diff options
Diffstat (limited to 'feature-add-SMx-support.patch')
| -rw-r--r-- | feature-add-SMx-support.patch | 1507 |
1 files changed, 1507 insertions, 0 deletions
diff --git a/feature-add-SMx-support.patch b/feature-add-SMx-support.patch new file mode 100644 index 0000000..e8b0f3c --- /dev/null +++ b/feature-add-SMx-support.patch @@ -0,0 +1,1507 @@ +From d2e28809c673f914b49147ca3fa31e08b9e885d7 Mon Sep 17 00:00:00 2001 +From: renmingshuai <renmingshuai@huawei.com> +Date: Sat, 29 Jul 2023 10:50:29 +0800 +Subject: [PATCH] feature add sm2 + +--- + Makefile.in | 4 +- + authfd.c | 2 + + authfile.c | 1 + + cipher.c | 1 + + digest-openssl.c | 1 + + digest.h | 3 +- + kex.c | 1 + + kex.h | 3 + + kexecdh.c | 23 +- + kexgen.c | 3 + + kexsm2.c | 406 ++++++++++++++++++++++++++ + mac.c | 1 + + pathnames.h | 1 + + regress/agent.sh | 9 + + regress/keytype.sh | 2 + + regress/knownhosts-command.sh | 1 + + regress/misc/fuzz-harness/sig_fuzz.cc | 4 + + regress/unittests/kex/test_kex.c | 3 + + ssh-ecdsa.c | 6 +- + ssh-keygen.c | 12 +- + ssh-keyscan.c | 12 +- + ssh-sm2.c | 381 ++++++++++++++++++++++++ + ssh_api.c | 2 + + sshconnect2.c | 1 + + sshd.c | 7 + + sshkey.c | 21 ++ + sshkey.h | 2 + + 27 files changed, 899 insertions(+), 14 deletions(-) + create mode 100644 kexsm2.c + create mode 100644 ssh-sm2.c + +diff --git a/Makefile.in b/Makefile.in +index 5fec5b3..7dcda3e 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -102,14 +102,14 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ + log.o match.o moduli.o nchan.o packet.o \ + readpass.o ttymodes.o xmalloc.o addr.o addrmatch.o \ + atomicio.o dispatch.o mac.o misc.o utf8.o \ +- monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \ ++ monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-sm2.o ssh-ecdsa-sk.o \ + ssh-ed25519-sk.o ssh-rsa.o dh.o \ + msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \ + ssh-pkcs11.o ssh-pkcs11-uri.o smult_curve25519_ref.o \ + poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \ + ssh-ed25519.o digest-openssl.o digest-libc.o \ + hmac.o ed25519.o hash.o \ +- kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \ ++ kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o kexsm2.o \ + kexgexc.o kexgexs.o \ + kexsntrup761x25519.o sntrup761.o kexgen.o \ + kexgssc.o \ +diff --git a/authfd.c b/authfd.c +index 25a3636..bcc25a7 100644 +--- a/authfd.c ++++ b/authfd.c +@@ -583,6 +583,8 @@ ssh_add_identity_constrained(int sock, struct sshkey *key, + case KEY_DSA_CERT: + case KEY_ECDSA: + case KEY_ECDSA_CERT: ++ case KEY_SM2: ++ case KEY_SM2_CERT: + case KEY_ECDSA_SK: + case KEY_ECDSA_SK_CERT: + #endif +diff --git a/authfile.c b/authfile.c +index 445f2dd..3884031 100644 +--- a/authfile.c ++++ b/authfile.c +@@ -332,6 +332,7 @@ sshkey_load_private_cert(int type, const char *filename, const char *passphrase, + case KEY_RSA: + case KEY_DSA: + case KEY_ECDSA: ++ case KEY_SM2: + #endif /* WITH_OPENSSL */ + case KEY_ED25519: + case KEY_XMSS: +diff --git a/cipher.c b/cipher.c +index 609450d..7f98413 100644 +--- a/cipher.c ++++ b/cipher.c +@@ -86,6 +86,7 @@ static const struct sshcipher ciphers[] = { + #endif + { "chacha20-poly1305@openssh.com", + 8, 64, 0, 16, CFLAG_CHACHAPOLY, NULL }, ++ { "sm4-ctr", 16, 16, 0, 0, 0, EVP_sm4_ctr }, + { "none", 8, 0, 0, 0, CFLAG_NONE, NULL }, + + { NULL, 0, 0, 0, 0, 0, NULL } +diff --git a/digest-openssl.c b/digest-openssl.c +index 94730e9..fa92360 100644 +--- a/digest-openssl.c ++++ b/digest-openssl.c +@@ -61,6 +61,7 @@ const struct ssh_digest digests[] = { + { SSH_DIGEST_SHA256, "SHA256", 32, EVP_sha256 }, + { SSH_DIGEST_SHA384, "SHA384", 48, EVP_sha384 }, + { SSH_DIGEST_SHA512, "SHA512", 64, EVP_sha512 }, ++ { SSH_DIGEST_SM3, "SM3", 32, EVP_sm3 }, + { -1, NULL, 0, NULL }, + }; + +diff --git a/digest.h b/digest.h +index c7ceeb3..520722c 100644 +--- a/digest.h ++++ b/digest.h +@@ -27,7 +27,8 @@ + #define SSH_DIGEST_SHA256 2 + #define SSH_DIGEST_SHA384 3 + #define SSH_DIGEST_SHA512 4 +-#define SSH_DIGEST_MAX 5 ++#define SSH_DIGEST_SM3 5 ++#define SSH_DIGEST_MAX 6 + + struct sshbuf; + struct ssh_digest_ctx; +diff --git a/kex.c b/kex.c +index 0fbd0ca..e9dfcc2 100644 +--- a/kex.c ++++ b/kex.c +@@ -125,6 +125,7 @@ static const struct kexalg kexalgs[] = { + SSH_DIGEST_SHA512 }, + #endif + #endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */ ++ { "sm2-sm3", KEX_SM2_SM3, NID_sm2, SSH_DIGEST_SM3 }, + { NULL, 0, -1, -1}, + }; + static const struct kexalg gss_kexalgs[] = { +diff --git a/kex.h b/kex.h +index 0fac9d3..044ec18 100644 +--- a/kex.h ++++ b/kex.h +@@ -102,6 +102,7 @@ enum kex_exchange { + KEX_ECDH_SHA2, + KEX_C25519_SHA256, + KEX_KEM_SNTRUP761X25519_SHA512, ++ KEX_SM2_SM3, + #ifdef GSSAPI + KEX_GSS_GRP1_SHA1, + KEX_GSS_GRP14_SHA1, +@@ -287,6 +288,8 @@ int kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE], + __attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE))) + __attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE))); + ++int SM2KAP_compute_key(void *out, size_t outlen, const EC_POINT *pub_key, const EC_KEY *eckey, int server); ++ + #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH) + void dump_digest(const char *, const u_char *, int); + #endif +diff --git a/kexecdh.c b/kexecdh.c +index efb2e55..69ec13b 100644 +--- a/kexecdh.c ++++ b/kexecdh.c +@@ -44,7 +44,7 @@ + + static int + kex_ecdh_dec_key_group(struct kex *, const struct sshbuf *, EC_KEY *key, +- const EC_GROUP *, struct sshbuf **); ++ const EC_GROUP *, struct sshbuf **, int server); + + int + kex_ecdh_keypair(struct kex *kex) +@@ -124,7 +124,7 @@ kex_ecdh_enc(struct kex *kex, const struct sshbuf *client_blob, + (r = sshbuf_get_u32(server_blob, NULL)) != 0) + goto out; + if ((r = kex_ecdh_dec_key_group(kex, client_blob, server_key, group, +- shared_secretp)) != 0) ++ shared_secretp, 1)) != 0) + goto out; + *server_blobp = server_blob; + server_blob = NULL; +@@ -136,7 +136,7 @@ kex_ecdh_enc(struct kex *kex, const struct sshbuf *client_blob, + + static int + kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob, +- EC_KEY *key, const EC_GROUP *group, struct sshbuf **shared_secretp) ++ EC_KEY *key, const EC_GROUP *group, struct sshbuf **shared_secretp, int server) + { + struct sshbuf *buf = NULL; + BIGNUM *shared_secret = NULL; +@@ -176,11 +176,20 @@ kex_ecdh_dec_key_group(struct kex *kex, const struct sshbuf *ec_blob, + r = SSH_ERR_ALLOC_FAIL; + goto out; + } +- if (ECDH_compute_key(kbuf, klen, dh_pub, key, NULL) != (int)klen || ++ if (kex->ec_nid == NID_sm2) { ++ if (SM2KAP_compute_key(kbuf, klen, dh_pub, key, server) != (int)klen || + BN_bin2bn(kbuf, klen, shared_secret) == NULL) { +- r = SSH_ERR_LIBCRYPTO_ERROR; +- goto out; ++ r = SSH_ERR_LIBCRYPTO_ERROR; ++ goto out; ++ } ++ } else { ++ if (ECDH_compute_key(kbuf, klen, dh_pub, key, NULL) != (int)klen || ++ BN_bin2bn(kbuf, klen, shared_secret) == NULL) { ++ r = SSH_ERR_LIBCRYPTO_ERROR; ++ goto out; ++ } + } ++ + #ifdef DEBUG_KEXECDH + dump_digest("shared secret", kbuf, klen); + #endif +@@ -203,7 +212,7 @@ kex_ecdh_dec(struct kex *kex, const struct sshbuf *server_blob, + int r; + + r = kex_ecdh_dec_key_group(kex, server_blob, kex->ec_client_key, +- kex->ec_group, shared_secretp); ++ kex->ec_group, shared_secretp, 0); + EC_KEY_free(kex->ec_client_key); + kex->ec_client_key = NULL; + return r; +diff --git a/kexgen.c b/kexgen.c +index ca70484..4855d5c 100644 +--- a/kexgen.c ++++ b/kexgen.c +@@ -111,6 +111,7 @@ kex_gen_client(struct ssh *ssh) + r = kex_dh_keypair(kex); + break; + case KEX_ECDH_SHA2: ++ case KEX_SM2_SM3: + r = kex_ecdh_keypair(kex); + break; + #endif +@@ -182,6 +183,7 @@ input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh) + r = kex_dh_dec(kex, server_blob, &shared_secret); + break; + case KEX_ECDH_SHA2: ++ case KEX_SM2_SM3: + r = kex_ecdh_dec(kex, server_blob, &shared_secret); + break; + #endif +@@ -298,6 +300,7 @@ input_kex_gen_init(int type, u_int32_t seq, struct ssh *ssh) + &shared_secret); + break; + case KEX_ECDH_SHA2: ++ case KEX_SM2_SM3: + r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey, + &shared_secret); + break; +diff --git a/kexsm2.c b/kexsm2.c +new file mode 100644 +index 0000000..f507557 +--- /dev/null ++++ b/kexsm2.c +@@ -0,0 +1,406 @@ ++#include <openssl/err.h> ++#include <openssl/evp.h> ++#include <openssl/bn.h> ++#include <string.h> ++#include <openssl/ecdh.h> ++#include <openssl/ec.h> ++ ++int sm2_compute_z_digest(uint8_t *out, ++ const EVP_MD *digest, ++ const uint8_t *id, ++ const size_t id_len, ++ const EC_KEY *key) ++{ ++ int rc = 0; ++ const EC_GROUP *group = EC_KEY_get0_group(key); ++ BN_CTX *ctx = NULL; ++ EVP_MD_CTX *hash = NULL; ++ BIGNUM *p = NULL; ++ BIGNUM *a = NULL; ++ BIGNUM *b = NULL; ++ BIGNUM *xG = NULL; ++ BIGNUM *yG = NULL; ++ BIGNUM *xA = NULL; ++ BIGNUM *yA = NULL; ++ int p_bytes = 0; ++ uint8_t *buf = NULL; ++ uint16_t entl = 0; ++ uint8_t e_byte = 0; ++ ++ hash = EVP_MD_CTX_new(); ++ ctx = BN_CTX_new(); ++ if (hash == NULL || ctx == NULL) { ++ goto done; ++ } ++ ++ p = BN_CTX_get(ctx); ++ a = BN_CTX_get(ctx); ++ b = BN_CTX_get(ctx); ++ xG = BN_CTX_get(ctx); ++ yG = BN_CTX_get(ctx); ++ xA = BN_CTX_get(ctx); ++ yA = BN_CTX_get(ctx); ++ ++ if (yA == NULL) { ++ goto done; ++ } ++ ++ if (!EVP_DigestInit(hash, digest)) { ++ goto done; ++ } ++ ++ /* Z = h(ENTL || ID || a || b || xG || yG || xA || yA) */ ++ ++ if (id_len >= (UINT16_MAX / 8)) { ++ /* too large */ ++ goto done; ++ } ++ ++ entl = (uint16_t)(8 * id_len); ++ ++ e_byte = entl >> 8; ++ if (!EVP_DigestUpdate(hash, &e_byte, 1)) { ++ goto done; ++ } ++ e_byte = entl & 0xFF; ++ if (!EVP_DigestUpdate(hash, &e_byte, 1)) { ++ goto done; ++ } ++ ++ if (id_len > 0 && !EVP_DigestUpdate(hash, id, id_len)) { ++ goto done; ++ } ++ ++ if (!EC_GROUP_get_curve(group, p, a, b, ctx)) { ++ goto done; ++ } ++ ++ p_bytes = BN_num_bytes(p); ++ buf = OPENSSL_zalloc(p_bytes); ++ if (buf == NULL) { ++ goto done; ++ } ++ ++ if (BN_bn2binpad(a, buf, p_bytes) < 0 ++ || !EVP_DigestUpdate(hash, buf, p_bytes) ++ || BN_bn2binpad(b, buf, p_bytes) < 0 ++ || !EVP_DigestUpdate(hash, buf, p_bytes) ++ || !EC_POINT_get_affine_coordinates(group, ++ EC_GROUP_get0_generator(group), ++ xG, yG, ctx) ++ || BN_bn2binpad(xG, buf, p_bytes) < 0 ++ || !EVP_DigestUpdate(hash, buf, p_bytes) ++ || BN_bn2binpad(yG, buf, p_bytes) < 0 ++ || !EVP_DigestUpdate(hash, buf, p_bytes) ++ || !EC_POINT_get_affine_coordinates(group, ++ EC_KEY_get0_public_key(key), ++ xA, yA, ctx) ++ || BN_bn2binpad(xA, buf, p_bytes) < 0 ++ || !EVP_DigestUpdate(hash, buf, p_bytes) ++ || BN_bn2binpad(yA, buf, p_bytes) < 0 ++ || !EVP_DigestUpdate(hash, buf, p_bytes) ++ || !EVP_DigestFinal(hash, out, NULL)) { ++ goto done; ++ } ++ ++ rc = 1; ++ ++ done: ++ OPENSSL_free(buf); ++ BN_CTX_free(ctx); ++ EVP_MD_CTX_free(hash); ++ return rc; ++} ++ ++ ++/* GM/T003_2012 Defined Key Derive Function */ ++int kdf_gmt003_2012(unsigned char *out, size_t outlen, const unsigned char *Z, size_t Zlen, const unsigned char *SharedInfo, size_t SharedInfolen, const EVP_MD *md) ++{ ++ EVP_MD_CTX *mctx = NULL; ++ unsigned int counter; ++ unsigned char ctr[4]; ++ size_t mdlen; ++ int retval = 0; ++ unsigned char dgst[EVP_MAX_MD_SIZE]; ++ ++ if (!out || !outlen) return retval; ++ if (md == NULL) { ++ md = EVP_sm3(); ++ } ++ mdlen = EVP_MD_size(md); ++ mctx = EVP_MD_CTX_new(); ++ if (mctx == NULL) { ++ goto err; ++ } ++ ++ for (counter = 1;; counter++) { ++ if (!EVP_DigestInit(mctx, md)) { ++ goto err; ++ } ++ ctr[0] = (unsigned char)((counter >> 24) & 0xFF); ++ ctr[1] = (unsigned char)((counter >> 16) & 0xFF); ++ ctr[2] = (unsigned char)((counter >> 8) & 0xFF); ++ ctr[3] = (unsigned char)(counter & 0xFF); ++ ++ if (!EVP_DigestUpdate(mctx, Z, Zlen)) { ++ goto err; ++ } ++ if (!EVP_DigestUpdate(mctx, ctr, sizeof(ctr))) { ++ goto err; ++ } ++ if (!EVP_DigestUpdate(mctx, SharedInfo, SharedInfolen)) { ++ goto err; ++ } ++ if (!EVP_DigestFinal(mctx, dgst, NULL)) { ++ goto err; ++ } ++ ++ if (outlen > mdlen) { ++ memcpy(out, dgst, mdlen); ++ out += mdlen; ++ outlen -= mdlen; ++ } else { ++ memcpy(out, dgst, outlen); ++ memset(dgst, 0, mdlen); ++ break; ++ } ++ } ++ ++ retval = 1; ++ ++err: ++ EVP_MD_CTX_free(mctx); ++ return retval; ++} ++ ++int sm2_kap_compute_key(void *out, size_t outlen, int server,\ ++ const uint8_t *peer_uid, int peer_uid_len, const uint8_t *self_uid, int self_uid_len, \ ++ const EC_KEY *peer_ecdhe_key, const EC_KEY *self_ecdhe_key, const EC_KEY *peer_pub_key, const EC_KEY *self_eckey, \ ++ const EVP_MD *md) ++{ ++ BN_CTX *ctx = NULL; ++ EC_POINT *UorV = NULL; ++ const EC_POINT *Rs, *Rp; ++ BIGNUM *Xs = NULL, *Xp = NULL, *h = NULL, *t = NULL, *two_power_w = NULL, *order = NULL; ++ const BIGNUM *priv_key, *r; ++ const EC_GROUP *group; ++ int w; ++ int ret = -1; ++ size_t buflen, len; ++ unsigned char *buf = NULL; ++ ++ if (outlen > INT_MAX) { ++ goto err; ++ } ++ ++ if (!peer_pub_key || !self_eckey) { ++ goto err; ++ } ++ ++ priv_key = EC_KEY_get0_private_key(self_eckey); ++ if (!priv_key) { ++ goto err; ++ } ++ ++ if (!peer_ecdhe_key || !self_ecdhe_key) { ++ goto err; ++ } ++ ++ Rs = EC_KEY_get0_public_key(self_ecdhe_key); ++ Rp = EC_KEY_get0_public_key(peer_ecdhe_key); ++ r = EC_KEY_get0_private_key(self_ecdhe_key); ++ ++ if (!Rs || !Rp || !r) { ++ goto err; ++ } ++ ++ ctx = BN_CTX_new(); ++ Xs = BN_new(); ++ Xp = BN_new(); ++ h = BN_new(); ++ t = BN_new(); ++ two_power_w = BN_new(); ++ order = BN_new(); ++ if (!Xs || !Xp || !h || !t || !two_power_w || !order) { ++ goto err; ++ } ++ ++ group = EC_KEY_get0_group(self_eckey); ++ ++ /*Second: Caculate -- w*/ ++ if (!EC_GROUP_get_order(group, order, ctx) || !EC_GROUP_get_cofactor(group, h, ctx)) { ++ goto err; ++ } ++ ++ w = (BN_num_bits(order) + 1) / 2 - 1; ++ if (!BN_lshift(two_power_w, BN_value_one(), w)) { ++ goto err; ++ } ++ ++ /*Third: Caculate -- X = 2 ^ w + (x & (2 ^ w - 1)) = 2 ^ w + (x mod 2 ^ w)*/ ++ UorV = EC_POINT_new(group); ++ ++ if (!UorV) { ++ goto err; ++ } ++ ++ /*Test peer public key On curve*/ ++ if (!EC_POINT_is_on_curve(group, Rp, ctx)) { ++ goto err; ++ } ++ ++ /*Get x*/ ++ if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) == NID_X9_62_prime_field) { ++ if (!EC_POINT_get_affine_coordinates_GFp(group, Rs, Xs, NULL, ctx)) { ++ goto err; ++ } ++ ++ if (!EC_POINT_get_affine_coordinates_GFp(group, Rp, Xp, NULL, ctx)) { ++ goto err; ++ } ++ } ++ ++ /*x mod 2 ^ w*/ ++ /*Caculate Self x*/ ++ if (!BN_nnmod(Xs, Xs, two_power_w, ctx)) { ++ goto err; ++ } ++ ++ if (!BN_add(Xs, Xs, two_power_w)) { ++ goto err; ++ } ++ ++ /*Caculate Peer x*/ ++ if (!BN_nnmod(Xp, Xp, two_power_w, ctx)) { ++ goto err; ++ } ++ ++ if (!BN_add(Xp, Xp, two_power_w)) { ++ goto err; ++ } ++ ++ /*Forth: Caculate t*/ ++ if (!BN_mod_mul(t, Xs, r, order, ctx)) { ++ goto err; ++ } ++ ++ if (!BN_mod_add(t, t, priv_key, order, ctx)) { ++ goto err; ++ } ++ ++ /*Fifth: Caculate V or U*/ ++ if (!BN_mul(t, t, h, ctx)) { ++ goto err; ++ } ++ ++ /* [x]R */ ++ if (!EC_POINT_mul(group, UorV, NULL, Rp, Xp, ctx)) { ++ goto err; ++ } ++ ++ /* P + [x]R */ ++ if (!EC_POINT_add(group, UorV, UorV, EC_KEY_get0_public_key(peer_pub_key), ctx)) { ++ goto err; ++ } ++ ++ if (!EC_POINT_mul(group, UorV, NULL, UorV, t, ctx)) { ++ goto err; ++ } ++ ++ /* Detect UorV is in */ ++ if (EC_POINT_is_at_infinity(group, UorV)) { ++ goto err; ++ } ++ ++ /*Sixth: Caculate Key -- Need Xuorv, Yuorv, Zc, Zs, klen*/ ++ { ++ /* ++ size_t buflen, len; ++ unsigned char *buf = NULL; ++ */ ++ size_t elemet_len, idx; ++ ++ elemet_len = (size_t)((EC_GROUP_get_degree(group) + 7) / 8); ++ buflen = elemet_len * 2 + 32 * 2 + 1; /*add 1 byte tag*/ ++ buf = (unsigned char *)OPENSSL_malloc(buflen + 10); ++ if (!buf) { ++ goto err; ++ } ++ memset(buf, 0, buflen + 10); ++ /*1 : Get public key for UorV, Notice: the first byte is a tag, not a valid char*/ ++ idx = EC_POINT_point2oct(group, UorV, 4, buf, buflen, ctx); ++ if (!idx) { ++ goto err; ++ } ++ ++ if (!server) { ++ /*SIDE A*/ ++ len = buflen - idx; ++ if (!sm2_compute_z_digest( (unsigned char *)(buf + idx), md, (const uint8_t *)self_uid, self_uid_len, self_eckey)) { ++ goto err; ++ } ++ len = 32; ++ idx += len; ++ } ++ ++ /*Caculate Peer Z*/ ++ len = buflen - idx; ++ if (!sm2_compute_z_digest( (unsigned char *)(buf + idx), md, (const uint8_t *)peer_uid, peer_uid_len, peer_pub_key)) { ++ goto err; ++ } ++ len = 32; ++ idx += len; ++ ++ if (server) { ++ /*SIDE B*/ ++ len = buflen - idx; ++ if (!sm2_compute_z_digest( (unsigned char *)(buf + idx), md, (const uint8_t *)self_uid, self_uid_len, self_eckey)) { ++ goto err; ++ } ++ len = 32; ++ idx += len; ++ } ++ ++ len = outlen; ++ if (!kdf_gmt003_2012(out, len, (const unsigned char *)(buf + 1), idx - 1, NULL, 0, md)) { ++ goto err; ++ } ++ } ++ ++ ret = outlen; ++ ++err: ++ if (Xs) BN_free(Xs); ++ if (Xp) BN_free(Xp); ++ if (h) BN_free(h); ++ if (t) BN_free(t); ++ if (two_power_w) BN_free(two_power_w); ++ if (order) BN_free(order); ++ if (UorV) EC_POINT_free(UorV); ++ if (buf) OPENSSL_free(buf); ++ if (ctx) BN_CTX_free(ctx); ++ ++ return ret; ++} ++ ++int SM2KAP_compute_key(void *out, size_t outlen, const EC_POINT *pub_key, const EC_KEY *eckey, int server) ++{ ++ int ret = 0; ++ EC_KEY *pubkey = NULL; ++ unsigned char id[16] = {1, 2, 3, 4, 5, 6, 7, 8, 1, 2, 3, 4, 5, 6, 7, 8}; ++ ++ if ((pubkey = EC_KEY_new_by_curve_name(NID_sm2)) == NULL) { ++ return ret; ++ } ++ ++ if (EC_KEY_set_public_key(pubkey, pub_key) != 1) { ++ ret = 0; ++ goto out; ++ } ++ ++ ret = sm2_kap_compute_key(out, outlen, server, id, sizeof(id), id, sizeof(id), pubkey, eckey, pubkey, eckey, (EVP_MD*)EVP_sm3()); ++ ++out: ++ EC_KEY_free(pubkey); ++ return ret; ++} +diff --git a/mac.c b/mac.c +index bf051ba..2de17a0 100644 +--- a/mac.c ++++ b/mac.c +@@ -65,6 +65,7 @@ static const struct macalg macs[] = { + { "hmac-md5-96", SSH_DIGEST, SSH_DIGEST_MD5, 96, 0, 0, 0 }, + { "umac-64@openssh.com", SSH_UMAC, 0, 0, 128, 64, 0 }, + { "umac-128@openssh.com", SSH_UMAC128, 0, 0, 128, 128, 0 }, ++ { "hmac-sm3", SSH_DIGEST, SSH_DIGEST_SM3, 0, 0, 0, 0 }, + + /* Encrypt-then-MAC variants */ + { "hmac-sha1-etm@openssh.com", SSH_DIGEST, SSH_DIGEST_SHA1, 0, 0, 0, 1 }, +diff --git a/pathnames.h b/pathnames.h +index a094888..0a805ad 100644 +--- a/pathnames.h ++++ b/pathnames.h +@@ -80,6 +80,7 @@ + #define _PATH_SSH_CLIENT_ID_XMSS _PATH_SSH_USER_DIR "/id_xmss" + #define _PATH_SSH_CLIENT_ID_ECDSA_SK _PATH_SSH_USER_DIR "/id_ecdsa_sk" + #define _PATH_SSH_CLIENT_ID_ED25519_SK _PATH_SSH_USER_DIR "/id_ed25519_sk" ++#define _PATH_SSH_CLIENT_ID_SM2 _PATH_SSH_USER_DIR "/id_sm2" + + /* + * Configuration file in user's home directory. This file need not be +diff --git a/regress/agent.sh b/regress/agent.sh +index 5f10606..3ab40b4 100644 +--- a/regress/agent.sh ++++ b/regress/agent.sh +@@ -87,9 +87,18 @@ fi + for t in ${SSH_KEYTYPES}; do + trace "connect via agent using $t key" + if [ "$t" = "ssh-dss" ]; then ++ sed -i "/PubkeyAcceptedAlgorithms/d" $OBJ/ssh_proxy ++ sed -i "/PubkeyAcceptedAlgorithms/d" $OBJ/sshd_proxy + echo "PubkeyAcceptedAlgorithms +ssh-dss" >> $OBJ/ssh_proxy + echo "PubkeyAcceptedAlgorithms +ssh-dss" >> $OBJ/sshd_proxy + fi ++ if [ "$t" = "sm2" ]; then ++ sed -i "/PubkeyAcceptedAlgorithms/d" $OBJ/ssh_proxy ++ sed -i "/PubkeyAcceptedAlgorithms/d" $OBJ/sshd_proxy ++ echo "PubkeyAcceptedAlgorithms +sm2,sm2-cert" >> $OBJ/ssh_proxy ++ echo "PubkeyAcceptedAlgorithms +sm2,sm2-cert" >> $OBJ/sshd_proxy ++ fi ++ + ${SSH} -F $OBJ/ssh_proxy -i $OBJ/$t-agent.pub -oIdentitiesOnly=yes \ + somehost exit 52 + r=$? +diff --git a/regress/keytype.sh b/regress/keytype.sh +index f1c0451..2665bd6 100644 +--- a/regress/keytype.sh ++++ b/regress/keytype.sh +@@ -18,6 +18,7 @@ for i in ${SSH_KEYTYPES}; do + ecdsa-sha2-nistp521) ktypes="$ktypes ecdsa-521" ;; + sk-ssh-ed25519*) ktypes="$ktypes ed25519-sk" ;; + sk-ecdsa-sha2-nistp256*) ktypes="$ktypes ecdsa-sk" ;; ++ sm2) ktypes="$ktypes sm2-256" ;; + esac + done + +@@ -44,6 +45,7 @@ kname_to_ktype() { + rsa-*) echo rsa-sha2-512,rsa-sha2-256,ssh-rsa;; + ed25519-sk) echo sk-ssh-ed25519@openssh.com;; + ecdsa-sk) echo sk-ecdsa-sha2-nistp256@openssh.com;; ++ sm2-256) echo sm2;; + esac + } + +diff --git a/regress/knownhosts-command.sh b/regress/knownhosts-command.sh +index 8472ec8..7f56fb1 100644 +--- a/regress/knownhosts-command.sh ++++ b/regress/knownhosts-command.sh +@@ -41,6 +41,7 @@ ${SSH} -F $OBJ/ssh_proxy x true && fail "ssh connect succeeded with bad exit" + for keytype in ${SSH_HOSTKEY_TYPES} ; do + algs=$keytype + test "x$keytype" = "xssh-dss" && continue ++ test "x$keytype" = "xsm2" && continue + test "x$keytype" = "xssh-rsa" && algs=ssh-rsa,rsa-sha2-256,rsa-sha2-512 + verbose "keytype $keytype" + cat > $OBJ/knownhosts_command << _EOF +diff --git a/regress/misc/fuzz-harness/sig_fuzz.cc b/regress/misc/fuzz-harness/sig_fuzz.cc +index b32502b..f260692 100644 +--- a/regress/misc/fuzz-harness/sig_fuzz.cc ++++ b/regress/misc/fuzz-harness/sig_fuzz.cc +@@ -30,6 +30,7 @@ int LLVMFuzzerTestOneInput(const uint8_t* sig, size_t slen) + static struct sshkey *ecdsa256 = generate_or_die(KEY_ECDSA, 256); + static struct sshkey *ecdsa384 = generate_or_die(KEY_ECDSA, 384); + static struct sshkey *ecdsa521 = generate_or_die(KEY_ECDSA, 521); ++ static struct sshkey *sm2 = generate_or_die(KEY_SM2, 256); + #endif + struct sshkey_sig_details *details = NULL; + static struct sshkey *ed25519 = generate_or_die(KEY_ED25519, 0); +@@ -53,6 +54,9 @@ int LLVMFuzzerTestOneInput(const uint8_t* sig, size_t slen) + sshkey_verify(ecdsa521, sig, slen, (const u_char *)data, dlen, NULL, 0, &details); + sshkey_sig_details_free(details); + details = NULL; ++ sshkey_verify(sm2, sig, slen, (const u_char *)data, dlen, NULL, 0, &details); ++ sshkey_sig_details_free(details); ++ details = NULL; + #endif + sshkey_verify(ed25519, sig, slen, (const u_char *)data, dlen, NULL, 0, &details); + sshkey_sig_details_free(details); +diff --git a/regress/unittests/kex/test_kex.c b/regress/unittests/kex/test_kex.c +index c26761e..d335b29 100644 +--- a/regress/unittests/kex/test_kex.c ++++ b/regress/unittests/kex/test_kex.c +@@ -151,6 +151,7 @@ do_kex_with_key(char *kex, int keytype, int bits) + #endif /* OPENSSL_HAS_ECC */ + #endif /* WITH_OPENSSL */ + server2->kex->kex[KEX_C25519_SHA256] = kex_gen_server; ++ server2->kex->kex[KEX_SM2_SM3] = kex_gen_server; + server2->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; + server2->kex->load_host_public_key = server->kex->load_host_public_key; + server2->kex->load_host_private_key = server->kex->load_host_private_key; +@@ -185,6 +186,7 @@ do_kex(char *kex) + #endif /* OPENSSL_HAS_ECC */ + #endif /* WITH_OPENSSL */ + do_kex_with_key(kex, KEY_ED25519, 256); ++ do_kex_with_key(kex, KEY_SM2, 256); + } + + void +@@ -201,6 +203,7 @@ kex_tests(void) + do_kex("diffie-hellman-group-exchange-sha1"); + do_kex("diffie-hellman-group14-sha1"); + do_kex("diffie-hellman-group1-sha1"); ++ do_kex("sm2-sm3"); + # ifdef USE_SNTRUP761X25519 + do_kex("sntrup761x25519-sha512@openssh.com"); + # endif /* USE_SNTRUP761X25519 */ +diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c +index b705157..5445ab5 100644 +--- a/ssh-ecdsa.c ++++ b/ssh-ecdsa.c +@@ -256,7 +256,8 @@ ssh_ecdsa_sign(struct sshkey *key, + *sigp = NULL; + + if (key == NULL || key->ecdsa == NULL || +- sshkey_type_plain(key->type) != KEY_ECDSA) ++ (sshkey_type_plain(key->type) != KEY_ECDSA && ++ sshkey_type_plain(key->type) != KEY_SM2)) + return SSH_ERR_INVALID_ARGUMENT; + + if ((hash_alg = sshkey_ec_nid_to_hash_alg(key->ecdsa_nid)) == -1) +@@ -332,7 +333,8 @@ ssh_ecdsa_verify(const struct sshkey *key, + unsigned char *sigb = NULL, *psig = NULL; + + if (key == NULL || key->ecdsa == NULL || +- sshkey_type_plain(key->type) != KEY_ECDSA || ++ (sshkey_type_plain(key->type) != KEY_ECDSA && ++ sshkey_type_plain(key->type) != KEY_SM2) || + sig == NULL || siglen == 0) + return SSH_ERR_INVALID_ARGUMENT; + +diff --git a/ssh-keygen.c b/ssh-keygen.c +index 0bff209..46f4998 100644 +--- a/ssh-keygen.c ++++ b/ssh-keygen.c +@@ -193,6 +193,7 @@ type_bits_valid(int type, const char *name, u_int32_t *bitsp) + *bitsp = DEFAULT_BITS_DSA; + break; + case KEY_ECDSA: ++ case KEY_SM2: + if (name != NULL && + (nid = sshkey_ecdsa_nid_from_name(name)) > 0) + *bitsp = sshkey_curve_nid_to_bits(nid); +@@ -219,6 +220,10 @@ type_bits_valid(int type, const char *name, u_int32_t *bitsp) + fatal("Invalid RSA key length: maximum is %d bits", + OPENSSL_RSA_MAX_MODULUS_BITS); + break; ++ case KEY_SM2: ++ if (*bitsp != 256) ++ fatal("Invalid SM2 key length: must be 256 bits"); ++ break; + case KEY_ECDSA: + if (sshkey_ecdsa_bits_to_nid(*bitsp) == -1) + #ifdef OPENSSL_HAS_NISTP521 +@@ -275,6 +280,9 @@ ask_filename(struct passwd *pw, const char *prompt) + case KEY_ECDSA: + name = _PATH_SSH_CLIENT_ID_ECDSA; + break; ++ case KEY_SM2: ++ name = _PATH_SSH_CLIENT_ID_SM2; ++ break; + case KEY_ECDSA_SK_CERT: + case KEY_ECDSA_SK: + name = _PATH_SSH_CLIENT_ID_ECDSA_SK; +@@ -386,6 +394,7 @@ do_convert_to_pkcs8(struct sshkey *k) + break; + #ifdef OPENSSL_HAS_ECC + case KEY_ECDSA: ++ case KEY_SM2: + if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa)) + fatal("PEM_write_EC_PUBKEY failed"); + break; +@@ -410,6 +419,7 @@ do_convert_to_pem(struct sshkey *k) + break; + #ifdef OPENSSL_HAS_ECC + case KEY_ECDSA: ++ case KEY_SM2: + if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa)) + fatal("PEM_write_EC_PUBKEY failed"); + break; +@@ -3280,7 +3290,7 @@ usage(void) + fprintf(stderr, + "usage: ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile]\n" + " [-m format] [-N new_passphrase] [-O option]\n" +- " [-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]\n" ++ " [-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa | sm2]\n" + " [-w provider] [-Z cipher]\n" + " ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase]\n" + " [-P old_passphrase] [-Z cipher]\n" +diff --git a/ssh-keyscan.c b/ssh-keyscan.c +index 245c73d..b402a21 100644 +--- a/ssh-keyscan.c ++++ b/ssh-keyscan.c +@@ -68,9 +68,10 @@ int ssh_port = SSH_DEFAULT_PORT; + #define KT_XMSS (1<<4) + #define KT_ECDSA_SK (1<<5) + #define KT_ED25519_SK (1<<6) ++#define KT_SM2 (1<<7) + + #define KT_MIN KT_DSA +-#define KT_MAX KT_ED25519_SK ++#define KT_MAX KT_SM2 + + int get_cert = 0; + int get_keytypes = KT_RSA|KT_ECDSA|KT_ED25519|KT_ECDSA_SK|KT_ED25519_SK; +@@ -267,6 +268,11 @@ keygrab_ssh2(con *c) + "ecdsa-sha2-nistp384," + "ecdsa-sha2-nistp521"; + break; ++ case KT_SM2: ++ myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ? ++ "sm2-cert" : ++ "sm2"; ++ break; + case KT_ECDSA_SK: + myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ? + "sk-ecdsa-sha2-nistp256-cert-v01@openssh.com" : +@@ -296,6 +302,7 @@ keygrab_ssh2(con *c) + c->c_ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; + # ifdef OPENSSL_HAS_ECC + c->c_ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; ++ c->c_ssh->kex->kex[KEX_SM2_SM3] = kex_gen_client; + # endif + #endif + c->c_ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; +@@ -789,6 +796,9 @@ main(int argc, char **argv) + case KEY_ECDSA: + get_keytypes |= KT_ECDSA; + break; ++ case KEY_SM2: ++ get_keytypes |= KT_SM2; ++ break; + case KEY_RSA: + get_keytypes |= KT_RSA; + break; +diff --git a/ssh-sm2.c b/ssh-sm2.c +new file mode 100644 +index 0000000..75e9731 +--- /dev/null ++++ b/ssh-sm2.c +@@ -0,0 +1,381 @@ ++#include "includes.h" ++#include <sys/types.h> ++#include <openssl/bn.h> ++#include <openssl/ecdsa.h> ++#include <openssl/evp.h> ++ ++#include <string.h> ++#include "sshbuf.h" ++#include "ssherr.h" ++#include "digest.h" ++#include "sshkey.h" ++ ++#include "openbsd-compat/openssl-compat.h" ++ ++/* Reuse some ECDSA internals */ ++extern struct sshkey_impl_funcs sshkey_ecdsa_funcs; ++ ++const unsigned char *sm2_id = (const unsigned char *)"1234567812345678"; ++ ++static void ++ssh_sm2_cleanup(struct sshkey *k) ++{ ++ EC_KEY_free(k->ecdsa); ++ k->ecdsa = NULL; ++} ++ ++static int ++ssh_sm2_equal(const struct sshkey *a, const struct sshkey *b) ++{ ++ if (!sshkey_ecdsa_funcs.equal(a, b)) ++ return 0; ++ return 1; ++} ++ ++static int ++ssh_sm2_serialize_public(const struct sshkey *key, struct sshbuf *b, ++ enum sshkey_serialize_rep opts) ++{ ++ int r; ++ ++ if ((r = sshkey_ecdsa_funcs.serialize_public(key, b, opts)) != 0) ++ return r; ++ ++ return 0; ++} ++ ++static int ++ssh_sm2_deserialize_public(const char *ktype, struct sshbuf *b, ++ struct sshkey *key) ++{ ++ int r; ++ ++ if ((r = sshkey_ecdsa_funcs.deserialize_public(ktype, b, key)) != 0) ++ return r; ++ return 0; ++} ++ ++static int ++ssh_sm2_serialize_private(const struct sshkey *key, struct sshbuf *b, ++ enum sshkey_serialize_rep opts) ++{ ++ int r; ++ ++ if ((r = sshkey_ecdsa_funcs.serialize_private(key, b, opts)) != 0) ++ return r; ++ ++ return 0; ++} ++ ++static int ++ssh_sm2_deserialize_private(const char *ktype, struct sshbuf *b, ++ struct sshkey *key) ++{ ++ int r; ++ ++ if ((r = sshkey_ecdsa_funcs.deserialize_private(ktype, b, key)) != 0) ++ return r; ++ ++ return 0; ++} ++ ++static int ++ssh_sm2_generate(struct sshkey *k, int bits) ++{ ++ EC_KEY *private; ++ ++ k->ecdsa_nid = NID_sm2; ++ if ((private = EC_KEY_new_by_curve_name(k->ecdsa_nid)) == NULL) ++ return SSH_ERR_ALLOC_FAIL; ++ if (EC_KEY_generate_key(private) != 1) { ++ EC_KEY_free(private); ++ return SSH_ERR_LIBCRYPTO_ERROR; ++ } ++ EC_KEY_set_asn1_flag(private, OPENSSL_EC_NAMED_CURVE); ++ k->ecdsa = private; ++ return 0; ++} ++ ++static int ++ssh_sm2_copy_public(const struct sshkey *from, struct sshkey *to) ++{ ++ int r; ++ ++ if ((r = sshkey_ecdsa_funcs.copy_public(from, to)) != 0) ++ return r; ++ return 0; ++} ++ ++static int ++sm2_get_sig(EVP_PKEY *pkey, const u_char *data, ++ size_t datalen, u_char *sig, size_t *slen) ++{ ++ EVP_PKEY_CTX *pctx = NULL; ++ EVP_MD_CTX *mctx = NULL; ++ int ret = SSH_ERR_INTERNAL_ERROR; ++ ++ if ((pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) { ++ ret = SSH_ERR_ALLOC_FAIL; ++ goto out; ++ } ++ if ((mctx = EVP_MD_CTX_new()) == NULL) { ++ ret = SSH_ERR_ALLOC_FAIL; ++ goto out; ++ } ++ if (EVP_PKEY_CTX_set1_id(pctx, sm2_id, 16) != 1) { ++ ret = SSH_ERR_INTERNAL_ERROR; ++ goto out; ++ } ++ ++ EVP_MD_CTX_set_pkey_ctx(mctx, pctx); ++ ++ if ((EVP_DigestSignInit(mctx, NULL, EVP_sm3(), NULL, pkey)) != 1) { ++ ret = SSH_ERR_INTERNAL_ERROR; ++ goto out; ++ } ++ ++ if ((EVP_DigestSignUpdate(mctx, data, datalen)) != 1) { ++ ret = SSH_ERR_INTERNAL_ERROR; ++ goto out; ++ } ++ ++ if ((EVP_DigestSignFinal(mctx, sig, slen)) != 1) { ++ ret = SSH_ERR_INTERNAL_ERROR; ++ goto out; ++ } ++ ret = 0; ++ ++out: ++ EVP_PKEY_CTX_free(pctx); ++ EVP_MD_CTX_free(mctx); ++ return ret; ++} ++ ++static int ++ssh_sm2_sign(struct sshkey *key, ++ u_char **sigp, size_t *lenp, ++ const u_char *data, size_t datalen, ++ const char *alg, const char *sk_provider, const char *sk_pin, u_int compat) ++{ ++ u_char *sig = NULL; ++ size_t slen = 0; ++ int pkey_len = 0; ++ int r = 0; ++ int len = 0; ++ EVP_PKEY *key_sm2 = NULL; ++ struct sshbuf *b = NULL; ++ int ret = SSH_ERR_INTERNAL_ERROR; ++ ++ if (lenp != NULL) ++ *lenp = 0; ++ if (sigp != NULL) ++ *sigp = NULL; ++ ++ if (key == NULL || key->ecdsa == NULL || ++ sshkey_type_plain(key->type) != KEY_SM2) ++ return SSH_ERR_INVALID_ARGUMENT; ++ ++ if ((key_sm2 = EVP_PKEY_new()) == NULL) { ++ return SSH_ERR_ALLOC_FAIL; ++ } ++ ++ if ((EVP_PKEY_set1_EC_KEY(key_sm2, key->ecdsa)) != 1) { ++ ret = SSH_ERR_INTERNAL_ERROR; ++ goto out; ++ } ++ ++ if ((pkey_len = EVP_PKEY_size(key_sm2)) == 0) { ++ ret = SSH_ERR_INVALID_ARGUMENT; ++ goto out; ++ } ++ ++ slen = pkey_len; ++ ++ if ((sig = OPENSSL_malloc(pkey_len)) == NULL) { ++ ret = SSH_ERR_ALLOC_FAIL; ++ goto out; ++ } ++ ++ if (ret = sm2_get_sig(key_sm2, data, datalen, sig, &slen)) { ++ goto out; ++ } ++ ++ if ((b = sshbuf_new()) == NULL) { ++ ret = SSH_ERR_ALLOC_FAIL; ++ goto out; ++ } ++ ++ if ((r = sshbuf_put_cstring(b, "sm2")) != 0 || ++ (r = sshbuf_put_string(b, sig, slen)) != 0) ++ goto out; ++ len = sshbuf_len(b); ++ if (sigp != NULL) { ++ if ((*sigp = malloc(len)) == NULL) { ++ ret = SSH_ERR_ALLOC_FAIL; ++ goto out; ++ } ++ memcpy(*sigp, sshbuf_ptr(b), len); ++ } ++ if (lenp != NULL) ++ *lenp = len; ++ ret = 0; ++ ++out: ++ EVP_PKEY_free(key_sm2); ++ if (sig != NULL) { ++ explicit_bzero(sig, slen); ++ OPENSSL_free(sig); ++ } ++ sshbuf_free(b); ++ return ret; ++} ++ ++static int ++sm2_verify_sig(EVP_PKEY *pkey, const u_char *data, ++ size_t datalen, const u_char *sig, size_t slen) ++{ ++ EVP_PKEY_CTX *pctx = NULL; ++ EVP_MD_CTX *mctx = NULL; ++ int ret = SSH_ERR_INTERNAL_ERROR; ++ ++ if ((pctx = EVP_PKEY_CTX_new(pkey, NULL)) == NULL) { ++ ret = SSH_ERR_ALLOC_FAIL; ++ goto out; ++ } ++ ++ if ((mctx = EVP_MD_CTX_new()) == NULL) { ++ ret = SSH_ERR_ALLOC_FAIL; ++ goto out; ++ } ++ ++ if (EVP_PKEY_CTX_set1_id(pctx, sm2_id, 16) != 1) { ++ ret = SSH_ERR_INTERNAL_ERROR; ++ goto out; ++ } ++ EVP_MD_CTX_set_pkey_ctx(mctx, pctx); ++ ++ if ((EVP_DigestVerifyInit(mctx, NULL, EVP_sm3(), NULL, pkey)) != 1) { ++ ret = SSH_ERR_INTERNAL_ERROR; ++ goto out; ++ } ++ ++ if ((EVP_DigestVerifyUpdate(mctx, data, datalen)) != 1) { ++ ret = SSH_ERR_INTERNAL_ERROR; ++ goto out; ++ } ++ ++ if ((EVP_DigestVerifyFinal(mctx, sig, slen)) != 1) { ++ ret = SSH_ERR_INTERNAL_ERROR; ++ goto out; ++ } ++ ++ ret = 0; ++out: ++ EVP_PKEY_CTX_free(pctx); ++ EVP_MD_CTX_free(mctx); ++ return ret; ++} ++ ++static int ++ssh_sm2_verify(const struct sshkey *key, ++ const u_char *signature, size_t signaturelen, ++ const u_char *data, size_t datalen, const char *alg, u_int compat, ++ struct sshkey_sig_details **detailsp) ++{ ++ const u_char *sig = NULL; ++ char *ktype = NULL; ++ size_t slen = 0; ++ int pkey_len = 0; ++ int r = 0; ++ int len = 0; ++ EVP_PKEY *key_sm2 = NULL; ++ struct sshbuf *b = NULL; ++ int ret = SSH_ERR_INTERNAL_ERROR; ++ ++ if (key == NULL || ++ sshkey_type_plain(key->type) != KEY_SM2 || ++ signature == NULL || signaturelen == 0) ++ return SSH_ERR_INVALID_ARGUMENT; ++ ++ if ((b = sshbuf_from(signature, signaturelen)) == NULL) ++ return SSH_ERR_ALLOC_FAIL; ++ ++ if ((r = sshbuf_get_cstring(b, &ktype, NULL)) != 0 || ++ (r = sshbuf_get_string_direct(b, &sig, &slen)) != 0) ++ goto out; ++ ++ if (strcmp("sm2", ktype) != 0) { ++ ret = SSH_ERR_KEY_TYPE_MISMATCH; ++ goto out; ++ } ++ ++ if (sshbuf_len(b) != 0) { ++ ret = SSH_ERR_UNEXPECTED_TRAILING_DATA; ++ goto out; ++ } ++ ++ if ((key_sm2 = EVP_PKEY_new()) == NULL) { ++ ret = SSH_ERR_ALLOC_FAIL; ++ goto out; ++ } ++ ++ if ((EVP_PKEY_set1_EC_KEY(key_sm2, key->ecdsa)) != 1) { ++ ret = SSH_ERR_INTERNAL_ERROR; ++ goto out; ++ } ++ ++ if ((pkey_len = EVP_PKEY_size(key_sm2)) == 0) { ++ ret = SSH_ERR_INVALID_ARGUMENT; ++ goto out; ++ } ++ ++ if (ret = sm2_verify_sig(key_sm2, data, datalen, sig, slen)) { ++ goto out; ++ } ++ ++ ret = 0; ++out: ++ EVP_PKEY_free(key_sm2); ++ sshbuf_free(b); ++ free(ktype); ++ return ret; ++} ++ ++static const struct sshkey_impl_funcs sshkey_sm2_funcs = { ++ /* .size = */ NULL, ++ /* .alloc = */ NULL, ++ /* .cleanup = */ ssh_sm2_cleanup, ++ /* .equal = */ ssh_sm2_equal, ++ /* .ssh_serialize_public = */ ssh_sm2_serialize_public, ++ /* .ssh_deserialize_public = */ ssh_sm2_deserialize_public, ++ /* .ssh_serialize_private = */ ssh_sm2_serialize_private, ++ /* .ssh_deserialize_private = */ssh_sm2_deserialize_private, ++ /* .generate = */ ssh_sm2_generate, ++ /* .copy_public = */ ssh_sm2_copy_public, ++ /* .sign = */ ssh_sm2_sign, ++ /* .verify = */ ssh_sm2_verify, ++}; ++ ++const struct sshkey_impl sshkey_sm2_impl = { ++ /* .name = */ "sm2", ++ /* .shortname = */ "SM2", ++ /* .sigalg = */ NULL, ++ /* .type = */ KEY_SM2, ++ /* .nid = */ NID_sm2, ++ /* .cert = */ 0, ++ /* .sigonly = */ 0, ++ /* .keybits = */ 256, ++ /* .funcs = */ &sshkey_sm2_funcs, ++}; ++ ++const struct sshkey_impl sshkey_sm2_cert_impl = { ++ /* .name = */ "sm2-cert", ++ /* .shortname = */ "SM2-CERT", ++ /* .sigalg = */ NULL, ++ /* .type = */ KEY_SM2_CERT, ++ /* .nid = */ NID_sm2, ++ /* .cert = */ 1, ++ /* .sigonly = */ 0, ++ /* .keybits = */ 256, ++ /* .funcs = */ &sshkey_sm2_funcs, ++}; +diff --git a/ssh_api.c b/ssh_api.c +index d3c6617..adc2598 100644 +--- a/ssh_api.c ++++ b/ssh_api.c +@@ -115,6 +115,7 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params) + ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; + # ifdef OPENSSL_HAS_ECC + ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_server; ++ ssh->kex->kex[KEX_SM2_SM3] = kex_gen_server; + # endif + #endif /* WITH_OPENSSL */ + ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_server; +@@ -133,6 +134,7 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params) + ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; + # ifdef OPENSSL_HAS_ECC + ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; ++ ssh->kex->kex[KEX_SM2_SM3] = kex_gen_client; + # endif + #endif /* WITH_OPENSSL */ + ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; +diff --git a/sshconnect2.c b/sshconnect2.c +index 3acfdb6..3fbff57 100644 +--- a/sshconnect2.c ++++ b/sshconnect2.c +@@ -326,6 +326,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port, + ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client; + # ifdef OPENSSL_HAS_ECC + ssh->kex->kex[KEX_ECDH_SHA2] = kex_gen_client; ++ ssh->kex->kex[KEX_SM2_SM3] = kex_gen_client; + # endif + # ifdef GSSAPI + if (options.gss_keyex) { +diff --git a/sshd.c b/sshd.c +index f366457..52c66ed 100644 +--- a/sshd.c ++++ b/sshd.c +@@ -695,6 +695,7 @@ list_hostkey_types(void) + /* FALLTHROUGH */ + case KEY_DSA: + case KEY_ECDSA: ++ case KEY_SM2: + case KEY_ED25519: + case KEY_ECDSA_SK: + case KEY_ED25519_SK: +@@ -716,6 +717,7 @@ list_hostkey_types(void) + /* FALLTHROUGH */ + case KEY_DSA_CERT: + case KEY_ECDSA_CERT: ++ case KEY_SM2_CERT: + case KEY_ED25519_CERT: + case KEY_ECDSA_SK_CERT: + case KEY_ED25519_SK_CERT: +@@ -742,6 +744,7 @@ get_hostkey_by_type(int type, int nid, int need_private, struct ssh *ssh) + case KEY_RSA_CERT: + case KEY_DSA_CERT: + case KEY_ECDSA_CERT: ++ case KEY_SM2_CERT: + case KEY_ED25519_CERT: + case KEY_ECDSA_SK_CERT: + case KEY_ED25519_SK_CERT: +@@ -758,8 +761,10 @@ get_hostkey_by_type(int type, int nid, int need_private, struct ssh *ssh) + continue; + switch (type) { + case KEY_ECDSA: ++ case KEY_SM2: + case KEY_ECDSA_SK: + case KEY_ECDSA_CERT: ++ case KEY_SM2_CERT: + case KEY_ECDSA_SK_CERT: + if (key->ecdsa_nid != nid) + continue; +@@ -2012,6 +2017,7 @@ main(int ac, char **av) + case KEY_RSA: + case KEY_DSA: + case KEY_ECDSA: ++ case KEY_SM2: + case KEY_ED25519: + case KEY_ECDSA_SK: + case KEY_ED25519_SK: +@@ -2573,6 +2579,7 @@ do_ssh2_kex(struct ssh *ssh) + kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; + # ifdef OPENSSL_HAS_ECC + kex->kex[KEX_ECDH_SHA2] = kex_gen_server; ++ kex->kex[KEX_SM2_SM3] = kex_gen_server; + # endif + # ifdef GSSAPI + if (options.gss_keyex) { +diff --git a/sshkey.c b/sshkey.c +index 1735159..1aee244 100644 +--- a/sshkey.c ++++ b/sshkey.c +@@ -130,6 +130,8 @@ extern const struct sshkey_impl sshkey_dsa_cert_impl; + extern const struct sshkey_impl sshkey_xmss_impl; + extern const struct sshkey_impl sshkey_xmss_cert_impl; + #endif ++extern const struct sshkey_impl sshkey_sm2_impl; ++extern const struct sshkey_impl sshkey_sm2_cert_impl; + + static int ssh_gss_equal(const struct sshkey *, const struct sshkey *) + { +@@ -237,6 +239,8 @@ const struct sshkey_impl * const keyimpls[] = { + &sshkey_xmss_cert_impl, + #endif + &sshkey_gss_kex_impl, ++ &sshkey_sm2_impl, ++ &sshkey_sm2_cert_impl, + NULL + }; + +@@ -340,6 +344,8 @@ key_type_is_ecdsa_variant(int type) + case KEY_ECDSA_CERT: + case KEY_ECDSA_SK: + case KEY_ECDSA_SK_CERT: ++ case KEY_SM2: ++ case KEY_SM2_CERT: + return 1; + } + return 0; +@@ -548,6 +554,8 @@ sshkey_type_plain(int type) + return KEY_ED25519_SK; + case KEY_XMSS_CERT: + return KEY_XMSS; ++ case KEY_SM2_CERT: ++ return KEY_SM2; + default: + return type; + } +@@ -564,6 +572,8 @@ sshkey_type_certified(int type) + return KEY_DSA_CERT; + case KEY_ECDSA: + return KEY_ECDSA_CERT; ++ case KEY_SM2: ++ return KEY_SM2_CERT; + case KEY_ECDSA_SK: + return KEY_ECDSA_SK_CERT; + case KEY_ED25519: +@@ -670,6 +680,8 @@ sshkey_curve_name_to_nid(const char *name) + else if (strcmp(name, "nistp521") == 0) + return NID_secp521r1; + # endif /* OPENSSL_HAS_NISTP521 */ ++ else if (strcmp(name, "sm2") == 0) ++ return NID_sm2; + else + return -1; + } +@@ -686,6 +698,8 @@ sshkey_curve_nid_to_bits(int nid) + case NID_secp521r1: + return 521; + # endif /* OPENSSL_HAS_NISTP521 */ ++ case NID_sm2: ++ return 256; + default: + return 0; + } +@@ -720,6 +734,8 @@ sshkey_curve_nid_to_name(int nid) + case NID_secp521r1: + return "nistp521"; + # endif /* OPENSSL_HAS_NISTP521 */ ++ case NID_sm2: ++ return "sm2"; + default: + return NULL; + } +@@ -3424,6 +3440,7 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf, + break; + #ifdef OPENSSL_HAS_ECC + case KEY_ECDSA: ++ case KEY_SM2: + if (format == SSHKEY_PRIVATE_PEM) { + success = PEM_write_bio_ECPrivateKey(bio, key->ecdsa, + cipher, passphrase, len, NULL, NULL); +@@ -3485,6 +3502,7 @@ sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob, + #ifdef WITH_OPENSSL + case KEY_DSA: + case KEY_ECDSA: ++ case KEY_SM2: + case KEY_RSA: + break; /* see below */ + #endif /* WITH_OPENSSL */ +@@ -3665,6 +3683,9 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type, + prv->ecdsa = EVP_PKEY_get1_EC_KEY(pk); + prv->type = KEY_ECDSA; + prv->ecdsa_nid = sshkey_ecdsa_key_to_nid(prv->ecdsa); ++ if (prv->ecdsa_nid == NID_sm2) { ++ prv->type = KEY_SM2; ++ } + if (prv->ecdsa_nid == -1 || + sshkey_curve_nid_to_name(prv->ecdsa_nid) == NULL || + sshkey_ec_validate_public(EC_KEY_get0_group(prv->ecdsa), +diff --git a/sshkey.h b/sshkey.h +index 8d662d1..c8d2662 100644 +--- a/sshkey.h ++++ b/sshkey.h +@@ -68,6 +68,8 @@ enum sshkey_types { + KEY_DSA_CERT, + KEY_ECDSA_CERT, + KEY_ED25519_CERT, ++ KEY_SM2, ++ KEY_SM2_CERT, + KEY_XMSS, + KEY_XMSS_CERT, + KEY_ECDSA_SK, +-- +2.23.0 + |