projects / u / mdw / putty / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Move the various big tables to the start of the file to save mucking about
[u/mdw/putty] / ssh.c
CommitLineData
374330e2 1#include <stdio.h>
2#include <stdlib.h>
fb09bf1c 3#include <stdarg.h>
4#include <assert.h>
374330e2 5
6#include "putty.h"
dacbd0e8 7#include "tree234.h"
fb09bf1c 8#include "ssh.h"
374330e2 9
10#ifndef FALSE
11#define FALSE 0
12#endif
13#ifndef TRUE
14#define TRUE 1
15#endif
16
32874aea 17#define SSH1_MSG_DISCONNECT 1 /* 0x1 */
18#define SSH1_SMSG_PUBLIC_KEY 2 /* 0x2 */
19#define SSH1_CMSG_SESSION_KEY 3 /* 0x3 */
20#define SSH1_CMSG_USER 4 /* 0x4 */
21#define SSH1_CMSG_AUTH_RSA 6 /* 0x6 */
22#define SSH1_SMSG_AUTH_RSA_CHALLENGE 7 /* 0x7 */
23#define SSH1_CMSG_AUTH_RSA_RESPONSE 8 /* 0x8 */
24#define SSH1_CMSG_AUTH_PASSWORD 9 /* 0x9 */
25#define SSH1_CMSG_REQUEST_PTY 10 /* 0xa */
26#define SSH1_CMSG_WINDOW_SIZE 11 /* 0xb */
27#define SSH1_CMSG_EXEC_SHELL 12 /* 0xc */
28#define SSH1_CMSG_EXEC_CMD 13 /* 0xd */
29#define SSH1_SMSG_SUCCESS 14 /* 0xe */
30#define SSH1_SMSG_FAILURE 15 /* 0xf */
31#define SSH1_CMSG_STDIN_DATA 16 /* 0x10 */
32#define SSH1_SMSG_STDOUT_DATA 17 /* 0x11 */
33#define SSH1_SMSG_STDERR_DATA 18 /* 0x12 */
34#define SSH1_CMSG_EOF 19 /* 0x13 */
35#define SSH1_SMSG_EXIT_STATUS 20 /* 0x14 */
36#define SSH1_MSG_CHANNEL_OPEN_CONFIRMATION 21 /* 0x15 */
37#define SSH1_MSG_CHANNEL_OPEN_FAILURE 22 /* 0x16 */
38#define SSH1_MSG_CHANNEL_DATA 23 /* 0x17 */
39#define SSH1_MSG_CHANNEL_CLOSE 24 /* 0x18 */
40#define SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION 25 /* 0x19 */
41#define SSH1_SMSG_X11_OPEN 27 /* 0x1b */
42#define SSH1_CMSG_PORT_FORWARD_REQUEST 28 /* 0x1c */
43#define SSH1_MSG_PORT_OPEN 29 /* 0x1d */
44#define SSH1_CMSG_AGENT_REQUEST_FORWARDING 30 /* 0x1e */
45#define SSH1_SMSG_AGENT_OPEN 31 /* 0x1f */
46#define SSH1_MSG_IGNORE 32 /* 0x20 */
47#define SSH1_CMSG_EXIT_CONFIRMATION 33 /* 0x21 */
48#define SSH1_CMSG_X11_REQUEST_FORWARDING 34 /* 0x22 */
49#define SSH1_CMSG_AUTH_RHOSTS_RSA 35 /* 0x23 */
50#define SSH1_MSG_DEBUG 36 /* 0x24 */
51#define SSH1_CMSG_REQUEST_COMPRESSION 37 /* 0x25 */
52#define SSH1_CMSG_AUTH_TIS 39 /* 0x27 */
53#define SSH1_SMSG_AUTH_TIS_CHALLENGE 40 /* 0x28 */
54#define SSH1_CMSG_AUTH_TIS_RESPONSE 41 /* 0x29 */
55#define SSH1_CMSG_AUTH_CCARD 70 /* 0x46 */
56#define SSH1_SMSG_AUTH_CCARD_CHALLENGE 71 /* 0x47 */
57#define SSH1_CMSG_AUTH_CCARD_RESPONSE 72 /* 0x48 */
58
59#define SSH1_AUTH_TIS 5 /* 0x5 */
60#define SSH1_AUTH_CCARD 16 /* 0x10 */
61
62#define SSH1_PROTOFLAG_SCREEN_NUMBER 1 /* 0x1 */
b96dc54c 63/* Mask for protoflags we will echo back to server if seen */
32874aea 64#define SSH1_PROTOFLAGS_SUPPORTED 0 /* 0x1 */
65
66#define SSH2_MSG_DISCONNECT 1 /* 0x1 */
67#define SSH2_MSG_IGNORE 2 /* 0x2 */
68#define SSH2_MSG_UNIMPLEMENTED 3 /* 0x3 */
69#define SSH2_MSG_DEBUG 4 /* 0x4 */
70#define SSH2_MSG_SERVICE_REQUEST 5 /* 0x5 */
71#define SSH2_MSG_SERVICE_ACCEPT 6 /* 0x6 */
72#define SSH2_MSG_KEXINIT 20 /* 0x14 */
73#define SSH2_MSG_NEWKEYS 21 /* 0x15 */
74#define SSH2_MSG_KEXDH_INIT 30 /* 0x1e */
75#define SSH2_MSG_KEXDH_REPLY 31 /* 0x1f */
76#define SSH2_MSG_KEX_DH_GEX_REQUEST 30 /* 0x1e */
77#define SSH2_MSG_KEX_DH_GEX_GROUP 31 /* 0x1f */
78#define SSH2_MSG_KEX_DH_GEX_INIT 32 /* 0x20 */
79#define SSH2_MSG_KEX_DH_GEX_REPLY 33 /* 0x21 */
80#define SSH2_MSG_USERAUTH_REQUEST 50 /* 0x32 */
81#define SSH2_MSG_USERAUTH_FAILURE 51 /* 0x33 */
82#define SSH2_MSG_USERAUTH_SUCCESS 52 /* 0x34 */
83#define SSH2_MSG_USERAUTH_BANNER 53 /* 0x35 */
84#define SSH2_MSG_USERAUTH_PK_OK 60 /* 0x3c */
85#define SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ 60 /* 0x3c */
761187b6 86#define SSH2_MSG_USERAUTH_INFO_REQUEST 60 /* 0x3c */
87#define SSH2_MSG_USERAUTH_INFO_RESPONSE 61 /* 0x3d */
32874aea 88#define SSH2_MSG_GLOBAL_REQUEST 80 /* 0x50 */
89#define SSH2_MSG_REQUEST_SUCCESS 81 /* 0x51 */
90#define SSH2_MSG_REQUEST_FAILURE 82 /* 0x52 */
91#define SSH2_MSG_CHANNEL_OPEN 90 /* 0x5a */
92#define SSH2_MSG_CHANNEL_OPEN_CONFIRMATION 91 /* 0x5b */
93#define SSH2_MSG_CHANNEL_OPEN_FAILURE 92 /* 0x5c */
94#define SSH2_MSG_CHANNEL_WINDOW_ADJUST 93 /* 0x5d */
95#define SSH2_MSG_CHANNEL_DATA 94 /* 0x5e */
96#define SSH2_MSG_CHANNEL_EXTENDED_DATA 95 /* 0x5f */
97#define SSH2_MSG_CHANNEL_EOF 96 /* 0x60 */
98#define SSH2_MSG_CHANNEL_CLOSE 97 /* 0x61 */
99#define SSH2_MSG_CHANNEL_REQUEST 98 /* 0x62 */
100#define SSH2_MSG_CHANNEL_SUCCESS 99 /* 0x63 */
101#define SSH2_MSG_CHANNEL_FAILURE 100 /* 0x64 */
102
00db133f 103/*
104 * Packet type contexts, so that ssh2_pkt_type can correctly decode
105 * the ambiguous type numbers back into the correct type strings.
106 */
107#define SSH2_PKTCTX_DHGROUP1 0x0001
108#define SSH2_PKTCTX_DHGEX 0x0002
109#define SSH2_PKTCTX_PUBLICKEY 0x0010
110#define SSH2_PKTCTX_PASSWORD 0x0020
111#define SSH2_PKTCTX_KBDINTER 0x0040
112#define SSH2_PKTCTX_AUTH_MASK 0x00F0
113
32874aea 114#define SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1 /* 0x1 */
115#define SSH2_DISCONNECT_PROTOCOL_ERROR 2 /* 0x2 */
116#define SSH2_DISCONNECT_KEY_EXCHANGE_FAILED 3 /* 0x3 */
117#define SSH2_DISCONNECT_HOST_AUTHENTICATION_FAILED 4 /* 0x4 */
118#define SSH2_DISCONNECT_MAC_ERROR 5 /* 0x5 */
119#define SSH2_DISCONNECT_COMPRESSION_ERROR 6 /* 0x6 */
120#define SSH2_DISCONNECT_SERVICE_NOT_AVAILABLE 7 /* 0x7 */
121#define SSH2_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED 8 /* 0x8 */
122#define SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9 /* 0x9 */
123#define SSH2_DISCONNECT_CONNECTION_LOST 10 /* 0xa */
124#define SSH2_DISCONNECT_BY_APPLICATION 11 /* 0xb */
125#define SSH2_DISCONNECT_TOO_MANY_CONNECTIONS 12 /* 0xc */
126#define SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER 13 /* 0xd */
127#define SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14 /* 0xe */
128#define SSH2_DISCONNECT_ILLEGAL_USER_NAME 15 /* 0xf */
38c4a8da 129
130static const char *const ssh2_disconnect_reasons[] = {
131 NULL,
132 "SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT",
133 "SSH_DISCONNECT_PROTOCOL_ERROR",
134 "SSH_DISCONNECT_KEY_EXCHANGE_FAILED",
135 "SSH_DISCONNECT_HOST_AUTHENTICATION_FAILED",
136 "SSH_DISCONNECT_MAC_ERROR",
137 "SSH_DISCONNECT_COMPRESSION_ERROR",
138 "SSH_DISCONNECT_SERVICE_NOT_AVAILABLE",
139 "SSH_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED",
140 "SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE",
141 "SSH_DISCONNECT_CONNECTION_LOST",
142 "SSH_DISCONNECT_BY_APPLICATION",
143 "SSH_DISCONNECT_TOO_MANY_CONNECTIONS",
144 "SSH_DISCONNECT_AUTH_CANCELLED_BY_USER",
145 "SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE",
146 "SSH_DISCONNECT_ILLEGAL_USER_NAME",
147};
9005f3ba 148
32874aea 149#define SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED 1 /* 0x1 */
150#define SSH2_OPEN_CONNECT_FAILED 2 /* 0x2 */
151#define SSH2_OPEN_UNKNOWN_CHANNEL_TYPE 3 /* 0x3 */
152#define SSH2_OPEN_RESOURCE_SHORTAGE 4 /* 0x4 */
d211621f 153
32874aea 154#define SSH2_EXTENDED_DATA_STDERR 1 /* 0x1 */
fb09bf1c 155
7d503c31 156/*
157 * Various remote-bug flags.
158 */
159#define BUG_CHOKES_ON_SSH1_IGNORE 1
160#define BUG_SSH2_HMAC 2
bd358db1 161#define BUG_NEEDS_SSH1_PLAIN_PASSWORD 4
0df73905 162#define BUG_CHOKES_ON_RSA 8
1dd353b5 163#define BUG_SSH2_RSA_PADDING 16
088bde77 164#define BUG_SSH2_DERIVEKEY 32
8e975795 165#define BUG_SSH2_DH_GEX 64
bd358db1 166
00db133f 167#define translate(x) if (type == x) return #x
51470298 168#define translatec(x,ctx) if (type == x && (pkt_ctx & ctx)) return #x
ae9ae89f 169static char *ssh1_pkt_type(int type)
00db133f 170{
171 translate(SSH1_MSG_DISCONNECT);
172 translate(SSH1_SMSG_PUBLIC_KEY);
173 translate(SSH1_CMSG_SESSION_KEY);
174 translate(SSH1_CMSG_USER);
175 translate(SSH1_CMSG_AUTH_RSA);
176 translate(SSH1_SMSG_AUTH_RSA_CHALLENGE);
177 translate(SSH1_CMSG_AUTH_RSA_RESPONSE);
178 translate(SSH1_CMSG_AUTH_PASSWORD);
179 translate(SSH1_CMSG_REQUEST_PTY);
180 translate(SSH1_CMSG_WINDOW_SIZE);
181 translate(SSH1_CMSG_EXEC_SHELL);
182 translate(SSH1_CMSG_EXEC_CMD);
183 translate(SSH1_SMSG_SUCCESS);
184 translate(SSH1_SMSG_FAILURE);
185 translate(SSH1_CMSG_STDIN_DATA);
186 translate(SSH1_SMSG_STDOUT_DATA);
187 translate(SSH1_SMSG_STDERR_DATA);
188 translate(SSH1_CMSG_EOF);
189 translate(SSH1_SMSG_EXIT_STATUS);
190 translate(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
191 translate(SSH1_MSG_CHANNEL_OPEN_FAILURE);
192 translate(SSH1_MSG_CHANNEL_DATA);
193 translate(SSH1_MSG_CHANNEL_CLOSE);
194 translate(SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION);
195 translate(SSH1_SMSG_X11_OPEN);
196 translate(SSH1_CMSG_PORT_FORWARD_REQUEST);
197 translate(SSH1_MSG_PORT_OPEN);
198 translate(SSH1_CMSG_AGENT_REQUEST_FORWARDING);
199 translate(SSH1_SMSG_AGENT_OPEN);
200 translate(SSH1_MSG_IGNORE);
201 translate(SSH1_CMSG_EXIT_CONFIRMATION);
202 translate(SSH1_CMSG_X11_REQUEST_FORWARDING);
203 translate(SSH1_CMSG_AUTH_RHOSTS_RSA);
204 translate(SSH1_MSG_DEBUG);
205 translate(SSH1_CMSG_REQUEST_COMPRESSION);
206 translate(SSH1_CMSG_AUTH_TIS);
207 translate(SSH1_SMSG_AUTH_TIS_CHALLENGE);
208 translate(SSH1_CMSG_AUTH_TIS_RESPONSE);
209 translate(SSH1_CMSG_AUTH_CCARD);
210 translate(SSH1_SMSG_AUTH_CCARD_CHALLENGE);
211 translate(SSH1_CMSG_AUTH_CCARD_RESPONSE);
212 return "unknown";
213}
ae9ae89f 214static char *ssh2_pkt_type(int pkt_ctx, int type)
00db133f 215{
216 translate(SSH2_MSG_DISCONNECT);
217 translate(SSH2_MSG_IGNORE);
218 translate(SSH2_MSG_UNIMPLEMENTED);
219 translate(SSH2_MSG_DEBUG);
220 translate(SSH2_MSG_SERVICE_REQUEST);
221 translate(SSH2_MSG_SERVICE_ACCEPT);
222 translate(SSH2_MSG_KEXINIT);
223 translate(SSH2_MSG_NEWKEYS);
224 translatec(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP1);
225 translatec(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP1);
226 translatec(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX);
227 translatec(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX);
228 translatec(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX);
229 translatec(SSH2_MSG_KEX_DH_GEX_REPLY, SSH2_PKTCTX_DHGEX);
230 translate(SSH2_MSG_USERAUTH_REQUEST);
231 translate(SSH2_MSG_USERAUTH_FAILURE);
232 translate(SSH2_MSG_USERAUTH_SUCCESS);
233 translate(SSH2_MSG_USERAUTH_BANNER);
234 translatec(SSH2_MSG_USERAUTH_PK_OK, SSH2_PKTCTX_PUBLICKEY);
235 translatec(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, SSH2_PKTCTX_PASSWORD);
236 translatec(SSH2_MSG_USERAUTH_INFO_REQUEST, SSH2_PKTCTX_KBDINTER);
237 translatec(SSH2_MSG_USERAUTH_INFO_RESPONSE, SSH2_PKTCTX_KBDINTER);
238 translate(SSH2_MSG_GLOBAL_REQUEST);
239 translate(SSH2_MSG_REQUEST_SUCCESS);
240 translate(SSH2_MSG_REQUEST_FAILURE);
241 translate(SSH2_MSG_CHANNEL_OPEN);
242 translate(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
243 translate(SSH2_MSG_CHANNEL_OPEN_FAILURE);
244 translate(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
245 translate(SSH2_MSG_CHANNEL_DATA);
246 translate(SSH2_MSG_CHANNEL_EXTENDED_DATA);
247 translate(SSH2_MSG_CHANNEL_EOF);
248 translate(SSH2_MSG_CHANNEL_CLOSE);
249 translate(SSH2_MSG_CHANNEL_REQUEST);
250 translate(SSH2_MSG_CHANNEL_SUCCESS);
251 translate(SSH2_MSG_CHANNEL_FAILURE);
252 return "unknown";
253}
254#undef translate
255#undef translatec
7d503c31 256
fb09bf1c 257#define GET_32BIT(cp) \
258 (((unsigned long)(unsigned char)(cp)[0] << 24) | \
259 ((unsigned long)(unsigned char)(cp)[1] << 16) | \
260 ((unsigned long)(unsigned char)(cp)[2] << 8) | \
261 ((unsigned long)(unsigned char)(cp)[3]))
262
263#define PUT_32BIT(cp, value) { \
264 (cp)[0] = (unsigned char)((value) >> 24); \
265 (cp)[1] = (unsigned char)((value) >> 16); \
266 (cp)[2] = (unsigned char)((value) >> 8); \
267 (cp)[3] = (unsigned char)(value); }
268
7cca0d81 269enum { PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM };
972a41c8 270
374330e2 271/* Coroutine mechanics for the sillier bits of the code */
51470298 272#define crBegin(v) { int *crLine = &v; switch(v) { case 0:;
273#define crState(t) \
274 struct t *s; \
275 if (!ssh->t) ssh->t = smalloc(sizeof(struct t)); \
276 s = ssh->t;
277#define crFinish(z) } *crLine = 0; return (z); }
278#define crFinishV } *crLine = 0; return; }
374330e2 279#define crReturn(z) \
280 do {\
51470298 281 *crLine =__LINE__; return (z); case __LINE__:;\
374330e2 282 } while (0)
283#define crReturnV \
284 do {\
51470298 285 *crLine=__LINE__; return; case __LINE__:;\
374330e2 286 } while (0)
51470298 287#define crStop(z) do{ *crLine = 0; return (z); }while(0)
288#define crStopV do{ *crLine = 0; return; }while(0)
fb09bf1c 289#define crWaitUntil(c) do { crReturn(0); } while (!(c))
7cca0d81 290#define crWaitUntilV(c) do { crReturnV; } while (!(c))
374330e2 291
51470298 292typedef struct ssh_tag *Ssh;
293
51470298 294static void ssh2_pkt_init(Ssh, int pkt_type);
295static void ssh2_pkt_addbool(Ssh, unsigned char value);
296static void ssh2_pkt_adduint32(Ssh, unsigned long value);
297static void ssh2_pkt_addstring_start(Ssh);
298static void ssh2_pkt_addstring_str(Ssh, char *data);
299static void ssh2_pkt_addstring_data(Ssh, char *data, int len);
300static void ssh2_pkt_addstring(Ssh, char *data);
d8baa528 301static unsigned char *ssh2_mpint_fmt(Bignum b, int *len);
51470298 302static void ssh2_pkt_addmp(Ssh, Bignum b);
303static int ssh2_pkt_construct(Ssh);
304static void ssh2_pkt_send(Ssh);
3d63ca2e 305
5471d09a 306/*
307 * Buffer management constants. There are several of these for
308 * various different purposes:
309 *
310 * - SSH1_BUFFER_LIMIT is the amount of backlog that must build up
311 * on a local data stream before we throttle the whole SSH
312 * connection (in SSH1 only). Throttling the whole connection is
313 * pretty drastic so we set this high in the hope it won't
314 * happen very often.
315 *
316 * - SSH_MAX_BACKLOG is the amount of backlog that must build up
317 * on the SSH connection itself before we defensively throttle
318 * _all_ local data streams. This is pretty drastic too (though
319 * thankfully unlikely in SSH2 since the window mechanism should
320 * ensure that the server never has any need to throttle its end
321 * of the connection), so we set this high as well.
322 *
323 * - OUR_V2_WINSIZE is the maximum window size we present on SSH2
324 * channels.
325 */
326
327#define SSH1_BUFFER_LIMIT 32768
328#define SSH_MAX_BACKLOG 32768
329#define OUR_V2_WINSIZE 16384
d74d141c 330
a92dd380 331const static struct ssh_kex *kex_algs[] = {
a92dd380 332 &ssh_diffiehellman_gex,
32874aea 333 &ssh_diffiehellman
334};
e5574168 335
85cc02bb 336const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss };
e5574168 337
e0e1a00d 338static void *nullmac_make_context(void)
339{
340 return NULL;
341}
342static void nullmac_free_context(void *handle)
343{
344}
345static void nullmac_key(void *handle, unsigned char *key)
32874aea 346{
347}
e0e1a00d 348static void nullmac_generate(void *handle, unsigned char *blk, int len,
32874aea 349 unsigned long seq)
350{
351}
e0e1a00d 352static int nullmac_verify(void *handle, unsigned char *blk, int len,
353 unsigned long seq)
32874aea 354{
355 return 1;
356}
57476f6b 357const static struct ssh_mac ssh_mac_none = {
e0e1a00d 358 nullmac_make_context, nullmac_free_context, nullmac_key,
359 nullmac_generate, nullmac_verify, "none", 0
e5574168 360};
8b2715b2 361const static struct ssh_mac *macs[] = {
32874aea 362 &ssh_sha1, &ssh_md5, &ssh_mac_none
363};
8b2715b2 364const static struct ssh_mac *buggymacs[] = {
32874aea 365 &ssh_sha1_buggy, &ssh_md5, &ssh_mac_none
366};
e5574168 367
5366aed8 368static void *ssh_comp_none_init(void)
369{
370 return NULL;
371}
372static void ssh_comp_none_cleanup(void *handle)
32874aea 373{
374}
5366aed8 375static int ssh_comp_none_block(void *handle, unsigned char *block, int len,
32874aea 376 unsigned char **outblock, int *outlen)
377{
378 return 0;
379}
5366aed8 380static int ssh_comp_none_disable(void *handle)
32874aea 381{
4ba9b64b 382 return 0;
383}
57476f6b 384const static struct ssh_compress ssh_comp_none = {
4ba9b64b 385 "none",
5366aed8 386 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
387 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
388 ssh_comp_none_disable, NULL
e5574168 389};
4ba9b64b 390extern const struct ssh_compress ssh_zlib;
391const static struct ssh_compress *compressions[] = {
32874aea 392 &ssh_zlib, &ssh_comp_none
393};
374330e2 394
32874aea 395enum { /* channel types */
783415f8 396 CHAN_MAINSESSION,
397 CHAN_X11,
398 CHAN_AGENT,
bc240b21 399 CHAN_SOCKDATA,
400 CHAN_SOCKDATA_DORMANT /* one the remote hasn't confirmed */
783415f8 401};
402
dacbd0e8 403/*
404 * 2-3-4 tree storing channels.
405 */
406struct ssh_channel {
51470298 407 Ssh ssh; /* pointer back to main context */
d211621f 408 unsigned remoteid, localid;
dacbd0e8 409 int type;
0357890f 410 /*
411 * In SSH1, this value contains four bits:
412 *
413 * 1 We have sent SSH1_MSG_CHANNEL_CLOSE.
414 * 2 We have sent SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
415 * 4 We have received SSH1_MSG_CHANNEL_CLOSE.
416 * 8 We have received SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
417 *
418 * A channel is completely finished with when all four bits are set.
419 */
dacbd0e8 420 int closes;
5471d09a 421 union {
422 struct ssh1_data_channel {
423 int throttling;
424 } v1;
425 struct ssh2_data_channel {
426 bufchain outbuffer;
427 unsigned remwindow, remmaxpkt;
428 unsigned locwindow;
429 } v2;
430 } v;
dacbd0e8 431 union {
32874aea 432 struct ssh_agent_channel {
433 unsigned char *message;
434 unsigned char msglen[4];
435 int lensofar, totallen;
436 } a;
437 struct ssh_x11_channel {
438 Socket s;
439 } x11;
d74d141c 440 struct ssh_pfd_channel {
441 Socket s;
442 } pfd;
dacbd0e8 443 } u;
444};
57476f6b 445
d74d141c 446/*
bc240b21 447 * 2-3-4 tree storing remote->local port forwardings. SSH 1 and SSH
448 * 2 use this structure in different ways, reflecting SSH 2's
449 * altogether saner approach to port forwarding.
450 *
451 * In SSH 1, you arrange a remote forwarding by sending the server
452 * the remote port number, and the local destination host:port.
453 * When a connection comes in, the server sends you back that
454 * host:port pair, and you connect to it. This is a ready-made
455 * security hole if you're not on the ball: a malicious server
456 * could send you back _any_ host:port pair, so if you trustingly
457 * connect to the address it gives you then you've just opened the
458 * entire inside of your corporate network just by connecting
459 * through it to a dodgy SSH server. Hence, we must store a list of
460 * host:port pairs we _are_ trying to forward to, and reject a
461 * connection request from the server if it's not in the list.
462 *
463 * In SSH 2, each side of the connection minds its own business and
464 * doesn't send unnecessary information to the other. You arrange a
465 * remote forwarding by sending the server just the remote port
466 * number. When a connection comes in, the server tells you which
467 * of its ports was connected to; and _you_ have to remember what
468 * local host:port pair went with that port number.
469 *
470 * Hence: in SSH 1 this structure stores host:port pairs we intend
471 * to allow connections to, and is indexed by those host:port
472 * pairs. In SSH 2 it stores a mapping from source port to
473 * destination host:port pair, and is indexed by source port.
d74d141c 474 */
475struct ssh_rportfwd {
bc240b21 476 unsigned sport, dport;
477 char dhost[256];
d74d141c 478};
479
57476f6b 480struct Packet {
481 long length;
482 int type;
483 unsigned char *data;
484 unsigned char *body;
485 long savedpos;
486 long maxlen;
487};
488
51470298 489static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt);
490static void ssh2_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt);
491static void ssh_size(void *handle, int width, int height);
492static void ssh_special(void *handle, Telnet_Special);
5471d09a 493static int ssh2_try_send(struct ssh_channel *c);
51470298 494static void ssh2_add_channel_data(struct ssh_channel *c, char *buf, int len);
495static void ssh_throttle_all(Ssh ssh, int enable, int bufsize);
5471d09a 496static void ssh2_set_window(struct ssh_channel *c, unsigned newwin);
51470298 497static int ssh_sendbuffer(void *handle);
57476f6b 498
51470298 499struct rdpkt1_state_tag {
57476f6b 500 long len, pad, biglen, to_read;
501 unsigned long realcrc, gotcrc;
502 unsigned char *p;
503 int i;
504 int chunk;
51470298 505};
57476f6b 506
51470298 507struct rdpkt2_state_tag {
960e736a 508 long len, pad, payload, packetlen, maclen;
509 int i;
510 int cipherblk;
511 unsigned long incoming_sequence;
51470298 512};
513
514struct ssh_tag {
515 const struct plug_function_table *fn;
516 /* the above field _must_ be first in the structure */
517
518 SHA_State exhash, exhashbase;
519
520 Socket s;
521
b9d7bcad 522 void *ldisc;
a8327734 523 void *logctx;
b9d7bcad 524
51470298 525 unsigned char session_key[32];
526 int v1_compressing;
527 int v1_remote_protoflags;
528 int v1_local_protoflags;
529 int agentfwd_enabled;
530 int X11_fwd_enabled;
531 int remote_bugs;
532 const struct ssh_cipher *cipher;
371e569c 533 void *v1_cipher_ctx;
0183b242 534 void *crcda_ctx;
51470298 535 const struct ssh2_cipher *cscipher, *sccipher;
371e569c 536 void *cs_cipher_ctx, *sc_cipher_ctx;
51470298 537 const struct ssh_mac *csmac, *scmac;
e0e1a00d 538 void *cs_mac_ctx, *sc_mac_ctx;
51470298 539 const struct ssh_compress *cscomp, *sccomp;
5366aed8 540 void *cs_comp_ctx, *sc_comp_ctx;
51470298 541 const struct ssh_kex *kex;
542 const struct ssh_signkey *hostkey;
543 unsigned char v2_session_id[20];
27cd7fc2 544 void *kex_ctx;
51470298 545
546 char *savedhost;
547 int savedport;
548 int send_ok;
549 int echoing, editing;
550
551 void *frontend;
552
553 int term_width, term_height;
554
555 tree234 *channels; /* indexed by local id */
556 struct ssh_channel *mainchan; /* primary session channel */
557 int exitcode;
558
559 tree234 *rportfwds;
560
561 enum {
562 SSH_STATE_PREPACKET,
563 SSH_STATE_BEFORE_SIZE,
564 SSH_STATE_INTERMED,
565 SSH_STATE_SESSION,
566 SSH_STATE_CLOSED
567 } state;
568
569 int size_needed, eof_needed;
570
571 struct Packet pktin;
572 struct Packet pktout;
573 unsigned char *deferred_send_data;
574 int deferred_len, deferred_size;
575
576 /*
577 * Gross hack: pscp will try to start SFTP but fall back to
578 * scp1 if that fails. This variable is the means by which
579 * scp.c can reach into the SSH code and find out which one it
580 * got.
581 */
582 int fallback_cmd;
583
584 /*
585 * Used for username and password input.
586 */
587 char *userpass_input_buffer;
588 int userpass_input_buflen;
589 int userpass_input_bufpos;
590 int userpass_input_echo;
591
592 char *portfwd_strptr;
593 int pkt_ctx;
594
302121de 595 void *x11auth;
596
51470298 597 int version;
598 int v1_throttle_count;
599 int overall_bufsize;
600 int throttled_all;
601 int v1_stdout_throttling;
602 int v2_outgoing_sequence;
603
604 int ssh1_rdpkt_crstate;
605 int ssh2_rdpkt_crstate;
606 int do_ssh_init_crstate;
607 int ssh_gotdata_crstate;
608 int ssh1_protocol_crstate;
609 int do_ssh1_login_crstate;
610 int do_ssh2_transport_crstate;
611 int do_ssh2_authconn_crstate;
612
613 void *do_ssh_init_state;
614 void *do_ssh1_login_state;
615 void *do_ssh2_transport_state;
616 void *do_ssh2_authconn_state;
617
618 struct rdpkt1_state_tag rdpkt1_state;
619 struct rdpkt2_state_tag rdpkt2_state;
620
621 void (*protocol) (Ssh ssh, unsigned char *in, int inlen, int ispkt);
622 int (*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen);
623};
960e736a 624
382908ad 625#define logevent(s) logevent(ssh->frontend, s)
a8327734 626
627/* logevent, only printf-formatted. */
ae9ae89f 628static void logeventf(Ssh ssh, char *fmt, ...)
a8327734 629{
630 va_list ap;
57356d63 631 char *buf;
a8327734 632
633 va_start(ap, fmt);
57356d63 634 buf = dupvprintf(fmt, ap);
a8327734 635 va_end(ap);
57356d63 636 logevent(buf);
57356d63 637 sfree(buf);
a8327734 638}
639
640#define bombout(msg) ( ssh->state = SSH_STATE_CLOSED, \
641 (ssh->s ? sk_close(ssh->s), ssh->s = NULL : 0), \
642 logeventf msg, connection_fatal msg )
643
32874aea 644static int ssh_channelcmp(void *av, void *bv)
645{
646 struct ssh_channel *a = (struct ssh_channel *) av;
647 struct ssh_channel *b = (struct ssh_channel *) bv;
648 if (a->localid < b->localid)
649 return -1;
650 if (a->localid > b->localid)
651 return +1;
dacbd0e8 652 return 0;
653}
32874aea 654static int ssh_channelfind(void *av, void *bv)
655{
656 unsigned *a = (unsigned *) av;
657 struct ssh_channel *b = (struct ssh_channel *) bv;
658 if (*a < b->localid)
659 return -1;
660 if (*a > b->localid)
661 return +1;
dacbd0e8 662 return 0;
663}
664
bc240b21 665static int ssh_rportcmp_ssh1(void *av, void *bv)
d74d141c 666{
667 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
668 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
669 int i;
bc240b21 670 if ( (i = strcmp(a->dhost, b->dhost)) != 0)
d74d141c 671 return i < 0 ? -1 : +1;
bc240b21 672 if (a->dport > b->dport)
673 return +1;
674 if (a->dport < b->dport)
675 return -1;
676 return 0;
677}
678
679static int ssh_rportcmp_ssh2(void *av, void *bv)
680{
681 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
682 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
cdcbdf3b 683
bc240b21 684 if (a->sport > b->sport)
d74d141c 685 return +1;
bc240b21 686 if (a->sport < b->sport)
687 return -1;
d74d141c 688 return 0;
689}
690
51470298 691static int alloc_channel_id(Ssh ssh)
32874aea 692{
260f3dec 693 const unsigned CHANNEL_NUMBER_OFFSET = 256;
694 unsigned low, high, mid;
d2371c81 695 int tsize;
696 struct ssh_channel *c;
697
698 /*
699 * First-fit allocation of channel numbers: always pick the
700 * lowest unused one. To do this, binary-search using the
701 * counted B-tree to find the largest channel ID which is in a
702 * contiguous sequence from the beginning. (Precisely
703 * everything in that sequence must have ID equal to its tree
704 * index plus CHANNEL_NUMBER_OFFSET.)
705 */
51470298 706 tsize = count234(ssh->channels);
d2371c81 707
32874aea 708 low = -1;
709 high = tsize;
d2371c81 710 while (high - low > 1) {
711 mid = (high + low) / 2;
51470298 712 c = index234(ssh->channels, mid);
d2371c81 713 if (c->localid == mid + CHANNEL_NUMBER_OFFSET)
714 low = mid; /* this one is fine */
715 else
716 high = mid; /* this one is past it */
717 }
718 /*
719 * Now low points to either -1, or the tree index of the
720 * largest ID in the initial sequence.
721 */
722 {
723 unsigned i = low + 1 + CHANNEL_NUMBER_OFFSET;
51470298 724 assert(NULL == find234(ssh->channels, &i, ssh_channelfind));
d2371c81 725 }
726 return low + 1 + CHANNEL_NUMBER_OFFSET;
727}
728
51470298 729static void c_write(Ssh ssh, char *buf, int len)
32874aea 730{
67779be7 731 if ((flags & FLAG_STDERR)) {
32874aea 732 int i;
733 for (i = 0; i < len; i++)
734 if (buf[i] != '\r')
735 fputc(buf[i], stderr);
fb09bf1c 736 return;
737 }
51470298 738 from_backend(ssh->frontend, 1, buf, len);
3bdaf79d 739}
740
51470298 741static void c_write_untrusted(Ssh ssh, char *buf, int len)
32874aea 742{
a209e957 743 int i;
744 for (i = 0; i < len; i++) {
32874aea 745 if (buf[i] == '\n')
51470298 746 c_write(ssh, "\r\n", 2);
32874aea 747 else if ((buf[i] & 0x60) || (buf[i] == '\r'))
51470298 748 c_write(ssh, buf + i, 1);
a209e957 749 }
750}
751
51470298 752static void c_write_str(Ssh ssh, char *buf)
32874aea 753{
51470298 754 c_write(ssh, buf, strlen(buf));
1408a877 755}
756
fb09bf1c 757/*
758 * Collect incoming data in the incoming packet buffer.
e5574168 759 * Decipher and verify the packet when it is completely read.
760 * Drop SSH1_MSG_DEBUG and SSH1_MSG_IGNORE packets.
fb09bf1c 761 * Update the *data and *datalen variables.
762 * Return the additional nr of bytes needed, or 0 when
763 * a complete packet is available.
764 */
51470298 765static int ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
fb09bf1c 766{
51470298 767 struct rdpkt1_state_tag *st = &ssh->rdpkt1_state;
374330e2 768
51470298 769 crBegin(ssh->ssh1_rdpkt_crstate);
374330e2 770
32874aea 771 next_packet:
37508af4 772
51470298 773 ssh->pktin.type = 0;
774 ssh->pktin.length = 0;
374330e2 775
57476f6b 776 for (st->i = st->len = 0; st->i < 4; st->i++) {
fb09bf1c 777 while ((*datalen) == 0)
32874aea 778 crReturn(4 - st->i);
57476f6b 779 st->len = (st->len << 8) + **data;
fb09bf1c 780 (*data)++, (*datalen)--;
781 }
374330e2 782
57476f6b 783 st->pad = 8 - (st->len % 8);
784 st->biglen = st->len + st->pad;
51470298 785 ssh->pktin.length = st->len - 5;
fb09bf1c 786
51470298 787 if (ssh->pktin.maxlen < st->biglen) {
788 ssh->pktin.maxlen = st->biglen;
789 ssh->pktin.data = srealloc(ssh->pktin.data, st->biglen + APIEXTRA);
fb09bf1c 790 }
374330e2 791
57476f6b 792 st->to_read = st->biglen;
51470298 793 st->p = ssh->pktin.data;
57476f6b 794 while (st->to_read > 0) {
32874aea 795 st->chunk = st->to_read;
fb09bf1c 796 while ((*datalen) == 0)
57476f6b 797 crReturn(st->to_read);
798 if (st->chunk > (*datalen))
799 st->chunk = (*datalen);
800 memcpy(st->p, *data, st->chunk);
801 *data += st->chunk;
802 *datalen -= st->chunk;
803 st->p += st->chunk;
804 st->to_read -= st->chunk;
fb09bf1c 805 }
374330e2 806
0183b242 807 if (ssh->cipher && detect_attack(ssh->crcda_ctx, ssh->pktin.data,
808 st->biglen, NULL)) {
a8327734 809 bombout((ssh,"Network attack (CRC compensation) detected!"));
9a3a93a5 810 crReturn(0);
811 }
812
51470298 813 if (ssh->cipher)
371e569c 814 ssh->cipher->decrypt(ssh->v1_cipher_ctx, ssh->pktin.data, st->biglen);
374330e2 815
51470298 816 st->realcrc = crc32(ssh->pktin.data, st->biglen - 4);
817 st->gotcrc = GET_32BIT(ssh->pktin.data + st->biglen - 4);
57476f6b 818 if (st->gotcrc != st->realcrc) {
a8327734 819 bombout((ssh,"Incorrect CRC received on packet"));
32874aea 820 crReturn(0);
fb09bf1c 821 }
572f871e 822
51470298 823 ssh->pktin.body = ssh->pktin.data + st->pad + 1;
4ba9b64b 824
51470298 825 if (ssh->v1_compressing) {
4ba9b64b 826 unsigned char *decompblk;
827 int decomplen;
5366aed8 828 zlib_decompress_block(ssh->sc_comp_ctx,
829 ssh->pktin.body - 1, ssh->pktin.length + 1,
4ba9b64b 830 &decompblk, &decomplen);
831
51470298 832 if (ssh->pktin.maxlen < st->pad + decomplen) {
833 ssh->pktin.maxlen = st->pad + decomplen;
834 ssh->pktin.data = srealloc(ssh->pktin.data,
835 ssh->pktin.maxlen + APIEXTRA);
836 ssh->pktin.body = ssh->pktin.data + st->pad + 1;
4ba9b64b 837 }
838
51470298 839 memcpy(ssh->pktin.body - 1, decompblk, decomplen);
dcbde236 840 sfree(decompblk);
51470298 841 ssh->pktin.length = decomplen - 1;
4ba9b64b 842 }
843
51470298 844 ssh->pktin.type = ssh->pktin.body[-1];
00db133f 845
a8327734 846 if (ssh->logctx)
847 log_packet(ssh->logctx,
848 PKT_INCOMING, ssh->pktin.type,
849 ssh1_pkt_type(ssh->pktin.type),
850 ssh->pktin.body, ssh->pktin.length);
00db133f 851
51470298 852 if (ssh->pktin.type == SSH1_SMSG_STDOUT_DATA ||
853 ssh->pktin.type == SSH1_SMSG_STDERR_DATA ||
854 ssh->pktin.type == SSH1_MSG_DEBUG ||
855 ssh->pktin.type == SSH1_SMSG_AUTH_TIS_CHALLENGE ||
856 ssh->pktin.type == SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
857 long stringlen = GET_32BIT(ssh->pktin.body);
858 if (stringlen + 4 != ssh->pktin.length) {
a8327734 859 bombout((ssh,"Received data packet with bogus string length"));
32874aea 860 crReturn(0);
861 }
fb09bf1c 862 }
863
51470298 864 if (ssh->pktin.type == SSH1_MSG_DEBUG) {
fb09bf1c 865 /* log debug message */
eb4504cc 866 char buf[512];
51470298 867 int stringlen = GET_32BIT(ssh->pktin.body);
eb4504cc 868 strcpy(buf, "Remote debug message: ");
869 if (stringlen > 480)
870 stringlen = 480;
51470298 871 memcpy(buf + 8, ssh->pktin.body + 4, stringlen);
3d63ca2e 872 buf[8 + stringlen] = '\0';
fb09bf1c 873 logevent(buf);
874 goto next_packet;
51470298 875 } else if (ssh->pktin.type == SSH1_MSG_IGNORE) {
fb09bf1c 876 /* do nothing */
877 goto next_packet;
878 }
879
51470298 880 if (ssh->pktin.type == SSH1_MSG_DISCONNECT) {
38c4a8da 881 /* log reason code in disconnect message */
882 char buf[256];
51470298 883 unsigned msglen = GET_32BIT(ssh->pktin.body);
260f3dec 884 unsigned nowlen;
38c4a8da 885 strcpy(buf, "Remote sent disconnect: ");
886 nowlen = strlen(buf);
32874aea 887 if (msglen > sizeof(buf) - nowlen - 1)
888 msglen = sizeof(buf) - nowlen - 1;
51470298 889 memcpy(buf + nowlen, ssh->pktin.body + 4, msglen);
32874aea 890 buf[nowlen + msglen] = '\0';
247308b5 891 /* logevent(buf); (this is now done within the bombout macro) */
a8327734 892 bombout((ssh,"Server sent disconnect message:\n\"%s\"", buf+nowlen));
e14d0f19 893 crReturn(0);
38c4a8da 894 }
895
fb09bf1c 896 crFinish(0);
897}
898
51470298 899static int ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
e5574168 900{
51470298 901 struct rdpkt2_state_tag *st = &ssh->rdpkt2_state;
e5574168 902
51470298 903 crBegin(ssh->ssh2_rdpkt_crstate);
e5574168 904
32874aea 905 next_packet:
51470298 906 ssh->pktin.type = 0;
907 ssh->pktin.length = 0;
908 if (ssh->sccipher)
909 st->cipherblk = ssh->sccipher->blksize;
e5574168 910 else
32874aea 911 st->cipherblk = 8;
960e736a 912 if (st->cipherblk < 8)
32874aea 913 st->cipherblk = 8;
960e736a 914
51470298 915 if (ssh->pktin.maxlen < st->cipherblk) {
916 ssh->pktin.maxlen = st->cipherblk;
917 ssh->pktin.data = srealloc(ssh->pktin.data, st->cipherblk + APIEXTRA);
e5574168 918 }
919
920 /*
921 * Acquire and decrypt the first block of the packet. This will
922 * contain the length and padding details.
923 */
32874aea 924 for (st->i = st->len = 0; st->i < st->cipherblk; st->i++) {
e5574168 925 while ((*datalen) == 0)
32874aea 926 crReturn(st->cipherblk - st->i);
51470298 927 ssh->pktin.data[st->i] = *(*data)++;
32874aea 928 (*datalen)--;
e5574168 929 }
4252c9cc 930
51470298 931 if (ssh->sccipher)
371e569c 932 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
933 ssh->pktin.data, st->cipherblk);
e5574168 934
935 /*
936 * Now get the length and padding figures.
937 */
51470298 938 st->len = GET_32BIT(ssh->pktin.data);
939 st->pad = ssh->pktin.data[4];
e5574168 940
941 /*
717dc483 942 * _Completely_ silly lengths should be stomped on before they
943 * do us any more damage.
944 */
945 if (st->len < 0 || st->pad < 0 || st->len + st->pad < 0) {
a8327734 946 bombout((ssh,"Incoming packet was garbled on decryption"));
717dc483 947 crReturn(0);
948 }
949
950 /*
e5574168 951 * This enables us to deduce the payload length.
952 */
960e736a 953 st->payload = st->len - st->pad - 1;
e5574168 954
51470298 955 ssh->pktin.length = st->payload + 5;
e5574168 956
957 /*
958 * So now we can work out the total packet length.
959 */
960e736a 960 st->packetlen = st->len + 4;
51470298 961 st->maclen = ssh->scmac ? ssh->scmac->len : 0;
e5574168 962
963 /*
964 * Adjust memory allocation if packet is too big.
965 */
51470298 966 if (ssh->pktin.maxlen < st->packetlen + st->maclen) {
967 ssh->pktin.maxlen = st->packetlen + st->maclen;
968 ssh->pktin.data = srealloc(ssh->pktin.data,
969 ssh->pktin.maxlen + APIEXTRA);
e5574168 970 }
971
972 /*
973 * Read and decrypt the remainder of the packet.
974 */
32874aea 975 for (st->i = st->cipherblk; st->i < st->packetlen + st->maclen;
976 st->i++) {
e5574168 977 while ((*datalen) == 0)
960e736a 978 crReturn(st->packetlen + st->maclen - st->i);
51470298 979 ssh->pktin.data[st->i] = *(*data)++;
32874aea 980 (*datalen)--;
e5574168 981 }
982 /* Decrypt everything _except_ the MAC. */
51470298 983 if (ssh->sccipher)
371e569c 984 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
985 ssh->pktin.data + st->cipherblk,
51470298 986 st->packetlen - st->cipherblk);
e5574168 987
988 /*
989 * Check the MAC.
990 */
51470298 991 if (ssh->scmac
e0e1a00d 992 && !ssh->scmac->verify(ssh->sc_mac_ctx, ssh->pktin.data, st->len + 4,
51470298 993 st->incoming_sequence)) {
a8327734 994 bombout((ssh,"Incorrect MAC received on packet"));
32874aea 995 crReturn(0);
8d5de777 996 }
32874aea 997 st->incoming_sequence++; /* whether or not we MACed */
e5574168 998
4ba9b64b 999 /*
1000 * Decompress packet payload.
1001 */
1002 {
1003 unsigned char *newpayload;
1004 int newlen;
51470298 1005 if (ssh->sccomp &&
5366aed8 1006 ssh->sccomp->decompress(ssh->sc_comp_ctx,
1007 ssh->pktin.data + 5, ssh->pktin.length - 5,
51470298 1008 &newpayload, &newlen)) {
1009 if (ssh->pktin.maxlen < newlen + 5) {
1010 ssh->pktin.maxlen = newlen + 5;
1011 ssh->pktin.data = srealloc(ssh->pktin.data,
1012 ssh->pktin.maxlen + APIEXTRA);
4ba9b64b 1013 }
51470298 1014 ssh->pktin.length = 5 + newlen;
1015 memcpy(ssh->pktin.data + 5, newpayload, newlen);
dcbde236 1016 sfree(newpayload);
4ba9b64b 1017 }
1018 }
1019
51470298 1020 ssh->pktin.savedpos = 6;
1021 ssh->pktin.type = ssh->pktin.data[5];
e5574168 1022
a8327734 1023 if (ssh->logctx)
1024 log_packet(ssh->logctx, PKT_INCOMING, ssh->pktin.type,
1025 ssh2_pkt_type(ssh->pkt_ctx, ssh->pktin.type),
1026 ssh->pktin.data+6, ssh->pktin.length-6);
00db133f 1027
51470298 1028 switch (ssh->pktin.type) {
3d63ca2e 1029 /*
1030 * These packets we must handle instantly.
1031 */
1032 case SSH2_MSG_DISCONNECT:
1033 {
1034 /* log reason code in disconnect message */
57356d63 1035 char *buf;
1036 int nowlen;
51470298 1037 int reason = GET_32BIT(ssh->pktin.data + 6);
1038 unsigned msglen = GET_32BIT(ssh->pktin.data + 10);
57356d63 1039
3d63ca2e 1040 if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
57356d63 1041 buf = dupprintf("Received disconnect message (%s)",
1042 ssh2_disconnect_reasons[reason]);
3d63ca2e 1043 } else {
57356d63 1044 buf = dupprintf("Received disconnect message (unknown"
1045 " type %d)", reason);
3d63ca2e 1046 }
1047 logevent(buf);
57356d63 1048 sfree(buf);
1049 buf = dupprintf("Disconnection message text: %n%.*s",
33b82b22 1050 &nowlen, msglen, ssh->pktin.data + 14);
3d63ca2e 1051 logevent(buf);
a8327734 1052 bombout((ssh,"Server sent disconnect message\ntype %d (%s):\n\"%s\"",
3d63ca2e 1053 reason,
1054 (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ?
1055 ssh2_disconnect_reasons[reason] : "unknown",
1056 buf+nowlen));
57356d63 1057 sfree(buf);
3d63ca2e 1058 crReturn(0);
1059 }
1060 break;
1061 case SSH2_MSG_IGNORE:
1062 goto next_packet;
1063 case SSH2_MSG_DEBUG:
1064 {
1065 /* log the debug message */
1066 char buf[512];
51470298 1067 /* int display = ssh->pktin.body[6]; */
1068 int stringlen = GET_32BIT(ssh->pktin.data+7);
3d63ca2e 1069 int prefix;
1070 strcpy(buf, "Remote debug message: ");
1071 prefix = strlen(buf);
51470298 1072 if (stringlen > (int)(sizeof(buf)-prefix-1))
3d63ca2e 1073 stringlen = sizeof(buf)-prefix-1;
51470298 1074 memcpy(buf + prefix, ssh->pktin.data + 11, stringlen);
3d63ca2e 1075 buf[prefix + stringlen] = '\0';
1076 logevent(buf);
38c4a8da 1077 }
3d63ca2e 1078 goto next_packet; /* FIXME: print the debug message */
1079
1080 /*
1081 * These packets we need do nothing about here.
1082 */
1083 case SSH2_MSG_UNIMPLEMENTED:
1084 case SSH2_MSG_SERVICE_REQUEST:
1085 case SSH2_MSG_SERVICE_ACCEPT:
1086 case SSH2_MSG_KEXINIT:
1087 case SSH2_MSG_NEWKEYS:
1088 case SSH2_MSG_KEXDH_INIT:
1089 case SSH2_MSG_KEXDH_REPLY:
1090 /* case SSH2_MSG_KEX_DH_GEX_REQUEST: duplicate case value */
1091 /* case SSH2_MSG_KEX_DH_GEX_GROUP: duplicate case value */
1092 case SSH2_MSG_KEX_DH_GEX_INIT:
1093 case SSH2_MSG_KEX_DH_GEX_REPLY:
1094 case SSH2_MSG_USERAUTH_REQUEST:
1095 case SSH2_MSG_USERAUTH_FAILURE:
1096 case SSH2_MSG_USERAUTH_SUCCESS:
1097 case SSH2_MSG_USERAUTH_BANNER:
1098 case SSH2_MSG_USERAUTH_PK_OK:
1099 /* case SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ: duplicate case value */
1100 /* case SSH2_MSG_USERAUTH_INFO_REQUEST: duplicate case value */
1101 case SSH2_MSG_USERAUTH_INFO_RESPONSE:
1102 case SSH2_MSG_GLOBAL_REQUEST:
1103 case SSH2_MSG_REQUEST_SUCCESS:
1104 case SSH2_MSG_REQUEST_FAILURE:
1105 case SSH2_MSG_CHANNEL_OPEN:
1106 case SSH2_MSG_CHANNEL_OPEN_CONFIRMATION:
1107 case SSH2_MSG_CHANNEL_OPEN_FAILURE:
1108 case SSH2_MSG_CHANNEL_WINDOW_ADJUST:
1109 case SSH2_MSG_CHANNEL_DATA:
1110 case SSH2_MSG_CHANNEL_EXTENDED_DATA:
1111 case SSH2_MSG_CHANNEL_EOF:
1112 case SSH2_MSG_CHANNEL_CLOSE:
1113 case SSH2_MSG_CHANNEL_REQUEST:
1114 case SSH2_MSG_CHANNEL_SUCCESS:
1115 case SSH2_MSG_CHANNEL_FAILURE:
1116 break;
1117
1118 /*
1119 * For anything else we send SSH2_MSG_UNIMPLEMENTED.
1120 */
1121 default:
51470298 1122 ssh2_pkt_init(ssh, SSH2_MSG_UNIMPLEMENTED);
1123 ssh2_pkt_adduint32(ssh, st->incoming_sequence - 1);
1124 ssh2_pkt_send(ssh);
3d63ca2e 1125 break;
38c4a8da 1126 }
1127
e5574168 1128 crFinish(0);
1129}
1130
51470298 1131static void ssh1_pktout_size(Ssh ssh, int len)
32874aea 1132{
374330e2 1133 int pad, biglen;
1134
1135 len += 5; /* type and CRC */
32874aea 1136 pad = 8 - (len % 8);
374330e2 1137 biglen = len + pad;
1138
51470298 1139 ssh->pktout.length = len - 5;
1140 if (ssh->pktout.maxlen < biglen) {
1141 ssh->pktout.maxlen = biglen;
8f203108 1142#ifdef MSCRYPTOAPI
fb09bf1c 1143 /* Allocate enough buffer space for extra block
8f203108 1144 * for MS CryptEncrypt() */
51470298 1145 ssh->pktout.data = srealloc(ssh->pktout.data, biglen + 12);
8f203108 1146#else
51470298 1147 ssh->pktout.data = srealloc(ssh->pktout.data, biglen + 4);
8f203108 1148#endif
374330e2 1149 }
51470298 1150 ssh->pktout.body = ssh->pktout.data + 4 + pad + 1;
4ba9b64b 1151}
374330e2 1152
51470298 1153static void s_wrpkt_start(Ssh ssh, int type, int len)
32874aea 1154{
51470298 1155 ssh1_pktout_size(ssh, len);
1156 ssh->pktout.type = type;
374330e2 1157}
1158
51470298 1159static int s_wrpkt_prepare(Ssh ssh)
32874aea 1160{
374330e2 1161 int pad, len, biglen, i;
1162 unsigned long crc;
1163
51470298 1164 ssh->pktout.body[-1] = ssh->pktout.type;
4ba9b64b 1165
a8327734 1166 if (ssh->logctx)
1167 log_packet(ssh->logctx, PKT_OUTGOING, ssh->pktout.type,
1168 ssh1_pkt_type(ssh->pktout.type),
1169 ssh->pktout.body, ssh->pktout.length);
00db133f 1170
51470298 1171 if (ssh->v1_compressing) {
4ba9b64b 1172 unsigned char *compblk;
1173 int complen;
5366aed8 1174 zlib_compress_block(ssh->cs_comp_ctx,
1175 ssh->pktout.body - 1, ssh->pktout.length + 1,
4ba9b64b 1176 &compblk, &complen);
51470298 1177 ssh1_pktout_size(ssh, complen - 1);
1178 memcpy(ssh->pktout.body - 1, compblk, complen);
dcbde236 1179 sfree(compblk);
4ba9b64b 1180 }
1181
51470298 1182 len = ssh->pktout.length + 5; /* type and CRC */
32874aea 1183 pad = 8 - (len % 8);
374330e2 1184 biglen = len + pad;
1185
32874aea 1186 for (i = 0; i < pad; i++)
51470298 1187 ssh->pktout.data[i + 4] = random_byte();
1188 crc = crc32(ssh->pktout.data + 4, biglen - 4);
1189 PUT_32BIT(ssh->pktout.data + biglen, crc);
1190 PUT_32BIT(ssh->pktout.data, len);
374330e2 1191
51470298 1192 if (ssh->cipher)
371e569c 1193 ssh->cipher->encrypt(ssh->v1_cipher_ctx, ssh->pktout.data + 4, biglen);
374330e2 1194
32874aea 1195 return biglen + 4;
39065bed 1196}
1197
51470298 1198static void s_wrpkt(Ssh ssh)
32874aea 1199{
5471d09a 1200 int len, backlog;
51470298 1201 len = s_wrpkt_prepare(ssh);
d8baa528 1202 backlog = sk_write(ssh->s, (char *)ssh->pktout.data, len);
5471d09a 1203 if (backlog > SSH_MAX_BACKLOG)
51470298 1204 ssh_throttle_all(ssh, 1, backlog);
39065bed 1205}
1206
51470298 1207static void s_wrpkt_defer(Ssh ssh)
32874aea 1208{
39065bed 1209 int len;
51470298 1210 len = s_wrpkt_prepare(ssh);
1211 if (ssh->deferred_len + len > ssh->deferred_size) {
1212 ssh->deferred_size = ssh->deferred_len + len + 128;
1213 ssh->deferred_send_data = srealloc(ssh->deferred_send_data,
1214 ssh->deferred_size);
39065bed 1215 }
51470298 1216 memcpy(ssh->deferred_send_data + ssh->deferred_len, ssh->pktout.data, len);
1217 ssh->deferred_len += len;
374330e2 1218}
1219
fb09bf1c 1220/*
39065bed 1221 * Construct a packet with the specified contents.
fb09bf1c 1222 */
51470298 1223static void construct_packet(Ssh ssh, int pkttype, va_list ap1, va_list ap2)
fb09bf1c 1224{
fb09bf1c 1225 unsigned char *p, *argp, argchar;
1226 unsigned long argint;
1227 int pktlen, argtype, arglen;
7cca0d81 1228 Bignum bn;
fb09bf1c 1229
1230 pktlen = 0;
39065bed 1231 while ((argtype = va_arg(ap1, int)) != PKT_END) {
fb09bf1c 1232 switch (argtype) {
1233 case PKT_INT:
39065bed 1234 (void) va_arg(ap1, int);
fb09bf1c 1235 pktlen += 4;
1236 break;
1237 case PKT_CHAR:
1ec39246 1238 (void) va_arg(ap1, int);
fb09bf1c 1239 pktlen++;
1240 break;
1241 case PKT_DATA:
39065bed 1242 (void) va_arg(ap1, unsigned char *);
1243 arglen = va_arg(ap1, int);
fb09bf1c 1244 pktlen += arglen;
1245 break;
1246 case PKT_STR:
39065bed 1247 argp = va_arg(ap1, unsigned char *);
d8baa528 1248 arglen = strlen((char *)argp);
fb09bf1c 1249 pktlen += 4 + arglen;
1250 break;
7cca0d81 1251 case PKT_BIGNUM:
39065bed 1252 bn = va_arg(ap1, Bignum);
32874aea 1253 pktlen += ssh1_bignum_length(bn);
7cca0d81 1254 break;
fb09bf1c 1255 default:
1256 assert(0);
1257 }
1258 }
fb09bf1c 1259
51470298 1260 s_wrpkt_start(ssh, pkttype, pktlen);
1261 p = ssh->pktout.body;
fb09bf1c 1262
39065bed 1263 while ((argtype = va_arg(ap2, int)) != PKT_END) {
fb09bf1c 1264 switch (argtype) {
1265 case PKT_INT:
39065bed 1266 argint = va_arg(ap2, int);
fb09bf1c 1267 PUT_32BIT(p, argint);
1268 p += 4;
1269 break;
1270 case PKT_CHAR:
1ec39246 1271 argchar = (unsigned char) va_arg(ap2, int);
fb09bf1c 1272 *p = argchar;
1273 p++;
1274 break;
1275 case PKT_DATA:
39065bed 1276 argp = va_arg(ap2, unsigned char *);
1277 arglen = va_arg(ap2, int);
fb09bf1c 1278 memcpy(p, argp, arglen);
1279 p += arglen;
1280 break;
1281 case PKT_STR:
39065bed 1282 argp = va_arg(ap2, unsigned char *);
d8baa528 1283 arglen = strlen((char *)argp);
fb09bf1c 1284 PUT_32BIT(p, arglen);
1285 memcpy(p + 4, argp, arglen);
1286 p += 4 + arglen;
1287 break;
7cca0d81 1288 case PKT_BIGNUM:
39065bed 1289 bn = va_arg(ap2, Bignum);
32874aea 1290 p += ssh1_write_bignum(p, bn);
7cca0d81 1291 break;
fb09bf1c 1292 }
1293 }
39065bed 1294}
fb09bf1c 1295
51470298 1296static void send_packet(Ssh ssh, int pkttype, ...)
32874aea 1297{
39065bed 1298 va_list ap1, ap2;
1299 va_start(ap1, pkttype);
1300 va_start(ap2, pkttype);
51470298 1301 construct_packet(ssh, pkttype, ap1, ap2);
1302 s_wrpkt(ssh);
fb09bf1c 1303}
1304
51470298 1305static void defer_packet(Ssh ssh, int pkttype, ...)
32874aea 1306{
39065bed 1307 va_list ap1, ap2;
1308 va_start(ap1, pkttype);
1309 va_start(ap2, pkttype);
51470298 1310 construct_packet(ssh, pkttype, ap1, ap2);
1311 s_wrpkt_defer(ssh);
39065bed 1312}
1313
32874aea 1314static int ssh_versioncmp(char *a, char *b)
1315{
9697bfd2 1316 char *ae, *be;
1317 unsigned long av, bv;
1318
43aa02a7 1319 av = strtoul(a, &ae, 10);
1320 bv = strtoul(b, &be, 10);
32874aea 1321 if (av != bv)
1322 return (av < bv ? -1 : +1);
1323 if (*ae == '.')
1324 ae++;
1325 if (*be == '.')
1326 be++;
43aa02a7 1327 av = strtoul(ae, &ae, 10);
1328 bv = strtoul(be, &be, 10);
32874aea 1329 if (av != bv)
1330 return (av < bv ? -1 : +1);
9697bfd2 1331 return 0;
1332}
1333
e5574168 1334/*
a92dd380 1335 * Utility routines for putting an SSH-protocol `string' and
1336 * `uint32' into a SHA state.
e5574168 1337 */
1338#include <stdio.h>
32874aea 1339static void sha_string(SHA_State * s, void *str, int len)
1340{
e5574168 1341 unsigned char lenblk[4];
e5574168 1342 PUT_32BIT(lenblk, len);
e5574168 1343 SHA_Bytes(s, lenblk, 4);
e5574168 1344 SHA_Bytes(s, str, len);
1345}
1346
32874aea 1347static void sha_uint32(SHA_State * s, unsigned i)
1348{
a92dd380 1349 unsigned char intblk[4];
1350 PUT_32BIT(intblk, i);
1351 SHA_Bytes(s, intblk, 4);
1352}
1353
7cca0d81 1354/*
1355 * SSH2 packet construction functions.
1356 */
51470298 1357static void ssh2_pkt_ensure(Ssh ssh, int length)
32874aea 1358{
51470298 1359 if (ssh->pktout.maxlen < length) {
1360 ssh->pktout.maxlen = length + 256;
1361 ssh->pktout.data = srealloc(ssh->pktout.data,
1362 ssh->pktout.maxlen + APIEXTRA);
1363 if (!ssh->pktout.data)
32874aea 1364 fatalbox("Out of memory");
7cca0d81 1365 }
783415f8 1366}
51470298 1367static void ssh2_pkt_adddata(Ssh ssh, void *data, int len)
32874aea 1368{
51470298 1369 ssh->pktout.length += len;
1370 ssh2_pkt_ensure(ssh, ssh->pktout.length);
1371 memcpy(ssh->pktout.data + ssh->pktout.length - len, data, len);
7cca0d81 1372}
51470298 1373static void ssh2_pkt_addbyte(Ssh ssh, unsigned char byte)
32874aea 1374{
51470298 1375 ssh2_pkt_adddata(ssh, &byte, 1);
7cca0d81 1376}
51470298 1377static void ssh2_pkt_init(Ssh ssh, int pkt_type)
32874aea 1378{
51470298 1379 ssh->pktout.length = 5;
1380 ssh2_pkt_addbyte(ssh, (unsigned char) pkt_type);
7cca0d81 1381}
51470298 1382static void ssh2_pkt_addbool(Ssh ssh, unsigned char value)
32874aea 1383{
51470298 1384 ssh2_pkt_adddata(ssh, &value, 1);
7cca0d81 1385}
51470298 1386static void ssh2_pkt_adduint32(Ssh ssh, unsigned long value)
32874aea 1387{
7cca0d81 1388 unsigned char x[4];
1389 PUT_32BIT(x, value);
51470298 1390 ssh2_pkt_adddata(ssh, x, 4);
7cca0d81 1391}
51470298 1392static void ssh2_pkt_addstring_start(Ssh ssh)
32874aea 1393{
51470298 1394 ssh2_pkt_adduint32(ssh, 0);
1395 ssh->pktout.savedpos = ssh->pktout.length;
7cca0d81 1396}
51470298 1397static void ssh2_pkt_addstring_str(Ssh ssh, char *data)
32874aea 1398{
51470298 1399 ssh2_pkt_adddata(ssh, data, strlen(data));
1400 PUT_32BIT(ssh->pktout.data + ssh->pktout.savedpos - 4,
1401 ssh->pktout.length - ssh->pktout.savedpos);
7cca0d81 1402}
51470298 1403static void ssh2_pkt_addstring_data(Ssh ssh, char *data, int len)
32874aea 1404{
51470298 1405 ssh2_pkt_adddata(ssh, data, len);
1406 PUT_32BIT(ssh->pktout.data + ssh->pktout.savedpos - 4,
1407 ssh->pktout.length - ssh->pktout.savedpos);
7cca0d81 1408}
51470298 1409static void ssh2_pkt_addstring(Ssh ssh, char *data)
32874aea 1410{
51470298 1411 ssh2_pkt_addstring_start(ssh);
1412 ssh2_pkt_addstring_str(ssh, data);
7cca0d81 1413}
d8baa528 1414static unsigned char *ssh2_mpint_fmt(Bignum b, int *len)
32874aea 1415{
7cca0d81 1416 unsigned char *p;
32874aea 1417 int i, n = (bignum_bitcount(b) + 7) / 8;
3709bfe9 1418 p = smalloc(n + 1);
7cca0d81 1419 if (!p)
32874aea 1420 fatalbox("out of memory");
7cca0d81 1421 p[0] = 0;
3709bfe9 1422 for (i = 1; i <= n; i++)
32874aea 1423 p[i] = bignum_byte(b, n - i);
7cca0d81 1424 i = 0;
32874aea 1425 while (i <= n && p[i] == 0 && (p[i + 1] & 0x80) == 0)
1426 i++;
1427 memmove(p, p + i, n + 1 - i);
1428 *len = n + 1 - i;
7cca0d81 1429 return p;
1430}
51470298 1431static void ssh2_pkt_addmp(Ssh ssh, Bignum b)
32874aea 1432{
7cca0d81 1433 unsigned char *p;
1434 int len;
1435 p = ssh2_mpint_fmt(b, &len);
51470298 1436 ssh2_pkt_addstring_start(ssh);
d8baa528 1437 ssh2_pkt_addstring_data(ssh, (char *)p, len);
dcbde236 1438 sfree(p);
7cca0d81 1439}
b185170a 1440
1441/*
1442 * Construct an SSH2 final-form packet: compress it, encrypt it,
1443 * put the MAC on it. Final packet, ready to be sent, is stored in
51470298 1444 * ssh->pktout.data. Total length is returned.
b185170a 1445 */
51470298 1446static int ssh2_pkt_construct(Ssh ssh)
32874aea 1447{
7cca0d81 1448 int cipherblk, maclen, padding, i;
7cca0d81 1449
a8327734 1450 if (ssh->logctx)
1451 log_packet(ssh->logctx, PKT_OUTGOING, ssh->pktout.data[5],
1452 ssh2_pkt_type(ssh->pkt_ctx, ssh->pktout.data[5]),
1453 ssh->pktout.data + 6, ssh->pktout.length - 6);
00db133f 1454
7cca0d81 1455 /*
4ba9b64b 1456 * Compress packet payload.
1457 */
4ba9b64b 1458 {
1459 unsigned char *newpayload;
1460 int newlen;
51470298 1461 if (ssh->cscomp &&
5366aed8 1462 ssh->cscomp->compress(ssh->cs_comp_ctx, ssh->pktout.data + 5,
1463 ssh->pktout.length - 5,
51470298 1464 &newpayload, &newlen)) {
1465 ssh->pktout.length = 5;
1466 ssh2_pkt_adddata(ssh, newpayload, newlen);
dcbde236 1467 sfree(newpayload);
4ba9b64b 1468 }
1469 }
1470
1471 /*
7cca0d81 1472 * Add padding. At least four bytes, and must also bring total
1473 * length (minus MAC) up to a multiple of the block size.
1474 */
51470298 1475 cipherblk = ssh->cscipher ? ssh->cscipher->blksize : 8; /* block size */
32874aea 1476 cipherblk = cipherblk < 8 ? 8 : cipherblk; /* or 8 if blksize < 8 */
7cca0d81 1477 padding = 4;
32874aea 1478 padding +=
51470298 1479 (cipherblk - (ssh->pktout.length + padding) % cipherblk) % cipherblk;
1480 maclen = ssh->csmac ? ssh->csmac->len : 0;
1481 ssh2_pkt_ensure(ssh, ssh->pktout.length + padding + maclen);
1482 ssh->pktout.data[4] = padding;
7cca0d81 1483 for (i = 0; i < padding; i++)
51470298 1484 ssh->pktout.data[ssh->pktout.length + i] = random_byte();
1485 PUT_32BIT(ssh->pktout.data, ssh->pktout.length + padding - 4);
1486 if (ssh->csmac)
e0e1a00d 1487 ssh->csmac->generate(ssh->cs_mac_ctx, ssh->pktout.data,
1488 ssh->pktout.length + padding,
51470298 1489 ssh->v2_outgoing_sequence);
1490 ssh->v2_outgoing_sequence++; /* whether or not we MACed */
1491
1492 if (ssh->cscipher)
371e569c 1493 ssh->cscipher->encrypt(ssh->cs_cipher_ctx,
1494 ssh->pktout.data, ssh->pktout.length + padding);
51470298 1495
1496 /* Ready-to-send packet starts at ssh->pktout.data. We return length. */
1497 return ssh->pktout.length + padding + maclen;
b185170a 1498}
1499
1500/*
1501 * Construct and send an SSH2 packet immediately.
1502 */
51470298 1503static void ssh2_pkt_send(Ssh ssh)
32874aea 1504{
5471d09a 1505 int len;
1506 int backlog;
51470298 1507 len = ssh2_pkt_construct(ssh);
d8baa528 1508 backlog = sk_write(ssh->s, (char *)ssh->pktout.data, len);
5471d09a 1509 if (backlog > SSH_MAX_BACKLOG)
51470298 1510 ssh_throttle_all(ssh, 1, backlog);
b185170a 1511}
1512
1513/*
1514 * Construct an SSH2 packet and add it to a deferred data block.
1515 * Useful for sending multiple packets in a single sk_write() call,
1516 * to prevent a traffic-analysing listener from being able to work
1517 * out the length of any particular packet (such as the password
1518 * packet).
1519 *
1520 * Note that because SSH2 sequence-numbers its packets, this can
1521 * NOT be used as an m4-style `defer' allowing packets to be
1522 * constructed in one order and sent in another.
1523 */
51470298 1524static void ssh2_pkt_defer(Ssh ssh)
32874aea 1525{
51470298 1526 int len = ssh2_pkt_construct(ssh);
1527 if (ssh->deferred_len + len > ssh->deferred_size) {
1528 ssh->deferred_size = ssh->deferred_len + len + 128;
1529 ssh->deferred_send_data = srealloc(ssh->deferred_send_data,
1530 ssh->deferred_size);
b185170a 1531 }
51470298 1532 memcpy(ssh->deferred_send_data + ssh->deferred_len, ssh->pktout.data, len);
1533 ssh->deferred_len += len;
b185170a 1534}
1535
1536/*
1537 * Send the whole deferred data block constructed by
39065bed 1538 * ssh2_pkt_defer() or SSH1's defer_packet().
b185170a 1539 */
51470298 1540static void ssh_pkt_defersend(Ssh ssh)
32874aea 1541{
5471d09a 1542 int backlog;
d8baa528 1543 backlog = sk_write(ssh->s, (char *)ssh->deferred_send_data,
1544 ssh->deferred_len);
51470298 1545 ssh->deferred_len = ssh->deferred_size = 0;
1546 sfree(ssh->deferred_send_data);
1547 ssh->deferred_send_data = NULL;
5471d09a 1548 if (backlog > SSH_MAX_BACKLOG)
51470298 1549 ssh_throttle_all(ssh, 1, backlog);
7cca0d81 1550}
1551
1552#if 0
32874aea 1553void bndebug(char *string, Bignum b)
1554{
7cca0d81 1555 unsigned char *p;
1556 int i, len;
1557 p = ssh2_mpint_fmt(b, &len);
1558 debug(("%s", string));
1559 for (i = 0; i < len; i++)
32874aea 1560 debug((" %02x", p[i]));
765c4200 1561 debug(("\n"));
dcbde236 1562 sfree(p);
7cca0d81 1563}
1564#endif
1565
32874aea 1566static void sha_mpint(SHA_State * s, Bignum b)
1567{
7cca0d81 1568 unsigned char *p;
1569 int len;
1570 p = ssh2_mpint_fmt(b, &len);
1571 sha_string(s, p, len);
dcbde236 1572 sfree(p);
7cca0d81 1573}
1574
1575/*
1576 * SSH2 packet decode functions.
1577 */
51470298 1578static unsigned long ssh2_pkt_getuint32(Ssh ssh)
32874aea 1579{
7cca0d81 1580 unsigned long value;
51470298 1581 if (ssh->pktin.length - ssh->pktin.savedpos < 4)
32874aea 1582 return 0; /* arrgh, no way to decline (FIXME?) */
51470298 1583 value = GET_32BIT(ssh->pktin.data + ssh->pktin.savedpos);
1584 ssh->pktin.savedpos += 4;
7cca0d81 1585 return value;
1586}
51470298 1587static int ssh2_pkt_getbool(Ssh ssh)
32874aea 1588{
65a22376 1589 unsigned long value;
51470298 1590 if (ssh->pktin.length - ssh->pktin.savedpos < 1)
32874aea 1591 return 0; /* arrgh, no way to decline (FIXME?) */
51470298 1592 value = ssh->pktin.data[ssh->pktin.savedpos] != 0;
1593 ssh->pktin.savedpos++;
65a22376 1594 return value;
1595}
51470298 1596static void ssh2_pkt_getstring(Ssh ssh, char **p, int *length)
32874aea 1597{
57356d63 1598 int len;
7cca0d81 1599 *p = NULL;
45068b27 1600 *length = 0;
51470298 1601 if (ssh->pktin.length - ssh->pktin.savedpos < 4)
32874aea 1602 return;
57356d63 1603 len = GET_32BIT(ssh->pktin.data + ssh->pktin.savedpos);
1604 if (len < 0)
1605 return;
1606 *length = len;
51470298 1607 ssh->pktin.savedpos += 4;
1608 if (ssh->pktin.length - ssh->pktin.savedpos < *length)
32874aea 1609 return;
d8baa528 1610 *p = (char *)(ssh->pktin.data + ssh->pktin.savedpos);
51470298 1611 ssh->pktin.savedpos += *length;
7cca0d81 1612}
51470298 1613static Bignum ssh2_pkt_getmp(Ssh ssh)
32874aea 1614{
7cca0d81 1615 char *p;
3709bfe9 1616 int length;
7cca0d81 1617 Bignum b;
1618
51470298 1619 ssh2_pkt_getstring(ssh, &p, &length);
7cca0d81 1620 if (!p)
32874aea 1621 return NULL;
8d5de777 1622 if (p[0] & 0x80) {
a8327734 1623 bombout((ssh,"internal error: Can't handle negative mpints"));
32874aea 1624 return NULL;
8d5de777 1625 }
d8baa528 1626 b = bignum_from_bytes((unsigned char *)p, length);
7cca0d81 1627 return b;
1628}
1629
7d503c31 1630/*
1dd353b5 1631 * Helper function to add an SSH2 signature blob to a packet.
1632 * Expects to be shown the public key blob as well as the signature
1633 * blob. Normally works just like ssh2_pkt_addstring, but will
1634 * fiddle with the signature packet if necessary for
1635 * BUG_SSH2_RSA_PADDING.
1636 */
51470298 1637static void ssh2_add_sigblob(Ssh ssh, void *pkblob_v, int pkblob_len,
1dd353b5 1638 void *sigblob_v, int sigblob_len)
1639{
1640 unsigned char *pkblob = (unsigned char *)pkblob_v;
1641 unsigned char *sigblob = (unsigned char *)sigblob_v;
1642
1643 /* dmemdump(pkblob, pkblob_len); */
1644 /* dmemdump(sigblob, sigblob_len); */
1645
1646 /*
1647 * See if this is in fact an ssh-rsa signature and a buggy
1648 * server; otherwise we can just do this the easy way.
1649 */
51470298 1650 if ((ssh->remote_bugs & BUG_SSH2_RSA_PADDING) &&
1dd353b5 1651 (GET_32BIT(pkblob) == 7 && !memcmp(pkblob+4, "ssh-rsa", 7))) {
1652 int pos, len, siglen;
1653
1654 /*
1655 * Find the byte length of the modulus.
1656 */
1657
1658 pos = 4+7; /* skip over "ssh-rsa" */
1659 pos += 4 + GET_32BIT(pkblob+pos); /* skip over exponent */
1660 len = GET_32BIT(pkblob+pos); /* find length of modulus */
1661 pos += 4; /* find modulus itself */
1662 while (len > 0 && pkblob[pos] == 0)
1663 len--, pos++;
1664 /* debug(("modulus length is %d\n", len)); */
1665
1666 /*
1667 * Now find the signature integer.
1668 */
1669 pos = 4+7; /* skip over "ssh-rsa" */
1670 siglen = GET_32BIT(sigblob+pos);
1671 /* debug(("signature length is %d\n", siglen)); */
1672
1673 if (len != siglen) {
1674 unsigned char newlen[4];
51470298 1675 ssh2_pkt_addstring_start(ssh);
d8baa528 1676 ssh2_pkt_addstring_data(ssh, (char *)sigblob, pos);
1dd353b5 1677 /* dmemdump(sigblob, pos); */
1678 pos += 4; /* point to start of actual sig */
1679 PUT_32BIT(newlen, len);
d8baa528 1680 ssh2_pkt_addstring_data(ssh, (char *)newlen, 4);
1dd353b5 1681 /* dmemdump(newlen, 4); */
1682 newlen[0] = 0;
1683 while (len-- > siglen) {
d8baa528 1684 ssh2_pkt_addstring_data(ssh, (char *)newlen, 1);
1dd353b5 1685 /* dmemdump(newlen, 1); */
1686 }
d8baa528 1687 ssh2_pkt_addstring_data(ssh, (char *)(sigblob+pos), siglen);
1dd353b5 1688 /* dmemdump(sigblob+pos, siglen); */
1689 return;
1690 }
1691
1692 /* Otherwise fall through and do it the easy way. */
1693 }
1694
51470298 1695 ssh2_pkt_addstring_start(ssh);
d8baa528 1696 ssh2_pkt_addstring_data(ssh, (char *)sigblob, sigblob_len);
1dd353b5 1697}
1698
1699/*
7d503c31 1700 * Examine the remote side's version string and compare it against
1701 * a list of known buggy implementations.
1702 */
51470298 1703static void ssh_detect_bugs(Ssh ssh, char *vstring)
32874aea 1704{
1705 char *imp; /* pointer to implementation part */
7d503c31 1706 imp = vstring;
1707 imp += strcspn(imp, "-");
bd358db1 1708 if (*imp) imp++;
7d503c31 1709 imp += strcspn(imp, "-");
bd358db1 1710 if (*imp) imp++;
7d503c31 1711
51470298 1712 ssh->remote_bugs = 0;
7d503c31 1713
2c9c6388 1714 if (cfg.sshbug_ignore1 == BUG_ON ||
1715 (cfg.sshbug_ignore1 == BUG_AUTO &&
1716 (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
1717 !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
1718 !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25")))) {
32874aea 1719 /*
1720 * These versions don't support SSH1_MSG_IGNORE, so we have
1721 * to use a different defence against password length
1722 * sniffing.
1723 */
51470298 1724 ssh->remote_bugs |= BUG_CHOKES_ON_SSH1_IGNORE;
32874aea 1725 logevent("We believe remote version has SSH1 ignore bug");
7d503c31 1726 }
1727
2c9c6388 1728 if (cfg.sshbug_plainpw1 == BUG_ON ||
1729 (cfg.sshbug_plainpw1 == BUG_AUTO &&
1730 (!strcmp(imp, "Cisco-1.25")))) {
bd358db1 1731 /*
1732 * These versions need a plain password sent; they can't
1733 * handle having a null and a random length of data after
1734 * the password.
1735 */
51470298 1736 ssh->remote_bugs |= BUG_NEEDS_SSH1_PLAIN_PASSWORD;
bd358db1 1737 logevent("We believe remote version needs a plain SSH1 password");
1738 }
1739
2c9c6388 1740 if (cfg.sshbug_rsa1 == BUG_ON ||
1741 (cfg.sshbug_rsa1 == BUG_AUTO &&
1742 (!strcmp(imp, "Cisco-1.25")))) {
0df73905 1743 /*
1744 * These versions apparently have no clue whatever about
1745 * RSA authentication and will panic and die if they see
1746 * an AUTH_RSA message.
1747 */
51470298 1748 ssh->remote_bugs |= BUG_CHOKES_ON_RSA;
0df73905 1749 logevent("We believe remote version can't handle RSA authentication");
1750 }
1751
2c9c6388 1752 if (cfg.sshbug_hmac2 == BUG_ON ||
1753 (cfg.sshbug_hmac2 == BUG_AUTO &&
831301f6 1754 (wc_match("2.1.0*", imp) || wc_match("2.0.*", imp) ||
1755 wc_match("2.2.0*", imp) || wc_match("2.3.0*", imp) ||
1756 wc_match("2.1 *", imp)))) {
32874aea 1757 /*
1758 * These versions have the HMAC bug.
1759 */
51470298 1760 ssh->remote_bugs |= BUG_SSH2_HMAC;
32874aea 1761 logevent("We believe remote version has SSH2 HMAC bug");
7d503c31 1762 }
1dd353b5 1763
2c9c6388 1764 if (cfg.sshbug_derivekey2 == BUG_ON ||
1765 (cfg.sshbug_derivekey2 == BUG_AUTO &&
d6430b97 1766 (wc_match("2.0.0*", imp) || wc_match("2.0.1[01]*", imp) ))) {
088bde77 1767 /*
1768 * These versions have the key-derivation bug (failing to
1769 * include the literal shared secret in the hashes that
1770 * generate the keys).
1771 */
51470298 1772 ssh->remote_bugs |= BUG_SSH2_DERIVEKEY;
088bde77 1773 logevent("We believe remote version has SSH2 key-derivation bug");
1774 }
1775
2c9c6388 1776 if (cfg.sshbug_rsapad2 == BUG_ON ||
1777 (cfg.sshbug_rsapad2 == BUG_AUTO &&
831301f6 1778 (wc_match("OpenSSH_2.[5-9]*", imp) ||
1779 wc_match("OpenSSH_3.[0-2]*", imp)))) {
1dd353b5 1780 /*
1781 * These versions have the SSH2 RSA padding bug.
1782 */
51470298 1783 ssh->remote_bugs |= BUG_SSH2_RSA_PADDING;
1dd353b5 1784 logevent("We believe remote version has SSH2 RSA padding bug");
1785 }
8e975795 1786
1787 if (cfg.sshbug_dhgex2 == BUG_ON) {
1788 /*
831301f6 1789 * User specified the SSH2 DH GEX bug.
8e975795 1790 */
51470298 1791 ssh->remote_bugs |= BUG_SSH2_DH_GEX;
8e975795 1792 logevent("We believe remote version has SSH2 DH group exchange bug");
1793 }
7d503c31 1794}
1795
51470298 1796static int do_ssh_init(Ssh ssh, unsigned char c)
32874aea 1797{
51470298 1798 struct do_ssh_init_state {
1799 int vslen;
1800 char version[10];
1801 char *vstring;
1802 int vstrsize;
1803 int i;
1804 int proto1, proto2;
1805 };
1806 crState(do_ssh_init_state);
374330e2 1807
51470298 1808 crBegin(ssh->do_ssh_init_crstate);
8df7a775 1809
1810 /* Search for the string "SSH-" in the input. */
51470298 1811 s->i = 0;
8df7a775 1812 while (1) {
1813 static const int transS[] = { 1, 2, 2, 1 };
1814 static const int transH[] = { 0, 0, 3, 0 };
1815 static const int transminus[] = { 0, 0, 0, -1 };
32874aea 1816 if (c == 'S')
51470298 1817 s->i = transS[s->i];
32874aea 1818 else if (c == 'H')
51470298 1819 s->i = transH[s->i];
32874aea 1820 else if (c == '-')
51470298 1821 s->i = transminus[s->i];
32874aea 1822 else
51470298 1823 s->i = 0;
1824 if (s->i < 0)
8df7a775 1825 break;
1826 crReturn(1); /* get another character */
374330e2 1827 }
8df7a775 1828
51470298 1829 s->vstrsize = 16;
1830 s->vstring = smalloc(s->vstrsize);
1831 strcpy(s->vstring, "SSH-");
1832 s->vslen = 4;
1833 s->i = 0;
374330e2 1834 while (1) {
8df7a775 1835 crReturn(1); /* get another char */
51470298 1836 if (s->vslen >= s->vstrsize - 1) {
1837 s->vstrsize += 16;
1838 s->vstring = srealloc(s->vstring, s->vstrsize);
32874aea 1839 }
51470298 1840 s->vstring[s->vslen++] = c;
1841 if (s->i >= 0) {
374330e2 1842 if (c == '-') {
51470298 1843 s->version[s->i] = '\0';
1844 s->i = -1;
1845 } else if (s->i < sizeof(s->version) - 1)
1846 s->version[s->i++] = c;
32874aea 1847 } else if (c == '\n')
374330e2 1848 break;
1849 }
1850
51470298 1851 ssh->agentfwd_enabled = FALSE;
1852 ssh->rdpkt2_state.incoming_sequence = 0;
960e736a 1853
51470298 1854 s->vstring[s->vslen] = 0;
1855 s->vstring[strcspn(s->vstring, "\r\n")] = '\0';/* remove EOL chars */
1856 {
1857 char *vlog;
1858 vlog = smalloc(20 + s->vslen);
1859 sprintf(vlog, "Server version: %s", s->vstring);
1860 logevent(vlog);
1861 sfree(vlog);
1862 }
1863 ssh_detect_bugs(ssh, s->vstring);
c5e9c988 1864
adf799dd 1865 /*
38d228a2 1866 * Decide which SSH protocol version to support.
adf799dd 1867 */
38d228a2 1868
1869 /* Anything strictly below "2.0" means protocol 1 is supported. */
51470298 1870 s->proto1 = ssh_versioncmp(s->version, "2.0") < 0;
38d228a2 1871 /* Anything greater or equal to "1.99" means protocol 2 is supported. */
51470298 1872 s->proto2 = ssh_versioncmp(s->version, "1.99") >= 0;
38d228a2 1873
51470298 1874 if (cfg.sshprot == 0 && !s->proto1) {
a8327734 1875 bombout((ssh,"SSH protocol version 1 required by user but not provided by server"));
38d228a2 1876 crReturn(0);
1877 }
51470298 1878 if (cfg.sshprot == 3 && !s->proto2) {
a8327734 1879 bombout((ssh,"SSH protocol version 2 required by user but not provided by server"));
38d228a2 1880 crReturn(0);
1881 }
1882
51470298 1883 if (s->proto2 && (cfg.sshprot >= 2 || !s->proto1)) {
32874aea 1884 /*
38d228a2 1885 * Use v2 protocol.
32874aea 1886 */
1887 char verstring[80], vlog[100];
1888 sprintf(verstring, "SSH-2.0-%s", sshver);
51470298 1889 SHA_Init(&ssh->exhashbase);
32874aea 1890 /*
1891 * Hash our version string and their version string.
1892 */
51470298 1893 sha_string(&ssh->exhashbase, verstring, strlen(verstring));
1894 sha_string(&ssh->exhashbase, s->vstring, strcspn(s->vstring, "\r\n"));
32874aea 1895 sprintf(vlog, "We claim version: %s", verstring);
1896 logevent(vlog);
1897 strcat(verstring, "\n");
1898 logevent("Using SSH protocol version 2");
51470298 1899 sk_write(ssh->s, verstring, strlen(verstring));
1900 ssh->protocol = ssh2_protocol;
1901 ssh->version = 2;
1902 ssh->s_rdpkt = ssh2_rdpkt;
e5574168 1903 } else {
32874aea 1904 /*
38d228a2 1905 * Use v1 protocol.
32874aea 1906 */
1907 char verstring[80], vlog[100];
1908 sprintf(verstring, "SSH-%s-%s",
51470298 1909 (ssh_versioncmp(s->version, "1.5") <= 0 ? s->version : "1.5"),
32874aea 1910 sshver);
1911 sprintf(vlog, "We claim version: %s", verstring);
1912 logevent(vlog);
1913 strcat(verstring, "\n");
759712a6 1914
32874aea 1915 logevent("Using SSH protocol version 1");
51470298 1916 sk_write(ssh->s, verstring, strlen(verstring));
1917 ssh->protocol = ssh1_protocol;
1918 ssh->version = 1;
1919 ssh->s_rdpkt = ssh1_rdpkt;
e5574168 1920 }
51470298 1921 ssh->state = SSH_STATE_BEFORE_SIZE;
8df7a775 1922
51470298 1923 sfree(s->vstring);
50526e47 1924
8df7a775 1925 crFinish(0);
1926}
1927
51470298 1928static void ssh_gotdata(Ssh ssh, unsigned char *data, int datalen)
8df7a775 1929{
51470298 1930 crBegin(ssh->ssh_gotdata_crstate);
8df7a775 1931
1932 /*
1933 * To begin with, feed the characters one by one to the
1934 * protocol initialisation / selection function do_ssh_init().
1935 * When that returns 0, we're done with the initial greeting
1936 * exchange and can move on to packet discipline.
1937 */
1938 while (1) {
51470298 1939 int ret; /* need not be kept across crReturn */
8df7a775 1940 if (datalen == 0)
1941 crReturnV; /* more data please */
51470298 1942 ret = do_ssh_init(ssh, *data);
32874aea 1943 data++;
1944 datalen--;
8df7a775 1945 if (ret == 0)
1946 break;
1947 }
1948
1949 /*
1950 * We emerge from that loop when the initial negotiation is
1951 * over and we have selected an s_rdpkt function. Now pass
1952 * everything to s_rdpkt, and then pass the resulting packets
1953 * to the proper protocol handler.
1954 */
1955 if (datalen == 0)
1956 crReturnV;
1957 while (1) {
1958 while (datalen > 0) {
51470298 1959 if (ssh->s_rdpkt(ssh, &data, &datalen) == 0) {
1960 if (ssh->state == SSH_STATE_CLOSED) {
e14d0f19 1961 return;
1962 }
51470298 1963 ssh->protocol(ssh, NULL, 0, 1);
1964 if (ssh->state == SSH_STATE_CLOSED) {
8df7a775 1965 return;
1966 }
1967 }
1968 }
1969 crReturnV;
1970 }
1971 crFinishV;
1972}
1973
32874aea 1974static int ssh_closing(Plug plug, char *error_msg, int error_code,
1975 int calling_back)
1976{
51470298 1977 Ssh ssh = (Ssh) plug;
1978 ssh->state = SSH_STATE_CLOSED;
1979 if (ssh->s) {
1980 sk_close(ssh->s);
1981 ssh->s = NULL;
f3ab576e 1982 }
7e78000d 1983 if (error_msg) {
32874aea 1984 /* A socket error has occurred. */
247308b5 1985 logevent(error_msg);
a8327734 1986 connection_fatal(ssh->frontend, error_msg);
7e78000d 1987 } else {
1988 /* Otherwise, the remote side closed the connection normally. */
8df7a775 1989 }
7e78000d 1990 return 0;
1991}
1992
32874aea 1993static int ssh_receive(Plug plug, int urgent, char *data, int len)
1994{
51470298 1995 Ssh ssh = (Ssh) plug;
d8baa528 1996 ssh_gotdata(ssh, (unsigned char *)data, len);
51470298 1997 if (ssh->state == SSH_STATE_CLOSED) {
1998 if (ssh->s) {
1999 sk_close(ssh->s);
2000 ssh->s = NULL;
32874aea 2001 }
2002 return 0;
3257deae 2003 }
fef97f43 2004 return 1;
374330e2 2005}
2006
5471d09a 2007static void ssh_sent(Plug plug, int bufsize)
2008{
51470298 2009 Ssh ssh = (Ssh) plug;
5471d09a 2010 /*
2011 * If the send backlog on the SSH socket itself clears, we
2012 * should unthrottle the whole world if it was throttled.
2013 */
2014 if (bufsize < SSH_MAX_BACKLOG)
51470298 2015 ssh_throttle_all(ssh, 0, bufsize);
5471d09a 2016}
2017
fb09bf1c 2018/*
8df7a775 2019 * Connect to specified host and port.
2020 * Returns an error message, or NULL on success.
6e1ebb76 2021 * Also places the canonical host name into `realhost'. It must be
2022 * freed by the caller.
8df7a775 2023 */
51470298 2024static char *connect_to_host(Ssh ssh, char *host, int port,
2025 char **realhost, int nodelay)
8df7a775 2026{
51470298 2027 static const struct plug_function_table fn_table = {
7e78000d 2028 ssh_closing,
5471d09a 2029 ssh_receive,
2030 ssh_sent,
2031 NULL
51470298 2032 };
7e78000d 2033
8df7a775 2034 SockAddr addr;
2035 char *err;
8df7a775 2036
51470298 2037 ssh->savedhost = smalloc(1 + strlen(host));
2038 if (!ssh->savedhost)
8df7a775 2039 fatalbox("Out of memory");
51470298 2040 strcpy(ssh->savedhost, host);
8df7a775 2041
2042 if (port < 0)
2043 port = 22; /* default ssh port */
51470298 2044 ssh->savedport = port;
8df7a775 2045
2046 /*
2047 * Try to find host.
2048 */
57356d63 2049 logeventf(ssh, "Looking up host \"%s\"", host);
b7a189f3 2050 addr = name_lookup(host, port, realhost);
70e5d0fd 2051 if ((err = sk_addr_error(addr)) != NULL)
8df7a775 2052 return err;
2053
8df7a775 2054 /*
2055 * Open socket.
2056 */
3ad9d396 2057 {
57356d63 2058 char addrbuf[100];
3ad9d396 2059 sk_getaddr(addr, addrbuf, 100);
57356d63 2060 logeventf(ssh, "Connecting to %s port %d", addrbuf, port);
3ad9d396 2061 }
51470298 2062 ssh->fn = &fn_table;
2063 ssh->s = new_connection(addr, *realhost, port, 0, 1, nodelay, (Plug) ssh);
70e5d0fd 2064 if ((err = sk_socket_error(ssh->s)) != NULL) {
51470298 2065 ssh->s = NULL;
8df7a775 2066 return err;
67c4ba2e 2067 }
8df7a775 2068
8df7a775 2069 return NULL;
2070}
2071
2072/*
5471d09a 2073 * Throttle or unthrottle the SSH connection.
2074 */
51470298 2075static void ssh1_throttle(Ssh ssh, int adjust)
5471d09a 2076{
51470298 2077 int old_count = ssh->v1_throttle_count;
2078 ssh->v1_throttle_count += adjust;
2079 assert(ssh->v1_throttle_count >= 0);
2080 if (ssh->v1_throttle_count && !old_count) {
2081 sk_set_frozen(ssh->s, 1);
2082 } else if (!ssh->v1_throttle_count && old_count) {
2083 sk_set_frozen(ssh->s, 0);
5471d09a 2084 }
2085}
2086
2087/*
2088 * Throttle or unthrottle _all_ local data streams (for when sends
2089 * on the SSH connection itself back up).
2090 */
51470298 2091static void ssh_throttle_all(Ssh ssh, int enable, int bufsize)
5471d09a 2092{
2093 int i;
2094 struct ssh_channel *c;
2095
51470298 2096 if (enable == ssh->throttled_all)
5471d09a 2097 return;
51470298 2098 ssh->throttled_all = enable;
2099 ssh->overall_bufsize = bufsize;
2100 if (!ssh->channels)
5471d09a 2101 return;
51470298 2102 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++) {
5471d09a 2103 switch (c->type) {
2104 case CHAN_MAINSESSION:
2105 /*
2106 * This is treated separately, outside the switch.
2107 */
2108 break;
2109 case CHAN_X11:
2110 x11_override_throttle(c->u.x11.s, enable);
2111 break;
2112 case CHAN_AGENT:
2113 /* Agent channels require no buffer management. */
2114 break;
2115 case CHAN_SOCKDATA:
2116 pfd_override_throttle(c->u.x11.s, enable);
2117 break;
2118 }
2119 }
2120}
2121
2122/*
51470298 2123 * Username and password input, abstracted off into routines
2124 * reusable in several places - even between SSH1 and SSH2.
0405e71f 2125 */
0405e71f 2126
2127/* Set up a username or password input loop on a given buffer. */
ae9ae89f 2128static void setup_userpass_input(Ssh ssh, char *buffer, int buflen, int echo)
0405e71f 2129{
51470298 2130 ssh->userpass_input_buffer = buffer;
2131 ssh->userpass_input_buflen = buflen;
2132 ssh->userpass_input_bufpos = 0;
2133 ssh->userpass_input_echo = echo;
0405e71f 2134}
2135
2136/*
2137 * Process some terminal data in the course of username/password
2138 * input. Returns >0 for success (line of input returned in
2139 * buffer), <0 for failure (user hit ^C/^D, bomb out and exit), 0
2140 * for inconclusive (keep waiting for more input please).
2141 */
ae9ae89f 2142static int process_userpass_input(Ssh ssh, unsigned char *in, int inlen)
0405e71f 2143{
2144 char c;
2145
2146 while (inlen--) {
2147 switch (c = *in++) {
2148 case 10:
2149 case 13:
51470298 2150 ssh->userpass_input_buffer[ssh->userpass_input_bufpos] = 0;
2151 ssh->userpass_input_buffer[ssh->userpass_input_buflen-1] = 0;
0405e71f 2152 return +1;
2153 break;
2154 case 8:
2155 case 127:
51470298 2156 if (ssh->userpass_input_bufpos > 0) {
2157 if (ssh->userpass_input_echo)
2158 c_write_str(ssh, "\b \b");
2159 ssh->userpass_input_bufpos--;
0405e71f 2160 }
2161 break;
2162 case 21:
2163 case 27:
51470298 2164 while (ssh->userpass_input_bufpos > 0) {
2165 if (ssh->userpass_input_echo)
2166 c_write_str(ssh, "\b \b");
2167 ssh->userpass_input_bufpos--;
0405e71f 2168 }
2169 break;
2170 case 3:
2171 case 4:
2172 return -1;
2173 break;
2174 default:
2175 if (((c >= ' ' && c <= '~') ||
2176 ((unsigned char) c >= 160))
51470298 2177 && ssh->userpass_input_bufpos < ssh->userpass_input_buflen-1) {
2178 ssh->userpass_input_buffer[ssh->userpass_input_bufpos++] = c;
2179 if (ssh->userpass_input_echo)
2180 c_write(ssh, &c, 1);
0405e71f 2181 }
2182 break;
2183 }
2184 }
2185 return 0;
2186}
2187
2188/*
fb09bf1c 2189 * Handle the key exchange and user authentication phases.
2190 */
51470298 2191static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt)
fb09bf1c 2192{
2d466ffd 2193 int i, j;
374330e2 2194 unsigned char cookie[8];
2195 struct RSAKey servkey, hostkey;
2196 struct MD5Context md5c;
51470298 2197 struct do_ssh1_login_state {
2198 int len;
2199 unsigned char *rsabuf, *keystr1, *keystr2;
2200 unsigned long supported_ciphers_mask, supported_auths_mask;
2201 int tried_publickey, tried_agent;
2202 int tis_auth_refused, ccard_auth_refused;
2203 unsigned char session_id[16];
2204 int cipher_type;
2205 char username[100];
2206 void *publickey_blob;
2207 int publickey_bloblen;
2208 char password[100];
2209 char prompt[200];
2210 int pos;
2211 char c;
2212 int pwpkt_type;
2213 unsigned char request[5], *response, *p;
2214 int responselen;
2215 int keyi, nkeys;
2216 int authed;
2217 struct RSAKey key;
2218 Bignum challenge;
2219 char *commentp;
2220 int commentlen;
2221 };
2222 crState(do_ssh1_login_state);
2223
2224 crBegin(ssh->do_ssh1_login_crstate);
374330e2 2225
32874aea 2226 if (!ispkt)
2227 crWaitUntil(ispkt);
374330e2 2228
51470298 2229 if (ssh->pktin.type != SSH1_SMSG_PUBLIC_KEY) {
a8327734 2230 bombout((ssh,"Public key packet not received"));
32874aea 2231 crReturn(0);
8d5de777 2232 }
374330e2 2233
c5e9c988 2234 logevent("Received public keys");
374330e2 2235
51470298 2236 memcpy(cookie, ssh->pktin.body, 8);
374330e2 2237
51470298 2238 i = makekey(ssh->pktin.body + 8, &servkey, &s->keystr1, 0);
2239 j = makekey(ssh->pktin.body + 8 + i, &hostkey, &s->keystr2, 0);
374330e2 2240
c5e9c988 2241 /*
1c2a93c4 2242 * Log the host key fingerprint.
c5e9c988 2243 */
c5e9c988 2244 {
2245 char logmsg[80];
1c2a93c4 2246 logevent("Host key fingerprint is:");
c5e9c988 2247 strcpy(logmsg, " ");
32874aea 2248 hostkey.comment = NULL;
2249 rsa_fingerprint(logmsg + strlen(logmsg),
2250 sizeof(logmsg) - strlen(logmsg), &hostkey);
c5e9c988 2251 logevent(logmsg);
2252 }
2253
51470298 2254 ssh->v1_remote_protoflags = GET_32BIT(ssh->pktin.body + 8 + i + j);
2255 s->supported_ciphers_mask = GET_32BIT(ssh->pktin.body + 12 + i + j);
2256 s->supported_auths_mask = GET_32BIT(ssh->pktin.body + 16 + i + j);
bea1ef5f 2257
51470298 2258 ssh->v1_local_protoflags =
2259 ssh->v1_remote_protoflags & SSH1_PROTOFLAGS_SUPPORTED;
2260 ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
b96dc54c 2261
c5e9c988 2262 MD5Init(&md5c);
51470298 2263 MD5Update(&md5c, s->keystr2, hostkey.bytes);
2264 MD5Update(&md5c, s->keystr1, servkey.bytes);
2265 MD5Update(&md5c, ssh->pktin.body, 8);
2266 MD5Final(s->session_id, &md5c);
374330e2 2267
32874aea 2268 for (i = 0; i < 32; i++)
51470298 2269 ssh->session_key[i] = random_byte();
374330e2 2270
51470298 2271 s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
374330e2 2272
51470298 2273 s->rsabuf = smalloc(s->len);
2274 if (!s->rsabuf)
374330e2 2275 fatalbox("Out of memory");
2276
89ee5268 2277 /*
2278 * Verify the host key.
2279 */
2280 {
32874aea 2281 /*
2282 * First format the key into a string.
2283 */
2284 int len = rsastr_len(&hostkey);
2285 char fingerprint[100];
2286 char *keystr = smalloc(len);
2287 if (!keystr)
2288 fatalbox("Out of memory");
2289 rsastr_fmt(keystr, &hostkey);
2290 rsa_fingerprint(fingerprint, sizeof(fingerprint), &hostkey);
a8327734 2291 verify_ssh_host_key(ssh->frontend,
2292 ssh->savedhost, ssh->savedport, "rsa", keystr,
32874aea 2293 fingerprint);
2294 sfree(keystr);
2295 }
2296
2297 for (i = 0; i < 32; i++) {
51470298 2298 s->rsabuf[i] = ssh->session_key[i];
374330e2 2299 if (i < 16)
51470298 2300 s->rsabuf[i] ^= s->session_id[i];
374330e2 2301 }
2302
2303 if (hostkey.bytes > servkey.bytes) {
51470298 2304 rsaencrypt(s->rsabuf, 32, &servkey);
2305 rsaencrypt(s->rsabuf, servkey.bytes, &hostkey);
374330e2 2306 } else {
51470298 2307 rsaencrypt(s->rsabuf, 32, &hostkey);
2308 rsaencrypt(s->rsabuf, hostkey.bytes, &servkey);
374330e2 2309 }
2310
c5e9c988 2311 logevent("Encrypted session key");
2312
ca20bfcf 2313 {
2314 int cipher_chosen = 0, warn = 0;
2315 char *cipher_string = NULL;
51470298 2316 int i;
ca20bfcf 2317 for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) {
2318 int next_cipher = cfg.ssh_cipherlist[i];
2319 if (next_cipher == CIPHER_WARN) {
2320 /* If/when we choose a cipher, warn about it */
2321 warn = 1;
2322 } else if (next_cipher == CIPHER_AES) {
2323 /* XXX Probably don't need to mention this. */
2324 logevent("AES not supported in SSH1, skipping");
2325 } else {
2326 switch (next_cipher) {
51470298 2327 case CIPHER_3DES: s->cipher_type = SSH_CIPHER_3DES;
ca20bfcf 2328 cipher_string = "3DES"; break;
51470298 2329 case CIPHER_BLOWFISH: s->cipher_type = SSH_CIPHER_BLOWFISH;
ca20bfcf 2330 cipher_string = "Blowfish"; break;
51470298 2331 case CIPHER_DES: s->cipher_type = SSH_CIPHER_DES;
ca20bfcf 2332 cipher_string = "single-DES"; break;
2333 }
51470298 2334 if (s->supported_ciphers_mask & (1 << s->cipher_type))
ca20bfcf 2335 cipher_chosen = 1;
2336 }
2337 }
2338 if (!cipher_chosen) {
51470298 2339 if ((s->supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0)
a8327734 2340 bombout((ssh,"Server violates SSH 1 protocol by not "
ca20bfcf 2341 "supporting 3DES encryption"));
2342 else
2343 /* shouldn't happen */
a8327734 2344 bombout((ssh,"No supported ciphers found"));
a99a05c0 2345 crReturn(0);
2346 }
ca20bfcf 2347
2348 /* Warn about chosen cipher if necessary. */
2349 if (warn)
a8327734 2350 askcipher(ssh->frontend, cipher_string, 0);
bea1ef5f 2351 }
ca20bfcf 2352
51470298 2353 switch (s->cipher_type) {
32874aea 2354 case SSH_CIPHER_3DES:
2355 logevent("Using 3DES encryption");
2356 break;
2357 case SSH_CIPHER_DES:
2358 logevent("Using single-DES encryption");
2359 break;
2360 case SSH_CIPHER_BLOWFISH:
2361 logevent("Using Blowfish encryption");
2362 break;
c5e9c988 2363 }
bea1ef5f 2364
51470298 2365 send_packet(ssh, SSH1_CMSG_SESSION_KEY,
2366 PKT_CHAR, s->cipher_type,
32874aea 2367 PKT_DATA, cookie, 8,
51470298 2368 PKT_CHAR, (s->len * 8) >> 8, PKT_CHAR, (s->len * 8) & 0xFF,
2369 PKT_DATA, s->rsabuf, s->len,
2370 PKT_INT, ssh->v1_local_protoflags, PKT_END);
fb09bf1c 2371
c5e9c988 2372 logevent("Trying to enable encryption...");
374330e2 2373
51470298 2374 sfree(s->rsabuf);
374330e2 2375
51470298 2376 ssh->cipher = (s->cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish_ssh1 :
2377 s->cipher_type == SSH_CIPHER_DES ? &ssh_des :
2378 &ssh_3des);
371e569c 2379 ssh->v1_cipher_ctx = ssh->cipher->make_context();
2380 ssh->cipher->sesskey(ssh->v1_cipher_ctx, ssh->session_key);
57356d63 2381 logeventf(ssh, "Initialised %s encryption", ssh->cipher->text_name);
374330e2 2382
0183b242 2383 ssh->crcda_ctx = crcda_make_context();
2384 logevent("Installing CRC compensation attack detector");
2385
fb09bf1c 2386 crWaitUntil(ispkt);
374330e2 2387
51470298 2388 if (ssh->pktin.type != SSH1_SMSG_SUCCESS) {
a8327734 2389 bombout((ssh,"Encryption not successfully enabled"));
32874aea 2390 crReturn(0);
8d5de777 2391 }
374330e2 2392
c5e9c988 2393 logevent("Successfully started encryption");
2394
374330e2 2395 fflush(stdout);
2396 {
67779be7 2397 if ((flags & FLAG_INTERACTIVE) && !*cfg.username) {
c0a81592 2398 if (ssh_get_line && !ssh_getline_pw_only) {
32874aea 2399 if (!ssh_get_line("login as: ",
51470298 2400 s->username, sizeof(s->username), FALSE)) {
32874aea 2401 /*
2402 * get_line failed to get a username.
2403 * Terminate.
2404 */
2405 logevent("No username provided. Abandoning session.");
51470298 2406 ssh->state = SSH_STATE_CLOSED;
32874aea 2407 crReturn(1);
2408 }
2409 } else {
51470298 2410 int ret; /* need not be kept over crReturn */
2411 c_write_str(ssh, "login as: ");
2412 ssh->send_ok = 1;
0405e71f 2413
51470298 2414 setup_userpass_input(ssh, s->username, sizeof(s->username), 1);
0405e71f 2415 do {
32874aea 2416 crWaitUntil(!ispkt);
51470298 2417 ret = process_userpass_input(ssh, in, inlen);
0405e71f 2418 } while (ret == 0);
2419 if (ret < 0)
2420 cleanup_exit(0);
51470298 2421 c_write_str(ssh, "\r\n");
32874aea 2422 }
2423 } else {
51470298 2424 strncpy(s->username, cfg.username, sizeof(s->username));
2425 s->username[sizeof(s->username)-1] = '\0';
374330e2 2426 }
fb09bf1c 2427
51470298 2428 send_packet(ssh, SSH1_CMSG_USER, PKT_STR, s->username, PKT_END);
c5e9c988 2429 {
51470298 2430 char userlog[22 + sizeof(s->username)];
2431 sprintf(userlog, "Sent username \"%s\"", s->username);
c5e9c988 2432 logevent(userlog);
32874aea 2433 if (flags & FLAG_INTERACTIVE &&
2434 (!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) {
3c8e959b 2435 strcat(userlog, "\r\n");
51470298 2436 c_write_str(ssh, userlog);
3c8e959b 2437 }
c5e9c988 2438 }
374330e2 2439 }
2440
fb09bf1c 2441 crWaitUntil(ispkt);
374330e2 2442
51470298 2443 if ((ssh->remote_bugs & BUG_CHOKES_ON_RSA)) {
0df73905 2444 /* We must not attempt PK auth. Pretend we've already tried it. */
51470298 2445 s->tried_publickey = s->tried_agent = 1;
0df73905 2446 } else {
51470298 2447 s->tried_publickey = s->tried_agent = 0;
0df73905 2448 }
51470298 2449 s->tis_auth_refused = s->ccard_auth_refused = 0;
396778f1 2450 /* Load the public half of cfg.keyfile so we notice if it's in Pageant */
2451 if (*cfg.keyfile) {
51470298 2452 if (!rsakey_pubblob(cfg.keyfile,
2453 &s->publickey_blob, &s->publickey_bloblen))
2454 s->publickey_blob = NULL;
396778f1 2455 } else
51470298 2456 s->publickey_blob = NULL;
7cca0d81 2457
51470298 2458 while (ssh->pktin.type == SSH1_SMSG_FAILURE) {
2459 s->pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
614a20a0 2460
51470298 2461 if (agent_exists() && !s->tried_agent) {
32874aea 2462 /*
2463 * Attempt RSA authentication using Pageant.
2464 */
32874aea 2465 void *r;
2466
51470298 2467 s->authed = FALSE;
2468 s->tried_agent = 1;
32874aea 2469 logevent("Pageant is running. Requesting keys.");
2470
2471 /* Request the keys held by the agent. */
51470298 2472 PUT_32BIT(s->request, 1);
2473 s->request[4] = SSH1_AGENTC_REQUEST_RSA_IDENTITIES;
2474 agent_query(s->request, 5, &r, &s->responselen);
2475 s->response = (unsigned char *) r;
2476 if (s->response && s->responselen >= 5 &&
2477 s->response[4] == SSH1_AGENT_RSA_IDENTITIES_ANSWER) {
2478 s->p = s->response + 5;
2479 s->nkeys = GET_32BIT(s->p);
2480 s->p += 4;
32874aea 2481 {
2482 char buf[64];
51470298 2483 sprintf(buf, "Pageant has %d SSH1 keys", s->nkeys);
32874aea 2484 logevent(buf);
2485 }
51470298 2486 for (s->keyi = 0; s->keyi < s->nkeys; s->keyi++) {
32874aea 2487 {
2488 char buf[64];
51470298 2489 sprintf(buf, "Trying Pageant key #%d", s->keyi);
32874aea 2490 logevent(buf);
2491 }
51470298 2492 if (s->publickey_blob &&
2493 !memcmp(s->p, s->publickey_blob,
2494 s->publickey_bloblen)) {
396778f1 2495 logevent("This key matches configured key file");
51470298 2496 s->tried_publickey = 1;
396778f1 2497 }
51470298 2498 s->p += 4;
2499 s->p += ssh1_read_bignum(s->p, &s->key.exponent);
2500 s->p += ssh1_read_bignum(s->p, &s->key.modulus);
2501 s->commentlen = GET_32BIT(s->p);
2502 s->p += 4;
d8baa528 2503 s->commentp = (char *)s->p;
51470298 2504 s->p += s->commentlen;
2505 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
2506 PKT_BIGNUM, s->key.modulus, PKT_END);
32874aea 2507 crWaitUntil(ispkt);
51470298 2508 if (ssh->pktin.type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
32874aea 2509 logevent("Key refused");
2510 continue;
2511 }
2512 logevent("Received RSA challenge");
51470298 2513 ssh1_read_bignum(ssh->pktin.body, &s->challenge);
32874aea 2514 {
2515 char *agentreq, *q, *ret;
2d466ffd 2516 void *vret;
32874aea 2517 int len, retlen;
2518 len = 1 + 4; /* message type, bit count */
51470298 2519 len += ssh1_bignum_length(s->key.exponent);
2520 len += ssh1_bignum_length(s->key.modulus);
2521 len += ssh1_bignum_length(s->challenge);
32874aea 2522 len += 16; /* session id */
2523 len += 4; /* response format */
2524 agentreq = smalloc(4 + len);
2525 PUT_32BIT(agentreq, len);
2526 q = agentreq + 4;
2527 *q++ = SSH1_AGENTC_RSA_CHALLENGE;
51470298 2528 PUT_32BIT(q, bignum_bitcount(s->key.modulus));
32874aea 2529 q += 4;
51470298 2530 q += ssh1_write_bignum(q, s->key.exponent);
2531 q += ssh1_write_bignum(q, s->key.modulus);
2532 q += ssh1_write_bignum(q, s->challenge);
2533 memcpy(q, s->session_id, 16);
32874aea 2534 q += 16;
2535 PUT_32BIT(q, 1); /* response format */
2d466ffd 2536 agent_query(agentreq, len + 4, &vret, &retlen);
2537 ret = vret;
32874aea 2538 sfree(agentreq);
2539 if (ret) {
2540 if (ret[4] == SSH1_AGENT_RSA_RESPONSE) {
2541 logevent("Sending Pageant's response");
51470298 2542 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
32874aea 2543 PKT_DATA, ret + 5, 16,
2544 PKT_END);
2545 sfree(ret);
2546 crWaitUntil(ispkt);
51470298 2547 if (ssh->pktin.type == SSH1_SMSG_SUCCESS) {
32874aea 2548 logevent
2549 ("Pageant's response accepted");
2550 if (flags & FLAG_VERBOSE) {
51470298 2551 c_write_str(ssh, "Authenticated using"
2552 " RSA key \"");
2553 c_write(ssh, s->commentp,
2554 s->commentlen);
2555 c_write_str(ssh, "\" from agent\r\n");
32874aea 2556 }
51470298 2557 s->authed = TRUE;
32874aea 2558 } else
2559 logevent
2560 ("Pageant's response not accepted");
2561 } else {
2562 logevent
2563 ("Pageant failed to answer challenge");
2564 sfree(ret);
2565 }
2566 } else {
2567 logevent("No reply received from Pageant");
2568 }
2569 }
51470298 2570 freebn(s->key.exponent);
2571 freebn(s->key.modulus);
2572 freebn(s->challenge);
2573 if (s->authed)
32874aea 2574 break;
2575 }
2576 }
51470298 2577 if (s->authed)
32874aea 2578 break;
2579 }
51470298 2580 if (*cfg.keyfile && !s->tried_publickey)
2581 s->pwpkt_type = SSH1_CMSG_AUTH_RSA;
32874aea 2582
614a20a0 2583 if (cfg.try_tis_auth &&
51470298 2584 (s->supported_auths_mask & (1 << SSH1_AUTH_TIS)) &&
2585 !s->tis_auth_refused) {
2586 s->pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
32874aea 2587 logevent("Requested TIS authentication");
51470298 2588 send_packet(ssh, SSH1_CMSG_AUTH_TIS, PKT_END);
32874aea 2589 crWaitUntil(ispkt);
51470298 2590 if (ssh->pktin.type != SSH1_SMSG_AUTH_TIS_CHALLENGE) {
32874aea 2591 logevent("TIS authentication declined");
2592 if (flags & FLAG_INTERACTIVE)
51470298 2593 c_write_str(ssh, "TIS authentication refused.\r\n");
2594 s->tis_auth_refused = 1;
614a20a0 2595 continue;
32874aea 2596 } else {
51470298 2597 int challengelen = GET_32BIT(ssh->pktin.body);
32874aea 2598 logevent("Received TIS challenge");
51470298 2599 if (challengelen > sizeof(s->prompt) - 1)
2600 challengelen = sizeof(s->prompt) - 1;/* prevent overrun */
2601 memcpy(s->prompt, ssh->pktin.body + 4, challengelen);
614a20a0 2602 /* Prompt heuristic comes from OpenSSH */
51470298 2603 strncpy(s->prompt + challengelen,
2604 memchr(s->prompt, '\n', challengelen) ?
614a20a0 2605 "": "\r\nResponse: ",
51470298 2606 (sizeof s->prompt) - challengelen);
2607 s->prompt[(sizeof s->prompt) - 1] = '\0';
32874aea 2608 }
2609 }
614a20a0 2610 if (cfg.try_tis_auth &&
51470298 2611 (s->supported_auths_mask & (1 << SSH1_AUTH_CCARD)) &&
2612 !s->ccard_auth_refused) {
2613 s->pwpkt_type = SSH1_CMSG_AUTH_CCARD_RESPONSE;
32874aea 2614 logevent("Requested CryptoCard authentication");
51470298 2615 send_packet(ssh, SSH1_CMSG_AUTH_CCARD, PKT_END);
32874aea 2616 crWaitUntil(ispkt);
51470298 2617 if (ssh->pktin.type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
32874aea 2618 logevent("CryptoCard authentication declined");
51470298 2619 c_write_str(ssh, "CryptoCard authentication refused.\r\n");
2620 s->ccard_auth_refused = 1;
614a20a0 2621 continue;
32874aea 2622 } else {
51470298 2623 int challengelen = GET_32BIT(ssh->pktin.body);
32874aea 2624 logevent("Received CryptoCard challenge");
51470298 2625 if (challengelen > sizeof(s->prompt) - 1)
2626 challengelen = sizeof(s->prompt) - 1;/* prevent overrun */
2627 memcpy(s->prompt, ssh->pktin.body + 4, challengelen);
2628 strncpy(s->prompt + challengelen,
2629 memchr(s->prompt, '\n', challengelen) ?
614a20a0 2630 "" : "\r\nResponse: ",
51470298 2631 sizeof(s->prompt) - challengelen);
2632 s->prompt[sizeof(s->prompt) - 1] = '\0';
32874aea 2633 }
2634 }
51470298 2635 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
2636 sprintf(s->prompt, "%.90s@%.90s's password: ",
2637 s->username, ssh->savedhost);
32874aea 2638 }
51470298 2639 if (s->pwpkt_type == SSH1_CMSG_AUTH_RSA) {
32874aea 2640 char *comment = NULL;
231ee168 2641 int type;
2642 char msgbuf[256];
32874aea 2643 if (flags & FLAG_VERBOSE)
51470298 2644 c_write_str(ssh, "Trying public key authentication.\r\n");
57356d63 2645 logeventf(ssh, "Trying public key \"%s\"", cfg.keyfile);
231ee168 2646 type = key_type(cfg.keyfile);
2647 if (type != SSH_KEYTYPE_SSH1) {
2648 sprintf(msgbuf, "Key is of wrong type (%s)",
2649 key_type_to_str(type));
2650 logevent(msgbuf);
51470298 2651 c_write_str(ssh, msgbuf);
2652 c_write_str(ssh, "\r\n");
2653 s->tried_publickey = 1;
231ee168 2654 continue;
2655 }
32874aea 2656 if (!rsakey_encrypted(cfg.keyfile, &comment)) {
2657 if (flags & FLAG_VERBOSE)
51470298 2658 c_write_str(ssh, "No passphrase required.\r\n");
32874aea 2659 goto tryauth;
2660 }
51470298 2661 sprintf(s->prompt, "Passphrase for key \"%.100s\": ", comment);
32874aea 2662 sfree(comment);
2663 }
a52f067e 2664
614a20a0 2665 /*
2666 * Show password prompt, having first obtained it via a TIS
2667 * or CryptoCard exchange if we're doing TIS or CryptoCard
2668 * authentication.
2669 */
fa17a66e 2670 if (ssh_get_line) {
51470298 2671 if (!ssh_get_line(s->prompt, s->password,
2672 sizeof(s->password), TRUE)) {
32874aea 2673 /*
2674 * get_line failed to get a password (for example
2675 * because one was supplied on the command line
2676 * which has already failed to work). Terminate.
2677 */
51470298 2678 send_packet(ssh, SSH1_MSG_DISCONNECT,
2bc6a386 2679 PKT_STR, "No more passwords available to try",
2680 PKT_END);
247308b5 2681 logevent("Unable to authenticate");
a8327734 2682 connection_fatal(ssh->frontend, "Unable to authenticate");
51470298 2683 ssh->state = SSH_STATE_CLOSED;
32874aea 2684 crReturn(1);
2685 }
fb09bf1c 2686 } else {
614a20a0 2687 /* Prompt may have come from server. We've munged it a bit, so
2688 * we know it to be zero-terminated at least once. */
51470298 2689 int ret; /* need not be saved over crReturn */
2690 c_write_untrusted(ssh, s->prompt, strlen(s->prompt));
2691 s->pos = 0;
0405e71f 2692
51470298 2693 setup_userpass_input(ssh, s->password, sizeof(s->password), 0);
0405e71f 2694 do {
32874aea 2695 crWaitUntil(!ispkt);
51470298 2696 ret = process_userpass_input(ssh, in, inlen);
0405e71f 2697 } while (ret == 0);
2698 if (ret < 0)
2699 cleanup_exit(0);
51470298 2700 c_write_str(ssh, "\r\n");
32874aea 2701 }
2702
2703 tryauth:
51470298 2704 if (s->pwpkt_type == SSH1_CMSG_AUTH_RSA) {
32874aea 2705 /*
2706 * Try public key authentication with the specified
2707 * key file.
2708 */
51470298 2709 s->tried_publickey = 1;
2710
2711 {
2712 int ret = loadrsakey(cfg.keyfile, &s->key, s->password);
2713 if (ret == 0) {
2714 c_write_str(ssh, "Couldn't load private key from ");
2715 c_write_str(ssh, cfg.keyfile);
2716 c_write_str(ssh, ".\r\n");
2717 continue; /* go and try password */
2718 }
2719 if (ret == -1) {
2720 c_write_str(ssh, "Wrong passphrase.\r\n");
2721 s->tried_publickey = 0;
2722 continue; /* try again */
2723 }
32874aea 2724 }
2725
2726 /*
2727 * Send a public key attempt.
2728 */
51470298 2729 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
2730 PKT_BIGNUM, s->key.modulus, PKT_END);
32874aea 2731
2732 crWaitUntil(ispkt);
51470298 2733 if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
2734 c_write_str(ssh, "Server refused our public key.\r\n");
32874aea 2735 continue; /* go and try password */
2736 }
51470298 2737 if (ssh->pktin.type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
a8327734 2738 bombout((ssh,"Bizarre response to offer of public key"));
32874aea 2739 crReturn(0);
2740 }
32874aea 2741
51470298 2742 {
2743 int i;
2744 unsigned char buffer[32];
2745 Bignum challenge, response;
2746
2747 ssh1_read_bignum(ssh->pktin.body, &challenge);
2748 response = rsadecrypt(challenge, &s->key);
2749 freebn(s->key.private_exponent);/* burn the evidence */
32874aea 2750
51470298 2751 for (i = 0; i < 32; i++) {
2752 buffer[i] = bignum_byte(response, 31 - i);
2753 }
2754
2755 MD5Init(&md5c);
2756 MD5Update(&md5c, buffer, 32);
2757 MD5Update(&md5c, s->session_id, 16);
2758 MD5Final(buffer, &md5c);
32874aea 2759
51470298 2760 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
2761 PKT_DATA, buffer, 16, PKT_END);
2762
2763 freebn(challenge);
2764 freebn(response);
2765 }
32874aea 2766
2767 crWaitUntil(ispkt);
51470298 2768 if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
32874aea 2769 if (flags & FLAG_VERBOSE)
51470298 2770 c_write_str(ssh, "Failed to authenticate with"
2771 " our public key.\r\n");
32874aea 2772 continue; /* go and try password */
51470298 2773 } else if (ssh->pktin.type != SSH1_SMSG_SUCCESS) {
a8327734 2774 bombout((ssh,"Bizarre response to RSA authentication response"));
32874aea 2775 crReturn(0);
2776 }
2777
2778 break; /* we're through! */
2779 } else {
51470298 2780 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
32874aea 2781 /*
2782 * Defence against traffic analysis: we send a
2783 * whole bunch of packets containing strings of
2784 * different lengths. One of these strings is the
2785 * password, in a SSH1_CMSG_AUTH_PASSWORD packet.
2786 * The others are all random data in
2787 * SSH1_MSG_IGNORE packets. This way a passive
2788 * listener can't tell which is the password, and
2789 * hence can't deduce the password length.
2790 *
2791 * Anybody with a password length greater than 16
2792 * bytes is going to have enough entropy in their
2793 * password that a listener won't find it _that_
2794 * much help to know how long it is. So what we'll
2795 * do is:
2796 *
2797 * - if password length < 16, we send 15 packets
2798 * containing string lengths 1 through 15
2799 *
2800 * - otherwise, we let N be the nearest multiple
2801 * of 8 below the password length, and send 8
2802 * packets containing string lengths N through
2803 * N+7. This won't obscure the order of
2804 * magnitude of the password length, but it will
2805 * introduce a bit of extra uncertainty.
2806 *
2807 * A few servers (the old 1.2.18 through 1.2.22)
2808 * can't deal with SSH1_MSG_IGNORE. For these
2809 * servers, we need an alternative defence. We make
2810 * use of the fact that the password is interpreted
2811 * as a C string: so we can append a NUL, then some
2812 * random data.
bd358db1 2813 *
2814 * One server (a Cisco one) can deal with neither
2815 * SSH1_MSG_IGNORE _nor_ a padded password string.
2816 * For this server we are left with no defences
2817 * against password length sniffing.
32874aea 2818 */
51470298 2819 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE)) {
b17c8428 2820 /*
2821 * The server can deal with SSH1_MSG_IGNORE, so
2822 * we can use the primary defence.
2823 */
32874aea 2824 int bottom, top, pwlen, i;
2825 char *randomstr;
2826
51470298 2827 pwlen = strlen(s->password);
32874aea 2828 if (pwlen < 16) {
2829 bottom = 0; /* zero length passwords are OK! :-) */
2830 top = 15;
2831 } else {
2832 bottom = pwlen & ~7;
2833 top = bottom + 7;
2834 }
2835
2836 assert(pwlen >= bottom && pwlen <= top);
2837
2838 randomstr = smalloc(top + 1);
2839
2840 for (i = bottom; i <= top; i++) {
2841 if (i == pwlen)
51470298 2842 defer_packet(ssh, s->pwpkt_type,
2843 PKT_STR, s->password, PKT_END);
32874aea 2844 else {
2845 for (j = 0; j < i; j++) {
2846 do {
2847 randomstr[j] = random_byte();
2848 } while (randomstr[j] == '\0');
2849 }
2850 randomstr[i] = '\0';
51470298 2851 defer_packet(ssh, SSH1_MSG_IGNORE,
32874aea 2852 PKT_STR, randomstr, PKT_END);
2853 }
2854 }
bd358db1 2855 logevent("Sending password with camouflage packets");
51470298 2856 ssh_pkt_defersend(ssh);
bd358db1 2857 }
51470298 2858 else if (!(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
b17c8428 2859 /*
2860 * The server can't deal with SSH1_MSG_IGNORE
2861 * but can deal with padded passwords, so we
2862 * can use the secondary defence.
2863 */
bd358db1 2864 char string[64];
51470298 2865 char *ss;
bd358db1 2866 int len;
2867
51470298 2868 len = strlen(s->password);
bd358db1 2869 if (len < sizeof(string)) {
51470298 2870 ss = string;
2871 strcpy(string, s->password);
bd358db1 2872 len++; /* cover the zero byte */
2873 while (len < sizeof(string)) {
2874 string[len++] = (char) random_byte();
2875 }
2876 } else {
51470298 2877 ss = s->password;
bd358db1 2878 }
2879 logevent("Sending length-padded password");
51470298 2880 send_packet(ssh, s->pwpkt_type, PKT_INT, len,
2881 PKT_DATA, ss, len, PKT_END);
bd358db1 2882 } else {
2883 /*
2884 * The server has _both_
2885 * BUG_CHOKES_ON_SSH1_IGNORE and
2886 * BUG_NEEDS_SSH1_PLAIN_PASSWORD. There is
2887 * therefore nothing we can do.
2888 */
2889 int len;
51470298 2890 len = strlen(s->password);
bd358db1 2891 logevent("Sending unpadded password");
51470298 2892 send_packet(ssh, s->pwpkt_type, PKT_INT, len,
2893 PKT_DATA, s->password, len, PKT_END);
32874aea 2894 }
2895 } else {
51470298 2896 send_packet(ssh, s->pwpkt_type, PKT_STR, s->password, PKT_END);
32874aea 2897 }
2898 }
c5e9c988 2899 logevent("Sent password");
51470298 2900 memset(s->password, 0, strlen(s->password));
fb09bf1c 2901 crWaitUntil(ispkt);
51470298 2902 if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
32874aea 2903 if (flags & FLAG_VERBOSE)
51470298 2904 c_write_str(ssh, "Access denied\r\n");
c5e9c988 2905 logevent("Authentication refused");
51470298 2906 } else if (ssh->pktin.type != SSH1_SMSG_SUCCESS) {
a8327734 2907 bombout((ssh,"Strange packet received, type %d", ssh->pktin.type));
32874aea 2908 crReturn(0);
374330e2 2909 }
2910 }
2911
c5e9c988 2912 logevent("Authentication successful");
2913
fb09bf1c 2914 crFinish(1);
2915}
2916
32874aea 2917void sshfwd_close(struct ssh_channel *c)
2918{
51470298 2919 Ssh ssh = c->ssh;
2920
80e48603 2921 if (c && !c->closes) {
4ed34d25 2922 /*
2923 * If the channel's remoteid is -1, we have sent
2924 * CHANNEL_OPEN for this channel, but it hasn't even been
2925 * acknowledged by the server. So we must set a close flag
2926 * on it now, and then when the server acks the channel
2927 * open, we can close it then.
2928 */
36cac739 2929 if (((int)c->remoteid) != -1) {
51470298 2930 if (ssh->version == 1) {
2931 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
4ed34d25 2932 PKT_END);
2933 } else {
51470298 2934 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_CLOSE);
2935 ssh2_pkt_adduint32(ssh, c->remoteid);
2936 ssh2_pkt_send(ssh);
4ed34d25 2937 }
32874aea 2938 }
0357890f 2939 c->closes = 1; /* sent MSG_CLOSE */
32874aea 2940 if (c->type == CHAN_X11) {
2941 c->u.x11.s = NULL;
d74d141c 2942 logevent("Forwarded X11 connection terminated");
4ed34d25 2943 } else if (c->type == CHAN_SOCKDATA ||
2944 c->type == CHAN_SOCKDATA_DORMANT) {
d74d141c 2945 c->u.pfd.s = NULL;
2946 logevent("Forwarded port closed");
32874aea 2947 }
2948 }
2949}
2950
5471d09a 2951int sshfwd_write(struct ssh_channel *c, char *buf, int len)
32874aea 2952{
51470298 2953 Ssh ssh = c->ssh;
2954
2955 if (ssh->version == 1) {
2956 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
32874aea 2957 PKT_INT, c->remoteid,
2958 PKT_INT, len, PKT_DATA, buf, len, PKT_END);
5471d09a 2959 /*
2960 * In SSH1 we can return 0 here - implying that forwarded
2961 * connections are never individually throttled - because
2962 * the only circumstance that can cause throttling will be
2963 * the whole SSH connection backing up, in which case
2964 * _everything_ will be throttled as a whole.
2965 */
2966 return 0;
783415f8 2967 } else {
32874aea 2968 ssh2_add_channel_data(c, buf, len);
5471d09a 2969 return ssh2_try_send(c);
2970 }
2971}
2972
2973void sshfwd_unthrottle(struct ssh_channel *c, int bufsize)
2974{
51470298 2975 Ssh ssh = c->ssh;
2976
2977 if (ssh->version == 1) {
5471d09a 2978 if (c->v.v1.throttling && bufsize < SSH1_BUFFER_LIMIT) {
2979 c->v.v1.throttling = 0;
51470298 2980 ssh1_throttle(ssh, -1);
5471d09a 2981 }
2982 } else {
2983 ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
783415f8 2984 }
9c964e85 2985}
2986
51470298 2987static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt)
32874aea 2988{
51470298 2989 crBegin(ssh->ssh1_protocol_crstate);
fb09bf1c 2990
2991 random_init();
2992
51470298 2993 while (!do_ssh1_login(ssh, in, inlen, ispkt)) {
fb09bf1c 2994 crReturnV;
85ee8208 2995 }
51470298 2996 if (ssh->state == SSH_STATE_CLOSED)
32874aea 2997 crReturnV;
fb09bf1c 2998
979310f1 2999 if (cfg.agentfwd && agent_exists()) {
32874aea 3000 logevent("Requesting agent forwarding");
51470298 3001 send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END);
32874aea 3002 do {
3003 crReturnV;
3004 } while (!ispkt);
51470298 3005 if (ssh->pktin.type != SSH1_SMSG_SUCCESS
3006 && ssh->pktin.type != SSH1_SMSG_FAILURE) {
a8327734 3007 bombout((ssh,"Protocol confusion"));
32874aea 3008 crReturnV;
51470298 3009 } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
32874aea 3010 logevent("Agent forwarding refused");
3011 } else {
3012 logevent("Agent forwarding enabled");
51470298 3013 ssh->agentfwd_enabled = TRUE;
db7d555c 3014 }
dacbd0e8 3015 }
3016
9c964e85 3017 if (cfg.x11_forward) {
32874aea 3018 char proto[20], data[64];
3019 logevent("Requesting X11 forwarding");
302121de 3020 ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
3021 data, sizeof(data));
51470298 3022 if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) {
3023 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
32874aea 3024 PKT_STR, proto, PKT_STR, data,
421d6835 3025 PKT_INT, x11_get_screen_number(cfg.x11_display),
3026 PKT_END);
32874aea 3027 } else {
51470298 3028 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
32874aea 3029 PKT_STR, proto, PKT_STR, data, PKT_END);
3030 }
3031 do {
3032 crReturnV;
3033 } while (!ispkt);
51470298 3034 if (ssh->pktin.type != SSH1_SMSG_SUCCESS
3035 && ssh->pktin.type != SSH1_SMSG_FAILURE) {
a8327734 3036 bombout((ssh,"Protocol confusion"));
32874aea 3037 crReturnV;
51470298 3038 } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
32874aea 3039 logevent("X11 forwarding refused");
3040 } else {
3041 logevent("X11 forwarding enabled");
51470298 3042 ssh->X11_fwd_enabled = TRUE;
9c964e85 3043 }
3044 }
3045
d74d141c 3046 {
9bf696b1 3047 char type;
d74d141c 3048 int n;
a4fc0d74 3049 int sport,dport,sserv,dserv;
6ee9b735 3050 char sports[256], dports[256], saddr[256], host[256];
d74d141c 3051
51470298 3052 ssh->rportfwds = newtree234(ssh_rportcmp_ssh1);
d74d141c 3053 /* Add port forwardings. */
51470298 3054 ssh->portfwd_strptr = cfg.portfwd;
3055 while (*ssh->portfwd_strptr) {
3056 type = *ssh->portfwd_strptr++;
6ee9b735 3057 saddr[0] = '\0';
d74d141c 3058 n = 0;
6ee9b735 3059 while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') {
3060 if (*ssh->portfwd_strptr == ':') {
3061 /*
3062 * We've seen a colon in the middle of the
3063 * source port number. This means that
3064 * everything we've seen until now is the
3065 * source _address_, so we'll move it into
3066 * saddr and start sports from the beginning
3067 * again.
3068 */
3069 ssh->portfwd_strptr++;
3070 sports[n] = '\0';
3071 strcpy(saddr, sports);
3072 n = 0;
3073 }
3074 if (n < 255) sports[n++] = *ssh->portfwd_strptr++;
3075 }
d74d141c 3076 sports[n] = 0;
51470298 3077 if (*ssh->portfwd_strptr == '\t')
3078 ssh->portfwd_strptr++;
d74d141c 3079 n = 0;
6ee9b735 3080 while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') {
3081 if (n < 255) host[n++] = *ssh->portfwd_strptr++;
3082 }
d74d141c 3083 host[n] = 0;
51470298 3084 if (*ssh->portfwd_strptr == ':')
3085 ssh->portfwd_strptr++;
d74d141c 3086 n = 0;
6ee9b735 3087 while (*ssh->portfwd_strptr) {
3088 if (n < 255) dports[n++] = *ssh->portfwd_strptr++;
3089 }
d74d141c 3090 dports[n] = 0;
51470298 3091 ssh->portfwd_strptr++;
d74d141c 3092 dport = atoi(dports);
a4fc0d74 3093 dserv = 0;
3094 if (dport == 0) {
3095 dserv = 1;
68a49acb 3096 dport = net_service_lookup(dports);
3097 if (!dport) {
57356d63 3098 logeventf(ssh, "Service lookup failed for"
3099 " destination port \"%s\"", dports);
a4fc0d74 3100 }
3101 }
d74d141c 3102 sport = atoi(sports);
a4fc0d74 3103 sserv = 0;
3104 if (sport == 0) {
3105 sserv = 1;
68a49acb 3106 sport = net_service_lookup(sports);
3107 if (!sport) {
57356d63 3108 logeventf(ssh, "Service lookup failed for source"
3109 " port \"%s\"", sports);
a4fc0d74 3110 }
3111 }
d74d141c 3112 if (sport && dport) {
3113 if (type == 'L') {
6ee9b735 3114 pfd_addforward(host, dport, *saddr ? saddr : NULL,
3115 sport, ssh);
3116 logeventf(ssh, "Local port %.*s%.*s%.*s%.*s%d%.*s"
3117 " forwarding to %s:%.*s%.*s%d%.*s",
3118 (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL,
3119 (int)(*saddr?1:0), ":",
57356d63 3120 (int)(sserv ? strlen(sports) : 0), sports,
3121 sserv, "(", sport, sserv, ")",
3122 host,
3123 (int)(dserv ? strlen(dports) : 0), dports,
3124 dserv, "(", dport, dserv, ")");
d74d141c 3125 } else {
3126 struct ssh_rportfwd *pf;
3127 pf = smalloc(sizeof(*pf));
bc240b21 3128 strcpy(pf->dhost, host);
3129 pf->dport = dport;
6ee9b735 3130 if (saddr) {
3131 logeventf(ssh,
3132 "SSH1 cannot handle source address spec \"%s:%d\"; ignoring",
3133 saddr, sport);
3134 }
51470298 3135 if (add234(ssh->rportfwds, pf) != pf) {
57356d63 3136 logeventf(ssh,
3137 "Duplicate remote port forwarding to %s:%d",
3138 host, dport);
bc240b21 3139 sfree(pf);
d74d141c 3140 } else {
57356d63 3141 logeventf(ssh, "Requesting remote port %.*s%.*s%d%.*s"
3142 " forward to %s:%.*s%.*s%d%.*s",
3143 (int)(sserv ? strlen(sports) : 0), sports,
3144 sserv, "(", sport, sserv, ")",
3145 host,
3146 (int)(dserv ? strlen(dports) : 0), dports,
3147 dserv, "(", dport, dserv, ")");
51470298 3148 send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST,
d74d141c 3149 PKT_INT, sport,
3150 PKT_STR, host,
3151 PKT_INT, dport,
3152 PKT_END);
9bf696b1 3153 do {
3154 crReturnV;
3155 } while (!ispkt);
51470298 3156 if (ssh->pktin.type != SSH1_SMSG_SUCCESS
3157 && ssh->pktin.type != SSH1_SMSG_FAILURE) {
a8327734 3158 bombout((ssh,"Protocol confusion"));
9bf696b1 3159 crReturnV;
51470298 3160 } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
3161 c_write_str(ssh, "Server refused port"
3162 " forwarding\r\n");
9bf696b1 3163 }
3164 logevent("Remote port forwarding enabled");
d74d141c 3165 }
3166 }
3167 }
3168 }
3169 }
3170
fef97f43 3171 if (!cfg.nopty) {
51470298 3172 send_packet(ssh, SSH1_CMSG_REQUEST_PTY,
32874aea 3173 PKT_STR, cfg.termtype,
51470298 3174 PKT_INT, ssh->term_height,
3175 PKT_INT, ssh->term_width,
32874aea 3176 PKT_INT, 0, PKT_INT, 0, PKT_CHAR, 0, PKT_END);
51470298 3177 ssh->state = SSH_STATE_INTERMED;
32874aea 3178 do {
3179 crReturnV;
3180 } while (!ispkt);
51470298 3181 if (ssh->pktin.type != SSH1_SMSG_SUCCESS
3182 && ssh->pktin.type != SSH1_SMSG_FAILURE) {
a8327734 3183 bombout((ssh,"Protocol confusion"));
32874aea 3184 crReturnV;
51470298 3185 } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
3186 c_write_str(ssh, "Server refused to allocate pty\r\n");
3187 ssh->editing = ssh->echoing = 1;
32874aea 3188 }
c5e9c988 3189 logevent("Allocated pty");
0965bee0 3190 } else {
51470298 3191 ssh->editing = ssh->echoing = 1;
374330e2 3192 }
3193
4ba9b64b 3194 if (cfg.compression) {
51470298 3195 send_packet(ssh, SSH1_CMSG_REQUEST_COMPRESSION, PKT_INT, 6, PKT_END);
32874aea 3196 do {
3197 crReturnV;
3198 } while (!ispkt);
51470298 3199 if (ssh->pktin.type != SSH1_SMSG_SUCCESS
3200 && ssh->pktin.type != SSH1_SMSG_FAILURE) {
a8327734 3201 bombout((ssh,"Protocol confusion"));
32874aea 3202 crReturnV;
51470298 3203 } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
3204 c_write_str(ssh, "Server refused to compress\r\n");
32874aea 3205 }
4ba9b64b 3206 logevent("Started compression");
51470298 3207 ssh->v1_compressing = TRUE;
5366aed8 3208 ssh->cs_comp_ctx = zlib_compress_init();
3209 logevent("Initialised zlib (RFC1950) compression");
3210 ssh->sc_comp_ctx = zlib_decompress_init();
3211 logevent("Initialised zlib (RFC1950) decompression");
4ba9b64b 3212 }
3213
fd5e5847 3214 /*
3215 * Start the shell or command.
3216 *
3217 * Special case: if the first-choice command is an SSH2
3218 * subsystem (hence not usable here) and the second choice
3219 * exists, we fall straight back to that.
3220 */
3221 {
3222 char *cmd = cfg.remote_cmd_ptr;
3223
3224 if (cfg.ssh_subsys && cfg.remote_cmd_ptr2) {
3225 cmd = cfg.remote_cmd_ptr2;
51470298 3226 ssh->fallback_cmd = TRUE;
fd5e5847 3227 }
3228 if (*cmd)
51470298 3229 send_packet(ssh, SSH1_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END);
fd5e5847 3230 else
51470298 3231 send_packet(ssh, SSH1_CMSG_EXEC_SHELL, PKT_END);
fd5e5847 3232 logevent("Started session");
3233 }
374330e2 3234
51470298 3235 ssh->state = SSH_STATE_SESSION;
3236 if (ssh->size_needed)
3237 ssh_size(ssh, ssh->term_width, ssh->term_height);
3238 if (ssh->eof_needed)
3239 ssh_special(ssh, TS_EOF);
374330e2 3240
b9d7bcad 3241 if (ssh->ldisc)
3242 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
51470298 3243 ssh->send_ok = 1;
3244 ssh->channels = newtree234(ssh_channelcmp);
374330e2 3245 while (1) {
3246 crReturnV;
3247 if (ispkt) {
51470298 3248 if (ssh->pktin.type == SSH1_SMSG_STDOUT_DATA ||
3249 ssh->pktin.type == SSH1_SMSG_STDERR_DATA) {
3250 long len = GET_32BIT(ssh->pktin.body);
5471d09a 3251 int bufsize =
51470298 3252 from_backend(ssh->frontend,
3253 ssh->pktin.type == SSH1_SMSG_STDERR_DATA,
d8baa528 3254 (char *)(ssh->pktin.body) + 4, len);
51470298 3255 if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
3256 ssh->v1_stdout_throttling = 1;
3257 ssh1_throttle(ssh, +1);
5471d09a 3258 }
51470298 3259 } else if (ssh->pktin.type == SSH1_MSG_DISCONNECT) {
3260 ssh->state = SSH_STATE_CLOSED;
c5e9c988 3261 logevent("Received disconnect request");
32874aea 3262 crReturnV;
51470298 3263 } else if (ssh->pktin.type == SSH1_SMSG_X11_OPEN) {
32874aea 3264 /* Remote side is trying to open a channel to talk to our
3265 * X-Server. Give them back a local channel number. */
3266 struct ssh_channel *c;
9c964e85 3267
3268 logevent("Received X11 connect request");
3269 /* Refuse if X11 forwarding is disabled. */
51470298 3270 if (!ssh->X11_fwd_enabled) {
3271 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
3272 PKT_INT, GET_32BIT(ssh->pktin.body), PKT_END);
9c964e85 3273 logevent("Rejected X11 connect request");
3274 } else {
9c964e85 3275 c = smalloc(sizeof(struct ssh_channel));
51470298 3276 c->ssh = ssh;
9c964e85 3277
302121de 3278 if (x11_init(&c->u.x11.s, cfg.x11_display, c,
3279 ssh->x11auth) != NULL) {
32874aea 3280 logevent("opening X11 forward connection failed");
3281 sfree(c);
51470298 3282 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
3283 PKT_INT, GET_32BIT(ssh->pktin.body),
32874aea 3284 PKT_END);
9c964e85 3285 } else {
32874aea 3286 logevent
3287 ("opening X11 forward connection succeeded");
51470298 3288 c->remoteid = GET_32BIT(ssh->pktin.body);
3289 c->localid = alloc_channel_id(ssh);
32874aea 3290 c->closes = 0;
5471d09a 3291 c->v.v1.throttling = 0;
32874aea 3292 c->type = CHAN_X11; /* identify channel type */
51470298 3293 add234(ssh->channels, c);
3294 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
32874aea 3295 PKT_INT, c->remoteid, PKT_INT,
3296 c->localid, PKT_END);
3297 logevent("Opened X11 forward channel");
9c964e85 3298 }
3299 }
51470298 3300 } else if (ssh->pktin.type == SSH1_SMSG_AGENT_OPEN) {
32874aea 3301 /* Remote side is trying to open a channel to talk to our
3302 * agent. Give them back a local channel number. */
3303 struct ssh_channel *c;
db7d555c 3304
3305 /* Refuse if agent forwarding is disabled. */
51470298 3306 if (!ssh->agentfwd_enabled) {
3307 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
3308 PKT_INT, GET_32BIT(ssh->pktin.body), PKT_END);
db7d555c 3309 } else {
dcbde236 3310 c = smalloc(sizeof(struct ssh_channel));
51470298 3311 c->ssh = ssh;
3312 c->remoteid = GET_32BIT(ssh->pktin.body);
3313 c->localid = alloc_channel_id(ssh);
db7d555c 3314 c->closes = 0;
5471d09a 3315 c->v.v1.throttling = 0;
32874aea 3316 c->type = CHAN_AGENT; /* identify channel type */
db7d555c 3317 c->u.a.lensofar = 0;
51470298 3318 add234(ssh->channels, c);
3319 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
db7d555c 3320 PKT_INT, c->remoteid, PKT_INT, c->localid,
3321 PKT_END);
3322 }
51470298 3323 } else if (ssh->pktin.type == SSH1_MSG_PORT_OPEN) {
d74d141c 3324 /* Remote side is trying to open a channel to talk to a
3325 * forwarded port. Give them back a local channel number. */
3326 struct ssh_channel *c;
3327 struct ssh_rportfwd pf;
3328 int hostsize, port;
3329 char host[256], buf[1024];
3330 char *p, *h, *e;
3331 c = smalloc(sizeof(struct ssh_channel));
51470298 3332 c->ssh = ssh;
d74d141c 3333
51470298 3334 hostsize = GET_32BIT(ssh->pktin.body+4);
d8baa528 3335 for (h = host, p = (char *)(ssh->pktin.body+8);
3336 hostsize != 0; hostsize--) {
d74d141c 3337 if (h+1 < host+sizeof(host))
3338 *h++ = *p;
95bc8819 3339 p++;
d74d141c 3340 }
3341 *h = 0;
3342 port = GET_32BIT(p);
3343
bc240b21 3344 strcpy(pf.dhost, host);
3345 pf.dport = port;
d74d141c 3346
51470298 3347 if (find234(ssh->rportfwds, &pf, NULL) == NULL) {
d74d141c 3348 sprintf(buf, "Rejected remote port open request for %s:%d",
3349 host, port);
3350 logevent(buf);
51470298 3351 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
3352 PKT_INT, GET_32BIT(ssh->pktin.body), PKT_END);
d74d141c 3353 } else {
3354 sprintf(buf, "Received remote port open request for %s:%d",
3355 host, port);
3356 logevent(buf);
3357 e = pfd_newconnect(&c->u.pfd.s, host, port, c);
3358 if (e != NULL) {
3359 char buf[256];
3360 sprintf(buf, "Port open failed: %s", e);
3361 logevent(buf);
3362 sfree(c);
51470298 3363 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
3364 PKT_INT, GET_32BIT(ssh->pktin.body),
d74d141c 3365 PKT_END);
3366 } else {
51470298 3367 c->remoteid = GET_32BIT(ssh->pktin.body);
3368 c->localid = alloc_channel_id(ssh);
d74d141c 3369 c->closes = 0;
5471d09a 3370 c->v.v1.throttling = 0;
d74d141c 3371 c->type = CHAN_SOCKDATA; /* identify channel type */
51470298 3372 add234(ssh->channels, c);
3373 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
d74d141c 3374 PKT_INT, c->remoteid, PKT_INT,
3375 c->localid, PKT_END);
3376 logevent("Forwarded port opened successfully");
3377 }
3378 }
3379
51470298 3380 } else if (ssh->pktin.type == SSH1_MSG_CHANNEL_OPEN_CONFIRMATION) {
3381 unsigned int remoteid = GET_32BIT(ssh->pktin.body);
3382 unsigned int localid = GET_32BIT(ssh->pktin.body+4);
bc240b21 3383 struct ssh_channel *c;
3384
51470298 3385 c = find234(ssh->channels, &remoteid, ssh_channelfind);
bc240b21 3386 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
3387 c->remoteid = localid;
3388 c->type = CHAN_SOCKDATA;
7781f316 3389 c->v.v1.throttling = 0;
bc240b21 3390 pfd_confirm(c->u.pfd.s);
3391 }
d74d141c 3392
4ed34d25 3393 if (c && c->closes) {
3394 /*
3395 * We have a pending close on this channel,
3396 * which we decided on before the server acked
3397 * the channel open. So now we know the
3398 * remoteid, we can close it again.
3399 */
51470298 3400 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE,
3401 PKT_INT, c->remoteid, PKT_END);
4ed34d25 3402 }
3403
51470298 3404 } else if (ssh->pktin.type == SSH1_MSG_CHANNEL_OPEN_FAILURE) {
3405 unsigned int remoteid = GET_32BIT(ssh->pktin.body);
724cface 3406 struct ssh_channel *c;
3407
51470298 3408 c = find234(ssh->channels, &remoteid, ssh_channelfind);
724cface 3409 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
3410 logevent("Forwarded connection refused by server");
3411 pfd_close(c->u.pfd.s);
51470298 3412 del234(ssh->channels, c);
724cface 3413 sfree(c);
3414 }
3415
51470298 3416 } else if (ssh->pktin.type == SSH1_MSG_CHANNEL_CLOSE ||
3417 ssh->pktin.type == SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION) {
32874aea 3418 /* Remote side closes a channel. */
51470298 3419 unsigned i = GET_32BIT(ssh->pktin.body);
32874aea 3420 struct ssh_channel *c;
51470298 3421 c = find234(ssh->channels, &i, ssh_channelfind);
d0d844c1 3422 if (c && ((int)c->remoteid) != -1) {
32874aea 3423 int closetype;
3424 closetype =
51470298 3425 (ssh->pktin.type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2);
0357890f 3426
783415f8 3427 if ((c->closes == 0) && (c->type == CHAN_X11)) {
d74d141c 3428 logevent("Forwarded X11 connection terminated");
9c964e85 3429 assert(c->u.x11.s != NULL);
3430 x11_close(c->u.x11.s);
3431 c->u.x11.s = NULL;
3432 }
d74d141c 3433 if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) {
3434 logevent("Forwarded port closed");
3435 assert(c->u.pfd.s != NULL);
3436 pfd_close(c->u.pfd.s);
3437 c->u.pfd.s = NULL;
3438 }
0357890f 3439
3440 c->closes |= (closetype << 2); /* seen this message */
3441 if (!(c->closes & closetype)) {
51470298 3442 send_packet(ssh, ssh->pktin.type, PKT_INT, c->remoteid,
0357890f 3443 PKT_END);
3444 c->closes |= closetype; /* sent it too */
3445 }
3446
3447 if (c->closes == 15) {
51470298 3448 del234(ssh->channels, c);
32874aea 3449 sfree(c);
3450 }
d0d844c1 3451 } else {
a8327734 3452 bombout((ssh,"Received CHANNEL_CLOSE%s for %s channel %d\n",
51470298 3453 ssh->pktin.type == SSH1_MSG_CHANNEL_CLOSE ? "" :
d0d844c1 3454 "_CONFIRMATION", c ? "half-open" : "nonexistent",
3455 i));
32874aea 3456 }
51470298 3457 } else if (ssh->pktin.type == SSH1_MSG_CHANNEL_DATA) {
32874aea 3458 /* Data sent down one of our channels. */
51470298 3459 int i = GET_32BIT(ssh->pktin.body);
3460 int len = GET_32BIT(ssh->pktin.body + 4);
3461 unsigned char *p = ssh->pktin.body + 8;
32874aea 3462 struct ssh_channel *c;
51470298 3463 c = find234(ssh->channels, &i, ssh_channelfind);
32874aea 3464 if (c) {
5471d09a 3465 int bufsize;
32874aea 3466 switch (c->type) {
3467 case CHAN_X11:
d8baa528 3468 bufsize = x11_send(c->u.x11.s, (char *)p, len);
9c964e85 3469 break;
d74d141c 3470 case CHAN_SOCKDATA:
d8baa528 3471 bufsize = pfd_send(c->u.pfd.s, (char *)p, len);
bc240b21 3472 break;
32874aea 3473 case CHAN_AGENT:
3474 /* Data for an agent message. Buffer it. */
3475 while (len > 0) {
3476 if (c->u.a.lensofar < 4) {
3477 int l = min(4 - c->u.a.lensofar, len);
3478 memcpy(c->u.a.msglen + c->u.a.lensofar, p,
3479 l);
3480 p += l;
3481 len -= l;
3482 c->u.a.lensofar += l;
3483 }
3484 if (c->u.a.lensofar == 4) {
3485 c->u.a.totallen =
3486 4 + GET_32BIT(c->u.a.msglen);
3487 c->u.a.message = smalloc(c->u.a.totallen);
3488 memcpy(c->u.a.message, c->u.a.msglen, 4);
3489 }
3490 if (c->u.a.lensofar >= 4 && len > 0) {
3491 int l =
3492 min(c->u.a.totallen - c->u.a.lensofar,
3493 len);
3494 memcpy(c->u.a.message + c->u.a.lensofar, p,
3495 l);
3496 p += l;
3497 len -= l;
3498 c->u.a.lensofar += l;
3499 }
3500 if (c->u.a.lensofar == c->u.a.totallen) {
3501 void *reply, *sentreply;
3502 int replylen;
3503 agent_query(c->u.a.message,
3504 c->u.a.totallen, &reply,
3505 &replylen);
3506 if (reply)
3507 sentreply = reply;
3508 else {
3509 /* Fake SSH_AGENT_FAILURE. */
3510 sentreply = "\0\0\0\1\5";
3511 replylen = 5;
3512 }
51470298 3513 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
32874aea 3514 PKT_INT, c->remoteid,
3515 PKT_INT, replylen,
3516 PKT_DATA, sentreply, replylen,
3517 PKT_END);
3518 if (reply)
3519 sfree(reply);
3520 sfree(c->u.a.message);
3521 c->u.a.lensofar = 0;
3522 }
3523 }
5471d09a 3524 bufsize = 0; /* agent channels never back up */
32874aea 3525 break;
3526 }
90347b95 3527 if (!c->v.v1.throttling && bufsize > SSH1_BUFFER_LIMIT) {
5471d09a 3528 c->v.v1.throttling = 1;
51470298 3529 ssh1_throttle(ssh, +1);
5471d09a 3530 }
32874aea 3531 }
51470298 3532 } else if (ssh->pktin.type == SSH1_SMSG_SUCCESS) {
972a41c8 3533 /* may be from EXEC_SHELL on some servers */
51470298 3534 } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
972a41c8 3535 /* may be from EXEC_SHELL on some servers
374330e2 3536 * if no pty is available or in other odd cases. Ignore */
51470298 3537 } else if (ssh->pktin.type == SSH1_SMSG_EXIT_STATUS) {
d8d6c7e5 3538 char buf[100];
51470298 3539 ssh->exitcode = GET_32BIT(ssh->pktin.body);
d8d6c7e5 3540 sprintf(buf, "Server sent command exit status %d",
51470298 3541 ssh->exitcode);
d8d6c7e5 3542 logevent(buf);
51470298 3543 send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
4252c9cc 3544 /*
3545 * In case `helpful' firewalls or proxies tack
3546 * extra human-readable text on the end of the
3547 * session which we might mistake for another
3548 * encrypted packet, we close the session once
3549 * we've sent EXIT_CONFIRMATION.
3550 */
51470298 3551 ssh->state = SSH_STATE_CLOSED;
4252c9cc 3552 crReturnV;
374330e2 3553 } else {
a8327734 3554 bombout((ssh,"Strange packet received: type %d", ssh->pktin.type));
32874aea 3555 crReturnV;
374330e2 3556 }
3557 } else {
8df7a775 3558 while (inlen > 0) {
3559 int len = min(inlen, 512);
51470298 3560 send_packet(ssh, SSH1_CMSG_STDIN_DATA,
8df7a775 3561 PKT_INT, len, PKT_DATA, in, len, PKT_END);
3562 in += len;
3563 inlen -= len;
3564 }
374330e2 3565 }
3566 }
3567
3568 crFinishV;
3569}
3570
3571/*
e5574168 3572 * Utility routine for decoding comma-separated strings in KEXINIT.
3573 */
32874aea 3574static int in_commasep_string(char *needle, char *haystack, int haylen)
3575{
57356d63 3576 int needlen;
3577 if (!needle || !haystack) /* protect against null pointers */
3578 return 0;
3579 needlen = strlen(needle);
e5574168 3580 while (1) {
32874aea 3581 /*
3582 * Is it at the start of the string?
3583 */
3584 if (haylen >= needlen && /* haystack is long enough */
3585 !memcmp(needle, haystack, needlen) && /* initial match */
3586 (haylen == needlen || haystack[needlen] == ',')
3587 /* either , or EOS follows */
3588 )
3589 return 1;
3590 /*
3591 * If not, search for the next comma and resume after that.
3592 * If no comma found, terminate.
3593 */
3594 while (haylen > 0 && *haystack != ',')
3595 haylen--, haystack++;
3596 if (haylen == 0)
3597 return 0;
3598 haylen--, haystack++; /* skip over comma itself */
e5574168 3599 }
3600}
3601
3602/*
d39f364a 3603 * SSH2 key creation method.
3604 */
d8baa528 3605static void ssh2_mkkey(Ssh ssh, Bignum K, unsigned char *H,
3606 unsigned char *sessid, char chr,
3607 unsigned char *keyspace)
32874aea 3608{
d39f364a 3609 SHA_State s;
3610 /* First 20 bytes. */
3611 SHA_Init(&s);
51470298 3612 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
088bde77 3613 sha_mpint(&s, K);
d39f364a 3614 SHA_Bytes(&s, H, 20);
3615 SHA_Bytes(&s, &chr, 1);
5e0d7cb8 3616 SHA_Bytes(&s, sessid, 20);
d39f364a 3617 SHA_Final(&s, keyspace);
3618 /* Next 20 bytes. */
3619 SHA_Init(&s);
51470298 3620 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
088bde77 3621 sha_mpint(&s, K);
d39f364a 3622 SHA_Bytes(&s, H, 20);
3623 SHA_Bytes(&s, keyspace, 20);
32874aea 3624 SHA_Final(&s, keyspace + 20);
d39f364a 3625}
3626
3627/*
7cca0d81 3628 * Handle the SSH2 transport layer.
e5574168 3629 */
51470298 3630static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt)
e5574168 3631{
51470298 3632 struct do_ssh2_transport_state {
3633 int nbits, pbits, warn;
3634 Bignum p, g, e, f, K;
3635 int kex_init_value, kex_reply_value;
3636 const struct ssh_mac **maclist;
3637 int nmacs;
3638 const struct ssh2_cipher *cscipher_tobe;
3639 const struct ssh2_cipher *sccipher_tobe;
3640 const struct ssh_mac *csmac_tobe;
3641 const struct ssh_mac *scmac_tobe;
3642 const struct ssh_compress *cscomp_tobe;
3643 const struct ssh_compress *sccomp_tobe;
3644 char *hostkeydata, *sigdata, *keystr, *fingerprint;
3645 int hostkeylen, siglen;
3646 void *hkey; /* actual host key */
3647 unsigned char exchange_hash[20];
3648 int n_preferred_ciphers;
3649 const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX];
3650 const struct ssh_compress *preferred_comp;
3651 int first_kex;
3652 };
3653 crState(do_ssh2_transport_state);
3654
3655 crBegin(ssh->do_ssh2_transport_crstate);
3656
3657 s->cscipher_tobe = s->sccipher_tobe = NULL;
3658 s->csmac_tobe = s->scmac_tobe = NULL;
3659 s->cscomp_tobe = s->sccomp_tobe = NULL;
3660
7cca0d81 3661 random_init();
51470298 3662 s->first_kex = 1;
e5574168 3663
51470298 3664 {
3665 int i;
3666 /*
3667 * Set up the preferred ciphers. (NULL => warn below here)
3668 */
3669 s->n_preferred_ciphers = 0;
3670 for (i = 0; i < CIPHER_MAX; i++) {
3671 switch (cfg.ssh_cipherlist[i]) {
3672 case CIPHER_BLOWFISH:
3673 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_blowfish;
3674 break;
3675 case CIPHER_DES:
3676 if (cfg.ssh2_des_cbc) {
3677 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_des;
3678 }
3679 break;
3680 case CIPHER_3DES:
3681 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_3des;
3682 break;
3683 case CIPHER_AES:
3684 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_aes;
3685 break;
3686 case CIPHER_WARN:
3687 /* Flag for later. Don't bother if it's the last in
3688 * the list. */
3689 if (i < CIPHER_MAX - 1) {
3690 s->preferred_ciphers[s->n_preferred_ciphers++] = NULL;
3691 }
3692 break;
ca20bfcf 3693 }
ca20bfcf 3694 }
5e8358ad 3695 }
ca20bfcf 3696
3697 /*
3698 * Set up preferred compression.
3699 */
4ba9b64b 3700 if (cfg.compression)
51470298 3701 s->preferred_comp = &ssh_zlib;
4ba9b64b 3702 else
51470298 3703 s->preferred_comp = &ssh_comp_none;
5e8358ad 3704
7591b9ff 3705 /*
3706 * Be prepared to work around the buggy MAC problem.
3707 */
51470298 3708 if (ssh->remote_bugs & BUG_SSH2_HMAC)
3709 s->maclist = buggymacs, s->nmacs = lenof(buggymacs);
7591b9ff 3710 else
51470298 3711 s->maclist = macs, s->nmacs = lenof(macs);
7591b9ff 3712
32874aea 3713 begin_key_exchange:
51470298 3714 {
3715 int i, j, cipherstr_started;
3716
3717 /*
3718 * Construct and send our key exchange packet.
3719 */
3720 ssh2_pkt_init(ssh, SSH2_MSG_KEXINIT);
3721 for (i = 0; i < 16; i++)
3722 ssh2_pkt_addbyte(ssh, (unsigned char) random_byte());
3723 /* List key exchange algorithms. */
3724 ssh2_pkt_addstring_start(ssh);
3725 for (i = 0; i < lenof(kex_algs); i++) {
3726 if (kex_algs[i] == &ssh_diffiehellman_gex &&
3727 (ssh->remote_bugs & BUG_SSH2_DH_GEX))
3728 continue;
3729 ssh2_pkt_addstring_str(ssh, kex_algs[i]->name);
3730 if (i < lenof(kex_algs) - 1)
3731 ssh2_pkt_addstring_str(ssh, ",");
32874aea 3732 }
51470298 3733 /* List server host key algorithms. */
3734 ssh2_pkt_addstring_start(ssh);
3735 for (i = 0; i < lenof(hostkey_algs); i++) {
3736 ssh2_pkt_addstring_str(ssh, hostkey_algs[i]->name);
3737 if (i < lenof(hostkey_algs) - 1)
3738 ssh2_pkt_addstring_str(ssh, ",");
32874aea 3739 }
51470298 3740 /* List client->server encryption algorithms. */
3741 ssh2_pkt_addstring_start(ssh);
3742 cipherstr_started = 0;
3743 for (i = 0; i < s->n_preferred_ciphers; i++) {
3744 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
3745 if (!c) continue; /* warning flag */
3746 for (j = 0; j < c->nciphers; j++) {
3747 if (cipherstr_started)
3748 ssh2_pkt_addstring_str(ssh, ",");
3749 ssh2_pkt_addstring_str(ssh, c->list[j]->name);
3750 cipherstr_started = 1;
3751 }
3752 }
3753 /* List server->client encryption algorithms. */
3754 ssh2_pkt_addstring_start(ssh);
3755 cipherstr_started = 0;
3756 for (i = 0; i < s->n_preferred_ciphers; i++) {
3757 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
3758 if (!c) continue; /* warning flag */
3759 for (j = 0; j < c->nciphers; j++) {
3760 if (cipherstr_started)
3761 ssh2_pkt_addstring_str(ssh, ",");
3762 ssh2_pkt_addstring_str(ssh, c->list[j]->name);
3763 cipherstr_started = 1;
3764 }
3765 }
3766 /* List client->server MAC algorithms. */
3767 ssh2_pkt_addstring_start(ssh);
3768 for (i = 0; i < s->nmacs; i++) {
3769 ssh2_pkt_addstring_str(ssh, s->maclist[i]->name);
3770 if (i < s->nmacs - 1)
3771 ssh2_pkt_addstring_str(ssh, ",");
3772 }
3773 /* List server->client MAC algorithms. */
3774 ssh2_pkt_addstring_start(ssh);
3775 for (i = 0; i < s->nmacs; i++) {
3776 ssh2_pkt_addstring_str(ssh, s->maclist[i]->name);
3777 if (i < s->nmacs - 1)
3778 ssh2_pkt_addstring_str(ssh, ",");
3779 }
3780 /* List client->server compression algorithms. */
3781 ssh2_pkt_addstring_start(ssh);
3782 for (i = 0; i < lenof(compressions) + 1; i++) {
3783 const struct ssh_compress *c =
3784 i == 0 ? s->preferred_comp : compressions[i - 1];
3785 ssh2_pkt_addstring_str(ssh, c->name);
3786 if (i < lenof(compressions))
3787 ssh2_pkt_addstring_str(ssh, ",");
3788 }
3789 /* List server->client compression algorithms. */
3790 ssh2_pkt_addstring_start(ssh);
3791 for (i = 0; i < lenof(compressions) + 1; i++) {
3792 const struct ssh_compress *c =
3793 i == 0 ? s->preferred_comp : compressions[i - 1];
3794 ssh2_pkt_addstring_str(ssh, c->name);
3795 if (i < lenof(compressions))
3796 ssh2_pkt_addstring_str(ssh, ",");
3797 }
3798 /* List client->server languages. Empty list. */
3799 ssh2_pkt_addstring_start(ssh);
3800 /* List server->client languages. Empty list. */
3801 ssh2_pkt_addstring_start(ssh);
3802 /* First KEX packet does _not_ follow, because we're not that brave. */
3803 ssh2_pkt_addbool(ssh, FALSE);
3804 /* Reserved. */
3805 ssh2_pkt_adduint32(ssh, 0);
e5574168 3806 }
0db56f73 3807
51470298 3808 ssh->exhash = ssh->exhashbase;
3809 sha_string(&ssh->exhash, ssh->pktout.data + 5, ssh->pktout.length - 5);
0db56f73 3810
51470298 3811 ssh2_pkt_send(ssh);
e5574168 3812
32874aea 3813 if (!ispkt)
3814 crWaitUntil(ispkt);
57356d63 3815 if (ssh->pktin.length > 5)
3816 sha_string(&ssh->exhash, ssh->pktin.data + 5, ssh->pktin.length - 5);
e5574168 3817
3818 /*
3819 * Now examine the other side's KEXINIT to see what we're up
3820 * to.
3821 */
51470298 3822 {
3823 char *str;
3824 int i, j, len;
3825
3826 if (ssh->pktin.type != SSH2_MSG_KEXINIT) {
a8327734 3827 bombout((ssh,"expected key exchange packet from server"));
51470298 3828 crReturn(0);
32874aea 3829 }
51470298 3830 ssh->kex = NULL;
3831 ssh->hostkey = NULL;
3832 s->cscipher_tobe = NULL;
3833 s->sccipher_tobe = NULL;
3834 s->csmac_tobe = NULL;
3835 s->scmac_tobe = NULL;
3836 s->cscomp_tobe = NULL;
3837 s->sccomp_tobe = NULL;
3838 ssh->pktin.savedpos += 16; /* skip garbage cookie */
3839 ssh2_pkt_getstring(ssh, &str, &len); /* key exchange algorithms */
3840 for (i = 0; i < lenof(kex_algs); i++) {
3841 if (kex_algs[i] == &ssh_diffiehellman_gex &&
3842 (ssh->remote_bugs & BUG_SSH2_DH_GEX))
3843 continue;
3844 if (in_commasep_string(kex_algs[i]->name, str, len)) {
3845 ssh->kex = kex_algs[i];
3846 break;
3847 }
32874aea 3848 }
51470298 3849 ssh2_pkt_getstring(ssh, &str, &len); /* host key algorithms */
3850 for (i = 0; i < lenof(hostkey_algs); i++) {
3851 if (in_commasep_string(hostkey_algs[i]->name, str, len)) {
3852 ssh->hostkey = hostkey_algs[i];
3853 break;
3854 }
3855 }
3856 ssh2_pkt_getstring(ssh, &str, &len); /* client->server cipher */
3857 s->warn = 0;
3858 for (i = 0; i < s->n_preferred_ciphers; i++) {
3859 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
3860 if (!c) {
3861 s->warn = 1;
3862 } else {
3863 for (j = 0; j < c->nciphers; j++) {
3864 if (in_commasep_string(c->list[j]->name, str, len)) {
3865 s->cscipher_tobe = c->list[j];
3866 break;
3867 }
ca20bfcf 3868 }
32874aea 3869 }
51470298 3870 if (s->cscipher_tobe) {
3871 if (s->warn)
a8327734 3872 askcipher(ssh->frontend, s->cscipher_tobe->name, 1);
51470298 3873 break;
3874 }
32874aea 3875 }
51470298 3876 if (!s->cscipher_tobe) {
57356d63 3877 bombout((ssh,"Couldn't agree a client-to-server cipher (available: %s)",
3878 str ? str : "(null)"));
51470298 3879 crReturn(0);
ca20bfcf 3880 }
0ef8f407 3881
51470298 3882 ssh2_pkt_getstring(ssh, &str, &len); /* server->client cipher */
3883 s->warn = 0;
3884 for (i = 0; i < s->n_preferred_ciphers; i++) {
3885 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
3886 if (!c) {
3887 s->warn = 1;
3888 } else {
3889 for (j = 0; j < c->nciphers; j++) {
3890 if (in_commasep_string(c->list[j]->name, str, len)) {
3891 s->sccipher_tobe = c->list[j];
3892 break;
3893 }
ca20bfcf 3894 }
32874aea 3895 }
51470298 3896 if (s->sccipher_tobe) {
3897 if (s->warn)
a8327734 3898 askcipher(ssh->frontend, s->sccipher_tobe->name, 2);
51470298 3899 break;
3900 }
32874aea 3901 }
51470298 3902 if (!s->sccipher_tobe) {
57356d63 3903 bombout((ssh,"Couldn't agree a server-to-client cipher (available: %s)",
3904 str ? str : "(null)"));
51470298 3905 crReturn(0);
ca20bfcf 3906 }
0ef8f407 3907
51470298 3908 ssh2_pkt_getstring(ssh, &str, &len); /* client->server mac */
3909 for (i = 0; i < s->nmacs; i++) {
3910 if (in_commasep_string(s->maclist[i]->name, str, len)) {
3911 s->csmac_tobe = s->maclist[i];
3912 break;
3913 }
32874aea 3914 }
51470298 3915 ssh2_pkt_getstring(ssh, &str, &len); /* server->client mac */
3916 for (i = 0; i < s->nmacs; i++) {
3917 if (in_commasep_string(s->maclist[i]->name, str, len)) {
3918 s->scmac_tobe = s->maclist[i];
3919 break;
3920 }
32874aea 3921 }
51470298 3922 ssh2_pkt_getstring(ssh, &str, &len); /* client->server compression */
3923 for (i = 0; i < lenof(compressions) + 1; i++) {
3924 const struct ssh_compress *c =
3925 i == 0 ? s->preferred_comp : compressions[i - 1];
3926 if (in_commasep_string(c->name, str, len)) {
3927 s->cscomp_tobe = c;
3928 break;
3929 }
32874aea 3930 }
51470298 3931 ssh2_pkt_getstring(ssh, &str, &len); /* server->client compression */
3932 for (i = 0; i < lenof(compressions) + 1; i++) {
3933 const struct ssh_compress *c =
3934 i == 0 ? s->preferred_comp : compressions[i - 1];
3935 if (in_commasep_string(c->name, str, len)) {
3936 s->sccomp_tobe = c;
3937 break;
3938 }
32874aea 3939 }
e5574168 3940 }
e5574168 3941
3942 /*
7bd5a860 3943 * Work out the number of bits of key we will need from the key
3944 * exchange. We start with the maximum key length of either
3945 * cipher...
3946 */
3947 {
32874aea 3948 int csbits, scbits;
7bd5a860 3949
51470298 3950 csbits = s->cscipher_tobe->keylen;
3951 scbits = s->sccipher_tobe->keylen;
3952 s->nbits = (csbits > scbits ? csbits : scbits);
7bd5a860 3953 }
3954 /* The keys only have 160-bit entropy, since they're based on
3955 * a SHA-1 hash. So cap the key size at 160 bits. */
51470298 3956 if (s->nbits > 160)
3957 s->nbits = 160;
7bd5a860 3958
3959 /*
a92dd380 3960 * If we're doing Diffie-Hellman group exchange, start by
3961 * requesting a group.
e5574168 3962 */
51470298 3963 if (ssh->kex == &ssh_diffiehellman_gex) {
32874aea 3964 logevent("Doing Diffie-Hellman group exchange");
51470298 3965 ssh->pkt_ctx |= SSH2_PKTCTX_DHGEX;
32874aea 3966 /*
3967 * Work out how big a DH group we will need to allow that
3968 * much data.
7bd5a860 3969 */
51470298 3970 s->pbits = 512 << ((s->nbits - 1) / 64);
3971 ssh2_pkt_init(ssh, SSH2_MSG_KEX_DH_GEX_REQUEST);
3972 ssh2_pkt_adduint32(ssh, s->pbits);
3973 ssh2_pkt_send(ssh);
32874aea 3974
3975 crWaitUntil(ispkt);
51470298 3976 if (ssh->pktin.type != SSH2_MSG_KEX_DH_GEX_GROUP) {
a8327734 3977 bombout((ssh,"expected key exchange group packet from server"));
32874aea 3978 crReturn(0);
3979 }
51470298 3980 s->p = ssh2_pkt_getmp(ssh);
3981 s->g = ssh2_pkt_getmp(ssh);
27cd7fc2 3982 ssh->kex_ctx = dh_setup_group(s->p, s->g);
51470298 3983 s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT;
3984 s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY;
a92dd380 3985 } else {
51470298 3986 ssh->pkt_ctx |= SSH2_PKTCTX_DHGROUP1;
27cd7fc2 3987 ssh->kex_ctx = dh_setup_group1();
51470298 3988 s->kex_init_value = SSH2_MSG_KEXDH_INIT;
3989 s->kex_reply_value = SSH2_MSG_KEXDH_REPLY;
8d5de777 3990 }
e5574168 3991
a92dd380 3992 logevent("Doing Diffie-Hellman key exchange");
e5574168 3993 /*
a92dd380 3994 * Now generate and send e for Diffie-Hellman.
e5574168 3995 */
27cd7fc2 3996 s->e = dh_create_e(ssh->kex_ctx, s->nbits * 2);
51470298 3997 ssh2_pkt_init(ssh, s->kex_init_value);
3998 ssh2_pkt_addmp(ssh, s->e);
3999 ssh2_pkt_send(ssh);
e5574168 4000
4001 crWaitUntil(ispkt);
51470298 4002 if (ssh->pktin.type != s->kex_reply_value) {
a8327734 4003 bombout((ssh,"expected key exchange reply packet from server"));
32874aea 4004 crReturn(0);
7cca0d81 4005 }
51470298 4006 ssh2_pkt_getstring(ssh, &s->hostkeydata, &s->hostkeylen);
4007 s->f = ssh2_pkt_getmp(ssh);
4008 ssh2_pkt_getstring(ssh, &s->sigdata, &s->siglen);
e5574168 4009
27cd7fc2 4010 s->K = dh_find_K(ssh->kex_ctx, s->f);
e5574168 4011
51470298 4012 sha_string(&ssh->exhash, s->hostkeydata, s->hostkeylen);
4013 if (ssh->kex == &ssh_diffiehellman_gex) {
4014 sha_uint32(&ssh->exhash, s->pbits);
4015 sha_mpint(&ssh->exhash, s->p);
4016 sha_mpint(&ssh->exhash, s->g);
a92dd380 4017 }
51470298 4018 sha_mpint(&ssh->exhash, s->e);
4019 sha_mpint(&ssh->exhash, s->f);
4020 sha_mpint(&ssh->exhash, s->K);
4021 SHA_Final(&ssh->exhash, s->exchange_hash);
e5574168 4022
27cd7fc2 4023 dh_cleanup(ssh->kex_ctx);
3709bfe9 4024
7cca0d81 4025#if 0
765c4200 4026 debug(("Exchange hash is:\n"));
51470298 4027 dmemdump(s->exchange_hash, 20);
7cca0d81 4028#endif
4029
51470298 4030 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
4031 if (!s->hkey ||
4032 !ssh->hostkey->verifysig(s->hkey, s->sigdata, s->siglen,
d8baa528 4033 (char *)s->exchange_hash, 20)) {
a8327734 4034 bombout((ssh,"Server's host key did not match the signature supplied"));
32874aea 4035 crReturn(0);
8d5de777 4036 }
e5574168 4037
4038 /*
7cca0d81 4039 * Authenticate remote host: verify host key. (We've already
4040 * checked the signature of the exchange hash.)
e5574168 4041 */
51470298 4042 s->keystr = ssh->hostkey->fmtkey(s->hkey);
4043 s->fingerprint = ssh->hostkey->fingerprint(s->hkey);
a8327734 4044 verify_ssh_host_key(ssh->frontend,
4045 ssh->savedhost, ssh->savedport, ssh->hostkey->keytype,
51470298 4046 s->keystr, s->fingerprint);
4047 if (s->first_kex) { /* don't bother logging this in rekeys */
5e0d7cb8 4048 logevent("Host key fingerprint is:");
51470298 4049 logevent(s->fingerprint);
5e0d7cb8 4050 }
51470298 4051 sfree(s->fingerprint);
4052 sfree(s->keystr);
4053 ssh->hostkey->freekey(s->hkey);
d39f364a 4054
4055 /*
7cca0d81 4056 * Send SSH2_MSG_NEWKEYS.
d39f364a 4057 */
51470298 4058 ssh2_pkt_init(ssh, SSH2_MSG_NEWKEYS);
4059 ssh2_pkt_send(ssh);
d39f364a 4060
4061 /*
8406eaf9 4062 * Expect SSH2_MSG_NEWKEYS from server.
4063 */
4064 crWaitUntil(ispkt);
51470298 4065 if (ssh->pktin.type != SSH2_MSG_NEWKEYS) {
a8327734 4066 bombout((ssh,"expected new-keys packet from server"));
8406eaf9 4067 crReturn(0);
4068 }
4069
4070 /*
d39f364a 4071 * Create and initialise session keys.
4072 */
371e569c 4073 if (ssh->cs_cipher_ctx)
4074 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
51470298 4075 ssh->cscipher = s->cscipher_tobe;
371e569c 4076 ssh->cs_cipher_ctx = ssh->cscipher->make_context();
e0e1a00d 4077
371e569c 4078 if (ssh->sc_cipher_ctx)
4079 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
51470298 4080 ssh->sccipher = s->sccipher_tobe;
371e569c 4081 ssh->sc_cipher_ctx = ssh->sccipher->make_context();
e0e1a00d 4082
4083 if (ssh->cs_mac_ctx)
4084 ssh->csmac->free_context(ssh->cs_mac_ctx);
51470298 4085 ssh->csmac = s->csmac_tobe;
e0e1a00d 4086 ssh->cs_mac_ctx = ssh->csmac->make_context();
4087
4088 if (ssh->sc_mac_ctx)
4089 ssh->scmac->free_context(ssh->sc_mac_ctx);
51470298 4090 ssh->scmac = s->scmac_tobe;
e0e1a00d 4091 ssh->sc_mac_ctx = ssh->scmac->make_context();
4092
5366aed8 4093 if (ssh->cs_comp_ctx)
4094 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
51470298 4095 ssh->cscomp = s->cscomp_tobe;
5366aed8 4096 ssh->cs_comp_ctx = ssh->cscomp->compress_init();
4097
4098 if (ssh->sc_comp_ctx)
4099 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
51470298 4100 ssh->sccomp = s->sccomp_tobe;
5366aed8 4101 ssh->sc_comp_ctx = ssh->sccomp->decompress_init();
4102
d39f364a 4103 /*
5e0d7cb8 4104 * Set IVs after keys. Here we use the exchange hash from the
4105 * _first_ key exchange.
d39f364a 4106 */
51470298 4107 {
4108 unsigned char keyspace[40];
4109 if (s->first_kex)
4110 memcpy(ssh->v2_session_id, s->exchange_hash,
4111 sizeof(s->exchange_hash));
4112 ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'C',keyspace);
371e569c 4113 ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace);
51470298 4114 ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'D',keyspace);
371e569c 4115 ssh->sccipher->setkey(ssh->sc_cipher_ctx, keyspace);
51470298 4116 ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'A',keyspace);
371e569c 4117 ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace);
51470298 4118 ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'B',keyspace);
371e569c 4119 ssh->sccipher->setiv(ssh->sc_cipher_ctx, keyspace);
51470298 4120 ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'E',keyspace);
e0e1a00d 4121 ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace);
51470298 4122 ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'F',keyspace);
e0e1a00d 4123 ssh->scmac->setkey(ssh->sc_mac_ctx, keyspace);
51470298 4124 }
57356d63 4125 logeventf(ssh, "Initialised %.200s client->server encryption",
4126 ssh->cscipher->text_name);
4127 logeventf(ssh, "Initialised %.200s server->client encryption",
4128 ssh->sccipher->text_name);
4129 if (ssh->cscomp->text_name)
4130 logeventf(ssh, "Initialised %s compression",
4131 ssh->cscomp->text_name);
4132 if (ssh->sccomp->text_name)
4133 logeventf(ssh, "Initialised %s decompression",
4134 ssh->sccomp->text_name);
d39f364a 4135
033b4cef 4136 /*
0db56f73 4137 * If this is the first key exchange phase, we must pass the
4138 * SSH2_MSG_NEWKEYS packet to the next layer, not because it
4139 * wants to see it but because it will need time to initialise
4140 * itself before it sees an actual packet. In subsequent key
4141 * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because
4142 * it would only confuse the layer above.
4143 */
51470298 4144 if (!s->first_kex) {
32874aea 4145 crReturn(0);
0db56f73 4146 }
51470298 4147 s->first_kex = 0;
0db56f73 4148
4149 /*
7cca0d81 4150 * Now we're encrypting. Begin returning 1 to the protocol main
4151 * function so that other things can run on top of the
4152 * transport. If we ever see a KEXINIT, we must go back to the
4153 * start.
033b4cef 4154 */
51470298 4155 while (!(ispkt && ssh->pktin.type == SSH2_MSG_KEXINIT)) {
32874aea 4156 crReturn(1);
e96adf72 4157 }
5e0d7cb8 4158 logevent("Server initiated key re-exchange");
7cca0d81 4159 goto begin_key_exchange;
e5574168 4160
4161 crFinish(1);
4162}
4163
7cca0d81 4164/*
783415f8 4165 * Add data to an SSH2 channel output buffer.
4166 */
32874aea 4167static void ssh2_add_channel_data(struct ssh_channel *c, char *buf,
4168 int len)
4169{
5471d09a 4170 bufchain_add(&c->v.v2.outbuffer, buf, len);
783415f8 4171}
4172
4173/*
4174 * Attempt to send data on an SSH2 channel.
4175 */
5471d09a 4176static int ssh2_try_send(struct ssh_channel *c)
32874aea 4177{
51470298 4178 Ssh ssh = c->ssh;
4179
5471d09a 4180 while (c->v.v2.remwindow > 0 && bufchain_size(&c->v.v2.outbuffer) > 0) {
4181 int len;
4182 void *data;
4183 bufchain_prefix(&c->v.v2.outbuffer, &data, &len);
4184 if ((unsigned)len > c->v.v2.remwindow)
4185 len = c->v.v2.remwindow;
4186 if ((unsigned)len > c->v.v2.remmaxpkt)
4187 len = c->v.v2.remmaxpkt;
51470298 4188 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_DATA);
4189 ssh2_pkt_adduint32(ssh, c->remoteid);
4190 ssh2_pkt_addstring_start(ssh);
4191 ssh2_pkt_addstring_data(ssh, data, len);
4192 ssh2_pkt_send(ssh);
5471d09a 4193 bufchain_consume(&c->v.v2.outbuffer, len);
4194 c->v.v2.remwindow -= len;
4195 }
4196
4197 /*
4198 * After having sent as much data as we can, return the amount
4199 * still buffered.
4200 */
4201 return bufchain_size(&c->v.v2.outbuffer);
4202}
4203
4204/*
4205 * Potentially enlarge the window on an SSH2 channel.
4206 */
4207static void ssh2_set_window(struct ssh_channel *c, unsigned newwin)
4208{
51470298 4209 Ssh ssh = c->ssh;
4210
6b69f42e 4211 /*
4212 * Never send WINDOW_ADJUST for a channel that the remote side
4213 * already thinks it's closed; there's no point, since it won't
4214 * be sending any more data anyway.
4215 */
4216 if (c->closes != 0)
4217 return;
4218
5471d09a 4219 if (newwin > c->v.v2.locwindow) {
51470298 4220 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_WINDOW_ADJUST);
4221 ssh2_pkt_adduint32(ssh, c->remoteid);
4222 ssh2_pkt_adduint32(ssh, newwin - c->v.v2.locwindow);
4223 ssh2_pkt_send(ssh);
5471d09a 4224 c->v.v2.locwindow = newwin;
783415f8 4225 }
4226}
4227
4228/*
7cca0d81 4229 * Handle the SSH2 userauth and connection layers.
4230 */
51470298 4231static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
7cca0d81 4232{
51470298 4233 struct do_ssh2_authconn_state {
4234 enum {
4235 AUTH_INVALID, AUTH_PUBLICKEY_AGENT, AUTH_PUBLICKEY_FILE,
4236 AUTH_PASSWORD,
4237 AUTH_KEYBOARD_INTERACTIVE
4238 } method;
4239 enum {
4240 AUTH_TYPE_NONE,
4241 AUTH_TYPE_PUBLICKEY,
4242 AUTH_TYPE_PUBLICKEY_OFFER_LOUD,
4243 AUTH_TYPE_PUBLICKEY_OFFER_QUIET,
4244 AUTH_TYPE_PASSWORD,
4245 AUTH_TYPE_KEYBOARD_INTERACTIVE,
4246 AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
4247 } type;
4248 int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter;
4249 int tried_pubkey_config, tried_agent, tried_keyb_inter;
4250 int kbd_inter_running;
4251 int we_are_in;
4252 int num_prompts, curr_prompt, echo;
4253 char username[100];
4254 int got_username;
4255 char pwprompt[200];
4256 char password[100];
4257 void *publickey_blob;
4258 int publickey_bloblen;
4259 unsigned char request[5], *response, *p;
4260 int responselen;
4261 int keyi, nkeys;
4262 int authed;
4263 char *pkblob, *alg, *commentp;
4264 int pklen, alglen, commentlen;
4265 int siglen, retlen, len;
4266 char *q, *agentreq, *ret;
4267 int try_send;
4268 };
4269 crState(do_ssh2_authconn_state);
4270
4271 crBegin(ssh->do_ssh2_authconn_crstate);
e5574168 4272
7cca0d81 4273 /*
4274 * Request userauth protocol, and await a response to it.
4275 */
51470298 4276 ssh2_pkt_init(ssh, SSH2_MSG_SERVICE_REQUEST);
4277 ssh2_pkt_addstring(ssh, "ssh-userauth");
4278 ssh2_pkt_send(ssh);
7cca0d81 4279 crWaitUntilV(ispkt);
51470298 4280 if (ssh->pktin.type != SSH2_MSG_SERVICE_ACCEPT) {
a8327734 4281 bombout((ssh,"Server refused user authentication protocol"));
32874aea 4282 crReturnV;
8d5de777 4283 }
7cca0d81 4284
4285 /*
1408a877 4286 * We repeat this whole loop, including the username prompt,
4287 * until we manage a successful authentication. If the user
51470298 4288 * types the wrong _password_, they can be sent back to the
4289 * beginning to try another username, if this is configured on.
4290 * (If they specify a username in the config, they are never
4291 * asked, even if they do give a wrong password.)
1408a877 4292 *
4293 * I think this best serves the needs of
4294 *
4295 * - the people who have no configuration, no keys, and just
4296 * want to try repeated (username,password) pairs until they
4297 * type both correctly
4298 *
4299 * - people who have keys and configuration but occasionally
4300 * need to fall back to passwords
4301 *
4302 * - people with a key held in Pageant, who might not have
4303 * logged in to a particular machine before; so they want to
4304 * type a username, and then _either_ their key will be
4305 * accepted, _or_ they will type a password. If they mistype
4306 * the username they will want to be able to get back and
4307 * retype it!
7cca0d81 4308 */
51470298 4309 s->username[0] = '\0';
4310 s->got_username = FALSE;
1408a877 4311 do {
1408a877 4312 /*
4313 * Get a username.
4314 */
51470298 4315 if (s->got_username && !cfg.change_username) {
5bb641e1 4316 /*
4317 * We got a username last time round this loop, and
4318 * with change_username turned off we don't try to get
4319 * it again.
4320 */
4321 } else if ((flags & FLAG_INTERACTIVE) && !*cfg.username) {
c0a81592 4322 if (ssh_get_line && !ssh_getline_pw_only) {
32874aea 4323 if (!ssh_get_line("login as: ",
51470298 4324 s->username, sizeof(s->username), FALSE)) {
32874aea 4325 /*
4326 * get_line failed to get a username.
4327 * Terminate.
4328 */
4329 logevent("No username provided. Abandoning session.");
51470298 4330 ssh->state = SSH_STATE_CLOSED;
32874aea 4331 crReturnV;
4332 }
4333 } else {
51470298 4334 int ret; /* need not be saved across crReturn */
4335 c_write_str(ssh, "login as: ");
4336 ssh->send_ok = 1;
4337 setup_userpass_input(ssh, s->username, sizeof(s->username), 1);
0405e71f 4338 do {
32874aea 4339 crWaitUntilV(!ispkt);
51470298 4340 ret = process_userpass_input(ssh, in, inlen);
0405e71f 4341 } while (ret == 0);
4342 if (ret < 0)
4343 cleanup_exit(0);
4ca0c9d1 4344 c_write_str(ssh, "\r\n");
32874aea 4345 }
51470298 4346 s->username[strcspn(s->username, "\n\r")] = '\0';
7cca0d81 4347 } else {
57356d63 4348 char *stuff;
51470298 4349 strncpy(s->username, cfg.username, sizeof(s->username));
4350 s->username[sizeof(s->username)-1] = '\0';
65a22376 4351 if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
57356d63 4352 stuff = dupprintf("Using username \"%s\".\r\n", s->username);
51470298 4353 c_write_str(ssh, stuff);
57356d63 4354 sfree(stuff);
7cca0d81 4355 }
4356 }
51470298 4357 s->got_username = TRUE;
7cca0d81 4358
65a22376 4359 /*
1408a877 4360 * Send an authentication request using method "none": (a)
4361 * just in case it succeeds, and (b) so that we know what
4362 * authentication methods we can usefully try next.
65a22376 4363 */
51470298 4364 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
4365
4366 ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_REQUEST);
4367 ssh2_pkt_addstring(ssh, s->username);
4368 ssh2_pkt_addstring(ssh, "ssh-connection");/* service requested */
4369 ssh2_pkt_addstring(ssh, "none"); /* method */
4370 ssh2_pkt_send(ssh);
4371 s->type = AUTH_TYPE_NONE;
4372 s->gotit = FALSE;
4373 s->we_are_in = FALSE;
4374
4375 s->tried_pubkey_config = FALSE;
4376 s->tried_agent = FALSE;
4377 s->tried_keyb_inter = FALSE;
4378 s->kbd_inter_running = FALSE;
396778f1 4379 /* Load the pub half of cfg.keyfile so we notice if it's in Pageant */
4380 if (*cfg.keyfile) {
231ee168 4381 int keytype;
c2ad7d0d 4382 logeventf(ssh, "Reading private key file \"%.150s\"", cfg.keyfile);
231ee168 4383 keytype = key_type(cfg.keyfile);
51470298 4384 if (keytype == SSH_KEYTYPE_SSH2) {
4385 s->publickey_blob =
4386 ssh2_userkey_loadpub(cfg.keyfile, NULL,
4387 &s->publickey_bloblen);
4388 } else {
57356d63 4389 char *msgbuf;
c2ad7d0d 4390 logeventf(ssh, "Unable to use this key file (%s)",
a8327734 4391 key_type_to_str(keytype));
57356d63 4392 msgbuf = dupprintf("Unable to use key file \"%.150s\""
4393 " (%s)\r\n", cfg.keyfile,
4394 key_type_to_str(keytype));
51470298 4395 c_write_str(ssh, msgbuf);
57356d63 4396 sfree(msgbuf);
51470298 4397 s->publickey_blob = NULL;
231ee168 4398 }
396778f1 4399 } else
51470298 4400 s->publickey_blob = NULL;
65a22376 4401
1408a877 4402 while (1) {
4403 /*
4404 * Wait for the result of the last authentication request.
4405 */
51470298 4406 if (!s->gotit)
1408a877 4407 crWaitUntilV(ispkt);
51470298 4408 while (ssh->pktin.type == SSH2_MSG_USERAUTH_BANNER) {
32874aea 4409 char *banner;
4410 int size;
4411 /*
4412 * Don't show the banner if we're operating in
4413 * non-verbose non-interactive mode. (It's probably
4414 * a script, which means nobody will read the
4415 * banner _anyway_, and moreover the printing of
4416 * the banner will screw up processing on the
4417 * output of (say) plink.)
4418 */
4419 if (flags & (FLAG_VERBOSE | FLAG_INTERACTIVE)) {
51470298 4420 ssh2_pkt_getstring(ssh, &banner, &size);
32874aea 4421 if (banner)
51470298 4422 c_write_untrusted(ssh, banner, size);
32874aea 4423 }
1408a877 4424 crWaitUntilV(ispkt);
4425 }
51470298 4426 if (ssh->pktin.type == SSH2_MSG_USERAUTH_SUCCESS) {
1408a877 4427 logevent("Access granted");
51470298 4428 s->we_are_in = TRUE;
1408a877 4429 break;
4430 }
65a22376 4431
51470298 4432 if (s->kbd_inter_running &&
4433 ssh->pktin.type == SSH2_MSG_USERAUTH_INFO_REQUEST) {
b3186d64 4434 /*
45068b27 4435 * This is either a further set-of-prompts packet
4436 * in keyboard-interactive authentication, or it's
4437 * the same one and we came back here with `gotit'
4438 * set. In the former case, we must reset the
4439 * curr_prompt variable.
b3186d64 4440 */
51470298 4441 if (!s->gotit)
4442 s->curr_prompt = 0;
4443 } else if (ssh->pktin.type != SSH2_MSG_USERAUTH_FAILURE) {
a8327734 4444 bombout((ssh,"Strange packet received during authentication: type %d",
51470298 4445 ssh->pktin.type));
38c4a8da 4446 crReturnV;
65a22376 4447 }
4448
51470298 4449 s->gotit = FALSE;
65a22376 4450
1408a877 4451 /*
4452 * OK, we're now sitting on a USERAUTH_FAILURE message, so
4453 * we can look at the string in it and know what we can
4454 * helpfully try next.
4455 */
51470298 4456 if (ssh->pktin.type == SSH2_MSG_USERAUTH_FAILURE) {
1408a877 4457 char *methods;
4458 int methlen;
51470298 4459 ssh2_pkt_getstring(ssh, &methods, &methlen);
4460 s->kbd_inter_running = FALSE;
4461 if (!ssh2_pkt_getbool(ssh)) {
1408a877 4462 /*
4463 * We have received an unequivocal Access
4464 * Denied. This can translate to a variety of
4465 * messages:
4466 *
4467 * - if we'd just tried "none" authentication,
4468 * it's not worth printing anything at all
4469 *
4470 * - if we'd just tried a public key _offer_,
4471 * the message should be "Server refused our
4472 * key" (or no message at all if the key
4473 * came from Pageant)
4474 *
4475 * - if we'd just tried anything else, the
4476 * message really should be "Access denied".
4477 *
4478 * Additionally, if we'd just tried password
4479 * authentication, we should break out of this
4480 * whole loop so as to go back to the username
4481 * prompt.
4482 */
51470298 4483 if (s->type == AUTH_TYPE_NONE) {
1408a877 4484 /* do nothing */
51470298 4485 } else if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD ||
4486 s->type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) {
4487 if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD)
4488 c_write_str(ssh, "Server refused our key\r\n");
1408a877 4489 logevent("Server refused public key");
51470298 4490 } else if (s->type==AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) {
4bdf7c46 4491 /* server declined keyboard-interactive; ignore */
1408a877 4492 } else {
51470298 4493 c_write_str(ssh, "Access denied\r\n");
1408a877 4494 logevent("Access denied");
51470298 4495 if (s->type == AUTH_TYPE_PASSWORD) {
4496 s->we_are_in = FALSE;
1408a877 4497 break;
4498 }
4499 }
4500 } else {
51470298 4501 c_write_str(ssh, "Further authentication required\r\n");
1408a877 4502 logevent("Further authentication required");
4503 }
65a22376 4504
51470298 4505 s->can_pubkey =
32874aea 4506 in_commasep_string("publickey", methods, methlen);
51470298 4507 s->can_passwd =
32874aea 4508 in_commasep_string("password", methods, methlen);
51470298 4509 s->can_keyb_inter = cfg.try_ki_auth &&
761187b6 4510 in_commasep_string("keyboard-interactive", methods, methlen);
1408a877 4511 }
65a22376 4512
51470298 4513 s->method = 0;
4514 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
65a22376 4515
0405e71f 4516 /*
4517 * Most password/passphrase prompts will be
4518 * non-echoing, so we set this to 0 by default.
4519 * Exception is that some keyboard-interactive prompts
4520 * can be echoing, in which case we'll set this to 1.
4521 */
51470298 4522 s->echo = 0;
0405e71f 4523
51470298 4524 if (!s->method && s->can_pubkey &&
4525 agent_exists() && !s->tried_agent) {
1983e559 4526 /*
4527 * Attempt public-key authentication using Pageant.
4528 */
1983e559 4529 void *r;
51470298 4530 s->authed = FALSE;
1983e559 4531
51470298 4532 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
4533 ssh->pkt_ctx |= SSH2_PKTCTX_PUBLICKEY;
00db133f 4534
51470298 4535 s->tried_agent = TRUE;
1983e559 4536
4537 logevent("Pageant is running. Requesting keys.");
4538
4539 /* Request the keys held by the agent. */
51470298 4540 PUT_32BIT(s->request, 1);
4541 s->request[4] = SSH2_AGENTC_REQUEST_IDENTITIES;
4542 agent_query(s->request, 5, &r, &s->responselen);
4543 s->response = (unsigned char *) r;
4544 if (s->response && s->responselen >= 5 &&
4545 s->response[4] == SSH2_AGENT_IDENTITIES_ANSWER) {
4546 s->p = s->response + 5;
4547 s->nkeys = GET_32BIT(s->p);
4548 s->p += 4;
32874aea 4549 {
4550 char buf[64];
51470298 4551 sprintf(buf, "Pageant has %d SSH2 keys", s->nkeys);
32874aea 4552 logevent(buf);
4553 }
51470298 4554 for (s->keyi = 0; s->keyi < s->nkeys; s->keyi++) {
2d466ffd 4555 void *vret;
1983e559 4556
32874aea 4557 {
4558 char buf[64];
51470298 4559 sprintf(buf, "Trying Pageant key #%d", s->keyi);
32874aea 4560 logevent(buf);
4561 }
51470298 4562 s->pklen = GET_32BIT(s->p);
4563 s->p += 4;
4564 if (s->publickey_blob &&
4565 s->pklen == s->publickey_bloblen &&
4566 !memcmp(s->p, s->publickey_blob,
4567 s->publickey_bloblen)) {
396778f1 4568 logevent("This key matches configured key file");
51470298 4569 s->tried_pubkey_config = 1;
396778f1 4570 }
d8baa528 4571 s->pkblob = (char *)s->p;
51470298 4572 s->p += s->pklen;
4573 s->alglen = GET_32BIT(s->pkblob);
4574 s->alg = s->pkblob + 4;
4575 s->commentlen = GET_32BIT(s->p);
4576 s->p += 4;
d8baa528 4577 s->commentp = (char *)s->p;
51470298 4578 s->p += s->commentlen;
4579 ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_REQUEST);
4580 ssh2_pkt_addstring(ssh, s->username);
4581 ssh2_pkt_addstring(ssh, "ssh-connection"); /* service requested */
4582 ssh2_pkt_addstring(ssh, "publickey"); /* method */
4583 ssh2_pkt_addbool(ssh, FALSE); /* no signature included */
4584 ssh2_pkt_addstring_start(ssh);
4585 ssh2_pkt_addstring_data(ssh, s->alg, s->alglen);
4586 ssh2_pkt_addstring_start(ssh);
4587 ssh2_pkt_addstring_data(ssh, s->pkblob, s->pklen);
4588 ssh2_pkt_send(ssh);
1983e559 4589
4590 crWaitUntilV(ispkt);
51470298 4591 if (ssh->pktin.type != SSH2_MSG_USERAUTH_PK_OK) {
1983e559 4592 logevent("Key refused");
4593 continue;
4594 }
4595
32874aea 4596 if (flags & FLAG_VERBOSE) {
51470298 4597 c_write_str(ssh, "Authenticating with "
4598 "public key \"");
4599 c_write(ssh, s->commentp, s->commentlen);
4600 c_write_str(ssh, "\" from agent\r\n");
32874aea 4601 }
1983e559 4602
4603 /*
4604 * Server is willing to accept the key.
4605 * Construct a SIGN_REQUEST.
4606 */
51470298 4607 ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_REQUEST);
4608 ssh2_pkt_addstring(ssh, s->username);
4609 ssh2_pkt_addstring(ssh, "ssh-connection"); /* service requested */
4610 ssh2_pkt_addstring(ssh, "publickey"); /* method */
4611 ssh2_pkt_addbool(ssh, TRUE);
4612 ssh2_pkt_addstring_start(ssh);
4613 ssh2_pkt_addstring_data(ssh, s->alg, s->alglen);
4614 ssh2_pkt_addstring_start(ssh);
4615 ssh2_pkt_addstring_data(ssh, s->pkblob, s->pklen);
4616
4617 s->siglen = ssh->pktout.length - 5 + 4 + 20;
4618 s->len = 1; /* message type */
4619 s->len += 4 + s->pklen; /* key blob */
4620 s->len += 4 + s->siglen; /* data to sign */
4621 s->len += 4; /* flags */
4622 s->agentreq = smalloc(4 + s->len);
4623 PUT_32BIT(s->agentreq, s->len);
4624 s->q = s->agentreq + 4;
4625 *s->q++ = SSH2_AGENTC_SIGN_REQUEST;
4626 PUT_32BIT(s->q, s->pklen);
4627 s->q += 4;
4628 memcpy(s->q, s->pkblob, s->pklen);
4629 s->q += s->pklen;
4630 PUT_32BIT(s->q, s->siglen);
4631 s->q += 4;
1983e559 4632 /* Now the data to be signed... */
51470298 4633 PUT_32BIT(s->q, 20);
4634 s->q += 4;
4635 memcpy(s->q, ssh->v2_session_id, 20);
4636 s->q += 20;
4637 memcpy(s->q, ssh->pktout.data + 5,
4638 ssh->pktout.length - 5);
4639 s->q += ssh->pktout.length - 5;
1983e559 4640 /* And finally the (zero) flags word. */
51470298 4641 PUT_32BIT(s->q, 0);
4642 agent_query(s->agentreq, s->len + 4, &vret, &s->retlen);
4643 s->ret = vret;
4644 sfree(s->agentreq);
4645 if (s->ret) {
4646 if (s->ret[4] == SSH2_AGENT_SIGN_RESPONSE) {
1983e559 4647 logevent("Sending Pageant's response");
51470298 4648 ssh2_add_sigblob(ssh, s->pkblob, s->pklen,
4649 s->ret + 9,
4650 GET_32BIT(s->ret + 5));
4651 ssh2_pkt_send(ssh);
4652 s->authed = TRUE;
1983e559 4653 break;
4654 } else {
32874aea 4655 logevent
4656 ("Pageant failed to answer challenge");
51470298 4657 sfree(s->ret);
1983e559 4658 }
4659 }
4660 }
51470298 4661 if (s->authed)
1983e559 4662 continue;
4663 }
4664 }
4665
51470298 4666 if (!s->method && s->can_pubkey && s->publickey_blob
4667 && !s->tried_pubkey_config) {
1408a877 4668 unsigned char *pub_blob;
4669 char *algorithm, *comment;
4670 int pub_blob_len;
65a22376 4671
51470298 4672 s->tried_pubkey_config = TRUE;
65a22376 4673
51470298 4674 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
4675 ssh->pkt_ctx |= SSH2_PKTCTX_PUBLICKEY;
00db133f 4676
65a22376 4677 /*
1408a877 4678 * Try the public key supplied in the configuration.
4679 *
4680 * First, offer the public blob to see if the server is
4681 * willing to accept it.
65a22376 4682 */
d8baa528 4683 pub_blob =
4684 (unsigned char *)ssh2_userkey_loadpub(cfg.keyfile,
4685 &algorithm,
4686 &pub_blob_len);
1408a877 4687 if (pub_blob) {
51470298 4688 ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_REQUEST);
4689 ssh2_pkt_addstring(ssh, s->username);
4690 ssh2_pkt_addstring(ssh, "ssh-connection"); /* service requested */
4691 ssh2_pkt_addstring(ssh, "publickey"); /* method */
4692 ssh2_pkt_addbool(ssh, FALSE); /* no signature included */
4693 ssh2_pkt_addstring(ssh, algorithm);
4694 ssh2_pkt_addstring_start(ssh);
d8baa528 4695 ssh2_pkt_addstring_data(ssh, (char *)pub_blob,
4696 pub_blob_len);
51470298 4697 ssh2_pkt_send(ssh);
32874aea 4698 logevent("Offered public key"); /* FIXME */
1408a877 4699
4700 crWaitUntilV(ispkt);
51470298 4701 if (ssh->pktin.type != SSH2_MSG_USERAUTH_PK_OK) {
4702 s->gotit = TRUE;
4703 s->type = AUTH_TYPE_PUBLICKEY_OFFER_LOUD;
32874aea 4704 continue; /* key refused; give up on it */
1408a877 4705 }
65a22376 4706
1408a877 4707 logevent("Offer of public key accepted");
65a22376 4708 /*
1408a877 4709 * Actually attempt a serious authentication using
4710 * the key.
65a22376 4711 */
1408a877 4712 if (ssh2_userkey_encrypted(cfg.keyfile, &comment)) {
51470298 4713 sprintf(s->pwprompt,
32874aea 4714 "Passphrase for key \"%.100s\": ",
4715 comment);
51470298 4716 s->need_pw = TRUE;
1408a877 4717 } else {
51470298 4718 s->need_pw = FALSE;
1408a877 4719 }
51470298 4720 c_write_str(ssh, "Authenticating with public key \"");
4721 c_write_str(ssh, comment);
4722 c_write_str(ssh, "\"\r\n");
4723 s->method = AUTH_PUBLICKEY_FILE;
65a22376 4724 }
1408a877 4725 }
4726
51470298 4727 if (!s->method && s->can_keyb_inter && !s->tried_keyb_inter) {
4728 s->method = AUTH_KEYBOARD_INTERACTIVE;
4729 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
4730 s->tried_keyb_inter = TRUE;
af659722 4731
51470298 4732 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
4733 ssh->pkt_ctx |= SSH2_PKTCTX_KBDINTER;
00db133f 4734
51470298 4735 ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_REQUEST);
4736 ssh2_pkt_addstring(ssh, s->username);
4737 ssh2_pkt_addstring(ssh, "ssh-connection"); /* service requested */
4738 ssh2_pkt_addstring(ssh, "keyboard-interactive"); /* method */
4739 ssh2_pkt_addstring(ssh, ""); /* lang */
4740 ssh2_pkt_addstring(ssh, "");
4741 ssh2_pkt_send(ssh);
af659722 4742
4743 crWaitUntilV(ispkt);
51470298 4744 if (ssh->pktin.type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
4745 if (ssh->pktin.type == SSH2_MSG_USERAUTH_FAILURE)
4746 s->gotit = TRUE;
af659722 4747 logevent("Keyboard-interactive authentication refused");
51470298 4748 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET;
af659722 4749 continue;
4750 }
4751
51470298 4752 s->kbd_inter_running = TRUE;
4753 s->curr_prompt = 0;
af659722 4754 }
4755
51470298 4756 if (s->kbd_inter_running) {
4757 s->method = AUTH_KEYBOARD_INTERACTIVE;
4758 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
4759 s->tried_keyb_inter = TRUE;
af659722 4760
51470298 4761 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
4762 ssh->pkt_ctx |= SSH2_PKTCTX_KBDINTER;
00db133f 4763
51470298 4764 if (s->curr_prompt == 0) {
45068b27 4765 /*
4766 * We've got a fresh USERAUTH_INFO_REQUEST.
4767 * Display header data, and start going through
4768 * the prompts.
4769 */
4770 char *name, *inst, *lang;
4771 int name_len, inst_len, lang_len;
4772
51470298 4773 ssh2_pkt_getstring(ssh, &name, &name_len);
4774 ssh2_pkt_getstring(ssh, &inst, &inst_len);
4775 ssh2_pkt_getstring(ssh, &lang, &lang_len);
45068b27 4776 if (name_len > 0) {
51470298 4777 c_write_untrusted(ssh, name, name_len);
4778 c_write_str(ssh, "\r\n");
45068b27 4779 }
4780 if (inst_len > 0) {
51470298 4781 c_write_untrusted(ssh, inst, inst_len);
4782 c_write_str(ssh, "\r\n");
45068b27 4783 }
51470298 4784 s->num_prompts = ssh2_pkt_getuint32(ssh);
45068b27 4785 }
af659722 4786
45068b27 4787 /*
4788 * If there are prompts remaining in the packet,
4789 * display one and get a response.
4790 */
51470298 4791 if (s->curr_prompt < s->num_prompts) {
45068b27 4792 char *prompt;
4793 int prompt_len;
af659722 4794
51470298 4795 ssh2_pkt_getstring(ssh, &prompt, &prompt_len);
45068b27 4796 if (prompt_len > 0) {
51470298 4797 strncpy(s->pwprompt, prompt, sizeof(s->pwprompt));
4798 s->pwprompt[prompt_len < sizeof(s->pwprompt) ?
4799 prompt_len : sizeof(s->pwprompt)-1] = '\0';
45068b27 4800 } else {
51470298 4801 strcpy(s->pwprompt,
45068b27 4802 "<server failed to send prompt>: ");
4803 }
51470298 4804 s->echo = ssh2_pkt_getbool(ssh);
4805 s->need_pw = TRUE;
45068b27 4806 } else
51470298 4807 s->need_pw = FALSE;
af659722 4808 }
4809
51470298 4810 if (!s->method && s->can_passwd) {
4811 s->method = AUTH_PASSWORD;
4812 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
4813 ssh->pkt_ctx |= SSH2_PKTCTX_PASSWORD;
4814 sprintf(s->pwprompt, "%.90s@%.90s's password: ", s->username,
4815 ssh->savedhost);
4816 s->need_pw = TRUE;
1408a877 4817 }
4818
51470298 4819 if (s->need_pw) {
fa17a66e 4820 if (ssh_get_line) {
51470298 4821 if (!ssh_get_line(s->pwprompt, s->password,
4822 sizeof(s->password), TRUE)) {
1408a877 4823 /*
fa17a66e 4824 * get_line failed to get a password (for
4825 * example because one was supplied on the
4826 * command line which has already failed to
4827 * work). Terminate.
1408a877 4828 */
51470298 4829 ssh2_pkt_init(ssh, SSH2_MSG_DISCONNECT);
4830 ssh2_pkt_adduint32(ssh,SSH2_DISCONNECT_BY_APPLICATION);
4831 ssh2_pkt_addstring(ssh, "No more passwords available"
4832 " to try");
4833 ssh2_pkt_addstring(ssh, "en"); /* language tag */
4834 ssh2_pkt_send(ssh);
247308b5 4835 logevent("Unable to authenticate");
a8327734 4836 connection_fatal(ssh->frontend,
4837 "Unable to authenticate");
51470298 4838 ssh->state = SSH_STATE_CLOSED;
1408a877 4839 crReturnV;
4840 }
4841 } else {
51470298 4842 int ret; /* need not be saved across crReturn */
4843 c_write_untrusted(ssh, s->pwprompt, strlen(s->pwprompt));
4844 ssh->send_ok = 1;
1408a877 4845
51470298 4846 setup_userpass_input(ssh, s->password,
4847 sizeof(s->password), s->echo);
0405e71f 4848 do {
1408a877 4849 crWaitUntilV(!ispkt);
51470298 4850 ret = process_userpass_input(ssh, in, inlen);
0405e71f 4851 } while (ret == 0);
4852 if (ret < 0)
4853 cleanup_exit(0);
51470298 4854 c_write_str(ssh, "\r\n");
65a22376 4855 }
65a22376 4856 }
65a22376 4857
51470298 4858 if (s->method == AUTH_PUBLICKEY_FILE) {
1408a877 4859 /*
4860 * We have our passphrase. Now try the actual authentication.
4861 */
4862 struct ssh2_userkey *key;
65a22376 4863
51470298 4864 key = ssh2_load_userkey(cfg.keyfile, s->password);
1408a877 4865 if (key == SSH2_WRONG_PASSPHRASE || key == NULL) {
4866 if (key == SSH2_WRONG_PASSPHRASE) {
51470298 4867 c_write_str(ssh, "Wrong passphrase\r\n");
4868 s->tried_pubkey_config = FALSE;
1408a877 4869 } else {
51470298 4870 c_write_str(ssh, "Unable to load private key\r\n");
4871 s->tried_pubkey_config = TRUE;
1408a877 4872 }
4873 /* Send a spurious AUTH_NONE to return to the top. */
51470298 4874 ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_REQUEST);
4875 ssh2_pkt_addstring(ssh, s->username);
4876 ssh2_pkt_addstring(ssh, "ssh-connection"); /* service requested */
4877 ssh2_pkt_addstring(ssh, "none"); /* method */
4878 ssh2_pkt_send(ssh);
4879 s->type = AUTH_TYPE_NONE;
1408a877 4880 } else {
1dd353b5 4881 unsigned char *pkblob, *sigblob, *sigdata;
4882 int pkblob_len, sigblob_len, sigdata_len;
65a22376 4883
1408a877 4884 /*
4885 * We have loaded the private key and the server
4886 * has announced that it's willing to accept it.
4887 * Hallelujah. Generate a signature and send it.
4888 */
51470298 4889 ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_REQUEST);
4890 ssh2_pkt_addstring(ssh, s->username);
4891 ssh2_pkt_addstring(ssh, "ssh-connection"); /* service requested */
4892 ssh2_pkt_addstring(ssh, "publickey"); /* method */
4893 ssh2_pkt_addbool(ssh, TRUE);
4894 ssh2_pkt_addstring(ssh, key->alg->name);
1dd353b5 4895 pkblob = key->alg->public_blob(key->data, &pkblob_len);
51470298 4896 ssh2_pkt_addstring_start(ssh);
d8baa528 4897 ssh2_pkt_addstring_data(ssh, (char *)pkblob, pkblob_len);
1408a877 4898
4899 /*
4900 * The data to be signed is:
4901 *
4902 * string session-id
4903 *
4904 * followed by everything so far placed in the
4905 * outgoing packet.
4906 */
51470298 4907 sigdata_len = ssh->pktout.length - 5 + 4 + 20;
1408a877 4908 sigdata = smalloc(sigdata_len);
4909 PUT_32BIT(sigdata, 20);
51470298 4910 memcpy(sigdata + 4, ssh->v2_session_id, 20);
4911 memcpy(sigdata + 24, ssh->pktout.data + 5,
4912 ssh->pktout.length - 5);
d8baa528 4913 sigblob = key->alg->sign(key->data, (char *)sigdata,
1dd353b5 4914 sigdata_len, &sigblob_len);
51470298 4915 ssh2_add_sigblob(ssh, pkblob, pkblob_len,
1dd353b5 4916 sigblob, sigblob_len);
4917 sfree(pkblob);
4918 sfree(sigblob);
1408a877 4919 sfree(sigdata);
4920
51470298 4921 ssh2_pkt_send(ssh);
4922 s->type = AUTH_TYPE_PUBLICKEY;
1408a877 4923 }
51470298 4924 } else if (s->method == AUTH_PASSWORD) {
65a22376 4925 /*
1408a877 4926 * We send the password packet lumped tightly together with
4927 * an SSH_MSG_IGNORE packet. The IGNORE packet contains a
4928 * string long enough to make the total length of the two
4929 * packets constant. This should ensure that a passive
4930 * listener doing traffic analyis can't work out the length
4931 * of the password.
4932 *
4933 * For this to work, we need an assumption about the
4934 * maximum length of the password packet. I think 256 is
4935 * pretty conservative. Anyone using a password longer than
4936 * that probably doesn't have much to worry about from
4937 * people who find out how long their password is!
65a22376 4938 */
51470298 4939 ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_REQUEST);
4940 ssh2_pkt_addstring(ssh, s->username);
4941 ssh2_pkt_addstring(ssh, "ssh-connection"); /* service requested */
4942 ssh2_pkt_addstring(ssh, "password");
4943 ssh2_pkt_addbool(ssh, FALSE);
4944 ssh2_pkt_addstring(ssh, s->password);
4945 ssh2_pkt_defer(ssh);
65a22376 4946 /*
1408a877 4947 * We'll include a string that's an exact multiple of the
4948 * cipher block size. If the cipher is NULL for some
4949 * reason, we don't do this trick at all because we gain
4950 * nothing by it.
65a22376 4951 */
51470298 4952 if (ssh->cscipher) {
32874aea 4953 int stringlen, i;
4954
51470298 4955 stringlen = (256 - ssh->deferred_len);
4956 stringlen += ssh->cscipher->blksize - 1;
4957 stringlen -= (stringlen % ssh->cscipher->blksize);
4958 if (ssh->cscomp) {
32874aea 4959 /*
4960 * Temporarily disable actual compression,
4961 * so we can guarantee to get this string
4962 * exactly the length we want it. The
4963 * compression-disabling routine should
4964 * return an integer indicating how many
4965 * bytes we should adjust our string length
4966 * by.
4967 */
5366aed8 4968 stringlen -=
4969 ssh->cscomp->disable_compression(ssh->cs_comp_ctx);
32874aea 4970 }
51470298 4971 ssh2_pkt_init(ssh, SSH2_MSG_IGNORE);
4972 ssh2_pkt_addstring_start(ssh);
6e9e9520 4973 for (i = 0; i < stringlen; i++) {
32874aea 4974 char c = (char) random_byte();
51470298 4975 ssh2_pkt_addstring_data(ssh, &c, 1);
65a22376 4976 }
51470298 4977 ssh2_pkt_defer(ssh);
65a22376 4978 }
51470298 4979 ssh_pkt_defersend(ssh);
0d43337a 4980 logevent("Sent password");
51470298 4981 s->type = AUTH_TYPE_PASSWORD;
4982 } else if (s->method == AUTH_KEYBOARD_INTERACTIVE) {
4983 if (s->curr_prompt == 0) {
4984 ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_INFO_RESPONSE);
4985 ssh2_pkt_adduint32(ssh, s->num_prompts);
45068b27 4986 }
51470298 4987 if (s->need_pw) { /* only add pw if we just got one! */
4988 ssh2_pkt_addstring(ssh, s->password);
4989 memset(s->password, 0, sizeof(s->password));
4990 s->curr_prompt++;
45068b27 4991 }
51470298 4992 if (s->curr_prompt >= s->num_prompts) {
4993 ssh2_pkt_send(ssh);
45068b27 4994 } else {
4995 /*
4996 * If there are prompts remaining, we set
4997 * `gotit' so that we won't attempt to get
4998 * another packet. Then we go back round the
4999 * loop and will end up retrieving another
5000 * prompt out of the existing packet. Funky or
5001 * what?
5002 */
51470298 5003 s->gotit = TRUE;
45068b27 5004 }
51470298 5005 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
1408a877 5006 } else {
51470298 5007 c_write_str(ssh, "No supported authentication methods"
5008 " left to try!\r\n");
5009 logevent("No supported authentications offered."
5010 " Disconnecting");
5011 ssh2_pkt_init(ssh, SSH2_MSG_DISCONNECT);
5012 ssh2_pkt_adduint32(ssh, SSH2_DISCONNECT_BY_APPLICATION);
5013 ssh2_pkt_addstring(ssh, "No supported authentication"
5014 " methods available");
5015 ssh2_pkt_addstring(ssh, "en"); /* language tag */
5016 ssh2_pkt_send(ssh);
5017 ssh->state = SSH_STATE_CLOSED;
1408a877 5018 crReturnV;
65a22376 5019 }
65a22376 5020 }
51470298 5021 } while (!s->we_are_in);
7cca0d81 5022
5023 /*
5024 * Now we're authenticated for the connection protocol. The
5025 * connection protocol will automatically have started at this
5026 * point; there's no need to send SERVICE_REQUEST.
5027 */
5028
5029 /*
5030 * So now create a channel with a session in it.
5031 */
51470298 5032 ssh->channels = newtree234(ssh_channelcmp);
5033 ssh->mainchan = smalloc(sizeof(struct ssh_channel));
5034 ssh->mainchan->ssh = ssh;
5035 ssh->mainchan->localid = alloc_channel_id(ssh);
5036 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_OPEN);
5037 ssh2_pkt_addstring(ssh, "session");
5038 ssh2_pkt_adduint32(ssh, ssh->mainchan->localid);
5039 ssh->mainchan->v.v2.locwindow = OUR_V2_WINSIZE;
5040 ssh2_pkt_adduint32(ssh, ssh->mainchan->v.v2.locwindow);/* our window size */
5041 ssh2_pkt_adduint32(ssh, 0x4000UL); /* our max pkt size */
5042 ssh2_pkt_send(ssh);
7cca0d81 5043 crWaitUntilV(ispkt);
51470298 5044 if (ssh->pktin.type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
a8327734 5045 bombout((ssh,"Server refused to open a session"));
32874aea 5046 crReturnV;
5047 /* FIXME: error data comes back in FAILURE packet */
7cca0d81 5048 }
51470298 5049 if (ssh2_pkt_getuint32(ssh) != ssh->mainchan->localid) {
a8327734 5050 bombout((ssh,"Server's channel confirmation cited wrong channel"));
32874aea 5051 crReturnV;
7cca0d81 5052 }
51470298 5053 ssh->mainchan->remoteid = ssh2_pkt_getuint32(ssh);
5054 ssh->mainchan->type = CHAN_MAINSESSION;
5055 ssh->mainchan->closes = 0;
5056 ssh->mainchan->v.v2.remwindow = ssh2_pkt_getuint32(ssh);
5057 ssh->mainchan->v.v2.remmaxpkt = ssh2_pkt_getuint32(ssh);
5058 bufchain_init(&ssh->mainchan->v.v2.outbuffer);
5059 add234(ssh->channels, ssh->mainchan);
7cca0d81 5060 logevent("Opened channel for session");
5061
5062 /*
783415f8 5063 * Potentially enable X11 forwarding.
5064 */
5065 if (cfg.x11_forward) {
32874aea 5066 char proto[20], data[64];
5067 logevent("Requesting X11 forwarding");
302121de 5068 ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
5069 data, sizeof(data));
51470298 5070 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST);
5071 ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid);
5072 ssh2_pkt_addstring(ssh, "x11-req");
5073 ssh2_pkt_addbool(ssh, 1); /* want reply */
5074 ssh2_pkt_addbool(ssh, 0); /* many connections */
5075 ssh2_pkt_addstring(ssh, proto);
5076 ssh2_pkt_addstring(ssh, data);
421d6835 5077 ssh2_pkt_adduint32(ssh, x11_get_screen_number(cfg.x11_display));
51470298 5078 ssh2_pkt_send(ssh);
32874aea 5079
5080 do {
5081 crWaitUntilV(ispkt);
51470298 5082 if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
5083 unsigned i = ssh2_pkt_getuint32(ssh);
32874aea 5084 struct ssh_channel *c;
51470298 5085 c = find234(ssh->channels, &i, ssh_channelfind);
32874aea 5086 if (!c)
5087 continue; /* nonexistent channel */
51470298 5088 c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
32874aea 5089 }
51470298 5090 } while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
32874aea 5091
51470298 5092 if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
5093 if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
a8327734 5094 bombout((ssh,"Unexpected response to X11 forwarding request:"
51470298 5095 " packet type %d", ssh->pktin.type));
32874aea 5096 crReturnV;
5097 }
5098 logevent("X11 forwarding refused");
5099 } else {
5100 logevent("X11 forwarding enabled");
51470298 5101 ssh->X11_fwd_enabled = TRUE;
32874aea 5102 }
783415f8 5103 }
5104
5105 /*
bc240b21 5106 * Enable port forwardings.
5107 */
5108 {
bc240b21 5109 char type;
5110 int n;
a4fc0d74 5111 int sport,dport,sserv,dserv;
6ee9b735 5112 char sports[256], dports[256], saddr[256], host[256];
bc240b21 5113
51470298 5114 ssh->rportfwds = newtree234(ssh_rportcmp_ssh2);
bc240b21 5115 /* Add port forwardings. */
51470298 5116 ssh->portfwd_strptr = cfg.portfwd;
5117 while (*ssh->portfwd_strptr) {
5118 type = *ssh->portfwd_strptr++;
6ee9b735 5119 saddr[0] = '\0';
bc240b21 5120 n = 0;
6ee9b735 5121 while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') {
5122 if (*ssh->portfwd_strptr == ':') {
5123 /*
5124 * We've seen a colon in the middle of the
5125 * source port number. This means that
5126 * everything we've seen until now is the
5127 * source _address_, so we'll move it into
5128 * saddr and start sports from the beginning
5129 * again.
5130 */
5131 ssh->portfwd_strptr++;
5132 sports[n] = '\0';
5133 strcpy(saddr, sports);
5134 n = 0;
5135 }
5136 if (n < 255) sports[n++] = *ssh->portfwd_strptr++;
5137 }
bc240b21 5138 sports[n] = 0;
51470298 5139 if (*ssh->portfwd_strptr == '\t')
5140 ssh->portfwd_strptr++;
bc240b21 5141 n = 0;
6ee9b735 5142 while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') {
5143 if (n < 255) host[n++] = *ssh->portfwd_strptr++;
5144 }
bc240b21 5145 host[n] = 0;
51470298 5146 if (*ssh->portfwd_strptr == ':')
5147 ssh->portfwd_strptr++;
bc240b21 5148 n = 0;
6ee9b735 5149 while (*ssh->portfwd_strptr) {
5150 if (n < 255) dports[n++] = *ssh->portfwd_strptr++;
5151 }
bc240b21 5152 dports[n] = 0;
51470298 5153 ssh->portfwd_strptr++;
bc240b21 5154 dport = atoi(dports);
a4fc0d74 5155 dserv = 0;
5156 if (dport == 0) {
5157 dserv = 1;
68a49acb 5158 dport = net_service_lookup(dports);
5159 if (!dport) {
57356d63 5160 logeventf(ssh, "Service lookup failed for destination"
5161 " port \"%s\"", dports);
a4fc0d74 5162 }
5163 }
bc240b21 5164 sport = atoi(sports);
a4fc0d74 5165 sserv = 0;
5166 if (sport == 0) {
5167 sserv = 1;
68a49acb 5168 sport = net_service_lookup(sports);
5169 if (!sport) {
57356d63 5170 logeventf(ssh, "Service lookup failed for source"
5171 " port \"%s\"", sports);
a4fc0d74 5172 }
5173 }
bc240b21 5174 if (sport && dport) {
5175 if (type == 'L') {
6ee9b735 5176 pfd_addforward(host, dport, *saddr ? saddr : NULL,
5177 sport, ssh);
5178 logeventf(ssh, "Local port %.*s%.*s%.*s%.*s%d%.*s"
5179 " forwarding to %s:%.*s%.*s%d%.*s",
5180 (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL,
5181 (int)(*saddr?1:0), ":",
57356d63 5182 (int)(sserv ? strlen(sports) : 0), sports,
5183 sserv, "(", sport, sserv, ")",
5184 host,
5185 (int)(dserv ? strlen(dports) : 0), dports,
5186 dserv, "(", dport, dserv, ")");
bc240b21 5187 } else {
5188 struct ssh_rportfwd *pf;
5189 pf = smalloc(sizeof(*pf));
5190 strcpy(pf->dhost, host);
5191 pf->dport = dport;
5192 pf->sport = sport;
51470298 5193 if (add234(ssh->rportfwds, pf) != pf) {
57356d63 5194 logeventf(ssh, "Duplicate remote port forwarding"
5195 " to %s:%d", host, dport);
bc240b21 5196 sfree(pf);
5197 } else {
6ee9b735 5198 logeventf(ssh, "Requesting remote port "
5199 "%.*s%.*s%.*s%.*s%d%.*s"
57356d63 5200 " forward to %s:%.*s%.*s%d%.*s",
6ee9b735 5201 (int)(*saddr?strlen(saddr):0),
5202 *saddr?saddr:NULL,
5203 (int)(*saddr?1:0), ":",
57356d63 5204 (int)(sserv ? strlen(sports) : 0), sports,
5205 sserv, "(", sport, sserv, ")",
5206 host,
5207 (int)(dserv ? strlen(dports) : 0), dports,
5208 dserv, "(", dport, dserv, ")");
51470298 5209 ssh2_pkt_init(ssh, SSH2_MSG_GLOBAL_REQUEST);
5210 ssh2_pkt_addstring(ssh, "tcpip-forward");
5211 ssh2_pkt_addbool(ssh, 1);/* want reply */
6ee9b735 5212 if (*saddr)
5213 ssh2_pkt_addstring(ssh, saddr);
beefa433 5214 if (cfg.rport_acceptall)
51470298 5215 ssh2_pkt_addstring(ssh, "0.0.0.0");
beefa433 5216 else
51470298 5217 ssh2_pkt_addstring(ssh, "127.0.0.1");
5218 ssh2_pkt_adduint32(ssh, sport);
5219 ssh2_pkt_send(ssh);
bc240b21 5220
5221 do {
5222 crWaitUntilV(ispkt);
51470298 5223 if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
5224 unsigned i = ssh2_pkt_getuint32(ssh);
bc240b21 5225 struct ssh_channel *c;
51470298 5226 c = find234(ssh->channels, &i, ssh_channelfind);
bc240b21 5227 if (!c)
5228 continue;/* nonexistent channel */
51470298 5229 c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
bc240b21 5230 }
51470298 5231 } while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
bc240b21 5232
51470298 5233 if (ssh->pktin.type != SSH2_MSG_REQUEST_SUCCESS) {
5234 if (ssh->pktin.type != SSH2_MSG_REQUEST_FAILURE) {
a8327734 5235 bombout((ssh,"Unexpected response to port "
c9886e66 5236 "forwarding request: packet type %d",
51470298 5237 ssh->pktin.type));
bc240b21 5238 crReturnV;
5239 }
5240 logevent("Server refused this port forwarding");
5241 } else {
5242 logevent("Remote port forwarding enabled");
5243 }
5244 }
5245 }
5246 }
5247 }
5248 }
5249
5250 /*
36c2a3e9 5251 * Potentially enable agent forwarding.
5252 */
5253 if (cfg.agentfwd && agent_exists()) {
32874aea 5254 logevent("Requesting OpenSSH-style agent forwarding");
51470298 5255 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST);
5256 ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid);
5257 ssh2_pkt_addstring(ssh, "auth-agent-req@openssh.com");
5258 ssh2_pkt_addbool(ssh, 1); /* want reply */
5259 ssh2_pkt_send(ssh);
32874aea 5260
5261 do {
5262 crWaitUntilV(ispkt);
51470298 5263 if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
5264 unsigned i = ssh2_pkt_getuint32(ssh);
32874aea 5265 struct ssh_channel *c;
51470298 5266 c = find234(ssh->channels, &i, ssh_channelfind);
32874aea 5267 if (!c)
5268 continue; /* nonexistent channel */
51470298 5269 c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
32874aea 5270 }
51470298 5271 } while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
32874aea 5272
51470298 5273 if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
5274 if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
a8327734 5275 bombout((ssh,"Unexpected response to agent forwarding request:"
51470298 5276 " packet type %d", ssh->pktin.type));
32874aea 5277 crReturnV;
5278 }
5279 logevent("Agent forwarding refused");
5280 } else {
5281 logevent("Agent forwarding enabled");
51470298 5282 ssh->agentfwd_enabled = TRUE;
32874aea 5283 }
36c2a3e9 5284 }
5285
5286 /*
7cca0d81 5287 * Now allocate a pty for the session.
5288 */
67779be7 5289 if (!cfg.nopty) {
51470298 5290 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST);
5291 ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid); /* recipient channel */
5292 ssh2_pkt_addstring(ssh, "pty-req");
5293 ssh2_pkt_addbool(ssh, 1); /* want reply */
5294 ssh2_pkt_addstring(ssh, cfg.termtype);
5295 ssh2_pkt_adduint32(ssh, ssh->term_width);
5296 ssh2_pkt_adduint32(ssh, ssh->term_height);
5297 ssh2_pkt_adduint32(ssh, 0); /* pixel width */
5298 ssh2_pkt_adduint32(ssh, 0); /* pixel height */
5299 ssh2_pkt_addstring_start(ssh);
5300 ssh2_pkt_addstring_data(ssh, "\0", 1); /* TTY_OP_END, no special options */
5301 ssh2_pkt_send(ssh);
5302 ssh->state = SSH_STATE_INTERMED;
32874aea 5303
5304 do {
5305 crWaitUntilV(ispkt);
51470298 5306 if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
5307 unsigned i = ssh2_pkt_getuint32(ssh);
32874aea 5308 struct ssh_channel *c;
51470298 5309 c = find234(ssh->channels, &i, ssh_channelfind);
32874aea 5310 if (!c)
5311 continue; /* nonexistent channel */
51470298 5312 c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
32874aea 5313 }
51470298 5314 } while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
32874aea 5315
51470298 5316 if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
5317 if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
a8327734 5318 bombout((ssh,"Unexpected response to pty request:"
51470298 5319 " packet type %d", ssh->pktin.type));
32874aea 5320 crReturnV;
5321 }
51470298 5322 c_write_str(ssh, "Server refused to allocate pty\r\n");
5323 ssh->editing = ssh->echoing = 1;
32874aea 5324 } else {
5325 logevent("Allocated pty");
5326 }
0965bee0 5327 } else {
51470298 5328 ssh->editing = ssh->echoing = 1;
7cca0d81 5329 }
5330
5331 /*
fd5e5847 5332 * Start a shell or a remote command. We may have to attempt
5333 * this twice if the config data has provided a second choice
5334 * of command.
7cca0d81 5335 */
fd5e5847 5336 while (1) {
5337 int subsys;
5338 char *cmd;
5339
51470298 5340 if (ssh->fallback_cmd) {
fd5e5847 5341 subsys = cfg.ssh_subsys2;
5342 cmd = cfg.remote_cmd_ptr2;
5343 } else {
5344 subsys = cfg.ssh_subsys;
5345 cmd = cfg.remote_cmd_ptr;
5346 }
5347
51470298 5348 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST);
5349 ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid); /* recipient channel */
fd5e5847 5350 if (subsys) {
51470298 5351 ssh2_pkt_addstring(ssh, "subsystem");
5352 ssh2_pkt_addbool(ssh, 1); /* want reply */
5353 ssh2_pkt_addstring(ssh, cmd);
fd5e5847 5354 } else if (*cmd) {
51470298 5355 ssh2_pkt_addstring(ssh, "exec");
5356 ssh2_pkt_addbool(ssh, 1); /* want reply */
5357 ssh2_pkt_addstring(ssh, cmd);
fd5e5847 5358 } else {
51470298 5359 ssh2_pkt_addstring(ssh, "shell");
5360 ssh2_pkt_addbool(ssh, 1); /* want reply */
32874aea 5361 }
51470298 5362 ssh2_pkt_send(ssh);
fd5e5847 5363 do {
5364 crWaitUntilV(ispkt);
51470298 5365 if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
5366 unsigned i = ssh2_pkt_getuint32(ssh);
fd5e5847 5367 struct ssh_channel *c;
51470298 5368 c = find234(ssh->channels, &i, ssh_channelfind);
fd5e5847 5369 if (!c)
5370 continue; /* nonexistent channel */
51470298 5371 c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
fd5e5847 5372 }
51470298 5373 } while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
5374 if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
5375 if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
a8327734 5376 bombout((ssh,"Unexpected response to shell/command request:"
51470298 5377 " packet type %d", ssh->pktin.type));
fd5e5847 5378 crReturnV;
5379 }
5380 /*
5381 * We failed to start the command. If this is the
5382 * fallback command, we really are finished; if it's
5383 * not, and if the fallback command exists, try falling
5384 * back to it before complaining.
5385 */
51470298 5386 if (!ssh->fallback_cmd && cfg.remote_cmd_ptr2 != NULL) {
fd5e5847 5387 logevent("Primary command failed; attempting fallback");
51470298 5388 ssh->fallback_cmd = TRUE;
fd5e5847 5389 continue;
5390 }
a8327734 5391 bombout((ssh,"Server refused to start a shell/command"));
32874aea 5392 crReturnV;
fd5e5847 5393 } else {
5394 logevent("Started a shell/command");
32874aea 5395 }
fd5e5847 5396 break;
7cca0d81 5397 }
5398
51470298 5399 ssh->state = SSH_STATE_SESSION;
5400 if (ssh->size_needed)
5401 ssh_size(ssh, ssh->term_width, ssh->term_height);
5402 if (ssh->eof_needed)
5403 ssh_special(ssh, TS_EOF);
6e48c3fe 5404
7cca0d81 5405 /*
5406 * Transfer data!
5407 */
b9d7bcad 5408 if (ssh->ldisc)
5409 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
51470298 5410 ssh->send_ok = 1;
7cca0d81 5411 while (1) {
e5574168 5412 crReturnV;
51470298 5413 s->try_send = FALSE;
7cca0d81 5414 if (ispkt) {
51470298 5415 if (ssh->pktin.type == SSH2_MSG_CHANNEL_DATA ||
5416 ssh->pktin.type == SSH2_MSG_CHANNEL_EXTENDED_DATA) {
32874aea 5417 char *data;
5418 int length;
51470298 5419 unsigned i = ssh2_pkt_getuint32(ssh);
32874aea 5420 struct ssh_channel *c;
51470298 5421 c = find234(ssh->channels, &i, ssh_channelfind);
32874aea 5422 if (!c)
5423 continue; /* nonexistent channel */
51470298 5424 if (ssh->pktin.type == SSH2_MSG_CHANNEL_EXTENDED_DATA &&
5425 ssh2_pkt_getuint32(ssh) != SSH2_EXTENDED_DATA_STDERR)
32874aea 5426 continue; /* extended but not stderr */
51470298 5427 ssh2_pkt_getstring(ssh, &data, &length);
32874aea 5428 if (data) {
5471d09a 5429 int bufsize;
5430 c->v.v2.locwindow -= length;
32874aea 5431 switch (c->type) {
5432 case CHAN_MAINSESSION:
5471d09a 5433 bufsize =
51470298 5434 from_backend(ssh->frontend, ssh->pktin.type ==
5471d09a 5435 SSH2_MSG_CHANNEL_EXTENDED_DATA,
5436 data, length);
32874aea 5437 break;
5438 case CHAN_X11:
5471d09a 5439 bufsize = x11_send(c->u.x11.s, data, length);
32874aea 5440 break;
d74d141c 5441 case CHAN_SOCKDATA:
5471d09a 5442 bufsize = pfd_send(c->u.pfd.s, data, length);
bc240b21 5443 break;
36c2a3e9 5444 case CHAN_AGENT:
32874aea 5445 while (length > 0) {
5446 if (c->u.a.lensofar < 4) {
5447 int l = min(4 - c->u.a.lensofar, length);
5448 memcpy(c->u.a.msglen + c->u.a.lensofar,
5449 data, l);
5450 data += l;
5451 length -= l;
5452 c->u.a.lensofar += l;
5453 }
5454 if (c->u.a.lensofar == 4) {
5455 c->u.a.totallen =
5456 4 + GET_32BIT(c->u.a.msglen);
5457 c->u.a.message = smalloc(c->u.a.totallen);
5458 memcpy(c->u.a.message, c->u.a.msglen, 4);
5459 }
5460 if (c->u.a.lensofar >= 4 && length > 0) {
5461 int l =
5462 min(c->u.a.totallen - c->u.a.lensofar,
5463 length);
5464 memcpy(c->u.a.message + c->u.a.lensofar,
5465 data, l);
5466 data += l;
5467 length -= l;
5468 c->u.a.lensofar += l;
5469 }
5470 if (c->u.a.lensofar == c->u.a.totallen) {
5471 void *reply, *sentreply;
5472 int replylen;
5473 agent_query(c->u.a.message,
5474 c->u.a.totallen, &reply,
5475 &replylen);
5476 if (reply)
5477 sentreply = reply;
5478 else {
5479 /* Fake SSH_AGENT_FAILURE. */
5480 sentreply = "\0\0\0\1\5";
5481 replylen = 5;
5482 }
51470298 5483 ssh2_add_channel_data(c, sentreply, replylen);
5484 s->try_send = TRUE;
32874aea 5485 if (reply)
5486 sfree(reply);
5487 sfree(c->u.a.message);
5488 c->u.a.lensofar = 0;
5489 }
5490 }
5471d09a 5491 bufsize = 0;
32874aea 5492 break;
5493 }
5494 /*
5471d09a 5495 * If we are not buffering too much data,
5496 * enlarge the window again at the remote side.
32874aea 5497 */
5471d09a 5498 if (bufsize < OUR_V2_WINSIZE)
5499 ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
32874aea 5500 }
51470298 5501 } else if (ssh->pktin.type == SSH2_MSG_CHANNEL_EOF) {
5502 unsigned i = ssh2_pkt_getuint32(ssh);
32874aea 5503 struct ssh_channel *c;
5504
51470298 5505 c = find234(ssh->channels, &i, ssh_channelfind);
32874aea 5506 if (!c)
5507 continue; /* nonexistent channel */
5508
5509 if (c->type == CHAN_X11) {
5510 /*
5511 * Remote EOF on an X11 channel means we should
5512 * wrap up and close the channel ourselves.
5513 */
5514 x11_close(c->u.x11.s);
5515 sshfwd_close(c);
5516 } else if (c->type == CHAN_AGENT) {
36c2a3e9 5517 sshfwd_close(c);
d74d141c 5518 } else if (c->type == CHAN_SOCKDATA) {
bc240b21 5519 pfd_close(c->u.pfd.s);
5520 sshfwd_close(c);
36c2a3e9 5521 }
51470298 5522 } else if (ssh->pktin.type == SSH2_MSG_CHANNEL_CLOSE) {
5523 unsigned i = ssh2_pkt_getuint32(ssh);
32874aea 5524 struct ssh_channel *c;
5525
51470298 5526 c = find234(ssh->channels, &i, ssh_channelfind);
d0d844c1 5527 if (!c || ((int)c->remoteid) == -1) {
a8327734 5528 bombout((ssh,"Received CHANNEL_CLOSE for %s channel %d\n",
d0d844c1 5529 c ? "half-open" : "nonexistent", i));
5530 }
32874aea 5531 /* Do pre-close processing on the channel. */
5532 switch (c->type) {
5533 case CHAN_MAINSESSION:
5534 break; /* nothing to see here, move along */
5535 case CHAN_X11:
92f157bd 5536 if (c->u.x11.s != NULL)
5537 x11_close(c->u.x11.s);
5538 sshfwd_close(c);
32874aea 5539 break;
5540 case CHAN_AGENT:
92f157bd 5541 sshfwd_close(c);
32874aea 5542 break;
d74d141c 5543 case CHAN_SOCKDATA:
92f157bd 5544 if (c->u.pfd.s != NULL)
5545 pfd_close(c->u.pfd.s);
5546 sshfwd_close(c);
bc240b21 5547 break;
32874aea 5548 }
92f157bd 5549 if (c->closes == 0) {
51470298 5550 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_CLOSE);
5551 ssh2_pkt_adduint32(ssh, c->remoteid);
5552 ssh2_pkt_send(ssh);
92f157bd 5553 }
51470298 5554 del234(ssh->channels, c);
5471d09a 5555 bufchain_clear(&c->v.v2.outbuffer);
32874aea 5556 sfree(c);
5557
5558 /*
5559 * See if that was the last channel left open.
5560 */
51470298 5561 if (count234(ssh->channels) == 0) {
ca2914d1 5562#if 0
5563 /*
5564 * We used to send SSH_MSG_DISCONNECT here,
5565 * because I'd believed that _every_ conforming
5566 * SSH2 connection had to end with a disconnect
5567 * being sent by at least one side; apparently
5568 * I was wrong and it's perfectly OK to
5569 * unceremoniously slam the connection shut
5570 * when you're done, and indeed OpenSSH feels
5571 * this is more polite than sending a
5572 * DISCONNECT. So now we don't.
5573 */
32874aea 5574 logevent("All channels closed. Disconnecting");
51470298 5575 ssh2_pkt_init(ssh, SSH2_MSG_DISCONNECT);
5576 ssh2_pkt_adduint32(ssh, SSH2_DISCONNECT_BY_APPLICATION);
5577 ssh2_pkt_addstring(ssh, "All open channels closed");
5578 ssh2_pkt_addstring(ssh, "en"); /* language tag */
5579 ssh2_pkt_send(ssh);
ca2914d1 5580#endif
51470298 5581 ssh->state = SSH_STATE_CLOSED;
32874aea 5582 crReturnV;
5583 }
5584 continue; /* remote sends close; ignore (FIXME) */
51470298 5585 } else if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
5586 unsigned i = ssh2_pkt_getuint32(ssh);
32874aea 5587 struct ssh_channel *c;
51470298 5588 c = find234(ssh->channels, &i, ssh_channelfind);
32874aea 5589 if (!c)
5590 continue; /* nonexistent channel */
51470298 5591 c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
5592 s->try_send = TRUE;
5593 } else if (ssh->pktin.type == SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
5594 unsigned i = ssh2_pkt_getuint32(ssh);
bc240b21 5595 struct ssh_channel *c;
51470298 5596 c = find234(ssh->channels, &i, ssh_channelfind);
bc240b21 5597 if (!c)
5598 continue; /* nonexistent channel */
5599 if (c->type != CHAN_SOCKDATA_DORMANT)
5600 continue; /* dunno why they're confirming this */
51470298 5601 c->remoteid = ssh2_pkt_getuint32(ssh);
bc240b21 5602 c->type = CHAN_SOCKDATA;
51470298 5603 c->v.v2.remwindow = ssh2_pkt_getuint32(ssh);
5604 c->v.v2.remmaxpkt = ssh2_pkt_getuint32(ssh);
4ed34d25 5605 if (c->u.pfd.s)
5606 pfd_confirm(c->u.pfd.s);
5607 if (c->closes) {
5608 /*
5609 * We have a pending close on this channel,
5610 * which we decided on before the server acked
5611 * the channel open. So now we know the
5612 * remoteid, we can close it again.
5613 */
51470298 5614 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_CLOSE);
5615 ssh2_pkt_adduint32(ssh, c->remoteid);
5616 ssh2_pkt_send(ssh);
4ed34d25 5617 }
51470298 5618 } else if (ssh->pktin.type == SSH2_MSG_CHANNEL_OPEN_FAILURE) {
5619 unsigned i = ssh2_pkt_getuint32(ssh);
724cface 5620 struct ssh_channel *c;
51470298 5621 c = find234(ssh->channels, &i, ssh_channelfind);
724cface 5622 if (!c)
5623 continue; /* nonexistent channel */
5624 if (c->type != CHAN_SOCKDATA_DORMANT)
5625 continue; /* dunno why they're failing this */
5626
5627 logevent("Forwarded connection refused by server");
5628
5629 pfd_close(c->u.pfd.s);
5630
51470298 5631 del234(ssh->channels, c);
724cface 5632 sfree(c);
51470298 5633 } else if (ssh->pktin.type == SSH2_MSG_CHANNEL_REQUEST) {
ebb0a590 5634 unsigned localid;
5635 char *type;
5636 int typelen, want_reply;
5637 struct ssh_channel *c;
5638
51470298 5639 localid = ssh2_pkt_getuint32(ssh);
5640 ssh2_pkt_getstring(ssh, &type, &typelen);
5641 want_reply = ssh2_pkt_getbool(ssh);
ebb0a590 5642
5643 /*
5644 * First, check that the channel exists. Otherwise,
5645 * we can instantly disconnect with a rude message.
5646 */
51470298 5647 c = find234(ssh->channels, &localid, ssh_channelfind);
ebb0a590 5648 if (!c) {
5649 char buf[80];
5650 sprintf(buf, "Received channel request for nonexistent"
5651 " channel %d", localid);
5652 logevent(buf);
51470298 5653 ssh2_pkt_init(ssh, SSH2_MSG_DISCONNECT);
5654 ssh2_pkt_adduint32(ssh, SSH2_DISCONNECT_BY_APPLICATION);
5655 ssh2_pkt_addstring(ssh, buf);
5656 ssh2_pkt_addstring(ssh, "en"); /* language tag */
5657 ssh2_pkt_send(ssh);
247308b5 5658 connection_fatal("%s", buf);
51470298 5659 ssh->state = SSH_STATE_CLOSED;
ebb0a590 5660 crReturnV;
5661 }
5662
5663 /*
d8d6c7e5 5664 * Having got the channel number, we now look at
5665 * the request type string to see if it's something
5666 * we recognise.
ebb0a590 5667 */
d8d6c7e5 5668 if (typelen == 11 && !memcmp(type, "exit-status", 11) &&
51470298 5669 c == ssh->mainchan) {
d8d6c7e5 5670 /* We recognise "exit-status" on the primary channel. */
5671 char buf[100];
51470298 5672 ssh->exitcode = ssh2_pkt_getuint32(ssh);
d8d6c7e5 5673 sprintf(buf, "Server sent command exit status %d",
51470298 5674 ssh->exitcode);
d8d6c7e5 5675 logevent(buf);
5676 if (want_reply) {
51470298 5677 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_SUCCESS);
5678 ssh2_pkt_adduint32(ssh, c->remoteid);
5679 ssh2_pkt_send(ssh);
d8d6c7e5 5680 }
5681 } else {
5682 /*
5683 * This is a channel request we don't know
5684 * about, so we now either ignore the request
5685 * or respond with CHANNEL_FAILURE, depending
5686 * on want_reply.
5687 */
5688 if (want_reply) {
51470298 5689 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_FAILURE);
5690 ssh2_pkt_adduint32(ssh, c->remoteid);
5691 ssh2_pkt_send(ssh);
d8d6c7e5 5692 }
ebb0a590 5693 }
51470298 5694 } else if (ssh->pktin.type == SSH2_MSG_GLOBAL_REQUEST) {
697d4856 5695 char *type;
5696 int typelen, want_reply;
5697
51470298 5698 ssh2_pkt_getstring(ssh, &type, &typelen);
5699 want_reply = ssh2_pkt_getbool(ssh);
697d4856 5700
5701 /*
5702 * We currently don't support any global requests
5703 * at all, so we either ignore the request or
5704 * respond with REQUEST_FAILURE, depending on
5705 * want_reply.
5706 */
5707 if (want_reply) {
51470298 5708 ssh2_pkt_init(ssh, SSH2_MSG_REQUEST_FAILURE);
5709 ssh2_pkt_send(ssh);
697d4856 5710 }
51470298 5711 } else if (ssh->pktin.type == SSH2_MSG_CHANNEL_OPEN) {
32874aea 5712 char *type;
5713 int typelen;
5714 char *error = NULL;
5715 struct ssh_channel *c;
bc240b21 5716 unsigned remid, winsize, pktsize;
51470298 5717 ssh2_pkt_getstring(ssh, &type, &typelen);
32874aea 5718 c = smalloc(sizeof(struct ssh_channel));
51470298 5719 c->ssh = ssh;
32874aea 5720
51470298 5721 remid = ssh2_pkt_getuint32(ssh);
5722 winsize = ssh2_pkt_getuint32(ssh);
5723 pktsize = ssh2_pkt_getuint32(ssh);
bc240b21 5724
32874aea 5725 if (typelen == 3 && !memcmp(type, "x11", 3)) {
51470298 5726 if (!ssh->X11_fwd_enabled)
32874aea 5727 error = "X11 forwarding is not enabled";
302121de 5728 else if (x11_init(&c->u.x11.s, cfg.x11_display, c,
5729 ssh->x11auth) != NULL) {
32874aea 5730 error = "Unable to open an X11 connection";
5731 } else {
5732 c->type = CHAN_X11;
5733 }
bc240b21 5734 } else if (typelen == 15 &&
5735 !memcmp(type, "forwarded-tcpip", 15)) {
5736 struct ssh_rportfwd pf, *realpf;
5737 char *dummy;
5738 int dummylen;
51470298 5739 ssh2_pkt_getstring(ssh, &dummy, &dummylen);/* skip address */
5740 pf.sport = ssh2_pkt_getuint32(ssh);
5741 realpf = find234(ssh->rportfwds, &pf, NULL);
bc240b21 5742 if (realpf == NULL) {
5743 error = "Remote port is not recognised";
5744 } else {
5745 char *e = pfd_newconnect(&c->u.pfd.s, realpf->dhost,
5746 realpf->dport, c);
57356d63 5747 logeventf(ssh, "Received remote port open request"
5748 " for %s:%d", realpf->dhost, realpf->dport);
bc240b21 5749 if (e != NULL) {
57356d63 5750 logeventf(ssh, "Port open failed: %s", e);
bc240b21 5751 error = "Port open failed";
5752 } else {
5753 logevent("Forwarded port opened successfully");
5754 c->type = CHAN_SOCKDATA;
5755 }
5756 }
32874aea 5757 } else if (typelen == 22 &&
36c2a3e9 5758 !memcmp(type, "auth-agent@openssh.com", 3)) {
51470298 5759 if (!ssh->agentfwd_enabled)
32874aea 5760 error = "Agent forwarding is not enabled";
36c2a3e9 5761 else {
32874aea 5762 c->type = CHAN_AGENT; /* identify channel type */
36c2a3e9 5763 c->u.a.lensofar = 0;
32874aea 5764 }
5765 } else {
5766 error = "Unsupported channel type requested";
5767 }
5768
bc240b21 5769 c->remoteid = remid;
32874aea 5770 if (error) {
51470298 5771 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_OPEN_FAILURE);
5772 ssh2_pkt_adduint32(ssh, c->remoteid);
5773 ssh2_pkt_adduint32(ssh, SSH2_OPEN_CONNECT_FAILED);
5774 ssh2_pkt_addstring(ssh, error);
5775 ssh2_pkt_addstring(ssh, "en"); /* language tag */
5776 ssh2_pkt_send(ssh);
32874aea 5777 sfree(c);
5778 } else {
51470298 5779 c->localid = alloc_channel_id(ssh);
32874aea 5780 c->closes = 0;
5471d09a 5781 c->v.v2.locwindow = OUR_V2_WINSIZE;
5782 c->v.v2.remwindow = winsize;
5783 c->v.v2.remmaxpkt = pktsize;
5784 bufchain_init(&c->v.v2.outbuffer);
51470298 5785 add234(ssh->channels, c);
5786 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
5787 ssh2_pkt_adduint32(ssh, c->remoteid);
5788 ssh2_pkt_adduint32(ssh, c->localid);
5789 ssh2_pkt_adduint32(ssh, c->v.v2.locwindow);
5790 ssh2_pkt_adduint32(ssh, 0x4000UL); /* our max pkt size */
5791 ssh2_pkt_send(ssh);
32874aea 5792 }
7cca0d81 5793 } else {
a8327734 5794 bombout((ssh,"Strange packet received: type %d", ssh->pktin.type));
32874aea 5795 crReturnV;
7cca0d81 5796 }
5797 } else {
32874aea 5798 /*
5799 * We have spare data. Add it to the channel buffer.
5800 */
d8baa528 5801 ssh2_add_channel_data(ssh->mainchan, (char *)in, inlen);
51470298 5802 s->try_send = TRUE;
32874aea 5803 }
51470298 5804 if (s->try_send) {
32874aea 5805 int i;
5806 struct ssh_channel *c;
5807 /*
5808 * Try to send data on all channels if we can.
5809 */
51470298 5810 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++) {
5471d09a 5811 int bufsize = ssh2_try_send(c);
5812 if (bufsize == 0) {
5813 switch (c->type) {
5814 case CHAN_MAINSESSION:
5815 /* stdin need not receive an unthrottle
5816 * notification since it will be polled */
5817 break;
5818 case CHAN_X11:
5819 x11_unthrottle(c->u.x11.s);
5820 break;
5821 case CHAN_AGENT:
5822 /* agent sockets are request/response and need no
5823 * buffer management */
5824 break;
5825 case CHAN_SOCKDATA:
5826 pfd_unthrottle(c->u.pfd.s);
5827 break;
5828 }
5829 }
5830 }
7cca0d81 5831 }
e5574168 5832 }
5833
5834 crFinishV;
5835}
5836
5837/*
7cca0d81 5838 * Handle the top-level SSH2 protocol.
5839 */
51470298 5840static void ssh2_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt)
7cca0d81 5841{
51470298 5842 if (do_ssh2_transport(ssh, in, inlen, ispkt) == 0)
32874aea 5843 return;
51470298 5844 do_ssh2_authconn(ssh, in, inlen, ispkt);
7cca0d81 5845}
5846
5847/*
8df7a775 5848 * Called to set up the connection.
374330e2 5849 *
5850 * Returns an error message, or NULL on success.
374330e2 5851 */
51470298 5852static char *ssh_init(void *frontend_handle, void **backend_handle,
887035a5 5853 char *host, int port, char **realhost, int nodelay)
32874aea 5854{
fb09bf1c 5855 char *p;
51470298 5856 Ssh ssh;
5857
5858 ssh = smalloc(sizeof(*ssh));
5859 ssh->s = NULL;
5860 ssh->cipher = NULL;
371e569c 5861 ssh->v1_cipher_ctx = NULL;
0183b242 5862 ssh->crcda_ctx = NULL;
51470298 5863 ssh->cscipher = NULL;
371e569c 5864 ssh->cs_cipher_ctx = NULL;
51470298 5865 ssh->sccipher = NULL;
371e569c 5866 ssh->sc_cipher_ctx = NULL;
51470298 5867 ssh->csmac = NULL;
a8327734 5868 ssh->cs_mac_ctx = NULL;
51470298 5869 ssh->scmac = NULL;
e0e1a00d 5870 ssh->sc_mac_ctx = NULL;
51470298 5871 ssh->cscomp = NULL;
5366aed8 5872 ssh->cs_comp_ctx = NULL;
51470298 5873 ssh->sccomp = NULL;
5366aed8 5874 ssh->sc_comp_ctx = NULL;
51470298 5875 ssh->kex = NULL;
5876 ssh->hostkey = NULL;
5877 ssh->exitcode = -1;
5878 ssh->state = SSH_STATE_PREPACKET;
5879 ssh->size_needed = FALSE;
5880 ssh->eof_needed = FALSE;
b9d7bcad 5881 ssh->ldisc = NULL;
a8327734 5882 ssh->logctx = NULL;
51470298 5883 {
5884 static const struct Packet empty = { 0, 0, NULL, NULL, 0 };
5885 ssh->pktin = ssh->pktout = empty;
5886 }
5887 ssh->deferred_send_data = NULL;
5888 ssh->deferred_len = 0;
5889 ssh->deferred_size = 0;
5890 ssh->fallback_cmd = 0;
5891 ssh->pkt_ctx = 0;
302121de 5892 ssh->x11auth = NULL;
be738459 5893 ssh->v1_compressing = FALSE;
51470298 5894 ssh->v2_outgoing_sequence = 0;
5895 ssh->ssh1_rdpkt_crstate = 0;
5896 ssh->ssh2_rdpkt_crstate = 0;
5897 ssh->do_ssh_init_crstate = 0;
5898 ssh->ssh_gotdata_crstate = 0;
5899 ssh->ssh1_protocol_crstate = 0;
5900 ssh->do_ssh1_login_crstate = 0;
5901 ssh->do_ssh2_transport_crstate = 0;
5902 ssh->do_ssh2_authconn_crstate = 0;
5903 ssh->do_ssh_init_state = NULL;
5904 ssh->do_ssh1_login_state = NULL;
5905 ssh->do_ssh2_transport_state = NULL;
5906 ssh->do_ssh2_authconn_state = NULL;
6571dbfd 5907 ssh->mainchan = NULL;
968d2d92 5908 ssh->throttled_all = 0;
5909 ssh->v1_stdout_throttling = 0;
51470298 5910
5911 *backend_handle = ssh;
32874aea 5912
8f203108 5913#ifdef MSCRYPTOAPI
32874aea 5914 if (crypto_startup() == 0)
8f203108 5915 return "Microsoft high encryption pack not installed!";
5916#endif
374330e2 5917
51470298 5918 ssh->frontend = frontend_handle;
5919 ssh->term_width = cfg.width;
5920 ssh->term_height = cfg.height;
887035a5 5921
51470298 5922 ssh->send_ok = 0;
5923 ssh->editing = 0;
5924 ssh->echoing = 0;
5925 ssh->v1_throttle_count = 0;
5926 ssh->overall_bufsize = 0;
5927 ssh->fallback_cmd = 0;
8df7a775 5928
51470298 5929 p = connect_to_host(ssh, host, port, realhost, nodelay);
fb09bf1c 5930 if (p != NULL)
5931 return p;
374330e2 5932
374330e2 5933 return NULL;
5934}
5935
5936/*
374330e2 5937 * Called to send data down the Telnet connection.
5938 */
51470298 5939static int ssh_send(void *handle, char *buf, int len)
32874aea 5940{
51470298 5941 Ssh ssh = (Ssh) handle;
5942
5943 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
5471d09a 5944 return 0;
374330e2 5945
d8baa528 5946 ssh->protocol(ssh, (unsigned char *)buf, len, 0);
5471d09a 5947
51470298 5948 return ssh_sendbuffer(ssh);
5471d09a 5949}
5950
5951/*
5952 * Called to query the current amount of buffered stdin data.
5953 */
51470298 5954static int ssh_sendbuffer(void *handle)
5471d09a 5955{
51470298 5956 Ssh ssh = (Ssh) handle;
5471d09a 5957 int override_value;
5958
51470298 5959 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
5471d09a 5960 return 0;
5961
5962 /*
5963 * If the SSH socket itself has backed up, add the total backup
5964 * size on that to any individual buffer on the stdin channel.
5965 */
5966 override_value = 0;
51470298 5967 if (ssh->throttled_all)
5968 override_value = ssh->overall_bufsize;
5471d09a 5969
51470298 5970 if (ssh->version == 1) {
5471d09a 5971 return override_value;
51470298 5972 } else if (ssh->version == 2) {
5973 if (!ssh->mainchan || ssh->mainchan->closes > 0)
5471d09a 5974 return override_value;
5975 else
51470298 5976 return (override_value +
5977 bufchain_size(&ssh->mainchan->v.v2.outbuffer));
5471d09a 5978 }
5979
5980 return 0;
374330e2 5981}
5982
5983/*
6e48c3fe 5984 * Called to set the size of the window from SSH's POV.
374330e2 5985 */
51470298 5986static void ssh_size(void *handle, int width, int height)
32874aea 5987{
51470298 5988 Ssh ssh = (Ssh) handle;
5989
5990 ssh->term_width = width;
5991 ssh->term_height = height;
f278d6f8 5992
51470298 5993 switch (ssh->state) {
374330e2 5994 case SSH_STATE_BEFORE_SIZE:
3687d221 5995 case SSH_STATE_PREPACKET:
21248260 5996 case SSH_STATE_CLOSED:
374330e2 5997 break; /* do nothing */
5998 case SSH_STATE_INTERMED:
51470298 5999 ssh->size_needed = TRUE; /* buffer for later */
374330e2 6000 break;
6001 case SSH_STATE_SESSION:
32874aea 6002 if (!cfg.nopty) {
51470298 6003 if (ssh->version == 1) {
6004 send_packet(ssh, SSH1_CMSG_WINDOW_SIZE,
6005 PKT_INT, ssh->term_height,
6006 PKT_INT, ssh->term_width,
32874aea 6007 PKT_INT, 0, PKT_INT, 0, PKT_END);
6008 } else {
51470298 6009 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST);
6010 ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid);
6011 ssh2_pkt_addstring(ssh, "window-change");
6012 ssh2_pkt_addbool(ssh, 0);
6013 ssh2_pkt_adduint32(ssh, ssh->term_width);
6014 ssh2_pkt_adduint32(ssh, ssh->term_height);
6015 ssh2_pkt_adduint32(ssh, 0);
6016 ssh2_pkt_adduint32(ssh, 0);
6017 ssh2_pkt_send(ssh);
32874aea 6018 }
6019 }
6020 break;
374330e2 6021 }
6022}
6023
6024/*
6abbf9e3 6025 * Send Telnet special codes. TS_EOF is useful for `plink', so you
6026 * can send an EOF and collect resulting output (e.g. `plink
6027 * hostname sort').
374330e2 6028 */
51470298 6029static void ssh_special(void *handle, Telnet_Special code)
32874aea 6030{
51470298 6031 Ssh ssh = (Ssh) handle;
6032
6abbf9e3 6033 if (code == TS_EOF) {
51470298 6034 if (ssh->state != SSH_STATE_SESSION) {
32874aea 6035 /*
6036 * Buffer the EOF in case we are pre-SESSION, so we can
6037 * send it as soon as we reach SESSION.
6038 */
6039 if (code == TS_EOF)
51470298 6040 ssh->eof_needed = TRUE;
32874aea 6041 return;
6042 }
51470298 6043 if (ssh->version == 1) {
6044 send_packet(ssh, SSH1_CMSG_EOF, PKT_END);
32874aea 6045 } else {
51470298 6046 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_EOF);
6047 ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid);
6048 ssh2_pkt_send(ssh);
32874aea 6049 }
6050 logevent("Sent EOF message");
ec55b220 6051 } else if (code == TS_PING) {
51470298 6052 if (ssh->state == SSH_STATE_CLOSED
6053 || ssh->state == SSH_STATE_PREPACKET) return;
6054 if (ssh->version == 1) {
6055 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
6056 send_packet(ssh, SSH1_MSG_IGNORE, PKT_STR, "", PKT_END);
32874aea 6057 } else {
51470298 6058 ssh2_pkt_init(ssh, SSH2_MSG_IGNORE);
6059 ssh2_pkt_addstring_start(ssh);
6060 ssh2_pkt_send(ssh);
32874aea 6061 }
6abbf9e3 6062 } else {
32874aea 6063 /* do nothing */
6abbf9e3 6064 }
374330e2 6065}
6066
51470298 6067void *new_sock_channel(void *handle, Socket s)
d74d141c 6068{
51470298 6069 Ssh ssh = (Ssh) handle;
d74d141c 6070 struct ssh_channel *c;
6071 c = smalloc(sizeof(struct ssh_channel));
51470298 6072 c->ssh = ssh;
d74d141c 6073
6074 if (c) {
bc240b21 6075 c->remoteid = -1; /* to be set when open confirmed */
51470298 6076 c->localid = alloc_channel_id(ssh);
d74d141c 6077 c->closes = 0;
bc240b21 6078 c->type = CHAN_SOCKDATA_DORMANT;/* identify channel type */
d74d141c 6079 c->u.pfd.s = s;
013dd8c0 6080 bufchain_init(&c->v.v2.outbuffer);
51470298 6081 add234(ssh->channels, c);
d74d141c 6082 }
6083 return c;
6084}
6085
5471d09a 6086/*
6087 * This is called when stdout/stderr (the entity to which
6088 * from_backend sends data) manages to clear some backlog.
6089 */
ae9ae89f 6090static void ssh_unthrottle(void *handle, int bufsize)
5471d09a 6091{
51470298 6092 Ssh ssh = (Ssh) handle;
6093 if (ssh->version == 1) {
6094 if (ssh->v1_stdout_throttling && bufsize < SSH1_BUFFER_LIMIT) {
6095 ssh->v1_stdout_throttling = 0;
6096 ssh1_throttle(ssh, -1);
5471d09a 6097 }
6098 } else {
51470298 6099 if (ssh->mainchan && ssh->mainchan->closes == 0)
6100 ssh2_set_window(ssh->mainchan, OUR_V2_WINSIZE - bufsize);
5471d09a 6101 }
6102}
6103
6b78788a 6104void ssh_send_port_open(void *channel, char *hostname, int port, char *org)
d74d141c 6105{
6106 struct ssh_channel *c = (struct ssh_channel *)channel;
6b78788a 6107 Ssh ssh = c->ssh;
d74d141c 6108
57356d63 6109 logeventf(ssh, "Opening forwarded connection to %s:%d", hostname, port);
d74d141c 6110
51470298 6111 if (ssh->version == 1) {
6112 send_packet(ssh, SSH1_MSG_PORT_OPEN,
bc240b21 6113 PKT_INT, c->localid,
6114 PKT_STR, hostname,
6115 PKT_INT, port,
6116 //PKT_STR, <org:orgport>,
6117 PKT_END);
6118 } else {
51470298 6119 ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_OPEN);
6120 ssh2_pkt_addstring(ssh, "direct-tcpip");
6121 ssh2_pkt_adduint32(ssh, c->localid);
5471d09a 6122 c->v.v2.locwindow = OUR_V2_WINSIZE;
51470298 6123 ssh2_pkt_adduint32(ssh, c->v.v2.locwindow);/* our window size */
6124 ssh2_pkt_adduint32(ssh, 0x4000UL); /* our max pkt size */
6125 ssh2_pkt_addstring(ssh, hostname);
6126 ssh2_pkt_adduint32(ssh, port);
bc240b21 6127 /*
6128 * We make up values for the originator data; partly it's
6129 * too much hassle to keep track, and partly I'm not
6130 * convinced the server should be told details like that
6131 * about my local network configuration.
6132 */
51470298 6133 ssh2_pkt_addstring(ssh, "client-side-connection");
6134 ssh2_pkt_adduint32(ssh, 0);
6135 ssh2_pkt_send(ssh);
bc240b21 6136 }
d74d141c 6137}
6138
6139
51470298 6140static Socket ssh_socket(void *handle)
32874aea 6141{
51470298 6142 Ssh ssh = (Ssh) handle;
6143 return ssh->s;
32874aea 6144}
8ccc75b0 6145
51470298 6146static int ssh_sendok(void *handle)
32874aea 6147{
51470298 6148 Ssh ssh = (Ssh) handle;
6149 return ssh->send_ok;
32874aea 6150}
fb09bf1c 6151
51470298 6152static int ssh_ldisc(void *handle, int option)
32874aea 6153{
51470298 6154 Ssh ssh = (Ssh) handle;
32874aea 6155 if (option == LD_ECHO)
51470298 6156 return ssh->echoing;
32874aea 6157 if (option == LD_EDIT)
51470298 6158 return ssh->editing;
0965bee0 6159 return FALSE;
6160}
6161
b9d7bcad 6162static void ssh_provide_ldisc(void *handle, void *ldisc)
6163{
6164 Ssh ssh = (Ssh) handle;
6165 ssh->ldisc = ldisc;
6166}
6167
a8327734 6168static void ssh_provide_logctx(void *handle, void *logctx)
6169{
6170 Ssh ssh = (Ssh) handle;
6171 ssh->logctx = logctx;
6172}
6173
51470298 6174static int ssh_return_exitcode(void *handle)
6175{
6176 Ssh ssh = (Ssh) handle;
6177 return ssh->exitcode;
6178}
6179
6180/*
6181 * Gross hack: pscp will try to start SFTP but fall back to scp1 if
6182 * that fails. This variable is the means by which scp.c can reach
6183 * into the SSH code and find out which one it got.
6184 */
6185extern int ssh_fallback_cmd(void *handle)
d8d6c7e5 6186{
51470298 6187 Ssh ssh = (Ssh) handle;
6188 return ssh->fallback_cmd;
d8d6c7e5 6189}
6190
374330e2 6191Backend ssh_backend = {
6192 ssh_init,
374330e2 6193 ssh_send,
5471d09a 6194 ssh_sendbuffer,
374330e2 6195 ssh_size,
4017be6d 6196 ssh_special,
8ccc75b0 6197 ssh_socket,
d8d6c7e5 6198 ssh_return_exitcode,
97db3be4 6199 ssh_sendok,
0965bee0 6200 ssh_ldisc,
b9d7bcad 6201 ssh_provide_ldisc,
a8327734 6202 ssh_provide_logctx,
5471d09a 6203 ssh_unthrottle,
97db3be4 6204 22
bc240b21 6205};
Local modifications for Simon Tatham's `PuTTY' SSH client and terminal emulator