From 53c88375fe54c1f551151a61ff66ff108606dcc8 Mon Sep 17 00:00:00 2001 From: Aris Adamantiadis Date: Wed, 7 Nov 2018 16:15:50 +0100 Subject: [PATCH] dh-gex: Add server implementation Signed-off-by: Aris Adamantiadis Reviewed-by: Jakub Jelen Reviewed-by: Andreas Schneider --- include/libssh/crypto.h | 1 + include/libssh/dh-gex.h | 5 -- include/libssh/dh.h | 1 + include/libssh/session.h | 1 + src/dh-gex.c | 161 +++++++++++++++++++++++++++++++++++---- src/dh.c | 47 +++++++++--- src/kex.c | 4 +- src/server.c | 1 + src/wrapper.c | 5 ++ 9 files changed, 195 insertions(+), 31 deletions(-) diff --git a/include/libssh/crypto.h b/include/libssh/crypto.h index 72b6a1d6..3ec0bc5a 100644 --- a/include/libssh/crypto.h +++ b/include/libssh/crypto.h @@ -98,6 +98,7 @@ struct ssh_crypto_struct { bignum e,f,x,k,y; bignum g, p; int dh_group_is_mutable; /* do free group parameters */ + size_t dh_pmin; int dh_pn; int dh_pmax; /* preferred group parameters */ #ifdef HAVE_ECDH #ifdef HAVE_OPENSSL_ECC EC_KEY *ecdh_privkey; diff --git a/include/libssh/dh-gex.h b/include/libssh/dh-gex.h index ea93e6d1..4fc23d82 100644 --- a/include/libssh/dh-gex.h +++ b/include/libssh/dh-gex.h @@ -23,11 +23,6 @@ #ifndef SRC_DH_GEX_H_ #define SRC_DH_GEX_H_ -/* Minimum, recommanded and maximum size of DH group */ -#define DH_PMIN 2048 -#define DH_PREQ 2048 -#define DH_PMAX 8192 - int ssh_client_dhgex_init(ssh_session session); #ifdef WITH_SERVER diff --git a/include/libssh/dh.h b/include/libssh/dh.h index 4b803f0b..25aad47e 100644 --- a/include/libssh/dh.h +++ b/include/libssh/dh.h @@ -47,5 +47,6 @@ void ssh_server_dh_init(ssh_session session); int ssh_dh_init_common(ssh_session session); void ssh_dh_cleanup(struct ssh_crypto_struct *crypto); int ssh_dh_generate_secret(ssh_session session, bignum dest); +int ssh_server_dh_process_init(ssh_session session, ssh_buffer packet); #endif /* DH_H_ */ diff --git a/include/libssh/session.h b/include/libssh/session.h index 5159f216..dfcb0cd6 100644 --- a/include/libssh/session.h +++ b/include/libssh/session.h @@ -49,6 +49,7 @@ enum ssh_session_state_e { enum ssh_dh_state_e { DH_STATE_INIT=0, + DH_STATE_GROUP_SENT, DH_STATE_REQUEST_SENT, DH_STATE_INIT_SENT, DH_STATE_NEWKEYS_SENT, diff --git a/src/dh-gex.c b/src/dh-gex.c index 6cbc9fd8..e5bcb48b 100644 --- a/src/dh-gex.c +++ b/src/dh-gex.c @@ -37,6 +37,11 @@ #include "libssh/buffer.h" #include "libssh/session.h" +/* Minimum, recommanded and maximum size of DH group */ +#define DH_PMIN 2048 +#define DH_PREQ 2048 +#define DH_PMAX 8192 + static SSH_PACKET_CALLBACK(ssh_packet_client_dhgex_group); static SSH_PACKET_CALLBACK(ssh_packet_client_dhgex_reply); @@ -65,13 +70,16 @@ int ssh_client_dhgex_init(ssh_session session) goto error; } + session->next_crypto->dh_pmin = DH_PMIN; + session->next_crypto->dh_pn = DH_PREQ; + session->next_crypto->dh_pmax = DH_PMAX; /* Minimum group size, preferred group size, maximum group size */ rc = ssh_buffer_pack(session->out_buffer, "bddd", SSH2_MSG_KEX_DH_GEX_REQUEST, - DH_PMIN, - DH_PREQ, - DH_PMAX); + session->next_crypto->dh_pmin, + session->next_crypto->dh_pn, + session->next_crypto->dh_pmax); if (rc != SSH_OK) { goto error; } @@ -99,6 +107,8 @@ SSH_PACKET_CALLBACK(ssh_packet_client_dhgex_group) int blen; bignum pmin1 = NULL, one = NULL; bignum_CTX ctx = bignum_ctx_new(); + (void) type; + (void) user; SSH_LOG(SSH_LOG_PROTOCOL, "SSH_MSG_KEX_DH_GEX_GROUP received"); @@ -440,19 +450,12 @@ static int ssh_retrieve_dhgroup_file(FILE *moduli, * @param[out] g generator * @return SSH_OK on success, SSH_ERROR otherwise. */ -/* TODO Make this function static when only used in this file */ -int ssh_retrieve_dhgroup(uint32_t pmin, - uint32_t pn, - uint32_t pmax, - size_t *size, - bignum *p, - bignum *g); -int ssh_retrieve_dhgroup(uint32_t pmin, - uint32_t pn, - uint32_t pmax, - size_t *size, - bignum *p, - bignum *g) +static int ssh_retrieve_dhgroup(uint32_t pmin, + uint32_t pn, + uint32_t pmax, + size_t *size, + bignum *p, + bignum *g) { FILE *moduli = NULL; char *generator = NULL; @@ -503,4 +506,130 @@ error: return SSH_ERROR; } +static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_request); +static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_init); + +static ssh_packet_callback dhgex_server_callbacks[]= { + NULL, /* SSH_MSG_KEX_DH_GEX_REQUEST_OLD */ + NULL, /* SSH_MSG_KEX_DH_GEX_GROUP */ + ssh_packet_server_dhgex_init, /* SSH_MSG_KEX_DH_GEX_INIT */ + NULL, /* SSH_MSG_KEX_DH_GEX_REPLY */ + ssh_packet_server_dhgex_request /* SSH_MSG_GEX_DH_GEX_REQUEST */ + +}; + +static struct ssh_packet_callbacks_struct ssh_dhgex_server_callbacks = { + .start = SSH2_MSG_KEX_DH_GEX_REQUEST_OLD, + .n_callbacks = 5, + .callbacks = dhgex_server_callbacks, + .user = NULL +}; + +/** @internal + * @brief sets up the diffie-hellman-groupx kex callbacks + */ +void ssh_server_dhgex_init(ssh_session session){ + /* register the packet callbacks */ + ssh_packet_set_callbacks(session, &ssh_dhgex_server_callbacks); + ssh_dh_init_common(session); + session->dh_handshake_state = DH_STATE_INIT; +} + +static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_request) +{ + uint32_t pmin, pn, pmax; + size_t size = 0; + int rc; + + (void) type; + (void) user; + + if (session->dh_handshake_state != DH_STATE_INIT) { + ssh_set_error(session, + SSH_FATAL, + "Received DH_GEX_REQUEST in invalid state"); + goto error; + } + + rc = ssh_dh_init_common(session); + if (rc != SSH_OK){ + ssh_set_error_oom(session); + goto error; + } + + /* Minimum group size, preferred group size, maximum group size */ + rc = ssh_buffer_unpack(packet, "ddd", &pmin, &pn, &pmax); + if (rc != SSH_OK){ + ssh_set_error_invalid(session); + goto error; + } + SSH_LOG(SSH_LOG_INFO, "dh-gex: DHGEX_REQUEST[%u:%u:%u]", pmin, pn, pmax); + + if (pmin > pn || pn > pmax || pn > DH_PMAX || pmax < DH_PMIN) { + ssh_set_error(session, + SSH_FATAL, + "Invalid dh-gex arguments [%u:%u:%u]", + pmin, + pn, + pmax); + goto error; + } + session->next_crypto->dh_pmin = pmin; + session->next_crypto->dh_pn = pn; + session->next_crypto->dh_pmax = pmax; + + /* ensure safe parameters */ + if (pmin < DH_PMIN) { + pmin = DH_PMIN; + if (pn < pmin) { + pn = pmin; + } + } + rc = ssh_retrieve_dhgroup(pmin, + pn, + pmax, + &size, + &session->next_crypto->p, + &session->next_crypto->g); + if (rc == SSH_ERROR) { + ssh_set_error(session, + SSH_FATAL, + "Couldn't find DH group for [%u:%u:%u]", + pmin, + pn, + pmax); + goto error; + } + session->next_crypto->dh_group_is_mutable = 1; + rc = ssh_buffer_pack(session->out_buffer, + "bBB", + SSH2_MSG_KEX_DH_GEX_GROUP, + session->next_crypto->p, + session->next_crypto->g); + if (rc != SSH_OK) { + ssh_set_error_invalid(session); + goto error; + } + + session->dh_handshake_state = DH_STATE_GROUP_SENT; + + rc = ssh_packet_send(session); +error: + + return SSH_PACKET_USED; +} + +/** @internal + * @brief parse an incoming SSH_MSG_KEX_DH_GEX_INIT packet and complete + * Diffie-Hellman key exchange + **/ +static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_init){ + (void) type; + (void) user; + SSH_LOG(SSH_LOG_DEBUG, "Received SSH_MSG_KEX_DHGEX_INIT"); + ssh_packet_remove_callbacks(session, &ssh_dhgex_server_callbacks); + ssh_server_dh_process_init(session, packet); + return SSH_PACKET_USED; +} + #endif /* WITH_SERVER */ diff --git a/src/dh.c b/src/dh.c index 8301a8dc..5dc29690 100644 --- a/src/dh.c +++ b/src/dh.c @@ -596,24 +596,21 @@ void ssh_server_dh_init(ssh_session session){ } /** @internal - * @brief processes a SSH_MSG_KEXDH_INIT or SSH_MSG_KEX_DH_GEX_INIT packet and send + * @brief processes a SSH_MSG_KEXDH_INIT or SSH_MSG_KEX_DH_GEX_INIT packet and sends * the appropriate SSH_MSG_KEXDH_REPLY or SSH_MSG_KEX_DH_GEX_REPLY */ -static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init) +int ssh_server_dh_process_init(ssh_session session, ssh_buffer packet) { ssh_key privkey = NULL; ssh_string sig_blob = NULL; ssh_string pubkey_blob = NULL; bignum_CTX ctx = bignum_ctx_new(); + int packet_type; int rc; - (void)type; - (void)user; if (bignum_ctx_invalid(ctx)) { goto error; } - ssh_packet_remove_callbacks(session, &ssh_dh_server_callbacks); - rc = ssh_buffer_unpack(packet, "B", &session->next_crypto->e); if (rc == SSH_ERROR) { ssh_set_error(session, SSH_FATAL, "No e number in client request"); @@ -658,6 +655,22 @@ static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init) ssh_set_error(session, SSH_FATAL, "Could not sign the session id"); goto error; } + switch (session->next_crypto->kex_type){ + case SSH_KEX_DH_GROUP1_SHA1: + case SSH_KEX_DH_GROUP14_SHA1: + case SSH_KEX_DH_GROUP16_SHA512: + case SSH_KEX_DH_GROUP18_SHA512: + packet_type = SSH2_MSG_KEXDH_REPLY; + break; + case SSH_KEX_DH_GEX_SHA1: + case SSH_KEX_DH_GEX_SHA256: + packet_type = SSH2_MSG_KEX_DH_GEX_REPLY; + break; + default: + ssh_set_error(session, SSH_FATAL, "Invalid kex type"); + goto error; + } + rc = ssh_dh_get_next_server_publickey_blob(session, &pubkey_blob); if (rc != SSH_OK){ ssh_set_error_oom(session); @@ -665,7 +678,7 @@ static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init) } rc = ssh_buffer_pack(session->out_buffer, "bSBS", - SSH2_MSG_KEXDH_REPLY, + packet_type, pubkey_blob, session->next_crypto->f, sig_blob); @@ -679,16 +692,19 @@ static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init) if (rc == SSH_ERROR) { goto error; } + SSH_LOG(SSH_LOG_DEBUG, "Sent KEX_DH_[GEX]_REPLY"); + if (ssh_buffer_add_u8(session->out_buffer, SSH2_MSG_NEWKEYS) < 0) { ssh_buffer_reinit(session->out_buffer); goto error; } + session->dh_handshake_state=DH_STATE_NEWKEYS_SENT; if (ssh_packet_send(session) == SSH_ERROR) { goto error; } SSH_LOG(SSH_LOG_PACKET, "SSH_MSG_NEWKEYS sent"); - session->dh_handshake_state = DH_STATE_NEWKEYS_SENT; - return SSH_PACKET_USED; + + return SSH_OK; error: if (!bignum_ctx_invalid(ctx)) { bignum_ctx_free(ctx); @@ -696,6 +712,19 @@ error: session->session_state = SSH_SESSION_STATE_ERROR; ssh_dh_cleanup(session->next_crypto); + return SSH_ERROR; +} + +/** @internal + * @brief parse an incoming SSH_MSG_KEXDH_INIT packet and complete + * Diffie-Hellman key exchange + **/ +static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init){ + (void)type; + (void)user; + SSH_LOG(SSH_LOG_DEBUG, "Received SSH_MSG_KEXDH_INIT"); + ssh_packet_remove_callbacks(session, &ssh_dh_server_callbacks); + ssh_server_dh_process_init(session, packet); return SSH_PACKET_USED; } diff --git a/src/kex.c b/src/kex.c index 1485cbdb..59522d22 100644 --- a/src/kex.c +++ b/src/kex.c @@ -1095,7 +1095,9 @@ int ssh_make_sessionid(ssh_session session) case SSH_KEX_DH_GEX_SHA256: rc = ssh_buffer_pack(buf, "dddBBBB", - DH_PMIN, DH_PREQ, DH_PMAX, + session->next_crypto->dh_pmin, + session->next_crypto->dh_pn, + session->next_crypto->dh_pmax, session->next_crypto->p, session->next_crypto->g, session->next_crypto->e, diff --git a/src/server.c b/src/server.c index 472e2c01..816c863d 100644 --- a/src/server.c +++ b/src/server.c @@ -226,6 +226,7 @@ SSH_PACKET_CALLBACK(ssh_packet_kexdh_init){ return SSH_PACKET_USED; } + SSH_LOG(SSH_LOG_DEBUG, "Calling next KEXDH handler"); return SSH_PACKET_NOT_USED; } diff --git a/src/wrapper.c b/src/wrapper.c index 74a2acb1..46ab22c5 100644 --- a/src/wrapper.c +++ b/src/wrapper.c @@ -49,6 +49,7 @@ #include "libssh/pki.h" #include "libssh/poly1305.h" #include "libssh/dh.h" +#include "libssh/dh-gex.h" #include "libssh/ecdh.h" #include "libssh/curve25519.h" @@ -538,6 +539,10 @@ int crypt_set_algorithms_server(ssh_session session){ case SSH_KEX_DH_GROUP18_SHA512: ssh_server_dh_init(session); break; + case SSH_KEX_DH_GEX_SHA1: + case SSH_KEX_DH_GEX_SHA256: + ssh_server_dhgex_init(session); + break; #ifdef HAVE_ECDH case SSH_KEX_ECDH_SHA2_NISTP256: case SSH_KEX_ECDH_SHA2_NISTP384: