diff options
Diffstat (limited to 'usr.bin')
-rw-r--r-- | usr.bin/ssh/kexdhc.c | 11 | ||||
-rw-r--r-- | usr.bin/ssh/kexdhs.c | 10 | ||||
-rw-r--r-- | usr.bin/ssh/kexgexc.c | 20 | ||||
-rw-r--r-- | usr.bin/ssh/kexgexs.c | 8 | ||||
-rw-r--r-- | usr.bin/ssh/monitor_wrap.c | 10 | ||||
-rw-r--r-- | usr.bin/ssh/packet.c | 7 | ||||
-rw-r--r-- | usr.bin/ssh/packet.h | 4 | ||||
-rw-r--r-- | usr.bin/ssh/ssh-ecdsa.c | 14 | ||||
-rw-r--r-- | usr.bin/ssh/sshbuf-getput-crypto.c | 17 | ||||
-rw-r--r-- | usr.bin/ssh/sshbuf.h | 4 | ||||
-rw-r--r-- | usr.bin/ssh/sshkey.c | 96 |
11 files changed, 68 insertions, 133 deletions
diff --git a/usr.bin/ssh/kexdhc.c b/usr.bin/ssh/kexdhc.c index fd77b87e2fc..6e2e41def25 100644 --- a/usr.bin/ssh/kexdhc.c +++ b/usr.bin/ssh/kexdhc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kexdhc.c,v 1.24 2018/12/27 03:25:25 djm Exp $ */ +/* $OpenBSD: kexdhc.c,v 1.25 2019/01/21 09:54:11 djm Exp $ */ /* * Copyright (c) 2001 Markus Friedl. All rights reserved. * @@ -129,13 +129,8 @@ input_kex_dh(int type, u_int32_t seq, struct ssh *ssh) r = SSH_ERR_SIGNATURE_INVALID; goto out; } - /* DH parameter f, server public DH key */ - if ((dh_server_pub = BN_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } - /* signed H */ - if ((r = sshpkt_get_bignum2(ssh, dh_server_pub)) != 0 || + /* DH parameter f, server public DH key, signed H */ + if ((r = sshpkt_get_bignum2(ssh, &dh_server_pub)) != 0 || (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 || (r = sshpkt_get_end(ssh)) != 0) goto out; diff --git a/usr.bin/ssh/kexdhs.c b/usr.bin/ssh/kexdhs.c index 2956c0cebee..a5d6508b358 100644 --- a/usr.bin/ssh/kexdhs.c +++ b/usr.bin/ssh/kexdhs.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kexdhs.c,v 1.30 2019/01/19 21:43:56 djm Exp $ */ +/* $OpenBSD: kexdhs.c,v 1.31 2019/01/21 09:54:11 djm Exp $ */ /* * Copyright (c) 2001 Markus Friedl. All rights reserved. * @@ -113,14 +113,10 @@ input_kex_dh_init(int type, u_int32_t seq, struct ssh *ssh) } /* key, cert */ - if ((dh_client_pub = BN_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } - DH_get0_key(kex->dh, &pub_key, NULL); - if ((r = sshpkt_get_bignum2(ssh, dh_client_pub)) != 0 || + if ((r = sshpkt_get_bignum2(ssh, &dh_client_pub)) != 0 || (r = sshpkt_get_end(ssh)) != 0) goto out; + DH_get0_key(kex->dh, &pub_key, NULL); #ifdef DEBUG_KEXDH fprintf(stderr, "dh_client_pub= "); diff --git a/usr.bin/ssh/kexgexc.c b/usr.bin/ssh/kexgexc.c index 1adf1052dcf..ea0eac944b1 100644 --- a/usr.bin/ssh/kexgexc.c +++ b/usr.bin/ssh/kexgexc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kexgexc.c,v 1.29 2018/12/27 03:25:25 djm Exp $ */ +/* $OpenBSD: kexgexc.c,v 1.30 2019/01/21 09:54:11 djm Exp $ */ /* * Copyright (c) 2000 Niels Provos. All rights reserved. * Copyright (c) 2001 Markus Friedl. All rights reserved. @@ -93,13 +93,8 @@ input_kex_dh_gex_group(int type, u_int32_t seq, struct ssh *ssh) debug("got SSH2_MSG_KEX_DH_GEX_GROUP"); - if ((p = BN_new()) == NULL || - (g = BN_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } - if ((r = sshpkt_get_bignum2(ssh, p)) != 0 || - (r = sshpkt_get_bignum2(ssh, g)) != 0 || + if ((r = sshpkt_get_bignum2(ssh, &p)) != 0 || + (r = sshpkt_get_bignum2(ssh, &g)) != 0 || (r = sshpkt_get_end(ssh)) != 0) goto out; if ((bits = BN_num_bits(p)) < 0 || @@ -170,13 +165,8 @@ input_kex_dh_gex_reply(int type, u_int32_t seq, struct ssh *ssh) r = SSH_ERR_SIGNATURE_INVALID; goto out; } - /* DH parameter f, server public DH key */ - if ((dh_server_pub = BN_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } - /* signed H */ - if ((r = sshpkt_get_bignum2(ssh, dh_server_pub)) != 0 || + /* DH parameter f, server public DH key, signed H */ + if ((r = sshpkt_get_bignum2(ssh, &dh_server_pub)) != 0 || (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 || (r = sshpkt_get_end(ssh)) != 0) goto out; diff --git a/usr.bin/ssh/kexgexs.c b/usr.bin/ssh/kexgexs.c index 146f5922e09..b98b8ccf8d1 100644 --- a/usr.bin/ssh/kexgexs.c +++ b/usr.bin/ssh/kexgexs.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kexgexs.c,v 1.37 2019/01/19 21:43:56 djm Exp $ */ +/* $OpenBSD: kexgexs.c,v 1.38 2019/01/21 09:54:11 djm Exp $ */ /* * Copyright (c) 2000 Niels Provos. All rights reserved. * Copyright (c) 2001 Markus Friedl. All rights reserved. @@ -143,11 +143,7 @@ input_kex_dh_gex_init(int type, u_int32_t seq, struct ssh *ssh) } /* key, cert */ - if ((dh_client_pub = BN_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } - if ((r = sshpkt_get_bignum2(ssh, dh_client_pub)) != 0 || + if ((r = sshpkt_get_bignum2(ssh, &dh_client_pub)) != 0 || (r = sshpkt_get_end(ssh)) != 0) goto out; diff --git a/usr.bin/ssh/monitor_wrap.c b/usr.bin/ssh/monitor_wrap.c index ac887e9cecb..24cdfa6897e 100644 --- a/usr.bin/ssh/monitor_wrap.c +++ b/usr.bin/ssh/monitor_wrap.c @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor_wrap.c,v 1.111 2019/01/19 21:43:56 djm Exp $ */ +/* $OpenBSD: monitor_wrap.c,v 1.112 2019/01/21 09:54:11 djm Exp $ */ /* * Copyright 2002 Niels Provos <provos@citi.umich.edu> * Copyright 2002 Markus Friedl <markus@openbsd.org> @@ -197,12 +197,8 @@ mm_choose_dh(int min, int nbits, int max) if (success == 0) fatal("%s: MONITOR_ANS_MODULI failed", __func__); - if ((p = BN_new()) == NULL) - fatal("%s: BN_new failed", __func__); - if ((g = BN_new()) == NULL) - fatal("%s: BN_new failed", __func__); - if ((r = sshbuf_get_bignum2(m, p)) != 0 || - (r = sshbuf_get_bignum2(m, g)) != 0) + if ((r = sshbuf_get_bignum2(m, &p)) != 0 || + (r = sshbuf_get_bignum2(m, &g)) != 0) fatal("%s: buffer error: %s", __func__, ssh_err(r)); debug3("%s: remaining %zu", __func__, sshbuf_len(m)); diff --git a/usr.bin/ssh/packet.c b/usr.bin/ssh/packet.c index 245023a23b5..41320e4e539 100644 --- a/usr.bin/ssh/packet.c +++ b/usr.bin/ssh/packet.c @@ -1,4 +1,4 @@ -/* $OpenBSD: packet.c,v 1.280 2019/01/19 21:33:14 djm Exp $ */ +/* $OpenBSD: packet.c,v 1.281 2019/01/21 09:54:11 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -2523,11 +2523,10 @@ sshpkt_get_ec(struct ssh *ssh, EC_POINT *v, const EC_GROUP *g) return sshbuf_get_ec(ssh->state->incoming_packet, v, g); } - int -sshpkt_get_bignum2(struct ssh *ssh, BIGNUM *v) +sshpkt_get_bignum2(struct ssh *ssh, BIGNUM **valp) { - return sshbuf_get_bignum2(ssh->state->incoming_packet, v); + return sshbuf_get_bignum2(ssh->state->incoming_packet, valp); } #endif /* WITH_OPENSSL */ diff --git a/usr.bin/ssh/packet.h b/usr.bin/ssh/packet.h index 8901c3399ea..061a44bd7fb 100644 --- a/usr.bin/ssh/packet.h +++ b/usr.bin/ssh/packet.h @@ -1,4 +1,4 @@ -/* $OpenBSD: packet.h,v 1.88 2019/01/19 21:33:14 djm Exp $ */ +/* $OpenBSD: packet.h,v 1.89 2019/01/21 09:54:11 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> @@ -186,7 +186,7 @@ int sshpkt_get_string_direct(struct ssh *ssh, const u_char **valp, size_t *lenp) int sshpkt_peek_string_direct(struct ssh *ssh, const u_char **valp, size_t *lenp); int sshpkt_get_cstring(struct ssh *ssh, char **valp, size_t *lenp); int sshpkt_get_ec(struct ssh *ssh, EC_POINT *v, const EC_GROUP *g); -int sshpkt_get_bignum2(struct ssh *ssh, BIGNUM *v); +int sshpkt_get_bignum2(struct ssh *ssh, BIGNUM **valp); int sshpkt_get_end(struct ssh *ssh); void sshpkt_fmt_connection_id(struct ssh *ssh, char *s, size_t l); const u_char *sshpkt_ptr(struct ssh *, size_t *lenp); diff --git a/usr.bin/ssh/ssh-ecdsa.c b/usr.bin/ssh/ssh-ecdsa.c index f187f048f42..d9d7e07beb9 100644 --- a/usr.bin/ssh/ssh-ecdsa.c +++ b/usr.bin/ssh/ssh-ecdsa.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-ecdsa.c,v 1.15 2018/09/13 02:08:33 djm Exp $ */ +/* $OpenBSD: ssh-ecdsa.c,v 1.16 2019/01/21 09:54:11 djm Exp $ */ /* * Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2010 Damien Miller. All rights reserved. @@ -145,15 +145,13 @@ ssh_ecdsa_verify(const struct sshkey *key, } /* parse signature */ - if ((sig = ECDSA_SIG_new()) == NULL || - (sig_r = BN_new()) == NULL || - (sig_s = BN_new()) == NULL) { - ret = SSH_ERR_ALLOC_FAIL; + if (sshbuf_get_bignum2(sigbuf, &sig_r) != 0 || + sshbuf_get_bignum2(sigbuf, &sig_s) != 0) { + ret = SSH_ERR_INVALID_FORMAT; goto out; } - if (sshbuf_get_bignum2(sigbuf, sig_r) != 0 || - sshbuf_get_bignum2(sigbuf, sig_s) != 0) { - ret = SSH_ERR_INVALID_FORMAT; + if ((sig = ECDSA_SIG_new()) == NULL) { + ret = SSH_ERR_ALLOC_FAIL; goto out; } if (!ECDSA_SIG_set0(sig, sig_r, sig_s)) { diff --git a/usr.bin/ssh/sshbuf-getput-crypto.c b/usr.bin/ssh/sshbuf-getput-crypto.c index 9d0da3b935e..fa91a8abd26 100644 --- a/usr.bin/ssh/sshbuf-getput-crypto.c +++ b/usr.bin/ssh/sshbuf-getput-crypto.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshbuf-getput-crypto.c,v 1.6 2019/01/21 09:52:25 djm Exp $ */ +/* $OpenBSD: sshbuf-getput-crypto.c,v 1.7 2019/01/21 09:54:11 djm Exp $ */ /* * Copyright (c) 2011 Damien Miller * @@ -28,16 +28,25 @@ #include "sshbuf.h" int -sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM *v) +sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM **valp) { + BIGNUM *v; const u_char *d; size_t len; int r; + if (valp != NULL) + *valp = NULL; if ((r = sshbuf_get_bignum2_bytes_direct(buf, &d, &len)) != 0) return r; - if (v != NULL && BN_bin2bn(d, len, v) == NULL) - return SSH_ERR_ALLOC_FAIL; + if (valp != NULL) { + if ((v = BN_new()) == NULL || + BN_bin2bn(d, len, v) == NULL) { + BN_clear_free(v); + return SSH_ERR_ALLOC_FAIL; + } + *valp = v; + } return 0; } diff --git a/usr.bin/ssh/sshbuf.h b/usr.bin/ssh/sshbuf.h index 01fafb43ac1..c4858867261 100644 --- a/usr.bin/ssh/sshbuf.h +++ b/usr.bin/ssh/sshbuf.h @@ -1,4 +1,4 @@ -/* $OpenBSD: sshbuf.h,v 1.12 2019/01/21 09:52:25 djm Exp $ */ +/* $OpenBSD: sshbuf.h,v 1.13 2019/01/21 09:54:11 djm Exp $ */ /* * Copyright (c) 2011 Damien Miller * @@ -204,7 +204,7 @@ int sshbuf_peek_string_direct(const struct sshbuf *buf, const u_char **valp, * Functions to extract or store SSH wire encoded bignums and elliptic * curve points. */ -int sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM *v); +int sshbuf_get_bignum2(struct sshbuf *buf, BIGNUM **valp); int sshbuf_get_bignum2_bytes_direct(struct sshbuf *buf, const u_char **valp, size_t *lenp); int sshbuf_put_bignum2(struct sshbuf *buf, const BIGNUM *v); diff --git a/usr.bin/ssh/sshkey.c b/usr.bin/ssh/sshkey.c index 00178bcdcf1..8a7538c7cf5 100644 --- a/usr.bin/ssh/sshkey.c +++ b/usr.bin/ssh/sshkey.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshkey.c,v 1.72 2018/10/11 00:52:46 djm Exp $ */ +/* $OpenBSD: sshkey.c,v 1.73 2019/01/21 09:54:11 djm Exp $ */ /* * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. * Copyright (c) 2008 Alexander von Gernler. All rights reserved. @@ -2010,13 +2010,8 @@ sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp, ret = SSH_ERR_ALLOC_FAIL; goto out; } - if ((rsa_e = BN_new()) == NULL || - (rsa_n = BN_new()) == NULL) { - ret = SSH_ERR_ALLOC_FAIL; - goto out; - } - if (sshbuf_get_bignum2(b, rsa_e) != 0 || - sshbuf_get_bignum2(b, rsa_n) != 0) { + if (sshbuf_get_bignum2(b, &rsa_e) != 0 || + sshbuf_get_bignum2(b, &rsa_n) != 0) { ret = SSH_ERR_INVALID_FORMAT; goto out; } @@ -2043,17 +2038,10 @@ sshkey_from_blob_internal(struct sshbuf *b, struct sshkey **keyp, ret = SSH_ERR_ALLOC_FAIL; goto out; } - if ((dsa_p = BN_new()) == NULL || - (dsa_q = BN_new()) == NULL || - (dsa_g = BN_new()) == NULL || - (dsa_pub_key = BN_new()) == NULL) { - ret = SSH_ERR_ALLOC_FAIL; - goto out; - } - if (sshbuf_get_bignum2(b, dsa_p) != 0 || - sshbuf_get_bignum2(b, dsa_q) != 0 || - sshbuf_get_bignum2(b, dsa_g) != 0 || - sshbuf_get_bignum2(b, dsa_pub_key) != 0) { + if (sshbuf_get_bignum2(b, &dsa_p) != 0 || + sshbuf_get_bignum2(b, &dsa_q) != 0 || + sshbuf_get_bignum2(b, &dsa_g) != 0 || + sshbuf_get_bignum2(b, &dsa_pub_key) != 0) { ret = SSH_ERR_INVALID_FORMAT; goto out; } @@ -2883,19 +2871,11 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) r = SSH_ERR_ALLOC_FAIL; goto out; } - if ((dsa_p = BN_new()) == NULL || - (dsa_q = BN_new()) == NULL || - (dsa_g = BN_new()) == NULL || - (dsa_pub_key = BN_new()) == NULL || - (dsa_priv_key = BN_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } - if ((r = sshbuf_get_bignum2(buf, dsa_p)) != 0 || - (r = sshbuf_get_bignum2(buf, dsa_q)) != 0 || - (r = sshbuf_get_bignum2(buf, dsa_g)) != 0 || - (r = sshbuf_get_bignum2(buf, dsa_pub_key)) != 0 || - (r = sshbuf_get_bignum2(buf, dsa_priv_key)) != 0) + if ((r = sshbuf_get_bignum2(buf, &dsa_p)) != 0 || + (r = sshbuf_get_bignum2(buf, &dsa_q)) != 0 || + (r = sshbuf_get_bignum2(buf, &dsa_g)) != 0 || + (r = sshbuf_get_bignum2(buf, &dsa_pub_key)) != 0 || + (r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0) goto out; if (!DSA_set0_pqg(k->dsa, dsa_p, dsa_q, dsa_g)) { r = SSH_ERR_LIBCRYPTO_ERROR; @@ -2909,12 +2889,8 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) dsa_pub_key = dsa_priv_key = NULL; /* transferred */ break; case KEY_DSA_CERT: - if ((dsa_priv_key = BN_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } if ((r = sshkey_froms(buf, &k)) != 0 || - (r = sshbuf_get_bignum2(buf, dsa_priv_key)) != 0) + (r = sshbuf_get_bignum2(buf, &dsa_priv_key)) != 0) goto out; if (!DSA_set0_key(k->dsa, NULL, dsa_priv_key)) { r = SSH_ERR_LIBCRYPTO_ERROR; @@ -2938,12 +2914,12 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) goto out; } k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid); - if (k->ecdsa == NULL || (exponent = BN_new()) == NULL) { + if (k->ecdsa == NULL) { r = SSH_ERR_LIBCRYPTO_ERROR; goto out; } if ((r = sshbuf_get_eckey(buf, k->ecdsa)) != 0 || - (r = sshbuf_get_bignum2(buf, exponent))) + (r = sshbuf_get_bignum2(buf, &exponent))) goto out; if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { r = SSH_ERR_LIBCRYPTO_ERROR; @@ -2955,12 +2931,8 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) goto out; break; case KEY_ECDSA_CERT: - if ((exponent = BN_new()) == NULL) { - r = SSH_ERR_LIBCRYPTO_ERROR; - goto out; - } if ((r = sshkey_froms(buf, &k)) != 0 || - (r = sshbuf_get_bignum2(buf, exponent)) != 0) + (r = sshbuf_get_bignum2(buf, &exponent)) != 0) goto out; if (EC_KEY_set_private_key(k->ecdsa, exponent) != 1) { r = SSH_ERR_LIBCRYPTO_ERROR; @@ -2976,21 +2948,12 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) r = SSH_ERR_ALLOC_FAIL; goto out; } - if ((rsa_n = BN_new()) == NULL || - (rsa_e = BN_new()) == NULL || - (rsa_d = BN_new()) == NULL || - (rsa_iqmp = BN_new()) == NULL || - (rsa_p = BN_new()) == NULL || - (rsa_q = BN_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } - if ((r = sshbuf_get_bignum2(buf, rsa_n)) != 0 || - (r = sshbuf_get_bignum2(buf, rsa_e)) != 0 || - (r = sshbuf_get_bignum2(buf, rsa_d)) != 0 || - (r = sshbuf_get_bignum2(buf, rsa_iqmp)) != 0 || - (r = sshbuf_get_bignum2(buf, rsa_p)) != 0 || - (r = sshbuf_get_bignum2(buf, rsa_q)) != 0) + if ((r = sshbuf_get_bignum2(buf, &rsa_n)) != 0 || + (r = sshbuf_get_bignum2(buf, &rsa_e)) != 0 || + (r = sshbuf_get_bignum2(buf, &rsa_d)) != 0 || + (r = sshbuf_get_bignum2(buf, &rsa_iqmp)) != 0 || + (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 || + (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0) goto out; if (!RSA_set0_key(k->rsa, rsa_n, rsa_e, rsa_d)) { r = SSH_ERR_LIBCRYPTO_ERROR; @@ -3008,18 +2971,11 @@ sshkey_private_deserialize(struct sshbuf *buf, struct sshkey **kp) goto out; break; case KEY_RSA_CERT: - if ((rsa_d = BN_new()) == NULL || - (rsa_iqmp = BN_new()) == NULL || - (rsa_p = BN_new()) == NULL || - (rsa_q = BN_new()) == NULL) { - r = SSH_ERR_ALLOC_FAIL; - goto out; - } if ((r = sshkey_froms(buf, &k)) != 0 || - (r = sshbuf_get_bignum2(buf, rsa_d)) != 0 || - (r = sshbuf_get_bignum2(buf, rsa_iqmp)) != 0 || - (r = sshbuf_get_bignum2(buf, rsa_p)) != 0 || - (r = sshbuf_get_bignum2(buf, rsa_q)) != 0) + (r = sshbuf_get_bignum2(buf, &rsa_d)) != 0 || + (r = sshbuf_get_bignum2(buf, &rsa_iqmp)) != 0 || + (r = sshbuf_get_bignum2(buf, &rsa_p)) != 0 || + (r = sshbuf_get_bignum2(buf, &rsa_q)) != 0) goto out; if (!RSA_set0_key(k->rsa, NULL, NULL, rsa_d)) { r = SSH_ERR_LIBCRYPTO_ERROR; |