aboutsummaryrefslogtreecommitdiff
path: root/src/kex.c
AgeCommit message (Collapse)AuthorFilesLines
11 dayskex: Avoid trailing comma in cipher listJakub Jelen1-13/+10
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2023-12-18CVE-2023-48795: Strip extensions from both kex lists for matchingJakub Jelen1-4/+12
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-18CVE-2023-48795: Server side mitigationsAris Adamantiadis1-10/+36
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be> Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-12-18CVE-2023-48795: client side mitigationAris Adamantiadis1-5/+28
Signed-off-by: Aris Adamantiadis <aris@0xbadc0de.be> Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04kex: Avoid NULL pointer dereference (GHSL-2023-032)Jakub Jelen1-0/+4
Thanks Phil Turnbull from Github Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04CVE-2023-1667:kex: Add support for sending first_kex_packet_follows flagJakub Jelen1-11/+73
This is not completely straightforward as it requires us to do some state shuffling. We introduce internal flag that can turn this on in client side, so far for testing only as we do not want to universally enable this. We also repurpose the server flag indicating the guess was wrong also for the client to make desired decisions. If we found out our guess was wrong, we need to hope the server was able to figure out this much, we need to revert the DH FSM state, drop the callbacks from the "wrong" key exchange method and initiate the right one. The server side is already tested by the pkd_hello_i1, which is executing tests against dropbrear clients, which is using this flag by default out of the box. Tested manually also with the pkd_hello --rekey to make sure the server is able to handle the rekeying with all key exchange methods. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04CVE-2023-1667:kex: Correctly handle last fields of KEXINIT also in the ↵Jakub Jelen1-57/+67
client side Previously, the last two fields of KEXINIT were considered as always zero for the key exchange. This was true for the sending side, but might have not been true for the received KEXINIT from the peer. This moves the construction of these two fields closer to their reading or writing, instead of hardcoding them on the last possible moment before they go as input to the hashing function. This also allows accepting the first_kex_packet_follows on the client side, even though there is no kex algorithm now that would allow this. It also avoid memory leaks in case the server_set_kex() or ssh_set_client_kex() gets called multiple times, ensuring the algorithms will not change under our hands. It also makes use of a new flag to track if we sent KEXINIT. Previously, this was tracked only implicitly by the content of the session->next_crypto->{server,client}_kex (local kex). If it was not set, we considered it was not send. But given that we need to check the local kex even before sending it when we receive first_kex_packet_follows flag in the KEXINIT, this can no longer be used. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04CVE-2023-1667:dh: Expose the callback cleanup functionsJakub Jelen1-0/+38
These will be helpful when we already sent the first key exchange packet, but we found out that our guess was wrong and we need to initiate different key exchange method with different callbacks. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04CVE-2023-1667:kex: Factor out the kex mapping to internal enumJakub Jelen1-28/+37
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04CVE-2023-1667:kex: Remove needless function argumentJakub Jelen1-3/+3
The information if the session is client or server session is already part of the session structure so this argument only duplicated information. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04CVE-2023-1667:kex: Properly conditionalize server codeJakub Jelen1-0/+9
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04kex: Reformat ssh_kex_select_methodsJakub Jelen1-36/+41
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04Reformat ssh_packet_kexinit()Jakub Jelen1-24/+30
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04kex: Reformat ssh_send_kexJakub Jelen1-45/+50
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-05-04kex: Clarify the commentJakub Jelen1-1/+1
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2023-03-28Remove zlib from the default compression methods and fips methodskhalid1-4/+6
Signed-off-by: Khalid Mamdouh <khalidmamdou7@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-02-02Remove support for DSA KeysMohammad Shehar Yaar Tausif1-12/+2
Solving issue #110. The original work is at !231 Some changes were needed because the newly added features in master through time Signed-off-by: Mohammad Shehar Yaar Tausif <sheharyaar48@gmail.com> Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-01-25kex: Fix typoJakub Jelen1-1/+1
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-01-25Clean up usage of HAVE_ECC and HAVE_ECDHJakub Jelen1-3/+3
they might be turned off and on independenty and each of them affects different part of libssh, authentication and key exchange respectively. But only HAVE_ECC is defined by the cmake. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-01-09Add support for sk-keys through configurationNorbert Pocs1-3/+15
To be able to enable sk-ecdsa, sk-edd25519 key usage from the config file the algorithms are needed to be listed in the algorithm lists. Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-11-18kex: Add functions for openssh +,-,^ featuresNorbert Pocs1-0/+105
The funcions can: - add a list to the default list - remove a list from the default list - prepend a list to the default list Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-10-07SSH_LOG_DEBUG: Recategorize loglevelsNorbert Pocs1-2/+2
Loglevel INFO is the default openssh configuration setting which does not print redundant information. On a system using openssh with loglevels set by the terms of openssh will cause unwanted log lines in the output. recategorized based on - SSH_LOG_DEBUG are informational debug logs (no error) Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-10-07SSH_LOG_TRACE: Recategorize loglevelsNorbert Pocs1-3/+3
Do not print out logs when no fatal error happens. This approach is similiar to openssh, when Error/Fatal does not print recoverable error logs. recategorized based on - SSH_LOG_TRACE are debug logs when error happens Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-07-07Change const bignum to bignumNorbert Pocs1-10/+30
Openssl3.0 API retrieves bignum variables from a key. Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-05-02Fix multiple spelling and grammar mistakesJunda Ai1-2/+2
Signed-off-by: Junda Ai <aijunda29@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-01-05Soften behaviour of the Compression=no/yes optionFabian Vogt1-3/+3
Currently Compression=no (the default) force-disables zlib algos, while Compression=yes force-enables it. This means that mismatching options between client and server lead to connection failure. This can easily happen if the server has default settings but the client specifies Compression=yes. OpenSSH treats the option as a "prefer compression" setting: Compression=no -> none,zlib@openssh.com,zlib (default) Compression=yes -> zlib@openssh.com,zlib,none This commit changes the libssh behaviour to the same as OpenSSH. Signed-off-by: Fabian Vogt <fabian@ritter-vogt.de> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2021-08-18CVE-2021-3634: Create a separate length for session_idJakub Jelen1-1/+3
Normally, the length of session_id and secret_hash is the same, but if we will get into rekeying with a peer that changes preference of key exchange algorithm, the new secret hash can be larger or smaller than the previous session_id causing invalid reads or writes. Resolves https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35485 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2021-08-18More consistent loggingJakub Jelen1-1/+1
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2021-01-11Cleanup AES compatibility codeDirkjan Bussink1-5/+1
OpenSSL 1.0.1 has support for CTR & GCM modes so the checks here are no longer needed. This allows for a bunch of additional cleanup of the old code. As for old MacOS versions etc, LibreSSL is a kind of compatibility layer there but things already don't work anyway with that, so it doesn't break anything that isn't already broken. OpenSSL is needed on MacOS separately anyway (like installed with Homebrew). Signed-off-by: Dirkjan Bussink <d.bussink@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2020-12-22Cleanup old OpenSSL 0.9.7 compatibility codeDirkjan Bussink1-7/+2
OpenSSL 0.9.7 is already not supported, so clean up the old legacy bits for that as well. Signed-off-by: Dirkjan Bussink <d.bussink@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2020-10-14Fix handshake bug with AEAD ciphers and no HMAC overlapDirkjan Bussink1-16/+41
There's currently a bug in libssh that a handshake doesn't complete if there is no overlap between HMAC methods, but when an AEAD cipher is used. In case of an AEAD cipher such as chacha20-poly1305 or aes256-gcm, the HMAC algorithm that is being picked is not relevant. But the problem here is that the HMAC still needs to have an overlap in the handshake, even if it is not used afterwards. This was found with a very strict server side configuration with libssh where only AEAD ciphers and EtM HMAC modes are accepted. The client tested against was dropbear. Dropbear does have support for chacha20-poly1305 and AES GCM modes, but no support for EtM HMAC modes. This meant that the libssh server in this case rejected the dropbear client, even though it is perfectly able to serve it since dropbear supports AEAD algorithms. The fix implemented here updates the HMAC phase of the handshake to handle this case. If it detects an AEAD cipher is used, it uses the HMAC abbreviations for the method instead. This is the same name that is used in other places as well. It matches the client to server and server to client values, but it does depend on the order of things in the ssh_kex_types_e enum, which I'm assuming here is ok since it's explicit. I've looked at how to add a test for this, but I couldn't really find a suitable place for it. I would love some tips if this is easily possible, or if it's easier for someone else to contribute, that's of course welcome too. Signed-off-by: Dirkjan Bussink <d.bussink@gmail.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2020-09-29src/kex.c: removes DES and SHA1 from mac and kex algorithms by default.Sahana Prasad1-9/+10
Signed-off-by: Sahana Prasad <sahana@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2020-07-16Disable *-cbc ciphers by defaultJakub Jelen1-10/+13
OpenSSH disabled them in 2014 and 2017 for servers and clients so its our turn to follow the suit. Fixes T236 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2020-05-05Add basic support for none cipher and MACsJakub Jelen1-4/+10
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2020-04-20Disable RSA and DSA keys with sha1 by defaultJakub Jelen1-11/+21
Fixes: T218 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2020-04-06kex: Add support for diffie-hellman-group14-sha256Anderson Toshiyuki Sasaki1-0/+6
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-12-23kex: Avoid always-false comparisons as reported by csbuildJakub Jelen1-4/+4
/builds/jjelen/libssh-mirror/src/kex.c:360:17: warning: comparison of unsigned expression < 0 is always false [-Wtype-limits] <--[cc] 360 | if (len < 0) { | ^ /builds/jjelen/libssh-mirror/src/kex.c:372:17: warning: comparison of unsigned expression < 0 is always false [-Wtype-limits] <--[cc] 372 | if (len < 0) { | ^ Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-12-09kex: Use SSH_BUFFER_FREE()Andreas Schneider1-3/+3
Fixes T183 Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-12-09kex: Use SSH_STRING_FREE()Andreas Schneider1-7/+7
Fixes T183 Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-12-09kex: Use a len variable for length checks in ssh_packet_kexinit()Andreas Schneider1-8/+9
Fixes T188 Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-11-18Use only one variable denoting the size of methods arraysJakub Jelen1-12/+10
Previously, there was non-consistent usage of constans SSH_KEX_METHODS, KEX_METHODS_SIZE and of magic number 10 to reference the arrays used for algorithm negotiation by peers. This commit settles down to the single constant and its usage throughout the whole codebase. Fixes T195 Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-07-30Replace ssh_print_hexa() with ssh_log_hexdump()Anderson Toshiyuki Sasaki1-10/+10
Replace all occurrences of the deprecated function ssh_print_hexa() with the introduced ssh_log_hexdump(). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-07-04kex: Do not ignore keys in known_hosts filesAnderson Toshiyuki Sasaki1-83/+82
Previously, if the SSH_OPTIONS_HOSTKEYS option was set by any mean, including the client configuration file, the keys in known_hosts files wouldn't be considered before advertising the list of wanted host keys. This could result in the client requesting the server to provide a signature using a key not present in the known_hosts files (e.g. when the first wanted algorithm in SSH_OPTIONS_HOSTKEYS is not present in the known_hosts files), causing a host key mismatch and possible key rejection. Now, the keys present in the known_hosts files are prioritized over the other wanted keys. This do not change the fact that only keys of types present in the list set in SSH_OPTIONS_HOSTKEYS will be accepted and prioritized following the order defined by such list. The new wanted list of hostkeys is given by: - The keys present in known_hosts files, ordered by preference defined in SSH_OPTIONS_HOSTKEYS. If the option is not set, a default order of preference is used. - The other keys present in the same option are appended without adding duplicates. If the option is not set, the default list of keys is used. Fixes: T156 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-06-13kex: Only advertise allowed signature typesAnderson Toshiyuki Sasaki1-2/+20
Previously, if the client supported rsa-sha2-256 or rsa-sha2-512, the server would advertise the extensions as supported without checking its own list of allowed algorithms. Now the server will only advertise allowed signature algorithms. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-13kex: Reformat ssh_kex_get_supported_method()Jakub Jelen1-5/+6
2019-06-13kex: List also certificate types in list of allowed public key algorithmsJakub Jelen1-10/+35
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-12kex, pki, server, options: Filter algorithms in FIPS modeAnderson Toshiyuki Sasaki1-2/+80
When in FIPS mode, filter the algorithms to enable only the allowed ones. If any algorithm is explicitly set through options or configuration file, they are kept. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-06-12kex: Remove unused codeAnderson Toshiyuki Sasaki1-17/+0
Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-06-12kex: Make order of preferred signature algorithms consistentAnderson Toshiyuki Sasaki1-3/+3
The default order of preference for signature algorithms were not consistent. This makes the following order of preference to be the default order: * ssh-ed25519 * ecdsa-sha2-nistp521 * ecdsa-sha2-nistp384 * ecdsa-sha2-nistp256 * rsa-sha2-512 * rsa-sha2-256 * ssh-rsa * ssh-dss Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-06-12kex, known_hosts: Use new tokens functionsAnderson Toshiyuki Sasaki1-107/+17
Replace the old tokens handling functions usage with the new implementation. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-20 13:09:36 +0000