| 1 |
/* $OpenBSD: mac.c,v 1.28 2014/02/07 06:55:54 djm Exp $ */ |
| 2 |
/* |
| 3 |
* Copyright (c) 2001 Markus Friedl. All rights reserved. |
| 4 |
* |
| 5 |
* Redistribution and use in source and binary forms, with or without |
| 6 |
* modification, are permitted provided that the following conditions |
| 7 |
* are met: |
| 8 |
* 1. Redistributions of source code must retain the above copyright |
| 9 |
* notice, this list of conditions and the following disclaimer. |
| 10 |
* 2. Redistributions in binary form must reproduce the above copyright |
| 11 |
* notice, this list of conditions and the following disclaimer in the |
| 12 |
* documentation and/or other materials provided with the distribution. |
| 13 |
* |
| 14 |
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
| 15 |
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
| 16 |
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
| 17 |
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
| 18 |
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
| 19 |
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| 20 |
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| 21 |
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 22 |
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 23 |
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 24 |
*/ |
| 25 |
|
| 26 |
#include "includes.h" |
| 27 |
|
| 28 |
#include <sys/types.h> |
| 29 |
|
| 30 |
#include <stdarg.h> |
| 31 |
#include <string.h> |
| 32 |
#include <signal.h> |
| 33 |
|
| 34 |
#include "xmalloc.h" |
| 35 |
#include "log.h" |
| 36 |
#include "cipher.h" |
| 37 |
#include "buffer.h" |
| 38 |
#include "key.h" |
| 39 |
#include "kex.h" |
| 40 |
#include "mac.h" |
| 41 |
#include "misc.h" |
| 42 |
|
| 43 |
#include "digest.h" |
| 44 |
#include "hmac.h" |
| 45 |
#include "umac.h" |
| 46 |
|
| 47 |
#include "openbsd-compat/openssl-compat.h" |
| 48 |
|
| 49 |
#define SSH_DIGEST 1 /* SSH_DIGEST_XXX */ |
| 50 |
#define SSH_UMAC 2 /* UMAC (not integrated with OpenSSL) */ |
| 51 |
#define SSH_UMAC128 3 |
| 52 |
|
| 53 |
struct macalg { |
| 54 |
char *name; |
| 55 |
int type; |
| 56 |
int alg; |
| 57 |
int truncatebits; /* truncate digest if != 0 */ |
| 58 |
int key_len; /* just for UMAC */ |
| 59 |
int len; /* just for UMAC */ |
| 60 |
int etm; /* Encrypt-then-MAC */ |
| 61 |
}; |
| 62 |
|
| 63 |
static const struct macalg macs[] = { |
| 64 |
/* Encrypt-and-MAC (encrypt-and-authenticate) variants */ |
| 65 |
{ "hmac-sha1", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 }, |
| 66 |
{ "hmac-sha1-96", SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 0 }, |
| 67 |
#ifdef HAVE_EVP_SHA256 |
| 68 |
{ "hmac-sha2-256", SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 0 }, |
| 69 |
{ "hmac-sha2-512", SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 0 }, |
| 70 |
#endif |
| 71 |
{ "hmac-md5", SSH_DIGEST, SSH_DIGEST_MD5, 0, 0, 0, 0 }, |
| 72 |
{ "hmac-md5-96", SSH_DIGEST, SSH_DIGEST_MD5, 96, 0, 0, 0 }, |
| 73 |
{ "hmac-ripemd160", SSH_DIGEST, SSH_DIGEST_RIPEMD160, 0, 0, 0, 0 }, |
| 74 |
{ "hmac-ripemd160@openssh.com", SSH_DIGEST, SSH_DIGEST_RIPEMD160, 0, 0, 0, 0 }, |
| 75 |
{ "umac-64@openssh.com", SSH_UMAC, 0, 0, 128, 64, 0 }, |
| 76 |
{ "umac-128@openssh.com", SSH_UMAC128, 0, 0, 128, 128, 0 }, |
| 77 |
|
| 78 |
/* Encrypt-then-MAC variants */ |
| 79 |
{ "hmac-sha1-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 1 }, |
| 80 |
{ "hmac-sha1-96-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 1 }, |
| 81 |
#ifdef HAVE_EVP_SHA256 |
| 82 |
{ "hmac-sha2-256-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 1 }, |
| 83 |
{ "hmac-sha2-512-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 1 }, |
| 84 |
#endif |
| 85 |
{ "hmac-md5-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_MD5, 0, 0, 0, 1 }, |
| 86 |
{ "hmac-md5-96-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_MD5, 96, 0, 0, 1 }, |
| 87 |
{ "hmac-ripemd160-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_RIPEMD160, 0, 0, 0, 1 }, |
| 88 |
{ "umac-64-etm@openssh.com", SSH_UMAC, 0, 0, 128, 64, 1 }, |
| 89 |
{ "umac-128-etm@openssh.com", SSH_UMAC128, 0, 0, 128, 128, 1 }, |
| 90 |
|
| 91 |
{ NULL, 0, 0, 0, 0, 0, 0 } |
| 92 |
}; |
| 93 |
|
| 94 |
/* Returns a list of supported MACs separated by the specified char. */ |
| 95 |
char * |
| 96 |
mac_alg_list(char sep) |
| 97 |
{ |
| 98 |
char *ret = NULL; |
| 99 |
size_t nlen, rlen = 0; |
| 100 |
const struct macalg *m; |
| 101 |
|
| 102 |
for (m = macs; m->name != NULL; m++) { |
| 103 |
if (ret != NULL) |
| 104 |
ret[rlen++] = sep; |
| 105 |
nlen = strlen(m->name); |
| 106 |
ret = xrealloc(ret, 1, rlen + nlen + 2); |
| 107 |
memcpy(ret + rlen, m->name, nlen + 1); |
| 108 |
rlen += nlen; |
| 109 |
} |
| 110 |
return ret; |
| 111 |
} |
| 112 |
|
| 113 |
static void |
| 114 |
mac_setup_by_alg(Mac *mac, const struct macalg *macalg) |
| 115 |
{ |
| 116 |
mac->type = macalg->type; |
| 117 |
if (mac->type == SSH_DIGEST) { |
| 118 |
if ((mac->hmac_ctx = ssh_hmac_start(macalg->alg)) == NULL) |
| 119 |
fatal("ssh_hmac_start(alg=%d) failed", macalg->alg); |
| 120 |
mac->key_len = mac->mac_len = ssh_hmac_bytes(macalg->alg); |
| 121 |
} else { |
| 122 |
mac->mac_len = macalg->len / 8; |
| 123 |
mac->key_len = macalg->key_len / 8; |
| 124 |
mac->umac_ctx = NULL; |
| 125 |
} |
| 126 |
if (macalg->truncatebits != 0) |
| 127 |
mac->mac_len = macalg->truncatebits / 8; |
| 128 |
mac->etm = macalg->etm; |
| 129 |
} |
| 130 |
|
| 131 |
int |
| 132 |
mac_setup(Mac *mac, char *name) |
| 133 |
{ |
| 134 |
const struct macalg *m; |
| 135 |
|
| 136 |
for (m = macs; m->name != NULL; m++) { |
| 137 |
if (strcmp(name, m->name) != 0) |
| 138 |
continue; |
| 139 |
if (mac != NULL) { |
| 140 |
mac_setup_by_alg(mac, m); |
| 141 |
debug2("mac_setup: setup %s", name); |
| 142 |
} |
| 143 |
return (0); |
| 144 |
} |
| 145 |
debug2("mac_setup: unknown %s", name); |
| 146 |
return (-1); |
| 147 |
} |
| 148 |
|
| 149 |
int |
| 150 |
mac_init(Mac *mac) |
| 151 |
{ |
| 152 |
if (mac->key == NULL) |
| 153 |
fatal("%s: no key", __func__); |
| 154 |
switch (mac->type) { |
| 155 |
case SSH_DIGEST: |
| 156 |
if (mac->hmac_ctx == NULL || |
| 157 |
ssh_hmac_init(mac->hmac_ctx, mac->key, mac->key_len) < 0) |
| 158 |
return -1; |
| 159 |
return 0; |
| 160 |
case SSH_UMAC: |
| 161 |
mac->umac_ctx = umac_new(mac->key); |
| 162 |
return 0; |
| 163 |
case SSH_UMAC128: |
| 164 |
mac->umac_ctx = umac128_new(mac->key); |
| 165 |
return 0; |
| 166 |
default: |
| 167 |
return -1; |
| 168 |
} |
| 169 |
} |
| 170 |
|
| 171 |
u_char * |
| 172 |
mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen) |
| 173 |
{ |
| 174 |
static union { |
| 175 |
u_char m[EVP_MAX_MD_SIZE]; |
| 176 |
u_int64_t for_align; |
| 177 |
} u; |
| 178 |
u_char b[4], nonce[8]; |
| 179 |
|
| 180 |
if (mac->mac_len > sizeof(u)) |
| 181 |
fatal("mac_compute: mac too long %u %zu", |
| 182 |
mac->mac_len, sizeof(u)); |
| 183 |
|
| 184 |
switch (mac->type) { |
| 185 |
case SSH_DIGEST: |
| 186 |
put_u32(b, seqno); |
| 187 |
/* reset HMAC context */ |
| 188 |
if (ssh_hmac_init(mac->hmac_ctx, NULL, 0) < 0 || |
| 189 |
ssh_hmac_update(mac->hmac_ctx, b, sizeof(b)) < 0 || |
| 190 |
ssh_hmac_update(mac->hmac_ctx, data, datalen) < 0 || |
| 191 |
ssh_hmac_final(mac->hmac_ctx, u.m, sizeof(u.m)) < 0) |
| 192 |
fatal("ssh_hmac failed"); |
| 193 |
break; |
| 194 |
case SSH_UMAC: |
| 195 |
put_u64(nonce, seqno); |
| 196 |
umac_update(mac->umac_ctx, data, datalen); |
| 197 |
umac_final(mac->umac_ctx, u.m, nonce); |
| 198 |
break; |
| 199 |
case SSH_UMAC128: |
| 200 |
put_u64(nonce, seqno); |
| 201 |
umac128_update(mac->umac_ctx, data, datalen); |
| 202 |
umac128_final(mac->umac_ctx, u.m, nonce); |
| 203 |
break; |
| 204 |
default: |
| 205 |
fatal("mac_compute: unknown MAC type"); |
| 206 |
} |
| 207 |
return (u.m); |
| 208 |
} |
| 209 |
|
| 210 |
void |
| 211 |
mac_clear(Mac *mac) |
| 212 |
{ |
| 213 |
if (mac->type == SSH_UMAC) { |
| 214 |
if (mac->umac_ctx != NULL) |
| 215 |
umac_delete(mac->umac_ctx); |
| 216 |
} else if (mac->type == SSH_UMAC128) { |
| 217 |
if (mac->umac_ctx != NULL) |
| 218 |
umac128_delete(mac->umac_ctx); |
| 219 |
} else if (mac->hmac_ctx != NULL) |
| 220 |
ssh_hmac_free(mac->hmac_ctx); |
| 221 |
mac->hmac_ctx = NULL; |
| 222 |
mac->umac_ctx = NULL; |
| 223 |
} |
| 224 |
|
| 225 |
/* XXX copied from ciphers_valid */ |
| 226 |
#define MAC_SEP "," |
| 227 |
int |
| 228 |
mac_valid(const char *names) |
| 229 |
{ |
| 230 |
char *maclist, *cp, *p; |
| 231 |
|
| 232 |
if (names == NULL || strcmp(names, "") == 0) |
| 233 |
return (0); |
| 234 |
maclist = cp = xstrdup(names); |
| 235 |
for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0'; |
| 236 |
(p = strsep(&cp, MAC_SEP))) { |
| 237 |
if (mac_setup(NULL, p) < 0) { |
| 238 |
debug("bad mac %s [%s]", p, names); |
| 239 |
free(maclist); |
| 240 |
return (0); |
| 241 |
} |
| 242 |
} |
| 243 |
debug3("macs ok: [%s]", names); |
| 244 |
free(maclist); |
| 245 |
return (1); |
| 246 |
} |
