blob: 5dce335fe5f11d1fe3533425544a5760263011ef [file] [log] [blame]
Damien Millera664e872000-04-16 11:52:47 +10001/*
Ben Lindstrom44697232001-07-04 03:32:30 +00002 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
Damien Millera664e872000-04-16 11:52:47 +10003 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
Damien Millera664e872000-04-16 11:52:47 +100012 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
Damien Miller9786e6e2005-07-26 21:54:56 +100026RCSID("$OpenBSD: kex.c,v 1.64 2005/07/25 11:59:39 markus Exp $");
Damien Millera664e872000-04-16 11:52:47 +100027
28#include <openssl/crypto.h>
Damien Millera664e872000-04-16 11:52:47 +100029
Ben Lindstrom226cfa02001-01-22 05:34:40 +000030#include "ssh2.h"
31#include "xmalloc.h"
32#include "buffer.h"
33#include "bufaux.h"
34#include "packet.h"
35#include "compat.h"
36#include "cipher.h"
Damien Millera664e872000-04-16 11:52:47 +100037#include "kex.h"
Damien Miller0bc1bd82000-11-13 22:57:25 +110038#include "key.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000039#include "log.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000040#include "mac.h"
Ben Lindstromb9be60a2001-03-11 01:49:19 +000041#include "match.h"
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000042#include "dispatch.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000043#include "monitor.h"
Damien Millera664e872000-04-16 11:52:47 +100044
Damien Millerb1715dc2000-05-30 13:44:51 +100045#define KEX_COOKIE_LEN 16
46
Ben Lindstrombba81212001-06-25 05:01:22 +000047/* prototype */
48static void kex_kexinit_finish(Kex *);
49static void kex_choose_conf(Kex *);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000050
51/* put algorithm proposal into buffer */
Ben Lindstrombba81212001-06-25 05:01:22 +000052static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000053kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
Damien Millera664e872000-04-16 11:52:47 +100054{
Damien Millereccb9de2005-06-17 12:59:34 +100055 u_int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000056
57 buffer_clear(b);
Ben Lindstrom59971722002-03-27 17:42:57 +000058 /*
59 * add a dummy cookie, the cookie will be overwritten by
60 * kex_send_kexinit(), each time a kexinit is set
61 */
62 for (i = 0; i < KEX_COOKIE_LEN; i++)
63 buffer_put_char(b, 0);
Damien Millera664e872000-04-16 11:52:47 +100064 for (i = 0; i < PROPOSAL_MAX; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000065 buffer_put_cstring(b, proposal[i]);
66 buffer_put_char(b, 0); /* first_kex_packet_follows */
67 buffer_put_int(b, 0); /* uint32 reserved */
Damien Millera664e872000-04-16 11:52:47 +100068}
69
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000070/* parse buffer and return algorithm proposal */
Ben Lindstrombba81212001-06-25 05:01:22 +000071static char **
Damien Millerbabb47a2003-02-24 11:53:32 +110072kex_buf2prop(Buffer *raw, int *first_kex_follows)
Damien Millerb1715dc2000-05-30 13:44:51 +100073{
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000074 Buffer b;
Damien Millerb1715dc2000-05-30 13:44:51 +100075 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000076 char **proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +100077
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000078 proposal = xmalloc(PROPOSAL_MAX * sizeof(char *));
Damien Millerb1715dc2000-05-30 13:44:51 +100079
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000080 buffer_init(&b);
81 buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
Damien Millerb1715dc2000-05-30 13:44:51 +100082 /* skip cookie */
83 for (i = 0; i < KEX_COOKIE_LEN; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000084 buffer_get_char(&b);
Damien Millerb1715dc2000-05-30 13:44:51 +100085 /* extract kex init proposal strings */
86 for (i = 0; i < PROPOSAL_MAX; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000087 proposal[i] = buffer_get_string(&b,NULL);
88 debug2("kex_parse_kexinit: %s", proposal[i]);
Damien Millerb1715dc2000-05-30 13:44:51 +100089 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000090 /* first kex follows / reserved */
91 i = buffer_get_char(&b);
Damien Millerbabb47a2003-02-24 11:53:32 +110092 if (first_kex_follows != NULL)
93 *first_kex_follows = i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000094 debug2("kex_parse_kexinit: first_kex_follows %d ", i);
95 i = buffer_get_int(&b);
96 debug2("kex_parse_kexinit: reserved %d ", i);
97 buffer_free(&b);
98 return proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +100099}
100
Ben Lindstrombba81212001-06-25 05:01:22 +0000101static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000102kex_prop_free(char **proposal)
Damien Millera664e872000-04-16 11:52:47 +1000103{
Damien Millereccb9de2005-06-17 12:59:34 +1000104 u_int i;
Damien Millera664e872000-04-16 11:52:47 +1000105
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000106 for (i = 0; i < PROPOSAL_MAX; i++)
107 xfree(proposal[i]);
108 xfree(proposal);
Damien Millera664e872000-04-16 11:52:47 +1000109}
110
Ben Lindstrombba81212001-06-25 05:01:22 +0000111static void
Damien Miller630d6f42002-01-22 23:17:30 +1100112kex_protocol_error(int type, u_int32_t seq, void *ctxt)
Damien Miller874d77b2000-10-14 16:23:11 +1100113{
Damien Miller630d6f42002-01-22 23:17:30 +1100114 error("Hm, kex protocol error: type %d seq %u", type, seq);
Damien Miller874d77b2000-10-14 16:23:11 +1100115}
116
Ben Lindstrombba81212001-06-25 05:01:22 +0000117static void
Damien Millerbc27d4e2002-02-13 13:54:06 +1100118kex_reset_dispatch(void)
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000119{
Damien Miller7d053392002-01-22 23:24:13 +1100120 dispatch_range(SSH2_MSG_TRANSPORT_MIN,
121 SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
Damien Millerbc27d4e2002-02-13 13:54:06 +1100122 dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000123}
124
125void
Ben Lindstrom238abf62001-04-04 17:52:53 +0000126kex_finish(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000127{
Damien Millerbc27d4e2002-02-13 13:54:06 +1100128 kex_reset_dispatch();
Ben Lindstrom238abf62001-04-04 17:52:53 +0000129
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000130 packet_start(SSH2_MSG_NEWKEYS);
131 packet_send();
132 /* packet_write_wait(); */
133 debug("SSH2_MSG_NEWKEYS sent");
Damien Millera664e872000-04-16 11:52:47 +1000134
Ben Lindstrom064496f2002-12-23 02:04:22 +0000135 debug("expecting SSH2_MSG_NEWKEYS");
Damien Millerdff50992002-01-22 23:16:32 +1100136 packet_read_expect(SSH2_MSG_NEWKEYS);
Ben Lindstrom14519082002-02-26 17:58:29 +0000137 packet_check_eom();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000138 debug("SSH2_MSG_NEWKEYS received");
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000139
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000140 kex->done = 1;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000141 buffer_clear(&kex->peer);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000142 /* buffer_clear(&kex->my); */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000143 kex->flags &= ~KEX_INIT_SENT;
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000144 xfree(kex->name);
145 kex->name = NULL;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000146}
Damien Millera664e872000-04-16 11:52:47 +1000147
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000148void
149kex_send_kexinit(Kex *kex)
150{
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000151 u_int32_t rnd = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000152 u_char *cookie;
Damien Millereccb9de2005-06-17 12:59:34 +1000153 u_int i;
Ben Lindstrom59971722002-03-27 17:42:57 +0000154
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000155 if (kex == NULL) {
156 error("kex_send_kexinit: no kex, cannot rekey");
157 return;
158 }
Ben Lindstrom238abf62001-04-04 17:52:53 +0000159 if (kex->flags & KEX_INIT_SENT) {
160 debug("KEX_INIT_SENT");
161 return;
162 }
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000163 kex->done = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000164
165 /* generate a random cookie */
166 if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
167 fatal("kex_send_kexinit: kex proposal too short");
168 cookie = buffer_ptr(&kex->my);
169 for (i = 0; i < KEX_COOKIE_LEN; i++) {
170 if (i % 4 == 0)
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000171 rnd = arc4random();
172 cookie[i] = rnd;
173 rnd >>= 8;
Ben Lindstrom59971722002-03-27 17:42:57 +0000174 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000175 packet_start(SSH2_MSG_KEXINIT);
176 packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
177 packet_send();
178 debug("SSH2_MSG_KEXINIT sent");
179 kex->flags |= KEX_INIT_SENT;
180}
181
182void
Damien Miller630d6f42002-01-22 23:17:30 +1100183kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000184{
185 char *ptr;
Damien Millereccb9de2005-06-17 12:59:34 +1000186 u_int i, dlen;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000187 Kex *kex = (Kex *)ctxt;
188
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000189 debug("SSH2_MSG_KEXINIT received");
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000190 if (kex == NULL)
191 fatal("kex_input_kexinit: no kex, cannot rekey");
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000192
193 ptr = packet_get_raw(&dlen);
194 buffer_append(&kex->peer, ptr, dlen);
195
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000196 /* discard packet */
197 for (i = 0; i < KEX_COOKIE_LEN; i++)
198 packet_get_char();
199 for (i = 0; i < PROPOSAL_MAX; i++)
200 xfree(packet_get_string(NULL));
Ben Lindstromc5a7f4f2002-06-25 23:19:13 +0000201 (void) packet_get_char();
202 (void) packet_get_int();
Damien Miller48b03fc2002-01-22 23:11:40 +1100203 packet_check_eom();
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000204
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000205 kex_kexinit_finish(kex);
206}
207
208Kex *
Ben Lindstrom238abf62001-04-04 17:52:53 +0000209kex_setup(char *proposal[PROPOSAL_MAX])
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000210{
211 Kex *kex;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000212
213 kex = xmalloc(sizeof(*kex));
214 memset(kex, 0, sizeof(*kex));
215 buffer_init(&kex->peer);
216 buffer_init(&kex->my);
217 kex_prop2buf(&kex->my, proposal);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000218 kex->done = 0;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000219
220 kex_send_kexinit(kex); /* we start */
Damien Millerbc27d4e2002-02-13 13:54:06 +1100221 kex_reset_dispatch();
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000222
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000223 return kex;
224}
225
Ben Lindstrombba81212001-06-25 05:01:22 +0000226static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000227kex_kexinit_finish(Kex *kex)
228{
229 if (!(kex->flags & KEX_INIT_SENT))
230 kex_send_kexinit(kex);
231
232 kex_choose_conf(kex);
233
Damien Miller8e7fb332003-02-24 12:03:03 +1100234 if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
235 kex->kex[kex->kex_type] != NULL) {
236 (kex->kex[kex->kex_type])(kex);
237 } else {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000238 fatal("Unsupported key exchange %d", kex->kex_type);
Damien Millera664e872000-04-16 11:52:47 +1000239 }
Damien Millera664e872000-04-16 11:52:47 +1000240}
241
Ben Lindstrombba81212001-06-25 05:01:22 +0000242static void
Damien Millera664e872000-04-16 11:52:47 +1000243choose_enc(Enc *enc, char *client, char *server)
244{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000245 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000246 if (name == NULL)
247 fatal("no matching cipher found: client %s server %s", client, server);
Damien Miller963f6b22002-02-19 15:21:23 +1100248 if ((enc->cipher = cipher_by_name(name)) == NULL)
Damien Miller874d77b2000-10-14 16:23:11 +1100249 fatal("matching cipher is not supported: %s", name);
Damien Millera664e872000-04-16 11:52:47 +1000250 enc->name = name;
251 enc->enabled = 0;
252 enc->iv = NULL;
253 enc->key = NULL;
Damien Miller963f6b22002-02-19 15:21:23 +1100254 enc->key_len = cipher_keylen(enc->cipher);
255 enc->block_size = cipher_blocksize(enc->cipher);
Damien Millera664e872000-04-16 11:52:47 +1000256}
Ben Lindstrombba81212001-06-25 05:01:22 +0000257static void
Damien Millera664e872000-04-16 11:52:47 +1000258choose_mac(Mac *mac, char *client, char *server)
259{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000260 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000261 if (name == NULL)
262 fatal("no matching mac found: client %s server %s", client, server);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000263 if (mac_init(mac, name) < 0)
Damien Millera664e872000-04-16 11:52:47 +1000264 fatal("unsupported mac %s", name);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000265 /* truncate the key */
266 if (datafellows & SSH_BUG_HMAC)
267 mac->key_len = 16;
Damien Millera664e872000-04-16 11:52:47 +1000268 mac->name = name;
Damien Millera664e872000-04-16 11:52:47 +1000269 mac->key = NULL;
270 mac->enabled = 0;
271}
Ben Lindstrombba81212001-06-25 05:01:22 +0000272static void
Damien Millera664e872000-04-16 11:52:47 +1000273choose_comp(Comp *comp, char *client, char *server)
274{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000275 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000276 if (name == NULL)
277 fatal("no matching comp found: client %s server %s", client, server);
Damien Miller9786e6e2005-07-26 21:54:56 +1000278 if (strcmp(name, "zlib@openssh.com") == 0) {
279 comp->type = COMP_DELAYED;
280 } else if (strcmp(name, "zlib") == 0) {
281 comp->type = COMP_ZLIB;
Damien Millera664e872000-04-16 11:52:47 +1000282 } else if (strcmp(name, "none") == 0) {
Damien Miller9786e6e2005-07-26 21:54:56 +1000283 comp->type = COMP_NONE;
Damien Millera664e872000-04-16 11:52:47 +1000284 } else {
285 fatal("unsupported comp %s", name);
286 }
287 comp->name = name;
288}
Ben Lindstrombba81212001-06-25 05:01:22 +0000289static void
Damien Millera664e872000-04-16 11:52:47 +1000290choose_kex(Kex *k, char *client, char *server)
291{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000292 k->name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000293 if (k->name == NULL)
294 fatal("no kex alg");
Damien Miller874d77b2000-10-14 16:23:11 +1100295 if (strcmp(k->name, KEX_DH1) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100296 k->kex_type = KEX_DH_GRP1_SHA1;
Damien Millerf675fc42004-06-15 10:30:09 +1000297 } else if (strcmp(k->name, KEX_DH14) == 0) {
298 k->kex_type = KEX_DH_GRP14_SHA1;
Damien Miller874d77b2000-10-14 16:23:11 +1100299 } else if (strcmp(k->name, KEX_DHGEX) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100300 k->kex_type = KEX_DH_GEX_SHA1;
Damien Miller874d77b2000-10-14 16:23:11 +1100301 } else
Damien Millera664e872000-04-16 11:52:47 +1000302 fatal("bad kex alg %s", k->name);
303}
Ben Lindstrombba81212001-06-25 05:01:22 +0000304static void
Damien Millera664e872000-04-16 11:52:47 +1000305choose_hostkeyalg(Kex *k, char *client, char *server)
306{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000307 char *hostkeyalg = match_list(client, server, NULL);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100308 if (hostkeyalg == NULL)
Damien Millera664e872000-04-16 11:52:47 +1000309 fatal("no hostkey alg");
Damien Miller0bc1bd82000-11-13 22:57:25 +1100310 k->hostkey_type = key_type_from_name(hostkeyalg);
311 if (k->hostkey_type == KEY_UNSPEC)
312 fatal("bad hostkey alg '%s'", hostkeyalg);
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000313 xfree(hostkeyalg);
Damien Millera664e872000-04-16 11:52:47 +1000314}
315
Damien Millera8e06ce2003-11-21 23:48:55 +1100316static int
Damien Millerbabb47a2003-02-24 11:53:32 +1100317proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
318{
319 static int check[] = {
320 PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
321 };
322 int *idx;
323 char *p;
324
325 for (idx = &check[0]; *idx != -1; idx++) {
326 if ((p = strchr(my[*idx], ',')) != NULL)
327 *p = '\0';
328 if ((p = strchr(peer[*idx], ',')) != NULL)
329 *p = '\0';
330 if (strcmp(my[*idx], peer[*idx]) != 0) {
331 debug2("proposal mismatch: my %s peer %s",
332 my[*idx], peer[*idx]);
333 return (0);
334 }
335 }
336 debug2("proposals match");
337 return (1);
338}
339
Ben Lindstrombba81212001-06-25 05:01:22 +0000340static void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000341kex_choose_conf(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000342{
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000343 Newkeys *newkeys;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000344 char **my, **peer;
345 char **cprop, **sprop;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000346 int nenc, nmac, ncomp;
Damien Millereccb9de2005-06-17 12:59:34 +1000347 u_int mode, ctos, need;
Damien Millerbabb47a2003-02-24 11:53:32 +1100348 int first_kex_follows, type;
Damien Millera664e872000-04-16 11:52:47 +1000349
Damien Millerbabb47a2003-02-24 11:53:32 +1100350 my = kex_buf2prop(&kex->my, NULL);
351 peer = kex_buf2prop(&kex->peer, &first_kex_follows);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000352
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000353 if (kex->server) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000354 cprop=peer;
355 sprop=my;
356 } else {
357 cprop=my;
358 sprop=peer;
359 }
Damien Millera664e872000-04-16 11:52:47 +1000360
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000361 /* Algorithm Negotiation */
Damien Millera664e872000-04-16 11:52:47 +1000362 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000363 newkeys = xmalloc(sizeof(*newkeys));
364 memset(newkeys, 0, sizeof(*newkeys));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000365 kex->newkeys[mode] = newkeys;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000366 ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
Damien Millera664e872000-04-16 11:52:47 +1000367 nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
368 nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
369 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000370 choose_enc (&newkeys->enc, cprop[nenc], sprop[nenc]);
371 choose_mac (&newkeys->mac, cprop[nmac], sprop[nmac]);
372 choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
Damien Millera664e872000-04-16 11:52:47 +1000373 debug("kex: %s %s %s %s",
374 ctos ? "client->server" : "server->client",
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000375 newkeys->enc.name,
376 newkeys->mac.name,
377 newkeys->comp.name);
Damien Millera664e872000-04-16 11:52:47 +1000378 }
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000379 choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
380 choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
Damien Millera664e872000-04-16 11:52:47 +1000381 sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
Damien Millera664e872000-04-16 11:52:47 +1000382 need = 0;
383 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000384 newkeys = kex->newkeys[mode];
Damien Miller963f6b22002-02-19 15:21:23 +1100385 if (need < newkeys->enc.key_len)
386 need = newkeys->enc.key_len;
387 if (need < newkeys->enc.block_size)
388 need = newkeys->enc.block_size;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000389 if (need < newkeys->mac.key_len)
390 need = newkeys->mac.key_len;
Damien Millera664e872000-04-16 11:52:47 +1000391 }
Damien Millerb1715dc2000-05-30 13:44:51 +1000392 /* XXX need runden? */
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000393 kex->we_need = need;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000394
Damien Millerbabb47a2003-02-24 11:53:32 +1100395 /* ignore the next message if the proposals do not match */
Damien Millera8e06ce2003-11-21 23:48:55 +1100396 if (first_kex_follows && !proposals_match(my, peer) &&
Damien Miller0dc1bef2005-07-17 17:22:45 +1000397 !(datafellows & SSH_BUG_FIRSTKEX)) {
Damien Millerbabb47a2003-02-24 11:53:32 +1100398 type = packet_read();
399 debug2("skipping next packet (type %u)", type);
400 }
401
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000402 kex_prop_free(my);
403 kex_prop_free(peer);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000404}
405
Ben Lindstrombba81212001-06-25 05:01:22 +0000406static u_char *
Damien Millereccb9de2005-06-17 12:59:34 +1000407derive_key(Kex *kex, int id, u_int need, u_char *hash, BIGNUM *shared_secret)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000408{
409 Buffer b;
Ben Lindstrom80cb27d2002-03-05 01:33:36 +0000410 const EVP_MD *evp_md = EVP_sha1();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000411 EVP_MD_CTX md;
412 char c = id;
Damien Millereccb9de2005-06-17 12:59:34 +1000413 u_int have;
Damien Miller3672e4b2002-02-05 11:54:07 +1100414 int mdsz = EVP_MD_size(evp_md);
Damien Millereccb9de2005-06-17 12:59:34 +1000415 u_char *digest;
Damien Miller46d38de2005-07-17 17:02:09 +1000416
Damien Millereccb9de2005-06-17 12:59:34 +1000417 if (mdsz < 0)
418 fatal("derive_key: mdsz < 0");
419 digest = xmalloc(roundup(need, mdsz));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000420
421 buffer_init(&b);
422 buffer_put_bignum2(&b, shared_secret);
423
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000424 /* K1 = HASH(K || H || "A" || session_id) */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000425 EVP_DigestInit(&md, evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000426 if (!(datafellows & SSH_BUG_DERIVEKEY))
427 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000428 EVP_DigestUpdate(&md, hash, mdsz);
429 EVP_DigestUpdate(&md, &c, 1);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000430 EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000431 EVP_DigestFinal(&md, digest, NULL);
432
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000433 /*
434 * expand key:
435 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
436 * Key = K1 || K2 || ... || Kn
437 */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000438 for (have = mdsz; need > have; have += mdsz) {
439 EVP_DigestInit(&md, evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000440 if (!(datafellows & SSH_BUG_DERIVEKEY))
441 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000442 EVP_DigestUpdate(&md, hash, mdsz);
443 EVP_DigestUpdate(&md, digest, have);
444 EVP_DigestFinal(&md, digest + have, NULL);
445 }
446 buffer_free(&b);
447#ifdef DEBUG_KEX
448 fprintf(stderr, "key '%c'== ", c);
449 dump_digest("key", digest, need);
450#endif
451 return digest;
Damien Millera664e872000-04-16 11:52:47 +1000452}
453
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000454Newkeys *current_keys[MODE_MAX];
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000455
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000456#define NKEYS 6
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000457void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000458kex_derive_keys(Kex *kex, u_char *hash, BIGNUM *shared_secret)
Damien Millera664e872000-04-16 11:52:47 +1000459{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000460 u_char *keys[NKEYS];
Damien Millereccb9de2005-06-17 12:59:34 +1000461 u_int i, mode, ctos;
Damien Millera664e872000-04-16 11:52:47 +1000462
463 for (i = 0; i < NKEYS; i++)
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000464 keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, shared_secret);
Damien Millera664e872000-04-16 11:52:47 +1000465
Ben Lindstrom064496f2002-12-23 02:04:22 +0000466 debug2("kex_derive_keys");
Damien Millera664e872000-04-16 11:52:47 +1000467 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000468 current_keys[mode] = kex->newkeys[mode];
469 kex->newkeys[mode] = NULL;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000470 ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000471 current_keys[mode]->enc.iv = keys[ctos ? 0 : 1];
472 current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
473 current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
Damien Millera664e872000-04-16 11:52:47 +1000474 }
Damien Millera664e872000-04-16 11:52:47 +1000475}
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000476
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000477Newkeys *
478kex_get_newkeys(int mode)
479{
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000480 Newkeys *ret;
481
482 ret = current_keys[mode];
483 current_keys[mode] = NULL;
484 return ret;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000485}
486
Darren Tuckere14e0052004-05-13 16:30:44 +1000487void
488derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
489 u_int8_t cookie[8], u_int8_t id[16])
490{
491 const EVP_MD *evp_md = EVP_md5();
492 EVP_MD_CTX md;
493 u_int8_t nbuf[2048], obuf[EVP_MAX_MD_SIZE];
494 int len;
495
496 EVP_DigestInit(&md, evp_md);
497
498 len = BN_num_bytes(host_modulus);
Damien Millereccb9de2005-06-17 12:59:34 +1000499 if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
Darren Tuckere14e0052004-05-13 16:30:44 +1000500 fatal("%s: bad host modulus (len %d)", __func__, len);
501 BN_bn2bin(host_modulus, nbuf);
502 EVP_DigestUpdate(&md, nbuf, len);
503
504 len = BN_num_bytes(server_modulus);
Damien Millereccb9de2005-06-17 12:59:34 +1000505 if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
Darren Tuckere14e0052004-05-13 16:30:44 +1000506 fatal("%s: bad server modulus (len %d)", __func__, len);
507 BN_bn2bin(server_modulus, nbuf);
508 EVP_DigestUpdate(&md, nbuf, len);
509
510 EVP_DigestUpdate(&md, cookie, 8);
511
Darren Tuckerb42714e2004-05-13 16:31:48 +1000512 EVP_DigestFinal(&md, obuf, NULL);
Darren Tuckere14e0052004-05-13 16:30:44 +1000513 memcpy(id, obuf, 16);
514
515 memset(nbuf, 0, sizeof(nbuf));
516 memset(obuf, 0, sizeof(obuf));
517 memset(&md, 0, sizeof(md));
518}
519
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000520#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
521void
522dump_digest(char *msg, u_char *digest, int len)
523{
Damien Millereccb9de2005-06-17 12:59:34 +1000524 u_int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000525
526 fprintf(stderr, "%s\n", msg);
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000527 for (i = 0; i< len; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000528 fprintf(stderr, "%02x", digest[i]);
529 if (i%32 == 31)
530 fprintf(stderr, "\n");
531 else if (i%8 == 7)
532 fprintf(stderr, " ");
533 }
534 fprintf(stderr, "\n");
535}
536#endif