Line | Source | Count |
1 | | - |
2 | | - |
3 | | - |
4 | | - |
5 | | - |
6 | | - |
7 | | - |
8 | | - |
9 | | - |
10 | | - |
11 | | - |
12 | | - |
13 | | - |
14 | | - |
15 | static int input_kex_dh_gex_request(int, u_int32_t, struct ssh *); | - |
16 | static int input_kex_dh_gex_init(int, u_int32_t, struct ssh *); | - |
17 | | - |
18 | int | - |
19 | kexgex_server(struct ssh *ssh) | - |
20 | { | - |
21 | ssh_dispatch_set(ssh, 34, | - |
22 | &input_kex_dh_gex_request); | - |
23 | debug("expecting SSH2_MSG_KEX_DH_GEX_REQUEST"); | - |
24 | returnexecuted 40 times by 1 test: return 0; 0;executed 40 times by 1 test: return 0; | 40 |
25 | } | - |
26 | | - |
27 | static int | - |
28 | input_kex_dh_gex_request(int type, u_int32_t seq, struct ssh *ssh) | - |
29 | { | - |
30 | struct kex *kex = ssh->kex; | - |
31 | int r; | - |
32 | u_int min = 0, max = 0, nbits = 0; | - |
33 | const BIGNUM *dh_p, *dh_g; | - |
34 | | - |
35 | debug("SSH2_MSG_KEX_DH_GEX_REQUEST received"); | - |
36 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_get_u32(ssh, &min)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
37 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_get_u32(ssh, &nbits)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
38 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_get_u32(ssh, &max)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
39 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_get_end(ssh)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
) | 0-40 |
40 | goto never executed: goto out; out;never executed: goto out; | 0 |
41 | kex->nbits = nbits; | - |
42 | kex->min = min; | - |
43 | kex->max = max; | - |
44 | min = (((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
2048) > (min))TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
? (2048) : (min)); | 0-40 |
45 | max = (((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
8192) < (max))TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
? (8192) : (max)); | 0-40 |
46 | nbits = (((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
2048) > (nbits))TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
? (2048) : (nbits)); | 0-40 |
47 | nbits = (((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
8192) < (nbits))TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
? (8192) : (nbits)); | 0-40 |
48 | | - |
49 | if (kex->max < kex->minTRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| kex->nbits < kex->minTRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
50 | kex->max < kex->nbitsTRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| kex->max < 2048TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
) { | 0-40 |
51 | r = -28; | - |
52 | goto never executed: goto out; out;never executed: goto out; | 0 |
53 | } | - |
54 | | - |
55 | | - |
56 | kex->dh = (use_privsepTRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
? mm_choose_dh(min, nbits, max) : choose_dh(min, nbits, max)); | 0-40 |
57 | if (kex->dh == TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
58 | ((void *)0)TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
59 | ) { | - |
60 | sshpkt_disconnect(ssh, "no matching DH grp found"); | - |
61 | r = -2; | - |
62 | goto never executed: goto out; out;never executed: goto out; | 0 |
63 | } | - |
64 | debug("SSH2_MSG_KEX_DH_GEX_GROUP sent"); | - |
65 | DH_get0_pqg(kex->dh, &dh_p, | - |
66 | ((void *)0) | - |
67 | , &dh_g); | - |
68 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_start(ssh, 31)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
69 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_put_bignum2(ssh, dh_p)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
70 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_put_bignum2(ssh, dh_g)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
71 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_send(ssh)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
) | 0-40 |
72 | goto never executed: goto out; out;never executed: goto out; | 0 |
73 | | - |
74 | | - |
75 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
) | 0-40 |
76 | goto never executed: goto out; out;never executed: goto out; | 0 |
77 | | - |
78 | debug("expecting SSH2_MSG_KEX_DH_GEX_INIT"); | - |
79 | ssh_dispatch_set(ssh, 32, &input_kex_dh_gex_init); | - |
80 | r = 0; | - |
81 | out:code before this statement executed 40 times by 1 test: out: | 40 |
82 | returnexecuted 40 times by 1 test: return r; r;executed 40 times by 1 test: return r; | 40 |
83 | } | - |
84 | | - |
85 | static int | - |
86 | input_kex_dh_gex_init(int type, u_int32_t seq, struct ssh *ssh) | - |
87 | { | - |
88 | struct kex *kex = ssh->kex; | - |
89 | BIGNUM *shared_secret = | - |
90 | ((void *)0) | - |
91 | , *dh_client_pub = | - |
92 | ((void *)0) | - |
93 | ; | - |
94 | const BIGNUM *pub_key, *dh_p, *dh_g; | - |
95 | struct sshkey *server_host_public, *server_host_private; | - |
96 | u_char *kbuf = | - |
97 | ((void *)0) | - |
98 | , *signature = | - |
99 | ((void *)0) | - |
100 | , *server_host_key_blob = | - |
101 | ((void *)0) | - |
102 | ; | - |
103 | u_char hash[64]; | - |
104 | size_t sbloblen, slen; | - |
105 | size_t klen = 0, hashlen; | - |
106 | int kout, r; | - |
107 | | - |
108 | if (kex->load_host_public_key == TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
109 | ((void *)0)TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
110 | || | - |
111 | kex->load_host_private_key == TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
112 | ((void *)0)TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
113 | ) { | - |
114 | r = -10; | - |
115 | goto never executed: goto out; out;never executed: goto out; | 0 |
116 | } | - |
117 | server_host_public = kex->load_host_public_key(kex->hostkey_type, | - |
118 | kex->hostkey_nid, ssh); | - |
119 | server_host_private = kex->load_host_private_key(kex->hostkey_type, | - |
120 | kex->hostkey_nid, ssh); | - |
121 | if (server_host_public == TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
122 | ((void *)0)TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
123 | ) { | - |
124 | r = -36; | - |
125 | goto never executed: goto out; out;never executed: goto out; | 0 |
126 | } | - |
127 | | - |
128 | | - |
129 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
dh_client_pub = BN_new()) == TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
130 | ((void *)0)TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
131 | ) { | - |
132 | r = -2; | - |
133 | goto never executed: goto out; out;never executed: goto out; | 0 |
134 | } | - |
135 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_get_bignum2(ssh, dh_client_pub)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
136 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_get_end(ssh)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
) | 0-40 |
137 | goto never executed: goto out; out;never executed: goto out; | 0 |
138 | | - |
139 | DH_get0_key(kex->dh, &pub_key, | - |
140 | ((void *)0) | - |
141 | ); | - |
142 | DH_get0_pqg(kex->dh, &dh_p, | - |
143 | ((void *)0) | - |
144 | , &dh_g); | - |
145 | if (!dh_pub_is_valid(kex->dh, dh_client_pub)TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
) { | 0-40 |
146 | sshpkt_disconnect(ssh, "bad client public DH value"); | - |
147 | r = -3; | - |
148 | goto never executed: goto out; out;never executed: goto out; | 0 |
149 | } | - |
150 | | - |
151 | klen = DH_size(kex->dh); | - |
152 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
kbuf = malloc(klen)) == TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
153 | ((void *)0)TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
154 | || | - |
155 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
shared_secret = BN_new()) == TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
156 | ((void *)0)TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
157 | ) { | - |
158 | r = -2; | - |
159 | goto never executed: goto out; out;never executed: goto out; | 0 |
160 | } | - |
161 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
kout = DH_compute_key(kbuf, dh_client_pub, kex->dh)) < 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
162 | BN_bin2bn(kbuf, kout, shared_secret) == TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
163 | ((void *)0)TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
164 | ) { | - |
165 | r = -22; | - |
166 | goto never executed: goto out; out;never executed: goto out; | 0 |
167 | } | - |
168 | | - |
169 | | - |
170 | | - |
171 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshkey_to_blob(server_host_public, &server_host_key_blob,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
172 | &sbloblen)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
) | 0-40 |
173 | goto never executed: goto out; out;never executed: goto out; | 0 |
174 | | - |
175 | hashlen = sizeof(hash); | - |
176 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = kexgex_hash(TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
177 | kex->hash_alg,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
178 | kex->client_version_string,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
179 | kex->server_version_string,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
180 | sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
181 | sshbuf_ptr(kex->my), sshbuf_len(kex->my),TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
182 | server_host_key_blob, sbloblen,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
183 | kex->min, kex->nbits, kex->max,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
184 | dh_p, dh_g,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
185 | dh_client_pub,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
186 | pub_key,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
187 | shared_secret,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
188 | hash, &hashlen)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
) | 0-40 |
189 | goto never executed: goto out; out;never executed: goto out; | 0 |
190 | | - |
191 | | - |
192 | if (kex->session_id == TRUE | evaluated 8 times by 1 test | FALSE | evaluated 32 times by 1 test |
| 8-32 |
193 | ((void *)0)TRUE | evaluated 8 times by 1 test | FALSE | evaluated 32 times by 1 test |
| 8-32 |
194 | ) { | - |
195 | kex->session_id_len = hashlen; | - |
196 | kex->session_id = malloc(kex->session_id_len); | - |
197 | if (kex->session_id == TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
198 | ((void *)0)TRUE | never evaluated | FALSE | evaluated 8 times by 1 test |
| 0-8 |
199 | ) { | - |
200 | r = -2; | - |
201 | goto never executed: goto out; out;never executed: goto out; | 0 |
202 | } | - |
203 | memcpy(kex->session_id, hash, kex->session_id_len); | - |
204 | }executed 8 times by 1 test: end of block | 8 |
205 | | - |
206 | | - |
207 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = kex->sign(server_host_private, server_host_public, &signature,TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
| 0-40 |
208 | &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
) | 0-40 |
209 | goto never executed: goto out; out;never executed: goto out; | 0 |
210 | | - |
211 | | - |
212 | | - |
213 | | - |
214 | if ((TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_start(ssh, 33)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
215 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
216 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_put_bignum2(ssh, pub_key)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
217 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_put_string(ssh, signature, slen)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
|| | 0-40 |
218 | (TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
r = sshpkt_send(ssh)) != 0TRUE | never evaluated | FALSE | evaluated 40 times by 1 test |
) | 0-40 |
219 | goto never executed: goto out; out;never executed: goto out; | 0 |
220 | | - |
221 | if ((TRUE | evaluated 40 times by 1 test | FALSE | never evaluated |
r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0TRUE | evaluated 40 times by 1 test | FALSE | never evaluated |
) | 0-40 |
222 | r = kex_send_newkeys(ssh);executed 40 times by 1 test: r = kex_send_newkeys(ssh); | 40 |
223 | out:code before this statement executed 40 times by 1 test: out: | 40 |
224 | DH_free(kex->dh); | - |
225 | kex->dh = | - |
226 | ((void *)0) | - |
227 | ; | - |
228 | BN_clear_free(dh_client_pub); | - |
229 | if (kbufTRUE | evaluated 40 times by 1 test | FALSE | never evaluated |
) { | 0-40 |
230 | explicit_bzero(kbuf, klen); | - |
231 | free(kbuf); | - |
232 | }executed 40 times by 1 test: end of block | 40 |
233 | BN_clear_free(shared_secret); | - |
234 | free(server_host_key_blob); | - |
235 | free(signature); | - |
236 | returnexecuted 40 times by 1 test: return r; r;executed 40 times by 1 test: return r; | 40 |
237 | } | - |
| | |