xref: /openssh-portable/kexgen.c (revision 2c71cec0)
1 /* $OpenBSD: kexgen.c,v 1.5 2020/12/29 00:59:15 djm Exp $ */
2 /*
3  * Copyright (c) 2019 Markus Friedl.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include "includes.h"
27 
28 #include <sys/types.h>
29 
30 #include <stdarg.h>
31 #include <stdio.h>
32 #include <string.h>
33 #include <signal.h>
34 
35 #include "sshkey.h"
36 #include "kex.h"
37 #include "log.h"
38 #include "packet.h"
39 #include "ssh2.h"
40 #include "sshbuf.h"
41 #include "digest.h"
42 #include "ssherr.h"
43 
44 static int input_kex_gen_init(int, u_int32_t, struct ssh *);
45 static int input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh);
46 
47 static int
kex_gen_hash(int hash_alg,const struct sshbuf * client_version,const struct sshbuf * server_version,const struct sshbuf * client_kexinit,const struct sshbuf * server_kexinit,const struct sshbuf * server_host_key_blob,const struct sshbuf * client_pub,const struct sshbuf * server_pub,const struct sshbuf * shared_secret,u_char * hash,size_t * hashlen)48 kex_gen_hash(
49     int hash_alg,
50     const struct sshbuf *client_version,
51     const struct sshbuf *server_version,
52     const struct sshbuf *client_kexinit,
53     const struct sshbuf *server_kexinit,
54     const struct sshbuf *server_host_key_blob,
55     const struct sshbuf *client_pub,
56     const struct sshbuf *server_pub,
57     const struct sshbuf *shared_secret,
58     u_char *hash, size_t *hashlen)
59 {
60 	struct sshbuf *b;
61 	int r;
62 
63 	if (*hashlen < ssh_digest_bytes(hash_alg))
64 		return SSH_ERR_INVALID_ARGUMENT;
65 	if ((b = sshbuf_new()) == NULL)
66 		return SSH_ERR_ALLOC_FAIL;
67 	if ((r = sshbuf_put_stringb(b, client_version)) != 0 ||
68 	    (r = sshbuf_put_stringb(b, server_version)) != 0 ||
69 	    /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
70 	    (r = sshbuf_put_u32(b, sshbuf_len(client_kexinit) + 1)) != 0 ||
71 	    (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
72 	    (r = sshbuf_putb(b, client_kexinit)) != 0 ||
73 	    (r = sshbuf_put_u32(b, sshbuf_len(server_kexinit) + 1)) != 0 ||
74 	    (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
75 	    (r = sshbuf_putb(b, server_kexinit)) != 0 ||
76 	    (r = sshbuf_put_stringb(b, server_host_key_blob)) != 0 ||
77 	    (r = sshbuf_put_stringb(b, client_pub)) != 0 ||
78 	    (r = sshbuf_put_stringb(b, server_pub)) != 0 ||
79 	    (r = sshbuf_putb(b, shared_secret)) != 0) {
80 		sshbuf_free(b);
81 		return r;
82 	}
83 #ifdef DEBUG_KEX
84 	sshbuf_dump(b, stderr);
85 #endif
86 	if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
87 		sshbuf_free(b);
88 		return SSH_ERR_LIBCRYPTO_ERROR;
89 	}
90 	sshbuf_free(b);
91 	*hashlen = ssh_digest_bytes(hash_alg);
92 #ifdef DEBUG_KEX
93 	dump_digest("hash", hash, *hashlen);
94 #endif
95 	return 0;
96 }
97 
98 int
kex_gen_client(struct ssh * ssh)99 kex_gen_client(struct ssh *ssh)
100 {
101 	struct kex *kex = ssh->kex;
102 	int r;
103 
104 	switch (kex->kex_type) {
105 #ifdef WITH_OPENSSL
106 	case KEX_DH_GRP1_SHA1:
107 	case KEX_DH_GRP14_SHA1:
108 	case KEX_DH_GRP14_SHA256:
109 	case KEX_DH_GRP16_SHA512:
110 	case KEX_DH_GRP18_SHA512:
111 		r = kex_dh_keypair(kex);
112 		break;
113 	case KEX_ECDH_SHA2:
114 		r = kex_ecdh_keypair(kex);
115 		break;
116 #endif
117 	case KEX_C25519_SHA256:
118 		r = kex_c25519_keypair(kex);
119 		break;
120 	case KEX_KEM_SNTRUP761X25519_SHA512:
121 		r = kex_kem_sntrup761x25519_keypair(kex);
122 		break;
123 	default:
124 		r = SSH_ERR_INVALID_ARGUMENT;
125 		break;
126 	}
127 	if (r != 0)
128 		return r;
129 	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 ||
130 	    (r = sshpkt_put_stringb(ssh, kex->client_pub)) != 0 ||
131 	    (r = sshpkt_send(ssh)) != 0)
132 		return r;
133 	debug("expecting SSH2_MSG_KEX_ECDH_REPLY");
134 	ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_gen_reply);
135 	return 0;
136 }
137 
138 static int
input_kex_gen_reply(int type,u_int32_t seq,struct ssh * ssh)139 input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh)
140 {
141 	struct kex *kex = ssh->kex;
142 	struct sshkey *server_host_key = NULL;
143 	struct sshbuf *shared_secret = NULL;
144 	struct sshbuf *server_blob = NULL;
145 	struct sshbuf *tmp = NULL, *server_host_key_blob = NULL;
146 	u_char *signature = NULL;
147 	u_char hash[SSH_DIGEST_MAX_LENGTH];
148 	size_t slen, hashlen;
149 	int r;
150 
151 	/* hostkey */
152 	if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
153 		goto out;
154 	/* sshkey_fromb() consumes its buffer, so make a copy */
155 	if ((tmp = sshbuf_fromb(server_host_key_blob)) == NULL) {
156 		r = SSH_ERR_ALLOC_FAIL;
157 		goto out;
158 	}
159 	if ((r = sshkey_fromb(tmp, &server_host_key)) != 0)
160 		goto out;
161 	if ((r = kex_verify_host_key(ssh, server_host_key)) != 0)
162 		goto out;
163 
164 	/* Q_S, server public key */
165 	/* signed H */
166 	if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 ||
167 	    (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
168 	    (r = sshpkt_get_end(ssh)) != 0)
169 		goto out;
170 
171 	/* compute shared secret */
172 	switch (kex->kex_type) {
173 #ifdef WITH_OPENSSL
174 	case KEX_DH_GRP1_SHA1:
175 	case KEX_DH_GRP14_SHA1:
176 	case KEX_DH_GRP14_SHA256:
177 	case KEX_DH_GRP16_SHA512:
178 	case KEX_DH_GRP18_SHA512:
179 		r = kex_dh_dec(kex, server_blob, &shared_secret);
180 		break;
181 	case KEX_ECDH_SHA2:
182 		r = kex_ecdh_dec(kex, server_blob, &shared_secret);
183 		break;
184 #endif
185 	case KEX_C25519_SHA256:
186 		r = kex_c25519_dec(kex, server_blob, &shared_secret);
187 		break;
188 	case KEX_KEM_SNTRUP761X25519_SHA512:
189 		r = kex_kem_sntrup761x25519_dec(kex, server_blob,
190 		    &shared_secret);
191 		break;
192 	default:
193 		r = SSH_ERR_INVALID_ARGUMENT;
194 		break;
195 	}
196 	if (r !=0 )
197 		goto out;
198 
199 	/* calc and verify H */
200 	hashlen = sizeof(hash);
201 	if ((r = kex_gen_hash(
202 	    kex->hash_alg,
203 	    kex->client_version,
204 	    kex->server_version,
205 	    kex->my,
206 	    kex->peer,
207 	    server_host_key_blob,
208 	    kex->client_pub,
209 	    server_blob,
210 	    shared_secret,
211 	    hash, &hashlen)) != 0)
212 		goto out;
213 
214 	if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,
215 	    kex->hostkey_alg, ssh->compat, NULL)) != 0)
216 		goto out;
217 
218 	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
219 		r = kex_send_newkeys(ssh);
220 out:
221 	explicit_bzero(hash, sizeof(hash));
222 	explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
223 	explicit_bzero(kex->sntrup761_client_key,
224 	    sizeof(kex->sntrup761_client_key));
225 	sshbuf_free(server_host_key_blob);
226 	free(signature);
227 	sshbuf_free(tmp);
228 	sshkey_free(server_host_key);
229 	sshbuf_free(server_blob);
230 	sshbuf_free(shared_secret);
231 	sshbuf_free(kex->client_pub);
232 	kex->client_pub = NULL;
233 	return r;
234 }
235 
236 int
kex_gen_server(struct ssh * ssh)237 kex_gen_server(struct ssh *ssh)
238 {
239 	debug("expecting SSH2_MSG_KEX_ECDH_INIT");
240 	ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_gen_init);
241 	return 0;
242 }
243 
244 static int
input_kex_gen_init(int type,u_int32_t seq,struct ssh * ssh)245 input_kex_gen_init(int type, u_int32_t seq, struct ssh *ssh)
246 {
247 	struct kex *kex = ssh->kex;
248 	struct sshkey *server_host_private, *server_host_public;
249 	struct sshbuf *shared_secret = NULL;
250 	struct sshbuf *server_pubkey = NULL;
251 	struct sshbuf *client_pubkey = NULL;
252 	struct sshbuf *server_host_key_blob = NULL;
253 	u_char *signature = NULL, hash[SSH_DIGEST_MAX_LENGTH];
254 	size_t slen, hashlen;
255 	int r;
256 
257 	if ((r = kex_load_hostkey(ssh, &server_host_private,
258 	    &server_host_public)) != 0)
259 		goto out;
260 
261 	if ((r = sshpkt_getb_froms(ssh, &client_pubkey)) != 0 ||
262 	    (r = sshpkt_get_end(ssh)) != 0)
263 		goto out;
264 
265 	/* compute shared secret */
266 	switch (kex->kex_type) {
267 #ifdef WITH_OPENSSL
268 	case KEX_DH_GRP1_SHA1:
269 	case KEX_DH_GRP14_SHA1:
270 	case KEX_DH_GRP14_SHA256:
271 	case KEX_DH_GRP16_SHA512:
272 	case KEX_DH_GRP18_SHA512:
273 		r = kex_dh_enc(kex, client_pubkey, &server_pubkey,
274 		    &shared_secret);
275 		break;
276 	case KEX_ECDH_SHA2:
277 		r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey,
278 		    &shared_secret);
279 		break;
280 #endif
281 	case KEX_C25519_SHA256:
282 		r = kex_c25519_enc(kex, client_pubkey, &server_pubkey,
283 		    &shared_secret);
284 		break;
285 	case KEX_KEM_SNTRUP761X25519_SHA512:
286 		r = kex_kem_sntrup761x25519_enc(kex, client_pubkey,
287 		    &server_pubkey, &shared_secret);
288 		break;
289 	default:
290 		r = SSH_ERR_INVALID_ARGUMENT;
291 		break;
292 	}
293 	if (r !=0 )
294 		goto out;
295 
296 	/* calc H */
297 	if ((server_host_key_blob = sshbuf_new()) == NULL) {
298 		r = SSH_ERR_ALLOC_FAIL;
299 		goto out;
300 	}
301 	if ((r = sshkey_putb(server_host_public, server_host_key_blob)) != 0)
302 		goto out;
303 	hashlen = sizeof(hash);
304 	if ((r = kex_gen_hash(
305 	    kex->hash_alg,
306 	    kex->client_version,
307 	    kex->server_version,
308 	    kex->peer,
309 	    kex->my,
310 	    server_host_key_blob,
311 	    client_pubkey,
312 	    server_pubkey,
313 	    shared_secret,
314 	    hash, &hashlen)) != 0)
315 		goto out;
316 
317 	/* sign H */
318 	if ((r = kex->sign(ssh, server_host_private, server_host_public,
319 	     &signature, &slen, hash, hashlen, kex->hostkey_alg)) != 0)
320 		goto out;
321 
322 	/* send server hostkey, ECDH pubkey 'Q_S' and signed H */
323 	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 ||
324 	    (r = sshpkt_put_stringb(ssh, server_host_key_blob)) != 0 ||
325 	    (r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 ||
326 	    (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
327 	    (r = sshpkt_send(ssh)) != 0)
328 		goto out;
329 
330 	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
331 		r = kex_send_newkeys(ssh);
332 out:
333 	explicit_bzero(hash, sizeof(hash));
334 	sshbuf_free(server_host_key_blob);
335 	free(signature);
336 	sshbuf_free(shared_secret);
337 	sshbuf_free(client_pubkey);
338 	sshbuf_free(server_pubkey);
339 	return r;
340 }
341