dh-gex: Add server implementation

Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>

include/libssh/crypto.h

@@ -98,6 +98,7 @@ struct ssh_crypto_struct {
     bignum e,f,x,k,y;
     bignum g, p;
     int dh_group_is_mutable; /* do free group parameters */
+    size_t dh_pmin; int dh_pn; int dh_pmax; /* preferred group parameters */
 #ifdef HAVE_ECDH
 #ifdef HAVE_OPENSSL_ECC
     EC_KEY *ecdh_privkey;

include/libssh/dh-gex.h

@@ -23,11 +23,6 @@
 #ifndef SRC_DH_GEX_H_
 #define SRC_DH_GEX_H_
 
-/* Minimum, recommanded and maximum size of DH group */
-#define DH_PMIN 2048
-#define DH_PREQ 2048
-#define DH_PMAX 8192
-
 int ssh_client_dhgex_init(ssh_session session);
 
 #ifdef WITH_SERVER

include/libssh/dh.h

@@ -47,5 +47,6 @@ void ssh_server_dh_init(ssh_session session);
 int ssh_dh_init_common(ssh_session session);
 void ssh_dh_cleanup(struct ssh_crypto_struct *crypto);
 int ssh_dh_generate_secret(ssh_session session, bignum dest);
+int ssh_server_dh_process_init(ssh_session session, ssh_buffer packet);
 
 #endif /* DH_H_ */

include/libssh/session.h

@@ -49,6 +49,7 @@ enum ssh_session_state_e {
 
 enum ssh_dh_state_e {
   DH_STATE_INIT=0,
+  DH_STATE_GROUP_SENT,
   DH_STATE_REQUEST_SENT,
   DH_STATE_INIT_SENT,
   DH_STATE_NEWKEYS_SENT,

src/dh-gex.c

@@ -37,6 +37,11 @@
 #include "libssh/buffer.h"
 #include "libssh/session.h"
 
+/* Minimum, recommanded and maximum size of DH group */
+#define DH_PMIN 2048
+#define DH_PREQ 2048
+#define DH_PMAX 8192
+
 static SSH_PACKET_CALLBACK(ssh_packet_client_dhgex_group);
 static SSH_PACKET_CALLBACK(ssh_packet_client_dhgex_reply);
 
@@ -65,13 +70,16 @@ int ssh_client_dhgex_init(ssh_session session)
         goto error;
     }
 
+    session->next_crypto->dh_pmin = DH_PMIN;
+    session->next_crypto->dh_pn = DH_PREQ;
+    session->next_crypto->dh_pmax = DH_PMAX;
     /* Minimum group size, preferred group size, maximum group size */
     rc = ssh_buffer_pack(session->out_buffer,
                          "bddd",
                          SSH2_MSG_KEX_DH_GEX_REQUEST,
-                         DH_PMIN,
+                         session->next_crypto->dh_pmin,
-                         DH_PREQ,
+                         session->next_crypto->dh_pn,
-                         DH_PMAX);
+                         session->next_crypto->dh_pmax);
     if (rc != SSH_OK) {
         goto error;
     }
@@ -99,6 +107,8 @@ SSH_PACKET_CALLBACK(ssh_packet_client_dhgex_group)
     int blen;
     bignum pmin1 = NULL, one = NULL;
     bignum_CTX ctx = bignum_ctx_new();
+    (void) type;
+    (void) user;
 
     SSH_LOG(SSH_LOG_PROTOCOL, "SSH_MSG_KEX_DH_GEX_GROUP received");
 
@@ -440,19 +450,12 @@ static int ssh_retrieve_dhgroup_file(FILE *moduli,
  * @param[out] g generator
  * @return SSH_OK on success, SSH_ERROR otherwise.
  */
-/* TODO Make this function static when only used in this file */
+static int ssh_retrieve_dhgroup(uint32_t pmin,
-int ssh_retrieve_dhgroup(uint32_t pmin,
+                                uint32_t pn,
-                         uint32_t pn,
+                                uint32_t pmax,
-                         uint32_t pmax,
+                                size_t *size,
-                         size_t *size,
+                                bignum *p,
-                         bignum *p,
+                                bignum *g)
-                         bignum *g);
-int ssh_retrieve_dhgroup(uint32_t pmin,
-                         uint32_t pn,
-                         uint32_t pmax,
-                         size_t *size,
-                         bignum *p,
-                         bignum *g)
 {
     FILE *moduli = NULL;
     char *generator = NULL;
@@ -503,4 +506,130 @@ error:
     return SSH_ERROR;
 }
 
+static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_request);
+static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_init);
+
+static ssh_packet_callback dhgex_server_callbacks[]= {
+    NULL, /* SSH_MSG_KEX_DH_GEX_REQUEST_OLD */
+    NULL, /* SSH_MSG_KEX_DH_GEX_GROUP */
+    ssh_packet_server_dhgex_init,   /* SSH_MSG_KEX_DH_GEX_INIT */
+    NULL,                           /* SSH_MSG_KEX_DH_GEX_REPLY */
+    ssh_packet_server_dhgex_request /* SSH_MSG_GEX_DH_GEX_REQUEST */
+
+};
+
+static struct ssh_packet_callbacks_struct ssh_dhgex_server_callbacks = {
+    .start = SSH2_MSG_KEX_DH_GEX_REQUEST_OLD,
+    .n_callbacks = 5,
+    .callbacks = dhgex_server_callbacks,
+    .user = NULL
+};
+
+/** @internal
+ * @brief sets up the diffie-hellman-groupx kex callbacks
+ */
+void ssh_server_dhgex_init(ssh_session session){
+    /* register the packet callbacks */
+    ssh_packet_set_callbacks(session, &ssh_dhgex_server_callbacks);
+    ssh_dh_init_common(session);
+    session->dh_handshake_state = DH_STATE_INIT;
+}
+
+static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_request)
+{
+    uint32_t pmin, pn, pmax;
+    size_t size = 0;
+    int rc;
+
+    (void) type;
+    (void) user;
+
+    if (session->dh_handshake_state != DH_STATE_INIT) {
+        ssh_set_error(session,
+                      SSH_FATAL,
+                      "Received DH_GEX_REQUEST in invalid state");
+        goto error;
+    }
+
+    rc = ssh_dh_init_common(session);
+    if (rc != SSH_OK){
+        ssh_set_error_oom(session);
+        goto error;
+    }
+
+    /* Minimum group size, preferred group size, maximum group size */
+    rc = ssh_buffer_unpack(packet, "ddd", &pmin, &pn, &pmax);
+    if (rc != SSH_OK){
+        ssh_set_error_invalid(session);
+        goto error;
+    }
+    SSH_LOG(SSH_LOG_INFO, "dh-gex: DHGEX_REQUEST[%u:%u:%u]", pmin, pn, pmax);
+
+    if (pmin > pn || pn > pmax || pn > DH_PMAX || pmax < DH_PMIN) {
+        ssh_set_error(session,
+                      SSH_FATAL,
+                      "Invalid dh-gex arguments [%u:%u:%u]",
+                      pmin,
+                      pn,
+                      pmax);
+        goto error;
+    }
+    session->next_crypto->dh_pmin = pmin;
+    session->next_crypto->dh_pn = pn;
+    session->next_crypto->dh_pmax = pmax;
+
+    /* ensure safe parameters */
+    if (pmin < DH_PMIN) {
+        pmin = DH_PMIN;
+        if (pn < pmin) {
+            pn = pmin;
+        }
+    }
+    rc = ssh_retrieve_dhgroup(pmin,
+                              pn,
+                              pmax,
+                              &size,
+                              &session->next_crypto->p,
+                              &session->next_crypto->g);
+    if (rc == SSH_ERROR) {
+        ssh_set_error(session,
+                      SSH_FATAL,
+                      "Couldn't find DH group for [%u:%u:%u]",
+                      pmin,
+                      pn,
+                      pmax);
+        goto error;
+    }
+    session->next_crypto->dh_group_is_mutable = 1;
+    rc = ssh_buffer_pack(session->out_buffer,
+                         "bBB",
+                         SSH2_MSG_KEX_DH_GEX_GROUP,
+                         session->next_crypto->p,
+                         session->next_crypto->g);
+    if (rc != SSH_OK) {
+        ssh_set_error_invalid(session);
+        goto error;
+    }
+
+    session->dh_handshake_state = DH_STATE_GROUP_SENT;
+
+    rc = ssh_packet_send(session);
+error:
+
+    return SSH_PACKET_USED;
+}
+
+/** @internal
+ * @brief parse an incoming SSH_MSG_KEX_DH_GEX_INIT packet and complete
+ *        Diffie-Hellman key exchange
+ **/
+static SSH_PACKET_CALLBACK(ssh_packet_server_dhgex_init){
+    (void) type;
+    (void) user;
+    SSH_LOG(SSH_LOG_DEBUG, "Received SSH_MSG_KEX_DHGEX_INIT");
+    ssh_packet_remove_callbacks(session, &ssh_dhgex_server_callbacks);
+    ssh_server_dh_process_init(session, packet);
+    return SSH_PACKET_USED;
+}
+
 #endif /* WITH_SERVER */

src/dh.c

@@ -596,24 +596,21 @@ void ssh_server_dh_init(ssh_session session){
 }
 
 /** @internal
- * @brief processes a SSH_MSG_KEXDH_INIT or SSH_MSG_KEX_DH_GEX_INIT packet and send
+ * @brief processes a SSH_MSG_KEXDH_INIT or SSH_MSG_KEX_DH_GEX_INIT packet and sends
  * the appropriate SSH_MSG_KEXDH_REPLY or SSH_MSG_KEX_DH_GEX_REPLY
  */
-static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init)
+int ssh_server_dh_process_init(ssh_session session, ssh_buffer packet)
 {
     ssh_key privkey = NULL;
     ssh_string sig_blob = NULL;
     ssh_string pubkey_blob = NULL;
     bignum_CTX ctx = bignum_ctx_new();
+    int packet_type;
     int rc;
-    (void)type;
-    (void)user;
 
     if (bignum_ctx_invalid(ctx)) {
         goto error;
     }
-    ssh_packet_remove_callbacks(session, &ssh_dh_server_callbacks);
-
     rc = ssh_buffer_unpack(packet, "B", &session->next_crypto->e);
     if (rc == SSH_ERROR) {
         ssh_set_error(session, SSH_FATAL, "No e number in client request");
@@ -658,6 +655,22 @@ static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init)
         ssh_set_error(session, SSH_FATAL, "Could not sign the session id");
         goto error;
     }
+    switch (session->next_crypto->kex_type){
+    case SSH_KEX_DH_GROUP1_SHA1:
+    case SSH_KEX_DH_GROUP14_SHA1:
+    case SSH_KEX_DH_GROUP16_SHA512:
+    case SSH_KEX_DH_GROUP18_SHA512:
+        packet_type = SSH2_MSG_KEXDH_REPLY;
+        break;
+    case SSH_KEX_DH_GEX_SHA1:
+    case SSH_KEX_DH_GEX_SHA256:
+        packet_type = SSH2_MSG_KEX_DH_GEX_REPLY;
+        break;
+    default:
+        ssh_set_error(session, SSH_FATAL, "Invalid kex type");
+        goto error;
+    }
+   
     rc = ssh_dh_get_next_server_publickey_blob(session, &pubkey_blob);
     if (rc != SSH_OK){
         ssh_set_error_oom(session);
@@ -665,7 +678,7 @@ static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init)
     }
     rc = ssh_buffer_pack(session->out_buffer,
                          "bSBS",
-                         SSH2_MSG_KEXDH_REPLY,
+                         packet_type,
                          pubkey_blob,
                          session->next_crypto->f,
                          sig_blob);
@@ -679,16 +692,19 @@ static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init)
     if (rc == SSH_ERROR) {
         goto error;
     }
+    SSH_LOG(SSH_LOG_DEBUG, "Sent KEX_DH_[GEX]_REPLY");
+
     if (ssh_buffer_add_u8(session->out_buffer, SSH2_MSG_NEWKEYS) < 0) {
         ssh_buffer_reinit(session->out_buffer);
         goto error;
     }
+    session->dh_handshake_state=DH_STATE_NEWKEYS_SENT;
     if (ssh_packet_send(session) == SSH_ERROR) {
         goto error;
     }
     SSH_LOG(SSH_LOG_PACKET, "SSH_MSG_NEWKEYS sent");
-    session->dh_handshake_state = DH_STATE_NEWKEYS_SENT;
+
-    return SSH_PACKET_USED;
+    return SSH_OK;
 error:
     if (!bignum_ctx_invalid(ctx)) {
         bignum_ctx_free(ctx);
@@ -696,6 +712,19 @@ error:
 
     session->session_state = SSH_SESSION_STATE_ERROR;
     ssh_dh_cleanup(session->next_crypto);
+    return SSH_ERROR;
+}
+
+/** @internal
+ * @brief parse an incoming SSH_MSG_KEXDH_INIT packet and complete
+ *        Diffie-Hellman key exchange
+ **/
+static SSH_PACKET_CALLBACK(ssh_packet_server_dh_init){
+    (void)type;
+    (void)user;
+    SSH_LOG(SSH_LOG_DEBUG, "Received SSH_MSG_KEXDH_INIT");
+    ssh_packet_remove_callbacks(session, &ssh_dh_server_callbacks);
+    ssh_server_dh_process_init(session, packet);
     return SSH_PACKET_USED;
 }
 

src/kex.c

@@ -1095,7 +1095,9 @@ int ssh_make_sessionid(ssh_session session)
     case SSH_KEX_DH_GEX_SHA256:
         rc = ssh_buffer_pack(buf,
                     "dddBBBB",
-                    DH_PMIN, DH_PREQ, DH_PMAX,
+                    session->next_crypto->dh_pmin,
+                    session->next_crypto->dh_pn,
+                    session->next_crypto->dh_pmax,
                     session->next_crypto->p,
                     session->next_crypto->g,
                     session->next_crypto->e,

src/server.c

@@ -226,6 +226,7 @@ SSH_PACKET_CALLBACK(ssh_packet_kexdh_init){
 
     return SSH_PACKET_USED;
   }
+  SSH_LOG(SSH_LOG_DEBUG, "Calling next KEXDH handler");
   return SSH_PACKET_NOT_USED;
 }
 

src/wrapper.c

@@ -49,6 +49,7 @@
 #include "libssh/pki.h"
 #include "libssh/poly1305.h"
 #include "libssh/dh.h"
+#include "libssh/dh-gex.h"
 #include "libssh/ecdh.h"
 #include "libssh/curve25519.h"
 
@@ -538,6 +539,10 @@ int crypt_set_algorithms_server(ssh_session session){
     case SSH_KEX_DH_GROUP18_SHA512:
       ssh_server_dh_init(session);
       break;
+    case SSH_KEX_DH_GEX_SHA1:
+    case SSH_KEX_DH_GEX_SHA256:
+      ssh_server_dhgex_init(session);
+      break;
 #ifdef HAVE_ECDH
     case SSH_KEX_ECDH_SHA2_NISTP256:
     case SSH_KEX_ECDH_SHA2_NISTP384: