- djm@cvs.openbsd.org 2008/06/26 09:19:40

     [dh.c dh.h moduli.c]
     when loading moduli from /etc/moduli in sshd(8), check that they
     are of the expected "safe prime" structure and have had
     appropriate primality tests performed;
     feedback and ok dtucker@

diff --git a/ChangeLog b/ChangeLog
index 945d32f075fc258a34142cdbf09ca7948e8897a4..087c06e342cf920c2a722b5f8912b64aa720216c 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -14,6 +14,12 @@
      bits. Note that this only affects explicit setting of modes (e.g. via
      sftp(1)'s chmod command) and not file transfers. (bz#1310)
      ok deraadt@ at c2k8
+   - djm@cvs.openbsd.org 2008/06/26 09:19:40
+     [dh.c dh.h moduli.c]
+     when loading moduli from /etc/moduli in sshd(8), check that they
+     are of the expected "safe prime" structure and have had
+     appropriate primality tests performed;
+     feedback and ok dtucker@
 
 20080628
  - (djm) [RFC.nroff contrib/cygwin/Makefile contrib/suse/openssh.spec]

diff --git a/dh.c b/dh.c
index 0908fcf113798fdb61cc570ff80c90c430158e49..b76605325deab1455fbf9c730c92e05b30469449 100644 (file)
--- a/dh.c
+++ b/dh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh.c,v 1.46 2008/04/13 00:22:17 djm Exp $ */
+/* $OpenBSD: dh.c,v 1.47 2008/06/26 09:19:39 djm Exp $ */
 /*
  * Copyright (c) 2000 Niels Provos.  All rights reserved.
  *
@@ -46,6 +46,7 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
        char *cp, *arg;
        char *strsize, *gen, *prime;
        const char *errstr = NULL;
+       long long n;
 
        cp = line;
        if ((arg = strdelim(&cp)) == NULL)
@@ -62,12 +63,24 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
        arg = strsep(&cp, " "); /* type */
        if (cp == NULL || *arg == '\0')
                goto fail;
+       /* Ensure this is a safe prime */
+       n = strtonum(arg, 0, 5, &errstr);
+       if (errstr != NULL || n != MODULI_TYPE_SAFE)
+               goto fail;
        arg = strsep(&cp, " "); /* tests */
        if (cp == NULL || *arg == '\0')
                goto fail;
+       /* Ensure prime has been tested and is not composite */
+       n = strtonum(arg, 0, 0x1f, &errstr);
+       if (errstr != NULL ||
+           (n & MODULI_TESTS_COMPOSITE) || !(n & ~MODULI_TESTS_COMPOSITE))
+               goto fail;
        arg = strsep(&cp, " "); /* tries */
        if (cp == NULL || *arg == '\0')
                goto fail;
+       n = strtonum(arg, 0, 1<<30, &errstr);
+       if (errstr != NULL || n == 0)
+               goto fail;
        strsize = strsep(&cp, " "); /* size */
        if (cp == NULL || *strsize == '\0' ||
            (dhg->size = (u_int)strtonum(strsize, 0, 64*1024, &errstr)) == 0 ||

diff --git a/dh.h b/dh.h
index 8e580ee87ded15a08e5294ea6a7be47a38d52a25..dfc1480eac66798c32483656f5a78d2fa2c525d3 100644 (file)
--- a/dh.h
+++ b/dh.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh.h,v 1.9 2006/03/25 22:22:43 djm Exp $ */
+/* $OpenBSD: dh.h,v 1.10 2008/06/26 09:19:40 djm Exp $ */
 
 /*
  * Copyright (c) 2000 Niels Provos.  All rights reserved.
@@ -46,4 +46,28 @@ int   dh_estimate(int);
 #define DH_GRP_MIN     1024
 #define DH_GRP_MAX     8192
 
+/*
+ * Values for "type" field of moduli(5)
+ * Specifies the internal structure of the prime modulus.
+ */
+#define MODULI_TYPE_UNKNOWN            (0)
+#define MODULI_TYPE_UNSTRUCTURED       (1)
+#define MODULI_TYPE_SAFE               (2)
+#define MODULI_TYPE_SCHNORR            (3)
+#define MODULI_TYPE_SOPHIE_GERMAIN     (4)
+#define MODULI_TYPE_STRONG             (5)
+
+/*
+ * Values for "tests" field of moduli(5)
+ * Specifies the methods used in checking for primality.
+ * Usually, more than one test is used.
+ */
+#define MODULI_TESTS_UNTESTED          (0x00)
+#define MODULI_TESTS_COMPOSITE         (0x01)
+#define MODULI_TESTS_SIEVE             (0x02)
+#define MODULI_TESTS_MILLER_RABIN      (0x04)
+#define MODULI_TESTS_JACOBI            (0x08)
+#define MODULI_TESTS_ELLIPTIC          (0x10)
+
+
 #endif

diff --git a/moduli.c b/moduli.c
index 8fa545daf090aea41121aadcb295ce3a8c0272a8..f737cb3f517d2063ac30d4774da4e0d06dcc6677 100644 (file)
--- a/moduli.c
+++ b/moduli.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: moduli.c,v 1.20 2007/02/24 03:30:11 ray Exp $ */
+/* $OpenBSD: moduli.c,v 1.21 2008/06/26 09:19:40 djm Exp $ */
 /*
  * Copyright 1994 Phil Karn <karn@qualcomm.com>
  * Copyright 1996-1998, 2003 William Allen Simpson <wsimpson@greendragon.com>
@@ -42,6 +42,7 @@
 #include <sys/types.h>
 
 #include <openssl/bn.h>
+#include <openssl/dh.h>
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -50,6 +51,7 @@
 #include <time.h>
 
 #include "xmalloc.h"
+#include "dh.h"
 #include "log.h"
 
 /*
@@ -59,27 +61,6 @@
 /* need line long enough for largest moduli plus headers */
 #define QLINESIZE              (100+8192)
 
-/* Type: decimal.
- * Specifies the internal structure of the prime modulus.
- */
-#define QTYPE_UNKNOWN          (0)
-#define QTYPE_UNSTRUCTURED     (1)
-#define QTYPE_SAFE             (2)
-#define QTYPE_SCHNORR          (3)
-#define QTYPE_SOPHIE_GERMAIN   (4)
-#define QTYPE_STRONG           (5)
-
-/* Tests: decimal (bit field).
- * Specifies the methods used in checking for primality.
- * Usually, more than one test is used.
- */
-#define QTEST_UNTESTED         (0x00)
-#define QTEST_COMPOSITE                (0x01)
-#define QTEST_SIEVE            (0x02)
-#define QTEST_MILLER_RABIN     (0x04)
-#define QTEST_JACOBI           (0x08)
-#define QTEST_ELLIPTIC         (0x10)
-
 /*
  * Size: decimal.
  * Specifies the number of the most significant bit (0 to M).
@@ -434,8 +415,9 @@ gen_candidates(FILE *out, u_int32_t memory, u_int32_t power, BIGNUM *start)
                        fatal("BN_set_word failed");
                if (BN_add(q, q, largebase) == 0)
                        fatal("BN_add failed");
-               if (qfileout(out, QTYPE_SOPHIE_GERMAIN, QTEST_SIEVE,
-                   largetries, (power - 1) /* MSB */, (0), q) == -1) {
+               if (qfileout(out, MODULI_TYPE_SOPHIE_GERMAIN,
+                   MODULI_TESTS_SIEVE, largetries,
+                   (power - 1) /* MSB */, (0), q) == -1) {
                        ret = -1;
                        break;
                }
@@ -507,7 +489,7 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted)
                /* tests */
                in_tests = strtoul(cp, &cp, 10);
 
-               if (in_tests & QTEST_COMPOSITE) {
+               if (in_tests & MODULI_TESTS_COMPOSITE) {
                        debug2("%10u: known composite", count_in);
                        continue;
                }
@@ -526,7 +508,7 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted)
 
                /* modulus (hex) */
                switch (in_type) {
-               case QTYPE_SOPHIE_GERMAIN:
+               case MODULI_TYPE_SOPHIE_GERMAIN:
                        debug2("%10u: (%u) Sophie-Germain", count_in, in_type);
                        a = q;
                        if (BN_hex2bn(&a, cp) == 0)
@@ -539,11 +521,11 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted)
                        in_size += 1;
                        generator_known = 0;
                        break;
-               case QTYPE_UNSTRUCTURED:
-               case QTYPE_SAFE:
-               case QTYPE_SCHNORR:
-               case QTYPE_STRONG:
-               case QTYPE_UNKNOWN:
+               case MODULI_TYPE_UNSTRUCTURED:
+               case MODULI_TYPE_SAFE:
+               case MODULI_TYPE_SCHNORR:
+               case MODULI_TYPE_STRONG:
+               case MODULI_TYPE_UNKNOWN:
                        debug2("%10u: (%u)", count_in, in_type);
                        a = p;
                        if (BN_hex2bn(&a, cp) == 0)
@@ -570,7 +552,7 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted)
                        continue;
                }
 
-               if (in_tests & QTEST_MILLER_RABIN)
+               if (in_tests & MODULI_TESTS_MILLER_RABIN)
                        in_tries += trials;
                else
                        in_tries = trials;
@@ -644,7 +626,8 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted)
                }
                debug("%10u: q is almost certainly prime", count_in);
 
-               if (qfileout(out, QTYPE_SAFE, (in_tests | QTEST_MILLER_RABIN),
+               if (qfileout(out, MODULI_TYPE_SAFE,
+                   in_tests | MODULI_TESTS_MILLER_RABIN,
                    in_tries, in_size, generator_known, p)) {
                        res = -1;
                        break;