kexgexs.c

   1 /* $OpenBSD: kexgexs.c,v 1.47 2024/05/17 00:30:23 djm Exp $ */
   2 /*
   3  * Copyright (c) 2000 Niels Provos.  All rights reserved.
   4  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  25  */
  26
  27 #include "includes.h"
  28
  29 #ifdef WITH_OPENSSL
  30
  31
  32 #include <stdarg.h>
  33 #include <stdio.h>
  34 #include <string.h>
  35 #include <signal.h>
  36
  37 #include <openssl/dh.h>
  38
  39 #include "openbsd-compat/openssl-compat.h"
  40
  41 #include "sshkey.h"
  42 #include "cipher.h"
  43 #include "digest.h"
  44 #include "kex.h"
  45 #include "log.h"
  46 #include "packet.h"
  47 #include "dh.h"
  48 #include "ssh2.h"
  49 #ifdef GSSAPI
  50 #include "ssh-gss.h"
  51 #endif
  52 #include "monitor_wrap.h"
  53 #include "dispatch.h"
  54 #include "ssherr.h"
  55 #include "sshbuf.h"
  56 #include "misc.h"
  57
  58 static int input_kex_dh_gex_request(int, u_int32_t, struct ssh *);
  59 static int input_kex_dh_gex_init(int, u_int32_t, struct ssh *);
  60
  61 int
  62 kexgex_server(struct ssh *ssh)
  63 {
  64         ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REQUEST,
  65             &input_kex_dh_gex_request);
  66         debug("expecting SSH2_MSG_KEX_DH_GEX_REQUEST");
  67         return 0;
  68 }
  69
  70 static int
  71 input_kex_dh_gex_request(int type, u_int32_t seq, struct ssh *ssh)
  72 {
  73         struct kex *kex = ssh->kex;
  74         int r;
  75         u_int min = 0, max = 0, nbits = 0;
  76         const BIGNUM *dh_p, *dh_g;
  77
  78         debug("SSH2_MSG_KEX_DH_GEX_REQUEST received");
  79         ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_REQUEST, &kex_protocol_error);
  80
  81         if ((r = sshpkt_get_u32(ssh, &min)) != 0 ||
  82             (r = sshpkt_get_u32(ssh, &nbits)) != 0 ||
  83             (r = sshpkt_get_u32(ssh, &max)) != 0 ||
  84             (r = sshpkt_get_end(ssh)) != 0)
  85                 goto out;
  86         kex->nbits = nbits;
  87         kex->min = min;
  88         kex->max = max;
  89         min = MAXIMUM(DH_GRP_MIN, min);
  90         max = MINIMUM(DH_GRP_MAX, max);
  91         nbits = MAXIMUM(DH_GRP_MIN, nbits);
  92         nbits = MINIMUM(DH_GRP_MAX, nbits);
  93
  94         if (kex->max < kex->min || kex->nbits < kex->min ||
  95             kex->max < kex->nbits || kex->max < DH_GRP_MIN) {
  96                 r = SSH_ERR_DH_GEX_OUT_OF_RANGE;
  97                 goto out;
  98         }
  99
 100         /* Contact privileged parent */
 101         kex->dh = mm_choose_dh(min, nbits, max);
 102         if (kex->dh == NULL) {
 103                 (void)sshpkt_disconnect(ssh, "no matching DH grp found");
 104                 r = SSH_ERR_ALLOC_FAIL;
 105                 goto out;
 106         }
 107         debug("SSH2_MSG_KEX_DH_GEX_GROUP sent");
 108         DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
 109         if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_GROUP)) != 0 ||
 110             (r = sshpkt_put_bignum2(ssh, dh_p)) != 0 ||
 111             (r = sshpkt_put_bignum2(ssh, dh_g)) != 0 ||
 112             (r = sshpkt_send(ssh)) != 0)
 113                 goto out;
 114
 115         /* Compute our exchange value in parallel with the client */
 116         if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
 117                 goto out;
 118
 119         debug("expecting SSH2_MSG_KEX_DH_GEX_INIT");
 120         ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_INIT, &input_kex_dh_gex_init);
 121         r = 0;
 122  out:
 123         return r;
 124 }
 125
 126 static int
 127 input_kex_dh_gex_init(int type, u_int32_t seq, struct ssh *ssh)
 128 {
 129         struct kex *kex = ssh->kex;
 130         BIGNUM *dh_client_pub = NULL;
 131         const BIGNUM *pub_key, *dh_p, *dh_g;
 132         struct sshbuf *shared_secret = NULL;
 133         struct sshbuf *server_host_key_blob = NULL;
 134         struct sshkey *server_host_public, *server_host_private;
 135         u_char *signature = NULL;
 136         u_char hash[SSH_DIGEST_MAX_LENGTH];
 137         size_t slen, hashlen;
 138         int r;
 139
 140         debug("SSH2_MSG_KEX_DH_GEX_INIT received");
 141         ssh_dispatch_set(ssh, SSH2_MSG_KEX_DH_GEX_INIT, &kex_protocol_error);
 142
 143         if ((r = kex_load_hostkey(ssh, &server_host_private,
 144             &server_host_public)) != 0)
 145                 goto out;
 146
 147         /* key, cert */
 148         if ((r = sshpkt_get_bignum2(ssh, &dh_client_pub)) != 0 ||
 149             (r = sshpkt_get_end(ssh)) != 0)
 150                 goto out;
 151         if ((shared_secret = sshbuf_new()) == NULL) {
 152                 r = SSH_ERR_ALLOC_FAIL;
 153                 goto out;
 154         }
 155         if ((r = kex_dh_compute_key(kex, dh_client_pub, shared_secret)) != 0)
 156                 goto out;
 157         if ((server_host_key_blob = sshbuf_new()) == NULL) {
 158                 r = SSH_ERR_ALLOC_FAIL;
 159                 goto out;
 160         }
 161         if ((r = sshkey_putb(server_host_public, server_host_key_blob)) != 0)
 162                 goto out;
 163
 164         /* calc H */
 165         DH_get0_key(kex->dh, &pub_key, NULL);
 166         DH_get0_pqg(kex->dh, &dh_p, NULL, &dh_g);
 167         hashlen = sizeof(hash);
 168         if ((r = kexgex_hash(
 169             kex->hash_alg,
 170             kex->client_version,
 171             kex->server_version,
 172             kex->peer,
 173             kex->my,
 174             server_host_key_blob,
 175             kex->min, kex->nbits, kex->max,
 176             dh_p, dh_g,
 177             dh_client_pub,
 178             pub_key,
 179             sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
 180             hash, &hashlen)) != 0)
 181                 goto out;
 182
 183         /* sign H */
 184         if ((r = kex->sign(ssh, server_host_private, server_host_public,
 185             &signature, &slen, hash, hashlen, kex->hostkey_alg)) < 0)
 186                 goto out;
 187
 188         /* send server hostkey, DH pubkey 'f' and signed H */
 189         if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_DH_GEX_REPLY)) != 0 ||
 190             (r = sshpkt_put_stringb(ssh, server_host_key_blob)) != 0 ||
 191             (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||     /* f */
 192             (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
 193             (r = sshpkt_send(ssh)) != 0)
 194                 goto out;
 195
 196         if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) != 0 ||
 197             (r = kex_send_newkeys(ssh)) != 0)
 198                 goto out;
 199
 200         /* retain copy of hostkey used at initial KEX */
 201         if (kex->initial_hostkey == NULL &&
 202             (r = sshkey_from_private(server_host_public,
 203             &kex->initial_hostkey)) != 0)
 204                 goto out;
 205         /* success */
 206  out:
 207         explicit_bzero(hash, sizeof(hash));
 208         DH_free(kex->dh);
 209         kex->dh = NULL;
 210         BN_clear_free(dh_client_pub);
 211         sshbuf_free(shared_secret);
 212         sshbuf_free(server_host_key_blob);
 213         free(signature);
 214         return r;
 215 }
 216 #endif /* WITH_OPENSSL */