blob: b070ccf42eb2fb66402d6d511c19ec5e14628b4f [file] [log] [blame]
Damien Millera664e872000-04-16 11:52:47 +10001/*
Ben Lindstrom44697232001-07-04 03:32:30 +00002 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
Damien Millera664e872000-04-16 11:52:47 +10003 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
Damien Millera664e872000-04-16 11:52:47 +100012 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
Damien Millerd3209042003-04-01 21:44:37 +100026RCSID("$OpenBSD: kex.c,v 1.55 2003/04/01 10:31:26 markus Exp $");
Damien Millera664e872000-04-16 11:52:47 +100027
28#include <openssl/crypto.h>
Damien Millera664e872000-04-16 11:52:47 +100029
Ben Lindstrom226cfa02001-01-22 05:34:40 +000030#include "ssh2.h"
31#include "xmalloc.h"
32#include "buffer.h"
33#include "bufaux.h"
34#include "packet.h"
35#include "compat.h"
36#include "cipher.h"
Damien Millera664e872000-04-16 11:52:47 +100037#include "kex.h"
Damien Miller0bc1bd82000-11-13 22:57:25 +110038#include "key.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000039#include "log.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000040#include "mac.h"
Ben Lindstromb9be60a2001-03-11 01:49:19 +000041#include "match.h"
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000042#include "dispatch.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000043#include "monitor.h"
Damien Millera664e872000-04-16 11:52:47 +100044
Damien Millerb1715dc2000-05-30 13:44:51 +100045#define KEX_COOKIE_LEN 16
46
Ben Lindstrombba81212001-06-25 05:01:22 +000047/* prototype */
48static void kex_kexinit_finish(Kex *);
49static void kex_choose_conf(Kex *);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000050
51/* put algorithm proposal into buffer */
Ben Lindstrombba81212001-06-25 05:01:22 +000052static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000053kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
Damien Millera664e872000-04-16 11:52:47 +100054{
Damien Millera664e872000-04-16 11:52:47 +100055 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000056
57 buffer_clear(b);
Ben Lindstrom59971722002-03-27 17:42:57 +000058 /*
59 * add a dummy cookie, the cookie will be overwritten by
60 * kex_send_kexinit(), each time a kexinit is set
61 */
62 for (i = 0; i < KEX_COOKIE_LEN; i++)
63 buffer_put_char(b, 0);
Damien Millera664e872000-04-16 11:52:47 +100064 for (i = 0; i < PROPOSAL_MAX; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000065 buffer_put_cstring(b, proposal[i]);
66 buffer_put_char(b, 0); /* first_kex_packet_follows */
67 buffer_put_int(b, 0); /* uint32 reserved */
Damien Millera664e872000-04-16 11:52:47 +100068}
69
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000070/* parse buffer and return algorithm proposal */
Ben Lindstrombba81212001-06-25 05:01:22 +000071static char **
Damien Millerbabb47a2003-02-24 11:53:32 +110072kex_buf2prop(Buffer *raw, int *first_kex_follows)
Damien Millerb1715dc2000-05-30 13:44:51 +100073{
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000074 Buffer b;
Damien Millerb1715dc2000-05-30 13:44:51 +100075 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000076 char **proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +100077
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000078 proposal = xmalloc(PROPOSAL_MAX * sizeof(char *));
Damien Millerb1715dc2000-05-30 13:44:51 +100079
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000080 buffer_init(&b);
81 buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
Damien Millerb1715dc2000-05-30 13:44:51 +100082 /* skip cookie */
83 for (i = 0; i < KEX_COOKIE_LEN; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000084 buffer_get_char(&b);
Damien Millerb1715dc2000-05-30 13:44:51 +100085 /* extract kex init proposal strings */
86 for (i = 0; i < PROPOSAL_MAX; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000087 proposal[i] = buffer_get_string(&b,NULL);
88 debug2("kex_parse_kexinit: %s", proposal[i]);
Damien Millerb1715dc2000-05-30 13:44:51 +100089 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000090 /* first kex follows / reserved */
91 i = buffer_get_char(&b);
Damien Millerbabb47a2003-02-24 11:53:32 +110092 if (first_kex_follows != NULL)
93 *first_kex_follows = i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000094 debug2("kex_parse_kexinit: first_kex_follows %d ", i);
95 i = buffer_get_int(&b);
96 debug2("kex_parse_kexinit: reserved %d ", i);
97 buffer_free(&b);
98 return proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +100099}
100
Ben Lindstrombba81212001-06-25 05:01:22 +0000101static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000102kex_prop_free(char **proposal)
Damien Millera664e872000-04-16 11:52:47 +1000103{
104 int i;
Damien Millera664e872000-04-16 11:52:47 +1000105
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000106 for (i = 0; i < PROPOSAL_MAX; i++)
107 xfree(proposal[i]);
108 xfree(proposal);
Damien Millera664e872000-04-16 11:52:47 +1000109}
110
Ben Lindstrombba81212001-06-25 05:01:22 +0000111static void
Damien Miller630d6f42002-01-22 23:17:30 +1100112kex_protocol_error(int type, u_int32_t seq, void *ctxt)
Damien Miller874d77b2000-10-14 16:23:11 +1100113{
Damien Miller630d6f42002-01-22 23:17:30 +1100114 error("Hm, kex protocol error: type %d seq %u", type, seq);
Damien Miller874d77b2000-10-14 16:23:11 +1100115}
116
Ben Lindstrombba81212001-06-25 05:01:22 +0000117static void
Damien Millerbc27d4e2002-02-13 13:54:06 +1100118kex_reset_dispatch(void)
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000119{
Damien Miller7d053392002-01-22 23:24:13 +1100120 dispatch_range(SSH2_MSG_TRANSPORT_MIN,
121 SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
Damien Millerbc27d4e2002-02-13 13:54:06 +1100122 dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000123}
124
125void
Ben Lindstrom238abf62001-04-04 17:52:53 +0000126kex_finish(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000127{
Damien Millerbc27d4e2002-02-13 13:54:06 +1100128 kex_reset_dispatch();
Ben Lindstrom238abf62001-04-04 17:52:53 +0000129
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000130 packet_start(SSH2_MSG_NEWKEYS);
131 packet_send();
132 /* packet_write_wait(); */
133 debug("SSH2_MSG_NEWKEYS sent");
Damien Millera664e872000-04-16 11:52:47 +1000134
Ben Lindstrom064496f2002-12-23 02:04:22 +0000135 debug("expecting SSH2_MSG_NEWKEYS");
Damien Millerdff50992002-01-22 23:16:32 +1100136 packet_read_expect(SSH2_MSG_NEWKEYS);
Ben Lindstrom14519082002-02-26 17:58:29 +0000137 packet_check_eom();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000138 debug("SSH2_MSG_NEWKEYS received");
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000139
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000140 kex->done = 1;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000141 buffer_clear(&kex->peer);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000142 /* buffer_clear(&kex->my); */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000143 kex->flags &= ~KEX_INIT_SENT;
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000144 xfree(kex->name);
145 kex->name = NULL;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000146}
Damien Millera664e872000-04-16 11:52:47 +1000147
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000148void
149kex_send_kexinit(Kex *kex)
150{
Ben Lindstrom59971722002-03-27 17:42:57 +0000151 u_int32_t rand = 0;
152 u_char *cookie;
153 int i;
154
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000155 if (kex == NULL) {
156 error("kex_send_kexinit: no kex, cannot rekey");
157 return;
158 }
Ben Lindstrom238abf62001-04-04 17:52:53 +0000159 if (kex->flags & KEX_INIT_SENT) {
160 debug("KEX_INIT_SENT");
161 return;
162 }
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000163 kex->done = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000164
165 /* generate a random cookie */
166 if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
167 fatal("kex_send_kexinit: kex proposal too short");
168 cookie = buffer_ptr(&kex->my);
169 for (i = 0; i < KEX_COOKIE_LEN; i++) {
170 if (i % 4 == 0)
171 rand = arc4random();
172 cookie[i] = rand;
173 rand >>= 8;
174 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000175 packet_start(SSH2_MSG_KEXINIT);
176 packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
177 packet_send();
178 debug("SSH2_MSG_KEXINIT sent");
179 kex->flags |= KEX_INIT_SENT;
180}
181
182void
Damien Miller630d6f42002-01-22 23:17:30 +1100183kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000184{
185 char *ptr;
186 int dlen;
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000187 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000188 Kex *kex = (Kex *)ctxt;
189
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000190 debug("SSH2_MSG_KEXINIT received");
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000191 if (kex == NULL)
192 fatal("kex_input_kexinit: no kex, cannot rekey");
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000193
194 ptr = packet_get_raw(&dlen);
195 buffer_append(&kex->peer, ptr, dlen);
196
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000197 /* discard packet */
198 for (i = 0; i < KEX_COOKIE_LEN; i++)
199 packet_get_char();
200 for (i = 0; i < PROPOSAL_MAX; i++)
201 xfree(packet_get_string(NULL));
Ben Lindstromc5a7f4f2002-06-25 23:19:13 +0000202 (void) packet_get_char();
203 (void) packet_get_int();
Damien Miller48b03fc2002-01-22 23:11:40 +1100204 packet_check_eom();
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000205
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000206 kex_kexinit_finish(kex);
207}
208
209Kex *
Ben Lindstrom238abf62001-04-04 17:52:53 +0000210kex_setup(char *proposal[PROPOSAL_MAX])
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000211{
212 Kex *kex;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000213
214 kex = xmalloc(sizeof(*kex));
215 memset(kex, 0, sizeof(*kex));
216 buffer_init(&kex->peer);
217 buffer_init(&kex->my);
218 kex_prop2buf(&kex->my, proposal);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000219 kex->done = 0;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000220
221 kex_send_kexinit(kex); /* we start */
Damien Millerbc27d4e2002-02-13 13:54:06 +1100222 kex_reset_dispatch();
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000223
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000224 return kex;
225}
226
Ben Lindstrombba81212001-06-25 05:01:22 +0000227static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000228kex_kexinit_finish(Kex *kex)
229{
230 if (!(kex->flags & KEX_INIT_SENT))
231 kex_send_kexinit(kex);
232
233 kex_choose_conf(kex);
234
Damien Miller8e7fb332003-02-24 12:03:03 +1100235 if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
236 kex->kex[kex->kex_type] != NULL) {
237 (kex->kex[kex->kex_type])(kex);
238 } else {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000239 fatal("Unsupported key exchange %d", kex->kex_type);
Damien Millera664e872000-04-16 11:52:47 +1000240 }
Damien Millera664e872000-04-16 11:52:47 +1000241}
242
Ben Lindstrombba81212001-06-25 05:01:22 +0000243static void
Damien Millera664e872000-04-16 11:52:47 +1000244choose_enc(Enc *enc, char *client, char *server)
245{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000246 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000247 if (name == NULL)
248 fatal("no matching cipher found: client %s server %s", client, server);
Damien Miller963f6b22002-02-19 15:21:23 +1100249 if ((enc->cipher = cipher_by_name(name)) == NULL)
Damien Miller874d77b2000-10-14 16:23:11 +1100250 fatal("matching cipher is not supported: %s", name);
Damien Millera664e872000-04-16 11:52:47 +1000251 enc->name = name;
252 enc->enabled = 0;
253 enc->iv = NULL;
254 enc->key = NULL;
Damien Miller963f6b22002-02-19 15:21:23 +1100255 enc->key_len = cipher_keylen(enc->cipher);
256 enc->block_size = cipher_blocksize(enc->cipher);
Damien Millera664e872000-04-16 11:52:47 +1000257}
Ben Lindstrombba81212001-06-25 05:01:22 +0000258static void
Damien Millera664e872000-04-16 11:52:47 +1000259choose_mac(Mac *mac, char *client, char *server)
260{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000261 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000262 if (name == NULL)
263 fatal("no matching mac found: client %s server %s", client, server);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000264 if (mac_init(mac, name) < 0)
Damien Millera664e872000-04-16 11:52:47 +1000265 fatal("unsupported mac %s", name);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000266 /* truncate the key */
267 if (datafellows & SSH_BUG_HMAC)
268 mac->key_len = 16;
Damien Millera664e872000-04-16 11:52:47 +1000269 mac->name = name;
Damien Millera664e872000-04-16 11:52:47 +1000270 mac->key = NULL;
271 mac->enabled = 0;
272}
Ben Lindstrombba81212001-06-25 05:01:22 +0000273static void
Damien Millera664e872000-04-16 11:52:47 +1000274choose_comp(Comp *comp, char *client, char *server)
275{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000276 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000277 if (name == NULL)
278 fatal("no matching comp found: client %s server %s", client, server);
279 if (strcmp(name, "zlib") == 0) {
280 comp->type = 1;
281 } else if (strcmp(name, "none") == 0) {
282 comp->type = 0;
283 } else {
284 fatal("unsupported comp %s", name);
285 }
286 comp->name = name;
287}
Ben Lindstrombba81212001-06-25 05:01:22 +0000288static void
Damien Millera664e872000-04-16 11:52:47 +1000289choose_kex(Kex *k, char *client, char *server)
290{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000291 k->name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000292 if (k->name == NULL)
293 fatal("no kex alg");
Damien Miller874d77b2000-10-14 16:23:11 +1100294 if (strcmp(k->name, KEX_DH1) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100295 k->kex_type = KEX_DH_GRP1_SHA1;
Damien Miller874d77b2000-10-14 16:23:11 +1100296 } else if (strcmp(k->name, KEX_DHGEX) == 0) {
Damien Miller8e7fb332003-02-24 12:03:03 +1100297 k->kex_type = KEX_DH_GEX_SHA1;
Damien Miller874d77b2000-10-14 16:23:11 +1100298 } else
Damien Millera664e872000-04-16 11:52:47 +1000299 fatal("bad kex alg %s", k->name);
300}
Ben Lindstrombba81212001-06-25 05:01:22 +0000301static void
Damien Millera664e872000-04-16 11:52:47 +1000302choose_hostkeyalg(Kex *k, char *client, char *server)
303{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000304 char *hostkeyalg = match_list(client, server, NULL);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100305 if (hostkeyalg == NULL)
Damien Millera664e872000-04-16 11:52:47 +1000306 fatal("no hostkey alg");
Damien Miller0bc1bd82000-11-13 22:57:25 +1100307 k->hostkey_type = key_type_from_name(hostkeyalg);
308 if (k->hostkey_type == KEY_UNSPEC)
309 fatal("bad hostkey alg '%s'", hostkeyalg);
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000310 xfree(hostkeyalg);
Damien Millera664e872000-04-16 11:52:47 +1000311}
312
Damien Millerbabb47a2003-02-24 11:53:32 +1100313static int
314proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
315{
316 static int check[] = {
317 PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
318 };
319 int *idx;
320 char *p;
321
322 for (idx = &check[0]; *idx != -1; idx++) {
323 if ((p = strchr(my[*idx], ',')) != NULL)
324 *p = '\0';
325 if ((p = strchr(peer[*idx], ',')) != NULL)
326 *p = '\0';
327 if (strcmp(my[*idx], peer[*idx]) != 0) {
328 debug2("proposal mismatch: my %s peer %s",
329 my[*idx], peer[*idx]);
330 return (0);
331 }
332 }
333 debug2("proposals match");
334 return (1);
335}
336
Ben Lindstrombba81212001-06-25 05:01:22 +0000337static void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000338kex_choose_conf(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000339{
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000340 Newkeys *newkeys;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000341 char **my, **peer;
342 char **cprop, **sprop;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000343 int nenc, nmac, ncomp;
Damien Millera664e872000-04-16 11:52:47 +1000344 int mode;
345 int ctos; /* direction: if true client-to-server */
346 int need;
Damien Millerbabb47a2003-02-24 11:53:32 +1100347 int first_kex_follows, type;
Damien Millera664e872000-04-16 11:52:47 +1000348
Damien Millerbabb47a2003-02-24 11:53:32 +1100349 my = kex_buf2prop(&kex->my, NULL);
350 peer = kex_buf2prop(&kex->peer, &first_kex_follows);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000351
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000352 if (kex->server) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000353 cprop=peer;
354 sprop=my;
355 } else {
356 cprop=my;
357 sprop=peer;
358 }
Damien Millera664e872000-04-16 11:52:47 +1000359
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000360 /* Algorithm Negotiation */
Damien Millera664e872000-04-16 11:52:47 +1000361 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000362 newkeys = xmalloc(sizeof(*newkeys));
363 memset(newkeys, 0, sizeof(*newkeys));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000364 kex->newkeys[mode] = newkeys;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000365 ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
Damien Millera664e872000-04-16 11:52:47 +1000366 nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
367 nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
368 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000369 choose_enc (&newkeys->enc, cprop[nenc], sprop[nenc]);
370 choose_mac (&newkeys->mac, cprop[nmac], sprop[nmac]);
371 choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
Damien Millera664e872000-04-16 11:52:47 +1000372 debug("kex: %s %s %s %s",
373 ctos ? "client->server" : "server->client",
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000374 newkeys->enc.name,
375 newkeys->mac.name,
376 newkeys->comp.name);
Damien Millera664e872000-04-16 11:52:47 +1000377 }
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000378 choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
379 choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
Damien Millera664e872000-04-16 11:52:47 +1000380 sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
Damien Millera664e872000-04-16 11:52:47 +1000381 need = 0;
382 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000383 newkeys = kex->newkeys[mode];
Damien Miller963f6b22002-02-19 15:21:23 +1100384 if (need < newkeys->enc.key_len)
385 need = newkeys->enc.key_len;
386 if (need < newkeys->enc.block_size)
387 need = newkeys->enc.block_size;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000388 if (need < newkeys->mac.key_len)
389 need = newkeys->mac.key_len;
Damien Millera664e872000-04-16 11:52:47 +1000390 }
Damien Millerb1715dc2000-05-30 13:44:51 +1000391 /* XXX need runden? */
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000392 kex->we_need = need;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000393
Damien Millerbabb47a2003-02-24 11:53:32 +1100394 /* ignore the next message if the proposals do not match */
Damien Millerd3209042003-04-01 21:44:37 +1000395 if (first_kex_follows && !proposals_match(my, peer) &&
396 !(datafellows & SSH_BUG_FIRSTKEX)) {
Damien Millerbabb47a2003-02-24 11:53:32 +1100397 type = packet_read();
398 debug2("skipping next packet (type %u)", type);
399 }
400
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000401 kex_prop_free(my);
402 kex_prop_free(peer);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000403}
404
Ben Lindstrombba81212001-06-25 05:01:22 +0000405static u_char *
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000406derive_key(Kex *kex, int id, int need, u_char *hash, BIGNUM *shared_secret)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000407{
408 Buffer b;
Ben Lindstrom80cb27d2002-03-05 01:33:36 +0000409 const EVP_MD *evp_md = EVP_sha1();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000410 EVP_MD_CTX md;
411 char c = id;
412 int have;
Damien Miller3672e4b2002-02-05 11:54:07 +1100413 int mdsz = EVP_MD_size(evp_md);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000414 u_char *digest = xmalloc(roundup(need, mdsz));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000415
416 buffer_init(&b);
417 buffer_put_bignum2(&b, shared_secret);
418
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000419 /* K1 = HASH(K || H || "A" || session_id) */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000420 EVP_DigestInit(&md, evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000421 if (!(datafellows & SSH_BUG_DERIVEKEY))
422 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000423 EVP_DigestUpdate(&md, hash, mdsz);
424 EVP_DigestUpdate(&md, &c, 1);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000425 EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000426 EVP_DigestFinal(&md, digest, NULL);
427
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000428 /*
429 * expand key:
430 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
431 * Key = K1 || K2 || ... || Kn
432 */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000433 for (have = mdsz; need > have; have += mdsz) {
434 EVP_DigestInit(&md, evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000435 if (!(datafellows & SSH_BUG_DERIVEKEY))
436 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000437 EVP_DigestUpdate(&md, hash, mdsz);
438 EVP_DigestUpdate(&md, digest, have);
439 EVP_DigestFinal(&md, digest + have, NULL);
440 }
441 buffer_free(&b);
442#ifdef DEBUG_KEX
443 fprintf(stderr, "key '%c'== ", c);
444 dump_digest("key", digest, need);
445#endif
446 return digest;
Damien Millera664e872000-04-16 11:52:47 +1000447}
448
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000449Newkeys *current_keys[MODE_MAX];
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000450
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000451#define NKEYS 6
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000452void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000453kex_derive_keys(Kex *kex, u_char *hash, BIGNUM *shared_secret)
Damien Millera664e872000-04-16 11:52:47 +1000454{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000455 u_char *keys[NKEYS];
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000456 int i, mode, ctos;
Damien Millera664e872000-04-16 11:52:47 +1000457
458 for (i = 0; i < NKEYS; i++)
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000459 keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, shared_secret);
Damien Millera664e872000-04-16 11:52:47 +1000460
Ben Lindstrom064496f2002-12-23 02:04:22 +0000461 debug2("kex_derive_keys");
Damien Millera664e872000-04-16 11:52:47 +1000462 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000463 current_keys[mode] = kex->newkeys[mode];
464 kex->newkeys[mode] = NULL;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000465 ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000466 current_keys[mode]->enc.iv = keys[ctos ? 0 : 1];
467 current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
468 current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
Damien Millera664e872000-04-16 11:52:47 +1000469 }
Damien Millera664e872000-04-16 11:52:47 +1000470}
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000471
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000472Newkeys *
473kex_get_newkeys(int mode)
474{
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000475 Newkeys *ret;
476
477 ret = current_keys[mode];
478 current_keys[mode] = NULL;
479 return ret;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000480}
481
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000482#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
483void
484dump_digest(char *msg, u_char *digest, int len)
485{
486 int i;
487
488 fprintf(stderr, "%s\n", msg);
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000489 for (i = 0; i< len; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000490 fprintf(stderr, "%02x", digest[i]);
491 if (i%32 == 31)
492 fprintf(stderr, "\n");
493 else if (i%8 == 7)
494 fprintf(stderr, " ");
495 }
496 fprintf(stderr, "\n");
497}
498#endif