projects / u / mdw / putty / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
The documentation was still claiming that we don't support x11-auth.
[u/mdw/putty] / ssh.c
CommitLineData
eaf1e20a 1/*
2 * SSH backend.
3 */
4
374330e2 5#include <stdio.h>
6#include <stdlib.h>
fb09bf1c 7#include <stdarg.h>
8#include <assert.h>
3c112d53 9#include <limits.h>
d051d1b4 10#include <signal.h>
374330e2 11
12#include "putty.h"
dacbd0e8 13#include "tree234.h"
fb09bf1c 14#include "ssh.h"
bf84a03a 15#ifndef NO_GSSAPI
b3d375b2 16#include "sshgssc.h"
42af6a67 17#include "sshgss.h"
bf84a03a 18#endif
374330e2 19
20#ifndef FALSE
21#define FALSE 0
22#endif
23#ifndef TRUE
24#define TRUE 1
25#endif
26
32874aea 27#define SSH1_MSG_DISCONNECT 1 /* 0x1 */
28#define SSH1_SMSG_PUBLIC_KEY 2 /* 0x2 */
29#define SSH1_CMSG_SESSION_KEY 3 /* 0x3 */
30#define SSH1_CMSG_USER 4 /* 0x4 */
31#define SSH1_CMSG_AUTH_RSA 6 /* 0x6 */
32#define SSH1_SMSG_AUTH_RSA_CHALLENGE 7 /* 0x7 */
33#define SSH1_CMSG_AUTH_RSA_RESPONSE 8 /* 0x8 */
34#define SSH1_CMSG_AUTH_PASSWORD 9 /* 0x9 */
35#define SSH1_CMSG_REQUEST_PTY 10 /* 0xa */
36#define SSH1_CMSG_WINDOW_SIZE 11 /* 0xb */
37#define SSH1_CMSG_EXEC_SHELL 12 /* 0xc */
38#define SSH1_CMSG_EXEC_CMD 13 /* 0xd */
39#define SSH1_SMSG_SUCCESS 14 /* 0xe */
40#define SSH1_SMSG_FAILURE 15 /* 0xf */
41#define SSH1_CMSG_STDIN_DATA 16 /* 0x10 */
42#define SSH1_SMSG_STDOUT_DATA 17 /* 0x11 */
43#define SSH1_SMSG_STDERR_DATA 18 /* 0x12 */
44#define SSH1_CMSG_EOF 19 /* 0x13 */
45#define SSH1_SMSG_EXIT_STATUS 20 /* 0x14 */
46#define SSH1_MSG_CHANNEL_OPEN_CONFIRMATION 21 /* 0x15 */
47#define SSH1_MSG_CHANNEL_OPEN_FAILURE 22 /* 0x16 */
48#define SSH1_MSG_CHANNEL_DATA 23 /* 0x17 */
49#define SSH1_MSG_CHANNEL_CLOSE 24 /* 0x18 */
50#define SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION 25 /* 0x19 */
51#define SSH1_SMSG_X11_OPEN 27 /* 0x1b */
52#define SSH1_CMSG_PORT_FORWARD_REQUEST 28 /* 0x1c */
53#define SSH1_MSG_PORT_OPEN 29 /* 0x1d */
54#define SSH1_CMSG_AGENT_REQUEST_FORWARDING 30 /* 0x1e */
55#define SSH1_SMSG_AGENT_OPEN 31 /* 0x1f */
56#define SSH1_MSG_IGNORE 32 /* 0x20 */
57#define SSH1_CMSG_EXIT_CONFIRMATION 33 /* 0x21 */
58#define SSH1_CMSG_X11_REQUEST_FORWARDING 34 /* 0x22 */
59#define SSH1_CMSG_AUTH_RHOSTS_RSA 35 /* 0x23 */
60#define SSH1_MSG_DEBUG 36 /* 0x24 */
61#define SSH1_CMSG_REQUEST_COMPRESSION 37 /* 0x25 */
62#define SSH1_CMSG_AUTH_TIS 39 /* 0x27 */
63#define SSH1_SMSG_AUTH_TIS_CHALLENGE 40 /* 0x28 */
64#define SSH1_CMSG_AUTH_TIS_RESPONSE 41 /* 0x29 */
65#define SSH1_CMSG_AUTH_CCARD 70 /* 0x46 */
66#define SSH1_SMSG_AUTH_CCARD_CHALLENGE 71 /* 0x47 */
67#define SSH1_CMSG_AUTH_CCARD_RESPONSE 72 /* 0x48 */
68
8f9e3231 69#define SSH1_AUTH_RHOSTS 1 /* 0x1 */
70#define SSH1_AUTH_RSA 2 /* 0x2 */
71#define SSH1_AUTH_PASSWORD 3 /* 0x3 */
72#define SSH1_AUTH_RHOSTS_RSA 4 /* 0x4 */
32874aea 73#define SSH1_AUTH_TIS 5 /* 0x5 */
74#define SSH1_AUTH_CCARD 16 /* 0x10 */
75
76#define SSH1_PROTOFLAG_SCREEN_NUMBER 1 /* 0x1 */
b96dc54c 77/* Mask for protoflags we will echo back to server if seen */
32874aea 78#define SSH1_PROTOFLAGS_SUPPORTED 0 /* 0x1 */
79
80#define SSH2_MSG_DISCONNECT 1 /* 0x1 */
81#define SSH2_MSG_IGNORE 2 /* 0x2 */
82#define SSH2_MSG_UNIMPLEMENTED 3 /* 0x3 */
83#define SSH2_MSG_DEBUG 4 /* 0x4 */
84#define SSH2_MSG_SERVICE_REQUEST 5 /* 0x5 */
85#define SSH2_MSG_SERVICE_ACCEPT 6 /* 0x6 */
86#define SSH2_MSG_KEXINIT 20 /* 0x14 */
87#define SSH2_MSG_NEWKEYS 21 /* 0x15 */
88#define SSH2_MSG_KEXDH_INIT 30 /* 0x1e */
89#define SSH2_MSG_KEXDH_REPLY 31 /* 0x1f */
90#define SSH2_MSG_KEX_DH_GEX_REQUEST 30 /* 0x1e */
91#define SSH2_MSG_KEX_DH_GEX_GROUP 31 /* 0x1f */
92#define SSH2_MSG_KEX_DH_GEX_INIT 32 /* 0x20 */
93#define SSH2_MSG_KEX_DH_GEX_REPLY 33 /* 0x21 */
fae1a71b 94#define SSH2_MSG_KEXRSA_PUBKEY 30 /* 0x1e */
95#define SSH2_MSG_KEXRSA_SECRET 31 /* 0x1f */
96#define SSH2_MSG_KEXRSA_DONE 32 /* 0x20 */
32874aea 97#define SSH2_MSG_USERAUTH_REQUEST 50 /* 0x32 */
98#define SSH2_MSG_USERAUTH_FAILURE 51 /* 0x33 */
99#define SSH2_MSG_USERAUTH_SUCCESS 52 /* 0x34 */
100#define SSH2_MSG_USERAUTH_BANNER 53 /* 0x35 */
101#define SSH2_MSG_USERAUTH_PK_OK 60 /* 0x3c */
102#define SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ 60 /* 0x3c */
761187b6 103#define SSH2_MSG_USERAUTH_INFO_REQUEST 60 /* 0x3c */
104#define SSH2_MSG_USERAUTH_INFO_RESPONSE 61 /* 0x3d */
32874aea 105#define SSH2_MSG_GLOBAL_REQUEST 80 /* 0x50 */
106#define SSH2_MSG_REQUEST_SUCCESS 81 /* 0x51 */
107#define SSH2_MSG_REQUEST_FAILURE 82 /* 0x52 */
108#define SSH2_MSG_CHANNEL_OPEN 90 /* 0x5a */
109#define SSH2_MSG_CHANNEL_OPEN_CONFIRMATION 91 /* 0x5b */
110#define SSH2_MSG_CHANNEL_OPEN_FAILURE 92 /* 0x5c */
111#define SSH2_MSG_CHANNEL_WINDOW_ADJUST 93 /* 0x5d */
112#define SSH2_MSG_CHANNEL_DATA 94 /* 0x5e */
113#define SSH2_MSG_CHANNEL_EXTENDED_DATA 95 /* 0x5f */
114#define SSH2_MSG_CHANNEL_EOF 96 /* 0x60 */
115#define SSH2_MSG_CHANNEL_CLOSE 97 /* 0x61 */
116#define SSH2_MSG_CHANNEL_REQUEST 98 /* 0x62 */
117#define SSH2_MSG_CHANNEL_SUCCESS 99 /* 0x63 */
118#define SSH2_MSG_CHANNEL_FAILURE 100 /* 0x64 */
42af6a67 119#define SSH2_MSG_USERAUTH_GSSAPI_RESPONSE 60
120#define SSH2_MSG_USERAUTH_GSSAPI_TOKEN 61
121#define SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE 63
122#define SSH2_MSG_USERAUTH_GSSAPI_ERROR 64
123#define SSH2_MSG_USERAUTH_GSSAPI_ERRTOK 65
124#define SSH2_MSG_USERAUTH_GSSAPI_MIC 66
32874aea 125
00db133f 126/*
127 * Packet type contexts, so that ssh2_pkt_type can correctly decode
128 * the ambiguous type numbers back into the correct type strings.
129 */
acab36bc 130typedef enum {
131 SSH2_PKTCTX_NOKEX,
132 SSH2_PKTCTX_DHGROUP,
133 SSH2_PKTCTX_DHGEX,
134 SSH2_PKTCTX_RSAKEX
135} Pkt_KCtx;
136typedef enum {
137 SSH2_PKTCTX_NOAUTH,
138 SSH2_PKTCTX_PUBLICKEY,
139 SSH2_PKTCTX_PASSWORD,
42af6a67 140 SSH2_PKTCTX_GSSAPI,
acab36bc 141 SSH2_PKTCTX_KBDINTER
142} Pkt_ACtx;
00db133f 143
32874aea 144#define SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1 /* 0x1 */
145#define SSH2_DISCONNECT_PROTOCOL_ERROR 2 /* 0x2 */
146#define SSH2_DISCONNECT_KEY_EXCHANGE_FAILED 3 /* 0x3 */
147#define SSH2_DISCONNECT_HOST_AUTHENTICATION_FAILED 4 /* 0x4 */
148#define SSH2_DISCONNECT_MAC_ERROR 5 /* 0x5 */
149#define SSH2_DISCONNECT_COMPRESSION_ERROR 6 /* 0x6 */
150#define SSH2_DISCONNECT_SERVICE_NOT_AVAILABLE 7 /* 0x7 */
151#define SSH2_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED 8 /* 0x8 */
152#define SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9 /* 0x9 */
153#define SSH2_DISCONNECT_CONNECTION_LOST 10 /* 0xa */
154#define SSH2_DISCONNECT_BY_APPLICATION 11 /* 0xb */
155#define SSH2_DISCONNECT_TOO_MANY_CONNECTIONS 12 /* 0xc */
156#define SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER 13 /* 0xd */
157#define SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14 /* 0xe */
158#define SSH2_DISCONNECT_ILLEGAL_USER_NAME 15 /* 0xf */
38c4a8da 159
160static const char *const ssh2_disconnect_reasons[] = {
161 NULL,
afb4d0dc 162 "host not allowed to connect",
163 "protocol error",
164 "key exchange failed",
165 "host authentication failed",
1da38d29 166 "MAC error",
afb4d0dc 167 "compression error",
168 "service not available",
169 "protocol version not supported",
170 "host key not verifiable",
171 "connection lost",
172 "by application",
173 "too many connections",
174 "auth cancelled by user",
175 "no more auth methods available",
176 "illegal user name",
38c4a8da 177};
9005f3ba 178
32874aea 179#define SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED 1 /* 0x1 */
180#define SSH2_OPEN_CONNECT_FAILED 2 /* 0x2 */
181#define SSH2_OPEN_UNKNOWN_CHANNEL_TYPE 3 /* 0x3 */
182#define SSH2_OPEN_RESOURCE_SHORTAGE 4 /* 0x4 */
d211621f 183
32874aea 184#define SSH2_EXTENDED_DATA_STDERR 1 /* 0x1 */
fb09bf1c 185
7d503c31 186/*
187 * Various remote-bug flags.
188 */
189#define BUG_CHOKES_ON_SSH1_IGNORE 1
190#define BUG_SSH2_HMAC 2
bd358db1 191#define BUG_NEEDS_SSH1_PLAIN_PASSWORD 4
0df73905 192#define BUG_CHOKES_ON_RSA 8
1dd353b5 193#define BUG_SSH2_RSA_PADDING 16
088bde77 194#define BUG_SSH2_DERIVEKEY 32
f382c87d 195#define BUG_SSH2_REKEY 64
dda87a28 196#define BUG_SSH2_PK_SESSIONID 128
c9739dba 197#define BUG_SSH2_MAXPKT 256
cf6ddb95 198#define BUG_CHOKES_ON_SSH2_IGNORE 512
bd358db1 199
c6ccd5c2 200/*
201 * Codes for terminal modes.
202 * Most of these are the same in SSH-1 and SSH-2.
7646c432 203 * This list is derived from RFC 4254 and
c6ccd5c2 204 * SSH-1 RFC-1.2.31.
205 */
206static const struct {
207 const char* const mode;
208 int opcode;
209 enum { TTY_OP_CHAR, TTY_OP_BOOL } type;
210} ssh_ttymodes[] = {
211 /* "V" prefix discarded for special characters relative to SSH specs */
212 { "INTR", 1, TTY_OP_CHAR },
213 { "QUIT", 2, TTY_OP_CHAR },
214 { "ERASE", 3, TTY_OP_CHAR },
215 { "KILL", 4, TTY_OP_CHAR },
216 { "EOF", 5, TTY_OP_CHAR },
217 { "EOL", 6, TTY_OP_CHAR },
218 { "EOL2", 7, TTY_OP_CHAR },
219 { "START", 8, TTY_OP_CHAR },
220 { "STOP", 9, TTY_OP_CHAR },
221 { "SUSP", 10, TTY_OP_CHAR },
222 { "DSUSP", 11, TTY_OP_CHAR },
223 { "REPRINT", 12, TTY_OP_CHAR },
224 { "WERASE", 13, TTY_OP_CHAR },
225 { "LNEXT", 14, TTY_OP_CHAR },
226 { "FLUSH", 15, TTY_OP_CHAR },
227 { "SWTCH", 16, TTY_OP_CHAR },
228 { "STATUS", 17, TTY_OP_CHAR },
229 { "DISCARD", 18, TTY_OP_CHAR },
230 { "IGNPAR", 30, TTY_OP_BOOL },
231 { "PARMRK", 31, TTY_OP_BOOL },
232 { "INPCK", 32, TTY_OP_BOOL },
233 { "ISTRIP", 33, TTY_OP_BOOL },
234 { "INLCR", 34, TTY_OP_BOOL },
235 { "IGNCR", 35, TTY_OP_BOOL },
236 { "ICRNL", 36, TTY_OP_BOOL },
237 { "IUCLC", 37, TTY_OP_BOOL },
238 { "IXON", 38, TTY_OP_BOOL },
239 { "IXANY", 39, TTY_OP_BOOL },
240 { "IXOFF", 40, TTY_OP_BOOL },
241 { "IMAXBEL", 41, TTY_OP_BOOL },
242 { "ISIG", 50, TTY_OP_BOOL },
243 { "ICANON", 51, TTY_OP_BOOL },
244 { "XCASE", 52, TTY_OP_BOOL },
245 { "ECHO", 53, TTY_OP_BOOL },
246 { "ECHOE", 54, TTY_OP_BOOL },
247 { "ECHOK", 55, TTY_OP_BOOL },
248 { "ECHONL", 56, TTY_OP_BOOL },
249 { "NOFLSH", 57, TTY_OP_BOOL },
250 { "TOSTOP", 58, TTY_OP_BOOL },
251 { "IEXTEN", 59, TTY_OP_BOOL },
252 { "ECHOCTL", 60, TTY_OP_BOOL },
253 { "ECHOKE", 61, TTY_OP_BOOL },
254 { "PENDIN", 62, TTY_OP_BOOL }, /* XXX is this a real mode? */
255 { "OPOST", 70, TTY_OP_BOOL },
256 { "OLCUC", 71, TTY_OP_BOOL },
257 { "ONLCR", 72, TTY_OP_BOOL },
258 { "OCRNL", 73, TTY_OP_BOOL },
259 { "ONOCR", 74, TTY_OP_BOOL },
260 { "ONLRET", 75, TTY_OP_BOOL },
261 { "CS7", 90, TTY_OP_BOOL },
262 { "CS8", 91, TTY_OP_BOOL },
263 { "PARENB", 92, TTY_OP_BOOL },
264 { "PARODD", 93, TTY_OP_BOOL }
265};
266
267/* Miscellaneous other tty-related constants. */
268#define SSH_TTY_OP_END 0
269/* The opcodes for ISPEED/OSPEED differ between SSH-1 and SSH-2. */
270#define SSH1_TTY_OP_ISPEED 192
271#define SSH1_TTY_OP_OSPEED 193
272#define SSH2_TTY_OP_ISPEED 128
273#define SSH2_TTY_OP_OSPEED 129
274
275/* Helper functions for parsing tty-related config. */
276static unsigned int ssh_tty_parse_specchar(char *s)
277{
278 unsigned int ret;
279 if (*s) {
280 char *next = NULL;
281 ret = ctrlparse(s, &next);
282 if (!next) ret = s[0];
283 } else {
284 ret = 255; /* special value meaning "don't set" */
285 }
286 return ret;
287}
288static unsigned int ssh_tty_parse_boolean(char *s)
289{
290 if (stricmp(s, "yes") == 0 ||
291 stricmp(s, "on") == 0 ||
292 stricmp(s, "true") == 0 ||
293 stricmp(s, "+") == 0)
294 return 1; /* true */
295 else if (stricmp(s, "no") == 0 ||
296 stricmp(s, "off") == 0 ||
297 stricmp(s, "false") == 0 ||
298 stricmp(s, "-") == 0)
299 return 0; /* false */
300 else
301 return (atoi(s) != 0);
302}
303
00db133f 304#define translate(x) if (type == x) return #x
acab36bc 305#define translatek(x,ctx) if (type == x && (pkt_kctx == ctx)) return #x
306#define translatea(x,ctx) if (type == x && (pkt_actx == ctx)) return #x
ae9ae89f 307static char *ssh1_pkt_type(int type)
00db133f 308{
309 translate(SSH1_MSG_DISCONNECT);
310 translate(SSH1_SMSG_PUBLIC_KEY);
311 translate(SSH1_CMSG_SESSION_KEY);
312 translate(SSH1_CMSG_USER);
313 translate(SSH1_CMSG_AUTH_RSA);
314 translate(SSH1_SMSG_AUTH_RSA_CHALLENGE);
315 translate(SSH1_CMSG_AUTH_RSA_RESPONSE);
316 translate(SSH1_CMSG_AUTH_PASSWORD);
317 translate(SSH1_CMSG_REQUEST_PTY);
318 translate(SSH1_CMSG_WINDOW_SIZE);
319 translate(SSH1_CMSG_EXEC_SHELL);
320 translate(SSH1_CMSG_EXEC_CMD);
321 translate(SSH1_SMSG_SUCCESS);
322 translate(SSH1_SMSG_FAILURE);
323 translate(SSH1_CMSG_STDIN_DATA);
324 translate(SSH1_SMSG_STDOUT_DATA);
325 translate(SSH1_SMSG_STDERR_DATA);
326 translate(SSH1_CMSG_EOF);
327 translate(SSH1_SMSG_EXIT_STATUS);
328 translate(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
329 translate(SSH1_MSG_CHANNEL_OPEN_FAILURE);
330 translate(SSH1_MSG_CHANNEL_DATA);
331 translate(SSH1_MSG_CHANNEL_CLOSE);
332 translate(SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION);
333 translate(SSH1_SMSG_X11_OPEN);
334 translate(SSH1_CMSG_PORT_FORWARD_REQUEST);
335 translate(SSH1_MSG_PORT_OPEN);
336 translate(SSH1_CMSG_AGENT_REQUEST_FORWARDING);
337 translate(SSH1_SMSG_AGENT_OPEN);
338 translate(SSH1_MSG_IGNORE);
339 translate(SSH1_CMSG_EXIT_CONFIRMATION);
340 translate(SSH1_CMSG_X11_REQUEST_FORWARDING);
341 translate(SSH1_CMSG_AUTH_RHOSTS_RSA);
342 translate(SSH1_MSG_DEBUG);
343 translate(SSH1_CMSG_REQUEST_COMPRESSION);
344 translate(SSH1_CMSG_AUTH_TIS);
345 translate(SSH1_SMSG_AUTH_TIS_CHALLENGE);
346 translate(SSH1_CMSG_AUTH_TIS_RESPONSE);
347 translate(SSH1_CMSG_AUTH_CCARD);
348 translate(SSH1_SMSG_AUTH_CCARD_CHALLENGE);
349 translate(SSH1_CMSG_AUTH_CCARD_RESPONSE);
350 return "unknown";
351}
acab36bc 352static char *ssh2_pkt_type(Pkt_KCtx pkt_kctx, Pkt_ACtx pkt_actx, int type)
00db133f 353{
42af6a67 354 translatea(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE,SSH2_PKTCTX_GSSAPI);
355 translatea(SSH2_MSG_USERAUTH_GSSAPI_TOKEN,SSH2_PKTCTX_GSSAPI);
356 translatea(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,SSH2_PKTCTX_GSSAPI);
357 translatea(SSH2_MSG_USERAUTH_GSSAPI_ERROR,SSH2_PKTCTX_GSSAPI);
358 translatea(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK,SSH2_PKTCTX_GSSAPI);
359 translatea(SSH2_MSG_USERAUTH_GSSAPI_MIC, SSH2_PKTCTX_GSSAPI);
00db133f 360 translate(SSH2_MSG_DISCONNECT);
361 translate(SSH2_MSG_IGNORE);
362 translate(SSH2_MSG_UNIMPLEMENTED);
363 translate(SSH2_MSG_DEBUG);
364 translate(SSH2_MSG_SERVICE_REQUEST);
365 translate(SSH2_MSG_SERVICE_ACCEPT);
366 translate(SSH2_MSG_KEXINIT);
367 translate(SSH2_MSG_NEWKEYS);
acab36bc 368 translatek(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP);
369 translatek(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP);
370 translatek(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX);
371 translatek(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX);
372 translatek(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX);
373 translatek(SSH2_MSG_KEX_DH_GEX_REPLY, SSH2_PKTCTX_DHGEX);
374 translatek(SSH2_MSG_KEXRSA_PUBKEY, SSH2_PKTCTX_RSAKEX);
375 translatek(SSH2_MSG_KEXRSA_SECRET, SSH2_PKTCTX_RSAKEX);
376 translatek(SSH2_MSG_KEXRSA_DONE, SSH2_PKTCTX_RSAKEX);
00db133f 377 translate(SSH2_MSG_USERAUTH_REQUEST);
378 translate(SSH2_MSG_USERAUTH_FAILURE);
379 translate(SSH2_MSG_USERAUTH_SUCCESS);
380 translate(SSH2_MSG_USERAUTH_BANNER);
acab36bc 381 translatea(SSH2_MSG_USERAUTH_PK_OK, SSH2_PKTCTX_PUBLICKEY);
382 translatea(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, SSH2_PKTCTX_PASSWORD);
383 translatea(SSH2_MSG_USERAUTH_INFO_REQUEST, SSH2_PKTCTX_KBDINTER);
384 translatea(SSH2_MSG_USERAUTH_INFO_RESPONSE, SSH2_PKTCTX_KBDINTER);
00db133f 385 translate(SSH2_MSG_GLOBAL_REQUEST);
386 translate(SSH2_MSG_REQUEST_SUCCESS);
387 translate(SSH2_MSG_REQUEST_FAILURE);
388 translate(SSH2_MSG_CHANNEL_OPEN);
389 translate(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
390 translate(SSH2_MSG_CHANNEL_OPEN_FAILURE);
391 translate(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
392 translate(SSH2_MSG_CHANNEL_DATA);
393 translate(SSH2_MSG_CHANNEL_EXTENDED_DATA);
394 translate(SSH2_MSG_CHANNEL_EOF);
395 translate(SSH2_MSG_CHANNEL_CLOSE);
396 translate(SSH2_MSG_CHANNEL_REQUEST);
397 translate(SSH2_MSG_CHANNEL_SUCCESS);
398 translate(SSH2_MSG_CHANNEL_FAILURE);
399 return "unknown";
400}
401#undef translate
402#undef translatec
7d503c31 403
9a10ecf4 404/* Enumeration values for fields in SSH-1 packets */
405enum {
406 PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM,
407 /* These values are for communicating relevant semantics of
408 * fields to the packet logging code. */
409 PKTT_OTHER, PKTT_PASSWORD, PKTT_DATA
410};
972a41c8 411
acddebd9 412/*
413 * Coroutine mechanics for the sillier bits of the code. If these
414 * macros look impenetrable to you, you might find it helpful to
415 * read
416 *
417 * http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html
418 *
419 * which explains the theory behind these macros.
b624d1e6 420 *
421 * In particular, if you are getting `case expression not constant'
422 * errors when building with MS Visual Studio, this is because MS's
423 * Edit and Continue debugging feature causes their compiler to
424 * violate ANSI C. To disable Edit and Continue debugging:
425 *
426 * - right-click ssh.c in the FileView
427 * - click Settings
428 * - select the C/C++ tab and the General category
429 * - under `Debug info:', select anything _other_ than `Program
430 * Database for Edit and Continue'.
acddebd9 431 */
51470298 432#define crBegin(v) { int *crLine = &v; switch(v) { case 0:;
433#define crState(t) \
434 struct t *s; \
3d88e64d 435 if (!ssh->t) ssh->t = snew(struct t); \
51470298 436 s = ssh->t;
437#define crFinish(z) } *crLine = 0; return (z); }
438#define crFinishV } *crLine = 0; return; }
374330e2 439#define crReturn(z) \
440 do {\
51470298 441 *crLine =__LINE__; return (z); case __LINE__:;\
374330e2 442 } while (0)
443#define crReturnV \
444 do {\
51470298 445 *crLine=__LINE__; return; case __LINE__:;\
374330e2 446 } while (0)
51470298 447#define crStop(z) do{ *crLine = 0; return (z); }while(0)
448#define crStopV do{ *crLine = 0; return; }while(0)
fb09bf1c 449#define crWaitUntil(c) do { crReturn(0); } while (!(c))
7cca0d81 450#define crWaitUntilV(c) do { crReturnV; } while (!(c))
374330e2 451
51470298 452typedef struct ssh_tag *Ssh;
ff3187f6 453struct Packet;
454
dacd8872 455static struct Packet *ssh1_pkt_init(int pkt_type);
ff3187f6 456static struct Packet *ssh2_pkt_init(int pkt_type);
dacd8872 457static void ssh_pkt_ensure(struct Packet *, int length);
458static void ssh_pkt_adddata(struct Packet *, void *data, int len);
459static void ssh_pkt_addbyte(struct Packet *, unsigned char value);
ff3187f6 460static void ssh2_pkt_addbool(struct Packet *, unsigned char value);
dacd8872 461static void ssh_pkt_adduint32(struct Packet *, unsigned long value);
462static void ssh_pkt_addstring_start(struct Packet *);
463static void ssh_pkt_addstring_str(struct Packet *, char *data);
464static void ssh_pkt_addstring_data(struct Packet *, char *data, int len);
465static void ssh_pkt_addstring(struct Packet *, char *data);
d8baa528 466static unsigned char *ssh2_mpint_fmt(Bignum b, int *len);
dacd8872 467static void ssh1_pkt_addmp(struct Packet *, Bignum b);
ff3187f6 468static void ssh2_pkt_addmp(struct Packet *, Bignum b);
469static int ssh2_pkt_construct(Ssh, struct Packet *);
470static void ssh2_pkt_send(Ssh, struct Packet *);
590f6a5f 471static void ssh2_pkt_send_noqueue(Ssh, struct Packet *);
ff3187f6 472static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
473 struct Packet *pktin);
474static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
475 struct Packet *pktin);
3d63ca2e 476
5471d09a 477/*
478 * Buffer management constants. There are several of these for
479 * various different purposes:
480 *
481 * - SSH1_BUFFER_LIMIT is the amount of backlog that must build up
482 * on a local data stream before we throttle the whole SSH
2e85c969 483 * connection (in SSH-1 only). Throttling the whole connection is
5471d09a 484 * pretty drastic so we set this high in the hope it won't
485 * happen very often.
486 *
487 * - SSH_MAX_BACKLOG is the amount of backlog that must build up
488 * on the SSH connection itself before we defensively throttle
489 * _all_ local data streams. This is pretty drastic too (though
2e85c969 490 * thankfully unlikely in SSH-2 since the window mechanism should
5471d09a 491 * ensure that the server never has any need to throttle its end
492 * of the connection), so we set this high as well.
493 *
2e85c969 494 * - OUR_V2_WINSIZE is the maximum window size we present on SSH-2
5471d09a 495 * channels.
9b53e9b8 496 *
497 * - OUR_V2_BIGWIN is the window size we advertise for the only
3361b80a 498 * channel in a simple connection. It must be <= INT_MAX.
9916cc1e 499 *
500 * - OUR_V2_MAXPKT is the official "maximum packet size" we send
501 * to the remote side. This actually has nothing to do with the
502 * size of the _packet_, but is instead a limit on the amount
503 * of data we're willing to receive in a single SSH2 channel
504 * data message.
505 *
506 * - OUR_V2_PACKETLIMIT is actually the maximum size of SSH
507 * _packet_ we're prepared to cope with. It must be a multiple
508 * of the cipher block size, and must be at least 35000.
5471d09a 509 */
510
511#define SSH1_BUFFER_LIMIT 32768
512#define SSH_MAX_BACKLOG 32768
513#define OUR_V2_WINSIZE 16384
3361b80a 514#define OUR_V2_BIGWIN 0x7fffffff
954d5c5a 515#define OUR_V2_MAXPKT 0x4000UL
9916cc1e 516#define OUR_V2_PACKETLIMIT 0x9000UL
d74d141c 517
edd0cb8a 518/* Maximum length of passwords/passphrases (arbitrary) */
519#define SSH_MAX_PASSWORD_LEN 100
520
85cc02bb 521const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss };
e5574168 522
8b2715b2 523const static struct ssh_mac *macs[] = {
6668a75e 524 &ssh_hmac_sha1, &ssh_hmac_sha1_96, &ssh_hmac_md5
32874aea 525};
8b2715b2 526const static struct ssh_mac *buggymacs[] = {
6668a75e 527 &ssh_hmac_sha1_buggy, &ssh_hmac_sha1_96_buggy, &ssh_hmac_md5
32874aea 528};
e5574168 529
5366aed8 530static void *ssh_comp_none_init(void)
531{
532 return NULL;
533}
534static void ssh_comp_none_cleanup(void *handle)
32874aea 535{
536}
5366aed8 537static int ssh_comp_none_block(void *handle, unsigned char *block, int len,
32874aea 538 unsigned char **outblock, int *outlen)
539{
540 return 0;
541}
5366aed8 542static int ssh_comp_none_disable(void *handle)
32874aea 543{
4ba9b64b 544 return 0;
545}
57476f6b 546const static struct ssh_compress ssh_comp_none = {
ab18ccff 547 "none", NULL,
5366aed8 548 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
549 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
550 ssh_comp_none_disable, NULL
e5574168 551};
4ba9b64b 552extern const struct ssh_compress ssh_zlib;
553const static struct ssh_compress *compressions[] = {
32874aea 554 &ssh_zlib, &ssh_comp_none
555};
374330e2 556
32874aea 557enum { /* channel types */
783415f8 558 CHAN_MAINSESSION,
559 CHAN_X11,
560 CHAN_AGENT,
bc240b21 561 CHAN_SOCKDATA,
562 CHAN_SOCKDATA_DORMANT /* one the remote hasn't confirmed */
783415f8 563};
564
dacbd0e8 565/*
0e443c99 566 * little structure to keep track of outstanding WINDOW_ADJUSTs
567 */
568struct winadj {
569 struct winadj *next;
570 unsigned size;
571};
572
573/*
dacbd0e8 574 * 2-3-4 tree storing channels.
575 */
576struct ssh_channel {
51470298 577 Ssh ssh; /* pointer back to main context */
d211621f 578 unsigned remoteid, localid;
dacbd0e8 579 int type;
64d6ff88 580 /* True if we opened this channel but server hasn't confirmed. */
581 int halfopen;
0357890f 582 /*
2e85c969 583 * In SSH-1, this value contains four bits:
0357890f 584 *
585 * 1 We have sent SSH1_MSG_CHANNEL_CLOSE.
586 * 2 We have sent SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
587 * 4 We have received SSH1_MSG_CHANNEL_CLOSE.
588 * 8 We have received SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
589 *
590 * A channel is completely finished with when all four bits are set.
591 */
dacbd0e8 592 int closes;
78280721 593
594 /*
595 * This flag indicates that a close is pending on the outgoing
596 * side of the channel: that is, wherever we're getting the data
597 * for this channel has sent us some data followed by EOF. We
598 * can't actually close the channel until we've finished sending
599 * the data, so we set this flag instead to remind us to
600 * initiate the closing process once our buffer is clear.
601 */
602 int pending_close;
603
ff68564b 604 /*
605 * True if this channel is causing the underlying connection to be
606 * throttled.
607 */
608 int throttling_conn;
5471d09a 609 union {
5471d09a 610 struct ssh2_data_channel {
611 bufchain outbuffer;
612 unsigned remwindow, remmaxpkt;
467e064d 613 /* locwindow is signed so we can cope with excess data. */
9b53e9b8 614 int locwindow, locmaxwin;
0e443c99 615 /*
616 * remlocwin is the amount of local window that we think
617 * the remote end had available to it after it sent the
618 * last data packet or window adjust ack.
619 */
620 int remlocwin;
621 /*
622 * These store the list of window adjusts that haven't
623 * been acked.
624 */
625 struct winadj *winadj_head, *winadj_tail;
626 enum { THROTTLED, UNTHROTTLING, UNTHROTTLED } throttle_state;
5471d09a 627 } v2;
628 } v;
dacbd0e8 629 union {
32874aea 630 struct ssh_agent_channel {
631 unsigned char *message;
632 unsigned char msglen[4];
a03c9f9c 633 unsigned lensofar, totallen;
32874aea 634 } a;
635 struct ssh_x11_channel {
636 Socket s;
637 } x11;
d74d141c 638 struct ssh_pfd_channel {
639 Socket s;
640 } pfd;
dacbd0e8 641 } u;
642};
57476f6b 643
d74d141c 644/*
2e85c969 645 * 2-3-4 tree storing remote->local port forwardings. SSH-1 and SSH-2
646 * use this structure in different ways, reflecting SSH-2's
bc240b21 647 * altogether saner approach to port forwarding.
648 *
2e85c969 649 * In SSH-1, you arrange a remote forwarding by sending the server
bc240b21 650 * the remote port number, and the local destination host:port.
651 * When a connection comes in, the server sends you back that
652 * host:port pair, and you connect to it. This is a ready-made
653 * security hole if you're not on the ball: a malicious server
654 * could send you back _any_ host:port pair, so if you trustingly
655 * connect to the address it gives you then you've just opened the
656 * entire inside of your corporate network just by connecting
657 * through it to a dodgy SSH server. Hence, we must store a list of
658 * host:port pairs we _are_ trying to forward to, and reject a
659 * connection request from the server if it's not in the list.
660 *
2e85c969 661 * In SSH-2, each side of the connection minds its own business and
bc240b21 662 * doesn't send unnecessary information to the other. You arrange a
663 * remote forwarding by sending the server just the remote port
664 * number. When a connection comes in, the server tells you which
665 * of its ports was connected to; and _you_ have to remember what
666 * local host:port pair went with that port number.
667 *
2e85c969 668 * Hence, in SSH-1 this structure is indexed by destination
669 * host:port pair, whereas in SSH-2 it is indexed by source port.
d74d141c 670 */
fda2feb1 671struct ssh_portfwd; /* forward declaration */
672
d74d141c 673struct ssh_rportfwd {
bc240b21 674 unsigned sport, dport;
675 char dhost[256];
06fadff5 676 char *sportdesc;
fda2feb1 677 struct ssh_portfwd *pfrec;
d74d141c 678};
fda2feb1 679#define free_rportfwd(pf) ( \
680 ((pf) ? (sfree((pf)->sportdesc)) : (void)0 ), sfree(pf) )
681
682/*
683 * Separately to the rportfwd tree (which is for looking up port
684 * open requests from the server), a tree of _these_ structures is
685 * used to keep track of all the currently open port forwardings,
686 * so that we can reconfigure in mid-session if the user requests
687 * it.
688 */
689struct ssh_portfwd {
84328ddb 690 enum { DESTROY, KEEP, CREATE } status;
fda2feb1 691 int type;
692 unsigned sport, dport;
693 char *saddr, *daddr;
3fe92132 694 char *sserv, *dserv;
fda2feb1 695 struct ssh_rportfwd *remote;
05581745 696 int addressfamily;
fda2feb1 697 void *local;
698};
699#define free_portfwd(pf) ( \
3fe92132 700 ((pf) ? (sfree((pf)->saddr), sfree((pf)->daddr), \
701 sfree((pf)->sserv), sfree((pf)->dserv)) : (void)0 ), sfree(pf) )
d74d141c 702
57476f6b 703struct Packet {
dacd8872 704 long length; /* length of `data' actually used */
705 long forcepad; /* SSH-2: force padding to at least this length */
706 int type; /* only used for incoming packets */
707 unsigned long sequence; /* SSH-2 incoming sequence number */
708 unsigned char *data; /* allocated storage */
709 unsigned char *body; /* offset of payload within `data' */
710 long savedpos; /* temporary index into `data' (for strings) */
711 long maxlen; /* amount of storage allocated for `data' */
712 long encrypted_len; /* for SSH-2 total-size counting */
ff3187f6 713
714 /*
715 * State associated with packet logging
716 */
717 int logmode;
718 int nblanks;
719 struct logblank_t *blanks;
57476f6b 720};
721
1c1a7262 722static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
ff3187f6 723 struct Packet *pktin);
1c1a7262 724static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
ff3187f6 725 struct Packet *pktin);
b09eaa88 726static void ssh1_protocol_setup(Ssh ssh);
727static void ssh2_protocol_setup(Ssh ssh);
51470298 728static void ssh_size(void *handle, int width, int height);
729static void ssh_special(void *handle, Telnet_Special);
5471d09a 730static int ssh2_try_send(struct ssh_channel *c);
51470298 731static void ssh2_add_channel_data(struct ssh_channel *c, char *buf, int len);
732static void ssh_throttle_all(Ssh ssh, int enable, int bufsize);
9fca3f8c 733static void ssh2_set_window(struct ssh_channel *c, int newwin);
51470298 734static int ssh_sendbuffer(void *handle);
ac934965 735static int ssh_do_close(Ssh ssh, int notify_exit);
ff3187f6 736static unsigned long ssh_pkt_getuint32(struct Packet *pkt);
737static int ssh2_pkt_getbool(struct Packet *pkt);
738static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length);
9442dd57 739static void ssh2_timer(void *ctx, long now);
1c1a7262 740static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
9442dd57 741 struct Packet *pktin);
57476f6b 742
51470298 743struct rdpkt1_state_tag {
57476f6b 744 long len, pad, biglen, to_read;
745 unsigned long realcrc, gotcrc;
746 unsigned char *p;
747 int i;
748 int chunk;
ff3187f6 749 struct Packet *pktin;
51470298 750};
57476f6b 751
51470298 752struct rdpkt2_state_tag {
960e736a 753 long len, pad, payload, packetlen, maclen;
754 int i;
755 int cipherblk;
756 unsigned long incoming_sequence;
ff3187f6 757 struct Packet *pktin;
51470298 758};
759
b09eaa88 760typedef void (*handler_fn_t)(Ssh ssh, struct Packet *pktin);
06fadff5 761typedef void (*chandler_fn_t)(Ssh ssh, struct Packet *pktin, void *ctx);
762
763struct queued_handler;
764struct queued_handler {
765 int msg1, msg2;
766 chandler_fn_t handler;
767 void *ctx;
768 struct queued_handler *next;
769};
b09eaa88 770
51470298 771struct ssh_tag {
772 const struct plug_function_table *fn;
773 /* the above field _must_ be first in the structure */
774
4320baf7 775 char *v_c, *v_s;
b672f405 776 void *exhash;
51470298 777
778 Socket s;
779
b9d7bcad 780 void *ldisc;
a8327734 781 void *logctx;
b9d7bcad 782
51470298 783 unsigned char session_key[32];
784 int v1_compressing;
785 int v1_remote_protoflags;
786 int v1_local_protoflags;
787 int agentfwd_enabled;
788 int X11_fwd_enabled;
789 int remote_bugs;
790 const struct ssh_cipher *cipher;
371e569c 791 void *v1_cipher_ctx;
0183b242 792 void *crcda_ctx;
51470298 793 const struct ssh2_cipher *cscipher, *sccipher;
371e569c 794 void *cs_cipher_ctx, *sc_cipher_ctx;
51470298 795 const struct ssh_mac *csmac, *scmac;
e0e1a00d 796 void *cs_mac_ctx, *sc_mac_ctx;
51470298 797 const struct ssh_compress *cscomp, *sccomp;
5366aed8 798 void *cs_comp_ctx, *sc_comp_ctx;
51470298 799 const struct ssh_kex *kex;
800 const struct ssh_signkey *hostkey;
754c0df9 801 unsigned char v2_session_id[SSH2_KEX_MAX_HASH_LEN];
b672f405 802 int v2_session_id_len;
27cd7fc2 803 void *kex_ctx;
51470298 804
805 char *savedhost;
806 int savedport;
807 int send_ok;
808 int echoing, editing;
809
810 void *frontend;
811
db219738 812 int ospeed, ispeed; /* temporaries */
51470298 813 int term_width, term_height;
814
815 tree234 *channels; /* indexed by local id */
816 struct ssh_channel *mainchan; /* primary session channel */
feb02b4e 817 int ncmode; /* is primary channel direct-tcpip? */
51470298 818 int exitcode;
ac934965 819 int close_expected;
9e296bfa 820 int clean_exit;
51470298 821
fda2feb1 822 tree234 *rportfwds, *portfwds;
51470298 823
824 enum {
825 SSH_STATE_PREPACKET,
826 SSH_STATE_BEFORE_SIZE,
827 SSH_STATE_INTERMED,
828 SSH_STATE_SESSION,
829 SSH_STATE_CLOSED
830 } state;
831
832 int size_needed, eof_needed;
833
590f6a5f 834 struct Packet **queue;
835 int queuelen, queuesize;
836 int queueing;
51470298 837 unsigned char *deferred_send_data;
838 int deferred_len, deferred_size;
839
840 /*
841 * Gross hack: pscp will try to start SFTP but fall back to
842 * scp1 if that fails. This variable is the means by which
843 * scp.c can reach into the SSH code and find out which one it
844 * got.
845 */
846 int fallback_cmd;
847
6bbce591 848 bufchain banner; /* accumulates banners during do_ssh2_authconn */
51470298 849
acab36bc 850 Pkt_KCtx pkt_kctx;
851 Pkt_ACtx pkt_actx;
51470298 852
8def70c3 853 struct X11Display *x11disp;
302121de 854
51470298 855 int version;
ff68564b 856 int conn_throttle_count;
51470298 857 int overall_bufsize;
858 int throttled_all;
859 int v1_stdout_throttling;
a8756193 860 unsigned long v2_outgoing_sequence;
51470298 861
862 int ssh1_rdpkt_crstate;
863 int ssh2_rdpkt_crstate;
864 int do_ssh_init_crstate;
865 int ssh_gotdata_crstate;
51470298 866 int do_ssh1_login_crstate;
b09eaa88 867 int do_ssh1_connection_crstate;
51470298 868 int do_ssh2_transport_crstate;
869 int do_ssh2_authconn_crstate;
870
871 void *do_ssh_init_state;
872 void *do_ssh1_login_state;
873 void *do_ssh2_transport_state;
874 void *do_ssh2_authconn_state;
875
876 struct rdpkt1_state_tag rdpkt1_state;
877 struct rdpkt2_state_tag rdpkt2_state;
878
2e85c969 879 /* SSH-1 and SSH-2 use this for different things, but both use it */
b09eaa88 880 int protocol_initial_phase_done;
881
1c1a7262 882 void (*protocol) (Ssh ssh, void *vin, int inlen,
ff3187f6 883 struct Packet *pkt);
884 struct Packet *(*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen);
86916870 885
886 /*
887 * We maintain a full _copy_ of a Config structure here, not
888 * merely a pointer to it. That way, when we're passed a new
889 * one for reconfiguration, we can check the differences and
890 * potentially reconfigure port forwardings etc in mid-session.
891 */
892 Config cfg;
839f10db 893
894 /*
3d9449a1 895 * Used to transfer data back from async callbacks.
839f10db 896 */
897 void *agent_response;
898 int agent_response_len;
3d9449a1 899 int user_response;
900
901 /*
902 * The SSH connection can be set as `frozen', meaning we are
903 * not currently accepting incoming data from the network. This
904 * is slightly more serious than setting the _socket_ as
905 * frozen, because we may already have had data passed to us
906 * from the network which we need to delay processing until
907 * after the freeze is lifted, so we also need a bufchain to
908 * store that data.
909 */
910 int frozen;
911 bufchain queued_incoming_data;
b09eaa88 912
913 /*
914 * Dispatch table for packet types that we may have to deal
915 * with at any time.
916 */
917 handler_fn_t packet_dispatch[256];
39934deb 918
919 /*
06fadff5 920 * Queues of one-off handler functions for success/failure
921 * indications from a request.
922 */
923 struct queued_handler *qhead, *qtail;
924
925 /*
39934deb 926 * This module deals with sending keepalives.
927 */
928 Pinger pinger;
9442dd57 929
930 /*
931 * Track incoming and outgoing data sizes and time, for
932 * size-based rekeys.
933 */
934 unsigned long incoming_data_size, outgoing_data_size, deferred_data_size;
d57f70af 935 unsigned long max_data_size;
9442dd57 936 int kex_in_progress;
e6c1536e 937 long next_rekey, last_rekey;
e13bba36 938 char *deferred_rekey_reason; /* points to STATIC string; don't free */
42af6a67 939
940 /*
941 * Fully qualified host name, which we need if doing GSSAPI.
942 */
943 char *fullhostname;
1e00c92b 944
945#ifndef NO_GSSAPI
946 /*
947 * GSSAPI libraries for this session.
948 */
949 struct ssh_gss_liblist *gsslibs;
950#endif
51470298 951};
960e736a 952
382908ad 953#define logevent(s) logevent(ssh->frontend, s)
a8327734 954
955/* logevent, only printf-formatted. */
cbe2d68f 956static void logeventf(Ssh ssh, const char *fmt, ...)
a8327734 957{
958 va_list ap;
57356d63 959 char *buf;
a8327734 960
961 va_start(ap, fmt);
57356d63 962 buf = dupvprintf(fmt, ap);
a8327734 963 va_end(ap);
57356d63 964 logevent(buf);
57356d63 965 sfree(buf);
a8327734 966}
967
6b5cf8b4 968#define bombout(msg) \
969 do { \
970 char *text = dupprintf msg; \
ac934965 971 ssh_do_close(ssh, FALSE); \
6b5cf8b4 972 logevent(text); \
973 connection_fatal(ssh->frontend, "%s", text); \
974 sfree(text); \
975 } while (0)
a8327734 976
9a10ecf4 977/* Functions to leave bits out of the SSH packet log file. */
978
ff3187f6 979static void dont_log_password(Ssh ssh, struct Packet *pkt, int blanktype)
9a10ecf4 980{
981 if (ssh->cfg.logomitpass)
ff3187f6 982 pkt->logmode = blanktype;
9a10ecf4 983}
984
ff3187f6 985static void dont_log_data(Ssh ssh, struct Packet *pkt, int blanktype)
9a10ecf4 986{
987 if (ssh->cfg.logomitdata)
ff3187f6 988 pkt->logmode = blanktype;
9a10ecf4 989}
990
ff3187f6 991static void end_log_omission(Ssh ssh, struct Packet *pkt)
9a10ecf4 992{
ff3187f6 993 pkt->logmode = PKTLOG_EMIT;
9a10ecf4 994}
995
c6ccd5c2 996/* Helper function for common bits of parsing cfg.ttymodes. */
997static void parse_ttymodes(Ssh ssh, char *modes,
998 void (*do_mode)(void *data, char *mode, char *val),
999 void *data)
1000{
1001 while (*modes) {
1002 char *t = strchr(modes, '\t');
1003 char *m = snewn(t-modes+1, char);
1004 char *val;
1005 strncpy(m, modes, t-modes);
1006 m[t-modes] = '\0';
1007 if (*(t+1) == 'A')
1008 val = get_ttymode(ssh->frontend, m);
1009 else
1010 val = dupstr(t+2);
1011 if (val)
1012 do_mode(data, m, val);
1013 sfree(m);
1014 sfree(val);
1015 modes += strlen(modes) + 1;
1016 }
1017}
1018
32874aea 1019static int ssh_channelcmp(void *av, void *bv)
1020{
1021 struct ssh_channel *a = (struct ssh_channel *) av;
1022 struct ssh_channel *b = (struct ssh_channel *) bv;
1023 if (a->localid < b->localid)
1024 return -1;
1025 if (a->localid > b->localid)
1026 return +1;
dacbd0e8 1027 return 0;
1028}
32874aea 1029static int ssh_channelfind(void *av, void *bv)
1030{
1031 unsigned *a = (unsigned *) av;
1032 struct ssh_channel *b = (struct ssh_channel *) bv;
1033 if (*a < b->localid)
1034 return -1;
1035 if (*a > b->localid)
1036 return +1;
dacbd0e8 1037 return 0;
1038}
1039
bc240b21 1040static int ssh_rportcmp_ssh1(void *av, void *bv)
d74d141c 1041{
1042 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
1043 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
1044 int i;
bc240b21 1045 if ( (i = strcmp(a->dhost, b->dhost)) != 0)
d74d141c 1046 return i < 0 ? -1 : +1;
bc240b21 1047 if (a->dport > b->dport)
1048 return +1;
1049 if (a->dport < b->dport)
1050 return -1;
1051 return 0;
1052}
1053
1054static int ssh_rportcmp_ssh2(void *av, void *bv)
1055{
1056 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
1057 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
cdcbdf3b 1058
bc240b21 1059 if (a->sport > b->sport)
d74d141c 1060 return +1;
bc240b21 1061 if (a->sport < b->sport)
1062 return -1;
d74d141c 1063 return 0;
1064}
1065
fda2feb1 1066/*
1067 * Special form of strcmp which can cope with NULL inputs. NULL is
1068 * defined to sort before even the empty string.
1069 */
1070static int nullstrcmp(const char *a, const char *b)
1071{
1072 if (a == NULL && b == NULL)
1073 return 0;
1074 if (a == NULL)
1075 return -1;
1076 if (b == NULL)
1077 return +1;
1078 return strcmp(a, b);
1079}
1080
1081static int ssh_portcmp(void *av, void *bv)
1082{
1083 struct ssh_portfwd *a = (struct ssh_portfwd *) av;
1084 struct ssh_portfwd *b = (struct ssh_portfwd *) bv;
1085 int i;
1086 if (a->type > b->type)
1087 return +1;
1088 if (a->type < b->type)
1089 return -1;
84328ddb 1090 if (a->addressfamily > b->addressfamily)
1091 return +1;
1092 if (a->addressfamily < b->addressfamily)
1093 return -1;
fda2feb1 1094 if ( (i = nullstrcmp(a->saddr, b->saddr)) != 0)
1095 return i < 0 ? -1 : +1;
1096 if (a->sport > b->sport)
1097 return +1;
1098 if (a->sport < b->sport)
1099 return -1;
1100 if (a->type != 'D') {
1101 if ( (i = nullstrcmp(a->daddr, b->daddr)) != 0)
1102 return i < 0 ? -1 : +1;
1103 if (a->dport > b->dport)
1104 return +1;
1105 if (a->dport < b->dport)
1106 return -1;
1107 }
1108 return 0;
1109}
1110
51470298 1111static int alloc_channel_id(Ssh ssh)
32874aea 1112{
260f3dec 1113 const unsigned CHANNEL_NUMBER_OFFSET = 256;
1114 unsigned low, high, mid;
d2371c81 1115 int tsize;
1116 struct ssh_channel *c;
1117
1118 /*
1119 * First-fit allocation of channel numbers: always pick the
1120 * lowest unused one. To do this, binary-search using the
1121 * counted B-tree to find the largest channel ID which is in a
1122 * contiguous sequence from the beginning. (Precisely
1123 * everything in that sequence must have ID equal to its tree
1124 * index plus CHANNEL_NUMBER_OFFSET.)
1125 */
51470298 1126 tsize = count234(ssh->channels);
d2371c81 1127
32874aea 1128 low = -1;
1129 high = tsize;
d2371c81 1130 while (high - low > 1) {
1131 mid = (high + low) / 2;
51470298 1132 c = index234(ssh->channels, mid);
d2371c81 1133 if (c->localid == mid + CHANNEL_NUMBER_OFFSET)
1134 low = mid; /* this one is fine */
1135 else
1136 high = mid; /* this one is past it */
1137 }
1138 /*
1139 * Now low points to either -1, or the tree index of the
1140 * largest ID in the initial sequence.
1141 */
1142 {
1143 unsigned i = low + 1 + CHANNEL_NUMBER_OFFSET;
51470298 1144 assert(NULL == find234(ssh->channels, &i, ssh_channelfind));
d2371c81 1145 }
1146 return low + 1 + CHANNEL_NUMBER_OFFSET;
1147}
1148
edd0cb8a 1149static void c_write_stderr(int trusted, const char *buf, int len)
1150{
1151 int i;
1152 for (i = 0; i < len; i++)
667deca9 1153 if (buf[i] != '\r' && (trusted || buf[i] == '\n' || (buf[i] & 0x60)))
edd0cb8a 1154 fputc(buf[i], stderr);
1155}
1156
9fab77dc 1157static void c_write(Ssh ssh, const char *buf, int len)
32874aea 1158{
edd0cb8a 1159 if (flags & FLAG_STDERR)
1160 c_write_stderr(1, buf, len);
1161 else
1162 from_backend(ssh->frontend, 1, buf, len);
3bdaf79d 1163}
1164
9fab77dc 1165static void c_write_untrusted(Ssh ssh, const char *buf, int len)
32874aea 1166{
edd0cb8a 1167 if (flags & FLAG_STDERR)
1168 c_write_stderr(0, buf, len);
1169 else
1170 from_backend_untrusted(ssh->frontend, buf, len);
a209e957 1171}
1172
9fab77dc 1173static void c_write_str(Ssh ssh, const char *buf)
32874aea 1174{
51470298 1175 c_write(ssh, buf, strlen(buf));
1408a877 1176}
1177
ff3187f6 1178static void ssh_free_packet(struct Packet *pkt)
1179{
1180 sfree(pkt->data);
1181 sfree(pkt);
1182}
1183static struct Packet *ssh_new_packet(void)
1184{
1185 struct Packet *pkt = snew(struct Packet);
1186
dacd8872 1187 pkt->body = pkt->data = NULL;
ff3187f6 1188 pkt->maxlen = 0;
1189 pkt->logmode = PKTLOG_EMIT;
1190 pkt->nblanks = 0;
1191 pkt->blanks = NULL;
1192
1193 return pkt;
1194}
1195
fb09bf1c 1196/*
1197 * Collect incoming data in the incoming packet buffer.
e5574168 1198 * Decipher and verify the packet when it is completely read.
1199 * Drop SSH1_MSG_DEBUG and SSH1_MSG_IGNORE packets.
fb09bf1c 1200 * Update the *data and *datalen variables.
ff3187f6 1201 * Return a Packet structure when a packet is completed.
fb09bf1c 1202 */
ff3187f6 1203static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
fb09bf1c 1204{
51470298 1205 struct rdpkt1_state_tag *st = &ssh->rdpkt1_state;
374330e2 1206
51470298 1207 crBegin(ssh->ssh1_rdpkt_crstate);
374330e2 1208
ff3187f6 1209 st->pktin = ssh_new_packet();
1210
1211 st->pktin->type = 0;
1212 st->pktin->length = 0;
374330e2 1213
57476f6b 1214 for (st->i = st->len = 0; st->i < 4; st->i++) {
fb09bf1c 1215 while ((*datalen) == 0)
ff3187f6 1216 crReturn(NULL);
57476f6b 1217 st->len = (st->len << 8) + **data;
fb09bf1c 1218 (*data)++, (*datalen)--;
1219 }
374330e2 1220
57476f6b 1221 st->pad = 8 - (st->len % 8);
1222 st->biglen = st->len + st->pad;
ff3187f6 1223 st->pktin->length = st->len - 5;
fb09bf1c 1224
ae0500e5 1225 if (st->biglen < 0) {
1226 bombout(("Extremely large packet length from server suggests"
1227 " data stream corruption"));
ff3187f6 1228 ssh_free_packet(st->pktin);
1229 crStop(NULL);
ae0500e5 1230 }
1231
ff3187f6 1232 st->pktin->maxlen = st->biglen;
1233 st->pktin->data = snewn(st->biglen + APIEXTRA, unsigned char);
374330e2 1234
57476f6b 1235 st->to_read = st->biglen;
ff3187f6 1236 st->p = st->pktin->data;
57476f6b 1237 while (st->to_read > 0) {
32874aea 1238 st->chunk = st->to_read;
fb09bf1c 1239 while ((*datalen) == 0)
ff3187f6 1240 crReturn(NULL);
57476f6b 1241 if (st->chunk > (*datalen))
1242 st->chunk = (*datalen);
1243 memcpy(st->p, *data, st->chunk);
1244 *data += st->chunk;
1245 *datalen -= st->chunk;
1246 st->p += st->chunk;
1247 st->to_read -= st->chunk;
fb09bf1c 1248 }
374330e2 1249
ff3187f6 1250 if (ssh->cipher && detect_attack(ssh->crcda_ctx, st->pktin->data,
0183b242 1251 st->biglen, NULL)) {
6b5cf8b4 1252 bombout(("Network attack (CRC compensation) detected!"));
ff3187f6 1253 ssh_free_packet(st->pktin);
1254 crStop(NULL);
9a3a93a5 1255 }
1256
51470298 1257 if (ssh->cipher)
ff3187f6 1258 ssh->cipher->decrypt(ssh->v1_cipher_ctx, st->pktin->data, st->biglen);
374330e2 1259
ff3187f6 1260 st->realcrc = crc32_compute(st->pktin->data, st->biglen - 4);
1261 st->gotcrc = GET_32BIT(st->pktin->data + st->biglen - 4);
57476f6b 1262 if (st->gotcrc != st->realcrc) {
6b5cf8b4 1263 bombout(("Incorrect CRC received on packet"));
ff3187f6 1264 ssh_free_packet(st->pktin);
1265 crStop(NULL);
fb09bf1c 1266 }
572f871e 1267
ff3187f6 1268 st->pktin->body = st->pktin->data + st->pad + 1;
1269 st->pktin->savedpos = 0;
4ba9b64b 1270
51470298 1271 if (ssh->v1_compressing) {
4ba9b64b 1272 unsigned char *decompblk;
1273 int decomplen;
36b8d9bb 1274 if (!zlib_decompress_block(ssh->sc_comp_ctx,
ff3187f6 1275 st->pktin->body - 1, st->pktin->length + 1,
36b8d9bb 1276 &decompblk, &decomplen)) {
1277 bombout(("Zlib decompression encountered invalid data"));
ff3187f6 1278 ssh_free_packet(st->pktin);
1279 crStop(NULL);
36b8d9bb 1280 }
4ba9b64b 1281
ff3187f6 1282 if (st->pktin->maxlen < st->pad + decomplen) {
1283 st->pktin->maxlen = st->pad + decomplen;
1284 st->pktin->data = sresize(st->pktin->data,
1285 st->pktin->maxlen + APIEXTRA,
3d88e64d 1286 unsigned char);
ff3187f6 1287 st->pktin->body = st->pktin->data + st->pad + 1;
4ba9b64b 1288 }
1289
ff3187f6 1290 memcpy(st->pktin->body - 1, decompblk, decomplen);
dcbde236 1291 sfree(decompblk);
ff3187f6 1292 st->pktin->length = decomplen - 1;
4ba9b64b 1293 }
1294
ff3187f6 1295 st->pktin->type = st->pktin->body[-1];
00db133f 1296
9a10ecf4 1297 /*
1298 * Log incoming packet, possibly omitting sensitive fields.
1299 */
1300 if (ssh->logctx) {
1301 int nblanks = 0;
1302 struct logblank_t blank;
1303 if (ssh->cfg.logomitdata) {
1304 int do_blank = FALSE, blank_prefix = 0;
1305 /* "Session data" packets - omit the data field */
ff3187f6 1306 if ((st->pktin->type == SSH1_SMSG_STDOUT_DATA) ||
1307 (st->pktin->type == SSH1_SMSG_STDERR_DATA)) {
9a10ecf4 1308 do_blank = TRUE; blank_prefix = 4;
a2724fba 1309 } else if (st->pktin->type == SSH1_MSG_CHANNEL_DATA) {
1310 do_blank = TRUE; blank_prefix = 8;
9a10ecf4 1311 }
1312 if (do_blank) {
1313 blank.offset = blank_prefix;
ff3187f6 1314 blank.len = st->pktin->length;
9a10ecf4 1315 blank.type = PKTLOG_OMIT;
1316 nblanks = 1;
1317 }
1318 }
a8327734 1319 log_packet(ssh->logctx,
ff3187f6 1320 PKT_INCOMING, st->pktin->type,
1321 ssh1_pkt_type(st->pktin->type),
1322 st->pktin->body, st->pktin->length,
0d13bfcd 1323 nblanks, &blank, NULL);
9a10ecf4 1324 }
00db133f 1325
ff3187f6 1326 crFinish(st->pktin);
fb09bf1c 1327}
1328
ff3187f6 1329static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
e5574168 1330{
51470298 1331 struct rdpkt2_state_tag *st = &ssh->rdpkt2_state;
e5574168 1332
51470298 1333 crBegin(ssh->ssh2_rdpkt_crstate);
e5574168 1334
ff3187f6 1335 st->pktin = ssh_new_packet();
1336
1337 st->pktin->type = 0;
1338 st->pktin->length = 0;
51470298 1339 if (ssh->sccipher)
1340 st->cipherblk = ssh->sccipher->blksize;
e5574168 1341 else
32874aea 1342 st->cipherblk = 8;
960e736a 1343 if (st->cipherblk < 8)
32874aea 1344 st->cipherblk = 8;
9916cc1e 1345 st->maclen = ssh->scmac ? ssh->scmac->len : 0;
960e736a 1346
9916cc1e 1347 if (ssh->sccipher && (ssh->sccipher->flags & SSH_CIPHER_IS_CBC) &&
1348 ssh->scmac) {
1349 /*
1350 * When dealing with a CBC-mode cipher, we want to avoid the
1351 * possibility of an attacker's tweaking the ciphertext stream
1352 * so as to cause us to feed the same block to the block
1353 * cipher more than once and thus leak information
1354 * (VU#958563). The way we do this is not to take any
1355 * decisions on the basis of anything we've decrypted until
1356 * we've verified it with a MAC. That includes the packet
1357 * length, so we just read data and check the MAC repeatedly,
1358 * and when the MAC passes, see if the length we've got is
1359 * plausible.
1360 */
1361
1362 /* May as well allocate the whole lot now. */
1363 st->pktin->data = snewn(OUR_V2_PACKETLIMIT + st->maclen + APIEXTRA,
1364 unsigned char);
1365
1366 /* Read an amount corresponding to the MAC. */
1367 for (st->i = 0; st->i < st->maclen; st->i++) {
1368 while ((*datalen) == 0)
1369 crReturn(NULL);
1370 st->pktin->data[st->i] = *(*data)++;
1371 (*datalen)--;
1372 }
e5574168 1373
9916cc1e 1374 st->packetlen = 0;
1375 {
1376 unsigned char seq[4];
1377 ssh->scmac->start(ssh->sc_mac_ctx);
1378 PUT_32BIT(seq, st->incoming_sequence);
1379 ssh->scmac->bytes(ssh->sc_mac_ctx, seq, 4);
1380 }
4252c9cc 1381
9916cc1e 1382 for (;;) { /* Once around this loop per cipher block. */
1383 /* Read another cipher-block's worth, and tack it onto the end. */
1384 for (st->i = 0; st->i < st->cipherblk; st->i++) {
1385 while ((*datalen) == 0)
1386 crReturn(NULL);
1387 st->pktin->data[st->packetlen+st->maclen+st->i] = *(*data)++;
1388 (*datalen)--;
1389 }
1390 /* Decrypt one more block (a little further back in the stream). */
1391 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1392 st->pktin->data + st->packetlen,
1393 st->cipherblk);
1394 /* Feed that block to the MAC. */
1395 ssh->scmac->bytes(ssh->sc_mac_ctx,
1396 st->pktin->data + st->packetlen, st->cipherblk);
1397 st->packetlen += st->cipherblk;
1398 /* See if that gives us a valid packet. */
1399 if (ssh->scmac->verresult(ssh->sc_mac_ctx,
1400 st->pktin->data + st->packetlen) &&
1401 (st->len = GET_32BIT(st->pktin->data)) + 4 == st->packetlen)
1402 break;
1403 if (st->packetlen >= OUR_V2_PACKETLIMIT) {
1404 bombout(("No valid incoming packet found"));
1405 ssh_free_packet(st->pktin);
1406 crStop(NULL);
1407 }
1408 }
1409 st->pktin->maxlen = st->packetlen + st->maclen;
1410 st->pktin->data = sresize(st->pktin->data,
1411 st->pktin->maxlen + APIEXTRA,
1412 unsigned char);
1413 } else {
1414 st->pktin->data = snewn(st->cipherblk + APIEXTRA, unsigned char);
1415
1416 /*
1417 * Acquire and decrypt the first block of the packet. This will
1418 * contain the length and padding details.
1419 */
1420 for (st->i = st->len = 0; st->i < st->cipherblk; st->i++) {
1421 while ((*datalen) == 0)
1422 crReturn(NULL);
1423 st->pktin->data[st->i] = *(*data)++;
1424 (*datalen)--;
1425 }
e5574168 1426
9916cc1e 1427 if (ssh->sccipher)
1428 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1429 st->pktin->data, st->cipherblk);
1430
1431 /*
1432 * Now get the length figure.
1433 */
1434 st->len = GET_32BIT(st->pktin->data);
1435
1436 /*
1437 * _Completely_ silly lengths should be stomped on before they
1438 * do us any more damage.
1439 */
1440 if (st->len < 0 || st->len > OUR_V2_PACKETLIMIT ||
1441 (st->len + 4) % st->cipherblk != 0) {
1442 bombout(("Incoming packet was garbled on decryption"));
1443 ssh_free_packet(st->pktin);
1444 crStop(NULL);
1445 }
e5574168 1446
9916cc1e 1447 /*
1448 * So now we can work out the total packet length.
1449 */
1450 st->packetlen = st->len + 4;
1451
1452 /*
1453 * Allocate memory for the rest of the packet.
1454 */
1455 st->pktin->maxlen = st->packetlen + st->maclen;
1456 st->pktin->data = sresize(st->pktin->data,
1457 st->pktin->maxlen + APIEXTRA,
1458 unsigned char);
1459
1460 /*
1461 * Read and decrypt the remainder of the packet.
1462 */
1463 for (st->i = st->cipherblk; st->i < st->packetlen + st->maclen;
1464 st->i++) {
1465 while ((*datalen) == 0)
1466 crReturn(NULL);
1467 st->pktin->data[st->i] = *(*data)++;
1468 (*datalen)--;
1469 }
1470 /* Decrypt everything _except_ the MAC. */
1471 if (ssh->sccipher)
1472 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1473 st->pktin->data + st->cipherblk,
1474 st->packetlen - st->cipherblk);
1475
1476 /*
1477 * Check the MAC.
1478 */
1479 if (ssh->scmac
1480 && !ssh->scmac->verify(ssh->sc_mac_ctx, st->pktin->data,
1481 st->len + 4, st->incoming_sequence)) {
1482 bombout(("Incorrect MAC received on packet"));
1483 ssh_free_packet(st->pktin);
1484 crStop(NULL);
1485 }
1486 }
1487 /* Get and sanity-check the amount of random padding. */
1488 st->pad = st->pktin->data[4];
1489 if (st->pad < 4 || st->len - st->pad < 1) {
1490 bombout(("Invalid padding length on received packet"));
ff3187f6 1491 ssh_free_packet(st->pktin);
1492 crStop(NULL);
717dc483 1493 }
717dc483 1494 /*
e5574168 1495 * This enables us to deduce the payload length.
1496 */
960e736a 1497 st->payload = st->len - st->pad - 1;
e5574168 1498
ff3187f6 1499 st->pktin->length = st->payload + 5;
9442dd57 1500 st->pktin->encrypted_len = st->packetlen;
1501
b09eaa88 1502 st->pktin->sequence = st->incoming_sequence++;
e5574168 1503
4ba9b64b 1504 /*
1505 * Decompress packet payload.
1506 */
1507 {
1508 unsigned char *newpayload;
1509 int newlen;
51470298 1510 if (ssh->sccomp &&
5366aed8 1511 ssh->sccomp->decompress(ssh->sc_comp_ctx,
ff3187f6 1512 st->pktin->data + 5, st->pktin->length - 5,
51470298 1513 &newpayload, &newlen)) {
ff3187f6 1514 if (st->pktin->maxlen < newlen + 5) {
1515 st->pktin->maxlen = newlen + 5;
1516 st->pktin->data = sresize(st->pktin->data,
1517 st->pktin->maxlen + APIEXTRA,
3d88e64d 1518 unsigned char);
4ba9b64b 1519 }
ff3187f6 1520 st->pktin->length = 5 + newlen;
1521 memcpy(st->pktin->data + 5, newpayload, newlen);
dcbde236 1522 sfree(newpayload);
4ba9b64b 1523 }
1524 }
1525
ff3187f6 1526 st->pktin->savedpos = 6;
1527 st->pktin->body = st->pktin->data;
1528 st->pktin->type = st->pktin->data[5];
e5574168 1529
9a10ecf4 1530 /*
1531 * Log incoming packet, possibly omitting sensitive fields.
1532 */
1533 if (ssh->logctx) {
1534 int nblanks = 0;
1535 struct logblank_t blank;
1536 if (ssh->cfg.logomitdata) {
1537 int do_blank = FALSE, blank_prefix = 0;
1538 /* "Session data" packets - omit the data field */
ff3187f6 1539 if (st->pktin->type == SSH2_MSG_CHANNEL_DATA) {
9a10ecf4 1540 do_blank = TRUE; blank_prefix = 8;
a2724fba 1541 } else if (st->pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA) {
1542 do_blank = TRUE; blank_prefix = 12;
9a10ecf4 1543 }
1544 if (do_blank) {
1545 blank.offset = blank_prefix;
ff3187f6 1546 blank.len = (st->pktin->length-6) - blank_prefix;
9a10ecf4 1547 blank.type = PKTLOG_OMIT;
1548 nblanks = 1;
1549 }
1550 }
ff3187f6 1551 log_packet(ssh->logctx, PKT_INCOMING, st->pktin->type,
acab36bc 1552 ssh2_pkt_type(ssh->pkt_kctx, ssh->pkt_actx,
1553 st->pktin->type),
ff3187f6 1554 st->pktin->data+6, st->pktin->length-6,
0d13bfcd 1555 nblanks, &blank, &st->pktin->sequence);
9a10ecf4 1556 }
00db133f 1557
ff3187f6 1558 crFinish(st->pktin);
e5574168 1559}
1560
dacd8872 1561static int s_wrpkt_prepare(Ssh ssh, struct Packet *pkt, int *offset_p)
32874aea 1562{
dacd8872 1563 int pad, biglen, i, pktoffs;
374330e2 1564 unsigned long crc;
fd7a4aad 1565#ifdef __SC__
1566 /*
1567 * XXX various versions of SC (including 8.8.4) screw up the
1568 * register allocation in this function and use the same register
1569 * (D6) for len and as a temporary, with predictable results. The
1570 * following sledgehammer prevents this.
1571 */
1572 volatile
1573#endif
1574 int len;
374330e2 1575
a8327734 1576 if (ssh->logctx)
dacd8872 1577 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[12],
1578 ssh1_pkt_type(pkt->data[12]),
1579 pkt->body, pkt->length - (pkt->body - pkt->data),
0d13bfcd 1580 pkt->nblanks, pkt->blanks, NULL);
ff3187f6 1581 sfree(pkt->blanks); pkt->blanks = NULL;
1582 pkt->nblanks = 0;
00db133f 1583
51470298 1584 if (ssh->v1_compressing) {
4ba9b64b 1585 unsigned char *compblk;
1586 int complen;
5366aed8 1587 zlib_compress_block(ssh->cs_comp_ctx,
dacd8872 1588 pkt->data + 12, pkt->length - 12,
4ba9b64b 1589 &compblk, &complen);
48406e6b 1590 ssh_pkt_ensure(pkt, complen + 2); /* just in case it's got bigger */
dacd8872 1591 memcpy(pkt->data + 12, compblk, complen);
dcbde236 1592 sfree(compblk);
dacd8872 1593 pkt->length = complen + 12;
4ba9b64b 1594 }
1595
dacd8872 1596 ssh_pkt_ensure(pkt, pkt->length + 4); /* space for CRC */
1597 pkt->length += 4;
1598 len = pkt->length - 4 - 8; /* len(type+data+CRC) */
32874aea 1599 pad = 8 - (len % 8);
dacd8872 1600 pktoffs = 8 - pad;
1601 biglen = len + pad; /* len(padding+type+data+CRC) */
374330e2 1602
dacd8872 1603 for (i = pktoffs; i < 4+8; i++)
1604 pkt->data[i] = random_byte();
1605 crc = crc32_compute(pkt->data + pktoffs + 4, biglen - 4); /* all ex len */
1606 PUT_32BIT(pkt->data + pktoffs + 4 + biglen - 4, crc);
1607 PUT_32BIT(pkt->data + pktoffs, len);
374330e2 1608
51470298 1609 if (ssh->cipher)
dacd8872 1610 ssh->cipher->encrypt(ssh->v1_cipher_ctx,
1611 pkt->data + pktoffs + 4, biglen);
374330e2 1612
dacd8872 1613 if (offset_p) *offset_p = pktoffs;
1614 return biglen + 4; /* len(length+padding+type+data+CRC) */
39065bed 1615}
1616
bf8a49a1 1617static int s_write(Ssh ssh, void *data, int len)
1618{
ff05dfef 1619 if (ssh->logctx)
0d13bfcd 1620 log_packet(ssh->logctx, PKT_OUTGOING, -1, NULL, data, len,
1621 0, NULL, NULL);
bf8a49a1 1622 return sk_write(ssh->s, (char *)data, len);
1623}
1624
ff3187f6 1625static void s_wrpkt(Ssh ssh, struct Packet *pkt)
32874aea 1626{
dacd8872 1627 int len, backlog, offset;
1628 len = s_wrpkt_prepare(ssh, pkt, &offset);
bf8a49a1 1629 backlog = s_write(ssh, pkt->data + offset, len);
5471d09a 1630 if (backlog > SSH_MAX_BACKLOG)
51470298 1631 ssh_throttle_all(ssh, 1, backlog);
dacd8872 1632 ssh_free_packet(pkt);
39065bed 1633}
1634
ff3187f6 1635static void s_wrpkt_defer(Ssh ssh, struct Packet *pkt)
32874aea 1636{
dacd8872 1637 int len, offset;
1638 len = s_wrpkt_prepare(ssh, pkt, &offset);
51470298 1639 if (ssh->deferred_len + len > ssh->deferred_size) {
1640 ssh->deferred_size = ssh->deferred_len + len + 128;
3d88e64d 1641 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
1642 ssh->deferred_size,
1643 unsigned char);
39065bed 1644 }
dacd8872 1645 memcpy(ssh->deferred_send_data + ssh->deferred_len,
1646 pkt->data + offset, len);
51470298 1647 ssh->deferred_len += len;
dacd8872 1648 ssh_free_packet(pkt);
374330e2 1649}
1650
fb09bf1c 1651/*
dacd8872 1652 * Construct a SSH-1 packet with the specified contents.
1653 * (This all-at-once interface used to be the only one, but now SSH-1
1654 * packets can also be constructed incrementally.)
fb09bf1c 1655 */
dacd8872 1656static struct Packet *construct_packet(Ssh ssh, int pkttype, va_list ap)
fb09bf1c 1657{
dacd8872 1658 int argtype;
7cca0d81 1659 Bignum bn;
ff3187f6 1660 struct Packet *pkt;
fb09bf1c 1661
dacd8872 1662 pkt = ssh1_pkt_init(pkttype);
fb09bf1c 1663
dacd8872 1664 while ((argtype = va_arg(ap, int)) != PKT_END) {
1665 unsigned char *argp, argchar;
8a9977e5 1666 char *sargp;
dacd8872 1667 unsigned long argint;
1668 int arglen;
fb09bf1c 1669 switch (argtype) {
9a10ecf4 1670 /* Actual fields in the packet */
fb09bf1c 1671 case PKT_INT:
dacd8872 1672 argint = va_arg(ap, int);
1673 ssh_pkt_adduint32(pkt, argint);
fb09bf1c 1674 break;
1675 case PKT_CHAR:
dacd8872 1676 argchar = (unsigned char) va_arg(ap, int);
1677 ssh_pkt_addbyte(pkt, argchar);
fb09bf1c 1678 break;
1679 case PKT_DATA:
dacd8872 1680 argp = va_arg(ap, unsigned char *);
1681 arglen = va_arg(ap, int);
1682 ssh_pkt_adddata(pkt, argp, arglen);
fb09bf1c 1683 break;
1684 case PKT_STR:
8a9977e5 1685 sargp = va_arg(ap, char *);
1686 ssh_pkt_addstring(pkt, sargp);
fb09bf1c 1687 break;
7cca0d81 1688 case PKT_BIGNUM:
dacd8872 1689 bn = va_arg(ap, Bignum);
1690 ssh1_pkt_addmp(pkt, bn);
9a10ecf4 1691 break;
1692 /* Tokens for modifications to packet logging */
1693 case PKTT_PASSWORD:
ff3187f6 1694 dont_log_password(ssh, pkt, PKTLOG_BLANK);
9a10ecf4 1695 break;
1696 case PKTT_DATA:
ff3187f6 1697 dont_log_data(ssh, pkt, PKTLOG_OMIT);
7cca0d81 1698 break;
9a10ecf4 1699 case PKTT_OTHER:
ff3187f6 1700 end_log_omission(ssh, pkt);
9a10ecf4 1701 break;
1702 }
fb09bf1c 1703 }
ff3187f6 1704
1705 return pkt;
39065bed 1706}
fb09bf1c 1707
51470298 1708static void send_packet(Ssh ssh, int pkttype, ...)
32874aea 1709{
ff3187f6 1710 struct Packet *pkt;
dacd8872 1711 va_list ap;
1712 va_start(ap, pkttype);
1713 pkt = construct_packet(ssh, pkttype, ap);
1714 va_end(ap);
ff3187f6 1715 s_wrpkt(ssh, pkt);
fb09bf1c 1716}
1717
51470298 1718static void defer_packet(Ssh ssh, int pkttype, ...)
32874aea 1719{
ff3187f6 1720 struct Packet *pkt;
dacd8872 1721 va_list ap;
1722 va_start(ap, pkttype);
1723 pkt = construct_packet(ssh, pkttype, ap);
1724 va_end(ap);
ff3187f6 1725 s_wrpkt_defer(ssh, pkt);
39065bed 1726}
1727
32874aea 1728static int ssh_versioncmp(char *a, char *b)
1729{
9697bfd2 1730 char *ae, *be;
1731 unsigned long av, bv;
1732
43aa02a7 1733 av = strtoul(a, &ae, 10);
1734 bv = strtoul(b, &be, 10);
32874aea 1735 if (av != bv)
1736 return (av < bv ? -1 : +1);
1737 if (*ae == '.')
1738 ae++;
1739 if (*be == '.')
1740 be++;
43aa02a7 1741 av = strtoul(ae, &ae, 10);
1742 bv = strtoul(be, &be, 10);
32874aea 1743 if (av != bv)
1744 return (av < bv ? -1 : +1);
9697bfd2 1745 return 0;
1746}
1747
e5574168 1748/*
a92dd380 1749 * Utility routines for putting an SSH-protocol `string' and
b672f405 1750 * `uint32' into a hash state.
e5574168 1751 */
b672f405 1752static void hash_string(const struct ssh_hash *h, void *s, void *str, int len)
32874aea 1753{
e5574168 1754 unsigned char lenblk[4];
e5574168 1755 PUT_32BIT(lenblk, len);
b672f405 1756 h->bytes(s, lenblk, 4);
1757 h->bytes(s, str, len);
e5574168 1758}
1759
b672f405 1760static void hash_uint32(const struct ssh_hash *h, void *s, unsigned i)
32874aea 1761{
a92dd380 1762 unsigned char intblk[4];
1763 PUT_32BIT(intblk, i);
b672f405 1764 h->bytes(s, intblk, 4);
a92dd380 1765}
1766
7cca0d81 1767/*
dacd8872 1768 * Packet construction functions. Mostly shared between SSH-1 and SSH-2.
7cca0d81 1769 */
dacd8872 1770static void ssh_pkt_ensure(struct Packet *pkt, int length)
32874aea 1771{
ff3187f6 1772 if (pkt->maxlen < length) {
dacd8872 1773 unsigned char *body = pkt->body;
3d71de0b 1774 int offset = body ? body - pkt->data : 0;
ff3187f6 1775 pkt->maxlen = length + 256;
1776 pkt->data = sresize(pkt->data, pkt->maxlen + APIEXTRA, unsigned char);
dacd8872 1777 if (body) pkt->body = pkt->data + offset;
7cca0d81 1778 }
783415f8 1779}
dacd8872 1780static void ssh_pkt_adddata(struct Packet *pkt, void *data, int len)
32874aea 1781{
ff3187f6 1782 if (pkt->logmode != PKTLOG_EMIT) {
1783 pkt->nblanks++;
1784 pkt->blanks = sresize(pkt->blanks, pkt->nblanks, struct logblank_t);
dacd8872 1785 assert(pkt->body);
1786 pkt->blanks[pkt->nblanks-1].offset = pkt->length -
1787 (pkt->body - pkt->data);
ff3187f6 1788 pkt->blanks[pkt->nblanks-1].len = len;
1789 pkt->blanks[pkt->nblanks-1].type = pkt->logmode;
1790 }
1791 pkt->length += len;
dacd8872 1792 ssh_pkt_ensure(pkt, pkt->length);
ff3187f6 1793 memcpy(pkt->data + pkt->length - len, data, len);
7cca0d81 1794}
dacd8872 1795static void ssh_pkt_addbyte(struct Packet *pkt, unsigned char byte)
32874aea 1796{
dacd8872 1797 ssh_pkt_adddata(pkt, &byte, 1);
7cca0d81 1798}
ff3187f6 1799static void ssh2_pkt_addbool(struct Packet *pkt, unsigned char value)
32874aea 1800{
dacd8872 1801 ssh_pkt_adddata(pkt, &value, 1);
7cca0d81 1802}
dacd8872 1803static void ssh_pkt_adduint32(struct Packet *pkt, unsigned long value)
32874aea 1804{
7cca0d81 1805 unsigned char x[4];
1806 PUT_32BIT(x, value);
dacd8872 1807 ssh_pkt_adddata(pkt, x, 4);
7cca0d81 1808}
dacd8872 1809static void ssh_pkt_addstring_start(struct Packet *pkt)
32874aea 1810{
dacd8872 1811 ssh_pkt_adduint32(pkt, 0);
ff3187f6 1812 pkt->savedpos = pkt->length;
7cca0d81 1813}
dacd8872 1814static void ssh_pkt_addstring_str(struct Packet *pkt, char *data)
32874aea 1815{
dacd8872 1816 ssh_pkt_adddata(pkt, data, strlen(data));
ff3187f6 1817 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
7cca0d81 1818}
dacd8872 1819static void ssh_pkt_addstring_data(struct Packet *pkt, char *data, int len)
32874aea 1820{
dacd8872 1821 ssh_pkt_adddata(pkt, data, len);
ff3187f6 1822 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
7cca0d81 1823}
dacd8872 1824static void ssh_pkt_addstring(struct Packet *pkt, char *data)
1825{
1826 ssh_pkt_addstring_start(pkt);
1827 ssh_pkt_addstring_str(pkt, data);
1828}
1829static void ssh1_pkt_addmp(struct Packet *pkt, Bignum b)
32874aea 1830{
dacd8872 1831 int len = ssh1_bignum_length(b);
8a9977e5 1832 unsigned char *data = snewn(len, unsigned char);
dacd8872 1833 (void) ssh1_write_bignum(data, b);
1834 ssh_pkt_adddata(pkt, data, len);
1835 sfree(data);
7cca0d81 1836}
d8baa528 1837static unsigned char *ssh2_mpint_fmt(Bignum b, int *len)
32874aea 1838{
7cca0d81 1839 unsigned char *p;
32874aea 1840 int i, n = (bignum_bitcount(b) + 7) / 8;
3d88e64d 1841 p = snewn(n + 1, unsigned char);
7cca0d81 1842 p[0] = 0;
3709bfe9 1843 for (i = 1; i <= n; i++)
32874aea 1844 p[i] = bignum_byte(b, n - i);
7cca0d81 1845 i = 0;
32874aea 1846 while (i <= n && p[i] == 0 && (p[i + 1] & 0x80) == 0)
1847 i++;
1848 memmove(p, p + i, n + 1 - i);
1849 *len = n + 1 - i;
7cca0d81 1850 return p;
1851}
ff3187f6 1852static void ssh2_pkt_addmp(struct Packet *pkt, Bignum b)
32874aea 1853{
7cca0d81 1854 unsigned char *p;
1855 int len;
1856 p = ssh2_mpint_fmt(b, &len);
dacd8872 1857 ssh_pkt_addstring_start(pkt);
1858 ssh_pkt_addstring_data(pkt, (char *)p, len);
dcbde236 1859 sfree(p);
7cca0d81 1860}
b185170a 1861
dacd8872 1862static struct Packet *ssh1_pkt_init(int pkt_type)
1863{
1864 struct Packet *pkt = ssh_new_packet();
1865 pkt->length = 4 + 8; /* space for length + max padding */
1866 ssh_pkt_addbyte(pkt, pkt_type);
1867 pkt->body = pkt->data + pkt->length;
1868 return pkt;
1869}
1870
1871/* For legacy code (SSH-1 and -2 packet construction used to be separate) */
1872#define ssh2_pkt_ensure(pkt, length) ssh_pkt_ensure(pkt, length)
1873#define ssh2_pkt_adddata(pkt, data, len) ssh_pkt_adddata(pkt, data, len)
1874#define ssh2_pkt_addbyte(pkt, byte) ssh_pkt_addbyte(pkt, byte)
1875#define ssh2_pkt_adduint32(pkt, value) ssh_pkt_adduint32(pkt, value)
1876#define ssh2_pkt_addstring_start(pkt) ssh_pkt_addstring_start(pkt)
1877#define ssh2_pkt_addstring_str(pkt, data) ssh_pkt_addstring_str(pkt, data)
1878#define ssh2_pkt_addstring_data(pkt, data, len) ssh_pkt_addstring_data(pkt, data, len)
1879#define ssh2_pkt_addstring(pkt, data) ssh_pkt_addstring(pkt, data)
1880
1881static struct Packet *ssh2_pkt_init(int pkt_type)
1882{
1883 struct Packet *pkt = ssh_new_packet();
3d71de0b 1884 pkt->length = 5; /* space for packet length + padding length */
dacd8872 1885 pkt->forcepad = 0;
1886 ssh_pkt_addbyte(pkt, (unsigned char) pkt_type);
3d71de0b 1887 pkt->body = pkt->data + pkt->length; /* after packet type */
dacd8872 1888 return pkt;
1889}
1890
b185170a 1891/*
2e85c969 1892 * Construct an SSH-2 final-form packet: compress it, encrypt it,
b185170a 1893 * put the MAC on it. Final packet, ready to be sent, is stored in
ff3187f6 1894 * pkt->data. Total length is returned.
b185170a 1895 */
ff3187f6 1896static int ssh2_pkt_construct(Ssh ssh, struct Packet *pkt)
32874aea 1897{
7cca0d81 1898 int cipherblk, maclen, padding, i;
7cca0d81 1899
a8327734 1900 if (ssh->logctx)
ff3187f6 1901 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[5],
acab36bc 1902 ssh2_pkt_type(ssh->pkt_kctx, ssh->pkt_actx, pkt->data[5]),
dacd8872 1903 pkt->body, pkt->length - (pkt->body - pkt->data),
0d13bfcd 1904 pkt->nblanks, pkt->blanks, &ssh->v2_outgoing_sequence);
ff3187f6 1905 sfree(pkt->blanks); pkt->blanks = NULL;
1906 pkt->nblanks = 0;
00db133f 1907
7cca0d81 1908 /*
4ba9b64b 1909 * Compress packet payload.
1910 */
4ba9b64b 1911 {
1912 unsigned char *newpayload;
1913 int newlen;
51470298 1914 if (ssh->cscomp &&
ff3187f6 1915 ssh->cscomp->compress(ssh->cs_comp_ctx, pkt->data + 5,
1916 pkt->length - 5,
51470298 1917 &newpayload, &newlen)) {
ff3187f6 1918 pkt->length = 5;
1919 ssh2_pkt_adddata(pkt, newpayload, newlen);
dcbde236 1920 sfree(newpayload);
4ba9b64b 1921 }
1922 }
1923
1924 /*
7cca0d81 1925 * Add padding. At least four bytes, and must also bring total
1926 * length (minus MAC) up to a multiple of the block size.
95d2d262 1927 * If pkt->forcepad is set, make sure the packet is at least that size
1928 * after padding.
7cca0d81 1929 */
51470298 1930 cipherblk = ssh->cscipher ? ssh->cscipher->blksize : 8; /* block size */
32874aea 1931 cipherblk = cipherblk < 8 ? 8 : cipherblk; /* or 8 if blksize < 8 */
7cca0d81 1932 padding = 4;
95d2d262 1933 if (pkt->length + padding < pkt->forcepad)
1934 padding = pkt->forcepad - pkt->length;
32874aea 1935 padding +=
ff3187f6 1936 (cipherblk - (pkt->length + padding) % cipherblk) % cipherblk;
95d2d262 1937 assert(padding <= 255);
51470298 1938 maclen = ssh->csmac ? ssh->csmac->len : 0;
ff3187f6 1939 ssh2_pkt_ensure(pkt, pkt->length + padding + maclen);
1940 pkt->data[4] = padding;
7cca0d81 1941 for (i = 0; i < padding; i++)
ff3187f6 1942 pkt->data[pkt->length + i] = random_byte();
1943 PUT_32BIT(pkt->data, pkt->length + padding - 4);
51470298 1944 if (ssh->csmac)
ff3187f6 1945 ssh->csmac->generate(ssh->cs_mac_ctx, pkt->data,
1946 pkt->length + padding,
51470298 1947 ssh->v2_outgoing_sequence);
1948 ssh->v2_outgoing_sequence++; /* whether or not we MACed */
1949
1950 if (ssh->cscipher)
371e569c 1951 ssh->cscipher->encrypt(ssh->cs_cipher_ctx,
ff3187f6 1952 pkt->data, pkt->length + padding);
51470298 1953
9442dd57 1954 pkt->encrypted_len = pkt->length + padding;
1955
ff3187f6 1956 /* Ready-to-send packet starts at pkt->data. We return length. */
1957 return pkt->length + padding + maclen;
b185170a 1958}
1959
1960/*
590f6a5f 1961 * Routines called from the main SSH code to send packets. There
1962 * are quite a few of these, because we have two separate
1963 * mechanisms for delaying the sending of packets:
1964 *
1965 * - In order to send an IGNORE message and a password message in
1966 * a single fixed-length blob, we require the ability to
1967 * concatenate the encrypted forms of those two packets _into_ a
1968 * single blob and then pass it to our <network.h> transport
1969 * layer in one go. Hence, there's a deferment mechanism which
1970 * works after packet encryption.
1971 *
1972 * - In order to avoid sending any connection-layer messages
1973 * during repeat key exchange, we have to queue up any such
1974 * outgoing messages _before_ they are encrypted (and in
1975 * particular before they're allocated sequence numbers), and
1976 * then send them once we've finished.
1977 *
1978 * I call these mechanisms `defer' and `queue' respectively, so as
1979 * to distinguish them reasonably easily.
1980 *
1981 * The functions send_noqueue() and defer_noqueue() free the packet
1982 * structure they are passed. Every outgoing packet goes through
1983 * precisely one of these functions in its life; packets passed to
1984 * ssh2_pkt_send() or ssh2_pkt_defer() either go straight to one of
1985 * these or get queued, and then when the queue is later emptied
1986 * the packets are all passed to defer_noqueue().
97ab28d7 1987 *
1988 * When using a CBC-mode cipher, it's necessary to ensure that an
1989 * attacker can't provide data to be encrypted using an IV that they
1990 * know. We ensure this by prefixing each packet that might contain
1991 * user data with an SSH_MSG_IGNORE. This is done using the deferral
1992 * mechanism, so in this case send_noqueue() ends up redirecting to
1993 * defer_noqueue(). If you don't like this inefficiency, don't use
1994 * CBC.
b185170a 1995 */
590f6a5f 1996
97ab28d7 1997static void ssh2_pkt_defer_noqueue(Ssh, struct Packet *, int);
1998static void ssh_pkt_defersend(Ssh);
1999
590f6a5f 2000/*
2e85c969 2001 * Send an SSH-2 packet immediately, without queuing or deferring.
590f6a5f 2002 */
2003static void ssh2_pkt_send_noqueue(Ssh ssh, struct Packet *pkt)
32874aea 2004{
5471d09a 2005 int len;
2006 int backlog;
97ab28d7 2007 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC)) {
2008 /* We need to send two packets, so use the deferral mechanism. */
2009 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
2010 ssh_pkt_defersend(ssh);
2011 return;
2012 }
ff3187f6 2013 len = ssh2_pkt_construct(ssh, pkt);
bf8a49a1 2014 backlog = s_write(ssh, pkt->data, len);
5471d09a 2015 if (backlog > SSH_MAX_BACKLOG)
51470298 2016 ssh_throttle_all(ssh, 1, backlog);
9442dd57 2017
2018 ssh->outgoing_data_size += pkt->encrypted_len;
2019 if (!ssh->kex_in_progress &&
d57f70af 2020 ssh->max_data_size != 0 &&
2021 ssh->outgoing_data_size > ssh->max_data_size)
f382c87d 2022 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
9442dd57 2023
ff3187f6 2024 ssh_free_packet(pkt);
b185170a 2025}
2026
2027/*
2e85c969 2028 * Defer an SSH-2 packet.
b185170a 2029 */
97ab28d7 2030static void ssh2_pkt_defer_noqueue(Ssh ssh, struct Packet *pkt, int noignore)
32874aea 2031{
97ab28d7 2032 int len;
2033 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC) &&
cf6ddb95 2034 ssh->deferred_len == 0 && !noignore &&
2035 !(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE)) {
97ab28d7 2036 /*
2037 * Interpose an SSH_MSG_IGNORE to ensure that user data don't
2038 * get encrypted with a known IV.
2039 */
2040 struct Packet *ipkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
27311cc7 2041 ssh2_pkt_addstring_start(ipkt);
97ab28d7 2042 ssh2_pkt_defer_noqueue(ssh, ipkt, TRUE);
2043 }
2044 len = ssh2_pkt_construct(ssh, pkt);
51470298 2045 if (ssh->deferred_len + len > ssh->deferred_size) {
2046 ssh->deferred_size = ssh->deferred_len + len + 128;
3d88e64d 2047 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
2048 ssh->deferred_size,
2049 unsigned char);
b185170a 2050 }
ff3187f6 2051 memcpy(ssh->deferred_send_data + ssh->deferred_len, pkt->data, len);
51470298 2052 ssh->deferred_len += len;
9442dd57 2053 ssh->deferred_data_size += pkt->encrypted_len;
ff3187f6 2054 ssh_free_packet(pkt);
b185170a 2055}
2056
2057/*
2e85c969 2058 * Queue an SSH-2 packet.
590f6a5f 2059 */
2060static void ssh2_pkt_queue(Ssh ssh, struct Packet *pkt)
2061{
2062 assert(ssh->queueing);
2063
2064 if (ssh->queuelen >= ssh->queuesize) {
2065 ssh->queuesize = ssh->queuelen + 32;
2066 ssh->queue = sresize(ssh->queue, ssh->queuesize, struct Packet *);
2067 }
2068
2069 ssh->queue[ssh->queuelen++] = pkt;
2070}
2071
2072/*
2073 * Either queue or send a packet, depending on whether queueing is
2074 * set.
2075 */
2076static void ssh2_pkt_send(Ssh ssh, struct Packet *pkt)
2077{
2078 if (ssh->queueing)
2079 ssh2_pkt_queue(ssh, pkt);
2080 else
2081 ssh2_pkt_send_noqueue(ssh, pkt);
2082}
2083
2084/*
2085 * Either queue or defer a packet, depending on whether queueing is
2086 * set.
2087 */
2088static void ssh2_pkt_defer(Ssh ssh, struct Packet *pkt)
2089{
2090 if (ssh->queueing)
2091 ssh2_pkt_queue(ssh, pkt);
2092 else
97ab28d7 2093 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
590f6a5f 2094}
2095
2096/*
b185170a 2097 * Send the whole deferred data block constructed by
2e85c969 2098 * ssh2_pkt_defer() or SSH-1's defer_packet().
590f6a5f 2099 *
2100 * The expected use of the defer mechanism is that you call
2101 * ssh2_pkt_defer() a few times, then call ssh_pkt_defersend(). If
2102 * not currently queueing, this simply sets up deferred_send_data
2103 * and then sends it. If we _are_ currently queueing, the calls to
2104 * ssh2_pkt_defer() put the deferred packets on to the queue
2105 * instead, and therefore ssh_pkt_defersend() has no deferred data
2106 * to send. Hence, there's no need to make it conditional on
2107 * ssh->queueing.
b185170a 2108 */
51470298 2109static void ssh_pkt_defersend(Ssh ssh)
32874aea 2110{
5471d09a 2111 int backlog;
bf8a49a1 2112 backlog = s_write(ssh, ssh->deferred_send_data, ssh->deferred_len);
51470298 2113 ssh->deferred_len = ssh->deferred_size = 0;
2114 sfree(ssh->deferred_send_data);
2115 ssh->deferred_send_data = NULL;
5471d09a 2116 if (backlog > SSH_MAX_BACKLOG)
51470298 2117 ssh_throttle_all(ssh, 1, backlog);
9442dd57 2118
2119 ssh->outgoing_data_size += ssh->deferred_data_size;
2120 if (!ssh->kex_in_progress &&
d57f70af 2121 ssh->max_data_size != 0 &&
2122 ssh->outgoing_data_size > ssh->max_data_size)
f382c87d 2123 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
9442dd57 2124 ssh->deferred_data_size = 0;
7cca0d81 2125}
2126
590f6a5f 2127/*
18524056 2128 * Send a packet whose length needs to be disguised (typically
2129 * passwords or keyboard-interactive responses).
2130 */
2131static void ssh2_pkt_send_with_padding(Ssh ssh, struct Packet *pkt,
2132 int padsize)
2133{
2134#if 0
2135 if (0) {
2136 /*
2137 * The simplest way to do this is to adjust the
2138 * variable-length padding field in the outgoing packet.
2139 *
2140 * Currently compiled out, because some Cisco SSH servers
2141 * don't like excessively padded packets (bah, why's it
2142 * always Cisco?)
2143 */
2144 pkt->forcepad = padsize;
2145 ssh2_pkt_send(ssh, pkt);
2146 } else
2147#endif
2148 {
2149 /*
2150 * If we can't do that, however, an alternative approach is
2151 * to use the pkt_defer mechanism to bundle the packet
2152 * tightly together with an SSH_MSG_IGNORE such that their
2153 * combined length is a constant. So first we construct the
2154 * final form of this packet and defer its sending.
2155 */
2156 ssh2_pkt_defer(ssh, pkt);
2157
2158 /*
2159 * Now construct an SSH_MSG_IGNORE which includes a string
2160 * that's an exact multiple of the cipher block size. (If
2161 * the cipher is NULL so that the block size is
2162 * unavailable, we don't do this trick at all, because we
2163 * gain nothing by it.)
2164 */
cf6ddb95 2165 if (ssh->cscipher &&
2166 !(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE)) {
18524056 2167 int stringlen, i;
2168
2169 stringlen = (256 - ssh->deferred_len);
2170 stringlen += ssh->cscipher->blksize - 1;
2171 stringlen -= (stringlen % ssh->cscipher->blksize);
2172 if (ssh->cscomp) {
2173 /*
2174 * Temporarily disable actual compression, so we
2175 * can guarantee to get this string exactly the
2176 * length we want it. The compression-disabling
2177 * routine should return an integer indicating how
2178 * many bytes we should adjust our string length
2179 * by.
2180 */
2181 stringlen -=
2182 ssh->cscomp->disable_compression(ssh->cs_comp_ctx);
2183 }
2184 pkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
2185 ssh2_pkt_addstring_start(pkt);
2186 for (i = 0; i < stringlen; i++) {
2187 char c = (char) random_byte();
2188 ssh2_pkt_addstring_data(pkt, &c, 1);
2189 }
2190 ssh2_pkt_defer(ssh, pkt);
2191 }
2192 ssh_pkt_defersend(ssh);
2193 }
2194}
2195
2196/*
2e85c969 2197 * Send all queued SSH-2 packets. We send them by means of
590f6a5f 2198 * ssh2_pkt_defer_noqueue(), in case they included a pair of
2199 * packets that needed to be lumped together.
2200 */
2201static void ssh2_pkt_queuesend(Ssh ssh)
2202{
2203 int i;
2204
2205 assert(!ssh->queueing);
2206
2207 for (i = 0; i < ssh->queuelen; i++)
97ab28d7 2208 ssh2_pkt_defer_noqueue(ssh, ssh->queue[i], FALSE);
590f6a5f 2209 ssh->queuelen = 0;
2210
2211 ssh_pkt_defersend(ssh);
2212}
2213
7cca0d81 2214#if 0
32874aea 2215void bndebug(char *string, Bignum b)
2216{
7cca0d81 2217 unsigned char *p;
2218 int i, len;
2219 p = ssh2_mpint_fmt(b, &len);
2220 debug(("%s", string));
2221 for (i = 0; i < len; i++)
32874aea 2222 debug((" %02x", p[i]));
765c4200 2223 debug(("\n"));
dcbde236 2224 sfree(p);
7cca0d81 2225}
2226#endif
2227
b672f405 2228static void hash_mpint(const struct ssh_hash *h, void *s, Bignum b)
32874aea 2229{
7cca0d81 2230 unsigned char *p;
2231 int len;
2232 p = ssh2_mpint_fmt(b, &len);
b672f405 2233 hash_string(h, s, p, len);
dcbde236 2234 sfree(p);
7cca0d81 2235}
2236
2237/*
2e85c969 2238 * Packet decode functions for both SSH-1 and SSH-2.
7cca0d81 2239 */
ff3187f6 2240static unsigned long ssh_pkt_getuint32(struct Packet *pkt)
32874aea 2241{
7cca0d81 2242 unsigned long value;
ff3187f6 2243 if (pkt->length - pkt->savedpos < 4)
32874aea 2244 return 0; /* arrgh, no way to decline (FIXME?) */
ff3187f6 2245 value = GET_32BIT(pkt->body + pkt->savedpos);
2246 pkt->savedpos += 4;
7cca0d81 2247 return value;
2248}
ff3187f6 2249static int ssh2_pkt_getbool(struct Packet *pkt)
32874aea 2250{
65a22376 2251 unsigned long value;
ff3187f6 2252 if (pkt->length - pkt->savedpos < 1)
32874aea 2253 return 0; /* arrgh, no way to decline (FIXME?) */
ff3187f6 2254 value = pkt->body[pkt->savedpos] != 0;
2255 pkt->savedpos++;
65a22376 2256 return value;
2257}
ff3187f6 2258static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length)
32874aea 2259{
57356d63 2260 int len;
7cca0d81 2261 *p = NULL;
45068b27 2262 *length = 0;
ff3187f6 2263 if (pkt->length - pkt->savedpos < 4)
32874aea 2264 return;
ff3187f6 2265 len = GET_32BIT(pkt->body + pkt->savedpos);
57356d63 2266 if (len < 0)
2267 return;
2268 *length = len;
ff3187f6 2269 pkt->savedpos += 4;
2270 if (pkt->length - pkt->savedpos < *length)
32874aea 2271 return;
ff3187f6 2272 *p = (char *)(pkt->body + pkt->savedpos);
2273 pkt->savedpos += *length;
7cca0d81 2274}
ff3187f6 2275static void *ssh_pkt_getdata(struct Packet *pkt, int length)
0016d70b 2276{
ff3187f6 2277 if (pkt->length - pkt->savedpos < length)
0016d70b 2278 return NULL;
ff3187f6 2279 pkt->savedpos += length;
2280 return pkt->body + (pkt->savedpos - length);
0016d70b 2281}
ff3187f6 2282static int ssh1_pkt_getrsakey(struct Packet *pkt, struct RSAKey *key,
0016d70b 2283 unsigned char **keystr)
2284{
2285 int j;
2286
ff3187f6 2287 j = makekey(pkt->body + pkt->savedpos,
2288 pkt->length - pkt->savedpos,
0016d70b 2289 key, keystr, 0);
2290
2291 if (j < 0)
2292 return FALSE;
2293
ff3187f6 2294 pkt->savedpos += j;
2295 assert(pkt->savedpos < pkt->length);
0016d70b 2296
2297 return TRUE;
2298}
ff3187f6 2299static Bignum ssh1_pkt_getmp(struct Packet *pkt)
0016d70b 2300{
2301 int j;
2302 Bignum b;
2303
ff3187f6 2304 j = ssh1_read_bignum(pkt->body + pkt->savedpos,
2305 pkt->length - pkt->savedpos, &b);
0016d70b 2306
2307 if (j < 0)
2308 return NULL;
2309
ff3187f6 2310 pkt->savedpos += j;
0016d70b 2311 return b;
2312}
ff3187f6 2313static Bignum ssh2_pkt_getmp(struct Packet *pkt)
32874aea 2314{
7cca0d81 2315 char *p;
3709bfe9 2316 int length;
7cca0d81 2317 Bignum b;
2318
ff3187f6 2319 ssh_pkt_getstring(pkt, &p, &length);
7cca0d81 2320 if (!p)
32874aea 2321 return NULL;
ff3187f6 2322 if (p[0] & 0x80)
32874aea 2323 return NULL;
d8baa528 2324 b = bignum_from_bytes((unsigned char *)p, length);
7cca0d81 2325 return b;
2326}
2327
7d503c31 2328/*
2e85c969 2329 * Helper function to add an SSH-2 signature blob to a packet.
1dd353b5 2330 * Expects to be shown the public key blob as well as the signature
2331 * blob. Normally works just like ssh2_pkt_addstring, but will
2332 * fiddle with the signature packet if necessary for
2333 * BUG_SSH2_RSA_PADDING.
2334 */
ff3187f6 2335static void ssh2_add_sigblob(Ssh ssh, struct Packet *pkt,
2336 void *pkblob_v, int pkblob_len,
1dd353b5 2337 void *sigblob_v, int sigblob_len)
2338{
2339 unsigned char *pkblob = (unsigned char *)pkblob_v;
2340 unsigned char *sigblob = (unsigned char *)sigblob_v;
2341
2342 /* dmemdump(pkblob, pkblob_len); */
2343 /* dmemdump(sigblob, sigblob_len); */
2344
2345 /*
2346 * See if this is in fact an ssh-rsa signature and a buggy
2347 * server; otherwise we can just do this the easy way.
2348 */
51470298 2349 if ((ssh->remote_bugs & BUG_SSH2_RSA_PADDING) &&
1dd353b5 2350 (GET_32BIT(pkblob) == 7 && !memcmp(pkblob+4, "ssh-rsa", 7))) {
2351 int pos, len, siglen;
2352
2353 /*
2354 * Find the byte length of the modulus.
2355 */
2356
2357 pos = 4+7; /* skip over "ssh-rsa" */
2358 pos += 4 + GET_32BIT(pkblob+pos); /* skip over exponent */
2359 len = GET_32BIT(pkblob+pos); /* find length of modulus */
2360 pos += 4; /* find modulus itself */
2361 while (len > 0 && pkblob[pos] == 0)
2362 len--, pos++;
2363 /* debug(("modulus length is %d\n", len)); */
2364
2365 /*
2366 * Now find the signature integer.
2367 */
2368 pos = 4+7; /* skip over "ssh-rsa" */
2369 siglen = GET_32BIT(sigblob+pos);
2370 /* debug(("signature length is %d\n", siglen)); */
2371
2372 if (len != siglen) {
2373 unsigned char newlen[4];
ff3187f6 2374 ssh2_pkt_addstring_start(pkt);
2375 ssh2_pkt_addstring_data(pkt, (char *)sigblob, pos);
1dd353b5 2376 /* dmemdump(sigblob, pos); */
2377 pos += 4; /* point to start of actual sig */
2378 PUT_32BIT(newlen, len);
ff3187f6 2379 ssh2_pkt_addstring_data(pkt, (char *)newlen, 4);
1dd353b5 2380 /* dmemdump(newlen, 4); */
2381 newlen[0] = 0;
2382 while (len-- > siglen) {
ff3187f6 2383 ssh2_pkt_addstring_data(pkt, (char *)newlen, 1);
1dd353b5 2384 /* dmemdump(newlen, 1); */
2385 }
ff3187f6 2386 ssh2_pkt_addstring_data(pkt, (char *)(sigblob+pos), siglen);
1dd353b5 2387 /* dmemdump(sigblob+pos, siglen); */
2388 return;
2389 }
2390
2391 /* Otherwise fall through and do it the easy way. */
2392 }
2393
ff3187f6 2394 ssh2_pkt_addstring_start(pkt);
2395 ssh2_pkt_addstring_data(pkt, (char *)sigblob, sigblob_len);
1dd353b5 2396}
2397
2398/*
7d503c31 2399 * Examine the remote side's version string and compare it against
2400 * a list of known buggy implementations.
2401 */
51470298 2402static void ssh_detect_bugs(Ssh ssh, char *vstring)
32874aea 2403{
2404 char *imp; /* pointer to implementation part */
7d503c31 2405 imp = vstring;
2406 imp += strcspn(imp, "-");
bd358db1 2407 if (*imp) imp++;
7d503c31 2408 imp += strcspn(imp, "-");
bd358db1 2409 if (*imp) imp++;
7d503c31 2410
51470298 2411 ssh->remote_bugs = 0;
7d503c31 2412
bf982899 2413 /*
2414 * General notes on server version strings:
2415 * - Not all servers reporting "Cisco-1.25" have all the bugs listed
2416 * here -- in particular, we've heard of one that's perfectly happy
2417 * with SSH1_MSG_IGNOREs -- but this string never seems to change,
2418 * so we can't distinguish them.
2419 */
5ecd7ad0 2420 if (ssh->cfg.sshbug_ignore1 == FORCE_ON ||
2421 (ssh->cfg.sshbug_ignore1 == AUTO &&
2c9c6388 2422 (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
2423 !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
46ac09aa 2424 !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25") ||
bd0b4caf 2425 !strcmp(imp, "OSU_1.4alpha3") || !strcmp(imp, "OSU_1.5alpha4")))) {
32874aea 2426 /*
2427 * These versions don't support SSH1_MSG_IGNORE, so we have
2428 * to use a different defence against password length
2429 * sniffing.
2430 */
51470298 2431 ssh->remote_bugs |= BUG_CHOKES_ON_SSH1_IGNORE;
2e85c969 2432 logevent("We believe remote version has SSH-1 ignore bug");
7d503c31 2433 }
2434
5ecd7ad0 2435 if (ssh->cfg.sshbug_plainpw1 == FORCE_ON ||
2436 (ssh->cfg.sshbug_plainpw1 == AUTO &&
46ac09aa 2437 (!strcmp(imp, "Cisco-1.25") || !strcmp(imp, "OSU_1.4alpha3")))) {
bd358db1 2438 /*
2439 * These versions need a plain password sent; they can't
2440 * handle having a null and a random length of data after
2441 * the password.
2442 */
51470298 2443 ssh->remote_bugs |= BUG_NEEDS_SSH1_PLAIN_PASSWORD;
2e85c969 2444 logevent("We believe remote version needs a plain SSH-1 password");
bd358db1 2445 }
2446
5ecd7ad0 2447 if (ssh->cfg.sshbug_rsa1 == FORCE_ON ||
2448 (ssh->cfg.sshbug_rsa1 == AUTO &&
2c9c6388 2449 (!strcmp(imp, "Cisco-1.25")))) {
0df73905 2450 /*
2451 * These versions apparently have no clue whatever about
2452 * RSA authentication and will panic and die if they see
2453 * an AUTH_RSA message.
2454 */
51470298 2455 ssh->remote_bugs |= BUG_CHOKES_ON_RSA;
19f47a7d 2456 logevent("We believe remote version can't handle SSH-1 RSA authentication");
0df73905 2457 }
2458
5ecd7ad0 2459 if (ssh->cfg.sshbug_hmac2 == FORCE_ON ||
2460 (ssh->cfg.sshbug_hmac2 == AUTO &&
b9f387af 2461 !wc_match("* VShell", imp) &&
831301f6 2462 (wc_match("2.1.0*", imp) || wc_match("2.0.*", imp) ||
2463 wc_match("2.2.0*", imp) || wc_match("2.3.0*", imp) ||
2464 wc_match("2.1 *", imp)))) {
32874aea 2465 /*
2466 * These versions have the HMAC bug.
2467 */
51470298 2468 ssh->remote_bugs |= BUG_SSH2_HMAC;
2e85c969 2469 logevent("We believe remote version has SSH-2 HMAC bug");
7d503c31 2470 }
1dd353b5 2471
5ecd7ad0 2472 if (ssh->cfg.sshbug_derivekey2 == FORCE_ON ||
2473 (ssh->cfg.sshbug_derivekey2 == AUTO &&
b9f387af 2474 !wc_match("* VShell", imp) &&
2856a1b9 2475 (wc_match("2.0.0*", imp) || wc_match("2.0.10*", imp) ))) {
088bde77 2476 /*
2477 * These versions have the key-derivation bug (failing to
2478 * include the literal shared secret in the hashes that
2479 * generate the keys).
2480 */
51470298 2481 ssh->remote_bugs |= BUG_SSH2_DERIVEKEY;
2e85c969 2482 logevent("We believe remote version has SSH-2 key-derivation bug");
088bde77 2483 }
2484
5ecd7ad0 2485 if (ssh->cfg.sshbug_rsapad2 == FORCE_ON ||
2486 (ssh->cfg.sshbug_rsapad2 == AUTO &&
831301f6 2487 (wc_match("OpenSSH_2.[5-9]*", imp) ||
2488 wc_match("OpenSSH_3.[0-2]*", imp)))) {
1dd353b5 2489 /*
2e85c969 2490 * These versions have the SSH-2 RSA padding bug.
1dd353b5 2491 */
51470298 2492 ssh->remote_bugs |= BUG_SSH2_RSA_PADDING;
2e85c969 2493 logevent("We believe remote version has SSH-2 RSA padding bug");
1dd353b5 2494 }
8e975795 2495
dda87a28 2496 if (ssh->cfg.sshbug_pksessid2 == FORCE_ON ||
2497 (ssh->cfg.sshbug_pksessid2 == AUTO &&
2498 wc_match("OpenSSH_2.[0-2]*", imp))) {
2499 /*
2e85c969 2500 * These versions have the SSH-2 session-ID bug in
dda87a28 2501 * public-key authentication.
2502 */
2503 ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID;
2e85c969 2504 logevent("We believe remote version has SSH-2 public-key-session-ID bug");
dda87a28 2505 }
f382c87d 2506
2507 if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
2508 (ssh->cfg.sshbug_rekey2 == AUTO &&
39b8712f 2509 (wc_match("DigiSSH_2.0", imp) ||
2510 wc_match("OpenSSH_2.[0-4]*", imp) ||
e12d95a5 2511 wc_match("OpenSSH_2.5.[0-3]*", imp) ||
2512 wc_match("Sun_SSH_1.0", imp) ||
f4275b53 2513 wc_match("Sun_SSH_1.0.1", imp) ||
96bd26de 2514 /* All versions <= 1.2.6 (they changed their format in 1.2.7) */
2515 wc_match("WeOnlyDo-*", imp)))) {
f382c87d 2516 /*
2e85c969 2517 * These versions have the SSH-2 rekey bug.
f382c87d 2518 */
2519 ssh->remote_bugs |= BUG_SSH2_REKEY;
2e85c969 2520 logevent("We believe remote version has SSH-2 rekey bug");
f382c87d 2521 }
c9739dba 2522
2523 if (ssh->cfg.sshbug_maxpkt2 == FORCE_ON ||
2524 (ssh->cfg.sshbug_maxpkt2 == AUTO &&
5ca836f2 2525 (wc_match("1.36_sshlib GlobalSCAPE", imp) ||
2526 wc_match("1.36 sshlib: GlobalScape", imp)))) {
c9739dba 2527 /*
2528 * This version ignores our makpkt and needs to be throttled.
2529 */
2530 ssh->remote_bugs |= BUG_SSH2_MAXPKT;
2531 logevent("We believe remote version ignores SSH-2 maximum packet size");
2532 }
cf6ddb95 2533
2534 if (ssh->cfg.sshbug_ignore2 == FORCE_ON) {
2535 /*
2536 * Servers that don't support SSH2_MSG_IGNORE. Currently,
2537 * none detected automatically.
2538 */
2539 ssh->remote_bugs |= BUG_CHOKES_ON_SSH2_IGNORE;
2540 logevent("We believe remote version has SSH-2 ignore bug");
2541 }
7d503c31 2542}
2543
d38d6a1f 2544/*
2545 * The `software version' part of an SSH version string is required
2546 * to contain no spaces or minus signs.
2547 */
2548static void ssh_fix_verstring(char *str)
2549{
2550 /* Eat "SSH-<protoversion>-". */
2551 assert(*str == 'S'); str++;
2552 assert(*str == 'S'); str++;
2553 assert(*str == 'H'); str++;
2554 assert(*str == '-'); str++;
2555 while (*str && *str != '-') str++;
2556 assert(*str == '-'); str++;
2557
2558 /* Convert minus signs and spaces in the remaining string into
2559 * underscores. */
2560 while (*str) {
2561 if (*str == '-' || *str == ' ')
2562 *str = '_';
2563 str++;
2564 }
2565}
2566
1fcd0d98 2567/*
2568 * Send an appropriate SSH version string.
2569 */
2570static void ssh_send_verstring(Ssh ssh, char *svers)
2571{
2572 char *verstring;
2573
2574 if (ssh->version == 2) {
2575 /*
2576 * Construct a v2 version string.
2577 */
2578 verstring = dupprintf("SSH-2.0-%s\015\012", sshver);
2579 } else {
2580 /*
2581 * Construct a v1 version string.
2582 */
2583 verstring = dupprintf("SSH-%s-%s\012",
2584 (ssh_versioncmp(svers, "1.5") <= 0 ?
2585 svers : "1.5"),
2586 sshver);
2587 }
2588
2589 ssh_fix_verstring(verstring);
2590
2591 if (ssh->version == 2) {
2592 size_t len;
2593 /*
2594 * Record our version string.
2595 */
2596 len = strcspn(verstring, "\015\012");
2597 ssh->v_c = snewn(len + 1, char);
2598 memcpy(ssh->v_c, verstring, len);
2599 ssh->v_c[len] = 0;
2600 }
2601
2602 logeventf(ssh, "We claim version: %.*s",
2603 strcspn(verstring, "\015\012"), verstring);
2604 s_write(ssh, verstring, strlen(verstring));
2605 sfree(verstring);
2606}
2607
51470298 2608static int do_ssh_init(Ssh ssh, unsigned char c)
32874aea 2609{
51470298 2610 struct do_ssh_init_state {
2611 int vslen;
2612 char version[10];
2613 char *vstring;
2614 int vstrsize;
2615 int i;
2616 int proto1, proto2;
2617 };
2618 crState(do_ssh_init_state);
374330e2 2619
51470298 2620 crBegin(ssh->do_ssh_init_crstate);
8df7a775 2621
8c1835c0 2622 /* Search for a line beginning with the string "SSH-" in the input. */
2623 for (;;) {
2624 if (c != 'S') goto no;
2625 crReturn(1);
2626 if (c != 'S') goto no;
2627 crReturn(1);
2628 if (c != 'H') goto no;
2629 crReturn(1);
2630 if (c != '-') goto no;
2631 break;
2632 no:
2633 while (c != '\012')
2634 crReturn(1);
2635 crReturn(1);
374330e2 2636 }
8df7a775 2637
51470298 2638 s->vstrsize = 16;
3d88e64d 2639 s->vstring = snewn(s->vstrsize, char);
51470298 2640 strcpy(s->vstring, "SSH-");
2641 s->vslen = 4;
2642 s->i = 0;
374330e2 2643 while (1) {
8df7a775 2644 crReturn(1); /* get another char */
51470298 2645 if (s->vslen >= s->vstrsize - 1) {
2646 s->vstrsize += 16;
3d88e64d 2647 s->vstring = sresize(s->vstring, s->vstrsize, char);
32874aea 2648 }
51470298 2649 s->vstring[s->vslen++] = c;
2650 if (s->i >= 0) {
374330e2 2651 if (c == '-') {
51470298 2652 s->version[s->i] = '\0';
2653 s->i = -1;
2654 } else if (s->i < sizeof(s->version) - 1)
2655 s->version[s->i++] = c;
c4ffc4d0 2656 } else if (c == '\012')
374330e2 2657 break;
2658 }
2659
51470298 2660 ssh->agentfwd_enabled = FALSE;
2661 ssh->rdpkt2_state.incoming_sequence = 0;
960e736a 2662
51470298 2663 s->vstring[s->vslen] = 0;
a7d4653a 2664 s->vstring[strcspn(s->vstring, "\015\012")] = '\0';/* remove EOL chars */
fb983202 2665 logeventf(ssh, "Server version: %s", s->vstring);
51470298 2666 ssh_detect_bugs(ssh, s->vstring);
c5e9c988 2667
adf799dd 2668 /*
38d228a2 2669 * Decide which SSH protocol version to support.
adf799dd 2670 */
38d228a2 2671
2672 /* Anything strictly below "2.0" means protocol 1 is supported. */
51470298 2673 s->proto1 = ssh_versioncmp(s->version, "2.0") < 0;
38d228a2 2674 /* Anything greater or equal to "1.99" means protocol 2 is supported. */
51470298 2675 s->proto2 = ssh_versioncmp(s->version, "1.99") >= 0;
38d228a2 2676
86916870 2677 if (ssh->cfg.sshprot == 0 && !s->proto1) {
6b5cf8b4 2678 bombout(("SSH protocol version 1 required by user but not provided by server"));
7ffdbc1a 2679 crStop(0);
38d228a2 2680 }
86916870 2681 if (ssh->cfg.sshprot == 3 && !s->proto2) {
6b5cf8b4 2682 bombout(("SSH protocol version 2 required by user but not provided by server"));
7ffdbc1a 2683 crStop(0);
38d228a2 2684 }
2685
1fcd0d98 2686 if (s->proto2 && (ssh->cfg.sshprot >= 2 || !s->proto1))
2687 ssh->version = 2;
2688 else
2689 ssh->version = 1;
d38d6a1f 2690
2691 logeventf(ssh, "Using SSH protocol version %d", ssh->version);
2692
1fcd0d98 2693 /* Send the version string, if we haven't already */
2694 if (ssh->cfg.sshprot != 3)
2695 ssh_send_verstring(ssh, s->version);
2696
2697 if (ssh->version == 2) {
2698 size_t len;
2699 /*
2700 * Record their version string.
2701 */
2702 len = strcspn(s->vstring, "\015\012");
2703 ssh->v_s = snewn(len + 1, char);
2704 memcpy(ssh->v_s, s->vstring, len);
2705 ssh->v_s[len] = 0;
2706
2707 /*
2708 * Initialise SSH-2 protocol.
2709 */
2710 ssh->protocol = ssh2_protocol;
2711 ssh2_protocol_setup(ssh);
2712 ssh->s_rdpkt = ssh2_rdpkt;
2713 } else {
2714 /*
2715 * Initialise SSH-1 protocol.
2716 */
2717 ssh->protocol = ssh1_protocol;
2718 ssh1_protocol_setup(ssh);
2719 ssh->s_rdpkt = ssh1_rdpkt;
2720 }
2721 if (ssh->version == 2)
2722 do_ssh2_transport(ssh, NULL, -1, NULL);
2723
125105d1 2724 update_specials_menu(ssh->frontend);
51470298 2725 ssh->state = SSH_STATE_BEFORE_SIZE;
39934deb 2726 ssh->pinger = pinger_new(&ssh->cfg, &ssh_backend, ssh);
8df7a775 2727
51470298 2728 sfree(s->vstring);
50526e47 2729
8df7a775 2730 crFinish(0);
2731}
2732
3d9449a1 2733static void ssh_process_incoming_data(Ssh ssh,
2734 unsigned char **data, int *datalen)
2735{
bf8a49a1 2736 struct Packet *pktin;
2737
2738 pktin = ssh->s_rdpkt(ssh, data, datalen);
3d9449a1 2739 if (pktin) {
2740 ssh->protocol(ssh, NULL, 0, pktin);
2741 ssh_free_packet(pktin);
2742 }
2743}
2744
2745static void ssh_queue_incoming_data(Ssh ssh,
2746 unsigned char **data, int *datalen)
2747{
2748 bufchain_add(&ssh->queued_incoming_data, *data, *datalen);
2749 *data += *datalen;
2750 *datalen = 0;
2751}
2752
2753static void ssh_process_queued_incoming_data(Ssh ssh)
2754{
2755 void *vdata;
2756 unsigned char *data;
2757 int len, origlen;
2758
2759 while (!ssh->frozen && bufchain_size(&ssh->queued_incoming_data)) {
2760 bufchain_prefix(&ssh->queued_incoming_data, &vdata, &len);
2761 data = vdata;
2762 origlen = len;
2763
2764 while (!ssh->frozen && len > 0)
2765 ssh_process_incoming_data(ssh, &data, &len);
2766
2767 if (origlen > len)
2768 bufchain_consume(&ssh->queued_incoming_data, origlen - len);
2769 }
2770}
2771
2772static void ssh_set_frozen(Ssh ssh, int frozen)
2773{
a5a6f839 2774 if (ssh->s)
2775 sk_set_frozen(ssh->s, frozen);
3d9449a1 2776 ssh->frozen = frozen;
2777}
2778
51470298 2779static void ssh_gotdata(Ssh ssh, unsigned char *data, int datalen)
8df7a775 2780{
bf8a49a1 2781 /* Log raw data, if we're in that mode. */
ff05dfef 2782 if (ssh->logctx)
2783 log_packet(ssh->logctx, PKT_INCOMING, -1, NULL, data, datalen,
0d13bfcd 2784 0, NULL, NULL);
bf8a49a1 2785
51470298 2786 crBegin(ssh->ssh_gotdata_crstate);
8df7a775 2787
2788 /*
2789 * To begin with, feed the characters one by one to the
2790 * protocol initialisation / selection function do_ssh_init().
2791 * When that returns 0, we're done with the initial greeting
2792 * exchange and can move on to packet discipline.
2793 */
2794 while (1) {
51470298 2795 int ret; /* need not be kept across crReturn */
8df7a775 2796 if (datalen == 0)
2797 crReturnV; /* more data please */
51470298 2798 ret = do_ssh_init(ssh, *data);
32874aea 2799 data++;
2800 datalen--;
8df7a775 2801 if (ret == 0)
2802 break;
2803 }
2804
2805 /*
2806 * We emerge from that loop when the initial negotiation is
2807 * over and we have selected an s_rdpkt function. Now pass
2808 * everything to s_rdpkt, and then pass the resulting packets
2809 * to the proper protocol handler.
2810 */
3d9449a1 2811
8df7a775 2812 while (1) {
e375106c 2813 while (bufchain_size(&ssh->queued_incoming_data) > 0 || datalen > 0) {
2814 if (ssh->frozen) {
3d9449a1 2815 ssh_queue_incoming_data(ssh, &data, &datalen);
e375106c 2816 /* This uses up all data and cannot cause anything interesting
2817 * to happen; indeed, for anything to happen at all, we must
2818 * return, so break out. */
2819 break;
2820 } else if (bufchain_size(&ssh->queued_incoming_data) > 0) {
2821 /* This uses up some or all data, and may freeze the
2822 * session. */
2823 ssh_process_queued_incoming_data(ssh);
2824 } else {
2825 /* This uses up some or all data, and may freeze the
2826 * session. */
2827 ssh_process_incoming_data(ssh, &data, &datalen);
2828 }
2829 /* FIXME this is probably EBW. */
ff3187f6 2830 if (ssh->state == SSH_STATE_CLOSED)
2831 return;
8df7a775 2832 }
e375106c 2833 /* We're out of data. Go and get some more. */
8df7a775 2834 crReturnV;
2835 }
2836 crFinishV;
2837}
2838
ac934965 2839static int ssh_do_close(Ssh ssh, int notify_exit)
32874aea 2840{
80ffa58b 2841 int ret = 0;
36f94d1f 2842 struct ssh_channel *c;
2843
51470298 2844 ssh->state = SSH_STATE_CLOSED;
ecbb0000 2845 expire_timer_context(ssh);
51470298 2846 if (ssh->s) {
2847 sk_close(ssh->s);
2848 ssh->s = NULL;
ac934965 2849 if (notify_exit)
2850 notify_remote_exit(ssh->frontend);
2851 else
2852 ret = 1;
f3ab576e 2853 }
36f94d1f 2854 /*
80ffa58b 2855 * Now we must shut down any port- and X-forwarded channels going
36f94d1f 2856 * through this connection.
2857 */
74a98066 2858 if (ssh->channels) {
80ffa58b 2859 while (NULL != (c = index234(ssh->channels, 0))) {
74a98066 2860 switch (c->type) {
2861 case CHAN_X11:
2862 x11_close(c->u.x11.s);
2863 break;
2864 case CHAN_SOCKDATA:
409eca86 2865 case CHAN_SOCKDATA_DORMANT:
74a98066 2866 pfd_close(c->u.pfd.s);
2867 break;
2868 }
80ffa58b 2869 del234(ssh->channels, c); /* moving next one to index 0 */
74a98066 2870 if (ssh->version == 2)
2871 bufchain_clear(&c->v.v2.outbuffer);
2872 sfree(c);
36f94d1f 2873 }
36f94d1f 2874 }
f8c9f9df 2875 /*
2876 * Go through port-forwardings, and close any associated
2877 * listening sockets.
2878 */
2879 if (ssh->portfwds) {
2880 struct ssh_portfwd *pf;
2881 while (NULL != (pf = index234(ssh->portfwds, 0))) {
2882 /* Dispose of any listening socket. */
2883 if (pf->local)
2884 pfd_terminate(pf->local);
2885 del234(ssh->portfwds, pf); /* moving next one to index 0 */
2886 free_portfwd(pf);
2887 }
b72bdf11 2888 freetree234(ssh->portfwds);
2889 ssh->portfwds = NULL;
f8c9f9df 2890 }
ac934965 2891
2892 return ret;
36f94d1f 2893}
2894
7555d6a5 2895static void ssh_log(Plug plug, int type, SockAddr addr, int port,
2896 const char *error_msg, int error_code)
2897{
2898 Ssh ssh = (Ssh) plug;
2899 char addrbuf[256], *msg;
2900
2901 sk_getaddr(addr, addrbuf, lenof(addrbuf));
2902
2903 if (type == 0)
2904 msg = dupprintf("Connecting to %s port %d", addrbuf, port);
2905 else
2906 msg = dupprintf("Failed to connect to %s: %s", addrbuf, error_msg);
2907
2908 logevent(msg);
fb983202 2909 sfree(msg);
7555d6a5 2910}
2911
cbe2d68f 2912static int ssh_closing(Plug plug, const char *error_msg, int error_code,
36f94d1f 2913 int calling_back)
2914{
2915 Ssh ssh = (Ssh) plug;
ac934965 2916 int need_notify = ssh_do_close(ssh, FALSE);
2917
9e296bfa 2918 if (!error_msg) {
2919 if (!ssh->close_expected)
2920 error_msg = "Server unexpectedly closed network connection";
2921 else
2922 error_msg = "Server closed network connection";
ac934965 2923 }
2924
d051d1b4 2925 if (ssh->close_expected && ssh->clean_exit && ssh->exitcode < 0)
2926 ssh->exitcode = 0;
2927
2425184b 2928 if (need_notify)
2929 notify_remote_exit(ssh->frontend);
2930
9e296bfa 2931 if (error_msg)
247308b5 2932 logevent(error_msg);
9e296bfa 2933 if (!ssh->close_expected || !ssh->clean_exit)
971bcc0a 2934 connection_fatal(ssh->frontend, "%s", error_msg);
7e78000d 2935 return 0;
2936}
2937
32874aea 2938static int ssh_receive(Plug plug, int urgent, char *data, int len)
2939{
51470298 2940 Ssh ssh = (Ssh) plug;
d8baa528 2941 ssh_gotdata(ssh, (unsigned char *)data, len);
51470298 2942 if (ssh->state == SSH_STATE_CLOSED) {
ac934965 2943 ssh_do_close(ssh, TRUE);
32874aea 2944 return 0;
3257deae 2945 }
fef97f43 2946 return 1;
374330e2 2947}
2948
5471d09a 2949static void ssh_sent(Plug plug, int bufsize)
2950{
51470298 2951 Ssh ssh = (Ssh) plug;
5471d09a 2952 /*
2953 * If the send backlog on the SSH socket itself clears, we
2954 * should unthrottle the whole world if it was throttled.
2955 */
2956 if (bufsize < SSH_MAX_BACKLOG)
51470298 2957 ssh_throttle_all(ssh, 0, bufsize);
5471d09a 2958}
2959
fb09bf1c 2960/*
8df7a775 2961 * Connect to specified host and port.
2962 * Returns an error message, or NULL on success.
6e1ebb76 2963 * Also places the canonical host name into `realhost'. It must be
2964 * freed by the caller.
8df7a775 2965 */
cbe2d68f 2966static const char *connect_to_host(Ssh ssh, char *host, int port,
79bf227b 2967 char **realhost, int nodelay, int keepalive)
8df7a775 2968{
51470298 2969 static const struct plug_function_table fn_table = {
7555d6a5 2970 ssh_log,
7e78000d 2971 ssh_closing,
5471d09a 2972 ssh_receive,
2973 ssh_sent,
2974 NULL
51470298 2975 };
7e78000d 2976
8df7a775 2977 SockAddr addr;
cbe2d68f 2978 const char *err;
8df7a775 2979
881da168 2980 if (*ssh->cfg.loghost) {
2981 char *colon;
8df7a775 2982
881da168 2983 ssh->savedhost = dupstr(ssh->cfg.loghost);
2984 ssh->savedport = 22; /* default ssh port */
2985
2986 /*
2987 * A colon suffix on savedhost also lets us affect
2988 * savedport.
2989 *
2990 * (FIXME: do something about IPv6 address literals here.)
2991 */
2992 colon = strrchr(ssh->savedhost, ':');
2993 if (colon) {
2994 *colon++ = '\0';
2995 if (*colon)
2996 ssh->savedport = atoi(colon);
2997 }
2998 } else {
2999 ssh->savedhost = dupstr(host);
3000 if (port < 0)
3001 port = 22; /* default ssh port */
3002 ssh->savedport = port;
3003 }
8df7a775 3004
3005 /*
3006 * Try to find host.
3007 */
05581745 3008 logeventf(ssh, "Looking up host \"%s\"%s", host,
3009 (ssh->cfg.addressfamily == ADDRTYPE_IPV4 ? " (IPv4)" :
3010 (ssh->cfg.addressfamily == ADDRTYPE_IPV6 ? " (IPv6)" : "")));
3011 addr = name_lookup(host, port, realhost, &ssh->cfg,
3012 ssh->cfg.addressfamily);
170c1e6e 3013 if ((err = sk_addr_error(addr)) != NULL) {
3014 sk_addr_free(addr);
8df7a775 3015 return err;
170c1e6e 3016 }
42af6a67 3017 ssh->fullhostname = dupstr(*realhost); /* save in case of GSSAPI */
8df7a775 3018
8df7a775 3019 /*
3020 * Open socket.
3021 */
51470298 3022 ssh->fn = &fn_table;
e8fa8f62 3023 ssh->s = new_connection(addr, *realhost, port,
79bf227b 3024 0, 1, nodelay, keepalive, (Plug) ssh, &ssh->cfg);
70e5d0fd 3025 if ((err = sk_socket_error(ssh->s)) != NULL) {
51470298 3026 ssh->s = NULL;
39934deb 3027 notify_remote_exit(ssh->frontend);
8df7a775 3028 return err;
67c4ba2e 3029 }
8df7a775 3030
ff05dfef 3031 /*
3032 * If the SSH version number's fixed, set it now, and if it's SSH-2,
3033 * send the version string too.
3034 */
3035 if (ssh->cfg.sshprot == 0)
3036 ssh->version = 1;
3037 if (ssh->cfg.sshprot == 3) {
3038 ssh->version = 2;
3039 ssh_send_verstring(ssh, NULL);
3040 }
3041
881da168 3042 /*
3043 * loghost, if configured, overrides realhost.
3044 */
3045 if (*ssh->cfg.loghost) {
3046 sfree(*realhost);
3047 *realhost = dupstr(ssh->cfg.loghost);
3048 }
3049
8df7a775 3050 return NULL;
3051}
3052
3053/*
5471d09a 3054 * Throttle or unthrottle the SSH connection.
3055 */
ff68564b 3056static void ssh_throttle_conn(Ssh ssh, int adjust)
5471d09a 3057{
ff68564b 3058 int old_count = ssh->conn_throttle_count;
3059 ssh->conn_throttle_count += adjust;
3060 assert(ssh->conn_throttle_count >= 0);
3061 if (ssh->conn_throttle_count && !old_count) {
3d9449a1 3062 ssh_set_frozen(ssh, 1);
ff68564b 3063 } else if (!ssh->conn_throttle_count && old_count) {
3d9449a1 3064 ssh_set_frozen(ssh, 0);
5471d09a 3065 }
3066}
3067
3068/*
3069 * Throttle or unthrottle _all_ local data streams (for when sends
3070 * on the SSH connection itself back up).
3071 */
51470298 3072static void ssh_throttle_all(Ssh ssh, int enable, int bufsize)
5471d09a 3073{
3074 int i;
3075 struct ssh_channel *c;
3076
51470298 3077 if (enable == ssh->throttled_all)
5471d09a 3078 return;
51470298 3079 ssh->throttled_all = enable;
3080 ssh->overall_bufsize = bufsize;
3081 if (!ssh->channels)
5471d09a 3082 return;
51470298 3083 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++) {
5471d09a 3084 switch (c->type) {
3085 case CHAN_MAINSESSION:
3086 /*
3087 * This is treated separately, outside the switch.
3088 */
3089 break;
3090 case CHAN_X11:
3091 x11_override_throttle(c->u.x11.s, enable);
3092 break;
3093 case CHAN_AGENT:
3094 /* Agent channels require no buffer management. */
3095 break;
3096 case CHAN_SOCKDATA:
36f94d1f 3097 pfd_override_throttle(c->u.pfd.s, enable);
5471d09a 3098 break;
3099 }
3100 }
3101}
3102
f11d78f2 3103static void ssh_agent_callback(void *sshv, void *reply, int replylen)
839f10db 3104{
3105 Ssh ssh = (Ssh) sshv;
3106
3107 ssh->agent_response = reply;
3108 ssh->agent_response_len = replylen;
3109
3110 if (ssh->version == 1)
ff3187f6 3111 do_ssh1_login(ssh, NULL, -1, NULL);
839f10db 3112 else
ff3187f6 3113 do_ssh2_authconn(ssh, NULL, -1, NULL);
839f10db 3114}
3115
3d9449a1 3116static void ssh_dialog_callback(void *sshv, int ret)
3117{
3118 Ssh ssh = (Ssh) sshv;
3119
3120 ssh->user_response = ret;
3121
3122 if (ssh->version == 1)
3123 do_ssh1_login(ssh, NULL, -1, NULL);
3124 else
3125 do_ssh2_transport(ssh, NULL, -1, NULL);
3126
3127 /*
3128 * This may have unfrozen the SSH connection, so do a
3129 * queued-data run.
3130 */
3131 ssh_process_queued_incoming_data(ssh);
3132}
3133
f11d78f2 3134static void ssh_agentf_callback(void *cv, void *reply, int replylen)
839f10db 3135{
3136 struct ssh_channel *c = (struct ssh_channel *)cv;
3137 Ssh ssh = c->ssh;
3138 void *sentreply = reply;
3139
3140 if (!sentreply) {
3141 /* Fake SSH_AGENT_FAILURE. */
3142 sentreply = "\0\0\0\1\5";
3143 replylen = 5;
3144 }
3145 if (ssh->version == 2) {
3146 ssh2_add_channel_data(c, sentreply, replylen);
3147 ssh2_try_send(c);
3148 } else {
3149 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
3150 PKT_INT, c->remoteid,
3151 PKT_INT, replylen,
a2724fba 3152 PKTT_DATA,
839f10db 3153 PKT_DATA, sentreply, replylen,
9a10ecf4 3154 PKTT_OTHER,
839f10db 3155 PKT_END);
3156 }
3157 if (reply)
3158 sfree(reply);
3159}
3160
0405e71f 3161/*
9e296bfa 3162 * Client-initiated disconnection. Send a DISCONNECT if `wire_reason'
3163 * non-NULL, otherwise just close the connection. `client_reason' == NULL
3164 * => log `wire_reason'.
3165 */
3166static void ssh_disconnect(Ssh ssh, char *client_reason, char *wire_reason,
3167 int code, int clean_exit)
3168{
3169 char *error;
3170 if (!client_reason)
3171 client_reason = wire_reason;
3172 if (client_reason)
3173 error = dupprintf("Disconnected: %s", client_reason);
3174 else
3175 error = dupstr("Disconnected");
3176 if (wire_reason) {
3177 if (ssh->version == 1) {
3178 send_packet(ssh, SSH1_MSG_DISCONNECT, PKT_STR, wire_reason,
3179 PKT_END);
3180 } else if (ssh->version == 2) {
3181 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT);
3182 ssh2_pkt_adduint32(pktout, code);
3183 ssh2_pkt_addstring(pktout, wire_reason);
3184 ssh2_pkt_addstring(pktout, "en"); /* language tag */
3185 ssh2_pkt_send_noqueue(ssh, pktout);
3186 }
3187 }
3188 ssh->close_expected = TRUE;
3189 ssh->clean_exit = clean_exit;
3190 ssh_closing((Plug)ssh, error, 0, 0);
3191 sfree(error);
3192}
3193
3194/*
fb09bf1c 3195 * Handle the key exchange and user authentication phases.
3196 */
ff3187f6 3197static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
3198 struct Packet *pktin)
fb09bf1c 3199{
0016d70b 3200 int i, j, ret;
3201 unsigned char cookie[8], *ptr;
374330e2 3202 struct RSAKey servkey, hostkey;
3203 struct MD5Context md5c;
51470298 3204 struct do_ssh1_login_state {
3205 int len;
3206 unsigned char *rsabuf, *keystr1, *keystr2;
3207 unsigned long supported_ciphers_mask, supported_auths_mask;
3208 int tried_publickey, tried_agent;
3209 int tis_auth_refused, ccard_auth_refused;
3210 unsigned char session_id[16];
3211 int cipher_type;
3212 char username[100];
3213 void *publickey_blob;
3214 int publickey_bloblen;
edd0cb8a 3215 char *publickey_comment;
3216 int publickey_encrypted;
3217 prompts_t *cur_prompt;
51470298 3218 char c;
3219 int pwpkt_type;
3220 unsigned char request[5], *response, *p;
3221 int responselen;
3222 int keyi, nkeys;
3223 int authed;
3224 struct RSAKey key;
3225 Bignum challenge;
3226 char *commentp;
3227 int commentlen;
3d9449a1 3228 int dlgret;
51470298 3229 };
3230 crState(do_ssh1_login_state);
3231
3232 crBegin(ssh->do_ssh1_login_crstate);
374330e2 3233
ff3187f6 3234 if (!pktin)
3235 crWaitUntil(pktin);
374330e2 3236
ff3187f6 3237 if (pktin->type != SSH1_SMSG_PUBLIC_KEY) {
6b5cf8b4 3238 bombout(("Public key packet not received"));
7ffdbc1a 3239 crStop(0);
8d5de777 3240 }
374330e2 3241
c5e9c988 3242 logevent("Received public keys");
374330e2 3243
ff3187f6 3244 ptr = ssh_pkt_getdata(pktin, 8);
0016d70b 3245 if (!ptr) {
2e85c969 3246 bombout(("SSH-1 public key packet stopped before random cookie"));
0016d70b 3247 crStop(0);
3248 }
3249 memcpy(cookie, ptr, 8);
374330e2 3250
ff3187f6 3251 if (!ssh1_pkt_getrsakey(pktin, &servkey, &s->keystr1) ||
3252 !ssh1_pkt_getrsakey(pktin, &hostkey, &s->keystr2)) {
2e85c969 3253 bombout(("Failed to read SSH-1 public keys from public key packet"));
0016d70b 3254 crStop(0);
3255 }
374330e2 3256
c5e9c988 3257 /*
1c2a93c4 3258 * Log the host key fingerprint.
c5e9c988 3259 */
c5e9c988 3260 {
3261 char logmsg[80];
1c2a93c4 3262 logevent("Host key fingerprint is:");
c5e9c988 3263 strcpy(logmsg, " ");
32874aea 3264 hostkey.comment = NULL;
3265 rsa_fingerprint(logmsg + strlen(logmsg),
3266 sizeof(logmsg) - strlen(logmsg), &hostkey);
c5e9c988 3267 logevent(logmsg);
3268 }
3269
ff3187f6 3270 ssh->v1_remote_protoflags = ssh_pkt_getuint32(pktin);
3271 s->supported_ciphers_mask = ssh_pkt_getuint32(pktin);
3272 s->supported_auths_mask = ssh_pkt_getuint32(pktin);
d5b2c841 3273 if ((ssh->remote_bugs & BUG_CHOKES_ON_RSA))
3274 s->supported_auths_mask &= ~(1 << SSH1_AUTH_RSA);
bea1ef5f 3275
51470298 3276 ssh->v1_local_protoflags =
3277 ssh->v1_remote_protoflags & SSH1_PROTOFLAGS_SUPPORTED;
3278 ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
b96dc54c 3279
c5e9c988 3280 MD5Init(&md5c);
51470298 3281 MD5Update(&md5c, s->keystr2, hostkey.bytes);
3282 MD5Update(&md5c, s->keystr1, servkey.bytes);
0016d70b 3283 MD5Update(&md5c, cookie, 8);
51470298 3284 MD5Final(s->session_id, &md5c);
374330e2 3285
32874aea 3286 for (i = 0; i < 32; i++)
51470298 3287 ssh->session_key[i] = random_byte();
374330e2 3288
0016d70b 3289 /*
3290 * Verify that the `bits' and `bytes' parameters match.
3291 */
3292 if (hostkey.bits > hostkey.bytes * 8 ||
3293 servkey.bits > servkey.bytes * 8) {
2e85c969 3294 bombout(("SSH-1 public keys were badly formatted"));
0016d70b 3295 crStop(0);
3296 }
3297
51470298 3298 s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
374330e2 3299
3d88e64d 3300 s->rsabuf = snewn(s->len, unsigned char);
374330e2 3301
89ee5268 3302 /*
3303 * Verify the host key.
3304 */
3305 {
32874aea 3306 /*
3307 * First format the key into a string.
3308 */
3309 int len = rsastr_len(&hostkey);
3310 char fingerprint[100];
3d88e64d 3311 char *keystr = snewn(len, char);
32874aea 3312 rsastr_fmt(keystr, &hostkey);
3313 rsa_fingerprint(fingerprint, sizeof(fingerprint), &hostkey);
3d9449a1 3314
3315 ssh_set_frozen(ssh, 1);
3316 s->dlgret = verify_ssh_host_key(ssh->frontend,
3317 ssh->savedhost, ssh->savedport,
3318 "rsa", keystr, fingerprint,
3319 ssh_dialog_callback, ssh);
32874aea 3320 sfree(keystr);
3d9449a1 3321 if (s->dlgret < 0) {
3322 do {
3323 crReturn(0);
3324 if (pktin) {
3325 bombout(("Unexpected data from server while waiting"
3326 " for user host key response"));
3327 crStop(0);
3328 }
3329 } while (pktin || inlen > 0);
3330 s->dlgret = ssh->user_response;
3331 }
3332 ssh_set_frozen(ssh, 0);
3333
3334 if (s->dlgret == 0) {
9e296bfa 3335 ssh_disconnect(ssh, "User aborted at host key verification",
3336 NULL, 0, TRUE);
2b3f6c19 3337 crStop(0);
3d9449a1 3338 }
32874aea 3339 }
3340
3341 for (i = 0; i < 32; i++) {
51470298 3342 s->rsabuf[i] = ssh->session_key[i];
374330e2 3343 if (i < 16)
51470298 3344 s->rsabuf[i] ^= s->session_id[i];
374330e2 3345 }
3346
3347 if (hostkey.bytes > servkey.bytes) {
0016d70b 3348 ret = rsaencrypt(s->rsabuf, 32, &servkey);
3349 if (ret)
3350 ret = rsaencrypt(s->rsabuf, servkey.bytes, &hostkey);
374330e2 3351 } else {
0016d70b 3352 ret = rsaencrypt(s->rsabuf, 32, &hostkey);
3353 if (ret)
3354 ret = rsaencrypt(s->rsabuf, hostkey.bytes, &servkey);
3355 }
3356 if (!ret) {
2e85c969 3357 bombout(("SSH-1 public key encryptions failed due to bad formatting"));
0016d70b 3358 crStop(0);
374330e2 3359 }
3360
c5e9c988 3361 logevent("Encrypted session key");
3362
ca20bfcf 3363 {
3364 int cipher_chosen = 0, warn = 0;
3365 char *cipher_string = NULL;
51470298 3366 int i;
ca20bfcf 3367 for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) {
86916870 3368 int next_cipher = ssh->cfg.ssh_cipherlist[i];
ca20bfcf 3369 if (next_cipher == CIPHER_WARN) {
3370 /* If/when we choose a cipher, warn about it */
3371 warn = 1;
3372 } else if (next_cipher == CIPHER_AES) {
3373 /* XXX Probably don't need to mention this. */
2e85c969 3374 logevent("AES not supported in SSH-1, skipping");
ca20bfcf 3375 } else {
3376 switch (next_cipher) {
51470298 3377 case CIPHER_3DES: s->cipher_type = SSH_CIPHER_3DES;
ca20bfcf 3378 cipher_string = "3DES"; break;
51470298 3379 case CIPHER_BLOWFISH: s->cipher_type = SSH_CIPHER_BLOWFISH;
ca20bfcf 3380 cipher_string = "Blowfish"; break;
51470298 3381 case CIPHER_DES: s->cipher_type = SSH_CIPHER_DES;
ca20bfcf 3382 cipher_string = "single-DES"; break;
3383 }
51470298 3384 if (s->supported_ciphers_mask & (1 << s->cipher_type))
ca20bfcf 3385 cipher_chosen = 1;
3386 }
3387 }
3388 if (!cipher_chosen) {
51470298 3389 if ((s->supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0)
2e85c969 3390 bombout(("Server violates SSH-1 protocol by not "
ca20bfcf 3391 "supporting 3DES encryption"));
3392 else
3393 /* shouldn't happen */
6b5cf8b4 3394 bombout(("No supported ciphers found"));
7ffdbc1a 3395 crStop(0);
a99a05c0 3396 }
ca20bfcf 3397
3398 /* Warn about chosen cipher if necessary. */
bb348ab1 3399 if (warn) {
3d9449a1 3400 ssh_set_frozen(ssh, 1);
3401 s->dlgret = askalg(ssh->frontend, "cipher", cipher_string,
3402 ssh_dialog_callback, ssh);
3403 if (s->dlgret < 0) {
3404 do {
3405 crReturn(0);
3406 if (pktin) {
3407 bombout(("Unexpected data from server while waiting"
3408 " for user response"));
3409 crStop(0);
3410 }
3411 } while (pktin || inlen > 0);
3412 s->dlgret = ssh->user_response;
3413 }
3414 ssh_set_frozen(ssh, 0);
3415 if (s->dlgret == 0) {
9e296bfa 3416 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
3417 0, TRUE);
96ccde8b 3418 crStop(0);
3d9449a1 3419 }
bb348ab1 3420 }
bea1ef5f 3421 }
ca20bfcf 3422
51470298 3423 switch (s->cipher_type) {
32874aea 3424 case SSH_CIPHER_3DES:
3425 logevent("Using 3DES encryption");
3426 break;
3427 case SSH_CIPHER_DES:
3428 logevent("Using single-DES encryption");
3429 break;
3430 case SSH_CIPHER_BLOWFISH:
3431 logevent("Using Blowfish encryption");
3432 break;
c5e9c988 3433 }
bea1ef5f 3434
51470298 3435 send_packet(ssh, SSH1_CMSG_SESSION_KEY,
3436 PKT_CHAR, s->cipher_type,
32874aea 3437 PKT_DATA, cookie, 8,
51470298 3438 PKT_CHAR, (s->len * 8) >> 8, PKT_CHAR, (s->len * 8) & 0xFF,
3439 PKT_DATA, s->rsabuf, s->len,
3440 PKT_INT, ssh->v1_local_protoflags, PKT_END);
fb09bf1c 3441
c5e9c988 3442 logevent("Trying to enable encryption...");
374330e2 3443
51470298 3444 sfree(s->rsabuf);
374330e2 3445
51470298 3446 ssh->cipher = (s->cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish_ssh1 :
3447 s->cipher_type == SSH_CIPHER_DES ? &ssh_des :
3448 &ssh_3des);
371e569c 3449 ssh->v1_cipher_ctx = ssh->cipher->make_context();
3450 ssh->cipher->sesskey(ssh->v1_cipher_ctx, ssh->session_key);
57356d63 3451 logeventf(ssh, "Initialised %s encryption", ssh->cipher->text_name);
374330e2 3452
0183b242 3453 ssh->crcda_ctx = crcda_make_context();
3454 logevent("Installing CRC compensation attack detector");
3455
679539d7 3456 if (servkey.modulus) {
3457 sfree(servkey.modulus);
3458 servkey.modulus = NULL;
3459 }
3460 if (servkey.exponent) {
3461 sfree(servkey.exponent);
3462 servkey.exponent = NULL;
3463 }
3464 if (hostkey.modulus) {
3465 sfree(hostkey.modulus);
3466 hostkey.modulus = NULL;
3467 }
3468 if (hostkey.exponent) {
3469 sfree(hostkey.exponent);
3470 hostkey.exponent = NULL;
3471 }
ff3187f6 3472 crWaitUntil(pktin);
374330e2 3473
ff3187f6 3474 if (pktin->type != SSH1_SMSG_SUCCESS) {
6b5cf8b4 3475 bombout(("Encryption not successfully enabled"));
7ffdbc1a 3476 crStop(0);
8d5de777 3477 }
374330e2 3478
c5e9c988 3479 logevent("Successfully started encryption");
3480
edd0cb8a 3481 fflush(stdout); /* FIXME eh? */
374330e2 3482 {
471c20b0 3483 if (!get_remote_username(&ssh->cfg, s->username,
3484 sizeof(s->username))) {
edd0cb8a 3485 int ret; /* need not be kept over crReturn */
3486 s->cur_prompt = new_prompts(ssh->frontend);
3487 s->cur_prompt->to_server = TRUE;
3488 s->cur_prompt->name = dupstr("SSH login name");
3489 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
3490 lenof(s->username));
3491 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3492 while (ret < 0) {
51470298 3493 ssh->send_ok = 1;
edd0cb8a 3494 crWaitUntil(!pktin);
3495 ret = get_userpass_input(s->cur_prompt, in, inlen);
3496 ssh->send_ok = 0;
3497 }
3498 if (!ret) {
3499 /*
3500 * Failed to get a username. Terminate.
3501 */
3502 free_prompts(s->cur_prompt);
3503 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
3504 crStop(0);
32874aea 3505 }
edd0cb8a 3506 memcpy(s->username, s->cur_prompt->prompts[0]->result,
3507 lenof(s->username));
3508 free_prompts(s->cur_prompt);
374330e2 3509 }
fb09bf1c 3510
51470298 3511 send_packet(ssh, SSH1_CMSG_USER, PKT_STR, s->username, PKT_END);
c5e9c988 3512 {
edd0cb8a 3513 char *userlog = dupprintf("Sent username \"%s\"", s->username);
c5e9c988 3514 logevent(userlog);
32874aea 3515 if (flags & FLAG_INTERACTIVE &&
3516 (!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) {
51470298 3517 c_write_str(ssh, userlog);
edd0cb8a 3518 c_write_str(ssh, "\r\n");
3c8e959b 3519 }
edd0cb8a 3520 sfree(userlog);
c5e9c988 3521 }
374330e2 3522 }
3523
ff3187f6 3524 crWaitUntil(pktin);
374330e2 3525
d5b2c841 3526 if ((s->supported_auths_mask & (1 << SSH1_AUTH_RSA)) == 0) {
0df73905 3527 /* We must not attempt PK auth. Pretend we've already tried it. */
51470298 3528 s->tried_publickey = s->tried_agent = 1;
0df73905 3529 } else {
51470298 3530 s->tried_publickey = s->tried_agent = 0;
0df73905 3531 }
51470298 3532 s->tis_auth_refused = s->ccard_auth_refused = 0;
edd0cb8a 3533 /*
3534 * Load the public half of any configured keyfile for later use.
3535 */
9a30e26b 3536 if (!filename_is_null(ssh->cfg.keyfile)) {
edd0cb8a 3537 int keytype;
3538 logeventf(ssh, "Reading private key file \"%.150s\"",
3539 filename_to_str(&ssh->cfg.keyfile));
3540 keytype = key_type(&ssh->cfg.keyfile);
3541 if (keytype == SSH_KEYTYPE_SSH1) {
3542 const char *error;
3543 if (rsakey_pubblob(&ssh->cfg.keyfile,
3544 &s->publickey_blob, &s->publickey_bloblen,
3545 &s->publickey_comment, &error)) {
3546 s->publickey_encrypted = rsakey_encrypted(&ssh->cfg.keyfile,
3547 NULL);
3548 } else {
3549 char *msgbuf;
3550 logeventf(ssh, "Unable to load private key (%s)", error);
3551 msgbuf = dupprintf("Unable to load private key file "
3552 "\"%.150s\" (%s)\r\n",
3553 filename_to_str(&ssh->cfg.keyfile),
3554 error);
3555 c_write_str(ssh, msgbuf);
3556 sfree(msgbuf);
3557 s->publickey_blob = NULL;
3558 }
3559 } else {
3560 char *msgbuf;
3561 logeventf(ssh, "Unable to use this key file (%s)",
3562 key_type_to_str(keytype));
3563 msgbuf = dupprintf("Unable to use key file \"%.150s\""
3564 " (%s)\r\n",
3565 filename_to_str(&ssh->cfg.keyfile),
3566 key_type_to_str(keytype));
3567 c_write_str(ssh, msgbuf);
3568 sfree(msgbuf);
51470298 3569 s->publickey_blob = NULL;
edd0cb8a 3570 }
396778f1 3571 } else
51470298 3572 s->publickey_blob = NULL;
7cca0d81 3573
ff3187f6 3574 while (pktin->type == SSH1_SMSG_FAILURE) {
51470298 3575 s->pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
614a20a0 3576
973612f5 3577 if (ssh->cfg.tryagent && agent_exists() && !s->tried_agent) {
32874aea 3578 /*
3579 * Attempt RSA authentication using Pageant.
3580 */
32874aea 3581 void *r;
3582
51470298 3583 s->authed = FALSE;
3584 s->tried_agent = 1;
32874aea 3585 logevent("Pageant is running. Requesting keys.");
3586
3587 /* Request the keys held by the agent. */
51470298 3588 PUT_32BIT(s->request, 1);
3589 s->request[4] = SSH1_AGENTC_REQUEST_RSA_IDENTITIES;
839f10db 3590 if (!agent_query(s->request, 5, &r, &s->responselen,
3591 ssh_agent_callback, ssh)) {
3592 do {
3593 crReturn(0);
ff3187f6 3594 if (pktin) {
839f10db 3595 bombout(("Unexpected data from server while waiting"
3596 " for agent response"));
3597 crStop(0);
3598 }
ff3187f6 3599 } while (pktin || inlen > 0);
839f10db 3600 r = ssh->agent_response;
3601 s->responselen = ssh->agent_response_len;
3602 }
51470298 3603 s->response = (unsigned char *) r;
3604 if (s->response && s->responselen >= 5 &&
3605 s->response[4] == SSH1_AGENT_RSA_IDENTITIES_ANSWER) {
3606 s->p = s->response + 5;
3607 s->nkeys = GET_32BIT(s->p);
3608 s->p += 4;
2e85c969 3609 logeventf(ssh, "Pageant has %d SSH-1 keys", s->nkeys);
51470298 3610 for (s->keyi = 0; s->keyi < s->nkeys; s->keyi++) {
94cd7c3a 3611 unsigned char *pkblob = s->p;
51470298 3612 s->p += 4;
0016d70b 3613 {
3614 int n, ok = FALSE;
3615 do { /* do while (0) to make breaking easy */
3616 n = ssh1_read_bignum
3617 (s->p, s->responselen-(s->p-s->response),
3618 &s->key.exponent);
3619 if (n < 0)
3620 break;
3621 s->p += n;
3622 n = ssh1_read_bignum
3623 (s->p, s->responselen-(s->p-s->response),
3624 &s->key.modulus);
3625 if (n < 0)
3626 break;
3627 s->p += n;
3628 if (s->responselen - (s->p-s->response) < 4)
3629 break;
3630 s->commentlen = GET_32BIT(s->p);
3631 s->p += 4;
3632 if (s->responselen - (s->p-s->response) <
3633 s->commentlen)
3634 break;
3635 s->commentp = (char *)s->p;
3636 s->p += s->commentlen;
3637 ok = TRUE;
3638 } while (0);
3639 if (!ok) {
3640 logevent("Pageant key list packet was truncated");
3641 break;
3642 }
3643 }
94cd7c3a 3644 if (s->publickey_blob) {
3645 if (!memcmp(pkblob, s->publickey_blob,
3646 s->publickey_bloblen)) {
3647 logeventf(ssh, "Pageant key #%d matches "
3648 "configured key file", s->keyi);
3649 s->tried_publickey = 1;
3650 } else
3651 /* Skip non-configured key */
3652 continue;
3653 }
3654 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
51470298 3655 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3656 PKT_BIGNUM, s->key.modulus, PKT_END);
ff3187f6 3657 crWaitUntil(pktin);
3658 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
32874aea 3659 logevent("Key refused");
3660 continue;
3661 }
3662 logevent("Received RSA challenge");
ff3187f6 3663 if ((s->challenge = ssh1_pkt_getmp(pktin)) == NULL) {
0016d70b 3664 bombout(("Server's RSA challenge was badly formatted"));
3665 crStop(0);
3666 }
3667
32874aea 3668 {
3669 char *agentreq, *q, *ret;
2d466ffd 3670 void *vret;
32874aea 3671 int len, retlen;
3672 len = 1 + 4; /* message type, bit count */
51470298 3673 len += ssh1_bignum_length(s->key.exponent);
3674 len += ssh1_bignum_length(s->key.modulus);
3675 len += ssh1_bignum_length(s->challenge);
32874aea 3676 len += 16; /* session id */
3677 len += 4; /* response format */
3d88e64d 3678 agentreq = snewn(4 + len, char);
32874aea 3679 PUT_32BIT(agentreq, len);
3680 q = agentreq + 4;
3681 *q++ = SSH1_AGENTC_RSA_CHALLENGE;
51470298 3682 PUT_32BIT(q, bignum_bitcount(s->key.modulus));
32874aea 3683 q += 4;
51470298 3684 q += ssh1_write_bignum(q, s->key.exponent);
3685 q += ssh1_write_bignum(q, s->key.modulus);
3686 q += ssh1_write_bignum(q, s->challenge);
3687 memcpy(q, s->session_id, 16);
32874aea 3688 q += 16;
3689 PUT_32BIT(q, 1); /* response format */
839f10db 3690 if (!agent_query(agentreq, len + 4, &vret, &retlen,
3691 ssh_agent_callback, ssh)) {
3692 sfree(agentreq);
3693 do {
3694 crReturn(0);
ff3187f6 3695 if (pktin) {
839f10db 3696 bombout(("Unexpected data from server"
3697 " while waiting for agent"
3698 " response"));
3699 crStop(0);
3700 }
ff3187f6 3701 } while (pktin || inlen > 0);
839f10db 3702 vret = ssh->agent_response;
3703 retlen = ssh->agent_response_len;
3704 } else
3705 sfree(agentreq);
2d466ffd 3706 ret = vret;
32874aea 3707 if (ret) {
3708 if (ret[4] == SSH1_AGENT_RSA_RESPONSE) {
3709 logevent("Sending Pageant's response");
51470298 3710 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
32874aea 3711 PKT_DATA, ret + 5, 16,
3712 PKT_END);
3713 sfree(ret);
ff3187f6 3714 crWaitUntil(pktin);
3715 if (pktin->type == SSH1_SMSG_SUCCESS) {
32874aea 3716 logevent
3717 ("Pageant's response accepted");
3718 if (flags & FLAG_VERBOSE) {
51470298 3719 c_write_str(ssh, "Authenticated using"
3720 " RSA key \"");
3721 c_write(ssh, s->commentp,
3722 s->commentlen);
3723 c_write_str(ssh, "\" from agent\r\n");
32874aea 3724 }
51470298 3725 s->authed = TRUE;
32874aea 3726 } else
3727 logevent
3728 ("Pageant's response not accepted");
3729 } else {
3730 logevent
3731 ("Pageant failed to answer challenge");
3732 sfree(ret);
3733 }
3734 } else {
3735 logevent("No reply received from Pageant");
3736 }
3737 }
51470298 3738 freebn(s->key.exponent);
3739 freebn(s->key.modulus);
3740 freebn(s->challenge);
3741 if (s->authed)
32874aea 3742 break;
3743 }
29b1d0b3 3744 sfree(s->response);
94cd7c3a 3745 if (s->publickey_blob && !s->tried_publickey)
3746 logevent("Configured key file not in Pageant");
32874aea 3747 }
51470298 3748 if (s->authed)
32874aea 3749 break;
3750 }
edd0cb8a 3751 if (s->publickey_blob && !s->tried_publickey) {
3752 /*
3753 * Try public key authentication with the specified
3754 * key file.
3755 */
3756 int got_passphrase; /* need not be kept over crReturn */
3757 if (flags & FLAG_VERBOSE)
3758 c_write_str(ssh, "Trying public key authentication.\r\n");
3759 logeventf(ssh, "Trying public key \"%s\"",
3760 filename_to_str(&ssh->cfg.keyfile));
3761 s->tried_publickey = 1;
3762 got_passphrase = FALSE;
3763 while (!got_passphrase) {
3764 /*
3765 * Get a passphrase, if necessary.
3766 */
3767 char *passphrase = NULL; /* only written after crReturn */
3768 const char *error;
3769 if (!s->publickey_encrypted) {
3770 if (flags & FLAG_VERBOSE)
3771 c_write_str(ssh, "No passphrase required.\r\n");
3772 passphrase = NULL;
3773 } else {
3774 int ret; /* need not be kept over crReturn */
3775 s->cur_prompt = new_prompts(ssh->frontend);
3776 s->cur_prompt->to_server = FALSE;
3777 s->cur_prompt->name = dupstr("SSH key passphrase");
3778 add_prompt(s->cur_prompt,
3779 dupprintf("Passphrase for key \"%.100s\": ",
3780 s->publickey_comment),
3781 FALSE, SSH_MAX_PASSWORD_LEN);
3782 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3783 while (ret < 0) {
3784 ssh->send_ok = 1;
3785 crWaitUntil(!pktin);
3786 ret = get_userpass_input(s->cur_prompt, in, inlen);
3787 ssh->send_ok = 0;
3788 }
3789 if (!ret) {
3790 /* Failed to get a passphrase. Terminate. */
3791 free_prompts(s->cur_prompt);
3792 ssh_disconnect(ssh, NULL, "Unable to authenticate",
3793 0, TRUE);
3794 crStop(0);
3795 }
3796 passphrase = dupstr(s->cur_prompt->prompts[0]->result);
3797 free_prompts(s->cur_prompt);
3798 }
3799 /*
3800 * Try decrypting key with passphrase.
3801 */
3802 ret = loadrsakey(&ssh->cfg.keyfile, &s->key, passphrase,
3803 &error);
3804 if (passphrase) {
3805 memset(passphrase, 0, strlen(passphrase));
3806 sfree(passphrase);
3807 }
3808 if (ret == 1) {
3809 /* Correct passphrase. */
3810 got_passphrase = TRUE;
3811 } else if (ret == 0) {
3812 c_write_str(ssh, "Couldn't load private key from ");
3813 c_write_str(ssh, filename_to_str(&ssh->cfg.keyfile));
3814 c_write_str(ssh, " (");
3815 c_write_str(ssh, error);
3816 c_write_str(ssh, ").\r\n");
3817 got_passphrase = FALSE;
3818 break; /* go and try something else */
3819 } else if (ret == -1) {
3820 c_write_str(ssh, "Wrong passphrase.\r\n"); /* FIXME */
edd0cb8a 3821 got_passphrase = FALSE;
3822 /* and try again */
43536490 3823 } else {
3824 assert(0 && "unexpected return from loadrsakey()");
edc23a8a 3825 got_passphrase = FALSE; /* placate optimisers */
edd0cb8a 3826 }
3827 }
3828
3829 if (got_passphrase) {
3830
3831 /*
3832 * Send a public key attempt.
3833 */
3834 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3835 PKT_BIGNUM, s->key.modulus, PKT_END);
3836
3837 crWaitUntil(pktin);
3838 if (pktin->type == SSH1_SMSG_FAILURE) {
3839 c_write_str(ssh, "Server refused our public key.\r\n");
7b575324 3840 continue; /* go and try something else */
edd0cb8a 3841 }
3842 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
3843 bombout(("Bizarre response to offer of public key"));
3844 crStop(0);
3845 }
3846
3847 {
3848 int i;
3849 unsigned char buffer[32];
3850 Bignum challenge, response;
3851
3852 if ((challenge = ssh1_pkt_getmp(pktin)) == NULL) {
3853 bombout(("Server's RSA challenge was badly formatted"));
3854 crStop(0);
3855 }
3856 response = rsadecrypt(challenge, &s->key);
3857 freebn(s->key.private_exponent);/* burn the evidence */
3858
3859 for (i = 0; i < 32; i++) {
3860 buffer[i] = bignum_byte(response, 31 - i);
3861 }
3862
3863 MD5Init(&md5c);
3864 MD5Update(&md5c, buffer, 32);
3865 MD5Update(&md5c, s->session_id, 16);
3866 MD5Final(buffer, &md5c);
3867
3868 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
3869 PKT_DATA, buffer, 16, PKT_END);
3870
3871 freebn(challenge);
3872 freebn(response);
3873 }
3874
3875 crWaitUntil(pktin);
3876 if (pktin->type == SSH1_SMSG_FAILURE) {
3877 if (flags & FLAG_VERBOSE)
3878 c_write_str(ssh, "Failed to authenticate with"
3879 " our public key.\r\n");
7b575324 3880 continue; /* go and try something else */
edd0cb8a 3881 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
3882 bombout(("Bizarre response to RSA authentication response"));
3883 crStop(0);
3884 }
3885
3886 break; /* we're through! */
3887 }
3888
3889 }
3890
3891 /*
3892 * Otherwise, try various forms of password-like authentication.
3893 */
3894 s->cur_prompt = new_prompts(ssh->frontend);
32874aea 3895
86916870 3896 if (ssh->cfg.try_tis_auth &&
51470298 3897 (s->supported_auths_mask & (1 << SSH1_AUTH_TIS)) &&
3898 !s->tis_auth_refused) {
3899 s->pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
32874aea 3900 logevent("Requested TIS authentication");
51470298 3901 send_packet(ssh, SSH1_CMSG_AUTH_TIS, PKT_END);
ff3187f6 3902 crWaitUntil(pktin);
3903 if (pktin->type != SSH1_SMSG_AUTH_TIS_CHALLENGE) {
32874aea 3904 logevent("TIS authentication declined");
3905 if (flags & FLAG_INTERACTIVE)
51470298 3906 c_write_str(ssh, "TIS authentication refused.\r\n");
3907 s->tis_auth_refused = 1;
614a20a0 3908 continue;
32874aea 3909 } else {
0016d70b 3910 char *challenge;
3911 int challengelen;
edd0cb8a 3912 char *instr_suf, *prompt;
0016d70b 3913
ff3187f6 3914 ssh_pkt_getstring(pktin, &challenge, &challengelen);
0016d70b 3915 if (!challenge) {
3916 bombout(("TIS challenge packet was badly formed"));
3917 crStop(0);
3918 }
32874aea 3919 logevent("Received TIS challenge");
edd0cb8a 3920 s->cur_prompt->to_server = TRUE;
3921 s->cur_prompt->name = dupstr("SSH TIS authentication");
614a20a0 3922 /* Prompt heuristic comes from OpenSSH */
edd0cb8a 3923 if (memchr(challenge, '\n', challengelen)) {
3924 instr_suf = dupstr("");
3925 prompt = dupprintf("%.*s", challengelen, challenge);
3926 } else {
3927 instr_suf = dupprintf("%.*s", challengelen, challenge);
3928 prompt = dupstr("Response: ");
3929 }
3930 s->cur_prompt->instruction =
3931 dupprintf("Using TIS authentication.%s%s",
3932 (*instr_suf) ? "\n" : "",
3933 instr_suf);
3934 s->cur_prompt->instr_reqd = TRUE;
3935 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3936 sfree(instr_suf);
32874aea 3937 }
3938 }
86916870 3939 if (ssh->cfg.try_tis_auth &&
51470298 3940 (s->supported_auths_mask & (1 << SSH1_AUTH_CCARD)) &&
3941 !s->ccard_auth_refused) {
3942 s->pwpkt_type = SSH1_CMSG_AUTH_CCARD_RESPONSE;
32874aea 3943 logevent("Requested CryptoCard authentication");
51470298 3944 send_packet(ssh, SSH1_CMSG_AUTH_CCARD, PKT_END);
ff3187f6 3945 crWaitUntil(pktin);
3946 if (pktin->type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
32874aea 3947 logevent("CryptoCard authentication declined");
51470298 3948 c_write_str(ssh, "CryptoCard authentication refused.\r\n");
3949 s->ccard_auth_refused = 1;
614a20a0 3950 continue;
32874aea 3951 } else {
0016d70b 3952 char *challenge;
3953 int challengelen;
edd0cb8a 3954 char *instr_suf, *prompt;
0016d70b 3955
ff3187f6 3956 ssh_pkt_getstring(pktin, &challenge, &challengelen);
0016d70b 3957 if (!challenge) {
3958 bombout(("CryptoCard challenge packet was badly formed"));
3959 crStop(0);
3960 }
32874aea 3961 logevent("Received CryptoCard challenge");
edd0cb8a 3962 s->cur_prompt->to_server = TRUE;
3963 s->cur_prompt->name = dupstr("SSH CryptoCard authentication");
3964 s->cur_prompt->name_reqd = FALSE;
3965 /* Prompt heuristic comes from OpenSSH */
3966 if (memchr(challenge, '\n', challengelen)) {
3967 instr_suf = dupstr("");
3968 prompt = dupprintf("%.*s", challengelen, challenge);
3969 } else {
3970 instr_suf = dupprintf("%.*s", challengelen, challenge);
3971 prompt = dupstr("Response: ");
3972 }
3973 s->cur_prompt->instruction =
3974 dupprintf("Using CryptoCard authentication.%s%s",
3975 (*instr_suf) ? "\n" : "",
3976 instr_suf);
3977 s->cur_prompt->instr_reqd = TRUE;
3978 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3979 sfree(instr_suf);
32874aea 3980 }
3981 }
51470298 3982 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
8f9e3231 3983 if ((s->supported_auths_mask & (1 << SSH1_AUTH_PASSWORD)) == 0) {
3984 bombout(("No supported authentication methods available"));
3985 crStop(0);
3986 }
edd0cb8a 3987 s->cur_prompt->to_server = TRUE;
3988 s->cur_prompt->name = dupstr("SSH password");
3989 add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
3990 s->username, ssh->savedhost),
3991 FALSE, SSH_MAX_PASSWORD_LEN);
32874aea 3992 }
a52f067e 3993
614a20a0 3994 /*
3995 * Show password prompt, having first obtained it via a TIS
3996 * or CryptoCard exchange if we're doing TIS or CryptoCard
3997 * authentication.
3998 */
edd0cb8a 3999 {
4000 int ret; /* need not be kept over crReturn */
4001 ret = get_userpass_input(s->cur_prompt, NULL, 0);
4002 while (ret < 0) {
4003 ssh->send_ok = 1;
4004 crWaitUntil(!pktin);
4005 ret = get_userpass_input(s->cur_prompt, in, inlen);
4006 ssh->send_ok = 0;
4007 }
4008 if (!ret) {
32874aea 4009 /*
edd0cb8a 4010 * Failed to get a password (for example
32874aea 4011 * because one was supplied on the command line
4012 * which has already failed to work). Terminate.
4013 */
edd0cb8a 4014 free_prompts(s->cur_prompt);
4015 ssh_disconnect(ssh, NULL, "Unable to authenticate", 0, TRUE);
4016 crStop(0);
32874aea 4017 }
32874aea 4018 }
4019
edd0cb8a 4020 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
32874aea 4021 /*
edd0cb8a 4022 * Defence against traffic analysis: we send a
4023 * whole bunch of packets containing strings of
4024 * different lengths. One of these strings is the
4025 * password, in a SSH1_CMSG_AUTH_PASSWORD packet.
4026 * The others are all random data in
4027 * SSH1_MSG_IGNORE packets. This way a passive
4028 * listener can't tell which is the password, and
4029 * hence can't deduce the password length.
4030 *
4031 * Anybody with a password length greater than 16
4032 * bytes is going to have enough entropy in their
4033 * password that a listener won't find it _that_
4034 * much help to know how long it is. So what we'll
4035 * do is:
4036 *
4037 * - if password length < 16, we send 15 packets
4038 * containing string lengths 1 through 15
4039 *
4040 * - otherwise, we let N be the nearest multiple
4041 * of 8 below the password length, and send 8
4042 * packets containing string lengths N through
4043 * N+7. This won't obscure the order of
4044 * magnitude of the password length, but it will
4045 * introduce a bit of extra uncertainty.
4046 *
bf982899 4047 * A few servers can't deal with SSH1_MSG_IGNORE, at
4048 * least in this context. For these servers, we need
4049 * an alternative defence. We make use of the fact
4050 * that the password is interpreted as a C string:
4051 * so we can append a NUL, then some random data.
edd0cb8a 4052 *
bf982899 4053 * A few servers can deal with neither SSH1_MSG_IGNORE
4054 * here _nor_ a padded password string.
4055 * For these servers we are left with no defences
edd0cb8a 4056 * against password length sniffing.
32874aea 4057 */
bf982899 4058 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE) &&
4059 !(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
32874aea 4060 /*
edd0cb8a 4061 * The server can deal with SSH1_MSG_IGNORE, so
4062 * we can use the primary defence.
32874aea 4063 */
edd0cb8a 4064 int bottom, top, pwlen, i;
4065 char *randomstr;
32874aea 4066
edd0cb8a 4067 pwlen = strlen(s->cur_prompt->prompts[0]->result);
4068 if (pwlen < 16) {
4069 bottom = 0; /* zero length passwords are OK! :-) */
4070 top = 15;
4071 } else {
4072 bottom = pwlen & ~7;
4073 top = bottom + 7;
4074 }
32874aea 4075
edd0cb8a 4076 assert(pwlen >= bottom && pwlen <= top);
32874aea 4077
edd0cb8a 4078 randomstr = snewn(top + 1, char);
32874aea 4079
edd0cb8a 4080 for (i = bottom; i <= top; i++) {
4081 if (i == pwlen) {
4082 defer_packet(ssh, s->pwpkt_type,
4083 PKTT_PASSWORD, PKT_STR,
4084 s->cur_prompt->prompts[0]->result,
4085 PKTT_OTHER, PKT_END);
4086 } else {
4087 for (j = 0; j < i; j++) {
4088 do {
4089 randomstr[j] = random_byte();
4090 } while (randomstr[j] == '\0');
32874aea 4091 }
edd0cb8a 4092 randomstr[i] = '\0';
4093 defer_packet(ssh, SSH1_MSG_IGNORE,
4094 PKT_STR, randomstr, PKT_END);
32874aea 4095 }
edd0cb8a 4096 }
4097 logevent("Sending password with camouflage packets");
4098 ssh_pkt_defersend(ssh);
4099 sfree(randomstr);
4100 }
4101 else if (!(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
4102 /*
4103 * The server can't deal with SSH1_MSG_IGNORE
4104 * but can deal with padded passwords, so we
4105 * can use the secondary defence.
4106 */
4107 char string[64];
4108 char *ss;
4109 int len;
4110
4111 len = strlen(s->cur_prompt->prompts[0]->result);
4112 if (len < sizeof(string)) {
4113 ss = string;
4114 strcpy(string, s->cur_prompt->prompts[0]->result);
4115 len++; /* cover the zero byte */
4116 while (len < sizeof(string)) {
4117 string[len++] = (char) random_byte();
bd358db1 4118 }
bd358db1 4119 } else {
edd0cb8a 4120 ss = s->cur_prompt->prompts[0]->result;
32874aea 4121 }
edd0cb8a 4122 logevent("Sending length-padded password");
9a10ecf4 4123 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
edd0cb8a 4124 PKT_INT, len, PKT_DATA, ss, len,
4125 PKTT_OTHER, PKT_END);
4126 } else {
4127 /*
bf982899 4128 * The server is believed unable to cope with
4129 * any of our password camouflage methods.
edd0cb8a 4130 */
4131 int len;
4132 len = strlen(s->cur_prompt->prompts[0]->result);
4133 logevent("Sending unpadded password");
4134 send_packet(ssh, s->pwpkt_type,
4135 PKTT_PASSWORD, PKT_INT, len,
4136 PKT_DATA, s->cur_prompt->prompts[0]->result, len,
4137 PKTT_OTHER, PKT_END);
32874aea 4138 }
edd0cb8a 4139 } else {
4140 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
4141 PKT_STR, s->cur_prompt->prompts[0]->result,
4142 PKTT_OTHER, PKT_END);
32874aea 4143 }
c5e9c988 4144 logevent("Sent password");
edd0cb8a 4145 free_prompts(s->cur_prompt);
ff3187f6 4146 crWaitUntil(pktin);
4147 if (pktin->type == SSH1_SMSG_FAILURE) {
32874aea 4148 if (flags & FLAG_VERBOSE)
51470298 4149 c_write_str(ssh, "Access denied\r\n");
c5e9c988 4150 logevent("Authentication refused");
ff3187f6 4151 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
4152 bombout(("Strange packet received, type %d", pktin->type));
7ffdbc1a 4153 crStop(0);
374330e2 4154 }
4155 }
4156
edd0cb8a 4157 /* Clear up */
4158 if (s->publickey_blob) {
4159 sfree(s->publickey_blob);
4160 sfree(s->publickey_comment);
4161 }
4162
c5e9c988 4163 logevent("Authentication successful");
4164
fb09bf1c 4165 crFinish(1);
4166}
4167
32874aea 4168void sshfwd_close(struct ssh_channel *c)
4169{
51470298 4170 Ssh ssh = c->ssh;
4171
1ef619ae 4172 if (ssh->state == SSH_STATE_CLOSED)
36f94d1f 4173 return;
36f94d1f 4174
75778ef1 4175 if (!c->closes) {
4ed34d25 4176 /*
64d6ff88 4177 * If halfopen is true, we have sent
4ed34d25 4178 * CHANNEL_OPEN for this channel, but it hasn't even been
4179 * acknowledged by the server. So we must set a close flag
4180 * on it now, and then when the server acks the channel
4181 * open, we can close it then.
4182 */
64d6ff88 4183 if (!c->halfopen) {
51470298 4184 if (ssh->version == 1) {
4185 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
4ed34d25 4186 PKT_END);
78280721 4187 c->closes = 1; /* sent MSG_CLOSE */
4ed34d25 4188 } else {
78280721 4189 int bytes_to_send = bufchain_size(&c->v.v2.outbuffer);
4190 if (bytes_to_send > 0) {
4191 /*
4192 * If we still have unsent data in our outgoing
4193 * buffer for this channel, we can't actually
4194 * initiate a close operation yet or that data
4195 * will be lost. Instead, set the pending_close
4196 * flag so that when we do clear the buffer
4197 * we'll start closing the channel.
4198 */
4199 char logmsg[160] = {'\0'};
4200 sprintf(
4201 logmsg,
4202 "Forwarded port pending to be closed : "
4203 "%d bytes remaining",
4204 bytes_to_send);
4205 logevent(logmsg);
4206
4207 c->pending_close = TRUE;
4208 } else {
4209 /*
4210 * No locally buffered data, so we can send the
4211 * close message immediately.
4212 */
4213 struct Packet *pktout;
4214 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
4215 ssh2_pkt_adduint32(pktout, c->remoteid);
4216 ssh2_pkt_send(ssh, pktout);
4217 c->closes = 1; /* sent MSG_CLOSE */
4218 logevent("Nothing left to send, closing channel");
4219 }
4ed34d25 4220 }
32874aea 4221 }
78280721 4222
32874aea 4223 if (c->type == CHAN_X11) {
4224 c->u.x11.s = NULL;
d74d141c 4225 logevent("Forwarded X11 connection terminated");
4ed34d25 4226 } else if (c->type == CHAN_SOCKDATA ||
4227 c->type == CHAN_SOCKDATA_DORMANT) {
d74d141c 4228 c->u.pfd.s = NULL;
4229 logevent("Forwarded port closed");
32874aea 4230 }
4231 }
4232}
4233
5471d09a 4234int sshfwd_write(struct ssh_channel *c, char *buf, int len)
32874aea 4235{
51470298 4236 Ssh ssh = c->ssh;
4237
1ef619ae 4238 if (ssh->state == SSH_STATE_CLOSED)
36f94d1f 4239 return 0;
36f94d1f 4240
51470298 4241 if (ssh->version == 1) {
4242 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
32874aea 4243 PKT_INT, c->remoteid,
a2724fba 4244 PKT_INT, len, PKTT_DATA, PKT_DATA, buf, len,
9a10ecf4 4245 PKTT_OTHER, PKT_END);
5471d09a 4246 /*
2e85c969 4247 * In SSH-1 we can return 0 here - implying that forwarded
5471d09a 4248 * connections are never individually throttled - because
4249 * the only circumstance that can cause throttling will be
4250 * the whole SSH connection backing up, in which case
4251 * _everything_ will be throttled as a whole.
4252 */
4253 return 0;
783415f8 4254 } else {
32874aea 4255 ssh2_add_channel_data(c, buf, len);
5471d09a 4256 return ssh2_try_send(c);
4257 }
4258}
4259
4260void sshfwd_unthrottle(struct ssh_channel *c, int bufsize)
4261{
51470298 4262 Ssh ssh = c->ssh;
ff68564b 4263 int buflimit;
51470298 4264
1ef619ae 4265 if (ssh->state == SSH_STATE_CLOSED)
36f94d1f 4266 return;
36f94d1f 4267
51470298 4268 if (ssh->version == 1) {
ff68564b 4269 buflimit = SSH1_BUFFER_LIMIT;
5471d09a 4270 } else {
ff68564b 4271 buflimit = c->v.v2.locmaxwin;
4272 ssh2_set_window(c, bufsize < buflimit ? buflimit - bufsize : 0);
4273 }
4274 if (c->throttling_conn && bufsize <= buflimit) {
4275 c->throttling_conn = 0;
4276 ssh_throttle_conn(ssh, -1);
783415f8 4277 }
9c964e85 4278}
4279
06fadff5 4280static void ssh_queueing_handler(Ssh ssh, struct Packet *pktin)
4281{
4282 struct queued_handler *qh = ssh->qhead;
4283
4284 assert(qh != NULL);
4285
4286 assert(pktin->type == qh->msg1 || pktin->type == qh->msg2);
4287
4288 if (qh->msg1 > 0) {
4289 assert(ssh->packet_dispatch[qh->msg1] == ssh_queueing_handler);
4290 ssh->packet_dispatch[qh->msg1] = NULL;
4291 }
4292 if (qh->msg2 > 0) {
4293 assert(ssh->packet_dispatch[qh->msg2] == ssh_queueing_handler);
4294 ssh->packet_dispatch[qh->msg2] = NULL;
4295 }
4296
4297 if (qh->next) {
4298 ssh->qhead = qh->next;
4299
4300 if (ssh->qhead->msg1 > 0) {
4301 assert(ssh->packet_dispatch[ssh->qhead->msg1] == NULL);
4302 ssh->packet_dispatch[ssh->qhead->msg1] = ssh_queueing_handler;
4303 }
4304 if (ssh->qhead->msg2 > 0) {
4305 assert(ssh->packet_dispatch[ssh->qhead->msg2] == NULL);
4306 ssh->packet_dispatch[ssh->qhead->msg2] = ssh_queueing_handler;
4307 }
4308 } else {
4309 ssh->qhead = ssh->qtail = NULL;
4310 ssh->packet_dispatch[pktin->type] = NULL;
4311 }
4312
4313 qh->handler(ssh, pktin, qh->ctx);
4314
4315 sfree(qh);
4316}
4317
4318static void ssh_queue_handler(Ssh ssh, int msg1, int msg2,
4319 chandler_fn_t handler, void *ctx)
4320{
4321 struct queued_handler *qh;
4322
4323 qh = snew(struct queued_handler);
4324 qh->msg1 = msg1;
4325 qh->msg2 = msg2;
4326 qh->handler = handler;
4327 qh->ctx = ctx;
4328 qh->next = NULL;
4329
4330 if (ssh->qtail == NULL) {
4331 ssh->qhead = qh;
4332
4333 if (qh->msg1 > 0) {
4334 assert(ssh->packet_dispatch[qh->msg1] == NULL);
4335 ssh->packet_dispatch[qh->msg1] = ssh_queueing_handler;
4336 }
4337 if (qh->msg2 > 0) {
4338 assert(ssh->packet_dispatch[qh->msg2] == NULL);
4339 ssh->packet_dispatch[qh->msg2] = ssh_queueing_handler;
4340 }
4341 } else {
4342 ssh->qtail->next = qh;
4343 }
4344 ssh->qtail = qh;
4345}
4346
4347static void ssh_rportfwd_succfail(Ssh ssh, struct Packet *pktin, void *ctx)
4348{
4349 struct ssh_rportfwd *rpf, *pf = (struct ssh_rportfwd *)ctx;
4350
4351 if (pktin->type == (ssh->version == 1 ? SSH1_SMSG_SUCCESS :
4352 SSH2_MSG_REQUEST_SUCCESS)) {
4353 logeventf(ssh, "Remote port forwarding from %s enabled",
4354 pf->sportdesc);
4355 } else {
4356 logeventf(ssh, "Remote port forwarding from %s refused",
4357 pf->sportdesc);
4358
4359 rpf = del234(ssh->rportfwds, pf);
4360 assert(rpf == pf);
8aea57fd 4361 pf->pfrec->remote = NULL;
fda2feb1 4362 free_rportfwd(pf);
06fadff5 4363 }
4364}
4365
4366static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
4367{
84328ddb 4368 const char *portfwd_strptr = cfg->portfwd;
4369 struct ssh_portfwd *epf;
4370 int i;
06fadff5 4371
fda2feb1 4372 if (!ssh->portfwds) {
4373 ssh->portfwds = newtree234(ssh_portcmp);
4374 } else {
4375 /*
4376 * Go through the existing port forwardings and tag them
84328ddb 4377 * with status==DESTROY. Any that we want to keep will be
4378 * re-enabled (status==KEEP) as we go through the
4379 * configuration and find out which bits are the same as
4380 * they were before.
fda2feb1 4381 */
4382 struct ssh_portfwd *epf;
4383 int i;
4384 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
84328ddb 4385 epf->status = DESTROY;
fda2feb1 4386 }
4387
06fadff5 4388 while (*portfwd_strptr) {
84328ddb 4389 char address_family, type;
4390 int sport,dport,sserv,dserv;
4391 char sports[256], dports[256], saddr[256], host[256];
4392 int n;
4393
05581745 4394 address_family = 'A';
4395 type = 'L';
84328ddb 4396 if (*portfwd_strptr == 'A' ||
4397 *portfwd_strptr == '4' ||
4398 *portfwd_strptr == '6')
4399 address_family = *portfwd_strptr++;
4400 if (*portfwd_strptr == 'L' ||
4401 *portfwd_strptr == 'R' ||
4402 *portfwd_strptr == 'D')
4403 type = *portfwd_strptr++;
05581745 4404
06fadff5 4405 saddr[0] = '\0';
05581745 4406
06fadff5 4407 n = 0;
4408 while (*portfwd_strptr && *portfwd_strptr != '\t') {
4409 if (*portfwd_strptr == ':') {
4410 /*
4411 * We've seen a colon in the middle of the
4412 * source port number. This means that
4413 * everything we've seen until now is the
4414 * source _address_, so we'll move it into
4415 * saddr and start sports from the beginning
4416 * again.
4417 */
4418 portfwd_strptr++;
4419 sports[n] = '\0';
4420 if (ssh->version == 1 && type == 'R') {
2e85c969 4421 logeventf(ssh, "SSH-1 cannot handle remote source address "
06fadff5 4422 "spec \"%s\"; ignoring", sports);
4423 } else
4424 strcpy(saddr, sports);
4425 n = 0;
4426 }
019164b0 4427 if (n < lenof(sports)-1) sports[n++] = *portfwd_strptr++;
06fadff5 4428 }
4429 sports[n] = 0;
4430 if (type != 'D') {
4431 if (*portfwd_strptr == '\t')
4432 portfwd_strptr++;
4433 n = 0;
4434 while (*portfwd_strptr && *portfwd_strptr != ':') {
019164b0 4435 if (n < lenof(host)-1) host[n++] = *portfwd_strptr++;
06fadff5 4436 }
4437 host[n] = 0;
4438 if (*portfwd_strptr == ':')
4439 portfwd_strptr++;
4440 n = 0;
4441 while (*portfwd_strptr) {
019164b0 4442 if (n < lenof(dports)-1) dports[n++] = *portfwd_strptr++;
06fadff5 4443 }
4444 dports[n] = 0;
4445 portfwd_strptr++;
4446 dport = atoi(dports);
4447 dserv = 0;
4448 if (dport == 0) {
4449 dserv = 1;
4450 dport = net_service_lookup(dports);
4451 if (!dport) {
4452 logeventf(ssh, "Service lookup failed for destination"
4453 " port \"%s\"", dports);
4454 }
4455 }
4456 } else {
4457 while (*portfwd_strptr) portfwd_strptr++;
a9e72926 4458 host[0] = 0;
4459 dports[0] = 0;
06fadff5 4460 dport = dserv = -1;
4461 portfwd_strptr++; /* eat the NUL and move to next one */
4462 }
4463 sport = atoi(sports);
4464 sserv = 0;
4465 if (sport == 0) {
4466 sserv = 1;
4467 sport = net_service_lookup(sports);
4468 if (!sport) {
4469 logeventf(ssh, "Service lookup failed for source"
4470 " port \"%s\"", sports);
4471 }
4472 }
4473 if (sport && dport) {
4474 /* Set up a description of the source port. */
fda2feb1 4475 struct ssh_portfwd *pfrec, *epfrec;
fda2feb1 4476
4477 pfrec = snew(struct ssh_portfwd);
4478 pfrec->type = type;
4479 pfrec->saddr = *saddr ? dupstr(saddr) : NULL;
3fe92132 4480 pfrec->sserv = sserv ? dupstr(sports) : NULL;
fda2feb1 4481 pfrec->sport = sport;
84328ddb 4482 pfrec->daddr = *host ? dupstr(host) : NULL;
3fe92132 4483 pfrec->dserv = dserv ? dupstr(dports) : NULL;
fda2feb1 4484 pfrec->dport = dport;
4485 pfrec->local = NULL;
4486 pfrec->remote = NULL;
05581745 4487 pfrec->addressfamily = (address_family == '4' ? ADDRTYPE_IPV4 :
4488 address_family == '6' ? ADDRTYPE_IPV6 :
4489 ADDRTYPE_UNSPEC);
fda2feb1 4490
4491 epfrec = add234(ssh->portfwds, pfrec);
4492 if (epfrec != pfrec) {
c00c1931 4493 if (epfrec->status == DESTROY) {
4494 /*
4495 * We already have a port forwarding up and running
4496 * with precisely these parameters. Hence, no need
4497 * to do anything; simply re-tag the existing one
4498 * as KEEP.
4499 */
4500 epfrec->status = KEEP;
4501 }
fda2feb1 4502 /*
c00c1931 4503 * Anything else indicates that there was a duplicate
4504 * in our input, which we'll silently ignore.
fda2feb1 4505 */
fda2feb1 4506 free_portfwd(pfrec);
84328ddb 4507 } else {
4508 pfrec->status = CREATE;
4509 }
4510 }
4511 }
4512
4513 /*
4514 * Now go through and destroy any port forwardings which were
4515 * not re-enabled.
4516 */
4517 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4518 if (epf->status == DESTROY) {
4519 char *message;
4520
4521 message = dupprintf("%s port forwarding from %s%s%d",
4522 epf->type == 'L' ? "local" :
4523 epf->type == 'R' ? "remote" : "dynamic",
4524 epf->saddr ? epf->saddr : "",
4525 epf->saddr ? ":" : "",
4526 epf->sport);
4527
4528 if (epf->type != 'D') {
4529 char *msg2 = dupprintf("%s to %s:%d", message,
4530 epf->daddr, epf->dport);
4531 sfree(message);
4532 message = msg2;
4533 }
4534
4535 logeventf(ssh, "Cancelling %s", message);
4536 sfree(message);
4537
8aea57fd 4538 /* epf->remote or epf->local may be NULL if setting up a
4539 * forwarding failed. */
84328ddb 4540 if (epf->remote) {
4541 struct ssh_rportfwd *rpf = epf->remote;
4542 struct Packet *pktout;
4543
4544 /*
4545 * Cancel the port forwarding at the server
4546 * end.
4547 */
4548 if (ssh->version == 1) {
4549 /*
4550 * We cannot cancel listening ports on the
2e85c969 4551 * server side in SSH-1! There's no message
84328ddb 4552 * to support it. Instead, we simply remove
4553 * the rportfwd record from the local end
4554 * so that any connections the server tries
4555 * to make on it are rejected.
4556 */
4557 } else {
4558 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4559 ssh2_pkt_addstring(pktout, "cancel-tcpip-forward");
4560 ssh2_pkt_addbool(pktout, 0);/* _don't_ want reply */
4561 if (epf->saddr) {
4562 ssh2_pkt_addstring(pktout, epf->saddr);
4563 } else if (ssh->cfg.rport_acceptall) {
5188540b 4564 /* XXX: ssh->cfg.rport_acceptall may not represent
4565 * what was used to open the original connection,
4566 * since it's reconfigurable. */
84328ddb 4567 ssh2_pkt_addstring(pktout, "0.0.0.0");
4568 } else {
4569 ssh2_pkt_addstring(pktout, "127.0.0.1");
4570 }
4571 ssh2_pkt_adduint32(pktout, epf->sport);
4572 ssh2_pkt_send(ssh, pktout);
4573 }
4574
4575 del234(ssh->rportfwds, rpf);
4576 free_rportfwd(rpf);
4577 } else if (epf->local) {
4578 pfd_terminate(epf->local);
4579 }
4580
4581 delpos234(ssh->portfwds, i);
4582 free_portfwd(epf);
4583 i--; /* so we don't skip one in the list */
4584 }
4585
4586 /*
4587 * And finally, set up any new port forwardings (status==CREATE).
4588 */
4589 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4590 if (epf->status == CREATE) {
4591 char *sportdesc, *dportdesc;
3fe92132 4592 sportdesc = dupprintf("%s%s%s%s%d%s",
84328ddb 4593 epf->saddr ? epf->saddr : "",
4594 epf->saddr ? ":" : "",
3fe92132 4595 epf->sserv ? epf->sserv : "",
4596 epf->sserv ? "(" : "",
4597 epf->sport,
4598 epf->sserv ? ")" : "");
84328ddb 4599 if (epf->type == 'D') {
4600 dportdesc = NULL;
4601 } else {
3fe92132 4602 dportdesc = dupprintf("%s:%s%s%d%s",
4603 epf->daddr,
4604 epf->dserv ? epf->dserv : "",
4605 epf->dserv ? "(" : "",
4606 epf->dport,
4607 epf->dserv ? ")" : "");
84328ddb 4608 }
05581745 4609
84328ddb 4610 if (epf->type == 'L') {
4611 const char *err = pfd_addforward(epf->daddr, epf->dport,
4612 epf->saddr, epf->sport,
5188540b 4613 ssh, cfg,
84328ddb 4614 &epf->local,
4615 epf->addressfamily);
4616
4617 logeventf(ssh, "Local %sport %s forwarding to %s%s%s",
4618 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4619 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4620 sportdesc, dportdesc,
4621 err ? " failed: " : "", err ? err : "");
4622 } else if (epf->type == 'D') {
06fadff5 4623 const char *err = pfd_addforward(NULL, -1,
84328ddb 4624 epf->saddr, epf->sport,
5188540b 4625 ssh, cfg,
84328ddb 4626 &epf->local,
4627 epf->addressfamily);
4628
4629 logeventf(ssh, "Local %sport %s SOCKS dynamic forwarding%s%s",
4630 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4631 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4632 sportdesc,
4633 err ? " failed: " : "", err ? err : "");
06fadff5 4634 } else {
4635 struct ssh_rportfwd *pf;
4636
4637 /*
4638 * Ensure the remote port forwardings tree exists.
4639 */
4640 if (!ssh->rportfwds) {
4641 if (ssh->version == 1)
4642 ssh->rportfwds = newtree234(ssh_rportcmp_ssh1);
4643 else
4644 ssh->rportfwds = newtree234(ssh_rportcmp_ssh2);
4645 }
4646
4647 pf = snew(struct ssh_rportfwd);
84328ddb 4648 strncpy(pf->dhost, epf->daddr, lenof(pf->dhost)-1);
4649 pf->dhost[lenof(pf->dhost)-1] = '\0';
4650 pf->dport = epf->dport;
4651 pf->sport = epf->sport;
06fadff5 4652 if (add234(ssh->rportfwds, pf) != pf) {
4653 logeventf(ssh, "Duplicate remote port forwarding to %s:%d",
84328ddb 4654 epf->daddr, epf->dport);
06fadff5 4655 sfree(pf);
4656 } else {
4657 logeventf(ssh, "Requesting remote port %s"
84328ddb 4658 " forward to %s", sportdesc, dportdesc);
06fadff5 4659
4660 pf->sportdesc = sportdesc;
4661 sportdesc = NULL;
84328ddb 4662 epf->remote = pf;
4663 pf->pfrec = epf;
06fadff5 4664
4665 if (ssh->version == 1) {
4666 send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST,
84328ddb 4667 PKT_INT, epf->sport,
4668 PKT_STR, epf->daddr,
4669 PKT_INT, epf->dport,
06fadff5 4670 PKT_END);
4671 ssh_queue_handler(ssh, SSH1_SMSG_SUCCESS,
4672 SSH1_SMSG_FAILURE,
4673 ssh_rportfwd_succfail, pf);
4674 } else {
4675 struct Packet *pktout;
4676 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4677 ssh2_pkt_addstring(pktout, "tcpip-forward");
4678 ssh2_pkt_addbool(pktout, 1);/* want reply */
84328ddb 4679 if (epf->saddr) {
4680 ssh2_pkt_addstring(pktout, epf->saddr);
5188540b 4681 } else if (cfg->rport_acceptall) {
06fadff5 4682 ssh2_pkt_addstring(pktout, "0.0.0.0");
4683 } else {
4684 ssh2_pkt_addstring(pktout, "127.0.0.1");
4685 }
84328ddb 4686 ssh2_pkt_adduint32(pktout, epf->sport);
06fadff5 4687 ssh2_pkt_send(ssh, pktout);
4688
4689 ssh_queue_handler(ssh, SSH2_MSG_REQUEST_SUCCESS,
4690 SSH2_MSG_REQUEST_FAILURE,
4691 ssh_rportfwd_succfail, pf);
4692 }
4693 }
4694 }
4695 sfree(sportdesc);
84328ddb 4696 sfree(dportdesc);
06fadff5 4697 }
06fadff5 4698}
4699
51df0ab5 4700static void ssh1_smsg_stdout_stderr_data(Ssh ssh, struct Packet *pktin)
4701{
4702 char *string;
4703 int stringlen, bufsize;
4704
4705 ssh_pkt_getstring(pktin, &string, &stringlen);
4706 if (string == NULL) {
4707 bombout(("Incoming terminal data packet was badly formed"));
4708 return;
4709 }
4710
4711 bufsize = from_backend(ssh->frontend, pktin->type == SSH1_SMSG_STDERR_DATA,
4712 string, stringlen);
4713 if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
4714 ssh->v1_stdout_throttling = 1;
ff68564b 4715 ssh_throttle_conn(ssh, +1);
51df0ab5 4716 }
4717}
4718
4719static void ssh1_smsg_x11_open(Ssh ssh, struct Packet *pktin)
4720{
4721 /* Remote side is trying to open a channel to talk to our
4722 * X-Server. Give them back a local channel number. */
4723 struct ssh_channel *c;
4724 int remoteid = ssh_pkt_getuint32(pktin);
4725
4726 logevent("Received X11 connect request");
4727 /* Refuse if X11 forwarding is disabled. */
4728 if (!ssh->X11_fwd_enabled) {
4729 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4730 PKT_INT, remoteid, PKT_END);
4731 logevent("Rejected X11 connect request");
4732 } else {
4733 c = snew(struct ssh_channel);
4734 c->ssh = ssh;
4735
8def70c3 4736 if (x11_init(&c->u.x11.s, ssh->x11disp, c,
4737 NULL, -1, &ssh->cfg) != NULL) {
51df0ab5 4738 logevent("Opening X11 forward connection failed");
4739 sfree(c);
4740 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4741 PKT_INT, remoteid, PKT_END);
4742 } else {
4743 logevent
4744 ("Opening X11 forward connection succeeded");
4745 c->remoteid = remoteid;
64d6ff88 4746 c->halfopen = FALSE;
51df0ab5 4747 c->localid = alloc_channel_id(ssh);
4748 c->closes = 0;
78280721 4749 c->pending_close = FALSE;
ff68564b 4750 c->throttling_conn = 0;
51df0ab5 4751 c->type = CHAN_X11; /* identify channel type */
4752 add234(ssh->channels, c);
4753 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4754 PKT_INT, c->remoteid, PKT_INT,
4755 c->localid, PKT_END);
4756 logevent("Opened X11 forward channel");
4757 }
4758 }
4759}
4760
4761static void ssh1_smsg_agent_open(Ssh ssh, struct Packet *pktin)
4762{
4763 /* Remote side is trying to open a channel to talk to our
4764 * agent. Give them back a local channel number. */
4765 struct ssh_channel *c;
4766 int remoteid = ssh_pkt_getuint32(pktin);
4767
4768 /* Refuse if agent forwarding is disabled. */
4769 if (!ssh->agentfwd_enabled) {
4770 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4771 PKT_INT, remoteid, PKT_END);
4772 } else {
4773 c = snew(struct ssh_channel);
4774 c->ssh = ssh;
4775 c->remoteid = remoteid;
64d6ff88 4776 c->halfopen = FALSE;
51df0ab5 4777 c->localid = alloc_channel_id(ssh);
4778 c->closes = 0;
78280721 4779 c->pending_close = FALSE;
ff68564b 4780 c->throttling_conn = 0;
51df0ab5 4781 c->type = CHAN_AGENT; /* identify channel type */
4782 c->u.a.lensofar = 0;
4783 add234(ssh->channels, c);
4784 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4785 PKT_INT, c->remoteid, PKT_INT, c->localid,
4786 PKT_END);
4787 }
4788}
4789
4790static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin)
4791{
4792 /* Remote side is trying to open a channel to talk to a
4793 * forwarded port. Give them back a local channel number. */
4794 struct ssh_channel *c;
05581745 4795 struct ssh_rportfwd pf, *pfp;
51df0ab5 4796 int remoteid;
4797 int hostsize, port;
fb983202 4798 char *host;
51df0ab5 4799 const char *e;
4800 c = snew(struct ssh_channel);
4801 c->ssh = ssh;
4802
4803 remoteid = ssh_pkt_getuint32(pktin);
4804 ssh_pkt_getstring(pktin, &host, &hostsize);
4805 port = ssh_pkt_getuint32(pktin);
4806
4807 if (hostsize >= lenof(pf.dhost))
4808 hostsize = lenof(pf.dhost)-1;
4809 memcpy(pf.dhost, host, hostsize);
4810 pf.dhost[hostsize] = '\0';
4811 pf.dport = port;
05581745 4812 pfp = find234(ssh->rportfwds, &pf, NULL);
51df0ab5 4813
05581745 4814 if (pfp == NULL) {
fb983202 4815 logeventf(ssh, "Rejected remote port open request for %s:%d",
4816 pf.dhost, port);
51df0ab5 4817 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4818 PKT_INT, remoteid, PKT_END);
4819 } else {
fb983202 4820 logeventf(ssh, "Received remote port open request for %s:%d",
4821 pf.dhost, port);
51df0ab5 4822 e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port,
05581745 4823 c, &ssh->cfg, pfp->pfrec->addressfamily);
51df0ab5 4824 if (e != NULL) {
fb983202 4825 logeventf(ssh, "Port open failed: %s", e);
51df0ab5 4826 sfree(c);
4827 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4828 PKT_INT, remoteid, PKT_END);
4829 } else {
4830 c->remoteid = remoteid;
64d6ff88 4831 c->halfopen = FALSE;
51df0ab5 4832 c->localid = alloc_channel_id(ssh);
4833 c->closes = 0;
78280721 4834 c->pending_close = FALSE;
ff68564b 4835 c->throttling_conn = 0;
51df0ab5 4836 c->type = CHAN_SOCKDATA; /* identify channel type */
4837 add234(ssh->channels, c);
4838 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4839 PKT_INT, c->remoteid, PKT_INT,
4840 c->localid, PKT_END);
4841 logevent("Forwarded port opened successfully");
4842 }
4843 }
4844}
4845
4846static void ssh1_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
4847{
4848 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4849 unsigned int localid = ssh_pkt_getuint32(pktin);
4850 struct ssh_channel *c;
4851
4852 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4853 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4854 c->remoteid = localid;
64d6ff88 4855 c->halfopen = FALSE;
51df0ab5 4856 c->type = CHAN_SOCKDATA;
ff68564b 4857 c->throttling_conn = 0;
51df0ab5 4858 pfd_confirm(c->u.pfd.s);
4859 }
4860
4861 if (c && c->closes) {
4862 /*
4863 * We have a pending close on this channel,
4864 * which we decided on before the server acked
4865 * the channel open. So now we know the
4866 * remoteid, we can close it again.
4867 */
4868 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE,
4869 PKT_INT, c->remoteid, PKT_END);
4870 }
4871}
4872
4873static void ssh1_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
4874{
4875 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4876 struct ssh_channel *c;
4877
4878 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4879 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4880 logevent("Forwarded connection refused by server");
4881 pfd_close(c->u.pfd.s);
4882 del234(ssh->channels, c);
4883 sfree(c);
4884 }
4885}
4886
4887static void ssh1_msg_channel_close(Ssh ssh, struct Packet *pktin)
4888{
4889 /* Remote side closes a channel. */
4890 unsigned i = ssh_pkt_getuint32(pktin);
4891 struct ssh_channel *c;
4892 c = find234(ssh->channels, &i, ssh_channelfind);
64d6ff88 4893 if (c && !c->halfopen) {
51df0ab5 4894 int closetype;
4895 closetype =
4896 (pktin->type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2);
4897
4898 if ((c->closes == 0) && (c->type == CHAN_X11)) {
4899 logevent("Forwarded X11 connection terminated");
4900 assert(c->u.x11.s != NULL);
4901 x11_close(c->u.x11.s);
4902 c->u.x11.s = NULL;
4903 }
4904 if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) {
4905 logevent("Forwarded port closed");
4906 assert(c->u.pfd.s != NULL);
4907 pfd_close(c->u.pfd.s);
4908 c->u.pfd.s = NULL;
4909 }
4910
4911 c->closes |= (closetype << 2); /* seen this message */
4912 if (!(c->closes & closetype)) {
4913 send_packet(ssh, pktin->type, PKT_INT, c->remoteid,
4914 PKT_END);
4915 c->closes |= closetype; /* sent it too */
4916 }
4917
4918 if (c->closes == 15) {
4919 del234(ssh->channels, c);
4920 sfree(c);
4921 }
4922 } else {
4923 bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n",
4924 pktin->type == SSH1_MSG_CHANNEL_CLOSE ? "" :
4925 "_CONFIRMATION", c ? "half-open" : "nonexistent",
4926 i));
4927 }
4928}
4929
4930static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin)
4931{
4932 /* Data sent down one of our channels. */
4933 int i = ssh_pkt_getuint32(pktin);
4934 char *p;
6d44acc9 4935 int len;
51df0ab5 4936 struct ssh_channel *c;
4937
4938 ssh_pkt_getstring(pktin, &p, &len);
4939
4940 c = find234(ssh->channels, &i, ssh_channelfind);
4941 if (c) {
4942 int bufsize = 0;
4943 switch (c->type) {
4944 case CHAN_X11:
4945 bufsize = x11_send(c->u.x11.s, p, len);
4946 break;
4947 case CHAN_SOCKDATA:
4948 bufsize = pfd_send(c->u.pfd.s, p, len);
4949 break;
4950 case CHAN_AGENT:
4951 /* Data for an agent message. Buffer it. */
4952 while (len > 0) {
4953 if (c->u.a.lensofar < 4) {
62ddb51e 4954 unsigned int l = min(4 - c->u.a.lensofar, (unsigned)len);
51df0ab5 4955 memcpy(c->u.a.msglen + c->u.a.lensofar, p,
4956 l);
4957 p += l;
4958 len -= l;
4959 c->u.a.lensofar += l;
4960 }
4961 if (c->u.a.lensofar == 4) {
4962 c->u.a.totallen =
4963 4 + GET_32BIT(c->u.a.msglen);
4964 c->u.a.message = snewn(c->u.a.totallen,
4965 unsigned char);
4966 memcpy(c->u.a.message, c->u.a.msglen, 4);
4967 }
4968 if (c->u.a.lensofar >= 4 && len > 0) {
aa63ab7e 4969 unsigned int l =
51df0ab5 4970 min(c->u.a.totallen - c->u.a.lensofar,
62ddb51e 4971 (unsigned)len);
51df0ab5 4972 memcpy(c->u.a.message + c->u.a.lensofar, p,
4973 l);
4974 p += l;
4975 len -= l;
4976 c->u.a.lensofar += l;
4977 }
4978 if (c->u.a.lensofar == c->u.a.totallen) {
4979 void *reply;
4980 int replylen;
4981 if (agent_query(c->u.a.message,
4982 c->u.a.totallen,
4983 &reply, &replylen,
4984 ssh_agentf_callback, c))
4985 ssh_agentf_callback(c, reply, replylen);
4986 sfree(c->u.a.message);
4987 c->u.a.lensofar = 0;
4988 }
4989 }
4990 bufsize = 0; /* agent channels never back up */
4991 break;
4992 }
ff68564b 4993 if (!c->throttling_conn && bufsize > SSH1_BUFFER_LIMIT) {
4994 c->throttling_conn = 1;
4995 ssh_throttle_conn(ssh, +1);
51df0ab5 4996 }
4997 }
4998}
4999
5000static void ssh1_smsg_exit_status(Ssh ssh, struct Packet *pktin)
5001{
51df0ab5 5002 ssh->exitcode = ssh_pkt_getuint32(pktin);
fb983202 5003 logeventf(ssh, "Server sent command exit status %d", ssh->exitcode);
51df0ab5 5004 send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
5005 /*
5006 * In case `helpful' firewalls or proxies tack
5007 * extra human-readable text on the end of the
5008 * session which we might mistake for another
5009 * encrypted packet, we close the session once
5010 * we've sent EXIT_CONFIRMATION.
5011 */
9e296bfa 5012 ssh_disconnect(ssh, NULL, NULL, 0, TRUE);
51df0ab5 5013}
5014
c6ccd5c2 5015/* Helper function to deal with sending tty modes for REQUEST_PTY */
5016static void ssh1_send_ttymode(void *data, char *mode, char *val)
5017{
5018 struct Packet *pktout = (struct Packet *)data;
5019 int i = 0;
5020 unsigned int arg = 0;
5021 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
5022 if (i == lenof(ssh_ttymodes)) return;
5023 switch (ssh_ttymodes[i].type) {
5024 case TTY_OP_CHAR:
5025 arg = ssh_tty_parse_specchar(val);
5026 break;
5027 case TTY_OP_BOOL:
5028 arg = ssh_tty_parse_boolean(val);
5029 break;
5030 }
5031 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
5032 ssh2_pkt_addbyte(pktout, arg);
5033}
5034
5035
b09eaa88 5036static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
5037 struct Packet *pktin)
32874aea 5038{
b09eaa88 5039 crBegin(ssh->do_ssh1_connection_crstate);
fb09bf1c 5040
51df0ab5 5041 ssh->packet_dispatch[SSH1_SMSG_STDOUT_DATA] =
5042 ssh->packet_dispatch[SSH1_SMSG_STDERR_DATA] =
5043 ssh1_smsg_stdout_stderr_data;
5044
5045 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_CONFIRMATION] =
5046 ssh1_msg_channel_open_confirmation;
5047 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_FAILURE] =
5048 ssh1_msg_channel_open_failure;
5049 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE] =
5050 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION] =
5051 ssh1_msg_channel_close;
5052 ssh->packet_dispatch[SSH1_MSG_CHANNEL_DATA] = ssh1_msg_channel_data;
5053 ssh->packet_dispatch[SSH1_SMSG_EXIT_STATUS] = ssh1_smsg_exit_status;
5054
86916870 5055 if (ssh->cfg.agentfwd && agent_exists()) {
32874aea 5056 logevent("Requesting agent forwarding");
51470298 5057 send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END);
32874aea 5058 do {
5059 crReturnV;
ff3187f6 5060 } while (!pktin);
5061 if (pktin->type != SSH1_SMSG_SUCCESS
5062 && pktin->type != SSH1_SMSG_FAILURE) {
6b5cf8b4 5063 bombout(("Protocol confusion"));
7ffdbc1a 5064 crStopV;
ff3187f6 5065 } else if (pktin->type == SSH1_SMSG_FAILURE) {
32874aea 5066 logevent("Agent forwarding refused");
5067 } else {
5068 logevent("Agent forwarding enabled");
51470298 5069 ssh->agentfwd_enabled = TRUE;
51df0ab5 5070 ssh->packet_dispatch[SSH1_SMSG_AGENT_OPEN] = ssh1_smsg_agent_open;
db7d555c 5071 }
dacbd0e8 5072 }
5073
d070d2ad 5074 if (ssh->cfg.x11_forward &&
5075 (ssh->x11disp = x11_setup_display(ssh->cfg.x11_display,
5076 ssh->cfg.x11_auth, &ssh->cfg))) {
32874aea 5077 logevent("Requesting X11 forwarding");
f68353be 5078 /*
5079 * Note that while we blank the X authentication data here, we don't
5080 * take any special action to blank the start of an X11 channel,
5081 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
5082 * without having session blanking enabled is likely to leak your
5083 * cookie into the log.
5084 */
51470298 5085 if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) {
5086 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
8def70c3 5087 PKT_STR, ssh->x11disp->remoteauthprotoname,
5088 PKTT_PASSWORD,
5089 PKT_STR, ssh->x11disp->remoteauthdatastring,
5090 PKTT_OTHER,
5091 PKT_INT, ssh->x11disp->screennum,
421d6835 5092 PKT_END);
32874aea 5093 } else {
51470298 5094 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
8def70c3 5095 PKT_STR, ssh->x11disp->remoteauthprotoname,
5096 PKTT_PASSWORD,
5097 PKT_STR, ssh->x11disp->remoteauthdatastring,
5098 PKTT_OTHER,
5099 PKT_END);
32874aea 5100 }
5101 do {
5102 crReturnV;
ff3187f6 5103 } while (!pktin);
5104 if (pktin->type != SSH1_SMSG_SUCCESS
5105 && pktin->type != SSH1_SMSG_FAILURE) {
6b5cf8b4 5106 bombout(("Protocol confusion"));
7ffdbc1a 5107 crStopV;
ff3187f6 5108 } else if (pktin->type == SSH1_SMSG_FAILURE) {
32874aea 5109 logevent("X11 forwarding refused");
5110 } else {
5111 logevent("X11 forwarding enabled");
51470298 5112 ssh->X11_fwd_enabled = TRUE;
51df0ab5 5113 ssh->packet_dispatch[SSH1_SMSG_X11_OPEN] = ssh1_smsg_x11_open;
9c964e85 5114 }
5115 }
5116
06fadff5 5117 ssh_setup_portfwd(ssh, &ssh->cfg);
5118 ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = ssh1_msg_port_open;
d74d141c 5119
86916870 5120 if (!ssh->cfg.nopty) {
c6ccd5c2 5121 struct Packet *pkt;
a5dd8467 5122 /* Unpick the terminal-speed string. */
5123 /* XXX perhaps we should allow no speeds to be sent. */
db219738 5124 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
5125 sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
a5dd8467 5126 /* Send the pty request. */
c6ccd5c2 5127 pkt = ssh1_pkt_init(SSH1_CMSG_REQUEST_PTY);
5128 ssh_pkt_addstring(pkt, ssh->cfg.termtype);
5129 ssh_pkt_adduint32(pkt, ssh->term_height);
5130 ssh_pkt_adduint32(pkt, ssh->term_width);
5131 ssh_pkt_adduint32(pkt, 0); /* width in pixels */
5132 ssh_pkt_adduint32(pkt, 0); /* height in pixels */
5133 parse_ttymodes(ssh, ssh->cfg.ttymodes,
5134 ssh1_send_ttymode, (void *)pkt);
5135 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_ISPEED);
5136 ssh_pkt_adduint32(pkt, ssh->ispeed);
5137 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_OSPEED);
5138 ssh_pkt_adduint32(pkt, ssh->ospeed);
5139 ssh_pkt_addbyte(pkt, SSH_TTY_OP_END);
5140 s_wrpkt(ssh, pkt);
51470298 5141 ssh->state = SSH_STATE_INTERMED;
32874aea 5142 do {
5143 crReturnV;
ff3187f6 5144 } while (!pktin);
5145 if (pktin->type != SSH1_SMSG_SUCCESS
5146 && pktin->type != SSH1_SMSG_FAILURE) {
6b5cf8b4 5147 bombout(("Protocol confusion"));
7ffdbc1a 5148 crStopV;
ff3187f6 5149 } else if (pktin->type == SSH1_SMSG_FAILURE) {
51470298 5150 c_write_str(ssh, "Server refused to allocate pty\r\n");
5151 ssh->editing = ssh->echoing = 1;
32874aea 5152 }
a5dd8467 5153 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
db219738 5154 ssh->ospeed, ssh->ispeed);
0965bee0 5155 } else {
51470298 5156 ssh->editing = ssh->echoing = 1;
374330e2 5157 }
5158
86916870 5159 if (ssh->cfg.compression) {
51470298 5160 send_packet(ssh, SSH1_CMSG_REQUEST_COMPRESSION, PKT_INT, 6, PKT_END);
32874aea 5161 do {
5162 crReturnV;
ff3187f6 5163 } while (!pktin);
5164 if (pktin->type != SSH1_SMSG_SUCCESS
5165 && pktin->type != SSH1_SMSG_FAILURE) {
6b5cf8b4 5166 bombout(("Protocol confusion"));
7ffdbc1a 5167 crStopV;
ff3187f6 5168 } else if (pktin->type == SSH1_SMSG_FAILURE) {
51470298 5169 c_write_str(ssh, "Server refused to compress\r\n");
32874aea 5170 }
4ba9b64b 5171 logevent("Started compression");
51470298 5172 ssh->v1_compressing = TRUE;
5366aed8 5173 ssh->cs_comp_ctx = zlib_compress_init();
5174 logevent("Initialised zlib (RFC1950) compression");
5175 ssh->sc_comp_ctx = zlib_decompress_init();
5176 logevent("Initialised zlib (RFC1950) decompression");
4ba9b64b 5177 }
5178
fd5e5847 5179 /*
5180 * Start the shell or command.
5181 *
2e85c969 5182 * Special case: if the first-choice command is an SSH-2
fd5e5847 5183 * subsystem (hence not usable here) and the second choice
5184 * exists, we fall straight back to that.
5185 */
5186 {
86916870 5187 char *cmd = ssh->cfg.remote_cmd_ptr;
04c52f10 5188
5189 if (!cmd) cmd = ssh->cfg.remote_cmd;
fd5e5847 5190
86916870 5191 if (ssh->cfg.ssh_subsys && ssh->cfg.remote_cmd_ptr2) {
5192 cmd = ssh->cfg.remote_cmd_ptr2;
51470298 5193 ssh->fallback_cmd = TRUE;
fd5e5847 5194 }
5195 if (*cmd)
51470298 5196 send_packet(ssh, SSH1_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END);
fd5e5847 5197 else
51470298 5198 send_packet(ssh, SSH1_CMSG_EXEC_SHELL, PKT_END);
fd5e5847 5199 logevent("Started session");
5200 }
374330e2 5201
51470298 5202 ssh->state = SSH_STATE_SESSION;
5203 if (ssh->size_needed)
5204 ssh_size(ssh, ssh->term_width, ssh->term_height);
5205 if (ssh->eof_needed)
5206 ssh_special(ssh, TS_EOF);
374330e2 5207
b9d7bcad 5208 if (ssh->ldisc)
5209 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
51470298 5210 ssh->send_ok = 1;
5211 ssh->channels = newtree234(ssh_channelcmp);
374330e2 5212 while (1) {
d74d141c 5213
51df0ab5 5214 /*
5215 * By this point, most incoming packets are already being
5216 * handled by the dispatch table, and we need only pay
5217 * attention to the unusual ones.
5218 */
0357890f 5219
51df0ab5 5220 crReturnV;
5221 if (pktin) {
5222 if (pktin->type == SSH1_SMSG_SUCCESS) {
972a41c8 5223 /* may be from EXEC_SHELL on some servers */
ff3187f6 5224 } else if (pktin->type == SSH1_SMSG_FAILURE) {
972a41c8 5225 /* may be from EXEC_SHELL on some servers
374330e2 5226 * if no pty is available or in other odd cases. Ignore */
374330e2 5227 } else {
ff3187f6 5228 bombout(("Strange packet received: type %d", pktin->type));
7ffdbc1a 5229 crStopV;
374330e2 5230 }
5231 } else {
8df7a775 5232 while (inlen > 0) {
5233 int len = min(inlen, 512);
a2724fba 5234 send_packet(ssh, SSH1_CMSG_STDIN_DATA,
5235 PKT_INT, len, PKTT_DATA, PKT_DATA, in, len,
9a10ecf4 5236 PKTT_OTHER, PKT_END);
8df7a775 5237 in += len;
5238 inlen -= len;
5239 }
374330e2 5240 }
5241 }
5242
5243 crFinishV;
5244}
5245
5246/*
2e85c969 5247 * Handle the top-level SSH-2 protocol.
b09eaa88 5248 */
5249static void ssh1_msg_debug(Ssh ssh, struct Packet *pktin)
5250{
fb983202 5251 char *msg;
b09eaa88 5252 int msglen;
5253
5254 ssh_pkt_getstring(pktin, &msg, &msglen);
fb983202 5255 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
b09eaa88 5256}
5257
5258static void ssh1_msg_disconnect(Ssh ssh, struct Packet *pktin)
5259{
5260 /* log reason code in disconnect message */
5261 char *msg;
5262 int msglen;
5263
5264 ssh_pkt_getstring(pktin, &msg, &msglen);
5265 bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg));
5266}
5267
409bfa77 5268static void ssh_msg_ignore(Ssh ssh, struct Packet *pktin)
b09eaa88 5269{
5270 /* Do nothing, because we're ignoring it! Duhh. */
5271}
5272
5273static void ssh1_protocol_setup(Ssh ssh)
5274{
5275 int i;
5276
5277 /*
5278 * Most messages are handled by the coroutines.
5279 */
5280 for (i = 0; i < 256; i++)
5281 ssh->packet_dispatch[i] = NULL;
5282
5283 /*
5284 * These special message types we install handlers for.
5285 */
5286 ssh->packet_dispatch[SSH1_MSG_DISCONNECT] = ssh1_msg_disconnect;
5287 ssh->packet_dispatch[SSH1_MSG_IGNORE] = ssh_msg_ignore;
5288 ssh->packet_dispatch[SSH1_MSG_DEBUG] = ssh1_msg_debug;
5289}
5290
1c1a7262 5291static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
b09eaa88 5292 struct Packet *pktin)
5293{
1c1a7262 5294 unsigned char *in=(unsigned char*)vin;
b09eaa88 5295 if (ssh->state == SSH_STATE_CLOSED)
5296 return;
5297
5298 if (pktin && ssh->packet_dispatch[pktin->type]) {
5299 ssh->packet_dispatch[pktin->type](ssh, pktin);
5300 return;
5301 }
5302
5303 if (!ssh->protocol_initial_phase_done) {
5304 if (do_ssh1_login(ssh, in, inlen, pktin))
5305 ssh->protocol_initial_phase_done = TRUE;
5306 else
5307 return;
5308 }
5309
5310 do_ssh1_connection(ssh, in, inlen, pktin);
5311}
5312
5313/*
e5574168 5314 * Utility routine for decoding comma-separated strings in KEXINIT.
5315 */
32874aea 5316static int in_commasep_string(char *needle, char *haystack, int haylen)
5317{
57356d63 5318 int needlen;
5319 if (!needle || !haystack) /* protect against null pointers */
5320 return 0;
5321 needlen = strlen(needle);
e5574168 5322 while (1) {
32874aea 5323 /*
5324 * Is it at the start of the string?
5325 */
5326 if (haylen >= needlen && /* haystack is long enough */
5327 !memcmp(needle, haystack, needlen) && /* initial match */
5328 (haylen == needlen || haystack[needlen] == ',')
5329 /* either , or EOS follows */
5330 )
5331 return 1;
5332 /*
5333 * If not, search for the next comma and resume after that.
5334 * If no comma found, terminate.
5335 */
5336 while (haylen > 0 && *haystack != ',')
5337 haylen--, haystack++;
5338 if (haylen == 0)
5339 return 0;
5340 haylen--, haystack++; /* skip over comma itself */
e5574168 5341 }
5342}
5343
5344/*
b59743d5 5345 * Similar routine for checking whether we have the first string in a list.
5346 */
5347static int first_in_commasep_string(char *needle, char *haystack, int haylen)
5348{
5349 int needlen;
5350 if (!needle || !haystack) /* protect against null pointers */
5351 return 0;
5352 needlen = strlen(needle);
5353 /*
5354 * Is it at the start of the string?
5355 */
5356 if (haylen >= needlen && /* haystack is long enough */
5357 !memcmp(needle, haystack, needlen) && /* initial match */
5358 (haylen == needlen || haystack[needlen] == ',')
5359 /* either , or EOS follows */
5360 )
5361 return 1;
5362 return 0;
5363}
5364
5365
5366/*
2e85c969 5367 * SSH-2 key creation method.
754c0df9 5368 * (Currently assumes 2 lots of any hash are sufficient to generate
5369 * keys/IVs for any cipher/MAC. SSH2_MKKEY_ITERS documents this assumption.)
d39f364a 5370 */
754c0df9 5371#define SSH2_MKKEY_ITERS (2)
b672f405 5372static void ssh2_mkkey(Ssh ssh, Bignum K, unsigned char *H, char chr,
d8baa528 5373 unsigned char *keyspace)
32874aea 5374{
b672f405 5375 const struct ssh_hash *h = ssh->kex->hash;
5376 void *s;
5377 /* First hlen bytes. */
5378 s = h->init();
51470298 5379 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
b672f405 5380 hash_mpint(h, s, K);
5381 h->bytes(s, H, h->hlen);
5382 h->bytes(s, &chr, 1);
5383 h->bytes(s, ssh->v2_session_id, ssh->v2_session_id_len);
5384 h->final(s, keyspace);
5385 /* Next hlen bytes. */
5386 s = h->init();
51470298 5387 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
b672f405 5388 hash_mpint(h, s, K);
5389 h->bytes(s, H, h->hlen);
5390 h->bytes(s, keyspace, h->hlen);
5391 h->final(s, keyspace + h->hlen);
d39f364a 5392}
5393
5394/*
2e85c969 5395 * Handle the SSH-2 transport layer.
e5574168 5396 */
1c1a7262 5397static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
ff3187f6 5398 struct Packet *pktin)
e5574168 5399{
1c1a7262 5400 unsigned char *in = (unsigned char *)vin;
51470298 5401 struct do_ssh2_transport_state {
4763c1c2 5402 int nbits, pbits, warn_kex, warn_cscipher, warn_sccipher;
51470298 5403 Bignum p, g, e, f, K;
3dc9a6a7 5404 void *our_kexinit;
5405 int our_kexinitlen;
51470298 5406 int kex_init_value, kex_reply_value;
5407 const struct ssh_mac **maclist;
5408 int nmacs;
5409 const struct ssh2_cipher *cscipher_tobe;
5410 const struct ssh2_cipher *sccipher_tobe;
5411 const struct ssh_mac *csmac_tobe;
5412 const struct ssh_mac *scmac_tobe;
5413 const struct ssh_compress *cscomp_tobe;
5414 const struct ssh_compress *sccomp_tobe;
fae1a71b 5415 char *hostkeydata, *sigdata, *rsakeydata, *keystr, *fingerprint;
5416 int hostkeylen, siglen, rsakeylen;
51470298 5417 void *hkey; /* actual host key */
fae1a71b 5418 void *rsakey; /* for RSA kex */
754c0df9 5419 unsigned char exchange_hash[SSH2_KEX_MAX_HASH_LEN];
83e7d008 5420 int n_preferred_kex;
34557659 5421 const struct ssh_kexes *preferred_kex[KEX_MAX];
51470298 5422 int n_preferred_ciphers;
5423 const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX];
5424 const struct ssh_compress *preferred_comp;
ab18ccff 5425 int userauth_succeeded; /* for delayed compression */
5426 int pending_compression;
e13bba36 5427 int got_session_id, activated_authconn;
ff3187f6 5428 struct Packet *pktout;
3d9449a1 5429 int dlgret;
5430 int guessok;
4763c1c2 5431 int ignorepkt;
51470298 5432 };
5433 crState(do_ssh2_transport_state);
5434
5435 crBegin(ssh->do_ssh2_transport_crstate);
5436
5437 s->cscipher_tobe = s->sccipher_tobe = NULL;
5438 s->csmac_tobe = s->scmac_tobe = NULL;
5439 s->cscomp_tobe = s->sccomp_tobe = NULL;
5440
e13bba36 5441 s->got_session_id = s->activated_authconn = FALSE;
ab18ccff 5442 s->userauth_succeeded = FALSE;
5443 s->pending_compression = FALSE;
e5574168 5444
e13bba36 5445 /*
5446 * Be prepared to work around the buggy MAC problem.
5447 */
5448 if (ssh->remote_bugs & BUG_SSH2_HMAC)
5449 s->maclist = buggymacs, s->nmacs = lenof(buggymacs);
5450 else
5451 s->maclist = macs, s->nmacs = lenof(macs);
5452
5453 begin_key_exchange:
acab36bc 5454 ssh->pkt_kctx = SSH2_PKTCTX_NOKEX;
51470298 5455 {
e13bba36 5456 int i, j, commalist_started;
5457
51470298 5458 /*
83e7d008 5459 * Set up the preferred key exchange. (NULL => warn below here)
5460 */
5461 s->n_preferred_kex = 0;
5462 for (i = 0; i < KEX_MAX; i++) {
5463 switch (ssh->cfg.ssh_kexlist[i]) {
5464 case KEX_DHGEX:
5465 s->preferred_kex[s->n_preferred_kex++] =
5466 &ssh_diffiehellman_gex;
5467 break;
5468 case KEX_DHGROUP14:
5469 s->preferred_kex[s->n_preferred_kex++] =
5470 &ssh_diffiehellman_group14;
5471 break;
5472 case KEX_DHGROUP1:
5473 s->preferred_kex[s->n_preferred_kex++] =
5474 &ssh_diffiehellman_group1;
5475 break;
fae1a71b 5476 case KEX_RSA:
5477 s->preferred_kex[s->n_preferred_kex++] =
5478 &ssh_rsa_kex;
5479 break;
754c0df9 5480 case KEX_WARN:
83e7d008 5481 /* Flag for later. Don't bother if it's the last in
5482 * the list. */
5483 if (i < KEX_MAX - 1) {
5484 s->preferred_kex[s->n_preferred_kex++] = NULL;
5485 }
5486 break;
5487 }
5488 }
83e7d008 5489
83e7d008 5490 /*
51470298 5491 * Set up the preferred ciphers. (NULL => warn below here)
5492 */
5493 s->n_preferred_ciphers = 0;
5494 for (i = 0; i < CIPHER_MAX; i++) {
86916870 5495 switch (ssh->cfg.ssh_cipherlist[i]) {
51470298 5496 case CIPHER_BLOWFISH:
5497 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_blowfish;
5498 break;
5499 case CIPHER_DES:
86916870 5500 if (ssh->cfg.ssh2_des_cbc) {
51470298 5501 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_des;
5502 }
5503 break;
5504 case CIPHER_3DES:
5505 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_3des;
5506 break;
5507 case CIPHER_AES:
5508 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_aes;
5509 break;
a2add208 5510 case CIPHER_ARCFOUR:
5511 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_arcfour;
5512 break;
51470298 5513 case CIPHER_WARN:
5514 /* Flag for later. Don't bother if it's the last in
5515 * the list. */
5516 if (i < CIPHER_MAX - 1) {
5517 s->preferred_ciphers[s->n_preferred_ciphers++] = NULL;
5518 }
5519 break;
ca20bfcf 5520 }
ca20bfcf 5521 }
7591b9ff 5522
e13bba36 5523 /*
5524 * Set up preferred compression.
5525 */
5526 if (ssh->cfg.compression)
5527 s->preferred_comp = &ssh_zlib;
5528 else
5529 s->preferred_comp = &ssh_comp_none;
51470298 5530
5531 /*
590f6a5f 5532 * Enable queueing of outgoing auth- or connection-layer
5533 * packets while we are in the middle of a key exchange.
5534 */
5535 ssh->queueing = TRUE;
5536
5537 /*
9442dd57 5538 * Flag that KEX is in progress.
5539 */
5540 ssh->kex_in_progress = TRUE;
5541
5542 /*
51470298 5543 * Construct and send our key exchange packet.
5544 */
ff3187f6 5545 s->pktout = ssh2_pkt_init(SSH2_MSG_KEXINIT);
51470298 5546 for (i = 0; i < 16; i++)
ff3187f6 5547 ssh2_pkt_addbyte(s->pktout, (unsigned char) random_byte());
51470298 5548 /* List key exchange algorithms. */
ff3187f6 5549 ssh2_pkt_addstring_start(s->pktout);
83e7d008 5550 commalist_started = 0;
5551 for (i = 0; i < s->n_preferred_kex; i++) {
34557659 5552 const struct ssh_kexes *k = s->preferred_kex[i];
83e7d008 5553 if (!k) continue; /* warning flag */
34557659 5554 for (j = 0; j < k->nkexes; j++) {
5555 if (commalist_started)
5556 ssh2_pkt_addstring_str(s->pktout, ",");
5557 ssh2_pkt_addstring_str(s->pktout, k->list[j]->name);
5558 commalist_started = 1;
5559 }
32874aea 5560 }
51470298 5561 /* List server host key algorithms. */
ff3187f6 5562 ssh2_pkt_addstring_start(s->pktout);
51470298 5563 for (i = 0; i < lenof(hostkey_algs); i++) {
ff3187f6 5564 ssh2_pkt_addstring_str(s->pktout, hostkey_algs[i]->name);
51470298 5565 if (i < lenof(hostkey_algs) - 1)
ff3187f6 5566 ssh2_pkt_addstring_str(s->pktout, ",");
32874aea 5567 }
51470298 5568 /* List client->server encryption algorithms. */
ff3187f6 5569 ssh2_pkt_addstring_start(s->pktout);
83e7d008 5570 commalist_started = 0;
51470298 5571 for (i = 0; i < s->n_preferred_ciphers; i++) {
5572 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5573 if (!c) continue; /* warning flag */
5574 for (j = 0; j < c->nciphers; j++) {
83e7d008 5575 if (commalist_started)
ff3187f6 5576 ssh2_pkt_addstring_str(s->pktout, ",");
5577 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
83e7d008 5578 commalist_started = 1;
51470298 5579 }
5580 }
5581 /* List server->client encryption algorithms. */
ff3187f6 5582 ssh2_pkt_addstring_start(s->pktout);
83e7d008 5583 commalist_started = 0;
51470298 5584 for (i = 0; i < s->n_preferred_ciphers; i++) {
5585 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5586 if (!c) continue; /* warning flag */
5587 for (j = 0; j < c->nciphers; j++) {
83e7d008 5588 if (commalist_started)
ff3187f6 5589 ssh2_pkt_addstring_str(s->pktout, ",");
5590 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
83e7d008 5591 commalist_started = 1;
51470298 5592 }
5593 }
5594 /* List client->server MAC algorithms. */
ff3187f6 5595 ssh2_pkt_addstring_start(s->pktout);
51470298 5596 for (i = 0; i < s->nmacs; i++) {
ff3187f6 5597 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
51470298 5598 if (i < s->nmacs - 1)
ff3187f6 5599 ssh2_pkt_addstring_str(s->pktout, ",");
51470298 5600 }
5601 /* List server->client MAC algorithms. */
ff3187f6 5602 ssh2_pkt_addstring_start(s->pktout);
51470298 5603 for (i = 0; i < s->nmacs; i++) {
ff3187f6 5604 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
51470298 5605 if (i < s->nmacs - 1)
ff3187f6 5606 ssh2_pkt_addstring_str(s->pktout, ",");
51470298 5607 }
ab18ccff 5608 /* List client->server compression algorithms,
5609 * then server->client compression algorithms. (We use the
5610 * same set twice.) */
5611 for (j = 0; j < 2; j++) {
5612 ssh2_pkt_addstring_start(s->pktout);
5613 assert(lenof(compressions) > 1);
5614 /* Prefer non-delayed versions */
5615 ssh2_pkt_addstring_str(s->pktout, s->preferred_comp->name);
5616 /* We don't even list delayed versions of algorithms until
5617 * they're allowed to be used, to avoid a race. See the end of
5618 * this function. */
5619 if (s->userauth_succeeded && s->preferred_comp->delayed_name) {
ff3187f6 5620 ssh2_pkt_addstring_str(s->pktout, ",");
ab18ccff 5621 ssh2_pkt_addstring_str(s->pktout,
5622 s->preferred_comp->delayed_name);
f6e0abe2 5623 }
ab18ccff 5624 for (i = 0; i < lenof(compressions); i++) {
5625 const struct ssh_compress *c = compressions[i];
5626 if (c != s->preferred_comp) {
5627 ssh2_pkt_addstring_str(s->pktout, ",");
5628 ssh2_pkt_addstring_str(s->pktout, c->name);
5629 if (s->userauth_succeeded && c->delayed_name) {
5630 ssh2_pkt_addstring_str(s->pktout, ",");
5631 ssh2_pkt_addstring_str(s->pktout, c->delayed_name);
5632 }
5633 }
f6e0abe2 5634 }
51470298 5635 }
5636 /* List client->server languages. Empty list. */
ff3187f6 5637 ssh2_pkt_addstring_start(s->pktout);
51470298 5638 /* List server->client languages. Empty list. */
ff3187f6 5639 ssh2_pkt_addstring_start(s->pktout);
51470298 5640 /* First KEX packet does _not_ follow, because we're not that brave. */
ff3187f6 5641 ssh2_pkt_addbool(s->pktout, FALSE);
51470298 5642 /* Reserved. */
ff3187f6 5643 ssh2_pkt_adduint32(s->pktout, 0);
e5574168 5644 }
0db56f73 5645
3dc9a6a7 5646 s->our_kexinitlen = s->pktout->length - 5;
5647 s->our_kexinit = snewn(s->our_kexinitlen, unsigned char);
5648 memcpy(s->our_kexinit, s->pktout->data + 5, s->our_kexinitlen);
0db56f73 5649
590f6a5f 5650 ssh2_pkt_send_noqueue(ssh, s->pktout);
e5574168 5651
ff3187f6 5652 if (!pktin)
5653 crWaitUntil(pktin);
e5574168 5654
5655 /*
5656 * Now examine the other side's KEXINIT to see what we're up
5657 * to.
5658 */
51470298 5659 {
4763c1c2 5660 char *str, *preferred;
3d9449a1 5661 int i, j, len;
51470298 5662
ff3187f6 5663 if (pktin->type != SSH2_MSG_KEXINIT) {
6b5cf8b4 5664 bombout(("expected key exchange packet from server"));
7ffdbc1a 5665 crStop(0);
32874aea 5666 }
51470298 5667 ssh->kex = NULL;
5668 ssh->hostkey = NULL;
5669 s->cscipher_tobe = NULL;
5670 s->sccipher_tobe = NULL;
5671 s->csmac_tobe = NULL;
5672 s->scmac_tobe = NULL;
5673 s->cscomp_tobe = NULL;
5674 s->sccomp_tobe = NULL;
4763c1c2 5675 s->warn_kex = s->warn_cscipher = s->warn_sccipher = FALSE;
5676
ff3187f6 5677 pktin->savedpos += 16; /* skip garbage cookie */
5678 ssh_pkt_getstring(pktin, &str, &len); /* key exchange algorithms */
4763c1c2 5679
5680 preferred = NULL;
83e7d008 5681 for (i = 0; i < s->n_preferred_kex; i++) {
34557659 5682 const struct ssh_kexes *k = s->preferred_kex[i];
83e7d008 5683 if (!k) {
4763c1c2 5684 s->warn_kex = TRUE;
5685 } else {
34557659 5686 for (j = 0; j < k->nkexes; j++) {
5687 if (!preferred) preferred = k->list[j]->name;
5688 if (in_commasep_string(k->list[j]->name, str, len)) {
5689 ssh->kex = k->list[j];
5690 break;
5691 }
5692 }
83e7d008 5693 }
4763c1c2 5694 if (ssh->kex)
51470298 5695 break;
32874aea 5696 }
83e7d008 5697 if (!ssh->kex) {
5698 bombout(("Couldn't agree a key exchange algorithm (available: %s)",
5699 str ? str : "(null)"));
5700 crStop(0);
5701 }
b59743d5 5702 /*
5703 * Note that the server's guess is considered wrong if it doesn't match
5704 * the first algorithm in our list, even if it's still the algorithm
5705 * we end up using.
5706 */
4763c1c2 5707 s->guessok = first_in_commasep_string(preferred, str, len);
ff3187f6 5708 ssh_pkt_getstring(pktin, &str, &len); /* host key algorithms */
51470298 5709 for (i = 0; i < lenof(hostkey_algs); i++) {
5710 if (in_commasep_string(hostkey_algs[i]->name, str, len)) {
5711 ssh->hostkey = hostkey_algs[i];
5712 break;
5713 }
5714 }
3d9449a1 5715 s->guessok = s->guessok &&
b59743d5 5716 first_in_commasep_string(hostkey_algs[0]->name, str, len);
ff3187f6 5717 ssh_pkt_getstring(pktin, &str, &len); /* client->server cipher */
51470298 5718 for (i = 0; i < s->n_preferred_ciphers; i++) {
5719 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5720 if (!c) {
4763c1c2 5721 s->warn_cscipher = TRUE;
51470298 5722 } else {
5723 for (j = 0; j < c->nciphers; j++) {
5724 if (in_commasep_string(c->list[j]->name, str, len)) {
5725 s->cscipher_tobe = c->list[j];
5726 break;
5727 }
ca20bfcf 5728 }
32874aea 5729 }
4763c1c2 5730 if (s->cscipher_tobe)
51470298 5731 break;
32874aea 5732 }
51470298 5733 if (!s->cscipher_tobe) {
6b5cf8b4 5734 bombout(("Couldn't agree a client-to-server cipher (available: %s)",
57356d63 5735 str ? str : "(null)"));
7ffdbc1a 5736 crStop(0);
ca20bfcf 5737 }
0ef8f407 5738
ff3187f6 5739 ssh_pkt_getstring(pktin, &str, &len); /* server->client cipher */
51470298 5740 for (i = 0; i < s->n_preferred_ciphers; i++) {
5741 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5742 if (!c) {
4763c1c2 5743 s->warn_sccipher = TRUE;
51470298 5744 } else {
5745 for (j = 0; j < c->nciphers; j++) {
5746 if (in_commasep_string(c->list[j]->name, str, len)) {
5747 s->sccipher_tobe = c->list[j];
5748 break;
5749 }
ca20bfcf 5750 }
32874aea 5751 }
4763c1c2 5752 if (s->sccipher_tobe)
51470298 5753 break;
32874aea 5754 }
51470298 5755 if (!s->sccipher_tobe) {
6b5cf8b4 5756 bombout(("Couldn't agree a server-to-client cipher (available: %s)",
57356d63 5757 str ? str : "(null)"));
7ffdbc1a 5758 crStop(0);
ca20bfcf 5759 }
0ef8f407 5760
ff3187f6 5761 ssh_pkt_getstring(pktin, &str, &len); /* client->server mac */
51470298 5762 for (i = 0; i < s->nmacs; i++) {
5763 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5764 s->csmac_tobe = s->maclist[i];
5765 break;
5766 }
32874aea 5767 }
ff3187f6 5768 ssh_pkt_getstring(pktin, &str, &len); /* server->client mac */
51470298 5769 for (i = 0; i < s->nmacs; i++) {
5770 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5771 s->scmac_tobe = s->maclist[i];
5772 break;
5773 }
32874aea 5774 }
ff3187f6 5775 ssh_pkt_getstring(pktin, &str, &len); /* client->server compression */
51470298 5776 for (i = 0; i < lenof(compressions) + 1; i++) {
5777 const struct ssh_compress *c =
5778 i == 0 ? s->preferred_comp : compressions[i - 1];
5779 if (in_commasep_string(c->name, str, len)) {
5780 s->cscomp_tobe = c;
5781 break;
ab18ccff 5782 } else if (in_commasep_string(c->delayed_name, str, len)) {
5783 if (s->userauth_succeeded) {
5784 s->cscomp_tobe = c;
5785 break;
5786 } else {
5787 s->pending_compression = TRUE; /* try this later */
5788 }
51470298 5789 }
32874aea 5790 }
ff3187f6 5791 ssh_pkt_getstring(pktin, &str, &len); /* server->client compression */
51470298 5792 for (i = 0; i < lenof(compressions) + 1; i++) {
5793 const struct ssh_compress *c =
5794 i == 0 ? s->preferred_comp : compressions[i - 1];
5795 if (in_commasep_string(c->name, str, len)) {
5796 s->sccomp_tobe = c;
5797 break;
ab18ccff 5798 } else if (in_commasep_string(c->delayed_name, str, len)) {
5799 if (s->userauth_succeeded) {
5800 s->sccomp_tobe = c;
5801 break;
5802 } else {
5803 s->pending_compression = TRUE; /* try this later */
5804 }
51470298 5805 }
32874aea 5806 }
ab18ccff 5807 if (s->pending_compression) {
5808 logevent("Server supports delayed compression; "
5809 "will try this later");
5810 }
b59743d5 5811 ssh_pkt_getstring(pktin, &str, &len); /* client->server language */
5812 ssh_pkt_getstring(pktin, &str, &len); /* server->client language */
4763c1c2 5813 s->ignorepkt = ssh2_pkt_getbool(pktin) && !s->guessok;
5814
5815 if (s->warn_kex) {
5816 ssh_set_frozen(ssh, 1);
5817 s->dlgret = askalg(ssh->frontend, "key-exchange algorithm",
5818 ssh->kex->name,
5819 ssh_dialog_callback, ssh);
5820 if (s->dlgret < 0) {
5821 do {
5822 crReturn(0);
5823 if (pktin) {
5824 bombout(("Unexpected data from server while"
5825 " waiting for user response"));
5826 crStop(0);
5827 }
5828 } while (pktin || inlen > 0);
5829 s->dlgret = ssh->user_response;
5830 }
5831 ssh_set_frozen(ssh, 0);
5832 if (s->dlgret == 0) {
9e296bfa 5833 ssh_disconnect(ssh, "User aborted at kex warning", NULL,
5834 0, TRUE);
a5a6f839 5835 crStop(0);
4763c1c2 5836 }
5837 }
5838
5839 if (s->warn_cscipher) {
5840 ssh_set_frozen(ssh, 1);
5841 s->dlgret = askalg(ssh->frontend,
5842 "client-to-server cipher",
5843 s->cscipher_tobe->name,
5844 ssh_dialog_callback, ssh);
5845 if (s->dlgret < 0) {
5846 do {
5847 crReturn(0);
5848 if (pktin) {
5849 bombout(("Unexpected data from server while"
5850 " waiting for user response"));
5851 crStop(0);
5852 }
5853 } while (pktin || inlen > 0);
5854 s->dlgret = ssh->user_response;
5855 }
5856 ssh_set_frozen(ssh, 0);
5857 if (s->dlgret == 0) {
9e296bfa 5858 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5859 0, TRUE);
a5a6f839 5860 crStop(0);
4763c1c2 5861 }
5862 }
5863
5864 if (s->warn_sccipher) {
5865 ssh_set_frozen(ssh, 1);
5866 s->dlgret = askalg(ssh->frontend,
5867 "server-to-client cipher",
5868 s->sccipher_tobe->name,
5869 ssh_dialog_callback, ssh);
5870 if (s->dlgret < 0) {
5871 do {
5872 crReturn(0);
5873 if (pktin) {
5874 bombout(("Unexpected data from server while"
5875 " waiting for user response"));
5876 crStop(0);
5877 }
5878 } while (pktin || inlen > 0);
5879 s->dlgret = ssh->user_response;
5880 }
5881 ssh_set_frozen(ssh, 0);
5882 if (s->dlgret == 0) {
9e296bfa 5883 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5884 0, TRUE);
a5a6f839 5885 crStop(0);
4763c1c2 5886 }
5887 }
5888
b672f405 5889 ssh->exhash = ssh->kex->hash->init();
5890 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_c, strlen(ssh->v_c));
5891 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_s, strlen(ssh->v_s));
5892 hash_string(ssh->kex->hash, ssh->exhash,
5893 s->our_kexinit, s->our_kexinitlen);
3dc9a6a7 5894 sfree(s->our_kexinit);
5895 if (pktin->length > 5)
b672f405 5896 hash_string(ssh->kex->hash, ssh->exhash,
5897 pktin->data + 5, pktin->length - 5);
3dc9a6a7 5898
4763c1c2 5899 if (s->ignorepkt) /* first_kex_packet_follows */
b59743d5 5900 crWaitUntil(pktin); /* Ignore packet */
e5574168 5901 }
e5574168 5902
fae1a71b 5903 if (ssh->kex->main_type == KEXTYPE_DH) {
30774ba3 5904 /*
5905 * Work out the number of bits of key we will need from the
5906 * key exchange. We start with the maximum key length of
5907 * either cipher...
5908 */
5909 {
5910 int csbits, scbits;
5911
5912 csbits = s->cscipher_tobe->keylen;
5913 scbits = s->sccipher_tobe->keylen;
5914 s->nbits = (csbits > scbits ? csbits : scbits);
5915 }
5916 /* The keys only have hlen-bit entropy, since they're based on
5917 * a hash. So cap the key size at hlen bits. */
5918 if (s->nbits > ssh->kex->hash->hlen * 8)
5919 s->nbits = ssh->kex->hash->hlen * 8;
5920
5921 /*
5922 * If we're doing Diffie-Hellman group exchange, start by
5923 * requesting a group.
5924 */
5925 if (!ssh->kex->pdata) {
5926 logevent("Doing Diffie-Hellman group exchange");
acab36bc 5927 ssh->pkt_kctx = SSH2_PKTCTX_DHGEX;
30774ba3 5928 /*
5929 * Work out how big a DH group we will need to allow that
5930 * much data.
5931 */
5932 s->pbits = 512 << ((s->nbits - 1) / 64);
5933 s->pktout = ssh2_pkt_init(SSH2_MSG_KEX_DH_GEX_REQUEST);
5934 ssh2_pkt_adduint32(s->pktout, s->pbits);
5935 ssh2_pkt_send_noqueue(ssh, s->pktout);
5936
5937 crWaitUntil(pktin);
5938 if (pktin->type != SSH2_MSG_KEX_DH_GEX_GROUP) {
5939 bombout(("expected key exchange group packet from server"));
5940 crStop(0);
5941 }
5942 s->p = ssh2_pkt_getmp(pktin);
5943 s->g = ssh2_pkt_getmp(pktin);
5944 if (!s->p || !s->g) {
5945 bombout(("unable to read mp-ints from incoming group packet"));
5946 crStop(0);
5947 }
5948 ssh->kex_ctx = dh_setup_gex(s->p, s->g);
5949 s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT;
5950 s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY;
5951 } else {
acab36bc 5952 ssh->pkt_kctx = SSH2_PKTCTX_DHGROUP;
30774ba3 5953 ssh->kex_ctx = dh_setup_group(ssh->kex);
5954 s->kex_init_value = SSH2_MSG_KEXDH_INIT;
5955 s->kex_reply_value = SSH2_MSG_KEXDH_REPLY;
5956 logeventf(ssh, "Using Diffie-Hellman with standard group \"%s\"",
5957 ssh->kex->groupname);
5958 }
e5574168 5959
30774ba3 5960 logeventf(ssh, "Doing Diffie-Hellman key exchange with hash %s",
5961 ssh->kex->hash->text_name);
5962 /*
5963 * Now generate and send e for Diffie-Hellman.
5964 */
5965 set_busy_status(ssh->frontend, BUSY_CPU); /* this can take a while */
5966 s->e = dh_create_e(ssh->kex_ctx, s->nbits * 2);
5967 s->pktout = ssh2_pkt_init(s->kex_init_value);
5968 ssh2_pkt_addmp(s->pktout, s->e);
5969 ssh2_pkt_send_noqueue(ssh, s->pktout);
5970
5971 set_busy_status(ssh->frontend, BUSY_WAITING); /* wait for server */
5972 crWaitUntil(pktin);
5973 if (pktin->type != s->kex_reply_value) {
5974 bombout(("expected key exchange reply packet from server"));
5975 crStop(0);
5976 }
5977 set_busy_status(ssh->frontend, BUSY_CPU); /* cogitate */
5978 ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
5979 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
5980 s->f = ssh2_pkt_getmp(pktin);
5981 if (!s->f) {
5982 bombout(("unable to parse key exchange reply packet"));
5983 crStop(0);
5984 }
5985 ssh_pkt_getstring(pktin, &s->sigdata, &s->siglen);
e5574168 5986
30774ba3 5987 s->K = dh_find_K(ssh->kex_ctx, s->f);
e5574168 5988
30774ba3 5989 /* We assume everything from now on will be quick, and it might
5990 * involve user interaction. */
5991 set_busy_status(ssh->frontend, BUSY_NOT);
755e0524 5992
30774ba3 5993 hash_string(ssh->kex->hash, ssh->exhash, s->hostkeydata, s->hostkeylen);
5994 if (!ssh->kex->pdata) {
5995 hash_uint32(ssh->kex->hash, ssh->exhash, s->pbits);
5996 hash_mpint(ssh->kex->hash, ssh->exhash, s->p);
5997 hash_mpint(ssh->kex->hash, ssh->exhash, s->g);
5998 }
5999 hash_mpint(ssh->kex->hash, ssh->exhash, s->e);
6000 hash_mpint(ssh->kex->hash, ssh->exhash, s->f);
6001
6002 dh_cleanup(ssh->kex_ctx);
6003 freebn(s->f);
6004 if (!ssh->kex->pdata) {
6005 freebn(s->g);
6006 freebn(s->p);
6007 }
fae1a71b 6008 } else {
6009 logeventf(ssh, "Doing RSA key exchange with hash %s",
6010 ssh->kex->hash->text_name);
acab36bc 6011 ssh->pkt_kctx = SSH2_PKTCTX_RSAKEX;
fae1a71b 6012 /*
6013 * RSA key exchange. First expect a KEXRSA_PUBKEY packet
6014 * from the server.
6015 */
6016 crWaitUntil(pktin);
6017 if (pktin->type != SSH2_MSG_KEXRSA_PUBKEY) {
6018 bombout(("expected RSA public key packet from server"));
6019 crStop(0);
6020 }
6021
6022 ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
6023 hash_string(ssh->kex->hash, ssh->exhash,
6024 s->hostkeydata, s->hostkeylen);
6025 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
6026
6027 {
6028 char *keydata;
6029 ssh_pkt_getstring(pktin, &keydata, &s->rsakeylen);
6030 s->rsakeydata = snewn(s->rsakeylen, char);
6031 memcpy(s->rsakeydata, keydata, s->rsakeylen);
6032 }
6033
6034 s->rsakey = ssh_rsakex_newkey(s->rsakeydata, s->rsakeylen);
6035 if (!s->rsakey) {
6036 sfree(s->rsakeydata);
6037 bombout(("unable to parse RSA public key from server"));
6038 crStop(0);
6039 }
6040
6041 hash_string(ssh->kex->hash, ssh->exhash, s->rsakeydata, s->rsakeylen);
6042
6043 /*
6044 * Next, set up a shared secret K, of precisely KLEN -
6045 * 2*HLEN - 49 bits, where KLEN is the bit length of the
6046 * RSA key modulus and HLEN is the bit length of the hash
6047 * we're using.
6048 */
6049 {
6050 int klen = ssh_rsakex_klen(s->rsakey);
6051 int nbits = klen - (2*ssh->kex->hash->hlen*8 + 49);
6052 int i, byte = 0;
6053 unsigned char *kstr1, *kstr2, *outstr;
6054 int kstr1len, kstr2len, outstrlen;
6055
6056 s->K = bn_power_2(nbits - 1);
6057
6058 for (i = 0; i < nbits; i++) {
6059 if ((i & 7) == 0) {
6060 byte = random_byte();
6061 }
6062 bignum_set_bit(s->K, i, (byte >> (i & 7)) & 1);
6063 }
6064
6065 /*
6066 * Encode this as an mpint.
6067 */
6068 kstr1 = ssh2_mpint_fmt(s->K, &kstr1len);
6069 kstr2 = snewn(kstr2len = 4 + kstr1len, unsigned char);
6070 PUT_32BIT(kstr2, kstr1len);
6071 memcpy(kstr2 + 4, kstr1, kstr1len);
6072
6073 /*
6074 * Encrypt it with the given RSA key.
6075 */
6076 outstrlen = (klen + 7) / 8;
6077 outstr = snewn(outstrlen, unsigned char);
6078 ssh_rsakex_encrypt(ssh->kex->hash, kstr2, kstr2len,
6079 outstr, outstrlen, s->rsakey);
6080
6081 /*
6082 * And send it off in a return packet.
6083 */
6084 s->pktout = ssh2_pkt_init(SSH2_MSG_KEXRSA_SECRET);
6085 ssh2_pkt_addstring_start(s->pktout);
7108a872 6086 ssh2_pkt_addstring_data(s->pktout, (char *)outstr, outstrlen);
fae1a71b 6087 ssh2_pkt_send_noqueue(ssh, s->pktout);
6088
6089 hash_string(ssh->kex->hash, ssh->exhash, outstr, outstrlen);
6090
6091 sfree(kstr2);
6092 sfree(kstr1);
6093 sfree(outstr);
6094 }
6095
6096 ssh_rsakex_freekey(s->rsakey);
6097
6098 crWaitUntil(pktin);
6099 if (pktin->type != SSH2_MSG_KEXRSA_DONE) {
6100 sfree(s->rsakeydata);
6101 bombout(("expected signature packet from server"));
6102 crStop(0);
6103 }
6104
6105 ssh_pkt_getstring(pktin, &s->sigdata, &s->siglen);
6106
6107 sfree(s->rsakeydata);
6108 }
6109
b672f405 6110 hash_mpint(ssh->kex->hash, ssh->exhash, s->K);
6111 assert(ssh->kex->hash->hlen <= sizeof(s->exchange_hash));
6112 ssh->kex->hash->final(ssh->exhash, s->exchange_hash);
e5574168 6113
fabd1805 6114 ssh->kex_ctx = NULL;
3709bfe9 6115
7cca0d81 6116#if 0
765c4200 6117 debug(("Exchange hash is:\n"));
b672f405 6118 dmemdump(s->exchange_hash, ssh->kex->hash->hlen);
7cca0d81 6119#endif
6120
51470298 6121 if (!s->hkey ||
6122 !ssh->hostkey->verifysig(s->hkey, s->sigdata, s->siglen,
b672f405 6123 (char *)s->exchange_hash,
6124 ssh->kex->hash->hlen)) {
6b5cf8b4 6125 bombout(("Server's host key did not match the signature supplied"));
7ffdbc1a 6126 crStop(0);
8d5de777 6127 }
e5574168 6128
6129 /*
7cca0d81 6130 * Authenticate remote host: verify host key. (We've already
6131 * checked the signature of the exchange hash.)
e5574168 6132 */
51470298 6133 s->keystr = ssh->hostkey->fmtkey(s->hkey);
6134 s->fingerprint = ssh->hostkey->fingerprint(s->hkey);
3d9449a1 6135 ssh_set_frozen(ssh, 1);
6136 s->dlgret = verify_ssh_host_key(ssh->frontend,
6137 ssh->savedhost, ssh->savedport,
6138 ssh->hostkey->keytype, s->keystr,
6139 s->fingerprint,
6140 ssh_dialog_callback, ssh);
6141 if (s->dlgret < 0) {
6142 do {
6143 crReturn(0);
6144 if (pktin) {
6145 bombout(("Unexpected data from server while waiting"
6146 " for user host key response"));
6147 crStop(0);
6148 }
6149 } while (pktin || inlen > 0);
6150 s->dlgret = ssh->user_response;
6151 }
6152 ssh_set_frozen(ssh, 0);
6153 if (s->dlgret == 0) {
9e296bfa 6154 ssh_disconnect(ssh, "User aborted at host key verification", NULL,
6155 0, TRUE);
3d9449a1 6156 crStop(0);
6157 }
e13bba36 6158 if (!s->got_session_id) { /* don't bother logging this in rekeys */
5e0d7cb8 6159 logevent("Host key fingerprint is:");
51470298 6160 logevent(s->fingerprint);
5e0d7cb8 6161 }
51470298 6162 sfree(s->fingerprint);
6163 sfree(s->keystr);
6164 ssh->hostkey->freekey(s->hkey);
d39f364a 6165
6166 /*
9442dd57 6167 * The exchange hash from the very first key exchange is also
6168 * the session id, used in session key construction and
6169 * authentication.
6170 */
e13bba36 6171 if (!s->got_session_id) {
b672f405 6172 assert(sizeof(s->exchange_hash) <= sizeof(ssh->v2_session_id));
9442dd57 6173 memcpy(ssh->v2_session_id, s->exchange_hash,
6174 sizeof(s->exchange_hash));
b672f405 6175 ssh->v2_session_id_len = ssh->kex->hash->hlen;
6052bb76 6176 assert(ssh->v2_session_id_len <= sizeof(ssh->v2_session_id));
e13bba36 6177 s->got_session_id = TRUE;
6178 }
9442dd57 6179
6180 /*
7cca0d81 6181 * Send SSH2_MSG_NEWKEYS.
d39f364a 6182 */
ff3187f6 6183 s->pktout = ssh2_pkt_init(SSH2_MSG_NEWKEYS);
590f6a5f 6184 ssh2_pkt_send_noqueue(ssh, s->pktout);
9442dd57 6185 ssh->outgoing_data_size = 0; /* start counting from here */
6186
6187 /*
6188 * We've sent client NEWKEYS, so create and initialise
c64fe7d4 6189 * client-to-server session keys.
9442dd57 6190 */
6191 if (ssh->cs_cipher_ctx)
6192 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
6193 ssh->cscipher = s->cscipher_tobe;
6194 ssh->cs_cipher_ctx = ssh->cscipher->make_context();
6195
6196 if (ssh->cs_mac_ctx)
6197 ssh->csmac->free_context(ssh->cs_mac_ctx);
6198 ssh->csmac = s->csmac_tobe;
6199 ssh->cs_mac_ctx = ssh->csmac->make_context();
6200
6201 if (ssh->cs_comp_ctx)
6202 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
6203 ssh->cscomp = s->cscomp_tobe;
6204 ssh->cs_comp_ctx = ssh->cscomp->compress_init();
6205
6206 /*
6207 * Set IVs on client-to-server keys. Here we use the exchange
6208 * hash from the _first_ key exchange.
6209 */
6210 {
754c0df9 6211 unsigned char keyspace[SSH2_KEX_MAX_HASH_LEN * SSH2_MKKEY_ITERS];
6212 assert(sizeof(keyspace) >= ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
b672f405 6213 ssh2_mkkey(ssh,s->K,s->exchange_hash,'C',keyspace);
754c0df9 6214 assert((ssh->cscipher->keylen+7) / 8 <=
6215 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
9442dd57 6216 ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace);
b672f405 6217 ssh2_mkkey(ssh,s->K,s->exchange_hash,'A',keyspace);
754c0df9 6218 assert(ssh->cscipher->blksize <=
6219 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
9442dd57 6220 ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace);
b672f405 6221 ssh2_mkkey(ssh,s->K,s->exchange_hash,'E',keyspace);
754c0df9 6222 assert(ssh->csmac->len <=
6223 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
9442dd57 6224 ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace);
754c0df9 6225 memset(keyspace, 0, sizeof(keyspace));
9442dd57 6226 }
6227
6228 logeventf(ssh, "Initialised %.200s client->server encryption",
6229 ssh->cscipher->text_name);
6230 logeventf(ssh, "Initialised %.200s client->server MAC algorithm",
6231 ssh->csmac->text_name);
6232 if (ssh->cscomp->text_name)
6233 logeventf(ssh, "Initialised %s compression",
6234 ssh->cscomp->text_name);
590f6a5f 6235
6236 /*
6237 * Now our end of the key exchange is complete, we can send all
6238 * our queued higher-layer packets.
6239 */
6240 ssh->queueing = FALSE;
6241 ssh2_pkt_queuesend(ssh);
d39f364a 6242
6243 /*
8406eaf9 6244 * Expect SSH2_MSG_NEWKEYS from server.
6245 */
ff3187f6 6246 crWaitUntil(pktin);
6247 if (pktin->type != SSH2_MSG_NEWKEYS) {
6b5cf8b4 6248 bombout(("expected new-keys packet from server"));
7ffdbc1a 6249 crStop(0);
8406eaf9 6250 }
9442dd57 6251 ssh->incoming_data_size = 0; /* start counting from here */
8406eaf9 6252
6253 /*
9442dd57 6254 * We've seen server NEWKEYS, so create and initialise
6255 * server-to-client session keys.
d39f364a 6256 */
371e569c 6257 if (ssh->sc_cipher_ctx)
6258 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
51470298 6259 ssh->sccipher = s->sccipher_tobe;
371e569c 6260 ssh->sc_cipher_ctx = ssh->sccipher->make_context();
e0e1a00d 6261
e0e1a00d 6262 if (ssh->sc_mac_ctx)
6263 ssh->scmac->free_context(ssh->sc_mac_ctx);
51470298 6264 ssh->scmac = s->scmac_tobe;
e0e1a00d 6265 ssh->sc_mac_ctx = ssh->scmac->make_context();
6266
5366aed8 6267 if (ssh->sc_comp_ctx)
6268 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
51470298 6269 ssh->sccomp = s->sccomp_tobe;
5366aed8 6270 ssh->sc_comp_ctx = ssh->sccomp->decompress_init();
6271
d39f364a 6272 /*
9442dd57 6273 * Set IVs on server-to-client keys. Here we use the exchange
6274 * hash from the _first_ key exchange.
d39f364a 6275 */
51470298 6276 {
754c0df9 6277 unsigned char keyspace[SSH2_KEX_MAX_HASH_LEN * SSH2_MKKEY_ITERS];
6278 assert(sizeof(keyspace) >= ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
b672f405 6279 ssh2_mkkey(ssh,s->K,s->exchange_hash,'D',keyspace);
754c0df9 6280 assert((ssh->sccipher->keylen+7) / 8 <=
6281 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
371e569c 6282 ssh->sccipher->setkey(ssh->sc_cipher_ctx, keyspace);
b672f405 6283 ssh2_mkkey(ssh,s->K,s->exchange_hash,'B',keyspace);
754c0df9 6284 assert(ssh->sccipher->blksize <=
6285 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
371e569c 6286 ssh->sccipher->setiv(ssh->sc_cipher_ctx, keyspace);
b672f405 6287 ssh2_mkkey(ssh,s->K,s->exchange_hash,'F',keyspace);
754c0df9 6288 assert(ssh->scmac->len <=
6289 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
e0e1a00d 6290 ssh->scmac->setkey(ssh->sc_mac_ctx, keyspace);
754c0df9 6291 memset(keyspace, 0, sizeof(keyspace));
51470298 6292 }
57356d63 6293 logeventf(ssh, "Initialised %.200s server->client encryption",
6294 ssh->sccipher->text_name);
6c135243 6295 logeventf(ssh, "Initialised %.200s server->client MAC algorithm",
6296 ssh->scmac->text_name);
57356d63 6297 if (ssh->sccomp->text_name)
6298 logeventf(ssh, "Initialised %s decompression",
6299 ssh->sccomp->text_name);
9442dd57 6300
6301 /*
fae1a71b 6302 * Free shared secret.
9442dd57 6303 */
679539d7 6304 freebn(s->K);
d39f364a 6305
033b4cef 6306 /*
e13bba36 6307 * Key exchange is over. Loop straight back round if we have a
6308 * deferred rekey reason.
6309 */
6310 if (ssh->deferred_rekey_reason) {
6311 logevent(ssh->deferred_rekey_reason);
6312 pktin = NULL;
6313 ssh->deferred_rekey_reason = NULL;
6314 goto begin_key_exchange;
6315 }
6316
6317 /*
6318 * Otherwise, schedule a timer for our next rekey.
9442dd57 6319 */
6320 ssh->kex_in_progress = FALSE;
e6c1536e 6321 ssh->last_rekey = GETTICKCOUNT();
d57f70af 6322 if (ssh->cfg.ssh_rekey_time != 0)
6323 ssh->next_rekey = schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
6324 ssh2_timer, ssh);
e13bba36 6325
9442dd57 6326 /*
0db56f73 6327 * If this is the first key exchange phase, we must pass the
6328 * SSH2_MSG_NEWKEYS packet to the next layer, not because it
6329 * wants to see it but because it will need time to initialise
6330 * itself before it sees an actual packet. In subsequent key
6331 * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because
6332 * it would only confuse the layer above.
6333 */
e13bba36 6334 if (s->activated_authconn) {
0e3607ed 6335 crReturn(0);
0db56f73 6336 }
e13bba36 6337 s->activated_authconn = TRUE;
0db56f73 6338
6339 /*
7cca0d81 6340 * Now we're encrypting. Begin returning 1 to the protocol main
6341 * function so that other things can run on top of the
6342 * transport. If we ever see a KEXINIT, we must go back to the
6343 * start.
9442dd57 6344 *
6345 * We _also_ go back to the start if we see pktin==NULL and
ab18ccff 6346 * inlen negative, because this is a special signal meaning
9442dd57 6347 * `initiate client-driven rekey', and `in' contains a message
6348 * giving the reason for the rekey.
ab18ccff 6349 *
6350 * inlen==-1 means always initiate a rekey;
6351 * inlen==-2 means that userauth has completed successfully and
6352 * we should consider rekeying (for delayed compression).
033b4cef 6353 */
9442dd57 6354 while (!((pktin && pktin->type == SSH2_MSG_KEXINIT) ||
ab18ccff 6355 (!pktin && inlen < 0))) {
f382c87d 6356 wait_for_rekey:
32874aea 6357 crReturn(1);
e96adf72 6358 }
9442dd57 6359 if (pktin) {
6360 logevent("Server initiated key re-exchange");
6361 } else {
ab18ccff 6362 if (inlen == -2) {
6363 /*
6364 * authconn has seen a USERAUTH_SUCCEEDED. Time to enable
6365 * delayed compression, if it's available.
6366 *
6367 * draft-miller-secsh-compression-delayed-00 says that you
6368 * negotiate delayed compression in the first key exchange, and
6369 * both sides start compressing when the server has sent
6370 * USERAUTH_SUCCESS. This has a race condition -- the server
6371 * can't know when the client has seen it, and thus which incoming
6372 * packets it should treat as compressed.
6373 *
6374 * Instead, we do the initial key exchange without offering the
6375 * delayed methods, but note if the server offers them; when we
6376 * get here, if a delayed method was available that was higher
6377 * on our list than what we got, we initiate a rekey in which we
6378 * _do_ list the delayed methods (and hopefully get it as a
6379 * result). Subsequent rekeys will do the same.
6380 */
6381 assert(!s->userauth_succeeded); /* should only happen once */
6382 s->userauth_succeeded = TRUE;
6383 if (!s->pending_compression)
6384 /* Can't see any point rekeying. */
6385 goto wait_for_rekey; /* this is utterly horrid */
6386 /* else fall through to rekey... */
6387 s->pending_compression = FALSE;
6388 }
f382c87d 6389 /*
ab18ccff 6390 * Now we've decided to rekey.
6391 *
f382c87d 6392 * Special case: if the server bug is set that doesn't
6393 * allow rekeying, we give a different log message and
6394 * continue waiting. (If such a server _initiates_ a rekey,
6395 * we process it anyway!)
6396 */
6397 if ((ssh->remote_bugs & BUG_SSH2_REKEY)) {
6398 logeventf(ssh, "Server bug prevents key re-exchange (%s)",
6399 (char *)in);
6400 /* Reset the counters, so that at least this message doesn't
6401 * hit the event log _too_ often. */
6402 ssh->outgoing_data_size = 0;
6403 ssh->incoming_data_size = 0;
6404 if (ssh->cfg.ssh_rekey_time != 0) {
6405 ssh->next_rekey =
6406 schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
6407 ssh2_timer, ssh);
6408 }
ab18ccff 6409 goto wait_for_rekey; /* this is still utterly horrid */
f382c87d 6410 } else {
6411 logeventf(ssh, "Initiating key re-exchange (%s)", (char *)in);
f382c87d 6412 }
9442dd57 6413 }
7cca0d81 6414 goto begin_key_exchange;
e5574168 6415
6416 crFinish(1);
6417}
6418
7cca0d81 6419/*
2e85c969 6420 * Add data to an SSH-2 channel output buffer.
783415f8 6421 */
32874aea 6422static void ssh2_add_channel_data(struct ssh_channel *c, char *buf,
6423 int len)
6424{
5471d09a 6425 bufchain_add(&c->v.v2.outbuffer, buf, len);
783415f8 6426}
6427
6428/*
2e85c969 6429 * Attempt to send data on an SSH-2 channel.
783415f8 6430 */
5471d09a 6431static int ssh2_try_send(struct ssh_channel *c)
32874aea 6432{
51470298 6433 Ssh ssh = c->ssh;
ff3187f6 6434 struct Packet *pktout;
51470298 6435
5471d09a 6436 while (c->v.v2.remwindow > 0 && bufchain_size(&c->v.v2.outbuffer) > 0) {
6437 int len;
6438 void *data;
6439 bufchain_prefix(&c->v.v2.outbuffer, &data, &len);
6440 if ((unsigned)len > c->v.v2.remwindow)
6441 len = c->v.v2.remwindow;
6442 if ((unsigned)len > c->v.v2.remmaxpkt)
6443 len = c->v.v2.remmaxpkt;
ff3187f6 6444 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_DATA);
6445 ssh2_pkt_adduint32(pktout, c->remoteid);
ff3187f6 6446 ssh2_pkt_addstring_start(pktout);
a2724fba 6447 dont_log_data(ssh, pktout, PKTLOG_OMIT);
ff3187f6 6448 ssh2_pkt_addstring_data(pktout, data, len);
6449 end_log_omission(ssh, pktout);
6450 ssh2_pkt_send(ssh, pktout);
5471d09a 6451 bufchain_consume(&c->v.v2.outbuffer, len);
6452 c->v.v2.remwindow -= len;
6453 }
6454
6455 /*
6456 * After having sent as much data as we can, return the amount
6457 * still buffered.
6458 */
6459 return bufchain_size(&c->v.v2.outbuffer);
6460}
6461
78280721 6462static void ssh2_try_send_and_unthrottle(Ssh ssh, struct ssh_channel *c)
1bfc7e93 6463{
6464 int bufsize;
6465 if (c->closes)
6466 return; /* don't send on closing channels */
6467 bufsize = ssh2_try_send(c);
6468 if (bufsize == 0) {
6469 switch (c->type) {
6470 case CHAN_MAINSESSION:
6471 /* stdin need not receive an unthrottle
6472 * notification since it will be polled */
6473 break;
6474 case CHAN_X11:
6475 x11_unthrottle(c->u.x11.s);
6476 break;
6477 case CHAN_AGENT:
6478 /* agent sockets are request/response and need no
6479 * buffer management */
6480 break;
6481 case CHAN_SOCKDATA:
6482 pfd_unthrottle(c->u.pfd.s);
6483 break;
6484 }
6485 }
78280721 6486
6487 /*
6488 * If we've emptied the channel's output buffer and there's a
6489 * pending close event, start the channel-closing procedure.
6490 */
6491 if (c->pending_close && bufchain_size(&c->v.v2.outbuffer) == 0) {
6492 struct Packet *pktout;
6493 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6494 ssh2_pkt_adduint32(pktout, c->remoteid);
6495 ssh2_pkt_send(ssh, pktout);
6496 c->closes = 1;
6497 c->pending_close = FALSE;
6498 }
1bfc7e93 6499}
6500
5471d09a 6501/*
94bdfe40 6502 * Set up most of a new ssh_channel for SSH-2.
6503 */
6504static void ssh2_channel_init(struct ssh_channel *c)
6505{
6506 Ssh ssh = c->ssh;
6507 c->localid = alloc_channel_id(ssh);
6508 c->closes = 0;
78280721 6509 c->pending_close = FALSE;
94bdfe40 6510 c->throttling_conn = FALSE;
6511 c->v.v2.locwindow = c->v.v2.locmaxwin = c->v.v2.remlocwin =
6512 ssh->cfg.ssh_simple ? OUR_V2_BIGWIN : OUR_V2_WINSIZE;
6513 c->v.v2.winadj_head = c->v.v2.winadj_tail = NULL;
6514 c->v.v2.throttle_state = UNTHROTTLED;
6515 bufchain_init(&c->v.v2.outbuffer);
6516}
6517
6518/*
2e85c969 6519 * Potentially enlarge the window on an SSH-2 channel.
5471d09a 6520 */
9fca3f8c 6521static void ssh2_set_window(struct ssh_channel *c, int newwin)
5471d09a 6522{
51470298 6523 Ssh ssh = c->ssh;
6524
6b69f42e 6525 /*
6526 * Never send WINDOW_ADJUST for a channel that the remote side
6527 * already thinks it's closed; there's no point, since it won't
6528 * be sending any more data anyway.
6529 */
6530 if (c->closes != 0)
6531 return;
6532
d252310a 6533 /*
c9739dba 6534 * If the remote end has a habit of ignoring maxpkt, limit the
6535 * window so that it has no choice (assuming it doesn't ignore the
6536 * window as well).
6537 */
6538 if ((ssh->remote_bugs & BUG_SSH2_MAXPKT) && newwin > OUR_V2_MAXPKT)
6539 newwin = OUR_V2_MAXPKT;
6540
6541
6542 /*
d252310a 6543 * Only send a WINDOW_ADJUST if there's significantly more window
6544 * available than the other end thinks there is. This saves us
6545 * sending a WINDOW_ADJUST for every character in a shell session.
6546 *
6547 * "Significant" is arbitrarily defined as half the window size.
6548 */
3361b80a 6549 if (newwin / 2 >= c->v.v2.locwindow) {
ff3187f6 6550 struct Packet *pktout;
0e443c99 6551 struct winadj *wa;
ff3187f6 6552
0e443c99 6553 /*
6554 * In order to keep track of how much window the client
6555 * actually has available, we'd like it to acknowledge each
6556 * WINDOW_ADJUST. We can't do that directly, so we accompany
6557 * it with a CHANNEL_REQUEST that has to be acknowledged.
6558 *
6559 * This is only necessary if we're opening the window wide.
6560 * If we're not, then throughput is being constrained by
6561 * something other than the maximum window size anyway.
6562 *
6563 * We also only send this if the main channel has finished its
6564 * initial CHANNEL_REQUESTs and installed the default
6565 * CHANNEL_FAILURE handler, so as not to risk giving it
6566 * unexpected CHANNEL_FAILUREs.
6567 */
6568 if (newwin == c->v.v2.locmaxwin &&
6569 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE]) {
6570 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
6571 ssh2_pkt_adduint32(pktout, c->remoteid);
6572 ssh2_pkt_addstring(pktout, "winadj@putty.projects.tartarus.org");
6573 ssh2_pkt_addbool(pktout, TRUE);
6574 ssh2_pkt_send(ssh, pktout);
6575
6576 /*
6577 * CHANNEL_FAILURE doesn't come with any indication of
6578 * what message caused it, so we have to keep track of the
6579 * outstanding CHANNEL_REQUESTs ourselves.
6580 */
6581 wa = snew(struct winadj);
6582 wa->size = newwin - c->v.v2.locwindow;
6583 wa->next = NULL;
6584 if (!c->v.v2.winadj_head)
6585 c->v.v2.winadj_head = wa;
6586 else
6587 c->v.v2.winadj_tail->next = wa;
6588 c->v.v2.winadj_tail = wa;
6589 if (c->v.v2.throttle_state != UNTHROTTLED)
6590 c->v.v2.throttle_state = UNTHROTTLING;
6591 } else {
6592 /* Pretend the WINDOW_ADJUST was acked immediately. */
6593 c->v.v2.remlocwin = newwin;
6594 c->v.v2.throttle_state = THROTTLED;
6595 }
ff3187f6 6596 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
6597 ssh2_pkt_adduint32(pktout, c->remoteid);
6598 ssh2_pkt_adduint32(pktout, newwin - c->v.v2.locwindow);
6599 ssh2_pkt_send(ssh, pktout);
5471d09a 6600 c->v.v2.locwindow = newwin;
783415f8 6601 }
6602}
6603
e223b7c7 6604/*
6605 * Find the channel associated with a message. If there's no channel,
6606 * or it's not properly open, make a noise about it and return NULL.
6607 */
6608static struct ssh_channel *ssh2_channel_msg(Ssh ssh, struct Packet *pktin)
6609{
6610 unsigned localid = ssh_pkt_getuint32(pktin);
6611 struct ssh_channel *c;
6612
6613 c = find234(ssh->channels, &localid, ssh_channelfind);
6614 if (!c ||
6615 (c->halfopen && pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION &&
6616 pktin->type != SSH2_MSG_CHANNEL_OPEN_FAILURE)) {
6617 char *buf = dupprintf("Received %s for %s channel %u",
6618 ssh2_pkt_type(ssh->pkt_kctx, ssh->pkt_actx,
6619 pktin->type),
6620 c ? "half-open" : "nonexistent", localid);
6621 ssh_disconnect(ssh, NULL, buf, SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6622 sfree(buf);
6623 return NULL;
6624 }
6625 return c;
6626}
6627
837d6ba6 6628static void ssh2_msg_channel_success(Ssh ssh, struct Packet *pktin)
6629{
6630 /*
6631 * This should never get called. All channel requests are either
6632 * sent with want_reply false or are sent before this handler gets
6633 * installed.
6634 */
6635 struct ssh_channel *c;
6636 struct winadj *wa;
6637
6638 c = ssh2_channel_msg(ssh, pktin);
6639 if (!c)
6640 return;
6641 wa = c->v.v2.winadj_head;
6642 if (wa)
6643 ssh_disconnect(ssh, NULL, "Received SSH_MSG_CHANNEL_SUCCESS for "
6644 "\"winadj@putty.projects.tartarus.org\"",
6645 SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6646 else
6647 ssh_disconnect(ssh, NULL,
6648 "Received unsolicited SSH_MSG_CHANNEL_SUCCESS",
6649 SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6650}
6651
0e443c99 6652static void ssh2_msg_channel_failure(Ssh ssh, struct Packet *pktin)
6653{
6654 /*
6655 * The only time this should get called is for "winadj@putty"
6656 * messages sent above. All other channel requests are either
6657 * sent with want_reply false or are sent before this handler gets
6658 * installed.
6659 */
0e443c99 6660 struct ssh_channel *c;
6661 struct winadj *wa;
6662
e223b7c7 6663 c = ssh2_channel_msg(ssh, pktin);
0e443c99 6664 if (!c)
e223b7c7 6665 return;
0e443c99 6666 wa = c->v.v2.winadj_head;
837d6ba6 6667 if (!wa) {
6668 ssh_disconnect(ssh, NULL,
6669 "Received unsolicited SSH_MSG_CHANNEL_FAILURE",
6670 SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6671 return;
0e443c99 6672 }
837d6ba6 6673 c->v.v2.winadj_head = wa->next;
6674 c->v.v2.remlocwin += wa->size;
6675 sfree(wa);
6676 /*
6677 * winadj messages are only sent when the window is fully open, so
6678 * if we get an ack of one, we know any pending unthrottle is
6679 * complete.
6680 */
6681 if (c->v.v2.throttle_state == UNTHROTTLING)
6682 c->v.v2.throttle_state = UNTHROTTLED;
0e443c99 6683}
6684
51df0ab5 6685static void ssh2_msg_channel_window_adjust(Ssh ssh, struct Packet *pktin)
b09eaa88 6686{
b09eaa88 6687 struct ssh_channel *c;
e223b7c7 6688 c = ssh2_channel_msg(ssh, pktin);
6689 if (!c)
6690 return;
6691 if (!c->closes) {
b09eaa88 6692 c->v.v2.remwindow += ssh_pkt_getuint32(pktin);
78280721 6693 ssh2_try_send_and_unthrottle(ssh, c);
1bfc7e93 6694 }
b09eaa88 6695}
6696
51df0ab5 6697static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin)
6698{
6699 char *data;
6d44acc9 6700 int length;
51df0ab5 6701 struct ssh_channel *c;
e223b7c7 6702 c = ssh2_channel_msg(ssh, pktin);
51df0ab5 6703 if (!c)
e223b7c7 6704 return;
51df0ab5 6705 if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA &&
6706 ssh_pkt_getuint32(pktin) != SSH2_EXTENDED_DATA_STDERR)
6707 return; /* extended but not stderr */
6708 ssh_pkt_getstring(pktin, &data, &length);
6709 if (data) {
6710 int bufsize = 0;
6711 c->v.v2.locwindow -= length;
0e443c99 6712 c->v.v2.remlocwin -= length;
51df0ab5 6713 switch (c->type) {
6714 case CHAN_MAINSESSION:
6715 bufsize =
6716 from_backend(ssh->frontend, pktin->type ==
6717 SSH2_MSG_CHANNEL_EXTENDED_DATA,
6718 data, length);
6719 break;
6720 case CHAN_X11:
6721 bufsize = x11_send(c->u.x11.s, data, length);
6722 break;
6723 case CHAN_SOCKDATA:
6724 bufsize = pfd_send(c->u.pfd.s, data, length);
6725 break;
6726 case CHAN_AGENT:
6727 while (length > 0) {
6728 if (c->u.a.lensofar < 4) {
62ddb51e 6729 unsigned int l = min(4 - c->u.a.lensofar,
6730 (unsigned)length);
51df0ab5 6731 memcpy(c->u.a.msglen + c->u.a.lensofar,
6732 data, l);
6733 data += l;
6734 length -= l;
6735 c->u.a.lensofar += l;
6736 }
6737 if (c->u.a.lensofar == 4) {
6738 c->u.a.totallen =
6739 4 + GET_32BIT(c->u.a.msglen);
6740 c->u.a.message = snewn(c->u.a.totallen,
6741 unsigned char);
6742 memcpy(c->u.a.message, c->u.a.msglen, 4);
6743 }
6744 if (c->u.a.lensofar >= 4 && length > 0) {
aa63ab7e 6745 unsigned int l =
51df0ab5 6746 min(c->u.a.totallen - c->u.a.lensofar,
62ddb51e 6747 (unsigned)length);
51df0ab5 6748 memcpy(c->u.a.message + c->u.a.lensofar,
6749 data, l);
6750 data += l;
6751 length -= l;
6752 c->u.a.lensofar += l;
6753 }
6754 if (c->u.a.lensofar == c->u.a.totallen) {
6755 void *reply;
6756 int replylen;
6757 if (agent_query(c->u.a.message,
6758 c->u.a.totallen,
6759 &reply, &replylen,
6760 ssh_agentf_callback, c))
6761 ssh_agentf_callback(c, reply, replylen);
6762 sfree(c->u.a.message);
6763 c->u.a.lensofar = 0;
6764 }
6765 }
6766 bufsize = 0;
6767 break;
6768 }
6769 /*
0e443c99 6770 * If it looks like the remote end hit the end of its window,
6771 * and we didn't want it to do that, think about using a
6772 * larger window.
6773 */
6774 if (c->v.v2.remlocwin <= 0 && c->v.v2.throttle_state == UNTHROTTLED &&
6775 c->v.v2.locmaxwin < 0x40000000)
6776 c->v.v2.locmaxwin += OUR_V2_WINSIZE;
6777 /*
51df0ab5 6778 * If we are not buffering too much data,
6779 * enlarge the window again at the remote side.
467e064d 6780 * If we are buffering too much, we may still
6781 * need to adjust the window if the server's
6782 * sent excess data.
51df0ab5 6783 */
9b53e9b8 6784 ssh2_set_window(c, bufsize < c->v.v2.locmaxwin ?
6785 c->v.v2.locmaxwin - bufsize : 0);
ff68564b 6786 /*
6787 * If we're either buffering way too much data, or if we're
6788 * buffering anything at all and we're in "simple" mode,
6789 * throttle the whole channel.
6790 */
6791 if ((bufsize > c->v.v2.locmaxwin ||
6792 (ssh->cfg.ssh_simple && bufsize > 0)) &&
6793 !c->throttling_conn) {
6794 c->throttling_conn = 1;
6795 ssh_throttle_conn(ssh, +1);
6796 }
51df0ab5 6797 }
6798}
6799
6800static void ssh2_msg_channel_eof(Ssh ssh, struct Packet *pktin)
6801{
51df0ab5 6802 struct ssh_channel *c;
6803
e223b7c7 6804 c = ssh2_channel_msg(ssh, pktin);
51df0ab5 6805 if (!c)
e223b7c7 6806 return;
51df0ab5 6807
6808 if (c->type == CHAN_X11) {
6809 /*
6810 * Remote EOF on an X11 channel means we should
6811 * wrap up and close the channel ourselves.
6812 */
6813 x11_close(c->u.x11.s);
5959132d 6814 c->u.x11.s = NULL;
51df0ab5 6815 sshfwd_close(c);
6816 } else if (c->type == CHAN_AGENT) {
6817 sshfwd_close(c);
6818 } else if (c->type == CHAN_SOCKDATA) {
6819 pfd_close(c->u.pfd.s);
5959132d 6820 c->u.pfd.s = NULL;
51df0ab5 6821 sshfwd_close(c);
6822 }
6823}
6824
6825static void ssh2_msg_channel_close(Ssh ssh, struct Packet *pktin)
6826{
51df0ab5 6827 struct ssh_channel *c;
6828 struct Packet *pktout;
6829
e223b7c7 6830 c = ssh2_channel_msg(ssh, pktin);
6831 if (!c)
51df0ab5 6832 return;
51df0ab5 6833 /* Do pre-close processing on the channel. */
6834 switch (c->type) {
6835 case CHAN_MAINSESSION:
6836 ssh->mainchan = NULL;
6837 update_specials_menu(ssh->frontend);
6838 break;
6839 case CHAN_X11:
6840 if (c->u.x11.s != NULL)
6841 x11_close(c->u.x11.s);
6842 sshfwd_close(c);
6843 break;
6844 case CHAN_AGENT:
6845 sshfwd_close(c);
6846 break;
6847 case CHAN_SOCKDATA:
6848 if (c->u.pfd.s != NULL)
6849 pfd_close(c->u.pfd.s);
6850 sshfwd_close(c);
6851 break;
6852 }
6853 if (c->closes == 0) {
6854 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6855 ssh2_pkt_adduint32(pktout, c->remoteid);
6856 ssh2_pkt_send(ssh, pktout);
6857 }
6858 del234(ssh->channels, c);
6859 bufchain_clear(&c->v.v2.outbuffer);
6860 sfree(c);
6861
6862 /*
6863 * See if that was the last channel left open.
6864 * (This is only our termination condition if we're
6865 * not running in -N mode.)
6866 */
6867 if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) {
51df0ab5 6868 /*
6869 * We used to send SSH_MSG_DISCONNECT here,
6870 * because I'd believed that _every_ conforming
2e85c969 6871 * SSH-2 connection had to end with a disconnect
51df0ab5 6872 * being sent by at least one side; apparently
6873 * I was wrong and it's perfectly OK to
6874 * unceremoniously slam the connection shut
6875 * when you're done, and indeed OpenSSH feels
6876 * this is more polite than sending a
6877 * DISCONNECT. So now we don't.
6878 */
9e296bfa 6879 ssh_disconnect(ssh, "All channels closed", NULL, 0, TRUE);
51df0ab5 6880 }
6881}
6882
6883static void ssh2_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
6884{
51df0ab5 6885 struct ssh_channel *c;
6886 struct Packet *pktout;
6887
e223b7c7 6888 c = ssh2_channel_msg(ssh, pktin);
51df0ab5 6889 if (!c)
e223b7c7 6890 return;
51df0ab5 6891 if (c->type != CHAN_SOCKDATA_DORMANT)
6892 return; /* dunno why they're confirming this */
6893 c->remoteid = ssh_pkt_getuint32(pktin);
64d6ff88 6894 c->halfopen = FALSE;
51df0ab5 6895 c->type = CHAN_SOCKDATA;
6896 c->v.v2.remwindow = ssh_pkt_getuint32(pktin);
6897 c->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
6898 if (c->u.pfd.s)
6899 pfd_confirm(c->u.pfd.s);
6900 if (c->closes) {
6901 /*
6902 * We have a pending close on this channel,
6903 * which we decided on before the server acked
6904 * the channel open. So now we know the
6905 * remoteid, we can close it again.
6906 */
6907 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6908 ssh2_pkt_adduint32(pktout, c->remoteid);
6909 ssh2_pkt_send(ssh, pktout);
6910 }
6911}
6912
6913static void ssh2_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
6914{
6915 static const char *const reasons[] = {
6916 "<unknown reason code>",
6917 "Administratively prohibited",
6918 "Connect failed",
6919 "Unknown channel type",
6920 "Resource shortage",
6921 };
51df0ab5 6922 unsigned reason_code;
6923 char *reason_string;
6924 int reason_length;
51df0ab5 6925 struct ssh_channel *c;
e223b7c7 6926 c = ssh2_channel_msg(ssh, pktin);
51df0ab5 6927 if (!c)
e223b7c7 6928 return;
51df0ab5 6929 if (c->type != CHAN_SOCKDATA_DORMANT)
6930 return; /* dunno why they're failing this */
6931
6932 reason_code = ssh_pkt_getuint32(pktin);
6933 if (reason_code >= lenof(reasons))
6934 reason_code = 0; /* ensure reasons[reason_code] in range */
6935 ssh_pkt_getstring(pktin, &reason_string, &reason_length);
fb983202 6936 logeventf(ssh, "Forwarded connection refused by server: %s [%.*s]",
6937 reasons[reason_code], reason_length, reason_string);
51df0ab5 6938
6939 pfd_close(c->u.pfd.s);
6940
6941 del234(ssh->channels, c);
6942 sfree(c);
6943}
6944
6945static void ssh2_msg_channel_request(Ssh ssh, struct Packet *pktin)
6946{
51df0ab5 6947 char *type;
6948 int typelen, want_reply;
6949 int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */
6950 struct ssh_channel *c;
6951 struct Packet *pktout;
6952
e223b7c7 6953 c = ssh2_channel_msg(ssh, pktin);
6954 if (!c)
6955 return;
51df0ab5 6956 ssh_pkt_getstring(pktin, &type, &typelen);
6957 want_reply = ssh2_pkt_getbool(pktin);
6958
6959 /*
51df0ab5 6960 * Having got the channel number, we now look at
6961 * the request type string to see if it's something
6962 * we recognise.
6963 */
6964 if (c == ssh->mainchan) {
6965 /*
6966 * We recognise "exit-status" and "exit-signal" on
6967 * the primary channel.
6968 */
6969 if (typelen == 11 &&
6970 !memcmp(type, "exit-status", 11)) {
6971
6972 ssh->exitcode = ssh_pkt_getuint32(pktin);
6973 logeventf(ssh, "Server sent command exit status %d",
6974 ssh->exitcode);
6975 reply = SSH2_MSG_CHANNEL_SUCCESS;
6976
6977 } else if (typelen == 11 &&
6978 !memcmp(type, "exit-signal", 11)) {
6979
6980 int is_plausible = TRUE, is_int = FALSE;
6981 char *fmt_sig = "", *fmt_msg = "";
6982 char *msg;
6983 int msglen = 0, core = FALSE;
6984 /* ICK: older versions of OpenSSH (e.g. 3.4p1)
6985 * provide an `int' for the signal, despite its
bccbeb71 6986 * having been a `string' in the drafts of RFC 4254 since at
51df0ab5 6987 * least 2001. (Fixed in session.c 1.147.) Try to
6988 * infer which we can safely parse it as. */
6989 {
6990 unsigned char *p = pktin->body +
6991 pktin->savedpos;
6992 long len = pktin->length - pktin->savedpos;
6993 unsigned long num = GET_32BIT(p); /* what is it? */
6994 /* If it's 0, it hardly matters; assume string */
6995 if (num == 0) {
6996 is_int = FALSE;
6997 } else {
6998 int maybe_int = FALSE, maybe_str = FALSE;
6999#define CHECK_HYPOTHESIS(offset, result) \
7000 do { \
7001 long q = offset; \
7002 if (q >= 0 && q+4 <= len) { \
7003 q = q + 4 + GET_32BIT(p+q); \
7004 if (q >= 0 && q+4 <= len && \
c849ff23 7005 ((q = q + 4 + GET_32BIT(p+q))!= 0) && q == len) \
51df0ab5 7006 result = TRUE; \
7007 } \
7008 } while(0)
7009 CHECK_HYPOTHESIS(4+1, maybe_int);
7010 CHECK_HYPOTHESIS(4+num+1, maybe_str);
7011#undef CHECK_HYPOTHESIS
7012 if (maybe_int && !maybe_str)
7013 is_int = TRUE;
7014 else if (!maybe_int && maybe_str)
7015 is_int = FALSE;
7016 else
7017 /* Crikey. Either or neither. Panic. */
7018 is_plausible = FALSE;
7019 }
7020 }
d051d1b4 7021 ssh->exitcode = 128; /* means `unknown signal' */
51df0ab5 7022 if (is_plausible) {
7023 if (is_int) {
7024 /* Old non-standard OpenSSH. */
7025 int signum = ssh_pkt_getuint32(pktin);
7026 fmt_sig = dupprintf(" %d", signum);
d051d1b4 7027 ssh->exitcode = 128 + signum;
51df0ab5 7028 } else {
bccbeb71 7029 /* As per RFC 4254. */
51df0ab5 7030 char *sig;
7031 int siglen;
7032 ssh_pkt_getstring(pktin, &sig, &siglen);
7033 /* Signal name isn't supposed to be blank, but
7034 * let's cope gracefully if it is. */
7035 if (siglen) {
7036 fmt_sig = dupprintf(" \"%.*s\"",
7037 siglen, sig);
7038 }
d051d1b4 7039
7040 /*
7041 * Really hideous method of translating the
7042 * signal description back into a locally
7043 * meaningful number.
7044 */
7045
7046 if (0)
7047 ;
b707973a 7048#define TRANSLATE_SIGNAL(s) \
7049 else if (siglen == lenof(#s)-1 && !memcmp(sig, #s, siglen)) \
7050 ssh->exitcode = 128 + SIG ## s
d051d1b4 7051#ifdef SIGABRT
b707973a 7052 TRANSLATE_SIGNAL(ABRT);
d051d1b4 7053#endif
7054#ifdef SIGALRM
b707973a 7055 TRANSLATE_SIGNAL(ALRM);
d051d1b4 7056#endif
7057#ifdef SIGFPE
b707973a 7058 TRANSLATE_SIGNAL(FPE);
d051d1b4 7059#endif
7060#ifdef SIGHUP
b707973a 7061 TRANSLATE_SIGNAL(HUP);
d051d1b4 7062#endif
7063#ifdef SIGILL
b707973a 7064 TRANSLATE_SIGNAL(ILL);
d051d1b4 7065#endif
7066#ifdef SIGINT
b707973a 7067 TRANSLATE_SIGNAL(INT);
d051d1b4 7068#endif
7069#ifdef SIGKILL
b707973a 7070 TRANSLATE_SIGNAL(KILL);
d051d1b4 7071#endif
7072#ifdef SIGPIPE
b707973a 7073 TRANSLATE_SIGNAL(PIPE);
d051d1b4 7074#endif
7075#ifdef SIGQUIT
b707973a 7076 TRANSLATE_SIGNAL(QUIT);
d051d1b4 7077#endif
7078#ifdef SIGSEGV
b707973a 7079 TRANSLATE_SIGNAL(SEGV);
d051d1b4 7080#endif
7081#ifdef SIGTERM
b707973a 7082 TRANSLATE_SIGNAL(TERM);
d051d1b4 7083#endif
7084#ifdef SIGUSR1
b707973a 7085 TRANSLATE_SIGNAL(USR1);
d051d1b4 7086#endif
7087#ifdef SIGUSR2
b707973a 7088 TRANSLATE_SIGNAL(USR2);
d051d1b4 7089#endif
b707973a 7090#undef TRANSLATE_SIGNAL
d051d1b4 7091 else
7092 ssh->exitcode = 128;
51df0ab5 7093 }
7094 core = ssh2_pkt_getbool(pktin);
7095 ssh_pkt_getstring(pktin, &msg, &msglen);
7096 if (msglen) {
7097 fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg);
7098 }
7099 /* ignore lang tag */
7100 } /* else don't attempt to parse */
7101 logeventf(ssh, "Server exited on signal%s%s%s",
7102 fmt_sig, core ? " (core dumped)" : "",
7103 fmt_msg);
7104 if (*fmt_sig) sfree(fmt_sig);
7105 if (*fmt_msg) sfree(fmt_msg);
7106 reply = SSH2_MSG_CHANNEL_SUCCESS;
7107
7108 }
7109 } else {
7110 /*
7111 * This is a channel request we don't know
7112 * about, so we now either ignore the request
7113 * or respond with CHANNEL_FAILURE, depending
7114 * on want_reply.
7115 */
7116 reply = SSH2_MSG_CHANNEL_FAILURE;
7117 }
7118 if (want_reply) {
7119 pktout = ssh2_pkt_init(reply);
7120 ssh2_pkt_adduint32(pktout, c->remoteid);
7121 ssh2_pkt_send(ssh, pktout);
7122 }
7123}
7124
7125static void ssh2_msg_global_request(Ssh ssh, struct Packet *pktin)
7126{
7127 char *type;
7128 int typelen, want_reply;
7129 struct Packet *pktout;
7130
7131 ssh_pkt_getstring(pktin, &type, &typelen);
7132 want_reply = ssh2_pkt_getbool(pktin);
7133
7134 /*
7135 * We currently don't support any global requests
7136 * at all, so we either ignore the request or
7137 * respond with REQUEST_FAILURE, depending on
7138 * want_reply.
7139 */
7140 if (want_reply) {
7141 pktout = ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE);
7142 ssh2_pkt_send(ssh, pktout);
7143 }
7144}
7145
7146static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin)
7147{
7148 char *type;
7149 int typelen;
7150 char *peeraddr;
7151 int peeraddrlen;
7152 int peerport;
7153 char *error = NULL;
7154 struct ssh_channel *c;
7155 unsigned remid, winsize, pktsize;
7156 struct Packet *pktout;
7157
7158 ssh_pkt_getstring(pktin, &type, &typelen);
7159 c = snew(struct ssh_channel);
7160 c->ssh = ssh;
7161
7162 remid = ssh_pkt_getuint32(pktin);
7163 winsize = ssh_pkt_getuint32(pktin);
7164 pktsize = ssh_pkt_getuint32(pktin);
7165
7166 if (typelen == 3 && !memcmp(type, "x11", 3)) {
7167 char *addrstr;
5907ebda 7168 const char *x11err;
51df0ab5 7169
7170 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
7171 addrstr = snewn(peeraddrlen+1, char);
7172 memcpy(addrstr, peeraddr, peeraddrlen);
7173 addrstr[peeraddrlen] = '\0';
7174 peerport = ssh_pkt_getuint32(pktin);
7175
7176 logeventf(ssh, "Received X11 connect request from %s:%d",
7177 addrstr, peerport);
7178
7179 if (!ssh->X11_fwd_enabled)
7180 error = "X11 forwarding is not enabled";
5907ebda 7181 else if ((x11err = x11_init(&c->u.x11.s, ssh->x11disp, c,
7182 addrstr, peerport, &ssh->cfg)) != NULL) {
7183 logeventf(ssh, "Local X11 connection failed: %s", x11err);
51df0ab5 7184 error = "Unable to open an X11 connection";
7185 } else {
7186 logevent("Opening X11 forward connection succeeded");
7187 c->type = CHAN_X11;
7188 }
7189
7190 sfree(addrstr);
7191 } else if (typelen == 15 &&
7192 !memcmp(type, "forwarded-tcpip", 15)) {
7193 struct ssh_rportfwd pf, *realpf;
7194 char *dummy;
7195 int dummylen;
7196 ssh_pkt_getstring(pktin, &dummy, &dummylen);/* skip address */
7197 pf.sport = ssh_pkt_getuint32(pktin);
7198 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
7199 peerport = ssh_pkt_getuint32(pktin);
7200 realpf = find234(ssh->rportfwds, &pf, NULL);
7201 logeventf(ssh, "Received remote port %d open request "
7202 "from %s:%d", pf.sport, peeraddr, peerport);
7203 if (realpf == NULL) {
7204 error = "Remote port is not recognised";
7205 } else {
7206 const char *e = pfd_newconnect(&c->u.pfd.s,
7207 realpf->dhost,
7208 realpf->dport, c,
05581745 7209 &ssh->cfg,
7210 realpf->pfrec->addressfamily);
51df0ab5 7211 logeventf(ssh, "Attempting to forward remote port to "
7212 "%s:%d", realpf->dhost, realpf->dport);
7213 if (e != NULL) {
7214 logeventf(ssh, "Port open failed: %s", e);
7215 error = "Port open failed";
7216 } else {
7217 logevent("Forwarded port opened successfully");
7218 c->type = CHAN_SOCKDATA;
7219 }
7220 }
7221 } else if (typelen == 22 &&
c49cf994 7222 !memcmp(type, "auth-agent@openssh.com", 22)) {
51df0ab5 7223 if (!ssh->agentfwd_enabled)
7224 error = "Agent forwarding is not enabled";
7225 else {
7226 c->type = CHAN_AGENT; /* identify channel type */
7227 c->u.a.lensofar = 0;
7228 }
7229 } else {
7230 error = "Unsupported channel type requested";
7231 }
7232
7233 c->remoteid = remid;
64d6ff88 7234 c->halfopen = FALSE;
51df0ab5 7235 if (error) {
7236 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE);
7237 ssh2_pkt_adduint32(pktout, c->remoteid);
7238 ssh2_pkt_adduint32(pktout, SSH2_OPEN_CONNECT_FAILED);
7239 ssh2_pkt_addstring(pktout, error);
7240 ssh2_pkt_addstring(pktout, "en"); /* language tag */
7241 ssh2_pkt_send(ssh, pktout);
7242 logeventf(ssh, "Rejected channel open: %s", error);
7243 sfree(c);
7244 } else {
94bdfe40 7245 ssh2_channel_init(c);
51df0ab5 7246 c->v.v2.remwindow = winsize;
7247 c->v.v2.remmaxpkt = pktsize;
51df0ab5 7248 add234(ssh->channels, c);
7249 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
7250 ssh2_pkt_adduint32(pktout, c->remoteid);
7251 ssh2_pkt_adduint32(pktout, c->localid);
7252 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);
954d5c5a 7253 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
51df0ab5 7254 ssh2_pkt_send(ssh, pktout);
7255 }
7256}
7257
6bbce591 7258/*
adb6167a 7259 * Buffer banner messages for later display at some convenient point,
7260 * if we're going to display them.
6bbce591 7261 */
7262static void ssh2_msg_userauth_banner(Ssh ssh, struct Packet *pktin)
7263{
7264 /* Arbitrary limit to prevent unbounded inflation of buffer */
adb6167a 7265 if (ssh->cfg.ssh_show_banner &&
7266 bufchain_size(&ssh->banner) <= 131072) {
6bbce591 7267 char *banner = NULL;
7268 int size = 0;
7269 ssh_pkt_getstring(pktin, &banner, &size);
7270 if (banner)
7271 bufchain_add(&ssh->banner, banner, size);
7272 }
7273}
7274
c6ccd5c2 7275/* Helper function to deal with sending tty modes for "pty-req" */
7276static void ssh2_send_ttymode(void *data, char *mode, char *val)
7277{
7278 struct Packet *pktout = (struct Packet *)data;
7279 int i = 0;
7280 unsigned int arg = 0;
7281 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
7282 if (i == lenof(ssh_ttymodes)) return;
7283 switch (ssh_ttymodes[i].type) {
7284 case TTY_OP_CHAR:
7285 arg = ssh_tty_parse_specchar(val);
7286 break;
7287 case TTY_OP_BOOL:
7288 arg = ssh_tty_parse_boolean(val);
7289 break;
7290 }
7291 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
7292 ssh2_pkt_adduint32(pktout, arg);
7293}
7294
783415f8 7295/*
2e85c969 7296 * Handle the SSH-2 userauth and connection layers.
7cca0d81 7297 */
ff3187f6 7298static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
7299 struct Packet *pktin)
7cca0d81 7300{
51470298 7301 struct do_ssh2_authconn_state {
7302 enum {
51470298 7303 AUTH_TYPE_NONE,
7304 AUTH_TYPE_PUBLICKEY,
7305 AUTH_TYPE_PUBLICKEY_OFFER_LOUD,
7306 AUTH_TYPE_PUBLICKEY_OFFER_QUIET,
7307 AUTH_TYPE_PASSWORD,
42af6a67 7308 AUTH_TYPE_GSSAPI,
51470298 7309 AUTH_TYPE_KEYBOARD_INTERACTIVE,
7310 AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
7311 } type;
a1a1fae4 7312 int done_service_req;
51470298 7313 int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter;
94cd7c3a 7314 int tried_pubkey_config, done_agent;
bf84a03a 7315#ifndef NO_GSSAPI
42af6a67 7316 int can_gssapi;
7317 int tried_gssapi;
bf84a03a 7318#endif
edd0cb8a 7319 int kbd_inter_refused;
ab18ccff 7320 int we_are_in, userauth_success;
edd0cb8a 7321 prompts_t *cur_prompt;
7322 int num_prompts;
51470298 7323 char username[100];
e955d348 7324 char *password;
51470298 7325 int got_username;
51470298 7326 void *publickey_blob;
7327 int publickey_bloblen;
edd0cb8a 7328 int publickey_encrypted;
7329 char *publickey_algorithm;
7330 char *publickey_comment;
94cd7c3a 7331 unsigned char agent_request[5], *agent_response, *agentp;
7332 int agent_responselen;
7333 unsigned char *pkblob_in_agent;
51470298 7334 int keyi, nkeys;
51470298 7335 char *pkblob, *alg, *commentp;
7336 int pklen, alglen, commentlen;
7337 int siglen, retlen, len;
7338 char *q, *agentreq, *ret;
7339 int try_send;
73feed4f 7340 int num_env, env_left, env_ok;
ff3187f6 7341 struct Packet *pktout;
bf84a03a 7342#ifndef NO_GSSAPI
b3d375b2 7343 struct ssh_gss_library *gsslib;
42af6a67 7344 Ssh_gss_ctx gss_ctx;
7345 Ssh_gss_buf gss_buf;
7346 Ssh_gss_buf gss_rcvtok, gss_sndtok;
7347 Ssh_gss_name gss_srv_name;
7348 Ssh_gss_stat gss_stat;
bf84a03a 7349#endif
51470298 7350 };
7351 crState(do_ssh2_authconn_state);
7352
7353 crBegin(ssh->do_ssh2_authconn_crstate);
e5574168 7354
a1a1fae4 7355 s->done_service_req = FALSE;
ab18ccff 7356 s->we_are_in = s->userauth_success = FALSE;
bf84a03a 7357#ifndef NO_GSSAPI
42af6a67 7358 s->tried_gssapi = FALSE;
bf84a03a 7359#endif
42af6a67 7360
a1a1fae4 7361 if (!ssh->cfg.ssh_no_userauth) {
7362 /*
7363 * Request userauth protocol, and await a response to it.
7364 */
7365 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
7366 ssh2_pkt_addstring(s->pktout, "ssh-userauth");
7367 ssh2_pkt_send(ssh, s->pktout);
7368 crWaitUntilV(pktin);
7369 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT)
7370 s->done_service_req = TRUE;
7371 }
7372 if (!s->done_service_req) {
7373 /*
7374 * Request connection protocol directly, without authentication.
7375 */
7376 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
7377 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7378 ssh2_pkt_send(ssh, s->pktout);
7379 crWaitUntilV(pktin);
7380 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT) {
7381 s->we_are_in = TRUE; /* no auth required */
7382 } else {
7383 bombout(("Server refused service request"));
7384 crStopV;
7385 }
8d5de777 7386 }
7cca0d81 7387
94cd7c3a 7388 /* Arrange to be able to deal with any BANNERs that come in.
7389 * (We do this now as packets may come in during the next bit.) */
7390 bufchain_init(&ssh->banner);
7391 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] =
7392 ssh2_msg_userauth_banner;
7393
7cca0d81 7394 /*
edd0cb8a 7395 * Misc one-time setup for authentication.
7396 */
7397 s->publickey_blob = NULL;
7398 if (!s->we_are_in) {
7399
7400 /*
7401 * Load the public half of any configured public key file
7402 * for later use.
7403 */
7404 if (!filename_is_null(ssh->cfg.keyfile)) {
7405 int keytype;
7406 logeventf(ssh, "Reading private key file \"%.150s\"",
7407 filename_to_str(&ssh->cfg.keyfile));
7408 keytype = key_type(&ssh->cfg.keyfile);
7409 if (keytype == SSH_KEYTYPE_SSH2) {
7410 const char *error;
7411 s->publickey_blob =
7412 ssh2_userkey_loadpub(&ssh->cfg.keyfile,
7413 &s->publickey_algorithm,
7414 &s->publickey_bloblen,
7415 &s->publickey_comment, &error);
7416 if (s->publickey_blob) {
7417 s->publickey_encrypted =
7418 ssh2_userkey_encrypted(&ssh->cfg.keyfile, NULL);
7419 } else {
7420 char *msgbuf;
7421 logeventf(ssh, "Unable to load private key (%s)",
7422 error);
7423 msgbuf = dupprintf("Unable to load private key file "
7424 "\"%.150s\" (%s)\r\n",
7425 filename_to_str(&ssh->cfg.keyfile),
7426 error);
7427 c_write_str(ssh, msgbuf);
7428 sfree(msgbuf);
7429 }
7430 } else {
7431 char *msgbuf;
7432 logeventf(ssh, "Unable to use this key file (%s)",
7433 key_type_to_str(keytype));
7434 msgbuf = dupprintf("Unable to use key file \"%.150s\""
7435 " (%s)\r\n",
7436 filename_to_str(&ssh->cfg.keyfile),
7437 key_type_to_str(keytype));
7438 c_write_str(ssh, msgbuf);
7439 sfree(msgbuf);
7440 s->publickey_blob = NULL;
7441 }
7442 }
7443
94cd7c3a 7444 /*
7445 * Find out about any keys Pageant has (but if there's a
7446 * public key configured, filter out all others).
7447 */
7448 s->nkeys = 0;
7449 s->agent_response = NULL;
7450 s->pkblob_in_agent = NULL;
116f229d 7451 if (ssh->cfg.tryagent && agent_exists()) {
94cd7c3a 7452
7453 void *r;
7454
7455 logevent("Pageant is running. Requesting keys.");
7456
7457 /* Request the keys held by the agent. */
7458 PUT_32BIT(s->agent_request, 1);
7459 s->agent_request[4] = SSH2_AGENTC_REQUEST_IDENTITIES;
7460 if (!agent_query(s->agent_request, 5, &r, &s->agent_responselen,
7461 ssh_agent_callback, ssh)) {
7462 do {
7463 crReturnV;
7464 if (pktin) {
7465 bombout(("Unexpected data from server while"
7466 " waiting for agent response"));
7467 crStopV;
7468 }
7469 } while (pktin || inlen > 0);
7470 r = ssh->agent_response;
7471 s->agent_responselen = ssh->agent_response_len;
7472 }
7473 s->agent_response = (unsigned char *) r;
7474 if (s->agent_response && s->agent_responselen >= 5 &&
7475 s->agent_response[4] == SSH2_AGENT_IDENTITIES_ANSWER) {
7476 int keyi;
7477 unsigned char *p;
7478 p = s->agent_response + 5;
7479 s->nkeys = GET_32BIT(p);
7480 p += 4;
7481 logeventf(ssh, "Pageant has %d SSH-2 keys", s->nkeys);
7482 if (s->publickey_blob) {
7483 /* See if configured key is in agent. */
7484 for (keyi = 0; keyi < s->nkeys; keyi++) {
7485 s->pklen = GET_32BIT(p);
7486 if (s->pklen == s->publickey_bloblen &&
7487 !memcmp(p+4, s->publickey_blob,
7488 s->publickey_bloblen)) {
7489 logeventf(ssh, "Pageant key #%d matches "
7490 "configured key file", keyi);
7491 s->keyi = keyi;
7492 s->pkblob_in_agent = p;
7493 break;
7494 }
7495 p += 4 + s->pklen;
7496 p += GET_32BIT(p) + 4; /* comment */
7497 }
7498 if (!s->pkblob_in_agent) {
7499 logevent("Configured key file not in Pageant");
7500 s->nkeys = 0;
7501 }
7502 }
7503 }
7504 }
7505
edd0cb8a 7506 }
7507
7508 /*
1408a877 7509 * We repeat this whole loop, including the username prompt,
7510 * until we manage a successful authentication. If the user
51470298 7511 * types the wrong _password_, they can be sent back to the
7512 * beginning to try another username, if this is configured on.
7513 * (If they specify a username in the config, they are never
7514 * asked, even if they do give a wrong password.)
1408a877 7515 *
7516 * I think this best serves the needs of
7517 *
7518 * - the people who have no configuration, no keys, and just
7519 * want to try repeated (username,password) pairs until they
7520 * type both correctly
7521 *
7522 * - people who have keys and configuration but occasionally
7523 * need to fall back to passwords
7524 *
7525 * - people with a key held in Pageant, who might not have
7526 * logged in to a particular machine before; so they want to
7527 * type a username, and then _either_ their key will be
7528 * accepted, _or_ they will type a password. If they mistype
7529 * the username they will want to be able to get back and
7530 * retype it!
7cca0d81 7531 */
51470298 7532 s->username[0] = '\0';
7533 s->got_username = FALSE;
a1a1fae4 7534 while (!s->we_are_in) {
1408a877 7535 /*
7536 * Get a username.
7537 */
86916870 7538 if (s->got_username && !ssh->cfg.change_username) {
5bb641e1 7539 /*
7540 * We got a username last time round this loop, and
7541 * with change_username turned off we don't try to get
7542 * it again.
7543 */
471c20b0 7544 } else if (!get_remote_username(&ssh->cfg, s->username,
7545 sizeof(s->username))) {
edd0cb8a 7546 int ret; /* need not be kept over crReturn */
7547 s->cur_prompt = new_prompts(ssh->frontend);
7548 s->cur_prompt->to_server = TRUE;
7549 s->cur_prompt->name = dupstr("SSH login name");
7550 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
7551 lenof(s->username));
7552 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7553 while (ret < 0) {
51470298 7554 ssh->send_ok = 1;
edd0cb8a 7555 crWaitUntilV(!pktin);
7556 ret = get_userpass_input(s->cur_prompt, in, inlen);
7557 ssh->send_ok = 0;
32874aea 7558 }
edd0cb8a 7559 if (!ret) {
7560 /*
7561 * get_userpass_input() failed to get a username.
7562 * Terminate.
7563 */
7564 free_prompts(s->cur_prompt);
7565 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
7566 crStopV;
7567 }
7568 memcpy(s->username, s->cur_prompt->prompts[0]->result,
7569 lenof(s->username));
7570 free_prompts(s->cur_prompt);
7cca0d81 7571 } else {
57356d63 7572 char *stuff;
65a22376 7573 if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
57356d63 7574 stuff = dupprintf("Using username \"%s\".\r\n", s->username);
51470298 7575 c_write_str(ssh, stuff);
57356d63 7576 sfree(stuff);
7cca0d81 7577 }
7578 }
51470298 7579 s->got_username = TRUE;
7cca0d81 7580
65a22376 7581 /*
1408a877 7582 * Send an authentication request using method "none": (a)
7583 * just in case it succeeds, and (b) so that we know what
7584 * authentication methods we can usefully try next.
65a22376 7585 */
acab36bc 7586 ssh->pkt_actx = SSH2_PKTCTX_NOAUTH;
51470298 7587
ff3187f6 7588 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7589 ssh2_pkt_addstring(s->pktout, s->username);
7590 ssh2_pkt_addstring(s->pktout, "ssh-connection");/* service requested */
7591 ssh2_pkt_addstring(s->pktout, "none"); /* method */
7592 ssh2_pkt_send(ssh, s->pktout);
51470298 7593 s->type = AUTH_TYPE_NONE;
7594 s->gotit = FALSE;
7595 s->we_are_in = FALSE;
7596
7597 s->tried_pubkey_config = FALSE;
6ac3a551 7598 s->kbd_inter_refused = FALSE;
65a22376 7599
94cd7c3a 7600 /* Reset agent request state. */
7601 s->done_agent = FALSE;
7602 if (s->agent_response) {
7603 if (s->pkblob_in_agent) {
7604 s->agentp = s->pkblob_in_agent;
7605 } else {
7606 s->agentp = s->agent_response + 5 + 4;
7607 s->keyi = 0;
7608 }
7609 }
7610
1408a877 7611 while (1) {
854caca5 7612 char *methods = NULL;
7613 int methlen = 0;
7614
1408a877 7615 /*
7616 * Wait for the result of the last authentication request.
7617 */
51470298 7618 if (!s->gotit)
ff3187f6 7619 crWaitUntilV(pktin);
6bbce591 7620 /*
7621 * Now is a convenient point to spew any banner material
7622 * that we've accumulated. (This should ensure that when
7623 * we exit the auth loop, we haven't any left to deal
7624 * with.)
7625 */
7626 {
7627 int size = bufchain_size(&ssh->banner);
32874aea 7628 /*
7629 * Don't show the banner if we're operating in
7630 * non-verbose non-interactive mode. (It's probably
7631 * a script, which means nobody will read the
7632 * banner _anyway_, and moreover the printing of
7633 * the banner will screw up processing on the
7634 * output of (say) plink.)
7635 */
6bbce591 7636 if (size && (flags & (FLAG_VERBOSE | FLAG_INTERACTIVE))) {
7637 char *banner = snewn(size, char);
7638 bufchain_fetch(&ssh->banner, banner, size);
7639 c_write_untrusted(ssh, banner, size);
7640 sfree(banner);
32874aea 7641 }
6bbce591 7642 bufchain_clear(&ssh->banner);
1408a877 7643 }
ff3187f6 7644 if (pktin->type == SSH2_MSG_USERAUTH_SUCCESS) {
1408a877 7645 logevent("Access granted");
ab18ccff 7646 s->we_are_in = s->userauth_success = TRUE;
1408a877 7647 break;
7648 }
65a22376 7649
42af6a67 7650 if (pktin->type != SSH2_MSG_USERAUTH_FAILURE && s->type != AUTH_TYPE_GSSAPI) {
e955d348 7651 bombout(("Strange packet received during authentication: "
7652 "type %d", pktin->type));
7ffdbc1a 7653 crStopV;
65a22376 7654 }
7655
51470298 7656 s->gotit = FALSE;
65a22376 7657
1408a877 7658 /*
7659 * OK, we're now sitting on a USERAUTH_FAILURE message, so
7660 * we can look at the string in it and know what we can
7661 * helpfully try next.
7662 */
ff3187f6 7663 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE) {
ff3187f6 7664 ssh_pkt_getstring(pktin, &methods, &methlen);
ff3187f6 7665 if (!ssh2_pkt_getbool(pktin)) {
1408a877 7666 /*
7667 * We have received an unequivocal Access
7668 * Denied. This can translate to a variety of
7669 * messages:
7670 *
7671 * - if we'd just tried "none" authentication,
7672 * it's not worth printing anything at all
7673 *
7674 * - if we'd just tried a public key _offer_,
7675 * the message should be "Server refused our
7676 * key" (or no message at all if the key
7677 * came from Pageant)
7678 *
7679 * - if we'd just tried anything else, the
7680 * message really should be "Access denied".
7681 *
7682 * Additionally, if we'd just tried password
7683 * authentication, we should break out of this
7684 * whole loop so as to go back to the username
91f57d1f 7685 * prompt (iff we're configured to allow
7686 * username change attempts).
1408a877 7687 */
51470298 7688 if (s->type == AUTH_TYPE_NONE) {
1408a877 7689 /* do nothing */
51470298 7690 } else if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD ||
7691 s->type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) {
7692 if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD)
7693 c_write_str(ssh, "Server refused our key\r\n");
1408a877 7694 logevent("Server refused public key");
51470298 7695 } else if (s->type==AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) {
4bdf7c46 7696 /* server declined keyboard-interactive; ignore */
1408a877 7697 } else {
51470298 7698 c_write_str(ssh, "Access denied\r\n");
1408a877 7699 logevent("Access denied");
91f57d1f 7700 if (s->type == AUTH_TYPE_PASSWORD &&
7701 ssh->cfg.change_username) {
6c9dce7c 7702 /* XXX perhaps we should allow
7703 * keyboard-interactive to do this too? */
51470298 7704 s->we_are_in = FALSE;
1408a877 7705 break;
7706 }
7707 }
7708 } else {
51470298 7709 c_write_str(ssh, "Further authentication required\r\n");
1408a877 7710 logevent("Further authentication required");
7711 }
65a22376 7712
51470298 7713 s->can_pubkey =
32874aea 7714 in_commasep_string("publickey", methods, methlen);
51470298 7715 s->can_passwd =
32874aea 7716 in_commasep_string("password", methods, methlen);
86916870 7717 s->can_keyb_inter = ssh->cfg.try_ki_auth &&
761187b6 7718 in_commasep_string("keyboard-interactive", methods, methlen);
1e00c92b 7719#ifndef NO_GSSAPI
7720 if (!ssh->gsslibs)
7721 ssh->gsslibs = ssh_gss_setup(&ssh->cfg);
42af6a67 7722 s->can_gssapi = ssh->cfg.try_gssapi_auth &&
b3d375b2 7723 in_commasep_string("gssapi-with-mic", methods, methlen) &&
1e00c92b 7724 ssh->gsslibs->nlibraries > 0;
42af6a67 7725#endif
1408a877 7726 }
65a22376 7727
acab36bc 7728 ssh->pkt_actx = SSH2_PKTCTX_NOAUTH;
65a22376 7729
94cd7c3a 7730 if (s->can_pubkey && !s->done_agent && s->nkeys) {
0405e71f 7731
1983e559 7732 /*
94cd7c3a 7733 * Attempt public-key authentication using a key from Pageant.
1983e559 7734 */
1983e559 7735
acab36bc 7736 ssh->pkt_actx = SSH2_PKTCTX_PUBLICKEY;
00db133f 7737
94cd7c3a 7738 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
7739
7740 /* Unpack key from agent response */
7741 s->pklen = GET_32BIT(s->agentp);
7742 s->agentp += 4;
7743 s->pkblob = (char *)s->agentp;
7744 s->agentp += s->pklen;
7745 s->alglen = GET_32BIT(s->pkblob);
7746 s->alg = s->pkblob + 4;
7747 s->commentlen = GET_32BIT(s->agentp);
7748 s->agentp += 4;
7749 s->commentp = (char *)s->agentp;
7750 s->agentp += s->commentlen;
7751 /* s->agentp now points at next key, if any */
7752
7753 /* See if server will accept it */
7754 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7755 ssh2_pkt_addstring(s->pktout, s->username);
7756 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7757 /* service requested */
7758 ssh2_pkt_addstring(s->pktout, "publickey");
7759 /* method */
7760 ssh2_pkt_addbool(s->pktout, FALSE); /* no signature included */
7761 ssh2_pkt_addstring_start(s->pktout);
7762 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
7763 ssh2_pkt_addstring_start(s->pktout);
7764 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
7765 ssh2_pkt_send(ssh, s->pktout);
7766 s->type = AUTH_TYPE_PUBLICKEY_OFFER_QUIET;
1983e559 7767
94cd7c3a 7768 crWaitUntilV(pktin);
7769 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
1983e559 7770
94cd7c3a 7771 /* Offer of key refused. */
7772 s->gotit = TRUE;
1983e559 7773
94cd7c3a 7774 } else {
7775
7776 void *vret;
1983e559 7777
94cd7c3a 7778 if (flags & FLAG_VERBOSE) {
7779 c_write_str(ssh, "Authenticating with "
7780 "public key \"");
7781 c_write(ssh, s->commentp, s->commentlen);
7782 c_write_str(ssh, "\" from agent\r\n");
7783 }
1983e559 7784
94cd7c3a 7785 /*
7786 * Server is willing to accept the key.
7787 * Construct a SIGN_REQUEST.
7788 */
7789 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7790 ssh2_pkt_addstring(s->pktout, s->username);
7791 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7792 /* service requested */
7793 ssh2_pkt_addstring(s->pktout, "publickey");
7794 /* method */
7795 ssh2_pkt_addbool(s->pktout, TRUE); /* signature included */
7796 ssh2_pkt_addstring_start(s->pktout);
7797 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
7798 ssh2_pkt_addstring_start(s->pktout);
7799 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
7800
7801 /* Ask agent for signature. */
7802 s->siglen = s->pktout->length - 5 + 4 +
7803 ssh->v2_session_id_len;
7804 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
7805 s->siglen -= 4;
7806 s->len = 1; /* message type */
7807 s->len += 4 + s->pklen; /* key blob */
7808 s->len += 4 + s->siglen; /* data to sign */
7809 s->len += 4; /* flags */
7810 s->agentreq = snewn(4 + s->len, char);
7811 PUT_32BIT(s->agentreq, s->len);
7812 s->q = s->agentreq + 4;
7813 *s->q++ = SSH2_AGENTC_SIGN_REQUEST;
7814 PUT_32BIT(s->q, s->pklen);
7815 s->q += 4;
7816 memcpy(s->q, s->pkblob, s->pklen);
7817 s->q += s->pklen;
7818 PUT_32BIT(s->q, s->siglen);
7819 s->q += 4;
7820 /* Now the data to be signed... */
7821 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
7822 PUT_32BIT(s->q, ssh->v2_session_id_len);
51470298 7823 s->q += 4;
94cd7c3a 7824 }
7825 memcpy(s->q, ssh->v2_session_id,
7826 ssh->v2_session_id_len);
7827 s->q += ssh->v2_session_id_len;
7828 memcpy(s->q, s->pktout->data + 5,
7829 s->pktout->length - 5);
7830 s->q += s->pktout->length - 5;
7831 /* And finally the (zero) flags word. */
7832 PUT_32BIT(s->q, 0);
7833 if (!agent_query(s->agentreq, s->len + 4,
7834 &vret, &s->retlen,
7835 ssh_agent_callback, ssh)) {
7836 do {
7837 crReturnV;
7838 if (pktin) {
7839 bombout(("Unexpected data from server"
7840 " while waiting for agent"
7841 " response"));
7842 crStopV;
1983e559 7843 }
94cd7c3a 7844 } while (pktin || inlen > 0);
7845 vret = ssh->agent_response;
7846 s->retlen = ssh->agent_response_len;
7847 }
7848 s->ret = vret;
7849 sfree(s->agentreq);
7850 if (s->ret) {
7851 if (s->ret[4] == SSH2_AGENT_SIGN_RESPONSE) {
7852 logevent("Sending Pageant's response");
7853 ssh2_add_sigblob(ssh, s->pktout,
7854 s->pkblob, s->pklen,
7855 s->ret + 9,
7856 GET_32BIT(s->ret + 5));
7857 ssh2_pkt_send(ssh, s->pktout);
7858 s->type = AUTH_TYPE_PUBLICKEY;
7859 } else {
7860 /* FIXME: less drastic response */
7861 bombout(("Pageant failed to answer challenge"));
7862 crStopV;
1983e559 7863 }
7864 }
1983e559 7865 }
94cd7c3a 7866
7867 /* Do we have any keys left to try? */
7868 if (s->pkblob_in_agent) {
7869 s->done_agent = TRUE;
7870 s->tried_pubkey_config = TRUE;
7871 } else {
7872 s->keyi++;
7873 if (s->keyi >= s->nkeys)
7874 s->done_agent = TRUE;
7875 }
1983e559 7876
edd0cb8a 7877 } else if (s->can_pubkey && s->publickey_blob &&
7878 !s->tried_pubkey_config) {
65a22376 7879
edd0cb8a 7880 struct ssh2_userkey *key; /* not live over crReturn */
7881 char *passphrase; /* not live over crReturn */
65a22376 7882
acab36bc 7883 ssh->pkt_actx = SSH2_PKTCTX_PUBLICKEY;
00db133f 7884
edd0cb8a 7885 s->tried_pubkey_config = TRUE;
7886
65a22376 7887 /*
1408a877 7888 * Try the public key supplied in the configuration.
7889 *
7890 * First, offer the public blob to see if the server is
7891 * willing to accept it.
65a22376 7892 */
ff3187f6 7893 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7894 ssh2_pkt_addstring(s->pktout, s->username);
edd0cb8a 7895 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7896 /* service requested */
7897 ssh2_pkt_addstring(s->pktout, "publickey"); /* method */
7898 ssh2_pkt_addbool(s->pktout, FALSE);
7899 /* no signature included */
7900 ssh2_pkt_addstring(s->pktout, s->publickey_algorithm);
7901 ssh2_pkt_addstring_start(s->pktout);
7902 ssh2_pkt_addstring_data(s->pktout,
7903 (char *)s->publickey_blob,
7904 s->publickey_bloblen);
ff3187f6 7905 ssh2_pkt_send(ssh, s->pktout);
edd0cb8a 7906 logevent("Offered public key");
ff3187f6 7907
7908 crWaitUntilV(pktin);
edd0cb8a 7909 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
7910 /* Key refused. Give up. */
7911 s->gotit = TRUE; /* reconsider message next loop */
7912 s->type = AUTH_TYPE_PUBLICKEY_OFFER_LOUD;
7913 continue; /* process this new message */
45068b27 7914 }
edd0cb8a 7915 logevent("Offer of public key accepted");
af659722 7916
45068b27 7917 /*
edd0cb8a 7918 * Actually attempt a serious authentication using
7919 * the key.
45068b27 7920 */
edd0cb8a 7921 if (flags & FLAG_VERBOSE) {
7922 c_write_str(ssh, "Authenticating with public key \"");
7923 c_write_str(ssh, s->publickey_comment);
7924 c_write_str(ssh, "\"\r\n");
7925 }
7926 key = NULL;
7927 while (!key) {
7928 const char *error; /* not live over crReturn */
7929 if (s->publickey_encrypted) {
7930 /*
7931 * Get a passphrase from the user.
7932 */
7933 int ret; /* need not be kept over crReturn */
7934 s->cur_prompt = new_prompts(ssh->frontend);
7935 s->cur_prompt->to_server = FALSE;
7936 s->cur_prompt->name = dupstr("SSH key passphrase");
7937 add_prompt(s->cur_prompt,
7938 dupprintf("Passphrase for key \"%.100s\": ",
7939 s->publickey_comment),
7940 FALSE, SSH_MAX_PASSWORD_LEN);
7941 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7942 while (ret < 0) {
7943 ssh->send_ok = 1;
7944 crWaitUntilV(!pktin);
7945 ret = get_userpass_input(s->cur_prompt,
7946 in, inlen);
7947 ssh->send_ok = 0;
7948 }
7949 if (!ret) {
7950 /* Failed to get a passphrase. Terminate. */
7951 free_prompts(s->cur_prompt);
7952 ssh_disconnect(ssh, NULL,
7953 "Unable to authenticate",
7954 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7955 TRUE);
7956 crStopV;
85fdbe25 7957 }
edd0cb8a 7958 passphrase =
7959 dupstr(s->cur_prompt->prompts[0]->result);
7960 free_prompts(s->cur_prompt);
45068b27 7961 } else {
edd0cb8a 7962 passphrase = NULL; /* no passphrase needed */
45068b27 7963 }
1408a877 7964
edd0cb8a 7965 /*
7966 * Try decrypting the key.
7967 */
7968 key = ssh2_load_userkey(&ssh->cfg.keyfile, passphrase,
7969 &error);
7970 if (passphrase) {
7971 /* burn the evidence */
7972 memset(passphrase, 0, strlen(passphrase));
7973 sfree(passphrase);
7974 }
7975 if (key == SSH2_WRONG_PASSPHRASE || key == NULL) {
7976 if (passphrase &&
7977 (key == SSH2_WRONG_PASSPHRASE)) {
7978 c_write_str(ssh, "Wrong passphrase\r\n");
7979 key = NULL;
7980 /* and loop again */
7981 } else {
7982 c_write_str(ssh, "Unable to load private key (");
7983 c_write_str(ssh, error);
7984 c_write_str(ssh, ")\r\n");
7985 key = NULL;
7986 break; /* try something else */
7987 }
1408a877 7988 }
65a22376 7989 }
65a22376 7990
edd0cb8a 7991 if (key) {
1dd353b5 7992 unsigned char *pkblob, *sigblob, *sigdata;
7993 int pkblob_len, sigblob_len, sigdata_len;
edd0cb8a 7994 int p;
65a22376 7995
1408a877 7996 /*
7997 * We have loaded the private key and the server
7998 * has announced that it's willing to accept it.
7999 * Hallelujah. Generate a signature and send it.
8000 */
ff3187f6 8001 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
8002 ssh2_pkt_addstring(s->pktout, s->username);
edd0cb8a 8003 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8004 /* service requested */
8005 ssh2_pkt_addstring(s->pktout, "publickey");
8006 /* method */
ff3187f6 8007 ssh2_pkt_addbool(s->pktout, TRUE);
edd0cb8a 8008 /* signature follows */
ff3187f6 8009 ssh2_pkt_addstring(s->pktout, key->alg->name);
edd0cb8a 8010 pkblob = key->alg->public_blob(key->data,
8011 &pkblob_len);
ff3187f6 8012 ssh2_pkt_addstring_start(s->pktout);
edd0cb8a 8013 ssh2_pkt_addstring_data(s->pktout, (char *)pkblob,
8014 pkblob_len);
1408a877 8015
8016 /*
8017 * The data to be signed is:
8018 *
8019 * string session-id
8020 *
8021 * followed by everything so far placed in the
8022 * outgoing packet.
8023 */
b672f405 8024 sigdata_len = s->pktout->length - 5 + 4 +
8025 ssh->v2_session_id_len;
edd0cb8a 8026 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
8027 sigdata_len -= 4;
92d60585 8028 sigdata = snewn(sigdata_len, unsigned char);
edd0cb8a 8029 p = 0;
8030 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
8031 PUT_32BIT(sigdata+p, ssh->v2_session_id_len);
8032 p += 4;
8033 }
b672f405 8034 memcpy(sigdata+p, ssh->v2_session_id,
8035 ssh->v2_session_id_len);
8036 p += ssh->v2_session_id_len;
ff3187f6 8037 memcpy(sigdata+p, s->pktout->data + 5,
8038 s->pktout->length - 5);
edd0cb8a 8039 p += s->pktout->length - 5;
8040 assert(p == sigdata_len);
d8baa528 8041 sigblob = key->alg->sign(key->data, (char *)sigdata,
1dd353b5 8042 sigdata_len, &sigblob_len);
ff3187f6 8043 ssh2_add_sigblob(ssh, s->pktout, pkblob, pkblob_len,
1dd353b5 8044 sigblob, sigblob_len);
8045 sfree(pkblob);
8046 sfree(sigblob);
1408a877 8047 sfree(sigdata);
8048
ff3187f6 8049 ssh2_pkt_send(ssh, s->pktout);
51470298 8050 s->type = AUTH_TYPE_PUBLICKEY;
75374b2f 8051 key->alg->freekey(key->data);
1408a877 8052 }
edd0cb8a 8053
42af6a67 8054#ifndef NO_GSSAPI
8055 } else if (s->can_gssapi && !s->tried_gssapi) {
8056
8057 /* GSSAPI Authentication */
8058
86557057 8059 int micoffset, len;
8060 char *data;
42af6a67 8061 Ssh_gss_buf mic;
8062 s->type = AUTH_TYPE_GSSAPI;
8063 s->tried_gssapi = TRUE;
8064 s->gotit = TRUE;
8065 ssh->pkt_actx = SSH2_PKTCTX_GSSAPI;
8066
b3d375b2 8067 /*
8068 * Pick the highest GSS library on the preference
8069 * list.
8070 */
8071 {
8072 int i, j;
8073 s->gsslib = NULL;
8074 for (i = 0; i < ngsslibs; i++) {
8075 int want_id = ssh->cfg.ssh_gsslist[i];
1e00c92b 8076 for (j = 0; j < ssh->gsslibs->nlibraries; j++)
8077 if (ssh->gsslibs->libraries[j].id == want_id) {
8078 s->gsslib = &ssh->gsslibs->libraries[j];
b3d375b2 8079 goto got_gsslib; /* double break */
8080 }
8081 }
8082 got_gsslib:
8083 /*
8084 * We always expect to have found something in
8085 * the above loop: we only came here if there
8086 * was at least one viable GSS library, and the
8087 * preference list should always mention
8088 * everything and only change the order.
8089 */
8090 assert(s->gsslib);
8091 }
8092
8093 if (s->gsslib->gsslogmsg)
8094 logevent(s->gsslib->gsslogmsg);
8095
42af6a67 8096 /* Sending USERAUTH_REQUEST with "gssapi-with-mic" method */
8097 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
8098 ssh2_pkt_addstring(s->pktout, s->username);
8099 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8100 ssh2_pkt_addstring(s->pktout, "gssapi-with-mic");
8101
8102 /* add mechanism info */
b3d375b2 8103 s->gsslib->indicate_mech(s->gsslib, &s->gss_buf);
42af6a67 8104
8105 /* number of GSSAPI mechanisms */
8106 ssh2_pkt_adduint32(s->pktout,1);
8107
8108 /* length of OID + 2 */
86557057 8109 ssh2_pkt_adduint32(s->pktout, s->gss_buf.length + 2);
42af6a67 8110 ssh2_pkt_addbyte(s->pktout, SSH2_GSS_OIDTYPE);
8111
8112 /* length of OID */
86557057 8113 ssh2_pkt_addbyte(s->pktout, (unsigned char) s->gss_buf.length);
42af6a67 8114
86557057 8115 ssh_pkt_adddata(s->pktout, s->gss_buf.value,
8116 s->gss_buf.length);
42af6a67 8117 ssh2_pkt_send(ssh, s->pktout);
8118 crWaitUntilV(pktin);
8119 if (pktin->type != SSH2_MSG_USERAUTH_GSSAPI_RESPONSE) {
8120 logevent("GSSAPI authentication request refused");
8121 continue;
8122 }
8123
8124 /* check returned packet ... */
8125
86557057 8126 ssh_pkt_getstring(pktin, &data, &len);
8127 s->gss_rcvtok.value = data;
8128 s->gss_rcvtok.length = len;
8129 if (s->gss_rcvtok.length != s->gss_buf.length + 2 ||
8130 ((char *)s->gss_rcvtok.value)[0] != SSH2_GSS_OIDTYPE ||
8131 ((char *)s->gss_rcvtok.value)[1] != s->gss_buf.length ||
8132 memcmp((char *)s->gss_rcvtok.value + 2,
8133 s->gss_buf.value,s->gss_buf.length) ) {
42af6a67 8134 logevent("GSSAPI authentication - wrong response from server");
8135 continue;
8136 }
8137
8138 /* now start running */
b3d375b2 8139 s->gss_stat = s->gsslib->import_name(s->gsslib,
8140 ssh->fullhostname,
8141 &s->gss_srv_name);
42af6a67 8142 if (s->gss_stat != SSH_GSS_OK) {
8143 if (s->gss_stat == SSH_GSS_BAD_HOST_NAME)
8144 logevent("GSSAPI import name failed - Bad service name");
8145 else
8146 logevent("GSSAPI import name failed");
8147 continue;
8148 }
8149
8150 /* fetch TGT into GSS engine */
b3d375b2 8151 s->gss_stat = s->gsslib->acquire_cred(s->gsslib, &s->gss_ctx);
42af6a67 8152
8153 if (s->gss_stat != SSH_GSS_OK) {
8154 logevent("GSSAPI authentication failed to get credentials");
b3d375b2 8155 s->gsslib->release_name(s->gsslib, &s->gss_srv_name);
42af6a67 8156 continue;
8157 }
8158
8159 /* initial tokens are empty */
86557057 8160 SSH_GSS_CLEAR_BUF(&s->gss_rcvtok);
99a3b3c9 8161 SSH_GSS_CLEAR_BUF(&s->gss_sndtok);
42af6a67 8162
8163 /* now enter the loop */
8164 do {
b3d375b2 8165 s->gss_stat = s->gsslib->init_sec_context
8166 (s->gsslib,
8167 &s->gss_ctx,
8168 s->gss_srv_name,
8169 ssh->cfg.gssapifwd,
8170 &s->gss_rcvtok,
8171 &s->gss_sndtok);
42af6a67 8172
8173 if (s->gss_stat!=SSH_GSS_S_COMPLETE &&
8174 s->gss_stat!=SSH_GSS_S_CONTINUE_NEEDED) {
8175 logevent("GSSAPI authentication initialisation failed");
8176
b3d375b2 8177 if (s->gsslib->display_status(s->gsslib, s->gss_ctx,
8178 &s->gss_buf) == SSH_GSS_OK) {
86557057 8179 logevent(s->gss_buf.value);
8180 sfree(s->gss_buf.value);
42af6a67 8181 }
8182
8183 break;
8184 }
8185 logevent("GSSAPI authentication initialised");
8186
8187 /* Client and server now exchange tokens until GSSAPI
8188 * no longer says CONTINUE_NEEDED */
8189
86557057 8190 if (s->gss_sndtok.length != 0) {
42af6a67 8191 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
8192 ssh_pkt_addstring_start(s->pktout);
86557057 8193 ssh_pkt_addstring_data(s->pktout,s->gss_sndtok.value,s->gss_sndtok.length);
42af6a67 8194 ssh2_pkt_send(ssh, s->pktout);
b3d375b2 8195 s->gsslib->free_tok(s->gsslib, &s->gss_sndtok);
42af6a67 8196 }
8197
8198 if (s->gss_stat == SSH_GSS_S_CONTINUE_NEEDED) {
8199 crWaitUntilV(pktin);
8200 if (pktin->type != SSH2_MSG_USERAUTH_GSSAPI_TOKEN) {
8201 logevent("GSSAPI authentication - bad server response");
8202 s->gss_stat = SSH_GSS_FAILURE;
8203 break;
8204 }
86557057 8205 ssh_pkt_getstring(pktin, &data, &len);
8206 s->gss_rcvtok.value = data;
8207 s->gss_rcvtok.length = len;
42af6a67 8208 }
8209 } while (s-> gss_stat == SSH_GSS_S_CONTINUE_NEEDED);
8210
8211 if (s->gss_stat != SSH_GSS_OK) {
b3d375b2 8212 s->gsslib->release_name(s->gsslib, &s->gss_srv_name);
8213 s->gsslib->release_cred(s->gsslib, &s->gss_ctx);
42af6a67 8214 continue;
8215 }
8216 logevent("GSSAPI authentication loop finished OK");
8217
8218 /* Now send the MIC */
8219
8220 s->pktout = ssh2_pkt_init(0);
8221 micoffset = s->pktout->length;
8222 ssh_pkt_addstring_start(s->pktout);
8223 ssh_pkt_addstring_data(s->pktout, (char *)ssh->v2_session_id, ssh->v2_session_id_len);
8224 ssh_pkt_addbyte(s->pktout, SSH2_MSG_USERAUTH_REQUEST);
8225 ssh_pkt_addstring(s->pktout, s->username);
8226 ssh_pkt_addstring(s->pktout, "ssh-connection");
8227 ssh_pkt_addstring(s->pktout, "gssapi-with-mic");
8228
86557057 8229 s->gss_buf.value = (char *)s->pktout->data + micoffset;
8230 s->gss_buf.length = s->pktout->length - micoffset;
42af6a67 8231
b3d375b2 8232 s->gsslib->get_mic(s->gsslib, s->gss_ctx, &s->gss_buf, &mic);
42af6a67 8233 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_GSSAPI_MIC);
8234 ssh_pkt_addstring_start(s->pktout);
86557057 8235 ssh_pkt_addstring_data(s->pktout, mic.value, mic.length);
42af6a67 8236 ssh2_pkt_send(ssh, s->pktout);
b3d375b2 8237 s->gsslib->free_mic(s->gsslib, &mic);
42af6a67 8238
8239 s->gotit = FALSE;
8240
b3d375b2 8241 s->gsslib->release_name(s->gsslib, &s->gss_srv_name);
8242 s->gsslib->release_cred(s->gsslib, &s->gss_ctx);
42af6a67 8243 continue;
8244#endif
edd0cb8a 8245 } else if (s->can_keyb_inter && !s->kbd_inter_refused) {
8246
8247 /*
8248 * Keyboard-interactive authentication.
8249 */
edd0cb8a 8250
edd0cb8a 8251 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
8252
acab36bc 8253 ssh->pkt_actx = SSH2_PKTCTX_KBDINTER;
edd0cb8a 8254
8255 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
8256 ssh2_pkt_addstring(s->pktout, s->username);
8257 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8258 /* service requested */
8259 ssh2_pkt_addstring(s->pktout, "keyboard-interactive");
8260 /* method */
8261 ssh2_pkt_addstring(s->pktout, ""); /* lang */
8262 ssh2_pkt_addstring(s->pktout, ""); /* submethods */
8263 ssh2_pkt_send(ssh, s->pktout);
8264
8265 crWaitUntilV(pktin);
8266 if (pktin->type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
8267 /* Server is not willing to do keyboard-interactive
b8e3173d 8268 * at all (or, bizarrely but legally, accepts the
8269 * user without actually issuing any prompts).
8270 * Give up on it entirely. */
edd0cb8a 8271 s->gotit = TRUE;
8272 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE)
8273 logevent("Keyboard-interactive authentication refused");
8274 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET;
8275 s->kbd_inter_refused = TRUE; /* don't try it again */
8276 continue;
8277 }
8278
8279 /*
b8e3173d 8280 * Loop while the server continues to send INFO_REQUESTs.
edd0cb8a 8281 */
b8e3173d 8282 while (pktin->type == SSH2_MSG_USERAUTH_INFO_REQUEST) {
edd0cb8a 8283
b8e3173d 8284 char *name, *inst, *lang;
8285 int name_len, inst_len, lang_len;
8286 int i;
8287
8288 /*
8289 * We've got a fresh USERAUTH_INFO_REQUEST.
8290 * Get the preamble and start building a prompt.
8291 */
8292 ssh_pkt_getstring(pktin, &name, &name_len);
8293 ssh_pkt_getstring(pktin, &inst, &inst_len);
8294 ssh_pkt_getstring(pktin, &lang, &lang_len);
8295 s->cur_prompt = new_prompts(ssh->frontend);
8296 s->cur_prompt->to_server = TRUE;
edd0cb8a 8297
b8e3173d 8298 /*
9ea10e78 8299 * Get any prompt(s) from the packet.
b8e3173d 8300 */
8301 s->num_prompts = ssh_pkt_getuint32(pktin);
8302 for (i = 0; i < s->num_prompts; i++) {
8303 char *prompt;
8304 int prompt_len;
8305 int echo;
8306 static char noprompt[] =
8307 "<server failed to send prompt>: ";
8308
8309 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
8310 echo = ssh2_pkt_getbool(pktin);
8311 if (!prompt_len) {
8312 prompt = noprompt;
8313 prompt_len = lenof(noprompt)-1;
8314 }
8315 add_prompt(s->cur_prompt,
8316 dupprintf("%.*s", prompt_len, prompt),
8317 echo, SSH_MAX_PASSWORD_LEN);
edd0cb8a 8318 }
b8e3173d 8319
9874c9d7 8320 if (name_len) {
8321 /* FIXME: better prefix to distinguish from
8322 * local prompts? */
8323 s->cur_prompt->name =
8324 dupprintf("SSH server: %.*s", name_len, name);
8325 s->cur_prompt->name_reqd = TRUE;
8326 } else {
8327 s->cur_prompt->name =
8328 dupstr("SSH server authentication");
8329 s->cur_prompt->name_reqd = FALSE;
8330 }
8331 /* We add a prefix to try to make it clear that a prompt
8332 * has come from the server.
8333 * FIXME: ugly to print "Using..." in prompt _every_
8334 * time round. Can this be done more subtly? */
8335 /* Special case: for reasons best known to themselves,
8336 * some servers send k-i requests with no prompts and
8337 * nothing to display. Keep quiet in this case. */
8338 if (s->num_prompts || name_len || inst_len) {
8339 s->cur_prompt->instruction =
8340 dupprintf("Using keyboard-interactive authentication.%s%.*s",
8341 inst_len ? "\n" : "", inst_len, inst);
8342 s->cur_prompt->instr_reqd = TRUE;
8343 } else {
8344 s->cur_prompt->instr_reqd = FALSE;
8345 }
8346
b8e3173d 8347 /*
9ea10e78 8348 * Display any instructions, and get the user's
8349 * response(s).
b8e3173d 8350 */
9ea10e78 8351 {
b8e3173d 8352 int ret; /* not live over crReturn */
8353 ret = get_userpass_input(s->cur_prompt, NULL, 0);
8354 while (ret < 0) {
8355 ssh->send_ok = 1;
8356 crWaitUntilV(!pktin);
8357 ret = get_userpass_input(s->cur_prompt, in, inlen);
8358 ssh->send_ok = 0;
8359 }
8360 if (!ret) {
8361 /*
8362 * Failed to get responses. Terminate.
8363 */
8364 free_prompts(s->cur_prompt);
8365 ssh_disconnect(ssh, NULL, "Unable to authenticate",
8366 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
8367 TRUE);
8368 crStopV;
8369 }
edd0cb8a 8370 }
b8e3173d 8371
8372 /*
9ea10e78 8373 * Send the response(s) to the server.
b8e3173d 8374 */
8375 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_INFO_RESPONSE);
b8e3173d 8376 ssh2_pkt_adduint32(s->pktout, s->num_prompts);
8377 for (i=0; i < s->num_prompts; i++) {
8378 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
8379 ssh2_pkt_addstring(s->pktout,
8380 s->cur_prompt->prompts[i]->result);
8381 end_log_omission(ssh, s->pktout);
8382 }
18524056 8383 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
b8e3173d 8384
8385 /*
8386 * Get the next packet in case it's another
8387 * INFO_REQUEST.
8388 */
8389 crWaitUntilV(pktin);
8390
edd0cb8a 8391 }
8392
8393 /*
b8e3173d 8394 * We should have SUCCESS or FAILURE now.
edd0cb8a 8395 */
b8e3173d 8396 s->gotit = TRUE;
edd0cb8a 8397
8398 } else if (s->can_passwd) {
8399
8400 /*
8401 * Plain old password authentication.
8402 */
8403 int ret; /* not live over crReturn */
e955d348 8404 int changereq_first_time; /* not live over crReturn */
edd0cb8a 8405
acab36bc 8406 ssh->pkt_actx = SSH2_PKTCTX_PASSWORD;
edd0cb8a 8407
8408 s->cur_prompt = new_prompts(ssh->frontend);
8409 s->cur_prompt->to_server = TRUE;
8410 s->cur_prompt->name = dupstr("SSH password");
8411 add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
8412 s->username,
8413 ssh->savedhost),
8414 FALSE, SSH_MAX_PASSWORD_LEN);
8415
8416 ret = get_userpass_input(s->cur_prompt, NULL, 0);
8417 while (ret < 0) {
8418 ssh->send_ok = 1;
8419 crWaitUntilV(!pktin);
8420 ret = get_userpass_input(s->cur_prompt, in, inlen);
8421 ssh->send_ok = 0;
8422 }
8423 if (!ret) {
8424 /*
8425 * Failed to get responses. Terminate.
8426 */
8427 free_prompts(s->cur_prompt);
8428 ssh_disconnect(ssh, NULL, "Unable to authenticate",
8429 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
8430 TRUE);
8431 crStopV;
8432 }
e955d348 8433 /*
8434 * Squirrel away the password. (We may need it later if
8435 * asked to change it.)
8436 */
8437 s->password = dupstr(s->cur_prompt->prompts[0]->result);
8438 free_prompts(s->cur_prompt);
edd0cb8a 8439
8440 /*
8441 * Send the password packet.
8442 *
95d2d262 8443 * We pad out the password packet to 256 bytes to make
8444 * it harder for an attacker to find the length of the
8445 * user's password.
1408a877 8446 *
95d2d262 8447 * Anyone using a password longer than 256 bytes
8448 * probably doesn't have much to worry about from
1408a877 8449 * people who find out how long their password is!
65a22376 8450 */
ff3187f6 8451 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
8452 ssh2_pkt_addstring(s->pktout, s->username);
edd0cb8a 8453 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8454 /* service requested */
ff3187f6 8455 ssh2_pkt_addstring(s->pktout, "password");
8456 ssh2_pkt_addbool(s->pktout, FALSE);
8457 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
e955d348 8458 ssh2_pkt_addstring(s->pktout, s->password);
ff3187f6 8459 end_log_omission(ssh, s->pktout);
18524056 8460 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
0d43337a 8461 logevent("Sent password");
28f4d4f0 8462 s->type = AUTH_TYPE_PASSWORD;
edd0cb8a 8463
e955d348 8464 /*
8465 * Wait for next packet, in case it's a password change
8466 * request.
8467 */
8468 crWaitUntilV(pktin);
8469 changereq_first_time = TRUE;
8470
8471 while (pktin->type == SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ) {
8472
8473 /*
8474 * We're being asked for a new password
8475 * (perhaps not for the first time).
8476 * Loop until the server accepts it.
8477 */
8478
8479 int got_new = FALSE; /* not live over crReturn */
8480 char *prompt; /* not live over crReturn */
8481 int prompt_len; /* not live over crReturn */
8482
8483 {
8484 char *msg;
8485 if (changereq_first_time)
8486 msg = "Server requested password change";
8487 else
8488 msg = "Server rejected new password";
8489 logevent(msg);
8490 c_write_str(ssh, msg);
8491 c_write_str(ssh, "\r\n");
8492 }
8493
8494 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
8495
8496 s->cur_prompt = new_prompts(ssh->frontend);
8497 s->cur_prompt->to_server = TRUE;
8498 s->cur_prompt->name = dupstr("New SSH password");
8499 s->cur_prompt->instruction =
8500 dupprintf("%.*s", prompt_len, prompt);
8501 s->cur_prompt->instr_reqd = TRUE;
d9add7bc 8502 /*
8503 * There's no explicit requirement in the protocol
8504 * for the "old" passwords in the original and
8505 * password-change messages to be the same, and
8506 * apparently some Cisco kit supports password change
8507 * by the user entering a blank password originally
8508 * and the real password subsequently, so,
8509 * reluctantly, we prompt for the old password again.
8510 *
8511 * (On the other hand, some servers don't even bother
8512 * to check this field.)
8513 */
8514 add_prompt(s->cur_prompt,
8515 dupstr("Current password (blank for previously entered password): "),
8516 FALSE, SSH_MAX_PASSWORD_LEN);
e955d348 8517 add_prompt(s->cur_prompt, dupstr("Enter new password: "),
8518 FALSE, SSH_MAX_PASSWORD_LEN);
8519 add_prompt(s->cur_prompt, dupstr("Confirm new password: "),
8520 FALSE, SSH_MAX_PASSWORD_LEN);
8521
8522 /*
8523 * Loop until the user manages to enter the same
8524 * password twice.
8525 */
8526 while (!got_new) {
8527
8528 ret = get_userpass_input(s->cur_prompt, NULL, 0);
8529 while (ret < 0) {
8530 ssh->send_ok = 1;
8531 crWaitUntilV(!pktin);
8532 ret = get_userpass_input(s->cur_prompt, in, inlen);
8533 ssh->send_ok = 0;
8534 }
8535 if (!ret) {
8536 /*
8537 * Failed to get responses. Terminate.
8538 */
8539 /* burn the evidence */
8540 free_prompts(s->cur_prompt);
8541 memset(s->password, 0, strlen(s->password));
8542 sfree(s->password);
8543 ssh_disconnect(ssh, NULL, "Unable to authenticate",
8544 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
8545 TRUE);
8546 crStopV;
8547 }
8548
8549 /*
d9add7bc 8550 * If the user specified a new original password
8551 * (IYSWIM), overwrite any previously specified
8552 * one.
8553 * (A side effect is that the user doesn't have to
8554 * re-enter it if they louse up the new password.)
8555 */
8556 if (s->cur_prompt->prompts[0]->result[0]) {
8557 memset(s->password, 0, strlen(s->password));
8558 /* burn the evidence */
8559 sfree(s->password);
8560 s->password =
8561 dupstr(s->cur_prompt->prompts[0]->result);
8562 }
8563
8564 /*
8565 * Check the two new passwords match.
e955d348 8566 */
d9add7bc 8567 got_new = (strcmp(s->cur_prompt->prompts[1]->result,
8568 s->cur_prompt->prompts[2]->result)
e955d348 8569 == 0);
8570 if (!got_new)
8571 /* They don't. Silly user. */
8572 c_write_str(ssh, "Passwords do not match\r\n");
8573
8574 }
8575
8576 /*
8577 * Send the new password (along with the old one).
8578 * (see above for padding rationale)
8579 */
8580 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
e955d348 8581 ssh2_pkt_addstring(s->pktout, s->username);
8582 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8583 /* service requested */
8584 ssh2_pkt_addstring(s->pktout, "password");
8585 ssh2_pkt_addbool(s->pktout, TRUE);
8586 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
8587 ssh2_pkt_addstring(s->pktout, s->password);
8588 ssh2_pkt_addstring(s->pktout,
d9add7bc 8589 s->cur_prompt->prompts[1]->result);
e955d348 8590 free_prompts(s->cur_prompt);
8591 end_log_omission(ssh, s->pktout);
18524056 8592 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
e955d348 8593 logevent("Sent new password");
8594
8595 /*
8596 * Now see what the server has to say about it.
8597 * (If it's CHANGEREQ again, it's not happy with the
8598 * new password.)
8599 */
8600 crWaitUntilV(pktin);
8601 changereq_first_time = FALSE;
8602
8603 }
8604
8605 /*
8606 * We need to reexamine the current pktin at the top
8607 * of the loop. Either:
8608 * - we weren't asked to change password at all, in
8609 * which case it's a SUCCESS or FAILURE with the
8610 * usual meaning
8611 * - we sent a new password, and the server was
8612 * either OK with it (SUCCESS or FAILURE w/partial
8613 * success) or unhappy with the _old_ password
8614 * (FAILURE w/o partial success)
8615 * In any of these cases, we go back to the top of
8616 * the loop and start again.
8617 */
8618 s->gotit = TRUE;
8619
8620 /*
8621 * We don't need the old password any more, in any
8622 * case. Burn the evidence.
8623 */
8624 memset(s->password, 0, strlen(s->password));
8625 sfree(s->password);
8626
1408a877 8627 } else {
854caca5 8628 char *str = dupprintf("No supported authentication methods available"
8629 " (server sent: %.*s)",
8630 methlen, methods);
edd0cb8a 8631
854caca5 8632 ssh_disconnect(ssh, str,
9e296bfa 8633 "No supported authentication methods available",
8634 SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
8635 FALSE);
854caca5 8636 sfree(str);
8637
7ffdbc1a 8638 crStopV;
edd0cb8a 8639
65a22376 8640 }
edd0cb8a 8641
65a22376 8642 }
a1a1fae4 8643 }
6bbce591 8644 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
7cca0d81 8645
edd0cb8a 8646 /* Clear up various bits and pieces from authentication. */
8647 if (s->publickey_blob) {
8648 sfree(s->publickey_blob);
8649 sfree(s->publickey_comment);
8650 }
94cd7c3a 8651 if (s->agent_response)
8652 sfree(s->agent_response);
edd0cb8a 8653
ab18ccff 8654 if (s->userauth_success) {
8655 /*
8656 * We've just received USERAUTH_SUCCESS, and we haven't sent any
8657 * packets since. Signal the transport layer to consider enacting
8658 * delayed compression.
8659 *
8660 * (Relying on we_are_in is not sufficient, as
8661 * draft-miller-secsh-compression-delayed is quite clear that it
8662 * triggers on USERAUTH_SUCCESS specifically, and we_are_in can
8663 * become set for other reasons.)
8664 */
8665 do_ssh2_transport(ssh, "enabling delayed compression", -2, NULL);
8666 }
8667
7cca0d81 8668 /*
a1a1fae4 8669 * Now the connection protocol has started, one way or another.
7cca0d81 8670 */
8671
0ed48730 8672 ssh->channels = newtree234(ssh_channelcmp);
8673
7cca0d81 8674 /*
b09eaa88 8675 * Set up handlers for some connection protocol messages, so we
8676 * don't have to handle them repeatedly in this coroutine.
8677 */
8678 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] =
8679 ssh2_msg_channel_window_adjust;
51df0ab5 8680 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] =
8681 ssh2_msg_global_request;
b09eaa88 8682
8683 /*
0ed48730 8684 * Create the main session channel.
7cca0d81 8685 */
feb02b4e 8686 if (ssh->cfg.ssh_no_shell) {
8687 ssh->mainchan = NULL;
8688 } else if (*ssh->cfg.ssh_nc_host) {
8689 /*
8690 * Just start a direct-tcpip channel and use it as the main
8691 * channel.
8692 */
8693 ssh->mainchan = snew(struct ssh_channel);
8694 ssh->mainchan->ssh = ssh;
94bdfe40 8695 ssh2_channel_init(ssh->mainchan);
23828b7e 8696 logeventf(ssh,
8697 "Opening direct-tcpip channel to %s:%d in place of session",
8698 ssh->cfg.ssh_nc_host, ssh->cfg.ssh_nc_port);
feb02b4e 8699 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
8700 ssh2_pkt_addstring(s->pktout, "direct-tcpip");
8701 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
feb02b4e 8702 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
8703 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
8704 ssh2_pkt_addstring(s->pktout, ssh->cfg.ssh_nc_host);
8705 ssh2_pkt_adduint32(s->pktout, ssh->cfg.ssh_nc_port);
8706 /*
23828b7e 8707 * There's nothing meaningful to put in the originator
8708 * fields, but some servers insist on syntactically correct
8709 * information.
feb02b4e 8710 */
8711 ssh2_pkt_addstring(s->pktout, "0.0.0.0");
8712 ssh2_pkt_adduint32(s->pktout, 0);
8713 ssh2_pkt_send(ssh, s->pktout);
8714
8715 crWaitUntilV(pktin);
8716 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
8717 bombout(("Server refused to open a direct-tcpip channel"));
8718 crStopV;
8719 /* FIXME: error data comes back in FAILURE packet */
8720 }
8721 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
8722 bombout(("Server's channel confirmation cited wrong channel"));
8723 crStopV;
8724 }
8725 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
8726 ssh->mainchan->halfopen = FALSE;
8727 ssh->mainchan->type = CHAN_MAINSESSION;
feb02b4e 8728 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
8729 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
feb02b4e 8730 add234(ssh->channels, ssh->mainchan);
8731 update_specials_menu(ssh->frontend);
23828b7e 8732 logevent("Opened direct-tcpip channel");
feb02b4e 8733 ssh->ncmode = TRUE;
8734 } else {
0ed48730 8735 ssh->mainchan = snew(struct ssh_channel);
8736 ssh->mainchan->ssh = ssh;
94bdfe40 8737 ssh2_channel_init(ssh->mainchan);
ff3187f6 8738 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
8739 ssh2_pkt_addstring(s->pktout, "session");
8740 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
ff3187f6 8741 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
954d5c5a 8742 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
ff3187f6 8743 ssh2_pkt_send(ssh, s->pktout);
8744 crWaitUntilV(pktin);
8745 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
0ed48730 8746 bombout(("Server refused to open a session"));
8747 crStopV;
8748 /* FIXME: error data comes back in FAILURE packet */
8749 }
ff3187f6 8750 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
0ed48730 8751 bombout(("Server's channel confirmation cited wrong channel"));
8752 crStopV;
8753 }
ff3187f6 8754 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
64d6ff88 8755 ssh->mainchan->halfopen = FALSE;
0ed48730 8756 ssh->mainchan->type = CHAN_MAINSESSION;
ff3187f6 8757 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
8758 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
0ed48730 8759 add234(ssh->channels, ssh->mainchan);
62638676 8760 update_specials_menu(ssh->frontend);
0ed48730 8761 logevent("Opened channel for session");
feb02b4e 8762 ssh->ncmode = FALSE;
8763 }
7cca0d81 8764
8765 /*
51df0ab5 8766 * Now we have a channel, make dispatch table entries for
8767 * general channel-based messages.
8768 */
8769 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] =
8770 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] =
8771 ssh2_msg_channel_data;
8772 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_channel_eof;
8773 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_channel_close;
8774 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] =
8775 ssh2_msg_channel_open_confirmation;
8776 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] =
8777 ssh2_msg_channel_open_failure;
8778 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] =
8779 ssh2_msg_channel_request;
8780 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] =
8781 ssh2_msg_channel_open;
8782
b589b816 8783 if (ssh->mainchan && ssh->cfg.ssh_simple) {
3361b80a 8784 /*
8785 * This message indicates to the server that we promise
8786 * not to try to run any other channel in parallel with
8787 * this one, so it's safe for it to advertise a very large
8788 * window and leave the flow control to TCP.
8789 */
8790 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8791 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8792 ssh2_pkt_addstring(s->pktout, "simple@putty.projects.tartarus.org");
8793 ssh2_pkt_addbool(s->pktout, 0); /* no reply */
8794 ssh2_pkt_send(ssh, s->pktout);
8795 }
8796
51df0ab5 8797 /*
783415f8 8798 * Potentially enable X11 forwarding.
8799 */
d070d2ad 8800 if (ssh->mainchan && !ssh->ncmode && ssh->cfg.x11_forward &&
8801 (ssh->x11disp = x11_setup_display(ssh->cfg.x11_display,
8802 ssh->cfg.x11_auth, &ssh->cfg))) {
32874aea 8803 logevent("Requesting X11 forwarding");
ff3187f6 8804 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8805 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8806 ssh2_pkt_addstring(s->pktout, "x11-req");
8807 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8808 ssh2_pkt_addbool(s->pktout, 0); /* many connections */
8def70c3 8809 ssh2_pkt_addstring(s->pktout, ssh->x11disp->remoteauthprotoname);
f68353be 8810 /*
8811 * Note that while we blank the X authentication data here, we don't
8812 * take any special action to blank the start of an X11 channel,
8813 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
8814 * without having session blanking enabled is likely to leak your
8815 * cookie into the log.
8816 */
178c3872 8817 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
8def70c3 8818 ssh2_pkt_addstring(s->pktout, ssh->x11disp->remoteauthdatastring);
178c3872 8819 end_log_omission(ssh, s->pktout);
8def70c3 8820 ssh2_pkt_adduint32(s->pktout, ssh->x11disp->screennum);
ff3187f6 8821 ssh2_pkt_send(ssh, s->pktout);
32874aea 8822
b09eaa88 8823 crWaitUntilV(pktin);
32874aea 8824
ff3187f6 8825 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8826 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
6b5cf8b4 8827 bombout(("Unexpected response to X11 forwarding request:"
ff3187f6 8828 " packet type %d", pktin->type));
7ffdbc1a 8829 crStopV;
32874aea 8830 }
8831 logevent("X11 forwarding refused");
8832 } else {
8833 logevent("X11 forwarding enabled");
51470298 8834 ssh->X11_fwd_enabled = TRUE;
32874aea 8835 }
783415f8 8836 }
8837
8838 /*
bc240b21 8839 * Enable port forwardings.
8840 */
06fadff5 8841 ssh_setup_portfwd(ssh, &ssh->cfg);
bc240b21 8842
8843 /*
36c2a3e9 8844 * Potentially enable agent forwarding.
8845 */
feb02b4e 8846 if (ssh->mainchan && !ssh->ncmode && ssh->cfg.agentfwd && agent_exists()) {
32874aea 8847 logevent("Requesting OpenSSH-style agent forwarding");
ff3187f6 8848 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8849 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8850 ssh2_pkt_addstring(s->pktout, "auth-agent-req@openssh.com");
8851 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8852 ssh2_pkt_send(ssh, s->pktout);
32874aea 8853
b09eaa88 8854 crWaitUntilV(pktin);
32874aea 8855
ff3187f6 8856 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8857 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
6b5cf8b4 8858 bombout(("Unexpected response to agent forwarding request:"
ff3187f6 8859 " packet type %d", pktin->type));
7ffdbc1a 8860 crStopV;
32874aea 8861 }
8862 logevent("Agent forwarding refused");
8863 } else {
8864 logevent("Agent forwarding enabled");
51470298 8865 ssh->agentfwd_enabled = TRUE;
32874aea 8866 }
36c2a3e9 8867 }
8868
8869 /*
7cca0d81 8870 * Now allocate a pty for the session.
8871 */
feb02b4e 8872 if (ssh->mainchan && !ssh->ncmode && !ssh->cfg.nopty) {
a5dd8467 8873 /* Unpick the terminal-speed string. */
8874 /* XXX perhaps we should allow no speeds to be sent. */
db219738 8875 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
8876 sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
a5dd8467 8877 /* Build the pty request. */
ff3187f6 8878 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8879 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
8880 ssh2_pkt_addstring(s->pktout, "pty-req");
8881 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8882 ssh2_pkt_addstring(s->pktout, ssh->cfg.termtype);
8883 ssh2_pkt_adduint32(s->pktout, ssh->term_width);
8884 ssh2_pkt_adduint32(s->pktout, ssh->term_height);
8885 ssh2_pkt_adduint32(s->pktout, 0); /* pixel width */
8886 ssh2_pkt_adduint32(s->pktout, 0); /* pixel height */
8887 ssh2_pkt_addstring_start(s->pktout);
c6ccd5c2 8888 parse_ttymodes(ssh, ssh->cfg.ttymodes,
8889 ssh2_send_ttymode, (void *)s->pktout);
8890 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_ISPEED);
ff3187f6 8891 ssh2_pkt_adduint32(s->pktout, ssh->ispeed);
c6ccd5c2 8892 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_OSPEED);
ff3187f6 8893 ssh2_pkt_adduint32(s->pktout, ssh->ospeed);
8894 ssh2_pkt_addstring_data(s->pktout, "\0", 1); /* TTY_OP_END */
8895 ssh2_pkt_send(ssh, s->pktout);
51470298 8896 ssh->state = SSH_STATE_INTERMED;
32874aea 8897
b09eaa88 8898 crWaitUntilV(pktin);
32874aea 8899
ff3187f6 8900 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8901 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
6b5cf8b4 8902 bombout(("Unexpected response to pty request:"
ff3187f6 8903 " packet type %d", pktin->type));
7ffdbc1a 8904 crStopV;
32874aea 8905 }
51470298 8906 c_write_str(ssh, "Server refused to allocate pty\r\n");
8907 ssh->editing = ssh->echoing = 1;
32874aea 8908 } else {
a5dd8467 8909 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
db219738 8910 ssh->ospeed, ssh->ispeed);
32874aea 8911 }
0965bee0 8912 } else {
51470298 8913 ssh->editing = ssh->echoing = 1;
7cca0d81 8914 }
8915
8916 /*
73feed4f 8917 * Send environment variables.
8918 *
8919 * Simplest thing here is to send all the requests at once, and
8920 * then wait for a whole bunch of successes or failures.
8921 */
feb02b4e 8922 if (ssh->mainchan && !ssh->ncmode && *ssh->cfg.environmt) {
73feed4f 8923 char *e = ssh->cfg.environmt;
8924 char *var, *varend, *val;
8925
8926 s->num_env = 0;
8927
8928 while (*e) {
8929 var = e;
8930 while (*e && *e != '\t') e++;
8931 varend = e;
8932 if (*e == '\t') e++;
8933 val = e;
8934 while (*e) e++;
8935 e++;
8936
ff3187f6 8937 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8938 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8939 ssh2_pkt_addstring(s->pktout, "env");
8940 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8941 ssh2_pkt_addstring_start(s->pktout);
8942 ssh2_pkt_addstring_data(s->pktout, var, varend-var);
8943 ssh2_pkt_addstring(s->pktout, val);
8944 ssh2_pkt_send(ssh, s->pktout);
73feed4f 8945
8946 s->num_env++;
8947 }
8948
8949 logeventf(ssh, "Sent %d environment variables", s->num_env);
8950
8951 s->env_ok = 0;
8952 s->env_left = s->num_env;
8953
8954 while (s->env_left > 0) {
b09eaa88 8955 crWaitUntilV(pktin);
73feed4f 8956
ff3187f6 8957 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8958 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
73feed4f 8959 bombout(("Unexpected response to environment request:"
ff3187f6 8960 " packet type %d", pktin->type));
73feed4f 8961 crStopV;
8962 }
8963 } else {
8964 s->env_ok++;
8965 }
8966
8967 s->env_left--;
8968 }
8969
8970 if (s->env_ok == s->num_env) {
8971 logevent("All environment variables successfully set");
8972 } else if (s->env_ok == 0) {
8973 logevent("All environment variables refused");
8974 c_write_str(ssh, "Server refused to set environment variables\r\n");
8975 } else {
8976 logeventf(ssh, "%d environment variables refused",
8977 s->num_env - s->env_ok);
8978 c_write_str(ssh, "Server refused to set all environment variables\r\n");
8979 }
8980 }
8981
8982 /*
fd5e5847 8983 * Start a shell or a remote command. We may have to attempt
8984 * this twice if the config data has provided a second choice
8985 * of command.
7cca0d81 8986 */
feb02b4e 8987 if (ssh->mainchan && !ssh->ncmode) while (1) {
fd5e5847 8988 int subsys;
8989 char *cmd;
8990
51470298 8991 if (ssh->fallback_cmd) {
86916870 8992 subsys = ssh->cfg.ssh_subsys2;
8993 cmd = ssh->cfg.remote_cmd_ptr2;
fd5e5847 8994 } else {
86916870 8995 subsys = ssh->cfg.ssh_subsys;
8996 cmd = ssh->cfg.remote_cmd_ptr;
04c52f10 8997 if (!cmd) cmd = ssh->cfg.remote_cmd;
fd5e5847 8998 }
8999
ff3187f6 9000 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9001 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
fd5e5847 9002 if (subsys) {
ff3187f6 9003 ssh2_pkt_addstring(s->pktout, "subsystem");
9004 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
9005 ssh2_pkt_addstring(s->pktout, cmd);
fd5e5847 9006 } else if (*cmd) {
ff3187f6 9007 ssh2_pkt_addstring(s->pktout, "exec");
9008 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
9009 ssh2_pkt_addstring(s->pktout, cmd);
fd5e5847 9010 } else {
ff3187f6 9011 ssh2_pkt_addstring(s->pktout, "shell");
9012 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
32874aea 9013 }
ff3187f6 9014 ssh2_pkt_send(ssh, s->pktout);
b09eaa88 9015
9016 crWaitUntilV(pktin);
9017
ff3187f6 9018 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
9019 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
6b5cf8b4 9020 bombout(("Unexpected response to shell/command request:"
ff3187f6 9021 " packet type %d", pktin->type));
7ffdbc1a 9022 crStopV;
fd5e5847 9023 }
9024 /*
9025 * We failed to start the command. If this is the
9026 * fallback command, we really are finished; if it's
9027 * not, and if the fallback command exists, try falling
9028 * back to it before complaining.
9029 */
86916870 9030 if (!ssh->fallback_cmd && ssh->cfg.remote_cmd_ptr2 != NULL) {
fd5e5847 9031 logevent("Primary command failed; attempting fallback");
51470298 9032 ssh->fallback_cmd = TRUE;
fd5e5847 9033 continue;
9034 }
6b5cf8b4 9035 bombout(("Server refused to start a shell/command"));
7ffdbc1a 9036 crStopV;
fd5e5847 9037 } else {
9038 logevent("Started a shell/command");
32874aea 9039 }
fd5e5847 9040 break;
7cca0d81 9041 }
9042
51470298 9043 ssh->state = SSH_STATE_SESSION;
9044 if (ssh->size_needed)
9045 ssh_size(ssh, ssh->term_width, ssh->term_height);
9046 if (ssh->eof_needed)
9047 ssh_special(ssh, TS_EOF);
6e48c3fe 9048
7cca0d81 9049 /*
0e443c99 9050 * All the initial channel requests are done, so install the default
9051 * failure handler.
9052 */
837d6ba6 9053 ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = ssh2_msg_channel_success;
0e443c99 9054 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = ssh2_msg_channel_failure;
9055
9056 /*
7cca0d81 9057 * Transfer data!
9058 */
b9d7bcad 9059 if (ssh->ldisc)
9060 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
0ed48730 9061 if (ssh->mainchan)
9062 ssh->send_ok = 1;
7cca0d81 9063 while (1) {
e5574168 9064 crReturnV;
51470298 9065 s->try_send = FALSE;
ff3187f6 9066 if (pktin) {
2b7540a7 9067
51df0ab5 9068 /*
9069 * _All_ the connection-layer packets we expect to
9070 * receive are now handled by the dispatch table.
9071 * Anything that reaches here must be bogus.
9072 */
32874aea 9073
51df0ab5 9074 bombout(("Strange packet received: type %d", pktin->type));
9075 crStopV;
0ed48730 9076 } else if (ssh->mainchan) {
32874aea 9077 /*
9078 * We have spare data. Add it to the channel buffer.
9079 */
d8baa528 9080 ssh2_add_channel_data(ssh->mainchan, (char *)in, inlen);
51470298 9081 s->try_send = TRUE;
32874aea 9082 }
51470298 9083 if (s->try_send) {
32874aea 9084 int i;
9085 struct ssh_channel *c;
9086 /*
9087 * Try to send data on all channels if we can.
9088 */
1bfc7e93 9089 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++)
78280721 9090 ssh2_try_send_and_unthrottle(ssh, c);
7cca0d81 9091 }
e5574168 9092 }
9093
9094 crFinishV;
9095}
9096
9097/*
2e85c969 9098 * Handlers for SSH-2 messages that might arrive at any moment.
b09eaa88 9099 */
409bfa77 9100static void ssh2_msg_disconnect(Ssh ssh, struct Packet *pktin)
b09eaa88 9101{
9102 /* log reason code in disconnect message */
9103 char *buf, *msg;
60860bc3 9104 int reason, msglen;
b09eaa88 9105
9106 reason = ssh_pkt_getuint32(pktin);
9107 ssh_pkt_getstring(pktin, &msg, &msglen);
9108
9109 if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
9110 buf = dupprintf("Received disconnect message (%s)",
9111 ssh2_disconnect_reasons[reason]);
9112 } else {
9113 buf = dupprintf("Received disconnect message (unknown"
9114 " type %d)", reason);
9115 }
9116 logevent(buf);
9117 sfree(buf);
60860bc3 9118 buf = dupprintf("Disconnection message text: %.*s",
9119 msglen, msg);
b09eaa88 9120 logevent(buf);
60860bc3 9121 bombout(("Server sent disconnect message\ntype %d (%s):\n\"%.*s\"",
b09eaa88 9122 reason,
9123 (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ?
9124 ssh2_disconnect_reasons[reason] : "unknown",
60860bc3 9125 msglen, msg));
b09eaa88 9126 sfree(buf);
9127}
9128
409bfa77 9129static void ssh2_msg_debug(Ssh ssh, struct Packet *pktin)
b09eaa88 9130{
9131 /* log the debug message */
fb983202 9132 char *msg;
b09eaa88 9133 int msglen;
9134 int always_display;
9135
9136 /* XXX maybe we should actually take notice of this */
9137 always_display = ssh2_pkt_getbool(pktin);
9138 ssh_pkt_getstring(pktin, &msg, &msglen);
9139
fb983202 9140 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
b09eaa88 9141}
9142
409bfa77 9143static void ssh2_msg_something_unimplemented(Ssh ssh, struct Packet *pktin)
b09eaa88 9144{
9145 struct Packet *pktout;
9146 pktout = ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED);
9147 ssh2_pkt_adduint32(pktout, pktin->sequence);
9148 /*
9149 * UNIMPLEMENTED messages MUST appear in the same order as the
9150 * messages they respond to. Hence, never queue them.
9151 */
9152 ssh2_pkt_send_noqueue(ssh, pktout);
9153}
9154
9155/*
2e85c969 9156 * Handle the top-level SSH-2 protocol.
7cca0d81 9157 */
b09eaa88 9158static void ssh2_protocol_setup(Ssh ssh)
9159{
9160 int i;
9161
9162 /*
9163 * Most messages cause SSH2_MSG_UNIMPLEMENTED.
9164 */
9165 for (i = 0; i < 256; i++)
9166 ssh->packet_dispatch[i] = ssh2_msg_something_unimplemented;
9167
9168 /*
9169 * Any message we actually understand, we set to NULL so that
9170 * the coroutines will get it.
9171 */
9172 ssh->packet_dispatch[SSH2_MSG_UNIMPLEMENTED] = NULL;
9173 ssh->packet_dispatch[SSH2_MSG_SERVICE_REQUEST] = NULL;
9174 ssh->packet_dispatch[SSH2_MSG_SERVICE_ACCEPT] = NULL;
9175 ssh->packet_dispatch[SSH2_MSG_KEXINIT] = NULL;
9176 ssh->packet_dispatch[SSH2_MSG_NEWKEYS] = NULL;
9177 ssh->packet_dispatch[SSH2_MSG_KEXDH_INIT] = NULL;
9178 ssh->packet_dispatch[SSH2_MSG_KEXDH_REPLY] = NULL;
9179 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REQUEST] = NULL; duplicate case value */
9180 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_GROUP] = NULL; duplicate case value */
9181 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_INIT] = NULL;
9182 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REPLY] = NULL;
9183 ssh->packet_dispatch[SSH2_MSG_USERAUTH_REQUEST] = NULL;
9184 ssh->packet_dispatch[SSH2_MSG_USERAUTH_FAILURE] = NULL;
9185 ssh->packet_dispatch[SSH2_MSG_USERAUTH_SUCCESS] = NULL;
9186 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
9187 ssh->packet_dispatch[SSH2_MSG_USERAUTH_PK_OK] = NULL;
9188 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ] = NULL; duplicate case value */
9189 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_REQUEST] = NULL; duplicate case value */
9190 ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_RESPONSE] = NULL;
9191 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = NULL;
9192 ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = NULL;
9193 ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = NULL;
9194 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = NULL;
9195 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = NULL;
9196 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = NULL;
9197 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = NULL;
9198 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = NULL;
9199 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = NULL;
9200 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = NULL;
9201 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = NULL;
9202 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = NULL;
9203 ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = NULL;
9204 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = NULL;
9205
9206 /*
9207 * These special message types we install handlers for.
9208 */
9209 ssh->packet_dispatch[SSH2_MSG_DISCONNECT] = ssh2_msg_disconnect;
2e85c969 9210 ssh->packet_dispatch[SSH2_MSG_IGNORE] = ssh_msg_ignore; /* shared with SSH-1 */
b09eaa88 9211 ssh->packet_dispatch[SSH2_MSG_DEBUG] = ssh2_msg_debug;
9212}
9213
9442dd57 9214static void ssh2_timer(void *ctx, long now)
9215{
9216 Ssh ssh = (Ssh)ctx;
9217
ecbb0000 9218 if (ssh->state == SSH_STATE_CLOSED)
9219 return;
9220
e6c1536e 9221 if (!ssh->kex_in_progress && ssh->cfg.ssh_rekey_time != 0 &&
9442dd57 9222 now - ssh->next_rekey >= 0) {
f382c87d 9223 do_ssh2_transport(ssh, "timeout", -1, NULL);
9442dd57 9224 }
9225}
9226
1c1a7262 9227static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
ff3187f6 9228 struct Packet *pktin)
7cca0d81 9229{
1c1a7262 9230 unsigned char *in = (unsigned char *)vin;
b09eaa88 9231 if (ssh->state == SSH_STATE_CLOSED)
9232 return;
9233
9442dd57 9234 if (pktin) {
9235 ssh->incoming_data_size += pktin->encrypted_len;
9236 if (!ssh->kex_in_progress &&
d57f70af 9237 ssh->max_data_size != 0 &&
9238 ssh->incoming_data_size > ssh->max_data_size)
f382c87d 9239 do_ssh2_transport(ssh, "too much data received", -1, NULL);
9442dd57 9240 }
9241
b09eaa88 9242 if (pktin && ssh->packet_dispatch[pktin->type]) {
9243 ssh->packet_dispatch[pktin->type](ssh, pktin);
32874aea 9244 return;
b09eaa88 9245 }
9246
9247 if (!ssh->protocol_initial_phase_done ||
9248 (pktin && pktin->type >= 20 && pktin->type < 50)) {
9249 if (do_ssh2_transport(ssh, in, inlen, pktin) &&
9250 !ssh->protocol_initial_phase_done) {
9251 ssh->protocol_initial_phase_done = TRUE;
9252 /*
9253 * Allow authconn to initialise itself.
9254 */
9255 do_ssh2_authconn(ssh, NULL, 0, NULL);
9256 }
9257 } else {
9258 do_ssh2_authconn(ssh, in, inlen, pktin);
9259 }
7cca0d81 9260}
9261
9262/*
8df7a775 9263 * Called to set up the connection.
374330e2 9264 *
9265 * Returns an error message, or NULL on success.
374330e2 9266 */
cbe2d68f 9267static const char *ssh_init(void *frontend_handle, void **backend_handle,
9268 Config *cfg,
79bf227b 9269 char *host, int port, char **realhost, int nodelay,
9270 int keepalive)
32874aea 9271{
cbe2d68f 9272 const char *p;
51470298 9273 Ssh ssh;
9274
3d88e64d 9275 ssh = snew(struct ssh_tag);
86916870 9276 ssh->cfg = *cfg; /* STRUCTURE COPY */
125105d1 9277 ssh->version = 0; /* when not ready yet */
51470298 9278 ssh->s = NULL;
9279 ssh->cipher = NULL;
371e569c 9280 ssh->v1_cipher_ctx = NULL;
0183b242 9281 ssh->crcda_ctx = NULL;
51470298 9282 ssh->cscipher = NULL;
371e569c 9283 ssh->cs_cipher_ctx = NULL;
51470298 9284 ssh->sccipher = NULL;
371e569c 9285 ssh->sc_cipher_ctx = NULL;
51470298 9286 ssh->csmac = NULL;
a8327734 9287 ssh->cs_mac_ctx = NULL;
51470298 9288 ssh->scmac = NULL;
e0e1a00d 9289 ssh->sc_mac_ctx = NULL;
51470298 9290 ssh->cscomp = NULL;
5366aed8 9291 ssh->cs_comp_ctx = NULL;
51470298 9292 ssh->sccomp = NULL;
5366aed8 9293 ssh->sc_comp_ctx = NULL;
51470298 9294 ssh->kex = NULL;
389aa499 9295 ssh->kex_ctx = NULL;
51470298 9296 ssh->hostkey = NULL;
9297 ssh->exitcode = -1;
ac934965 9298 ssh->close_expected = FALSE;
9e296bfa 9299 ssh->clean_exit = FALSE;
51470298 9300 ssh->state = SSH_STATE_PREPACKET;
9301 ssh->size_needed = FALSE;
9302 ssh->eof_needed = FALSE;
b9d7bcad 9303 ssh->ldisc = NULL;
a8327734 9304 ssh->logctx = NULL;
51470298 9305 ssh->deferred_send_data = NULL;
9306 ssh->deferred_len = 0;
9307 ssh->deferred_size = 0;
9308 ssh->fallback_cmd = 0;
acab36bc 9309 ssh->pkt_kctx = SSH2_PKTCTX_NOKEX;
9310 ssh->pkt_actx = SSH2_PKTCTX_NOAUTH;
8def70c3 9311 ssh->x11disp = NULL;
be738459 9312 ssh->v1_compressing = FALSE;
51470298 9313 ssh->v2_outgoing_sequence = 0;
9314 ssh->ssh1_rdpkt_crstate = 0;
9315 ssh->ssh2_rdpkt_crstate = 0;
9316 ssh->do_ssh_init_crstate = 0;
9317 ssh->ssh_gotdata_crstate = 0;
b09eaa88 9318 ssh->do_ssh1_connection_crstate = 0;
51470298 9319 ssh->do_ssh1_login_crstate = 0;
9320 ssh->do_ssh2_transport_crstate = 0;
9321 ssh->do_ssh2_authconn_crstate = 0;
9322 ssh->do_ssh_init_state = NULL;
9323 ssh->do_ssh1_login_state = NULL;
9324 ssh->do_ssh2_transport_state = NULL;
9325 ssh->do_ssh2_authconn_state = NULL;
4320baf7 9326 ssh->v_c = NULL;
9327 ssh->v_s = NULL;
6571dbfd 9328 ssh->mainchan = NULL;
968d2d92 9329 ssh->throttled_all = 0;
9330 ssh->v1_stdout_throttling = 0;
590f6a5f 9331 ssh->queue = NULL;
9332 ssh->queuelen = ssh->queuesize = 0;
9333 ssh->queueing = FALSE;
06fadff5 9334 ssh->qhead = ssh->qtail = NULL;
e13bba36 9335 ssh->deferred_rekey_reason = NULL;
3d9449a1 9336 bufchain_init(&ssh->queued_incoming_data);
9337 ssh->frozen = FALSE;
51470298 9338
9339 *backend_handle = ssh;
32874aea 9340
8f203108 9341#ifdef MSCRYPTOAPI
32874aea 9342 if (crypto_startup() == 0)
8f203108 9343 return "Microsoft high encryption pack not installed!";
9344#endif
374330e2 9345
51470298 9346 ssh->frontend = frontend_handle;
86916870 9347 ssh->term_width = ssh->cfg.width;
9348 ssh->term_height = ssh->cfg.height;
887035a5 9349
fabd1805 9350 ssh->channels = NULL;
9351 ssh->rportfwds = NULL;
f47a5ffb 9352 ssh->portfwds = NULL;
fabd1805 9353
51470298 9354 ssh->send_ok = 0;
9355 ssh->editing = 0;
9356 ssh->echoing = 0;
ff68564b 9357 ssh->conn_throttle_count = 0;
51470298 9358 ssh->overall_bufsize = 0;
9359 ssh->fallback_cmd = 0;
8df7a775 9360
3648d4c5 9361 ssh->protocol = NULL;
9362
b09eaa88 9363 ssh->protocol_initial_phase_done = FALSE;
9364
39934deb 9365 ssh->pinger = NULL;
9366
9442dd57 9367 ssh->incoming_data_size = ssh->outgoing_data_size =
9368 ssh->deferred_data_size = 0L;
d57f70af 9369 ssh->max_data_size = parse_blocksize(ssh->cfg.ssh_rekey_data);
9442dd57 9370 ssh->kex_in_progress = FALSE;
9371
1e00c92b 9372#ifndef NO_GSSAPI
9373 ssh->gsslibs = NULL;
9374#endif
9375
79bf227b 9376 p = connect_to_host(ssh, host, port, realhost, nodelay, keepalive);
fb09bf1c 9377 if (p != NULL)
9378 return p;
374330e2 9379
5d17ccfc 9380 random_ref();
9381
374330e2 9382 return NULL;
9383}
9384
fabd1805 9385static void ssh_free(void *handle)
9386{
9387 Ssh ssh = (Ssh) handle;
9388 struct ssh_channel *c;
9389 struct ssh_rportfwd *pf;
9390
9391 if (ssh->v1_cipher_ctx)
9392 ssh->cipher->free_context(ssh->v1_cipher_ctx);
9393 if (ssh->cs_cipher_ctx)
9394 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
9395 if (ssh->sc_cipher_ctx)
9396 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
9397 if (ssh->cs_mac_ctx)
9398 ssh->csmac->free_context(ssh->cs_mac_ctx);
9399 if (ssh->sc_mac_ctx)
9400 ssh->scmac->free_context(ssh->sc_mac_ctx);
29b1d0b3 9401 if (ssh->cs_comp_ctx) {
9402 if (ssh->cscomp)
9403 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
9404 else
9405 zlib_compress_cleanup(ssh->cs_comp_ctx);
9406 }
9407 if (ssh->sc_comp_ctx) {
9408 if (ssh->sccomp)
9409 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
9410 else
9411 zlib_decompress_cleanup(ssh->sc_comp_ctx);
9412 }
fabd1805 9413 if (ssh->kex_ctx)
9414 dh_cleanup(ssh->kex_ctx);
9415 sfree(ssh->savedhost);
9416
590f6a5f 9417 while (ssh->queuelen-- > 0)
9418 ssh_free_packet(ssh->queue[ssh->queuelen]);
9419 sfree(ssh->queue);
9420
06fadff5 9421 while (ssh->qhead) {
9422 struct queued_handler *qh = ssh->qhead;
9423 ssh->qhead = qh->next;
9424 sfree(ssh->qhead);
9425 }
9426 ssh->qhead = ssh->qtail = NULL;
9427
fabd1805 9428 if (ssh->channels) {
9429 while ((c = delpos234(ssh->channels, 0)) != NULL) {
9430 switch (c->type) {
9431 case CHAN_X11:
9432 if (c->u.x11.s != NULL)
9433 x11_close(c->u.x11.s);
9434 break;
9435 case CHAN_SOCKDATA:
409eca86 9436 case CHAN_SOCKDATA_DORMANT:
fabd1805 9437 if (c->u.pfd.s != NULL)
9438 pfd_close(c->u.pfd.s);
9439 break;
9440 }
9441 sfree(c);
9442 }
9443 freetree234(ssh->channels);
cdb52705 9444 ssh->channels = NULL;
fabd1805 9445 }
9446
9447 if (ssh->rportfwds) {
9448 while ((pf = delpos234(ssh->rportfwds, 0)) != NULL)
8aea57fd 9449 free_rportfwd(pf);
fabd1805 9450 freetree234(ssh->rportfwds);
cdb52705 9451 ssh->rportfwds = NULL;
fabd1805 9452 }
9453 sfree(ssh->deferred_send_data);
8def70c3 9454 if (ssh->x11disp)
9455 x11_free_display(ssh->x11disp);
fabd1805 9456 sfree(ssh->do_ssh_init_state);
9457 sfree(ssh->do_ssh1_login_state);
9458 sfree(ssh->do_ssh2_transport_state);
9459 sfree(ssh->do_ssh2_authconn_state);
4320baf7 9460 sfree(ssh->v_c);
9461 sfree(ssh->v_s);
42af6a67 9462 sfree(ssh->fullhostname);
679539d7 9463 if (ssh->crcda_ctx) {
9464 crcda_free_context(ssh->crcda_ctx);
9465 ssh->crcda_ctx = NULL;
9466 }
fabd1805 9467 if (ssh->s)
ac934965 9468 ssh_do_close(ssh, TRUE);
9442dd57 9469 expire_timer_context(ssh);
39934deb 9470 if (ssh->pinger)
9471 pinger_free(ssh->pinger);
3d9449a1 9472 bufchain_clear(&ssh->queued_incoming_data);
1e00c92b 9473#ifndef NO_GSSAPI
9474 if (ssh->gsslibs)
9475 ssh_gss_cleanup(ssh->gsslibs);
9476#endif
ee50e8b6 9477 sfree(ssh);
5d17ccfc 9478
9479 random_unref();
fabd1805 9480}
9481
374330e2 9482/*
86916870 9483 * Reconfigure the SSH backend.
86916870 9484 */
9485static void ssh_reconfig(void *handle, Config *cfg)
9486{
9487 Ssh ssh = (Ssh) handle;
e13bba36 9488 char *rekeying = NULL, rekey_mandatory = FALSE;
e6c1536e 9489 unsigned long old_max_data_size;
9490
39934deb 9491 pinger_reconfig(ssh->pinger, &ssh->cfg, cfg);
3b6606c7 9492 if (ssh->portfwds)
9493 ssh_setup_portfwd(ssh, cfg);
e6c1536e 9494
9495 if (ssh->cfg.ssh_rekey_time != cfg->ssh_rekey_time &&
9496 cfg->ssh_rekey_time != 0) {
9497 long new_next = ssh->last_rekey + cfg->ssh_rekey_time*60*TICKSPERSEC;
9498 long now = GETTICKCOUNT();
9499
9500 if (new_next - now < 0) {
f382c87d 9501 rekeying = "timeout shortened";
e6c1536e 9502 } else {
9503 ssh->next_rekey = schedule_timer(new_next - now, ssh2_timer, ssh);
9504 }
9505 }
9506
9507 old_max_data_size = ssh->max_data_size;
9508 ssh->max_data_size = parse_blocksize(cfg->ssh_rekey_data);
9509 if (old_max_data_size != ssh->max_data_size &&
9510 ssh->max_data_size != 0) {
9511 if (ssh->outgoing_data_size > ssh->max_data_size ||
9512 ssh->incoming_data_size > ssh->max_data_size)
f382c87d 9513 rekeying = "data limit lowered";
e6c1536e 9514 }
9515
e13bba36 9516 if (ssh->cfg.compression != cfg->compression) {
f382c87d 9517 rekeying = "compression setting changed";
e13bba36 9518 rekey_mandatory = TRUE;
9519 }
9520
9521 if (ssh->cfg.ssh2_des_cbc != cfg->ssh2_des_cbc ||
9522 memcmp(ssh->cfg.ssh_cipherlist, cfg->ssh_cipherlist,
9523 sizeof(ssh->cfg.ssh_cipherlist))) {
f382c87d 9524 rekeying = "cipher settings changed";
e13bba36 9525 rekey_mandatory = TRUE;
e6c1536e 9526 }
9527
86916870 9528 ssh->cfg = *cfg; /* STRUCTURE COPY */
e13bba36 9529
9530 if (rekeying) {
9531 if (!ssh->kex_in_progress) {
9532 do_ssh2_transport(ssh, rekeying, -1, NULL);
9533 } else if (rekey_mandatory) {
9534 ssh->deferred_rekey_reason = rekeying;
9535 }
9536 }
86916870 9537}
9538
9539/*
86dc445a 9540 * Called to send data down the SSH connection.
374330e2 9541 */
51470298 9542static int ssh_send(void *handle, char *buf, int len)
32874aea 9543{
51470298 9544 Ssh ssh = (Ssh) handle;
9545
9546 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
5471d09a 9547 return 0;
374330e2 9548
d8baa528 9549 ssh->protocol(ssh, (unsigned char *)buf, len, 0);
5471d09a 9550
51470298 9551 return ssh_sendbuffer(ssh);
5471d09a 9552}
9553
9554/*
9555 * Called to query the current amount of buffered stdin data.
9556 */
51470298 9557static int ssh_sendbuffer(void *handle)
5471d09a 9558{
51470298 9559 Ssh ssh = (Ssh) handle;
5471d09a 9560 int override_value;
9561
51470298 9562 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
5471d09a 9563 return 0;
9564
9565 /*
9566 * If the SSH socket itself has backed up, add the total backup
9567 * size on that to any individual buffer on the stdin channel.
9568 */
9569 override_value = 0;
51470298 9570 if (ssh->throttled_all)
9571 override_value = ssh->overall_bufsize;
5471d09a 9572
51470298 9573 if (ssh->version == 1) {
5471d09a 9574 return override_value;
51470298 9575 } else if (ssh->version == 2) {
9576 if (!ssh->mainchan || ssh->mainchan->closes > 0)
5471d09a 9577 return override_value;
9578 else
51470298 9579 return (override_value +
9580 bufchain_size(&ssh->mainchan->v.v2.outbuffer));
5471d09a 9581 }
9582
9583 return 0;
374330e2 9584}
9585
9586/*
6e48c3fe 9587 * Called to set the size of the window from SSH's POV.
374330e2 9588 */
51470298 9589static void ssh_size(void *handle, int width, int height)
32874aea 9590{
51470298 9591 Ssh ssh = (Ssh) handle;
ff3187f6 9592 struct Packet *pktout;
51470298 9593
9594 ssh->term_width = width;
9595 ssh->term_height = height;
f278d6f8 9596
51470298 9597 switch (ssh->state) {
374330e2 9598 case SSH_STATE_BEFORE_SIZE:
3687d221 9599 case SSH_STATE_PREPACKET:
21248260 9600 case SSH_STATE_CLOSED:
374330e2 9601 break; /* do nothing */
9602 case SSH_STATE_INTERMED:
51470298 9603 ssh->size_needed = TRUE; /* buffer for later */
374330e2 9604 break;
9605 case SSH_STATE_SESSION:
86916870 9606 if (!ssh->cfg.nopty) {
51470298 9607 if (ssh->version == 1) {
9608 send_packet(ssh, SSH1_CMSG_WINDOW_SIZE,
9609 PKT_INT, ssh->term_height,
9610 PKT_INT, ssh->term_width,
32874aea 9611 PKT_INT, 0, PKT_INT, 0, PKT_END);
0ed48730 9612 } else if (ssh->mainchan) {
ff3187f6 9613 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9614 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9615 ssh2_pkt_addstring(pktout, "window-change");
9616 ssh2_pkt_addbool(pktout, 0);
9617 ssh2_pkt_adduint32(pktout, ssh->term_width);
9618 ssh2_pkt_adduint32(pktout, ssh->term_height);
9619 ssh2_pkt_adduint32(pktout, 0);
9620 ssh2_pkt_adduint32(pktout, 0);
9621 ssh2_pkt_send(ssh, pktout);
32874aea 9622 }
9623 }
9624 break;
374330e2 9625 }
9626}
9627
9628/*
125105d1 9629 * Return a list of the special codes that make sense in this
9630 * protocol.
9631 */
9632static const struct telnet_special *ssh_get_specials(void *handle)
9633{
786ba75e 9634 static const struct telnet_special ssh1_ignore_special[] = {
9635 {"IGNORE message", TS_NOP}
9636 };
cf6ddb95 9637 static const struct telnet_special ssh2_ignore_special[] = {
62638676 9638 {"IGNORE message", TS_NOP},
cf6ddb95 9639 };
9640 static const struct telnet_special ssh2_rekey_special[] = {
9442dd57 9641 {"Repeat key exchange", TS_REKEY},
62638676 9642 };
9643 static const struct telnet_special ssh2_session_specials[] = {
6f2d0cde 9644 {NULL, TS_SEP},
9645 {"Break", TS_BRK},
bccbeb71 9646 /* These are the signal names defined by RFC 4254.
6f2d0cde 9647 * They include all the ISO C signals, but are a subset of the POSIX
9648 * required signals. */
9649 {"SIGINT (Interrupt)", TS_SIGINT},
9650 {"SIGTERM (Terminate)", TS_SIGTERM},
9651 {"SIGKILL (Kill)", TS_SIGKILL},
9652 {"SIGQUIT (Quit)", TS_SIGQUIT},
9653 {"SIGHUP (Hangup)", TS_SIGHUP},
9654 {"More signals", TS_SUBMENU},
9655 {"SIGABRT", TS_SIGABRT}, {"SIGALRM", TS_SIGALRM},
9656 {"SIGFPE", TS_SIGFPE}, {"SIGILL", TS_SIGILL},
9657 {"SIGPIPE", TS_SIGPIPE}, {"SIGSEGV", TS_SIGSEGV},
9658 {"SIGUSR1", TS_SIGUSR1}, {"SIGUSR2", TS_SIGUSR2},
9659 {NULL, TS_EXITMENU}
62638676 9660 };
9661 static const struct telnet_special specials_end[] = {
6f2d0cde 9662 {NULL, TS_EXITMENU}
62638676 9663 };
786ba75e 9664 /* XXX review this length for any changes: */
cf6ddb95 9665 static struct telnet_special ssh_specials[lenof(ssh2_ignore_special) +
9666 lenof(ssh2_rekey_special) +
62638676 9667 lenof(ssh2_session_specials) +
9668 lenof(specials_end)];
125105d1 9669 Ssh ssh = (Ssh) handle;
62638676 9670 int i = 0;
9671#define ADD_SPECIALS(name) \
9672 do { \
9673 assert((i + lenof(name)) <= lenof(ssh_specials)); \
9674 memcpy(&ssh_specials[i], name, sizeof name); \
9675 i += lenof(name); \
9676 } while(0)
125105d1 9677
9678 if (ssh->version == 1) {
62638676 9679 /* Don't bother offering IGNORE if we've decided the remote
9680 * won't cope with it, since we wouldn't bother sending it if
9681 * asked anyway. */
9682 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
786ba75e 9683 ADD_SPECIALS(ssh1_ignore_special);
125105d1 9684 } else if (ssh->version == 2) {
cf6ddb95 9685 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE))
9686 ADD_SPECIALS(ssh2_ignore_special);
9687 if (!(ssh->remote_bugs & BUG_SSH2_REKEY))
9688 ADD_SPECIALS(ssh2_rekey_special);
62638676 9689 if (ssh->mainchan)
9690 ADD_SPECIALS(ssh2_session_specials);
9691 } /* else we're not ready yet */
9692
9693 if (i) {
9694 ADD_SPECIALS(specials_end);
9695 return ssh_specials;
9696 } else {
125105d1 9697 return NULL;
62638676 9698 }
9699#undef ADD_SPECIALS
125105d1 9700}
9701
9702/*
86dc445a 9703 * Send special codes. TS_EOF is useful for `plink', so you
6abbf9e3 9704 * can send an EOF and collect resulting output (e.g. `plink
9705 * hostname sort').
374330e2 9706 */
51470298 9707static void ssh_special(void *handle, Telnet_Special code)
32874aea 9708{
51470298 9709 Ssh ssh = (Ssh) handle;
ff3187f6 9710 struct Packet *pktout;
51470298 9711
6abbf9e3 9712 if (code == TS_EOF) {
51470298 9713 if (ssh->state != SSH_STATE_SESSION) {
32874aea 9714 /*
9715 * Buffer the EOF in case we are pre-SESSION, so we can
9716 * send it as soon as we reach SESSION.
9717 */
9718 if (code == TS_EOF)
51470298 9719 ssh->eof_needed = TRUE;
32874aea 9720 return;
9721 }
51470298 9722 if (ssh->version == 1) {
9723 send_packet(ssh, SSH1_CMSG_EOF, PKT_END);
0ed48730 9724 } else if (ssh->mainchan) {
ff3187f6 9725 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_EOF);
9726 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9727 ssh2_pkt_send(ssh, pktout);
00a0b113 9728 ssh->send_ok = 0; /* now stop trying to read from stdin */
32874aea 9729 }
9730 logevent("Sent EOF message");
125105d1 9731 } else if (code == TS_PING || code == TS_NOP) {
51470298 9732 if (ssh->state == SSH_STATE_CLOSED
9733 || ssh->state == SSH_STATE_PREPACKET) return;
9734 if (ssh->version == 1) {
9735 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
9736 send_packet(ssh, SSH1_MSG_IGNORE, PKT_STR, "", PKT_END);
32874aea 9737 } else {
cf6ddb95 9738 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE)) {
9739 pktout = ssh2_pkt_init(SSH2_MSG_IGNORE);
9740 ssh2_pkt_addstring_start(pktout);
9741 ssh2_pkt_send_noqueue(ssh, pktout);
9742 }
32874aea 9743 }
9442dd57 9744 } else if (code == TS_REKEY) {
9745 if (!ssh->kex_in_progress && ssh->version == 2) {
f382c87d 9746 do_ssh2_transport(ssh, "at user request", -1, NULL);
9442dd57 9747 }
125105d1 9748 } else if (code == TS_BRK) {
9749 if (ssh->state == SSH_STATE_CLOSED
9750 || ssh->state == SSH_STATE_PREPACKET) return;
9751 if (ssh->version == 1) {
2e85c969 9752 logevent("Unable to send BREAK signal in SSH-1");
0ed48730 9753 } else if (ssh->mainchan) {
ff3187f6 9754 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9755 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9756 ssh2_pkt_addstring(pktout, "break");
9757 ssh2_pkt_addbool(pktout, 0);
9758 ssh2_pkt_adduint32(pktout, 0); /* default break length */
9759 ssh2_pkt_send(ssh, pktout);
125105d1 9760 }
6abbf9e3 9761 } else {
6f2d0cde 9762 /* Is is a POSIX signal? */
9763 char *signame = NULL;
9764 if (code == TS_SIGABRT) signame = "ABRT";
9765 if (code == TS_SIGALRM) signame = "ALRM";
9766 if (code == TS_SIGFPE) signame = "FPE";
9767 if (code == TS_SIGHUP) signame = "HUP";
9768 if (code == TS_SIGILL) signame = "ILL";
9769 if (code == TS_SIGINT) signame = "INT";
9770 if (code == TS_SIGKILL) signame = "KILL";
9771 if (code == TS_SIGPIPE) signame = "PIPE";
9772 if (code == TS_SIGQUIT) signame = "QUIT";
9773 if (code == TS_SIGSEGV) signame = "SEGV";
9774 if (code == TS_SIGTERM) signame = "TERM";
9775 if (code == TS_SIGUSR1) signame = "USR1";
9776 if (code == TS_SIGUSR2) signame = "USR2";
9777 /* The SSH-2 protocol does in principle support arbitrary named
9778 * signals, including signame@domain, but we don't support those. */
9779 if (signame) {
9780 /* It's a signal. */
9781 if (ssh->version == 2 && ssh->mainchan) {
ff3187f6 9782 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9783 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9784 ssh2_pkt_addstring(pktout, "signal");
9785 ssh2_pkt_addbool(pktout, 0);
9786 ssh2_pkt_addstring(pktout, signame);
9787 ssh2_pkt_send(ssh, pktout);
6f2d0cde 9788 logeventf(ssh, "Sent signal SIG%s", signame);
9789 }
9790 } else {
9791 /* Never heard of it. Do nothing */
9792 }
6abbf9e3 9793 }
374330e2 9794}
9795
51470298 9796void *new_sock_channel(void *handle, Socket s)
d74d141c 9797{
51470298 9798 Ssh ssh = (Ssh) handle;
d74d141c 9799 struct ssh_channel *c;
3d88e64d 9800 c = snew(struct ssh_channel);
d74d141c 9801
70c0cbe1 9802 c->ssh = ssh;
9803 ssh2_channel_init(c);
9804 c->halfopen = TRUE;
9805 c->type = CHAN_SOCKDATA_DORMANT;/* identify channel type */
9806 c->u.pfd.s = s;
9807 add234(ssh->channels, c);
d74d141c 9808 return c;
9809}
9810
5471d09a 9811/*
9812 * This is called when stdout/stderr (the entity to which
9813 * from_backend sends data) manages to clear some backlog.
9814 */
ae9ae89f 9815static void ssh_unthrottle(void *handle, int bufsize)
5471d09a 9816{
51470298 9817 Ssh ssh = (Ssh) handle;
ff68564b 9818 int buflimit;
9819
51470298 9820 if (ssh->version == 1) {
9821 if (ssh->v1_stdout_throttling && bufsize < SSH1_BUFFER_LIMIT) {
9822 ssh->v1_stdout_throttling = 0;
ff68564b 9823 ssh_throttle_conn(ssh, -1);
5471d09a 9824 }
9825 } else {
ff68564b 9826 if (ssh->mainchan) {
ab87bf1d 9827 ssh2_set_window(ssh->mainchan,
ff68564b 9828 bufsize < ssh->mainchan->v.v2.locmaxwin ?
9829 ssh->mainchan->v.v2.locmaxwin - bufsize : 0);
9830 if (ssh->cfg.ssh_simple)
9831 buflimit = 0;
9832 else
9833 buflimit = ssh->mainchan->v.v2.locmaxwin;
9834 if (ssh->mainchan->throttling_conn && bufsize <= buflimit) {
9835 ssh->mainchan->throttling_conn = 0;
9836 ssh_throttle_conn(ssh, -1);
9837 }
9838 }
5471d09a 9839 }
9840}
9841
6b78788a 9842void ssh_send_port_open(void *channel, char *hostname, int port, char *org)
d74d141c 9843{
9844 struct ssh_channel *c = (struct ssh_channel *)channel;
6b78788a 9845 Ssh ssh = c->ssh;
ff3187f6 9846 struct Packet *pktout;
d74d141c 9847
57356d63 9848 logeventf(ssh, "Opening forwarded connection to %s:%d", hostname, port);
d74d141c 9849
51470298 9850 if (ssh->version == 1) {
9851 send_packet(ssh, SSH1_MSG_PORT_OPEN,
bc240b21 9852 PKT_INT, c->localid,
9853 PKT_STR, hostname,
9854 PKT_INT, port,
31fb1866 9855 /* PKT_STR, <org:orgport>, */
bc240b21 9856 PKT_END);
9857 } else {
ff3187f6 9858 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
9859 ssh2_pkt_addstring(pktout, "direct-tcpip");
9860 ssh2_pkt_adduint32(pktout, c->localid);
ff3187f6 9861 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);/* our window size */
954d5c5a 9862 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
ff3187f6 9863 ssh2_pkt_addstring(pktout, hostname);
9864 ssh2_pkt_adduint32(pktout, port);
bc240b21 9865 /*
9866 * We make up values for the originator data; partly it's
9867 * too much hassle to keep track, and partly I'm not
9868 * convinced the server should be told details like that
9869 * about my local network configuration.
1f182589 9870 * The "originator IP address" is syntactically a numeric
9871 * IP address, and some servers (e.g., Tectia) get upset
9872 * if it doesn't match this syntax.
bc240b21 9873 */
1f182589 9874 ssh2_pkt_addstring(pktout, "0.0.0.0");
ff3187f6 9875 ssh2_pkt_adduint32(pktout, 0);
9876 ssh2_pkt_send(ssh, pktout);
bc240b21 9877 }
d74d141c 9878}
9879
6226c939 9880static int ssh_connected(void *handle)
32874aea 9881{
51470298 9882 Ssh ssh = (Ssh) handle;
6226c939 9883 return ssh->s != NULL;
32874aea 9884}
8ccc75b0 9885
51470298 9886static int ssh_sendok(void *handle)
32874aea 9887{
51470298 9888 Ssh ssh = (Ssh) handle;
9889 return ssh->send_ok;
32874aea 9890}
fb09bf1c 9891
51470298 9892static int ssh_ldisc(void *handle, int option)
32874aea 9893{
51470298 9894 Ssh ssh = (Ssh) handle;
32874aea 9895 if (option == LD_ECHO)
51470298 9896 return ssh->echoing;
32874aea 9897 if (option == LD_EDIT)
51470298 9898 return ssh->editing;
0965bee0 9899 return FALSE;
9900}
9901
b9d7bcad 9902static void ssh_provide_ldisc(void *handle, void *ldisc)
9903{
9904 Ssh ssh = (Ssh) handle;
9905 ssh->ldisc = ldisc;
9906}
9907
a8327734 9908static void ssh_provide_logctx(void *handle, void *logctx)
9909{
9910 Ssh ssh = (Ssh) handle;
9911 ssh->logctx = logctx;
9912}
9913
51470298 9914static int ssh_return_exitcode(void *handle)
9915{
9916 Ssh ssh = (Ssh) handle;
3bb2f322 9917 if (ssh->s != NULL)
9918 return -1;
9919 else
3c112d53 9920 return (ssh->exitcode >= 0 ? ssh->exitcode : INT_MAX);
51470298 9921}
9922
9923/*
f89c3294 9924 * cfg_info for SSH is the currently running version of the
9925 * protocol. (1 for 1; 2 for 2; 0 for not-decided-yet.)
9926 */
9927static int ssh_cfg_info(void *handle)
9928{
9929 Ssh ssh = (Ssh) handle;
9930 return ssh->version;
9931}
9932
9933/*
51470298 9934 * Gross hack: pscp will try to start SFTP but fall back to scp1 if
9935 * that fails. This variable is the means by which scp.c can reach
9936 * into the SSH code and find out which one it got.
9937 */
9938extern int ssh_fallback_cmd(void *handle)
d8d6c7e5 9939{
51470298 9940 Ssh ssh = (Ssh) handle;
9941 return ssh->fallback_cmd;
d8d6c7e5 9942}
9943
374330e2 9944Backend ssh_backend = {
9945 ssh_init,
fabd1805 9946 ssh_free,
86916870 9947 ssh_reconfig,
374330e2 9948 ssh_send,
5471d09a 9949 ssh_sendbuffer,
374330e2 9950 ssh_size,
4017be6d 9951 ssh_special,
125105d1 9952 ssh_get_specials,
6226c939 9953 ssh_connected,
d8d6c7e5 9954 ssh_return_exitcode,
97db3be4 9955 ssh_sendok,
0965bee0 9956 ssh_ldisc,
b9d7bcad 9957 ssh_provide_ldisc,
a8327734 9958 ssh_provide_logctx,
5471d09a 9959 ssh_unthrottle,
f89c3294 9960 ssh_cfg_info,
9e164d82 9961 "ssh",
9962 PROT_SSH,
97db3be4 9963 22
bc240b21 9964};
Local modifications for Simon Tatham's `PuTTY' SSH client and terminal emulator