niceSOFT/libssh | Gitverse

src/packet_crypt.c
330 строк9 KB
Andreas Schneider
packet: Check hmac return codes in ssh_packet_hmac_verify()
14 июл 2022, 16:03
14 июл 2022, 16:0343fb1d7
/*
 * crypt.c - blowfish-cbc code
 *
 * This file is part of the SSH Library
 *
 * Copyright (c) 2003 by Aris Adamantiadis
 *
 * The SSH Library is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation; either version 2.1 of the License, or (at your
 * option) any later version.
 *
 * The SSH Library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
 * License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with the SSH Library; see the file COPYING.  If not, write to
 * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
 * MA 02111-1307, USA.
 */

#include "config.h"
#include <assert.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

#ifndef _WIN32
#include <netinet/in.h>
#include <arpa/inet.h>
#endif

#ifdef OPENSSL_CRYPTO
#include <openssl/evp.h>
#include <openssl/hmac.h>
#endif

#include "libssh/priv.h"
#include "libssh/session.h"
#include "libssh/wrapper.h"
#include "libssh/crypto.h"
#include "libssh/buffer.h"
#include "libssh/bytearray.h"

/** @internal
 * @brief decrypt the packet length from a raw encrypted packet, and store the first decrypted
 * blocksize.
 * @returns native byte-ordered decrypted length of the upcoming packet
 */
uint32_t ssh_packet_decrypt_len(ssh_session session,
                                uint8_t *destination,
                                uint8_t *source)
{
    struct ssh_crypto_struct *crypto = NULL;
    uint32_t decrypted;
    int rc;

    crypto = ssh_packet_get_current_crypto(session, SSH_DIRECTION_IN);
    if (crypto != NULL) {
        if (crypto->in_cipher->aead_decrypt_length != NULL) {
            rc = crypto->in_cipher->aead_decrypt_length(
                    crypto->in_cipher, source, destination,
                    crypto->in_cipher->lenfield_blocksize,
                    session->recv_seq);
        } else {
            rc = ssh_packet_decrypt(
                    session,
                    destination,
                    source,
                    0,
                    crypto->in_cipher->blocksize);
        }
        if (rc < 0) {
            return 0;
        }
    } else {
        memcpy(destination, source, 8);
    }
    memcpy(&decrypted,destination,sizeof(decrypted));

    return ntohl(decrypted);
}

/** @internal
 * @brief decrypts the content of an SSH packet.
 * @param[source] source packet, including the encrypted length field
 * @param[start] index in the packet that was not decrypted yet.
 * @param[encrypted_size] size of the encrypted data to be decrypted after start.
 */
int ssh_packet_decrypt(ssh_session session,
                       uint8_t *destination,
                       uint8_t *source,
                       size_t start,
                       size_t encrypted_size)
{
    struct ssh_crypto_struct *crypto = NULL;
    struct ssh_cipher_struct *cipher = NULL;

    if (encrypted_size <= 0) {
        return SSH_ERROR;
    }

    crypto = ssh_packet_get_current_crypto(session, SSH_DIRECTION_IN);
    if (crypto == NULL) {
        return SSH_ERROR;
    }
    cipher = crypto->in_cipher;

    if (encrypted_size % cipher->blocksize != 0) {
        ssh_set_error(session,
                      SSH_FATAL,
                      "Cryptographic functions must be used on multiple of "
                      "blocksize (received %zu)",
                      encrypted_size);
        return SSH_ERROR;
    }

    if (cipher->aead_decrypt != NULL) {
        return cipher->aead_decrypt(cipher,
                                    source,
                                    destination,
                                    encrypted_size,
                                    session->recv_seq);
    } else {
        cipher->decrypt(cipher, source + start, destination, encrypted_size);
    }

    return 0;
}

unsigned char *ssh_packet_encrypt(ssh_session session, void *data, size_t len)
{
  struct ssh_crypto_struct *crypto = NULL;
  struct ssh_cipher_struct *cipher = NULL;
  HMACCTX ctx = NULL;
  char *out = NULL;
  int etm_packet_offset = 0, rc;
  unsigned int blocksize;
  size_t finallen = DIGEST_MAX_LEN;
  uint32_t seq, lenfield_blocksize;
  enum ssh_hmac_e type;
  bool etm;

  assert(len);

  crypto = ssh_packet_get_current_crypto(session, SSH_DIRECTION_OUT);
  if (crypto == NULL) {
      return NULL; /* nothing to do here */
  }

  blocksize = crypto->out_cipher->blocksize;
  lenfield_blocksize = crypto->out_cipher->lenfield_blocksize;

  type = crypto->out_hmac;
  etm = crypto->out_hmac_etm;

  if (etm) {
      etm_packet_offset = sizeof(uint32_t);
  }

  if ((len - lenfield_blocksize - etm_packet_offset) % blocksize != 0) {
      ssh_set_error(session, SSH_FATAL, "Cryptographic functions must be set"
                    " on at least one blocksize (received %zu)", len);
      return NULL;
  }
  out = calloc(1, len);
  if (out == NULL) {
    return NULL;
  }

  seq = ntohl(session->send_seq);
  cipher = crypto->out_cipher;

  if (cipher->aead_encrypt != NULL) {
      cipher->aead_encrypt(cipher, data, out, len,
            crypto->hmacbuf, session->send_seq);
      memcpy(data, out, len);
  } else {
      if (type != SSH_HMAC_NONE) {
          ctx = hmac_init(crypto->encryptMAC, hmac_digest_len(type), type);
          if (ctx == NULL) {
              SAFE_FREE(out);
              return NULL;
          }

          if (!etm) {
              rc = hmac_update(ctx, (unsigned char *)&seq, sizeof(uint32_t));
              if (rc != 1) {
                  SAFE_FREE(out);
                  return NULL;
              }
              rc = hmac_update(ctx, data, len);
              if (rc != 1) {
                  SAFE_FREE(out);
                  return NULL;
              }
              rc = hmac_final(ctx, crypto->hmacbuf, &finallen);
              if (rc != 1) {
                  SAFE_FREE(out);
                  return NULL;
              }
          }
      }

      cipher->encrypt(cipher, (uint8_t*)data + etm_packet_offset, out, len - etm_packet_offset);
      memcpy((uint8_t*)data + etm_packet_offset, out, len - etm_packet_offset);

      if (type != SSH_HMAC_NONE) {
          if (etm) {
              PUSH_BE_U32(data, 0, len - etm_packet_offset);
              rc = hmac_update(ctx, (unsigned char *)&seq, sizeof(uint32_t));
              if (rc != 1) {
                  SAFE_FREE(out);
                  return NULL;
              }
              rc = hmac_update(ctx, data, len);
              if (rc != 1) {
                  SAFE_FREE(out);
                  return NULL;
              }
              rc = hmac_final(ctx, crypto->hmacbuf, &finallen);
              if (rc != 1) {
                  SAFE_FREE(out);
                  return NULL;
              }
          }
#ifdef DEBUG_CRYPTO
          ssh_log_hexdump("mac: ", data, len);
          if (finallen != hmac_digest_len(type)) {
              printf("Final len is %zu\n", finallen);
          }
          ssh_log_hexdump("Packet hmac", crypto->hmacbuf, hmac_digest_len(type));
#endif
      }
  }
  explicit_bzero(out, len);
  SAFE_FREE(out);

  return crypto->hmacbuf;
}

/**
 * @internal
 *
 * @brief Verify the hmac of a packet
 *
 * @param  session      The session to use.
 * @param  data         The pointer to the data to verify the hmac from.
 * @param  len          The length of the given data.
 * @param  mac          The mac to compare with the hmac.
 *
 * @return              0 if hmac and mac are equal, < 0 if not or an error
 *                      occurred.
 */
int ssh_packet_hmac_verify(ssh_session session,
                           const void *data,
                           size_t len,
                           uint8_t *mac,
                           enum ssh_hmac_e type)
{
    struct ssh_crypto_struct *crypto = NULL;
    unsigned char hmacbuf[DIGEST_MAX_LEN] = {0};
    HMACCTX ctx;
    size_t hmaclen = DIGEST_MAX_LEN;
    uint32_t seq;
    int cmp;
    int rc;

    /* AEAD types have no mac checking */
    if (type == SSH_HMAC_AEAD_POLY1305 ||
        type == SSH_HMAC_AEAD_GCM) {
        return SSH_OK;
    }

    crypto = ssh_packet_get_current_crypto(session,
                                           SSH_DIRECTION_IN);
    if (crypto == NULL) {
        return SSH_ERROR;
    }

    ctx = hmac_init(crypto->decryptMAC,
                    hmac_digest_len(type),
                    type);
    if (ctx == NULL) {
        return SSH_ERROR;
    }

    seq = htonl(session->recv_seq);

    rc = hmac_update(ctx,
                     (unsigned char *) &seq,
                     sizeof(uint32_t));
    if (rc != 1) {
        return SSH_ERROR;
    }
    rc = hmac_update(ctx,
                     data,
                     len);
    if (rc != 1) {
        return SSH_ERROR;
    }
    rc = hmac_final(ctx,
                    hmacbuf,
                    &hmaclen);
    if (rc != 1) {
        return SSH_ERROR;
    }

#ifdef DEBUG_CRYPTO
    ssh_log_hexdump("received mac",
                    mac,
                    hmaclen);
    ssh_log_hexdump("Computed mac",
                    hmacbuf,
                    hmaclen);
    ssh_log_hexdump("seq",
                    (unsigned char *)&seq,
                    sizeof(uint32_t));
#endif
    cmp = secure_memcmp(mac,
                        hmacbuf,
                        hmaclen);
    if (cmp == 0) {
        return SSH_OK;
    }

    return SSH_ERROR;
}