GCC Code Coverage Report
Directory: ./ Exec Total Coverage
File: usr.bin/ssh/lib/../kexgexc.c Lines: 0 114 0.0 %
Date: 2017-11-13 Branches: 0 94 0.0 %

Line Branch Exec Source
1
/* $OpenBSD: kexgexc.c,v 1.25 2017/05/30 14:23:52 markus Exp $ */
2
/*
3
 * Copyright (c) 2000 Niels Provos.  All rights reserved.
4
 * Copyright (c) 2001 Markus Friedl.  All rights reserved.
5
 *
6
 * Redistribution and use in source and binary forms, with or without
7
 * modification, are permitted provided that the following conditions
8
 * are met:
9
 * 1. Redistributions of source code must retain the above copyright
10
 *    notice, this list of conditions and the following disclaimer.
11
 * 2. Redistributions in binary form must reproduce the above copyright
12
 *    notice, this list of conditions and the following disclaimer in the
13
 *    documentation and/or other materials provided with the distribution.
14
 *
15
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25
 */
26
27
#include <sys/types.h>
28
29
#include <openssl/dh.h>
30
31
#include <stdio.h>
32
#include <string.h>
33
#include <signal.h>
34
35
#include "sshkey.h"
36
#include "cipher.h"
37
#include "digest.h"
38
#include "kex.h"
39
#include "log.h"
40
#include "packet.h"
41
#include "dh.h"
42
#include "ssh2.h"
43
#include "compat.h"
44
#include "dispatch.h"
45
#include "ssherr.h"
46
#include "sshbuf.h"
47
#include "misc.h"
48
49
static int input_kex_dh_gex_group(int, u_int32_t, struct ssh *);
50
static int input_kex_dh_gex_reply(int, u_int32_t, struct ssh *);
51
52
int
53
kexgex_client(struct ssh *ssh)
54
{
55
	struct kex *kex = ssh->kex;
56
	int r;
57
	u_int nbits;
58
59
	nbits = dh_estimate(kex->dh_need * 8);
60
61
	kex->min = DH_GRP_MIN;
62
	kex->max = DH_GRP_MAX;
63
	kex->nbits = nbits;
64
	if (datafellows & SSH_BUG_DHGEX_LARGE)
65
		kex->nbits = MINIMUM(kex->nbits, 4096);
66
	/* New GEX request */
67
	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REQUEST)) != 0 ||
68
	    (r = sshpkt_put_u32(ssh, kex->min)) != 0 ||
69
	    (r = sshpkt_put_u32(ssh, kex->nbits)) != 0 ||
70
	    (r = sshpkt_put_u32(ssh, kex->max)) != 0 ||
71
	    (r = sshpkt_send(ssh)) != 0)
72
		goto out;
73
	debug("SSH2_MSG_KEX_DH_GEX_REQUEST(%u<%u<%u) sent",
74
	    kex->min, kex->nbits, kex->max);
75
#ifdef DEBUG_KEXDH
76
	fprintf(stderr, "\nmin = %d, nbits = %d, max = %d\n",
77
	    kex->min, kex->nbits, kex->max);
78
#endif
79
	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_GROUP,
80
	    &input_kex_dh_gex_group);
81
	r = 0;
82
 out:
83
	return r;
84
}
85
86
static int
87
input_kex_dh_gex_group(int type, u_int32_t seq, struct ssh *ssh)
88
{
89
	struct kex *kex = ssh->kex;
90
	BIGNUM *p = NULL, *g = NULL;
91
	int r, bits;
92
93
	debug("got SSH2_MSG_KEX_DH_GEX_GROUP");
94
95
	if ((p = BN_new()) == NULL ||
96
	    (g = BN_new()) == NULL) {
97
		r = SSH_ERR_ALLOC_FAIL;
98
		goto out;
99
	}
100
	if ((r = sshpkt_get_bignum2(ssh, p)) != 0 ||
101
	    (r = sshpkt_get_bignum2(ssh, g)) != 0 ||
102
	    (r = sshpkt_get_end(ssh)) != 0)
103
		goto out;
104
	if ((bits = BN_num_bits(p)) < 0 ||
105
	    (u_int)bits < kex->min || (u_int)bits > kex->max) {
106
		r = SSH_ERR_DH_GEX_OUT_OF_RANGE;
107
		goto out;
108
	}
109
	if ((kex->dh = dh_new_group(g, p)) == NULL) {
110
		r = SSH_ERR_ALLOC_FAIL;
111
		goto out;
112
	}
113
	p = g = NULL; /* belong to kex->dh now */
114
115
	/* generate and send 'e', client DH public key */
116
	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0 ||
117
	    (r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_INIT)) != 0 ||
118
	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||
119
	    (r = sshpkt_send(ssh)) != 0)
120
		goto out;
121
	debug("SSH2_MSG_KEX_DH_GEX_INIT sent");
122
#ifdef DEBUG_KEXDH
123
	DHparams_print_fp(stderr, kex->dh);
124
	fprintf(stderr, "pub= ");
125
	BN_print_fp(stderr, kex->dh->pub_key);
126
	fprintf(stderr, "\n");
127
#endif
128
	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_GROUP, NULL);
129
	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REPLY, &input_kex_dh_gex_reply);
130
	r = 0;
131
out:
132
	if (p)
133
		BN_clear_free(p);
134
	if (g)
135
		BN_clear_free(g);
136
	return r;
137
}
138
139
static int
140
input_kex_dh_gex_reply(int type, u_int32_t seq, struct ssh *ssh)
141
{
142
	struct kex *kex = ssh->kex;
143
	BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
144
	struct sshkey *server_host_key = NULL;
145
	u_char *kbuf = NULL, *signature = NULL, *server_host_key_blob = NULL;
146
	u_char hash[SSH_DIGEST_MAX_LENGTH];
147
	size_t klen = 0, slen, sbloblen, hashlen;
148
	int kout, r;
149
150
	debug("got SSH2_MSG_KEX_DH_GEX_REPLY");
151
	if (kex->verify_host_key == NULL) {
152
		r = SSH_ERR_INVALID_ARGUMENT;
153
		goto out;
154
	}
155
	/* key, cert */
156
	if ((r = sshpkt_get_string(ssh, &server_host_key_blob,
157
	    &sbloblen)) != 0 ||
158
	    (r = sshkey_from_blob(server_host_key_blob, sbloblen,
159
	    &server_host_key)) != 0)
160
		goto out;
161
	if (server_host_key->type != kex->hostkey_type ||
162
	    (kex->hostkey_type == KEY_ECDSA &&
163
	    server_host_key->ecdsa_nid != kex->hostkey_nid)) {
164
		r = SSH_ERR_KEY_TYPE_MISMATCH;
165
		goto out;
166
	}
167
	if (kex->verify_host_key(server_host_key, ssh) == -1) {
168
		r = SSH_ERR_SIGNATURE_INVALID;
169
		goto out;
170
	}
171
	/* DH parameter f, server public DH key */
172
	if ((dh_server_pub = BN_new()) == NULL) {
173
		r = SSH_ERR_ALLOC_FAIL;
174
		goto out;
175
	}
176
	/* signed H */
177
	if ((r = sshpkt_get_bignum2(ssh, dh_server_pub)) != 0 ||
178
	    (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
179
	    (r = sshpkt_get_end(ssh)) != 0)
180
		goto out;
181
#ifdef DEBUG_KEXDH
182
	fprintf(stderr, "dh_server_pub= ");
183
	BN_print_fp(stderr, dh_server_pub);
184
	fprintf(stderr, "\n");
185
	debug("bits %d", BN_num_bits(dh_server_pub));
186
#endif
187
	if (!dh_pub_is_valid(kex->dh, dh_server_pub)) {
188
		sshpkt_disconnect(ssh, "bad server public DH value");
189
		r = SSH_ERR_MESSAGE_INCOMPLETE;
190
		goto out;
191
	}
192
193
	klen = DH_size(kex->dh);
194
	if ((kbuf = malloc(klen)) == NULL ||
195
	    (shared_secret = BN_new()) == NULL) {
196
		r = SSH_ERR_ALLOC_FAIL;
197
		goto out;
198
	}
199
	if ((kout = DH_compute_key(kbuf, dh_server_pub, kex->dh)) < 0 ||
200
	    BN_bin2bn(kbuf, kout, shared_secret) == NULL) {
201
		r = SSH_ERR_LIBCRYPTO_ERROR;
202
		goto out;
203
	}
204
#ifdef DEBUG_KEXDH
205
	dump_digest("shared secret", kbuf, kout);
206
#endif
207
	if (ssh->compat & SSH_OLD_DHGEX)
208
		kex->min = kex->max = -1;
209
210
	/* calc and verify H */
211
	hashlen = sizeof(hash);
212
	if ((r = kexgex_hash(
213
	    kex->hash_alg,
214
	    kex->client_version_string,
215
	    kex->server_version_string,
216
	    sshbuf_ptr(kex->my), sshbuf_len(kex->my),
217
	    sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
218
	    server_host_key_blob, sbloblen,
219
	    kex->min, kex->nbits, kex->max,
220
	    kex->dh->p, kex->dh->g,
221
	    kex->dh->pub_key,
222
	    dh_server_pub,
223
	    shared_secret,
224
	    hash, &hashlen)) != 0)
225
		goto out;
226
227
	if ((r = sshkey_verify(server_host_key, signature, slen, hash,
228
	    hashlen, ssh->compat)) != 0)
229
		goto out;
230
231
	/* save session id */
232
	if (kex->session_id == NULL) {
233
		kex->session_id_len = hashlen;
234
		kex->session_id = malloc(kex->session_id_len);
235
		if (kex->session_id == NULL) {
236
			r = SSH_ERR_ALLOC_FAIL;
237
			goto out;
238
		}
239
		memcpy(kex->session_id, hash, kex->session_id_len);
240
	}
241
242
	if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
243
		r = kex_send_newkeys(ssh);
244
 out:
245
	explicit_bzero(hash, sizeof(hash));
246
	DH_free(kex->dh);
247
	kex->dh = NULL;
248
	if (dh_server_pub)
249
		BN_clear_free(dh_server_pub);
250
	if (kbuf) {
251
		explicit_bzero(kbuf, klen);
252
		free(kbuf);
253
	}
254
	if (shared_secret)
255
		BN_clear_free(shared_secret);
256
	sshkey_free(server_host_key);
257
	free(server_host_key_blob);
258
	free(signature);
259
	return r;
260
}