1 /* $OpenBSD: kexgexs.c,v 1.31 2017/05/30 14:23:52 markus Exp $ */
3 * Copyright (c) 2000 Niels Provos. All rights reserved.
4 * Copyright (c) 2001 Markus Friedl. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37 #include <openssl/dh.h>
51 #include "monitor_wrap.h"
57 static int input_kex_dh_gex_request(int, u_int32_t
, struct ssh
*);
58 static int input_kex_dh_gex_init(int, u_int32_t
, struct ssh
*);
61 kexgex_server(struct ssh
*ssh
)
63 ssh_dispatch_set(ssh
, SSH2_MSG_KEX_DH_GEX_REQUEST
,
64 &input_kex_dh_gex_request
);
65 debug("expecting SSH2_MSG_KEX_DH_GEX_REQUEST");
70 input_kex_dh_gex_request(int type
, u_int32_t seq
, struct ssh
*ssh
)
72 struct kex
*kex
= ssh
->kex
;
74 u_int min
= 0, max
= 0, nbits
= 0;
76 debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
77 if ((r
= sshpkt_get_u32(ssh
, &min
)) != 0 ||
78 (r
= sshpkt_get_u32(ssh
, &nbits
)) != 0 ||
79 (r
= sshpkt_get_u32(ssh
, &max
)) != 0 ||
80 (r
= sshpkt_get_end(ssh
)) != 0)
85 min
= MAXIMUM(DH_GRP_MIN
, min
);
86 max
= MINIMUM(DH_GRP_MAX
, max
);
87 nbits
= MAXIMUM(DH_GRP_MIN
, nbits
);
88 nbits
= MINIMUM(DH_GRP_MAX
, nbits
);
90 if (kex
->max
< kex
->min
|| kex
->nbits
< kex
->min
||
91 kex
->max
< kex
->nbits
|| kex
->max
< DH_GRP_MIN
) {
92 r
= SSH_ERR_DH_GEX_OUT_OF_RANGE
;
96 /* Contact privileged parent */
97 kex
->dh
= PRIVSEP(choose_dh(min
, nbits
, max
));
98 if (kex
->dh
== NULL
) {
99 sshpkt_disconnect(ssh
, "no matching DH grp found");
100 r
= SSH_ERR_ALLOC_FAIL
;
103 debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");
104 if ((r
= sshpkt_start(ssh
, SSH2_MSG_KEX_DH_GEX_GROUP
)) != 0 ||
105 (r
= sshpkt_put_bignum2(ssh
, kex
->dh
->p
)) != 0 ||
106 (r
= sshpkt_put_bignum2(ssh
, kex
->dh
->g
)) != 0 ||
107 (r
= sshpkt_send(ssh
)) != 0)
110 /* Compute our exchange value in parallel with the client */
111 if ((r
= dh_gen_key(kex
->dh
, kex
->we_need
* 8)) != 0)
114 debug("expecting SSH2_MSG_KEX_DH_GEX_INIT");
115 ssh_dispatch_set(ssh
, SSH2_MSG_KEX_DH_GEX_INIT
, &input_kex_dh_gex_init
);
122 input_kex_dh_gex_init(int type
, u_int32_t seq
, struct ssh
*ssh
)
124 struct kex
*kex
= ssh
->kex
;
125 BIGNUM
*shared_secret
= NULL
, *dh_client_pub
= NULL
;
126 struct sshkey
*server_host_public
, *server_host_private
;
127 u_char
*kbuf
= NULL
, *signature
= NULL
, *server_host_key_blob
= NULL
;
128 u_char hash
[SSH_DIGEST_MAX_LENGTH
];
129 size_t sbloblen
, slen
;
130 size_t klen
= 0, hashlen
;
133 if (kex
->load_host_public_key
== NULL
||
134 kex
->load_host_private_key
== NULL
) {
135 r
= SSH_ERR_INVALID_ARGUMENT
;
138 server_host_public
= kex
->load_host_public_key(kex
->hostkey_type
,
139 kex
->hostkey_nid
, ssh
);
140 server_host_private
= kex
->load_host_private_key(kex
->hostkey_type
,
141 kex
->hostkey_nid
, ssh
);
142 if (server_host_public
== NULL
) {
143 r
= SSH_ERR_NO_HOSTKEY_LOADED
;
148 if ((dh_client_pub
= BN_new()) == NULL
) {
149 r
= SSH_ERR_ALLOC_FAIL
;
152 if ((r
= sshpkt_get_bignum2(ssh
, dh_client_pub
)) != 0 ||
153 (r
= sshpkt_get_end(ssh
)) != 0)
157 fprintf(stderr
, "dh_client_pub= ");
158 BN_print_fp(stderr
, dh_client_pub
);
159 fprintf(stderr
, "\n");
160 debug("bits %d", BN_num_bits(dh_client_pub
));
164 DHparams_print_fp(stderr
, kex
->dh
);
165 fprintf(stderr
, "pub= ");
166 BN_print_fp(stderr
, kex
->dh
->pub_key
);
167 fprintf(stderr
, "\n");
169 if (!dh_pub_is_valid(kex
->dh
, dh_client_pub
)) {
170 sshpkt_disconnect(ssh
, "bad client public DH value");
171 r
= SSH_ERR_MESSAGE_INCOMPLETE
;
175 klen
= DH_size(kex
->dh
);
176 if ((kbuf
= malloc(klen
)) == NULL
||
177 (shared_secret
= BN_new()) == NULL
) {
178 r
= SSH_ERR_ALLOC_FAIL
;
181 if ((kout
= DH_compute_key(kbuf
, dh_client_pub
, kex
->dh
)) < 0 ||
182 BN_bin2bn(kbuf
, kout
, shared_secret
) == NULL
) {
183 r
= SSH_ERR_LIBCRYPTO_ERROR
;
187 dump_digest("shared secret", kbuf
, kout
);
189 if ((r
= sshkey_to_blob(server_host_public
, &server_host_key_blob
,
193 hashlen
= sizeof(hash
);
194 if ((r
= kexgex_hash(
196 kex
->client_version_string
,
197 kex
->server_version_string
,
198 sshbuf_ptr(kex
->peer
), sshbuf_len(kex
->peer
),
199 sshbuf_ptr(kex
->my
), sshbuf_len(kex
->my
),
200 server_host_key_blob
, sbloblen
,
201 kex
->min
, kex
->nbits
, kex
->max
,
202 kex
->dh
->p
, kex
->dh
->g
,
206 hash
, &hashlen
)) != 0)
209 /* save session id := H */
210 if (kex
->session_id
== NULL
) {
211 kex
->session_id_len
= hashlen
;
212 kex
->session_id
= malloc(kex
->session_id_len
);
213 if (kex
->session_id
== NULL
) {
214 r
= SSH_ERR_ALLOC_FAIL
;
217 memcpy(kex
->session_id
, hash
, kex
->session_id_len
);
221 if ((r
= kex
->sign(server_host_private
, server_host_public
, &signature
,
222 &slen
, hash
, hashlen
, kex
->hostkey_alg
, ssh
->compat
)) < 0)
225 /* destroy_sensitive_data(); */
227 /* send server hostkey, DH pubkey 'f' and singed H */
228 if ((r
= sshpkt_start(ssh
, SSH2_MSG_KEX_DH_GEX_REPLY
)) != 0 ||
229 (r
= sshpkt_put_string(ssh
, server_host_key_blob
, sbloblen
)) != 0 ||
230 (r
= sshpkt_put_bignum2(ssh
, kex
->dh
->pub_key
)) != 0 || /* f */
231 (r
= sshpkt_put_string(ssh
, signature
, slen
)) != 0 ||
232 (r
= sshpkt_send(ssh
)) != 0)
235 if ((r
= kex_derive_keys_bn(ssh
, hash
, hashlen
, shared_secret
)) == 0)
236 r
= kex_send_newkeys(ssh
);
241 BN_clear_free(dh_client_pub
);
243 explicit_bzero(kbuf
, klen
);
247 BN_clear_free(shared_secret
);
248 free(server_host_key_blob
);
252 #endif /* WITH_OPENSSL */