[gssapi-openssh.git] / openssh / kex.c

/* $OpenBSD: kex.c,v 1.80 2008/09/06 12:24:13 djm Exp $ */
/*
 * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#include <sys/param.h>

#include <signal.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <openssl/crypto.h>

#include "xmalloc.h"
#include "ssh2.h"
#include "buffer.h"
#include "packet.h"
#include "compat.h"
#include "cipher.h"
#include "key.h"
#include "kex.h"
#include "log.h"
#include "mac.h"
#include "match.h"
#include "dispatch.h"
#include "monitor.h"
#include "canohost.h"

#ifdef GSSAPI
#include "ssh-gss.h"
#endif

#define KEX_COOKIE_LEN	16

#if OPENSSL_VERSION_NUMBER >= 0x00907000L
# if defined(HAVE_EVP_SHA256)
# define evp_ssh_sha256 EVP_sha256
# else
extern const EVP_MD *evp_ssh_sha256(void);
# endif
#endif

/* prototype */
static void kex_kexinit_finish(Kex *);
static void kex_choose_conf(Kex *);

/* put algorithm proposal into buffer */
/* used in sshconnect.c as well as kex.c */
void
kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
{
	u_int i;

	buffer_clear(b);
	/*
	 * add a dummy cookie, the cookie will be overwritten by
	 * kex_send_kexinit(), each time a kexinit is set
	 */
	for (i = 0; i < KEX_COOKIE_LEN; i++)
		buffer_put_char(b, 0);
	for (i = 0; i < PROPOSAL_MAX; i++)
		buffer_put_cstring(b, proposal[i]);
	buffer_put_char(b, 0);			/* first_kex_packet_follows */
	buffer_put_int(b, 0);			/* uint32 reserved */
}

/* parse buffer and return algorithm proposal */
static char **
kex_buf2prop(Buffer *raw, int *first_kex_follows)
{
	Buffer b;
	u_int i;
	char **proposal;

	proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));

	buffer_init(&b);
	buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
	/* skip cookie */
	for (i = 0; i < KEX_COOKIE_LEN; i++)
		buffer_get_char(&b);
	/* extract kex init proposal strings */
	for (i = 0; i < PROPOSAL_MAX; i++) {
		proposal[i] = buffer_get_string(&b,NULL);
		debug2("kex_parse_kexinit: %s", proposal[i]);
	}
	/* first kex follows / reserved */
	i = buffer_get_char(&b);
	if (first_kex_follows != NULL)
		*first_kex_follows = i;
	debug2("kex_parse_kexinit: first_kex_follows %d ", i);
	i = buffer_get_int(&b);
	debug2("kex_parse_kexinit: reserved %u ", i);
	buffer_free(&b);
	return proposal;
}

static void
kex_prop_free(char **proposal)
{
	u_int i;

	for (i = 0; i < PROPOSAL_MAX; i++)
		xfree(proposal[i]);
	xfree(proposal);
}

/* ARGSUSED */
static void
kex_protocol_error(int type, u_int32_t seq, void *ctxt)
{
	error("Hm, kex protocol error: type %d seq %u", type, seq);
}

static void
kex_reset_dispatch(void)
{
	dispatch_range(SSH2_MSG_TRANSPORT_MIN,
	    SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
	dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
}

void
kex_finish(Kex *kex)
{
	kex_reset_dispatch();

	packet_start(SSH2_MSG_NEWKEYS);
	packet_send();
	/* packet_write_wait(); */
	debug("SSH2_MSG_NEWKEYS sent");

	debug("expecting SSH2_MSG_NEWKEYS");
	packet_read_expect(SSH2_MSG_NEWKEYS);
	packet_check_eom();
	debug("SSH2_MSG_NEWKEYS received");

	kex->done = 1;
	buffer_clear(&kex->peer);
	/* buffer_clear(&kex->my); */
	kex->flags &= ~KEX_INIT_SENT;
	xfree(kex->name);
	kex->name = NULL;
}

void
kex_send_kexinit(Kex *kex)
{
	u_int32_t rnd = 0;
	u_char *cookie;
	u_int i;

	if (kex == NULL) {
		error("kex_send_kexinit: no kex, cannot rekey");
		return;
	}
	if (kex->flags & KEX_INIT_SENT) {
		debug("KEX_INIT_SENT");
		return;
	}
	kex->done = 0;

	/* generate a random cookie */
	if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
		fatal("kex_send_kexinit: kex proposal too short");
	cookie = buffer_ptr(&kex->my);
	for (i = 0; i < KEX_COOKIE_LEN; i++) {
		if (i % 4 == 0)
			rnd = arc4random();
		cookie[i] = rnd;
		rnd >>= 8;
	}
	packet_start(SSH2_MSG_KEXINIT);
	packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
	packet_send();
	debug("SSH2_MSG_KEXINIT sent");
	kex->flags |= KEX_INIT_SENT;
}

/* ARGSUSED */
void
kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
{
	char *ptr;
	u_int i, dlen;
	Kex *kex = (Kex *)ctxt;

	debug("SSH2_MSG_KEXINIT received");
	if (kex == NULL)
		fatal("kex_input_kexinit: no kex, cannot rekey");

	ptr = packet_get_raw(&dlen);
	buffer_append(&kex->peer, ptr, dlen);

	/* discard packet */
	for (i = 0; i < KEX_COOKIE_LEN; i++)
		packet_get_char();
	for (i = 0; i < PROPOSAL_MAX; i++)
		xfree(packet_get_string(NULL));
	(void) packet_get_char();
	(void) packet_get_int();
	packet_check_eom();

	kex_kexinit_finish(kex);
}

Kex *
kex_setup(char *proposal[PROPOSAL_MAX])
{
	Kex *kex;

	kex = xcalloc(1, sizeof(*kex));
	buffer_init(&kex->peer);
	buffer_init(&kex->my);
	kex_prop2buf(&kex->my, proposal);
	kex->done = 0;

	kex_send_kexinit(kex);					/* we start */
	kex_reset_dispatch();

	return kex;
}

static void
kex_kexinit_finish(Kex *kex)
{
	if (!(kex->flags & KEX_INIT_SENT))
		kex_send_kexinit(kex);

	kex_choose_conf(kex);

	if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
	    kex->kex[kex->kex_type] != NULL) {
		(kex->kex[kex->kex_type])(kex);
	} else {
		fatal("Unsupported key exchange %d", kex->kex_type);
	}
}

static void
choose_enc(Enc *enc, char *client, char *server)
{
	char *name = match_list(client, server, NULL);
	if (name == NULL)
		fatal("no matching cipher found: client %s server %s",
		    client, server);
	if ((enc->cipher = cipher_by_name(name)) == NULL)
		fatal("matching cipher is not supported: %s", name);
	enc->name = name;
	enc->enabled = 0;
	enc->iv = NULL;
	enc->key = NULL;
	enc->key_len = cipher_keylen(enc->cipher);
	enc->block_size = cipher_blocksize(enc->cipher);
}

static void
choose_mac(Mac *mac, char *client, char *server)
{
	char *name = match_list(client, server, NULL);
	if (name == NULL)
		fatal("no matching mac found: client %s server %s",
		    client, server);
	if (mac_setup(mac, name) < 0)
		fatal("unsupported mac %s", name);
	/* truncate the key */
	if (datafellows & SSH_BUG_HMAC)
		mac->key_len = 16;
	mac->name = name;
	mac->key = NULL;
	mac->enabled = 0;
}

static void
choose_comp(Comp *comp, char *client, char *server)
{
	char *name = match_list(client, server, NULL);
	if (name == NULL)
		fatal("no matching comp found: client %s server %s", client, server);
	if (strcmp(name, "zlib@openssh.com") == 0) {
		comp->type = COMP_DELAYED;
	} else if (strcmp(name, "zlib") == 0) {
		comp->type = COMP_ZLIB;
	} else if (strcmp(name, "none") == 0) {
		comp->type = COMP_NONE;
	} else {
		fatal("unsupported comp %s", name);
	}
	comp->name = name;
}

static void
choose_kex(Kex *k, char *client, char *server)
{
	k->name = match_list(client, server, NULL);
	if (k->name == NULL)
		fatal("Unable to negotiate a key exchange method");
	if (strcmp(k->name, KEX_DH1) == 0) {
		k->kex_type = KEX_DH_GRP1_SHA1;
		k->evp_md = EVP_sha1();
	} else if (strcmp(k->name, KEX_DH14) == 0) {
		k->kex_type = KEX_DH_GRP14_SHA1;
		k->evp_md = EVP_sha1();
	} else if (strcmp(k->name, KEX_DHGEX_SHA1) == 0) {
		k->kex_type = KEX_DH_GEX_SHA1;
		k->evp_md = EVP_sha1();
#if OPENSSL_VERSION_NUMBER >= 0x00907000L
	} else if (strcmp(k->name, KEX_DHGEX_SHA256) == 0) {
		k->kex_type = KEX_DH_GEX_SHA256;
		k->evp_md = evp_ssh_sha256();
#endif
#ifdef GSSAPI
	} else if (strncmp(k->name, KEX_GSS_GEX_SHA1_ID,
	    sizeof(KEX_GSS_GEX_SHA1_ID) - 1) == 0) {
		k->kex_type = KEX_GSS_GEX_SHA1;
		k->evp_md = EVP_sha1();
	} else if (strncmp(k->name, KEX_GSS_GRP1_SHA1_ID,
	    sizeof(KEX_GSS_GRP1_SHA1_ID) - 1) == 0) {
		k->kex_type = KEX_GSS_GRP1_SHA1;
		k->evp_md = EVP_sha1();
	} else if (strncmp(k->name, KEX_GSS_GRP14_SHA1_ID,
	    sizeof(KEX_GSS_GRP14_SHA1_ID) - 1) == 0) {
		k->kex_type = KEX_GSS_GRP14_SHA1;
		k->evp_md = EVP_sha1();
#endif
	} else
		fatal("bad kex alg %s", k->name);
}

static void
choose_hostkeyalg(Kex *k, char *client, char *server)
{
	char *hostkeyalg = match_list(client, server, NULL);
	if (hostkeyalg == NULL)
		fatal("no hostkey alg");
	k->hostkey_type = key_type_from_name(hostkeyalg);
	if (k->hostkey_type == KEY_UNSPEC)
		fatal("bad hostkey alg '%s'", hostkeyalg);
	xfree(hostkeyalg);
}

static int
proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
{
	static int check[] = {
		PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
	};
	int *idx;
	char *p;

	for (idx = &check[0]; *idx != -1; idx++) {
		if ((p = strchr(my[*idx], ',')) != NULL)
			*p = '\0';
		if ((p = strchr(peer[*idx], ',')) != NULL)
			*p = '\0';
		if (strcmp(my[*idx], peer[*idx]) != 0) {
			debug2("proposal mismatch: my %s peer %s",
			    my[*idx], peer[*idx]);
			return (0);
		}
	}
	debug2("proposals match");
	return (1);
}

static void
kex_choose_conf(Kex *kex)
{
	Newkeys *newkeys;
	char **my, **peer;
	char **cprop, **sprop;
	int nenc, nmac, ncomp;
	u_int mode, ctos, need;
	int first_kex_follows, type;
	int log_flag = 0;

	int auth_flag;

	auth_flag = packet_authentication_state();

	debug ("AUTH STATE IS %d", auth_flag);

	my   = kex_buf2prop(&kex->my, NULL);
	peer = kex_buf2prop(&kex->peer, &first_kex_follows);

	if (kex->server) {
		cprop=peer;
		sprop=my;
	} else {
		cprop=my;
		sprop=peer;
	}

	/* Algorithm Negotiation */
	for (mode = 0; mode < MODE_MAX; mode++) {
		newkeys = xcalloc(1, sizeof(*newkeys));
		kex->newkeys[mode] = newkeys;
		ctos = (!kex->server && mode == MODE_OUT) ||
		    (kex->server && mode == MODE_IN);
		nenc  = ctos ? PROPOSAL_ENC_ALGS_CTOS  : PROPOSAL_ENC_ALGS_STOC;
		nmac  = ctos ? PROPOSAL_MAC_ALGS_CTOS  : PROPOSAL_MAC_ALGS_STOC;
		ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
		choose_enc (&newkeys->enc,  cprop[nenc],  sprop[nenc]);
		choose_mac (&newkeys->mac,  cprop[nmac],  sprop[nmac]);
		choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
		debug("REQUESTED ENC.NAME is '%s'", newkeys->enc.name);
		if (strcmp(newkeys->enc.name, "none") == 0) {
				debug("Requesting NONE. Authflag is %d", auth_flag);			
			if (auth_flag == 1) {
				debug("None requested post authentication.");
			} else {
				fatal("Pre-authentication none cipher requests are not allowed.");
			}
		} 
		debug("kex: %s %s %s %s",
		    ctos ? "client->server" : "server->client",
		    newkeys->enc.name,
		    newkeys->mac.name,
		    newkeys->comp.name);
		/* client starts withctos = 0 && log flag = 0 and no log*/
		/* 2nd client pass ctos=1 and flag = 1 so no log*/
		/* server starts with ctos =1 && log_flag = 0 so log */
		/* 2nd sever pass ctos = 1 && log flag = 1 so no log*/
		/* -cjr*/
		if (ctos && !log_flag) {
			logit("SSH: Server;Ltype: Kex;Remote: %s-%d;Enc: %s;MAC: %s;Comp: %s",
			      get_remote_ipaddr(),
			      get_remote_port(),
			      newkeys->enc.name,
			      newkeys->mac.name,
			      newkeys->comp.name);
		}
		log_flag = 1;
	}
	choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
	choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
	    sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
	need = 0;
	for (mode = 0; mode < MODE_MAX; mode++) {
		newkeys = kex->newkeys[mode];
		if (need < newkeys->enc.key_len)
			need = newkeys->enc.key_len;
		if (need < newkeys->enc.block_size)
			need = newkeys->enc.block_size;
		if (need < newkeys->mac.key_len)
			need = newkeys->mac.key_len;
	}
	/* XXX need runden? */
	kex->we_need = need;

	/* ignore the next message if the proposals do not match */
	if (first_kex_follows && !proposals_match(my, peer) &&
	    !(datafellows & SSH_BUG_FIRSTKEX)) {
		type = packet_read();
		debug2("skipping next packet (type %u)", type);
	}

	kex_prop_free(my);
	kex_prop_free(peer);
}

static u_char *
derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
    BIGNUM *shared_secret)
{
	Buffer b;
	EVP_MD_CTX md;
	char c = id;
	u_int have;
	int mdsz;
	u_char *digest;

	if ((mdsz = EVP_MD_size(kex->evp_md)) <= 0)
		fatal("bad kex md size %d", mdsz);
	digest = xmalloc(roundup(need, mdsz));

	buffer_init(&b);
	buffer_put_bignum2(&b, shared_secret);

	/* K1 = HASH(K || H || "A" || session_id) */
	EVP_DigestInit(&md, kex->evp_md);
	if (!(datafellows & SSH_BUG_DERIVEKEY))
		EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
	EVP_DigestUpdate(&md, hash, hashlen);
	EVP_DigestUpdate(&md, &c, 1);
	EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
	EVP_DigestFinal(&md, digest, NULL);

	/*
	 * expand key:
	 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
	 * Key = K1 || K2 || ... || Kn
	 */
	for (have = mdsz; need > have; have += mdsz) {
		EVP_DigestInit(&md, kex->evp_md);
		if (!(datafellows & SSH_BUG_DERIVEKEY))
			EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
		EVP_DigestUpdate(&md, hash, hashlen);
		EVP_DigestUpdate(&md, digest, have);
		EVP_DigestFinal(&md, digest + have, NULL);
	}
	buffer_free(&b);
#ifdef DEBUG_KEX
	fprintf(stderr, "key '%c'== ", c);
	dump_digest("key", digest, need);
#endif
	return digest;
}

Newkeys *current_keys[MODE_MAX];

#define NKEYS	6
void
kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen, BIGNUM *shared_secret)
{
	u_char *keys[NKEYS];
	u_int i, mode, ctos;

	for (i = 0; i < NKEYS; i++) {
		keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
		    shared_secret);
	}

	debug2("kex_derive_keys");
	for (mode = 0; mode < MODE_MAX; mode++) {
		current_keys[mode] = kex->newkeys[mode];
		kex->newkeys[mode] = NULL;
		ctos = (!kex->server && mode == MODE_OUT) ||
		    (kex->server && mode == MODE_IN);
		current_keys[mode]->enc.iv  = keys[ctos ? 0 : 1];
		current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
		current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
	}
}

Newkeys *
kex_get_newkeys(int mode)
{
	Newkeys *ret;

	ret = current_keys[mode];
	current_keys[mode] = NULL;
	return ret;
}

void
derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
    u_int8_t cookie[8], u_int8_t id[16])
{
	const EVP_MD *evp_md = EVP_md5();
	EVP_MD_CTX md;
	u_int8_t nbuf[2048], obuf[EVP_MAX_MD_SIZE];
	int len;

	EVP_DigestInit(&md, evp_md);

	len = BN_num_bytes(host_modulus);
	if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
		fatal("%s: bad host modulus (len %d)", __func__, len);
	BN_bn2bin(host_modulus, nbuf);
	EVP_DigestUpdate(&md, nbuf, len);

	len = BN_num_bytes(server_modulus);
	if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
		fatal("%s: bad server modulus (len %d)", __func__, len);
	BN_bn2bin(server_modulus, nbuf);
	EVP_DigestUpdate(&md, nbuf, len);

	EVP_DigestUpdate(&md, cookie, 8);

	EVP_DigestFinal(&md, obuf, NULL);
	memcpy(id, obuf, 16);

	memset(nbuf, 0, sizeof(nbuf));
	memset(obuf, 0, sizeof(obuf));
	memset(&md, 0, sizeof(md));
}

#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
void
dump_digest(char *msg, u_char *digest, int len)
{
	u_int i;

	fprintf(stderr, "%s\n", msg);
	for (i = 0; i < len; i++) {
		fprintf(stderr, "%02x", digest[i]);
		if (i%32 == 31)
			fprintf(stderr, "\n");
		else if (i%8 == 7)
			fprintf(stderr, " ");
	}
	fprintf(stderr, "\n");
}
#endif
Commit	Line	Data
91d9cdd3	1	/* $OpenBSD: kex.c,v 1.80 2008/09/06 12:24:13 djm Exp $ */
3c0ef626	2	/*
	3	* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	*
	14	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	15	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	16	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	17	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	18	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	19	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	20	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	21	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	23	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "includes.h"
9108f8d9	27
	28	#include <sys/param.h>
	29
	30	#include <signal.h>
	31	#include <stdarg.h>
	32	#include <stdio.h>
	33	#include <stdlib.h>
	34	#include <string.h>
3c0ef626	35
	36	#include <openssl/crypto.h>
	37
3c0ef626	38	#include "xmalloc.h"
9108f8d9	39	#include "ssh2.h"
3c0ef626	40	#include "buffer.h"
3c0ef626	41	#include "packet.h"
	42	#include "compat.h"
	43	#include "cipher.h"
3c0ef626	44	#include "key.h"
9108f8d9	45	#include "kex.h"
3c0ef626	46	#include "log.h"
	47	#include "mac.h"
	48	#include "match.h"
	49	#include "dispatch.h"
700318f3	50	#include "monitor.h"
76d45d2f	51	#include "canohost.h"
3c0ef626	52
f97edba6	53	#ifdef GSSAPI
	54	#include "ssh-gss.h"
	55	#endif
	56
3c0ef626	57	#define KEX_COOKIE_LEN 16
3c0ef626	58
9108f8d9	59	#if OPENSSL_VERSION_NUMBER >= 0x00907000L
	60	# if defined(HAVE_EVP_SHA256)
	61	# define evp_ssh_sha256 EVP_sha256
	62	# else
	63	extern const EVP_MD *evp_ssh_sha256(void);
	64	# endif
	65	#endif
	66
3c0ef626	67	/* prototype */
	68	static void kex_kexinit_finish(Kex *);
	69	static void kex_choose_conf(Kex *);
	70
	71	/* put algorithm proposal into buffer */
76d45d2f	72	/* used in sshconnect.c as well as kex.c */
76d45d2f	73	void
3c0ef626	74	kex_prop2buf(Buffer b, char proposal[PROPOSAL_MAX])
3c0ef626	75	{
665a873d	76	u_int i;
3c0ef626	77
3c0ef626	78	buffer_clear(b);
700318f3	79	/*
	80	* add a dummy cookie, the cookie will be overwritten by
	81	* kex_send_kexinit(), each time a kexinit is set
	82	*/
	83	for (i = 0; i < KEX_COOKIE_LEN; i++)
	84	buffer_put_char(b, 0);
3c0ef626	85	for (i = 0; i < PROPOSAL_MAX; i++)
	86	buffer_put_cstring(b, proposal[i]);
	87	buffer_put_char(b, 0); /* first_kex_packet_follows */
	88	buffer_put_int(b, 0); /* uint32 reserved */
	89	}
	90
	91	/* parse buffer and return algorithm proposal */
	92	static char **
6a9b3198	93	kex_buf2prop(Buffer raw, int first_kex_follows)
3c0ef626	94	{
3c0ef626	95	Buffer b;
d4487008	96	u_int i;
3c0ef626	97	char **proposal;
3c0ef626	98
9108f8d9	99	proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
3c0ef626	100
	101	buffer_init(&b);
	102	buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
	103	/* skip cookie */
	104	for (i = 0; i < KEX_COOKIE_LEN; i++)
	105	buffer_get_char(&b);
	106	/* extract kex init proposal strings */
	107	for (i = 0; i < PROPOSAL_MAX; i++) {
	108	proposal[i] = buffer_get_string(&b,NULL);
	109	debug2("kex_parse_kexinit: %s", proposal[i]);
	110	}
	111	/* first kex follows / reserved */
	112	i = buffer_get_char(&b);
6a9b3198	113	if (first_kex_follows != NULL)
6a9b3198	114	*first_kex_follows = i;
3c0ef626	115	debug2("kex_parse_kexinit: first_kex_follows %d ", i);
3c0ef626	116	i = buffer_get_int(&b);
d4487008	117	debug2("kex_parse_kexinit: reserved %u ", i);
3c0ef626	118	buffer_free(&b);
	119	return proposal;
	120	}
	121
	122	static void
	123	kex_prop_free(char **proposal)
	124	{
665a873d	125	u_int i;
3c0ef626	126
	127	for (i = 0; i < PROPOSAL_MAX; i++)
	128	xfree(proposal[i]);
	129	xfree(proposal);
	130	}
	131
d4487008	132	/* ARGSUSED */
3c0ef626	133	static void
e9a17296	134	kex_protocol_error(int type, u_int32_t seq, void *ctxt)
3c0ef626	135	{
e9a17296	136	error("Hm, kex protocol error: type %d seq %u", type, seq);
3c0ef626	137	}
	138
	139	static void
e9a17296	140	kex_reset_dispatch(void)
3c0ef626	141	{
e9a17296	142	dispatch_range(SSH2_MSG_TRANSPORT_MIN,
	143	SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
	144	dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
3c0ef626	145	}
	146
	147	void
	148	kex_finish(Kex *kex)
	149	{
e9a17296	150	kex_reset_dispatch();
3c0ef626	151
	152	packet_start(SSH2_MSG_NEWKEYS);
	153	packet_send();
	154	/* packet_write_wait(); */
	155	debug("SSH2_MSG_NEWKEYS sent");
	156
6a9b3198	157	debug("expecting SSH2_MSG_NEWKEYS");
e9a17296	158	packet_read_expect(SSH2_MSG_NEWKEYS);
e9a17296	159	packet_check_eom();
3c0ef626	160	debug("SSH2_MSG_NEWKEYS received");
	161
	162	kex->done = 1;
	163	buffer_clear(&kex->peer);
	164	/* buffer_clear(&kex->my); */
	165	kex->flags &= ~KEX_INIT_SENT;
	166	xfree(kex->name);
	167	kex->name = NULL;
	168	}
	169
	170	void
	171	kex_send_kexinit(Kex *kex)
	172	{
c9f39d2c	173	u_int32_t rnd = 0;
700318f3	174	u_char *cookie;
665a873d	175	u_int i;
700318f3	176
3c0ef626	177	if (kex == NULL) {
	178	error("kex_send_kexinit: no kex, cannot rekey");
	179	return;
	180	}
	181	if (kex->flags & KEX_INIT_SENT) {
	182	debug("KEX_INIT_SENT");
	183	return;
	184	}
	185	kex->done = 0;
700318f3	186
	187	/* generate a random cookie */
	188	if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
	189	fatal("kex_send_kexinit: kex proposal too short");
	190	cookie = buffer_ptr(&kex->my);
	191	for (i = 0; i < KEX_COOKIE_LEN; i++) {
	192	if (i % 4 == 0)
c9f39d2c	193	rnd = arc4random();
	194	cookie[i] = rnd;
	195	rnd >>= 8;
700318f3	196	}
3c0ef626	197	packet_start(SSH2_MSG_KEXINIT);
	198	packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
	199	packet_send();
	200	debug("SSH2_MSG_KEXINIT sent");
	201	kex->flags \|= KEX_INIT_SENT;
	202	}
	203
d4487008	204	/* ARGSUSED */
3c0ef626	205	void
e9a17296	206	kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
3c0ef626	207	{
3c0ef626	208	char *ptr;
665a873d	209	u_int i, dlen;
3c0ef626	210	Kex kex = (Kex )ctxt;
	211
	212	debug("SSH2_MSG_KEXINIT received");
	213	if (kex == NULL)
	214	fatal("kex_input_kexinit: no kex, cannot rekey");
	215
	216	ptr = packet_get_raw(&dlen);
	217	buffer_append(&kex->peer, ptr, dlen);
	218
	219	/* discard packet */
	220	for (i = 0; i < KEX_COOKIE_LEN; i++)
	221	packet_get_char();
	222	for (i = 0; i < PROPOSAL_MAX; i++)
	223	xfree(packet_get_string(NULL));
680cee3b	224	(void) packet_get_char();
680cee3b	225	(void) packet_get_int();
e9a17296	226	packet_check_eom();
3c0ef626	227
	228	kex_kexinit_finish(kex);
	229	}
	230
	231	Kex *
	232	kex_setup(char *proposal[PROPOSAL_MAX])
	233	{
	234	Kex *kex;
	235
9108f8d9	236	kex = xcalloc(1, sizeof(*kex));
3c0ef626	237	buffer_init(&kex->peer);
	238	buffer_init(&kex->my);
	239	kex_prop2buf(&kex->my, proposal);
	240	kex->done = 0;
	241
	242	kex_send_kexinit(kex); /* we start */
e9a17296	243	kex_reset_dispatch();
3c0ef626	244
	245	return kex;
	246	}
	247
	248	static void
	249	kex_kexinit_finish(Kex *kex)
	250	{
	251	if (!(kex->flags & KEX_INIT_SENT))
	252	kex_send_kexinit(kex);
	253
	254	kex_choose_conf(kex);
	255
6a9b3198	256	if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
	257	kex->kex[kex->kex_type] != NULL) {
	258	(kex->kex[kex->kex_type])(kex);
	259	} else {
3c0ef626	260	fatal("Unsupported key exchange %d", kex->kex_type);
	261	}
	262	}
	263
	264	static void
	265	choose_enc(Enc enc, char client, char *server)
	266	{
	267	char *name = match_list(client, server, NULL);
	268	if (name == NULL)
d4487008	269	fatal("no matching cipher found: client %s server %s",
d4487008	270	client, server);
e9a17296	271	if ((enc->cipher = cipher_by_name(name)) == NULL)
3c0ef626	272	fatal("matching cipher is not supported: %s", name);
	273	enc->name = name;
	274	enc->enabled = 0;
	275	enc->iv = NULL;
	276	enc->key = NULL;
e9a17296	277	enc->key_len = cipher_keylen(enc->cipher);
e9a17296	278	enc->block_size = cipher_blocksize(enc->cipher);
3c0ef626	279	}
9108f8d9	280
3c0ef626	281	static void
	282	choose_mac(Mac mac, char client, char *server)
	283	{
	284	char *name = match_list(client, server, NULL);
	285	if (name == NULL)
d4487008	286	fatal("no matching mac found: client %s server %s",
	287	client, server);
	288	if (mac_setup(mac, name) < 0)
3c0ef626	289	fatal("unsupported mac %s", name);
	290	/* truncate the key */
	291	if (datafellows & SSH_BUG_HMAC)
	292	mac->key_len = 16;
	293	mac->name = name;
	294	mac->key = NULL;
	295	mac->enabled = 0;
	296	}
9108f8d9	297
3c0ef626	298	static void
	299	choose_comp(Comp comp, char client, char *server)
	300	{
	301	char *name = match_list(client, server, NULL);
	302	if (name == NULL)
	303	fatal("no matching comp found: client %s server %s", client, server);
665a873d	304	if (strcmp(name, "zlib@openssh.com") == 0) {
	305	comp->type = COMP_DELAYED;
	306	} else if (strcmp(name, "zlib") == 0) {
	307	comp->type = COMP_ZLIB;
3c0ef626	308	} else if (strcmp(name, "none") == 0) {
665a873d	309	comp->type = COMP_NONE;
3c0ef626	310	} else {
	311	fatal("unsupported comp %s", name);
	312	}
	313	comp->name = name;
	314	}
9108f8d9	315
3c0ef626	316	static void
	317	choose_kex(Kex k, char client, char *server)
	318	{
	319	k->name = match_list(client, server, NULL);
	320	if (k->name == NULL)
d4487008	321	fatal("Unable to negotiate a key exchange method");
3c0ef626	322	if (strcmp(k->name, KEX_DH1) == 0) {
6a9b3198	323	k->kex_type = KEX_DH_GRP1_SHA1;
2c06c99b	324	k->evp_md = EVP_sha1();
c9f39d2c	325	} else if (strcmp(k->name, KEX_DH14) == 0) {
c9f39d2c	326	k->kex_type = KEX_DH_GRP14_SHA1;
2c06c99b	327	k->evp_md = EVP_sha1();
2c06c99b	328	} else if (strcmp(k->name, KEX_DHGEX_SHA1) == 0) {
6a9b3198	329	k->kex_type = KEX_DH_GEX_SHA1;
2c06c99b	330	k->evp_md = EVP_sha1();
9108f8d9	331	#if OPENSSL_VERSION_NUMBER >= 0x00907000L
	332	} else if (strcmp(k->name, KEX_DHGEX_SHA256) == 0) {
	333	k->kex_type = KEX_DH_GEX_SHA256;
	334	k->evp_md = evp_ssh_sha256();
	335	#endif
f97edba6	336	#ifdef GSSAPI
	337	} else if (strncmp(k->name, KEX_GSS_GEX_SHA1_ID,
	338	sizeof(KEX_GSS_GEX_SHA1_ID) - 1) == 0) {
	339	k->kex_type = KEX_GSS_GEX_SHA1;
	340	k->evp_md = EVP_sha1();
	341	} else if (strncmp(k->name, KEX_GSS_GRP1_SHA1_ID,
	342	sizeof(KEX_GSS_GRP1_SHA1_ID) - 1) == 0) {
	343	k->kex_type = KEX_GSS_GRP1_SHA1;
	344	k->evp_md = EVP_sha1();
	345	} else if (strncmp(k->name, KEX_GSS_GRP14_SHA1_ID,
	346	sizeof(KEX_GSS_GRP14_SHA1_ID) - 1) == 0) {
	347	k->kex_type = KEX_GSS_GRP14_SHA1;
	348	k->evp_md = EVP_sha1();
	349	#endif
3c0ef626	350	} else
	351	fatal("bad kex alg %s", k->name);
	352	}
2c06c99b	353
3c0ef626	354	static void
	355	choose_hostkeyalg(Kex k, char client, char *server)
	356	{
	357	char *hostkeyalg = match_list(client, server, NULL);
	358	if (hostkeyalg == NULL)
	359	fatal("no hostkey alg");
	360	k->hostkey_type = key_type_from_name(hostkeyalg);
	361	if (k->hostkey_type == KEY_UNSPEC)
	362	fatal("bad hostkey alg '%s'", hostkeyalg);
	363	xfree(hostkeyalg);
	364	}
	365
cdd66111	366	static int
6a9b3198	367	proposals_match(char my[PROPOSAL_MAX], char peer[PROPOSAL_MAX])
	368	{
	369	static int check[] = {
	370	PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
	371	};
	372	int *idx;
	373	char *p;
	374
	375	for (idx = &check[0]; *idx != -1; idx++) {
	376	if ((p = strchr(my[*idx], ',')) != NULL)
	377	*p = '\0';
	378	if ((p = strchr(peer[*idx], ',')) != NULL)
	379	*p = '\0';
	380	if (strcmp(my[idx], peer[idx]) != 0) {
	381	debug2("proposal mismatch: my %s peer %s",
	382	my[idx], peer[idx]);
	383	return (0);
	384	}
	385	}
	386	debug2("proposals match");
	387	return (1);
	388	}
	389
3c0ef626	390	static void
	391	kex_choose_conf(Kex *kex)
	392	{
	393	Newkeys *newkeys;
	394	char my, peer;
	395	char cprop, sprop;
	396	int nenc, nmac, ncomp;
665a873d	397	u_int mode, ctos, need;
6a9b3198	398	int first_kex_follows, type;
76d45d2f	399	int log_flag = 0;
	400
	401	int auth_flag;
	402
	403	auth_flag = packet_authentication_state();
	404
	405	debug ("AUTH STATE IS %d", auth_flag);
3c0ef626	406
6a9b3198	407	my = kex_buf2prop(&kex->my, NULL);
6a9b3198	408	peer = kex_buf2prop(&kex->peer, &first_kex_follows);
3c0ef626	409
	410	if (kex->server) {
	411	cprop=peer;
	412	sprop=my;
	413	} else {
	414	cprop=my;
	415	sprop=peer;
	416	}
	417
	418	/* Algorithm Negotiation */
	419	for (mode = 0; mode < MODE_MAX; mode++) {
9108f8d9	420	newkeys = xcalloc(1, sizeof(*newkeys));
3c0ef626	421	kex->newkeys[mode] = newkeys;
d4487008	422	ctos = (!kex->server && mode == MODE_OUT) \|\|
d4487008	423	(kex->server && mode == MODE_IN);
3c0ef626	424	nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
	425	nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
	426	ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
	427	choose_enc (&newkeys->enc, cprop[nenc], sprop[nenc]);
	428	choose_mac (&newkeys->mac, cprop[nmac], sprop[nmac]);
	429	choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
76d45d2f	430	debug("REQUESTED ENC.NAME is '%s'", newkeys->enc.name);
	431	if (strcmp(newkeys->enc.name, "none") == 0) {
	432	debug("Requesting NONE. Authflag is %d", auth_flag);
	433	if (auth_flag == 1) {
	434	debug("None requested post authentication.");
	435	} else {
	436	fatal("Pre-authentication none cipher requests are not allowed.");
	437	}
	438	}
3c0ef626	439	debug("kex: %s %s %s %s",
	440	ctos ? "client->server" : "server->client",
	441	newkeys->enc.name,
	442	newkeys->mac.name,
	443	newkeys->comp.name);
76d45d2f	444	/* client starts withctos = 0 && log flag = 0 and no log*/
	445	/* 2nd client pass ctos=1 and flag = 1 so no log*/
	446	/* server starts with ctos =1 && log_flag = 0 so log */
	447	/* 2nd sever pass ctos = 1 && log flag = 1 so no log*/
	448	/* -cjr*/
	449	if (ctos && !log_flag) {
	450	logit("SSH: Server;Ltype: Kex;Remote: %s-%d;Enc: %s;MAC: %s;Comp: %s",
	451	get_remote_ipaddr(),
	452	get_remote_port(),
	453	newkeys->enc.name,
	454	newkeys->mac.name,
	455	newkeys->comp.name);
	456	}
	457	log_flag = 1;
3c0ef626	458	}
	459	choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
	460	choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
	461	sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
	462	need = 0;
	463	for (mode = 0; mode < MODE_MAX; mode++) {
	464	newkeys = kex->newkeys[mode];
e9a17296	465	if (need < newkeys->enc.key_len)
	466	need = newkeys->enc.key_len;
	467	if (need < newkeys->enc.block_size)
	468	need = newkeys->enc.block_size;
3c0ef626	469	if (need < newkeys->mac.key_len)
	470	need = newkeys->mac.key_len;
	471	}
	472	/* XXX need runden? */
	473	kex->we_need = need;
	474
6a9b3198	475	/* ignore the next message if the proposals do not match */
cdd66111	476	if (first_kex_follows && !proposals_match(my, peer) &&
665a873d	477	!(datafellows & SSH_BUG_FIRSTKEX)) {
6a9b3198	478	type = packet_read();
	479	debug2("skipping next packet (type %u)", type);
	480	}
	481
3c0ef626	482	kex_prop_free(my);
	483	kex_prop_free(peer);
	484	}
	485
	486	static u_char *
2c06c99b	487	derive_key(Kex kex, int id, u_int need, u_char hash, u_int hashlen,
2c06c99b	488	BIGNUM *shared_secret)
3c0ef626	489	{
3c0ef626	490	Buffer b;
3c0ef626	491	EVP_MD_CTX md;
3c0ef626	492	char c = id;
665a873d	493	u_int have;
2c06c99b	494	int mdsz;
665a873d	495	u_char *digest;
665a873d	496
2c06c99b	497	if ((mdsz = EVP_MD_size(kex->evp_md)) <= 0)
2c06c99b	498	fatal("bad kex md size %d", mdsz);
9108f8d9	499	digest = xmalloc(roundup(need, mdsz));
3c0ef626	500
	501	buffer_init(&b);
	502	buffer_put_bignum2(&b, shared_secret);
	503
	504	/* K1 = HASH(K \|\| H \|\| "A" \|\| session_id) */
2c06c99b	505	EVP_DigestInit(&md, kex->evp_md);
3c0ef626	506	if (!(datafellows & SSH_BUG_DERIVEKEY))
3c0ef626	507	EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
2c06c99b	508	EVP_DigestUpdate(&md, hash, hashlen);
3c0ef626	509	EVP_DigestUpdate(&md, &c, 1);
	510	EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
	511	EVP_DigestFinal(&md, digest, NULL);
	512
	513	/*
	514	* expand key:
	515	* Kn = HASH(K \|\| H \|\| K1 \|\| K2 \|\| ... \|\| Kn-1)
	516	* Key = K1 \|\| K2 \|\| ... \|\| Kn
	517	*/
	518	for (have = mdsz; need > have; have += mdsz) {
2c06c99b	519	EVP_DigestInit(&md, kex->evp_md);
3c0ef626	520	if (!(datafellows & SSH_BUG_DERIVEKEY))
3c0ef626	521	EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
2c06c99b	522	EVP_DigestUpdate(&md, hash, hashlen);
3c0ef626	523	EVP_DigestUpdate(&md, digest, have);
	524	EVP_DigestFinal(&md, digest + have, NULL);
	525	}
	526	buffer_free(&b);
	527	#ifdef DEBUG_KEX
	528	fprintf(stderr, "key '%c'== ", c);
	529	dump_digest("key", digest, need);
	530	#endif
	531	return digest;
	532	}
	533
	534	Newkeys *current_keys[MODE_MAX];
	535
	536	#define NKEYS 6
	537	void
2c06c99b	538	kex_derive_keys(Kex kex, u_char hash, u_int hashlen, BIGNUM *shared_secret)
3c0ef626	539	{
3c0ef626	540	u_char *keys[NKEYS];
665a873d	541	u_int i, mode, ctos;
3c0ef626	542
2c06c99b	543	for (i = 0; i < NKEYS; i++) {
	544	keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
	545	shared_secret);
	546	}
3c0ef626	547
6a9b3198	548	debug2("kex_derive_keys");
3c0ef626	549	for (mode = 0; mode < MODE_MAX; mode++) {
	550	current_keys[mode] = kex->newkeys[mode];
	551	kex->newkeys[mode] = NULL;
9108f8d9	552	ctos = (!kex->server && mode == MODE_OUT) \|\|
9108f8d9	553	(kex->server && mode == MODE_IN);
3c0ef626	554	current_keys[mode]->enc.iv = keys[ctos ? 0 : 1];
	555	current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
	556	current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
	557	}
	558	}
	559
	560	Newkeys *
	561	kex_get_newkeys(int mode)
	562	{
	563	Newkeys *ret;
	564
	565	ret = current_keys[mode];
	566	current_keys[mode] = NULL;
	567	return ret;
	568	}
	569
c9f39d2c	570	void
	571	derive_ssh1_session_id(BIGNUM host_modulus, BIGNUM server_modulus,
	572	u_int8_t cookie[8], u_int8_t id[16])
	573	{
	574	const EVP_MD *evp_md = EVP_md5();
	575	EVP_MD_CTX md;
	576	u_int8_t nbuf[2048], obuf[EVP_MAX_MD_SIZE];
	577	int len;
	578
	579	EVP_DigestInit(&md, evp_md);
	580
	581	len = BN_num_bytes(host_modulus);
665a873d	582	if (len < (512 / 8) \|\| (u_int)len > sizeof(nbuf))
c9f39d2c	583	fatal("%s: bad host modulus (len %d)", __func__, len);
	584	BN_bn2bin(host_modulus, nbuf);
	585	EVP_DigestUpdate(&md, nbuf, len);
	586
	587	len = BN_num_bytes(server_modulus);
665a873d	588	if (len < (512 / 8) \|\| (u_int)len > sizeof(nbuf))
c9f39d2c	589	fatal("%s: bad server modulus (len %d)", __func__, len);
	590	BN_bn2bin(server_modulus, nbuf);
	591	EVP_DigestUpdate(&md, nbuf, len);
	592
	593	EVP_DigestUpdate(&md, cookie, 8);
	594
	595	EVP_DigestFinal(&md, obuf, NULL);
	596	memcpy(id, obuf, 16);
	597
	598	memset(nbuf, 0, sizeof(nbuf));
	599	memset(obuf, 0, sizeof(obuf));
	600	memset(&md, 0, sizeof(md));
	601	}
	602
3c0ef626	603	#if defined(DEBUG_KEX) \|\| defined(DEBUG_KEXDH)
	604	void
	605	dump_digest(char msg, u_char digest, int len)
	606	{
665a873d	607	u_int i;
3c0ef626	608
3c0ef626	609	fprintf(stderr, "%s\n", msg);
799ae497	610	for (i = 0; i < len; i++) {
3c0ef626	611	fprintf(stderr, "%02x", digest[i]);
	612	if (i%32 == 31)
	613	fprintf(stderr, "\n");
	614	else if (i%8 == 7)
	615	fprintf(stderr, " ");
	616	}
	617	fprintf(stderr, "\n");
	618	}
	619	#endif