97 	const char **defprop = ssh->kex->server ? defpropserver : defpropclient;  in kex_proposal_populate_entries()
107 	if ((cp = kex_names_cat(kexalgos, ssh->kex->server ?  in kex_proposal_populate_entries()
241 	if ((ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict) {  in kex_protocol_error()
276 	free(ssh->kex->server_sig_algs);  in kex_set_server_sig_algs()
277 	ssh->kex->server_sig_algs = NULL;  in kex_set_server_sig_algs()
285 		if (ssh->kex->server_sig_algs != NULL &&  in kex_set_server_sig_algs()
286 		    kex_has_any_alg(sigalg, ssh->kex->server_sig_algs))  in kex_set_server_sig_algs()
288 		xextendf(&ssh->kex->server_sig_algs, ",", "%s", sigalg);  in kex_set_server_sig_algs()
292 	if (ssh->kex->server_sig_algs == NULL)  in kex_set_server_sig_algs()
293 		ssh->kex->server_sig_algs = xstrdup("");  in kex_set_server_sig_algs()
301 	if (ssh->kex->server_sig_algs == NULL &&  in kex_compose_ext_info_server()
302 	    (ssh->kex->server_sig_algs = sshkey_alg_list(0, 1, 1, ',')) == NULL)  in kex_compose_ext_info_server()
306 	    (r = sshbuf_put_cstring(m, ssh->kex->server_sig_algs)) != 0 ||  in kex_compose_ext_info_server()
341 	if ((ssh->kex->flags & KEX_INITIAL) == 0)  in kex_maybe_send_ext_info()
343 	if (!ssh->kex->ext_info_c && !ssh->kex->ext_info_s)  in kex_maybe_send_ext_info()
349 	if (ssh->kex->ext_info_c &&  in kex_maybe_send_ext_info()
352 	if (ssh->kex->ext_info_s &&  in kex_maybe_send_ext_info()
377 	if ((ssh->kex->flags & KEX_HAS_EXT_INFO_IN_AUTH) == 0)  in kex_server_update_ext_info()
384 	    (r = sshpkt_put_cstring(ssh, ssh->kex->server_sig_algs)) != 0 ||  in kex_server_update_ext_info()
411 kex_ext_info_check_ver(struct kex *kex, const char *name,  in kex_ext_info_check_ver()  argument
420 		kex->flags |= flag;  in kex_ext_info_check_ver()
440 		free(ssh->kex->server_sig_algs);  in kex_ext_info_client_parse()
441 		ssh->kex->server_sig_algs = xstrdup((const char *)value);  in kex_ext_info_client_parse()
442 	} else if (ssh->kex->ext_info_received == 1 &&  in kex_ext_info_client_parse()
444 		if ((r = kex_ext_info_check_ver(ssh->kex, name, value, vlen,  in kex_ext_info_client_parse()
448 	} else if (ssh->kex->ext_info_received == 1 &&  in kex_ext_info_client_parse()
450 		if ((r = kex_ext_info_check_ver(ssh->kex, name, value, vlen,  in kex_ext_info_client_parse()
467 		if ((r = kex_ext_info_check_ver(ssh->kex, name, value, vlen,  in kex_ext_info_server_parse()
479 	struct kex *kex = ssh->kex;  in kex_input_ext_info()  local
480 	const int max_ext_info = kex->server ? 1 : 2;  in kex_input_ext_info()
488 	if (++kex->ext_info_received > max_ext_info) {  in kex_input_ext_info()
508 		if (kex->server) {  in kex_input_ext_info()
526 	struct kex *kex = ssh->kex;  in kex_input_newkeys()  local
527 	int r, initial = (kex->flags & KEX_INITIAL) != 0;  in kex_input_newkeys()
531 	if (kex->ext_info_c && initial)  in kex_input_newkeys()
541 		if ((r = kex_buf2prop(kex->my, NULL, &prop)) != 0)  in kex_input_newkeys()
544 		    kex->server ?  in kex_input_newkeys()
552 		if ((r = kex_prop2buf(ssh->kex->my, prop)) != 0) {  in kex_input_newkeys()
562 	kex->done = 1;  in kex_input_newkeys()
563 	kex->flags &= ~KEX_INITIAL;  in kex_input_newkeys()
564 	sshbuf_reset(kex->peer);  in kex_input_newkeys()
565 	kex->flags &= ~KEX_INIT_SENT;  in kex_input_newkeys()
566 	free(kex->name);  in kex_input_newkeys()
567 	kex->name = NULL;  in kex_input_newkeys()
575 	struct kex *kex = ssh->kex;  in kex_send_kexinit()  local
578 	if (kex == NULL) {  in kex_send_kexinit()
582 	if (kex->flags & KEX_INIT_SENT)  in kex_send_kexinit()
584 	kex->done = 0;  in kex_send_kexinit()
587 	if (sshbuf_len(kex->my) < KEX_COOKIE_LEN) {  in kex_send_kexinit()
589 		    sshbuf_len(kex->my), KEX_COOKIE_LEN);  in kex_send_kexinit()
592 	if ((cookie = sshbuf_mutable_ptr(kex->my)) == NULL) {  in kex_send_kexinit()
599 	    (r = sshpkt_putb(ssh, kex->my)) != 0 ||  in kex_send_kexinit()
605 	kex->flags |= KEX_INIT_SENT;  in kex_send_kexinit()
612 	struct kex *kex = ssh->kex;  in kex_input_kexinit()  local
619 	if (kex == NULL) {  in kex_input_kexinit()
625 	if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)  in kex_input_kexinit()
656 	if (!(kex->flags & KEX_INIT_SENT))  in kex_input_kexinit()
662 	if (kex->kex_type < KEX_MAX && kex->kex[kex->kex_type] != NULL)  in kex_input_kexinit()
663 		return (kex->kex[kex->kex_type])(ssh);  in kex_input_kexinit()
665 	error_f("unknown kex type %u", kex->kex_type);  in kex_input_kexinit()
669 struct kex *
672 	struct kex *kex;  in kex_new()  local
674 	if ((kex = calloc(1, sizeof(*kex))) == NULL ||  in kex_new()
675 	    (kex->peer = sshbuf_new()) == NULL ||  in kex_new()
676 	    (kex->my = sshbuf_new()) == NULL ||  in kex_new()
677 	    (kex->client_version = sshbuf_new()) == NULL ||  in kex_new()
678 	    (kex->server_version = sshbuf_new()) == NULL ||  in kex_new()
679 	    (kex->session_id = sshbuf_new()) == NULL) {  in kex_new()
680 		kex_free(kex);  in kex_new()
683 	return kex;  in kex_new()
717 kex_free(struct kex *kex)  in kex_free()  argument
721 	if (kex == NULL)  in kex_free()
725 	DH_free(kex->dh);  in kex_free()
727 	EC_KEY_free(kex->ec_client_key);  in kex_free()
731 		kex_free_newkeys(kex->newkeys[mode]);  in kex_free()
732 		kex->newkeys[mode] = NULL;  in kex_free()
734 	sshbuf_free(kex->peer);  in kex_free()
735 	sshbuf_free(kex->my);  in kex_free()
736 	sshbuf_free(kex->client_version);  in kex_free()
737 	sshbuf_free(kex->server_version);  in kex_free()
738 	sshbuf_free(kex->client_pub);  in kex_free()
739 	sshbuf_free(kex->session_id);  in kex_free()
740 	sshbuf_free(kex->initial_sig);  in kex_free()
741 	sshkey_free(kex->initial_hostkey);  in kex_free()
742 	free(kex->failed_choice);  in kex_free()
743 	free(kex->hostkey_alg);  in kex_free()
744 	free(kex->name);  in kex_free()
745 	free(kex);  in kex_free()
753 	if ((r = kex_prop2buf(ssh->kex->my, proposal)) != 0)  in kex_ready()
755 	ssh->kex->flags = KEX_INITIAL;  in kex_ready()
769 		kex_free(ssh->kex);  in kex_setup()
770 		ssh->kex = NULL;  in kex_setup()
783 	if (ssh->kex == NULL) {  in kex_start_rekex()
787 	if (ssh->kex->done == 0) {  in kex_start_rekex()
791 	ssh->kex->done = 0;  in kex_start_rekex()
859 choose_kex(struct kex *k, char *client, char *server)  in choose_kex()
877 choose_hostkeyalg(struct kex *k, char *client, char *server)  in choose_hostkeyalg()
928 	struct kex *kex = ssh->kex;  in kex_choose_conf()  local
936 	debug2("local %s KEXINIT proposal", kex->server ? "server" : "client");  in kex_choose_conf()
937 	if ((r = kex_buf2prop(kex->my, NULL, &my)) != 0)  in kex_choose_conf()
939 	debug2("peer %s KEXINIT proposal", kex->server ? "client" : "server");  in kex_choose_conf()
940 	if ((r = kex_buf2prop(kex->peer, &first_kex_follows, &peer)) != 0)  in kex_choose_conf()
943 	if (kex->server) {  in kex_choose_conf()
952 	if ((kex->flags & KEX_INITIAL) != 0) {  in kex_choose_conf()
953 		if (kex->server) {  in kex_choose_conf()
954 			kex->ext_info_c = kexalgs_contains(peer, "ext-info-c");  in kex_choose_conf()
955 			kex->kex_strict = kexalgs_contains(peer,  in kex_choose_conf()
958 			kex->ext_info_s = kexalgs_contains(peer, "ext-info-s");  in kex_choose_conf()
959 			kex->kex_strict = kexalgs_contains(peer,  in kex_choose_conf()
962 		if (kex->kex_strict) {  in kex_choose_conf()
972 	if (kex->server && (kex->flags & KEX_INITIAL)) {  in kex_choose_conf()
975 			kex->flags |= KEX_RSA_SHA2_256_SUPPORTED;  in kex_choose_conf()
978 			kex->flags |= KEX_RSA_SHA2_512_SUPPORTED;  in kex_choose_conf()
982 	if ((r = choose_kex(kex, cprop[PROPOSAL_KEX_ALGS],  in kex_choose_conf()
984 		kex->failed_choice = peer[PROPOSAL_KEX_ALGS];  in kex_choose_conf()
988 	if ((r = choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],  in kex_choose_conf()
990 		kex->failed_choice = peer[PROPOSAL_SERVER_HOST_KEY_ALGS];  in kex_choose_conf()
999 		kex->newkeys[mode] = newkeys;  in kex_choose_conf()
1000 		ctos = (!kex->server && mode == MODE_OUT) ||  in kex_choose_conf()
1001 		    (kex->server && mode == MODE_IN);  in kex_choose_conf()
1007 			kex->failed_choice = peer[nenc];  in kex_choose_conf()
1016 			kex->failed_choice = peer[nmac];  in kex_choose_conf()
1022 			kex->failed_choice = peer[ncomp];  in kex_choose_conf()
1034 		newkeys = kex->newkeys[mode];  in kex_choose_conf()
1045 	kex->we_need = need;  in kex_choose_conf()
1046 	kex->dh_need = dh_need;  in kex_choose_conf()
1062 	struct kex *kex = ssh->kex;  in derive_key()  local
1070 	if ((mdsz = ssh_digest_bytes(kex->hash_alg)) == 0)  in derive_key()
1078 	if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL ||  in derive_key()
1082 	    ssh_digest_update_buffer(hashctx, kex->session_id) != 0 ||  in derive_key()
1097 		if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL ||  in derive_key()
1127 	struct kex *kex = ssh->kex;  in kex_derive_keys()  local
1133 	if ((kex->flags & KEX_INITIAL) != 0) {  in kex_derive_keys()
1134 		if (sshbuf_len(kex->session_id) != 0) {  in kex_derive_keys()
1138 		if ((r = sshbuf_put(kex->session_id, hash, hashlen)) != 0)  in kex_derive_keys()
1140 	} else if (sshbuf_len(kex->session_id) == 0) {  in kex_derive_keys()
1145 		if ((r = derive_key(ssh, 'A'+i, kex->we_need, hash, hashlen,  in kex_derive_keys()
1153 		ctos = (!kex->server && mode == MODE_OUT) ||  in kex_derive_keys()
1154 		    (kex->server && mode == MODE_IN);  in kex_derive_keys()
1155 		kex->newkeys[mode]->enc.iv  = keys[ctos ? 0 : 1];  in kex_derive_keys()
1156 		kex->newkeys[mode]->enc.key = keys[ctos ? 2 : 3];  in kex_derive_keys()
1157 		kex->newkeys[mode]->mac.key = keys[ctos ? 4 : 5];  in kex_derive_keys()
1165 	struct kex *kex = ssh->kex;  in kex_load_hostkey()  local
1169 	if (kex->load_host_public_key == NULL ||  in kex_load_hostkey()
1170 	    kex->load_host_private_key == NULL) {  in kex_load_hostkey()
1174 	*pubp = kex->load_host_public_key(kex->hostkey_type,  in kex_load_hostkey()
1175 	    kex->hostkey_nid, ssh);  in kex_load_hostkey()
1176 	*prvp = kex->load_host_private_key(kex->hostkey_type,  in kex_load_hostkey()
1177 	    kex->hostkey_nid, ssh);  in kex_load_hostkey()
1186 	struct kex *kex = ssh->kex;  in kex_verify_host_key()  local
1188 	if (kex->verify_host_key == NULL) {  in kex_verify_host_key()
1192 	if (server_host_key->type != kex->hostkey_type ||  in kex_verify_host_key()
1193 	    (kex->hostkey_type == KEY_ECDSA &&  in kex_verify_host_key()
1194 	    server_host_key->ecdsa_nid != kex->hostkey_nid))  in kex_verify_host_key()
1196 	if (kex->verify_host_key(server_host_key, ssh) == -1)  in kex_verify_host_key()
1219 	if (!ssh->kex->server)  in send_error()
1242 	struct sshbuf *our_version = ssh->kex->server ?  in kex_exchange_identification()
1243 	    ssh->kex->server_version : ssh->kex->client_version;  in kex_exchange_identification()
1244 	struct sshbuf *peer_version = ssh->kex->server ?  in kex_exchange_identification()
1245 	    ssh->kex->client_version : ssh->kex->server_version;  in kex_exchange_identification()
1358 		if (ssh->kex->server) {  in kex_exchange_identification()
1414 	if (ssh->kex->server && (ssh->compat & SSH_BUG_PROBE) != 0) {  in kex_exchange_identification()
1421 	if (ssh->kex->server && (ssh->compat & SSH_BUG_SCANNER) != 0) {  in kex_exchange_identification()