add mbedtls crypto support

Summary:
This patch adds support for mbedTLS as a crypto backend for libssh.
mbedTLS is an SSL/TLS library that has been designed to mainly be used
in embedded systems.  It is loosely coupled and has a low memory
footprint.  mbedTLS also provides a cryptography library (libmbedcrypto)
that can be used without the TLS modules.
The patch is unfortunately quite big, since several new files had to
be added.
DSA is disabled at compile time, since mbedTLS doesn't support DSA
Patch review and feedback would be appreciated, and if any issues or
suggestions appear, I'm willing to work on them.

Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>

Test Plan:
* The patch has been tested with a Debug and MinSizeRel build, with
libssh unit tests, client tests and the pkd tests.
* All the tests have been run with valgrind's memcheck, drd and helgrind
tools.
* The examples/samplessh client works when built with the patch.

Reviewers: asn, aris

Subscribers: simonsj

Differential Revision: https://bugs.libssh.org/D1

src/CMakeLists.txt

@@ -39,6 +39,17 @@ if (OPENSSL_CRYPTO_LIBRARY)
   )
 endif (OPENSSL_CRYPTO_LIBRARY)
 
+if (MBEDTLS_CRYPTO_LIBRARY)
+    set(LIBSSH_PRIVATE_INCLUDE_DIRS
+      ${LIBSSH_PRIVATE_INCLUDE_DIRS}
+      ${MBEDTLS_INCLUDE_DIR}
+    )
+  set(LIBSSH_LINK_LIBRARIES
+    ${LIBSSH_LINK_LIBRARIES}
+    ${MBEDTLS_CRYPTO_LIBRARY}
+  )
+endif (MBEDTLS_CRYPTO_LIBRARY)
+
 if (GCRYPT_LIBRARY)
   set(LIBSSH_PRIVATE_INCLUDE_DIRS
     ${LIBSSH_PRIVATE_INCLUDE_DIRS}
@@ -160,6 +171,14 @@ if (WITH_GCRYPT)
         pki_gcrypt.c
         ecdh_gcrypt.c
        )
+elseif (WITH_MBEDTLS)
+    set(libssh_SRCS
+        ${libssh_SRCS}
+        libmbedcrypto.c
+        mbedcrypto_missing.c
+        pki_mbedcrypto.c
+        ecdh_mbedcrypto.c
+       )
 else (WITH_GCRYPT)
     set(libssh_SRCS
         ${libssh_SRCS}

src/bignum.c

@@ -60,6 +60,8 @@ ssh_string ssh_make_bignum_string(bignum num) {
   bignum_bn2bin(num, len, ptr->data + pad);
 #elif HAVE_LIBCRYPTO
   bignum_bn2bin(num, ptr->data + pad);
+#elif HAVE_LIBMBEDCRYPTO
+  bignum_bn2bin(num, ptr->data + pad);
 #endif
 
   return ptr;
@@ -78,6 +80,9 @@ bignum ssh_make_string_bn(ssh_string string){
   bignum_bin2bn(string->data, len, &bn);
 #elif defined HAVE_LIBCRYPTO
   bn = bignum_bin2bn(string->data, len, NULL);
+#elif defined HAVE_LIBMBEDCRYPTO
+  bn = bignum_new();
+  bignum_bin2bn(string->data, len, bn);
 #endif
 
   return bn;
@@ -91,6 +96,8 @@ void ssh_make_string_bn_inplace(ssh_string string, bignum bnout) {
   (void) bnout;
 #elif defined HAVE_LIBCRYPTO
   bignum_bin2bn(string->data, len, bnout);
+#elif defined HAVE_LIBMBEDCRYPTO
+  bignum_bin2bn(string->data, len, bnout);
 #endif
 }
 
@@ -102,6 +109,9 @@ void ssh_print_bignum(const char *which, const bignum num) {
 #elif defined HAVE_LIBCRYPTO
   char *hex = NULL;
   hex = bignum_bn2hex(num);
+#elif defined HAVE_LIBMBEDCRYPTO
+  char *hex = NULL;
+  hex = bignum_bn2hex(num);
 #endif
   fprintf(stderr, "%s value: ", which);
   fprintf(stderr, "%s\n", (hex == NULL) ? "(null)" : (char *) hex);
@@ -109,5 +119,7 @@ void ssh_print_bignum(const char *which, const bignum num) {
   SAFE_FREE(hex);
 #elif defined HAVE_LIBCRYPTO
   OPENSSL_free(hex);
+#elif defined HAVE_LIBMBEDCRYPTO
+  SAFE_FREE(hex);
 #endif
 }

src/bind.c

@@ -178,6 +178,7 @@ static int ssh_bind_import_keys(ssh_bind sshbind) {
   }
 #endif
 
+#ifdef HAVE_DSA
   if (sshbind->dsa == NULL && sshbind->dsakey != NULL) {
       rc = ssh_pki_import_privkey_file(sshbind->dsakey,
                                        NULL,
@@ -199,6 +200,7 @@ static int ssh_bind_import_keys(ssh_bind sshbind) {
           return SSH_ERROR;
       }
   }
+#endif
 
   if (sshbind->rsa == NULL && sshbind->rsakey != NULL) {
       rc = ssh_pki_import_privkey_file(sshbind->rsakey,
@@ -450,6 +452,7 @@ int ssh_bind_accept_fd(ssh_bind sshbind, ssh_session session, socket_t fd){
         }
     }
 #endif
+#ifdef HAVE_DSA
     if (sshbind->dsa) {
         session->srv.dsa_key = ssh_key_dup(sshbind->dsa);
         if (session->srv.dsa_key == NULL) {
@@ -457,6 +460,7 @@ int ssh_bind_accept_fd(ssh_bind sshbind, ssh_session session, socket_t fd){
           return SSH_ERROR;
         }
     }
+#endif
     if (sshbind->rsa) {
         session->srv.rsa_key = ssh_key_dup(sshbind->rsa);
         if (session->srv.rsa_key == NULL) {

src/curve25519.c

@@ -75,6 +75,12 @@ static int ssh_curve25519_build_k(ssh_session session) {
 #ifdef HAVE_LIBCRYPTO
   session->next_crypto->k = bignum_new();
 
+  if (session->next_crypto->k == NULL) {
+    return SSH_ERROR;
+  }
+#elif defined HAVE_LIBMBEDCRYPTO
+  session->next_crypto->k = bignum_new();
+
   if (session->next_crypto->k == NULL) {
     return SSH_ERROR;
   }
@@ -91,6 +97,8 @@ static int ssh_curve25519_build_k(ssh_session session) {
   bignum_bin2bn(k, CURVE25519_PUBKEY_SIZE, &session->next_crypto->k);
 #elif defined HAVE_LIBCRYPTO
   bignum_bin2bn(k, CURVE25519_PUBKEY_SIZE, session->next_crypto->k);
+#elif defined HAVE_LIBMBEDCRYPTO
+  bignum_bin2bn(k, CURVE25519_PUBKEY_SIZE, session->next_crypto->k);
 #endif
 
 #ifdef DEBUG_CRYPTO

src/dh.c

@@ -143,6 +143,8 @@ int ssh_get_random(void *where, int len, int strong){
     return RAND_pseudo_bytes(where,len);
   }
 # endif /* OPENSSL_VERSION_NUMBER */
+#elif defined HAVE_LIBMBEDCRYPTO
+  return ssh_mbedtls_random(where, len, strong);
 #endif
 
   /* never reached */
@@ -162,6 +164,8 @@ int ssh_crypto_init(void) {
       gcry_control(GCRYCTL_INIT_SECMEM, 4096);
       gcry_control(GCRYCTL_INITIALIZATION_FINISHED,0);
     }
+#elif HAVE_LIBMBEDCRYPTO
+    ssh_mbedtls_init();
 #endif
 
     g = bignum_new();
@@ -206,7 +210,12 @@ int ssh_crypto_init(void) {
     bignum_bin2bn(p_group14_value, P_GROUP14_LEN, p_group14);
 
     OpenSSL_add_all_algorithms();
+#elif defined HAVE_LIBMBEDCRYPTO
+    p_group1 = bignum_new();
+    bignum_bin2bn(p_group1_value, P_GROUP1_LEN, p_group1);
 
+    p_group14 = bignum_new();
+    bignum_bin2bn(p_group14_value, P_GROUP14_LEN, p_group14);
 #endif
 
     ssh_crypto_initialized = 1;
@@ -228,6 +237,8 @@ void ssh_crypto_finalize(void) {
 #elif defined HAVE_LIBCRYPTO
     EVP_cleanup();
     CRYPTO_cleanup_all_ex_data();
+#elif defined HAVE_LIBMBEDTLS
+    ssh_mbedtls_cleanup();
 #endif
     ssh_crypto_initialized=0;
   }
@@ -249,6 +260,8 @@ int ssh_dh_generate_x(ssh_session session) {
   bignum_rand(session->next_crypto->x, keysize);
 #elif defined HAVE_LIBCRYPTO
   bignum_rand(session->next_crypto->x, keysize, -1, 0);
+#elif defined HAVE_LIBMBEDCRYPTO
+  bignum_rand(session->next_crypto->x, keysize, -1, 0);
 #endif
 
   /* not harder than this */
@@ -276,6 +289,8 @@ int ssh_dh_generate_y(ssh_session session) {
   bignum_rand(session->next_crypto->y, keysize);
 #elif defined HAVE_LIBCRYPTO
   bignum_rand(session->next_crypto->y, keysize, -1, 0);
+#elif defined HAVE_LIBMBEDCRYPTO
+  bignum_rand(session->next_crypto->y, keysize, -1, 0);
 #endif
 
   /* not harder than this */
@@ -309,6 +324,9 @@ int ssh_dh_generate_e(ssh_session session) {
 #elif defined HAVE_LIBCRYPTO
   bignum_mod_exp(session->next_crypto->e, g, session->next_crypto->x,
       select_p(session->next_crypto->kex_type), ctx);
+#elif defined HAVE_LIBMBEDCRYPTO
+  bignum_mod_exp(session->next_crypto->e, g, session->next_crypto->x,
+      select_p(session->next_crypto->kex_type), NULL);
 #endif
 
 #ifdef DEBUG_CRYPTO
@@ -344,6 +362,9 @@ int ssh_dh_generate_f(ssh_session session) {
 #elif defined HAVE_LIBCRYPTO
   bignum_mod_exp(session->next_crypto->f, g, session->next_crypto->y,
       select_p(session->next_crypto->kex_type), ctx);
+#elif defined HAVE_LIBMBEDCRYPTO
+  bignum_mod_exp(session->next_crypto->f, g, session->next_crypto->y,
+      select_p(session->next_crypto->kex_type), NULL);
 #endif
 
 #ifdef DEBUG_CRYPTO
@@ -430,6 +451,14 @@ int ssh_dh_build_k(ssh_session session) {
     bignum_mod_exp(session->next_crypto->k, session->next_crypto->e,
         session->next_crypto->y, select_p(session->next_crypto->kex_type), ctx);
   }
+#elif defined HAVE_LIBMBEDCRYPTO
+  if (session->client) {
+    bignum_mod_exp(session->next_crypto->k, session->next_crypto->f,
+        session->next_crypto->x, select_p(session->next_crypto->kex_type), NULL);
+  } else {
+    bignum_mod_exp(session->next_crypto->k, session->next_crypto->e,
+        session->next_crypto->y, select_p(session->next_crypto->kex_type), NULL);
+  }
 #endif
 
 #ifdef DEBUG_CRYPTO

src/ecdh_mbedcrypto.c

@@ -0,0 +1,295 @@
+/*
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2017 Sartura d.o.o.
+ *
+ * Author: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>
+ *
+ * The SSH Library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ *
+ * The SSH Library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the SSH Library; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include "libssh/session.h"
+#include "libssh/ecdh.h"
+#include "libssh/buffer.h"
+#include "libssh/ssh2.h"
+#include "libssh/dh.h"
+#include "libssh/pki.h"
+#include "libssh/bignum.h"
+#include "libssh/libmbedcrypto.h"
+
+#include <mbedtls/ecdh.h>
+#include <mbedtls/ecp.h>
+
+#ifdef HAVE_ECDH
+
+static mbedtls_ecp_group_id ecdh_kex_type_to_curve(enum ssh_key_exchange_e kex_type) {
+    if (kex_type == SSH_KEX_ECDH_SHA2_NISTP256) {
+        return MBEDTLS_ECP_DP_SECP256R1;
+    } else if (kex_type == SSH_KEX_ECDH_SHA2_NISTP384) {
+        return MBEDTLS_ECP_DP_SECP384R1;
+    } else if (kex_type == SSH_KEX_ECDH_SHA2_NISTP521) {
+        return MBEDTLS_ECP_DP_SECP521R1;
+    }
+
+    return MBEDTLS_ECP_DP_NONE;
+}
+int ssh_client_ecdh_init(ssh_session session)
+{
+    ssh_string client_pubkey = NULL;
+    mbedtls_ecp_group grp;
+    int rc;
+    mbedtls_ecp_group_id curve;
+
+    curve = ecdh_kex_type_to_curve(session->next_crypto->kex_type);
+    if (curve == MBEDTLS_ECP_DP_NONE) {
+        return SSH_ERROR;
+    }
+
+    rc = ssh_buffer_add_u8(session->out_buffer, SSH2_MSG_KEX_ECDH_INIT);
+    if (rc < 0) {
+        return SSH_ERROR;
+    }
+
+    session->next_crypto->ecdh_privkey = malloc(sizeof(mbedtls_ecp_keypair));
+    if (session->next_crypto->ecdh_privkey == NULL) {
+        return SSH_ERROR;
+    }
+
+    mbedtls_ecp_keypair_init(session->next_crypto->ecdh_privkey);
+    mbedtls_ecp_group_init(&grp);
+
+    rc = mbedtls_ecp_group_load(&grp, curve);
+    if (rc != 0) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    rc = mbedtls_ecp_gen_keypair(&grp, &session->next_crypto->ecdh_privkey->d,
+            &session->next_crypto->ecdh_privkey->Q, mbedtls_ctr_drbg_random,
+            &ssh_mbedtls_ctr_drbg);
+
+    if (rc != 0) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    client_pubkey = make_ecpoint_string(&grp,
+            &session->next_crypto->ecdh_privkey->Q);
+    if (client_pubkey == NULL) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    rc = ssh_buffer_add_ssh_string(session->out_buffer, client_pubkey);
+    if (rc < 0) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    session->next_crypto->ecdh_client_pubkey = client_pubkey;
+    client_pubkey = NULL;
+
+    rc = ssh_packet_send(session);
+
+out:
+    mbedtls_ecp_group_free(&grp);
+    ssh_string_free(client_pubkey);
+
+    return rc;
+}
+
+int ecdh_build_k(ssh_session session)
+{
+    mbedtls_ecp_group grp;
+    mbedtls_ecp_point pubkey;
+    int rc;
+    mbedtls_ecp_group_id curve;
+
+    curve = ecdh_kex_type_to_curve(session->next_crypto->kex_type);
+    if (curve == MBEDTLS_ECP_DP_NONE) {
+        return SSH_ERROR;
+    }
+
+    mbedtls_ecp_group_init(&grp);
+    mbedtls_ecp_point_init(&pubkey);
+
+    rc = mbedtls_ecp_group_load(&grp, curve);
+    if (rc != 0) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    if (session->server) {
+        rc = mbedtls_ecp_point_read_binary(&grp, &pubkey,
+                ssh_string_data(session->next_crypto->ecdh_client_pubkey),
+                ssh_string_len(session->next_crypto->ecdh_client_pubkey));
+    } else {
+        rc = mbedtls_ecp_point_read_binary(&grp, &pubkey,
+                ssh_string_data(session->next_crypto->ecdh_server_pubkey),
+                ssh_string_len(session->next_crypto->ecdh_server_pubkey));
+    }
+
+    if (rc != 0) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    session->next_crypto->k = malloc(sizeof(mbedtls_mpi));
+    if (session->next_crypto->k == NULL) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    mbedtls_mpi_init(session->next_crypto->k);
+
+    rc = mbedtls_ecdh_compute_shared(&grp, session->next_crypto->k, &pubkey,
+            &session->next_crypto->ecdh_privkey->d, mbedtls_ctr_drbg_random,
+            &ssh_mbedtls_ctr_drbg);
+    if (rc != 0) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+out:
+    mbedtls_ecp_keypair_free(session->next_crypto->ecdh_privkey);
+    SAFE_FREE(session->next_crypto->ecdh_privkey);
+    mbedtls_ecp_group_free(&grp);
+    mbedtls_ecp_point_free(&pubkey);
+    return rc;
+}
+
+#ifdef WITH_SERVER
+int ssh_server_ecdh_init(ssh_session session, ssh_buffer packet)
+{
+    ssh_string q_c_string = NULL;
+    ssh_string q_s_string = NULL;
+    mbedtls_ecp_group grp;
+    ssh_key privkey = NULL;
+    ssh_string sig_blob = NULL;
+    int rc;
+    mbedtls_ecp_group_id curve;
+
+    curve = ecdh_kex_type_to_curve(session->next_crypto->kex_type);
+    if (curve == MBEDTLS_ECP_DP_NONE) {
+        return SSH_ERROR;
+    }
+
+    q_c_string = ssh_buffer_get_ssh_string(packet);
+    if (q_c_string == NULL) {
+        ssh_set_error(session, SSH_FATAL, "No Q_C ECC point in packet");
+        return SSH_ERROR;
+    }
+
+    session->next_crypto->ecdh_privkey = malloc(sizeof(mbedtls_ecp_keypair));
+    if (session->next_crypto->ecdh_privkey == NULL) {
+        ssh_set_error_oom(session);
+        return SSH_ERROR;
+    }
+
+    session->next_crypto->ecdh_client_pubkey = q_c_string;
+
+    mbedtls_ecp_group_init(&grp);
+    mbedtls_ecp_keypair_init(session->next_crypto->ecdh_privkey);
+
+    rc = mbedtls_ecp_group_load(&grp, curve);
+    if (rc != 0) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    rc = mbedtls_ecp_gen_keypair(&grp, &session->next_crypto->ecdh_privkey->d,
+            &session->next_crypto->ecdh_privkey->Q, mbedtls_ctr_drbg_random,
+            &ssh_mbedtls_ctr_drbg);
+    if (rc != 0) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    q_s_string = make_ecpoint_string(&grp, &session->next_crypto->ecdh_privkey->Q);
+    if (q_s_string == NULL) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    session->next_crypto->ecdh_server_pubkey = q_s_string;
+
+    /* build k and session_id */
+    rc = ecdh_build_k(session);
+    if (rc != SSH_OK) {
+        ssh_set_error(session, SSH_FATAL, "Cannot build k number");
+        goto out;
+    }
+
+    /* privkey is not allocated */
+    rc = ssh_get_key_params(session, &privkey);
+    if (rc == SSH_ERROR) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    rc = ssh_make_sessionid(session);
+    if (rc != SSH_OK) {
+        ssh_set_error(session, SSH_FATAL, "Could not create a session id");
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    sig_blob = ssh_srv_pki_do_sign_sessionid(session, privkey);
+    if (sig_blob == NULL) {
+        ssh_set_error(session, SSH_FATAL, "Could not sign the session id");
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    rc = ssh_buffer_pack(session->out_buffer, "bSSS",
+            SSH2_MSG_KEXDH_REPLY, session->next_crypto->server_pubkey,
+            q_s_string,
+            sig_blob);
+
+    ssh_string_free(sig_blob);
+
+    if (rc != SSH_OK) {
+        ssh_set_error_oom(session);
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    SSH_LOG(SSH_LOG_PROTOCOL, "SSH_MSG_KEXDH_REPLY sent");
+    rc = ssh_packet_send(session);
+    if (rc != SSH_OK) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    rc = ssh_buffer_add_u8(session->out_buffer, SSH2_MSG_NEWKEYS);
+    if (rc < 0) {
+        rc = SSH_ERROR;
+        goto out;
+    }
+
+    session->dh_handshake_state = DH_STATE_NEWKEYS_SENT;
+    rc = ssh_packet_send(session);
+    SSH_LOG(SSH_LOG_PROTOCOL, "SSH_MSG_NEWKEYS sent");
+
+out:
+    mbedtls_ecp_group_free(&grp);
+    return rc;
+}
+
+#endif /* WITH_SERVER */
+#endif

src/kex.c

@@ -43,6 +43,12 @@
 # define DES "3des-cbc"
 # define DES_SUPPORTED "3des-cbc,des-cbc-ssh1"
 
+#elif defined HAVE_LIBMBEDCRYPTO
+# define BLOWFISH "blowfish-cbc,"
+# define AES "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,"
+# define DES "3des-cbc"
+# define DES_SUPPORTED "3des-cbc,des-cbc-ssh1"
+
 #elif defined(HAVE_LIBCRYPTO)
 
 # ifdef HAVE_OPENSSL_BLOWFISH_H
@@ -81,7 +87,11 @@
 #define ECDH "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,"
 #define HOSTKEYS "ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss"
 #else
+#ifdef HAVE_DSA
 #define HOSTKEYS "ssh-ed25519,ssh-rsa,ssh-dss"
+#else
+#define HOSTKEYS "ssh-ed25519,ssh-rsa"
+#endif
 #define ECDH ""
 #endif
 
@@ -560,7 +570,9 @@ static char *ssh_client_select_hostkeys(ssh_session session){
         "ecdsa-sha2-nistp384",
         "ecdsa-sha2-nistp256",
         "ssh-rsa",
+#ifdef HAVE_DSA
         "ssh-dss",
+#endif
         "ssh-rsa1",
         NULL
     };

src/known_hosts.c

@@ -220,7 +220,11 @@ static int check_public_key(ssh_session session, char **tokens) {
 
     for (i = 2; i < 4; i++) { /* e, then n */
       tmpbn = NULL;
+#ifdef HAVE_LIBMBEDCRYPTO
+      bignum_dec2bn(tokens[i], tmpbn);
+#else
       bignum_dec2bn(tokens[i], &tmpbn);
+#endif
       if (tmpbn == NULL) {
         ssh_buffer_free(pubkey_buffer);
         return -1;
@@ -242,6 +246,8 @@ static int check_public_key(ssh_session session, char **tokens) {
       bignum_bn2bin(tmpbn, len, ssh_string_data(tmpstring));
 #elif defined HAVE_LIBCRYPTO
       bignum_bn2bin(tmpbn, ssh_string_data(tmpstring));
+#elif defined HAVE_LIBMBEDCRYPTO
+      bignum_bn2bin(tmpbn, ssh_string_data(tmpstring));
 #endif
       bignum_free(tmpbn);
       if (ssh_buffer_add_ssh_string(pubkey_buffer, tmpstring) < 0) {

src/legacy.c

@@ -362,6 +362,9 @@ void publickey_free(ssh_public_key key) {
       gcry_sexp_release(key->rsa_pub);
 #elif defined HAVE_LIBCRYPTO
       RSA_free(key->rsa_pub);
+#elif defined HAVE_LIBMBEDCRYPTO
+      mbedtls_pk_free(key->rsa_pub);
+      SAFE_FREE(key->rsa_pub);
 #endif
       break;
     default:
@@ -463,6 +466,9 @@ void privatekey_free(ssh_private_key prv) {
 #elif defined HAVE_LIBCRYPTO
   DSA_free(prv->dsa_priv);
   RSA_free(prv->rsa_priv);
+#elif defined HAVE_LIBMBEDCRYPTO
+  mbedtls_pk_free(prv->rsa_priv);
+  SAFE_FREE(prv->rsa_priv);
 #endif
   memset(prv, 0, sizeof(struct ssh_private_key_struct));
   SAFE_FREE(prv);

src/mbedcrypto_missing.c

@@ -0,0 +1,128 @@
+/*
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2017 Sartura d.o.o.
+ *
+ * Author: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>
+ *
+ * The SSH Library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ *
+ * The SSH Library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the SSH Library; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include "libssh/priv.h"
+#include "libssh/libmbedcrypto.h"
+
+#ifdef HAVE_LIBMBEDCRYPTO
+bignum ssh_mbedcry_bn_new(void)
+{
+    bignum bn;
+
+    bn = malloc(sizeof(mbedtls_mpi));
+    if (bn) {
+        mbedtls_mpi_init(bn);
+    }
+
+    return bn;
+}
+
+void ssh_mbedcry_bn_free(bignum bn)
+{
+    mbedtls_mpi_free(bn);
+    SAFE_FREE(bn);
+}
+
+char *ssh_mbedcry_bn2num(bignum num, int radix)
+{
+    char *buf = NULL;
+    size_t olen;
+    int rc;
+
+    rc = mbedtls_mpi_write_string(num, radix, buf, 0, &olen);
+    if (rc != 0) {
+        return NULL;
+    }
+
+    buf = malloc(olen);
+    if (buf == NULL) {
+        return NULL;
+    }
+
+    rc = mbedtls_mpi_write_string(num, radix, buf, olen, &olen);
+    if (rc != 0) {
+        SAFE_FREE(buf);
+        return NULL;
+    }
+
+    return buf;
+}
+
+int ssh_mbedcry_rand(bignum rnd, int bits, int top, int bottom)
+{
+    size_t len;
+    int rc;
+    int i;
+
+    if (bits <= 0) {
+        return 0;
+    }
+
+    len = bits / 8 + 1;
+    rc = mbedtls_mpi_fill_random(rnd, len, mbedtls_ctr_drbg_random,
+            &ssh_mbedtls_ctr_drbg);
+    if (rc != 0) {
+        return 0;
+    }
+
+    for (i = len * 8 - 1; i >= bits; i--) {
+        rc = mbedtls_mpi_set_bit(rnd, i, 0);
+        if (rc != 0) {
+            return 0;
+        }
+    }
+
+    if (top == 0) {
+        rc = mbedtls_mpi_set_bit(rnd, bits - 1, 0);
+    }
+
+    if (top == 1) {
+        if (bits < 2) {
+            return 0;
+        }
+
+        rc = mbedtls_mpi_set_bit(rnd, bits - 2, 0);
+        if (rc != 0) {
+            return 0;
+        }
+    }
+
+    if (bottom) {
+        rc = mbedtls_mpi_set_bit(rnd, 0, 1);
+        if (rc != 0) {
+            return 0;
+        }
+    }
+
+    return 1;
+}
+
+int ssh_mbedcry_is_bit_set(bignum num, size_t pos)
+{
+    int bit;
+    bit = mbedtls_mpi_get_bit(num, pos);
+    return bit;
+}
+#endif

src/misc.c

@@ -82,6 +82,12 @@
 #define CRYPTO_STRING ""
 #endif
 
+#ifdef HAVE_LIBMBEDCRYPTO
+#define MBED_STRING "/mbedtls"
+#else
+#define MBED_STRING ""
+#endif
+
 #ifdef WITH_ZLIB
 #define ZLIB_STRING "/zlib"
 #else
@@ -349,7 +355,7 @@ char *ssh_hostport(const char *host, int port){
  */
 const char *ssh_version(int req_version) {
   if (req_version <= LIBSSH_VERSION_INT) {
-    return SSH_STRINGIFY(LIBSSH_VERSION) GCRYPT_STRING CRYPTO_STRING
+    return SSH_STRINGIFY(LIBSSH_VERSION) GCRYPT_STRING CRYPTO_STRING MBED_STRING
       ZLIB_STRING;
   }
 

src/options.c

@@ -1493,8 +1493,15 @@ int ssh_bind_options_set(ssh_bind sshbind, enum ssh_bind_options_e type,
           key_type = ssh_key_type(key);
           switch (key_type) {
           case SSH_KEYTYPE_DSS:
+#ifdef HAVE_DSA
               bind_key_loc = &sshbind->dsa;
               bind_key_path_loc = &sshbind->dsakey;
+#else
+              ssh_set_error(sshbind,
+                      SSH_FATAL,
+                      "DSS key used and libssh compiled "
+                      "without DSA support");
+#endif
               break;
           case SSH_KEYTYPE_ECDSA:
 #ifdef HAVE_ECC
@@ -1550,7 +1557,14 @@ int ssh_bind_options_set(ssh_bind sshbind, enum ssh_bind_options_e type,
             key_type = ssh_key_type(key);
             switch (key_type) {
                 case SSH_KEYTYPE_DSS:
+#ifdef HAVE_DSA
                     bind_key_loc = &sshbind->dsa;
+#else
+                    ssh_set_error(sshbind,
+                                  SSH_FATAL,
+                                  "DSA key used and libssh compiled "
+                                  "without DSA support");
+#endif
                     break;
                 case SSH_KEYTYPE_ECDSA:
 #ifdef HAVE_ECC

src/pki.c

@@ -138,6 +138,16 @@ void ssh_key_clean (ssh_key key){
 #ifdef HAVE_OPENSSL_ECC
     if(key->ecdsa) EC_KEY_free(key->ecdsa);
 #endif /* HAVE_OPENSSL_ECC */
+#elif defined HAVE_LIBMBEDCRYPTO
+    if (key->rsa != NULL) {
+        mbedtls_pk_free(key->rsa);
+        SAFE_FREE(key->rsa);
+    }
+
+    if (key->ecdsa != NULL) {
+        mbedtls_ecdsa_free(key->ecdsa);
+        SAFE_FREE(key->ecdsa);
+    }
 #endif
     if (key->ed25519_privkey != NULL){
         BURN_BUFFER(key->ed25519_privkey, sizeof(ed25519_privkey));
@@ -354,6 +364,8 @@ void ssh_signature_free(ssh_signature sig)
             gcry_sexp_release(sig->rsa_sig);
 #elif defined HAVE_LIBCRYPTO
             SAFE_FREE(sig->rsa_sig);
+#elif defined HAVE_LIBMBEDCRYPTO
+            SAFE_FREE(sig->rsa_sig);
 #endif
             break;
         case SSH_KEYTYPE_ECDSA:
@@ -361,6 +373,9 @@ void ssh_signature_free(ssh_signature sig)
             gcry_sexp_release(sig->ecdsa_sig);
 #elif defined(HAVE_LIBCRYPTO) && defined(HAVE_OPENSSL_ECC)
             ECDSA_SIG_free(sig->ecdsa_sig);
+#elif defined HAVE_LIBMBEDCRYPTO
+            bignum_free(sig->ecdsa_sig.r);
+            bignum_free(sig->ecdsa_sig.s);
 #endif
             break;
         case SSH_KEYTYPE_ED25519:

src/server.c

@@ -107,6 +107,7 @@ static int server_set_kex(ssh_session session) {
                ",%s", session->srv.ecdsa_key->type_c);
   }
 #endif
+#ifdef HAVE_DSA
   if (session->srv.dsa_key != NULL) {
       len = strlen(hostkeys);
       keytype = ssh_key_type(session->srv.dsa_key);
@@ -114,6 +115,7 @@ static int server_set_kex(ssh_session session) {
       snprintf(hostkeys + len, sizeof(hostkeys) - len,
                ",%s", ssh_key_type_to_char(keytype));
   }
+#endif
   if (session->srv.rsa_key != NULL) {
       len = strlen(hostkeys);
       keytype = ssh_key_type(session->srv.rsa_key);

src/session.c

@@ -148,6 +148,7 @@ ssh_session ssh_new(void) {
       goto err;
     }
 
+#ifdef HAVE_DSA
     id = strdup("%d/id_dsa");
     if (id == NULL) {
       goto err;
@@ -156,6 +157,7 @@ ssh_session ssh_new(void) {
     if (rc == SSH_ERROR) {
       goto err;
     }
+#endif
 
     id = strdup("%d/identity");
     if (id == NULL) {

src/threads.c

@@ -33,6 +33,10 @@
 #include "libssh/crypto.h"
 #include "libssh/threads.h"
 
+#ifdef HAVE_LIBMBEDCRYPTO
+#include <mbedtls/threading.h>
+#endif
+
 static int threads_noop (void **lock){
 	(void)lock;
   return 0;
@@ -100,6 +104,28 @@ static int libgcrypt_thread_init(void){
 	return SSH_OK;
 }
 #endif /* GCRYPT_VERSION_NUMBER */
+#elif defined HAVE_LIBMBEDCRYPTO
+static int libmbedcrypto_thread_init(void)
+{
+    if (user_callbacks == NULL) {
+        return SSH_ERROR;
+    }
+
+    if (user_callbacks == &ssh_threads_noop) {
+        return SSH_OK;
+    }
+#ifdef MBEDTLS_THREADING_ALT
+    else {
+        mbedtls_threading_set_alt(user_callbacks->mutex_init,
+                user_callbacks->mutex_destroy, user_callbacks->mutex_lock,
+                user_callbacks->mutex_unlock);
+    }
+#elif defined MBEDTLS_THREADING_PTHREAD
+    return SSH_OK;
+#else
+    return SSH_ERROR;
+#endif
+}
 #else /* HAVE_LIBGCRYPT */
 
 /* Libcrypto specific stuff */
@@ -181,6 +207,8 @@ int ssh_threads_init(void){
 	/* Then initialize the crypto libraries threading callbacks */
 #ifdef HAVE_LIBGCRYPT
 	ret = libgcrypt_thread_init();
+#elif HAVE_LIBMBEDCRYPTO
+    ret = libmbedcrypto_thread_init();
 #else /* Libcrypto */
 	ret = libcrypto_thread_init();
 #endif
@@ -191,6 +219,10 @@ int ssh_threads_init(void){
 
 void ssh_threads_finalize(void){
 #ifdef HAVE_LIBGCRYPT
+#elif HAVE_LIBMBEDCRYPTO
+#ifdef MBEDTLS_THREADING_ALT
+    mbedtls_threading_free_alt();
+#endif
 #else
 	libcrypto_thread_finalize();
 #endif