ssh: added more groups for gex

1 files changed, 38 insertions, 3 deletions

diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index 74e25e1641..9be8e45aed 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -399,16 +399,23 @@ handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = HostKey,
 %%% 
 handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request{min = Min,
 						      n   = NBits,
-						      max = Max}, Ssh0) ->
+						      max = Max}, Ssh0) when Min=<NBits, NBits=<Max ->
     %% server
-    {G,P} = dh_group1(), %% TODO real imp this seems to be a hack?!
+    {G, P} = dh_gex_group(Min, NBits, Max),
     {Private, Public} = dh_gen_key(G, P, 1024),
     {SshPacket, Ssh} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
     {ok, SshPacket, 
      Ssh#ssh{keyex_key = {{Private, Public}, {G, P}},
 	     keyex_info = {Min, Max, NBits}
-	    }}.
+	    }};
+handle_kex_dh_gex_request(_, _) ->
+  throw({{error,bad_ssh_msg_kex_dh_gex_request},
+	 #ssh_msg_disconnect{
+	    code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+	    description = "Key exchange failed, bad values in ssh_msg_kex_dh_gex_request",
+	    language = ""}
+	}).
 
 handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
     %% client
@@ -1205,9 +1212,35 @@ peer_name({Host, _}) ->
 %%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
+%%% rfc 2489, ch 6.2
 dh_group1() ->
     {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF}.
 
+%%% rfc 3526, ch3
+dh_group14() ->
+    {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF}.
+
+%%% rfc 3526, ch4
+dh_group15() ->
+   {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF}.
+
+%%% rfc 3526, ch5
+dh_group16() ->
+   {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA993B4EA988D8FDDC186FFB7DC90A6C08F4DF435C934063199FFFFFFFFFFFFFFFF}.
+
+
+%%% First try exact match:
+dh_gex_group(_Min, N, _Max) when N==1024 -> dh_group1();
+dh_gex_group(_Min, N, _Max) when N==2048 -> dh_group14();
+dh_gex_group(_Min, N, _Max) when N==3072 -> dh_group15();
+dh_gex_group(_Min, N, _Max) when N==4096 -> dh_group16();
+%%% If not an exact match, select the largest possible:
+dh_gex_group(Min, _N, Max) when Min=<4096, 4096=<Max -> dh_group16();
+dh_gex_group(Min, _N, Max) when Min=<3072, 3072=<Max -> dh_group15();
+dh_gex_group(Min, _N, Max) when Min=<2048, 2048=<Max -> dh_group14();
+dh_gex_group(Min, _N, Max) when Min=<1024, 1024=<Max -> dh_group1().
+
+
 dh_gen_key(G, P, _) ->
     {Public, Private} = crypto:generate_key(dh, [P, G]),
     {crypto:bytes_to_integer(Private), crypto:bytes_to_integer(Public)}.
@@ -1217,6 +1250,8 @@ dh_compute_key(G, P, OthersPublic, MyPrivate) ->
       crypto:compute_key(dh, OthersPublic, MyPrivate, [P,G])
      ).
 
+
+
 trim_tail(Str) ->
     lists:reverse(trim_head(lists:reverse(Str))).