blob: 5dfca0a240f9f237016560a3f03ae0be6aa48924 [file] [log] [blame]
djm@openbsd.org001aa552018-04-10 00:10:49 +00001/* $OpenBSD: kexdhs.c,v 1.27 2018/04/10 00:10:49 djm Exp $ */
Damien Miller8e7fb332003-02-24 12:03:03 +11002/*
3 * Copyright (c) 2001 Markus Friedl. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "includes.h"
Damien Miller8e7fb332003-02-24 12:03:03 +110027
Damien Miller72ef7c12015-01-15 02:21:31 +110028#ifdef WITH_OPENSSL
29
Damien Millerd7834352006-08-05 12:39:39 +100030#include <sys/types.h>
Damien Millerded319c2006-09-01 15:38:36 +100031
32#include <stdarg.h>
Damien Millere3476ed2006-07-24 14:13:33 +100033#include <string.h>
Damien Millerd7834352006-08-05 12:39:39 +100034#include <signal.h>
Damien Millere3476ed2006-07-24 14:13:33 +100035
Damien Miller4499f4c2010-11-20 15:15:49 +110036#include <openssl/dh.h>
37
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000038#include "sshkey.h"
Damien Millerd7834352006-08-05 12:39:39 +100039#include "cipher.h"
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000040#include "digest.h"
Damien Miller8e7fb332003-02-24 12:03:03 +110041#include "kex.h"
42#include "log.h"
43#include "packet.h"
44#include "dh.h"
45#include "ssh2.h"
Damien Miller8e7fb332003-02-24 12:03:03 +110046
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000047#include "dispatch.h"
48#include "compat.h"
49#include "ssherr.h"
50#include "sshbuf.h"
51
markus@openbsd.org2ae666a2017-05-30 14:23:52 +000052static int input_kex_dh_init(int, u_int32_t, struct ssh *);
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000053
54int
55kexdh_server(struct ssh *ssh)
Damien Miller8e7fb332003-02-24 12:03:03 +110056{
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000057 struct kex *kex = ssh->kex;
58 int r;
Damien Miller8e7fb332003-02-24 12:03:03 +110059
60 /* generate server DH public key */
Damien Millerf675fc42004-06-15 10:30:09 +100061 switch (kex->kex_type) {
62 case KEX_DH_GRP1_SHA1:
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000063 kex->dh = dh_new_group1();
Damien Millerf675fc42004-06-15 10:30:09 +100064 break;
65 case KEX_DH_GRP14_SHA1:
djm@openbsd.org0e8eeec2016-05-02 10:26:04 +000066 case KEX_DH_GRP14_SHA256:
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000067 kex->dh = dh_new_group14();
Damien Millerf675fc42004-06-15 10:30:09 +100068 break;
djm@openbsd.org0e8eeec2016-05-02 10:26:04 +000069 case KEX_DH_GRP16_SHA512:
70 kex->dh = dh_new_group16();
71 break;
72 case KEX_DH_GRP18_SHA512:
73 kex->dh = dh_new_group18();
74 break;
Damien Millerf675fc42004-06-15 10:30:09 +100075 default:
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000076 r = SSH_ERR_INVALID_ARGUMENT;
77 goto out;
Damien Millerf675fc42004-06-15 10:30:09 +100078 }
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000079 if (kex->dh == NULL) {
80 r = SSH_ERR_ALLOC_FAIL;
81 goto out;
82 }
83 if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
84 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +110085
86 debug("expecting SSH2_MSG_KEXDH_INIT");
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000087 ssh_dispatch_set(ssh, SSH2_MSG_KEXDH_INIT, &input_kex_dh_init);
88 r = 0;
89 out:
90 return r;
91}
92
93int
markus@openbsd.org2ae666a2017-05-30 14:23:52 +000094input_kex_dh_init(int type, u_int32_t seq, struct ssh *ssh)
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000095{
markus@openbsd.org57d10cb2015-01-19 20:16:15 +000096 struct kex *kex = ssh->kex;
97 BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
98 struct sshkey *server_host_public, *server_host_private;
99 u_char *kbuf = NULL, *signature = NULL, *server_host_key_blob = NULL;
100 u_char hash[SSH_DIGEST_MAX_LENGTH];
101 size_t sbloblen, slen;
102 size_t klen = 0, hashlen;
103 int kout, r;
Damien Miller8e7fb332003-02-24 12:03:03 +1100104
Damien Miller0a80ca12010-02-27 07:55:05 +1100105 if (kex->load_host_public_key == NULL ||
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000106 kex->load_host_private_key == NULL) {
107 r = SSH_ERR_INVALID_ARGUMENT;
108 goto out;
109 }
djm@openbsd.org5104db72015-01-26 06:10:03 +0000110 server_host_public = kex->load_host_public_key(kex->hostkey_type,
111 kex->hostkey_nid, ssh);
112 server_host_private = kex->load_host_private_key(kex->hostkey_type,
113 kex->hostkey_nid, ssh);
djm@openbsd.orge2cc6be2015-01-20 07:55:33 +0000114 if (server_host_public == NULL) {
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000115 r = SSH_ERR_NO_HOSTKEY_LOADED;
116 goto out;
117 }
Damien Miller8e7fb332003-02-24 12:03:03 +1100118
119 /* key, cert */
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000120 if ((dh_client_pub = BN_new()) == NULL) {
121 r = SSH_ERR_ALLOC_FAIL;
122 goto out;
123 }
124 if ((r = sshpkt_get_bignum2(ssh, dh_client_pub)) != 0 ||
125 (r = sshpkt_get_end(ssh)) != 0)
126 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +1100127
128#ifdef DEBUG_KEXDH
129 fprintf(stderr, "dh_client_pub= ");
130 BN_print_fp(stderr, dh_client_pub);
131 fprintf(stderr, "\n");
132 debug("bits %d", BN_num_bits(dh_client_pub));
133#endif
134
135#ifdef DEBUG_KEXDH
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000136 DHparams_print_fp(stderr, kex->dh);
Damien Miller8e7fb332003-02-24 12:03:03 +1100137 fprintf(stderr, "pub= ");
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000138 BN_print_fp(stderr, kex->dh->pub_key);
Damien Miller8e7fb332003-02-24 12:03:03 +1100139 fprintf(stderr, "\n");
140#endif
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000141 if (!dh_pub_is_valid(kex->dh, dh_client_pub)) {
142 sshpkt_disconnect(ssh, "bad client public DH value");
143 r = SSH_ERR_MESSAGE_INCOMPLETE;
144 goto out;
145 }
Damien Miller8e7fb332003-02-24 12:03:03 +1100146
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000147 klen = DH_size(kex->dh);
148 if ((kbuf = malloc(klen)) == NULL ||
149 (shared_secret = BN_new()) == NULL) {
150 r = SSH_ERR_ALLOC_FAIL;
151 goto out;
152 }
153 if ((kout = DH_compute_key(kbuf, dh_client_pub, kex->dh)) < 0 ||
154 BN_bin2bn(kbuf, kout, shared_secret) == NULL) {
155 r = SSH_ERR_LIBCRYPTO_ERROR;
156 goto out;
157 }
Damien Miller8e7fb332003-02-24 12:03:03 +1100158#ifdef DEBUG_KEXDH
159 dump_digest("shared secret", kbuf, kout);
160#endif
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000161 if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob,
162 &sbloblen)) != 0)
163 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +1100164 /* calc H */
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000165 hashlen = sizeof(hash);
166 if ((r = kex_dh_hash(
djm@openbsd.org0e8eeec2016-05-02 10:26:04 +0000167 kex->hash_alg,
Damien Miller8e7fb332003-02-24 12:03:03 +1100168 kex->client_version_string,
169 kex->server_version_string,
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000170 sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
171 sshbuf_ptr(kex->my), sshbuf_len(kex->my),
Damien Miller8e7fb332003-02-24 12:03:03 +1100172 server_host_key_blob, sbloblen,
173 dh_client_pub,
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000174 kex->dh->pub_key,
Damien Miller19bb3a52005-11-05 15:19:35 +1100175 shared_secret,
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000176 hash, &hashlen)) != 0)
177 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +1100178
179 /* save session id := H */
Damien Miller8e7fb332003-02-24 12:03:03 +1100180 if (kex->session_id == NULL) {
Damien Miller19bb3a52005-11-05 15:19:35 +1100181 kex->session_id_len = hashlen;
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000182 kex->session_id = malloc(kex->session_id_len);
183 if (kex->session_id == NULL) {
184 r = SSH_ERR_ALLOC_FAIL;
185 goto out;
186 }
Damien Miller8e7fb332003-02-24 12:03:03 +1100187 memcpy(kex->session_id, hash, kex->session_id_len);
188 }
189
190 /* sign H */
markus@openbsd.org76c9fbb2015-12-04 16:41:28 +0000191 if ((r = kex->sign(server_host_private, server_host_public, &signature,
192 &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000193 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +1100194
195 /* destroy_sensitive_data(); */
196
djm@openbsd.org001aa552018-04-10 00:10:49 +0000197 /* send server hostkey, DH pubkey 'f' and signed H */
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000198 if ((r = sshpkt_start(ssh, SSH2_MSG_KEXDH_REPLY)) != 0 ||
199 (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
200 (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 || /* f */
201 (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
202 (r = sshpkt_send(ssh)) != 0)
203 goto out;
Damien Miller8e7fb332003-02-24 12:03:03 +1100204
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000205 if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
206 r = kex_send_newkeys(ssh);
207 out:
208 explicit_bzero(hash, sizeof(hash));
209 DH_free(kex->dh);
210 kex->dh = NULL;
jsing@openbsd.org7cd31632018-02-07 02:06:50 +0000211 BN_clear_free(dh_client_pub);
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000212 if (kbuf) {
213 explicit_bzero(kbuf, klen);
214 free(kbuf);
215 }
jsing@openbsd.org7cd31632018-02-07 02:06:50 +0000216 BN_clear_free(shared_secret);
Darren Tuckera627d422013-06-02 07:31:17 +1000217 free(server_host_key_blob);
markus@openbsd.org57d10cb2015-01-19 20:16:15 +0000218 free(signature);
219 return r;
Damien Miller8e7fb332003-02-24 12:03:03 +1100220}
Damien Miller72ef7c12015-01-15 02:21:31 +1100221#endif /* WITH_OPENSSL */