projects / u / mdw / putty / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
In term_init(), copy stuff out of the conf _before_ calling
[u/mdw/putty] / ssh.c
CommitLineData
eaf1e20a 1/*
2 * SSH backend.
3 */
4
374330e2 5#include <stdio.h>
6#include <stdlib.h>
fb09bf1c 7#include <stdarg.h>
8#include <assert.h>
3c112d53 9#include <limits.h>
d051d1b4 10#include <signal.h>
374330e2 11
12#include "putty.h"
dacbd0e8 13#include "tree234.h"
fb09bf1c 14#include "ssh.h"
bf84a03a 15#ifndef NO_GSSAPI
b3d375b2 16#include "sshgssc.h"
42af6a67 17#include "sshgss.h"
bf84a03a 18#endif
374330e2 19
20#ifndef FALSE
21#define FALSE 0
22#endif
23#ifndef TRUE
24#define TRUE 1
25#endif
26
32874aea 27#define SSH1_MSG_DISCONNECT 1 /* 0x1 */
28#define SSH1_SMSG_PUBLIC_KEY 2 /* 0x2 */
29#define SSH1_CMSG_SESSION_KEY 3 /* 0x3 */
30#define SSH1_CMSG_USER 4 /* 0x4 */
31#define SSH1_CMSG_AUTH_RSA 6 /* 0x6 */
32#define SSH1_SMSG_AUTH_RSA_CHALLENGE 7 /* 0x7 */
33#define SSH1_CMSG_AUTH_RSA_RESPONSE 8 /* 0x8 */
34#define SSH1_CMSG_AUTH_PASSWORD 9 /* 0x9 */
35#define SSH1_CMSG_REQUEST_PTY 10 /* 0xa */
36#define SSH1_CMSG_WINDOW_SIZE 11 /* 0xb */
37#define SSH1_CMSG_EXEC_SHELL 12 /* 0xc */
38#define SSH1_CMSG_EXEC_CMD 13 /* 0xd */
39#define SSH1_SMSG_SUCCESS 14 /* 0xe */
40#define SSH1_SMSG_FAILURE 15 /* 0xf */
41#define SSH1_CMSG_STDIN_DATA 16 /* 0x10 */
42#define SSH1_SMSG_STDOUT_DATA 17 /* 0x11 */
43#define SSH1_SMSG_STDERR_DATA 18 /* 0x12 */
44#define SSH1_CMSG_EOF 19 /* 0x13 */
45#define SSH1_SMSG_EXIT_STATUS 20 /* 0x14 */
46#define SSH1_MSG_CHANNEL_OPEN_CONFIRMATION 21 /* 0x15 */
47#define SSH1_MSG_CHANNEL_OPEN_FAILURE 22 /* 0x16 */
48#define SSH1_MSG_CHANNEL_DATA 23 /* 0x17 */
49#define SSH1_MSG_CHANNEL_CLOSE 24 /* 0x18 */
50#define SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION 25 /* 0x19 */
51#define SSH1_SMSG_X11_OPEN 27 /* 0x1b */
52#define SSH1_CMSG_PORT_FORWARD_REQUEST 28 /* 0x1c */
53#define SSH1_MSG_PORT_OPEN 29 /* 0x1d */
54#define SSH1_CMSG_AGENT_REQUEST_FORWARDING 30 /* 0x1e */
55#define SSH1_SMSG_AGENT_OPEN 31 /* 0x1f */
56#define SSH1_MSG_IGNORE 32 /* 0x20 */
57#define SSH1_CMSG_EXIT_CONFIRMATION 33 /* 0x21 */
58#define SSH1_CMSG_X11_REQUEST_FORWARDING 34 /* 0x22 */
59#define SSH1_CMSG_AUTH_RHOSTS_RSA 35 /* 0x23 */
60#define SSH1_MSG_DEBUG 36 /* 0x24 */
61#define SSH1_CMSG_REQUEST_COMPRESSION 37 /* 0x25 */
62#define SSH1_CMSG_AUTH_TIS 39 /* 0x27 */
63#define SSH1_SMSG_AUTH_TIS_CHALLENGE 40 /* 0x28 */
64#define SSH1_CMSG_AUTH_TIS_RESPONSE 41 /* 0x29 */
65#define SSH1_CMSG_AUTH_CCARD 70 /* 0x46 */
66#define SSH1_SMSG_AUTH_CCARD_CHALLENGE 71 /* 0x47 */
67#define SSH1_CMSG_AUTH_CCARD_RESPONSE 72 /* 0x48 */
68
8f9e3231 69#define SSH1_AUTH_RHOSTS 1 /* 0x1 */
70#define SSH1_AUTH_RSA 2 /* 0x2 */
71#define SSH1_AUTH_PASSWORD 3 /* 0x3 */
72#define SSH1_AUTH_RHOSTS_RSA 4 /* 0x4 */
32874aea 73#define SSH1_AUTH_TIS 5 /* 0x5 */
74#define SSH1_AUTH_CCARD 16 /* 0x10 */
75
76#define SSH1_PROTOFLAG_SCREEN_NUMBER 1 /* 0x1 */
b96dc54c 77/* Mask for protoflags we will echo back to server if seen */
32874aea 78#define SSH1_PROTOFLAGS_SUPPORTED 0 /* 0x1 */
79
80#define SSH2_MSG_DISCONNECT 1 /* 0x1 */
81#define SSH2_MSG_IGNORE 2 /* 0x2 */
82#define SSH2_MSG_UNIMPLEMENTED 3 /* 0x3 */
83#define SSH2_MSG_DEBUG 4 /* 0x4 */
84#define SSH2_MSG_SERVICE_REQUEST 5 /* 0x5 */
85#define SSH2_MSG_SERVICE_ACCEPT 6 /* 0x6 */
86#define SSH2_MSG_KEXINIT 20 /* 0x14 */
87#define SSH2_MSG_NEWKEYS 21 /* 0x15 */
88#define SSH2_MSG_KEXDH_INIT 30 /* 0x1e */
89#define SSH2_MSG_KEXDH_REPLY 31 /* 0x1f */
90#define SSH2_MSG_KEX_DH_GEX_REQUEST 30 /* 0x1e */
91#define SSH2_MSG_KEX_DH_GEX_GROUP 31 /* 0x1f */
92#define SSH2_MSG_KEX_DH_GEX_INIT 32 /* 0x20 */
93#define SSH2_MSG_KEX_DH_GEX_REPLY 33 /* 0x21 */
fae1a71b 94#define SSH2_MSG_KEXRSA_PUBKEY 30 /* 0x1e */
95#define SSH2_MSG_KEXRSA_SECRET 31 /* 0x1f */
96#define SSH2_MSG_KEXRSA_DONE 32 /* 0x20 */
32874aea 97#define SSH2_MSG_USERAUTH_REQUEST 50 /* 0x32 */
98#define SSH2_MSG_USERAUTH_FAILURE 51 /* 0x33 */
99#define SSH2_MSG_USERAUTH_SUCCESS 52 /* 0x34 */
100#define SSH2_MSG_USERAUTH_BANNER 53 /* 0x35 */
101#define SSH2_MSG_USERAUTH_PK_OK 60 /* 0x3c */
102#define SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ 60 /* 0x3c */
761187b6 103#define SSH2_MSG_USERAUTH_INFO_REQUEST 60 /* 0x3c */
104#define SSH2_MSG_USERAUTH_INFO_RESPONSE 61 /* 0x3d */
32874aea 105#define SSH2_MSG_GLOBAL_REQUEST 80 /* 0x50 */
106#define SSH2_MSG_REQUEST_SUCCESS 81 /* 0x51 */
107#define SSH2_MSG_REQUEST_FAILURE 82 /* 0x52 */
108#define SSH2_MSG_CHANNEL_OPEN 90 /* 0x5a */
109#define SSH2_MSG_CHANNEL_OPEN_CONFIRMATION 91 /* 0x5b */
110#define SSH2_MSG_CHANNEL_OPEN_FAILURE 92 /* 0x5c */
111#define SSH2_MSG_CHANNEL_WINDOW_ADJUST 93 /* 0x5d */
112#define SSH2_MSG_CHANNEL_DATA 94 /* 0x5e */
113#define SSH2_MSG_CHANNEL_EXTENDED_DATA 95 /* 0x5f */
114#define SSH2_MSG_CHANNEL_EOF 96 /* 0x60 */
115#define SSH2_MSG_CHANNEL_CLOSE 97 /* 0x61 */
116#define SSH2_MSG_CHANNEL_REQUEST 98 /* 0x62 */
117#define SSH2_MSG_CHANNEL_SUCCESS 99 /* 0x63 */
118#define SSH2_MSG_CHANNEL_FAILURE 100 /* 0x64 */
42af6a67 119#define SSH2_MSG_USERAUTH_GSSAPI_RESPONSE 60
120#define SSH2_MSG_USERAUTH_GSSAPI_TOKEN 61
121#define SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE 63
122#define SSH2_MSG_USERAUTH_GSSAPI_ERROR 64
123#define SSH2_MSG_USERAUTH_GSSAPI_ERRTOK 65
124#define SSH2_MSG_USERAUTH_GSSAPI_MIC 66
32874aea 125
00db133f 126/*
127 * Packet type contexts, so that ssh2_pkt_type can correctly decode
128 * the ambiguous type numbers back into the correct type strings.
129 */
acab36bc 130typedef enum {
131 SSH2_PKTCTX_NOKEX,
132 SSH2_PKTCTX_DHGROUP,
133 SSH2_PKTCTX_DHGEX,
134 SSH2_PKTCTX_RSAKEX
135} Pkt_KCtx;
136typedef enum {
137 SSH2_PKTCTX_NOAUTH,
138 SSH2_PKTCTX_PUBLICKEY,
139 SSH2_PKTCTX_PASSWORD,
42af6a67 140 SSH2_PKTCTX_GSSAPI,
acab36bc 141 SSH2_PKTCTX_KBDINTER
142} Pkt_ACtx;
00db133f 143
32874aea 144#define SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1 /* 0x1 */
145#define SSH2_DISCONNECT_PROTOCOL_ERROR 2 /* 0x2 */
146#define SSH2_DISCONNECT_KEY_EXCHANGE_FAILED 3 /* 0x3 */
147#define SSH2_DISCONNECT_HOST_AUTHENTICATION_FAILED 4 /* 0x4 */
148#define SSH2_DISCONNECT_MAC_ERROR 5 /* 0x5 */
149#define SSH2_DISCONNECT_COMPRESSION_ERROR 6 /* 0x6 */
150#define SSH2_DISCONNECT_SERVICE_NOT_AVAILABLE 7 /* 0x7 */
151#define SSH2_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED 8 /* 0x8 */
152#define SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9 /* 0x9 */
153#define SSH2_DISCONNECT_CONNECTION_LOST 10 /* 0xa */
154#define SSH2_DISCONNECT_BY_APPLICATION 11 /* 0xb */
155#define SSH2_DISCONNECT_TOO_MANY_CONNECTIONS 12 /* 0xc */
156#define SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER 13 /* 0xd */
157#define SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14 /* 0xe */
158#define SSH2_DISCONNECT_ILLEGAL_USER_NAME 15 /* 0xf */
38c4a8da 159
160static const char *const ssh2_disconnect_reasons[] = {
161 NULL,
afb4d0dc 162 "host not allowed to connect",
163 "protocol error",
164 "key exchange failed",
165 "host authentication failed",
1da38d29 166 "MAC error",
afb4d0dc 167 "compression error",
168 "service not available",
169 "protocol version not supported",
170 "host key not verifiable",
171 "connection lost",
172 "by application",
173 "too many connections",
174 "auth cancelled by user",
175 "no more auth methods available",
176 "illegal user name",
38c4a8da 177};
9005f3ba 178
32874aea 179#define SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED 1 /* 0x1 */
180#define SSH2_OPEN_CONNECT_FAILED 2 /* 0x2 */
181#define SSH2_OPEN_UNKNOWN_CHANNEL_TYPE 3 /* 0x3 */
182#define SSH2_OPEN_RESOURCE_SHORTAGE 4 /* 0x4 */
d211621f 183
32874aea 184#define SSH2_EXTENDED_DATA_STDERR 1 /* 0x1 */
fb09bf1c 185
7d503c31 186/*
187 * Various remote-bug flags.
188 */
189#define BUG_CHOKES_ON_SSH1_IGNORE 1
190#define BUG_SSH2_HMAC 2
bd358db1 191#define BUG_NEEDS_SSH1_PLAIN_PASSWORD 4
0df73905 192#define BUG_CHOKES_ON_RSA 8
1dd353b5 193#define BUG_SSH2_RSA_PADDING 16
088bde77 194#define BUG_SSH2_DERIVEKEY 32
f382c87d 195#define BUG_SSH2_REKEY 64
dda87a28 196#define BUG_SSH2_PK_SESSIONID 128
c9739dba 197#define BUG_SSH2_MAXPKT 256
cf6ddb95 198#define BUG_CHOKES_ON_SSH2_IGNORE 512
bd358db1 199
c6ccd5c2 200/*
201 * Codes for terminal modes.
202 * Most of these are the same in SSH-1 and SSH-2.
7646c432 203 * This list is derived from RFC 4254 and
c6ccd5c2 204 * SSH-1 RFC-1.2.31.
205 */
206static const struct {
207 const char* const mode;
208 int opcode;
209 enum { TTY_OP_CHAR, TTY_OP_BOOL } type;
210} ssh_ttymodes[] = {
211 /* "V" prefix discarded for special characters relative to SSH specs */
212 { "INTR", 1, TTY_OP_CHAR },
213 { "QUIT", 2, TTY_OP_CHAR },
214 { "ERASE", 3, TTY_OP_CHAR },
215 { "KILL", 4, TTY_OP_CHAR },
216 { "EOF", 5, TTY_OP_CHAR },
217 { "EOL", 6, TTY_OP_CHAR },
218 { "EOL2", 7, TTY_OP_CHAR },
219 { "START", 8, TTY_OP_CHAR },
220 { "STOP", 9, TTY_OP_CHAR },
221 { "SUSP", 10, TTY_OP_CHAR },
222 { "DSUSP", 11, TTY_OP_CHAR },
223 { "REPRINT", 12, TTY_OP_CHAR },
224 { "WERASE", 13, TTY_OP_CHAR },
225 { "LNEXT", 14, TTY_OP_CHAR },
226 { "FLUSH", 15, TTY_OP_CHAR },
227 { "SWTCH", 16, TTY_OP_CHAR },
228 { "STATUS", 17, TTY_OP_CHAR },
229 { "DISCARD", 18, TTY_OP_CHAR },
230 { "IGNPAR", 30, TTY_OP_BOOL },
231 { "PARMRK", 31, TTY_OP_BOOL },
232 { "INPCK", 32, TTY_OP_BOOL },
233 { "ISTRIP", 33, TTY_OP_BOOL },
234 { "INLCR", 34, TTY_OP_BOOL },
235 { "IGNCR", 35, TTY_OP_BOOL },
236 { "ICRNL", 36, TTY_OP_BOOL },
237 { "IUCLC", 37, TTY_OP_BOOL },
238 { "IXON", 38, TTY_OP_BOOL },
239 { "IXANY", 39, TTY_OP_BOOL },
240 { "IXOFF", 40, TTY_OP_BOOL },
241 { "IMAXBEL", 41, TTY_OP_BOOL },
242 { "ISIG", 50, TTY_OP_BOOL },
243 { "ICANON", 51, TTY_OP_BOOL },
244 { "XCASE", 52, TTY_OP_BOOL },
245 { "ECHO", 53, TTY_OP_BOOL },
246 { "ECHOE", 54, TTY_OP_BOOL },
247 { "ECHOK", 55, TTY_OP_BOOL },
248 { "ECHONL", 56, TTY_OP_BOOL },
249 { "NOFLSH", 57, TTY_OP_BOOL },
250 { "TOSTOP", 58, TTY_OP_BOOL },
251 { "IEXTEN", 59, TTY_OP_BOOL },
252 { "ECHOCTL", 60, TTY_OP_BOOL },
253 { "ECHOKE", 61, TTY_OP_BOOL },
254 { "PENDIN", 62, TTY_OP_BOOL }, /* XXX is this a real mode? */
255 { "OPOST", 70, TTY_OP_BOOL },
256 { "OLCUC", 71, TTY_OP_BOOL },
257 { "ONLCR", 72, TTY_OP_BOOL },
258 { "OCRNL", 73, TTY_OP_BOOL },
259 { "ONOCR", 74, TTY_OP_BOOL },
260 { "ONLRET", 75, TTY_OP_BOOL },
261 { "CS7", 90, TTY_OP_BOOL },
262 { "CS8", 91, TTY_OP_BOOL },
263 { "PARENB", 92, TTY_OP_BOOL },
264 { "PARODD", 93, TTY_OP_BOOL }
265};
266
267/* Miscellaneous other tty-related constants. */
268#define SSH_TTY_OP_END 0
269/* The opcodes for ISPEED/OSPEED differ between SSH-1 and SSH-2. */
270#define SSH1_TTY_OP_ISPEED 192
271#define SSH1_TTY_OP_OSPEED 193
272#define SSH2_TTY_OP_ISPEED 128
273#define SSH2_TTY_OP_OSPEED 129
274
275/* Helper functions for parsing tty-related config. */
276static unsigned int ssh_tty_parse_specchar(char *s)
277{
278 unsigned int ret;
279 if (*s) {
280 char *next = NULL;
281 ret = ctrlparse(s, &next);
282 if (!next) ret = s[0];
283 } else {
284 ret = 255; /* special value meaning "don't set" */
285 }
286 return ret;
287}
288static unsigned int ssh_tty_parse_boolean(char *s)
289{
290 if (stricmp(s, "yes") == 0 ||
291 stricmp(s, "on") == 0 ||
292 stricmp(s, "true") == 0 ||
293 stricmp(s, "+") == 0)
294 return 1; /* true */
295 else if (stricmp(s, "no") == 0 ||
296 stricmp(s, "off") == 0 ||
297 stricmp(s, "false") == 0 ||
298 stricmp(s, "-") == 0)
299 return 0; /* false */
300 else
301 return (atoi(s) != 0);
302}
303
00db133f 304#define translate(x) if (type == x) return #x
acab36bc 305#define translatek(x,ctx) if (type == x && (pkt_kctx == ctx)) return #x
306#define translatea(x,ctx) if (type == x && (pkt_actx == ctx)) return #x
ae9ae89f 307static char *ssh1_pkt_type(int type)
00db133f 308{
309 translate(SSH1_MSG_DISCONNECT);
310 translate(SSH1_SMSG_PUBLIC_KEY);
311 translate(SSH1_CMSG_SESSION_KEY);
312 translate(SSH1_CMSG_USER);
313 translate(SSH1_CMSG_AUTH_RSA);
314 translate(SSH1_SMSG_AUTH_RSA_CHALLENGE);
315 translate(SSH1_CMSG_AUTH_RSA_RESPONSE);
316 translate(SSH1_CMSG_AUTH_PASSWORD);
317 translate(SSH1_CMSG_REQUEST_PTY);
318 translate(SSH1_CMSG_WINDOW_SIZE);
319 translate(SSH1_CMSG_EXEC_SHELL);
320 translate(SSH1_CMSG_EXEC_CMD);
321 translate(SSH1_SMSG_SUCCESS);
322 translate(SSH1_SMSG_FAILURE);
323 translate(SSH1_CMSG_STDIN_DATA);
324 translate(SSH1_SMSG_STDOUT_DATA);
325 translate(SSH1_SMSG_STDERR_DATA);
326 translate(SSH1_CMSG_EOF);
327 translate(SSH1_SMSG_EXIT_STATUS);
328 translate(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
329 translate(SSH1_MSG_CHANNEL_OPEN_FAILURE);
330 translate(SSH1_MSG_CHANNEL_DATA);
331 translate(SSH1_MSG_CHANNEL_CLOSE);
332 translate(SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION);
333 translate(SSH1_SMSG_X11_OPEN);
334 translate(SSH1_CMSG_PORT_FORWARD_REQUEST);
335 translate(SSH1_MSG_PORT_OPEN);
336 translate(SSH1_CMSG_AGENT_REQUEST_FORWARDING);
337 translate(SSH1_SMSG_AGENT_OPEN);
338 translate(SSH1_MSG_IGNORE);
339 translate(SSH1_CMSG_EXIT_CONFIRMATION);
340 translate(SSH1_CMSG_X11_REQUEST_FORWARDING);
341 translate(SSH1_CMSG_AUTH_RHOSTS_RSA);
342 translate(SSH1_MSG_DEBUG);
343 translate(SSH1_CMSG_REQUEST_COMPRESSION);
344 translate(SSH1_CMSG_AUTH_TIS);
345 translate(SSH1_SMSG_AUTH_TIS_CHALLENGE);
346 translate(SSH1_CMSG_AUTH_TIS_RESPONSE);
347 translate(SSH1_CMSG_AUTH_CCARD);
348 translate(SSH1_SMSG_AUTH_CCARD_CHALLENGE);
349 translate(SSH1_CMSG_AUTH_CCARD_RESPONSE);
350 return "unknown";
351}
acab36bc 352static char *ssh2_pkt_type(Pkt_KCtx pkt_kctx, Pkt_ACtx pkt_actx, int type)
00db133f 353{
42af6a67 354 translatea(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE,SSH2_PKTCTX_GSSAPI);
355 translatea(SSH2_MSG_USERAUTH_GSSAPI_TOKEN,SSH2_PKTCTX_GSSAPI);
356 translatea(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,SSH2_PKTCTX_GSSAPI);
357 translatea(SSH2_MSG_USERAUTH_GSSAPI_ERROR,SSH2_PKTCTX_GSSAPI);
358 translatea(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK,SSH2_PKTCTX_GSSAPI);
359 translatea(SSH2_MSG_USERAUTH_GSSAPI_MIC, SSH2_PKTCTX_GSSAPI);
00db133f 360 translate(SSH2_MSG_DISCONNECT);
361 translate(SSH2_MSG_IGNORE);
362 translate(SSH2_MSG_UNIMPLEMENTED);
363 translate(SSH2_MSG_DEBUG);
364 translate(SSH2_MSG_SERVICE_REQUEST);
365 translate(SSH2_MSG_SERVICE_ACCEPT);
366 translate(SSH2_MSG_KEXINIT);
367 translate(SSH2_MSG_NEWKEYS);
acab36bc 368 translatek(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP);
369 translatek(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP);
370 translatek(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX);
371 translatek(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX);
372 translatek(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX);
373 translatek(SSH2_MSG_KEX_DH_GEX_REPLY, SSH2_PKTCTX_DHGEX);
374 translatek(SSH2_MSG_KEXRSA_PUBKEY, SSH2_PKTCTX_RSAKEX);
375 translatek(SSH2_MSG_KEXRSA_SECRET, SSH2_PKTCTX_RSAKEX);
376 translatek(SSH2_MSG_KEXRSA_DONE, SSH2_PKTCTX_RSAKEX);
00db133f 377 translate(SSH2_MSG_USERAUTH_REQUEST);
378 translate(SSH2_MSG_USERAUTH_FAILURE);
379 translate(SSH2_MSG_USERAUTH_SUCCESS);
380 translate(SSH2_MSG_USERAUTH_BANNER);
acab36bc 381 translatea(SSH2_MSG_USERAUTH_PK_OK, SSH2_PKTCTX_PUBLICKEY);
382 translatea(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, SSH2_PKTCTX_PASSWORD);
383 translatea(SSH2_MSG_USERAUTH_INFO_REQUEST, SSH2_PKTCTX_KBDINTER);
384 translatea(SSH2_MSG_USERAUTH_INFO_RESPONSE, SSH2_PKTCTX_KBDINTER);
00db133f 385 translate(SSH2_MSG_GLOBAL_REQUEST);
386 translate(SSH2_MSG_REQUEST_SUCCESS);
387 translate(SSH2_MSG_REQUEST_FAILURE);
388 translate(SSH2_MSG_CHANNEL_OPEN);
389 translate(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
390 translate(SSH2_MSG_CHANNEL_OPEN_FAILURE);
391 translate(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
392 translate(SSH2_MSG_CHANNEL_DATA);
393 translate(SSH2_MSG_CHANNEL_EXTENDED_DATA);
394 translate(SSH2_MSG_CHANNEL_EOF);
395 translate(SSH2_MSG_CHANNEL_CLOSE);
396 translate(SSH2_MSG_CHANNEL_REQUEST);
397 translate(SSH2_MSG_CHANNEL_SUCCESS);
398 translate(SSH2_MSG_CHANNEL_FAILURE);
399 return "unknown";
400}
401#undef translate
402#undef translatec
7d503c31 403
9a10ecf4 404/* Enumeration values for fields in SSH-1 packets */
405enum {
406 PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM,
407 /* These values are for communicating relevant semantics of
408 * fields to the packet logging code. */
409 PKTT_OTHER, PKTT_PASSWORD, PKTT_DATA
410};
972a41c8 411
acddebd9 412/*
413 * Coroutine mechanics for the sillier bits of the code. If these
414 * macros look impenetrable to you, you might find it helpful to
415 * read
416 *
417 * http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html
418 *
419 * which explains the theory behind these macros.
b624d1e6 420 *
421 * In particular, if you are getting `case expression not constant'
422 * errors when building with MS Visual Studio, this is because MS's
423 * Edit and Continue debugging feature causes their compiler to
424 * violate ANSI C. To disable Edit and Continue debugging:
425 *
426 * - right-click ssh.c in the FileView
427 * - click Settings
428 * - select the C/C++ tab and the General category
429 * - under `Debug info:', select anything _other_ than `Program
430 * Database for Edit and Continue'.
acddebd9 431 */
51470298 432#define crBegin(v) { int *crLine = &v; switch(v) { case 0:;
433#define crState(t) \
434 struct t *s; \
3d88e64d 435 if (!ssh->t) ssh->t = snew(struct t); \
51470298 436 s = ssh->t;
437#define crFinish(z) } *crLine = 0; return (z); }
438#define crFinishV } *crLine = 0; return; }
374330e2 439#define crReturn(z) \
440 do {\
51470298 441 *crLine =__LINE__; return (z); case __LINE__:;\
374330e2 442 } while (0)
443#define crReturnV \
444 do {\
51470298 445 *crLine=__LINE__; return; case __LINE__:;\
374330e2 446 } while (0)
51470298 447#define crStop(z) do{ *crLine = 0; return (z); }while(0)
448#define crStopV do{ *crLine = 0; return; }while(0)
fb09bf1c 449#define crWaitUntil(c) do { crReturn(0); } while (!(c))
7cca0d81 450#define crWaitUntilV(c) do { crReturnV; } while (!(c))
374330e2 451
51470298 452typedef struct ssh_tag *Ssh;
ff3187f6 453struct Packet;
454
dacd8872 455static struct Packet *ssh1_pkt_init(int pkt_type);
ff3187f6 456static struct Packet *ssh2_pkt_init(int pkt_type);
dacd8872 457static void ssh_pkt_ensure(struct Packet *, int length);
458static void ssh_pkt_adddata(struct Packet *, void *data, int len);
459static void ssh_pkt_addbyte(struct Packet *, unsigned char value);
ff3187f6 460static void ssh2_pkt_addbool(struct Packet *, unsigned char value);
dacd8872 461static void ssh_pkt_adduint32(struct Packet *, unsigned long value);
462static void ssh_pkt_addstring_start(struct Packet *);
463static void ssh_pkt_addstring_str(struct Packet *, char *data);
464static void ssh_pkt_addstring_data(struct Packet *, char *data, int len);
465static void ssh_pkt_addstring(struct Packet *, char *data);
d8baa528 466static unsigned char *ssh2_mpint_fmt(Bignum b, int *len);
dacd8872 467static void ssh1_pkt_addmp(struct Packet *, Bignum b);
ff3187f6 468static void ssh2_pkt_addmp(struct Packet *, Bignum b);
469static int ssh2_pkt_construct(Ssh, struct Packet *);
470static void ssh2_pkt_send(Ssh, struct Packet *);
590f6a5f 471static void ssh2_pkt_send_noqueue(Ssh, struct Packet *);
ff3187f6 472static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
473 struct Packet *pktin);
474static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
475 struct Packet *pktin);
3d63ca2e 476
5471d09a 477/*
478 * Buffer management constants. There are several of these for
479 * various different purposes:
480 *
481 * - SSH1_BUFFER_LIMIT is the amount of backlog that must build up
482 * on a local data stream before we throttle the whole SSH
2e85c969 483 * connection (in SSH-1 only). Throttling the whole connection is
5471d09a 484 * pretty drastic so we set this high in the hope it won't
485 * happen very often.
486 *
487 * - SSH_MAX_BACKLOG is the amount of backlog that must build up
488 * on the SSH connection itself before we defensively throttle
489 * _all_ local data streams. This is pretty drastic too (though
2e85c969 490 * thankfully unlikely in SSH-2 since the window mechanism should
5471d09a 491 * ensure that the server never has any need to throttle its end
492 * of the connection), so we set this high as well.
493 *
2e85c969 494 * - OUR_V2_WINSIZE is the maximum window size we present on SSH-2
5471d09a 495 * channels.
9b53e9b8 496 *
497 * - OUR_V2_BIGWIN is the window size we advertise for the only
3361b80a 498 * channel in a simple connection. It must be <= INT_MAX.
9916cc1e 499 *
500 * - OUR_V2_MAXPKT is the official "maximum packet size" we send
501 * to the remote side. This actually has nothing to do with the
502 * size of the _packet_, but is instead a limit on the amount
503 * of data we're willing to receive in a single SSH2 channel
504 * data message.
505 *
506 * - OUR_V2_PACKETLIMIT is actually the maximum size of SSH
507 * _packet_ we're prepared to cope with. It must be a multiple
508 * of the cipher block size, and must be at least 35000.
5471d09a 509 */
510
511#define SSH1_BUFFER_LIMIT 32768
512#define SSH_MAX_BACKLOG 32768
513#define OUR_V2_WINSIZE 16384
3361b80a 514#define OUR_V2_BIGWIN 0x7fffffff
954d5c5a 515#define OUR_V2_MAXPKT 0x4000UL
9916cc1e 516#define OUR_V2_PACKETLIMIT 0x9000UL
d74d141c 517
edd0cb8a 518/* Maximum length of passwords/passphrases (arbitrary) */
519#define SSH_MAX_PASSWORD_LEN 100
520
85cc02bb 521const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss };
e5574168 522
8b2715b2 523const static struct ssh_mac *macs[] = {
6668a75e 524 &ssh_hmac_sha1, &ssh_hmac_sha1_96, &ssh_hmac_md5
32874aea 525};
8b2715b2 526const static struct ssh_mac *buggymacs[] = {
6668a75e 527 &ssh_hmac_sha1_buggy, &ssh_hmac_sha1_96_buggy, &ssh_hmac_md5
32874aea 528};
e5574168 529
5366aed8 530static void *ssh_comp_none_init(void)
531{
532 return NULL;
533}
534static void ssh_comp_none_cleanup(void *handle)
32874aea 535{
536}
5366aed8 537static int ssh_comp_none_block(void *handle, unsigned char *block, int len,
32874aea 538 unsigned char **outblock, int *outlen)
539{
540 return 0;
541}
5366aed8 542static int ssh_comp_none_disable(void *handle)
32874aea 543{
4ba9b64b 544 return 0;
545}
57476f6b 546const static struct ssh_compress ssh_comp_none = {
ab18ccff 547 "none", NULL,
5366aed8 548 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
549 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
550 ssh_comp_none_disable, NULL
e5574168 551};
4ba9b64b 552extern const struct ssh_compress ssh_zlib;
553const static struct ssh_compress *compressions[] = {
32874aea 554 &ssh_zlib, &ssh_comp_none
555};
374330e2 556
32874aea 557enum { /* channel types */
783415f8 558 CHAN_MAINSESSION,
559 CHAN_X11,
560 CHAN_AGENT,
bc240b21 561 CHAN_SOCKDATA,
562 CHAN_SOCKDATA_DORMANT /* one the remote hasn't confirmed */
783415f8 563};
564
dacbd0e8 565/*
0e443c99 566 * little structure to keep track of outstanding WINDOW_ADJUSTs
567 */
568struct winadj {
569 struct winadj *next;
570 unsigned size;
571};
572
573/*
dacbd0e8 574 * 2-3-4 tree storing channels.
575 */
576struct ssh_channel {
51470298 577 Ssh ssh; /* pointer back to main context */
d211621f 578 unsigned remoteid, localid;
dacbd0e8 579 int type;
64d6ff88 580 /* True if we opened this channel but server hasn't confirmed. */
581 int halfopen;
0357890f 582 /*
2e85c969 583 * In SSH-1, this value contains four bits:
0357890f 584 *
585 * 1 We have sent SSH1_MSG_CHANNEL_CLOSE.
586 * 2 We have sent SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
587 * 4 We have received SSH1_MSG_CHANNEL_CLOSE.
588 * 8 We have received SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
589 *
590 * A channel is completely finished with when all four bits are set.
591 */
dacbd0e8 592 int closes;
78280721 593
594 /*
595 * This flag indicates that a close is pending on the outgoing
596 * side of the channel: that is, wherever we're getting the data
597 * for this channel has sent us some data followed by EOF. We
598 * can't actually close the channel until we've finished sending
599 * the data, so we set this flag instead to remind us to
600 * initiate the closing process once our buffer is clear.
601 */
602 int pending_close;
603
ff68564b 604 /*
605 * True if this channel is causing the underlying connection to be
606 * throttled.
607 */
608 int throttling_conn;
5471d09a 609 union {
5471d09a 610 struct ssh2_data_channel {
611 bufchain outbuffer;
612 unsigned remwindow, remmaxpkt;
467e064d 613 /* locwindow is signed so we can cope with excess data. */
9b53e9b8 614 int locwindow, locmaxwin;
0e443c99 615 /*
616 * remlocwin is the amount of local window that we think
617 * the remote end had available to it after it sent the
618 * last data packet or window adjust ack.
619 */
620 int remlocwin;
621 /*
622 * These store the list of window adjusts that haven't
623 * been acked.
624 */
625 struct winadj *winadj_head, *winadj_tail;
626 enum { THROTTLED, UNTHROTTLING, UNTHROTTLED } throttle_state;
5471d09a 627 } v2;
628 } v;
dacbd0e8 629 union {
32874aea 630 struct ssh_agent_channel {
631 unsigned char *message;
632 unsigned char msglen[4];
a03c9f9c 633 unsigned lensofar, totallen;
32874aea 634 } a;
635 struct ssh_x11_channel {
636 Socket s;
637 } x11;
d74d141c 638 struct ssh_pfd_channel {
639 Socket s;
640 } pfd;
dacbd0e8 641 } u;
642};
57476f6b 643
d74d141c 644/*
2e85c969 645 * 2-3-4 tree storing remote->local port forwardings. SSH-1 and SSH-2
646 * use this structure in different ways, reflecting SSH-2's
bc240b21 647 * altogether saner approach to port forwarding.
648 *
2e85c969 649 * In SSH-1, you arrange a remote forwarding by sending the server
bc240b21 650 * the remote port number, and the local destination host:port.
651 * When a connection comes in, the server sends you back that
652 * host:port pair, and you connect to it. This is a ready-made
653 * security hole if you're not on the ball: a malicious server
654 * could send you back _any_ host:port pair, so if you trustingly
655 * connect to the address it gives you then you've just opened the
656 * entire inside of your corporate network just by connecting
657 * through it to a dodgy SSH server. Hence, we must store a list of
658 * host:port pairs we _are_ trying to forward to, and reject a
659 * connection request from the server if it's not in the list.
660 *
2e85c969 661 * In SSH-2, each side of the connection minds its own business and
bc240b21 662 * doesn't send unnecessary information to the other. You arrange a
663 * remote forwarding by sending the server just the remote port
664 * number. When a connection comes in, the server tells you which
665 * of its ports was connected to; and _you_ have to remember what
666 * local host:port pair went with that port number.
667 *
2e85c969 668 * Hence, in SSH-1 this structure is indexed by destination
669 * host:port pair, whereas in SSH-2 it is indexed by source port.
d74d141c 670 */
fda2feb1 671struct ssh_portfwd; /* forward declaration */
672
d74d141c 673struct ssh_rportfwd {
bc240b21 674 unsigned sport, dport;
675 char dhost[256];
06fadff5 676 char *sportdesc;
fda2feb1 677 struct ssh_portfwd *pfrec;
d74d141c 678};
fda2feb1 679#define free_rportfwd(pf) ( \
680 ((pf) ? (sfree((pf)->sportdesc)) : (void)0 ), sfree(pf) )
681
682/*
683 * Separately to the rportfwd tree (which is for looking up port
684 * open requests from the server), a tree of _these_ structures is
685 * used to keep track of all the currently open port forwardings,
686 * so that we can reconfigure in mid-session if the user requests
687 * it.
688 */
689struct ssh_portfwd {
84328ddb 690 enum { DESTROY, KEEP, CREATE } status;
fda2feb1 691 int type;
692 unsigned sport, dport;
693 char *saddr, *daddr;
3fe92132 694 char *sserv, *dserv;
fda2feb1 695 struct ssh_rportfwd *remote;
05581745 696 int addressfamily;
fda2feb1 697 void *local;
698};
699#define free_portfwd(pf) ( \
3fe92132 700 ((pf) ? (sfree((pf)->saddr), sfree((pf)->daddr), \
701 sfree((pf)->sserv), sfree((pf)->dserv)) : (void)0 ), sfree(pf) )
d74d141c 702
57476f6b 703struct Packet {
dacd8872 704 long length; /* length of `data' actually used */
705 long forcepad; /* SSH-2: force padding to at least this length */
706 int type; /* only used for incoming packets */
707 unsigned long sequence; /* SSH-2 incoming sequence number */
708 unsigned char *data; /* allocated storage */
709 unsigned char *body; /* offset of payload within `data' */
710 long savedpos; /* temporary index into `data' (for strings) */
711 long maxlen; /* amount of storage allocated for `data' */
712 long encrypted_len; /* for SSH-2 total-size counting */
ff3187f6 713
714 /*
715 * State associated with packet logging
716 */
717 int logmode;
718 int nblanks;
719 struct logblank_t *blanks;
57476f6b 720};
721
1c1a7262 722static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
ff3187f6 723 struct Packet *pktin);
1c1a7262 724static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
ff3187f6 725 struct Packet *pktin);
b09eaa88 726static void ssh1_protocol_setup(Ssh ssh);
727static void ssh2_protocol_setup(Ssh ssh);
51470298 728static void ssh_size(void *handle, int width, int height);
729static void ssh_special(void *handle, Telnet_Special);
5471d09a 730static int ssh2_try_send(struct ssh_channel *c);
51470298 731static void ssh2_add_channel_data(struct ssh_channel *c, char *buf, int len);
732static void ssh_throttle_all(Ssh ssh, int enable, int bufsize);
9fca3f8c 733static void ssh2_set_window(struct ssh_channel *c, int newwin);
51470298 734static int ssh_sendbuffer(void *handle);
ac934965 735static int ssh_do_close(Ssh ssh, int notify_exit);
ff3187f6 736static unsigned long ssh_pkt_getuint32(struct Packet *pkt);
737static int ssh2_pkt_getbool(struct Packet *pkt);
738static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length);
9442dd57 739static void ssh2_timer(void *ctx, long now);
1c1a7262 740static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
9442dd57 741 struct Packet *pktin);
57476f6b 742
51470298 743struct rdpkt1_state_tag {
57476f6b 744 long len, pad, biglen, to_read;
745 unsigned long realcrc, gotcrc;
746 unsigned char *p;
747 int i;
748 int chunk;
ff3187f6 749 struct Packet *pktin;
51470298 750};
57476f6b 751
51470298 752struct rdpkt2_state_tag {
960e736a 753 long len, pad, payload, packetlen, maclen;
754 int i;
755 int cipherblk;
756 unsigned long incoming_sequence;
ff3187f6 757 struct Packet *pktin;
51470298 758};
759
b09eaa88 760typedef void (*handler_fn_t)(Ssh ssh, struct Packet *pktin);
06fadff5 761typedef void (*chandler_fn_t)(Ssh ssh, struct Packet *pktin, void *ctx);
762
763struct queued_handler;
764struct queued_handler {
765 int msg1, msg2;
766 chandler_fn_t handler;
767 void *ctx;
768 struct queued_handler *next;
769};
b09eaa88 770
51470298 771struct ssh_tag {
772 const struct plug_function_table *fn;
773 /* the above field _must_ be first in the structure */
774
4320baf7 775 char *v_c, *v_s;
b672f405 776 void *exhash;
51470298 777
778 Socket s;
779
b9d7bcad 780 void *ldisc;
a8327734 781 void *logctx;
b9d7bcad 782
51470298 783 unsigned char session_key[32];
784 int v1_compressing;
785 int v1_remote_protoflags;
786 int v1_local_protoflags;
787 int agentfwd_enabled;
788 int X11_fwd_enabled;
789 int remote_bugs;
790 const struct ssh_cipher *cipher;
371e569c 791 void *v1_cipher_ctx;
0183b242 792 void *crcda_ctx;
51470298 793 const struct ssh2_cipher *cscipher, *sccipher;
371e569c 794 void *cs_cipher_ctx, *sc_cipher_ctx;
51470298 795 const struct ssh_mac *csmac, *scmac;
e0e1a00d 796 void *cs_mac_ctx, *sc_mac_ctx;
51470298 797 const struct ssh_compress *cscomp, *sccomp;
5366aed8 798 void *cs_comp_ctx, *sc_comp_ctx;
51470298 799 const struct ssh_kex *kex;
800 const struct ssh_signkey *hostkey;
754c0df9 801 unsigned char v2_session_id[SSH2_KEX_MAX_HASH_LEN];
b672f405 802 int v2_session_id_len;
27cd7fc2 803 void *kex_ctx;
51470298 804
805 char *savedhost;
806 int savedport;
807 int send_ok;
808 int echoing, editing;
809
810 void *frontend;
811
db219738 812 int ospeed, ispeed; /* temporaries */
51470298 813 int term_width, term_height;
814
815 tree234 *channels; /* indexed by local id */
816 struct ssh_channel *mainchan; /* primary session channel */
feb02b4e 817 int ncmode; /* is primary channel direct-tcpip? */
51470298 818 int exitcode;
ac934965 819 int close_expected;
9e296bfa 820 int clean_exit;
51470298 821
fda2feb1 822 tree234 *rportfwds, *portfwds;
51470298 823
824 enum {
825 SSH_STATE_PREPACKET,
826 SSH_STATE_BEFORE_SIZE,
827 SSH_STATE_INTERMED,
828 SSH_STATE_SESSION,
829 SSH_STATE_CLOSED
830 } state;
831
832 int size_needed, eof_needed;
833
590f6a5f 834 struct Packet **queue;
835 int queuelen, queuesize;
836 int queueing;
51470298 837 unsigned char *deferred_send_data;
838 int deferred_len, deferred_size;
839
840 /*
841 * Gross hack: pscp will try to start SFTP but fall back to
842 * scp1 if that fails. This variable is the means by which
843 * scp.c can reach into the SSH code and find out which one it
844 * got.
845 */
846 int fallback_cmd;
847
6bbce591 848 bufchain banner; /* accumulates banners during do_ssh2_authconn */
51470298 849
acab36bc 850 Pkt_KCtx pkt_kctx;
851 Pkt_ACtx pkt_actx;
51470298 852
8def70c3 853 struct X11Display *x11disp;
302121de 854
51470298 855 int version;
ff68564b 856 int conn_throttle_count;
51470298 857 int overall_bufsize;
858 int throttled_all;
859 int v1_stdout_throttling;
a8756193 860 unsigned long v2_outgoing_sequence;
51470298 861
862 int ssh1_rdpkt_crstate;
863 int ssh2_rdpkt_crstate;
864 int do_ssh_init_crstate;
865 int ssh_gotdata_crstate;
51470298 866 int do_ssh1_login_crstate;
b09eaa88 867 int do_ssh1_connection_crstate;
51470298 868 int do_ssh2_transport_crstate;
869 int do_ssh2_authconn_crstate;
870
871 void *do_ssh_init_state;
872 void *do_ssh1_login_state;
873 void *do_ssh2_transport_state;
874 void *do_ssh2_authconn_state;
875
876 struct rdpkt1_state_tag rdpkt1_state;
877 struct rdpkt2_state_tag rdpkt2_state;
878
2e85c969 879 /* SSH-1 and SSH-2 use this for different things, but both use it */
b09eaa88 880 int protocol_initial_phase_done;
881
1c1a7262 882 void (*protocol) (Ssh ssh, void *vin, int inlen,
ff3187f6 883 struct Packet *pkt);
884 struct Packet *(*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen);
86916870 885
886 /*
4a693cfc 887 * We maintain our own copy of a Conf structure here. That way,
888 * when we're passed a new one for reconfiguration, we can check
889 * the differences and potentially reconfigure port forwardings
890 * etc in mid-session.
86916870 891 */
4a693cfc 892 Conf *conf;
893
894 /*
895 * Values cached out of conf so as to avoid the tree234 lookup
896 * cost every time they're used.
897 */
898 int logomitdata;
899
900 /*
901 * Dynamically allocated username string created during SSH
902 * login. Stored in here rather than in the coroutine state so
903 * that it'll be reliably freed if we shut down the SSH session
904 * at some unexpected moment.
905 */
906 char *username;
839f10db 907
908 /*
3d9449a1 909 * Used to transfer data back from async callbacks.
839f10db 910 */
911 void *agent_response;
912 int agent_response_len;
3d9449a1 913 int user_response;
914
915 /*
916 * The SSH connection can be set as `frozen', meaning we are
917 * not currently accepting incoming data from the network. This
918 * is slightly more serious than setting the _socket_ as
919 * frozen, because we may already have had data passed to us
920 * from the network which we need to delay processing until
921 * after the freeze is lifted, so we also need a bufchain to
922 * store that data.
923 */
924 int frozen;
925 bufchain queued_incoming_data;
b09eaa88 926
927 /*
928 * Dispatch table for packet types that we may have to deal
929 * with at any time.
930 */
931 handler_fn_t packet_dispatch[256];
39934deb 932
933 /*
06fadff5 934 * Queues of one-off handler functions for success/failure
935 * indications from a request.
936 */
937 struct queued_handler *qhead, *qtail;
938
939 /*
39934deb 940 * This module deals with sending keepalives.
941 */
942 Pinger pinger;
9442dd57 943
944 /*
945 * Track incoming and outgoing data sizes and time, for
946 * size-based rekeys.
947 */
948 unsigned long incoming_data_size, outgoing_data_size, deferred_data_size;
d57f70af 949 unsigned long max_data_size;
9442dd57 950 int kex_in_progress;
e6c1536e 951 long next_rekey, last_rekey;
e13bba36 952 char *deferred_rekey_reason; /* points to STATIC string; don't free */
42af6a67 953
954 /*
955 * Fully qualified host name, which we need if doing GSSAPI.
956 */
957 char *fullhostname;
1e00c92b 958
959#ifndef NO_GSSAPI
960 /*
961 * GSSAPI libraries for this session.
962 */
963 struct ssh_gss_liblist *gsslibs;
964#endif
51470298 965};
960e736a 966
382908ad 967#define logevent(s) logevent(ssh->frontend, s)
a8327734 968
969/* logevent, only printf-formatted. */
cbe2d68f 970static void logeventf(Ssh ssh, const char *fmt, ...)
a8327734 971{
972 va_list ap;
57356d63 973 char *buf;
a8327734 974
975 va_start(ap, fmt);
57356d63 976 buf = dupvprintf(fmt, ap);
a8327734 977 va_end(ap);
57356d63 978 logevent(buf);
57356d63 979 sfree(buf);
a8327734 980}
981
6b5cf8b4 982#define bombout(msg) \
983 do { \
984 char *text = dupprintf msg; \
ac934965 985 ssh_do_close(ssh, FALSE); \
6b5cf8b4 986 logevent(text); \
987 connection_fatal(ssh->frontend, "%s", text); \
988 sfree(text); \
989 } while (0)
a8327734 990
9a10ecf4 991/* Functions to leave bits out of the SSH packet log file. */
992
ff3187f6 993static void dont_log_password(Ssh ssh, struct Packet *pkt, int blanktype)
9a10ecf4 994{
4a693cfc 995 if (conf_get_int(ssh->conf, CONF_logomitpass))
ff3187f6 996 pkt->logmode = blanktype;
9a10ecf4 997}
998
ff3187f6 999static void dont_log_data(Ssh ssh, struct Packet *pkt, int blanktype)
9a10ecf4 1000{
4a693cfc 1001 if (ssh->logomitdata)
ff3187f6 1002 pkt->logmode = blanktype;
9a10ecf4 1003}
1004
ff3187f6 1005static void end_log_omission(Ssh ssh, struct Packet *pkt)
9a10ecf4 1006{
ff3187f6 1007 pkt->logmode = PKTLOG_EMIT;
9a10ecf4 1008}
1009
4a693cfc 1010/* Helper function for common bits of parsing ttymodes. */
1011static void parse_ttymodes(Ssh ssh,
c6ccd5c2 1012 void (*do_mode)(void *data, char *mode, char *val),
1013 void *data)
1014{
4a693cfc 1015 char *key, *val;
1016
1017 for (val = conf_get_str_strs(ssh->conf, CONF_ttymodes, NULL, &key);
1018 val != NULL;
1019 val = conf_get_str_strs(ssh->conf, CONF_ttymodes, key, &key)) {
1020 /*
1021 * val[0] is either 'V', indicating that an explicit value
1022 * follows it, or 'A' indicating that we should pass the
1023 * value through from the local environment via get_ttymode.
1024 */
1025 if (val[0] == 'A')
1026 val = get_ttymode(ssh->frontend, key);
c6ccd5c2 1027 else
4a693cfc 1028 val++; /* skip the 'V' */
c6ccd5c2 1029 if (val)
4a693cfc 1030 do_mode(data, key, val);
c6ccd5c2 1031 }
1032}
1033
32874aea 1034static int ssh_channelcmp(void *av, void *bv)
1035{
1036 struct ssh_channel *a = (struct ssh_channel *) av;
1037 struct ssh_channel *b = (struct ssh_channel *) bv;
1038 if (a->localid < b->localid)
1039 return -1;
1040 if (a->localid > b->localid)
1041 return +1;
dacbd0e8 1042 return 0;
1043}
32874aea 1044static int ssh_channelfind(void *av, void *bv)
1045{
1046 unsigned *a = (unsigned *) av;
1047 struct ssh_channel *b = (struct ssh_channel *) bv;
1048 if (*a < b->localid)
1049 return -1;
1050 if (*a > b->localid)
1051 return +1;
dacbd0e8 1052 return 0;
1053}
1054
bc240b21 1055static int ssh_rportcmp_ssh1(void *av, void *bv)
d74d141c 1056{
1057 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
1058 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
1059 int i;
bc240b21 1060 if ( (i = strcmp(a->dhost, b->dhost)) != 0)
d74d141c 1061 return i < 0 ? -1 : +1;
bc240b21 1062 if (a->dport > b->dport)
1063 return +1;
1064 if (a->dport < b->dport)
1065 return -1;
1066 return 0;
1067}
1068
1069static int ssh_rportcmp_ssh2(void *av, void *bv)
1070{
1071 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
1072 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
cdcbdf3b 1073
bc240b21 1074 if (a->sport > b->sport)
d74d141c 1075 return +1;
bc240b21 1076 if (a->sport < b->sport)
1077 return -1;
d74d141c 1078 return 0;
1079}
1080
fda2feb1 1081/*
1082 * Special form of strcmp which can cope with NULL inputs. NULL is
1083 * defined to sort before even the empty string.
1084 */
1085static int nullstrcmp(const char *a, const char *b)
1086{
1087 if (a == NULL && b == NULL)
1088 return 0;
1089 if (a == NULL)
1090 return -1;
1091 if (b == NULL)
1092 return +1;
1093 return strcmp(a, b);
1094}
1095
1096static int ssh_portcmp(void *av, void *bv)
1097{
1098 struct ssh_portfwd *a = (struct ssh_portfwd *) av;
1099 struct ssh_portfwd *b = (struct ssh_portfwd *) bv;
1100 int i;
1101 if (a->type > b->type)
1102 return +1;
1103 if (a->type < b->type)
1104 return -1;
84328ddb 1105 if (a->addressfamily > b->addressfamily)
1106 return +1;
1107 if (a->addressfamily < b->addressfamily)
1108 return -1;
fda2feb1 1109 if ( (i = nullstrcmp(a->saddr, b->saddr)) != 0)
1110 return i < 0 ? -1 : +1;
1111 if (a->sport > b->sport)
1112 return +1;
1113 if (a->sport < b->sport)
1114 return -1;
1115 if (a->type != 'D') {
1116 if ( (i = nullstrcmp(a->daddr, b->daddr)) != 0)
1117 return i < 0 ? -1 : +1;
1118 if (a->dport > b->dport)
1119 return +1;
1120 if (a->dport < b->dport)
1121 return -1;
1122 }
1123 return 0;
1124}
1125
51470298 1126static int alloc_channel_id(Ssh ssh)
32874aea 1127{
260f3dec 1128 const unsigned CHANNEL_NUMBER_OFFSET = 256;
1129 unsigned low, high, mid;
d2371c81 1130 int tsize;
1131 struct ssh_channel *c;
1132
1133 /*
1134 * First-fit allocation of channel numbers: always pick the
1135 * lowest unused one. To do this, binary-search using the
1136 * counted B-tree to find the largest channel ID which is in a
1137 * contiguous sequence from the beginning. (Precisely
1138 * everything in that sequence must have ID equal to its tree
1139 * index plus CHANNEL_NUMBER_OFFSET.)
1140 */
51470298 1141 tsize = count234(ssh->channels);
d2371c81 1142
32874aea 1143 low = -1;
1144 high = tsize;
d2371c81 1145 while (high - low > 1) {
1146 mid = (high + low) / 2;
51470298 1147 c = index234(ssh->channels, mid);
d2371c81 1148 if (c->localid == mid + CHANNEL_NUMBER_OFFSET)
1149 low = mid; /* this one is fine */
1150 else
1151 high = mid; /* this one is past it */
1152 }
1153 /*
1154 * Now low points to either -1, or the tree index of the
1155 * largest ID in the initial sequence.
1156 */
1157 {
1158 unsigned i = low + 1 + CHANNEL_NUMBER_OFFSET;
51470298 1159 assert(NULL == find234(ssh->channels, &i, ssh_channelfind));
d2371c81 1160 }
1161 return low + 1 + CHANNEL_NUMBER_OFFSET;
1162}
1163
edd0cb8a 1164static void c_write_stderr(int trusted, const char *buf, int len)
1165{
1166 int i;
1167 for (i = 0; i < len; i++)
667deca9 1168 if (buf[i] != '\r' && (trusted || buf[i] == '\n' || (buf[i] & 0x60)))
edd0cb8a 1169 fputc(buf[i], stderr);
1170}
1171
9fab77dc 1172static void c_write(Ssh ssh, const char *buf, int len)
32874aea 1173{
edd0cb8a 1174 if (flags & FLAG_STDERR)
1175 c_write_stderr(1, buf, len);
1176 else
1177 from_backend(ssh->frontend, 1, buf, len);
3bdaf79d 1178}
1179
9fab77dc 1180static void c_write_untrusted(Ssh ssh, const char *buf, int len)
32874aea 1181{
edd0cb8a 1182 if (flags & FLAG_STDERR)
1183 c_write_stderr(0, buf, len);
1184 else
1185 from_backend_untrusted(ssh->frontend, buf, len);
a209e957 1186}
1187
9fab77dc 1188static void c_write_str(Ssh ssh, const char *buf)
32874aea 1189{
51470298 1190 c_write(ssh, buf, strlen(buf));
1408a877 1191}
1192
ff3187f6 1193static void ssh_free_packet(struct Packet *pkt)
1194{
1195 sfree(pkt->data);
1196 sfree(pkt);
1197}
1198static struct Packet *ssh_new_packet(void)
1199{
1200 struct Packet *pkt = snew(struct Packet);
1201
dacd8872 1202 pkt->body = pkt->data = NULL;
ff3187f6 1203 pkt->maxlen = 0;
1204 pkt->logmode = PKTLOG_EMIT;
1205 pkt->nblanks = 0;
1206 pkt->blanks = NULL;
1207
1208 return pkt;
1209}
1210
fb09bf1c 1211/*
1212 * Collect incoming data in the incoming packet buffer.
e5574168 1213 * Decipher and verify the packet when it is completely read.
1214 * Drop SSH1_MSG_DEBUG and SSH1_MSG_IGNORE packets.
fb09bf1c 1215 * Update the *data and *datalen variables.
ff3187f6 1216 * Return a Packet structure when a packet is completed.
fb09bf1c 1217 */
ff3187f6 1218static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
fb09bf1c 1219{
51470298 1220 struct rdpkt1_state_tag *st = &ssh->rdpkt1_state;
374330e2 1221
51470298 1222 crBegin(ssh->ssh1_rdpkt_crstate);
374330e2 1223
ff3187f6 1224 st->pktin = ssh_new_packet();
1225
1226 st->pktin->type = 0;
1227 st->pktin->length = 0;
374330e2 1228
57476f6b 1229 for (st->i = st->len = 0; st->i < 4; st->i++) {
fb09bf1c 1230 while ((*datalen) == 0)
ff3187f6 1231 crReturn(NULL);
57476f6b 1232 st->len = (st->len << 8) + **data;
fb09bf1c 1233 (*data)++, (*datalen)--;
1234 }
374330e2 1235
57476f6b 1236 st->pad = 8 - (st->len % 8);
1237 st->biglen = st->len + st->pad;
ff3187f6 1238 st->pktin->length = st->len - 5;
fb09bf1c 1239
ae0500e5 1240 if (st->biglen < 0) {
1241 bombout(("Extremely large packet length from server suggests"
1242 " data stream corruption"));
ff3187f6 1243 ssh_free_packet(st->pktin);
1244 crStop(NULL);
ae0500e5 1245 }
1246
ff3187f6 1247 st->pktin->maxlen = st->biglen;
1248 st->pktin->data = snewn(st->biglen + APIEXTRA, unsigned char);
374330e2 1249
57476f6b 1250 st->to_read = st->biglen;
ff3187f6 1251 st->p = st->pktin->data;
57476f6b 1252 while (st->to_read > 0) {
32874aea 1253 st->chunk = st->to_read;
fb09bf1c 1254 while ((*datalen) == 0)
ff3187f6 1255 crReturn(NULL);
57476f6b 1256 if (st->chunk > (*datalen))
1257 st->chunk = (*datalen);
1258 memcpy(st->p, *data, st->chunk);
1259 *data += st->chunk;
1260 *datalen -= st->chunk;
1261 st->p += st->chunk;
1262 st->to_read -= st->chunk;
fb09bf1c 1263 }
374330e2 1264
ff3187f6 1265 if (ssh->cipher && detect_attack(ssh->crcda_ctx, st->pktin->data,
0183b242 1266 st->biglen, NULL)) {
6b5cf8b4 1267 bombout(("Network attack (CRC compensation) detected!"));
ff3187f6 1268 ssh_free_packet(st->pktin);
1269 crStop(NULL);
9a3a93a5 1270 }
1271
51470298 1272 if (ssh->cipher)
ff3187f6 1273 ssh->cipher->decrypt(ssh->v1_cipher_ctx, st->pktin->data, st->biglen);
374330e2 1274
ff3187f6 1275 st->realcrc = crc32_compute(st->pktin->data, st->biglen - 4);
1276 st->gotcrc = GET_32BIT(st->pktin->data + st->biglen - 4);
57476f6b 1277 if (st->gotcrc != st->realcrc) {
6b5cf8b4 1278 bombout(("Incorrect CRC received on packet"));
ff3187f6 1279 ssh_free_packet(st->pktin);
1280 crStop(NULL);
fb09bf1c 1281 }
572f871e 1282
ff3187f6 1283 st->pktin->body = st->pktin->data + st->pad + 1;
1284 st->pktin->savedpos = 0;
4ba9b64b 1285
51470298 1286 if (ssh->v1_compressing) {
4ba9b64b 1287 unsigned char *decompblk;
1288 int decomplen;
36b8d9bb 1289 if (!zlib_decompress_block(ssh->sc_comp_ctx,
ff3187f6 1290 st->pktin->body - 1, st->pktin->length + 1,
36b8d9bb 1291 &decompblk, &decomplen)) {
1292 bombout(("Zlib decompression encountered invalid data"));
ff3187f6 1293 ssh_free_packet(st->pktin);
1294 crStop(NULL);
36b8d9bb 1295 }
4ba9b64b 1296
ff3187f6 1297 if (st->pktin->maxlen < st->pad + decomplen) {
1298 st->pktin->maxlen = st->pad + decomplen;
1299 st->pktin->data = sresize(st->pktin->data,
1300 st->pktin->maxlen + APIEXTRA,
3d88e64d 1301 unsigned char);
ff3187f6 1302 st->pktin->body = st->pktin->data + st->pad + 1;
4ba9b64b 1303 }
1304
ff3187f6 1305 memcpy(st->pktin->body - 1, decompblk, decomplen);
dcbde236 1306 sfree(decompblk);
ff3187f6 1307 st->pktin->length = decomplen - 1;
4ba9b64b 1308 }
1309
ff3187f6 1310 st->pktin->type = st->pktin->body[-1];
00db133f 1311
9a10ecf4 1312 /*
1313 * Log incoming packet, possibly omitting sensitive fields.
1314 */
1315 if (ssh->logctx) {
1316 int nblanks = 0;
1317 struct logblank_t blank;
4a693cfc 1318 if (ssh->logomitdata) {
9a10ecf4 1319 int do_blank = FALSE, blank_prefix = 0;
1320 /* "Session data" packets - omit the data field */
ff3187f6 1321 if ((st->pktin->type == SSH1_SMSG_STDOUT_DATA) ||
1322 (st->pktin->type == SSH1_SMSG_STDERR_DATA)) {
9a10ecf4 1323 do_blank = TRUE; blank_prefix = 4;
a2724fba 1324 } else if (st->pktin->type == SSH1_MSG_CHANNEL_DATA) {
1325 do_blank = TRUE; blank_prefix = 8;
9a10ecf4 1326 }
1327 if (do_blank) {
1328 blank.offset = blank_prefix;
ff3187f6 1329 blank.len = st->pktin->length;
9a10ecf4 1330 blank.type = PKTLOG_OMIT;
1331 nblanks = 1;
1332 }
1333 }
a8327734 1334 log_packet(ssh->logctx,
ff3187f6 1335 PKT_INCOMING, st->pktin->type,
1336 ssh1_pkt_type(st->pktin->type),
1337 st->pktin->body, st->pktin->length,
0d13bfcd 1338 nblanks, &blank, NULL);
9a10ecf4 1339 }
00db133f 1340
ff3187f6 1341 crFinish(st->pktin);
fb09bf1c 1342}
1343
ff3187f6 1344static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
e5574168 1345{
51470298 1346 struct rdpkt2_state_tag *st = &ssh->rdpkt2_state;
e5574168 1347
51470298 1348 crBegin(ssh->ssh2_rdpkt_crstate);
e5574168 1349
ff3187f6 1350 st->pktin = ssh_new_packet();
1351
1352 st->pktin->type = 0;
1353 st->pktin->length = 0;
51470298 1354 if (ssh->sccipher)
1355 st->cipherblk = ssh->sccipher->blksize;
e5574168 1356 else
32874aea 1357 st->cipherblk = 8;
960e736a 1358 if (st->cipherblk < 8)
32874aea 1359 st->cipherblk = 8;
9916cc1e 1360 st->maclen = ssh->scmac ? ssh->scmac->len : 0;
960e736a 1361
9916cc1e 1362 if (ssh->sccipher && (ssh->sccipher->flags & SSH_CIPHER_IS_CBC) &&
1363 ssh->scmac) {
1364 /*
1365 * When dealing with a CBC-mode cipher, we want to avoid the
1366 * possibility of an attacker's tweaking the ciphertext stream
1367 * so as to cause us to feed the same block to the block
1368 * cipher more than once and thus leak information
1369 * (VU#958563). The way we do this is not to take any
1370 * decisions on the basis of anything we've decrypted until
1371 * we've verified it with a MAC. That includes the packet
1372 * length, so we just read data and check the MAC repeatedly,
1373 * and when the MAC passes, see if the length we've got is
1374 * plausible.
1375 */
1376
1377 /* May as well allocate the whole lot now. */
1378 st->pktin->data = snewn(OUR_V2_PACKETLIMIT + st->maclen + APIEXTRA,
1379 unsigned char);
1380
1381 /* Read an amount corresponding to the MAC. */
1382 for (st->i = 0; st->i < st->maclen; st->i++) {
1383 while ((*datalen) == 0)
1384 crReturn(NULL);
1385 st->pktin->data[st->i] = *(*data)++;
1386 (*datalen)--;
1387 }
e5574168 1388
9916cc1e 1389 st->packetlen = 0;
1390 {
1391 unsigned char seq[4];
1392 ssh->scmac->start(ssh->sc_mac_ctx);
1393 PUT_32BIT(seq, st->incoming_sequence);
1394 ssh->scmac->bytes(ssh->sc_mac_ctx, seq, 4);
1395 }
4252c9cc 1396
9916cc1e 1397 for (;;) { /* Once around this loop per cipher block. */
1398 /* Read another cipher-block's worth, and tack it onto the end. */
1399 for (st->i = 0; st->i < st->cipherblk; st->i++) {
1400 while ((*datalen) == 0)
1401 crReturn(NULL);
1402 st->pktin->data[st->packetlen+st->maclen+st->i] = *(*data)++;
1403 (*datalen)--;
1404 }
1405 /* Decrypt one more block (a little further back in the stream). */
1406 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1407 st->pktin->data + st->packetlen,
1408 st->cipherblk);
1409 /* Feed that block to the MAC. */
1410 ssh->scmac->bytes(ssh->sc_mac_ctx,
1411 st->pktin->data + st->packetlen, st->cipherblk);
1412 st->packetlen += st->cipherblk;
1413 /* See if that gives us a valid packet. */
1414 if (ssh->scmac->verresult(ssh->sc_mac_ctx,
1415 st->pktin->data + st->packetlen) &&
1416 (st->len = GET_32BIT(st->pktin->data)) + 4 == st->packetlen)
1417 break;
1418 if (st->packetlen >= OUR_V2_PACKETLIMIT) {
1419 bombout(("No valid incoming packet found"));
1420 ssh_free_packet(st->pktin);
1421 crStop(NULL);
1422 }
1423 }
1424 st->pktin->maxlen = st->packetlen + st->maclen;
1425 st->pktin->data = sresize(st->pktin->data,
1426 st->pktin->maxlen + APIEXTRA,
1427 unsigned char);
1428 } else {
1429 st->pktin->data = snewn(st->cipherblk + APIEXTRA, unsigned char);
1430
1431 /*
1432 * Acquire and decrypt the first block of the packet. This will
1433 * contain the length and padding details.
1434 */
1435 for (st->i = st->len = 0; st->i < st->cipherblk; st->i++) {
1436 while ((*datalen) == 0)
1437 crReturn(NULL);
1438 st->pktin->data[st->i] = *(*data)++;
1439 (*datalen)--;
1440 }
e5574168 1441
9916cc1e 1442 if (ssh->sccipher)
1443 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1444 st->pktin->data, st->cipherblk);
1445
1446 /*
1447 * Now get the length figure.
1448 */
1449 st->len = GET_32BIT(st->pktin->data);
1450
1451 /*
1452 * _Completely_ silly lengths should be stomped on before they
1453 * do us any more damage.
1454 */
1455 if (st->len < 0 || st->len > OUR_V2_PACKETLIMIT ||
1456 (st->len + 4) % st->cipherblk != 0) {
1457 bombout(("Incoming packet was garbled on decryption"));
1458 ssh_free_packet(st->pktin);
1459 crStop(NULL);
1460 }
e5574168 1461
9916cc1e 1462 /*
1463 * So now we can work out the total packet length.
1464 */
1465 st->packetlen = st->len + 4;
1466
1467 /*
1468 * Allocate memory for the rest of the packet.
1469 */
1470 st->pktin->maxlen = st->packetlen + st->maclen;
1471 st->pktin->data = sresize(st->pktin->data,
1472 st->pktin->maxlen + APIEXTRA,
1473 unsigned char);
1474
1475 /*
1476 * Read and decrypt the remainder of the packet.
1477 */
1478 for (st->i = st->cipherblk; st->i < st->packetlen + st->maclen;
1479 st->i++) {
1480 while ((*datalen) == 0)
1481 crReturn(NULL);
1482 st->pktin->data[st->i] = *(*data)++;
1483 (*datalen)--;
1484 }
1485 /* Decrypt everything _except_ the MAC. */
1486 if (ssh->sccipher)
1487 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1488 st->pktin->data + st->cipherblk,
1489 st->packetlen - st->cipherblk);
1490
1491 /*
1492 * Check the MAC.
1493 */
1494 if (ssh->scmac
1495 && !ssh->scmac->verify(ssh->sc_mac_ctx, st->pktin->data,
1496 st->len + 4, st->incoming_sequence)) {
1497 bombout(("Incorrect MAC received on packet"));
1498 ssh_free_packet(st->pktin);
1499 crStop(NULL);
1500 }
1501 }
1502 /* Get and sanity-check the amount of random padding. */
1503 st->pad = st->pktin->data[4];
1504 if (st->pad < 4 || st->len - st->pad < 1) {
1505 bombout(("Invalid padding length on received packet"));
ff3187f6 1506 ssh_free_packet(st->pktin);
1507 crStop(NULL);
717dc483 1508 }
717dc483 1509 /*
e5574168 1510 * This enables us to deduce the payload length.
1511 */
960e736a 1512 st->payload = st->len - st->pad - 1;
e5574168 1513
ff3187f6 1514 st->pktin->length = st->payload + 5;
9442dd57 1515 st->pktin->encrypted_len = st->packetlen;
1516
b09eaa88 1517 st->pktin->sequence = st->incoming_sequence++;
e5574168 1518
4ba9b64b 1519 /*
1520 * Decompress packet payload.
1521 */
1522 {
1523 unsigned char *newpayload;
1524 int newlen;
51470298 1525 if (ssh->sccomp &&
5366aed8 1526 ssh->sccomp->decompress(ssh->sc_comp_ctx,
ff3187f6 1527 st->pktin->data + 5, st->pktin->length - 5,
51470298 1528 &newpayload, &newlen)) {
ff3187f6 1529 if (st->pktin->maxlen < newlen + 5) {
1530 st->pktin->maxlen = newlen + 5;
1531 st->pktin->data = sresize(st->pktin->data,
1532 st->pktin->maxlen + APIEXTRA,
3d88e64d 1533 unsigned char);
4ba9b64b 1534 }
ff3187f6 1535 st->pktin->length = 5 + newlen;
1536 memcpy(st->pktin->data + 5, newpayload, newlen);
dcbde236 1537 sfree(newpayload);
4ba9b64b 1538 }
1539 }
1540
ff3187f6 1541 st->pktin->savedpos = 6;
1542 st->pktin->body = st->pktin->data;
1543 st->pktin->type = st->pktin->data[5];
e5574168 1544
9a10ecf4 1545 /*
1546 * Log incoming packet, possibly omitting sensitive fields.
1547 */
1548 if (ssh->logctx) {
1549 int nblanks = 0;
1550 struct logblank_t blank;
4a693cfc 1551 if (ssh->logomitdata) {
9a10ecf4 1552 int do_blank = FALSE, blank_prefix = 0;
1553 /* "Session data" packets - omit the data field */
ff3187f6 1554 if (st->pktin->type == SSH2_MSG_CHANNEL_DATA) {
9a10ecf4 1555 do_blank = TRUE; blank_prefix = 8;
a2724fba 1556 } else if (st->pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA) {
1557 do_blank = TRUE; blank_prefix = 12;
9a10ecf4 1558 }
1559 if (do_blank) {
1560 blank.offset = blank_prefix;
ff3187f6 1561 blank.len = (st->pktin->length-6) - blank_prefix;
9a10ecf4 1562 blank.type = PKTLOG_OMIT;
1563 nblanks = 1;
1564 }
1565 }
ff3187f6 1566 log_packet(ssh->logctx, PKT_INCOMING, st->pktin->type,
acab36bc 1567 ssh2_pkt_type(ssh->pkt_kctx, ssh->pkt_actx,
1568 st->pktin->type),
ff3187f6 1569 st->pktin->data+6, st->pktin->length-6,
0d13bfcd 1570 nblanks, &blank, &st->pktin->sequence);
9a10ecf4 1571 }
00db133f 1572
ff3187f6 1573 crFinish(st->pktin);
e5574168 1574}
1575
dacd8872 1576static int s_wrpkt_prepare(Ssh ssh, struct Packet *pkt, int *offset_p)
32874aea 1577{
dacd8872 1578 int pad, biglen, i, pktoffs;
374330e2 1579 unsigned long crc;
fd7a4aad 1580#ifdef __SC__
1581 /*
1582 * XXX various versions of SC (including 8.8.4) screw up the
1583 * register allocation in this function and use the same register
1584 * (D6) for len and as a temporary, with predictable results. The
1585 * following sledgehammer prevents this.
1586 */
1587 volatile
1588#endif
1589 int len;
374330e2 1590
a8327734 1591 if (ssh->logctx)
dacd8872 1592 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[12],
1593 ssh1_pkt_type(pkt->data[12]),
1594 pkt->body, pkt->length - (pkt->body - pkt->data),
0d13bfcd 1595 pkt->nblanks, pkt->blanks, NULL);
ff3187f6 1596 sfree(pkt->blanks); pkt->blanks = NULL;
1597 pkt->nblanks = 0;
00db133f 1598
51470298 1599 if (ssh->v1_compressing) {
4ba9b64b 1600 unsigned char *compblk;
1601 int complen;
5366aed8 1602 zlib_compress_block(ssh->cs_comp_ctx,
dacd8872 1603 pkt->data + 12, pkt->length - 12,
4ba9b64b 1604 &compblk, &complen);
48406e6b 1605 ssh_pkt_ensure(pkt, complen + 2); /* just in case it's got bigger */
dacd8872 1606 memcpy(pkt->data + 12, compblk, complen);
dcbde236 1607 sfree(compblk);
dacd8872 1608 pkt->length = complen + 12;
4ba9b64b 1609 }
1610
dacd8872 1611 ssh_pkt_ensure(pkt, pkt->length + 4); /* space for CRC */
1612 pkt->length += 4;
1613 len = pkt->length - 4 - 8; /* len(type+data+CRC) */
32874aea 1614 pad = 8 - (len % 8);
dacd8872 1615 pktoffs = 8 - pad;
1616 biglen = len + pad; /* len(padding+type+data+CRC) */
374330e2 1617
dacd8872 1618 for (i = pktoffs; i < 4+8; i++)
1619 pkt->data[i] = random_byte();
1620 crc = crc32_compute(pkt->data + pktoffs + 4, biglen - 4); /* all ex len */
1621 PUT_32BIT(pkt->data + pktoffs + 4 + biglen - 4, crc);
1622 PUT_32BIT(pkt->data + pktoffs, len);
374330e2 1623
51470298 1624 if (ssh->cipher)
dacd8872 1625 ssh->cipher->encrypt(ssh->v1_cipher_ctx,
1626 pkt->data + pktoffs + 4, biglen);
374330e2 1627
dacd8872 1628 if (offset_p) *offset_p = pktoffs;
1629 return biglen + 4; /* len(length+padding+type+data+CRC) */
39065bed 1630}
1631
bf8a49a1 1632static int s_write(Ssh ssh, void *data, int len)
1633{
ff05dfef 1634 if (ssh->logctx)
0d13bfcd 1635 log_packet(ssh->logctx, PKT_OUTGOING, -1, NULL, data, len,
1636 0, NULL, NULL);
bf8a49a1 1637 return sk_write(ssh->s, (char *)data, len);
1638}
1639
ff3187f6 1640static void s_wrpkt(Ssh ssh, struct Packet *pkt)
32874aea 1641{
dacd8872 1642 int len, backlog, offset;
1643 len = s_wrpkt_prepare(ssh, pkt, &offset);
bf8a49a1 1644 backlog = s_write(ssh, pkt->data + offset, len);
5471d09a 1645 if (backlog > SSH_MAX_BACKLOG)
51470298 1646 ssh_throttle_all(ssh, 1, backlog);
dacd8872 1647 ssh_free_packet(pkt);
39065bed 1648}
1649
ff3187f6 1650static void s_wrpkt_defer(Ssh ssh, struct Packet *pkt)
32874aea 1651{
dacd8872 1652 int len, offset;
1653 len = s_wrpkt_prepare(ssh, pkt, &offset);
51470298 1654 if (ssh->deferred_len + len > ssh->deferred_size) {
1655 ssh->deferred_size = ssh->deferred_len + len + 128;
3d88e64d 1656 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
1657 ssh->deferred_size,
1658 unsigned char);
39065bed 1659 }
dacd8872 1660 memcpy(ssh->deferred_send_data + ssh->deferred_len,
1661 pkt->data + offset, len);
51470298 1662 ssh->deferred_len += len;
dacd8872 1663 ssh_free_packet(pkt);
374330e2 1664}
1665
fb09bf1c 1666/*
dacd8872 1667 * Construct a SSH-1 packet with the specified contents.
1668 * (This all-at-once interface used to be the only one, but now SSH-1
1669 * packets can also be constructed incrementally.)
fb09bf1c 1670 */
dacd8872 1671static struct Packet *construct_packet(Ssh ssh, int pkttype, va_list ap)
fb09bf1c 1672{
dacd8872 1673 int argtype;
7cca0d81 1674 Bignum bn;
ff3187f6 1675 struct Packet *pkt;
fb09bf1c 1676
dacd8872 1677 pkt = ssh1_pkt_init(pkttype);
fb09bf1c 1678
dacd8872 1679 while ((argtype = va_arg(ap, int)) != PKT_END) {
1680 unsigned char *argp, argchar;
8a9977e5 1681 char *sargp;
dacd8872 1682 unsigned long argint;
1683 int arglen;
fb09bf1c 1684 switch (argtype) {
9a10ecf4 1685 /* Actual fields in the packet */
fb09bf1c 1686 case PKT_INT:
dacd8872 1687 argint = va_arg(ap, int);
1688 ssh_pkt_adduint32(pkt, argint);
fb09bf1c 1689 break;
1690 case PKT_CHAR:
dacd8872 1691 argchar = (unsigned char) va_arg(ap, int);
1692 ssh_pkt_addbyte(pkt, argchar);
fb09bf1c 1693 break;
1694 case PKT_DATA:
dacd8872 1695 argp = va_arg(ap, unsigned char *);
1696 arglen = va_arg(ap, int);
1697 ssh_pkt_adddata(pkt, argp, arglen);
fb09bf1c 1698 break;
1699 case PKT_STR:
8a9977e5 1700 sargp = va_arg(ap, char *);
1701 ssh_pkt_addstring(pkt, sargp);
fb09bf1c 1702 break;
7cca0d81 1703 case PKT_BIGNUM:
dacd8872 1704 bn = va_arg(ap, Bignum);
1705 ssh1_pkt_addmp(pkt, bn);
9a10ecf4 1706 break;
1707 /* Tokens for modifications to packet logging */
1708 case PKTT_PASSWORD:
ff3187f6 1709 dont_log_password(ssh, pkt, PKTLOG_BLANK);
9a10ecf4 1710 break;
1711 case PKTT_DATA:
ff3187f6 1712 dont_log_data(ssh, pkt, PKTLOG_OMIT);
7cca0d81 1713 break;
9a10ecf4 1714 case PKTT_OTHER:
ff3187f6 1715 end_log_omission(ssh, pkt);
9a10ecf4 1716 break;
1717 }
fb09bf1c 1718 }
ff3187f6 1719
1720 return pkt;
39065bed 1721}
fb09bf1c 1722
51470298 1723static void send_packet(Ssh ssh, int pkttype, ...)
32874aea 1724{
ff3187f6 1725 struct Packet *pkt;
dacd8872 1726 va_list ap;
1727 va_start(ap, pkttype);
1728 pkt = construct_packet(ssh, pkttype, ap);
1729 va_end(ap);
ff3187f6 1730 s_wrpkt(ssh, pkt);
fb09bf1c 1731}
1732
51470298 1733static void defer_packet(Ssh ssh, int pkttype, ...)
32874aea 1734{
ff3187f6 1735 struct Packet *pkt;
dacd8872 1736 va_list ap;
1737 va_start(ap, pkttype);
1738 pkt = construct_packet(ssh, pkttype, ap);
1739 va_end(ap);
ff3187f6 1740 s_wrpkt_defer(ssh, pkt);
39065bed 1741}
1742
32874aea 1743static int ssh_versioncmp(char *a, char *b)
1744{
9697bfd2 1745 char *ae, *be;
1746 unsigned long av, bv;
1747
43aa02a7 1748 av = strtoul(a, &ae, 10);
1749 bv = strtoul(b, &be, 10);
32874aea 1750 if (av != bv)
1751 return (av < bv ? -1 : +1);
1752 if (*ae == '.')
1753 ae++;
1754 if (*be == '.')
1755 be++;
43aa02a7 1756 av = strtoul(ae, &ae, 10);
1757 bv = strtoul(be, &be, 10);
32874aea 1758 if (av != bv)
1759 return (av < bv ? -1 : +1);
9697bfd2 1760 return 0;
1761}
1762
e5574168 1763/*
a92dd380 1764 * Utility routines for putting an SSH-protocol `string' and
b672f405 1765 * `uint32' into a hash state.
e5574168 1766 */
b672f405 1767static void hash_string(const struct ssh_hash *h, void *s, void *str, int len)
32874aea 1768{
e5574168 1769 unsigned char lenblk[4];
e5574168 1770 PUT_32BIT(lenblk, len);
b672f405 1771 h->bytes(s, lenblk, 4);
1772 h->bytes(s, str, len);
e5574168 1773}
1774
b672f405 1775static void hash_uint32(const struct ssh_hash *h, void *s, unsigned i)
32874aea 1776{
a92dd380 1777 unsigned char intblk[4];
1778 PUT_32BIT(intblk, i);
b672f405 1779 h->bytes(s, intblk, 4);
a92dd380 1780}
1781
7cca0d81 1782/*
dacd8872 1783 * Packet construction functions. Mostly shared between SSH-1 and SSH-2.
7cca0d81 1784 */
dacd8872 1785static void ssh_pkt_ensure(struct Packet *pkt, int length)
32874aea 1786{
ff3187f6 1787 if (pkt->maxlen < length) {
dacd8872 1788 unsigned char *body = pkt->body;
3d71de0b 1789 int offset = body ? body - pkt->data : 0;
ff3187f6 1790 pkt->maxlen = length + 256;
1791 pkt->data = sresize(pkt->data, pkt->maxlen + APIEXTRA, unsigned char);
dacd8872 1792 if (body) pkt->body = pkt->data + offset;
7cca0d81 1793 }
783415f8 1794}
dacd8872 1795static void ssh_pkt_adddata(struct Packet *pkt, void *data, int len)
32874aea 1796{
ff3187f6 1797 if (pkt->logmode != PKTLOG_EMIT) {
1798 pkt->nblanks++;
1799 pkt->blanks = sresize(pkt->blanks, pkt->nblanks, struct logblank_t);
dacd8872 1800 assert(pkt->body);
1801 pkt->blanks[pkt->nblanks-1].offset = pkt->length -
1802 (pkt->body - pkt->data);
ff3187f6 1803 pkt->blanks[pkt->nblanks-1].len = len;
1804 pkt->blanks[pkt->nblanks-1].type = pkt->logmode;
1805 }
1806 pkt->length += len;
dacd8872 1807 ssh_pkt_ensure(pkt, pkt->length);
ff3187f6 1808 memcpy(pkt->data + pkt->length - len, data, len);
7cca0d81 1809}
dacd8872 1810static void ssh_pkt_addbyte(struct Packet *pkt, unsigned char byte)
32874aea 1811{
dacd8872 1812 ssh_pkt_adddata(pkt, &byte, 1);
7cca0d81 1813}
ff3187f6 1814static void ssh2_pkt_addbool(struct Packet *pkt, unsigned char value)
32874aea 1815{
dacd8872 1816 ssh_pkt_adddata(pkt, &value, 1);
7cca0d81 1817}
dacd8872 1818static void ssh_pkt_adduint32(struct Packet *pkt, unsigned long value)
32874aea 1819{
7cca0d81 1820 unsigned char x[4];
1821 PUT_32BIT(x, value);
dacd8872 1822 ssh_pkt_adddata(pkt, x, 4);
7cca0d81 1823}
dacd8872 1824static void ssh_pkt_addstring_start(struct Packet *pkt)
32874aea 1825{
dacd8872 1826 ssh_pkt_adduint32(pkt, 0);
ff3187f6 1827 pkt->savedpos = pkt->length;
7cca0d81 1828}
dacd8872 1829static void ssh_pkt_addstring_str(struct Packet *pkt, char *data)
32874aea 1830{
dacd8872 1831 ssh_pkt_adddata(pkt, data, strlen(data));
ff3187f6 1832 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
7cca0d81 1833}
dacd8872 1834static void ssh_pkt_addstring_data(struct Packet *pkt, char *data, int len)
32874aea 1835{
dacd8872 1836 ssh_pkt_adddata(pkt, data, len);
ff3187f6 1837 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
7cca0d81 1838}
dacd8872 1839static void ssh_pkt_addstring(struct Packet *pkt, char *data)
1840{
1841 ssh_pkt_addstring_start(pkt);
1842 ssh_pkt_addstring_str(pkt, data);
1843}
1844static void ssh1_pkt_addmp(struct Packet *pkt, Bignum b)
32874aea 1845{
dacd8872 1846 int len = ssh1_bignum_length(b);
8a9977e5 1847 unsigned char *data = snewn(len, unsigned char);
dacd8872 1848 (void) ssh1_write_bignum(data, b);
1849 ssh_pkt_adddata(pkt, data, len);
1850 sfree(data);
7cca0d81 1851}
d8baa528 1852static unsigned char *ssh2_mpint_fmt(Bignum b, int *len)
32874aea 1853{
7cca0d81 1854 unsigned char *p;
32874aea 1855 int i, n = (bignum_bitcount(b) + 7) / 8;
3d88e64d 1856 p = snewn(n + 1, unsigned char);
7cca0d81 1857 p[0] = 0;
3709bfe9 1858 for (i = 1; i <= n; i++)
32874aea 1859 p[i] = bignum_byte(b, n - i);
7cca0d81 1860 i = 0;
32874aea 1861 while (i <= n && p[i] == 0 && (p[i + 1] & 0x80) == 0)
1862 i++;
1863 memmove(p, p + i, n + 1 - i);
1864 *len = n + 1 - i;
7cca0d81 1865 return p;
1866}
ff3187f6 1867static void ssh2_pkt_addmp(struct Packet *pkt, Bignum b)
32874aea 1868{
7cca0d81 1869 unsigned char *p;
1870 int len;
1871 p = ssh2_mpint_fmt(b, &len);
dacd8872 1872 ssh_pkt_addstring_start(pkt);
1873 ssh_pkt_addstring_data(pkt, (char *)p, len);
dcbde236 1874 sfree(p);
7cca0d81 1875}
b185170a 1876
dacd8872 1877static struct Packet *ssh1_pkt_init(int pkt_type)
1878{
1879 struct Packet *pkt = ssh_new_packet();
1880 pkt->length = 4 + 8; /* space for length + max padding */
1881 ssh_pkt_addbyte(pkt, pkt_type);
1882 pkt->body = pkt->data + pkt->length;
1883 return pkt;
1884}
1885
1886/* For legacy code (SSH-1 and -2 packet construction used to be separate) */
1887#define ssh2_pkt_ensure(pkt, length) ssh_pkt_ensure(pkt, length)
1888#define ssh2_pkt_adddata(pkt, data, len) ssh_pkt_adddata(pkt, data, len)
1889#define ssh2_pkt_addbyte(pkt, byte) ssh_pkt_addbyte(pkt, byte)
1890#define ssh2_pkt_adduint32(pkt, value) ssh_pkt_adduint32(pkt, value)
1891#define ssh2_pkt_addstring_start(pkt) ssh_pkt_addstring_start(pkt)
1892#define ssh2_pkt_addstring_str(pkt, data) ssh_pkt_addstring_str(pkt, data)
1893#define ssh2_pkt_addstring_data(pkt, data, len) ssh_pkt_addstring_data(pkt, data, len)
1894#define ssh2_pkt_addstring(pkt, data) ssh_pkt_addstring(pkt, data)
1895
1896static struct Packet *ssh2_pkt_init(int pkt_type)
1897{
1898 struct Packet *pkt = ssh_new_packet();
3d71de0b 1899 pkt->length = 5; /* space for packet length + padding length */
dacd8872 1900 pkt->forcepad = 0;
1901 ssh_pkt_addbyte(pkt, (unsigned char) pkt_type);
3d71de0b 1902 pkt->body = pkt->data + pkt->length; /* after packet type */
dacd8872 1903 return pkt;
1904}
1905
b185170a 1906/*
2e85c969 1907 * Construct an SSH-2 final-form packet: compress it, encrypt it,
b185170a 1908 * put the MAC on it. Final packet, ready to be sent, is stored in
ff3187f6 1909 * pkt->data. Total length is returned.
b185170a 1910 */
ff3187f6 1911static int ssh2_pkt_construct(Ssh ssh, struct Packet *pkt)
32874aea 1912{
7cca0d81 1913 int cipherblk, maclen, padding, i;
7cca0d81 1914
a8327734 1915 if (ssh->logctx)
ff3187f6 1916 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[5],
acab36bc 1917 ssh2_pkt_type(ssh->pkt_kctx, ssh->pkt_actx, pkt->data[5]),
dacd8872 1918 pkt->body, pkt->length - (pkt->body - pkt->data),
0d13bfcd 1919 pkt->nblanks, pkt->blanks, &ssh->v2_outgoing_sequence);
ff3187f6 1920 sfree(pkt->blanks); pkt->blanks = NULL;
1921 pkt->nblanks = 0;
00db133f 1922
7cca0d81 1923 /*
4ba9b64b 1924 * Compress packet payload.
1925 */
4ba9b64b 1926 {
1927 unsigned char *newpayload;
1928 int newlen;
51470298 1929 if (ssh->cscomp &&
ff3187f6 1930 ssh->cscomp->compress(ssh->cs_comp_ctx, pkt->data + 5,
1931 pkt->length - 5,
51470298 1932 &newpayload, &newlen)) {
ff3187f6 1933 pkt->length = 5;
1934 ssh2_pkt_adddata(pkt, newpayload, newlen);
dcbde236 1935 sfree(newpayload);
4ba9b64b 1936 }
1937 }
1938
1939 /*
7cca0d81 1940 * Add padding. At least four bytes, and must also bring total
1941 * length (minus MAC) up to a multiple of the block size.
95d2d262 1942 * If pkt->forcepad is set, make sure the packet is at least that size
1943 * after padding.
7cca0d81 1944 */
51470298 1945 cipherblk = ssh->cscipher ? ssh->cscipher->blksize : 8; /* block size */
32874aea 1946 cipherblk = cipherblk < 8 ? 8 : cipherblk; /* or 8 if blksize < 8 */
7cca0d81 1947 padding = 4;
95d2d262 1948 if (pkt->length + padding < pkt->forcepad)
1949 padding = pkt->forcepad - pkt->length;
32874aea 1950 padding +=
ff3187f6 1951 (cipherblk - (pkt->length + padding) % cipherblk) % cipherblk;
95d2d262 1952 assert(padding <= 255);
51470298 1953 maclen = ssh->csmac ? ssh->csmac->len : 0;
ff3187f6 1954 ssh2_pkt_ensure(pkt, pkt->length + padding + maclen);
1955 pkt->data[4] = padding;
7cca0d81 1956 for (i = 0; i < padding; i++)
ff3187f6 1957 pkt->data[pkt->length + i] = random_byte();
1958 PUT_32BIT(pkt->data, pkt->length + padding - 4);
51470298 1959 if (ssh->csmac)
ff3187f6 1960 ssh->csmac->generate(ssh->cs_mac_ctx, pkt->data,
1961 pkt->length + padding,
51470298 1962 ssh->v2_outgoing_sequence);
1963 ssh->v2_outgoing_sequence++; /* whether or not we MACed */
1964
1965 if (ssh->cscipher)
371e569c 1966 ssh->cscipher->encrypt(ssh->cs_cipher_ctx,
ff3187f6 1967 pkt->data, pkt->length + padding);
51470298 1968
9442dd57 1969 pkt->encrypted_len = pkt->length + padding;
1970
ff3187f6 1971 /* Ready-to-send packet starts at pkt->data. We return length. */
1972 return pkt->length + padding + maclen;
b185170a 1973}
1974
1975/*
590f6a5f 1976 * Routines called from the main SSH code to send packets. There
1977 * are quite a few of these, because we have two separate
1978 * mechanisms for delaying the sending of packets:
1979 *
1980 * - In order to send an IGNORE message and a password message in
1981 * a single fixed-length blob, we require the ability to
1982 * concatenate the encrypted forms of those two packets _into_ a
1983 * single blob and then pass it to our <network.h> transport
1984 * layer in one go. Hence, there's a deferment mechanism which
1985 * works after packet encryption.
1986 *
1987 * - In order to avoid sending any connection-layer messages
1988 * during repeat key exchange, we have to queue up any such
1989 * outgoing messages _before_ they are encrypted (and in
1990 * particular before they're allocated sequence numbers), and
1991 * then send them once we've finished.
1992 *
1993 * I call these mechanisms `defer' and `queue' respectively, so as
1994 * to distinguish them reasonably easily.
1995 *
1996 * The functions send_noqueue() and defer_noqueue() free the packet
1997 * structure they are passed. Every outgoing packet goes through
1998 * precisely one of these functions in its life; packets passed to
1999 * ssh2_pkt_send() or ssh2_pkt_defer() either go straight to one of
2000 * these or get queued, and then when the queue is later emptied
2001 * the packets are all passed to defer_noqueue().
97ab28d7 2002 *
2003 * When using a CBC-mode cipher, it's necessary to ensure that an
2004 * attacker can't provide data to be encrypted using an IV that they
2005 * know. We ensure this by prefixing each packet that might contain
2006 * user data with an SSH_MSG_IGNORE. This is done using the deferral
2007 * mechanism, so in this case send_noqueue() ends up redirecting to
2008 * defer_noqueue(). If you don't like this inefficiency, don't use
2009 * CBC.
b185170a 2010 */
590f6a5f 2011
97ab28d7 2012static void ssh2_pkt_defer_noqueue(Ssh, struct Packet *, int);
2013static void ssh_pkt_defersend(Ssh);
2014
590f6a5f 2015/*
2e85c969 2016 * Send an SSH-2 packet immediately, without queuing or deferring.
590f6a5f 2017 */
2018static void ssh2_pkt_send_noqueue(Ssh ssh, struct Packet *pkt)
32874aea 2019{
5471d09a 2020 int len;
2021 int backlog;
97ab28d7 2022 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC)) {
2023 /* We need to send two packets, so use the deferral mechanism. */
2024 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
2025 ssh_pkt_defersend(ssh);
2026 return;
2027 }
ff3187f6 2028 len = ssh2_pkt_construct(ssh, pkt);
bf8a49a1 2029 backlog = s_write(ssh, pkt->data, len);
5471d09a 2030 if (backlog > SSH_MAX_BACKLOG)
51470298 2031 ssh_throttle_all(ssh, 1, backlog);
9442dd57 2032
2033 ssh->outgoing_data_size += pkt->encrypted_len;
2034 if (!ssh->kex_in_progress &&
d57f70af 2035 ssh->max_data_size != 0 &&
2036 ssh->outgoing_data_size > ssh->max_data_size)
f382c87d 2037 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
9442dd57 2038
ff3187f6 2039 ssh_free_packet(pkt);
b185170a 2040}
2041
2042/*
2e85c969 2043 * Defer an SSH-2 packet.
b185170a 2044 */
97ab28d7 2045static void ssh2_pkt_defer_noqueue(Ssh ssh, struct Packet *pkt, int noignore)
32874aea 2046{
97ab28d7 2047 int len;
2048 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC) &&
cf6ddb95 2049 ssh->deferred_len == 0 && !noignore &&
2050 !(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE)) {
97ab28d7 2051 /*
2052 * Interpose an SSH_MSG_IGNORE to ensure that user data don't
2053 * get encrypted with a known IV.
2054 */
2055 struct Packet *ipkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
27311cc7 2056 ssh2_pkt_addstring_start(ipkt);
97ab28d7 2057 ssh2_pkt_defer_noqueue(ssh, ipkt, TRUE);
2058 }
2059 len = ssh2_pkt_construct(ssh, pkt);
51470298 2060 if (ssh->deferred_len + len > ssh->deferred_size) {
2061 ssh->deferred_size = ssh->deferred_len + len + 128;
3d88e64d 2062 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
2063 ssh->deferred_size,
2064 unsigned char);
b185170a 2065 }
ff3187f6 2066 memcpy(ssh->deferred_send_data + ssh->deferred_len, pkt->data, len);
51470298 2067 ssh->deferred_len += len;
9442dd57 2068 ssh->deferred_data_size += pkt->encrypted_len;
ff3187f6 2069 ssh_free_packet(pkt);
b185170a 2070}
2071
2072/*
2e85c969 2073 * Queue an SSH-2 packet.
590f6a5f 2074 */
2075static void ssh2_pkt_queue(Ssh ssh, struct Packet *pkt)
2076{
2077 assert(ssh->queueing);
2078
2079 if (ssh->queuelen >= ssh->queuesize) {
2080 ssh->queuesize = ssh->queuelen + 32;
2081 ssh->queue = sresize(ssh->queue, ssh->queuesize, struct Packet *);
2082 }
2083
2084 ssh->queue[ssh->queuelen++] = pkt;
2085}
2086
2087/*
2088 * Either queue or send a packet, depending on whether queueing is
2089 * set.
2090 */
2091static void ssh2_pkt_send(Ssh ssh, struct Packet *pkt)
2092{
2093 if (ssh->queueing)
2094 ssh2_pkt_queue(ssh, pkt);
2095 else
2096 ssh2_pkt_send_noqueue(ssh, pkt);
2097}
2098
2099/*
2100 * Either queue or defer a packet, depending on whether queueing is
2101 * set.
2102 */
2103static void ssh2_pkt_defer(Ssh ssh, struct Packet *pkt)
2104{
2105 if (ssh->queueing)
2106 ssh2_pkt_queue(ssh, pkt);
2107 else
97ab28d7 2108 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
590f6a5f 2109}
2110
2111/*
b185170a 2112 * Send the whole deferred data block constructed by
2e85c969 2113 * ssh2_pkt_defer() or SSH-1's defer_packet().
590f6a5f 2114 *
2115 * The expected use of the defer mechanism is that you call
2116 * ssh2_pkt_defer() a few times, then call ssh_pkt_defersend(). If
2117 * not currently queueing, this simply sets up deferred_send_data
2118 * and then sends it. If we _are_ currently queueing, the calls to
2119 * ssh2_pkt_defer() put the deferred packets on to the queue
2120 * instead, and therefore ssh_pkt_defersend() has no deferred data
2121 * to send. Hence, there's no need to make it conditional on
2122 * ssh->queueing.
b185170a 2123 */
51470298 2124static void ssh_pkt_defersend(Ssh ssh)
32874aea 2125{
5471d09a 2126 int backlog;
bf8a49a1 2127 backlog = s_write(ssh, ssh->deferred_send_data, ssh->deferred_len);
51470298 2128 ssh->deferred_len = ssh->deferred_size = 0;
2129 sfree(ssh->deferred_send_data);
2130 ssh->deferred_send_data = NULL;
5471d09a 2131 if (backlog > SSH_MAX_BACKLOG)
51470298 2132 ssh_throttle_all(ssh, 1, backlog);
9442dd57 2133
2134 ssh->outgoing_data_size += ssh->deferred_data_size;
2135 if (!ssh->kex_in_progress &&
d57f70af 2136 ssh->max_data_size != 0 &&
2137 ssh->outgoing_data_size > ssh->max_data_size)
f382c87d 2138 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
9442dd57 2139 ssh->deferred_data_size = 0;
7cca0d81 2140}
2141
590f6a5f 2142/*
18524056 2143 * Send a packet whose length needs to be disguised (typically
2144 * passwords or keyboard-interactive responses).
2145 */
2146static void ssh2_pkt_send_with_padding(Ssh ssh, struct Packet *pkt,
2147 int padsize)
2148{
2149#if 0
2150 if (0) {
2151 /*
2152 * The simplest way to do this is to adjust the
2153 * variable-length padding field in the outgoing packet.
2154 *
2155 * Currently compiled out, because some Cisco SSH servers
2156 * don't like excessively padded packets (bah, why's it
2157 * always Cisco?)
2158 */
2159 pkt->forcepad = padsize;
2160 ssh2_pkt_send(ssh, pkt);
2161 } else
2162#endif
2163 {
2164 /*
2165 * If we can't do that, however, an alternative approach is
2166 * to use the pkt_defer mechanism to bundle the packet
2167 * tightly together with an SSH_MSG_IGNORE such that their
2168 * combined length is a constant. So first we construct the
2169 * final form of this packet and defer its sending.
2170 */
2171 ssh2_pkt_defer(ssh, pkt);
2172
2173 /*
2174 * Now construct an SSH_MSG_IGNORE which includes a string
2175 * that's an exact multiple of the cipher block size. (If
2176 * the cipher is NULL so that the block size is
2177 * unavailable, we don't do this trick at all, because we
2178 * gain nothing by it.)
2179 */
cf6ddb95 2180 if (ssh->cscipher &&
2181 !(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE)) {
18524056 2182 int stringlen, i;
2183
2184 stringlen = (256 - ssh->deferred_len);
2185 stringlen += ssh->cscipher->blksize - 1;
2186 stringlen -= (stringlen % ssh->cscipher->blksize);
2187 if (ssh->cscomp) {
2188 /*
2189 * Temporarily disable actual compression, so we
2190 * can guarantee to get this string exactly the
2191 * length we want it. The compression-disabling
2192 * routine should return an integer indicating how
2193 * many bytes we should adjust our string length
2194 * by.
2195 */
2196 stringlen -=
2197 ssh->cscomp->disable_compression(ssh->cs_comp_ctx);
2198 }
2199 pkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
2200 ssh2_pkt_addstring_start(pkt);
2201 for (i = 0; i < stringlen; i++) {
2202 char c = (char) random_byte();
2203 ssh2_pkt_addstring_data(pkt, &c, 1);
2204 }
2205 ssh2_pkt_defer(ssh, pkt);
2206 }
2207 ssh_pkt_defersend(ssh);
2208 }
2209}
2210
2211/*
2e85c969 2212 * Send all queued SSH-2 packets. We send them by means of
590f6a5f 2213 * ssh2_pkt_defer_noqueue(), in case they included a pair of
2214 * packets that needed to be lumped together.
2215 */
2216static void ssh2_pkt_queuesend(Ssh ssh)
2217{
2218 int i;
2219
2220 assert(!ssh->queueing);
2221
2222 for (i = 0; i < ssh->queuelen; i++)
97ab28d7 2223 ssh2_pkt_defer_noqueue(ssh, ssh->queue[i], FALSE);
590f6a5f 2224 ssh->queuelen = 0;
2225
2226 ssh_pkt_defersend(ssh);
2227}
2228
7cca0d81 2229#if 0
32874aea 2230void bndebug(char *string, Bignum b)
2231{
7cca0d81 2232 unsigned char *p;
2233 int i, len;
2234 p = ssh2_mpint_fmt(b, &len);
2235 debug(("%s", string));
2236 for (i = 0; i < len; i++)
32874aea 2237 debug((" %02x", p[i]));
765c4200 2238 debug(("\n"));
dcbde236 2239 sfree(p);
7cca0d81 2240}
2241#endif
2242
b672f405 2243static void hash_mpint(const struct ssh_hash *h, void *s, Bignum b)
32874aea 2244{
7cca0d81 2245 unsigned char *p;
2246 int len;
2247 p = ssh2_mpint_fmt(b, &len);
b672f405 2248 hash_string(h, s, p, len);
dcbde236 2249 sfree(p);
7cca0d81 2250}
2251
2252/*
2e85c969 2253 * Packet decode functions for both SSH-1 and SSH-2.
7cca0d81 2254 */
ff3187f6 2255static unsigned long ssh_pkt_getuint32(struct Packet *pkt)
32874aea 2256{
7cca0d81 2257 unsigned long value;
ff3187f6 2258 if (pkt->length - pkt->savedpos < 4)
32874aea 2259 return 0; /* arrgh, no way to decline (FIXME?) */
ff3187f6 2260 value = GET_32BIT(pkt->body + pkt->savedpos);
2261 pkt->savedpos += 4;
7cca0d81 2262 return value;
2263}
ff3187f6 2264static int ssh2_pkt_getbool(struct Packet *pkt)
32874aea 2265{
65a22376 2266 unsigned long value;
ff3187f6 2267 if (pkt->length - pkt->savedpos < 1)
32874aea 2268 return 0; /* arrgh, no way to decline (FIXME?) */
ff3187f6 2269 value = pkt->body[pkt->savedpos] != 0;
2270 pkt->savedpos++;
65a22376 2271 return value;
2272}
ff3187f6 2273static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length)
32874aea 2274{
57356d63 2275 int len;
7cca0d81 2276 *p = NULL;
45068b27 2277 *length = 0;
ff3187f6 2278 if (pkt->length - pkt->savedpos < 4)
32874aea 2279 return;
ff3187f6 2280 len = GET_32BIT(pkt->body + pkt->savedpos);
57356d63 2281 if (len < 0)
2282 return;
2283 *length = len;
ff3187f6 2284 pkt->savedpos += 4;
2285 if (pkt->length - pkt->savedpos < *length)
32874aea 2286 return;
ff3187f6 2287 *p = (char *)(pkt->body + pkt->savedpos);
2288 pkt->savedpos += *length;
7cca0d81 2289}
ff3187f6 2290static void *ssh_pkt_getdata(struct Packet *pkt, int length)
0016d70b 2291{
ff3187f6 2292 if (pkt->length - pkt->savedpos < length)
0016d70b 2293 return NULL;
ff3187f6 2294 pkt->savedpos += length;
2295 return pkt->body + (pkt->savedpos - length);
0016d70b 2296}
ff3187f6 2297static int ssh1_pkt_getrsakey(struct Packet *pkt, struct RSAKey *key,
0016d70b 2298 unsigned char **keystr)
2299{
2300 int j;
2301
ff3187f6 2302 j = makekey(pkt->body + pkt->savedpos,
2303 pkt->length - pkt->savedpos,
0016d70b 2304 key, keystr, 0);
2305
2306 if (j < 0)
2307 return FALSE;
2308
ff3187f6 2309 pkt->savedpos += j;
2310 assert(pkt->savedpos < pkt->length);
0016d70b 2311
2312 return TRUE;
2313}
ff3187f6 2314static Bignum ssh1_pkt_getmp(struct Packet *pkt)
0016d70b 2315{
2316 int j;
2317 Bignum b;
2318
ff3187f6 2319 j = ssh1_read_bignum(pkt->body + pkt->savedpos,
2320 pkt->length - pkt->savedpos, &b);
0016d70b 2321
2322 if (j < 0)
2323 return NULL;
2324
ff3187f6 2325 pkt->savedpos += j;
0016d70b 2326 return b;
2327}
ff3187f6 2328static Bignum ssh2_pkt_getmp(struct Packet *pkt)
32874aea 2329{
7cca0d81 2330 char *p;
3709bfe9 2331 int length;
7cca0d81 2332 Bignum b;
2333
ff3187f6 2334 ssh_pkt_getstring(pkt, &p, &length);
7cca0d81 2335 if (!p)
32874aea 2336 return NULL;
ff3187f6 2337 if (p[0] & 0x80)
32874aea 2338 return NULL;
d8baa528 2339 b = bignum_from_bytes((unsigned char *)p, length);
7cca0d81 2340 return b;
2341}
2342
7d503c31 2343/*
2e85c969 2344 * Helper function to add an SSH-2 signature blob to a packet.
1dd353b5 2345 * Expects to be shown the public key blob as well as the signature
2346 * blob. Normally works just like ssh2_pkt_addstring, but will
2347 * fiddle with the signature packet if necessary for
2348 * BUG_SSH2_RSA_PADDING.
2349 */
ff3187f6 2350static void ssh2_add_sigblob(Ssh ssh, struct Packet *pkt,
2351 void *pkblob_v, int pkblob_len,
1dd353b5 2352 void *sigblob_v, int sigblob_len)
2353{
2354 unsigned char *pkblob = (unsigned char *)pkblob_v;
2355 unsigned char *sigblob = (unsigned char *)sigblob_v;
2356
2357 /* dmemdump(pkblob, pkblob_len); */
2358 /* dmemdump(sigblob, sigblob_len); */
2359
2360 /*
2361 * See if this is in fact an ssh-rsa signature and a buggy
2362 * server; otherwise we can just do this the easy way.
2363 */
51470298 2364 if ((ssh->remote_bugs & BUG_SSH2_RSA_PADDING) &&
1dd353b5 2365 (GET_32BIT(pkblob) == 7 && !memcmp(pkblob+4, "ssh-rsa", 7))) {
2366 int pos, len, siglen;
2367
2368 /*
2369 * Find the byte length of the modulus.
2370 */
2371
2372 pos = 4+7; /* skip over "ssh-rsa" */
2373 pos += 4 + GET_32BIT(pkblob+pos); /* skip over exponent */
2374 len = GET_32BIT(pkblob+pos); /* find length of modulus */
2375 pos += 4; /* find modulus itself */
2376 while (len > 0 && pkblob[pos] == 0)
2377 len--, pos++;
2378 /* debug(("modulus length is %d\n", len)); */
2379
2380 /*
2381 * Now find the signature integer.
2382 */
2383 pos = 4+7; /* skip over "ssh-rsa" */
2384 siglen = GET_32BIT(sigblob+pos);
2385 /* debug(("signature length is %d\n", siglen)); */
2386
2387 if (len != siglen) {
2388 unsigned char newlen[4];
ff3187f6 2389 ssh2_pkt_addstring_start(pkt);
2390 ssh2_pkt_addstring_data(pkt, (char *)sigblob, pos);
1dd353b5 2391 /* dmemdump(sigblob, pos); */
2392 pos += 4; /* point to start of actual sig */
2393 PUT_32BIT(newlen, len);
ff3187f6 2394 ssh2_pkt_addstring_data(pkt, (char *)newlen, 4);
1dd353b5 2395 /* dmemdump(newlen, 4); */
2396 newlen[0] = 0;
2397 while (len-- > siglen) {
ff3187f6 2398 ssh2_pkt_addstring_data(pkt, (char *)newlen, 1);
1dd353b5 2399 /* dmemdump(newlen, 1); */
2400 }
ff3187f6 2401 ssh2_pkt_addstring_data(pkt, (char *)(sigblob+pos), siglen);
1dd353b5 2402 /* dmemdump(sigblob+pos, siglen); */
2403 return;
2404 }
2405
2406 /* Otherwise fall through and do it the easy way. */
2407 }
2408
ff3187f6 2409 ssh2_pkt_addstring_start(pkt);
2410 ssh2_pkt_addstring_data(pkt, (char *)sigblob, sigblob_len);
1dd353b5 2411}
2412
2413/*
7d503c31 2414 * Examine the remote side's version string and compare it against
2415 * a list of known buggy implementations.
2416 */
51470298 2417static void ssh_detect_bugs(Ssh ssh, char *vstring)
32874aea 2418{
2419 char *imp; /* pointer to implementation part */
7d503c31 2420 imp = vstring;
2421 imp += strcspn(imp, "-");
bd358db1 2422 if (*imp) imp++;
7d503c31 2423 imp += strcspn(imp, "-");
bd358db1 2424 if (*imp) imp++;
7d503c31 2425
51470298 2426 ssh->remote_bugs = 0;
7d503c31 2427
bf982899 2428 /*
2429 * General notes on server version strings:
2430 * - Not all servers reporting "Cisco-1.25" have all the bugs listed
2431 * here -- in particular, we've heard of one that's perfectly happy
2432 * with SSH1_MSG_IGNOREs -- but this string never seems to change,
2433 * so we can't distinguish them.
2434 */
4a693cfc 2435 if (conf_get_int(ssh->conf, CONF_sshbug_ignore1) == FORCE_ON ||
2436 (conf_get_int(ssh->conf, CONF_sshbug_ignore1) == AUTO &&
2c9c6388 2437 (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
2438 !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
46ac09aa 2439 !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25") ||
bd0b4caf 2440 !strcmp(imp, "OSU_1.4alpha3") || !strcmp(imp, "OSU_1.5alpha4")))) {
32874aea 2441 /*
2442 * These versions don't support SSH1_MSG_IGNORE, so we have
2443 * to use a different defence against password length
2444 * sniffing.
2445 */
51470298 2446 ssh->remote_bugs |= BUG_CHOKES_ON_SSH1_IGNORE;
2e85c969 2447 logevent("We believe remote version has SSH-1 ignore bug");
7d503c31 2448 }
2449
4a693cfc 2450 if (conf_get_int(ssh->conf, CONF_sshbug_plainpw1) == FORCE_ON ||
2451 (conf_get_int(ssh->conf, CONF_sshbug_plainpw1) == AUTO &&
46ac09aa 2452 (!strcmp(imp, "Cisco-1.25") || !strcmp(imp, "OSU_1.4alpha3")))) {
bd358db1 2453 /*
2454 * These versions need a plain password sent; they can't
2455 * handle having a null and a random length of data after
2456 * the password.
2457 */
51470298 2458 ssh->remote_bugs |= BUG_NEEDS_SSH1_PLAIN_PASSWORD;
2e85c969 2459 logevent("We believe remote version needs a plain SSH-1 password");
bd358db1 2460 }
2461
4a693cfc 2462 if (conf_get_int(ssh->conf, CONF_sshbug_rsa1) == FORCE_ON ||
2463 (conf_get_int(ssh->conf, CONF_sshbug_rsa1) == AUTO &&
2c9c6388 2464 (!strcmp(imp, "Cisco-1.25")))) {
0df73905 2465 /*
2466 * These versions apparently have no clue whatever about
2467 * RSA authentication and will panic and die if they see
2468 * an AUTH_RSA message.
2469 */
51470298 2470 ssh->remote_bugs |= BUG_CHOKES_ON_RSA;
19f47a7d 2471 logevent("We believe remote version can't handle SSH-1 RSA authentication");
0df73905 2472 }
2473
4a693cfc 2474 if (conf_get_int(ssh->conf, CONF_sshbug_hmac2) == FORCE_ON ||
2475 (conf_get_int(ssh->conf, CONF_sshbug_hmac2) == AUTO &&
b9f387af 2476 !wc_match("* VShell", imp) &&
831301f6 2477 (wc_match("2.1.0*", imp) || wc_match("2.0.*", imp) ||
2478 wc_match("2.2.0*", imp) || wc_match("2.3.0*", imp) ||
2479 wc_match("2.1 *", imp)))) {
32874aea 2480 /*
2481 * These versions have the HMAC bug.
2482 */
51470298 2483 ssh->remote_bugs |= BUG_SSH2_HMAC;
2e85c969 2484 logevent("We believe remote version has SSH-2 HMAC bug");
7d503c31 2485 }
1dd353b5 2486
4a693cfc 2487 if (conf_get_int(ssh->conf, CONF_sshbug_derivekey2) == FORCE_ON ||
2488 (conf_get_int(ssh->conf, CONF_sshbug_derivekey2) == AUTO &&
b9f387af 2489 !wc_match("* VShell", imp) &&
2856a1b9 2490 (wc_match("2.0.0*", imp) || wc_match("2.0.10*", imp) ))) {
088bde77 2491 /*
2492 * These versions have the key-derivation bug (failing to
2493 * include the literal shared secret in the hashes that
2494 * generate the keys).
2495 */
51470298 2496 ssh->remote_bugs |= BUG_SSH2_DERIVEKEY;
2e85c969 2497 logevent("We believe remote version has SSH-2 key-derivation bug");
088bde77 2498 }
2499
4a693cfc 2500 if (conf_get_int(ssh->conf, CONF_sshbug_rsapad2) == FORCE_ON ||
2501 (conf_get_int(ssh->conf, CONF_sshbug_rsapad2) == AUTO &&
831301f6 2502 (wc_match("OpenSSH_2.[5-9]*", imp) ||
2503 wc_match("OpenSSH_3.[0-2]*", imp)))) {
1dd353b5 2504 /*
2e85c969 2505 * These versions have the SSH-2 RSA padding bug.
1dd353b5 2506 */
51470298 2507 ssh->remote_bugs |= BUG_SSH2_RSA_PADDING;
2e85c969 2508 logevent("We believe remote version has SSH-2 RSA padding bug");
1dd353b5 2509 }
8e975795 2510
4a693cfc 2511 if (conf_get_int(ssh->conf, CONF_sshbug_pksessid2) == FORCE_ON ||
2512 (conf_get_int(ssh->conf, CONF_sshbug_pksessid2) == AUTO &&
dda87a28 2513 wc_match("OpenSSH_2.[0-2]*", imp))) {
2514 /*
2e85c969 2515 * These versions have the SSH-2 session-ID bug in
dda87a28 2516 * public-key authentication.
2517 */
2518 ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID;
2e85c969 2519 logevent("We believe remote version has SSH-2 public-key-session-ID bug");
dda87a28 2520 }
f382c87d 2521
4a693cfc 2522 if (conf_get_int(ssh->conf, CONF_sshbug_rekey2) == FORCE_ON ||
2523 (conf_get_int(ssh->conf, CONF_sshbug_rekey2) == AUTO &&
39b8712f 2524 (wc_match("DigiSSH_2.0", imp) ||
2525 wc_match("OpenSSH_2.[0-4]*", imp) ||
e12d95a5 2526 wc_match("OpenSSH_2.5.[0-3]*", imp) ||
2527 wc_match("Sun_SSH_1.0", imp) ||
f4275b53 2528 wc_match("Sun_SSH_1.0.1", imp) ||
96bd26de 2529 /* All versions <= 1.2.6 (they changed their format in 1.2.7) */
2530 wc_match("WeOnlyDo-*", imp)))) {
f382c87d 2531 /*
2e85c969 2532 * These versions have the SSH-2 rekey bug.
f382c87d 2533 */
2534 ssh->remote_bugs |= BUG_SSH2_REKEY;
2e85c969 2535 logevent("We believe remote version has SSH-2 rekey bug");
f382c87d 2536 }
c9739dba 2537
4a693cfc 2538 if (conf_get_int(ssh->conf, CONF_sshbug_maxpkt2) == FORCE_ON ||
2539 (conf_get_int(ssh->conf, CONF_sshbug_maxpkt2) == AUTO &&
5ca836f2 2540 (wc_match("1.36_sshlib GlobalSCAPE", imp) ||
2541 wc_match("1.36 sshlib: GlobalScape", imp)))) {
c9739dba 2542 /*
2543 * This version ignores our makpkt and needs to be throttled.
2544 */
2545 ssh->remote_bugs |= BUG_SSH2_MAXPKT;
2546 logevent("We believe remote version ignores SSH-2 maximum packet size");
2547 }
cf6ddb95 2548
4a693cfc 2549 if (conf_get_int(ssh->conf, CONF_sshbug_ignore2) == FORCE_ON) {
cf6ddb95 2550 /*
2551 * Servers that don't support SSH2_MSG_IGNORE. Currently,
2552 * none detected automatically.
2553 */
2554 ssh->remote_bugs |= BUG_CHOKES_ON_SSH2_IGNORE;
2555 logevent("We believe remote version has SSH-2 ignore bug");
2556 }
7d503c31 2557}
2558
d38d6a1f 2559/*
2560 * The `software version' part of an SSH version string is required
2561 * to contain no spaces or minus signs.
2562 */
2563static void ssh_fix_verstring(char *str)
2564{
2565 /* Eat "SSH-<protoversion>-". */
2566 assert(*str == 'S'); str++;
2567 assert(*str == 'S'); str++;
2568 assert(*str == 'H'); str++;
2569 assert(*str == '-'); str++;
2570 while (*str && *str != '-') str++;
2571 assert(*str == '-'); str++;
2572
2573 /* Convert minus signs and spaces in the remaining string into
2574 * underscores. */
2575 while (*str) {
2576 if (*str == '-' || *str == ' ')
2577 *str = '_';
2578 str++;
2579 }
2580}
2581
1fcd0d98 2582/*
2583 * Send an appropriate SSH version string.
2584 */
2585static void ssh_send_verstring(Ssh ssh, char *svers)
2586{
2587 char *verstring;
2588
2589 if (ssh->version == 2) {
2590 /*
2591 * Construct a v2 version string.
2592 */
2593 verstring = dupprintf("SSH-2.0-%s\015\012", sshver);
2594 } else {
2595 /*
2596 * Construct a v1 version string.
2597 */
2598 verstring = dupprintf("SSH-%s-%s\012",
2599 (ssh_versioncmp(svers, "1.5") <= 0 ?
2600 svers : "1.5"),
2601 sshver);
2602 }
2603
2604 ssh_fix_verstring(verstring);
2605
2606 if (ssh->version == 2) {
2607 size_t len;
2608 /*
2609 * Record our version string.
2610 */
2611 len = strcspn(verstring, "\015\012");
2612 ssh->v_c = snewn(len + 1, char);
2613 memcpy(ssh->v_c, verstring, len);
2614 ssh->v_c[len] = 0;
2615 }
2616
2617 logeventf(ssh, "We claim version: %.*s",
2618 strcspn(verstring, "\015\012"), verstring);
2619 s_write(ssh, verstring, strlen(verstring));
2620 sfree(verstring);
2621}
2622
51470298 2623static int do_ssh_init(Ssh ssh, unsigned char c)
32874aea 2624{
51470298 2625 struct do_ssh_init_state {
2626 int vslen;
2627 char version[10];
2628 char *vstring;
2629 int vstrsize;
2630 int i;
2631 int proto1, proto2;
2632 };
2633 crState(do_ssh_init_state);
374330e2 2634
51470298 2635 crBegin(ssh->do_ssh_init_crstate);
8df7a775 2636
8c1835c0 2637 /* Search for a line beginning with the string "SSH-" in the input. */
2638 for (;;) {
2639 if (c != 'S') goto no;
2640 crReturn(1);
2641 if (c != 'S') goto no;
2642 crReturn(1);
2643 if (c != 'H') goto no;
2644 crReturn(1);
2645 if (c != '-') goto no;
2646 break;
2647 no:
2648 while (c != '\012')
2649 crReturn(1);
2650 crReturn(1);
374330e2 2651 }
8df7a775 2652
51470298 2653 s->vstrsize = 16;
3d88e64d 2654 s->vstring = snewn(s->vstrsize, char);
51470298 2655 strcpy(s->vstring, "SSH-");
2656 s->vslen = 4;
2657 s->i = 0;
374330e2 2658 while (1) {
8df7a775 2659 crReturn(1); /* get another char */
51470298 2660 if (s->vslen >= s->vstrsize - 1) {
2661 s->vstrsize += 16;
3d88e64d 2662 s->vstring = sresize(s->vstring, s->vstrsize, char);
32874aea 2663 }
51470298 2664 s->vstring[s->vslen++] = c;
2665 if (s->i >= 0) {
374330e2 2666 if (c == '-') {
51470298 2667 s->version[s->i] = '\0';
2668 s->i = -1;
2669 } else if (s->i < sizeof(s->version) - 1)
2670 s->version[s->i++] = c;
c4ffc4d0 2671 } else if (c == '\012')
374330e2 2672 break;
2673 }
2674
51470298 2675 ssh->agentfwd_enabled = FALSE;
2676 ssh->rdpkt2_state.incoming_sequence = 0;
960e736a 2677
51470298 2678 s->vstring[s->vslen] = 0;
a7d4653a 2679 s->vstring[strcspn(s->vstring, "\015\012")] = '\0';/* remove EOL chars */
fb983202 2680 logeventf(ssh, "Server version: %s", s->vstring);
51470298 2681 ssh_detect_bugs(ssh, s->vstring);
c5e9c988 2682
adf799dd 2683 /*
38d228a2 2684 * Decide which SSH protocol version to support.
adf799dd 2685 */
38d228a2 2686
2687 /* Anything strictly below "2.0" means protocol 1 is supported. */
51470298 2688 s->proto1 = ssh_versioncmp(s->version, "2.0") < 0;
38d228a2 2689 /* Anything greater or equal to "1.99" means protocol 2 is supported. */
51470298 2690 s->proto2 = ssh_versioncmp(s->version, "1.99") >= 0;
38d228a2 2691
4a693cfc 2692 if (conf_get_int(ssh->conf, CONF_sshprot) == 0 && !s->proto1) {
6b5cf8b4 2693 bombout(("SSH protocol version 1 required by user but not provided by server"));
7ffdbc1a 2694 crStop(0);
38d228a2 2695 }
4a693cfc 2696 if (conf_get_int(ssh->conf, CONF_sshprot) == 3 && !s->proto2) {
6b5cf8b4 2697 bombout(("SSH protocol version 2 required by user but not provided by server"));
7ffdbc1a 2698 crStop(0);
38d228a2 2699 }
2700
4a693cfc 2701 if (s->proto2 && (conf_get_int(ssh->conf, CONF_sshprot) >= 2 || !s->proto1))
1fcd0d98 2702 ssh->version = 2;
2703 else
2704 ssh->version = 1;
d38d6a1f 2705
2706 logeventf(ssh, "Using SSH protocol version %d", ssh->version);
2707
1fcd0d98 2708 /* Send the version string, if we haven't already */
4a693cfc 2709 if (conf_get_int(ssh->conf, CONF_sshprot) != 3)
1fcd0d98 2710 ssh_send_verstring(ssh, s->version);
2711
2712 if (ssh->version == 2) {
2713 size_t len;
2714 /*
2715 * Record their version string.
2716 */
2717 len = strcspn(s->vstring, "\015\012");
2718 ssh->v_s = snewn(len + 1, char);
2719 memcpy(ssh->v_s, s->vstring, len);
2720 ssh->v_s[len] = 0;
2721
2722 /*
2723 * Initialise SSH-2 protocol.
2724 */
2725 ssh->protocol = ssh2_protocol;
2726 ssh2_protocol_setup(ssh);
2727 ssh->s_rdpkt = ssh2_rdpkt;
2728 } else {
2729 /*
2730 * Initialise SSH-1 protocol.
2731 */
2732 ssh->protocol = ssh1_protocol;
2733 ssh1_protocol_setup(ssh);
2734 ssh->s_rdpkt = ssh1_rdpkt;
2735 }
2736 if (ssh->version == 2)
2737 do_ssh2_transport(ssh, NULL, -1, NULL);
2738
125105d1 2739 update_specials_menu(ssh->frontend);
51470298 2740 ssh->state = SSH_STATE_BEFORE_SIZE;
4a693cfc 2741 ssh->pinger = pinger_new(ssh->conf, &ssh_backend, ssh);
8df7a775 2742
51470298 2743 sfree(s->vstring);
50526e47 2744
8df7a775 2745 crFinish(0);
2746}
2747
3d9449a1 2748static void ssh_process_incoming_data(Ssh ssh,
2749 unsigned char **data, int *datalen)
2750{
bf8a49a1 2751 struct Packet *pktin;
2752
2753 pktin = ssh->s_rdpkt(ssh, data, datalen);
3d9449a1 2754 if (pktin) {
2755 ssh->protocol(ssh, NULL, 0, pktin);
2756 ssh_free_packet(pktin);
2757 }
2758}
2759
2760static void ssh_queue_incoming_data(Ssh ssh,
2761 unsigned char **data, int *datalen)
2762{
2763 bufchain_add(&ssh->queued_incoming_data, *data, *datalen);
2764 *data += *datalen;
2765 *datalen = 0;
2766}
2767
2768static void ssh_process_queued_incoming_data(Ssh ssh)
2769{
2770 void *vdata;
2771 unsigned char *data;
2772 int len, origlen;
2773
2774 while (!ssh->frozen && bufchain_size(&ssh->queued_incoming_data)) {
2775 bufchain_prefix(&ssh->queued_incoming_data, &vdata, &len);
2776 data = vdata;
2777 origlen = len;
2778
2779 while (!ssh->frozen && len > 0)
2780 ssh_process_incoming_data(ssh, &data, &len);
2781
2782 if (origlen > len)
2783 bufchain_consume(&ssh->queued_incoming_data, origlen - len);
2784 }
2785}
2786
2787static void ssh_set_frozen(Ssh ssh, int frozen)
2788{
a5a6f839 2789 if (ssh->s)
2790 sk_set_frozen(ssh->s, frozen);
3d9449a1 2791 ssh->frozen = frozen;
2792}
2793
51470298 2794static void ssh_gotdata(Ssh ssh, unsigned char *data, int datalen)
8df7a775 2795{
bf8a49a1 2796 /* Log raw data, if we're in that mode. */
ff05dfef 2797 if (ssh->logctx)
2798 log_packet(ssh->logctx, PKT_INCOMING, -1, NULL, data, datalen,
0d13bfcd 2799 0, NULL, NULL);
bf8a49a1 2800
51470298 2801 crBegin(ssh->ssh_gotdata_crstate);
8df7a775 2802
2803 /*
2804 * To begin with, feed the characters one by one to the
2805 * protocol initialisation / selection function do_ssh_init().
2806 * When that returns 0, we're done with the initial greeting
2807 * exchange and can move on to packet discipline.
2808 */
2809 while (1) {
51470298 2810 int ret; /* need not be kept across crReturn */
8df7a775 2811 if (datalen == 0)
2812 crReturnV; /* more data please */
51470298 2813 ret = do_ssh_init(ssh, *data);
32874aea 2814 data++;
2815 datalen--;
8df7a775 2816 if (ret == 0)
2817 break;
2818 }
2819
2820 /*
2821 * We emerge from that loop when the initial negotiation is
2822 * over and we have selected an s_rdpkt function. Now pass
2823 * everything to s_rdpkt, and then pass the resulting packets
2824 * to the proper protocol handler.
2825 */
3d9449a1 2826
8df7a775 2827 while (1) {
e375106c 2828 while (bufchain_size(&ssh->queued_incoming_data) > 0 || datalen > 0) {
2829 if (ssh->frozen) {
3d9449a1 2830 ssh_queue_incoming_data(ssh, &data, &datalen);
e375106c 2831 /* This uses up all data and cannot cause anything interesting
2832 * to happen; indeed, for anything to happen at all, we must
2833 * return, so break out. */
2834 break;
2835 } else if (bufchain_size(&ssh->queued_incoming_data) > 0) {
2836 /* This uses up some or all data, and may freeze the
2837 * session. */
2838 ssh_process_queued_incoming_data(ssh);
2839 } else {
2840 /* This uses up some or all data, and may freeze the
2841 * session. */
2842 ssh_process_incoming_data(ssh, &data, &datalen);
2843 }
2844 /* FIXME this is probably EBW. */
ff3187f6 2845 if (ssh->state == SSH_STATE_CLOSED)
2846 return;
8df7a775 2847 }
e375106c 2848 /* We're out of data. Go and get some more. */
8df7a775 2849 crReturnV;
2850 }
2851 crFinishV;
2852}
2853
ac934965 2854static int ssh_do_close(Ssh ssh, int notify_exit)
32874aea 2855{
80ffa58b 2856 int ret = 0;
36f94d1f 2857 struct ssh_channel *c;
2858
51470298 2859 ssh->state = SSH_STATE_CLOSED;
ecbb0000 2860 expire_timer_context(ssh);
51470298 2861 if (ssh->s) {
2862 sk_close(ssh->s);
2863 ssh->s = NULL;
ac934965 2864 if (notify_exit)
2865 notify_remote_exit(ssh->frontend);
2866 else
2867 ret = 1;
f3ab576e 2868 }
36f94d1f 2869 /*
80ffa58b 2870 * Now we must shut down any port- and X-forwarded channels going
36f94d1f 2871 * through this connection.
2872 */
74a98066 2873 if (ssh->channels) {
80ffa58b 2874 while (NULL != (c = index234(ssh->channels, 0))) {
74a98066 2875 switch (c->type) {
2876 case CHAN_X11:
2877 x11_close(c->u.x11.s);
2878 break;
2879 case CHAN_SOCKDATA:
409eca86 2880 case CHAN_SOCKDATA_DORMANT:
74a98066 2881 pfd_close(c->u.pfd.s);
2882 break;
2883 }
80ffa58b 2884 del234(ssh->channels, c); /* moving next one to index 0 */
74a98066 2885 if (ssh->version == 2)
2886 bufchain_clear(&c->v.v2.outbuffer);
2887 sfree(c);
36f94d1f 2888 }
36f94d1f 2889 }
f8c9f9df 2890 /*
2891 * Go through port-forwardings, and close any associated
2892 * listening sockets.
2893 */
2894 if (ssh->portfwds) {
2895 struct ssh_portfwd *pf;
2896 while (NULL != (pf = index234(ssh->portfwds, 0))) {
2897 /* Dispose of any listening socket. */
2898 if (pf->local)
2899 pfd_terminate(pf->local);
2900 del234(ssh->portfwds, pf); /* moving next one to index 0 */
2901 free_portfwd(pf);
2902 }
b72bdf11 2903 freetree234(ssh->portfwds);
2904 ssh->portfwds = NULL;
f8c9f9df 2905 }
ac934965 2906
2907 return ret;
36f94d1f 2908}
2909
7555d6a5 2910static void ssh_log(Plug plug, int type, SockAddr addr, int port,
2911 const char *error_msg, int error_code)
2912{
2913 Ssh ssh = (Ssh) plug;
2914 char addrbuf[256], *msg;
2915
2916 sk_getaddr(addr, addrbuf, lenof(addrbuf));
2917
2918 if (type == 0)
2919 msg = dupprintf("Connecting to %s port %d", addrbuf, port);
2920 else
2921 msg = dupprintf("Failed to connect to %s: %s", addrbuf, error_msg);
2922
2923 logevent(msg);
fb983202 2924 sfree(msg);
7555d6a5 2925}
2926
cbe2d68f 2927static int ssh_closing(Plug plug, const char *error_msg, int error_code,
36f94d1f 2928 int calling_back)
2929{
2930 Ssh ssh = (Ssh) plug;
ac934965 2931 int need_notify = ssh_do_close(ssh, FALSE);
2932
9e296bfa 2933 if (!error_msg) {
2934 if (!ssh->close_expected)
2935 error_msg = "Server unexpectedly closed network connection";
2936 else
2937 error_msg = "Server closed network connection";
ac934965 2938 }
2939
d051d1b4 2940 if (ssh->close_expected && ssh->clean_exit && ssh->exitcode < 0)
2941 ssh->exitcode = 0;
2942
2425184b 2943 if (need_notify)
2944 notify_remote_exit(ssh->frontend);
2945
9e296bfa 2946 if (error_msg)
247308b5 2947 logevent(error_msg);
9e296bfa 2948 if (!ssh->close_expected || !ssh->clean_exit)
971bcc0a 2949 connection_fatal(ssh->frontend, "%s", error_msg);
7e78000d 2950 return 0;
2951}
2952
32874aea 2953static int ssh_receive(Plug plug, int urgent, char *data, int len)
2954{
51470298 2955 Ssh ssh = (Ssh) plug;
d8baa528 2956 ssh_gotdata(ssh, (unsigned char *)data, len);
51470298 2957 if (ssh->state == SSH_STATE_CLOSED) {
ac934965 2958 ssh_do_close(ssh, TRUE);
32874aea 2959 return 0;
3257deae 2960 }
fef97f43 2961 return 1;
374330e2 2962}
2963
5471d09a 2964static void ssh_sent(Plug plug, int bufsize)
2965{
51470298 2966 Ssh ssh = (Ssh) plug;
5471d09a 2967 /*
2968 * If the send backlog on the SSH socket itself clears, we
2969 * should unthrottle the whole world if it was throttled.
2970 */
2971 if (bufsize < SSH_MAX_BACKLOG)
51470298 2972 ssh_throttle_all(ssh, 0, bufsize);
5471d09a 2973}
2974
fb09bf1c 2975/*
8df7a775 2976 * Connect to specified host and port.
2977 * Returns an error message, or NULL on success.
6e1ebb76 2978 * Also places the canonical host name into `realhost'. It must be
2979 * freed by the caller.
8df7a775 2980 */
cbe2d68f 2981static const char *connect_to_host(Ssh ssh, char *host, int port,
79bf227b 2982 char **realhost, int nodelay, int keepalive)
8df7a775 2983{
51470298 2984 static const struct plug_function_table fn_table = {
7555d6a5 2985 ssh_log,
7e78000d 2986 ssh_closing,
5471d09a 2987 ssh_receive,
2988 ssh_sent,
2989 NULL
51470298 2990 };
7e78000d 2991
8df7a775 2992 SockAddr addr;
cbe2d68f 2993 const char *err;
4a693cfc 2994 char *loghost;
2995 int addressfamily, sshprot;
2996
2997 loghost = conf_get_str(ssh->conf, CONF_loghost);
2998 if (*loghost) {
881da168 2999 char *colon;
8df7a775 3000
4a693cfc 3001 ssh->savedhost = dupstr(loghost);
881da168 3002 ssh->savedport = 22; /* default ssh port */
3003
3004 /*
3005 * A colon suffix on savedhost also lets us affect
3006 * savedport.
3007 *
3008 * (FIXME: do something about IPv6 address literals here.)
3009 */
3010 colon = strrchr(ssh->savedhost, ':');
3011 if (colon) {
3012 *colon++ = '\0';
3013 if (*colon)
3014 ssh->savedport = atoi(colon);
3015 }
3016 } else {
3017 ssh->savedhost = dupstr(host);
3018 if (port < 0)
3019 port = 22; /* default ssh port */
3020 ssh->savedport = port;
3021 }
8df7a775 3022
3023 /*
3024 * Try to find host.
3025 */
4a693cfc 3026 addressfamily = conf_get_int(ssh->conf, CONF_addressfamily);
05581745 3027 logeventf(ssh, "Looking up host \"%s\"%s", host,
4a693cfc 3028 (addressfamily == ADDRTYPE_IPV4 ? " (IPv4)" :
3029 (addressfamily == ADDRTYPE_IPV6 ? " (IPv6)" : "")));
3030 addr = name_lookup(host, port, realhost, ssh->conf, addressfamily);
170c1e6e 3031 if ((err = sk_addr_error(addr)) != NULL) {
3032 sk_addr_free(addr);
8df7a775 3033 return err;
170c1e6e 3034 }
42af6a67 3035 ssh->fullhostname = dupstr(*realhost); /* save in case of GSSAPI */
8df7a775 3036
8df7a775 3037 /*
3038 * Open socket.
3039 */
51470298 3040 ssh->fn = &fn_table;
e8fa8f62 3041 ssh->s = new_connection(addr, *realhost, port,
4a693cfc 3042 0, 1, nodelay, keepalive, (Plug) ssh, ssh->conf);
70e5d0fd 3043 if ((err = sk_socket_error(ssh->s)) != NULL) {
51470298 3044 ssh->s = NULL;
39934deb 3045 notify_remote_exit(ssh->frontend);
8df7a775 3046 return err;
67c4ba2e 3047 }
8df7a775 3048
ff05dfef 3049 /*
3050 * If the SSH version number's fixed, set it now, and if it's SSH-2,
3051 * send the version string too.
3052 */
4a693cfc 3053 sshprot = conf_get_int(ssh->conf, CONF_sshprot);
3054 if (sshprot == 0)
ff05dfef 3055 ssh->version = 1;
4a693cfc 3056 if (sshprot == 3) {
ff05dfef 3057 ssh->version = 2;
3058 ssh_send_verstring(ssh, NULL);
3059 }
3060
881da168 3061 /*
3062 * loghost, if configured, overrides realhost.
3063 */
4a693cfc 3064 if (*loghost) {
881da168 3065 sfree(*realhost);
4a693cfc 3066 *realhost = dupstr(loghost);
881da168 3067 }
3068
8df7a775 3069 return NULL;
3070}
3071
3072/*
5471d09a 3073 * Throttle or unthrottle the SSH connection.
3074 */
ff68564b 3075static void ssh_throttle_conn(Ssh ssh, int adjust)
5471d09a 3076{
ff68564b 3077 int old_count = ssh->conn_throttle_count;
3078 ssh->conn_throttle_count += adjust;
3079 assert(ssh->conn_throttle_count >= 0);
3080 if (ssh->conn_throttle_count && !old_count) {
3d9449a1 3081 ssh_set_frozen(ssh, 1);
ff68564b 3082 } else if (!ssh->conn_throttle_count && old_count) {
3d9449a1 3083 ssh_set_frozen(ssh, 0);
5471d09a 3084 }
3085}
3086
3087/*
3088 * Throttle or unthrottle _all_ local data streams (for when sends
3089 * on the SSH connection itself back up).
3090 */
51470298 3091static void ssh_throttle_all(Ssh ssh, int enable, int bufsize)
5471d09a 3092{
3093 int i;
3094 struct ssh_channel *c;
3095
51470298 3096 if (enable == ssh->throttled_all)
5471d09a 3097 return;
51470298 3098 ssh->throttled_all = enable;
3099 ssh->overall_bufsize = bufsize;
3100 if (!ssh->channels)
5471d09a 3101 return;
51470298 3102 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++) {
5471d09a 3103 switch (c->type) {
3104 case CHAN_MAINSESSION:
3105 /*
3106 * This is treated separately, outside the switch.
3107 */
3108 break;
3109 case CHAN_X11:
3110 x11_override_throttle(c->u.x11.s, enable);
3111 break;
3112 case CHAN_AGENT:
3113 /* Agent channels require no buffer management. */
3114 break;
3115 case CHAN_SOCKDATA:
36f94d1f 3116 pfd_override_throttle(c->u.pfd.s, enable);
5471d09a 3117 break;
3118 }
3119 }
3120}
3121
f11d78f2 3122static void ssh_agent_callback(void *sshv, void *reply, int replylen)
839f10db 3123{
3124 Ssh ssh = (Ssh) sshv;
3125
3126 ssh->agent_response = reply;
3127 ssh->agent_response_len = replylen;
3128
3129 if (ssh->version == 1)
ff3187f6 3130 do_ssh1_login(ssh, NULL, -1, NULL);
839f10db 3131 else
ff3187f6 3132 do_ssh2_authconn(ssh, NULL, -1, NULL);
839f10db 3133}
3134
3d9449a1 3135static void ssh_dialog_callback(void *sshv, int ret)
3136{
3137 Ssh ssh = (Ssh) sshv;
3138
3139 ssh->user_response = ret;
3140
3141 if (ssh->version == 1)
3142 do_ssh1_login(ssh, NULL, -1, NULL);
3143 else
3144 do_ssh2_transport(ssh, NULL, -1, NULL);
3145
3146 /*
3147 * This may have unfrozen the SSH connection, so do a
3148 * queued-data run.
3149 */
3150 ssh_process_queued_incoming_data(ssh);
3151}
3152
f11d78f2 3153static void ssh_agentf_callback(void *cv, void *reply, int replylen)
839f10db 3154{
3155 struct ssh_channel *c = (struct ssh_channel *)cv;
3156 Ssh ssh = c->ssh;
3157 void *sentreply = reply;
3158
3159 if (!sentreply) {
3160 /* Fake SSH_AGENT_FAILURE. */
3161 sentreply = "\0\0\0\1\5";
3162 replylen = 5;
3163 }
3164 if (ssh->version == 2) {
3165 ssh2_add_channel_data(c, sentreply, replylen);
3166 ssh2_try_send(c);
3167 } else {
3168 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
3169 PKT_INT, c->remoteid,
3170 PKT_INT, replylen,
a2724fba 3171 PKTT_DATA,
839f10db 3172 PKT_DATA, sentreply, replylen,
9a10ecf4 3173 PKTT_OTHER,
839f10db 3174 PKT_END);
3175 }
3176 if (reply)
3177 sfree(reply);
3178}
3179
0405e71f 3180/*
9e296bfa 3181 * Client-initiated disconnection. Send a DISCONNECT if `wire_reason'
3182 * non-NULL, otherwise just close the connection. `client_reason' == NULL
3183 * => log `wire_reason'.
3184 */
3185static void ssh_disconnect(Ssh ssh, char *client_reason, char *wire_reason,
3186 int code, int clean_exit)
3187{
3188 char *error;
3189 if (!client_reason)
3190 client_reason = wire_reason;
3191 if (client_reason)
3192 error = dupprintf("Disconnected: %s", client_reason);
3193 else
3194 error = dupstr("Disconnected");
3195 if (wire_reason) {
3196 if (ssh->version == 1) {
3197 send_packet(ssh, SSH1_MSG_DISCONNECT, PKT_STR, wire_reason,
3198 PKT_END);
3199 } else if (ssh->version == 2) {
3200 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT);
3201 ssh2_pkt_adduint32(pktout, code);
3202 ssh2_pkt_addstring(pktout, wire_reason);
3203 ssh2_pkt_addstring(pktout, "en"); /* language tag */
3204 ssh2_pkt_send_noqueue(ssh, pktout);
3205 }
3206 }
3207 ssh->close_expected = TRUE;
3208 ssh->clean_exit = clean_exit;
3209 ssh_closing((Plug)ssh, error, 0, 0);
3210 sfree(error);
3211}
3212
3213/*
fb09bf1c 3214 * Handle the key exchange and user authentication phases.
3215 */
ff3187f6 3216static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
3217 struct Packet *pktin)
fb09bf1c 3218{
0016d70b 3219 int i, j, ret;
3220 unsigned char cookie[8], *ptr;
374330e2 3221 struct RSAKey servkey, hostkey;
3222 struct MD5Context md5c;
51470298 3223 struct do_ssh1_login_state {
3224 int len;
3225 unsigned char *rsabuf, *keystr1, *keystr2;
3226 unsigned long supported_ciphers_mask, supported_auths_mask;
3227 int tried_publickey, tried_agent;
3228 int tis_auth_refused, ccard_auth_refused;
3229 unsigned char session_id[16];
3230 int cipher_type;
51470298 3231 void *publickey_blob;
3232 int publickey_bloblen;
edd0cb8a 3233 char *publickey_comment;
3234 int publickey_encrypted;
3235 prompts_t *cur_prompt;
51470298 3236 char c;
3237 int pwpkt_type;
3238 unsigned char request[5], *response, *p;
3239 int responselen;
3240 int keyi, nkeys;
3241 int authed;
3242 struct RSAKey key;
3243 Bignum challenge;
3244 char *commentp;
3245 int commentlen;
3d9449a1 3246 int dlgret;
4a693cfc 3247 Filename *keyfile;
51470298 3248 };
3249 crState(do_ssh1_login_state);
3250
3251 crBegin(ssh->do_ssh1_login_crstate);
374330e2 3252
ff3187f6 3253 if (!pktin)
3254 crWaitUntil(pktin);
374330e2 3255
ff3187f6 3256 if (pktin->type != SSH1_SMSG_PUBLIC_KEY) {
6b5cf8b4 3257 bombout(("Public key packet not received"));
7ffdbc1a 3258 crStop(0);
8d5de777 3259 }
374330e2 3260
c5e9c988 3261 logevent("Received public keys");
374330e2 3262
ff3187f6 3263 ptr = ssh_pkt_getdata(pktin, 8);
0016d70b 3264 if (!ptr) {
2e85c969 3265 bombout(("SSH-1 public key packet stopped before random cookie"));
0016d70b 3266 crStop(0);
3267 }
3268 memcpy(cookie, ptr, 8);
374330e2 3269
ff3187f6 3270 if (!ssh1_pkt_getrsakey(pktin, &servkey, &s->keystr1) ||
3271 !ssh1_pkt_getrsakey(pktin, &hostkey, &s->keystr2)) {
2e85c969 3272 bombout(("Failed to read SSH-1 public keys from public key packet"));
0016d70b 3273 crStop(0);
3274 }
374330e2 3275
c5e9c988 3276 /*
1c2a93c4 3277 * Log the host key fingerprint.
c5e9c988 3278 */
c5e9c988 3279 {
3280 char logmsg[80];
1c2a93c4 3281 logevent("Host key fingerprint is:");
c5e9c988 3282 strcpy(logmsg, " ");
32874aea 3283 hostkey.comment = NULL;
3284 rsa_fingerprint(logmsg + strlen(logmsg),
3285 sizeof(logmsg) - strlen(logmsg), &hostkey);
c5e9c988 3286 logevent(logmsg);
3287 }
3288
ff3187f6 3289 ssh->v1_remote_protoflags = ssh_pkt_getuint32(pktin);
3290 s->supported_ciphers_mask = ssh_pkt_getuint32(pktin);
3291 s->supported_auths_mask = ssh_pkt_getuint32(pktin);
d5b2c841 3292 if ((ssh->remote_bugs & BUG_CHOKES_ON_RSA))
3293 s->supported_auths_mask &= ~(1 << SSH1_AUTH_RSA);
bea1ef5f 3294
51470298 3295 ssh->v1_local_protoflags =
3296 ssh->v1_remote_protoflags & SSH1_PROTOFLAGS_SUPPORTED;
3297 ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
b96dc54c 3298
c5e9c988 3299 MD5Init(&md5c);
51470298 3300 MD5Update(&md5c, s->keystr2, hostkey.bytes);
3301 MD5Update(&md5c, s->keystr1, servkey.bytes);
0016d70b 3302 MD5Update(&md5c, cookie, 8);
51470298 3303 MD5Final(s->session_id, &md5c);
374330e2 3304
32874aea 3305 for (i = 0; i < 32; i++)
51470298 3306 ssh->session_key[i] = random_byte();
374330e2 3307
0016d70b 3308 /*
3309 * Verify that the `bits' and `bytes' parameters match.
3310 */
3311 if (hostkey.bits > hostkey.bytes * 8 ||
3312 servkey.bits > servkey.bytes * 8) {
2e85c969 3313 bombout(("SSH-1 public keys were badly formatted"));
0016d70b 3314 crStop(0);
3315 }
3316
51470298 3317 s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
374330e2 3318
3d88e64d 3319 s->rsabuf = snewn(s->len, unsigned char);
374330e2 3320
89ee5268 3321 /*
3322 * Verify the host key.
3323 */
3324 {
32874aea 3325 /*
3326 * First format the key into a string.
3327 */
3328 int len = rsastr_len(&hostkey);
3329 char fingerprint[100];
3d88e64d 3330 char *keystr = snewn(len, char);
32874aea 3331 rsastr_fmt(keystr, &hostkey);
3332 rsa_fingerprint(fingerprint, sizeof(fingerprint), &hostkey);
3d9449a1 3333
3334 ssh_set_frozen(ssh, 1);
3335 s->dlgret = verify_ssh_host_key(ssh->frontend,
3336 ssh->savedhost, ssh->savedport,
3337 "rsa", keystr, fingerprint,
3338 ssh_dialog_callback, ssh);
32874aea 3339 sfree(keystr);
3d9449a1 3340 if (s->dlgret < 0) {
3341 do {
3342 crReturn(0);
3343 if (pktin) {
3344 bombout(("Unexpected data from server while waiting"
3345 " for user host key response"));
3346 crStop(0);
3347 }
3348 } while (pktin || inlen > 0);
3349 s->dlgret = ssh->user_response;
3350 }
3351 ssh_set_frozen(ssh, 0);
3352
3353 if (s->dlgret == 0) {
9e296bfa 3354 ssh_disconnect(ssh, "User aborted at host key verification",
3355 NULL, 0, TRUE);
2b3f6c19 3356 crStop(0);
3d9449a1 3357 }
32874aea 3358 }
3359
3360 for (i = 0; i < 32; i++) {
51470298 3361 s->rsabuf[i] = ssh->session_key[i];
374330e2 3362 if (i < 16)
51470298 3363 s->rsabuf[i] ^= s->session_id[i];
374330e2 3364 }
3365
3366 if (hostkey.bytes > servkey.bytes) {
0016d70b 3367 ret = rsaencrypt(s->rsabuf, 32, &servkey);
3368 if (ret)
3369 ret = rsaencrypt(s->rsabuf, servkey.bytes, &hostkey);
374330e2 3370 } else {
0016d70b 3371 ret = rsaencrypt(s->rsabuf, 32, &hostkey);
3372 if (ret)
3373 ret = rsaencrypt(s->rsabuf, hostkey.bytes, &servkey);
3374 }
3375 if (!ret) {
2e85c969 3376 bombout(("SSH-1 public key encryptions failed due to bad formatting"));
0016d70b 3377 crStop(0);
374330e2 3378 }
3379
c5e9c988 3380 logevent("Encrypted session key");
3381
ca20bfcf 3382 {
3383 int cipher_chosen = 0, warn = 0;
3384 char *cipher_string = NULL;
51470298 3385 int i;
ca20bfcf 3386 for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) {
4a693cfc 3387 int next_cipher = conf_get_int_int(ssh->conf,
3388 CONF_ssh_cipherlist, i);
ca20bfcf 3389 if (next_cipher == CIPHER_WARN) {
3390 /* If/when we choose a cipher, warn about it */
3391 warn = 1;
3392 } else if (next_cipher == CIPHER_AES) {
3393 /* XXX Probably don't need to mention this. */
2e85c969 3394 logevent("AES not supported in SSH-1, skipping");
ca20bfcf 3395 } else {
3396 switch (next_cipher) {
51470298 3397 case CIPHER_3DES: s->cipher_type = SSH_CIPHER_3DES;
ca20bfcf 3398 cipher_string = "3DES"; break;
51470298 3399 case CIPHER_BLOWFISH: s->cipher_type = SSH_CIPHER_BLOWFISH;
ca20bfcf 3400 cipher_string = "Blowfish"; break;
51470298 3401 case CIPHER_DES: s->cipher_type = SSH_CIPHER_DES;
ca20bfcf 3402 cipher_string = "single-DES"; break;
3403 }
51470298 3404 if (s->supported_ciphers_mask & (1 << s->cipher_type))
ca20bfcf 3405 cipher_chosen = 1;
3406 }
3407 }
3408 if (!cipher_chosen) {
51470298 3409 if ((s->supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0)
2e85c969 3410 bombout(("Server violates SSH-1 protocol by not "
ca20bfcf 3411 "supporting 3DES encryption"));
3412 else
3413 /* shouldn't happen */
6b5cf8b4 3414 bombout(("No supported ciphers found"));
7ffdbc1a 3415 crStop(0);
a99a05c0 3416 }
ca20bfcf 3417
3418 /* Warn about chosen cipher if necessary. */
bb348ab1 3419 if (warn) {
3d9449a1 3420 ssh_set_frozen(ssh, 1);
3421 s->dlgret = askalg(ssh->frontend, "cipher", cipher_string,
3422 ssh_dialog_callback, ssh);
3423 if (s->dlgret < 0) {
3424 do {
3425 crReturn(0);
3426 if (pktin) {
3427 bombout(("Unexpected data from server while waiting"
3428 " for user response"));
3429 crStop(0);
3430 }
3431 } while (pktin || inlen > 0);
3432 s->dlgret = ssh->user_response;
3433 }
3434 ssh_set_frozen(ssh, 0);
3435 if (s->dlgret == 0) {
9e296bfa 3436 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
3437 0, TRUE);
96ccde8b 3438 crStop(0);
3d9449a1 3439 }
bb348ab1 3440 }
bea1ef5f 3441 }
ca20bfcf 3442
51470298 3443 switch (s->cipher_type) {
32874aea 3444 case SSH_CIPHER_3DES:
3445 logevent("Using 3DES encryption");
3446 break;
3447 case SSH_CIPHER_DES:
3448 logevent("Using single-DES encryption");
3449 break;
3450 case SSH_CIPHER_BLOWFISH:
3451 logevent("Using Blowfish encryption");
3452 break;
c5e9c988 3453 }
bea1ef5f 3454
51470298 3455 send_packet(ssh, SSH1_CMSG_SESSION_KEY,
3456 PKT_CHAR, s->cipher_type,
32874aea 3457 PKT_DATA, cookie, 8,
51470298 3458 PKT_CHAR, (s->len * 8) >> 8, PKT_CHAR, (s->len * 8) & 0xFF,
3459 PKT_DATA, s->rsabuf, s->len,
3460 PKT_INT, ssh->v1_local_protoflags, PKT_END);
fb09bf1c 3461
c5e9c988 3462 logevent("Trying to enable encryption...");
374330e2 3463
51470298 3464 sfree(s->rsabuf);
374330e2 3465
51470298 3466 ssh->cipher = (s->cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish_ssh1 :
3467 s->cipher_type == SSH_CIPHER_DES ? &ssh_des :
3468 &ssh_3des);
371e569c 3469 ssh->v1_cipher_ctx = ssh->cipher->make_context();
3470 ssh->cipher->sesskey(ssh->v1_cipher_ctx, ssh->session_key);
57356d63 3471 logeventf(ssh, "Initialised %s encryption", ssh->cipher->text_name);
374330e2 3472
0183b242 3473 ssh->crcda_ctx = crcda_make_context();
3474 logevent("Installing CRC compensation attack detector");
3475
679539d7 3476 if (servkey.modulus) {
3477 sfree(servkey.modulus);
3478 servkey.modulus = NULL;
3479 }
3480 if (servkey.exponent) {
3481 sfree(servkey.exponent);
3482 servkey.exponent = NULL;
3483 }
3484 if (hostkey.modulus) {
3485 sfree(hostkey.modulus);
3486 hostkey.modulus = NULL;
3487 }
3488 if (hostkey.exponent) {
3489 sfree(hostkey.exponent);
3490 hostkey.exponent = NULL;
3491 }
ff3187f6 3492 crWaitUntil(pktin);
374330e2 3493
ff3187f6 3494 if (pktin->type != SSH1_SMSG_SUCCESS) {
6b5cf8b4 3495 bombout(("Encryption not successfully enabled"));
7ffdbc1a 3496 crStop(0);
8d5de777 3497 }
374330e2 3498
c5e9c988 3499 logevent("Successfully started encryption");
3500
edd0cb8a 3501 fflush(stdout); /* FIXME eh? */
374330e2 3502 {
4a693cfc 3503 if ((ssh->username = get_remote_username(ssh->conf)) == NULL) {
edd0cb8a 3504 int ret; /* need not be kept over crReturn */
3505 s->cur_prompt = new_prompts(ssh->frontend);
3506 s->cur_prompt->to_server = TRUE;
3507 s->cur_prompt->name = dupstr("SSH login name");
4a693cfc 3508 /* 512 is an arbitrary upper limit on username size */
3509 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE, 512);
edd0cb8a 3510 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3511 while (ret < 0) {
51470298 3512 ssh->send_ok = 1;
edd0cb8a 3513 crWaitUntil(!pktin);
3514 ret = get_userpass_input(s->cur_prompt, in, inlen);
3515 ssh->send_ok = 0;
3516 }
3517 if (!ret) {
3518 /*
3519 * Failed to get a username. Terminate.
3520 */
3521 free_prompts(s->cur_prompt);
3522 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
3523 crStop(0);
32874aea 3524 }
4a693cfc 3525 ssh->username = dupstr(s->cur_prompt->prompts[0]->result);
edd0cb8a 3526 free_prompts(s->cur_prompt);
374330e2 3527 }
fb09bf1c 3528
4a693cfc 3529 send_packet(ssh, SSH1_CMSG_USER, PKT_STR, ssh->username, PKT_END);
c5e9c988 3530 {
4a693cfc 3531 char *userlog = dupprintf("Sent username \"%s\"", ssh->username);
c5e9c988 3532 logevent(userlog);
32874aea 3533 if (flags & FLAG_INTERACTIVE &&
3534 (!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) {
51470298 3535 c_write_str(ssh, userlog);
edd0cb8a 3536 c_write_str(ssh, "\r\n");
3c8e959b 3537 }
edd0cb8a 3538 sfree(userlog);
c5e9c988 3539 }
374330e2 3540 }
3541
ff3187f6 3542 crWaitUntil(pktin);
374330e2 3543
d5b2c841 3544 if ((s->supported_auths_mask & (1 << SSH1_AUTH_RSA)) == 0) {
0df73905 3545 /* We must not attempt PK auth. Pretend we've already tried it. */
51470298 3546 s->tried_publickey = s->tried_agent = 1;
0df73905 3547 } else {
51470298 3548 s->tried_publickey = s->tried_agent = 0;
0df73905 3549 }
51470298 3550 s->tis_auth_refused = s->ccard_auth_refused = 0;
edd0cb8a 3551 /*
3552 * Load the public half of any configured keyfile for later use.
3553 */
4a693cfc 3554 s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
3555 if (!filename_is_null(*s->keyfile)) {
edd0cb8a 3556 int keytype;
3557 logeventf(ssh, "Reading private key file \"%.150s\"",
4a693cfc 3558 filename_to_str(s->keyfile));
3559 keytype = key_type(s->keyfile);
edd0cb8a 3560 if (keytype == SSH_KEYTYPE_SSH1) {
3561 const char *error;
4a693cfc 3562 if (rsakey_pubblob(s->keyfile,
edd0cb8a 3563 &s->publickey_blob, &s->publickey_bloblen,
3564 &s->publickey_comment, &error)) {
4a693cfc 3565 s->publickey_encrypted = rsakey_encrypted(s->keyfile,
edd0cb8a 3566 NULL);
3567 } else {
3568 char *msgbuf;
3569 logeventf(ssh, "Unable to load private key (%s)", error);
3570 msgbuf = dupprintf("Unable to load private key file "
3571 "\"%.150s\" (%s)\r\n",
4a693cfc 3572 filename_to_str(s->keyfile),
edd0cb8a 3573 error);
3574 c_write_str(ssh, msgbuf);
3575 sfree(msgbuf);
3576 s->publickey_blob = NULL;
3577 }
3578 } else {
3579 char *msgbuf;
3580 logeventf(ssh, "Unable to use this key file (%s)",
3581 key_type_to_str(keytype));
3582 msgbuf = dupprintf("Unable to use key file \"%.150s\""
3583 " (%s)\r\n",
4a693cfc 3584 filename_to_str(s->keyfile),
edd0cb8a 3585 key_type_to_str(keytype));
3586 c_write_str(ssh, msgbuf);
3587 sfree(msgbuf);
51470298 3588 s->publickey_blob = NULL;
edd0cb8a 3589 }
396778f1 3590 } else
51470298 3591 s->publickey_blob = NULL;
7cca0d81 3592
ff3187f6 3593 while (pktin->type == SSH1_SMSG_FAILURE) {
51470298 3594 s->pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
614a20a0 3595
4a693cfc 3596 if (conf_get_int(ssh->conf, CONF_tryagent) && agent_exists() && !s->tried_agent) {
32874aea 3597 /*
3598 * Attempt RSA authentication using Pageant.
3599 */
32874aea 3600 void *r;
3601
51470298 3602 s->authed = FALSE;
3603 s->tried_agent = 1;
32874aea 3604 logevent("Pageant is running. Requesting keys.");
3605
3606 /* Request the keys held by the agent. */
51470298 3607 PUT_32BIT(s->request, 1);
3608 s->request[4] = SSH1_AGENTC_REQUEST_RSA_IDENTITIES;
839f10db 3609 if (!agent_query(s->request, 5, &r, &s->responselen,
3610 ssh_agent_callback, ssh)) {
3611 do {
3612 crReturn(0);
ff3187f6 3613 if (pktin) {
839f10db 3614 bombout(("Unexpected data from server while waiting"
3615 " for agent response"));
3616 crStop(0);
3617 }
ff3187f6 3618 } while (pktin || inlen > 0);
839f10db 3619 r = ssh->agent_response;
3620 s->responselen = ssh->agent_response_len;
3621 }
51470298 3622 s->response = (unsigned char *) r;
3623 if (s->response && s->responselen >= 5 &&
3624 s->response[4] == SSH1_AGENT_RSA_IDENTITIES_ANSWER) {
3625 s->p = s->response + 5;
3626 s->nkeys = GET_32BIT(s->p);
3627 s->p += 4;
2e85c969 3628 logeventf(ssh, "Pageant has %d SSH-1 keys", s->nkeys);
51470298 3629 for (s->keyi = 0; s->keyi < s->nkeys; s->keyi++) {
94cd7c3a 3630 unsigned char *pkblob = s->p;
51470298 3631 s->p += 4;
0016d70b 3632 {
3633 int n, ok = FALSE;
3634 do { /* do while (0) to make breaking easy */
3635 n = ssh1_read_bignum
3636 (s->p, s->responselen-(s->p-s->response),
3637 &s->key.exponent);
3638 if (n < 0)
3639 break;
3640 s->p += n;
3641 n = ssh1_read_bignum
3642 (s->p, s->responselen-(s->p-s->response),
3643 &s->key.modulus);
3644 if (n < 0)
3645 break;
3646 s->p += n;
3647 if (s->responselen - (s->p-s->response) < 4)
3648 break;
3649 s->commentlen = GET_32BIT(s->p);
3650 s->p += 4;
3651 if (s->responselen - (s->p-s->response) <
3652 s->commentlen)
3653 break;
3654 s->commentp = (char *)s->p;
3655 s->p += s->commentlen;
3656 ok = TRUE;
3657 } while (0);
3658 if (!ok) {
3659 logevent("Pageant key list packet was truncated");
3660 break;
3661 }
3662 }
94cd7c3a 3663 if (s->publickey_blob) {
3664 if (!memcmp(pkblob, s->publickey_blob,
3665 s->publickey_bloblen)) {
3666 logeventf(ssh, "Pageant key #%d matches "
3667 "configured key file", s->keyi);
3668 s->tried_publickey = 1;
3669 } else
3670 /* Skip non-configured key */
3671 continue;
3672 }
3673 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
51470298 3674 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3675 PKT_BIGNUM, s->key.modulus, PKT_END);
ff3187f6 3676 crWaitUntil(pktin);
3677 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
32874aea 3678 logevent("Key refused");
3679 continue;
3680 }
3681 logevent("Received RSA challenge");
ff3187f6 3682 if ((s->challenge = ssh1_pkt_getmp(pktin)) == NULL) {
0016d70b 3683 bombout(("Server's RSA challenge was badly formatted"));
3684 crStop(0);
3685 }
3686
32874aea 3687 {
3688 char *agentreq, *q, *ret;
2d466ffd 3689 void *vret;
32874aea 3690 int len, retlen;
3691 len = 1 + 4; /* message type, bit count */
51470298 3692 len += ssh1_bignum_length(s->key.exponent);
3693 len += ssh1_bignum_length(s->key.modulus);
3694 len += ssh1_bignum_length(s->challenge);
32874aea 3695 len += 16; /* session id */
3696 len += 4; /* response format */
3d88e64d 3697 agentreq = snewn(4 + len, char);
32874aea 3698 PUT_32BIT(agentreq, len);
3699 q = agentreq + 4;
3700 *q++ = SSH1_AGENTC_RSA_CHALLENGE;
51470298 3701 PUT_32BIT(q, bignum_bitcount(s->key.modulus));
32874aea 3702 q += 4;
51470298 3703 q += ssh1_write_bignum(q, s->key.exponent);
3704 q += ssh1_write_bignum(q, s->key.modulus);
3705 q += ssh1_write_bignum(q, s->challenge);
3706 memcpy(q, s->session_id, 16);
32874aea 3707 q += 16;
3708 PUT_32BIT(q, 1); /* response format */
839f10db 3709 if (!agent_query(agentreq, len + 4, &vret, &retlen,
3710 ssh_agent_callback, ssh)) {
3711 sfree(agentreq);
3712 do {
3713 crReturn(0);
ff3187f6 3714 if (pktin) {
839f10db 3715 bombout(("Unexpected data from server"
3716 " while waiting for agent"
3717 " response"));
3718 crStop(0);
3719 }
ff3187f6 3720 } while (pktin || inlen > 0);
839f10db 3721 vret = ssh->agent_response;
3722 retlen = ssh->agent_response_len;
3723 } else
3724 sfree(agentreq);
2d466ffd 3725 ret = vret;
32874aea 3726 if (ret) {
3727 if (ret[4] == SSH1_AGENT_RSA_RESPONSE) {
3728 logevent("Sending Pageant's response");
51470298 3729 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
32874aea 3730 PKT_DATA, ret + 5, 16,
3731 PKT_END);
3732 sfree(ret);
ff3187f6 3733 crWaitUntil(pktin);
3734 if (pktin->type == SSH1_SMSG_SUCCESS) {
32874aea 3735 logevent
3736 ("Pageant's response accepted");
3737 if (flags & FLAG_VERBOSE) {
51470298 3738 c_write_str(ssh, "Authenticated using"
3739 " RSA key \"");
3740 c_write(ssh, s->commentp,
3741 s->commentlen);
3742 c_write_str(ssh, "\" from agent\r\n");
32874aea 3743 }
51470298 3744 s->authed = TRUE;
32874aea 3745 } else
3746 logevent
3747 ("Pageant's response not accepted");
3748 } else {
3749 logevent
3750 ("Pageant failed to answer challenge");
3751 sfree(ret);
3752 }
3753 } else {
3754 logevent("No reply received from Pageant");
3755 }
3756 }
51470298 3757 freebn(s->key.exponent);
3758 freebn(s->key.modulus);
3759 freebn(s->challenge);
3760 if (s->authed)
32874aea 3761 break;
3762 }
29b1d0b3 3763 sfree(s->response);
94cd7c3a 3764 if (s->publickey_blob && !s->tried_publickey)
3765 logevent("Configured key file not in Pageant");
5ff99b8e 3766 } else {
3767 logevent("Failed to get reply from Pageant");
3768 }
51470298 3769 if (s->authed)
32874aea 3770 break;
3771 }
edd0cb8a 3772 if (s->publickey_blob && !s->tried_publickey) {
3773 /*
3774 * Try public key authentication with the specified
3775 * key file.
3776 */
3777 int got_passphrase; /* need not be kept over crReturn */
3778 if (flags & FLAG_VERBOSE)
3779 c_write_str(ssh, "Trying public key authentication.\r\n");
4a693cfc 3780 s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
edd0cb8a 3781 logeventf(ssh, "Trying public key \"%s\"",
4a693cfc 3782 filename_to_str(s->keyfile));
edd0cb8a 3783 s->tried_publickey = 1;
3784 got_passphrase = FALSE;
3785 while (!got_passphrase) {
3786 /*
3787 * Get a passphrase, if necessary.
3788 */
3789 char *passphrase = NULL; /* only written after crReturn */
3790 const char *error;
3791 if (!s->publickey_encrypted) {
3792 if (flags & FLAG_VERBOSE)
3793 c_write_str(ssh, "No passphrase required.\r\n");
3794 passphrase = NULL;
3795 } else {
3796 int ret; /* need not be kept over crReturn */
3797 s->cur_prompt = new_prompts(ssh->frontend);
3798 s->cur_prompt->to_server = FALSE;
3799 s->cur_prompt->name = dupstr("SSH key passphrase");
3800 add_prompt(s->cur_prompt,
3801 dupprintf("Passphrase for key \"%.100s\": ",
3802 s->publickey_comment),
3803 FALSE, SSH_MAX_PASSWORD_LEN);
3804 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3805 while (ret < 0) {
3806 ssh->send_ok = 1;
3807 crWaitUntil(!pktin);
3808 ret = get_userpass_input(s->cur_prompt, in, inlen);
3809 ssh->send_ok = 0;
3810 }
3811 if (!ret) {
3812 /* Failed to get a passphrase. Terminate. */
3813 free_prompts(s->cur_prompt);
3814 ssh_disconnect(ssh, NULL, "Unable to authenticate",
3815 0, TRUE);
3816 crStop(0);
3817 }
3818 passphrase = dupstr(s->cur_prompt->prompts[0]->result);
3819 free_prompts(s->cur_prompt);
3820 }
3821 /*
3822 * Try decrypting key with passphrase.
3823 */
4a693cfc 3824 s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
3825 ret = loadrsakey(s->keyfile, &s->key, passphrase,
edd0cb8a 3826 &error);
3827 if (passphrase) {
3828 memset(passphrase, 0, strlen(passphrase));
3829 sfree(passphrase);
3830 }
3831 if (ret == 1) {
3832 /* Correct passphrase. */
3833 got_passphrase = TRUE;
3834 } else if (ret == 0) {
3835 c_write_str(ssh, "Couldn't load private key from ");
4a693cfc 3836 c_write_str(ssh, filename_to_str(s->keyfile));
edd0cb8a 3837 c_write_str(ssh, " (");
3838 c_write_str(ssh, error);
3839 c_write_str(ssh, ").\r\n");
3840 got_passphrase = FALSE;
3841 break; /* go and try something else */
3842 } else if (ret == -1) {
3843 c_write_str(ssh, "Wrong passphrase.\r\n"); /* FIXME */
edd0cb8a 3844 got_passphrase = FALSE;
3845 /* and try again */
43536490 3846 } else {
3847 assert(0 && "unexpected return from loadrsakey()");
edc23a8a 3848 got_passphrase = FALSE; /* placate optimisers */
edd0cb8a 3849 }
3850 }
3851
3852 if (got_passphrase) {
3853
3854 /*
3855 * Send a public key attempt.
3856 */
3857 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3858 PKT_BIGNUM, s->key.modulus, PKT_END);
3859
3860 crWaitUntil(pktin);
3861 if (pktin->type == SSH1_SMSG_FAILURE) {
3862 c_write_str(ssh, "Server refused our public key.\r\n");
7b575324 3863 continue; /* go and try something else */
edd0cb8a 3864 }
3865 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
3866 bombout(("Bizarre response to offer of public key"));
3867 crStop(0);
3868 }
3869
3870 {
3871 int i;
3872 unsigned char buffer[32];
3873 Bignum challenge, response;
3874
3875 if ((challenge = ssh1_pkt_getmp(pktin)) == NULL) {
3876 bombout(("Server's RSA challenge was badly formatted"));
3877 crStop(0);
3878 }
3879 response = rsadecrypt(challenge, &s->key);
3880 freebn(s->key.private_exponent);/* burn the evidence */
3881
3882 for (i = 0; i < 32; i++) {
3883 buffer[i] = bignum_byte(response, 31 - i);
3884 }
3885
3886 MD5Init(&md5c);
3887 MD5Update(&md5c, buffer, 32);
3888 MD5Update(&md5c, s->session_id, 16);
3889 MD5Final(buffer, &md5c);
3890
3891 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
3892 PKT_DATA, buffer, 16, PKT_END);
3893
3894 freebn(challenge);
3895 freebn(response);
3896 }
3897
3898 crWaitUntil(pktin);
3899 if (pktin->type == SSH1_SMSG_FAILURE) {
3900 if (flags & FLAG_VERBOSE)
3901 c_write_str(ssh, "Failed to authenticate with"
3902 " our public key.\r\n");
7b575324 3903 continue; /* go and try something else */
edd0cb8a 3904 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
3905 bombout(("Bizarre response to RSA authentication response"));
3906 crStop(0);
3907 }
3908
3909 break; /* we're through! */
3910 }
3911
3912 }
3913
3914 /*
3915 * Otherwise, try various forms of password-like authentication.
3916 */
3917 s->cur_prompt = new_prompts(ssh->frontend);
32874aea 3918
4a693cfc 3919 if (conf_get_int(ssh->conf, CONF_try_tis_auth) &&
51470298 3920 (s->supported_auths_mask & (1 << SSH1_AUTH_TIS)) &&
3921 !s->tis_auth_refused) {
3922 s->pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
32874aea 3923 logevent("Requested TIS authentication");
51470298 3924 send_packet(ssh, SSH1_CMSG_AUTH_TIS, PKT_END);
ff3187f6 3925 crWaitUntil(pktin);
3926 if (pktin->type != SSH1_SMSG_AUTH_TIS_CHALLENGE) {
32874aea 3927 logevent("TIS authentication declined");
3928 if (flags & FLAG_INTERACTIVE)
51470298 3929 c_write_str(ssh, "TIS authentication refused.\r\n");
3930 s->tis_auth_refused = 1;
614a20a0 3931 continue;
32874aea 3932 } else {
0016d70b 3933 char *challenge;
3934 int challengelen;
edd0cb8a 3935 char *instr_suf, *prompt;
0016d70b 3936
ff3187f6 3937 ssh_pkt_getstring(pktin, &challenge, &challengelen);
0016d70b 3938 if (!challenge) {
3939 bombout(("TIS challenge packet was badly formed"));
3940 crStop(0);
3941 }
32874aea 3942 logevent("Received TIS challenge");
edd0cb8a 3943 s->cur_prompt->to_server = TRUE;
3944 s->cur_prompt->name = dupstr("SSH TIS authentication");
614a20a0 3945 /* Prompt heuristic comes from OpenSSH */
edd0cb8a 3946 if (memchr(challenge, '\n', challengelen)) {
3947 instr_suf = dupstr("");
3948 prompt = dupprintf("%.*s", challengelen, challenge);
3949 } else {
3950 instr_suf = dupprintf("%.*s", challengelen, challenge);
3951 prompt = dupstr("Response: ");
3952 }
3953 s->cur_prompt->instruction =
3954 dupprintf("Using TIS authentication.%s%s",
3955 (*instr_suf) ? "\n" : "",
3956 instr_suf);
3957 s->cur_prompt->instr_reqd = TRUE;
3958 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3959 sfree(instr_suf);
32874aea 3960 }
3961 }
4a693cfc 3962 if (conf_get_int(ssh->conf, CONF_try_tis_auth) &&
51470298 3963 (s->supported_auths_mask & (1 << SSH1_AUTH_CCARD)) &&
3964 !s->ccard_auth_refused) {
3965 s->pwpkt_type = SSH1_CMSG_AUTH_CCARD_RESPONSE;
32874aea 3966 logevent("Requested CryptoCard authentication");
51470298 3967 send_packet(ssh, SSH1_CMSG_AUTH_CCARD, PKT_END);
ff3187f6 3968 crWaitUntil(pktin);
3969 if (pktin->type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
32874aea 3970 logevent("CryptoCard authentication declined");
51470298 3971 c_write_str(ssh, "CryptoCard authentication refused.\r\n");
3972 s->ccard_auth_refused = 1;
614a20a0 3973 continue;
32874aea 3974 } else {
0016d70b 3975 char *challenge;
3976 int challengelen;
edd0cb8a 3977 char *instr_suf, *prompt;
0016d70b 3978
ff3187f6 3979 ssh_pkt_getstring(pktin, &challenge, &challengelen);
0016d70b 3980 if (!challenge) {
3981 bombout(("CryptoCard challenge packet was badly formed"));
3982 crStop(0);
3983 }
32874aea 3984 logevent("Received CryptoCard challenge");
edd0cb8a 3985 s->cur_prompt->to_server = TRUE;
3986 s->cur_prompt->name = dupstr("SSH CryptoCard authentication");
3987 s->cur_prompt->name_reqd = FALSE;
3988 /* Prompt heuristic comes from OpenSSH */
3989 if (memchr(challenge, '\n', challengelen)) {
3990 instr_suf = dupstr("");
3991 prompt = dupprintf("%.*s", challengelen, challenge);
3992 } else {
3993 instr_suf = dupprintf("%.*s", challengelen, challenge);
3994 prompt = dupstr("Response: ");
3995 }
3996 s->cur_prompt->instruction =
3997 dupprintf("Using CryptoCard authentication.%s%s",
3998 (*instr_suf) ? "\n" : "",
3999 instr_suf);
4000 s->cur_prompt->instr_reqd = TRUE;
4001 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
4002 sfree(instr_suf);
32874aea 4003 }
4004 }
51470298 4005 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
8f9e3231 4006 if ((s->supported_auths_mask & (1 << SSH1_AUTH_PASSWORD)) == 0) {
4007 bombout(("No supported authentication methods available"));
4008 crStop(0);
4009 }
edd0cb8a 4010 s->cur_prompt->to_server = TRUE;
4011 s->cur_prompt->name = dupstr("SSH password");
4a693cfc 4012 add_prompt(s->cur_prompt, dupprintf("%s@%s's password: ",
4013 ssh->username, ssh->savedhost),
edd0cb8a 4014 FALSE, SSH_MAX_PASSWORD_LEN);
32874aea 4015 }
a52f067e 4016
614a20a0 4017 /*
4018 * Show password prompt, having first obtained it via a TIS
4019 * or CryptoCard exchange if we're doing TIS or CryptoCard
4020 * authentication.
4021 */
edd0cb8a 4022 {
4023 int ret; /* need not be kept over crReturn */
4024 ret = get_userpass_input(s->cur_prompt, NULL, 0);
4025 while (ret < 0) {
4026 ssh->send_ok = 1;
4027 crWaitUntil(!pktin);
4028 ret = get_userpass_input(s->cur_prompt, in, inlen);
4029 ssh->send_ok = 0;
4030 }
4031 if (!ret) {
32874aea 4032 /*
edd0cb8a 4033 * Failed to get a password (for example
32874aea 4034 * because one was supplied on the command line
4035 * which has already failed to work). Terminate.
4036 */
edd0cb8a 4037 free_prompts(s->cur_prompt);
4038 ssh_disconnect(ssh, NULL, "Unable to authenticate", 0, TRUE);
4039 crStop(0);
32874aea 4040 }
32874aea 4041 }
4042
edd0cb8a 4043 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
32874aea 4044 /*
edd0cb8a 4045 * Defence against traffic analysis: we send a
4046 * whole bunch of packets containing strings of
4047 * different lengths. One of these strings is the
4048 * password, in a SSH1_CMSG_AUTH_PASSWORD packet.
4049 * The others are all random data in
4050 * SSH1_MSG_IGNORE packets. This way a passive
4051 * listener can't tell which is the password, and
4052 * hence can't deduce the password length.
4053 *
4054 * Anybody with a password length greater than 16
4055 * bytes is going to have enough entropy in their
4056 * password that a listener won't find it _that_
4057 * much help to know how long it is. So what we'll
4058 * do is:
4059 *
4060 * - if password length < 16, we send 15 packets
4061 * containing string lengths 1 through 15
4062 *
4063 * - otherwise, we let N be the nearest multiple
4064 * of 8 below the password length, and send 8
4065 * packets containing string lengths N through
4066 * N+7. This won't obscure the order of
4067 * magnitude of the password length, but it will
4068 * introduce a bit of extra uncertainty.
4069 *
bf982899 4070 * A few servers can't deal with SSH1_MSG_IGNORE, at
4071 * least in this context. For these servers, we need
4072 * an alternative defence. We make use of the fact
4073 * that the password is interpreted as a C string:
4074 * so we can append a NUL, then some random data.
edd0cb8a 4075 *
bf982899 4076 * A few servers can deal with neither SSH1_MSG_IGNORE
4077 * here _nor_ a padded password string.
4078 * For these servers we are left with no defences
edd0cb8a 4079 * against password length sniffing.
32874aea 4080 */
bf982899 4081 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE) &&
4082 !(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
32874aea 4083 /*
edd0cb8a 4084 * The server can deal with SSH1_MSG_IGNORE, so
4085 * we can use the primary defence.
32874aea 4086 */
edd0cb8a 4087 int bottom, top, pwlen, i;
4088 char *randomstr;
32874aea 4089
edd0cb8a 4090 pwlen = strlen(s->cur_prompt->prompts[0]->result);
4091 if (pwlen < 16) {
4092 bottom = 0; /* zero length passwords are OK! :-) */
4093 top = 15;
4094 } else {
4095 bottom = pwlen & ~7;
4096 top = bottom + 7;
4097 }
32874aea 4098
edd0cb8a 4099 assert(pwlen >= bottom && pwlen <= top);
32874aea 4100
edd0cb8a 4101 randomstr = snewn(top + 1, char);
32874aea 4102
edd0cb8a 4103 for (i = bottom; i <= top; i++) {
4104 if (i == pwlen) {
4105 defer_packet(ssh, s->pwpkt_type,
4106 PKTT_PASSWORD, PKT_STR,
4107 s->cur_prompt->prompts[0]->result,
4108 PKTT_OTHER, PKT_END);
4109 } else {
4110 for (j = 0; j < i; j++) {
4111 do {
4112 randomstr[j] = random_byte();
4113 } while (randomstr[j] == '\0');
32874aea 4114 }
edd0cb8a 4115 randomstr[i] = '\0';
4116 defer_packet(ssh, SSH1_MSG_IGNORE,
4117 PKT_STR, randomstr, PKT_END);
32874aea 4118 }
edd0cb8a 4119 }
4120 logevent("Sending password with camouflage packets");
4121 ssh_pkt_defersend(ssh);
4122 sfree(randomstr);
4123 }
4124 else if (!(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
4125 /*
4126 * The server can't deal with SSH1_MSG_IGNORE
4127 * but can deal with padded passwords, so we
4128 * can use the secondary defence.
4129 */
4130 char string[64];
4131 char *ss;
4132 int len;
4133
4134 len = strlen(s->cur_prompt->prompts[0]->result);
4135 if (len < sizeof(string)) {
4136 ss = string;
4137 strcpy(string, s->cur_prompt->prompts[0]->result);
4138 len++; /* cover the zero byte */
4139 while (len < sizeof(string)) {
4140 string[len++] = (char) random_byte();
bd358db1 4141 }
bd358db1 4142 } else {
edd0cb8a 4143 ss = s->cur_prompt->prompts[0]->result;
32874aea 4144 }
edd0cb8a 4145 logevent("Sending length-padded password");
9a10ecf4 4146 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
edd0cb8a 4147 PKT_INT, len, PKT_DATA, ss, len,
4148 PKTT_OTHER, PKT_END);
4149 } else {
4150 /*
bf982899 4151 * The server is believed unable to cope with
4152 * any of our password camouflage methods.
edd0cb8a 4153 */
4154 int len;
4155 len = strlen(s->cur_prompt->prompts[0]->result);
4156 logevent("Sending unpadded password");
4157 send_packet(ssh, s->pwpkt_type,
4158 PKTT_PASSWORD, PKT_INT, len,
4159 PKT_DATA, s->cur_prompt->prompts[0]->result, len,
4160 PKTT_OTHER, PKT_END);
32874aea 4161 }
edd0cb8a 4162 } else {
4163 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
4164 PKT_STR, s->cur_prompt->prompts[0]->result,
4165 PKTT_OTHER, PKT_END);
32874aea 4166 }
c5e9c988 4167 logevent("Sent password");
edd0cb8a 4168 free_prompts(s->cur_prompt);
ff3187f6 4169 crWaitUntil(pktin);
4170 if (pktin->type == SSH1_SMSG_FAILURE) {
32874aea 4171 if (flags & FLAG_VERBOSE)
51470298 4172 c_write_str(ssh, "Access denied\r\n");
c5e9c988 4173 logevent("Authentication refused");
ff3187f6 4174 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
4175 bombout(("Strange packet received, type %d", pktin->type));
7ffdbc1a 4176 crStop(0);
374330e2 4177 }
4178 }
4179
edd0cb8a 4180 /* Clear up */
4181 if (s->publickey_blob) {
4182 sfree(s->publickey_blob);
4183 sfree(s->publickey_comment);
4184 }
4185
c5e9c988 4186 logevent("Authentication successful");
4187
fb09bf1c 4188 crFinish(1);
4189}
4190
32874aea 4191void sshfwd_close(struct ssh_channel *c)
4192{
51470298 4193 Ssh ssh = c->ssh;
4194
1ef619ae 4195 if (ssh->state == SSH_STATE_CLOSED)
36f94d1f 4196 return;
36f94d1f 4197
75778ef1 4198 if (!c->closes) {
4ed34d25 4199 /*
64d6ff88 4200 * If halfopen is true, we have sent
4ed34d25 4201 * CHANNEL_OPEN for this channel, but it hasn't even been
4202 * acknowledged by the server. So we must set a close flag
4203 * on it now, and then when the server acks the channel
4204 * open, we can close it then.
4205 */
64d6ff88 4206 if (!c->halfopen) {
51470298 4207 if (ssh->version == 1) {
4208 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
4ed34d25 4209 PKT_END);
78280721 4210 c->closes = 1; /* sent MSG_CLOSE */
4ed34d25 4211 } else {
78280721 4212 int bytes_to_send = bufchain_size(&c->v.v2.outbuffer);
4213 if (bytes_to_send > 0) {
4214 /*
4215 * If we still have unsent data in our outgoing
4216 * buffer for this channel, we can't actually
4217 * initiate a close operation yet or that data
4218 * will be lost. Instead, set the pending_close
4219 * flag so that when we do clear the buffer
4220 * we'll start closing the channel.
4221 */
4222 char logmsg[160] = {'\0'};
4223 sprintf(
4224 logmsg,
4225 "Forwarded port pending to be closed : "
4226 "%d bytes remaining",
4227 bytes_to_send);
4228 logevent(logmsg);
4229
4230 c->pending_close = TRUE;
4231 } else {
4232 /*
4233 * No locally buffered data, so we can send the
4234 * close message immediately.
4235 */
4236 struct Packet *pktout;
4237 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
4238 ssh2_pkt_adduint32(pktout, c->remoteid);
4239 ssh2_pkt_send(ssh, pktout);
4240 c->closes = 1; /* sent MSG_CLOSE */
4241 logevent("Nothing left to send, closing channel");
4242 }
4ed34d25 4243 }
32874aea 4244 }
78280721 4245
32874aea 4246 if (c->type == CHAN_X11) {
4247 c->u.x11.s = NULL;
d74d141c 4248 logevent("Forwarded X11 connection terminated");
4ed34d25 4249 } else if (c->type == CHAN_SOCKDATA ||
4250 c->type == CHAN_SOCKDATA_DORMANT) {
d74d141c 4251 c->u.pfd.s = NULL;
4252 logevent("Forwarded port closed");
32874aea 4253 }
4254 }
4255}
4256
5471d09a 4257int sshfwd_write(struct ssh_channel *c, char *buf, int len)
32874aea 4258{
51470298 4259 Ssh ssh = c->ssh;
4260
1ef619ae 4261 if (ssh->state == SSH_STATE_CLOSED)
36f94d1f 4262 return 0;
36f94d1f 4263
51470298 4264 if (ssh->version == 1) {
4265 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
32874aea 4266 PKT_INT, c->remoteid,
a2724fba 4267 PKT_INT, len, PKTT_DATA, PKT_DATA, buf, len,
9a10ecf4 4268 PKTT_OTHER, PKT_END);
5471d09a 4269 /*
2e85c969 4270 * In SSH-1 we can return 0 here - implying that forwarded
5471d09a 4271 * connections are never individually throttled - because
4272 * the only circumstance that can cause throttling will be
4273 * the whole SSH connection backing up, in which case
4274 * _everything_ will be throttled as a whole.
4275 */
4276 return 0;
783415f8 4277 } else {
32874aea 4278 ssh2_add_channel_data(c, buf, len);
5471d09a 4279 return ssh2_try_send(c);
4280 }
4281}
4282
4283void sshfwd_unthrottle(struct ssh_channel *c, int bufsize)
4284{
51470298 4285 Ssh ssh = c->ssh;
ff68564b 4286 int buflimit;
51470298 4287
1ef619ae 4288 if (ssh->state == SSH_STATE_CLOSED)
36f94d1f 4289 return;
36f94d1f 4290
51470298 4291 if (ssh->version == 1) {
ff68564b 4292 buflimit = SSH1_BUFFER_LIMIT;
5471d09a 4293 } else {
ff68564b 4294 buflimit = c->v.v2.locmaxwin;
4295 ssh2_set_window(c, bufsize < buflimit ? buflimit - bufsize : 0);
4296 }
4297 if (c->throttling_conn && bufsize <= buflimit) {
4298 c->throttling_conn = 0;
4299 ssh_throttle_conn(ssh, -1);
783415f8 4300 }
9c964e85 4301}
4302
06fadff5 4303static void ssh_queueing_handler(Ssh ssh, struct Packet *pktin)
4304{
4305 struct queued_handler *qh = ssh->qhead;
4306
4307 assert(qh != NULL);
4308
4309 assert(pktin->type == qh->msg1 || pktin->type == qh->msg2);
4310
4311 if (qh->msg1 > 0) {
4312 assert(ssh->packet_dispatch[qh->msg1] == ssh_queueing_handler);
4313 ssh->packet_dispatch[qh->msg1] = NULL;
4314 }
4315 if (qh->msg2 > 0) {
4316 assert(ssh->packet_dispatch[qh->msg2] == ssh_queueing_handler);
4317 ssh->packet_dispatch[qh->msg2] = NULL;
4318 }
4319
4320 if (qh->next) {
4321 ssh->qhead = qh->next;
4322
4323 if (ssh->qhead->msg1 > 0) {
4324 assert(ssh->packet_dispatch[ssh->qhead->msg1] == NULL);
4325 ssh->packet_dispatch[ssh->qhead->msg1] = ssh_queueing_handler;
4326 }
4327 if (ssh->qhead->msg2 > 0) {
4328 assert(ssh->packet_dispatch[ssh->qhead->msg2] == NULL);
4329 ssh->packet_dispatch[ssh->qhead->msg2] = ssh_queueing_handler;
4330 }
4331 } else {
4332 ssh->qhead = ssh->qtail = NULL;
4333 ssh->packet_dispatch[pktin->type] = NULL;
4334 }
4335
4336 qh->handler(ssh, pktin, qh->ctx);
4337
4338 sfree(qh);
4339}
4340
4341static void ssh_queue_handler(Ssh ssh, int msg1, int msg2,
4342 chandler_fn_t handler, void *ctx)
4343{
4344 struct queued_handler *qh;
4345
4346 qh = snew(struct queued_handler);
4347 qh->msg1 = msg1;
4348 qh->msg2 = msg2;
4349 qh->handler = handler;
4350 qh->ctx = ctx;
4351 qh->next = NULL;
4352
4353 if (ssh->qtail == NULL) {
4354 ssh->qhead = qh;
4355
4356 if (qh->msg1 > 0) {
4357 assert(ssh->packet_dispatch[qh->msg1] == NULL);
4358 ssh->packet_dispatch[qh->msg1] = ssh_queueing_handler;
4359 }
4360 if (qh->msg2 > 0) {
4361 assert(ssh->packet_dispatch[qh->msg2] == NULL);
4362 ssh->packet_dispatch[qh->msg2] = ssh_queueing_handler;
4363 }
4364 } else {
4365 ssh->qtail->next = qh;
4366 }
4367 ssh->qtail = qh;
4368}
4369
4370static void ssh_rportfwd_succfail(Ssh ssh, struct Packet *pktin, void *ctx)
4371{
4372 struct ssh_rportfwd *rpf, *pf = (struct ssh_rportfwd *)ctx;
4373
4374 if (pktin->type == (ssh->version == 1 ? SSH1_SMSG_SUCCESS :
4375 SSH2_MSG_REQUEST_SUCCESS)) {
4376 logeventf(ssh, "Remote port forwarding from %s enabled",
4377 pf->sportdesc);
4378 } else {
4379 logeventf(ssh, "Remote port forwarding from %s refused",
4380 pf->sportdesc);
4381
4382 rpf = del234(ssh->rportfwds, pf);
4383 assert(rpf == pf);
8aea57fd 4384 pf->pfrec->remote = NULL;
fda2feb1 4385 free_rportfwd(pf);
06fadff5 4386 }
4387}
4388
4a693cfc 4389static void ssh_setup_portfwd(Ssh ssh, Conf *conf)
06fadff5 4390{
84328ddb 4391 struct ssh_portfwd *epf;
4392 int i;
4a693cfc 4393 char *key, *val;
06fadff5 4394
fda2feb1 4395 if (!ssh->portfwds) {
4396 ssh->portfwds = newtree234(ssh_portcmp);
4397 } else {
4398 /*
4399 * Go through the existing port forwardings and tag them
84328ddb 4400 * with status==DESTROY. Any that we want to keep will be
4401 * re-enabled (status==KEEP) as we go through the
4402 * configuration and find out which bits are the same as
4403 * they were before.
fda2feb1 4404 */
4405 struct ssh_portfwd *epf;
4406 int i;
4407 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
84328ddb 4408 epf->status = DESTROY;
fda2feb1 4409 }
4410
4a693cfc 4411 for (val = conf_get_str_strs(conf, CONF_portfwd, NULL, &key);
4412 val != NULL;
4413 val = conf_get_str_strs(conf, CONF_portfwd, key, &key)) {
4414 char *kp, *kp2, *vp, *vp2;
84328ddb 4415 char address_family, type;
4416 int sport,dport,sserv,dserv;
4a693cfc 4417 char *sports, *dports, *saddr, *host;
4418
4419 kp = key;
84328ddb 4420
05581745 4421 address_family = 'A';
4422 type = 'L';
4a693cfc 4423 if (*kp == 'A' || *kp == '4' || *kp == '6')
4424 address_family = *kp++;
4425 if (*kp == 'L' || *kp == 'R')
4426 type = *kp++;
4427
4428 if ((kp2 = strchr(kp, ':')) != NULL) {
4429 /*
4430 * There's a colon in the middle of the source port
4431 * string, which means that the part before it is
4432 * actually a source address.
4433 */
4434 saddr = dupprintf("%.*s", (int)(kp2 - kp), kp);
4435 sports = kp2+1;
06fadff5 4436 } else {
4a693cfc 4437 saddr = NULL;
4438 sports = kp;
06fadff5 4439 }
4440 sport = atoi(sports);
4441 sserv = 0;
4442 if (sport == 0) {
4443 sserv = 1;
4444 sport = net_service_lookup(sports);
4445 if (!sport) {
4446 logeventf(ssh, "Service lookup failed for source"
4447 " port \"%s\"", sports);
4448 }
4449 }
4a693cfc 4450
4451 if (type == 'L' && !strcmp(val, "D")) {
4452 /* dynamic forwarding */
4453 host = NULL;
4454 dports = NULL;
4455 dport = -1;
4456 dserv = 0;
4457 type = 'D';
4458 } else {
4459 /* ordinary forwarding */
4460 vp = val;
4461 vp2 = vp + strcspn(vp, ":");
4462 host = dupprintf("%.*s", (int)(vp2 - vp), vp);
4463 if (vp2)
4464 vp2++;
4465 dports = vp2;
4466 dport = atoi(dports);
4467 dserv = 0;
4468 if (dport == 0) {
4469 dserv = 1;
4470 dport = net_service_lookup(dports);
4471 if (!dport) {
4472 logeventf(ssh, "Service lookup failed for destination"
4473 " port \"%s\"", dports);
4474 }
4475 }
4476 }
4477
06fadff5 4478 if (sport && dport) {
4479 /* Set up a description of the source port. */
fda2feb1 4480 struct ssh_portfwd *pfrec, *epfrec;
fda2feb1 4481
4482 pfrec = snew(struct ssh_portfwd);
4483 pfrec->type = type;
4a693cfc 4484 pfrec->saddr = saddr;
3fe92132 4485 pfrec->sserv = sserv ? dupstr(sports) : NULL;
fda2feb1 4486 pfrec->sport = sport;
4a693cfc 4487 pfrec->daddr = host;
3fe92132 4488 pfrec->dserv = dserv ? dupstr(dports) : NULL;
fda2feb1 4489 pfrec->dport = dport;
4490 pfrec->local = NULL;
4491 pfrec->remote = NULL;
05581745 4492 pfrec->addressfamily = (address_family == '4' ? ADDRTYPE_IPV4 :
4493 address_family == '6' ? ADDRTYPE_IPV6 :
4494 ADDRTYPE_UNSPEC);
fda2feb1 4495
4496 epfrec = add234(ssh->portfwds, pfrec);
4497 if (epfrec != pfrec) {
c00c1931 4498 if (epfrec->status == DESTROY) {
4499 /*
4500 * We already have a port forwarding up and running
4501 * with precisely these parameters. Hence, no need
4502 * to do anything; simply re-tag the existing one
4503 * as KEEP.
4504 */
4505 epfrec->status = KEEP;
4506 }
fda2feb1 4507 /*
c00c1931 4508 * Anything else indicates that there was a duplicate
4509 * in our input, which we'll silently ignore.
fda2feb1 4510 */
fda2feb1 4511 free_portfwd(pfrec);
84328ddb 4512 } else {
4513 pfrec->status = CREATE;
4514 }
4a693cfc 4515 } else {
4516 sfree(saddr);
4517 sfree(host);
84328ddb 4518 }
4519 }
4520
4521 /*
4522 * Now go through and destroy any port forwardings which were
4523 * not re-enabled.
4524 */
4525 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4526 if (epf->status == DESTROY) {
4527 char *message;
4528
4529 message = dupprintf("%s port forwarding from %s%s%d",
4530 epf->type == 'L' ? "local" :
4531 epf->type == 'R' ? "remote" : "dynamic",
4532 epf->saddr ? epf->saddr : "",
4533 epf->saddr ? ":" : "",
4534 epf->sport);
4535
4536 if (epf->type != 'D') {
4537 char *msg2 = dupprintf("%s to %s:%d", message,
4538 epf->daddr, epf->dport);
4539 sfree(message);
4540 message = msg2;
4541 }
4542
4543 logeventf(ssh, "Cancelling %s", message);
4544 sfree(message);
4545
8aea57fd 4546 /* epf->remote or epf->local may be NULL if setting up a
4547 * forwarding failed. */
84328ddb 4548 if (epf->remote) {
4549 struct ssh_rportfwd *rpf = epf->remote;
4550 struct Packet *pktout;
4551
4552 /*
4553 * Cancel the port forwarding at the server
4554 * end.
4555 */
4556 if (ssh->version == 1) {
4557 /*
4558 * We cannot cancel listening ports on the
2e85c969 4559 * server side in SSH-1! There's no message
84328ddb 4560 * to support it. Instead, we simply remove
4561 * the rportfwd record from the local end
4562 * so that any connections the server tries
4563 * to make on it are rejected.
4564 */
4565 } else {
4566 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4567 ssh2_pkt_addstring(pktout, "cancel-tcpip-forward");
4568 ssh2_pkt_addbool(pktout, 0);/* _don't_ want reply */
4569 if (epf->saddr) {
4570 ssh2_pkt_addstring(pktout, epf->saddr);
4a693cfc 4571 } else if (conf_get_int(conf, CONF_rport_acceptall)) {
4572 /* XXX: rport_acceptall may not represent
5188540b 4573 * what was used to open the original connection,
4574 * since it's reconfigurable. */
84328ddb 4575 ssh2_pkt_addstring(pktout, "0.0.0.0");
4576 } else {
4577 ssh2_pkt_addstring(pktout, "127.0.0.1");
4578 }
4579 ssh2_pkt_adduint32(pktout, epf->sport);
4580 ssh2_pkt_send(ssh, pktout);
4581 }
4582
4583 del234(ssh->rportfwds, rpf);
4584 free_rportfwd(rpf);
4585 } else if (epf->local) {
4586 pfd_terminate(epf->local);
4587 }
4588
4589 delpos234(ssh->portfwds, i);
4590 free_portfwd(epf);
4591 i--; /* so we don't skip one in the list */
4592 }
4593
4594 /*
4595 * And finally, set up any new port forwardings (status==CREATE).
4596 */
4597 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4598 if (epf->status == CREATE) {
4599 char *sportdesc, *dportdesc;
3fe92132 4600 sportdesc = dupprintf("%s%s%s%s%d%s",
84328ddb 4601 epf->saddr ? epf->saddr : "",
4602 epf->saddr ? ":" : "",
3fe92132 4603 epf->sserv ? epf->sserv : "",
4604 epf->sserv ? "(" : "",
4605 epf->sport,
4606 epf->sserv ? ")" : "");
84328ddb 4607 if (epf->type == 'D') {
4608 dportdesc = NULL;
4609 } else {
3fe92132 4610 dportdesc = dupprintf("%s:%s%s%d%s",
4611 epf->daddr,
4612 epf->dserv ? epf->dserv : "",
4613 epf->dserv ? "(" : "",
4614 epf->dport,
4615 epf->dserv ? ")" : "");
84328ddb 4616 }
05581745 4617
84328ddb 4618 if (epf->type == 'L') {
4619 const char *err = pfd_addforward(epf->daddr, epf->dport,
4620 epf->saddr, epf->sport,
4a693cfc 4621 ssh, conf,
84328ddb 4622 &epf->local,
4623 epf->addressfamily);
4624
4625 logeventf(ssh, "Local %sport %s forwarding to %s%s%s",
4626 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4627 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4628 sportdesc, dportdesc,
4629 err ? " failed: " : "", err ? err : "");
4630 } else if (epf->type == 'D') {
06fadff5 4631 const char *err = pfd_addforward(NULL, -1,
84328ddb 4632 epf->saddr, epf->sport,
4a693cfc 4633 ssh, conf,
84328ddb 4634 &epf->local,
4635 epf->addressfamily);
4636
4637 logeventf(ssh, "Local %sport %s SOCKS dynamic forwarding%s%s",
4638 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4639 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4640 sportdesc,
4641 err ? " failed: " : "", err ? err : "");
06fadff5 4642 } else {
4643 struct ssh_rportfwd *pf;
4644
4645 /*
4646 * Ensure the remote port forwardings tree exists.
4647 */
4648 if (!ssh->rportfwds) {
4649 if (ssh->version == 1)
4650 ssh->rportfwds = newtree234(ssh_rportcmp_ssh1);
4651 else
4652 ssh->rportfwds = newtree234(ssh_rportcmp_ssh2);
4653 }
4654
4655 pf = snew(struct ssh_rportfwd);
84328ddb 4656 strncpy(pf->dhost, epf->daddr, lenof(pf->dhost)-1);
4657 pf->dhost[lenof(pf->dhost)-1] = '\0';
4658 pf->dport = epf->dport;
4659 pf->sport = epf->sport;
06fadff5 4660 if (add234(ssh->rportfwds, pf) != pf) {
4661 logeventf(ssh, "Duplicate remote port forwarding to %s:%d",
84328ddb 4662 epf->daddr, epf->dport);
06fadff5 4663 sfree(pf);
4664 } else {
4665 logeventf(ssh, "Requesting remote port %s"
84328ddb 4666 " forward to %s", sportdesc, dportdesc);
06fadff5 4667
4668 pf->sportdesc = sportdesc;
4669 sportdesc = NULL;
84328ddb 4670 epf->remote = pf;
4671 pf->pfrec = epf;
06fadff5 4672
4673 if (ssh->version == 1) {
4674 send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST,
84328ddb 4675 PKT_INT, epf->sport,
4676 PKT_STR, epf->daddr,
4677 PKT_INT, epf->dport,
06fadff5 4678 PKT_END);
4679 ssh_queue_handler(ssh, SSH1_SMSG_SUCCESS,
4680 SSH1_SMSG_FAILURE,
4681 ssh_rportfwd_succfail, pf);
4682 } else {
4683 struct Packet *pktout;
4684 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4685 ssh2_pkt_addstring(pktout, "tcpip-forward");
4686 ssh2_pkt_addbool(pktout, 1);/* want reply */
84328ddb 4687 if (epf->saddr) {
4688 ssh2_pkt_addstring(pktout, epf->saddr);
4a693cfc 4689 } else if (conf_get_int(conf, CONF_rport_acceptall)) {
06fadff5 4690 ssh2_pkt_addstring(pktout, "0.0.0.0");
4691 } else {
4692 ssh2_pkt_addstring(pktout, "127.0.0.1");
4693 }
84328ddb 4694 ssh2_pkt_adduint32(pktout, epf->sport);
06fadff5 4695 ssh2_pkt_send(ssh, pktout);
4696
4697 ssh_queue_handler(ssh, SSH2_MSG_REQUEST_SUCCESS,
4698 SSH2_MSG_REQUEST_FAILURE,
4699 ssh_rportfwd_succfail, pf);
4700 }
4701 }
4702 }
4703 sfree(sportdesc);
84328ddb 4704 sfree(dportdesc);
06fadff5 4705 }
06fadff5 4706}
4707
51df0ab5 4708static void ssh1_smsg_stdout_stderr_data(Ssh ssh, struct Packet *pktin)
4709{
4710 char *string;
4711 int stringlen, bufsize;
4712
4713 ssh_pkt_getstring(pktin, &string, &stringlen);
4714 if (string == NULL) {
4715 bombout(("Incoming terminal data packet was badly formed"));
4716 return;
4717 }
4718
4719 bufsize = from_backend(ssh->frontend, pktin->type == SSH1_SMSG_STDERR_DATA,
4720 string, stringlen);
4721 if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
4722 ssh->v1_stdout_throttling = 1;
ff68564b 4723 ssh_throttle_conn(ssh, +1);
51df0ab5 4724 }
4725}
4726
4727static void ssh1_smsg_x11_open(Ssh ssh, struct Packet *pktin)
4728{
4729 /* Remote side is trying to open a channel to talk to our
4730 * X-Server. Give them back a local channel number. */
4731 struct ssh_channel *c;
4732 int remoteid = ssh_pkt_getuint32(pktin);
4733
4734 logevent("Received X11 connect request");
4735 /* Refuse if X11 forwarding is disabled. */
4736 if (!ssh->X11_fwd_enabled) {
4737 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4738 PKT_INT, remoteid, PKT_END);
4739 logevent("Rejected X11 connect request");
4740 } else {
4741 c = snew(struct ssh_channel);
4742 c->ssh = ssh;
4743
8def70c3 4744 if (x11_init(&c->u.x11.s, ssh->x11disp, c,
4a693cfc 4745 NULL, -1, ssh->conf) != NULL) {
51df0ab5 4746 logevent("Opening X11 forward connection failed");
4747 sfree(c);
4748 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4749 PKT_INT, remoteid, PKT_END);
4750 } else {
4751 logevent
4752 ("Opening X11 forward connection succeeded");
4753 c->remoteid = remoteid;
64d6ff88 4754 c->halfopen = FALSE;
51df0ab5 4755 c->localid = alloc_channel_id(ssh);
4756 c->closes = 0;
78280721 4757 c->pending_close = FALSE;
ff68564b 4758 c->throttling_conn = 0;
51df0ab5 4759 c->type = CHAN_X11; /* identify channel type */
4760 add234(ssh->channels, c);
4761 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4762 PKT_INT, c->remoteid, PKT_INT,
4763 c->localid, PKT_END);
4764 logevent("Opened X11 forward channel");
4765 }
4766 }
4767}
4768
4769static void ssh1_smsg_agent_open(Ssh ssh, struct Packet *pktin)
4770{
4771 /* Remote side is trying to open a channel to talk to our
4772 * agent. Give them back a local channel number. */
4773 struct ssh_channel *c;
4774 int remoteid = ssh_pkt_getuint32(pktin);
4775
4776 /* Refuse if agent forwarding is disabled. */
4777 if (!ssh->agentfwd_enabled) {
4778 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4779 PKT_INT, remoteid, PKT_END);
4780 } else {
4781 c = snew(struct ssh_channel);
4782 c->ssh = ssh;
4783 c->remoteid = remoteid;
64d6ff88 4784 c->halfopen = FALSE;
51df0ab5 4785 c->localid = alloc_channel_id(ssh);
4786 c->closes = 0;
78280721 4787 c->pending_close = FALSE;
ff68564b 4788 c->throttling_conn = 0;
51df0ab5 4789 c->type = CHAN_AGENT; /* identify channel type */
4790 c->u.a.lensofar = 0;
4791 add234(ssh->channels, c);
4792 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4793 PKT_INT, c->remoteid, PKT_INT, c->localid,
4794 PKT_END);
4795 }
4796}
4797
4798static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin)
4799{
4800 /* Remote side is trying to open a channel to talk to a
4801 * forwarded port. Give them back a local channel number. */
4802 struct ssh_channel *c;
05581745 4803 struct ssh_rportfwd pf, *pfp;
51df0ab5 4804 int remoteid;
4805 int hostsize, port;
fb983202 4806 char *host;
51df0ab5 4807 const char *e;
4808 c = snew(struct ssh_channel);
4809 c->ssh = ssh;
4810
4811 remoteid = ssh_pkt_getuint32(pktin);
4812 ssh_pkt_getstring(pktin, &host, &hostsize);
4813 port = ssh_pkt_getuint32(pktin);
4814
4815 if (hostsize >= lenof(pf.dhost))
4816 hostsize = lenof(pf.dhost)-1;
4817 memcpy(pf.dhost, host, hostsize);
4818 pf.dhost[hostsize] = '\0';
4819 pf.dport = port;
05581745 4820 pfp = find234(ssh->rportfwds, &pf, NULL);
51df0ab5 4821
05581745 4822 if (pfp == NULL) {
fb983202 4823 logeventf(ssh, "Rejected remote port open request for %s:%d",
4824 pf.dhost, port);
51df0ab5 4825 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4826 PKT_INT, remoteid, PKT_END);
4827 } else {
fb983202 4828 logeventf(ssh, "Received remote port open request for %s:%d",
4829 pf.dhost, port);
51df0ab5 4830 e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port,
4a693cfc 4831 c, ssh->conf, pfp->pfrec->addressfamily);
51df0ab5 4832 if (e != NULL) {
fb983202 4833 logeventf(ssh, "Port open failed: %s", e);
51df0ab5 4834 sfree(c);
4835 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4836 PKT_INT, remoteid, PKT_END);
4837 } else {
4838 c->remoteid = remoteid;
64d6ff88 4839 c->halfopen = FALSE;
51df0ab5 4840 c->localid = alloc_channel_id(ssh);
4841 c->closes = 0;
78280721 4842 c->pending_close = FALSE;
ff68564b 4843 c->throttling_conn = 0;
51df0ab5 4844 c->type = CHAN_SOCKDATA; /* identify channel type */
4845 add234(ssh->channels, c);
4846 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4847 PKT_INT, c->remoteid, PKT_INT,
4848 c->localid, PKT_END);
4849 logevent("Forwarded port opened successfully");
4850 }
4851 }
4852}
4853
4854static void ssh1_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
4855{
4856 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4857 unsigned int localid = ssh_pkt_getuint32(pktin);
4858 struct ssh_channel *c;
4859
4860 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4861 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4862 c->remoteid = localid;
64d6ff88 4863 c->halfopen = FALSE;
51df0ab5 4864 c->type = CHAN_SOCKDATA;
ff68564b 4865 c->throttling_conn = 0;
51df0ab5 4866 pfd_confirm(c->u.pfd.s);
4867 }
4868
4869 if (c && c->closes) {
4870 /*
4871 * We have a pending close on this channel,
4872 * which we decided on before the server acked
4873 * the channel open. So now we know the
4874 * remoteid, we can close it again.
4875 */
4876 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE,
4877 PKT_INT, c->remoteid, PKT_END);
4878 }
4879}
4880
4881static void ssh1_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
4882{
4883 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4884 struct ssh_channel *c;
4885
4886 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4887 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4888 logevent("Forwarded connection refused by server");
4889 pfd_close(c->u.pfd.s);
4890 del234(ssh->channels, c);
4891 sfree(c);
4892 }
4893}
4894
4895static void ssh1_msg_channel_close(Ssh ssh, struct Packet *pktin)
4896{
4897 /* Remote side closes a channel. */
4898 unsigned i = ssh_pkt_getuint32(pktin);
4899 struct ssh_channel *c;
4900 c = find234(ssh->channels, &i, ssh_channelfind);
64d6ff88 4901 if (c && !c->halfopen) {
51df0ab5 4902 int closetype;
4903 closetype =
4904 (pktin->type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2);
4905
4906 if ((c->closes == 0) && (c->type == CHAN_X11)) {
4907 logevent("Forwarded X11 connection terminated");
4908 assert(c->u.x11.s != NULL);
4909 x11_close(c->u.x11.s);
4910 c->u.x11.s = NULL;
4911 }
4912 if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) {
4913 logevent("Forwarded port closed");
4914 assert(c->u.pfd.s != NULL);
4915 pfd_close(c->u.pfd.s);
4916 c->u.pfd.s = NULL;
4917 }
4918
4919 c->closes |= (closetype << 2); /* seen this message */
4920 if (!(c->closes & closetype)) {
4921 send_packet(ssh, pktin->type, PKT_INT, c->remoteid,
4922 PKT_END);
4923 c->closes |= closetype; /* sent it too */
4924 }
4925
4926 if (c->closes == 15) {
4927 del234(ssh->channels, c);
4928 sfree(c);
4929 }
4930 } else {
4931 bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n",
4932 pktin->type == SSH1_MSG_CHANNEL_CLOSE ? "" :
4933 "_CONFIRMATION", c ? "half-open" : "nonexistent",
4934 i));
4935 }
4936}
4937
4938static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin)
4939{
4940 /* Data sent down one of our channels. */
4941 int i = ssh_pkt_getuint32(pktin);
4942 char *p;
6d44acc9 4943 int len;
51df0ab5 4944 struct ssh_channel *c;
4945
4946 ssh_pkt_getstring(pktin, &p, &len);
4947
4948 c = find234(ssh->channels, &i, ssh_channelfind);
4949 if (c) {
4950 int bufsize = 0;
4951 switch (c->type) {
4952 case CHAN_X11:
4953 bufsize = x11_send(c->u.x11.s, p, len);
4954 break;
4955 case CHAN_SOCKDATA:
4956 bufsize = pfd_send(c->u.pfd.s, p, len);
4957 break;
4958 case CHAN_AGENT:
4959 /* Data for an agent message. Buffer it. */
4960 while (len > 0) {
4961 if (c->u.a.lensofar < 4) {
62ddb51e 4962 unsigned int l = min(4 - c->u.a.lensofar, (unsigned)len);
51df0ab5 4963 memcpy(c->u.a.msglen + c->u.a.lensofar, p,
4964 l);
4965 p += l;
4966 len -= l;
4967 c->u.a.lensofar += l;
4968 }
4969 if (c->u.a.lensofar == 4) {
4970 c->u.a.totallen =
4971 4 + GET_32BIT(c->u.a.msglen);
4972 c->u.a.message = snewn(c->u.a.totallen,
4973 unsigned char);
4974 memcpy(c->u.a.message, c->u.a.msglen, 4);
4975 }
4976 if (c->u.a.lensofar >= 4 && len > 0) {
aa63ab7e 4977 unsigned int l =
51df0ab5 4978 min(c->u.a.totallen - c->u.a.lensofar,
62ddb51e 4979 (unsigned)len);
51df0ab5 4980 memcpy(c->u.a.message + c->u.a.lensofar, p,
4981 l);
4982 p += l;
4983 len -= l;
4984 c->u.a.lensofar += l;
4985 }
4986 if (c->u.a.lensofar == c->u.a.totallen) {
4987 void *reply;
4988 int replylen;
4989 if (agent_query(c->u.a.message,
4990 c->u.a.totallen,
4991 &reply, &replylen,
4992 ssh_agentf_callback, c))
4993 ssh_agentf_callback(c, reply, replylen);
4994 sfree(c->u.a.message);
4995 c->u.a.lensofar = 0;
4996 }
4997 }
4998 bufsize = 0; /* agent channels never back up */
4999 break;
5000 }
ff68564b 5001 if (!c->throttling_conn && bufsize > SSH1_BUFFER_LIMIT) {
5002 c->throttling_conn = 1;
5003 ssh_throttle_conn(ssh, +1);
51df0ab5 5004 }
5005 }
5006}
5007
5008static void ssh1_smsg_exit_status(Ssh ssh, struct Packet *pktin)
5009{
51df0ab5 5010 ssh->exitcode = ssh_pkt_getuint32(pktin);
fb983202 5011 logeventf(ssh, "Server sent command exit status %d", ssh->exitcode);
51df0ab5 5012 send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
5013 /*
5014 * In case `helpful' firewalls or proxies tack
5015 * extra human-readable text on the end of the
5016 * session which we might mistake for another
5017 * encrypted packet, we close the session once
5018 * we've sent EXIT_CONFIRMATION.
5019 */
9e296bfa 5020 ssh_disconnect(ssh, NULL, NULL, 0, TRUE);
51df0ab5 5021}
5022
c6ccd5c2 5023/* Helper function to deal with sending tty modes for REQUEST_PTY */
5024static void ssh1_send_ttymode(void *data, char *mode, char *val)
5025{
5026 struct Packet *pktout = (struct Packet *)data;
5027 int i = 0;
5028 unsigned int arg = 0;
5029 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
5030 if (i == lenof(ssh_ttymodes)) return;
5031 switch (ssh_ttymodes[i].type) {
5032 case TTY_OP_CHAR:
5033 arg = ssh_tty_parse_specchar(val);
5034 break;
5035 case TTY_OP_BOOL:
5036 arg = ssh_tty_parse_boolean(val);
5037 break;
5038 }
5039 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
5040 ssh2_pkt_addbyte(pktout, arg);
5041}
5042
5043
b09eaa88 5044static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
5045 struct Packet *pktin)
32874aea 5046{
b09eaa88 5047 crBegin(ssh->do_ssh1_connection_crstate);
fb09bf1c 5048
51df0ab5 5049 ssh->packet_dispatch[SSH1_SMSG_STDOUT_DATA] =
5050 ssh->packet_dispatch[SSH1_SMSG_STDERR_DATA] =
5051 ssh1_smsg_stdout_stderr_data;
5052
5053 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_CONFIRMATION] =
5054 ssh1_msg_channel_open_confirmation;
5055 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_FAILURE] =
5056 ssh1_msg_channel_open_failure;
5057 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE] =
5058 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION] =
5059 ssh1_msg_channel_close;
5060 ssh->packet_dispatch[SSH1_MSG_CHANNEL_DATA] = ssh1_msg_channel_data;
5061 ssh->packet_dispatch[SSH1_SMSG_EXIT_STATUS] = ssh1_smsg_exit_status;
5062
4a693cfc 5063 if (conf_get_int(ssh->conf, CONF_agentfwd) && agent_exists()) {
32874aea 5064 logevent("Requesting agent forwarding");
51470298 5065 send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END);
32874aea 5066 do {
5067 crReturnV;
ff3187f6 5068 } while (!pktin);
5069 if (pktin->type != SSH1_SMSG_SUCCESS
5070 && pktin->type != SSH1_SMSG_FAILURE) {
6b5cf8b4 5071 bombout(("Protocol confusion"));
7ffdbc1a 5072 crStopV;
ff3187f6 5073 } else if (pktin->type == SSH1_SMSG_FAILURE) {
32874aea 5074 logevent("Agent forwarding refused");
5075 } else {
5076 logevent("Agent forwarding enabled");
51470298 5077 ssh->agentfwd_enabled = TRUE;
51df0ab5 5078 ssh->packet_dispatch[SSH1_SMSG_AGENT_OPEN] = ssh1_smsg_agent_open;
db7d555c 5079 }
dacbd0e8 5080 }
5081
4a693cfc 5082 if (conf_get_int(ssh->conf, CONF_x11_forward) &&
5083 (ssh->x11disp = x11_setup_display(conf_get_str(ssh->conf, CONF_x11_display),
5084 conf_get_int(ssh->conf, CONF_x11_auth), ssh->conf))) {
32874aea 5085 logevent("Requesting X11 forwarding");
f68353be 5086 /*
5087 * Note that while we blank the X authentication data here, we don't
5088 * take any special action to blank the start of an X11 channel,
5089 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
5090 * without having session blanking enabled is likely to leak your
5091 * cookie into the log.
5092 */
51470298 5093 if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) {
5094 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
8def70c3 5095 PKT_STR, ssh->x11disp->remoteauthprotoname,
5096 PKTT_PASSWORD,
5097 PKT_STR, ssh->x11disp->remoteauthdatastring,
5098 PKTT_OTHER,
5099 PKT_INT, ssh->x11disp->screennum,
421d6835 5100 PKT_END);
32874aea 5101 } else {
51470298 5102 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
8def70c3 5103 PKT_STR, ssh->x11disp->remoteauthprotoname,
5104 PKTT_PASSWORD,
5105 PKT_STR, ssh->x11disp->remoteauthdatastring,
5106 PKTT_OTHER,
5107 PKT_END);
32874aea 5108 }
5109 do {
5110 crReturnV;
ff3187f6 5111 } while (!pktin);
5112 if (pktin->type != SSH1_SMSG_SUCCESS
5113 && pktin->type != SSH1_SMSG_FAILURE) {
6b5cf8b4 5114 bombout(("Protocol confusion"));
7ffdbc1a 5115 crStopV;
ff3187f6 5116 } else if (pktin->type == SSH1_SMSG_FAILURE) {
32874aea 5117 logevent("X11 forwarding refused");
5118 } else {
5119 logevent("X11 forwarding enabled");
51470298 5120 ssh->X11_fwd_enabled = TRUE;
51df0ab5 5121 ssh->packet_dispatch[SSH1_SMSG_X11_OPEN] = ssh1_smsg_x11_open;
9c964e85 5122 }
5123 }
5124
4a693cfc 5125 ssh_setup_portfwd(ssh, ssh->conf);
06fadff5 5126 ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = ssh1_msg_port_open;
d74d141c 5127
4a693cfc 5128 if (!conf_get_int(ssh->conf, CONF_nopty)) {
c6ccd5c2 5129 struct Packet *pkt;
a5dd8467 5130 /* Unpick the terminal-speed string. */
5131 /* XXX perhaps we should allow no speeds to be sent. */
db219738 5132 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
4a693cfc 5133 sscanf(conf_get_str(ssh->conf, CONF_termspeed), "%d,%d", &ssh->ospeed, &ssh->ispeed);
a5dd8467 5134 /* Send the pty request. */
c6ccd5c2 5135 pkt = ssh1_pkt_init(SSH1_CMSG_REQUEST_PTY);
4a693cfc 5136 ssh_pkt_addstring(pkt, conf_get_str(ssh->conf, CONF_termtype));
c6ccd5c2 5137 ssh_pkt_adduint32(pkt, ssh->term_height);
5138 ssh_pkt_adduint32(pkt, ssh->term_width);
5139 ssh_pkt_adduint32(pkt, 0); /* width in pixels */
5140 ssh_pkt_adduint32(pkt, 0); /* height in pixels */
4a693cfc 5141 parse_ttymodes(ssh, ssh1_send_ttymode, (void *)pkt);
c6ccd5c2 5142 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_ISPEED);
5143 ssh_pkt_adduint32(pkt, ssh->ispeed);
5144 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_OSPEED);
5145 ssh_pkt_adduint32(pkt, ssh->ospeed);
5146 ssh_pkt_addbyte(pkt, SSH_TTY_OP_END);
5147 s_wrpkt(ssh, pkt);
51470298 5148 ssh->state = SSH_STATE_INTERMED;
32874aea 5149 do {
5150 crReturnV;
ff3187f6 5151 } while (!pktin);
5152 if (pktin->type != SSH1_SMSG_SUCCESS
5153 && pktin->type != SSH1_SMSG_FAILURE) {
6b5cf8b4 5154 bombout(("Protocol confusion"));
7ffdbc1a 5155 crStopV;
ff3187f6 5156 } else if (pktin->type == SSH1_SMSG_FAILURE) {
51470298 5157 c_write_str(ssh, "Server refused to allocate pty\r\n");
5158 ssh->editing = ssh->echoing = 1;
32874aea 5159 }
a5dd8467 5160 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
db219738 5161 ssh->ospeed, ssh->ispeed);
0965bee0 5162 } else {
51470298 5163 ssh->editing = ssh->echoing = 1;
374330e2 5164 }
5165
4a693cfc 5166 if (conf_get_int(ssh->conf, CONF_compression)) {
51470298 5167 send_packet(ssh, SSH1_CMSG_REQUEST_COMPRESSION, PKT_INT, 6, PKT_END);
32874aea 5168 do {
5169 crReturnV;
ff3187f6 5170 } while (!pktin);
5171 if (pktin->type != SSH1_SMSG_SUCCESS
5172 && pktin->type != SSH1_SMSG_FAILURE) {
6b5cf8b4 5173 bombout(("Protocol confusion"));
7ffdbc1a 5174 crStopV;
ff3187f6 5175 } else if (pktin->type == SSH1_SMSG_FAILURE) {
51470298 5176 c_write_str(ssh, "Server refused to compress\r\n");
32874aea 5177 }
4ba9b64b 5178 logevent("Started compression");
51470298 5179 ssh->v1_compressing = TRUE;
5366aed8 5180 ssh->cs_comp_ctx = zlib_compress_init();
5181 logevent("Initialised zlib (RFC1950) compression");
5182 ssh->sc_comp_ctx = zlib_decompress_init();
5183 logevent("Initialised zlib (RFC1950) decompression");
4ba9b64b 5184 }
5185
fd5e5847 5186 /*
5187 * Start the shell or command.
5188 *
2e85c969 5189 * Special case: if the first-choice command is an SSH-2
fd5e5847 5190 * subsystem (hence not usable here) and the second choice
5191 * exists, we fall straight back to that.
5192 */
5193 {
4a693cfc 5194 char *cmd = conf_get_str(ssh->conf, CONF_remote_cmd);
fd5e5847 5195
4a693cfc 5196 if (conf_get_int(ssh->conf, CONF_ssh_subsys) &&
5197 conf_get_str(ssh->conf, CONF_remote_cmd2)) {
5198 cmd = conf_get_str(ssh->conf, CONF_remote_cmd2);
51470298 5199 ssh->fallback_cmd = TRUE;
fd5e5847 5200 }
5201 if (*cmd)
51470298 5202 send_packet(ssh, SSH1_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END);
fd5e5847 5203 else
51470298 5204 send_packet(ssh, SSH1_CMSG_EXEC_SHELL, PKT_END);
fd5e5847 5205 logevent("Started session");
5206 }
374330e2 5207
51470298 5208 ssh->state = SSH_STATE_SESSION;
5209 if (ssh->size_needed)
5210 ssh_size(ssh, ssh->term_width, ssh->term_height);
5211 if (ssh->eof_needed)
5212 ssh_special(ssh, TS_EOF);
374330e2 5213
b9d7bcad 5214 if (ssh->ldisc)
5215 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
51470298 5216 ssh->send_ok = 1;
5217 ssh->channels = newtree234(ssh_channelcmp);
374330e2 5218 while (1) {
d74d141c 5219
51df0ab5 5220 /*
5221 * By this point, most incoming packets are already being
5222 * handled by the dispatch table, and we need only pay
5223 * attention to the unusual ones.
5224 */
0357890f 5225
51df0ab5 5226 crReturnV;
5227 if (pktin) {
5228 if (pktin->type == SSH1_SMSG_SUCCESS) {
972a41c8 5229 /* may be from EXEC_SHELL on some servers */
ff3187f6 5230 } else if (pktin->type == SSH1_SMSG_FAILURE) {
972a41c8 5231 /* may be from EXEC_SHELL on some servers
374330e2 5232 * if no pty is available or in other odd cases. Ignore */
374330e2 5233 } else {
ff3187f6 5234 bombout(("Strange packet received: type %d", pktin->type));
7ffdbc1a 5235 crStopV;
374330e2 5236 }
5237 } else {
8df7a775 5238 while (inlen > 0) {
5239 int len = min(inlen, 512);
a2724fba 5240 send_packet(ssh, SSH1_CMSG_STDIN_DATA,
5241 PKT_INT, len, PKTT_DATA, PKT_DATA, in, len,
9a10ecf4 5242 PKTT_OTHER, PKT_END);
8df7a775 5243 in += len;
5244 inlen -= len;
5245 }
374330e2 5246 }
5247 }
5248
5249 crFinishV;
5250}
5251
5252/*
2e85c969 5253 * Handle the top-level SSH-2 protocol.
b09eaa88 5254 */
5255static void ssh1_msg_debug(Ssh ssh, struct Packet *pktin)
5256{
fb983202 5257 char *msg;
b09eaa88 5258 int msglen;
5259
5260 ssh_pkt_getstring(pktin, &msg, &msglen);
fb983202 5261 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
b09eaa88 5262}
5263
5264static void ssh1_msg_disconnect(Ssh ssh, struct Packet *pktin)
5265{
5266 /* log reason code in disconnect message */
5267 char *msg;
5268 int msglen;
5269
5270 ssh_pkt_getstring(pktin, &msg, &msglen);
5271 bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg));
5272}
5273
409bfa77 5274static void ssh_msg_ignore(Ssh ssh, struct Packet *pktin)
b09eaa88 5275{
5276 /* Do nothing, because we're ignoring it! Duhh. */
5277}
5278
5279static void ssh1_protocol_setup(Ssh ssh)
5280{
5281 int i;
5282
5283 /*
5284 * Most messages are handled by the coroutines.
5285 */
5286 for (i = 0; i < 256; i++)
5287 ssh->packet_dispatch[i] = NULL;
5288
5289 /*
5290 * These special message types we install handlers for.
5291 */
5292 ssh->packet_dispatch[SSH1_MSG_DISCONNECT] = ssh1_msg_disconnect;
5293 ssh->packet_dispatch[SSH1_MSG_IGNORE] = ssh_msg_ignore;
5294 ssh->packet_dispatch[SSH1_MSG_DEBUG] = ssh1_msg_debug;
5295}
5296
1c1a7262 5297static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
b09eaa88 5298 struct Packet *pktin)
5299{
1c1a7262 5300 unsigned char *in=(unsigned char*)vin;
b09eaa88 5301 if (ssh->state == SSH_STATE_CLOSED)
5302 return;
5303
5304 if (pktin && ssh->packet_dispatch[pktin->type]) {
5305 ssh->packet_dispatch[pktin->type](ssh, pktin);
5306 return;
5307 }
5308
5309 if (!ssh->protocol_initial_phase_done) {
5310 if (do_ssh1_login(ssh, in, inlen, pktin))
5311 ssh->protocol_initial_phase_done = TRUE;
5312 else
5313 return;
5314 }
5315
5316 do_ssh1_connection(ssh, in, inlen, pktin);
5317}
5318
5319/*
e5574168 5320 * Utility routine for decoding comma-separated strings in KEXINIT.
5321 */
32874aea 5322static int in_commasep_string(char *needle, char *haystack, int haylen)
5323{
57356d63 5324 int needlen;
5325 if (!needle || !haystack) /* protect against null pointers */
5326 return 0;
5327 needlen = strlen(needle);
e5574168 5328 while (1) {
32874aea 5329 /*
5330 * Is it at the start of the string?
5331 */
5332 if (haylen >= needlen && /* haystack is long enough */
5333 !memcmp(needle, haystack, needlen) && /* initial match */
5334 (haylen == needlen || haystack[needlen] == ',')
5335 /* either , or EOS follows */
5336 )
5337 return 1;
5338 /*
5339 * If not, search for the next comma and resume after that.
5340 * If no comma found, terminate.
5341 */
5342 while (haylen > 0 && *haystack != ',')
5343 haylen--, haystack++;
5344 if (haylen == 0)
5345 return 0;
5346 haylen--, haystack++; /* skip over comma itself */
e5574168 5347 }
5348}
5349
5350/*
b59743d5 5351 * Similar routine for checking whether we have the first string in a list.
5352 */
5353static int first_in_commasep_string(char *needle, char *haystack, int haylen)
5354{
5355 int needlen;
5356 if (!needle || !haystack) /* protect against null pointers */
5357 return 0;
5358 needlen = strlen(needle);
5359 /*
5360 * Is it at the start of the string?
5361 */
5362 if (haylen >= needlen && /* haystack is long enough */
5363 !memcmp(needle, haystack, needlen) && /* initial match */
5364 (haylen == needlen || haystack[needlen] == ',')
5365 /* either , or EOS follows */
5366 )
5367 return 1;
5368 return 0;
5369}
5370
5371
5372/*
2e85c969 5373 * SSH-2 key creation method.
754c0df9 5374 * (Currently assumes 2 lots of any hash are sufficient to generate
5375 * keys/IVs for any cipher/MAC. SSH2_MKKEY_ITERS documents this assumption.)
d39f364a 5376 */
754c0df9 5377#define SSH2_MKKEY_ITERS (2)
b672f405 5378static void ssh2_mkkey(Ssh ssh, Bignum K, unsigned char *H, char chr,
d8baa528 5379 unsigned char *keyspace)
32874aea 5380{
b672f405 5381 const struct ssh_hash *h = ssh->kex->hash;
5382 void *s;
5383 /* First hlen bytes. */
5384 s = h->init();
51470298 5385 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
b672f405 5386 hash_mpint(h, s, K);
5387 h->bytes(s, H, h->hlen);
5388 h->bytes(s, &chr, 1);
5389 h->bytes(s, ssh->v2_session_id, ssh->v2_session_id_len);
5390 h->final(s, keyspace);
5391 /* Next hlen bytes. */
5392 s = h->init();
51470298 5393 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
b672f405 5394 hash_mpint(h, s, K);
5395 h->bytes(s, H, h->hlen);
5396 h->bytes(s, keyspace, h->hlen);
5397 h->final(s, keyspace + h->hlen);
d39f364a 5398}
5399
5400/*
2e85c969 5401 * Handle the SSH-2 transport layer.
e5574168 5402 */
1c1a7262 5403static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
ff3187f6 5404 struct Packet *pktin)
e5574168 5405{
1c1a7262 5406 unsigned char *in = (unsigned char *)vin;
51470298 5407 struct do_ssh2_transport_state {
4763c1c2 5408 int nbits, pbits, warn_kex, warn_cscipher, warn_sccipher;
51470298 5409 Bignum p, g, e, f, K;
3dc9a6a7 5410 void *our_kexinit;
5411 int our_kexinitlen;
51470298 5412 int kex_init_value, kex_reply_value;
5413 const struct ssh_mac **maclist;
5414 int nmacs;
5415 const struct ssh2_cipher *cscipher_tobe;
5416 const struct ssh2_cipher *sccipher_tobe;
5417 const struct ssh_mac *csmac_tobe;
5418 const struct ssh_mac *scmac_tobe;
5419 const struct ssh_compress *cscomp_tobe;
5420 const struct ssh_compress *sccomp_tobe;
fae1a71b 5421 char *hostkeydata, *sigdata, *rsakeydata, *keystr, *fingerprint;
5422 int hostkeylen, siglen, rsakeylen;
51470298 5423 void *hkey; /* actual host key */
fae1a71b 5424 void *rsakey; /* for RSA kex */
754c0df9 5425 unsigned char exchange_hash[SSH2_KEX_MAX_HASH_LEN];
83e7d008 5426 int n_preferred_kex;
34557659 5427 const struct ssh_kexes *preferred_kex[KEX_MAX];
51470298 5428 int n_preferred_ciphers;
5429 const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX];
5430 const struct ssh_compress *preferred_comp;
ab18ccff 5431 int userauth_succeeded; /* for delayed compression */
5432 int pending_compression;
e13bba36 5433 int got_session_id, activated_authconn;
ff3187f6 5434 struct Packet *pktout;
3d9449a1 5435 int dlgret;
5436 int guessok;
4763c1c2 5437 int ignorepkt;
51470298 5438 };
5439 crState(do_ssh2_transport_state);
5440
5441 crBegin(ssh->do_ssh2_transport_crstate);
5442
5443 s->cscipher_tobe = s->sccipher_tobe = NULL;
5444 s->csmac_tobe = s->scmac_tobe = NULL;
5445 s->cscomp_tobe = s->sccomp_tobe = NULL;
5446
e13bba36 5447 s->got_session_id = s->activated_authconn = FALSE;
ab18ccff 5448 s->userauth_succeeded = FALSE;
5449 s->pending_compression = FALSE;
e5574168 5450
e13bba36 5451 /*
5452 * Be prepared to work around the buggy MAC problem.
5453 */
5454 if (ssh->remote_bugs & BUG_SSH2_HMAC)
5455 s->maclist = buggymacs, s->nmacs = lenof(buggymacs);
5456 else
5457 s->maclist = macs, s->nmacs = lenof(macs);
5458
5459 begin_key_exchange:
acab36bc 5460 ssh->pkt_kctx = SSH2_PKTCTX_NOKEX;
51470298 5461 {
e13bba36 5462 int i, j, commalist_started;
5463
51470298 5464 /*
83e7d008 5465 * Set up the preferred key exchange. (NULL => warn below here)
5466 */
5467 s->n_preferred_kex = 0;
5468 for (i = 0; i < KEX_MAX; i++) {
4a693cfc 5469 switch (conf_get_int_int(ssh->conf, CONF_ssh_kexlist, i)) {
83e7d008 5470 case KEX_DHGEX:
5471 s->preferred_kex[s->n_preferred_kex++] =
5472 &ssh_diffiehellman_gex;
5473 break;
5474 case KEX_DHGROUP14:
5475 s->preferred_kex[s->n_preferred_kex++] =
5476 &ssh_diffiehellman_group14;
5477 break;
5478 case KEX_DHGROUP1:
5479 s->preferred_kex[s->n_preferred_kex++] =
5480 &ssh_diffiehellman_group1;
5481 break;
fae1a71b 5482 case KEX_RSA:
5483 s->preferred_kex[s->n_preferred_kex++] =
5484 &ssh_rsa_kex;
5485 break;
754c0df9 5486 case KEX_WARN:
83e7d008 5487 /* Flag for later. Don't bother if it's the last in
5488 * the list. */
5489 if (i < KEX_MAX - 1) {
5490 s->preferred_kex[s->n_preferred_kex++] = NULL;
5491 }
5492 break;
5493 }
5494 }
83e7d008 5495
83e7d008 5496 /*
51470298 5497 * Set up the preferred ciphers. (NULL => warn below here)
5498 */
5499 s->n_preferred_ciphers = 0;
5500 for (i = 0; i < CIPHER_MAX; i++) {
4a693cfc 5501 switch (conf_get_int_int(ssh->conf, CONF_ssh_cipherlist, i)) {
51470298 5502 case CIPHER_BLOWFISH:
5503 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_blowfish;
5504 break;
5505 case CIPHER_DES:
4a693cfc 5506 if (conf_get_int(ssh->conf, CONF_ssh2_des_cbc)) {
51470298 5507 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_des;
5508 }
5509 break;
5510 case CIPHER_3DES:
5511 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_3des;
5512 break;
5513 case CIPHER_AES:
5514 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_aes;
5515 break;
a2add208 5516 case CIPHER_ARCFOUR:
5517 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_arcfour;
5518 break;
51470298 5519 case CIPHER_WARN:
5520 /* Flag for later. Don't bother if it's the last in
5521 * the list. */
5522 if (i < CIPHER_MAX - 1) {
5523 s->preferred_ciphers[s->n_preferred_ciphers++] = NULL;
5524 }
5525 break;
ca20bfcf 5526 }
ca20bfcf 5527 }
7591b9ff 5528
e13bba36 5529 /*
5530 * Set up preferred compression.
5531 */
4a693cfc 5532 if (conf_get_int(ssh->conf, CONF_compression))
e13bba36 5533 s->preferred_comp = &ssh_zlib;
5534 else
5535 s->preferred_comp = &ssh_comp_none;
51470298 5536
5537 /*
590f6a5f 5538 * Enable queueing of outgoing auth- or connection-layer
5539 * packets while we are in the middle of a key exchange.
5540 */
5541 ssh->queueing = TRUE;
5542
5543 /*
9442dd57 5544 * Flag that KEX is in progress.
5545 */
5546 ssh->kex_in_progress = TRUE;
5547
5548 /*
51470298 5549 * Construct and send our key exchange packet.
5550 */
ff3187f6 5551 s->pktout = ssh2_pkt_init(SSH2_MSG_KEXINIT);
51470298 5552 for (i = 0; i < 16; i++)
ff3187f6 5553 ssh2_pkt_addbyte(s->pktout, (unsigned char) random_byte());
51470298 5554 /* List key exchange algorithms. */
ff3187f6 5555 ssh2_pkt_addstring_start(s->pktout);
83e7d008 5556 commalist_started = 0;
5557 for (i = 0; i < s->n_preferred_kex; i++) {
34557659 5558 const struct ssh_kexes *k = s->preferred_kex[i];
83e7d008 5559 if (!k) continue; /* warning flag */
34557659 5560 for (j = 0; j < k->nkexes; j++) {
5561 if (commalist_started)
5562 ssh2_pkt_addstring_str(s->pktout, ",");
5563 ssh2_pkt_addstring_str(s->pktout, k->list[j]->name);
5564 commalist_started = 1;
5565 }
32874aea 5566 }
51470298 5567 /* List server host key algorithms. */
ff3187f6 5568 ssh2_pkt_addstring_start(s->pktout);
51470298 5569 for (i = 0; i < lenof(hostkey_algs); i++) {
ff3187f6 5570 ssh2_pkt_addstring_str(s->pktout, hostkey_algs[i]->name);
51470298 5571 if (i < lenof(hostkey_algs) - 1)
ff3187f6 5572 ssh2_pkt_addstring_str(s->pktout, ",");
32874aea 5573 }
51470298 5574 /* List client->server encryption algorithms. */
ff3187f6 5575 ssh2_pkt_addstring_start(s->pktout);
83e7d008 5576 commalist_started = 0;
51470298 5577 for (i = 0; i < s->n_preferred_ciphers; i++) {
5578 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5579 if (!c) continue; /* warning flag */
5580 for (j = 0; j < c->nciphers; j++) {
83e7d008 5581 if (commalist_started)
ff3187f6 5582 ssh2_pkt_addstring_str(s->pktout, ",");
5583 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
83e7d008 5584 commalist_started = 1;
51470298 5585 }
5586 }
5587 /* List server->client encryption algorithms. */
ff3187f6 5588 ssh2_pkt_addstring_start(s->pktout);
83e7d008 5589 commalist_started = 0;
51470298 5590 for (i = 0; i < s->n_preferred_ciphers; i++) {
5591 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5592 if (!c) continue; /* warning flag */
5593 for (j = 0; j < c->nciphers; j++) {
83e7d008 5594 if (commalist_started)
ff3187f6 5595 ssh2_pkt_addstring_str(s->pktout, ",");
5596 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
83e7d008 5597 commalist_started = 1;
51470298 5598 }
5599 }
5600 /* List client->server MAC algorithms. */
ff3187f6 5601 ssh2_pkt_addstring_start(s->pktout);
51470298 5602 for (i = 0; i < s->nmacs; i++) {
ff3187f6 5603 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
51470298 5604 if (i < s->nmacs - 1)
ff3187f6 5605 ssh2_pkt_addstring_str(s->pktout, ",");
51470298 5606 }
5607 /* List server->client MAC algorithms. */
ff3187f6 5608 ssh2_pkt_addstring_start(s->pktout);
51470298 5609 for (i = 0; i < s->nmacs; i++) {
ff3187f6 5610 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
51470298 5611 if (i < s->nmacs - 1)
ff3187f6 5612 ssh2_pkt_addstring_str(s->pktout, ",");
51470298 5613 }
ab18ccff 5614 /* List client->server compression algorithms,
5615 * then server->client compression algorithms. (We use the
5616 * same set twice.) */
5617 for (j = 0; j < 2; j++) {
5618 ssh2_pkt_addstring_start(s->pktout);
5619 assert(lenof(compressions) > 1);
5620 /* Prefer non-delayed versions */
5621 ssh2_pkt_addstring_str(s->pktout, s->preferred_comp->name);
5622 /* We don't even list delayed versions of algorithms until
5623 * they're allowed to be used, to avoid a race. See the end of
5624 * this function. */
5625 if (s->userauth_succeeded && s->preferred_comp->delayed_name) {
ff3187f6 5626 ssh2_pkt_addstring_str(s->pktout, ",");
ab18ccff 5627 ssh2_pkt_addstring_str(s->pktout,
5628 s->preferred_comp->delayed_name);
f6e0abe2 5629 }
ab18ccff 5630 for (i = 0; i < lenof(compressions); i++) {
5631 const struct ssh_compress *c = compressions[i];
5632 if (c != s->preferred_comp) {
5633 ssh2_pkt_addstring_str(s->pktout, ",");
5634 ssh2_pkt_addstring_str(s->pktout, c->name);
5635 if (s->userauth_succeeded && c->delayed_name) {
5636 ssh2_pkt_addstring_str(s->pktout, ",");
5637 ssh2_pkt_addstring_str(s->pktout, c->delayed_name);
5638 }
5639 }
f6e0abe2 5640 }
51470298 5641 }
5642 /* List client->server languages. Empty list. */
ff3187f6 5643 ssh2_pkt_addstring_start(s->pktout);
51470298 5644 /* List server->client languages. Empty list. */
ff3187f6 5645 ssh2_pkt_addstring_start(s->pktout);
51470298 5646 /* First KEX packet does _not_ follow, because we're not that brave. */
ff3187f6 5647 ssh2_pkt_addbool(s->pktout, FALSE);
51470298 5648 /* Reserved. */
ff3187f6 5649 ssh2_pkt_adduint32(s->pktout, 0);
e5574168 5650 }
0db56f73 5651
3dc9a6a7 5652 s->our_kexinitlen = s->pktout->length - 5;
5653 s->our_kexinit = snewn(s->our_kexinitlen, unsigned char);
5654 memcpy(s->our_kexinit, s->pktout->data + 5, s->our_kexinitlen);
0db56f73 5655
590f6a5f 5656 ssh2_pkt_send_noqueue(ssh, s->pktout);
e5574168 5657
ff3187f6 5658 if (!pktin)
5659 crWaitUntil(pktin);
e5574168 5660
5661 /*
5662 * Now examine the other side's KEXINIT to see what we're up
5663 * to.
5664 */
51470298 5665 {
4763c1c2 5666 char *str, *preferred;
3d9449a1 5667 int i, j, len;
51470298 5668
ff3187f6 5669 if (pktin->type != SSH2_MSG_KEXINIT) {
6b5cf8b4 5670 bombout(("expected key exchange packet from server"));
7ffdbc1a 5671 crStop(0);
32874aea 5672 }
51470298 5673 ssh->kex = NULL;
5674 ssh->hostkey = NULL;
5675 s->cscipher_tobe = NULL;
5676 s->sccipher_tobe = NULL;
5677 s->csmac_tobe = NULL;
5678 s->scmac_tobe = NULL;
5679 s->cscomp_tobe = NULL;
5680 s->sccomp_tobe = NULL;
4763c1c2 5681 s->warn_kex = s->warn_cscipher = s->warn_sccipher = FALSE;
5682
ff3187f6 5683 pktin->savedpos += 16; /* skip garbage cookie */
5684 ssh_pkt_getstring(pktin, &str, &len); /* key exchange algorithms */
4763c1c2 5685
5686 preferred = NULL;
83e7d008 5687 for (i = 0; i < s->n_preferred_kex; i++) {
34557659 5688 const struct ssh_kexes *k = s->preferred_kex[i];
83e7d008 5689 if (!k) {
4763c1c2 5690 s->warn_kex = TRUE;
5691 } else {
34557659 5692 for (j = 0; j < k->nkexes; j++) {
5693 if (!preferred) preferred = k->list[j]->name;
5694 if (in_commasep_string(k->list[j]->name, str, len)) {
5695 ssh->kex = k->list[j];
5696 break;
5697 }
5698 }
83e7d008 5699 }
4763c1c2 5700 if (ssh->kex)
51470298 5701 break;
32874aea 5702 }
83e7d008 5703 if (!ssh->kex) {
5704 bombout(("Couldn't agree a key exchange algorithm (available: %s)",
5705 str ? str : "(null)"));
5706 crStop(0);
5707 }
b59743d5 5708 /*
5709 * Note that the server's guess is considered wrong if it doesn't match
5710 * the first algorithm in our list, even if it's still the algorithm
5711 * we end up using.
5712 */
4763c1c2 5713 s->guessok = first_in_commasep_string(preferred, str, len);
ff3187f6 5714 ssh_pkt_getstring(pktin, &str, &len); /* host key algorithms */
51470298 5715 for (i = 0; i < lenof(hostkey_algs); i++) {
5716 if (in_commasep_string(hostkey_algs[i]->name, str, len)) {
5717 ssh->hostkey = hostkey_algs[i];
5718 break;
5719 }
5720 }
3d9449a1 5721 s->guessok = s->guessok &&
b59743d5 5722 first_in_commasep_string(hostkey_algs[0]->name, str, len);
ff3187f6 5723 ssh_pkt_getstring(pktin, &str, &len); /* client->server cipher */
51470298 5724 for (i = 0; i < s->n_preferred_ciphers; i++) {
5725 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5726 if (!c) {
4763c1c2 5727 s->warn_cscipher = TRUE;
51470298 5728 } else {
5729 for (j = 0; j < c->nciphers; j++) {
5730 if (in_commasep_string(c->list[j]->name, str, len)) {
5731 s->cscipher_tobe = c->list[j];
5732 break;
5733 }
ca20bfcf 5734 }
32874aea 5735 }
4763c1c2 5736 if (s->cscipher_tobe)
51470298 5737 break;
32874aea 5738 }
51470298 5739 if (!s->cscipher_tobe) {
6b5cf8b4 5740 bombout(("Couldn't agree a client-to-server cipher (available: %s)",
57356d63 5741 str ? str : "(null)"));
7ffdbc1a 5742 crStop(0);
ca20bfcf 5743 }
0ef8f407 5744
ff3187f6 5745 ssh_pkt_getstring(pktin, &str, &len); /* server->client cipher */
51470298 5746 for (i = 0; i < s->n_preferred_ciphers; i++) {
5747 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5748 if (!c) {
4763c1c2 5749 s->warn_sccipher = TRUE;
51470298 5750 } else {
5751 for (j = 0; j < c->nciphers; j++) {
5752 if (in_commasep_string(c->list[j]->name, str, len)) {
5753 s->sccipher_tobe = c->list[j];
5754 break;
5755 }
ca20bfcf 5756 }
32874aea 5757 }
4763c1c2 5758 if (s->sccipher_tobe)
51470298 5759 break;
32874aea 5760 }
51470298 5761 if (!s->sccipher_tobe) {
6b5cf8b4 5762 bombout(("Couldn't agree a server-to-client cipher (available: %s)",
57356d63 5763 str ? str : "(null)"));
7ffdbc1a 5764 crStop(0);
ca20bfcf 5765 }
0ef8f407 5766
ff3187f6 5767 ssh_pkt_getstring(pktin, &str, &len); /* client->server mac */
51470298 5768 for (i = 0; i < s->nmacs; i++) {
5769 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5770 s->csmac_tobe = s->maclist[i];
5771 break;
5772 }
32874aea 5773 }
ff3187f6 5774 ssh_pkt_getstring(pktin, &str, &len); /* server->client mac */
51470298 5775 for (i = 0; i < s->nmacs; i++) {
5776 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5777 s->scmac_tobe = s->maclist[i];
5778 break;
5779 }
32874aea 5780 }
ff3187f6 5781 ssh_pkt_getstring(pktin, &str, &len); /* client->server compression */
51470298 5782 for (i = 0; i < lenof(compressions) + 1; i++) {
5783 const struct ssh_compress *c =
5784 i == 0 ? s->preferred_comp : compressions[i - 1];
5785 if (in_commasep_string(c->name, str, len)) {
5786 s->cscomp_tobe = c;
5787 break;
ab18ccff 5788 } else if (in_commasep_string(c->delayed_name, str, len)) {
5789 if (s->userauth_succeeded) {
5790 s->cscomp_tobe = c;
5791 break;
5792 } else {
5793 s->pending_compression = TRUE; /* try this later */
5794 }
51470298 5795 }
32874aea 5796 }
ff3187f6 5797 ssh_pkt_getstring(pktin, &str, &len); /* server->client compression */
51470298 5798 for (i = 0; i < lenof(compressions) + 1; i++) {
5799 const struct ssh_compress *c =
5800 i == 0 ? s->preferred_comp : compressions[i - 1];
5801 if (in_commasep_string(c->name, str, len)) {
5802 s->sccomp_tobe = c;
5803 break;
ab18ccff 5804 } else if (in_commasep_string(c->delayed_name, str, len)) {
5805 if (s->userauth_succeeded) {
5806 s->sccomp_tobe = c;
5807 break;
5808 } else {
5809 s->pending_compression = TRUE; /* try this later */
5810 }
51470298 5811 }
32874aea 5812 }
ab18ccff 5813 if (s->pending_compression) {
5814 logevent("Server supports delayed compression; "
5815 "will try this later");
5816 }
b59743d5 5817 ssh_pkt_getstring(pktin, &str, &len); /* client->server language */
5818 ssh_pkt_getstring(pktin, &str, &len); /* server->client language */
4763c1c2 5819 s->ignorepkt = ssh2_pkt_getbool(pktin) && !s->guessok;
5820
5821 if (s->warn_kex) {
5822 ssh_set_frozen(ssh, 1);
5823 s->dlgret = askalg(ssh->frontend, "key-exchange algorithm",
5824 ssh->kex->name,
5825 ssh_dialog_callback, ssh);
5826 if (s->dlgret < 0) {
5827 do {
5828 crReturn(0);
5829 if (pktin) {
5830 bombout(("Unexpected data from server while"
5831 " waiting for user response"));
5832 crStop(0);
5833 }
5834 } while (pktin || inlen > 0);
5835 s->dlgret = ssh->user_response;
5836 }
5837 ssh_set_frozen(ssh, 0);
5838 if (s->dlgret == 0) {
9e296bfa 5839 ssh_disconnect(ssh, "User aborted at kex warning", NULL,
5840 0, TRUE);
a5a6f839 5841 crStop(0);
4763c1c2 5842 }
5843 }
5844
5845 if (s->warn_cscipher) {
5846 ssh_set_frozen(ssh, 1);
5847 s->dlgret = askalg(ssh->frontend,
5848 "client-to-server cipher",
5849 s->cscipher_tobe->name,
5850 ssh_dialog_callback, ssh);
5851 if (s->dlgret < 0) {
5852 do {
5853 crReturn(0);
5854 if (pktin) {
5855 bombout(("Unexpected data from server while"
5856 " waiting for user response"));
5857 crStop(0);
5858 }
5859 } while (pktin || inlen > 0);
5860 s->dlgret = ssh->user_response;
5861 }
5862 ssh_set_frozen(ssh, 0);
5863 if (s->dlgret == 0) {
9e296bfa 5864 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5865 0, TRUE);
a5a6f839 5866 crStop(0);
4763c1c2 5867 }
5868 }
5869
5870 if (s->warn_sccipher) {
5871 ssh_set_frozen(ssh, 1);
5872 s->dlgret = askalg(ssh->frontend,
5873 "server-to-client cipher",
5874 s->sccipher_tobe->name,
5875 ssh_dialog_callback, ssh);
5876 if (s->dlgret < 0) {
5877 do {
5878 crReturn(0);
5879 if (pktin) {
5880 bombout(("Unexpected data from server while"
5881 " waiting for user response"));
5882 crStop(0);
5883 }
5884 } while (pktin || inlen > 0);
5885 s->dlgret = ssh->user_response;
5886 }
5887 ssh_set_frozen(ssh, 0);
5888 if (s->dlgret == 0) {
9e296bfa 5889 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5890 0, TRUE);
a5a6f839 5891 crStop(0);
4763c1c2 5892 }
5893 }
5894
b672f405 5895 ssh->exhash = ssh->kex->hash->init();
5896 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_c, strlen(ssh->v_c));
5897 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_s, strlen(ssh->v_s));
5898 hash_string(ssh->kex->hash, ssh->exhash,
5899 s->our_kexinit, s->our_kexinitlen);
3dc9a6a7 5900 sfree(s->our_kexinit);
5901 if (pktin->length > 5)
b672f405 5902 hash_string(ssh->kex->hash, ssh->exhash,
5903 pktin->data + 5, pktin->length - 5);
3dc9a6a7 5904
4763c1c2 5905 if (s->ignorepkt) /* first_kex_packet_follows */
b59743d5 5906 crWaitUntil(pktin); /* Ignore packet */
e5574168 5907 }
e5574168 5908
fae1a71b 5909 if (ssh->kex->main_type == KEXTYPE_DH) {
30774ba3 5910 /*
5911 * Work out the number of bits of key we will need from the
5912 * key exchange. We start with the maximum key length of
5913 * either cipher...
5914 */
5915 {
5916 int csbits, scbits;
5917
5918 csbits = s->cscipher_tobe->keylen;
5919 scbits = s->sccipher_tobe->keylen;
5920 s->nbits = (csbits > scbits ? csbits : scbits);
5921 }
5922 /* The keys only have hlen-bit entropy, since they're based on
5923 * a hash. So cap the key size at hlen bits. */
5924 if (s->nbits > ssh->kex->hash->hlen * 8)
5925 s->nbits = ssh->kex->hash->hlen * 8;
5926
5927 /*
5928 * If we're doing Diffie-Hellman group exchange, start by
5929 * requesting a group.
5930 */
5931 if (!ssh->kex->pdata) {
5932 logevent("Doing Diffie-Hellman group exchange");
acab36bc 5933 ssh->pkt_kctx = SSH2_PKTCTX_DHGEX;
30774ba3 5934 /*
5935 * Work out how big a DH group we will need to allow that
5936 * much data.
5937 */
5938 s->pbits = 512 << ((s->nbits - 1) / 64);
5939 s->pktout = ssh2_pkt_init(SSH2_MSG_KEX_DH_GEX_REQUEST);
5940 ssh2_pkt_adduint32(s->pktout, s->pbits);
5941 ssh2_pkt_send_noqueue(ssh, s->pktout);
5942
5943 crWaitUntil(pktin);
5944 if (pktin->type != SSH2_MSG_KEX_DH_GEX_GROUP) {
5945 bombout(("expected key exchange group packet from server"));
5946 crStop(0);
5947 }
5948 s->p = ssh2_pkt_getmp(pktin);
5949 s->g = ssh2_pkt_getmp(pktin);
5950 if (!s->p || !s->g) {
5951 bombout(("unable to read mp-ints from incoming group packet"));
5952 crStop(0);
5953 }
5954 ssh->kex_ctx = dh_setup_gex(s->p, s->g);
5955 s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT;
5956 s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY;
5957 } else {
acab36bc 5958 ssh->pkt_kctx = SSH2_PKTCTX_DHGROUP;
30774ba3 5959 ssh->kex_ctx = dh_setup_group(ssh->kex);
5960 s->kex_init_value = SSH2_MSG_KEXDH_INIT;
5961 s->kex_reply_value = SSH2_MSG_KEXDH_REPLY;
5962 logeventf(ssh, "Using Diffie-Hellman with standard group \"%s\"",
5963 ssh->kex->groupname);
5964 }
e5574168 5965
30774ba3 5966 logeventf(ssh, "Doing Diffie-Hellman key exchange with hash %s",
5967 ssh->kex->hash->text_name);
5968 /*
5969 * Now generate and send e for Diffie-Hellman.
5970 */
5971 set_busy_status(ssh->frontend, BUSY_CPU); /* this can take a while */
5972 s->e = dh_create_e(ssh->kex_ctx, s->nbits * 2);
5973 s->pktout = ssh2_pkt_init(s->kex_init_value);
5974 ssh2_pkt_addmp(s->pktout, s->e);
5975 ssh2_pkt_send_noqueue(ssh, s->pktout);
5976
5977 set_busy_status(ssh->frontend, BUSY_WAITING); /* wait for server */
5978 crWaitUntil(pktin);
5979 if (pktin->type != s->kex_reply_value) {
5980 bombout(("expected key exchange reply packet from server"));
5981 crStop(0);
5982 }
5983 set_busy_status(ssh->frontend, BUSY_CPU); /* cogitate */
5984 ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
5985 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
5986 s->f = ssh2_pkt_getmp(pktin);
5987 if (!s->f) {
5988 bombout(("unable to parse key exchange reply packet"));
5989 crStop(0);
5990 }
5991 ssh_pkt_getstring(pktin, &s->sigdata, &s->siglen);
e5574168 5992
30774ba3 5993 s->K = dh_find_K(ssh->kex_ctx, s->f);
e5574168 5994
30774ba3 5995 /* We assume everything from now on will be quick, and it might
5996 * involve user interaction. */
5997 set_busy_status(ssh->frontend, BUSY_NOT);
755e0524 5998
30774ba3 5999 hash_string(ssh->kex->hash, ssh->exhash, s->hostkeydata, s->hostkeylen);
6000 if (!ssh->kex->pdata) {
6001 hash_uint32(ssh->kex->hash, ssh->exhash, s->pbits);
6002 hash_mpint(ssh->kex->hash, ssh->exhash, s->p);
6003 hash_mpint(ssh->kex->hash, ssh->exhash, s->g);
6004 }
6005 hash_mpint(ssh->kex->hash, ssh->exhash, s->e);
6006 hash_mpint(ssh->kex->hash, ssh->exhash, s->f);
6007
6008 dh_cleanup(ssh->kex_ctx);
6009 freebn(s->f);
6010 if (!ssh->kex->pdata) {
6011 freebn(s->g);
6012 freebn(s->p);
6013 }
fae1a71b 6014 } else {
6015 logeventf(ssh, "Doing RSA key exchange with hash %s",
6016 ssh->kex->hash->text_name);
acab36bc 6017 ssh->pkt_kctx = SSH2_PKTCTX_RSAKEX;
fae1a71b 6018 /*
6019 * RSA key exchange. First expect a KEXRSA_PUBKEY packet
6020 * from the server.
6021 */
6022 crWaitUntil(pktin);
6023 if (pktin->type != SSH2_MSG_KEXRSA_PUBKEY) {
6024 bombout(("expected RSA public key packet from server"));
6025 crStop(0);
6026 }
6027
6028 ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
6029 hash_string(ssh->kex->hash, ssh->exhash,
6030 s->hostkeydata, s->hostkeylen);
6031 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
6032
6033 {
6034 char *keydata;
6035 ssh_pkt_getstring(pktin, &keydata, &s->rsakeylen);
6036 s->rsakeydata = snewn(s->rsakeylen, char);
6037 memcpy(s->rsakeydata, keydata, s->rsakeylen);
6038 }
6039
6040 s->rsakey = ssh_rsakex_newkey(s->rsakeydata, s->rsakeylen);
6041 if (!s->rsakey) {
6042 sfree(s->rsakeydata);
6043 bombout(("unable to parse RSA public key from server"));
6044 crStop(0);
6045 }
6046
6047 hash_string(ssh->kex->hash, ssh->exhash, s->rsakeydata, s->rsakeylen);
6048
6049 /*
6050 * Next, set up a shared secret K, of precisely KLEN -
6051 * 2*HLEN - 49 bits, where KLEN is the bit length of the
6052 * RSA key modulus and HLEN is the bit length of the hash
6053 * we're using.
6054 */
6055 {
6056 int klen = ssh_rsakex_klen(s->rsakey);
6057 int nbits = klen - (2*ssh->kex->hash->hlen*8 + 49);
6058 int i, byte = 0;
6059 unsigned char *kstr1, *kstr2, *outstr;
6060 int kstr1len, kstr2len, outstrlen;
6061
6062 s->K = bn_power_2(nbits - 1);
6063
6064 for (i = 0; i < nbits; i++) {
6065 if ((i & 7) == 0) {
6066 byte = random_byte();
6067 }
6068 bignum_set_bit(s->K, i, (byte >> (i & 7)) & 1);
6069 }
6070
6071 /*
6072 * Encode this as an mpint.
6073 */
6074 kstr1 = ssh2_mpint_fmt(s->K, &kstr1len);
6075 kstr2 = snewn(kstr2len = 4 + kstr1len, unsigned char);
6076 PUT_32BIT(kstr2, kstr1len);
6077 memcpy(kstr2 + 4, kstr1, kstr1len);
6078
6079 /*
6080 * Encrypt it with the given RSA key.
6081 */
6082 outstrlen = (klen + 7) / 8;
6083 outstr = snewn(outstrlen, unsigned char);
6084 ssh_rsakex_encrypt(ssh->kex->hash, kstr2, kstr2len,
6085 outstr, outstrlen, s->rsakey);
6086
6087 /*
6088 * And send it off in a return packet.
6089 */
6090 s->pktout = ssh2_pkt_init(SSH2_MSG_KEXRSA_SECRET);
6091 ssh2_pkt_addstring_start(s->pktout);
7108a872 6092 ssh2_pkt_addstring_data(s->pktout, (char *)outstr, outstrlen);
fae1a71b 6093 ssh2_pkt_send_noqueue(ssh, s->pktout);
6094
6095 hash_string(ssh->kex->hash, ssh->exhash, outstr, outstrlen);
6096
6097 sfree(kstr2);
6098 sfree(kstr1);
6099 sfree(outstr);
6100 }
6101
6102 ssh_rsakex_freekey(s->rsakey);
6103
6104 crWaitUntil(pktin);
6105 if (pktin->type != SSH2_MSG_KEXRSA_DONE) {
6106 sfree(s->rsakeydata);
6107 bombout(("expected signature packet from server"));
6108 crStop(0);
6109 }
6110
6111 ssh_pkt_getstring(pktin, &s->sigdata, &s->siglen);
6112
6113 sfree(s->rsakeydata);
6114 }
6115
b672f405 6116 hash_mpint(ssh->kex->hash, ssh->exhash, s->K);
6117 assert(ssh->kex->hash->hlen <= sizeof(s->exchange_hash));
6118 ssh->kex->hash->final(ssh->exhash, s->exchange_hash);
e5574168 6119
fabd1805 6120 ssh->kex_ctx = NULL;
3709bfe9 6121
7cca0d81 6122#if 0
765c4200 6123 debug(("Exchange hash is:\n"));
b672f405 6124 dmemdump(s->exchange_hash, ssh->kex->hash->hlen);
7cca0d81 6125#endif
6126
51470298 6127 if (!s->hkey ||
6128 !ssh->hostkey->verifysig(s->hkey, s->sigdata, s->siglen,
b672f405 6129 (char *)s->exchange_hash,
6130 ssh->kex->hash->hlen)) {
6b5cf8b4 6131 bombout(("Server's host key did not match the signature supplied"));
7ffdbc1a 6132 crStop(0);
8d5de777 6133 }
e5574168 6134
6135 /*
7cca0d81 6136 * Authenticate remote host: verify host key. (We've already
6137 * checked the signature of the exchange hash.)
e5574168 6138 */
51470298 6139 s->keystr = ssh->hostkey->fmtkey(s->hkey);
6140 s->fingerprint = ssh->hostkey->fingerprint(s->hkey);
3d9449a1 6141 ssh_set_frozen(ssh, 1);
6142 s->dlgret = verify_ssh_host_key(ssh->frontend,
6143 ssh->savedhost, ssh->savedport,
6144 ssh->hostkey->keytype, s->keystr,
6145 s->fingerprint,
6146 ssh_dialog_callback, ssh);
6147 if (s->dlgret < 0) {
6148 do {
6149 crReturn(0);
6150 if (pktin) {
6151 bombout(("Unexpected data from server while waiting"
6152 " for user host key response"));
6153 crStop(0);
6154 }
6155 } while (pktin || inlen > 0);
6156 s->dlgret = ssh->user_response;
6157 }
6158 ssh_set_frozen(ssh, 0);
6159 if (s->dlgret == 0) {
9e296bfa 6160 ssh_disconnect(ssh, "User aborted at host key verification", NULL,
6161 0, TRUE);
3d9449a1 6162 crStop(0);
6163 }
e13bba36 6164 if (!s->got_session_id) { /* don't bother logging this in rekeys */
5e0d7cb8 6165 logevent("Host key fingerprint is:");
51470298 6166 logevent(s->fingerprint);
5e0d7cb8 6167 }
51470298 6168 sfree(s->fingerprint);
6169 sfree(s->keystr);
6170 ssh->hostkey->freekey(s->hkey);
d39f364a 6171
6172 /*
9442dd57 6173 * The exchange hash from the very first key exchange is also
6174 * the session id, used in session key construction and
6175 * authentication.
6176 */
e13bba36 6177 if (!s->got_session_id) {
b672f405 6178 assert(sizeof(s->exchange_hash) <= sizeof(ssh->v2_session_id));
9442dd57 6179 memcpy(ssh->v2_session_id, s->exchange_hash,
6180 sizeof(s->exchange_hash));
b672f405 6181 ssh->v2_session_id_len = ssh->kex->hash->hlen;
6052bb76 6182 assert(ssh->v2_session_id_len <= sizeof(ssh->v2_session_id));
e13bba36 6183 s->got_session_id = TRUE;
6184 }
9442dd57 6185
6186 /*
7cca0d81 6187 * Send SSH2_MSG_NEWKEYS.
d39f364a 6188 */
ff3187f6 6189 s->pktout = ssh2_pkt_init(SSH2_MSG_NEWKEYS);
590f6a5f 6190 ssh2_pkt_send_noqueue(ssh, s->pktout);
9442dd57 6191 ssh->outgoing_data_size = 0; /* start counting from here */
6192
6193 /*
6194 * We've sent client NEWKEYS, so create and initialise
c64fe7d4 6195 * client-to-server session keys.
9442dd57 6196 */
6197 if (ssh->cs_cipher_ctx)
6198 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
6199 ssh->cscipher = s->cscipher_tobe;
6200 ssh->cs_cipher_ctx = ssh->cscipher->make_context();
6201
6202 if (ssh->cs_mac_ctx)
6203 ssh->csmac->free_context(ssh->cs_mac_ctx);
6204 ssh->csmac = s->csmac_tobe;
6205 ssh->cs_mac_ctx = ssh->csmac->make_context();
6206
6207 if (ssh->cs_comp_ctx)
6208 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
6209 ssh->cscomp = s->cscomp_tobe;
6210 ssh->cs_comp_ctx = ssh->cscomp->compress_init();
6211
6212 /*
6213 * Set IVs on client-to-server keys. Here we use the exchange
6214 * hash from the _first_ key exchange.
6215 */
6216 {
754c0df9 6217 unsigned char keyspace[SSH2_KEX_MAX_HASH_LEN * SSH2_MKKEY_ITERS];
6218 assert(sizeof(keyspace) >= ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
b672f405 6219 ssh2_mkkey(ssh,s->K,s->exchange_hash,'C',keyspace);
754c0df9 6220 assert((ssh->cscipher->keylen+7) / 8 <=
6221 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
9442dd57 6222 ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace);
b672f405 6223 ssh2_mkkey(ssh,s->K,s->exchange_hash,'A',keyspace);
754c0df9 6224 assert(ssh->cscipher->blksize <=
6225 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
9442dd57 6226 ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace);
b672f405 6227 ssh2_mkkey(ssh,s->K,s->exchange_hash,'E',keyspace);
754c0df9 6228 assert(ssh->csmac->len <=
6229 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
9442dd57 6230 ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace);
754c0df9 6231 memset(keyspace, 0, sizeof(keyspace));
9442dd57 6232 }
6233
6234 logeventf(ssh, "Initialised %.200s client->server encryption",
6235 ssh->cscipher->text_name);
6236 logeventf(ssh, "Initialised %.200s client->server MAC algorithm",
6237 ssh->csmac->text_name);
6238 if (ssh->cscomp->text_name)
6239 logeventf(ssh, "Initialised %s compression",
6240 ssh->cscomp->text_name);
590f6a5f 6241
6242 /*
6243 * Now our end of the key exchange is complete, we can send all
6244 * our queued higher-layer packets.
6245 */
6246 ssh->queueing = FALSE;
6247 ssh2_pkt_queuesend(ssh);
d39f364a 6248
6249 /*
8406eaf9 6250 * Expect SSH2_MSG_NEWKEYS from server.
6251 */
ff3187f6 6252 crWaitUntil(pktin);
6253 if (pktin->type != SSH2_MSG_NEWKEYS) {
6b5cf8b4 6254 bombout(("expected new-keys packet from server"));
7ffdbc1a 6255 crStop(0);
8406eaf9 6256 }
9442dd57 6257 ssh->incoming_data_size = 0; /* start counting from here */
8406eaf9 6258
6259 /*
9442dd57 6260 * We've seen server NEWKEYS, so create and initialise
6261 * server-to-client session keys.
d39f364a 6262 */
371e569c 6263 if (ssh->sc_cipher_ctx)
6264 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
51470298 6265 ssh->sccipher = s->sccipher_tobe;
371e569c 6266 ssh->sc_cipher_ctx = ssh->sccipher->make_context();
e0e1a00d 6267
e0e1a00d 6268 if (ssh->sc_mac_ctx)
6269 ssh->scmac->free_context(ssh->sc_mac_ctx);
51470298 6270 ssh->scmac = s->scmac_tobe;
e0e1a00d 6271 ssh->sc_mac_ctx = ssh->scmac->make_context();
6272
5366aed8 6273 if (ssh->sc_comp_ctx)
6274 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
51470298 6275 ssh->sccomp = s->sccomp_tobe;
5366aed8 6276 ssh->sc_comp_ctx = ssh->sccomp->decompress_init();
6277
d39f364a 6278 /*
9442dd57 6279 * Set IVs on server-to-client keys. Here we use the exchange
6280 * hash from the _first_ key exchange.
d39f364a 6281 */
51470298 6282 {
754c0df9 6283 unsigned char keyspace[SSH2_KEX_MAX_HASH_LEN * SSH2_MKKEY_ITERS];
6284 assert(sizeof(keyspace) >= ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
b672f405 6285 ssh2_mkkey(ssh,s->K,s->exchange_hash,'D',keyspace);
754c0df9 6286 assert((ssh->sccipher->keylen+7) / 8 <=
6287 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
371e569c 6288 ssh->sccipher->setkey(ssh->sc_cipher_ctx, keyspace);
b672f405 6289 ssh2_mkkey(ssh,s->K,s->exchange_hash,'B',keyspace);
754c0df9 6290 assert(ssh->sccipher->blksize <=
6291 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
371e569c 6292 ssh->sccipher->setiv(ssh->sc_cipher_ctx, keyspace);
b672f405 6293 ssh2_mkkey(ssh,s->K,s->exchange_hash,'F',keyspace);
754c0df9 6294 assert(ssh->scmac->len <=
6295 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
e0e1a00d 6296 ssh->scmac->setkey(ssh->sc_mac_ctx, keyspace);
754c0df9 6297 memset(keyspace, 0, sizeof(keyspace));
51470298 6298 }
57356d63 6299 logeventf(ssh, "Initialised %.200s server->client encryption",
6300 ssh->sccipher->text_name);
6c135243 6301 logeventf(ssh, "Initialised %.200s server->client MAC algorithm",
6302 ssh->scmac->text_name);
57356d63 6303 if (ssh->sccomp->text_name)
6304 logeventf(ssh, "Initialised %s decompression",
6305 ssh->sccomp->text_name);
9442dd57 6306
6307 /*
fae1a71b 6308 * Free shared secret.
9442dd57 6309 */
679539d7 6310 freebn(s->K);
d39f364a 6311
033b4cef 6312 /*
e13bba36 6313 * Key exchange is over. Loop straight back round if we have a
6314 * deferred rekey reason.
6315 */
6316 if (ssh->deferred_rekey_reason) {
6317 logevent(ssh->deferred_rekey_reason);
6318 pktin = NULL;
6319 ssh->deferred_rekey_reason = NULL;
6320 goto begin_key_exchange;
6321 }
6322
6323 /*
6324 * Otherwise, schedule a timer for our next rekey.
9442dd57 6325 */
6326 ssh->kex_in_progress = FALSE;
e6c1536e 6327 ssh->last_rekey = GETTICKCOUNT();
4a693cfc 6328 if (conf_get_int(ssh->conf, CONF_ssh_rekey_time) != 0)
6329 ssh->next_rekey = schedule_timer(conf_get_int(ssh->conf, CONF_ssh_rekey_time)*60*TICKSPERSEC,
d57f70af 6330 ssh2_timer, ssh);
e13bba36 6331
9442dd57 6332 /*
0db56f73 6333 * If this is the first key exchange phase, we must pass the
6334 * SSH2_MSG_NEWKEYS packet to the next layer, not because it
6335 * wants to see it but because it will need time to initialise
6336 * itself before it sees an actual packet. In subsequent key
6337 * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because
6338 * it would only confuse the layer above.
6339 */
e13bba36 6340 if (s->activated_authconn) {
0e3607ed 6341 crReturn(0);
0db56f73 6342 }
e13bba36 6343 s->activated_authconn = TRUE;
0db56f73 6344
6345 /*
7cca0d81 6346 * Now we're encrypting. Begin returning 1 to the protocol main
6347 * function so that other things can run on top of the
6348 * transport. If we ever see a KEXINIT, we must go back to the
6349 * start.
9442dd57 6350 *
6351 * We _also_ go back to the start if we see pktin==NULL and
ab18ccff 6352 * inlen negative, because this is a special signal meaning
9442dd57 6353 * `initiate client-driven rekey', and `in' contains a message
6354 * giving the reason for the rekey.
ab18ccff 6355 *
6356 * inlen==-1 means always initiate a rekey;
6357 * inlen==-2 means that userauth has completed successfully and
6358 * we should consider rekeying (for delayed compression).
033b4cef 6359 */
9442dd57 6360 while (!((pktin && pktin->type == SSH2_MSG_KEXINIT) ||
ab18ccff 6361 (!pktin && inlen < 0))) {
f382c87d 6362 wait_for_rekey:
32874aea 6363 crReturn(1);
e96adf72 6364 }
9442dd57 6365 if (pktin) {
6366 logevent("Server initiated key re-exchange");
6367 } else {
ab18ccff 6368 if (inlen == -2) {
6369 /*
6370 * authconn has seen a USERAUTH_SUCCEEDED. Time to enable
6371 * delayed compression, if it's available.
6372 *
6373 * draft-miller-secsh-compression-delayed-00 says that you
6374 * negotiate delayed compression in the first key exchange, and
6375 * both sides start compressing when the server has sent
6376 * USERAUTH_SUCCESS. This has a race condition -- the server
6377 * can't know when the client has seen it, and thus which incoming
6378 * packets it should treat as compressed.
6379 *
6380 * Instead, we do the initial key exchange without offering the
6381 * delayed methods, but note if the server offers them; when we
6382 * get here, if a delayed method was available that was higher
6383 * on our list than what we got, we initiate a rekey in which we
6384 * _do_ list the delayed methods (and hopefully get it as a
6385 * result). Subsequent rekeys will do the same.
6386 */
6387 assert(!s->userauth_succeeded); /* should only happen once */
6388 s->userauth_succeeded = TRUE;
6389 if (!s->pending_compression)
6390 /* Can't see any point rekeying. */
6391 goto wait_for_rekey; /* this is utterly horrid */
6392 /* else fall through to rekey... */
6393 s->pending_compression = FALSE;
6394 }
f382c87d 6395 /*
ab18ccff 6396 * Now we've decided to rekey.
6397 *
f382c87d 6398 * Special case: if the server bug is set that doesn't
6399 * allow rekeying, we give a different log message and
6400 * continue waiting. (If such a server _initiates_ a rekey,
6401 * we process it anyway!)
6402 */
6403 if ((ssh->remote_bugs & BUG_SSH2_REKEY)) {
6404 logeventf(ssh, "Server bug prevents key re-exchange (%s)",
6405 (char *)in);
6406 /* Reset the counters, so that at least this message doesn't
6407 * hit the event log _too_ often. */
6408 ssh->outgoing_data_size = 0;
6409 ssh->incoming_data_size = 0;
4a693cfc 6410 if (conf_get_int(ssh->conf, CONF_ssh_rekey_time) != 0) {
f382c87d 6411 ssh->next_rekey =
4a693cfc 6412 schedule_timer(conf_get_int(ssh->conf, CONF_ssh_rekey_time)*60*TICKSPERSEC,
f382c87d 6413 ssh2_timer, ssh);
6414 }
ab18ccff 6415 goto wait_for_rekey; /* this is still utterly horrid */
f382c87d 6416 } else {
6417 logeventf(ssh, "Initiating key re-exchange (%s)", (char *)in);
f382c87d 6418 }
9442dd57 6419 }
7cca0d81 6420 goto begin_key_exchange;
e5574168 6421
6422 crFinish(1);
6423}
6424
7cca0d81 6425/*
2e85c969 6426 * Add data to an SSH-2 channel output buffer.
783415f8 6427 */
32874aea 6428static void ssh2_add_channel_data(struct ssh_channel *c, char *buf,
6429 int len)
6430{
5471d09a 6431 bufchain_add(&c->v.v2.outbuffer, buf, len);
783415f8 6432}
6433
6434/*
2e85c969 6435 * Attempt to send data on an SSH-2 channel.
783415f8 6436 */
5471d09a 6437static int ssh2_try_send(struct ssh_channel *c)
32874aea 6438{
51470298 6439 Ssh ssh = c->ssh;
ff3187f6 6440 struct Packet *pktout;
51470298 6441
5471d09a 6442 while (c->v.v2.remwindow > 0 && bufchain_size(&c->v.v2.outbuffer) > 0) {
6443 int len;
6444 void *data;
6445 bufchain_prefix(&c->v.v2.outbuffer, &data, &len);
6446 if ((unsigned)len > c->v.v2.remwindow)
6447 len = c->v.v2.remwindow;
6448 if ((unsigned)len > c->v.v2.remmaxpkt)
6449 len = c->v.v2.remmaxpkt;
ff3187f6 6450 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_DATA);
6451 ssh2_pkt_adduint32(pktout, c->remoteid);
ff3187f6 6452 ssh2_pkt_addstring_start(pktout);
a2724fba 6453 dont_log_data(ssh, pktout, PKTLOG_OMIT);
ff3187f6 6454 ssh2_pkt_addstring_data(pktout, data, len);
6455 end_log_omission(ssh, pktout);
6456 ssh2_pkt_send(ssh, pktout);
5471d09a 6457 bufchain_consume(&c->v.v2.outbuffer, len);
6458 c->v.v2.remwindow -= len;
6459 }
6460
6461 /*
6462 * After having sent as much data as we can, return the amount
6463 * still buffered.
6464 */
6465 return bufchain_size(&c->v.v2.outbuffer);
6466}
6467
78280721 6468static void ssh2_try_send_and_unthrottle(Ssh ssh, struct ssh_channel *c)
1bfc7e93 6469{
6470 int bufsize;
6471 if (c->closes)
6472 return; /* don't send on closing channels */
6473 bufsize = ssh2_try_send(c);
6474 if (bufsize == 0) {
6475 switch (c->type) {
6476 case CHAN_MAINSESSION:
6477 /* stdin need not receive an unthrottle
6478 * notification since it will be polled */
6479 break;
6480 case CHAN_X11:
6481 x11_unthrottle(c->u.x11.s);
6482 break;
6483 case CHAN_AGENT:
6484 /* agent sockets are request/response and need no
6485 * buffer management */
6486 break;
6487 case CHAN_SOCKDATA:
6488 pfd_unthrottle(c->u.pfd.s);
6489 break;
6490 }
6491 }
78280721 6492
6493 /*
6494 * If we've emptied the channel's output buffer and there's a
6495 * pending close event, start the channel-closing procedure.
6496 */
6497 if (c->pending_close && bufchain_size(&c->v.v2.outbuffer) == 0) {
6498 struct Packet *pktout;
6499 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6500 ssh2_pkt_adduint32(pktout, c->remoteid);
6501 ssh2_pkt_send(ssh, pktout);
6502 c->closes = 1;
6503 c->pending_close = FALSE;
6504 }
1bfc7e93 6505}
6506
5471d09a 6507/*
94bdfe40 6508 * Set up most of a new ssh_channel for SSH-2.
6509 */
6510static void ssh2_channel_init(struct ssh_channel *c)
6511{
6512 Ssh ssh = c->ssh;
6513 c->localid = alloc_channel_id(ssh);
6514 c->closes = 0;
78280721 6515 c->pending_close = FALSE;
94bdfe40 6516 c->throttling_conn = FALSE;
6517 c->v.v2.locwindow = c->v.v2.locmaxwin = c->v.v2.remlocwin =
4a693cfc 6518 conf_get_int(ssh->conf, CONF_ssh_simple) ? OUR_V2_BIGWIN : OUR_V2_WINSIZE;
94bdfe40 6519 c->v.v2.winadj_head = c->v.v2.winadj_tail = NULL;
6520 c->v.v2.throttle_state = UNTHROTTLED;
6521 bufchain_init(&c->v.v2.outbuffer);
6522}
6523
6524/*
2e85c969 6525 * Potentially enlarge the window on an SSH-2 channel.
5471d09a 6526 */
9fca3f8c 6527static void ssh2_set_window(struct ssh_channel *c, int newwin)
5471d09a 6528{
51470298 6529 Ssh ssh = c->ssh;
6530
6b69f42e 6531 /*
6532 * Never send WINDOW_ADJUST for a channel that the remote side
6533 * already thinks it's closed; there's no point, since it won't
6534 * be sending any more data anyway.
6535 */
6536 if (c->closes != 0)
6537 return;
6538
d252310a 6539 /*
c9739dba 6540 * If the remote end has a habit of ignoring maxpkt, limit the
6541 * window so that it has no choice (assuming it doesn't ignore the
6542 * window as well).
6543 */
6544 if ((ssh->remote_bugs & BUG_SSH2_MAXPKT) && newwin > OUR_V2_MAXPKT)
6545 newwin = OUR_V2_MAXPKT;
6546
6547
6548 /*
d252310a 6549 * Only send a WINDOW_ADJUST if there's significantly more window
6550 * available than the other end thinks there is. This saves us
6551 * sending a WINDOW_ADJUST for every character in a shell session.
6552 *
6553 * "Significant" is arbitrarily defined as half the window size.
6554 */
3361b80a 6555 if (newwin / 2 >= c->v.v2.locwindow) {
ff3187f6 6556 struct Packet *pktout;
0e443c99 6557 struct winadj *wa;
ff3187f6 6558
0e443c99 6559 /*
6560 * In order to keep track of how much window the client
6561 * actually has available, we'd like it to acknowledge each
6562 * WINDOW_ADJUST. We can't do that directly, so we accompany
6563 * it with a CHANNEL_REQUEST that has to be acknowledged.
6564 *
6565 * This is only necessary if we're opening the window wide.
6566 * If we're not, then throughput is being constrained by
6567 * something other than the maximum window size anyway.
6568 *
6569 * We also only send this if the main channel has finished its
6570 * initial CHANNEL_REQUESTs and installed the default
6571 * CHANNEL_FAILURE handler, so as not to risk giving it
6572 * unexpected CHANNEL_FAILUREs.
6573 */
6574 if (newwin == c->v.v2.locmaxwin &&
6575 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE]) {
6576 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
6577 ssh2_pkt_adduint32(pktout, c->remoteid);
6578 ssh2_pkt_addstring(pktout, "winadj@putty.projects.tartarus.org");
6579 ssh2_pkt_addbool(pktout, TRUE);
6580 ssh2_pkt_send(ssh, pktout);
6581
6582 /*
6583 * CHANNEL_FAILURE doesn't come with any indication of
6584 * what message caused it, so we have to keep track of the
6585 * outstanding CHANNEL_REQUESTs ourselves.
6586 */
6587 wa = snew(struct winadj);
6588 wa->size = newwin - c->v.v2.locwindow;
6589 wa->next = NULL;
6590 if (!c->v.v2.winadj_head)
6591 c->v.v2.winadj_head = wa;
6592 else
6593 c->v.v2.winadj_tail->next = wa;
6594 c->v.v2.winadj_tail = wa;
6595 if (c->v.v2.throttle_state != UNTHROTTLED)
6596 c->v.v2.throttle_state = UNTHROTTLING;
6597 } else {
6598 /* Pretend the WINDOW_ADJUST was acked immediately. */
6599 c->v.v2.remlocwin = newwin;
6600 c->v.v2.throttle_state = THROTTLED;
6601 }
ff3187f6 6602 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
6603 ssh2_pkt_adduint32(pktout, c->remoteid);
6604 ssh2_pkt_adduint32(pktout, newwin - c->v.v2.locwindow);
6605 ssh2_pkt_send(ssh, pktout);
5471d09a 6606 c->v.v2.locwindow = newwin;
783415f8 6607 }
6608}
6609
e223b7c7 6610/*
6611 * Find the channel associated with a message. If there's no channel,
6612 * or it's not properly open, make a noise about it and return NULL.
6613 */
6614static struct ssh_channel *ssh2_channel_msg(Ssh ssh, struct Packet *pktin)
6615{
6616 unsigned localid = ssh_pkt_getuint32(pktin);
6617 struct ssh_channel *c;
6618
6619 c = find234(ssh->channels, &localid, ssh_channelfind);
6620 if (!c ||
6621 (c->halfopen && pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION &&
6622 pktin->type != SSH2_MSG_CHANNEL_OPEN_FAILURE)) {
6623 char *buf = dupprintf("Received %s for %s channel %u",
6624 ssh2_pkt_type(ssh->pkt_kctx, ssh->pkt_actx,
6625 pktin->type),
6626 c ? "half-open" : "nonexistent", localid);
6627 ssh_disconnect(ssh, NULL, buf, SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6628 sfree(buf);
6629 return NULL;
6630 }
6631 return c;
6632}
6633
e030765f 6634static int ssh2_handle_winadj_response(struct ssh_channel *c)
6635{
6636 struct winadj *wa = c->v.v2.winadj_head;
6637 if (!wa)
6638 return FALSE;
6639 c->v.v2.winadj_head = wa->next;
6640 c->v.v2.remlocwin += wa->size;
6641 sfree(wa);
6642 /*
6643 * winadj messages are only sent when the window is fully open, so
6644 * if we get an ack of one, we know any pending unthrottle is
6645 * complete.
6646 */
6647 if (c->v.v2.throttle_state == UNTHROTTLING)
6648 c->v.v2.throttle_state = UNTHROTTLED;
6649 return TRUE;
6650}
6651
837d6ba6 6652static void ssh2_msg_channel_success(Ssh ssh, struct Packet *pktin)
6653{
6654 /*
6655 * This should never get called. All channel requests are either
e030765f 6656 * sent with want_reply false, are sent before this handler gets
6657 * installed, or are "winadj@putty" requests, which servers should
6658 * never respond to with success.
6659 *
6660 * However, at least one server ("boks_sshd") is known to return
6661 * SUCCESS for channel requests it's never heard of, such as
6662 * "winadj@putty". Raised with foxt.com as bug 090916-090424, but
6663 * for the sake of a quiet life, we handle it just the same as the
6664 * expected FAILURE.
837d6ba6 6665 */
6666 struct ssh_channel *c;
837d6ba6 6667
6668 c = ssh2_channel_msg(ssh, pktin);
6669 if (!c)
6670 return;
e030765f 6671 if (!ssh2_handle_winadj_response(c))
837d6ba6 6672 ssh_disconnect(ssh, NULL,
6673 "Received unsolicited SSH_MSG_CHANNEL_SUCCESS",
6674 SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6675}
6676
0e443c99 6677static void ssh2_msg_channel_failure(Ssh ssh, struct Packet *pktin)
6678{
6679 /*
6680 * The only time this should get called is for "winadj@putty"
6681 * messages sent above. All other channel requests are either
6682 * sent with want_reply false or are sent before this handler gets
6683 * installed.
6684 */
0e443c99 6685 struct ssh_channel *c;
0e443c99 6686
e223b7c7 6687 c = ssh2_channel_msg(ssh, pktin);
0e443c99 6688 if (!c)
e223b7c7 6689 return;
e030765f 6690 if (!ssh2_handle_winadj_response(c))
837d6ba6 6691 ssh_disconnect(ssh, NULL,
6692 "Received unsolicited SSH_MSG_CHANNEL_FAILURE",
6693 SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
0e443c99 6694}
6695
51df0ab5 6696static void ssh2_msg_channel_window_adjust(Ssh ssh, struct Packet *pktin)
b09eaa88 6697{
b09eaa88 6698 struct ssh_channel *c;
e223b7c7 6699 c = ssh2_channel_msg(ssh, pktin);
6700 if (!c)
6701 return;
6702 if (!c->closes) {
b09eaa88 6703 c->v.v2.remwindow += ssh_pkt_getuint32(pktin);
78280721 6704 ssh2_try_send_and_unthrottle(ssh, c);
1bfc7e93 6705 }
b09eaa88 6706}
6707
51df0ab5 6708static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin)
6709{
6710 char *data;
6d44acc9 6711 int length;
51df0ab5 6712 struct ssh_channel *c;
e223b7c7 6713 c = ssh2_channel_msg(ssh, pktin);
51df0ab5 6714 if (!c)
e223b7c7 6715 return;
51df0ab5 6716 if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA &&
6717 ssh_pkt_getuint32(pktin) != SSH2_EXTENDED_DATA_STDERR)
6718 return; /* extended but not stderr */
6719 ssh_pkt_getstring(pktin, &data, &length);
6720 if (data) {
6721 int bufsize = 0;
6722 c->v.v2.locwindow -= length;
0e443c99 6723 c->v.v2.remlocwin -= length;
51df0ab5 6724 switch (c->type) {
6725 case CHAN_MAINSESSION:
6726 bufsize =
6727 from_backend(ssh->frontend, pktin->type ==
6728 SSH2_MSG_CHANNEL_EXTENDED_DATA,
6729 data, length);
6730 break;
6731 case CHAN_X11:
6732 bufsize = x11_send(c->u.x11.s, data, length);
6733 break;
6734 case CHAN_SOCKDATA:
6735 bufsize = pfd_send(c->u.pfd.s, data, length);
6736 break;
6737 case CHAN_AGENT:
6738 while (length > 0) {
6739 if (c->u.a.lensofar < 4) {
62ddb51e 6740 unsigned int l = min(4 - c->u.a.lensofar,
6741 (unsigned)length);
51df0ab5 6742 memcpy(c->u.a.msglen + c->u.a.lensofar,
6743 data, l);
6744 data += l;
6745 length -= l;
6746 c->u.a.lensofar += l;
6747 }
6748 if (c->u.a.lensofar == 4) {
6749 c->u.a.totallen =
6750 4 + GET_32BIT(c->u.a.msglen);
6751 c->u.a.message = snewn(c->u.a.totallen,
6752 unsigned char);
6753 memcpy(c->u.a.message, c->u.a.msglen, 4);
6754 }
6755 if (c->u.a.lensofar >= 4 && length > 0) {
aa63ab7e 6756 unsigned int l =
51df0ab5 6757 min(c->u.a.totallen - c->u.a.lensofar,
62ddb51e 6758 (unsigned)length);
51df0ab5 6759 memcpy(c->u.a.message + c->u.a.lensofar,
6760 data, l);
6761 data += l;
6762 length -= l;
6763 c->u.a.lensofar += l;
6764 }
6765 if (c->u.a.lensofar == c->u.a.totallen) {
6766 void *reply;
6767 int replylen;
6768 if (agent_query(c->u.a.message,
6769 c->u.a.totallen,
6770 &reply, &replylen,
6771 ssh_agentf_callback, c))
6772 ssh_agentf_callback(c, reply, replylen);
6773 sfree(c->u.a.message);
6774 c->u.a.lensofar = 0;
6775 }
6776 }
6777 bufsize = 0;
6778 break;
6779 }
6780 /*
0e443c99 6781 * If it looks like the remote end hit the end of its window,
6782 * and we didn't want it to do that, think about using a
6783 * larger window.
6784 */
6785 if (c->v.v2.remlocwin <= 0 && c->v.v2.throttle_state == UNTHROTTLED &&
6786 c->v.v2.locmaxwin < 0x40000000)
6787 c->v.v2.locmaxwin += OUR_V2_WINSIZE;
6788 /*
51df0ab5 6789 * If we are not buffering too much data,
6790 * enlarge the window again at the remote side.
467e064d 6791 * If we are buffering too much, we may still
6792 * need to adjust the window if the server's
6793 * sent excess data.
51df0ab5 6794 */
9b53e9b8 6795 ssh2_set_window(c, bufsize < c->v.v2.locmaxwin ?
6796 c->v.v2.locmaxwin - bufsize : 0);
ff68564b 6797 /*
6798 * If we're either buffering way too much data, or if we're
6799 * buffering anything at all and we're in "simple" mode,
6800 * throttle the whole channel.
6801 */
6802 if ((bufsize > c->v.v2.locmaxwin ||
4a693cfc 6803 (conf_get_int(ssh->conf, CONF_ssh_simple) && bufsize > 0)) &&
ff68564b 6804 !c->throttling_conn) {
6805 c->throttling_conn = 1;
6806 ssh_throttle_conn(ssh, +1);
6807 }
51df0ab5 6808 }
6809}
6810
6811static void ssh2_msg_channel_eof(Ssh ssh, struct Packet *pktin)
6812{
51df0ab5 6813 struct ssh_channel *c;
6814
e223b7c7 6815 c = ssh2_channel_msg(ssh, pktin);
51df0ab5 6816 if (!c)
e223b7c7 6817 return;
51df0ab5 6818
6819 if (c->type == CHAN_X11) {
6820 /*
6821 * Remote EOF on an X11 channel means we should
6822 * wrap up and close the channel ourselves.
6823 */
6824 x11_close(c->u.x11.s);
5959132d 6825 c->u.x11.s = NULL;
51df0ab5 6826 sshfwd_close(c);
6827 } else if (c->type == CHAN_AGENT) {
6828 sshfwd_close(c);
6829 } else if (c->type == CHAN_SOCKDATA) {
6830 pfd_close(c->u.pfd.s);
5959132d 6831 c->u.pfd.s = NULL;
51df0ab5 6832 sshfwd_close(c);
6833 }
6834}
6835
6836static void ssh2_msg_channel_close(Ssh ssh, struct Packet *pktin)
6837{
51df0ab5 6838 struct ssh_channel *c;
6839 struct Packet *pktout;
6840
e223b7c7 6841 c = ssh2_channel_msg(ssh, pktin);
6842 if (!c)
51df0ab5 6843 return;
51df0ab5 6844 /* Do pre-close processing on the channel. */
6845 switch (c->type) {
6846 case CHAN_MAINSESSION:
6847 ssh->mainchan = NULL;
6848 update_specials_menu(ssh->frontend);
6849 break;
6850 case CHAN_X11:
6851 if (c->u.x11.s != NULL)
6852 x11_close(c->u.x11.s);
6853 sshfwd_close(c);
6854 break;
6855 case CHAN_AGENT:
6856 sshfwd_close(c);
6857 break;
6858 case CHAN_SOCKDATA:
6859 if (c->u.pfd.s != NULL)
6860 pfd_close(c->u.pfd.s);
6861 sshfwd_close(c);
6862 break;
6863 }
6864 if (c->closes == 0) {
6865 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6866 ssh2_pkt_adduint32(pktout, c->remoteid);
6867 ssh2_pkt_send(ssh, pktout);
6868 }
6869 del234(ssh->channels, c);
6870 bufchain_clear(&c->v.v2.outbuffer);
6871 sfree(c);
6872
6873 /*
6874 * See if that was the last channel left open.
6875 * (This is only our termination condition if we're
6876 * not running in -N mode.)
6877 */
4a693cfc 6878 if (!conf_get_int(ssh->conf, CONF_ssh_no_shell) && count234(ssh->channels) == 0) {
51df0ab5 6879 /*
6880 * We used to send SSH_MSG_DISCONNECT here,
6881 * because I'd believed that _every_ conforming
2e85c969 6882 * SSH-2 connection had to end with a disconnect
51df0ab5 6883 * being sent by at least one side; apparently
6884 * I was wrong and it's perfectly OK to
6885 * unceremoniously slam the connection shut
6886 * when you're done, and indeed OpenSSH feels
6887 * this is more polite than sending a
6888 * DISCONNECT. So now we don't.
6889 */
9e296bfa 6890 ssh_disconnect(ssh, "All channels closed", NULL, 0, TRUE);
51df0ab5 6891 }
6892}
6893
6894static void ssh2_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
6895{
51df0ab5 6896 struct ssh_channel *c;
6897 struct Packet *pktout;
6898
e223b7c7 6899 c = ssh2_channel_msg(ssh, pktin);
51df0ab5 6900 if (!c)
e223b7c7 6901 return;
51df0ab5 6902 if (c->type != CHAN_SOCKDATA_DORMANT)
6903 return; /* dunno why they're confirming this */
6904 c->remoteid = ssh_pkt_getuint32(pktin);
64d6ff88 6905 c->halfopen = FALSE;
51df0ab5 6906 c->type = CHAN_SOCKDATA;
6907 c->v.v2.remwindow = ssh_pkt_getuint32(pktin);
6908 c->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
6909 if (c->u.pfd.s)
6910 pfd_confirm(c->u.pfd.s);
6911 if (c->closes) {
6912 /*
6913 * We have a pending close on this channel,
6914 * which we decided on before the server acked
6915 * the channel open. So now we know the
6916 * remoteid, we can close it again.
6917 */
6918 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6919 ssh2_pkt_adduint32(pktout, c->remoteid);
6920 ssh2_pkt_send(ssh, pktout);
6921 }
6922}
6923
6924static void ssh2_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
6925{
6926 static const char *const reasons[] = {
6927 "<unknown reason code>",
6928 "Administratively prohibited",
6929 "Connect failed",
6930 "Unknown channel type",
6931 "Resource shortage",
6932 };
51df0ab5 6933 unsigned reason_code;
6934 char *reason_string;
6935 int reason_length;
51df0ab5 6936 struct ssh_channel *c;
e223b7c7 6937 c = ssh2_channel_msg(ssh, pktin);
51df0ab5 6938 if (!c)
e223b7c7 6939 return;
51df0ab5 6940 if (c->type != CHAN_SOCKDATA_DORMANT)
6941 return; /* dunno why they're failing this */
6942
6943 reason_code = ssh_pkt_getuint32(pktin);
6944 if (reason_code >= lenof(reasons))
6945 reason_code = 0; /* ensure reasons[reason_code] in range */
6946 ssh_pkt_getstring(pktin, &reason_string, &reason_length);
fb983202 6947 logeventf(ssh, "Forwarded connection refused by server: %s [%.*s]",
6948 reasons[reason_code], reason_length, reason_string);
51df0ab5 6949
6950 pfd_close(c->u.pfd.s);
6951
6952 del234(ssh->channels, c);
6953 sfree(c);
6954}
6955
6956static void ssh2_msg_channel_request(Ssh ssh, struct Packet *pktin)
6957{
51df0ab5 6958 char *type;
6959 int typelen, want_reply;
6960 int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */
6961 struct ssh_channel *c;
6962 struct Packet *pktout;
6963
e223b7c7 6964 c = ssh2_channel_msg(ssh, pktin);
6965 if (!c)
6966 return;
51df0ab5 6967 ssh_pkt_getstring(pktin, &type, &typelen);
6968 want_reply = ssh2_pkt_getbool(pktin);
6969
6970 /*
51df0ab5 6971 * Having got the channel number, we now look at
6972 * the request type string to see if it's something
6973 * we recognise.
6974 */
6975 if (c == ssh->mainchan) {
6976 /*
6977 * We recognise "exit-status" and "exit-signal" on
6978 * the primary channel.
6979 */
6980 if (typelen == 11 &&
6981 !memcmp(type, "exit-status", 11)) {
6982
6983 ssh->exitcode = ssh_pkt_getuint32(pktin);
6984 logeventf(ssh, "Server sent command exit status %d",
6985 ssh->exitcode);
6986 reply = SSH2_MSG_CHANNEL_SUCCESS;
6987
6988 } else if (typelen == 11 &&
6989 !memcmp(type, "exit-signal", 11)) {
6990
6991 int is_plausible = TRUE, is_int = FALSE;
6992 char *fmt_sig = "", *fmt_msg = "";
6993 char *msg;
6994 int msglen = 0, core = FALSE;
6995 /* ICK: older versions of OpenSSH (e.g. 3.4p1)
6996 * provide an `int' for the signal, despite its
bccbeb71 6997 * having been a `string' in the drafts of RFC 4254 since at
51df0ab5 6998 * least 2001. (Fixed in session.c 1.147.) Try to
6999 * infer which we can safely parse it as. */
7000 {
7001 unsigned char *p = pktin->body +
7002 pktin->savedpos;
7003 long len = pktin->length - pktin->savedpos;
7004 unsigned long num = GET_32BIT(p); /* what is it? */
7005 /* If it's 0, it hardly matters; assume string */
7006 if (num == 0) {
7007 is_int = FALSE;
7008 } else {
7009 int maybe_int = FALSE, maybe_str = FALSE;
7010#define CHECK_HYPOTHESIS(offset, result) \
7011 do { \
7012 long q = offset; \
7013 if (q >= 0 && q+4 <= len) { \
7014 q = q + 4 + GET_32BIT(p+q); \
7015 if (q >= 0 && q+4 <= len && \
c849ff23 7016 ((q = q + 4 + GET_32BIT(p+q))!= 0) && q == len) \
51df0ab5 7017 result = TRUE; \
7018 } \
7019 } while(0)
7020 CHECK_HYPOTHESIS(4+1, maybe_int);
7021 CHECK_HYPOTHESIS(4+num+1, maybe_str);
7022#undef CHECK_HYPOTHESIS
7023 if (maybe_int && !maybe_str)
7024 is_int = TRUE;
7025 else if (!maybe_int && maybe_str)
7026 is_int = FALSE;
7027 else
7028 /* Crikey. Either or neither. Panic. */
7029 is_plausible = FALSE;
7030 }
7031 }
d051d1b4 7032 ssh->exitcode = 128; /* means `unknown signal' */
51df0ab5 7033 if (is_plausible) {
7034 if (is_int) {
7035 /* Old non-standard OpenSSH. */
7036 int signum = ssh_pkt_getuint32(pktin);
7037 fmt_sig = dupprintf(" %d", signum);
d051d1b4 7038 ssh->exitcode = 128 + signum;
51df0ab5 7039 } else {
bccbeb71 7040 /* As per RFC 4254. */
51df0ab5 7041 char *sig;
7042 int siglen;
7043 ssh_pkt_getstring(pktin, &sig, &siglen);
7044 /* Signal name isn't supposed to be blank, but
7045 * let's cope gracefully if it is. */
7046 if (siglen) {
7047 fmt_sig = dupprintf(" \"%.*s\"",
7048 siglen, sig);
7049 }
d051d1b4 7050
7051 /*
7052 * Really hideous method of translating the
7053 * signal description back into a locally
7054 * meaningful number.
7055 */
7056
7057 if (0)
7058 ;
b707973a 7059#define TRANSLATE_SIGNAL(s) \
7060 else if (siglen == lenof(#s)-1 && !memcmp(sig, #s, siglen)) \
7061 ssh->exitcode = 128 + SIG ## s
d051d1b4 7062#ifdef SIGABRT
b707973a 7063 TRANSLATE_SIGNAL(ABRT);
d051d1b4 7064#endif
7065#ifdef SIGALRM
b707973a 7066 TRANSLATE_SIGNAL(ALRM);
d051d1b4 7067#endif
7068#ifdef SIGFPE
b707973a 7069 TRANSLATE_SIGNAL(FPE);
d051d1b4 7070#endif
7071#ifdef SIGHUP
b707973a 7072 TRANSLATE_SIGNAL(HUP);
d051d1b4 7073#endif
7074#ifdef SIGILL
b707973a 7075 TRANSLATE_SIGNAL(ILL);
d051d1b4 7076#endif
7077#ifdef SIGINT
b707973a 7078 TRANSLATE_SIGNAL(INT);
d051d1b4 7079#endif
7080#ifdef SIGKILL
b707973a 7081 TRANSLATE_SIGNAL(KILL);
d051d1b4 7082#endif
7083#ifdef SIGPIPE
b707973a 7084 TRANSLATE_SIGNAL(PIPE);
d051d1b4 7085#endif
7086#ifdef SIGQUIT
b707973a 7087 TRANSLATE_SIGNAL(QUIT);
d051d1b4 7088#endif
7089#ifdef SIGSEGV
b707973a 7090 TRANSLATE_SIGNAL(SEGV);
d051d1b4 7091#endif
7092#ifdef SIGTERM
b707973a 7093 TRANSLATE_SIGNAL(TERM);
d051d1b4 7094#endif
7095#ifdef SIGUSR1
b707973a 7096 TRANSLATE_SIGNAL(USR1);
d051d1b4 7097#endif
7098#ifdef SIGUSR2
b707973a 7099 TRANSLATE_SIGNAL(USR2);
d051d1b4 7100#endif
b707973a 7101#undef TRANSLATE_SIGNAL
d051d1b4 7102 else
7103 ssh->exitcode = 128;
51df0ab5 7104 }
7105 core = ssh2_pkt_getbool(pktin);
7106 ssh_pkt_getstring(pktin, &msg, &msglen);
7107 if (msglen) {
7108 fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg);
7109 }
7110 /* ignore lang tag */
7111 } /* else don't attempt to parse */
7112 logeventf(ssh, "Server exited on signal%s%s%s",
7113 fmt_sig, core ? " (core dumped)" : "",
7114 fmt_msg);
7115 if (*fmt_sig) sfree(fmt_sig);
7116 if (*fmt_msg) sfree(fmt_msg);
7117 reply = SSH2_MSG_CHANNEL_SUCCESS;
7118
7119 }
7120 } else {
7121 /*
7122 * This is a channel request we don't know
7123 * about, so we now either ignore the request
7124 * or respond with CHANNEL_FAILURE, depending
7125 * on want_reply.
7126 */
7127 reply = SSH2_MSG_CHANNEL_FAILURE;
7128 }
7129 if (want_reply) {
7130 pktout = ssh2_pkt_init(reply);
7131 ssh2_pkt_adduint32(pktout, c->remoteid);
7132 ssh2_pkt_send(ssh, pktout);
7133 }
7134}
7135
7136static void ssh2_msg_global_request(Ssh ssh, struct Packet *pktin)
7137{
7138 char *type;
7139 int typelen, want_reply;
7140 struct Packet *pktout;
7141
7142 ssh_pkt_getstring(pktin, &type, &typelen);
7143 want_reply = ssh2_pkt_getbool(pktin);
7144
7145 /*
7146 * We currently don't support any global requests
7147 * at all, so we either ignore the request or
7148 * respond with REQUEST_FAILURE, depending on
7149 * want_reply.
7150 */
7151 if (want_reply) {
7152 pktout = ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE);
7153 ssh2_pkt_send(ssh, pktout);
7154 }
7155}
7156
7157static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin)
7158{
7159 char *type;
7160 int typelen;
7161 char *peeraddr;
7162 int peeraddrlen;
7163 int peerport;
7164 char *error = NULL;
7165 struct ssh_channel *c;
7166 unsigned remid, winsize, pktsize;
7167 struct Packet *pktout;
7168
7169 ssh_pkt_getstring(pktin, &type, &typelen);
7170 c = snew(struct ssh_channel);
7171 c->ssh = ssh;
7172
7173 remid = ssh_pkt_getuint32(pktin);
7174 winsize = ssh_pkt_getuint32(pktin);
7175 pktsize = ssh_pkt_getuint32(pktin);
7176
7177 if (typelen == 3 && !memcmp(type, "x11", 3)) {
7178 char *addrstr;
5907ebda 7179 const char *x11err;
51df0ab5 7180
7181 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
7182 addrstr = snewn(peeraddrlen+1, char);
7183 memcpy(addrstr, peeraddr, peeraddrlen);
7184 addrstr[peeraddrlen] = '\0';
7185 peerport = ssh_pkt_getuint32(pktin);
7186
7187 logeventf(ssh, "Received X11 connect request from %s:%d",
7188 addrstr, peerport);
7189
7190 if (!ssh->X11_fwd_enabled)
7191 error = "X11 forwarding is not enabled";
5907ebda 7192 else if ((x11err = x11_init(&c->u.x11.s, ssh->x11disp, c,
4a693cfc 7193 addrstr, peerport, ssh->conf)) != NULL) {
5907ebda 7194 logeventf(ssh, "Local X11 connection failed: %s", x11err);
51df0ab5 7195 error = "Unable to open an X11 connection";
7196 } else {
7197 logevent("Opening X11 forward connection succeeded");
7198 c->type = CHAN_X11;
7199 }
7200
7201 sfree(addrstr);
7202 } else if (typelen == 15 &&
7203 !memcmp(type, "forwarded-tcpip", 15)) {
7204 struct ssh_rportfwd pf, *realpf;
7205 char *dummy;
7206 int dummylen;
7207 ssh_pkt_getstring(pktin, &dummy, &dummylen);/* skip address */
7208 pf.sport = ssh_pkt_getuint32(pktin);
7209 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
7210 peerport = ssh_pkt_getuint32(pktin);
7211 realpf = find234(ssh->rportfwds, &pf, NULL);
7212 logeventf(ssh, "Received remote port %d open request "
7213 "from %s:%d", pf.sport, peeraddr, peerport);
7214 if (realpf == NULL) {
7215 error = "Remote port is not recognised";
7216 } else {
7217 const char *e = pfd_newconnect(&c->u.pfd.s,
7218 realpf->dhost,
7219 realpf->dport, c,
4a693cfc 7220 ssh->conf,
05581745 7221 realpf->pfrec->addressfamily);
51df0ab5 7222 logeventf(ssh, "Attempting to forward remote port to "
7223 "%s:%d", realpf->dhost, realpf->dport);
7224 if (e != NULL) {
7225 logeventf(ssh, "Port open failed: %s", e);
7226 error = "Port open failed";
7227 } else {
7228 logevent("Forwarded port opened successfully");
7229 c->type = CHAN_SOCKDATA;
7230 }
7231 }
7232 } else if (typelen == 22 &&
c49cf994 7233 !memcmp(type, "auth-agent@openssh.com", 22)) {
51df0ab5 7234 if (!ssh->agentfwd_enabled)
7235 error = "Agent forwarding is not enabled";
7236 else {
7237 c->type = CHAN_AGENT; /* identify channel type */
7238 c->u.a.lensofar = 0;
7239 }
7240 } else {
7241 error = "Unsupported channel type requested";
7242 }
7243
7244 c->remoteid = remid;
64d6ff88 7245 c->halfopen = FALSE;
51df0ab5 7246 if (error) {
7247 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE);
7248 ssh2_pkt_adduint32(pktout, c->remoteid);
7249 ssh2_pkt_adduint32(pktout, SSH2_OPEN_CONNECT_FAILED);
7250 ssh2_pkt_addstring(pktout, error);
7251 ssh2_pkt_addstring(pktout, "en"); /* language tag */
7252 ssh2_pkt_send(ssh, pktout);
7253 logeventf(ssh, "Rejected channel open: %s", error);
7254 sfree(c);
7255 } else {
94bdfe40 7256 ssh2_channel_init(c);
51df0ab5 7257 c->v.v2.remwindow = winsize;
7258 c->v.v2.remmaxpkt = pktsize;
51df0ab5 7259 add234(ssh->channels, c);
7260 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
7261 ssh2_pkt_adduint32(pktout, c->remoteid);
7262 ssh2_pkt_adduint32(pktout, c->localid);
7263 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);
954d5c5a 7264 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
51df0ab5 7265 ssh2_pkt_send(ssh, pktout);
7266 }
7267}
7268
6bbce591 7269/*
adb6167a 7270 * Buffer banner messages for later display at some convenient point,
7271 * if we're going to display them.
6bbce591 7272 */
7273static void ssh2_msg_userauth_banner(Ssh ssh, struct Packet *pktin)
7274{
7275 /* Arbitrary limit to prevent unbounded inflation of buffer */
4a693cfc 7276 if (conf_get_int(ssh->conf, CONF_ssh_show_banner) &&
adb6167a 7277 bufchain_size(&ssh->banner) <= 131072) {
6bbce591 7278 char *banner = NULL;
7279 int size = 0;
7280 ssh_pkt_getstring(pktin, &banner, &size);
7281 if (banner)
7282 bufchain_add(&ssh->banner, banner, size);
7283 }
7284}
7285
c6ccd5c2 7286/* Helper function to deal with sending tty modes for "pty-req" */
7287static void ssh2_send_ttymode(void *data, char *mode, char *val)
7288{
7289 struct Packet *pktout = (struct Packet *)data;
7290 int i = 0;
7291 unsigned int arg = 0;
7292 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
7293 if (i == lenof(ssh_ttymodes)) return;
7294 switch (ssh_ttymodes[i].type) {
7295 case TTY_OP_CHAR:
7296 arg = ssh_tty_parse_specchar(val);
7297 break;
7298 case TTY_OP_BOOL:
7299 arg = ssh_tty_parse_boolean(val);
7300 break;
7301 }
7302 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
7303 ssh2_pkt_adduint32(pktout, arg);
7304}
7305
783415f8 7306/*
2e85c969 7307 * Handle the SSH-2 userauth and connection layers.
7cca0d81 7308 */
ff3187f6 7309static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
7310 struct Packet *pktin)
7cca0d81 7311{
51470298 7312 struct do_ssh2_authconn_state {
7313 enum {
51470298 7314 AUTH_TYPE_NONE,
7315 AUTH_TYPE_PUBLICKEY,
7316 AUTH_TYPE_PUBLICKEY_OFFER_LOUD,
7317 AUTH_TYPE_PUBLICKEY_OFFER_QUIET,
7318 AUTH_TYPE_PASSWORD,
8221906d 7319 AUTH_TYPE_GSSAPI, /* always QUIET */
51470298 7320 AUTH_TYPE_KEYBOARD_INTERACTIVE,
7321 AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
7322 } type;
a1a1fae4 7323 int done_service_req;
51470298 7324 int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter;
94cd7c3a 7325 int tried_pubkey_config, done_agent;
bf84a03a 7326#ifndef NO_GSSAPI
42af6a67 7327 int can_gssapi;
7328 int tried_gssapi;
bf84a03a 7329#endif
edd0cb8a 7330 int kbd_inter_refused;
ab18ccff 7331 int we_are_in, userauth_success;
edd0cb8a 7332 prompts_t *cur_prompt;
7333 int num_prompts;
4a693cfc 7334 char *username;
e955d348 7335 char *password;
51470298 7336 int got_username;
51470298 7337 void *publickey_blob;
7338 int publickey_bloblen;
edd0cb8a 7339 int publickey_encrypted;
7340 char *publickey_algorithm;
7341 char *publickey_comment;
94cd7c3a 7342 unsigned char agent_request[5], *agent_response, *agentp;
7343 int agent_responselen;
7344 unsigned char *pkblob_in_agent;
51470298 7345 int keyi, nkeys;
51470298 7346 char *pkblob, *alg, *commentp;
7347 int pklen, alglen, commentlen;
7348 int siglen, retlen, len;
7349 char *q, *agentreq, *ret;
7350 int try_send;
73feed4f 7351 int num_env, env_left, env_ok;
ff3187f6 7352 struct Packet *pktout;
4a693cfc 7353 Filename *keyfile;
bf84a03a 7354#ifndef NO_GSSAPI
b3d375b2 7355 struct ssh_gss_library *gsslib;
42af6a67 7356 Ssh_gss_ctx gss_ctx;
7357 Ssh_gss_buf gss_buf;
7358 Ssh_gss_buf gss_rcvtok, gss_sndtok;
7359 Ssh_gss_name gss_srv_name;
7360 Ssh_gss_stat gss_stat;
bf84a03a 7361#endif
51470298 7362 };
7363 crState(do_ssh2_authconn_state);
7364
7365 crBegin(ssh->do_ssh2_authconn_crstate);
e5574168 7366
a1a1fae4 7367 s->done_service_req = FALSE;
ab18ccff 7368 s->we_are_in = s->userauth_success = FALSE;
bf84a03a 7369#ifndef NO_GSSAPI
42af6a67 7370 s->tried_gssapi = FALSE;
bf84a03a 7371#endif
42af6a67 7372
4a693cfc 7373 if (!conf_get_int(ssh->conf, CONF_ssh_no_userauth)) {
a1a1fae4 7374 /*
7375 * Request userauth protocol, and await a response to it.
7376 */
7377 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
7378 ssh2_pkt_addstring(s->pktout, "ssh-userauth");
7379 ssh2_pkt_send(ssh, s->pktout);
7380 crWaitUntilV(pktin);
7381 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT)
7382 s->done_service_req = TRUE;
7383 }
7384 if (!s->done_service_req) {
7385 /*
7386 * Request connection protocol directly, without authentication.
7387 */
7388 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
7389 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7390 ssh2_pkt_send(ssh, s->pktout);
7391 crWaitUntilV(pktin);
7392 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT) {
7393 s->we_are_in = TRUE; /* no auth required */
7394 } else {
7395 bombout(("Server refused service request"));
7396 crStopV;
7397 }
8d5de777 7398 }
7cca0d81 7399
94cd7c3a 7400 /* Arrange to be able to deal with any BANNERs that come in.
7401 * (We do this now as packets may come in during the next bit.) */
7402 bufchain_init(&ssh->banner);
7403 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] =
7404 ssh2_msg_userauth_banner;
7405
7cca0d81 7406 /*
edd0cb8a 7407 * Misc one-time setup for authentication.
7408 */
7409 s->publickey_blob = NULL;
7410 if (!s->we_are_in) {
7411
7412 /*
7413 * Load the public half of any configured public key file
7414 * for later use.
7415 */
4a693cfc 7416 s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
7417 if (!filename_is_null(*s->keyfile)) {
edd0cb8a 7418 int keytype;
7419 logeventf(ssh, "Reading private key file \"%.150s\"",
4a693cfc 7420 filename_to_str(s->keyfile));
7421 keytype = key_type(s->keyfile);
edd0cb8a 7422 if (keytype == SSH_KEYTYPE_SSH2) {
7423 const char *error;
7424 s->publickey_blob =
4a693cfc 7425 ssh2_userkey_loadpub(s->keyfile,
edd0cb8a 7426 &s->publickey_algorithm,
7427 &s->publickey_bloblen,
7428 &s->publickey_comment, &error);
7429 if (s->publickey_blob) {
7430 s->publickey_encrypted =
4a693cfc 7431 ssh2_userkey_encrypted(s->keyfile, NULL);
edd0cb8a 7432 } else {
7433 char *msgbuf;
7434 logeventf(ssh, "Unable to load private key (%s)",
7435 error);
7436 msgbuf = dupprintf("Unable to load private key file "
7437 "\"%.150s\" (%s)\r\n",
4a693cfc 7438 filename_to_str(s->keyfile),
edd0cb8a 7439 error);
7440 c_write_str(ssh, msgbuf);
7441 sfree(msgbuf);
7442 }
7443 } else {
7444 char *msgbuf;
7445 logeventf(ssh, "Unable to use this key file (%s)",
7446 key_type_to_str(keytype));
7447 msgbuf = dupprintf("Unable to use key file \"%.150s\""
7448 " (%s)\r\n",
4a693cfc 7449 filename_to_str(s->keyfile),
edd0cb8a 7450 key_type_to_str(keytype));
7451 c_write_str(ssh, msgbuf);
7452 sfree(msgbuf);
7453 s->publickey_blob = NULL;
7454 }
7455 }
7456
94cd7c3a 7457 /*
7458 * Find out about any keys Pageant has (but if there's a
7459 * public key configured, filter out all others).
7460 */
7461 s->nkeys = 0;
7462 s->agent_response = NULL;
7463 s->pkblob_in_agent = NULL;
4a693cfc 7464 if (conf_get_int(ssh->conf, CONF_tryagent) && agent_exists()) {
94cd7c3a 7465
7466 void *r;
7467
7468 logevent("Pageant is running. Requesting keys.");
7469
7470 /* Request the keys held by the agent. */
7471 PUT_32BIT(s->agent_request, 1);
7472 s->agent_request[4] = SSH2_AGENTC_REQUEST_IDENTITIES;
7473 if (!agent_query(s->agent_request, 5, &r, &s->agent_responselen,
7474 ssh_agent_callback, ssh)) {
7475 do {
7476 crReturnV;
7477 if (pktin) {
7478 bombout(("Unexpected data from server while"
7479 " waiting for agent response"));
7480 crStopV;
7481 }
7482 } while (pktin || inlen > 0);
7483 r = ssh->agent_response;
7484 s->agent_responselen = ssh->agent_response_len;
7485 }
7486 s->agent_response = (unsigned char *) r;
7487 if (s->agent_response && s->agent_responselen >= 5 &&
7488 s->agent_response[4] == SSH2_AGENT_IDENTITIES_ANSWER) {
7489 int keyi;
7490 unsigned char *p;
7491 p = s->agent_response + 5;
7492 s->nkeys = GET_32BIT(p);
7493 p += 4;
7494 logeventf(ssh, "Pageant has %d SSH-2 keys", s->nkeys);
7495 if (s->publickey_blob) {
7496 /* See if configured key is in agent. */
7497 for (keyi = 0; keyi < s->nkeys; keyi++) {
7498 s->pklen = GET_32BIT(p);
7499 if (s->pklen == s->publickey_bloblen &&
7500 !memcmp(p+4, s->publickey_blob,
7501 s->publickey_bloblen)) {
7502 logeventf(ssh, "Pageant key #%d matches "
7503 "configured key file", keyi);
7504 s->keyi = keyi;
7505 s->pkblob_in_agent = p;
7506 break;
7507 }
7508 p += 4 + s->pklen;
7509 p += GET_32BIT(p) + 4; /* comment */
7510 }
7511 if (!s->pkblob_in_agent) {
7512 logevent("Configured key file not in Pageant");
7513 s->nkeys = 0;
7514 }
7515 }
5ff99b8e 7516 } else {
7517 logevent("Failed to get reply from Pageant");
94cd7c3a 7518 }
7519 }
7520
edd0cb8a 7521 }
7522
7523 /*
1408a877 7524 * We repeat this whole loop, including the username prompt,
7525 * until we manage a successful authentication. If the user
51470298 7526 * types the wrong _password_, they can be sent back to the
7527 * beginning to try another username, if this is configured on.
7528 * (If they specify a username in the config, they are never
7529 * asked, even if they do give a wrong password.)
1408a877 7530 *
7531 * I think this best serves the needs of
7532 *
7533 * - the people who have no configuration, no keys, and just
7534 * want to try repeated (username,password) pairs until they
7535 * type both correctly
7536 *
7537 * - people who have keys and configuration but occasionally
7538 * need to fall back to passwords
7539 *
7540 * - people with a key held in Pageant, who might not have
7541 * logged in to a particular machine before; so they want to
7542 * type a username, and then _either_ their key will be
7543 * accepted, _or_ they will type a password. If they mistype
7544 * the username they will want to be able to get back and
7545 * retype it!
7cca0d81 7546 */
51470298 7547 s->got_username = FALSE;
a1a1fae4 7548 while (!s->we_are_in) {
1408a877 7549 /*
7550 * Get a username.
7551 */
4a693cfc 7552 if (s->got_username && !conf_get_int(ssh->conf, CONF_change_username)) {
5bb641e1 7553 /*
7554 * We got a username last time round this loop, and
7555 * with change_username turned off we don't try to get
7556 * it again.
7557 */
4a693cfc 7558 } else if ((ssh->username = get_remote_username(ssh->conf)) == NULL) {
edd0cb8a 7559 int ret; /* need not be kept over crReturn */
7560 s->cur_prompt = new_prompts(ssh->frontend);
7561 s->cur_prompt->to_server = TRUE;
7562 s->cur_prompt->name = dupstr("SSH login name");
4a693cfc 7563 /* 512 is an arbitrary limit :-( */
7564 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE, 512);
edd0cb8a 7565 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7566 while (ret < 0) {
51470298 7567 ssh->send_ok = 1;
edd0cb8a 7568 crWaitUntilV(!pktin);
7569 ret = get_userpass_input(s->cur_prompt, in, inlen);
7570 ssh->send_ok = 0;
32874aea 7571 }
edd0cb8a 7572 if (!ret) {
7573 /*
7574 * get_userpass_input() failed to get a username.
7575 * Terminate.
7576 */
7577 free_prompts(s->cur_prompt);
7578 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
7579 crStopV;
7580 }
4a693cfc 7581 ssh->username = dupstr(s->cur_prompt->prompts[0]->result);
edd0cb8a 7582 free_prompts(s->cur_prompt);
7cca0d81 7583 } else {
57356d63 7584 char *stuff;
65a22376 7585 if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
4a693cfc 7586 stuff = dupprintf("Using username \"%s\".\r\n", ssh->username);
51470298 7587 c_write_str(ssh, stuff);
57356d63 7588 sfree(stuff);
7cca0d81 7589 }
7590 }
51470298 7591 s->got_username = TRUE;
7cca0d81 7592
65a22376 7593 /*
1408a877 7594 * Send an authentication request using method "none": (a)
7595 * just in case it succeeds, and (b) so that we know what
7596 * authentication methods we can usefully try next.
65a22376 7597 */
acab36bc 7598 ssh->pkt_actx = SSH2_PKTCTX_NOAUTH;
51470298 7599
ff3187f6 7600 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
4a693cfc 7601 ssh2_pkt_addstring(s->pktout, ssh->username);
ff3187f6 7602 ssh2_pkt_addstring(s->pktout, "ssh-connection");/* service requested */
7603 ssh2_pkt_addstring(s->pktout, "none"); /* method */
7604 ssh2_pkt_send(ssh, s->pktout);
51470298 7605 s->type = AUTH_TYPE_NONE;
7606 s->gotit = FALSE;
7607 s->we_are_in = FALSE;
7608
7609 s->tried_pubkey_config = FALSE;
6ac3a551 7610 s->kbd_inter_refused = FALSE;
65a22376 7611
94cd7c3a 7612 /* Reset agent request state. */
7613 s->done_agent = FALSE;
7614 if (s->agent_response) {
7615 if (s->pkblob_in_agent) {
7616 s->agentp = s->pkblob_in_agent;
7617 } else {
7618 s->agentp = s->agent_response + 5 + 4;
7619 s->keyi = 0;
7620 }
7621 }
7622
1408a877 7623 while (1) {
854caca5 7624 char *methods = NULL;
7625 int methlen = 0;
7626
1408a877 7627 /*
7628 * Wait for the result of the last authentication request.
7629 */
51470298 7630 if (!s->gotit)
ff3187f6 7631 crWaitUntilV(pktin);
6bbce591 7632 /*
7633 * Now is a convenient point to spew any banner material
7634 * that we've accumulated. (This should ensure that when
7635 * we exit the auth loop, we haven't any left to deal
7636 * with.)
7637 */
7638 {
7639 int size = bufchain_size(&ssh->banner);
32874aea 7640 /*
7641 * Don't show the banner if we're operating in
7642 * non-verbose non-interactive mode. (It's probably
7643 * a script, which means nobody will read the
7644 * banner _anyway_, and moreover the printing of
7645 * the banner will screw up processing on the
7646 * output of (say) plink.)
7647 */
6bbce591 7648 if (size && (flags & (FLAG_VERBOSE | FLAG_INTERACTIVE))) {
7649 char *banner = snewn(size, char);
7650 bufchain_fetch(&ssh->banner, banner, size);
7651 c_write_untrusted(ssh, banner, size);
7652 sfree(banner);
32874aea 7653 }
6bbce591 7654 bufchain_clear(&ssh->banner);
1408a877 7655 }
ff3187f6 7656 if (pktin->type == SSH2_MSG_USERAUTH_SUCCESS) {
1408a877 7657 logevent("Access granted");
ab18ccff 7658 s->we_are_in = s->userauth_success = TRUE;
1408a877 7659 break;
7660 }
65a22376 7661
42af6a67 7662 if (pktin->type != SSH2_MSG_USERAUTH_FAILURE && s->type != AUTH_TYPE_GSSAPI) {
e955d348 7663 bombout(("Strange packet received during authentication: "
7664 "type %d", pktin->type));
7ffdbc1a 7665 crStopV;
65a22376 7666 }
7667
51470298 7668 s->gotit = FALSE;
65a22376 7669
1408a877 7670 /*
7671 * OK, we're now sitting on a USERAUTH_FAILURE message, so
7672 * we can look at the string in it and know what we can
7673 * helpfully try next.
7674 */
ff3187f6 7675 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE) {
ff3187f6 7676 ssh_pkt_getstring(pktin, &methods, &methlen);
ff3187f6 7677 if (!ssh2_pkt_getbool(pktin)) {
1408a877 7678 /*
7679 * We have received an unequivocal Access
7680 * Denied. This can translate to a variety of
8221906d 7681 * messages, or no message at all.
7682 *
7683 * For forms of authentication which are attempted
7684 * implicitly, by which I mean without printing
7685 * anything in the window indicating that we're
7686 * trying them, we should never print 'Access
7687 * denied'.
7688 *
7689 * If we do print a message saying that we're
7690 * attempting some kind of authentication, it's OK
7691 * to print a followup message saying it failed -
7692 * but the message may sometimes be more specific
7693 * than simply 'Access denied'.
7694 *
1408a877 7695 * Additionally, if we'd just tried password
7696 * authentication, we should break out of this
7697 * whole loop so as to go back to the username
91f57d1f 7698 * prompt (iff we're configured to allow
7699 * username change attempts).
1408a877 7700 */
51470298 7701 if (s->type == AUTH_TYPE_NONE) {
1408a877 7702 /* do nothing */
51470298 7703 } else if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD ||
7704 s->type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) {
7705 if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD)
7706 c_write_str(ssh, "Server refused our key\r\n");
8221906d 7707 logevent("Server refused our key");
7708 } else if (s->type == AUTH_TYPE_PUBLICKEY) {
7709 /* This _shouldn't_ happen except by a
7710 * protocol bug causing client and server to
7711 * disagree on what is a correct signature. */
7712 c_write_str(ssh, "Server refused public-key signature"
7713 " despite accepting key!\r\n");
7714 logevent("Server refused public-key signature"
7715 " despite accepting key!");
51470298 7716 } else if (s->type==AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) {
8221906d 7717 /* quiet, so no c_write */
7718 logevent("Server refused keyboard-interactive authentication");
7719 } else if (s->type==AUTH_TYPE_GSSAPI) {
7720 /* always quiet, so no c_write */
2af4fe8f 7721 /* also, the code down in the GSSAPI block has
7722 * already logged this in the Event Log */
8221906d 7723 } else if (s->type == AUTH_TYPE_KEYBOARD_INTERACTIVE) {
7724 logevent("Keyboard-interactive authentication failed");
7725 c_write_str(ssh, "Access denied\r\n");
7726 } else {
7727 assert(s->type == AUTH_TYPE_PASSWORD);
7728 logevent("Password authentication failed");
51470298 7729 c_write_str(ssh, "Access denied\r\n");
8221906d 7730
7731 if (conf_get_int(ssh->conf, CONF_change_username)) {
6c9dce7c 7732 /* XXX perhaps we should allow
7733 * keyboard-interactive to do this too? */
51470298 7734 s->we_are_in = FALSE;
1408a877 7735 break;
7736 }
7737 }
7738 } else {
51470298 7739 c_write_str(ssh, "Further authentication required\r\n");
1408a877 7740 logevent("Further authentication required");
7741 }
65a22376 7742
51470298 7743 s->can_pubkey =
32874aea 7744 in_commasep_string("publickey", methods, methlen);
51470298 7745 s->can_passwd =
32874aea 7746 in_commasep_string("password", methods, methlen);
4a693cfc 7747 s->can_keyb_inter = conf_get_int(ssh->conf, CONF_try_ki_auth) &&
761187b6 7748 in_commasep_string("keyboard-interactive", methods, methlen);
1e00c92b 7749#ifndef NO_GSSAPI
7750 if (!ssh->gsslibs)
4a693cfc 7751 ssh->gsslibs = ssh_gss_setup(ssh->conf);
7752 s->can_gssapi = conf_get_int(ssh->conf, CONF_try_gssapi_auth) &&
b3d375b2 7753 in_commasep_string("gssapi-with-mic", methods, methlen) &&
1e00c92b 7754 ssh->gsslibs->nlibraries > 0;
42af6a67 7755#endif
1408a877 7756 }
65a22376 7757
acab36bc 7758 ssh->pkt_actx = SSH2_PKTCTX_NOAUTH;
65a22376 7759
94cd7c3a 7760 if (s->can_pubkey && !s->done_agent && s->nkeys) {
0405e71f 7761
1983e559 7762 /*
94cd7c3a 7763 * Attempt public-key authentication using a key from Pageant.
1983e559 7764 */
1983e559 7765
acab36bc 7766 ssh->pkt_actx = SSH2_PKTCTX_PUBLICKEY;
00db133f 7767
94cd7c3a 7768 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
7769
7770 /* Unpack key from agent response */
7771 s->pklen = GET_32BIT(s->agentp);
7772 s->agentp += 4;
7773 s->pkblob = (char *)s->agentp;
7774 s->agentp += s->pklen;
7775 s->alglen = GET_32BIT(s->pkblob);
7776 s->alg = s->pkblob + 4;
7777 s->commentlen = GET_32BIT(s->agentp);
7778 s->agentp += 4;
7779 s->commentp = (char *)s->agentp;
7780 s->agentp += s->commentlen;
7781 /* s->agentp now points at next key, if any */
7782
7783 /* See if server will accept it */
7784 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
4a693cfc 7785 ssh2_pkt_addstring(s->pktout, ssh->username);
94cd7c3a 7786 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7787 /* service requested */
7788 ssh2_pkt_addstring(s->pktout, "publickey");
7789 /* method */
7790 ssh2_pkt_addbool(s->pktout, FALSE); /* no signature included */
7791 ssh2_pkt_addstring_start(s->pktout);
7792 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
7793 ssh2_pkt_addstring_start(s->pktout);
7794 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
7795 ssh2_pkt_send(ssh, s->pktout);
7796 s->type = AUTH_TYPE_PUBLICKEY_OFFER_QUIET;
1983e559 7797
94cd7c3a 7798 crWaitUntilV(pktin);
7799 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
1983e559 7800
94cd7c3a 7801 /* Offer of key refused. */
7802 s->gotit = TRUE;
1983e559 7803
94cd7c3a 7804 } else {
7805
7806 void *vret;
1983e559 7807
94cd7c3a 7808 if (flags & FLAG_VERBOSE) {
7809 c_write_str(ssh, "Authenticating with "
7810 "public key \"");
7811 c_write(ssh, s->commentp, s->commentlen);
7812 c_write_str(ssh, "\" from agent\r\n");
7813 }
1983e559 7814
94cd7c3a 7815 /*
7816 * Server is willing to accept the key.
7817 * Construct a SIGN_REQUEST.
7818 */
7819 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
4a693cfc 7820 ssh2_pkt_addstring(s->pktout, ssh->username);
94cd7c3a 7821 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7822 /* service requested */
7823 ssh2_pkt_addstring(s->pktout, "publickey");
7824 /* method */
7825 ssh2_pkt_addbool(s->pktout, TRUE); /* signature included */
7826 ssh2_pkt_addstring_start(s->pktout);
7827 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
7828 ssh2_pkt_addstring_start(s->pktout);
7829 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
7830
7831 /* Ask agent for signature. */
7832 s->siglen = s->pktout->length - 5 + 4 +
7833 ssh->v2_session_id_len;
7834 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
7835 s->siglen -= 4;
7836 s->len = 1; /* message type */
7837 s->len += 4 + s->pklen; /* key blob */
7838 s->len += 4 + s->siglen; /* data to sign */
7839 s->len += 4; /* flags */
7840 s->agentreq = snewn(4 + s->len, char);
7841 PUT_32BIT(s->agentreq, s->len);
7842 s->q = s->agentreq + 4;
7843 *s->q++ = SSH2_AGENTC_SIGN_REQUEST;
7844 PUT_32BIT(s->q, s->pklen);
7845 s->q += 4;
7846 memcpy(s->q, s->pkblob, s->pklen);
7847 s->q += s->pklen;
7848 PUT_32BIT(s->q, s->siglen);
7849 s->q += 4;
7850 /* Now the data to be signed... */
7851 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
7852 PUT_32BIT(s->q, ssh->v2_session_id_len);
51470298 7853 s->q += 4;
94cd7c3a 7854 }
7855 memcpy(s->q, ssh->v2_session_id,
7856 ssh->v2_session_id_len);
7857 s->q += ssh->v2_session_id_len;
7858 memcpy(s->q, s->pktout->data + 5,
7859 s->pktout->length - 5);
7860 s->q += s->pktout->length - 5;
7861 /* And finally the (zero) flags word. */
7862 PUT_32BIT(s->q, 0);
7863 if (!agent_query(s->agentreq, s->len + 4,
7864 &vret, &s->retlen,
7865 ssh_agent_callback, ssh)) {
7866 do {
7867 crReturnV;
7868 if (pktin) {
7869 bombout(("Unexpected data from server"
7870 " while waiting for agent"
7871 " response"));
7872 crStopV;
1983e559 7873 }
94cd7c3a 7874 } while (pktin || inlen > 0);
7875 vret = ssh->agent_response;
7876 s->retlen = ssh->agent_response_len;
7877 }
7878 s->ret = vret;
7879 sfree(s->agentreq);
7880 if (s->ret) {
7881 if (s->ret[4] == SSH2_AGENT_SIGN_RESPONSE) {
7882 logevent("Sending Pageant's response");
7883 ssh2_add_sigblob(ssh, s->pktout,
7884 s->pkblob, s->pklen,
7885 s->ret + 9,
7886 GET_32BIT(s->ret + 5));
7887 ssh2_pkt_send(ssh, s->pktout);
7888 s->type = AUTH_TYPE_PUBLICKEY;
7889 } else {
7890 /* FIXME: less drastic response */
7891 bombout(("Pageant failed to answer challenge"));
7892 crStopV;
1983e559 7893 }
7894 }
1983e559 7895 }
94cd7c3a 7896
7897 /* Do we have any keys left to try? */
7898 if (s->pkblob_in_agent) {
7899 s->done_agent = TRUE;
7900 s->tried_pubkey_config = TRUE;
7901 } else {
7902 s->keyi++;
7903 if (s->keyi >= s->nkeys)
7904 s->done_agent = TRUE;
7905 }
1983e559 7906
edd0cb8a 7907 } else if (s->can_pubkey && s->publickey_blob &&
7908 !s->tried_pubkey_config) {
65a22376 7909
edd0cb8a 7910 struct ssh2_userkey *key; /* not live over crReturn */
7911 char *passphrase; /* not live over crReturn */
65a22376 7912
acab36bc 7913 ssh->pkt_actx = SSH2_PKTCTX_PUBLICKEY;
00db133f 7914
edd0cb8a 7915 s->tried_pubkey_config = TRUE;
7916
65a22376 7917 /*
1408a877 7918 * Try the public key supplied in the configuration.
7919 *
7920 * First, offer the public blob to see if the server is
7921 * willing to accept it.
65a22376 7922 */
ff3187f6 7923 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
4a693cfc 7924 ssh2_pkt_addstring(s->pktout, ssh->username);
edd0cb8a 7925 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7926 /* service requested */
7927 ssh2_pkt_addstring(s->pktout, "publickey"); /* method */
7928 ssh2_pkt_addbool(s->pktout, FALSE);
7929 /* no signature included */
7930 ssh2_pkt_addstring(s->pktout, s->publickey_algorithm);
7931 ssh2_pkt_addstring_start(s->pktout);
7932 ssh2_pkt_addstring_data(s->pktout,
7933 (char *)s->publickey_blob,
7934 s->publickey_bloblen);
ff3187f6 7935 ssh2_pkt_send(ssh, s->pktout);
edd0cb8a 7936 logevent("Offered public key");
ff3187f6 7937
7938 crWaitUntilV(pktin);
edd0cb8a 7939 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
7940 /* Key refused. Give up. */
7941 s->gotit = TRUE; /* reconsider message next loop */
7942 s->type = AUTH_TYPE_PUBLICKEY_OFFER_LOUD;
7943 continue; /* process this new message */
45068b27 7944 }
edd0cb8a 7945 logevent("Offer of public key accepted");
af659722 7946
45068b27 7947 /*
edd0cb8a 7948 * Actually attempt a serious authentication using
7949 * the key.
45068b27 7950 */
edd0cb8a 7951 if (flags & FLAG_VERBOSE) {
7952 c_write_str(ssh, "Authenticating with public key \"");
7953 c_write_str(ssh, s->publickey_comment);
7954 c_write_str(ssh, "\"\r\n");
7955 }
7956 key = NULL;
7957 while (!key) {
7958 const char *error; /* not live over crReturn */
7959 if (s->publickey_encrypted) {
7960 /*
7961 * Get a passphrase from the user.
7962 */
7963 int ret; /* need not be kept over crReturn */
7964 s->cur_prompt = new_prompts(ssh->frontend);
7965 s->cur_prompt->to_server = FALSE;
7966 s->cur_prompt->name = dupstr("SSH key passphrase");
7967 add_prompt(s->cur_prompt,
7968 dupprintf("Passphrase for key \"%.100s\": ",
7969 s->publickey_comment),
7970 FALSE, SSH_MAX_PASSWORD_LEN);
7971 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7972 while (ret < 0) {
7973 ssh->send_ok = 1;
7974 crWaitUntilV(!pktin);
7975 ret = get_userpass_input(s->cur_prompt,
7976 in, inlen);
7977 ssh->send_ok = 0;
7978 }
7979 if (!ret) {
7980 /* Failed to get a passphrase. Terminate. */
7981 free_prompts(s->cur_prompt);
7982 ssh_disconnect(ssh, NULL,
7983 "Unable to authenticate",
7984 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7985 TRUE);
7986 crStopV;
85fdbe25 7987 }
edd0cb8a 7988 passphrase =
7989 dupstr(s->cur_prompt->prompts[0]->result);
7990 free_prompts(s->cur_prompt);
45068b27 7991 } else {
edd0cb8a 7992 passphrase = NULL; /* no passphrase needed */
45068b27 7993 }
1408a877 7994
edd0cb8a 7995 /*
7996 * Try decrypting the key.
7997 */
4a693cfc 7998 s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
7999 key = ssh2_load_userkey(s->keyfile, passphrase, &error);
edd0cb8a 8000 if (passphrase) {
8001 /* burn the evidence */
8002 memset(passphrase, 0, strlen(passphrase));
8003 sfree(passphrase);
8004 }
8005 if (key == SSH2_WRONG_PASSPHRASE || key == NULL) {
8006 if (passphrase &&
8007 (key == SSH2_WRONG_PASSPHRASE)) {
8008 c_write_str(ssh, "Wrong passphrase\r\n");
8009 key = NULL;
8010 /* and loop again */
8011 } else {
8012 c_write_str(ssh, "Unable to load private key (");
8013 c_write_str(ssh, error);
8014 c_write_str(ssh, ")\r\n");
8015 key = NULL;
8016 break; /* try something else */
8017 }
1408a877 8018 }
65a22376 8019 }
65a22376 8020
edd0cb8a 8021 if (key) {
1dd353b5 8022 unsigned char *pkblob, *sigblob, *sigdata;
8023 int pkblob_len, sigblob_len, sigdata_len;
edd0cb8a 8024 int p;
65a22376 8025
1408a877 8026 /*
8027 * We have loaded the private key and the server
8028 * has announced that it's willing to accept it.
8029 * Hallelujah. Generate a signature and send it.
8030 */
ff3187f6 8031 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
4a693cfc 8032 ssh2_pkt_addstring(s->pktout, ssh->username);
edd0cb8a 8033 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8034 /* service requested */
8035 ssh2_pkt_addstring(s->pktout, "publickey");
8036 /* method */
ff3187f6 8037 ssh2_pkt_addbool(s->pktout, TRUE);
edd0cb8a 8038 /* signature follows */
ff3187f6 8039 ssh2_pkt_addstring(s->pktout, key->alg->name);
edd0cb8a 8040 pkblob = key->alg->public_blob(key->data,
8041 &pkblob_len);
ff3187f6 8042 ssh2_pkt_addstring_start(s->pktout);
edd0cb8a 8043 ssh2_pkt_addstring_data(s->pktout, (char *)pkblob,
8044 pkblob_len);
1408a877 8045
8046 /*
8047 * The data to be signed is:
8048 *
8049 * string session-id
8050 *
8051 * followed by everything so far placed in the
8052 * outgoing packet.
8053 */
b672f405 8054 sigdata_len = s->pktout->length - 5 + 4 +
8055 ssh->v2_session_id_len;
edd0cb8a 8056 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
8057 sigdata_len -= 4;
92d60585 8058 sigdata = snewn(sigdata_len, unsigned char);
edd0cb8a 8059 p = 0;
8060 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
8061 PUT_32BIT(sigdata+p, ssh->v2_session_id_len);
8062 p += 4;
8063 }
b672f405 8064 memcpy(sigdata+p, ssh->v2_session_id,
8065 ssh->v2_session_id_len);
8066 p += ssh->v2_session_id_len;
ff3187f6 8067 memcpy(sigdata+p, s->pktout->data + 5,
8068 s->pktout->length - 5);
edd0cb8a 8069 p += s->pktout->length - 5;
8070 assert(p == sigdata_len);
d8baa528 8071 sigblob = key->alg->sign(key->data, (char *)sigdata,
1dd353b5 8072 sigdata_len, &sigblob_len);
ff3187f6 8073 ssh2_add_sigblob(ssh, s->pktout, pkblob, pkblob_len,
1dd353b5 8074 sigblob, sigblob_len);
8075 sfree(pkblob);
8076 sfree(sigblob);
1408a877 8077 sfree(sigdata);
8078
ff3187f6 8079 ssh2_pkt_send(ssh, s->pktout);
8221906d 8080 logevent("Sent public key signature");
51470298 8081 s->type = AUTH_TYPE_PUBLICKEY;
75374b2f 8082 key->alg->freekey(key->data);
1408a877 8083 }
edd0cb8a 8084
42af6a67 8085#ifndef NO_GSSAPI
8086 } else if (s->can_gssapi && !s->tried_gssapi) {
8087
8088 /* GSSAPI Authentication */
8089
86557057 8090 int micoffset, len;
8091 char *data;
42af6a67 8092 Ssh_gss_buf mic;
8093 s->type = AUTH_TYPE_GSSAPI;
8094 s->tried_gssapi = TRUE;
8095 s->gotit = TRUE;
8096 ssh->pkt_actx = SSH2_PKTCTX_GSSAPI;
8097
b3d375b2 8098 /*
8099 * Pick the highest GSS library on the preference
8100 * list.
8101 */
8102 {
8103 int i, j;
8104 s->gsslib = NULL;
8105 for (i = 0; i < ngsslibs; i++) {
4a693cfc 8106 int want_id = conf_get_int_int(ssh->conf,
8107 CONF_ssh_gsslist, i);
1e00c92b 8108 for (j = 0; j < ssh->gsslibs->nlibraries; j++)
8109 if (ssh->gsslibs->libraries[j].id == want_id) {
8110 s->gsslib = &ssh->gsslibs->libraries[j];
b3d375b2 8111 goto got_gsslib; /* double break */
8112 }
8113 }
8114 got_gsslib:
8115 /*
8116 * We always expect to have found something in
8117 * the above loop: we only came here if there
8118 * was at least one viable GSS library, and the
8119 * preference list should always mention
8120 * everything and only change the order.
8121 */
8122 assert(s->gsslib);
8123 }
8124
8125 if (s->gsslib->gsslogmsg)
8126 logevent(s->gsslib->gsslogmsg);
8127
42af6a67 8128 /* Sending USERAUTH_REQUEST with "gssapi-with-mic" method */
8129 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
4a693cfc 8130 ssh2_pkt_addstring(s->pktout, ssh->username);
42af6a67 8131 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8132 ssh2_pkt_addstring(s->pktout, "gssapi-with-mic");
8221906d 8133 logevent("Attempting GSSAPI authentication");
42af6a67 8134
8135 /* add mechanism info */
b3d375b2 8136 s->gsslib->indicate_mech(s->gsslib, &s->gss_buf);
42af6a67 8137
8138 /* number of GSSAPI mechanisms */
8139 ssh2_pkt_adduint32(s->pktout,1);
8140
8141 /* length of OID + 2 */
86557057 8142 ssh2_pkt_adduint32(s->pktout, s->gss_buf.length + 2);
42af6a67 8143 ssh2_pkt_addbyte(s->pktout, SSH2_GSS_OIDTYPE);
8144
8145 /* length of OID */
86557057 8146 ssh2_pkt_addbyte(s->pktout, (unsigned char) s->gss_buf.length);
42af6a67 8147
86557057 8148 ssh_pkt_adddata(s->pktout, s->gss_buf.value,
8149 s->gss_buf.length);
42af6a67 8150 ssh2_pkt_send(ssh, s->pktout);
8151 crWaitUntilV(pktin);
8152 if (pktin->type != SSH2_MSG_USERAUTH_GSSAPI_RESPONSE) {
8153 logevent("GSSAPI authentication request refused");
8154 continue;
8155 }
8156
8157 /* check returned packet ... */
8158
86557057 8159 ssh_pkt_getstring(pktin, &data, &len);
8160 s->gss_rcvtok.value = data;
8161 s->gss_rcvtok.length = len;
8162 if (s->gss_rcvtok.length != s->gss_buf.length + 2 ||
8163 ((char *)s->gss_rcvtok.value)[0] != SSH2_GSS_OIDTYPE ||
8164 ((char *)s->gss_rcvtok.value)[1] != s->gss_buf.length ||
8165 memcmp((char *)s->gss_rcvtok.value + 2,
8166 s->gss_buf.value,s->gss_buf.length) ) {
42af6a67 8167 logevent("GSSAPI authentication - wrong response from server");
8168 continue;
8169 }
8170
8171 /* now start running */
b3d375b2 8172 s->gss_stat = s->gsslib->import_name(s->gsslib,
8173 ssh->fullhostname,
8174 &s->gss_srv_name);
42af6a67 8175 if (s->gss_stat != SSH_GSS_OK) {
8176 if (s->gss_stat == SSH_GSS_BAD_HOST_NAME)
8177 logevent("GSSAPI import name failed - Bad service name");
8178 else
8179 logevent("GSSAPI import name failed");
8180 continue;
8181 }
8182
8183 /* fetch TGT into GSS engine */
b3d375b2 8184 s->gss_stat = s->gsslib->acquire_cred(s->gsslib, &s->gss_ctx);
42af6a67 8185
8186 if (s->gss_stat != SSH_GSS_OK) {
8187 logevent("GSSAPI authentication failed to get credentials");
b3d375b2 8188 s->gsslib->release_name(s->gsslib, &s->gss_srv_name);
42af6a67 8189 continue;
8190 }
8191
8192 /* initial tokens are empty */
86557057 8193 SSH_GSS_CLEAR_BUF(&s->gss_rcvtok);
99a3b3c9 8194 SSH_GSS_CLEAR_BUF(&s->gss_sndtok);
42af6a67 8195
8196 /* now enter the loop */
8197 do {
b3d375b2 8198 s->gss_stat = s->gsslib->init_sec_context
8199 (s->gsslib,
8200 &s->gss_ctx,
8201 s->gss_srv_name,
4a693cfc 8202 conf_get_int(ssh->conf, CONF_gssapifwd),
b3d375b2 8203 &s->gss_rcvtok,
8204 &s->gss_sndtok);
42af6a67 8205
8206 if (s->gss_stat!=SSH_GSS_S_COMPLETE &&
8207 s->gss_stat!=SSH_GSS_S_CONTINUE_NEEDED) {
8208 logevent("GSSAPI authentication initialisation failed");
8209
b3d375b2 8210 if (s->gsslib->display_status(s->gsslib, s->gss_ctx,
8211 &s->gss_buf) == SSH_GSS_OK) {
86557057 8212 logevent(s->gss_buf.value);
8213 sfree(s->gss_buf.value);
42af6a67 8214 }
8215
8216 break;
8217 }
8218 logevent("GSSAPI authentication initialised");
8219
8220 /* Client and server now exchange tokens until GSSAPI
8221 * no longer says CONTINUE_NEEDED */
8222
86557057 8223 if (s->gss_sndtok.length != 0) {
42af6a67 8224 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
8225 ssh_pkt_addstring_start(s->pktout);
86557057 8226 ssh_pkt_addstring_data(s->pktout,s->gss_sndtok.value,s->gss_sndtok.length);
42af6a67 8227 ssh2_pkt_send(ssh, s->pktout);
b3d375b2 8228 s->gsslib->free_tok(s->gsslib, &s->gss_sndtok);
42af6a67 8229 }
8230
8231 if (s->gss_stat == SSH_GSS_S_CONTINUE_NEEDED) {
8232 crWaitUntilV(pktin);
8233 if (pktin->type != SSH2_MSG_USERAUTH_GSSAPI_TOKEN) {
8234 logevent("GSSAPI authentication - bad server response");
8235 s->gss_stat = SSH_GSS_FAILURE;
8236 break;
8237 }
86557057 8238 ssh_pkt_getstring(pktin, &data, &len);
8239 s->gss_rcvtok.value = data;
8240 s->gss_rcvtok.length = len;
42af6a67 8241 }
8242 } while (s-> gss_stat == SSH_GSS_S_CONTINUE_NEEDED);
8243
8244 if (s->gss_stat != SSH_GSS_OK) {
b3d375b2 8245 s->gsslib->release_name(s->gsslib, &s->gss_srv_name);
8246 s->gsslib->release_cred(s->gsslib, &s->gss_ctx);
42af6a67 8247 continue;
8248 }
8249 logevent("GSSAPI authentication loop finished OK");
8250
8251 /* Now send the MIC */
8252
8253 s->pktout = ssh2_pkt_init(0);
8254 micoffset = s->pktout->length;
8255 ssh_pkt_addstring_start(s->pktout);
8256 ssh_pkt_addstring_data(s->pktout, (char *)ssh->v2_session_id, ssh->v2_session_id_len);
8257 ssh_pkt_addbyte(s->pktout, SSH2_MSG_USERAUTH_REQUEST);
4a693cfc 8258 ssh_pkt_addstring(s->pktout, ssh->username);
42af6a67 8259 ssh_pkt_addstring(s->pktout, "ssh-connection");
8260 ssh_pkt_addstring(s->pktout, "gssapi-with-mic");
8261
86557057 8262 s->gss_buf.value = (char *)s->pktout->data + micoffset;
8263 s->gss_buf.length = s->pktout->length - micoffset;
42af6a67 8264
b3d375b2 8265 s->gsslib->get_mic(s->gsslib, s->gss_ctx, &s->gss_buf, &mic);
42af6a67 8266 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_GSSAPI_MIC);
8267 ssh_pkt_addstring_start(s->pktout);
86557057 8268 ssh_pkt_addstring_data(s->pktout, mic.value, mic.length);
42af6a67 8269 ssh2_pkt_send(ssh, s->pktout);
b3d375b2 8270 s->gsslib->free_mic(s->gsslib, &mic);
42af6a67 8271
8272 s->gotit = FALSE;
8273
b3d375b2 8274 s->gsslib->release_name(s->gsslib, &s->gss_srv_name);
8275 s->gsslib->release_cred(s->gsslib, &s->gss_ctx);
42af6a67 8276 continue;
8277#endif
edd0cb8a 8278 } else if (s->can_keyb_inter && !s->kbd_inter_refused) {
8279
8280 /*
8281 * Keyboard-interactive authentication.
8282 */
edd0cb8a 8283
edd0cb8a 8284 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
8285
acab36bc 8286 ssh->pkt_actx = SSH2_PKTCTX_KBDINTER;
edd0cb8a 8287
8288 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
4a693cfc 8289 ssh2_pkt_addstring(s->pktout, ssh->username);
edd0cb8a 8290 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8291 /* service requested */
8292 ssh2_pkt_addstring(s->pktout, "keyboard-interactive");
8293 /* method */
8294 ssh2_pkt_addstring(s->pktout, ""); /* lang */
8295 ssh2_pkt_addstring(s->pktout, ""); /* submethods */
8296 ssh2_pkt_send(ssh, s->pktout);
8221906d 8297
8298 logevent("Attempting keyboard-interactive authentication");
edd0cb8a 8299
8300 crWaitUntilV(pktin);
8301 if (pktin->type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
8302 /* Server is not willing to do keyboard-interactive
b8e3173d 8303 * at all (or, bizarrely but legally, accepts the
8304 * user without actually issuing any prompts).
8305 * Give up on it entirely. */
edd0cb8a 8306 s->gotit = TRUE;
edd0cb8a 8307 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET;
8308 s->kbd_inter_refused = TRUE; /* don't try it again */
8309 continue;
8310 }
8311
8312 /*
b8e3173d 8313 * Loop while the server continues to send INFO_REQUESTs.
edd0cb8a 8314 */
b8e3173d 8315 while (pktin->type == SSH2_MSG_USERAUTH_INFO_REQUEST) {
edd0cb8a 8316
b8e3173d 8317 char *name, *inst, *lang;
8318 int name_len, inst_len, lang_len;
8319 int i;
8320
8321 /*
8322 * We've got a fresh USERAUTH_INFO_REQUEST.
8323 * Get the preamble and start building a prompt.
8324 */
8325 ssh_pkt_getstring(pktin, &name, &name_len);
8326 ssh_pkt_getstring(pktin, &inst, &inst_len);
8327 ssh_pkt_getstring(pktin, &lang, &lang_len);
8328 s->cur_prompt = new_prompts(ssh->frontend);
8329 s->cur_prompt->to_server = TRUE;
edd0cb8a 8330
b8e3173d 8331 /*
9ea10e78 8332 * Get any prompt(s) from the packet.
b8e3173d 8333 */
8334 s->num_prompts = ssh_pkt_getuint32(pktin);
8335 for (i = 0; i < s->num_prompts; i++) {
8336 char *prompt;
8337 int prompt_len;
8338 int echo;
8339 static char noprompt[] =
8340 "<server failed to send prompt>: ";
8341
8342 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
8343 echo = ssh2_pkt_getbool(pktin);
8344 if (!prompt_len) {
8345 prompt = noprompt;
8346 prompt_len = lenof(noprompt)-1;
8347 }
8348 add_prompt(s->cur_prompt,
8349 dupprintf("%.*s", prompt_len, prompt),
8350 echo, SSH_MAX_PASSWORD_LEN);
edd0cb8a 8351 }
b8e3173d 8352
9874c9d7 8353 if (name_len) {
8354 /* FIXME: better prefix to distinguish from
8355 * local prompts? */
8356 s->cur_prompt->name =
8357 dupprintf("SSH server: %.*s", name_len, name);
8358 s->cur_prompt->name_reqd = TRUE;
8359 } else {
8360 s->cur_prompt->name =
8361 dupstr("SSH server authentication");
8362 s->cur_prompt->name_reqd = FALSE;
8363 }
8364 /* We add a prefix to try to make it clear that a prompt
8365 * has come from the server.
8366 * FIXME: ugly to print "Using..." in prompt _every_
8367 * time round. Can this be done more subtly? */
8368 /* Special case: for reasons best known to themselves,
8369 * some servers send k-i requests with no prompts and
8370 * nothing to display. Keep quiet in this case. */
8371 if (s->num_prompts || name_len || inst_len) {
8372 s->cur_prompt->instruction =
8373 dupprintf("Using keyboard-interactive authentication.%s%.*s",
8374 inst_len ? "\n" : "", inst_len, inst);
8375 s->cur_prompt->instr_reqd = TRUE;
8376 } else {
8377 s->cur_prompt->instr_reqd = FALSE;
8378 }
8379
b8e3173d 8380 /*
9ea10e78 8381 * Display any instructions, and get the user's
8382 * response(s).
b8e3173d 8383 */
9ea10e78 8384 {
b8e3173d 8385 int ret; /* not live over crReturn */
8386 ret = get_userpass_input(s->cur_prompt, NULL, 0);
8387 while (ret < 0) {
8388 ssh->send_ok = 1;
8389 crWaitUntilV(!pktin);
8390 ret = get_userpass_input(s->cur_prompt, in, inlen);
8391 ssh->send_ok = 0;
8392 }
8393 if (!ret) {
8394 /*
8395 * Failed to get responses. Terminate.
8396 */
8397 free_prompts(s->cur_prompt);
8398 ssh_disconnect(ssh, NULL, "Unable to authenticate",
8399 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
8400 TRUE);
8401 crStopV;
8402 }
edd0cb8a 8403 }
b8e3173d 8404
8405 /*
9ea10e78 8406 * Send the response(s) to the server.
b8e3173d 8407 */
8408 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_INFO_RESPONSE);
b8e3173d 8409 ssh2_pkt_adduint32(s->pktout, s->num_prompts);
8410 for (i=0; i < s->num_prompts; i++) {
8411 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
8412 ssh2_pkt_addstring(s->pktout,
8413 s->cur_prompt->prompts[i]->result);
8414 end_log_omission(ssh, s->pktout);
8415 }
18524056 8416 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
b8e3173d 8417
8418 /*
8419 * Get the next packet in case it's another
8420 * INFO_REQUEST.
8421 */
8422 crWaitUntilV(pktin);
8423
edd0cb8a 8424 }
8425
8426 /*
b8e3173d 8427 * We should have SUCCESS or FAILURE now.
edd0cb8a 8428 */
b8e3173d 8429 s->gotit = TRUE;
edd0cb8a 8430
8431 } else if (s->can_passwd) {
8432
8433 /*
8434 * Plain old password authentication.
8435 */
8436 int ret; /* not live over crReturn */
e955d348 8437 int changereq_first_time; /* not live over crReturn */
edd0cb8a 8438
acab36bc 8439 ssh->pkt_actx = SSH2_PKTCTX_PASSWORD;
edd0cb8a 8440
8441 s->cur_prompt = new_prompts(ssh->frontend);
8442 s->cur_prompt->to_server = TRUE;
8443 s->cur_prompt->name = dupstr("SSH password");
4a693cfc 8444 add_prompt(s->cur_prompt, dupprintf("%s@%s's password: ",
8445 ssh->username,
edd0cb8a 8446 ssh->savedhost),
8447 FALSE, SSH_MAX_PASSWORD_LEN);
8448
8449 ret = get_userpass_input(s->cur_prompt, NULL, 0);
8450 while (ret < 0) {
8451 ssh->send_ok = 1;
8452 crWaitUntilV(!pktin);
8453 ret = get_userpass_input(s->cur_prompt, in, inlen);
8454 ssh->send_ok = 0;
8455 }
8456 if (!ret) {
8457 /*
8458 * Failed to get responses. Terminate.
8459 */
8460 free_prompts(s->cur_prompt);
8461 ssh_disconnect(ssh, NULL, "Unable to authenticate",
8462 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
8463 TRUE);
8464 crStopV;
8465 }
e955d348 8466 /*
8467 * Squirrel away the password. (We may need it later if
8468 * asked to change it.)
8469 */
8470 s->password = dupstr(s->cur_prompt->prompts[0]->result);
8471 free_prompts(s->cur_prompt);
edd0cb8a 8472
8473 /*
8474 * Send the password packet.
8475 *
95d2d262 8476 * We pad out the password packet to 256 bytes to make
8477 * it harder for an attacker to find the length of the
8478 * user's password.
1408a877 8479 *
95d2d262 8480 * Anyone using a password longer than 256 bytes
8481 * probably doesn't have much to worry about from
1408a877 8482 * people who find out how long their password is!
65a22376 8483 */
ff3187f6 8484 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
4a693cfc 8485 ssh2_pkt_addstring(s->pktout, ssh->username);
edd0cb8a 8486 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8487 /* service requested */
ff3187f6 8488 ssh2_pkt_addstring(s->pktout, "password");
8489 ssh2_pkt_addbool(s->pktout, FALSE);
8490 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
e955d348 8491 ssh2_pkt_addstring(s->pktout, s->password);
ff3187f6 8492 end_log_omission(ssh, s->pktout);
18524056 8493 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
0d43337a 8494 logevent("Sent password");
28f4d4f0 8495 s->type = AUTH_TYPE_PASSWORD;
edd0cb8a 8496
e955d348 8497 /*
8498 * Wait for next packet, in case it's a password change
8499 * request.
8500 */
8501 crWaitUntilV(pktin);
8502 changereq_first_time = TRUE;
8503
8504 while (pktin->type == SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ) {
8505
8506 /*
8507 * We're being asked for a new password
8508 * (perhaps not for the first time).
8509 * Loop until the server accepts it.
8510 */
8511
8512 int got_new = FALSE; /* not live over crReturn */
8513 char *prompt; /* not live over crReturn */
8514 int prompt_len; /* not live over crReturn */
8515
8516 {
8517 char *msg;
8518 if (changereq_first_time)
8519 msg = "Server requested password change";
8520 else
8521 msg = "Server rejected new password";
8522 logevent(msg);
8523 c_write_str(ssh, msg);
8524 c_write_str(ssh, "\r\n");
8525 }
8526
8527 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
8528
8529 s->cur_prompt = new_prompts(ssh->frontend);
8530 s->cur_prompt->to_server = TRUE;
8531 s->cur_prompt->name = dupstr("New SSH password");
8532 s->cur_prompt->instruction =
8533 dupprintf("%.*s", prompt_len, prompt);
8534 s->cur_prompt->instr_reqd = TRUE;
d9add7bc 8535 /*
8536 * There's no explicit requirement in the protocol
8537 * for the "old" passwords in the original and
8538 * password-change messages to be the same, and
8539 * apparently some Cisco kit supports password change
8540 * by the user entering a blank password originally
8541 * and the real password subsequently, so,
8542 * reluctantly, we prompt for the old password again.
8543 *
8544 * (On the other hand, some servers don't even bother
8545 * to check this field.)
8546 */
8547 add_prompt(s->cur_prompt,
8548 dupstr("Current password (blank for previously entered password): "),
8549 FALSE, SSH_MAX_PASSWORD_LEN);
e955d348 8550 add_prompt(s->cur_prompt, dupstr("Enter new password: "),
8551 FALSE, SSH_MAX_PASSWORD_LEN);
8552 add_prompt(s->cur_prompt, dupstr("Confirm new password: "),
8553 FALSE, SSH_MAX_PASSWORD_LEN);
8554
8555 /*
8556 * Loop until the user manages to enter the same
8557 * password twice.
8558 */
8559 while (!got_new) {
8560
8561 ret = get_userpass_input(s->cur_prompt, NULL, 0);
8562 while (ret < 0) {
8563 ssh->send_ok = 1;
8564 crWaitUntilV(!pktin);
8565 ret = get_userpass_input(s->cur_prompt, in, inlen);
8566 ssh->send_ok = 0;
8567 }
8568 if (!ret) {
8569 /*
8570 * Failed to get responses. Terminate.
8571 */
8572 /* burn the evidence */
8573 free_prompts(s->cur_prompt);
8574 memset(s->password, 0, strlen(s->password));
8575 sfree(s->password);
8576 ssh_disconnect(ssh, NULL, "Unable to authenticate",
8577 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
8578 TRUE);
8579 crStopV;
8580 }
8581
8582 /*
d9add7bc 8583 * If the user specified a new original password
8584 * (IYSWIM), overwrite any previously specified
8585 * one.
8586 * (A side effect is that the user doesn't have to
8587 * re-enter it if they louse up the new password.)
8588 */
8589 if (s->cur_prompt->prompts[0]->result[0]) {
8590 memset(s->password, 0, strlen(s->password));
8591 /* burn the evidence */
8592 sfree(s->password);
8593 s->password =
8594 dupstr(s->cur_prompt->prompts[0]->result);
8595 }
8596
8597 /*
8598 * Check the two new passwords match.
e955d348 8599 */
d9add7bc 8600 got_new = (strcmp(s->cur_prompt->prompts[1]->result,
8601 s->cur_prompt->prompts[2]->result)
e955d348 8602 == 0);
8603 if (!got_new)
8604 /* They don't. Silly user. */
8605 c_write_str(ssh, "Passwords do not match\r\n");
8606
8607 }
8608
8609 /*
8610 * Send the new password (along with the old one).
8611 * (see above for padding rationale)
8612 */
8613 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
4a693cfc 8614 ssh2_pkt_addstring(s->pktout, ssh->username);
e955d348 8615 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8616 /* service requested */
8617 ssh2_pkt_addstring(s->pktout, "password");
8618 ssh2_pkt_addbool(s->pktout, TRUE);
8619 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
8620 ssh2_pkt_addstring(s->pktout, s->password);
8621 ssh2_pkt_addstring(s->pktout,
d9add7bc 8622 s->cur_prompt->prompts[1]->result);
e955d348 8623 free_prompts(s->cur_prompt);
8624 end_log_omission(ssh, s->pktout);
18524056 8625 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
e955d348 8626 logevent("Sent new password");
8627
8628 /*
8629 * Now see what the server has to say about it.
8630 * (If it's CHANGEREQ again, it's not happy with the
8631 * new password.)
8632 */
8633 crWaitUntilV(pktin);
8634 changereq_first_time = FALSE;
8635
8636 }
8637
8638 /*
8639 * We need to reexamine the current pktin at the top
8640 * of the loop. Either:
8641 * - we weren't asked to change password at all, in
8642 * which case it's a SUCCESS or FAILURE with the
8643 * usual meaning
8644 * - we sent a new password, and the server was
8645 * either OK with it (SUCCESS or FAILURE w/partial
8646 * success) or unhappy with the _old_ password
8647 * (FAILURE w/o partial success)
8648 * In any of these cases, we go back to the top of
8649 * the loop and start again.
8650 */
8651 s->gotit = TRUE;
8652
8653 /*
8654 * We don't need the old password any more, in any
8655 * case. Burn the evidence.
8656 */
8657 memset(s->password, 0, strlen(s->password));
8658 sfree(s->password);
8659
1408a877 8660 } else {
854caca5 8661 char *str = dupprintf("No supported authentication methods available"
8662 " (server sent: %.*s)",
8663 methlen, methods);
edd0cb8a 8664
854caca5 8665 ssh_disconnect(ssh, str,
9e296bfa 8666 "No supported authentication methods available",
8667 SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
8668 FALSE);
854caca5 8669 sfree(str);
8670
7ffdbc1a 8671 crStopV;
edd0cb8a 8672
65a22376 8673 }
edd0cb8a 8674
65a22376 8675 }
a1a1fae4 8676 }
6bbce591 8677 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
7cca0d81 8678
edd0cb8a 8679 /* Clear up various bits and pieces from authentication. */
8680 if (s->publickey_blob) {
8681 sfree(s->publickey_blob);
8682 sfree(s->publickey_comment);
8683 }
94cd7c3a 8684 if (s->agent_response)
8685 sfree(s->agent_response);
edd0cb8a 8686
ab18ccff 8687 if (s->userauth_success) {
8688 /*
8689 * We've just received USERAUTH_SUCCESS, and we haven't sent any
8690 * packets since. Signal the transport layer to consider enacting
8691 * delayed compression.
8692 *
8693 * (Relying on we_are_in is not sufficient, as
8694 * draft-miller-secsh-compression-delayed is quite clear that it
8695 * triggers on USERAUTH_SUCCESS specifically, and we_are_in can
8696 * become set for other reasons.)
8697 */
8698 do_ssh2_transport(ssh, "enabling delayed compression", -2, NULL);
8699 }
8700
7cca0d81 8701 /*
a1a1fae4 8702 * Now the connection protocol has started, one way or another.
7cca0d81 8703 */
8704
0ed48730 8705 ssh->channels = newtree234(ssh_channelcmp);
8706
7cca0d81 8707 /*
b09eaa88 8708 * Set up handlers for some connection protocol messages, so we
8709 * don't have to handle them repeatedly in this coroutine.
8710 */
8711 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] =
8712 ssh2_msg_channel_window_adjust;
51df0ab5 8713 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] =
8714 ssh2_msg_global_request;
b09eaa88 8715
8716 /*
0ed48730 8717 * Create the main session channel.
7cca0d81 8718 */
4a693cfc 8719 if (conf_get_int(ssh->conf, CONF_ssh_no_shell)) {
feb02b4e 8720 ssh->mainchan = NULL;
4a693cfc 8721 } else if (*conf_get_str(ssh->conf, CONF_ssh_nc_host)) {
feb02b4e 8722 /*
8723 * Just start a direct-tcpip channel and use it as the main
8724 * channel.
8725 */
8726 ssh->mainchan = snew(struct ssh_channel);
8727 ssh->mainchan->ssh = ssh;
94bdfe40 8728 ssh2_channel_init(ssh->mainchan);
23828b7e 8729 logeventf(ssh,
8730 "Opening direct-tcpip channel to %s:%d in place of session",
4a693cfc 8731 conf_get_str(ssh->conf, CONF_ssh_nc_host),
8732 conf_get_int(ssh->conf, CONF_ssh_nc_port));
feb02b4e 8733 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
8734 ssh2_pkt_addstring(s->pktout, "direct-tcpip");
8735 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
feb02b4e 8736 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
8737 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
4a693cfc 8738 ssh2_pkt_addstring(s->pktout, conf_get_str(ssh->conf, CONF_ssh_nc_host));
8739 ssh2_pkt_adduint32(s->pktout, conf_get_int(ssh->conf, CONF_ssh_nc_port));
feb02b4e 8740 /*
23828b7e 8741 * There's nothing meaningful to put in the originator
8742 * fields, but some servers insist on syntactically correct
8743 * information.
feb02b4e 8744 */
8745 ssh2_pkt_addstring(s->pktout, "0.0.0.0");
8746 ssh2_pkt_adduint32(s->pktout, 0);
8747 ssh2_pkt_send(ssh, s->pktout);
8748
8749 crWaitUntilV(pktin);
8750 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
8751 bombout(("Server refused to open a direct-tcpip channel"));
8752 crStopV;
8753 /* FIXME: error data comes back in FAILURE packet */
8754 }
8755 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
8756 bombout(("Server's channel confirmation cited wrong channel"));
8757 crStopV;
8758 }
8759 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
8760 ssh->mainchan->halfopen = FALSE;
8761 ssh->mainchan->type = CHAN_MAINSESSION;
feb02b4e 8762 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
8763 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
feb02b4e 8764 add234(ssh->channels, ssh->mainchan);
8765 update_specials_menu(ssh->frontend);
23828b7e 8766 logevent("Opened direct-tcpip channel");
feb02b4e 8767 ssh->ncmode = TRUE;
8768 } else {
0ed48730 8769 ssh->mainchan = snew(struct ssh_channel);
8770 ssh->mainchan->ssh = ssh;
94bdfe40 8771 ssh2_channel_init(ssh->mainchan);
ff3187f6 8772 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
8773 ssh2_pkt_addstring(s->pktout, "session");
8774 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
ff3187f6 8775 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
954d5c5a 8776 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
ff3187f6 8777 ssh2_pkt_send(ssh, s->pktout);
8778 crWaitUntilV(pktin);
8779 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
0ed48730 8780 bombout(("Server refused to open a session"));
8781 crStopV;
8782 /* FIXME: error data comes back in FAILURE packet */
8783 }
ff3187f6 8784 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
0ed48730 8785 bombout(("Server's channel confirmation cited wrong channel"));
8786 crStopV;
8787 }
ff3187f6 8788 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
64d6ff88 8789 ssh->mainchan->halfopen = FALSE;
0ed48730 8790 ssh->mainchan->type = CHAN_MAINSESSION;
ff3187f6 8791 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
8792 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
0ed48730 8793 add234(ssh->channels, ssh->mainchan);
62638676 8794 update_specials_menu(ssh->frontend);
0ed48730 8795 logevent("Opened channel for session");
feb02b4e 8796 ssh->ncmode = FALSE;
8797 }
7cca0d81 8798
8799 /*
51df0ab5 8800 * Now we have a channel, make dispatch table entries for
8801 * general channel-based messages.
8802 */
8803 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] =
8804 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] =
8805 ssh2_msg_channel_data;
8806 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_channel_eof;
8807 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_channel_close;
8808 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] =
8809 ssh2_msg_channel_open_confirmation;
8810 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] =
8811 ssh2_msg_channel_open_failure;
8812 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] =
8813 ssh2_msg_channel_request;
8814 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] =
8815 ssh2_msg_channel_open;
8816
4a693cfc 8817 if (ssh->mainchan && conf_get_int(ssh->conf, CONF_ssh_simple)) {
3361b80a 8818 /*
8819 * This message indicates to the server that we promise
8820 * not to try to run any other channel in parallel with
8821 * this one, so it's safe for it to advertise a very large
8822 * window and leave the flow control to TCP.
8823 */
8824 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8825 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8826 ssh2_pkt_addstring(s->pktout, "simple@putty.projects.tartarus.org");
8827 ssh2_pkt_addbool(s->pktout, 0); /* no reply */
8828 ssh2_pkt_send(ssh, s->pktout);
8829 }
8830
51df0ab5 8831 /*
783415f8 8832 * Potentially enable X11 forwarding.
8833 */
4a693cfc 8834 if (ssh->mainchan && !ssh->ncmode && conf_get_int(ssh->conf, CONF_x11_forward) &&
8835 (ssh->x11disp = x11_setup_display(conf_get_str(ssh->conf, CONF_x11_display),
8836 conf_get_int(ssh->conf, CONF_x11_auth), ssh->conf))) {
32874aea 8837 logevent("Requesting X11 forwarding");
ff3187f6 8838 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8839 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8840 ssh2_pkt_addstring(s->pktout, "x11-req");
8841 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8842 ssh2_pkt_addbool(s->pktout, 0); /* many connections */
8def70c3 8843 ssh2_pkt_addstring(s->pktout, ssh->x11disp->remoteauthprotoname);
f68353be 8844 /*
8845 * Note that while we blank the X authentication data here, we don't
8846 * take any special action to blank the start of an X11 channel,
8847 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
8848 * without having session blanking enabled is likely to leak your
8849 * cookie into the log.
8850 */
178c3872 8851 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
8def70c3 8852 ssh2_pkt_addstring(s->pktout, ssh->x11disp->remoteauthdatastring);
178c3872 8853 end_log_omission(ssh, s->pktout);
8def70c3 8854 ssh2_pkt_adduint32(s->pktout, ssh->x11disp->screennum);
ff3187f6 8855 ssh2_pkt_send(ssh, s->pktout);
32874aea 8856
b09eaa88 8857 crWaitUntilV(pktin);
32874aea 8858
ff3187f6 8859 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8860 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
6b5cf8b4 8861 bombout(("Unexpected response to X11 forwarding request:"
ff3187f6 8862 " packet type %d", pktin->type));
7ffdbc1a 8863 crStopV;
32874aea 8864 }
8865 logevent("X11 forwarding refused");
8866 } else {
8867 logevent("X11 forwarding enabled");
51470298 8868 ssh->X11_fwd_enabled = TRUE;
32874aea 8869 }
783415f8 8870 }
8871
8872 /*
bc240b21 8873 * Enable port forwardings.
8874 */
4a693cfc 8875 ssh_setup_portfwd(ssh, ssh->conf);
bc240b21 8876
8877 /*
36c2a3e9 8878 * Potentially enable agent forwarding.
8879 */
4a693cfc 8880 if (ssh->mainchan && !ssh->ncmode && conf_get_int(ssh->conf, CONF_agentfwd) && agent_exists()) {
32874aea 8881 logevent("Requesting OpenSSH-style agent forwarding");
ff3187f6 8882 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8883 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8884 ssh2_pkt_addstring(s->pktout, "auth-agent-req@openssh.com");
8885 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8886 ssh2_pkt_send(ssh, s->pktout);
32874aea 8887
b09eaa88 8888 crWaitUntilV(pktin);
32874aea 8889
ff3187f6 8890 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8891 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
6b5cf8b4 8892 bombout(("Unexpected response to agent forwarding request:"
ff3187f6 8893 " packet type %d", pktin->type));
7ffdbc1a 8894 crStopV;
32874aea 8895 }
8896 logevent("Agent forwarding refused");
8897 } else {
8898 logevent("Agent forwarding enabled");
51470298 8899 ssh->agentfwd_enabled = TRUE;
32874aea 8900 }
36c2a3e9 8901 }
8902
8903 /*
7cca0d81 8904 * Now allocate a pty for the session.
8905 */
4a693cfc 8906 if (ssh->mainchan && !ssh->ncmode && !conf_get_int(ssh->conf, CONF_nopty)) {
a5dd8467 8907 /* Unpick the terminal-speed string. */
8908 /* XXX perhaps we should allow no speeds to be sent. */
db219738 8909 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
4a693cfc 8910 sscanf(conf_get_str(ssh->conf, CONF_termspeed), "%d,%d", &ssh->ospeed, &ssh->ispeed);
a5dd8467 8911 /* Build the pty request. */
ff3187f6 8912 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8913 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
8914 ssh2_pkt_addstring(s->pktout, "pty-req");
8915 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
4a693cfc 8916 ssh2_pkt_addstring(s->pktout, conf_get_str(ssh->conf, CONF_termtype));
ff3187f6 8917 ssh2_pkt_adduint32(s->pktout, ssh->term_width);
8918 ssh2_pkt_adduint32(s->pktout, ssh->term_height);
8919 ssh2_pkt_adduint32(s->pktout, 0); /* pixel width */
8920 ssh2_pkt_adduint32(s->pktout, 0); /* pixel height */
8921 ssh2_pkt_addstring_start(s->pktout);
4a693cfc 8922 parse_ttymodes(ssh, ssh2_send_ttymode, (void *)s->pktout);
c6ccd5c2 8923 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_ISPEED);
ff3187f6 8924 ssh2_pkt_adduint32(s->pktout, ssh->ispeed);
c6ccd5c2 8925 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_OSPEED);
ff3187f6 8926 ssh2_pkt_adduint32(s->pktout, ssh->ospeed);
8927 ssh2_pkt_addstring_data(s->pktout, "\0", 1); /* TTY_OP_END */
8928 ssh2_pkt_send(ssh, s->pktout);
51470298 8929 ssh->state = SSH_STATE_INTERMED;
32874aea 8930
b09eaa88 8931 crWaitUntilV(pktin);
32874aea 8932
ff3187f6 8933 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8934 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
6b5cf8b4 8935 bombout(("Unexpected response to pty request:"
ff3187f6 8936 " packet type %d", pktin->type));
7ffdbc1a 8937 crStopV;
32874aea 8938 }
51470298 8939 c_write_str(ssh, "Server refused to allocate pty\r\n");
8940 ssh->editing = ssh->echoing = 1;
32874aea 8941 } else {
a5dd8467 8942 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
db219738 8943 ssh->ospeed, ssh->ispeed);
32874aea 8944 }
0965bee0 8945 } else {
51470298 8946 ssh->editing = ssh->echoing = 1;
7cca0d81 8947 }
8948
8949 /*
73feed4f 8950 * Send environment variables.
8951 *
8952 * Simplest thing here is to send all the requests at once, and
8953 * then wait for a whole bunch of successes or failures.
8954 */
4a693cfc 8955 if (ssh->mainchan && !ssh->ncmode) {
8956 char *key, *val;
73feed4f 8957
8958 s->num_env = 0;
8959
4a693cfc 8960 for (val = conf_get_str_strs(ssh->conf, CONF_environmt, NULL, &key);
8961 val != NULL;
8962 val = conf_get_str_strs(ssh->conf, CONF_environmt, key, &key)) {
ff3187f6 8963 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8964 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8965 ssh2_pkt_addstring(s->pktout, "env");
8966 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
4a693cfc 8967 ssh2_pkt_addstring(s->pktout, key);
ff3187f6 8968 ssh2_pkt_addstring(s->pktout, val);
8969 ssh2_pkt_send(ssh, s->pktout);
73feed4f 8970
8971 s->num_env++;
8972 }
8973
4a693cfc 8974 if (s->num_env) {
8975 logeventf(ssh, "Sent %d environment variables", s->num_env);
73feed4f 8976
4a693cfc 8977 s->env_ok = 0;
8978 s->env_left = s->num_env;
73feed4f 8979
4a693cfc 8980 while (s->env_left > 0) {
8981 crWaitUntilV(pktin);
73feed4f 8982
4a693cfc 8983 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8984 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8985 bombout(("Unexpected response to environment request:"
8986 " packet type %d", pktin->type));
8987 crStopV;
8988 }
8989 } else {
8990 s->env_ok++;
73feed4f 8991 }
73feed4f 8992
4a693cfc 8993 s->env_left--;
8994 }
73feed4f 8995
4a693cfc 8996 if (s->env_ok == s->num_env) {
8997 logevent("All environment variables successfully set");
8998 } else if (s->env_ok == 0) {
8999 logevent("All environment variables refused");
9000 c_write_str(ssh, "Server refused to set environment variables\r\n");
9001 } else {
9002 logeventf(ssh, "%d environment variables refused",
9003 s->num_env - s->env_ok);
9004 c_write_str(ssh, "Server refused to set all environment variables\r\n");
9005 }
73feed4f 9006 }
9007 }
9008
9009 /*
fd5e5847 9010 * Start a shell or a remote command. We may have to attempt
9011 * this twice if the config data has provided a second choice
9012 * of command.
7cca0d81 9013 */
feb02b4e 9014 if (ssh->mainchan && !ssh->ncmode) while (1) {
fd5e5847 9015 int subsys;
9016 char *cmd;
9017
51470298 9018 if (ssh->fallback_cmd) {
4a693cfc 9019 subsys = conf_get_int(ssh->conf, CONF_ssh_subsys2);
9020 cmd = conf_get_str(ssh->conf, CONF_remote_cmd2);
fd5e5847 9021 } else {
4a693cfc 9022 subsys = conf_get_int(ssh->conf, CONF_ssh_subsys);
9023 cmd = conf_get_str(ssh->conf, CONF_remote_cmd);
fd5e5847 9024 }
9025
ff3187f6 9026 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9027 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
fd5e5847 9028 if (subsys) {
ff3187f6 9029 ssh2_pkt_addstring(s->pktout, "subsystem");
9030 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
9031 ssh2_pkt_addstring(s->pktout, cmd);
fd5e5847 9032 } else if (*cmd) {
ff3187f6 9033 ssh2_pkt_addstring(s->pktout, "exec");
9034 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
9035 ssh2_pkt_addstring(s->pktout, cmd);
fd5e5847 9036 } else {
ff3187f6 9037 ssh2_pkt_addstring(s->pktout, "shell");
9038 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
32874aea 9039 }
ff3187f6 9040 ssh2_pkt_send(ssh, s->pktout);
b09eaa88 9041
9042 crWaitUntilV(pktin);
9043
ff3187f6 9044 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
9045 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
6b5cf8b4 9046 bombout(("Unexpected response to shell/command request:"
ff3187f6 9047 " packet type %d", pktin->type));
7ffdbc1a 9048 crStopV;
fd5e5847 9049 }
9050 /*
9051 * We failed to start the command. If this is the
9052 * fallback command, we really are finished; if it's
9053 * not, and if the fallback command exists, try falling
9054 * back to it before complaining.
9055 */
4a693cfc 9056 if (!ssh->fallback_cmd &&
9057 *conf_get_str(ssh->conf, CONF_remote_cmd2)) {
fd5e5847 9058 logevent("Primary command failed; attempting fallback");
51470298 9059 ssh->fallback_cmd = TRUE;
fd5e5847 9060 continue;
9061 }
6b5cf8b4 9062 bombout(("Server refused to start a shell/command"));
7ffdbc1a 9063 crStopV;
fd5e5847 9064 } else {
9065 logevent("Started a shell/command");
32874aea 9066 }
fd5e5847 9067 break;
7cca0d81 9068 }
9069
51470298 9070 ssh->state = SSH_STATE_SESSION;
9071 if (ssh->size_needed)
9072 ssh_size(ssh, ssh->term_width, ssh->term_height);
9073 if (ssh->eof_needed)
9074 ssh_special(ssh, TS_EOF);
6e48c3fe 9075
7cca0d81 9076 /*
0e443c99 9077 * All the initial channel requests are done, so install the default
9078 * failure handler.
9079 */
837d6ba6 9080 ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = ssh2_msg_channel_success;
0e443c99 9081 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = ssh2_msg_channel_failure;
9082
9083 /*
7cca0d81 9084 * Transfer data!
9085 */
b9d7bcad 9086 if (ssh->ldisc)
9087 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
0ed48730 9088 if (ssh->mainchan)
9089 ssh->send_ok = 1;
7cca0d81 9090 while (1) {
e5574168 9091 crReturnV;
51470298 9092 s->try_send = FALSE;
ff3187f6 9093 if (pktin) {
2b7540a7 9094
51df0ab5 9095 /*
9096 * _All_ the connection-layer packets we expect to
9097 * receive are now handled by the dispatch table.
9098 * Anything that reaches here must be bogus.
9099 */
32874aea 9100
51df0ab5 9101 bombout(("Strange packet received: type %d", pktin->type));
9102 crStopV;
0ed48730 9103 } else if (ssh->mainchan) {
32874aea 9104 /*
9105 * We have spare data. Add it to the channel buffer.
9106 */
d8baa528 9107 ssh2_add_channel_data(ssh->mainchan, (char *)in, inlen);
51470298 9108 s->try_send = TRUE;
32874aea 9109 }
51470298 9110 if (s->try_send) {
32874aea 9111 int i;
9112 struct ssh_channel *c;
9113 /*
9114 * Try to send data on all channels if we can.
9115 */
1bfc7e93 9116 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++)
78280721 9117 ssh2_try_send_and_unthrottle(ssh, c);
7cca0d81 9118 }
e5574168 9119 }
9120
9121 crFinishV;
9122}
9123
9124/*
2e85c969 9125 * Handlers for SSH-2 messages that might arrive at any moment.
b09eaa88 9126 */
409bfa77 9127static void ssh2_msg_disconnect(Ssh ssh, struct Packet *pktin)
b09eaa88 9128{
9129 /* log reason code in disconnect message */
9130 char *buf, *msg;
60860bc3 9131 int reason, msglen;
b09eaa88 9132
9133 reason = ssh_pkt_getuint32(pktin);
9134 ssh_pkt_getstring(pktin, &msg, &msglen);
9135
9136 if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
9137 buf = dupprintf("Received disconnect message (%s)",
9138 ssh2_disconnect_reasons[reason]);
9139 } else {
9140 buf = dupprintf("Received disconnect message (unknown"
9141 " type %d)", reason);
9142 }
9143 logevent(buf);
9144 sfree(buf);
60860bc3 9145 buf = dupprintf("Disconnection message text: %.*s",
9146 msglen, msg);
b09eaa88 9147 logevent(buf);
60860bc3 9148 bombout(("Server sent disconnect message\ntype %d (%s):\n\"%.*s\"",
b09eaa88 9149 reason,
9150 (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ?
9151 ssh2_disconnect_reasons[reason] : "unknown",
60860bc3 9152 msglen, msg));
b09eaa88 9153 sfree(buf);
9154}
9155
409bfa77 9156static void ssh2_msg_debug(Ssh ssh, struct Packet *pktin)
b09eaa88 9157{
9158 /* log the debug message */
fb983202 9159 char *msg;
b09eaa88 9160 int msglen;
b09eaa88 9161
3ab79841 9162 /* XXX maybe we should actually take notice of the return value */
9163 ssh2_pkt_getbool(pktin);
b09eaa88 9164 ssh_pkt_getstring(pktin, &msg, &msglen);
9165
fb983202 9166 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
b09eaa88 9167}
9168
409bfa77 9169static void ssh2_msg_something_unimplemented(Ssh ssh, struct Packet *pktin)
b09eaa88 9170{
9171 struct Packet *pktout;
9172 pktout = ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED);
9173 ssh2_pkt_adduint32(pktout, pktin->sequence);
9174 /*
9175 * UNIMPLEMENTED messages MUST appear in the same order as the
9176 * messages they respond to. Hence, never queue them.
9177 */
9178 ssh2_pkt_send_noqueue(ssh, pktout);
9179}
9180
9181/*
2e85c969 9182 * Handle the top-level SSH-2 protocol.
7cca0d81 9183 */
b09eaa88 9184static void ssh2_protocol_setup(Ssh ssh)
9185{
9186 int i;
9187
9188 /*
9189 * Most messages cause SSH2_MSG_UNIMPLEMENTED.
9190 */
9191 for (i = 0; i < 256; i++)
9192 ssh->packet_dispatch[i] = ssh2_msg_something_unimplemented;
9193
9194 /*
9195 * Any message we actually understand, we set to NULL so that
9196 * the coroutines will get it.
9197 */
9198 ssh->packet_dispatch[SSH2_MSG_UNIMPLEMENTED] = NULL;
9199 ssh->packet_dispatch[SSH2_MSG_SERVICE_REQUEST] = NULL;
9200 ssh->packet_dispatch[SSH2_MSG_SERVICE_ACCEPT] = NULL;
9201 ssh->packet_dispatch[SSH2_MSG_KEXINIT] = NULL;
9202 ssh->packet_dispatch[SSH2_MSG_NEWKEYS] = NULL;
9203 ssh->packet_dispatch[SSH2_MSG_KEXDH_INIT] = NULL;
9204 ssh->packet_dispatch[SSH2_MSG_KEXDH_REPLY] = NULL;
9205 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REQUEST] = NULL; duplicate case value */
9206 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_GROUP] = NULL; duplicate case value */
9207 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_INIT] = NULL;
9208 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REPLY] = NULL;
9209 ssh->packet_dispatch[SSH2_MSG_USERAUTH_REQUEST] = NULL;
9210 ssh->packet_dispatch[SSH2_MSG_USERAUTH_FAILURE] = NULL;
9211 ssh->packet_dispatch[SSH2_MSG_USERAUTH_SUCCESS] = NULL;
9212 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
9213 ssh->packet_dispatch[SSH2_MSG_USERAUTH_PK_OK] = NULL;
9214 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ] = NULL; duplicate case value */
9215 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_REQUEST] = NULL; duplicate case value */
9216 ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_RESPONSE] = NULL;
9217 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = NULL;
9218 ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = NULL;
9219 ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = NULL;
9220 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = NULL;
9221 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = NULL;
9222 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = NULL;
9223 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = NULL;
9224 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = NULL;
9225 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = NULL;
9226 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = NULL;
9227 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = NULL;
9228 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = NULL;
9229 ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = NULL;
9230 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = NULL;
9231
9232 /*
9233 * These special message types we install handlers for.
9234 */
9235 ssh->packet_dispatch[SSH2_MSG_DISCONNECT] = ssh2_msg_disconnect;
2e85c969 9236 ssh->packet_dispatch[SSH2_MSG_IGNORE] = ssh_msg_ignore; /* shared with SSH-1 */
b09eaa88 9237 ssh->packet_dispatch[SSH2_MSG_DEBUG] = ssh2_msg_debug;
9238}
9239
9442dd57 9240static void ssh2_timer(void *ctx, long now)
9241{
9242 Ssh ssh = (Ssh)ctx;
9243
ecbb0000 9244 if (ssh->state == SSH_STATE_CLOSED)
9245 return;
9246
4a693cfc 9247 if (!ssh->kex_in_progress && conf_get_int(ssh->conf, CONF_ssh_rekey_time) != 0 &&
9442dd57 9248 now - ssh->next_rekey >= 0) {
f382c87d 9249 do_ssh2_transport(ssh, "timeout", -1, NULL);
9442dd57 9250 }
9251}
9252
1c1a7262 9253static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
ff3187f6 9254 struct Packet *pktin)
7cca0d81 9255{
1c1a7262 9256 unsigned char *in = (unsigned char *)vin;
b09eaa88 9257 if (ssh->state == SSH_STATE_CLOSED)
9258 return;
9259
9442dd57 9260 if (pktin) {
9261 ssh->incoming_data_size += pktin->encrypted_len;
9262 if (!ssh->kex_in_progress &&
d57f70af 9263 ssh->max_data_size != 0 &&
9264 ssh->incoming_data_size > ssh->max_data_size)
f382c87d 9265 do_ssh2_transport(ssh, "too much data received", -1, NULL);
9442dd57 9266 }
9267
b09eaa88 9268 if (pktin && ssh->packet_dispatch[pktin->type]) {
9269 ssh->packet_dispatch[pktin->type](ssh, pktin);
32874aea 9270 return;
b09eaa88 9271 }
9272
9273 if (!ssh->protocol_initial_phase_done ||
9274 (pktin && pktin->type >= 20 && pktin->type < 50)) {
9275 if (do_ssh2_transport(ssh, in, inlen, pktin) &&
9276 !ssh->protocol_initial_phase_done) {
9277 ssh->protocol_initial_phase_done = TRUE;
9278 /*
9279 * Allow authconn to initialise itself.
9280 */
9281 do_ssh2_authconn(ssh, NULL, 0, NULL);
9282 }
9283 } else {
9284 do_ssh2_authconn(ssh, in, inlen, pktin);
9285 }
7cca0d81 9286}
9287
4a693cfc 9288static void ssh_cache_conf_values(Ssh ssh)
9289{
9290 ssh->logomitdata = conf_get_int(ssh->conf, CONF_logomitdata);
9291}
9292
7cca0d81 9293/*
8df7a775 9294 * Called to set up the connection.
374330e2 9295 *
9296 * Returns an error message, or NULL on success.
374330e2 9297 */
cbe2d68f 9298static const char *ssh_init(void *frontend_handle, void **backend_handle,
4a693cfc 9299 Conf *conf, char *host, int port, char **realhost,
9300 int nodelay, int keepalive)
32874aea 9301{
cbe2d68f 9302 const char *p;
51470298 9303 Ssh ssh;
9304
3d88e64d 9305 ssh = snew(struct ssh_tag);
4a693cfc 9306 ssh->conf = conf_copy(conf);
9307 ssh_cache_conf_values(ssh);
125105d1 9308 ssh->version = 0; /* when not ready yet */
51470298 9309 ssh->s = NULL;
9310 ssh->cipher = NULL;
371e569c 9311 ssh->v1_cipher_ctx = NULL;
0183b242 9312 ssh->crcda_ctx = NULL;
51470298 9313 ssh->cscipher = NULL;
371e569c 9314 ssh->cs_cipher_ctx = NULL;
51470298 9315 ssh->sccipher = NULL;
371e569c 9316 ssh->sc_cipher_ctx = NULL;
51470298 9317 ssh->csmac = NULL;
a8327734 9318 ssh->cs_mac_ctx = NULL;
51470298 9319 ssh->scmac = NULL;
e0e1a00d 9320 ssh->sc_mac_ctx = NULL;
51470298 9321 ssh->cscomp = NULL;
5366aed8 9322 ssh->cs_comp_ctx = NULL;
51470298 9323 ssh->sccomp = NULL;
5366aed8 9324 ssh->sc_comp_ctx = NULL;
51470298 9325 ssh->kex = NULL;
389aa499 9326 ssh->kex_ctx = NULL;
51470298 9327 ssh->hostkey = NULL;
9328 ssh->exitcode = -1;
ac934965 9329 ssh->close_expected = FALSE;
9e296bfa 9330 ssh->clean_exit = FALSE;
51470298 9331 ssh->state = SSH_STATE_PREPACKET;
9332 ssh->size_needed = FALSE;
9333 ssh->eof_needed = FALSE;
b9d7bcad 9334 ssh->ldisc = NULL;
a8327734 9335 ssh->logctx = NULL;
51470298 9336 ssh->deferred_send_data = NULL;
9337 ssh->deferred_len = 0;
9338 ssh->deferred_size = 0;
9339 ssh->fallback_cmd = 0;
acab36bc 9340 ssh->pkt_kctx = SSH2_PKTCTX_NOKEX;
9341 ssh->pkt_actx = SSH2_PKTCTX_NOAUTH;
8def70c3 9342 ssh->x11disp = NULL;
be738459 9343 ssh->v1_compressing = FALSE;
51470298 9344 ssh->v2_outgoing_sequence = 0;
9345 ssh->ssh1_rdpkt_crstate = 0;
9346 ssh->ssh2_rdpkt_crstate = 0;
9347 ssh->do_ssh_init_crstate = 0;
9348 ssh->ssh_gotdata_crstate = 0;
b09eaa88 9349 ssh->do_ssh1_connection_crstate = 0;
51470298 9350 ssh->do_ssh1_login_crstate = 0;
9351 ssh->do_ssh2_transport_crstate = 0;
9352 ssh->do_ssh2_authconn_crstate = 0;
9353 ssh->do_ssh_init_state = NULL;
9354 ssh->do_ssh1_login_state = NULL;
9355 ssh->do_ssh2_transport_state = NULL;
9356 ssh->do_ssh2_authconn_state = NULL;
4320baf7 9357 ssh->v_c = NULL;
9358 ssh->v_s = NULL;
6571dbfd 9359 ssh->mainchan = NULL;
968d2d92 9360 ssh->throttled_all = 0;
9361 ssh->v1_stdout_throttling = 0;
590f6a5f 9362 ssh->queue = NULL;
9363 ssh->queuelen = ssh->queuesize = 0;
9364 ssh->queueing = FALSE;
06fadff5 9365 ssh->qhead = ssh->qtail = NULL;
e13bba36 9366 ssh->deferred_rekey_reason = NULL;
3d9449a1 9367 bufchain_init(&ssh->queued_incoming_data);
9368 ssh->frozen = FALSE;
4a693cfc 9369 ssh->username = NULL;
51470298 9370
9371 *backend_handle = ssh;
32874aea 9372
8f203108 9373#ifdef MSCRYPTOAPI
32874aea 9374 if (crypto_startup() == 0)
8f203108 9375 return "Microsoft high encryption pack not installed!";
9376#endif
374330e2 9377
51470298 9378 ssh->frontend = frontend_handle;
4a693cfc 9379 ssh->term_width = conf_get_int(ssh->conf, CONF_width);
9380 ssh->term_height = conf_get_int(ssh->conf, CONF_height);
887035a5 9381
fabd1805 9382 ssh->channels = NULL;
9383 ssh->rportfwds = NULL;
f47a5ffb 9384 ssh->portfwds = NULL;
fabd1805 9385
51470298 9386 ssh->send_ok = 0;
9387 ssh->editing = 0;
9388 ssh->echoing = 0;
ff68564b 9389 ssh->conn_throttle_count = 0;
51470298 9390 ssh->overall_bufsize = 0;
9391 ssh->fallback_cmd = 0;
8df7a775 9392
3648d4c5 9393 ssh->protocol = NULL;
9394
b09eaa88 9395 ssh->protocol_initial_phase_done = FALSE;
9396
39934deb 9397 ssh->pinger = NULL;
9398
9442dd57 9399 ssh->incoming_data_size = ssh->outgoing_data_size =
9400 ssh->deferred_data_size = 0L;
4a693cfc 9401 ssh->max_data_size = parse_blocksize(conf_get_str(ssh->conf,
9402 CONF_ssh_rekey_data));
9442dd57 9403 ssh->kex_in_progress = FALSE;
9404
1e00c92b 9405#ifndef NO_GSSAPI
9406 ssh->gsslibs = NULL;
9407#endif
9408
79bf227b 9409 p = connect_to_host(ssh, host, port, realhost, nodelay, keepalive);
fb09bf1c 9410 if (p != NULL)
9411 return p;
374330e2 9412
5d17ccfc 9413 random_ref();
9414
374330e2 9415 return NULL;
9416}
9417
fabd1805 9418static void ssh_free(void *handle)
9419{
9420 Ssh ssh = (Ssh) handle;
9421 struct ssh_channel *c;
9422 struct ssh_rportfwd *pf;
9423
9424 if (ssh->v1_cipher_ctx)
9425 ssh->cipher->free_context(ssh->v1_cipher_ctx);
9426 if (ssh->cs_cipher_ctx)
9427 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
9428 if (ssh->sc_cipher_ctx)
9429 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
9430 if (ssh->cs_mac_ctx)
9431 ssh->csmac->free_context(ssh->cs_mac_ctx);
9432 if (ssh->sc_mac_ctx)
9433 ssh->scmac->free_context(ssh->sc_mac_ctx);
29b1d0b3 9434 if (ssh->cs_comp_ctx) {
9435 if (ssh->cscomp)
9436 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
9437 else
9438 zlib_compress_cleanup(ssh->cs_comp_ctx);
9439 }
9440 if (ssh->sc_comp_ctx) {
9441 if (ssh->sccomp)
9442 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
9443 else
9444 zlib_decompress_cleanup(ssh->sc_comp_ctx);
9445 }
fabd1805 9446 if (ssh->kex_ctx)
9447 dh_cleanup(ssh->kex_ctx);
9448 sfree(ssh->savedhost);
9449
590f6a5f 9450 while (ssh->queuelen-- > 0)
9451 ssh_free_packet(ssh->queue[ssh->queuelen]);
9452 sfree(ssh->queue);
9453
06fadff5 9454 while (ssh->qhead) {
9455 struct queued_handler *qh = ssh->qhead;
9456 ssh->qhead = qh->next;
9457 sfree(ssh->qhead);
9458 }
9459 ssh->qhead = ssh->qtail = NULL;
9460
fabd1805 9461 if (ssh->channels) {
9462 while ((c = delpos234(ssh->channels, 0)) != NULL) {
9463 switch (c->type) {
9464 case CHAN_X11:
9465 if (c->u.x11.s != NULL)
9466 x11_close(c->u.x11.s);
9467 break;
9468 case CHAN_SOCKDATA:
409eca86 9469 case CHAN_SOCKDATA_DORMANT:
fabd1805 9470 if (c->u.pfd.s != NULL)
9471 pfd_close(c->u.pfd.s);
9472 break;
9473 }
9474 sfree(c);
9475 }
9476 freetree234(ssh->channels);
cdb52705 9477 ssh->channels = NULL;
fabd1805 9478 }
9479
9480 if (ssh->rportfwds) {
9481 while ((pf = delpos234(ssh->rportfwds, 0)) != NULL)
8aea57fd 9482 free_rportfwd(pf);
fabd1805 9483 freetree234(ssh->rportfwds);
cdb52705 9484 ssh->rportfwds = NULL;
fabd1805 9485 }
9486 sfree(ssh->deferred_send_data);
8def70c3 9487 if (ssh->x11disp)
9488 x11_free_display(ssh->x11disp);
fabd1805 9489 sfree(ssh->do_ssh_init_state);
9490 sfree(ssh->do_ssh1_login_state);
9491 sfree(ssh->do_ssh2_transport_state);
9492 sfree(ssh->do_ssh2_authconn_state);
4320baf7 9493 sfree(ssh->v_c);
9494 sfree(ssh->v_s);
42af6a67 9495 sfree(ssh->fullhostname);
679539d7 9496 if (ssh->crcda_ctx) {
9497 crcda_free_context(ssh->crcda_ctx);
9498 ssh->crcda_ctx = NULL;
9499 }
fabd1805 9500 if (ssh->s)
ac934965 9501 ssh_do_close(ssh, TRUE);
9442dd57 9502 expire_timer_context(ssh);
39934deb 9503 if (ssh->pinger)
9504 pinger_free(ssh->pinger);
3d9449a1 9505 bufchain_clear(&ssh->queued_incoming_data);
4a693cfc 9506 sfree(ssh->username);
9507 conf_free(ssh->conf);
1e00c92b 9508#ifndef NO_GSSAPI
9509 if (ssh->gsslibs)
9510 ssh_gss_cleanup(ssh->gsslibs);
9511#endif
ee50e8b6 9512 sfree(ssh);
5d17ccfc 9513
9514 random_unref();
fabd1805 9515}
9516
374330e2 9517/*
86916870 9518 * Reconfigure the SSH backend.
86916870 9519 */
4a693cfc 9520static void ssh_reconfig(void *handle, Conf *conf)
86916870 9521{
9522 Ssh ssh = (Ssh) handle;
e13bba36 9523 char *rekeying = NULL, rekey_mandatory = FALSE;
e6c1536e 9524 unsigned long old_max_data_size;
4a693cfc 9525 int i, rekey_time;
e6c1536e 9526
4a693cfc 9527 pinger_reconfig(ssh->pinger, ssh->conf, conf);
3b6606c7 9528 if (ssh->portfwds)
4a693cfc 9529 ssh_setup_portfwd(ssh, conf);
e6c1536e 9530
4a693cfc 9531 rekey_time = conf_get_int(conf, CONF_ssh_rekey_time);
9532 if (conf_get_int(ssh->conf, CONF_ssh_rekey_time) != rekey_time &&
9533 rekey_time != 0) {
9534 long new_next = ssh->last_rekey + rekey_time*60*TICKSPERSEC;
e6c1536e 9535 long now = GETTICKCOUNT();
9536
9537 if (new_next - now < 0) {
f382c87d 9538 rekeying = "timeout shortened";
e6c1536e 9539 } else {
9540 ssh->next_rekey = schedule_timer(new_next - now, ssh2_timer, ssh);
9541 }
9542 }
9543
9544 old_max_data_size = ssh->max_data_size;
4a693cfc 9545 ssh->max_data_size = parse_blocksize(conf_get_str(ssh->conf,
9546 CONF_ssh_rekey_data));
e6c1536e 9547 if (old_max_data_size != ssh->max_data_size &&
9548 ssh->max_data_size != 0) {
9549 if (ssh->outgoing_data_size > ssh->max_data_size ||
9550 ssh->incoming_data_size > ssh->max_data_size)
f382c87d 9551 rekeying = "data limit lowered";
e6c1536e 9552 }
9553
4a693cfc 9554 if (conf_get_int(ssh->conf, CONF_compression) !=
9555 conf_get_int(conf, CONF_compression)) {
f382c87d 9556 rekeying = "compression setting changed";
e13bba36 9557 rekey_mandatory = TRUE;
9558 }
9559
4a693cfc 9560 for (i = 0; i < CIPHER_MAX; i++)
9561 if (conf_get_int_int(ssh->conf, CONF_ssh_cipherlist, i) !=
9562 conf_get_int_int(conf, CONF_ssh_cipherlist, i)) {
9563 rekeying = "cipher settings changed";
9564 rekey_mandatory = TRUE;
9565 }
9566 if (conf_get_int(ssh->conf, CONF_ssh2_des_cbc) !=
9567 conf_get_int(conf, CONF_ssh2_des_cbc)) {
f382c87d 9568 rekeying = "cipher settings changed";
e13bba36 9569 rekey_mandatory = TRUE;
e6c1536e 9570 }
9571
4a693cfc 9572 conf_free(ssh->conf);
9573 ssh->conf = conf_copy(conf);
9574 ssh_cache_conf_values(ssh);
e13bba36 9575
9576 if (rekeying) {
9577 if (!ssh->kex_in_progress) {
9578 do_ssh2_transport(ssh, rekeying, -1, NULL);
9579 } else if (rekey_mandatory) {
9580 ssh->deferred_rekey_reason = rekeying;
9581 }
9582 }
86916870 9583}
9584
9585/*
86dc445a 9586 * Called to send data down the SSH connection.
374330e2 9587 */
51470298 9588static int ssh_send(void *handle, char *buf, int len)
32874aea 9589{
51470298 9590 Ssh ssh = (Ssh) handle;
9591
9592 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
5471d09a 9593 return 0;
374330e2 9594
d8baa528 9595 ssh->protocol(ssh, (unsigned char *)buf, len, 0);
5471d09a 9596
51470298 9597 return ssh_sendbuffer(ssh);
5471d09a 9598}
9599
9600/*
9601 * Called to query the current amount of buffered stdin data.
9602 */
51470298 9603static int ssh_sendbuffer(void *handle)
5471d09a 9604{
51470298 9605 Ssh ssh = (Ssh) handle;
5471d09a 9606 int override_value;
9607
51470298 9608 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
5471d09a 9609 return 0;
9610
9611 /*
9612 * If the SSH socket itself has backed up, add the total backup
9613 * size on that to any individual buffer on the stdin channel.
9614 */
9615 override_value = 0;
51470298 9616 if (ssh->throttled_all)
9617 override_value = ssh->overall_bufsize;
5471d09a 9618
51470298 9619 if (ssh->version == 1) {
5471d09a 9620 return override_value;
51470298 9621 } else if (ssh->version == 2) {
9622 if (!ssh->mainchan || ssh->mainchan->closes > 0)
5471d09a 9623 return override_value;
9624 else
51470298 9625 return (override_value +
9626 bufchain_size(&ssh->mainchan->v.v2.outbuffer));
5471d09a 9627 }
9628
9629 return 0;
374330e2 9630}
9631
9632/*
6e48c3fe 9633 * Called to set the size of the window from SSH's POV.
374330e2 9634 */
51470298 9635static void ssh_size(void *handle, int width, int height)
32874aea 9636{
51470298 9637 Ssh ssh = (Ssh) handle;
ff3187f6 9638 struct Packet *pktout;
51470298 9639
9640 ssh->term_width = width;
9641 ssh->term_height = height;
f278d6f8 9642
51470298 9643 switch (ssh->state) {
374330e2 9644 case SSH_STATE_BEFORE_SIZE:
3687d221 9645 case SSH_STATE_PREPACKET:
21248260 9646 case SSH_STATE_CLOSED:
374330e2 9647 break; /* do nothing */
9648 case SSH_STATE_INTERMED:
51470298 9649 ssh->size_needed = TRUE; /* buffer for later */
374330e2 9650 break;
9651 case SSH_STATE_SESSION:
4a693cfc 9652 if (!conf_get_int(ssh->conf, CONF_nopty)) {
51470298 9653 if (ssh->version == 1) {
9654 send_packet(ssh, SSH1_CMSG_WINDOW_SIZE,
9655 PKT_INT, ssh->term_height,
9656 PKT_INT, ssh->term_width,
32874aea 9657 PKT_INT, 0, PKT_INT, 0, PKT_END);
0ed48730 9658 } else if (ssh->mainchan) {
ff3187f6 9659 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9660 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9661 ssh2_pkt_addstring(pktout, "window-change");
9662 ssh2_pkt_addbool(pktout, 0);
9663 ssh2_pkt_adduint32(pktout, ssh->term_width);
9664 ssh2_pkt_adduint32(pktout, ssh->term_height);
9665 ssh2_pkt_adduint32(pktout, 0);
9666 ssh2_pkt_adduint32(pktout, 0);
9667 ssh2_pkt_send(ssh, pktout);
32874aea 9668 }
9669 }
9670 break;
374330e2 9671 }
9672}
9673
9674/*
125105d1 9675 * Return a list of the special codes that make sense in this
9676 * protocol.
9677 */
9678static const struct telnet_special *ssh_get_specials(void *handle)
9679{
786ba75e 9680 static const struct telnet_special ssh1_ignore_special[] = {
9681 {"IGNORE message", TS_NOP}
9682 };
cf6ddb95 9683 static const struct telnet_special ssh2_ignore_special[] = {
62638676 9684 {"IGNORE message", TS_NOP},
cf6ddb95 9685 };
9686 static const struct telnet_special ssh2_rekey_special[] = {
9442dd57 9687 {"Repeat key exchange", TS_REKEY},
62638676 9688 };
9689 static const struct telnet_special ssh2_session_specials[] = {
6f2d0cde 9690 {NULL, TS_SEP},
9691 {"Break", TS_BRK},
bccbeb71 9692 /* These are the signal names defined by RFC 4254.
6f2d0cde 9693 * They include all the ISO C signals, but are a subset of the POSIX
9694 * required signals. */
9695 {"SIGINT (Interrupt)", TS_SIGINT},
9696 {"SIGTERM (Terminate)", TS_SIGTERM},
9697 {"SIGKILL (Kill)", TS_SIGKILL},
9698 {"SIGQUIT (Quit)", TS_SIGQUIT},
9699 {"SIGHUP (Hangup)", TS_SIGHUP},
9700 {"More signals", TS_SUBMENU},
9701 {"SIGABRT", TS_SIGABRT}, {"SIGALRM", TS_SIGALRM},
9702 {"SIGFPE", TS_SIGFPE}, {"SIGILL", TS_SIGILL},
9703 {"SIGPIPE", TS_SIGPIPE}, {"SIGSEGV", TS_SIGSEGV},
9704 {"SIGUSR1", TS_SIGUSR1}, {"SIGUSR2", TS_SIGUSR2},
9705 {NULL, TS_EXITMENU}
62638676 9706 };
9707 static const struct telnet_special specials_end[] = {
6f2d0cde 9708 {NULL, TS_EXITMENU}
62638676 9709 };
786ba75e 9710 /* XXX review this length for any changes: */
cf6ddb95 9711 static struct telnet_special ssh_specials[lenof(ssh2_ignore_special) +
9712 lenof(ssh2_rekey_special) +
62638676 9713 lenof(ssh2_session_specials) +
9714 lenof(specials_end)];
125105d1 9715 Ssh ssh = (Ssh) handle;
62638676 9716 int i = 0;
9717#define ADD_SPECIALS(name) \
9718 do { \
9719 assert((i + lenof(name)) <= lenof(ssh_specials)); \
9720 memcpy(&ssh_specials[i], name, sizeof name); \
9721 i += lenof(name); \
9722 } while(0)
125105d1 9723
9724 if (ssh->version == 1) {
62638676 9725 /* Don't bother offering IGNORE if we've decided the remote
9726 * won't cope with it, since we wouldn't bother sending it if
9727 * asked anyway. */
9728 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
786ba75e 9729 ADD_SPECIALS(ssh1_ignore_special);
125105d1 9730 } else if (ssh->version == 2) {
cf6ddb95 9731 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE))
9732 ADD_SPECIALS(ssh2_ignore_special);
9733 if (!(ssh->remote_bugs & BUG_SSH2_REKEY))
9734 ADD_SPECIALS(ssh2_rekey_special);
62638676 9735 if (ssh->mainchan)
9736 ADD_SPECIALS(ssh2_session_specials);
9737 } /* else we're not ready yet */
9738
9739 if (i) {
9740 ADD_SPECIALS(specials_end);
9741 return ssh_specials;
9742 } else {
125105d1 9743 return NULL;
62638676 9744 }
9745#undef ADD_SPECIALS
125105d1 9746}
9747
9748/*
86dc445a 9749 * Send special codes. TS_EOF is useful for `plink', so you
6abbf9e3 9750 * can send an EOF and collect resulting output (e.g. `plink
9751 * hostname sort').
374330e2 9752 */
51470298 9753static void ssh_special(void *handle, Telnet_Special code)
32874aea 9754{
51470298 9755 Ssh ssh = (Ssh) handle;
ff3187f6 9756 struct Packet *pktout;
51470298 9757
6abbf9e3 9758 if (code == TS_EOF) {
51470298 9759 if (ssh->state != SSH_STATE_SESSION) {
32874aea 9760 /*
9761 * Buffer the EOF in case we are pre-SESSION, so we can
9762 * send it as soon as we reach SESSION.
9763 */
9764 if (code == TS_EOF)
51470298 9765 ssh->eof_needed = TRUE;
32874aea 9766 return;
9767 }
51470298 9768 if (ssh->version == 1) {
9769 send_packet(ssh, SSH1_CMSG_EOF, PKT_END);
0ed48730 9770 } else if (ssh->mainchan) {
ff3187f6 9771 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_EOF);
9772 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9773 ssh2_pkt_send(ssh, pktout);
00a0b113 9774 ssh->send_ok = 0; /* now stop trying to read from stdin */
32874aea 9775 }
9776 logevent("Sent EOF message");
125105d1 9777 } else if (code == TS_PING || code == TS_NOP) {
51470298 9778 if (ssh->state == SSH_STATE_CLOSED
9779 || ssh->state == SSH_STATE_PREPACKET) return;
9780 if (ssh->version == 1) {
9781 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
9782 send_packet(ssh, SSH1_MSG_IGNORE, PKT_STR, "", PKT_END);
32874aea 9783 } else {
cf6ddb95 9784 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE)) {
9785 pktout = ssh2_pkt_init(SSH2_MSG_IGNORE);
9786 ssh2_pkt_addstring_start(pktout);
9787 ssh2_pkt_send_noqueue(ssh, pktout);
9788 }
32874aea 9789 }
9442dd57 9790 } else if (code == TS_REKEY) {
9791 if (!ssh->kex_in_progress && ssh->version == 2) {
f382c87d 9792 do_ssh2_transport(ssh, "at user request", -1, NULL);
9442dd57 9793 }
125105d1 9794 } else if (code == TS_BRK) {
9795 if (ssh->state == SSH_STATE_CLOSED
9796 || ssh->state == SSH_STATE_PREPACKET) return;
9797 if (ssh->version == 1) {
2e85c969 9798 logevent("Unable to send BREAK signal in SSH-1");
0ed48730 9799 } else if (ssh->mainchan) {
ff3187f6 9800 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9801 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9802 ssh2_pkt_addstring(pktout, "break");
9803 ssh2_pkt_addbool(pktout, 0);
9804 ssh2_pkt_adduint32(pktout, 0); /* default break length */
9805 ssh2_pkt_send(ssh, pktout);
125105d1 9806 }
6abbf9e3 9807 } else {
6f2d0cde 9808 /* Is is a POSIX signal? */
9809 char *signame = NULL;
9810 if (code == TS_SIGABRT) signame = "ABRT";
9811 if (code == TS_SIGALRM) signame = "ALRM";
9812 if (code == TS_SIGFPE) signame = "FPE";
9813 if (code == TS_SIGHUP) signame = "HUP";
9814 if (code == TS_SIGILL) signame = "ILL";
9815 if (code == TS_SIGINT) signame = "INT";
9816 if (code == TS_SIGKILL) signame = "KILL";
9817 if (code == TS_SIGPIPE) signame = "PIPE";
9818 if (code == TS_SIGQUIT) signame = "QUIT";
9819 if (code == TS_SIGSEGV) signame = "SEGV";
9820 if (code == TS_SIGTERM) signame = "TERM";
9821 if (code == TS_SIGUSR1) signame = "USR1";
9822 if (code == TS_SIGUSR2) signame = "USR2";
9823 /* The SSH-2 protocol does in principle support arbitrary named
9824 * signals, including signame@domain, but we don't support those. */
9825 if (signame) {
9826 /* It's a signal. */
9827 if (ssh->version == 2 && ssh->mainchan) {
ff3187f6 9828 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9829 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9830 ssh2_pkt_addstring(pktout, "signal");
9831 ssh2_pkt_addbool(pktout, 0);
9832 ssh2_pkt_addstring(pktout, signame);
9833 ssh2_pkt_send(ssh, pktout);
6f2d0cde 9834 logeventf(ssh, "Sent signal SIG%s", signame);
9835 }
9836 } else {
9837 /* Never heard of it. Do nothing */
9838 }
6abbf9e3 9839 }
374330e2 9840}
9841
51470298 9842void *new_sock_channel(void *handle, Socket s)
d74d141c 9843{
51470298 9844 Ssh ssh = (Ssh) handle;
d74d141c 9845 struct ssh_channel *c;
3d88e64d 9846 c = snew(struct ssh_channel);
d74d141c 9847
70c0cbe1 9848 c->ssh = ssh;
9849 ssh2_channel_init(c);
9850 c->halfopen = TRUE;
9851 c->type = CHAN_SOCKDATA_DORMANT;/* identify channel type */
9852 c->u.pfd.s = s;
9853 add234(ssh->channels, c);
d74d141c 9854 return c;
9855}
9856
5471d09a 9857/*
9858 * This is called when stdout/stderr (the entity to which
9859 * from_backend sends data) manages to clear some backlog.
9860 */
ae9ae89f 9861static void ssh_unthrottle(void *handle, int bufsize)
5471d09a 9862{
51470298 9863 Ssh ssh = (Ssh) handle;
ff68564b 9864 int buflimit;
9865
51470298 9866 if (ssh->version == 1) {
9867 if (ssh->v1_stdout_throttling && bufsize < SSH1_BUFFER_LIMIT) {
9868 ssh->v1_stdout_throttling = 0;
ff68564b 9869 ssh_throttle_conn(ssh, -1);
5471d09a 9870 }
9871 } else {
ff68564b 9872 if (ssh->mainchan) {
ab87bf1d 9873 ssh2_set_window(ssh->mainchan,
ff68564b 9874 bufsize < ssh->mainchan->v.v2.locmaxwin ?
9875 ssh->mainchan->v.v2.locmaxwin - bufsize : 0);
4a693cfc 9876 if (conf_get_int(ssh->conf, CONF_ssh_simple))
ff68564b 9877 buflimit = 0;
9878 else
9879 buflimit = ssh->mainchan->v.v2.locmaxwin;
9880 if (ssh->mainchan->throttling_conn && bufsize <= buflimit) {
9881 ssh->mainchan->throttling_conn = 0;
9882 ssh_throttle_conn(ssh, -1);
9883 }
9884 }
5471d09a 9885 }
9886}
9887
6b78788a 9888void ssh_send_port_open(void *channel, char *hostname, int port, char *org)
d74d141c 9889{
9890 struct ssh_channel *c = (struct ssh_channel *)channel;
6b78788a 9891 Ssh ssh = c->ssh;
ff3187f6 9892 struct Packet *pktout;
d74d141c 9893
57356d63 9894 logeventf(ssh, "Opening forwarded connection to %s:%d", hostname, port);
d74d141c 9895
51470298 9896 if (ssh->version == 1) {
9897 send_packet(ssh, SSH1_MSG_PORT_OPEN,
bc240b21 9898 PKT_INT, c->localid,
9899 PKT_STR, hostname,
9900 PKT_INT, port,
31fb1866 9901 /* PKT_STR, <org:orgport>, */
bc240b21 9902 PKT_END);
9903 } else {
ff3187f6 9904 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
9905 ssh2_pkt_addstring(pktout, "direct-tcpip");
9906 ssh2_pkt_adduint32(pktout, c->localid);
ff3187f6 9907 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);/* our window size */
954d5c5a 9908 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
ff3187f6 9909 ssh2_pkt_addstring(pktout, hostname);
9910 ssh2_pkt_adduint32(pktout, port);
bc240b21 9911 /*
9912 * We make up values for the originator data; partly it's
9913 * too much hassle to keep track, and partly I'm not
9914 * convinced the server should be told details like that
9915 * about my local network configuration.
1f182589 9916 * The "originator IP address" is syntactically a numeric
9917 * IP address, and some servers (e.g., Tectia) get upset
9918 * if it doesn't match this syntax.
bc240b21 9919 */
1f182589 9920 ssh2_pkt_addstring(pktout, "0.0.0.0");
ff3187f6 9921 ssh2_pkt_adduint32(pktout, 0);
9922 ssh2_pkt_send(ssh, pktout);
bc240b21 9923 }
d74d141c 9924}
9925
6226c939 9926static int ssh_connected(void *handle)
32874aea 9927{
51470298 9928 Ssh ssh = (Ssh) handle;
6226c939 9929 return ssh->s != NULL;
32874aea 9930}
8ccc75b0 9931
51470298 9932static int ssh_sendok(void *handle)
32874aea 9933{
51470298 9934 Ssh ssh = (Ssh) handle;
9935 return ssh->send_ok;
32874aea 9936}
fb09bf1c 9937
51470298 9938static int ssh_ldisc(void *handle, int option)
32874aea 9939{
51470298 9940 Ssh ssh = (Ssh) handle;
32874aea 9941 if (option == LD_ECHO)
51470298 9942 return ssh->echoing;
32874aea 9943 if (option == LD_EDIT)
51470298 9944 return ssh->editing;
0965bee0 9945 return FALSE;
9946}
9947
b9d7bcad 9948static void ssh_provide_ldisc(void *handle, void *ldisc)
9949{
9950 Ssh ssh = (Ssh) handle;
9951 ssh->ldisc = ldisc;
9952}
9953
a8327734 9954static void ssh_provide_logctx(void *handle, void *logctx)
9955{
9956 Ssh ssh = (Ssh) handle;
9957 ssh->logctx = logctx;
9958}
9959
51470298 9960static int ssh_return_exitcode(void *handle)
9961{
9962 Ssh ssh = (Ssh) handle;
3bb2f322 9963 if (ssh->s != NULL)
9964 return -1;
9965 else
3c112d53 9966 return (ssh->exitcode >= 0 ? ssh->exitcode : INT_MAX);
51470298 9967}
9968
9969/*
f89c3294 9970 * cfg_info for SSH is the currently running version of the
9971 * protocol. (1 for 1; 2 for 2; 0 for not-decided-yet.)
9972 */
9973static int ssh_cfg_info(void *handle)
9974{
9975 Ssh ssh = (Ssh) handle;
9976 return ssh->version;
9977}
9978
9979/*
51470298 9980 * Gross hack: pscp will try to start SFTP but fall back to scp1 if
9981 * that fails. This variable is the means by which scp.c can reach
9982 * into the SSH code and find out which one it got.
9983 */
9984extern int ssh_fallback_cmd(void *handle)
d8d6c7e5 9985{
51470298 9986 Ssh ssh = (Ssh) handle;
9987 return ssh->fallback_cmd;
d8d6c7e5 9988}
9989
374330e2 9990Backend ssh_backend = {
9991 ssh_init,
fabd1805 9992 ssh_free,
86916870 9993 ssh_reconfig,
374330e2 9994 ssh_send,
5471d09a 9995 ssh_sendbuffer,
374330e2 9996 ssh_size,
4017be6d 9997 ssh_special,
125105d1 9998 ssh_get_specials,
6226c939 9999 ssh_connected,
d8d6c7e5 10000 ssh_return_exitcode,
97db3be4 10001 ssh_sendok,
0965bee0 10002 ssh_ldisc,
b9d7bcad 10003 ssh_provide_ldisc,
a8327734 10004 ssh_provide_logctx,
5471d09a 10005 ssh_unthrottle,
f89c3294 10006 ssh_cfg_info,
9e164d82 10007 "ssh",
10008 PROT_SSH,
97db3be4 10009 22
bc240b21 10010};
Local modifications for Simon Tatham's `PuTTY' SSH client and terminal emulator