ssh: Repair/add experimental diffie-hellman-group-exchange-sha1 support

DO NOT USE IN PRODUCTION!!!

This is a bug fixing of the previously partly impelmented kex algorithm.
There are more things to do, for example genrate/select better g,p pair obeying the min||n||max request.
It is not enabled by default, but may be enabled with the option
  {preferred_algorithms, [{kex, ['diffie-hellman-group-exchange-sha1']}]}

1 files changed, 167 insertions, 80 deletions

diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index 2e7391e1f8..ce0762bf96 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -39,7 +39,7 @@
 	 key_exchange_init_msg/1,
 	 key_init/3, new_keys_message/1,
 	 handle_kexinit_msg/3, handle_kexdh_init/2,
-	 handle_kex_dh_gex_group/2, handle_kex_dh_gex_reply/2,
+	 handle_kex_dh_gex_group/2, handle_kex_dh_gex_init/2, handle_kex_dh_gex_reply/2,
 	 handle_new_keys/2, handle_kex_dh_gex_request/2,
 	 handle_kexdh_reply/2, 
 	 unpack/3, decompress/2, ssh_packet/2, pack/2, msg_data/1,
@@ -66,6 +66,8 @@ algo_classes() -> [kex, public_key, cipher, mac, compression].
 default_algorithms(compression) ->
     %% Do not announce '[email protected]' because there seem to be problems
     supported_algorithms(compression, same(['[email protected]']));
+default_algorithms(kex) ->
+    supported_algorithms(kex, ['diffie-hellman-group-exchange-sha1']);
 default_algorithms(Alg) ->
     supported_algorithms(Alg).
 
@@ -73,7 +75,8 @@ default_algorithms(Alg) ->
 supported_algorithms() -> [{K,supported_algorithms(K)} || K <- algo_classes()].
 
 supported_algorithms(kex) ->
-    ['diffie-hellman-group1-sha1'];
+    ['diffie-hellman-group1-sha1',
+     'diffie-hellman-group-exchange-sha1'];
 supported_algorithms(public_key) ->
     ssh_auth:default_public_key_algorithms();
 supported_algorithms(cipher) ->
@@ -135,7 +138,7 @@ ssh_vsn() ->
 	_:_ -> ""
     end.
     
-random_id(Nlo, Nup) -> 
+random_id(Nlo, Nup) ->
     [crypto:rand_uniform($a,$z+1) || _<- lists:duplicate(crypto:rand_uniform(Nlo,Nup+1),x)  ].
 
 hello_version_msg(Data) ->
@@ -144,7 +147,7 @@ hello_version_msg(Data) ->
 next_seqnum(SeqNum) ->
     (SeqNum + 1) band 16#ffffffff.
 
-decrypt_first_block(Bin, #ssh{decrypt_block_size = BlockSize} = Ssh0) -> 
+decrypt_first_block(Bin, #ssh{decrypt_block_size = BlockSize} = Ssh0) ->
     <<EncBlock:BlockSize/binary, EncData/binary>> = Bin,
     {Ssh, <<?UINT32(PacketLen), _/binary>> = DecData} =
 	decrypt(Ssh0, EncBlock),
@@ -282,9 +285,14 @@ verify_algorithm(#alg{kex = 'diffie-hellman-group1-sha1'}) -> true;
 verify_algorithm(#alg{kex = 'diffie-hellman-group-exchange-sha1'}) -> true;
 verify_algorithm(_) -> false.
 
+%%%----------------------------------------------------------------
+%%%
+%%% Key exchange initialization
+%%%
 key_exchange_first_msg('diffie-hellman-group1-sha1', Ssh0) ->
     {G, P} = dh_group1(),
     {Private, Public} = dh_gen_key(G, P, 1024),
+    %% Public = G^Private mod P  (def)
     {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kexdh_init{e = Public}, Ssh0),
     {ok, SshPacket, 
      Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}}}};
@@ -295,13 +303,18 @@ key_exchange_first_msg('diffie-hellman-group-exchange-sha1', Ssh0) ->
     Max = ?DEFAULT_DH_GROUP_MAX,
     {SshPacket, Ssh1} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_request{min = Min, 
-					       n = NBits, max = Max}, 
+					       n = NBits,
+					       max = Max}, 
 		   Ssh0),
     {ok, SshPacket, 
      Ssh1#ssh{keyex_info = {Min, Max, NBits}}}. 
 
-
+%%%----------------------------------------------------------------
+%%%
+%%% diffie-hellman-group1-sha1
+%%% 
 handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, Ssh0) ->
+    %% server
     {G, P} = dh_group1(),
     if
 	1=<E, E=<(P-1) ->
@@ -314,101 +327,176 @@ handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, Ssh0) ->
 								f = Public,
 								h_sig = H_SIG
 							       }, Ssh0),
-	    
 	    {ok, SshPacket, Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}},
 				     shared_secret = K,
 				     exchanged_hash = H,
 				     session_id = sid(Ssh1, H)}};
+
 	true ->
-	    Error = {error,bad_e_from_peer},
-	    Disconnect = #ssh_msg_disconnect{
-			    code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-			    description = "Key exchange failed, 'f' out of bounds",
-			    language = "en"},
-	    throw({Error, Disconnect})
+	    throw({{error,bad_e_from_peer},
+		   #ssh_msg_disconnect{
+		      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		      description = "Key exchange failed, 'e' out of bounds",
+		      language = ""}
+		   })
     end.
 
-handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
-    {Private, Public} = dh_gen_key(G,P,1024),
-    {SshPacket, Ssh1} = 
-	ssh_packet(#ssh_msg_kex_dh_gex_init{e = Public}, Ssh0),
-    {ok, SshPacket, 
-     Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}}}}.
+handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = HostKey,
+					f = F,
+					h_sig = H_SIG}, 
+		   #ssh{keyex_key = {{Private, Public}, {_G, P}}} = Ssh0) ->
+    %% client
+    if 
+	1=<F, F=<(P-1)->
+	    K = ssh_math:ipow(F, Private, P),
+	    H = kex_h(Ssh0, HostKey, Public, F, K),
+
+	    case verify_host_key(Ssh0, HostKey, H, H_SIG) of
+		ok ->
+		    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
+		    {ok, SshPacket, Ssh#ssh{shared_secret  = K,
+					    exchanged_hash = H,
+					    session_id = sid(Ssh, H)}};
+		Error ->
+		    throw({Error,
+			   #ssh_msg_disconnect{
+			      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+			      description = "Key exchange failed",
+			      language = "en"}
+			  })
+	    end;
 
-handle_new_keys(#ssh_msg_newkeys{}, Ssh0) ->
-    try install_alg(Ssh0) of
-	#ssh{} = Ssh ->
-	    {ok, Ssh}
-    catch 
-	error:_Error -> %% TODO: Throw earlier ....
-	    throw(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
-				      description = "Install alg failed", 
-				      language = "en"})
-    end. 
+	true ->
+	    throw({{error,bad_f_from_peer},
+		   #ssh_msg_disconnect{
+		      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		      description = "Key exchange failed, 'f' out of bounds",
+		      language = ""}
+		   })
+    end.
 
 
-%% %% Select algorithms
-handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = HostKey, f = F,
-					h_sig = H_SIG}, 
-		   #ssh{keyex_key = {{Private, Public}, {_G, P}}} = Ssh0) when 1=<F, F=<(P-1)->
-    K = ssh_math:ipow(F, Private, P),
-    H = kex_h(Ssh0, HostKey, Public, F, K),
-
-    case verify_host_key(Ssh0, HostKey, H, H_SIG) of
-	ok ->
-	    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
-	    {ok, SshPacket, Ssh#ssh{shared_secret  = K,
-				    exchanged_hash = H,
-				    session_id = sid(Ssh, H)}};
-	Error ->
-	    Disconnect = #ssh_msg_disconnect{
-	      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-	      description = "Key exchange failed",
-	      language = "en"},
-	    throw({Error, Disconnect})
-    end;
-handle_kexdh_reply(#ssh_msg_kexdh_reply{}, _SSH) ->
-    Error = {error,bad_f_from_peer},
-    Disconnect = #ssh_msg_disconnect{
-		    code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-		    description = "Key exchange failed, 'f' out of bounds",
-		    language = "en"},
-    throw({Error, Disconnect}).
-
-
-handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request{min = _Min,
-						      n   = _NBits,
-						      max = _Max}, Ssh0) ->
+%%%----------------------------------------------------------------
+%%%
+%%% diffie-hellman-group-exchange-sha1
+%%% 
+handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request{min = Min,
+						      n   = NBits,
+						      max = Max}, Ssh0) ->
+    %% server
     {G,P} = dh_group1(), %% TODO real imp this seems to be a hack?!
     {Private, Public} = dh_gen_key(G, P, 1024),
     {SshPacket, Ssh} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
     {ok, SshPacket, 
-     Ssh#ssh{keyex_key = {{Private, Public}, {G, P}}}}.
+     Ssh#ssh{keyex_key = {{Private, Public}, {G, P}},
+	     keyex_info = {Min, Max, NBits}
+	    }}.
+
+handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
+    %% client
+    {Private, Public} = dh_gen_key(G, P, 1024),
+    {SshPacket, Ssh1} = 
+	ssh_packet(#ssh_msg_kex_dh_gex_init{e = Public}, Ssh0),	% Pub = G^Priv mod P (def)
+
+    {ok, SshPacket, 
+     Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}}}}.
+
+handle_kex_dh_gex_init(#ssh_msg_kex_dh_gex_init{e = E}, 
+		       #ssh{keyex_key = {{Private, Public}, {G, P}},
+			    keyex_info = {Min, Max, NBits}} = 
+			   Ssh0) ->
+    %% server
+    if
+	1=<E, E=<(P-1) ->
+	    K = ssh_math:ipow(E, Private, P),
+	    if
+		1<K, K<(P-1) ->
+		    HostKey = get_host_key(Ssh0),
+		    H = kex_h(Ssh0, HostKey, Min, NBits, Max, P, G, E, Public, K),
+		    H_SIG = sign_host_key(Ssh0, HostKey, H),
+		    {SshPacket, Ssh} = 
+			ssh_packet(#ssh_msg_kex_dh_gex_reply{public_host_key = HostKey, 
+							     f = Public,
+							     h_sig = H_SIG}, Ssh0),
+		    {ok, SshPacket, Ssh#ssh{shared_secret = K,
+					    exchanged_hash = H,
+					    session_id = sid(Ssh, H)
+					   }};
+		true ->
+		    throw({{error,bad_K},
+			   #ssh_msg_disconnect{
+			      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+			      description = "Key exchange failed, 'K' out of bounds",
+			      language = ""}
+			  })
+	    end;
+	true ->
+	    throw({{error,bad_e_from_peer},
+		   #ssh_msg_disconnect{
+		      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		      description = "Key exchange failed, 'e' out of bounds",
+		      language = ""}
+		  })
+    end.
 
 handle_kex_dh_gex_reply(#ssh_msg_kex_dh_gex_reply{public_host_key = HostKey, 
 						  f = F,
 						  h_sig = H_SIG},
 			#ssh{keyex_key = {{Private, Public}, {G, P}},
 			     keyex_info = {Min, Max, NBits}} = 
-		 	Ssh0) ->
-    K = ssh_math:ipow(F, Private, P),
-    H = kex_h(Ssh0, HostKey, Min, NBits, Max, P, G, Public, F, K),
-
-    case verify_host_key(Ssh0, HostKey, H, H_SIG) of
-	ok ->
-	    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
-	    {ok, SshPacket, Ssh#ssh{shared_secret  = K,
-			  exchanged_hash = H,
-			  session_id = sid(Ssh, H)}};
-	_Error ->
-	    Disconnect = #ssh_msg_disconnect{
-	      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-	      description = "Key exchange failed",
-	      language = "en"},
-	    throw(Disconnect)
+			    Ssh0) ->
+    %% client
+    if 
+	1=<F, F=<(P-1)->
+	    K = ssh_math:ipow(F, Private, P),
+	    if
+		1<K, K<(P-1) ->
+		    H = kex_h(Ssh0, HostKey, Min, NBits, Max, P, G, Public, F, K),
+
+		    case verify_host_key(Ssh0, HostKey, H, H_SIG) of
+			ok ->
+			    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
+			    {ok, SshPacket, Ssh#ssh{shared_secret  = K,
+						    exchanged_hash = H,
+						    session_id = sid(Ssh, H)}};
+			_Error ->
+			    throw(#ssh_msg_disconnect{
+				     code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+				     description = "Key exchange failed",
+				     language = ""}
+				 )
+		    end;
+
+		true ->
+		    throw({{error,bad_K},
+			   #ssh_msg_disconnect{
+			      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+			      description = "Key exchange failed, 'K' out of bounds",
+			      language = ""}
+			  })
+	    end;
+	true ->
+	    throw({{error,bad_f_from_peer},
+		   #ssh_msg_disconnect{
+		      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		      description = "Key exchange failed, 'f' out of bounds",
+		      language = ""}
+		  })
     end.	       
 
+%%%----------------------------------------------------------------
+handle_new_keys(#ssh_msg_newkeys{}, Ssh0) ->
+    try install_alg(Ssh0) of
+	#ssh{} = Ssh ->
+	    {ok, Ssh}
+    catch 
+	error:_Error -> %% TODO: Throw earlier ....
+	    throw(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+				      description = "Install alg failed", 
+				      language = "en"})
+    end. 
+
 %% select session id
 sid(#ssh{session_id = undefined}, H) -> 
     H;
@@ -511,7 +599,6 @@ select_algorithm(Role, Client, Server) ->
 	       decompress = Decompression,
 	       c_lng = C_Lng,
 	       s_lng = S_Lng},
-%%ct:pal("~p~n Client=~p~n Server=~p~n    Alg=~p~n",[Role,Client,Server,Alg]),
     {ok, Alg}.
 
 select_encrypt_decrypt(client, Client, Server) ->
@@ -1001,7 +1088,7 @@ recv_mac_init(SSH) ->
 recv_mac_final(SSH) ->
     {ok, SSH#ssh { recv_mac = none, recv_mac_key = undefined }}.
 
-mac(none, _ , _, _) ->  
+mac(none, _ , _, _) ->
     <<>>;
 mac('hmac-sha1', Key, SeqNum, Data) ->
     crypto:hmac(sha, Key, [<<?UINT32(SeqNum)>>, Data]);