lib/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2025-05-30 05:24:50 +03:00
Code

dh-gex: Add server implementation

Browse Source 
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
This commit is contained in:
Aris Adamantiadis 2018-11-07 16:15:50 +01:00 committed by Andreas Schneider
parent 40faa98c5e
commit 53c88375fe
9 changed files with 195 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/libssh/crypto.h
View File

@ -98,6 +98,7 @@ struct ssh_crypto_struct {
bignum e,f,x,k,y;
bignum g, p;
int dh_group_is_mutable; /* do free group parameters */
size_t dh_pmin; int dh_pn; int dh_pmax; /* preferred group parameters */
#ifdef HAVE_ECDH
#ifdef HAVE_OPENSSL_ECC
EC_KEY *ecdh_privkey;

5
include/libssh/dh-gex.h
View File

@ -23,11 +23,6 @@
#ifndef SRC_DH_GEX_H_
#define SRC_DH_GEX_H_
/* Minimum, recommanded and maximum size of DH group */
#define DH_PMIN 2048
#define DH_PREQ 2048
#define DH_PMAX 8192
int ssh_client_dhgex_init(ssh_session session);
#ifdef WITH_SERVER

1
include/libssh/dh.h
View File

@ -47,5 +47,6 @@ void ssh_server_dh_init(ssh_session session);
int ssh_dh_init_common(ssh_session session);
void ssh_dh_cleanup(struct ssh_crypto_struct *crypto);
int ssh_dh_generate_secret(ssh_session session, bignum dest);
int ssh_server_dh_process_init(ssh_session session, ssh_buffer packet);
#endif /* DH_H_ */

1
include/libssh/session.h
View File

@ -49,6 +49,7 @@ enum ssh_session_state_e {
enum ssh_dh_state_e {
DH_STATE_INIT=0,
DH_STATE_GROUP_SENT,
DH_STATE_REQUEST_SENT,
DH_STATE_INIT_SENT,
DH_STATE_NEWKEYS_SENT,

161
src/dh-gex.c
View File

@ -37,6 +37,11 @@
#include "libssh/buffer.h"
#include "libssh/session.h"
/* Minimum, recommanded and maximum size of DH group */
#define DH_PMIN 2048
#define DH_PREQ 2048
#define DH_PMAX 8192
static SSH_PACKET_CALLBACK(ssh_packet_client_dhgex_group);
static SSH_PACKET_CALLBACK(ssh_packet_client_dhgex_reply);
@ -65,13 +70,16 @@ int ssh_client_dhgex_init(ssh_session session)
goto error;
}
session->next_crypto->dh_pmin = DH_PMIN;
session->next_crypto->dh_pn = DH_PREQ;
session->next_crypto->dh_pmax = DH_PMAX;
/* Minimum group size, preferred group size, maximum group size */
rc = ssh_buffer_pack(session->out_buffer,
"bddd",
SSH2_MSG_KEX_DH_GEX_REQUEST,
DH_PMIN,
DH_PREQ,
DH_PMAX);
session->next_crypto->dh_pmin,
session->next_crypto->dh_pn,
session->next_crypto->dh_pmax);
if (rc != SSH_OK) {
goto error;
}
@ -99,6 +107,8 @@ SSH_PACKET_CALLBACK(ssh_packet_client_dhgex_group)
int blen;
bignum pmin1 = NULL, one = NULL;
bignum_CTX ctx = bignum_ctx_new();
(void) type;
(void) user;
SSH_LOG(SSH_LOG_PROTOCOL, "SSH_MSG_KEX_DH_GEX_GROUP received");
@ -440,19 +450,12 @@ static int ssh_retrieve_dhgroup_file(FILE *moduli,
* @param[out] g generator
* @return SSH_OK on success, SSH_ERROR otherwise.
*/
/* TODO Make this function static when only used in this file */
int ssh_retrieve_dhgroup(uint32_t pmin,
uint32_t pn,
uint32_t pmax,
size_t *size,
bignum *p,
bignum *g);
int ssh_retrieve_dhgroup(uint32_t pmin,
uint32_t pn,
uint32_t pmax,
size_t *size,
bignum *p,
bignum *g)
static int ssh_retrieve_dhgroup(uint32_t pmin,
uint32_t pn,
uint32_t pmax,
size_t *size,
bignum *p,
bignum *g)
{
FILE *moduli = NULL;
char *generator = NULL;
@ -503,4 +506,130 @@ error:
return SSH_ERROR;
}
static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_request);
static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_init);
static ssh_packet_callback dhgex_server_callbacks[]= {
NULL, /* SSH_MSG_KEX_DH_GEX_REQUEST_OLD */
NULL, /* SSH_MSG_KEX_DH_GEX_GROUP */
ssh_packet_server_dhgex_init, /* SSH_MSG_KEX_DH_GEX_INIT */
NULL, /* SSH_MSG_KEX_DH_GEX_REPLY */
ssh_packet_server_dhgex_request /* SSH_MSG_GEX_DH_GEX_REQUEST */
};
static struct ssh_packet_callbacks_struct ssh_dhgex_server_callbacks = {
.start = SSH2_MSG_KEX_DH_GEX_REQUEST_OLD,
.n_callbacks = 5,
.callbacks = dhgex_server_callbacks,
.user = NULL
};
/** @internal
* @brief sets up the diffie-hellman-groupx kex callbacks
*/
void ssh_server_dhgex_init(ssh_session session){
/* register the packet callbacks */
ssh_packet_set_callbacks(session, &ssh_dhgex_server_callbacks);
ssh_dh_init_common(session);
session->dh_handshake_state = DH_STATE_INIT;
}
static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_request)
{
uint32_t pmin, pn, pmax;
size_t size = 0;
int rc;
(void) type;
(void) user;
if (session->dh_handshake_state != DH_STATE_INIT) {
ssh_set_error(session,
SSH_FATAL,
"Received DH_GEX_REQUEST in invalid state");
goto error;
}
rc = ssh_dh_init_common(session);
if (rc != SSH_OK){
ssh_set_error_oom(session);
goto error;
}
/* Minimum group size, preferred group size, maximum group size */
rc = ssh_buffer_unpack(packet, "ddd", &pmin, &pn, &pmax);
if (rc != SSH_OK){
ssh_set_error_invalid(session);
goto error;
}
SSH_LOG(SSH_LOG_INFO, "dh-gex: DHGEX_REQUEST[%u:%u:%u]", pmin, pn, pmax);
if (pmin > pn || pn > pmax || pn > DH_PMAX || pmax < DH_PMIN) {
ssh_set_error(session,
SSH_FATAL,
"Invalid dh-gex arguments [%u:%u:%u]",
pmin,
pn,
pmax);
goto error;
}
session->next_crypto->dh_pmin = pmin;
session->next_crypto->dh_pn = pn;
session->next_crypto->dh_pmax = pmax;
/* ensure safe parameters */
if (pmin < DH_PMIN) {
pmin = DH_PMIN;
if (pn < pmin) {
pn = pmin;
}
}
rc = ssh_retrieve_dhgroup(pmin,
pn,
pmax,
&size,
&session->next_crypto->p,
&session->next_crypto->g);
if (rc == SSH_ERROR) {
ssh_set_error(session,
SSH_FATAL,
"Couldn't find DH group for [%u:%u:%u]",
pmin,
pn,
pmax);
goto error;
}
session->next_crypto->dh_group_is_mutable = 1;
rc = ssh_buffer_pack(session->out_buffer,
"bBB",
SSH2_MSG_KEX_DH_GEX_GROUP,
session->next_crypto->p,
session->next_crypto->g);
if (rc != SSH_OK) {
ssh_set_error_invalid(session);
goto error;
}
session->dh_handshake_state = DH_STATE_GROUP_SENT;
rc = ssh_packet_send(session);
error:
return SSH_PACKET_USED;
}
/** @internal
* @brief parse an incoming SSH_MSG_KEX_DH_GEX_INIT packet and complete
* Diffie-Hellman key exchange
**/
static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_init){
(void) type;
(void) user;
SSH_LOG(SSH_LOG_DEBUG, "Received SSH_MSG_KEX_DHGEX_INIT");
ssh_packet_remove_callbacks(session, &ssh_dhgex_server_callbacks);
ssh_server_dh_process_init(session, packet);
return SSH_PACKET_USED;
}
#endif /* WITH_SERVER */

47
src/dh.c
View File

@ -596,24 +596,21 @@ void ssh_server_dh_init(ssh_session session){
}
/** @internal
* @brief processes a SSH_MSG_KEXDH_INIT or SSH_MSG_KEX_DH_GEX_INIT packet and send
* @brief processes a SSH_MSG_KEXDH_INIT or SSH_MSG_KEX_DH_GEX_INIT packet and sends
* the appropriate SSH_MSG_KEXDH_REPLY or SSH_MSG_KEX_DH_GEX_REPLY
*/
static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init)
int ssh_server_dh_process_init(ssh_session session, ssh_buffer packet)
{
ssh_key privkey = NULL;
ssh_string sig_blob = NULL;
ssh_string pubkey_blob = NULL;
bignum_CTX ctx = bignum_ctx_new();
int packet_type;
int rc;
(void)type;
(void)user;
if (bignum_ctx_invalid(ctx)) {
goto error;
}
ssh_packet_remove_callbacks(session, &ssh_dh_server_callbacks);
rc = ssh_buffer_unpack(packet, "B", &session->next_crypto->e);
if (rc == SSH_ERROR) {
ssh_set_error(session, SSH_FATAL, "No e number in client request");
@ -658,6 +655,22 @@ static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init)
ssh_set_error(session, SSH_FATAL, "Could not sign the session id");
goto error;
}
switch (session->next_crypto->kex_type){
case SSH_KEX_DH_GROUP1_SHA1:
case SSH_KEX_DH_GROUP14_SHA1:
case SSH_KEX_DH_GROUP16_SHA512:
case SSH_KEX_DH_GROUP18_SHA512:
packet_type = SSH2_MSG_KEXDH_REPLY;
break;
case SSH_KEX_DH_GEX_SHA1:
case SSH_KEX_DH_GEX_SHA256:
packet_type = SSH2_MSG_KEX_DH_GEX_REPLY;
break;
default:
ssh_set_error(session, SSH_FATAL, "Invalid kex type");
goto error;
}
rc = ssh_dh_get_next_server_publickey_blob(session, &pubkey_blob);
if (rc != SSH_OK){
ssh_set_error_oom(session);
@ -665,7 +678,7 @@ static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init)
}
rc = ssh_buffer_pack(session->out_buffer,
"bSBS",
SSH2_MSG_KEXDH_REPLY,
packet_type,
pubkey_blob,
session->next_crypto->f,
sig_blob);
@ -679,16 +692,19 @@ static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init)
if (rc == SSH_ERROR) {
goto error;
}
SSH_LOG(SSH_LOG_DEBUG, "Sent KEX_DH_[GEX]_REPLY");
if (ssh_buffer_add_u8(session->out_buffer, SSH2_MSG_NEWKEYS) < 0) {
ssh_buffer_reinit(session->out_buffer);
goto error;
}
session->dh_handshake_state=DH_STATE_NEWKEYS_SENT;
if (ssh_packet_send(session) == SSH_ERROR) {
goto error;
}
SSH_LOG(SSH_LOG_PACKET, "SSH_MSG_NEWKEYS sent");
session->dh_handshake_state = DH_STATE_NEWKEYS_SENT;
return SSH_PACKET_USED;
return SSH_OK;
error:
if (!bignum_ctx_invalid(ctx)) {
bignum_ctx_free(ctx);
@ -696,6 +712,19 @@ error:
session->session_state = SSH_SESSION_STATE_ERROR;
ssh_dh_cleanup(session->next_crypto);
return SSH_ERROR;
}
/** @internal
* @brief parse an incoming SSH_MSG_KEXDH_INIT packet and complete
* Diffie-Hellman key exchange
**/
static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init){
(void)type;
(void)user;
SSH_LOG(SSH_LOG_DEBUG, "Received SSH_MSG_KEXDH_INIT");
ssh_packet_remove_callbacks(session, &ssh_dh_server_callbacks);
ssh_server_dh_process_init(session, packet);
return SSH_PACKET_USED;
}

4
src/kex.c
View File

@ -1095,7 +1095,9 @@ int ssh_make_sessionid(ssh_session session)
case SSH_KEX_DH_GEX_SHA256:
rc = ssh_buffer_pack(buf,
"dddBBBB",
DH_PMIN, DH_PREQ, DH_PMAX,
session->next_crypto->dh_pmin,
session->next_crypto->dh_pn,
session->next_crypto->dh_pmax,
session->next_crypto->p,
session->next_crypto->g,
session->next_crypto->e,

1
src/server.c
View File

@ -226,6 +226,7 @@ SSH_PACKET_CALLBACK(ssh_packet_kexdh_init){
return SSH_PACKET_USED;
}
SSH_LOG(SSH_LOG_DEBUG, "Calling next KEXDH handler");
return SSH_PACKET_NOT_USED;
}

5
src/wrapper.c
View File

@ -49,6 +49,7 @@
#include "libssh/pki.h"
#include "libssh/poly1305.h"
#include "libssh/dh.h"
#include "libssh/dh-gex.h"
#include "libssh/ecdh.h"
#include "libssh/curve25519.h"
@ -538,6 +539,10 @@ int crypt_set_algorithms_server(ssh_session session){
case SSH_KEX_DH_GROUP18_SHA512:
ssh_server_dh_init(session);
break;
case SSH_KEX_DH_GEX_SHA1:
case SSH_KEX_DH_GEX_SHA256:
ssh_server_dhgex_init(session);
break;
#ifdef HAVE_ECDH
case SSH_KEX_ECDH_SHA2_NISTP256:
case SSH_KEX_ECDH_SHA2_NISTP384: