summaryrefslogtreecommitdiff
path: root/usr/src
diff options
context:
space:
mode:
Diffstat (limited to 'usr/src')
-rw-r--r--usr/src/cmd/ssh/include/kex.h23
-rw-r--r--usr/src/cmd/ssh/include/mac.h10
-rw-r--r--usr/src/cmd/ssh/libssh/common/kex.c8
-rw-r--r--usr/src/cmd/ssh/libssh/common/mac.c108
-rw-r--r--usr/src/cmd/ssh/libssh/common/packet.c11
-rw-r--r--usr/src/cmd/ssh/sshd/altprivsep.c4
6 files changed, 105 insertions, 59 deletions
diff --git a/usr/src/cmd/ssh/include/kex.h b/usr/src/cmd/ssh/include/kex.h
index 77e0fc6880..30a6cdb4a5 100644
--- a/usr/src/cmd/ssh/include/kex.h
+++ b/usr/src/cmd/ssh/include/kex.h
@@ -22,7 +22,7 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/*
- * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
+ * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
@@ -36,6 +36,7 @@ extern "C" {
#endif
#include <openssl/evp.h>
+#include <openssl/hmac.h>
#include "buffer.h"
#include "cipher.h"
#include "key.h"
@@ -106,12 +107,14 @@ struct Enc {
u_char *iv;
};
struct Mac {
- char *name;
- int enabled;
- const EVP_MD *md;
- int mac_len;
- u_char *key;
- int key_len;
+ char *name;
+ int enabled;
+ u_int mac_len;
+ u_char *key;
+ u_int key_len;
+ int type;
+ const EVP_MD *evp_md;
+ HMAC_CTX evp_ctx;
};
struct Comp {
int type;
@@ -169,12 +172,6 @@ void kex_send_kexinit(Kex *);
void kex_input_kexinit(int, u_int32_t, void *);
void kex_derive_keys(Kex *, u_char *, BIGNUM *);
-/* XXX Remove after merge of 3.6/7 code is completed */
-#if 0
-void kexdh(Kex *);
-void kexgex(Kex *);
-#endif
-
Newkeys *kex_get_newkeys(int);
void kexdh_client(Kex *);
diff --git a/usr/src/cmd/ssh/include/mac.h b/usr/src/cmd/ssh/include/mac.h
index d4e0e97ae7..cc05d332ae 100644
--- a/usr/src/cmd/ssh/include/mac.h
+++ b/usr/src/cmd/ssh/include/mac.h
@@ -1,4 +1,3 @@
-/* $OpenBSD: mac.h,v 1.3 2001/06/26 17:27:24 markus Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
@@ -23,19 +22,20 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
+/* $OpenBSD: mac.h,v 1.3 2001/06/26 17:27:24 markus Exp $ */
+
#ifndef _MAC_H
#define _MAC_H
-#pragma ident "%Z%%M% %I% %E% SMI"
-
#ifdef __cplusplus
extern "C" {
#endif
-
int mac_valid(const char *);
-int mac_init(Mac *, char *);
+int mac_setup(Mac *, char *);
+int mac_init(Mac *);
u_char *mac_compute(Mac *, u_int32_t, u_char *, int);
+void mac_clear(Mac *);
#ifdef __cplusplus
}
diff --git a/usr/src/cmd/ssh/libssh/common/kex.c b/usr/src/cmd/ssh/libssh/common/kex.c
index 7bdf80c463..2df031eb33 100644
--- a/usr/src/cmd/ssh/libssh/common/kex.c
+++ b/usr/src/cmd/ssh/libssh/common/kex.c
@@ -374,8 +374,9 @@ choose_mac(Mac *mac, char *client, char *server)
{
char *name = match_list(client, server, NULL);
if (name == NULL)
- fatal("no matching mac found: client %s server %s", client, server);
- if (mac_init(mac, name) < 0)
+ fatal("no matching mac found: client %s server %s",
+ client, server);
+ if (mac_setup(mac, name) < 0)
fatal("unsupported mac %s", name);
/* truncate the key */
if (datafellows & SSH_BUG_HMAC)
@@ -384,6 +385,7 @@ choose_mac(Mac *mac, char *client, char *server)
mac->key = NULL;
mac->enabled = 0;
}
+
static void
choose_comp(Comp *comp, char *client, char *server)
{
@@ -399,6 +401,7 @@ choose_comp(Comp *comp, char *client, char *server)
}
comp->name = name;
}
+
static void
choose_kex(Kex *k, char *client, char *server)
{
@@ -418,6 +421,7 @@ choose_kex(Kex *k, char *client, char *server)
} else
fatal("bad kex alg %s", k->name);
}
+
static void
choose_hostkeyalg(Kex *k, char *client, char *server)
{
diff --git a/usr/src/cmd/ssh/libssh/common/mac.c b/usr/src/cmd/ssh/libssh/common/mac.c
index c04a2746f1..e25f5eb95d 100644
--- a/usr/src/cmd/ssh/libssh/common/mac.c
+++ b/usr/src/cmd/ssh/libssh/common/mac.c
@@ -1,8 +1,4 @@
/*
- * Copyright 2003 Sun Microsystems, Inc. All rights reserved.
- * Use is subject to license terms.
- */
-/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -29,8 +25,6 @@
#include "includes.h"
RCSID("$OpenBSD: mac.c,v 1.5 2002/05/16 22:02:50 markus Exp $");
-#pragma ident "%Z%%M% %I% %E% SMI"
-
#include <openssl/hmac.h>
#include "xmalloc.h"
@@ -39,63 +33,111 @@ RCSID("$OpenBSD: mac.c,v 1.5 2002/05/16 22:02:50 markus Exp $");
#include "cipher.h"
#include "kex.h"
#include "mac.h"
+#include "misc.h"
+
+#define SSH_EVP 1 /* OpenSSL EVP-based MAC */
struct {
char *name;
+ int type;
const EVP_MD * (*mdfunc)(void);
int truncatebits; /* truncate digest if != 0 */
+ int key_len; /* will be used if we have UMAC */
} macs[] = {
- { "hmac-sha1", EVP_sha1, 0 },
- { "hmac-sha1-96", EVP_sha1, 96 },
- { "hmac-md5", EVP_md5, 0 },
- { "hmac-md5-96", EVP_md5, 96 },
+ { "hmac-sha1", SSH_EVP, EVP_sha1, 0, -1 },
+ { "hmac-sha1-96", SSH_EVP, EVP_sha1, 96, -1 },
+ { "hmac-md5", SSH_EVP, EVP_md5, 0, -1 },
+ { "hmac-md5-96", SSH_EVP, EVP_md5, 96, -1 },
#ifdef SOLARIS_SSH_ENABLE_RIPEMD160
- { "hmac-ripemd160", EVP_ripemd160, 0 },
- { "hmac-ripemd160@openssh.com", EVP_ripemd160, 0 },
+ { "hmac-ripemd160", SSH_EVP, EVP_ripemd160, 0, -1 },
+ { "hmac-ripemd160@openssh.com", SSH_EVP, EVP_ripemd160, 0, -1 },
#endif /* SOLARIS_SSH_ENABLE_RIPEMD160 */
- { NULL, NULL, 0 }
+ { NULL, 0, NULL, 0, -1 }
};
+static void
+mac_setup_by_id(Mac *mac, int which)
+{
+ int evp_len;
+ mac->type = macs[which].type;
+ if (mac->type == SSH_EVP) {
+ mac->evp_md = (*macs[which].mdfunc)();
+ if ((evp_len = EVP_MD_size(mac->evp_md)) <= 0)
+ fatal("mac %s len %d", mac->name, evp_len);
+ mac->key_len = mac->mac_len = (u_int)evp_len;
+ } else
+ fatal("wrong MAC type (%d)", mac->type);
+ if (macs[which].truncatebits != 0)
+ mac->mac_len = macs[which].truncatebits / 8;
+}
+
int
-mac_init(Mac *mac, char *name)
+mac_setup(Mac *mac, char *name)
{
int i;
+
for (i = 0; macs[i].name; i++) {
if (strcmp(name, macs[i].name) == 0) {
- if (mac != NULL) {
- mac->md = (*macs[i].mdfunc)();
- mac->key_len = mac->mac_len = EVP_MD_size(mac->md);
- if (macs[i].truncatebits != 0)
- mac->mac_len = macs[i].truncatebits/8;
- }
- debug2("mac_init: found %s", name);
+ if (mac != NULL)
+ mac_setup_by_id(mac, i);
+ debug2("mac_setup: found %s", name);
return (0);
}
}
- debug2("mac_init: unknown %s", name);
+ debug2("mac_setup: unknown %s", name);
return (-1);
}
+int
+mac_init(Mac *mac)
+{
+ if (mac->key == NULL)
+ fatal("mac_init: no key");
+ switch (mac->type) {
+ case SSH_EVP:
+ if (mac->evp_md == NULL)
+ return -1;
+ HMAC_Init(&mac->evp_ctx, mac->key, mac->key_len, mac->evp_md);
+ return 0;
+ default:
+ return -1;
+ }
+}
+
u_char *
mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
{
- HMAC_CTX c;
static u_char m[EVP_MAX_MD_SIZE];
u_char b[4];
- if (mac->key == NULL)
- fatal("mac_compute: no key");
if (mac->mac_len > sizeof(m))
- fatal("mac_compute: mac too long");
- HMAC_Init(&c, mac->key, mac->key_len, mac->md);
- PUT_32BIT(b, seqno);
- HMAC_Update(&c, b, sizeof(b));
- HMAC_Update(&c, data, datalen);
- HMAC_Final(&c, m, NULL);
- HMAC_cleanup(&c);
+ fatal("mac_compute: mac too long %u %lu",
+ mac->mac_len, (u_long)sizeof(m));
+
+ switch (mac->type) {
+ case SSH_EVP:
+ put_u32(b, seqno);
+ /* reset HMAC context */
+ HMAC_Init(&mac->evp_ctx, NULL, 0, NULL);
+ HMAC_Update(&mac->evp_ctx, b, sizeof(b));
+ HMAC_Update(&mac->evp_ctx, data, datalen);
+ HMAC_Final(&mac->evp_ctx, m, NULL);
+ break;
+ default:
+ fatal("mac_compute: unknown MAC type");
+ }
+
return (m);
}
+void
+mac_clear(Mac *mac)
+{
+ if (mac->evp_md != NULL)
+ HMAC_cleanup(&mac->evp_ctx);
+ mac->evp_md = NULL;
+}
+
/* XXX copied from ciphers_valid */
#define MAC_SEP ","
int
@@ -108,7 +150,7 @@ mac_valid(const char *names)
maclist = cp = xstrdup(names);
for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0';
(p = strsep(&cp, MAC_SEP))) {
- if (mac_init(NULL, p) < 0) {
+ if (mac_setup(NULL, p) < 0) {
debug("bad mac %s [%s]", p, names);
xfree(maclist);
return (0);
diff --git a/usr/src/cmd/ssh/libssh/common/packet.c b/usr/src/cmd/ssh/libssh/common/packet.c
index 1635a2b75a..0906cc94e1 100644
--- a/usr/src/cmd/ssh/libssh/common/packet.c
+++ b/usr/src/cmd/ssh/libssh/common/packet.c
@@ -36,7 +36,7 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/*
- * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
+ * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
@@ -601,7 +601,7 @@ set_newkeys(int mode)
enc = &newkeys[mode]->enc;
mac = &newkeys[mode]->mac;
comp = &newkeys[mode]->comp;
- if (mac->md != NULL)
+ if (mac_init(mac) == 0)
mac->enabled = 1;
#ifdef PACKET_DEBUG
debug("new encryption key:\n");
@@ -671,12 +671,15 @@ free_keys(Newkeys *keys)
enc = &keys->enc;
mac = &keys->mac;
comp = &keys->comp;
- memset(mac->key, 0, mac->key_len);
xfree(enc->name);
xfree(enc->iv);
xfree(enc->key);
- xfree(mac->name);
+
+ memset(mac->key, 0, mac->key_len);
xfree(mac->key);
+ xfree(mac->name);
+ mac_clear(mac);
+
xfree(comp->name);
xfree(keys);
}
diff --git a/usr/src/cmd/ssh/sshd/altprivsep.c b/usr/src/cmd/ssh/sshd/altprivsep.c
index 2f1548f51d..5fb6e8905f 100644
--- a/usr/src/cmd/ssh/sshd/altprivsep.c
+++ b/usr/src/cmd/ssh/sshd/altprivsep.c
@@ -18,7 +18,7 @@
*
* CDDL HEADER END
*
- * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
+ * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
@@ -491,7 +491,7 @@ altprivsep_get_newkeys(enum kex_modes mode)
/* MAC name */
mac->name = altprivsep_packet_get_string(NULL);
- if (mac_init(mac, mac->name) < 0)
+ if (mac_setup(mac, mac->name) < 0)
fatal("Monitor negotiated an unknown MAC algorithm "
"during re-key");
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-31 14:22:42 +0000