xref: /freebsd/crypto/openssh/kexgexs.c (revision 190cef3d52236565eb22e18b33e9e865ec634aa3)
1 /* $OpenBSD: kexgexs.c,v 1.33 2018/04/10 00:10:49 djm Exp $ */
2 /*
3  * Copyright (c) 2000 Niels Provos.  All rights reserved.
4  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include "includes.h"
28 
29 #ifdef WITH_OPENSSL
30 
31 
32 #include <stdarg.h>
33 #include <stdio.h>
34 #include <string.h>
35 #include <signal.h>
36 
37 #include <openssl/dh.h>
38 
39 #include "sshkey.h"
40 #include "cipher.h"
41 #include "digest.h"
42 #include "kex.h"
43 #include "log.h"
44 #include "packet.h"
45 #include "dh.h"
46 #include "ssh2.h"
47 #include "compat.h"
48 #ifdef GSSAPI
49 #include "ssh-gss.h"
50 #endif
51 #include "monitor_wrap.h"
52 #include "dispatch.h"
53 #include "ssherr.h"
54 #include "sshbuf.h"
55 #include "misc.h"
56 
57 static int input_kex_dh_gex_request(int, u_int32_t, struct ssh *);
58 static int input_kex_dh_gex_init(int, u_int32_t, struct ssh *);
59 
60 int
61 kexgex_server(struct ssh *ssh)
62 {
63 	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REQUEST,
64 	    &input_kex_dh_gex_request);
65 	debug("expecting SSH2_MSG_KEX_DH_GEX_REQUEST");
66 	return 0;
67 }
68 
69 static int
70 input_kex_dh_gex_request(int type, u_int32_t seq, struct ssh *ssh)
71 {
72 	struct kex *kex = ssh->kex;
73 	int r;
74 	u_int min = 0, max = 0, nbits = 0;
75 
76 	debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
77 	if ((r = sshpkt_get_u32(ssh, &min)) != 0 ||
78 	    (r = sshpkt_get_u32(ssh, &nbits)) != 0 ||
79 	    (r = sshpkt_get_u32(ssh, &max)) != 0 ||
80 	    (r = sshpkt_get_end(ssh)) != 0)
81 		goto out;
82 	kex->nbits = nbits;
83 	kex->min = min;
84 	kex->max = max;
85 	min = MAXIMUM(DH_GRP_MIN, min);
86 	max = MINIMUM(DH_GRP_MAX, max);
87 	nbits = MAXIMUM(DH_GRP_MIN, nbits);
88 	nbits = MINIMUM(DH_GRP_MAX, nbits);
89 
90 	if (kex->max < kex->min || kex->nbits < kex->min ||
91 	    kex->max < kex->nbits || kex->max < DH_GRP_MIN) {
92 		r = SSH_ERR_DH_GEX_OUT_OF_RANGE;
93 		goto out;
94 	}
95 
96 	/* Contact privileged parent */
97 	kex->dh = PRIVSEP(choose_dh(min, nbits, max));
98 	if (kex->dh == NULL) {
99 		sshpkt_disconnect(ssh, "no matching DH grp found");
100 		r = SSH_ERR_ALLOC_FAIL;
101 		goto out;
102 	}
103 	debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");
104 	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_GROUP)) != 0 ||
105 	    (r = sshpkt_put_bignum2(ssh, kex->dh->p)) != 0 ||
106 	    (r = sshpkt_put_bignum2(ssh, kex->dh->g)) != 0 ||
107 	    (r = sshpkt_send(ssh)) != 0)
108 		goto out;
109 
110 	/* Compute our exchange value in parallel with the client */
111 	if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
112 		goto out;
113 
114 	debug("expecting SSH2_MSG_KEX_DH_GEX_INIT");
115 	ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_INIT, &input_kex_dh_gex_init);
116 	r = 0;
117  out:
118 	return r;
119 }
120 
121 static int
122 input_kex_dh_gex_init(int type, u_int32_t seq, struct ssh *ssh)
123 {
124 	struct kex *kex = ssh->kex;
125 	BIGNUM *shared_secret = NULL, *dh_client_pub = NULL;
126 	struct sshkey *server_host_public, *server_host_private;
127 	u_char *kbuf = NULL, *signature = NULL, *server_host_key_blob = NULL;
128 	u_char hash[SSH_DIGEST_MAX_LENGTH];
129 	size_t sbloblen, slen;
130 	size_t klen = 0, hashlen;
131 	int kout, r;
132 
133 	if (kex->load_host_public_key == NULL ||
134 	    kex->load_host_private_key == NULL) {
135 		r = SSH_ERR_INVALID_ARGUMENT;
136 		goto out;
137 	}
138 	server_host_public = kex->load_host_public_key(kex->hostkey_type,
139 	    kex->hostkey_nid, ssh);
140 	server_host_private = kex->load_host_private_key(kex->hostkey_type,
141 	    kex->hostkey_nid, ssh);
142 	if (server_host_public == NULL) {
143 		r = SSH_ERR_NO_HOSTKEY_LOADED;
144 		goto out;
145 	}
146 
147 	/* key, cert */
148 	if ((dh_client_pub = BN_new()) == NULL) {
149 		r = SSH_ERR_ALLOC_FAIL;
150 		goto out;
151 	}
152 	if ((r = sshpkt_get_bignum2(ssh, dh_client_pub)) != 0 ||
153 	    (r = sshpkt_get_end(ssh)) != 0)
154 		goto out;
155 
156 #ifdef DEBUG_KEXDH
157 	fprintf(stderr, "dh_client_pub= ");
158 	BN_print_fp(stderr, dh_client_pub);
159 	fprintf(stderr, "\n");
160 	debug("bits %d", BN_num_bits(dh_client_pub));
161 #endif
162 
163 #ifdef DEBUG_KEXDH
164 	DHparams_print_fp(stderr, kex->dh);
165 	fprintf(stderr, "pub= ");
166 	BN_print_fp(stderr, kex->dh->pub_key);
167 	fprintf(stderr, "\n");
168 #endif
169 	if (!dh_pub_is_valid(kex->dh, dh_client_pub)) {
170 		sshpkt_disconnect(ssh, "bad client public DH value");
171 		r = SSH_ERR_MESSAGE_INCOMPLETE;
172 		goto out;
173 	}
174 
175 	klen = DH_size(kex->dh);
176 	if ((kbuf = malloc(klen)) == NULL ||
177 	    (shared_secret = BN_new()) == NULL) {
178 		r = SSH_ERR_ALLOC_FAIL;
179 		goto out;
180 	}
181 	if ((kout = DH_compute_key(kbuf, dh_client_pub, kex->dh)) < 0 ||
182 	    BN_bin2bn(kbuf, kout, shared_secret) == NULL) {
183 		r = SSH_ERR_LIBCRYPTO_ERROR;
184 		goto out;
185 	}
186 #ifdef DEBUG_KEXDH
187 	dump_digest("shared secret", kbuf, kout);
188 #endif
189 	if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob,
190 	    &sbloblen)) != 0)
191 		goto out;
192 	/* calc H */
193 	hashlen = sizeof(hash);
194 	if ((r = kexgex_hash(
195 	    kex->hash_alg,
196 	    kex->client_version_string,
197 	    kex->server_version_string,
198 	    sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
199 	    sshbuf_ptr(kex->my), sshbuf_len(kex->my),
200 	    server_host_key_blob, sbloblen,
201 	    kex->min, kex->nbits, kex->max,
202 	    kex->dh->p, kex->dh->g,
203 	    dh_client_pub,
204 	    kex->dh->pub_key,
205 	    shared_secret,
206 	    hash, &hashlen)) != 0)
207 		goto out;
208 
209 	/* save session id := H */
210 	if (kex->session_id == NULL) {
211 		kex->session_id_len = hashlen;
212 		kex->session_id = malloc(kex->session_id_len);
213 		if (kex->session_id == NULL) {
214 			r = SSH_ERR_ALLOC_FAIL;
215 			goto out;
216 		}
217 		memcpy(kex->session_id, hash, kex->session_id_len);
218 	}
219 
220 	/* sign H */
221 	if ((r = kex->sign(server_host_private, server_host_public, &signature,
222 	     &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0)
223 		goto out;
224 
225 	/* destroy_sensitive_data(); */
226 
227 	/* send server hostkey, DH pubkey 'f' and signed H */
228 	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REPLY)) != 0 ||
229 	    (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
230 	    (r = sshpkt_put_bignum2(ssh, kex->dh->pub_key)) != 0 ||     /* f */
231 	    (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
232 	    (r = sshpkt_send(ssh)) != 0)
233 		goto out;
234 
235 	if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
236 		r = kex_send_newkeys(ssh);
237  out:
238 	DH_free(kex->dh);
239 	kex->dh = NULL;
240 	BN_clear_free(dh_client_pub);
241 	if (kbuf) {
242 		explicit_bzero(kbuf, klen);
243 		free(kbuf);
244 	}
245 	BN_clear_free(shared_secret);
246 	free(server_host_key_blob);
247 	free(signature);
248 	return r;
249 }
250 #endif /* WITH_OPENSSL */
251