1 /* $OpenBSD: cipher.c,v 1.103 2017/04/30 23:10:43 djm Exp $ */ 2 /* 3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * 7 * As far as I am concerned, the code I have written for this software 8 * can be used freely for any purpose. Any derived versions of this 9 * software must be clearly marked as such, and if the derived work is 10 * incompatible with the protocol description in the RFC file, it must be 11 * called by a name other than "ssh" or "Secure Shell". 12 * 13 * 14 * Copyright (c) 1999 Niels Provos. All rights reserved. 15 * Copyright (c) 1999, 2000 Markus Friedl. All rights reserved. 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions 19 * are met: 20 * 1. Redistributions of source code must retain the above copyright 21 * notice, this list of conditions and the following disclaimer. 22 * 2. Redistributions in binary form must reproduce the above copyright 23 * notice, this list of conditions and the following disclaimer in the 24 * documentation and/or other materials provided with the distribution. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 27 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 28 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 30 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 31 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 32 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 33 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 34 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36 */ 37 38 #include "includes.h" 39 40 #include <sys/types.h> 41 42 #include <string.h> 43 #include <stdarg.h> 44 #include <stdio.h> 45 46 #include "cipher.h" 47 #include "misc.h" 48 #include "sshbuf.h" 49 #include "ssherr.h" 50 #include "digest.h" 51 52 #include "openbsd-compat/openssl-compat.h" 53 54 55 struct sshcipher_ctx { 56 int plaintext; 57 int encrypt; 58 EVP_CIPHER_CTX *evp; 59 struct chachapoly_ctx cp_ctx; /* XXX union with evp? */ 60 struct aesctr_ctx ac_ctx; /* XXX union with evp? */ 61 const struct sshcipher *cipher; 62 }; 63 64 struct sshcipher { 65 char *name; 66 int number; /* for ssh1 only */ 67 u_int block_size; 68 u_int key_len; 69 u_int iv_len; /* defaults to block_size */ 70 u_int auth_len; 71 u_int discard_len; 72 u_int flags; 73 #define CFLAG_CBC (1<<0) 74 #define CFLAG_CHACHAPOLY (1<<1) 75 #define CFLAG_AESCTR (1<<2) 76 #define CFLAG_NONE (1<<3) 77 #ifdef WITH_OPENSSL 78 const EVP_CIPHER *(*evptype)(void); 79 #else 80 void *ignored; 81 #endif 82 }; 83 84 static const struct sshcipher ciphers[] = { 85 #ifdef WITH_OPENSSL 86 { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null }, 87 { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc }, 88 # ifndef OPENSSL_NO_BF 89 { "blowfish-cbc", 90 SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_bf_cbc }, 91 # endif /* OPENSSL_NO_BF */ 92 # ifndef OPENSSL_NO_CAST 93 { "cast128-cbc", 94 SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_cast5_cbc }, 95 # endif /* OPENSSL_NO_CAST */ 96 # ifndef OPENSSL_NO_RC4 97 { "arcfour", SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 0, EVP_rc4 }, 98 { "arcfour128", SSH_CIPHER_SSH2, 8, 16, 0, 0, 1536, 0, EVP_rc4 }, 99 { "arcfour256", SSH_CIPHER_SSH2, 8, 32, 0, 0, 1536, 0, EVP_rc4 }, 100 # endif /* OPENSSL_NO_RC4 */ 101 { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc }, 102 { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc }, 103 { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc }, 104 { "rijndael-cbc@lysator.liu.se", 105 SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc }, 106 { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr }, 107 { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_192_ctr }, 108 { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_256_ctr }, 109 # ifdef OPENSSL_HAVE_EVPGCM 110 { "aes128-gcm@openssh.com", 111 SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm }, 112 { "aes256-gcm@openssh.com", 113 SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm }, 114 # endif /* OPENSSL_HAVE_EVPGCM */ 115 #else /* WITH_OPENSSL */ 116 { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, CFLAG_AESCTR, NULL }, 117 { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, CFLAG_AESCTR, NULL }, 118 { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, CFLAG_AESCTR, NULL }, 119 { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, CFLAG_NONE, NULL }, 120 #endif /* WITH_OPENSSL */ 121 { "chacha20-poly1305@openssh.com", 122 SSH_CIPHER_SSH2, 8, 64, 0, 16, 0, CFLAG_CHACHAPOLY, NULL }, 123 124 { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL } 125 }; 126 127 /*--*/ 128 129 /* Returns a comma-separated list of supported ciphers. */ 130 char * 131 cipher_alg_list(char sep, int auth_only) 132 { 133 char *tmp, *ret = NULL; 134 size_t nlen, rlen = 0; 135 const struct sshcipher *c; 136 137 for (c = ciphers; c->name != NULL; c++) { 138 if (c->number != SSH_CIPHER_SSH2) 139 continue; 140 if (auth_only && c->auth_len == 0) 141 continue; 142 if (ret != NULL) 143 ret[rlen++] = sep; 144 nlen = strlen(c->name); 145 if ((tmp = realloc(ret, rlen + nlen + 2)) == NULL) { 146 free(ret); 147 return NULL; 148 } 149 ret = tmp; 150 memcpy(ret + rlen, c->name, nlen + 1); 151 rlen += nlen; 152 } 153 return ret; 154 } 155 156 u_int 157 cipher_blocksize(const struct sshcipher *c) 158 { 159 return (c->block_size); 160 } 161 162 u_int 163 cipher_keylen(const struct sshcipher *c) 164 { 165 return (c->key_len); 166 } 167 168 u_int 169 cipher_seclen(const struct sshcipher *c) 170 { 171 if (strcmp("3des-cbc", c->name) == 0) 172 return 14; 173 return cipher_keylen(c); 174 } 175 176 u_int 177 cipher_authlen(const struct sshcipher *c) 178 { 179 return (c->auth_len); 180 } 181 182 u_int 183 cipher_ivlen(const struct sshcipher *c) 184 { 185 /* 186 * Default is cipher block size, except for chacha20+poly1305 that 187 * needs no IV. XXX make iv_len == -1 default? 188 */ 189 return (c->iv_len != 0 || (c->flags & CFLAG_CHACHAPOLY) != 0) ? 190 c->iv_len : c->block_size; 191 } 192 193 u_int 194 cipher_get_number(const struct sshcipher *c) 195 { 196 return (c->number); 197 } 198 199 u_int 200 cipher_is_cbc(const struct sshcipher *c) 201 { 202 return (c->flags & CFLAG_CBC) != 0; 203 } 204 205 u_int 206 cipher_ctx_is_plaintext(struct sshcipher_ctx *cc) 207 { 208 return cc->plaintext; 209 } 210 211 u_int 212 cipher_ctx_get_number(struct sshcipher_ctx *cc) 213 { 214 return cc->cipher->number; 215 } 216 217 u_int 218 cipher_mask_ssh1(int client) 219 { 220 u_int mask = 0; 221 mask |= 1 << SSH_CIPHER_3DES; /* Mandatory */ 222 mask |= 1 << SSH_CIPHER_BLOWFISH; 223 if (client) { 224 mask |= 1 << SSH_CIPHER_DES; 225 } 226 return mask; 227 } 228 229 const struct sshcipher * 230 cipher_by_name(const char *name) 231 { 232 const struct sshcipher *c; 233 for (c = ciphers; c->name != NULL; c++) 234 if (strcmp(c->name, name) == 0) 235 return c; 236 return NULL; 237 } 238 239 const struct sshcipher * 240 cipher_by_number(int id) 241 { 242 const struct sshcipher *c; 243 for (c = ciphers; c->name != NULL; c++) 244 if (c->number == id) 245 return c; 246 return NULL; 247 } 248 249 #define CIPHER_SEP "," 250 int 251 ciphers_valid(const char *names) 252 { 253 const struct sshcipher *c; 254 char *cipher_list, *cp; 255 char *p; 256 257 if (names == NULL || strcmp(names, "") == 0) 258 return 0; 259 if ((cipher_list = cp = strdup(names)) == NULL) 260 return 0; 261 for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0'; 262 (p = strsep(&cp, CIPHER_SEP))) { 263 c = cipher_by_name(p); 264 if (c == NULL || c->number != SSH_CIPHER_SSH2) { 265 free(cipher_list); 266 return 0; 267 } 268 } 269 free(cipher_list); 270 return 1; 271 } 272 273 /* 274 * Parses the name of the cipher. Returns the number of the corresponding 275 * cipher, or -1 on error. 276 */ 277 278 int 279 cipher_number(const char *name) 280 { 281 const struct sshcipher *c; 282 if (name == NULL) 283 return -1; 284 for (c = ciphers; c->name != NULL; c++) 285 if (strcasecmp(c->name, name) == 0) 286 return c->number; 287 return -1; 288 } 289 290 char * 291 cipher_name(int id) 292 { 293 const struct sshcipher *c = cipher_by_number(id); 294 return (c==NULL) ? "<unknown>" : c->name; 295 } 296 297 const char * 298 cipher_warning_message(const struct sshcipher_ctx *cc) 299 { 300 if (cc == NULL || cc->cipher == NULL) 301 return NULL; 302 if (cc->cipher->number == SSH_CIPHER_DES) 303 return "use of DES is strongly discouraged due to " 304 "cryptographic weaknesses"; 305 return NULL; 306 } 307 308 int 309 cipher_init(struct sshcipher_ctx **ccp, const struct sshcipher *cipher, 310 const u_char *key, u_int keylen, const u_char *iv, u_int ivlen, 311 int do_encrypt) 312 { 313 struct sshcipher_ctx *cc = NULL; 314 int ret = SSH_ERR_INTERNAL_ERROR; 315 #ifdef WITH_OPENSSL 316 const EVP_CIPHER *type; 317 int klen; 318 u_char *junk, *discard; 319 #endif 320 321 *ccp = NULL; 322 if ((cc = calloc(sizeof(*cc), 1)) == NULL) 323 return SSH_ERR_ALLOC_FAIL; 324 325 if (cipher->number == SSH_CIPHER_DES) { 326 if (keylen > 8) 327 keylen = 8; 328 } 329 330 cc->plaintext = (cipher->number == SSH_CIPHER_NONE); 331 cc->encrypt = do_encrypt; 332 333 if (keylen < cipher->key_len || 334 (iv != NULL && ivlen < cipher_ivlen(cipher))) { 335 ret = SSH_ERR_INVALID_ARGUMENT; 336 goto out; 337 } 338 339 cc->cipher = cipher; 340 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) { 341 ret = chachapoly_init(&cc->cp_ctx, key, keylen); 342 goto out; 343 } 344 #ifndef WITH_OPENSSL 345 if ((cc->cipher->flags & CFLAG_AESCTR) != 0) { 346 aesctr_keysetup(&cc->ac_ctx, key, 8 * keylen, 8 * ivlen); 347 aesctr_ivsetup(&cc->ac_ctx, iv); 348 ret = 0; 349 goto out; 350 } 351 if ((cc->cipher->flags & CFLAG_NONE) != 0) { 352 ret = 0; 353 goto out; 354 } 355 ret = SSH_ERR_INVALID_ARGUMENT; 356 goto out; 357 #else /* WITH_OPENSSL */ 358 type = (*cipher->evptype)(); 359 if ((cc->evp = EVP_CIPHER_CTX_new()) == NULL) { 360 ret = SSH_ERR_ALLOC_FAIL; 361 goto out; 362 } 363 if (EVP_CipherInit(cc->evp, type, NULL, (u_char *)iv, 364 (do_encrypt == CIPHER_ENCRYPT)) == 0) { 365 ret = SSH_ERR_LIBCRYPTO_ERROR; 366 goto out; 367 } 368 if (cipher_authlen(cipher) && 369 !EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_SET_IV_FIXED, 370 -1, (u_char *)iv)) { 371 ret = SSH_ERR_LIBCRYPTO_ERROR; 372 goto out; 373 } 374 klen = EVP_CIPHER_CTX_key_length(cc->evp); 375 if (klen > 0 && keylen != (u_int)klen) { 376 if (EVP_CIPHER_CTX_set_key_length(cc->evp, keylen) == 0) { 377 ret = SSH_ERR_LIBCRYPTO_ERROR; 378 goto out; 379 } 380 } 381 if (EVP_CipherInit(cc->evp, NULL, (u_char *)key, NULL, -1) == 0) { 382 ret = SSH_ERR_LIBCRYPTO_ERROR; 383 goto out; 384 } 385 386 if (cipher->discard_len > 0) { 387 if ((junk = malloc(cipher->discard_len)) == NULL || 388 (discard = malloc(cipher->discard_len)) == NULL) { 389 free(junk); 390 ret = SSH_ERR_ALLOC_FAIL; 391 goto out; 392 } 393 ret = EVP_Cipher(cc->evp, discard, junk, cipher->discard_len); 394 explicit_bzero(discard, cipher->discard_len); 395 free(junk); 396 free(discard); 397 if (ret != 1) { 398 ret = SSH_ERR_LIBCRYPTO_ERROR; 399 goto out; 400 } 401 } 402 ret = 0; 403 #endif /* WITH_OPENSSL */ 404 out: 405 if (ret == 0) { 406 /* success */ 407 *ccp = cc; 408 } else { 409 if (cc != NULL) { 410 #ifdef WITH_OPENSSL 411 if (cc->evp != NULL) 412 EVP_CIPHER_CTX_free(cc->evp); 413 #endif /* WITH_OPENSSL */ 414 explicit_bzero(cc, sizeof(*cc)); 415 free(cc); 416 } 417 } 418 return ret; 419 } 420 421 /* 422 * cipher_crypt() operates as following: 423 * Copy 'aadlen' bytes (without en/decryption) from 'src' to 'dest'. 424 * Theses bytes are treated as additional authenticated data for 425 * authenticated encryption modes. 426 * En/Decrypt 'len' bytes at offset 'aadlen' from 'src' to 'dest'. 427 * Use 'authlen' bytes at offset 'len'+'aadlen' as the authentication tag. 428 * This tag is written on encryption and verified on decryption. 429 * Both 'aadlen' and 'authlen' can be set to 0. 430 */ 431 int 432 cipher_crypt(struct sshcipher_ctx *cc, u_int seqnr, u_char *dest, 433 const u_char *src, u_int len, u_int aadlen, u_int authlen) 434 { 435 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) { 436 return chachapoly_crypt(&cc->cp_ctx, seqnr, dest, src, 437 len, aadlen, authlen, cc->encrypt); 438 } 439 #ifndef WITH_OPENSSL 440 if ((cc->cipher->flags & CFLAG_AESCTR) != 0) { 441 if (aadlen) 442 memcpy(dest, src, aadlen); 443 aesctr_encrypt_bytes(&cc->ac_ctx, src + aadlen, 444 dest + aadlen, len); 445 return 0; 446 } 447 if ((cc->cipher->flags & CFLAG_NONE) != 0) { 448 memcpy(dest, src, aadlen + len); 449 return 0; 450 } 451 return SSH_ERR_INVALID_ARGUMENT; 452 #else 453 if (authlen) { 454 u_char lastiv[1]; 455 456 if (authlen != cipher_authlen(cc->cipher)) 457 return SSH_ERR_INVALID_ARGUMENT; 458 /* increment IV */ 459 if (!EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_IV_GEN, 460 1, lastiv)) 461 return SSH_ERR_LIBCRYPTO_ERROR; 462 /* set tag on decyption */ 463 if (!cc->encrypt && 464 !EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_SET_TAG, 465 authlen, (u_char *)src + aadlen + len)) 466 return SSH_ERR_LIBCRYPTO_ERROR; 467 } 468 if (aadlen) { 469 if (authlen && 470 EVP_Cipher(cc->evp, NULL, (u_char *)src, aadlen) < 0) 471 return SSH_ERR_LIBCRYPTO_ERROR; 472 memcpy(dest, src, aadlen); 473 } 474 if (len % cc->cipher->block_size) 475 return SSH_ERR_INVALID_ARGUMENT; 476 if (EVP_Cipher(cc->evp, dest + aadlen, (u_char *)src + aadlen, 477 len) < 0) 478 return SSH_ERR_LIBCRYPTO_ERROR; 479 if (authlen) { 480 /* compute tag (on encrypt) or verify tag (on decrypt) */ 481 if (EVP_Cipher(cc->evp, NULL, NULL, 0) < 0) 482 return cc->encrypt ? 483 SSH_ERR_LIBCRYPTO_ERROR : SSH_ERR_MAC_INVALID; 484 if (cc->encrypt && 485 !EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_GET_TAG, 486 authlen, dest + aadlen + len)) 487 return SSH_ERR_LIBCRYPTO_ERROR; 488 } 489 return 0; 490 #endif 491 } 492 493 /* Extract the packet length, including any decryption necessary beforehand */ 494 int 495 cipher_get_length(struct sshcipher_ctx *cc, u_int *plenp, u_int seqnr, 496 const u_char *cp, u_int len) 497 { 498 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) 499 return chachapoly_get_length(&cc->cp_ctx, plenp, seqnr, 500 cp, len); 501 if (len < 4) 502 return SSH_ERR_MESSAGE_INCOMPLETE; 503 *plenp = get_u32(cp); 504 return 0; 505 } 506 507 void 508 cipher_free(struct sshcipher_ctx *cc) 509 { 510 if (cc == NULL) 511 return; 512 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) 513 explicit_bzero(&cc->cp_ctx, sizeof(cc->cp_ctx)); 514 else if ((cc->cipher->flags & CFLAG_AESCTR) != 0) 515 explicit_bzero(&cc->ac_ctx, sizeof(cc->ac_ctx)); 516 #ifdef WITH_OPENSSL 517 if (cc->evp != NULL) { 518 EVP_CIPHER_CTX_free(cc->evp); 519 cc->evp = NULL; 520 } 521 #endif 522 explicit_bzero(cc, sizeof(*cc)); 523 free(cc); 524 } 525 526 /* 527 * Selects the cipher, and keys if by computing the MD5 checksum of the 528 * passphrase and using the resulting 16 bytes as the key. 529 */ 530 int 531 cipher_set_key_string(struct sshcipher_ctx **ccp, 532 const struct sshcipher *cipher, const char *passphrase, int do_encrypt) 533 { 534 u_char digest[16]; 535 int r = SSH_ERR_INTERNAL_ERROR; 536 537 if ((r = ssh_digest_memory(SSH_DIGEST_MD5, 538 passphrase, strlen(passphrase), 539 digest, sizeof(digest))) != 0) 540 goto out; 541 542 r = cipher_init(ccp, cipher, digest, 16, NULL, 0, do_encrypt); 543 out: 544 explicit_bzero(digest, sizeof(digest)); 545 return r; 546 } 547 548 /* 549 * Exports an IV from the sshcipher_ctx required to export the key 550 * state back from the unprivileged child to the privileged parent 551 * process. 552 */ 553 int 554 cipher_get_keyiv_len(const struct sshcipher_ctx *cc) 555 { 556 const struct sshcipher *c = cc->cipher; 557 int ivlen = 0; 558 559 if (c->number == SSH_CIPHER_3DES) 560 ivlen = 24; 561 else if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) 562 ivlen = 0; 563 else if ((cc->cipher->flags & CFLAG_AESCTR) != 0) 564 ivlen = sizeof(cc->ac_ctx.ctr); 565 #ifdef WITH_OPENSSL 566 else 567 ivlen = EVP_CIPHER_CTX_iv_length(cc->evp); 568 #endif /* WITH_OPENSSL */ 569 return (ivlen); 570 } 571 572 int 573 cipher_get_keyiv(struct sshcipher_ctx *cc, u_char *iv, u_int len) 574 { 575 const struct sshcipher *c = cc->cipher; 576 #ifdef WITH_OPENSSL 577 int evplen; 578 #endif 579 580 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) { 581 if (len != 0) 582 return SSH_ERR_INVALID_ARGUMENT; 583 return 0; 584 } 585 if ((cc->cipher->flags & CFLAG_AESCTR) != 0) { 586 if (len != sizeof(cc->ac_ctx.ctr)) 587 return SSH_ERR_INVALID_ARGUMENT; 588 memcpy(iv, cc->ac_ctx.ctr, len); 589 return 0; 590 } 591 if ((cc->cipher->flags & CFLAG_NONE) != 0) 592 return 0; 593 594 switch (c->number) { 595 #ifdef WITH_OPENSSL 596 case SSH_CIPHER_SSH2: 597 case SSH_CIPHER_DES: 598 case SSH_CIPHER_BLOWFISH: 599 evplen = EVP_CIPHER_CTX_iv_length(cc->evp); 600 if (evplen == 0) 601 return 0; 602 else if (evplen < 0) 603 return SSH_ERR_LIBCRYPTO_ERROR; 604 if ((u_int)evplen != len) 605 return SSH_ERR_INVALID_ARGUMENT; 606 #ifndef OPENSSL_HAVE_EVPCTR 607 if (c->evptype == evp_aes_128_ctr) 608 ssh_aes_ctr_iv(cc->evp, 0, iv, len); 609 else 610 #endif 611 if (cipher_authlen(c)) { 612 if (!EVP_CIPHER_CTX_ctrl(cc->evp, EVP_CTRL_GCM_IV_GEN, 613 len, iv)) 614 return SSH_ERR_LIBCRYPTO_ERROR; 615 } else 616 memcpy(iv, cc->evp->iv, len); 617 break; 618 #endif 619 default: 620 return SSH_ERR_INVALID_ARGUMENT; 621 } 622 return 0; 623 } 624 625 int 626 cipher_set_keyiv(struct sshcipher_ctx *cc, const u_char *iv) 627 { 628 const struct sshcipher *c = cc->cipher; 629 #ifdef WITH_OPENSSL 630 int evplen = 0; 631 #endif 632 633 if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) 634 return 0; 635 if ((cc->cipher->flags & CFLAG_NONE) != 0) 636 return 0; 637 638 switch (c->number) { 639 #ifdef WITH_OPENSSL 640 case SSH_CIPHER_SSH2: 641 case SSH_CIPHER_DES: 642 case SSH_CIPHER_BLOWFISH: 643 evplen = EVP_CIPHER_CTX_iv_length(cc->evp); 644 if (evplen <= 0) 645 return SSH_ERR_LIBCRYPTO_ERROR; 646 #ifndef OPENSSL_HAVE_EVPCTR 647 /* XXX iv arg is const, but ssh_aes_ctr_iv isn't */ 648 if (c->evptype == evp_aes_128_ctr) 649 ssh_aes_ctr_iv(cc->evp, 1, (u_char *)iv, evplen); 650 else 651 #endif 652 if (cipher_authlen(c)) { 653 /* XXX iv arg is const, but EVP_CIPHER_CTX_ctrl isn't */ 654 if (!EVP_CIPHER_CTX_ctrl(cc->evp, 655 EVP_CTRL_GCM_SET_IV_FIXED, -1, (void *)iv)) 656 return SSH_ERR_LIBCRYPTO_ERROR; 657 } else 658 memcpy(cc->evp->iv, iv, evplen); 659 break; 660 #endif 661 default: 662 return SSH_ERR_INVALID_ARGUMENT; 663 } 664 return 0; 665 } 666 667 #ifdef WITH_OPENSSL 668 #define EVP_X_STATE(evp) (evp)->cipher_data 669 #define EVP_X_STATE_LEN(evp) (evp)->cipher->ctx_size 670 #endif 671 672 int 673 cipher_get_keycontext(const struct sshcipher_ctx *cc, u_char *dat) 674 { 675 #if defined(WITH_OPENSSL) && !defined(OPENSSL_NO_RC4) 676 const struct sshcipher *c = cc->cipher; 677 int plen = 0; 678 679 if (c->evptype == EVP_rc4) { 680 plen = EVP_X_STATE_LEN(cc->evp); 681 if (dat == NULL) 682 return (plen); 683 memcpy(dat, EVP_X_STATE(cc->evp), plen); 684 } 685 return (plen); 686 #else 687 return 0; 688 #endif 689 } 690 691 void 692 cipher_set_keycontext(struct sshcipher_ctx *cc, const u_char *dat) 693 { 694 #if defined(WITH_OPENSSL) && !defined(OPENSSL_NO_RC4) 695 const struct sshcipher *c = cc->cipher; 696 int plen; 697 698 if (c->evptype == EVP_rc4) { 699 plen = EVP_X_STATE_LEN(cc->evp); 700 memcpy(EVP_X_STATE(cc->evp), dat, plen); 701 } 702 #endif 703 } 704