|
Packit Service |
31306d |
/*
|
|
Packit Service |
31306d |
* This file is part of the SSH Library
|
|
Packit Service |
31306d |
*
|
|
Packit Service |
31306d |
* Copyright (c) 2011-2013 by Aris Adamantiadis
|
|
Packit Service |
31306d |
*
|
|
Packit Service |
31306d |
* The SSH Library is free software; you can redistribute it and/or modify
|
|
Packit Service |
31306d |
* it under the terms of the GNU Lesser General Public License as published by
|
|
Packit Service |
31306d |
* the Free Software Foundation; either version 2.1 of the License, or (at your
|
|
Packit Service |
31306d |
* option) any later version.
|
|
Packit Service |
31306d |
*
|
|
Packit Service |
31306d |
* The SSH Library is distributed in the hope that it will be useful, but
|
|
Packit Service |
31306d |
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
Packit Service |
31306d |
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
|
|
Packit Service |
31306d |
* License for more details.
|
|
Packit Service |
31306d |
*
|
|
Packit Service |
31306d |
* You should have received a copy of the GNU Lesser General Public License
|
|
Packit Service |
31306d |
* along with the SSH Library; see the file COPYING. If not, write to
|
|
Packit Service |
31306d |
* the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
|
|
Packit Service |
31306d |
* MA 02111-1307, USA.
|
|
Packit Service |
31306d |
*/
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
#include "config.h"
|
|
Packit Service |
31306d |
#include "libssh/session.h"
|
|
Packit Service |
31306d |
#include "libssh/ecdh.h"
|
|
Packit Service |
31306d |
#include "libssh/dh.h"
|
|
Packit Service |
31306d |
#include "libssh/buffer.h"
|
|
Packit Service |
31306d |
#include "libssh/ssh2.h"
|
|
Packit Service |
31306d |
#include "libssh/pki.h"
|
|
Packit Service |
31306d |
#include "libssh/bignum.h"
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
#ifdef HAVE_ECDH
|
|
Packit Service |
31306d |
#include <openssl/ecdh.h>
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
#define NISTP256 NID_X9_62_prime256v1
|
|
Packit Service |
31306d |
#define NISTP384 NID_secp384r1
|
|
Packit Service |
31306d |
#define NISTP521 NID_secp521r1
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
/** @internal
|
|
Packit Service |
31306d |
* @brief Map the given key exchange enum value to its curve name.
|
|
Packit Service |
31306d |
*/
|
|
Packit Service |
31306d |
static int ecdh_kex_type_to_curve(enum ssh_key_exchange_e kex_type) {
|
|
Packit Service |
31306d |
if (kex_type == SSH_KEX_ECDH_SHA2_NISTP256) {
|
|
Packit Service |
31306d |
return NISTP256;
|
|
Packit Service |
31306d |
} else if (kex_type == SSH_KEX_ECDH_SHA2_NISTP384) {
|
|
Packit Service |
31306d |
return NISTP384;
|
|
Packit Service |
31306d |
} else if (kex_type == SSH_KEX_ECDH_SHA2_NISTP521) {
|
|
Packit Service |
31306d |
return NISTP521;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
return SSH_ERROR;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
/** @internal
|
|
Packit Service |
31306d |
* @brief Starts ecdh-sha2-nistp256 key exchange
|
|
Packit Service |
31306d |
*/
|
|
Packit Service |
31306d |
int ssh_client_ecdh_init(ssh_session session){
|
|
Packit Service |
31306d |
EC_KEY *key;
|
|
Packit Service |
31306d |
const EC_GROUP *group;
|
|
Packit Service |
31306d |
const EC_POINT *pubkey;
|
|
Packit Service |
31306d |
ssh_string client_pubkey;
|
|
Packit Service |
31306d |
int curve;
|
|
Packit Service |
31306d |
int len;
|
|
Packit Service |
31306d |
int rc;
|
|
Packit Service |
31306d |
bignum_CTX ctx = BN_CTX_new();
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
rc = ssh_buffer_add_u8(session->out_buffer, SSH2_MSG_KEX_ECDH_INIT);
|
|
Packit Service |
31306d |
if (rc < 0) {
|
|
Packit Service |
31306d |
BN_CTX_free(ctx);
|
|
Packit Service |
31306d |
return SSH_ERROR;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
curve = ecdh_kex_type_to_curve(session->next_crypto->kex_type);
|
|
Packit Service |
31306d |
if (curve == SSH_ERROR) {
|
|
Packit Service |
31306d |
BN_CTX_free(ctx);
|
|
Packit Service |
31306d |
return SSH_ERROR;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
key = EC_KEY_new_by_curve_name(curve);
|
|
Packit Service |
31306d |
if (key == NULL) {
|
|
Packit Service |
31306d |
BN_CTX_free(ctx);
|
|
Packit Service |
31306d |
return SSH_ERROR;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
group = EC_KEY_get0_group(key);
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
EC_KEY_generate_key(key);
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
pubkey=EC_KEY_get0_public_key(key);
|
|
Packit Service |
31306d |
len = EC_POINT_point2oct(group,pubkey,POINT_CONVERSION_UNCOMPRESSED,
|
|
Packit Service |
31306d |
NULL,0,ctx);
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
client_pubkey = ssh_string_new(len);
|
|
Packit Service |
31306d |
if (client_pubkey == NULL) {
|
|
Packit Service |
31306d |
BN_CTX_free(ctx);
|
|
Packit Service |
31306d |
EC_KEY_free(key);
|
|
Packit Service |
31306d |
return SSH_ERROR;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
EC_POINT_point2oct(group,pubkey,POINT_CONVERSION_UNCOMPRESSED,
|
|
Packit Service |
31306d |
ssh_string_data(client_pubkey),len,ctx);
|
|
Packit Service |
31306d |
BN_CTX_free(ctx);
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
rc = ssh_buffer_add_ssh_string(session->out_buffer,client_pubkey);
|
|
Packit Service |
31306d |
if (rc < 0) {
|
|
Packit Service |
31306d |
EC_KEY_free(key);
|
|
Packit Service |
31306d |
SSH_STRING_FREE(client_pubkey);
|
|
Packit Service |
31306d |
return SSH_ERROR;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
session->next_crypto->ecdh_privkey = key;
|
|
Packit Service |
31306d |
session->next_crypto->ecdh_client_pubkey = client_pubkey;
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
/* register the packet callbacks */
|
|
Packit Service |
31306d |
ssh_packet_set_callbacks(session, &ssh_ecdh_client_callbacks);
|
|
Packit Service |
31306d |
session->dh_handshake_state = DH_STATE_INIT_SENT;
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
rc = ssh_packet_send(session);
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
return rc;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
int ecdh_build_k(ssh_session session) {
|
|
Packit Service |
31306d |
const EC_GROUP *group = EC_KEY_get0_group(session->next_crypto->ecdh_privkey);
|
|
Packit Service |
31306d |
EC_POINT *pubkey;
|
|
Packit Service |
31306d |
void *buffer;
|
|
Packit Service |
31306d |
int rc;
|
|
Packit Service |
31306d |
int len = (EC_GROUP_get_degree(group) + 7) / 8;
|
|
Packit Service |
31306d |
bignum_CTX ctx = bignum_ctx_new();
|
|
Packit Service |
31306d |
if (ctx == NULL) {
|
|
Packit Service |
31306d |
return -1;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
pubkey = EC_POINT_new(group);
|
|
Packit Service |
31306d |
if (pubkey == NULL) {
|
|
Packit Service |
31306d |
bignum_ctx_free(ctx);
|
|
Packit Service |
31306d |
return -1;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
if (session->server) {
|
|
Packit Service |
31306d |
rc = EC_POINT_oct2point(group,
|
|
Packit Service |
31306d |
pubkey,
|
|
Packit Service |
31306d |
ssh_string_data(session->next_crypto->ecdh_client_pubkey),
|
|
Packit Service |
31306d |
ssh_string_len(session->next_crypto->ecdh_client_pubkey),
|
|
Packit Service |
31306d |
ctx);
|
|
Packit Service |
31306d |
} else {
|
|
Packit Service |
31306d |
rc = EC_POINT_oct2point(group,
|
|
Packit Service |
31306d |
pubkey,
|
|
Packit Service |
31306d |
ssh_string_data(session->next_crypto->ecdh_server_pubkey),
|
|
Packit Service |
31306d |
ssh_string_len(session->next_crypto->ecdh_server_pubkey),
|
|
Packit Service |
31306d |
ctx);
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
bignum_ctx_free(ctx);
|
|
Packit Service |
31306d |
if (rc <= 0) {
|
|
Packit Service |
31306d |
EC_POINT_clear_free(pubkey);
|
|
Packit Service |
31306d |
return -1;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
buffer = malloc(len);
|
|
Packit Service |
31306d |
if (buffer == NULL) {
|
|
Packit Service |
31306d |
EC_POINT_clear_free(pubkey);
|
|
Packit Service |
31306d |
return -1;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
rc = ECDH_compute_key(buffer,
|
|
Packit Service |
31306d |
len,
|
|
Packit Service |
31306d |
pubkey,
|
|
Packit Service |
31306d |
session->next_crypto->ecdh_privkey,
|
|
Packit Service |
31306d |
NULL);
|
|
Packit Service |
31306d |
EC_POINT_clear_free(pubkey);
|
|
Packit Service |
31306d |
if (rc <= 0) {
|
|
Packit Service |
31306d |
free(buffer);
|
|
Packit Service |
31306d |
return -1;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
bignum_bin2bn(buffer, len, &session->next_crypto->shared_secret);
|
|
Packit Service |
31306d |
free(buffer);
|
|
Packit Service |
31306d |
if (session->next_crypto->shared_secret == NULL) {
|
|
Packit Service |
31306d |
EC_KEY_free(session->next_crypto->ecdh_privkey);
|
|
Packit Service |
31306d |
session->next_crypto->ecdh_privkey = NULL;
|
|
Packit Service |
31306d |
return -1;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
EC_KEY_free(session->next_crypto->ecdh_privkey);
|
|
Packit Service |
31306d |
session->next_crypto->ecdh_privkey = NULL;
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
#ifdef DEBUG_CRYPTO
|
|
Packit Service |
31306d |
ssh_log_hexdump("Session server cookie",
|
|
Packit Service |
31306d |
session->next_crypto->server_kex.cookie, 16);
|
|
Packit Service |
31306d |
ssh_log_hexdump("Session client cookie",
|
|
Packit Service |
31306d |
session->next_crypto->client_kex.cookie, 16);
|
|
Packit Service |
31306d |
ssh_print_bignum("Shared secret key", session->next_crypto->shared_secret);
|
|
Packit Service |
31306d |
#endif
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
return 0;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
#ifdef WITH_SERVER
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
/** @brief Handle a SSH_MSG_KEXDH_INIT packet (server) and send a
|
|
Packit Service |
31306d |
* SSH_MSG_KEXDH_REPLY
|
|
Packit Service |
31306d |
*/
|
|
Packit Service |
31306d |
SSH_PACKET_CALLBACK(ssh_packet_server_ecdh_init){
|
|
Packit Service |
31306d |
/* ECDH keys */
|
|
Packit Service |
31306d |
ssh_string q_c_string;
|
|
Packit Service |
31306d |
ssh_string q_s_string;
|
|
Packit Service |
31306d |
EC_KEY *ecdh_key;
|
|
Packit Service |
31306d |
const EC_GROUP *group;
|
|
Packit Service |
31306d |
const EC_POINT *ecdh_pubkey;
|
|
Packit Service |
31306d |
bignum_CTX ctx;
|
|
Packit Service |
31306d |
/* SSH host keys (rsa,dsa,ecdsa) */
|
|
Packit Service |
31306d |
ssh_key privkey;
|
|
Packit Service |
31306d |
enum ssh_digest_e digest = SSH_DIGEST_AUTO;
|
|
Packit Service |
31306d |
ssh_string sig_blob = NULL;
|
|
Packit Service |
31306d |
ssh_string pubkey_blob = NULL;
|
|
Packit Service |
31306d |
int curve;
|
|
Packit Service |
31306d |
int len;
|
|
Packit Service |
31306d |
int rc;
|
|
Packit Service |
31306d |
(void)type;
|
|
Packit Service |
31306d |
(void)user;
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
ssh_packet_remove_callbacks(session, &ssh_ecdh_server_callbacks);
|
|
Packit Service |
31306d |
/* Extract the client pubkey from the init packet */
|
|
Packit Service |
31306d |
q_c_string = ssh_buffer_get_ssh_string(packet);
|
|
Packit Service |
31306d |
if (q_c_string == NULL) {
|
|
Packit Service |
31306d |
ssh_set_error(session,SSH_FATAL, "No Q_C ECC point in packet");
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
session->next_crypto->ecdh_client_pubkey = q_c_string;
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
/* Build server's keypair */
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
ctx = BN_CTX_new();
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
curve = ecdh_kex_type_to_curve(session->next_crypto->kex_type);
|
|
Packit Service |
31306d |
if (curve == SSH_ERROR) {
|
|
Packit Service |
31306d |
BN_CTX_free(ctx);
|
|
Packit Service |
31306d |
return SSH_ERROR;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
ecdh_key = EC_KEY_new_by_curve_name(curve);
|
|
Packit Service |
31306d |
if (ecdh_key == NULL) {
|
|
Packit Service |
31306d |
ssh_set_error_oom(session);
|
|
Packit Service |
31306d |
BN_CTX_free(ctx);
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
group = EC_KEY_get0_group(ecdh_key);
|
|
Packit Service |
31306d |
EC_KEY_generate_key(ecdh_key);
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
ecdh_pubkey = EC_KEY_get0_public_key(ecdh_key);
|
|
Packit Service |
31306d |
len = EC_POINT_point2oct(group,
|
|
Packit Service |
31306d |
ecdh_pubkey,
|
|
Packit Service |
31306d |
POINT_CONVERSION_UNCOMPRESSED,
|
|
Packit Service |
31306d |
NULL,
|
|
Packit Service |
31306d |
0,
|
|
Packit Service |
31306d |
ctx);
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
q_s_string = ssh_string_new(len);
|
|
Packit Service |
31306d |
if (q_s_string == NULL) {
|
|
Packit Service |
31306d |
EC_KEY_free(ecdh_key);
|
|
Packit Service |
31306d |
BN_CTX_free(ctx);
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
EC_POINT_point2oct(group,
|
|
Packit Service |
31306d |
ecdh_pubkey,
|
|
Packit Service |
31306d |
POINT_CONVERSION_UNCOMPRESSED,
|
|
Packit Service |
31306d |
ssh_string_data(q_s_string),
|
|
Packit Service |
31306d |
len,
|
|
Packit Service |
31306d |
ctx);
|
|
Packit Service |
31306d |
BN_CTX_free(ctx);
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
session->next_crypto->ecdh_privkey = ecdh_key;
|
|
Packit Service |
31306d |
session->next_crypto->ecdh_server_pubkey = q_s_string;
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
/* build k and session_id */
|
|
Packit Service |
31306d |
rc = ecdh_build_k(session);
|
|
Packit Service |
31306d |
if (rc < 0) {
|
|
Packit Service |
31306d |
ssh_set_error(session, SSH_FATAL, "Cannot build k number");
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
/* privkey is not allocated */
|
|
Packit Service |
31306d |
rc = ssh_get_key_params(session, &privkey, &digest);
|
|
Packit Service |
31306d |
if (rc == SSH_ERROR) {
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
rc = ssh_make_sessionid(session);
|
|
Packit Service |
31306d |
if (rc != SSH_OK) {
|
|
Packit Service |
31306d |
ssh_set_error(session, SSH_FATAL, "Could not create a session id");
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
sig_blob = ssh_srv_pki_do_sign_sessionid(session, privkey, digest);
|
|
Packit Service |
31306d |
if (sig_blob == NULL) {
|
|
Packit Service |
31306d |
ssh_set_error(session, SSH_FATAL, "Could not sign the session id");
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
rc = ssh_dh_get_next_server_publickey_blob(session, &pubkey_blob);
|
|
Packit Service |
31306d |
if (rc != SSH_OK) {
|
|
Packit Service |
31306d |
ssh_set_error(session, SSH_FATAL, "Could not export server public key");
|
|
Packit Service |
31306d |
SSH_STRING_FREE(sig_blob);
|
|
Packit Service |
31306d |
return SSH_ERROR;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
rc = ssh_buffer_pack(session->out_buffer,
|
|
Packit Service |
31306d |
"bSSS",
|
|
Packit Service |
31306d |
SSH2_MSG_KEXDH_REPLY,
|
|
Packit Service |
31306d |
pubkey_blob, /* host's pubkey */
|
|
Packit Service |
31306d |
q_s_string, /* ecdh public key */
|
|
Packit Service |
31306d |
sig_blob); /* signature blob */
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
SSH_STRING_FREE(sig_blob);
|
|
Packit Service |
31306d |
SSH_STRING_FREE(pubkey_blob);
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
if (rc != SSH_OK) {
|
|
Packit Service |
31306d |
ssh_set_error_oom(session);
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
SSH_LOG(SSH_LOG_PROTOCOL, "SSH_MSG_KEXDH_REPLY sent");
|
|
Packit Service |
31306d |
rc = ssh_packet_send(session);
|
|
Packit Service |
31306d |
if (rc == SSH_ERROR) {
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
/* Send the MSG_NEWKEYS */
|
|
Packit Service |
31306d |
rc = ssh_buffer_add_u8(session->out_buffer, SSH2_MSG_NEWKEYS);
|
|
Packit Service |
31306d |
if (rc < 0) {
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
session->dh_handshake_state = DH_STATE_NEWKEYS_SENT;
|
|
Packit Service |
31306d |
rc = ssh_packet_send(session);
|
|
Packit Service |
31306d |
if (rc == SSH_ERROR){
|
|
Packit Service |
31306d |
goto error;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
SSH_LOG(SSH_LOG_PROTOCOL, "SSH_MSG_NEWKEYS sent");
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
return SSH_PACKET_USED;
|
|
Packit Service |
31306d |
error:
|
|
Packit Service |
31306d |
ssh_buffer_reinit(session->out_buffer);
|
|
Packit Service |
31306d |
session->session_state = SSH_SESSION_STATE_ERROR;
|
|
Packit Service |
31306d |
return SSH_PACKET_USED;
|
|
Packit Service |
31306d |
}
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
#endif /* WITH_SERVER */
|
|
Packit Service |
31306d |
|
|
Packit Service |
31306d |
#endif /* HAVE_ECDH */
|