Attachment 2766 Details for Bug 2515 – add diffie-hellman-group{14,15,16}-sha256

[patch] add diffie-hellman-group{14,15,16}-sha256

openssh-group15_16.patch (text/plain), 8.31 KB, created by Darren Tucker on 2015-12-11 15:29:06 AEDT

(hide)

Description:

Filename:

MIME Type:

Creator: Darren Tucker

Created: 2015-12-11 15:29:06 AEDT

Size: 8.31 KB

patch

obsolete

>diff --git a/dh.c b/dh.c
>index 4c639ac..9387637 100644
>--- a/dh.c
>+++ b/dh.c
>@@ -338,12 +338,34 @@ dh_new_group14(void)
> 	return (dh_new_group_asc(gen, group14));
> }
> 
>-/*
>- * 4k bit fallback group used by DH-GEX if moduli file cannot be read.
>- * Source: MODP group 16 from RFC3526.
>- */
>+/* MODP group 15 from RFC3526. */
> DH *
>-dh_new_group_fallback(int max)
>+dh_new_group15(void)
>+{
>+	static char *gen = "2", *group15 =
>+	    "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
>+	    "29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
>+	    "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
>+	    "E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
>+	    "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE45B3D"
>+	    "C2007CB8" "A163BF05" "98DA4836" "1C55D39A" "69163FA8" "FD24CF5F"
>+	    "83655D23" "DCA3AD96" "1C62F356" "208552BB" "9ED52907" "7096966D"
>+	    "670C354E" "4ABC9804" "F1746C08" "CA18217C" "32905E46" "2E36CE3B"
>+	    "E39E772C" "180E8603" "9B2783A2" "EC07A28F" "B5C55DF0" "6F4C52C9"
>+	    "DE2BCBF6" "95581718" "3995497C" "EA956AE5" "15D22618" "98FA0510"
>+	    "15728E5A" "8AAAC42D" "AD33170D" "04507A33" "A85521AB" "DF1CBA64"
>+	    "ECFB8504" "58DBEF0A" "8AEA7157" "5D060C7D" "B3970F85" "A6E1E4C7"
>+	    "ABF5AE8C" "DB0933D7" "1E8C94E0" "4A25619D" "CEE3D226" "1AD2EE6B"
>+	    "F12FFA06" "D98A0864" "D8760273" "3EC86A64" "521F2B18" "177B200C"
>+	    "BBE11757" "7A615D6C" "770988C0" "BAD946E2" "08E24FA0" "74E5AB31"
>+	    "43DB5BFC" "E0FD108E" "4B82D120" "A93AD2CA" "FFFFFFFF" "FFFFFFFF";
>+
>+	return (dh_new_group_asc(gen, group15));
>+}
>+
>+/* MODP group 16 from RFC3526. */
>+DH *
>+dh_new_group16(void)
> {
> 	static char *gen = "2", *group16 =
> 	    "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
>@@ -369,12 +391,19 @@ dh_new_group_fallback(int max)
> 	    "93B4EA98" "8D8FDDC1" "86FFB7DC" "90A6C08F" "4DF435C9" "34063199"
> 	    "FFFFFFFF" "FFFFFFFF";
> 
>+	return (dh_new_group_asc(gen, group16));
>+}
>+
>+/* Select fallback group used by DH-GEX if moduli file cannot be read. */
>+DH *
>+dh_new_group_fallback(int max)
>+{
> 	if (max < 4096) {
> 		debug3("requested max size %d, using 2k bit group 14", max);
> 		return dh_new_group14();
> 	}
> 	debug3("using 4k bit group 16");
>-	return (dh_new_group_asc(gen, group16));
>+	return dh_new_group16();
> }
> 
> /*
>diff --git a/dh.h b/dh.h
>index e191cfd..278e59b 100644
>--- a/dh.h
>+++ b/dh.h
>@@ -37,6 +37,8 @@ DH	*dh_new_group_asc(const char *, const char *);
> DH	*dh_new_group(BIGNUM *, BIGNUM *);
> DH	*dh_new_group1(void);
> DH	*dh_new_group14(void);
>+DH	*dh_new_group15(void);
>+DH	*dh_new_group16(void);
> DH	*dh_new_group_fallback(int);
> 
> int	 dh_gen_key(DH *, int);
>diff --git a/kex.c b/kex.c
>index 8243164..13d071f 100644
>--- a/kex.c
>+++ b/kex.c
>@@ -89,9 +89,12 @@ struct kexalg {
> static const struct kexalg kexalgs[] = {
> #ifdef WITH_OPENSSL
> 	{ KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
>-	{ KEX_DH14, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
>+	{ KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
> 	{ KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
> #ifdef HAVE_EVP_SHA256
>+	{ KEX_DH14_SHA256, KEX_DH_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
>+	{ KEX_DH15_SHA256, KEX_DH_GRP15_SHA256, 0, SSH_DIGEST_SHA256 },
>+	{ KEX_DH16_SHA256, KEX_DH_GRP16_SHA256, 0, SSH_DIGEST_SHA256 },
> 	{ KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },
> #endif /* HAVE_EVP_SHA256 */
> #ifdef OPENSSL_HAS_ECC
>diff --git a/kex.h b/kex.h
>index 25ccf2e..2ae95ae 100644
>--- a/kex.h
>+++ b/kex.h
>@@ -51,7 +51,10 @@
> #define KEX_COOKIE_LEN	16
> 
> #define	KEX_DH1			"diffie-hellman-group1-sha1"
>-#define	KEX_DH14		"diffie-hellman-group14-sha1"
>+#define	KEX_DH14_SHA1		"diffie-hellman-group14-sha1"
>+#define	KEX_DH14_SHA256		"diffie-hellman-group14-sha256"
>+#define	KEX_DH15_SHA256		"diffie-hellman-group15-sha256"
>+#define	KEX_DH16_SHA256		"diffie-hellman-group16-sha256"
> #define	KEX_DHGEX_SHA1		"diffie-hellman-group-exchange-sha1"
> #define	KEX_DHGEX_SHA256	"diffie-hellman-group-exchange-sha256"
> #define	KEX_RESUME		"resume@appgate.com"
>@@ -89,6 +92,9 @@ enum kex_modes {
> enum kex_exchange {
> 	KEX_DH_GRP1_SHA1,
> 	KEX_DH_GRP14_SHA1,
>+	KEX_DH_GRP14_SHA256,
>+	KEX_DH_GRP15_SHA256,
>+	KEX_DH_GRP16_SHA256,
> 	KEX_DH_GEX_SHA1,
> 	KEX_DH_GEX_SHA256,
> 	KEX_ECDH_SHA2,
>diff --git a/kexdhc.c b/kexdhc.c
>index af259f1..f4d5729 100644
>--- a/kexdhc.c
>+++ b/kexdhc.c
>@@ -63,8 +63,15 @@ kexdh_client(struct ssh *ssh)
> 		kex->dh = dh_new_group1();
> 		break;
> 	case KEX_DH_GRP14_SHA1:
>+	case KEX_DH_GRP14_SHA256:
> 		kex->dh = dh_new_group14();
> 		break;
>+	case KEX_DH_GRP15_SHA256:
>+		kex->dh = dh_new_group15();
>+		break;
>+	case KEX_DH_GRP16_SHA256:
>+		kex->dh = dh_new_group16();
>+		break;
> 	default:
> 		r = SSH_ERR_INVALID_ARGUMENT;
> 		goto out;
>diff --git a/kexdhs.c b/kexdhs.c
>index bf933e4..2c9b4bd 100644
>--- a/kexdhs.c
>+++ b/kexdhs.c
>@@ -63,8 +63,15 @@ kexdh_server(struct ssh *ssh)
> 		kex->dh = dh_new_group1();
> 		break;
> 	case KEX_DH_GRP14_SHA1:
>+	case KEX_DH_GRP14_SHA256:
> 		kex->dh = dh_new_group14();
> 		break;
>+	case KEX_DH_GRP15_SHA256:
>+		kex->dh = dh_new_group15();
>+		break;
>+	case KEX_DH_GRP16_SHA256:
>+		kex->dh = dh_new_group16();
>+		break;
> 	default:
> 		r = SSH_ERR_INVALID_ARGUMENT;
> 		goto out;
>diff --git a/monitor.c b/monitor.c
>index b3edd64..d6d8644 100644
>--- a/monitor.c
>+++ b/monitor.c
>@@ -1855,6 +1855,9 @@ monitor_apply_keystate(struct monitor *pmonitor)
> #ifdef WITH_OPENSSL
> 		kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
> 		kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
>+		kex->kex[KEX_DH_GRP14_SHA256] = kexdh_server;
>+		kex->kex[KEX_DH_GRP15_SHA256] = kexdh_server;
>+		kex->kex[KEX_DH_GRP16_SHA256] = kexdh_server;
> 		kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
> 		kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
> # ifdef OPENSSL_HAS_ECC
>diff --git a/myproposal.h b/myproposal.h
>index b266b52..c9ea4a5 100644
>--- a/myproposal.h
>+++ b/myproposal.h
>@@ -68,7 +68,10 @@
> 
> #ifdef HAVE_EVP_SHA256
> # define KEX_SHA256_METHODS \
>-	"diffie-hellman-group-exchange-sha256,"
>+	"diffie-hellman-group-exchange-sha256," \
>+	"diffie-hellman-group16-sha256," \
>+	"diffie-hellman-group15-sha256," \
>+	"diffie-hellman-group14-sha256,"
> #define	SHA2_HMAC_MODES \
> 	"hmac-sha2-256," \
> 	"hmac-sha2-512,"
>diff --git a/ssh-keyscan.c b/ssh-keyscan.c
>index a23276f..7f7a0ce 100644
>--- a/ssh-keyscan.c
>+++ b/ssh-keyscan.c
>@@ -302,6 +302,9 @@ keygrab_ssh2(con *c)
> #ifdef WITH_OPENSSL
> 	c->c_ssh->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
> 	c->c_ssh->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
>+	c->c_ssh->kex->kex[KEX_DH_GRP14_SHA256] = kexdh_client;
>+	c->c_ssh->kex->kex[KEX_DH_GRP15_SHA256] = kexdh_client;
>+	c->c_ssh->kex->kex[KEX_DH_GRP16_SHA256] = kexdh_client;
> 	c->c_ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
> 	c->c_ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
> # ifdef OPENSSL_HAS_ECC
>diff --git a/ssh_api.c b/ssh_api.c
>index f544f00..4acc6f8 100644
>--- a/ssh_api.c
>+++ b/ssh_api.c
>@@ -103,6 +103,9 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
> #ifdef WITH_OPENSSL
> 		ssh->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
> 		ssh->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
>+		ssh->kex->kex[KEX_DH_GRP14_SHA256] = kexdh_server;
>+		ssh->kex->kex[KEX_DH_GRP15_SHA256] = kexdh_server;
>+		ssh->kex->kex[KEX_DH_GRP16_SHA256] = kexdh_server;
> 		ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
> 		ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
> # ifdef OPENSSL_HAS_ECC
>diff --git a/sshconnect2.c b/sshconnect2.c
>index 250278f..08f7667 100644
>--- a/sshconnect2.c
>+++ b/sshconnect2.c
>@@ -206,6 +206,9 @@ ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
> #ifdef WITH_OPENSSL
> 	kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
> 	kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
>+	kex->kex[KEX_DH_GRP14_SHA256] = kexdh_client;
>+	kex->kex[KEX_DH_GRP15_SHA256] = kexdh_client;
>+	kex->kex[KEX_DH_GRP16_SHA256] = kexdh_client;
> 	kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
> 	kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
> # ifdef OPENSSL_HAS_ECC
>diff --git a/sshd.c b/sshd.c
>index 5d2e0a0..2d53bb4 100644
>--- a/sshd.c
>+++ b/sshd.c
>@@ -2577,6 +2577,9 @@ do_ssh2_kex(void)
> #ifdef WITH_OPENSSL
> 	kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
> 	kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
>+	kex->kex[KEX_DH_GRP14_SHA256] = kexdh_server;
>+	kex->kex[KEX_DH_GRP15_SHA256] = kexdh_server;
>+	kex->kex[KEX_DH_GRP16_SHA256] = kexdh_server;
> 	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
> 	kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
> # ifdef OPENSSL_HAS_ECC

Actions: View | Diff

Attachments on bug 2515: 2766 | 2767 | 2768 | 2769 | 2808