From 6ff8f667f792052fd47689c3e421fcd6ddca1cd0 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Fri, 25 Aug 2017 19:15:48 +0200
Subject: [PATCH 1/3] GSSAPI Key exchange methods with DH and SHA2
---
gss-genr.c | 10 ++++++++++
kex.c | 2 ++
kex.h | 2 ++
kexgssc.c | 6 ++++++
kexgsss.c | 6 ++++++
monitor.c | 2 ++
regress/kextype.sh | 4 +++-
regress/rekey.sh | 8 ++++++--
ssh-gss.h | 2 ++
ssh_config.5 | 4 +++-
sshconnect2.c | 2 ++
sshd.c | 2 ++
sshd_config.5 | 4 +++-
13 files changed, 49 insertions(+), 5 deletions(-)
diff --git a/gss-genr.c b/gss-genr.c
index dc63682d..c6eff3d7 100644
--- a/gss-genr.c
+++ b/gss-genr.c
@@ -183,6 +183,16 @@ ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {
return GSS_C_NO_OID;
name += sizeof(KEX_GSS_GRP14_SHA1_ID) - 1;
break;
+ case KEX_GSS_GRP14_SHA256:
+ if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA256_ID))
+ return GSS_C_NO_OID;
+ name += sizeof(KEX_GSS_GRP14_SHA256_ID) - 1;
+ break;
+ case KEX_GSS_GRP16_SHA512:
+ if (strlen(name) < sizeof(KEX_GSS_GRP16_SHA512_ID))
+ return GSS_C_NO_OID;
+ name += sizeof(KEX_GSS_GRP16_SHA512_ID) - 1;
+ break;
case KEX_GSS_GEX_SHA1:
if (strlen(name) < sizeof(KEX_GSS_GEX_SHA1_ID))
return GSS_C_NO_OID;
diff --git a/kex.c b/kex.c
index 63e028fa..e798fecb 100644
--- a/kex.c
+++ b/kex.c
@@ -112,6 +112,8 @@ static const struct kexalg kexalgs[] = {
{ KEX_GSS_GEX_SHA1_ID, KEX_GSS_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
{ KEX_GSS_GRP1_SHA1_ID, KEX_GSS_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
{ KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
+ { KEX_GSS_GRP14_SHA256_ID, KEX_GSS_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
+ { KEX_GSS_GRP16_SHA512_ID, KEX_GSS_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
#endif
{ NULL, -1, -1, -1},
};
diff --git a/kex.h b/kex.h
index 8a2b37c5..f27958ae 100644
--- a/kex.h
+++ b/kex.h
@@ -102,6 +102,8 @@ enum kex_exchange {
#ifdef GSSAPI
KEX_GSS_GRP1_SHA1,
KEX_GSS_GRP14_SHA1,
+ KEX_GSS_GRP14_SHA256,
+ KEX_GSS_GRP16_SHA512,
KEX_GSS_GEX_SHA1,
#endif
KEX_MAX
diff --git a/kexgssc.c b/kexgssc.c
index 132df8b5..ed23f06d 100644
--- a/kexgssc.c
+++ b/kexgssc.c
@@ -88,8 +88,12 @@ kexgss_client(struct ssh *ssh) {
dh = dh_new_group1();
break;
case KEX_GSS_GRP14_SHA1:
+ case KEX_GSS_GRP14_SHA256:
dh = dh_new_group14();
break;
+ case KEX_GSS_GRP16_SHA512:
+ dh = dh_new_group16();
+ break;
case KEX_GSS_GEX_SHA1:
debug("Doing group exchange\n");
nbits = dh_estimate(ssh->kex->we_need * 8);
@@ -272,6 +276,8 @@ kexgss_client(struct ssh *ssh) {
switch (ssh->kex->kex_type) {
case KEX_GSS_GRP1_SHA1:
case KEX_GSS_GRP14_SHA1:
+ case KEX_GSS_GRP14_SHA256:
+ case KEX_GSS_GRP16_SHA512:
kex_dh_hash(ssh->kex->hash_alg, ssh->kex->client_version_string,
ssh->kex->server_version_string,
sshbuf_ptr(ssh->kex->my), sshbuf_len(ssh->kex->my),
diff --git a/kexgsss.c b/kexgsss.c
index 82a715cc..b7da8823 100644
--- a/kexgsss.c
+++ b/kexgsss.c
@@ -104,8 +104,12 @@ kexgss_server(struct ssh *ssh)
dh = dh_new_group1();
break;
case KEX_GSS_GRP14_SHA1:
+ case KEX_GSS_GRP14_SHA256:
dh = dh_new_group14();
break;
+ case KEX_GSS_GRP16_SHA512:
+ dh = dh_new_group16();
+ break;
case KEX_GSS_GEX_SHA1:
debug("Doing group exchange");
packet_read_expect(SSH2_MSG_KEXGSS_GROUPREQ);
@@ -223,6 +227,8 @@ kexgss_server(struct ssh *ssh)
switch (ssh->kex->kex_type) {
case KEX_GSS_GRP1_SHA1:
case KEX_GSS_GRP14_SHA1:
+ case KEX_GSS_GRP14_SHA256:
+ case KEX_GSS_GRP16_SHA512:
kex_dh_hash(ssh->kex->hash_alg,
ssh->kex->client_version_string, ssh->kex->server_version_string,
sshbuf_ptr(ssh->kex->peer), sshbuf_len(ssh->kex->peer),
diff --git a/monitor.c b/monitor.c
index 17046936..d6bc7ac7 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1648,6 +1648,8 @@ monitor_apply_keystate(struct monitor *pmonitor)
if (options.gss_keyex) {
kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
+ kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server;
+ kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server;
kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
}
#endif
diff --git a/regress/kextype.sh b/regress/kextype.sh
index 780362ca..45f4f16d 100644
--- a/regress/kextype.sh
+++ b/regress/kextype.sh
@@ -14,7 +14,9 @@ echo "KexAlgorithms=$KEXOPT" >> $OBJ/sshd_proxy
tries="1 2 3 4"
for k in `${SSH} -Q kex`; do
- if [ $k = "gss-gex-sha1-" -o $k = "gss-group1-sha1-" -o $k = "gss-group14-sha1-" ]; then
+ if [ $k = "gss-gex-sha1-" -o $k = "gss-group1-sha1-" -o \
+ $k = "gss-group14-sha1-" -o $k = "gss-group14-sha256-" -o \
+ $k = "gss-group16-sha512-" ]; then
continue
fi
verbose "kex $k"
diff --git a/regress/rekey.sh b/regress/rekey.sh
index 9fbe9b38..a2921bef 100644
--- a/regress/rekey.sh
+++ b/regress/rekey.sh
@@ -38,7 +38,9 @@ increase_datafile_size 300
opts=""
for i in `${SSH} -Q kex`; do
- if [ $i = "gss-gex-sha1-" -o $i = "gss-group1-sha1-" -o $i = "gss-group14-sha1-" ]; then
+ if [ $i = "gss-gex-sha1-" -o $i = "gss-group1-sha1-" -o \
+ $i = "gss-group14-sha1-" -o $i = "gss-group14-sha256-" -o \
+ $i = "gss-group16-sha512-" ]; then
continue
fi
opts="$opts KexAlgorithms=$i"
@@ -59,7 +61,9 @@ done
if ${SSH} -Q cipher-auth | grep '^.*$' >/dev/null 2>&1 ; then
for c in `${SSH} -Q cipher-auth`; do
for kex in `${SSH} -Q kex`; do
- if [ $kex = "gss-gex-sha1-" -o $kex = "gss-group1-sha1-" -o $kex = "gss-group14-sha1-" ]; then
+ if [ $kex = "gss-gex-sha1-" -o $kex = "gss-group1-sha1-" -o \
+ $kex = "gss-group14-sha1-" -o $kex = "gss-group14-sha256-" -o \
+ $kex = "gss-group16-sha512-" ]; then
continue
fi
verbose "client rekey $c $kex"
diff --git a/ssh-gss.h b/ssh-gss.h
index 6b6adb2b..7bf8d75e 100644
--- a/ssh-gss.h
+++ b/ssh-gss.h
@@ -70,6 +70,8 @@
#define SSH2_MSG_KEXGSS_GROUP 41
#define KEX_GSS_GRP1_SHA1_ID "gss-group1-sha1-"
#define KEX_GSS_GRP14_SHA1_ID "gss-group14-sha1-"
+#define KEX_GSS_GRP14_SHA256_ID "gss-group14-sha256-"
+#define KEX_GSS_GRP16_SHA512_ID "gss-group16-sha512-"
#define KEX_GSS_GEX_SHA1_ID "gss-gex-sha1-"
#define GSS_KEX_DEFAULT_KEX \
diff --git a/ssh_config.5 b/ssh_config.5
index 6b24649e..3d6da510 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -760,7 +760,9 @@ key exchange. Possible values are
.Bd -literal -offset 3n
gss-gex-sha1-,
gss-group1-sha1-,
-gss-group14-sha1-
+gss-group14-sha1-,
+gss-group14-sha256-,
+gss-group16-sha512-
.Ed
.Pp
The default is
diff --git a/sshconnect2.c b/sshconnect2.c
index 8db98293..5d6b8be0 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -253,6 +253,8 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
if (options.gss_keyex) {
kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_client;
kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_client;
+ kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_client;
+ kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_client;
kex->kex[KEX_GSS_GEX_SHA1] = kexgss_client;
}
#endif
diff --git a/sshd.c b/sshd.c
index 895df26f..e4c879a2 100644
--- a/sshd.c
+++ b/sshd.c
@@ -2244,6 +2244,8 @@ do_ssh2_kex(void)
if (options.gss_keyex) {
kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server;
kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server;
+ kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server;
+ kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server;
kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
}
#endif
diff --git a/sshd_config.5 b/sshd_config.5
index bf81f6af..0793418b 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -675,7 +675,9 @@ key exchange. Possible values are
.Bd -literal -offset 3n
gss-gex-sha1-,
gss-group1-sha1-,
-gss-group14-sha1-
+gss-group14-sha1-,
+gss-group14-sha256-,
+gss-group16-sha512-
.Ed
.Pp
The default is
--
2.13.5
From 7d56144903fc625c33da7fabf103f4f6bba4d43a Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Tue, 29 Aug 2017 15:32:14 +0200
Subject: [PATCH 2/3] GSSAPI Key exchange using ECDH and SHA2
---
gss-genr.c | 10 ++
kex.c | 3 +
kex.h | 4 +
kexgssc.c | 392 ++++++++++++++++++++++++++++++++++++++++++++++++++++-
kexgsss.c | 333 +++++++++++++++++++++++++++++++++++++++++++++
monitor.c | 5 +-
regress/kextype.sh | 1 +
regress/rekey.sh | 2 +
ssh-gss.h | 2 +
ssh_config.5 | 4 +-
sshconnect2.c | 2 +
sshd.c | 2 +
sshd_config.5 | 4 +-
13 files changed, 754 insertions(+), 10 deletions(-)
diff --git a/gss-genr.c b/gss-genr.c
index c6eff3d7..22040244 100644
--- a/gss-genr.c
+++ b/gss-genr.c
@@ -198,6 +198,16 @@ ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {
return GSS_C_NO_OID;
name += sizeof(KEX_GSS_GEX_SHA1_ID) - 1;
break;
+ case KEX_GSS_NISTP256_SHA256:
+ if (strlen(name) < sizeof(KEX_GSS_NISTP256_SHA256_ID))
+ return GSS_C_NO_OID;
+ name += sizeof(KEX_GSS_NISTP256_SHA256_ID) - 1;
+ break;
+ case KEX_GSS_C25519_SHA256:
+ if (strlen(name) < sizeof(KEX_GSS_C25519_SHA256_ID))
+ return GSS_C_NO_OID;
+ name += sizeof(KEX_GSS_C25519_SHA256_ID) - 1;
+ break;
default:
return GSS_C_NO_OID;
}
diff --git a/kex.c b/kex.c
index e798fecb..bdeeada9 100644
--- a/kex.c
+++ b/kex.c
@@ -114,6 +114,9 @@ static const struct kexalg kexalgs[] = {
{ KEX_GSS_GRP14_SHA1_ID, KEX_GSS_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
{ KEX_GSS_GRP14_SHA256_ID, KEX_GSS_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
{ KEX_GSS_GRP16_SHA512_ID, KEX_GSS_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
+ { KEX_GSS_NISTP256_SHA256_ID, KEX_GSS_NISTP256_SHA256,
+ NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
+ { KEX_GSS_C25519_SHA256_ID, KEX_GSS_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
#endif
{ NULL, -1, -1, -1},
};
diff --git a/kex.h b/kex.h
index f27958ae..7def8561 100644
--- a/kex.h
+++ b/kex.h
@@ -105,6 +105,8 @@ enum kex_exchange {
KEX_GSS_GRP14_SHA256,
KEX_GSS_GRP16_SHA512,
KEX_GSS_GEX_SHA1,
+ KEX_GSS_NISTP256_SHA256,
+ KEX_GSS_C25519_SHA256,
#endif
KEX_MAX
};
@@ -211,6 +213,8 @@ int kexecdh_server(struct ssh *);
int kexc25519_client(struct ssh *);
int kexc25519_server(struct ssh *);
#ifdef GSSAPI
+int kexecgss_client(struct ssh *);
+int kexecgss_server(struct ssh *);
int kexgss_client(struct ssh *);
int kexgss_server(struct ssh *);
#endif
diff --git a/kexgssc.c b/kexgssc.c
index ed23f06d..bdb3109a 100644
--- a/kexgssc.c
+++ b/kexgssc.c
@@ -43,6 +43,7 @@
#include "packet.h"
#include "dh.h"
#include "digest.h"
+#include "ssherr.h"
#include "ssh-gss.h"
@@ -52,7 +53,7 @@ kexgss_client(struct ssh *ssh) {
gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr;
Gssctxt *ctxt;
OM_uint32 maj_status, min_status, ret_flags;
- u_int klen, kout, slen = 0, strlen;
+ u_int klen, kout, slen = 0, packet_len;
DH *dh;
BIGNUM *dh_server_pub = NULL;
BIGNUM *shared_secret = NULL;
@@ -201,20 +202,20 @@ kexgss_client(struct ssh *ssh) {
debug("Received GSSAPI_CONTINUE");
if (maj_status == GSS_S_COMPLETE)
fatal("GSSAPI Continue received from server when complete");
- recv_tok.value = packet_get_string(&strlen);
- recv_tok.length = strlen;
+ recv_tok.value = packet_get_string(&packet_len);
+ recv_tok.length = packet_len;
break;
case SSH2_MSG_KEXGSS_COMPLETE:
debug("Received GSSAPI_COMPLETE");
packet_get_bignum2(dh_server_pub);
- msg_tok.value = packet_get_string(&strlen);
- msg_tok.length = strlen;
+ msg_tok.value = packet_get_string(&packet_len);
+ msg_tok.length = packet_len;
/* Is there a token included? */
if (packet_get_char()) {
recv_tok.value=
- packet_get_string(&strlen);
- recv_tok.length = strlen;
+ packet_get_string(&packet_len);
+ recv_tok.length = packet_len;
/* If we're already complete - protocol error */
if (maj_status == GSS_S_COMPLETE)
packet_disconnect("Protocol error: received token when complete");
@@ -344,4 +345,382 @@ kexgss_client(struct ssh *ssh) {
return kex_send_newkeys(ssh);
}
+int
+kexecgss_client(struct ssh *ssh) {
+ gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+ gss_buffer_desc recv_tok, gssbuf, msg_tok, *token_ptr;
+ Gssctxt *ctxt;
+ OM_uint32 maj_status, min_status, ret_flags;
+ u_int klen = 0, slen = 0, packet_len;
+ u_char *server_pub = NULL;
+ u_int server_pub_len = 0;
+ BIGNUM *shared_secret = NULL;
+ u_char *kbuf = NULL;
+ u_char *serverhostkey = NULL;
+ u_char *empty = "";
+ char *msg;
+ char *lang;
+ int type = 0;
+ int first = 1;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t hashlen;
+ const EC_GROUP *group = NULL;
+ const EC_POINT *public_key;
+ struct sshbuf *Q_C = NULL;
+ struct kex *kex = ssh->kex;
+ EC_POINT *server_public = NULL;
+ struct sshbuf *c25519_shared_secret = NULL;
+ int r;
+
+ /* Initialise our GSSAPI world */
+ ssh_gssapi_build_ctx(&ctxt);
+ if (ssh_gssapi_id_kex(ctxt, kex->name, kex->kex_type)
+ == GSS_C_NO_OID)
+ fatal("Couldn't identify host exchange");
+
+ if (ssh_gssapi_import_name(ctxt, kex->gss_host))
+ fatal("Couldn't import hostname");
+
+ if (kex->gss_client &&
+ ssh_gssapi_client_identity(ctxt, kex->gss_client))
+ fatal("Couldn't acquire client credentials");
+
+ if ((Q_C = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+
+ switch (kex->kex_type) {
+ case KEX_GSS_NISTP256_SHA256:
+ if ((kex->ec_client_key = EC_KEY_new_by_curve_name(kex->ec_nid)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (EC_KEY_generate_key(kex->ec_client_key) != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ group = EC_KEY_get0_group(kex->ec_client_key);
+ public_key = EC_KEY_get0_public_key(kex->ec_client_key);
+#ifdef DEBUG_KEXECDH
+ fputs("client private key:\n", stderr);
+ sshkey_dump_ec_key(kex->ec_client_key);
+#endif
+
+ sshbuf_put_ec(Q_C, public_key, group);
+ break;
+ case KEX_GSS_C25519_SHA256:
+ kexc25519_keygen(kex->c25519_client_key, kex->c25519_client_pubkey);
+#ifdef DEBUG_KEXECDH
+ dump_digest("client private key:", kex->c25519_client_key,
+ sizeof(kex->c25519_client_key));
+#endif
+
+ if ((r = sshbuf_put_string(Q_C, kex->c25519_client_pubkey,
+ sizeof(kex->c25519_client_pubkey))) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ break;
+ default:
+ fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
+ }
+
+ token_ptr = GSS_C_NO_BUFFER;
+
+ do {
+ /* Step 2 - call GSS_Init_sec_context() */
+ debug("Calling gss_init_sec_context");
+
+ maj_status = ssh_gssapi_init_ctx(ctxt,
+ kex->gss_deleg_creds, token_ptr, &send_tok,
+ &ret_flags);
+
+ if (GSS_ERROR(maj_status)) {
+ if (send_tok.length != 0) {
+ packet_start(SSH2_MSG_KEXGSS_CONTINUE);
+ packet_put_string(send_tok.value,
+ send_tok.length);
+ }
+ fatal("gss_init_context failed");
+ }
+
+ /* If we've got an old receive buffer get rid of it */
+ if (token_ptr != GSS_C_NO_BUFFER)
+ free(recv_tok.value);
+
+ if (maj_status == GSS_S_COMPLETE) {
+ /* If mutual state flag is not true, kex fails */
+ if (!(ret_flags & GSS_C_MUTUAL_FLAG))
+ fatal("Mutual authentication failed");
+
+ /* If integ avail flag is not true kex fails */
+ if (!(ret_flags & GSS_C_INTEG_FLAG))
+ fatal("Integrity check failed");
+ }
+
+ /*
+ * If we have data to send, then the last message that we
+ * received cannot have been a 'complete'.
+ */
+ if (send_tok.length != 0) {
+ if (first) {
+ const u_char * ptr;
+ size_t len;
+
+ packet_start(SSH2_MSG_KEXGSS_INIT);
+ packet_put_string(send_tok.value,
+ send_tok.length);
+ sshbuf_get_string_direct(Q_C, &ptr, &len);
+ packet_put_string(ptr, len);
+ first = 0;
+ } else {
+ packet_start(SSH2_MSG_KEXGSS_CONTINUE);
+ packet_put_string(send_tok.value,
+ send_tok.length);
+ }
+ packet_send();
+ gss_release_buffer(&min_status, &send_tok);
+
+ /* If we've sent them data, they should reply */
+ do {
+ type = packet_read();
+ if (type == SSH2_MSG_KEXGSS_HOSTKEY) {
+ debug("Received KEXGSS_HOSTKEY");
+ if (serverhostkey)
+ fatal("Server host key received more than once");
+ serverhostkey =
+ packet_get_string(&slen);
+ }
+ } while (type == SSH2_MSG_KEXGSS_HOSTKEY);
+
+ switch (type) {
+ case SSH2_MSG_KEXGSS_CONTINUE:
+ debug("Received GSSAPI_CONTINUE");
+ if (maj_status == GSS_S_COMPLETE)
+ fatal("GSSAPI Continue received from server when complete");
+ recv_tok.value = packet_get_string(&packet_len);
+ recv_tok.length = packet_len;
+ break;
+ case SSH2_MSG_KEXGSS_COMPLETE:
+ debug("Received GSSAPI_COMPLETE");
+ server_pub = packet_get_string(&server_pub_len);
+ msg_tok.value = packet_get_string(&packet_len);
+ msg_tok.length = packet_len;
+
+ /* Is there a token included? */
+ if (packet_get_char()) {
+ recv_tok.value=
+ packet_get_string(&packet_len);
+ recv_tok.length = packet_len;
+ /* If we're already complete - protocol error */
+ if (maj_status == GSS_S_COMPLETE)
+ packet_disconnect("Protocol error: received token when complete");
+ } else {
+ /* No token included */
+ if (maj_status != GSS_S_COMPLETE)
+ packet_disconnect("Protocol error: did not receive final token");
+ }
+ break;
+ case SSH2_MSG_KEXGSS_ERROR:
+ debug("Received Error");
+ maj_status = packet_get_int();
+ min_status = packet_get_int();
+ msg = packet_get_string(NULL);
+ lang = packet_get_string(NULL);
+ fatal("GSSAPI Error: \n%.400s",msg);
+ default:
+ packet_disconnect("Protocol error: didn't expect packet type %d",
+ type);
+ }
+ token_ptr = &recv_tok;
+ } else {
+ /* No data, and not complete */
+ if (maj_status != GSS_S_COMPLETE)
+ fatal("Not complete, and no token output");
+ }
+ } while (maj_status & GSS_S_CONTINUE_NEEDED);
+
+ /*
+ * We _must_ have received a COMPLETE message in reply from the
+ * server, which will have set dh_server_pub and msg_tok
+ */
+
+ if (type != SSH2_MSG_KEXGSS_COMPLETE)
+ fatal("Didn't receive a SSH2_MSG_KEXGSS_COMPLETE when I expected it");
+
+ /* 7. C verifies that the key Q_S is valid */
+ /* 8. C computes shared secret */
+ switch (kex->kex_type) {
+ case KEX_GSS_NISTP256_SHA256:
+ if (server_pub_len != 65)
+ fatal("The received NIST-P256 key did not match"
+ "expected length (expected 65, got %d)", server_pub_len);
+
+ if (server_pub[0] != POINT_CONVERSION_UNCOMPRESSED)
+ fatal("The received NIST-P256 key does not have first octet 0x04");
+
+ if ((server_public = EC_POINT_new(group)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+
+ if (!EC_POINT_oct2point(group, server_public, server_pub,
+ server_pub_len, NULL))
+ fatal("Can not decode received NIST-P256 client key");
+#ifdef DEBUG_KEXECDH
+ fputs("server public key:\n", stderr);
+ sshkey_dump_ec_point(group, server_public);
+#endif
+
+ if (sshkey_ec_validate_public(group, server_public) != 0) {
+ sshpkt_disconnect(ssh, "invalid client public key");
+ r = SSH_ERR_MESSAGE_INCOMPLETE;
+ goto out;
+ }
+
+ if (!EC_POINT_is_on_curve(group, server_public, NULL))
+ fatal("Received NIST-P256 client key is not on curve");
+
+ /* Calculate shared_secret */
+ klen = (EC_GROUP_get_degree(group) + 7) / 8;
+ if ((kbuf = malloc(klen)) == NULL ||
+ (shared_secret = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (ECDH_compute_key(kbuf, klen, server_public,
+ kex->ec_client_key, NULL) != (int)klen ||
+ BN_bin2bn(kbuf, klen, shared_secret) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+#ifdef DEBUG_KEXECDH
+ dump_digest("shared secret", kbuf, klen);
+#endif
+ break;
+ case KEX_GSS_C25519_SHA256:
+ if (server_pub_len != 32)
+ fatal("The received curve25519 key did not match"
+ "expected length (expected 32, got %d)", server_pub_len);
+
+ if (server_pub[server_pub_len-1] & 0x80)
+ fatal("The received key has MSB of last octet set!");
+#ifdef DEBUG_KEXECDH
+ dump_digest("server public key:", server_pub, CURVE25519_SIZE);
+#endif
+
+ /* generate shared secret */
+ if ((c25519_shared_secret = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = kexc25519_shared_key(kex->c25519_client_key,
+ server_pub, c25519_shared_secret)) < 0)
+ goto out;
+
+ /* if all octets of the shared secret are zero octets,
+ * is already checked in kexc25519_shared_key() */
+ break;
+ default:
+ fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
+ }
+
+ hashlen = sizeof(hash);
+ switch (kex->kex_type) {
+ case KEX_GSS_NISTP256_SHA256:
+ kex_ecdh_hash(
+ kex->hash_alg,
+ group,
+ kex->client_version_string,
+ kex->server_version_string,
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
+ (serverhostkey ? serverhostkey : empty), slen,
+ EC_KEY_get0_public_key(kex->ec_client_key),
+ server_public,
+ shared_secret,
+ hash, &hashlen
+ );
+ break;
+ case KEX_GSS_C25519_SHA256:
+ kex_c25519_hash(
+ kex->hash_alg,
+ kex->client_version_string, kex->server_version_string,
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
+ (serverhostkey ? serverhostkey : empty), slen,
+ kex->c25519_client_pubkey, server_pub,
+ sshbuf_ptr(c25519_shared_secret), sshbuf_len(c25519_shared_secret),
+ hash, &hashlen
+ );
+ break;
+ default:
+ fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
+ }
+
+ gssbuf.value = hash;
+ gssbuf.length = hashlen;
+
+ /* Verify that the hash matches the MIC we just got. */
+ if (GSS_ERROR(ssh_gssapi_checkmic(ctxt, &gssbuf, &msg_tok)))
+ packet_disconnect("Hash's MIC didn't verify");
+
+ free(msg_tok.value);
+
+ /* save session id */
+ if (kex->session_id == NULL) {
+ kex->session_id_len = hashlen;
+ kex->session_id = xmalloc(kex->session_id_len);
+ memcpy(kex->session_id, hash, kex->session_id_len);
+ }
+
+ if (kex->gss_deleg_creds)
+ ssh_gssapi_credentials_updated(ctxt);
+
+ if (gss_kex_context == NULL)
+ gss_kex_context = ctxt;
+ else
+ ssh_gssapi_delete_ctx(&ctxt);
+
+ /* Finally derive the keys and send them */
+ switch (kex->kex_type) {
+ case KEX_GSS_NISTP256_SHA256:
+ if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) != 0)
+ goto out;
+ break;
+ case KEX_GSS_C25519_SHA256:
+ if ((r = kex_derive_keys(ssh, hash, hashlen, c25519_shared_secret)) != 0)
+ goto out;
+ break;
+ default:
+ fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
+ }
+ r = kex_send_newkeys(ssh);
+out:
+ free(serverhostkey);
+ explicit_bzero(hash, sizeof(hash));
+ sshbuf_free(Q_C);
+ if (server_pub)
+ free(server_pub);
+ switch (kex->kex_type) {
+ case KEX_GSS_NISTP256_SHA256:
+ if (kex->ec_client_key) {
+ EC_KEY_free(kex->ec_client_key);
+ kex->ec_client_key = NULL;
+ }
+ if (server_public)
+ EC_POINT_clear_free(server_public);
+ if (kbuf) {
+ explicit_bzero(kbuf, klen);
+ free(kbuf);
+ }
+ if (shared_secret)
+ BN_clear_free(shared_secret);
+ break;
+ case KEX_GSS_C25519_SHA256:
+ explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
+ sshbuf_free(c25519_shared_secret);
+ break;
+ }
+ return r;
+}
#endif /* GSSAPI */
diff --git a/kexgsss.c b/kexgsss.c
index b7da8823..a7c42803 100644
--- a/kexgsss.c
+++ b/kexgsss.c
@@ -46,6 +46,7 @@
#include "servconf.h"
#include "ssh-gss.h"
#include "digest.h"
+#include "ssherr.h"
extern ServerOptions options;
@@ -303,4 +304,338 @@ kexgss_server(struct ssh *ssh)
ssh_gssapi_rekey_creds();
return 0;
}
+
+int
+kexecgss_server(struct ssh *ssh)
+{
+ OM_uint32 maj_status, min_status;
+
+ /*
+ * Some GSSAPI implementations use the input value of ret_flags (an
+ * output variable) as a means of triggering mechanism specific
+ * features. Initializing it to zero avoids inadvertently
+ * activating this non-standard behaviour.
+ */
+
+ OM_uint32 ret_flags = 0;
+ gss_buffer_desc gssbuf, recv_tok, msg_tok;
+ gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+ Gssctxt *ctxt = NULL;
+ u_int slen, klen = 0;
+ u_char *kbuf = NULL;
+ BIGNUM *shared_secret = NULL;
+ int type = 0;
+ gss_OID oid;
+ char *mechs;
+ u_char hash[SSH_DIGEST_MAX_LENGTH];
+ size_t hashlen;
+ u_char *client_pub = NULL;
+ u_int client_pub_len = 0;
+ const EC_GROUP *group = NULL;
+ EC_POINT *client_public = NULL;
+ EC_KEY *server_key = NULL;
+ const EC_POINT *public_key;
+ u_char c25519_server_key[CURVE25519_SIZE];
+ u_char c25519_server_pubkey[CURVE25519_SIZE];
+ struct sshbuf *c25519_shared_secret = NULL;
+ struct sshbuf *Q_S;
+ struct kex *kex = ssh->kex;
+ int r;
+
+ /* Initialise GSSAPI */
+
+ /* If we're rekeying, privsep means that some of the private structures
+ * in the GSSAPI code are no longer available. This kludges them back
+ * into life
+ */
+ if (!ssh_gssapi_oid_table_ok())
+ if ((mechs = ssh_gssapi_server_mechanisms()))
+ free(mechs);
+
+ debug2("%s: Identifying %s", __func__, kex->name);
+ oid = ssh_gssapi_id_kex(NULL, kex->name, kex->kex_type);
+ if (oid == GSS_C_NO_OID)
+ fatal("Unknown gssapi mechanism");
+
+ debug2("%s: Acquiring credentials", __func__);
+
+ if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, oid))))
+ fatal("Unable to acquire credentials for the server");
+
+ if ((Q_S = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+
+ /* 5. S generates an ephemeral key pair (do the allocations early) */
+ switch (kex->kex_type) {
+ case KEX_GSS_NISTP256_SHA256:
+ if ((server_key = EC_KEY_new_by_curve_name(kex->ec_nid)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (EC_KEY_generate_key(server_key) != 1) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ group = EC_KEY_get0_group(server_key);
+ public_key = EC_KEY_get0_public_key(server_key);
+
+ sshbuf_put_ec(Q_S, public_key, group);
+ break;
+ case KEX_GSS_C25519_SHA256:
+ kexc25519_keygen(c25519_server_key, c25519_server_pubkey);
+#ifdef DEBUG_KEXECDH
+ dump_digest("server private key:", c25519_server_key,
+ sizeof(c25519_server_key));
+#endif
+ if ((r = sshbuf_put_string(Q_S, c25519_server_pubkey,
+ sizeof(c25519_server_pubkey))) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ break;
+ default:
+ fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
+ }
+
+ do {
+ debug("Wait SSH2_MSG_GSSAPI_INIT");
+ type = packet_read();
+ switch(type) {
+ case SSH2_MSG_KEXGSS_INIT:
+ if (client_pub != NULL)
+ fatal("Received KEXGSS_INIT after initialising");
+ recv_tok.value = packet_get_string(&slen);
+ recv_tok.length = slen;
+
+ client_pub = packet_get_string(&client_pub_len);
+
+ /* Send SSH_MSG_KEXGSS_HOSTKEY here, if we want */
+ break;
+ case SSH2_MSG_KEXGSS_CONTINUE:
+ recv_tok.value = packet_get_string(&slen);
+ recv_tok.length = slen;
+ break;
+ default:
+ packet_disconnect(
+ "Protocol error: didn't expect packet type %d",
+ type);
+ }
+
+ maj_status = PRIVSEP(ssh_gssapi_accept_ctx(ctxt, &recv_tok,
+ &send_tok, &ret_flags));
+
+ free(recv_tok.value);
+
+ if (maj_status != GSS_S_COMPLETE && send_tok.length == 0)
+ fatal("Zero length token output when incomplete");
+
+ if (client_pub == NULL)
+ fatal("No client public key");
+
+ if (maj_status & GSS_S_CONTINUE_NEEDED) {
+ debug("Sending GSSAPI_CONTINUE");
+ packet_start(SSH2_MSG_KEXGSS_CONTINUE);
+ packet_put_string(send_tok.value, send_tok.length);
+ packet_send();
+ gss_release_buffer(&min_status, &send_tok);
+ }
+ } while (maj_status & GSS_S_CONTINUE_NEEDED);
+
+ if (GSS_ERROR(maj_status)) {
+ if (send_tok.length > 0) {
+ packet_start(SSH2_MSG_KEXGSS_CONTINUE);
+ packet_put_string(send_tok.value, send_tok.length);
+ packet_send();
+ }
+ fatal("accept_ctx died");
+ }
+
+ if (!(ret_flags & GSS_C_MUTUAL_FLAG))
+ fatal("Mutual Authentication flag wasn't set");
+
+ if (!(ret_flags & GSS_C_INTEG_FLAG))
+ fatal("Integrity flag wasn't set");
+
+ /* 3. S verifies that the (client) key is valid */
+ /* calculate shared secret */
+ switch (kex->kex_type) {
+ case KEX_GSS_NISTP256_SHA256:
+ if (client_pub_len != 65)
+ fatal("The received NIST-P256 key did not match"
+ "expected length (expected 65, got %d)", client_pub_len);
+
+ if (client_pub[0] != POINT_CONVERSION_UNCOMPRESSED)
+ fatal("The received NIST-P256 key does not have first octet 0x04");
+
+ if ((client_public = EC_POINT_new(group)) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+
+ if (!EC_POINT_oct2point(group, client_public, client_pub,
+ client_pub_len, NULL))
+ fatal("Can not decode received NIST-P256 client key");
+
+ if (sshkey_ec_validate_public(group, client_public) != 0) {
+ sshpkt_disconnect(ssh, "invalid client public key");
+ r = SSH_ERR_MESSAGE_INCOMPLETE;
+ goto out;
+ }
+
+ if (!EC_POINT_is_on_curve(group, client_public, NULL))
+ fatal("Received NIST-P256 client key is not on curve");
+
+ /* Calculate shared_secret */
+ klen = (EC_GROUP_get_degree(group) + 7) / 8;
+ if ((kbuf = malloc(klen)) == NULL ||
+ (shared_secret = BN_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if (ECDH_compute_key(kbuf, klen, client_public,
+ server_key, NULL) != (int)klen ||
+ BN_bin2bn(kbuf, klen, shared_secret) == NULL) {
+ r = SSH_ERR_LIBCRYPTO_ERROR;
+ goto out;
+ }
+ break;
+ case KEX_GSS_C25519_SHA256:
+ if (client_pub_len != 32)
+ fatal("The received curve25519 key did not match"
+ "expected length (expected 32, got %d)", client_pub_len);
+
+ if (client_pub[client_pub_len-1] & 0x80)
+ fatal("The received key has MSB of last octet set!");
+
+ /* generate shared secret */
+ if ((c25519_shared_secret = sshbuf_new()) == NULL) {
+ r = SSH_ERR_ALLOC_FAIL;
+ goto out;
+ }
+ if ((r = kexc25519_shared_key(c25519_server_key,
+ client_pub, c25519_shared_secret)) < 0)
+ goto out;
+
+ /* if all octets of the shared secret are zero octets,
+ * is already checked in kexc25519_shared_key() */
+ break;
+ default:
+ fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
+ }
+
+ hashlen = sizeof(hash);
+ switch (kex->kex_type) {
+ case KEX_GSS_NISTP256_SHA256:
+ kex_ecdh_hash(
+ kex->hash_alg,
+ group,
+ kex->client_version_string,
+ kex->server_version_string,
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
+ NULL, 0,
+ client_public,
+ EC_KEY_get0_public_key(server_key),
+ shared_secret,
+ hash, &hashlen
+ );
+ break;
+ case KEX_GSS_C25519_SHA256:
+ kex_c25519_hash(
+ kex->hash_alg,
+ kex->client_version_string, kex->server_version_string,
+ sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
+ sshbuf_ptr(kex->my), sshbuf_len(kex->my),
+ NULL, 0,
+ client_pub, c25519_server_pubkey,
+ sshbuf_ptr(c25519_shared_secret), sshbuf_len(c25519_shared_secret),
+ hash, &hashlen
+ );
+ break;
+ default:
+ fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
+ }
+
+ if (kex->session_id == NULL) {
+ kex->session_id_len = hashlen;
+ kex->session_id = xmalloc(kex->session_id_len);
+ memcpy(kex->session_id, hash, kex->session_id_len);
+ }
+
+ gssbuf.value = hash;
+ gssbuf.length = hashlen;
+
+ if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt,&gssbuf,&msg_tok))))
+ fatal("Couldn't get MIC");
+
+ packet_start(SSH2_MSG_KEXGSS_COMPLETE);
+ {
+ const u_char *ptr;
+ size_t len;
+ if ((r = sshbuf_get_string_direct(Q_S, &ptr, &len)) != 0)
+ fatal("%s: buffer error: %s", __func__, ssh_err(r));
+ packet_put_string(ptr, len);
+ }
+ packet_put_string(msg_tok.value, msg_tok.length);
+
+ if (send_tok.length != 0) {
+ packet_put_char(1); /* true */
+ packet_put_string(send_tok.value, send_tok.length);
+ } else {
+ packet_put_char(0); /* false */
+ }
+ packet_send();
+
+ gss_release_buffer(&min_status, &send_tok);
+ gss_release_buffer(&min_status, &msg_tok);
+
+ if (gss_kex_context == NULL)
+ gss_kex_context = ctxt;
+ else
+ ssh_gssapi_delete_ctx(&ctxt);
+
+ /* Finally derive the keys and send them */
+ switch (kex->kex_type) {
+ case KEX_GSS_NISTP256_SHA256:
+ if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) != 0)
+ goto out;
+ break;
+ case KEX_GSS_C25519_SHA256:
+ if ((r = kex_derive_keys(ssh, hash, hashlen, c25519_shared_secret)) != 0)
+ goto out;
+ break;
+ default:
+ fatal("%s: Unexpected KEX type %d", __func__, kex->kex_type);
+ }
+ if ((r = kex_send_newkeys(ssh)) != 0)
+ goto out;
+
+ /* If this was a rekey, then save out any delegated credentials we
+ * just exchanged. */
+ if (options.gss_store_rekey)
+ ssh_gssapi_rekey_creds();
+out:
+ explicit_bzero(hash, sizeof(hash));
+ if (Q_S)
+ sshbuf_free(Q_S);
+ if (client_pub)
+ free(client_pub);
+ switch (kex->kex_type) {
+ case KEX_GSS_NISTP256_SHA256:
+ if (server_key)
+ EC_KEY_free(server_key);
+ if (kbuf) {
+ explicit_bzero(kbuf, klen);
+ free(kbuf);
+ }
+ if (shared_secret)
+ BN_clear_free(shared_secret);
+ break;
+ case KEX_GSS_C25519_SHA256:
+ explicit_bzero(c25519_server_key, sizeof(c25519_server_key));
+ sshbuf_free(c25519_shared_secret);
+ break;
+ }
+ return r;
+}
#endif /* GSSAPI */
diff --git a/monitor.c b/monitor.c
index d6bc7ac7..b11616c8 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1651,6 +1651,8 @@ monitor_apply_keystate(struct monitor *pmonitor)
kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server;
kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server;
kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
+ kex->kex[KEX_GSS_NISTP256_SHA256] = kexecgss_server;
+ kex->kex[KEX_GSS_C25519_SHA256] = kexecgss_server;
}
#endif
kex->load_host_public_key=&get_hostkey_public_by_type;
@@ -1867,7 +1869,8 @@ mm_answer_gss_sign(int socket, Buffer *m)
if ((r = sshbuf_get_string(m, (u_char **)&data.value, &data.length)) != 0)
fatal("%s: buffer error: %s", __func__, ssh_err(r));
- if (data.length != 20)
+ /* Lengths of SHA-1, SHA-256 and SHA-512 hashes that are used */
+ if (data.length != 20 && data.length != 32 && data.length != 64)
fatal("%s: data length incorrect: %d", __func__,
(int) data.length);
diff --git a/regress/kextype.sh b/regress/kextype.sh
index 45f4f16d..d5b4a713 100644
--- a/regress/kextype.sh
+++ b/regress/kextype.sh
@@ -15,6 +15,7 @@ echo "KexAlgorithms=$KEXOPT" >> $OBJ/sshd_proxy
tries="1 2 3 4"
for k in `${SSH} -Q kex`; do
if [ $k = "gss-gex-sha1-" -o $k = "gss-group1-sha1-" -o \
+ $k = "gss-nistp256-sha256-" -o $k = "gss-curve25519-sha256-" -o \
$k = "gss-group14-sha1-" -o $k = "gss-group14-sha256-" -o \
$k = "gss-group16-sha512-" ]; then
continue
diff --git a/regress/rekey.sh b/regress/rekey.sh
index a2921bef..b118c6c8 100644
--- a/regress/rekey.sh
+++ b/regress/rekey.sh
@@ -39,6 +39,7 @@ increase_datafile_size 300
opts=""
for i in `${SSH} -Q kex`; do
if [ $i = "gss-gex-sha1-" -o $i = "gss-group1-sha1-" -o \
+ $i = "gss-nistp256-sha256-" -o $i = "gss-curve25519-sha256-" -o \
$i = "gss-group14-sha1-" -o $i = "gss-group14-sha256-" -o \
$i = "gss-group16-sha512-" ]; then
continue
@@ -62,6 +63,7 @@ if ${SSH} -Q cipher-auth | grep '^.*$' >/dev/null 2>&1 ; then
for c in `${SSH} -Q cipher-auth`; do
for kex in `${SSH} -Q kex`; do
if [ $kex = "gss-gex-sha1-" -o $kex = "gss-group1-sha1-" -o \
+ $kex = "gss-nistp256-sha256-" -o $kex = "gss-curve25519-sha256-" -o \
$kex = "gss-group14-sha1-" -o $kex = "gss-group14-sha256-" -o \
$kex = "gss-group16-sha512-" ]; then
continue
diff --git a/ssh-gss.h b/ssh-gss.h
index 7bf8d75e..1f73721d 100644
--- a/ssh-gss.h
+++ b/ssh-gss.h
@@ -73,6 +73,8 @@
#define KEX_GSS_GRP14_SHA256_ID "gss-group14-sha256-"
#define KEX_GSS_GRP16_SHA512_ID "gss-group16-sha512-"
#define KEX_GSS_GEX_SHA1_ID "gss-gex-sha1-"
+#define KEX_GSS_NISTP256_SHA256_ID "gss-nistp256-sha256-"
+#define KEX_GSS_C25519_SHA256_ID "gss-curve25519-sha256-"
#define GSS_KEX_DEFAULT_KEX \
KEX_GSS_GEX_SHA1_ID "," \
diff --git a/ssh_config.5 b/ssh_config.5
index 3d6da510..1dc29bf1 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -762,7 +762,9 @@ gss-gex-sha1-,
gss-group1-sha1-,
gss-group14-sha1-,
gss-group14-sha256-,
-gss-group16-sha512-
+gss-group16-sha512-,
+gss-nistp256-sha256-,
+gss-curve25519-sha256-
.Ed
.Pp
The default is
diff --git a/sshconnect2.c b/sshconnect2.c
index 5d6b8be0..280ae5a6 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -256,6 +256,8 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_client;
kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_client;
kex->kex[KEX_GSS_GEX_SHA1] = kexgss_client;
+ kex->kex[KEX_GSS_NISTP256_SHA256] = kexecgss_client;
+ kex->kex[KEX_GSS_C25519_SHA256] = kexecgss_client;
}
#endif
kex->kex[KEX_C25519_SHA256] = kexc25519_client;
diff --git a/sshd.c b/sshd.c
index e4c879a2..a35735d8 100644
--- a/sshd.c
+++ b/sshd.c
@@ -2247,6 +2247,8 @@ do_ssh2_kex(void)
kex->kex[KEX_GSS_GRP14_SHA256] = kexgss_server;
kex->kex[KEX_GSS_GRP16_SHA512] = kexgss_server;
kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server;
+ kex->kex[KEX_GSS_NISTP256_SHA256] = kexecgss_server;
+ kex->kex[KEX_GSS_C25519_SHA256] = kexecgss_server;
}
#endif
kex->server = 1;
diff --git a/sshd_config.5 b/sshd_config.5
index 0793418b..888316bf 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -677,7 +677,9 @@ gss-gex-sha1-,
gss-group1-sha1-,
gss-group14-sha1-,
gss-group14-sha256-,
-gss-group16-sha512-
+gss-group16-sha512-,
+gss-nistp256-sha256-,
+gss-curve25519-sha256-
.Ed
.Pp
The default is
--
2.13.5
From 0431695660d5eb1dd1169d42a1624c75a92aa5d2 Mon Sep 17 00:00:00 2001
From: Jakub Jelen <jjelen@redhat.com>
Date: Wed, 30 Aug 2017 15:30:51 +0200
Subject: [PATCH 3/3] Simplify rough edges of GSSAPI Kex
---
gss-genr.c | 53 +++++++++++++++++------------------------------------
regress/kextype.sh | 10 ++++------
regress/rekey.sh | 20 ++++++++------------
3 files changed, 29 insertions(+), 54 deletions(-)
diff --git a/gss-genr.c b/gss-genr.c
index 22040244..c671be31 100644
--- a/gss-genr.c
+++ b/gss-genr.c
@@ -171,47 +171,28 @@ ssh_gssapi_kex_mechs(gss_OID_set gss_supported, ssh_gssapi_check_fn *check,
gss_OID
ssh_gssapi_id_kex(Gssctxt *ctx, char *name, int kex_type) {
int i = 0;
-
- switch (kex_type) {
- case KEX_GSS_GRP1_SHA1:
- if (strlen(name) < sizeof(KEX_GSS_GRP1_SHA1_ID))
- return GSS_C_NO_OID;
- name += sizeof(KEX_GSS_GRP1_SHA1_ID) - 1;
- break;
- case KEX_GSS_GRP14_SHA1:
- if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA1_ID))
- return GSS_C_NO_OID;
- name += sizeof(KEX_GSS_GRP14_SHA1_ID) - 1;
- break;
- case KEX_GSS_GRP14_SHA256:
- if (strlen(name) < sizeof(KEX_GSS_GRP14_SHA256_ID))
- return GSS_C_NO_OID;
- name += sizeof(KEX_GSS_GRP14_SHA256_ID) - 1;
- break;
- case KEX_GSS_GRP16_SHA512:
- if (strlen(name) < sizeof(KEX_GSS_GRP16_SHA512_ID))
- return GSS_C_NO_OID;
- name += sizeof(KEX_GSS_GRP16_SHA512_ID) - 1;
- break;
- case KEX_GSS_GEX_SHA1:
- if (strlen(name) < sizeof(KEX_GSS_GEX_SHA1_ID))
- return GSS_C_NO_OID;
- name += sizeof(KEX_GSS_GEX_SHA1_ID) - 1;
- break;
- case KEX_GSS_NISTP256_SHA256:
- if (strlen(name) < sizeof(KEX_GSS_NISTP256_SHA256_ID))
- return GSS_C_NO_OID;
- name += sizeof(KEX_GSS_NISTP256_SHA256_ID) - 1;
- break;
- case KEX_GSS_C25519_SHA256:
- if (strlen(name) < sizeof(KEX_GSS_C25519_SHA256_ID))
- return GSS_C_NO_OID;
- name += sizeof(KEX_GSS_C25519_SHA256_ID) - 1;
+
+#define SKIP_KEX_NAME(type) \
+ case type: \
+ if (strlen(name) < sizeof(type##_ID)) \
+ return GSS_C_NO_OID; \
+ name += sizeof(type##_ID) - 1; \
break;
+
+ switch (kex_type) {
+ SKIP_KEX_NAME(KEX_GSS_GRP1_SHA1)
+ SKIP_KEX_NAME(KEX_GSS_GRP14_SHA1)
+ SKIP_KEX_NAME(KEX_GSS_GRP14_SHA256)
+ SKIP_KEX_NAME(KEX_GSS_GRP16_SHA512)
+ SKIP_KEX_NAME(KEX_GSS_GEX_SHA1)
+ SKIP_KEX_NAME(KEX_GSS_NISTP256_SHA256)
+ SKIP_KEX_NAME(KEX_GSS_C25519_SHA256)
default:
return GSS_C_NO_OID;
}
+#undef SKIP_KEX_NAME
+
while (gss_enc2oid[i].encoded != NULL &&
strcmp(name, gss_enc2oid[i].encoded) != 0)
i++;
diff --git a/regress/kextype.sh b/regress/kextype.sh
index d5b4a713..6b4af28a 100644
--- a/regress/kextype.sh
+++ b/regress/kextype.sh
@@ -14,12 +14,10 @@ echo "KexAlgorithms=$KEXOPT" >> $OBJ/sshd_proxy
tries="1 2 3 4"
for k in `${SSH} -Q kex`; do
- if [ $k = "gss-gex-sha1-" -o $k = "gss-group1-sha1-" -o \
- $k = "gss-nistp256-sha256-" -o $k = "gss-curve25519-sha256-" -o \
- $k = "gss-group14-sha1-" -o $k = "gss-group14-sha256-" -o \
- $k = "gss-group16-sha512-" ]; then
- continue
- fi
+ # ignore GSSAPI key exchange mechanisms (all of them start with gss-)
+ case $k in
+ gss-* ) continue ;;
+ esac
verbose "kex $k"
for i in $tries; do
${SSH} -F $OBJ/ssh_proxy -o KexAlgorithms=$k x true
diff --git a/regress/rekey.sh b/regress/rekey.sh
index b118c6c8..d6a8742f 100644
--- a/regress/rekey.sh
+++ b/regress/rekey.sh
@@ -38,12 +38,10 @@ increase_datafile_size 300
opts=""
for i in `${SSH} -Q kex`; do
- if [ $i = "gss-gex-sha1-" -o $i = "gss-group1-sha1-" -o \
- $i = "gss-nistp256-sha256-" -o $i = "gss-curve25519-sha256-" -o \
- $i = "gss-group14-sha1-" -o $i = "gss-group14-sha256-" -o \
- $i = "gss-group16-sha512-" ]; then
- continue
- fi
+ # ignore GSSAPI key exchange mechanisms (all of them start with gss-)
+ case $i in
+ gss-* ) continue ;;
+ esac
opts="$opts KexAlgorithms=$i"
done
for i in `${SSH} -Q cipher`; do
@@ -62,12 +60,10 @@ done
if ${SSH} -Q cipher-auth | grep '^.*$' >/dev/null 2>&1 ; then
for c in `${SSH} -Q cipher-auth`; do
for kex in `${SSH} -Q kex`; do
- if [ $kex = "gss-gex-sha1-" -o $kex = "gss-group1-sha1-" -o \
- $kex = "gss-nistp256-sha256-" -o $kex = "gss-curve25519-sha256-" -o \
- $kex = "gss-group14-sha1-" -o $kex = "gss-group14-sha256-" -o \
- $kex = "gss-group16-sha512-" ]; then
- continue
- fi
+ # ignore GSSAPI key exchange mechanisms (all of them start with gss-)
+ case $kex in
+ gss-* ) continue ;;
+ esac
verbose "client rekey $c $kex"
ssh_data_rekeying "KexAlgorithms=$kex" -oRekeyLimit=256k -oCiphers=$c
done
--
2.13.5