1 /* $OpenBSD: kexgexs.c,v 1.29 2016/06/08 02:13:01 dtucker Exp $ */
3 * Copyright (c) 2000 Niels Provos. All rights reserved.
4 * Copyright (c) 2001 Markus Friedl. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 #include <sys/param.h> /* MIN MAX */
38 #include <openssl/dh.h>
52 #include "monitor_wrap.h"
57 static int input_kex_dh_gex_request(int, u_int32_t
, void *);
58 static int input_kex_dh_gex_init(int, u_int32_t
, void *);
61 kexgex_server(struct ssh
*ssh
)
63 ssh_dispatch_set(ssh
, SSH2_MSG_KEX_DH_GEX_REQUEST
,
64 &input_kex_dh_gex_request
);
65 debug("expecting SSH2_MSG_KEX_DH_GEX_REQUEST");
70 input_kex_dh_gex_request(int type
, u_int32_t seq
, void *ctxt
)
72 struct ssh
*ssh
= ctxt
;
73 struct kex
*kex
= ssh
->kex
;
75 u_int min
= 0, max
= 0, nbits
= 0;
77 debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
78 if ((r
= sshpkt_get_u32(ssh
, &min
)) != 0 ||
79 (r
= sshpkt_get_u32(ssh
, &nbits
)) != 0 ||
80 (r
= sshpkt_get_u32(ssh
, &max
)) != 0 ||
81 (r
= sshpkt_get_end(ssh
)) != 0)
86 min
= MAX(DH_GRP_MIN
, min
);
87 max
= MIN(DH_GRP_MAX
, max
);
88 nbits
= MAX(DH_GRP_MIN
, nbits
);
89 nbits
= MIN(DH_GRP_MAX
, nbits
);
91 if (kex
->max
< kex
->min
|| kex
->nbits
< kex
->min
||
92 kex
->max
< kex
->nbits
|| kex
->max
< DH_GRP_MIN
) {
93 r
= SSH_ERR_DH_GEX_OUT_OF_RANGE
;
97 /* Contact privileged parent */
98 kex
->dh
= PRIVSEP(choose_dh(min
, nbits
, max
));
99 if (kex
->dh
== NULL
) {
100 sshpkt_disconnect(ssh
, "no matching DH grp found");
101 r
= SSH_ERR_ALLOC_FAIL
;
104 debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");
105 if ((r
= sshpkt_start(ssh
, SSH2_MSG_KEX_DH_GEX_GROUP
)) != 0 ||
106 (r
= sshpkt_put_bignum2(ssh
, kex
->dh
->p
)) != 0 ||
107 (r
= sshpkt_put_bignum2(ssh
, kex
->dh
->g
)) != 0 ||
108 (r
= sshpkt_send(ssh
)) != 0)
111 /* Compute our exchange value in parallel with the client */
112 if ((r
= dh_gen_key(kex
->dh
, kex
->we_need
* 8)) != 0)
115 debug("expecting SSH2_MSG_KEX_DH_GEX_INIT");
116 ssh_dispatch_set(ssh
, SSH2_MSG_KEX_DH_GEX_INIT
, &input_kex_dh_gex_init
);
123 input_kex_dh_gex_init(int type
, u_int32_t seq
, void *ctxt
)
125 struct ssh
*ssh
= ctxt
;
126 struct kex
*kex
= ssh
->kex
;
127 BIGNUM
*shared_secret
= NULL
, *dh_client_pub
= NULL
;
128 struct sshkey
*server_host_public
, *server_host_private
;
129 u_char
*kbuf
= NULL
, *signature
= NULL
, *server_host_key_blob
= NULL
;
130 u_char hash
[SSH_DIGEST_MAX_LENGTH
];
131 size_t sbloblen
, slen
;
132 size_t klen
= 0, hashlen
;
135 if (kex
->load_host_public_key
== NULL
||
136 kex
->load_host_private_key
== NULL
) {
137 r
= SSH_ERR_INVALID_ARGUMENT
;
140 server_host_public
= kex
->load_host_public_key(kex
->hostkey_type
,
141 kex
->hostkey_nid
, ssh
);
142 server_host_private
= kex
->load_host_private_key(kex
->hostkey_type
,
143 kex
->hostkey_nid
, ssh
);
144 if (server_host_public
== NULL
) {
145 r
= SSH_ERR_NO_HOSTKEY_LOADED
;
150 if ((dh_client_pub
= BN_new()) == NULL
) {
151 r
= SSH_ERR_ALLOC_FAIL
;
154 if ((r
= sshpkt_get_bignum2(ssh
, dh_client_pub
)) != 0 ||
155 (r
= sshpkt_get_end(ssh
)) != 0)
159 fprintf(stderr
, "dh_client_pub= ");
160 BN_print_fp(stderr
, dh_client_pub
);
161 fprintf(stderr
, "\n");
162 debug("bits %d", BN_num_bits(dh_client_pub
));
166 DHparams_print_fp(stderr
, kex
->dh
);
167 fprintf(stderr
, "pub= ");
168 BN_print_fp(stderr
, kex
->dh
->pub_key
);
169 fprintf(stderr
, "\n");
171 if (!dh_pub_is_valid(kex
->dh
, dh_client_pub
)) {
172 sshpkt_disconnect(ssh
, "bad client public DH value");
173 r
= SSH_ERR_MESSAGE_INCOMPLETE
;
177 klen
= DH_size(kex
->dh
);
178 if ((kbuf
= malloc(klen
)) == NULL
||
179 (shared_secret
= BN_new()) == NULL
) {
180 r
= SSH_ERR_ALLOC_FAIL
;
183 if ((kout
= DH_compute_key(kbuf
, dh_client_pub
, kex
->dh
)) < 0 ||
184 BN_bin2bn(kbuf
, kout
, shared_secret
) == NULL
) {
185 r
= SSH_ERR_LIBCRYPTO_ERROR
;
189 dump_digest("shared secret", kbuf
, kout
);
191 if ((r
= sshkey_to_blob(server_host_public
, &server_host_key_blob
,
195 hashlen
= sizeof(hash
);
196 if ((r
= kexgex_hash(
198 kex
->client_version_string
,
199 kex
->server_version_string
,
200 sshbuf_ptr(kex
->peer
), sshbuf_len(kex
->peer
),
201 sshbuf_ptr(kex
->my
), sshbuf_len(kex
->my
),
202 server_host_key_blob
, sbloblen
,
203 kex
->min
, kex
->nbits
, kex
->max
,
204 kex
->dh
->p
, kex
->dh
->g
,
208 hash
, &hashlen
)) != 0)
211 /* save session id := H */
212 if (kex
->session_id
== NULL
) {
213 kex
->session_id_len
= hashlen
;
214 kex
->session_id
= malloc(kex
->session_id_len
);
215 if (kex
->session_id
== NULL
) {
216 r
= SSH_ERR_ALLOC_FAIL
;
219 memcpy(kex
->session_id
, hash
, kex
->session_id_len
);
223 if ((r
= kex
->sign(server_host_private
, server_host_public
, &signature
,
224 &slen
, hash
, hashlen
, kex
->hostkey_alg
, ssh
->compat
)) < 0)
227 /* destroy_sensitive_data(); */
229 /* send server hostkey, DH pubkey 'f' and singed H */
230 if ((r
= sshpkt_start(ssh
, SSH2_MSG_KEX_DH_GEX_REPLY
)) != 0 ||
231 (r
= sshpkt_put_string(ssh
, server_host_key_blob
, sbloblen
)) != 0 ||
232 (r
= sshpkt_put_bignum2(ssh
, kex
->dh
->pub_key
)) != 0 || /* f */
233 (r
= sshpkt_put_string(ssh
, signature
, slen
)) != 0 ||
234 (r
= sshpkt_send(ssh
)) != 0)
237 if ((r
= kex_derive_keys_bn(ssh
, hash
, hashlen
, shared_secret
)) == 0)
238 r
= kex_send_newkeys(ssh
);
243 BN_clear_free(dh_client_pub
);
245 explicit_bzero(kbuf
, klen
);
249 BN_clear_free(shared_secret
);
250 free(server_host_key_blob
);
254 #endif /* WITH_OPENSSL */