1 /* $NetBSD: mac.c,v 1.18 2026/04/08 18:58:40 christos Exp $ */ 2 /* $OpenBSD: mac.c,v 1.38 2026/03/03 09:57:25 dtucker Exp $ */ 3 4 /* 5 * Copyright (c) 2001 Markus Friedl. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include "includes.h" 29 __RCSID("$NetBSD: mac.c,v 1.18 2026/04/08 18:58:40 christos Exp $"); 30 #include <sys/types.h> 31 32 #include <stdio.h> 33 #include <stdlib.h> 34 #include <string.h> 35 36 #include "digest.h" 37 #include "hmac.h" 38 #include "umac.h" 39 #include "mac.h" 40 #include "misc.h" 41 #include "ssherr.h" 42 #include "sshbuf.h" 43 44 #define SSH_DIGEST 1 /* SSH_DIGEST_XXX */ 45 #define SSH_UMAC 2 /* UMAC (not integrated with OpenSSL) */ 46 #define SSH_UMAC128 3 47 48 struct macalg { 49 const char *name; 50 int type; 51 int alg; 52 int truncatebits; /* truncate digest if != 0 */ 53 int key_len; /* just for UMAC */ 54 int len; /* just for UMAC */ 55 int etm; /* Encrypt-then-MAC */ 56 }; 57 58 static const struct macalg macs[] = { 59 /* Encrypt-and-MAC (encrypt-and-authenticate) variants */ 60 { "hmac-sha1", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 0 }, 61 { "hmac-sha1-96", SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 0 }, 62 { "hmac-sha2-256", SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 0 }, 63 { "hmac-sha2-512", SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 0 }, 64 { "hmac-md5", SSH_DIGEST, SSH_DIGEST_MD5, 0, 0, 0, 0 }, 65 { "hmac-md5-96", SSH_DIGEST, SSH_DIGEST_MD5, 96, 0, 0, 0 }, 66 { "umac-64 (at) openssh.com", SSH_UMAC, 0, 0, 128, 64, 0 }, 67 { "umac-128 (at) openssh.com", SSH_UMAC128, 0, 0, 128, 128, 0 }, 68 69 /* Encrypt-then-MAC variants */ 70 { "hmac-sha1-etm (at) openssh.com", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 1 }, 71 { "hmac-sha1-96-etm (at) openssh.com", SSH_DIGEST, SSH_DIGEST_SHA1, 96, 0, 0, 1 }, 72 { "hmac-sha2-256-etm (at) openssh.com", SSH_DIGEST, SSH_DIGEST_SHA256, 0, 0, 0, 1 }, 73 { "hmac-sha2-512-etm (at) openssh.com", SSH_DIGEST, SSH_DIGEST_SHA512, 0, 0, 0, 1 }, 74 { "hmac-md5-etm (at) openssh.com", SSH_DIGEST, SSH_DIGEST_MD5, 0, 0, 0, 1 }, 75 { "hmac-md5-96-etm (at) openssh.com", SSH_DIGEST, SSH_DIGEST_MD5, 96, 0, 0, 1 }, 76 { "umac-64-etm (at) openssh.com", SSH_UMAC, 0, 0, 128, 64, 1 }, 77 { "umac-128-etm (at) openssh.com", SSH_UMAC128, 0, 0, 128, 128, 1 }, 78 79 { NULL, 0, 0, 0, 0, 0, 0 } 80 }; 81 82 /* Returns a list of supported MACs separated by the specified char. */ 83 char * 84 mac_alg_list(char sep) 85 { 86 char *ret = NULL; 87 const struct macalg *m; 88 char sep_str[2] = {sep, '\0'}; 89 90 for (m = macs; m->name != NULL; m++) 91 xextendf(&ret, sep_str, "%s", m->name); 92 93 return ret; 94 } 95 96 static int 97 mac_setup_by_alg(struct sshmac *mac, const struct macalg *macalg) 98 { 99 mac->type = macalg->type; 100 if (mac->type == SSH_DIGEST) { 101 if ((mac->hmac_ctx = ssh_hmac_start(macalg->alg)) == NULL) 102 return SSH_ERR_ALLOC_FAIL; 103 mac->key_len = mac->mac_len = ssh_hmac_bytes(macalg->alg); 104 } else { 105 mac->mac_len = macalg->len / 8; 106 mac->key_len = macalg->key_len / 8; 107 mac->umac_ctx = NULL; 108 } 109 if (macalg->truncatebits != 0) 110 mac->mac_len = macalg->truncatebits / 8; 111 mac->etm = macalg->etm; 112 return 0; 113 } 114 115 int 116 mac_setup(struct sshmac *mac, char *name) 117 { 118 const struct macalg *m; 119 120 for (m = macs; m->name != NULL; m++) { 121 if (strcmp(name, m->name) != 0) 122 continue; 123 if (mac != NULL) 124 return mac_setup_by_alg(mac, m); 125 return 0; 126 } 127 return SSH_ERR_INVALID_ARGUMENT; 128 } 129 130 int 131 mac_init(struct sshmac *mac) 132 { 133 if (mac->key == NULL) 134 return SSH_ERR_INVALID_ARGUMENT; 135 switch (mac->type) { 136 case SSH_DIGEST: 137 if (mac->hmac_ctx == NULL || 138 ssh_hmac_init(mac->hmac_ctx, mac->key, mac->key_len) < 0) 139 return SSH_ERR_INVALID_ARGUMENT; 140 return 0; 141 case SSH_UMAC: 142 if ((mac->umac_ctx = umac_new(mac->key)) == NULL) 143 return SSH_ERR_ALLOC_FAIL; 144 return 0; 145 case SSH_UMAC128: 146 if ((mac->umac_ctx = umac128_new(mac->key)) == NULL) 147 return SSH_ERR_ALLOC_FAIL; 148 return 0; 149 default: 150 return SSH_ERR_INVALID_ARGUMENT; 151 } 152 } 153 154 int 155 mac_compute(struct sshmac *mac, uint32_t seqno, 156 const u_char *data, int datalen, 157 u_char *digest, size_t dlen) 158 { 159 static union { 160 u_char m[SSH_DIGEST_MAX_LENGTH]; 161 uint64_t for_align; 162 } u; 163 u_char b[4]; 164 u_char nonce[8]; 165 166 if (mac->mac_len > sizeof(u)) 167 return SSH_ERR_INTERNAL_ERROR; 168 169 switch (mac->type) { 170 case SSH_DIGEST: 171 put_u32(b, seqno); 172 /* reset HMAC context */ 173 if (ssh_hmac_init(mac->hmac_ctx, NULL, 0) < 0 || 174 ssh_hmac_update(mac->hmac_ctx, b, sizeof(b)) < 0 || 175 ssh_hmac_update(mac->hmac_ctx, data, datalen) < 0 || 176 ssh_hmac_final(mac->hmac_ctx, u.m, sizeof(u.m)) < 0) 177 return SSH_ERR_LIBCRYPTO_ERROR; 178 break; 179 case SSH_UMAC: 180 POKE_U64(nonce, seqno); 181 umac_update(mac->umac_ctx, data, datalen); 182 umac_final(mac->umac_ctx, u.m, nonce); 183 break; 184 case SSH_UMAC128: 185 put_u64(nonce, seqno); 186 umac128_update(mac->umac_ctx, data, datalen); 187 umac128_final(mac->umac_ctx, u.m, nonce); 188 break; 189 default: 190 return SSH_ERR_INVALID_ARGUMENT; 191 } 192 if (digest != NULL) { 193 if (dlen > mac->mac_len) 194 dlen = mac->mac_len; 195 memcpy(digest, u.m, dlen); 196 } 197 return 0; 198 } 199 200 int 201 mac_check(struct sshmac *mac, uint32_t seqno, 202 const u_char *data, size_t dlen, 203 const u_char *theirmac, size_t mlen) 204 { 205 u_char ourmac[SSH_DIGEST_MAX_LENGTH]; 206 int r; 207 208 if (mac->mac_len > mlen) 209 return SSH_ERR_INVALID_ARGUMENT; 210 if ((r = mac_compute(mac, seqno, data, dlen, 211 ourmac, sizeof(ourmac))) != 0) 212 return r; 213 if (timingsafe_bcmp(ourmac, theirmac, mac->mac_len) != 0) 214 return SSH_ERR_MAC_INVALID; 215 return 0; 216 } 217 218 void 219 mac_clear(struct sshmac *mac) 220 { 221 if (mac->type == SSH_UMAC) { 222 if (mac->umac_ctx != NULL) 223 umac_delete(mac->umac_ctx); 224 } else if (mac->type == SSH_UMAC128) { 225 if (mac->umac_ctx != NULL) 226 umac128_delete(mac->umac_ctx); 227 } else if (mac->hmac_ctx != NULL) 228 ssh_hmac_free(mac->hmac_ctx); 229 mac->hmac_ctx = NULL; 230 mac->umac_ctx = NULL; 231 } 232 233 /* XXX copied from ciphers_valid */ 234 #define MAC_SEP "," 235 int 236 mac_valid(const char *names) 237 { 238 char *maclist, *cp, *p; 239 240 if (names == NULL || strcmp(names, "") == 0) 241 return 0; 242 if ((maclist = cp = strdup(names)) == NULL) 243 return 0; 244 for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0'; 245 (p = strsep(&cp, MAC_SEP))) { 246 if (mac_setup(NULL, p) < 0) { 247 free(maclist); 248 return 0; 249 } 250 } 251 free(maclist); 252 return 1; 253 } 254
Indexes created Thu Jun 18 00:24:58 UTC 2026