/* Copyright (c) 2004-2007, Sara Golemon <sarag@libssh2.org>

* Copyright (c) 2010-2019, Daniel Stenberg <daniel@haxx.se>

* All rights reserved.

*

* Redistribution and use in source and binary forms,

* with or without modification, are permitted provided

* that the following conditions are met:

*

* Redistributions of source code must retain the above

* copyright notice, this list of conditions and the

* following disclaimer.

*

* Redistributions in binary form must reproduce the above

* copyright notice, this list of conditions and the following

* disclaimer in the documentation and/or other materials

* provided with the distribution.

*

* Neither the name of the copyright holder nor the names

* of any other contributors may be used to endorse or

* promote products derived from this software without

* specific prior written permission.

*

* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND

* CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,

* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR

* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,

* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,

* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE

* USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY

* OF SUCH DAMAGE.

*/

#include "libssh2_priv.h"

#include "transport.h"

#include "comp.h"

#include "mac.h"

#include <assert.h>

/* define SHA1_DIGEST_LENGTH for the macro below */

#ifndef SHA1_DIGEST_LENGTH

#define SHA1_DIGEST_LENGTH SHA_DIGEST_LENGTH

#endif

/* TODO: Switch this to an inline and handle alloc() failures */

/* Helper macro called from

kex_method_diffie_hellman_group1_sha1_key_exchange */

#define LIBSSH2_KEX_METHOD_EC_SHA_VALUE_HASH(value, reqlen, version) \

{ \

if(type == LIBSSH2_EC_CURVE_NISTP256) { \

LIBSSH2_KEX_METHOD_SHA_VALUE_HASH(256, value, reqlen, version); \

} \

else if(type == LIBSSH2_EC_CURVE_NISTP384) { \

LIBSSH2_KEX_METHOD_SHA_VALUE_HASH(384, value, reqlen, version); \

} \

else if(type == LIBSSH2_EC_CURVE_NISTP521) { \

LIBSSH2_KEX_METHOD_SHA_VALUE_HASH(512, value, reqlen, version); \

} \

} \

#define LIBSSH2_KEX_METHOD_SHA_VALUE_HASH(digest_type, value, \

reqlen, version) \

{ \

libssh2_sha##digest_type##_ctx hash; \

unsigned long len = 0; \

if(!(value)) { \

value = LIBSSH2_ALLOC(session, \

reqlen + SHA##digest_type##_DIGEST_LENGTH); \

} \

if(value) \

while(len < (unsigned long)reqlen) { \

libssh2_sha##digest_type##_init(&hash); \

libssh2_sha##digest_type##_update(hash, \

exchange_state->k_value, \

exchange_state->k_value_len); \

libssh2_sha##digest_type##_update(hash, \

exchange_state->h_sig_comp, \

SHA##digest_type##_DIGEST_LENGTH); \

if(len > 0) { \

libssh2_sha##digest_type##_update(hash, value, len); \

} \

else { \

libssh2_sha##digest_type##_update(hash, (version), 1); \

libssh2_sha##digest_type##_update(hash, session->session_id,\

session->session_id_len); \

} \

libssh2_sha##digest_type##_final(hash, (value) + len); \

len += SHA##digest_type##_DIGEST_LENGTH; \

} \

}

/*!

* @note The following are wrapper functions used by diffie_hellman_sha_algo().

* TODO: Switch backend SHA macros to functions to allow function pointers

* @discussion Ideally these would be function pointers but the backend macros

* don't allow it so we have to wrap them up in helper functions

*/

static void _libssh2_sha_algo_ctx_init(int sha_algo, void *ctx)

{

if(sha_algo == 512) {

libssh2_sha512_init((libssh2_sha512_ctx*)ctx);

}

else if(sha_algo == 384) {

libssh2_sha384_init((libssh2_sha384_ctx*)ctx);

}

else if(sha_algo == 256) {

libssh2_sha256_init((libssh2_sha256_ctx*)ctx);

}

else if(sha_algo == 1) {

libssh2_sha1_init((libssh2_sha1_ctx*)ctx);

}

else {

assert(0);

}

}

static void _libssh2_sha_algo_ctx_update(int sha_algo, void *ctx,

void *data, size_t len)

{

if(sha_algo == 512) {

libssh2_sha512_ctx *_ctx = (libssh2_sha512_ctx*)ctx;

libssh2_sha512_update(*_ctx, data, len);

}

else if(sha_algo == 384) {

libssh2_sha384_ctx *_ctx = (libssh2_sha384_ctx*)ctx;

libssh2_sha384_update(*_ctx, data, len);

}

else if(sha_algo == 256) {

libssh2_sha256_ctx *_ctx = (libssh2_sha256_ctx*)ctx;

libssh2_sha256_update(*_ctx, data, len);

}

else if(sha_algo == 1) {

libssh2_sha1_ctx *_ctx = (libssh2_sha1_ctx*)ctx;

libssh2_sha1_update(*_ctx, data, len);

}

else {

#if LIBSSH2DEBUG

assert(0);

#endif

}

}

static void _libssh2_sha_algo_ctx_final(int sha_algo, void *ctx,

void *hash)

{

if(sha_algo == 512) {

libssh2_sha512_ctx *_ctx = (libssh2_sha512_ctx*)ctx;

libssh2_sha512_final(*_ctx, hash);

}

else if(sha_algo == 384) {

libssh2_sha384_ctx *_ctx = (libssh2_sha384_ctx*)ctx;

libssh2_sha384_final(*_ctx, hash);

}

else if(sha_algo == 256) {

libssh2_sha256_ctx *_ctx = (libssh2_sha256_ctx*)ctx;

libssh2_sha256_final(*_ctx, hash);

}

else if(sha_algo == 1) {

libssh2_sha1_ctx *_ctx = (libssh2_sha1_ctx*)ctx;

libssh2_sha1_final(*_ctx, hash);

}

else {

#if LIBSSH2DEBUG

assert(0);

#endif

}

}

static void _libssh2_sha_algo_value_hash(int sha_algo,

LIBSSH2_SESSION *session,

kmdhgGPshakex_state_t *exchange_state,

unsigned char **data, size_t data_len,

const unsigned char *version)

{

if(sha_algo == 512) {

LIBSSH2_KEX_METHOD_SHA_VALUE_HASH(512, *data, data_len, version);

}

else if(sha_algo == 384) {

LIBSSH2_KEX_METHOD_SHA_VALUE_HASH(384, *data, data_len, version);

}

else if(sha_algo == 256) {

LIBSSH2_KEX_METHOD_SHA_VALUE_HASH(256, *data, data_len, version);

}

else if(sha_algo == 1) {

LIBSSH2_KEX_METHOD_SHA_VALUE_HASH(1, *data, data_len, version);

}

else {

#if LIBSSH2DEBUG

assert(0);

#endif

}

}

/*!

* @function diffie_hellman_sha_algo

* @abstract Diffie Hellman Key Exchange, Group Agnostic,

* SHA Algorithm Agnostic

* @result 0 on success, error code on failure

*/

static int diffie_hellman_sha_algo(LIBSSH2_SESSION *session,

_libssh2_bn *g,

_libssh2_bn *p,

int group_order,

int sha_algo_value,

void *exchange_hash_ctx,

unsigned char packet_type_init,

unsigned char packet_type_reply,

unsigned char *midhash,

unsigned long midhash_len,

kmdhgGPshakex_state_t *exchange_state)

{

int ret = 0;

int rc;

int digest_len = 0;

if(sha_algo_value == 512)

digest_len = SHA512_DIGEST_LENGTH;

else if(sha_algo_value == 384)

digest_len = SHA384_DIGEST_LENGTH;

else if(sha_algo_value == 256)

digest_len = SHA256_DIGEST_LENGTH;

else if(sha_algo_value == 1)

digest_len = SHA1_DIGEST_LENGTH;

else {

ret = _libssh2_error(session, LIBSSH2_ERROR_PROTO,

"sha algo value is unimplemented");

goto clean_exit;

}

if(exchange_state->state == libssh2_NB_state_idle) {

/* Setup initial values */

exchange_state->e_packet = NULL;

exchange_state->s_packet = NULL;

exchange_state->k_value = NULL;

exchange_state->ctx = _libssh2_bn_ctx_new();

libssh2_dh_init(&exchange_state->x);

exchange_state->e = _libssh2_bn_init(); /* g^x mod p */

exchange_state->f = _libssh2_bn_init_from_bin(); /* g^(Random from

server) mod p */

exchange_state->k = _libssh2_bn_init(); /* The shared secret: f^x mod

p */

/* Zero the whole thing out */

memset(&exchange_state->req_state, 0, sizeof(packet_require_state_t));

/* Generate x and e */

if(_libssh2_bn_bits(p) > LIBSSH2_DH_MAX_MODULUS_BITS) {

ret = _libssh2_error(session, LIBSSH2_ERROR_INVAL,

"dh modulus value is too large");

goto clean_exit;

}

rc = libssh2_dh_key_pair(&exchange_state->x, exchange_state->e, g, p,

group_order, exchange_state->ctx);

if(rc)

goto clean_exit;

/* Send KEX init */

/* packet_type(1) + String Length(4) + leading 0(1) */

exchange_state->e_packet_len =

_libssh2_bn_bytes(exchange_state->e) + 6;

if(_libssh2_bn_bits(exchange_state->e) % 8) {

/* Leading 00 not needed */

exchange_state->e_packet_len--;

}

exchange_state->e_packet =

LIBSSH2_ALLOC(session, exchange_state->e_packet_len);

if(!exchange_state->e_packet) {

ret = _libssh2_error(session, LIBSSH2_ERROR_ALLOC,

"Out of memory error");

goto clean_exit;

}

exchange_state->e_packet[0] = packet_type_init;

_libssh2_htonu32(exchange_state->e_packet + 1,

exchange_state->e_packet_len - 5);

if(_libssh2_bn_bits(exchange_state->e) % 8) {

_libssh2_bn_to_bin(exchange_state->e,

exchange_state->e_packet + 5);

}

else {

exchange_state->e_packet[5] = 0;

_libssh2_bn_to_bin(exchange_state->e,

exchange_state->e_packet + 6);

}

_libssh2_debug(session, LIBSSH2_TRACE_KEX, "Sending KEX packet %d",

(int) packet_type_init);

exchange_state->state = libssh2_NB_state_created;

}

if(exchange_state->state == libssh2_NB_state_created) {

rc = _libssh2_transport_send(session, exchange_state->e_packet,

exchange_state->e_packet_len,

NULL, 0);

if(rc == LIBSSH2_ERROR_EAGAIN) {

return rc;

}

else if(rc) {

ret = _libssh2_error(session, rc,

"Unable to send KEX init message");

goto clean_exit;

}

exchange_state->state = libssh2_NB_state_sent;

}

if(exchange_state->state == libssh2_NB_state_sent) {

if(session->burn_optimistic_kexinit) {

/* The first KEX packet to come along will be the guess initially

* sent by the server. That guess turned out to be wrong so we

* need to silently ignore it */

int burn_type;

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Waiting for badly guessed KEX packet "

"(to be ignored)");

burn_type =

_libssh2_packet_burn(session, &exchange_state->burn_state);

if(burn_type == LIBSSH2_ERROR_EAGAIN) {

return burn_type;

}

else if(burn_type <= 0) {

/* Failed to receive a packet */

ret = burn_type;

goto clean_exit;

}

session->burn_optimistic_kexinit = 0;

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Burnt packet of type: %02x",

(unsigned int) burn_type);

}

exchange_state->state = libssh2_NB_state_sent1;

}

if(exchange_state->state == libssh2_NB_state_sent1) {

/* Wait for KEX reply */

struct string_buf buf;

size_t host_key_len;

rc = _libssh2_packet_require(session, packet_type_reply,

&exchange_state->s_packet,

&exchange_state->s_packet_len, 0, NULL,

0, &exchange_state->req_state);

if(rc == LIBSSH2_ERROR_EAGAIN) {

return rc;

}

if(rc) {

ret = _libssh2_error(session, LIBSSH2_ERROR_TIMEOUT,

"Timed out waiting for KEX reply");

goto clean_exit;

}

/* Parse KEXDH_REPLY */

if(exchange_state->s_packet_len < 5) {

ret = _libssh2_error(session, LIBSSH2_ERROR_PROTO,

"Unexpected packet length");

goto clean_exit;

}

buf.data = exchange_state->s_packet;

buf.len = exchange_state->s_packet_len;

buf.dataptr = buf.data;

buf.dataptr++; /* advance past type */

if(session->server_hostkey)

LIBSSH2_FREE(session, session->server_hostkey);

if(_libssh2_copy_string(session, &buf, &(session->server_hostkey),

&host_key_len)) {

ret = _libssh2_error(session, LIBSSH2_ERROR_ALLOC,

"Could not copy host key");

goto clean_exit;

}

session->server_hostkey_len = (uint32_t)host_key_len;

#if LIBSSH2_MD5

{

libssh2_md5_ctx fingerprint_ctx;

if(libssh2_md5_init(&fingerprint_ctx)) {

libssh2_md5_update(fingerprint_ctx, session->server_hostkey,

session->server_hostkey_len);

libssh2_md5_final(fingerprint_ctx,

session->server_hostkey_md5);

session->server_hostkey_md5_valid = TRUE;

}

else {

session->server_hostkey_md5_valid = FALSE;

}

}

#ifdef LIBSSH2DEBUG

{

char fingerprint[50], *fprint = fingerprint;

int i;

for(i = 0; i < 16; i++, fprint += 3) {

snprintf(fprint, 4, "%02x:", session->server_hostkey_md5[i]);

}

*(--fprint) = '\0';

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Server's MD5 Fingerprint: %s", fingerprint);

}

#endif /* LIBSSH2DEBUG */

#endif /* ! LIBSSH2_MD5 */

{

libssh2_sha1_ctx fingerprint_ctx;

if(libssh2_sha1_init(&fingerprint_ctx)) {

libssh2_sha1_update(fingerprint_ctx, session->server_hostkey,

session->server_hostkey_len);

libssh2_sha1_final(fingerprint_ctx,

session->server_hostkey_sha1);

session->server_hostkey_sha1_valid = TRUE;

}

else {

session->server_hostkey_sha1_valid = FALSE;

}

}

#ifdef LIBSSH2DEBUG

{

char fingerprint[64], *fprint = fingerprint;

int i;

for(i = 0; i < 20; i++, fprint += 3) {

snprintf(fprint, 4, "%02x:", session->server_hostkey_sha1[i]);

}

*(--fprint) = '\0';

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Server's SHA1 Fingerprint: %s", fingerprint);

}

#endif /* LIBSSH2DEBUG */

{

libssh2_sha256_ctx fingerprint_ctx;

if(libssh2_sha256_init(&fingerprint_ctx)) {

libssh2_sha256_update(fingerprint_ctx, session->server_hostkey,

session->server_hostkey_len);

libssh2_sha256_final(fingerprint_ctx,

session->server_hostkey_sha256);

session->server_hostkey_sha256_valid = TRUE;

}

else {

session->server_hostkey_sha256_valid = FALSE;

}

}

#ifdef LIBSSH2DEBUG

{

char *base64Fingerprint = NULL;

_libssh2_base64_encode(session,

(const char *)

session->server_hostkey_sha256,

SHA256_DIGEST_LENGTH, &base64Fingerprint);

if(base64Fingerprint != NULL) {

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Server's SHA256 Fingerprint: %s",

base64Fingerprint);

LIBSSH2_FREE(session, base64Fingerprint);

}

}

#endif /* LIBSSH2DEBUG */

if(session->hostkey->init(session, session->server_hostkey,

session->server_hostkey_len,

&session->server_hostkey_abstract)) {

ret = _libssh2_error(session, LIBSSH2_ERROR_HOSTKEY_INIT,

"Unable to initialize hostkey importer");

goto clean_exit;

}

if(_libssh2_get_string(&buf, &(exchange_state->f_value),

&(exchange_state->f_value_len))) {

ret = _libssh2_error(session, LIBSSH2_ERROR_HOSTKEY_INIT,

"Unable to get f value");

goto clean_exit;

}

_libssh2_bn_from_bin(exchange_state->f, exchange_state->f_value_len,

exchange_state->f_value);

if(_libssh2_get_string(&buf, &(exchange_state->h_sig),

&(exchange_state->h_sig_len))) {

ret = _libssh2_error(session, LIBSSH2_ERROR_HOSTKEY_INIT,

"Unable to get h sig");

goto clean_exit;

}

/* Compute the shared secret */

libssh2_dh_secret(&exchange_state->x, exchange_state->k,

exchange_state->f, p, exchange_state->ctx);

exchange_state->k_value_len = _libssh2_bn_bytes(exchange_state->k) + 5;

if(_libssh2_bn_bits(exchange_state->k) % 8) {

/* don't need leading 00 */

exchange_state->k_value_len--;

}

exchange_state->k_value =

LIBSSH2_ALLOC(session, exchange_state->k_value_len);

if(!exchange_state->k_value) {

ret = _libssh2_error(session, LIBSSH2_ERROR_ALLOC,

"Unable to allocate buffer for K");

goto clean_exit;

}

_libssh2_htonu32(exchange_state->k_value,

exchange_state->k_value_len - 4);

if(_libssh2_bn_bits(exchange_state->k) % 8) {

_libssh2_bn_to_bin(exchange_state->k, exchange_state->k_value + 4);

}

else {

exchange_state->k_value[4] = 0;

_libssh2_bn_to_bin(exchange_state->k, exchange_state->k_value + 5);

}

exchange_state->exchange_hash = (void *)&exchange_hash_ctx;

_libssh2_sha_algo_ctx_init(sha_algo_value, exchange_hash_ctx);

if(session->local.banner) {

_libssh2_htonu32(exchange_state->h_sig_comp,

strlen((char *) session->local.banner) - 2);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->h_sig_comp, 4);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

session->local.banner,

strlen((char *) session->local.banner) - 2);

}

else {

_libssh2_htonu32(exchange_state->h_sig_comp,

sizeof(LIBSSH2_SSH_DEFAULT_BANNER) - 1);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->h_sig_comp, 4);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

(unsigned char *)

LIBSSH2_SSH_DEFAULT_BANNER,

sizeof(LIBSSH2_SSH_DEFAULT_BANNER) - 1);

}

_libssh2_htonu32(exchange_state->h_sig_comp,

strlen((char *) session->remote.banner));

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->h_sig_comp, 4);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

session->remote.banner,

strlen((char *) session->remote.banner));

_libssh2_htonu32(exchange_state->h_sig_comp,

session->local.kexinit_len);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->h_sig_comp, 4);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

session->local.kexinit,

session->local.kexinit_len);

_libssh2_htonu32(exchange_state->h_sig_comp,

session->remote.kexinit_len);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->h_sig_comp, 4);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

session->remote.kexinit,

session->remote.kexinit_len);

_libssh2_htonu32(exchange_state->h_sig_comp,

session->server_hostkey_len);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->h_sig_comp, 4);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

session->server_hostkey,

session->server_hostkey_len);

if(packet_type_init == SSH_MSG_KEX_DH_GEX_INIT) {

/* diffie-hellman-group-exchange hashes additional fields */

#ifdef LIBSSH2_DH_GEX_NEW

_libssh2_htonu32(exchange_state->h_sig_comp,

LIBSSH2_DH_GEX_MINGROUP);

_libssh2_htonu32(exchange_state->h_sig_comp + 4,

LIBSSH2_DH_GEX_OPTGROUP);

_libssh2_htonu32(exchange_state->h_sig_comp + 8,

LIBSSH2_DH_GEX_MAXGROUP);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->h_sig_comp, 12);

#else

_libssh2_htonu32(exchange_state->h_sig_comp,

LIBSSH2_DH_GEX_OPTGROUP);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->h_sig_comp, 4);

#endif

}

if(midhash) {

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

midhash, midhash_len);

}

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->e_packet + 1,

exchange_state->e_packet_len - 1);

_libssh2_htonu32(exchange_state->h_sig_comp,

exchange_state->f_value_len);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->h_sig_comp, 4);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->f_value,

exchange_state->f_value_len);

_libssh2_sha_algo_ctx_update(sha_algo_value, exchange_hash_ctx,

exchange_state->k_value,

exchange_state->k_value_len);

_libssh2_sha_algo_ctx_final(sha_algo_value, exchange_hash_ctx,

exchange_state->h_sig_comp);

if(session->hostkey->

sig_verify(session, exchange_state->h_sig,

exchange_state->h_sig_len, exchange_state->h_sig_comp,

digest_len, &session->server_hostkey_abstract)) {

ret = _libssh2_error(session, LIBSSH2_ERROR_HOSTKEY_SIGN,

"Unable to verify hostkey signature");

goto clean_exit;

}

_libssh2_debug(session, LIBSSH2_TRACE_KEX, "Sending NEWKEYS message");

exchange_state->c = SSH_MSG_NEWKEYS;

exchange_state->state = libssh2_NB_state_sent2;

}

if(exchange_state->state == libssh2_NB_state_sent2) {

rc = _libssh2_transport_send(session, &exchange_state->c, 1, NULL, 0);

if(rc == LIBSSH2_ERROR_EAGAIN) {

return rc;

}

else if(rc) {

ret = _libssh2_error(session, rc,

"Unable to send NEWKEYS message");

goto clean_exit;

}

exchange_state->state = libssh2_NB_state_sent3;

}

if(exchange_state->state == libssh2_NB_state_sent3) {

rc = _libssh2_packet_require(session, SSH_MSG_NEWKEYS,

&exchange_state->tmp,

&exchange_state->tmp_len, 0, NULL, 0,

&exchange_state->req_state);

if(rc == LIBSSH2_ERROR_EAGAIN) {

return rc;

}

else if(rc) {

ret = _libssh2_error(session, rc, "Timed out waiting for NEWKEYS");

goto clean_exit;

}

/* The first key exchange has been performed,

switch to active crypt/comp/mac mode */

session->state |= LIBSSH2_STATE_NEWKEYS;

_libssh2_debug(session, LIBSSH2_TRACE_KEX, "Received NEWKEYS message");

/* This will actually end up being just packet_type(1)

for this packet type anyway */

LIBSSH2_FREE(session, exchange_state->tmp);

if(!session->session_id) {

session->session_id = LIBSSH2_ALLOC(session, digest_len);

if(!session->session_id) {

ret = _libssh2_error(session, LIBSSH2_ERROR_ALLOC,

"Unable to allocate buffer for "

"SHA digest");

goto clean_exit;

}

memcpy(session->session_id, exchange_state->h_sig_comp,

digest_len);

session->session_id_len = digest_len;

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"session_id calculated");

}

/* Cleanup any existing cipher */

if(session->local.crypt->dtor) {

session->local.crypt->dtor(session,

&session->local.crypt_abstract);

}

/* Calculate IV/Secret/Key for each direction */

if(session->local.crypt->init) {

unsigned char *iv = NULL, *secret = NULL;

int free_iv = 0, free_secret = 0;

_libssh2_sha_algo_value_hash(sha_algo_value, session,

exchange_state, &iv,

session->local.crypt->iv_len,

(const unsigned char *)"A");

if(!iv) {

ret = -1;

goto clean_exit;

}

_libssh2_sha_algo_value_hash(sha_algo_value, session,

exchange_state, &secret,

session->local.crypt->secret_len,

(const unsigned char *)"C");

if(!secret) {

LIBSSH2_FREE(session, iv);

ret = LIBSSH2_ERROR_KEX_FAILURE;

goto clean_exit;

}

if(session->local.crypt->

init(session, session->local.crypt, iv, &free_iv, secret,

&free_secret, 1, &session->local.crypt_abstract)) {

LIBSSH2_FREE(session, iv);

LIBSSH2_FREE(session, secret);

ret = LIBSSH2_ERROR_KEX_FAILURE;

goto clean_exit;

}

if(free_iv) {

_libssh2_explicit_zero(iv, session->local.crypt->iv_len);

LIBSSH2_FREE(session, iv);

}

if(free_secret) {

_libssh2_explicit_zero(secret,

session->local.crypt->secret_len);

LIBSSH2_FREE(session, secret);

}

}

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Client to Server IV and Key calculated");

if(session->remote.crypt->dtor) {

/* Cleanup any existing cipher */

session->remote.crypt->dtor(session,

&session->remote.crypt_abstract);

}

if(session->remote.crypt->init) {

unsigned char *iv = NULL, *secret = NULL;

int free_iv = 0, free_secret = 0;

_libssh2_sha_algo_value_hash(sha_algo_value, session,

exchange_state, &iv,

session->remote.crypt->iv_len,

(const unsigned char *)"B");

if(!iv) {

ret = LIBSSH2_ERROR_KEX_FAILURE;

goto clean_exit;

}

_libssh2_sha_algo_value_hash(sha_algo_value, session,

exchange_state, &secret,

session->remote.crypt->secret_len,

(const unsigned char *)"D");

if(!secret) {

LIBSSH2_FREE(session, iv);

ret = LIBSSH2_ERROR_KEX_FAILURE;

goto clean_exit;

}

if(session->remote.crypt->

init(session, session->remote.crypt, iv, &free_iv, secret,

&free_secret, 0, &session->remote.crypt_abstract)) {

LIBSSH2_FREE(session, iv);

LIBSSH2_FREE(session, secret);

ret = LIBSSH2_ERROR_KEX_FAILURE;

goto clean_exit;

}

if(free_iv) {

_libssh2_explicit_zero(iv, session->remote.crypt->iv_len);

LIBSSH2_FREE(session, iv);

}

if(free_secret) {

_libssh2_explicit_zero(secret,

session->remote.crypt->secret_len);

LIBSSH2_FREE(session, secret);

}

}

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Server to Client IV and Key calculated");

if(session->local.mac->dtor) {

session->local.mac->dtor(session, &session->local.mac_abstract);

}

if(session->local.mac->init) {

unsigned char *key = NULL;

int free_key = 0;

_libssh2_sha_algo_value_hash(sha_algo_value, session,

exchange_state, &key,

session->local.mac->key_len,

(const unsigned char *)"E");

if(!key) {

ret = LIBSSH2_ERROR_KEX_FAILURE;

goto clean_exit;

}

session->local.mac->init(session, key, &free_key,

&session->local.mac_abstract);

if(free_key) {

_libssh2_explicit_zero(key, session->local.mac->key_len);

LIBSSH2_FREE(session, key);

}

}

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Client to Server HMAC Key calculated");

if(session->remote.mac->dtor) {

session->remote.mac->dtor(session, &session->remote.mac_abstract);

}

if(session->remote.mac->init) {

unsigned char *key = NULL;

int free_key = 0;

_libssh2_sha_algo_value_hash(sha_algo_value, session,

exchange_state, &key,

session->remote.mac->key_len,

(const unsigned char *)"F");

if(!key) {

ret = LIBSSH2_ERROR_KEX_FAILURE;

goto clean_exit;

}

session->remote.mac->init(session, key, &free_key,

&session->remote.mac_abstract);

if(free_key) {

_libssh2_explicit_zero(key, session->remote.mac->key_len);

LIBSSH2_FREE(session, key);

}

}

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Server to Client HMAC Key calculated");

/* Initialize compression for each direction */

/* Cleanup any existing compression */

if(session->local.comp && session->local.comp->dtor) {

session->local.comp->dtor(session, 1,

&session->local.comp_abstract);

}

if(session->local.comp && session->local.comp->init) {

if(session->local.comp->init(session, 1,

&session->local.comp_abstract)) {

ret = LIBSSH2_ERROR_KEX_FAILURE;

goto clean_exit;

}

}

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Client to Server compression initialized");

if(session->remote.comp && session->remote.comp->dtor) {

session->remote.comp->dtor(session, 0,

&session->remote.comp_abstract);

}

if(session->remote.comp && session->remote.comp->init) {

if(session->remote.comp->init(session, 0,

&session->remote.comp_abstract)) {

ret = LIBSSH2_ERROR_KEX_FAILURE;

goto clean_exit;

}

}

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Server to Client compression initialized");

}

clean_exit:

libssh2_dh_dtor(&exchange_state->x);

_libssh2_bn_free(exchange_state->e);

exchange_state->e = NULL;

_libssh2_bn_free(exchange_state->f);

exchange_state->f = NULL;

_libssh2_bn_free(exchange_state->k);

exchange_state->k = NULL;

_libssh2_bn_ctx_free(exchange_state->ctx);

exchange_state->ctx = NULL;

if(exchange_state->e_packet) {

LIBSSH2_FREE(session, exchange_state->e_packet);

exchange_state->e_packet = NULL;

}

if(exchange_state->s_packet) {

LIBSSH2_FREE(session, exchange_state->s_packet);

exchange_state->s_packet = NULL;

}

if(exchange_state->k_value) {

LIBSSH2_FREE(session, exchange_state->k_value);

exchange_state->k_value = NULL;

}

exchange_state->state = libssh2_NB_state_idle;

return ret;

}

/* kex_method_diffie_hellman_group1_sha1_key_exchange

* Diffie-Hellman Group1 (Actually Group2) Key Exchange using SHA1

*/

static int

kex_method_diffie_hellman_group1_sha1_key_exchange(LIBSSH2_SESSION *session,

key_exchange_state_low_t

* key_state)

{

static const unsigned char p_value[128] = {

0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,

0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,

0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,

0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,

0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,

0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,

0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,

0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,

0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,

0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,

0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,

0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,

0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,

0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,

0x49, 0x28, 0x66, 0x51, 0xEC, 0xE6, 0x53, 0x81,

0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF

};

int ret;

libssh2_sha1_ctx exchange_hash_ctx;

if(key_state->state == libssh2_NB_state_idle) {

/* g == 2 */

key_state->p = _libssh2_bn_init_from_bin(); /* SSH2 defined value

(p_value) */

key_state->g = _libssh2_bn_init(); /* SSH2 defined value (2) */

/* Initialize P and G */

_libssh2_bn_set_word(key_state->g, 2);

_libssh2_bn_from_bin(key_state->p, 128, p_value);

_libssh2_debug(session, LIBSSH2_TRACE_KEX,

"Initiating Diffie-Hellman Group1 Key Exchange");

key_state->state = libssh2_NB_state_created;

}

ret = diffie_hellman_sha_algo(session, key_state->g, key_state->p, 128, 1,

(void *)&exchange_hash_ctx,

SSH_MSG_KEXDH_INIT, SSH_MSG_KEXDH_REPLY,

NULL, 0, &key_state->exchange_state);

if(ret == LIBSSH2_ERROR_EAGAIN) {

return ret;

}

_libssh2_bn_free(key_state->p);

key_state->p = NULL;

_libssh2_bn_free(key_state->g);

key_state->g = NULL;

key_state->state = libssh2_NB_state_idle;

return ret;

}

/* kex_method_diffie_hellman_group14_key_exchange

* Diffie-Hellman Group14 Key Exchange with hash function callback

*/

typedef int (*diffie_hellman_hash_func_t)(LIBSSH2_SESSION *,

_libssh2_bn *,

_libssh2_bn *,

int,

int,

void *,

unsigned char,

unsigned char,

unsigned char *,

unsigned long,

kmdhgGPshakex_state_t *);

static int

kex_method_diffie_hellman_group14_key_exchange(LIBSSH2_SESSION *session,

key_exchange_state_low_t

* key_state,

int sha_algo_value,

void *exchange_hash_ctx,