ssh: added more groups for gex

2 files changed, 38 insertions, 48 deletions

diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index 74e25e1641..9be8e45aed 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -399,16 +399,23 @@ handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = HostKey,
 %%% 
 handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request{min = Min,
 						      n   = NBits,
-						      max = Max}, Ssh0) ->
+						      max = Max}, Ssh0) when Min=<NBits, NBits=<Max ->
     %% server
-    {G,P} = dh_group1(), %% TODO real imp this seems to be a hack?!
+    {G, P} = dh_gex_group(Min, NBits, Max),
     {Private, Public} = dh_gen_key(G, P, 1024),
     {SshPacket, Ssh} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
     {ok, SshPacket, 
      Ssh#ssh{keyex_key = {{Private, Public}, {G, P}},
 	     keyex_info = {Min, Max, NBits}
-	    }}.
+	    }};
+handle_kex_dh_gex_request(_, _) ->
+  throw({{error,bad_ssh_msg_kex_dh_gex_request},
+	 #ssh_msg_disconnect{
+	    code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+	    description = "Key exchange failed, bad values in ssh_msg_kex_dh_gex_request",
+	    language = ""}
+	}).
 
 handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
     %% client
@@ -1205,9 +1212,35 @@ peer_name({Host, _}) ->
 %%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
+%%% rfc 2489, ch 6.2
 dh_group1() ->
     {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF}.
 
+%%% rfc 3526, ch3
+dh_group14() ->
+    {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF}.
+
+%%% rfc 3526, ch4
+dh_group15() ->
+   {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF}.
+
+%%% rfc 3526, ch5
+dh_group16() ->
+   {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA993B4EA988D8FDDC186FFB7DC90A6C08F4DF435C934063199FFFFFFFFFFFFFFFF}.
+
+
+%%% First try exact match:
+dh_gex_group(_Min, N, _Max) when N==1024 -> dh_group1();
+dh_gex_group(_Min, N, _Max) when N==2048 -> dh_group14();
+dh_gex_group(_Min, N, _Max) when N==3072 -> dh_group15();
+dh_gex_group(_Min, N, _Max) when N==4096 -> dh_group16();
+%%% If not an exact match, select the largest possible:
+dh_gex_group(Min, _N, Max) when Min=<4096, 4096=<Max -> dh_group16();
+dh_gex_group(Min, _N, Max) when Min=<3072, 3072=<Max -> dh_group15();
+dh_gex_group(Min, _N, Max) when Min=<2048, 2048=<Max -> dh_group14();
+dh_gex_group(Min, _N, Max) when Min=<1024, 1024=<Max -> dh_group1().
+
+
 dh_gen_key(G, P, _) ->
     {Public, Private} = crypto:generate_key(dh, [P, G]),
     {crypto:bytes_to_integer(Private), crypto:bytes_to_integer(Public)}.
@@ -1217,6 +1250,8 @@ dh_compute_key(G, P, OthersPublic, MyPrivate) ->
       crypto:compute_key(dh, OthersPublic, MyPrivate, [P,G])
      ).
 
+
+
 trim_tail(Str) ->
     lists:reverse(trim_head(lists:reverse(Str))).
 
diff --git a/lib/ssh/src/ssh_transport.hrl b/lib/ssh/src/ssh_transport.hrl
index 2faf8a9316..ab59742b96 100644
--- a/lib/ssh/src/ssh_transport.hrl
+++ b/lib/ssh/src/ssh_transport.hrl
@@ -188,49 +188,4 @@
 -define(SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,  14).
 -define(SSH_DISCONNECT_ILLEGAL_USER_NAME,  15).
 
-
-%%%----------------------------------------------------------------------
-%%% #   DH_14_xxx
-%%% Description: Oakley group 14 prime numbers and generator. Used in
-%%%              diffie-hellman-group1-sha1 key exchange method.
-%%%----------------------------------------------------------------------
-%%%----------------------------------------------------------------------
-%%% #   DH_14_P
-%%% Description: Prime for this group
-%%%----------------------------------------------------------------------
-
--define(DH_14_P,
-	<<000,000,000,129,000,255,255,255,255,255,255,255,255,201,015,218,
-	  162,033,104,194,052,196,198,098,139,128,220,028,209,041,002,078,
-	  008,138,103,204,116,002,011,190,166,059,019,155,034,081,074,008,
-	  121,142,052,004,221,239,149,025,179,205,058,067,027,048,043,010,
-	  109,242,095,020,055,079,225,053,109,109,081,194,069,228,133,181,
-	  118,098,094,126,198,244,076,066,233,166,055,237,107,011,255,092,
-	  182,244,006,183,237,238,056,107,251,090,137,159,165,174,159,036,
-	  017,124,075,031,230,073,040,102,081,236,230,083,129,255,255,255,
-	  255,255,255,255,255>>).
-
-%%%----------------------------------------------------------------------
-%%% #   DH_14_G
-%%% Description: Generator for DH_14_P.
-%%%----------------------------------------------------------------------
-
--define(DH_14_G, <<0,0,0,1,2>>).
-
-%%%----------------------------------------------------------------------
-%%% #   DH_14_Q
-%%% Description: Group order (DH_14_P - 1) / 2.
-%%%----------------------------------------------------------------------
-
--define(DH_14_Q,
-	<<000,000,000,128,127,255,255,255,255,255,255,255,228,135,237,081,
-	  016,180,097,026,098,099,049,069,192,110,014,104,148,129,039,004,
-	  069,051,230,058,001,005,223,083,029,137,205,145,040,165,004,060,
-	  199,026,002,110,247,202,140,217,230,157,033,141,152,021,133,054,
-	  249,047,138,027,167,240,154,182,182,168,225,034,242,066,218,187,
-	  049,047,063,099,122,038,033,116,211,027,246,181,133,255,174,091,
-	  122,003,091,246,247,028,053,253,173,068,207,210,215,079,146,008,
-	  190,037,143,243,036,148,051,040,246,115,041,192,255,255,255,255,
-	  255,255,255,255>>).
-
 -endif. % -ifdef(ssh_transport).