#define BUG_CHOKES_ON_RSA 8
#define BUG_SSH2_RSA_PADDING 16
#define BUG_SSH2_DERIVEKEY 32
+#define BUG_SSH2_DH_GEX 64
static int ssh_pkt_ctx = 0;
struct ssh_channel {
unsigned remoteid, localid;
int type;
+ /*
+ * In SSH1, this value contains four bits:
+ *
+ * 1 We have sent SSH1_MSG_CHANNEL_CLOSE.
+ * 2 We have sent SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
+ * 4 We have received SSH1_MSG_CHANNEL_CLOSE.
+ * 8 We have received SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
+ *
+ * A channel is completely finished with when all four bits are set.
+ */
int closes;
union {
struct ssh1_data_channel {
static int ssh_send_ok;
static int ssh_echoing, ssh_editing;
+static void *frontend;
+
+static int ssh_term_width, ssh_term_height;
+
static tree234 *ssh_channels; /* indexed by local id */
static struct ssh_channel *mainchan; /* primary session channel */
static int ssh_exitcode = -1;
static void (*ssh_protocol) (unsigned char *in, int inlen, int ispkt);
static void ssh1_protocol(unsigned char *in, int inlen, int ispkt);
static void ssh2_protocol(unsigned char *in, int inlen, int ispkt);
-static void ssh_size(void);
+static void ssh_size(int width, int height);
static void ssh_special(Telnet_Special);
static int ssh2_try_send(struct ssh_channel *c);
static void ssh2_add_channel_data(struct ssh_channel *c, char *buf,
fputc(buf[i], stderr);
return;
}
- from_backend(1, buf, len);
+ from_backend(frontend, 1, buf, len);
}
static void c_write_untrusted(char *buf, int len)
if (pktin.type == SSH1_MSG_DEBUG) {
/* log debug message */
- char buf[80];
+ char buf[512];
int stringlen = GET_32BIT(pktin.body);
- strcpy(buf, "Remote: ");
- if (stringlen > 70)
- stringlen = 70;
+ strcpy(buf, "Remote debug message: ");
+ if (stringlen > 480)
+ stringlen = 480;
memcpy(buf + 8, pktin.body + 4, stringlen);
buf[8 + stringlen] = '\0';
logevent(buf);
ssh_remote_bugs = 0;
- if (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
- !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
- !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25")) {
+ if (cfg.sshbug_ignore1 == BUG_ON ||
+ (cfg.sshbug_ignore1 == BUG_AUTO &&
+ (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
+ !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
+ !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25")))) {
/*
* These versions don't support SSH1_MSG_IGNORE, so we have
* to use a different defence against password length
logevent("We believe remote version has SSH1 ignore bug");
}
- if (!strcmp(imp, "Cisco-1.25")) {
+ if (cfg.sshbug_plainpw1 == BUG_ON ||
+ (cfg.sshbug_plainpw1 == BUG_AUTO &&
+ (!strcmp(imp, "Cisco-1.25")))) {
/*
* These versions need a plain password sent; they can't
* handle having a null and a random length of data after
logevent("We believe remote version needs a plain SSH1 password");
}
- if (!strcmp(imp, "Cisco-1.25")) {
+ if (cfg.sshbug_rsa1 == BUG_ON ||
+ (cfg.sshbug_rsa1 == BUG_AUTO &&
+ (!strcmp(imp, "Cisco-1.25")))) {
/*
* These versions apparently have no clue whatever about
* RSA authentication and will panic and die if they see
logevent("We believe remote version can't handle RSA authentication");
}
- if (!strncmp(imp, "2.1.0", 5) || !strncmp(imp, "2.0.", 4) ||
- !strncmp(imp, "2.2.0", 5) || !strncmp(imp, "2.3.0", 5) ||
- !strncmp(imp, "2.1 ", 4)) {
+ if (cfg.sshbug_hmac2 == BUG_ON ||
+ (cfg.sshbug_hmac2 == BUG_AUTO &&
+ (!strncmp(imp, "2.1.0", 5) || !strncmp(imp, "2.0.", 4) ||
+ !strncmp(imp, "2.2.0", 5) || !strncmp(imp, "2.3.0", 5) ||
+ !strncmp(imp, "2.1 ", 4)))) {
/*
* These versions have the HMAC bug.
*/
logevent("We believe remote version has SSH2 HMAC bug");
}
- if (!strncmp(imp, "2.0.", 4)) {
+ if (cfg.sshbug_derivekey2 == BUG_ON ||
+ (cfg.sshbug_derivekey2 == BUG_AUTO &&
+ (!strncmp(imp, "2.0.", 4)))) {
/*
* These versions have the key-derivation bug (failing to
* include the literal shared secret in the hashes that
logevent("We believe remote version has SSH2 key-derivation bug");
}
- if ((!strncmp(imp, "OpenSSH_2.", 10) && imp[10]>='5' && imp[10]<='9') ||
- (!strncmp(imp, "OpenSSH_3.", 10) && imp[10]>='0' && imp[10]<='2')) {
+ if (cfg.sshbug_rsapad2 == BUG_ON ||
+ (cfg.sshbug_rsapad2 == BUG_AUTO &&
+ ((!strncmp(imp, "OpenSSH_2.", 10) && imp[10]>='5' && imp[10]<='9') ||
+ (!strncmp(imp, "OpenSSH_3.", 10) && imp[10]>='0' && imp[10]<='2')))){
/*
* These versions have the SSH2 RSA padding bug.
*/
ssh_remote_bugs |= BUG_SSH2_RSA_PADDING;
logevent("We believe remote version has SSH2 RSA padding bug");
}
+
+ if (cfg.sshbug_dhgex2 == BUG_ON) {
+ /*
+ * These versions have the SSH2 DH GEX bug.
+ */
+ ssh_remote_bugs |= BUG_SSH2_DH_GEX;
+ logevent("We believe remote version has SSH2 DH group exchange bug");
+ }
}
static int do_ssh_init(unsigned char c)
c_write_str("\r\n");
}
} else {
- strncpy(username, cfg.username, 99);
- username[99] = '\0';
+ strncpy(username, cfg.username, sizeof(username));
+ username[sizeof(username)-1] = '\0';
}
send_packet(SSH1_CMSG_USER, PKT_STR, username, PKT_END);
ssh2_pkt_send();
}
}
- c->closes = 1;
+ c->closes = 1; /* sent MSG_CLOSE */
if (c->type == CHAN_X11) {
c->u.x11.s = NULL;
logevent("Forwarded X11 connection terminated");
if (!cfg.nopty) {
send_packet(SSH1_CMSG_REQUEST_PTY,
PKT_STR, cfg.termtype,
- PKT_INT, rows, PKT_INT, cols,
+ PKT_INT, ssh_term_height,
+ PKT_INT, ssh_term_width,
PKT_INT, 0, PKT_INT, 0, PKT_CHAR, 0, PKT_END);
ssh_state = SSH_STATE_INTERMED;
do {
ssh_state = SSH_STATE_SESSION;
if (size_needed)
- ssh_size();
+ ssh_size(ssh_term_width, ssh_term_height);
if (eof_needed)
ssh_special(TS_EOF);
pktin.type == SSH1_SMSG_STDERR_DATA) {
long len = GET_32BIT(pktin.body);
int bufsize =
- from_backend(pktin.type == SSH1_SMSG_STDERR_DATA,
+ from_backend(frontend, pktin.type == SSH1_SMSG_STDERR_DATA,
pktin.body + 4, len);
if (!ssh1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
ssh1_stdout_throttling = 1;
unsigned i = GET_32BIT(pktin.body);
struct ssh_channel *c;
c = find234(ssh_channels, &i, ssh_channelfind);
- if (c) {
+ if (c && ((int)c->remoteid) != -1) {
int closetype;
closetype =
(pktin.type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2);
- if (!(c->closes & closetype))
- send_packet(pktin.type, PKT_INT, c->remoteid,
- PKT_END);
+
if ((c->closes == 0) && (c->type == CHAN_X11)) {
logevent("Forwarded X11 connection terminated");
assert(c->u.x11.s != NULL);
pfd_close(c->u.pfd.s);
c->u.pfd.s = NULL;
}
- c->closes |= closetype;
- if (c->closes == 3) {
+
+ c->closes |= (closetype << 2); /* seen this message */
+ if (!(c->closes & closetype)) {
+ send_packet(pktin.type, PKT_INT, c->remoteid,
+ PKT_END);
+ c->closes |= closetype; /* sent it too */
+ }
+
+ if (c->closes == 15) {
del234(ssh_channels, c);
sfree(c);
}
+ } else {
+ bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n",
+ pktin.type == SSH1_MSG_CHANNEL_CLOSE ? "" :
+ "_CONFIRMATION", c ? "half-open" : "nonexistent",
+ i));
}
} else if (pktin.type == SSH1_MSG_CHANNEL_DATA) {
/* Data sent down one of our channels. */
/*
* Be prepared to work around the buggy MAC problem.
*/
- if (cfg.buggymac || (ssh_remote_bugs & BUG_SSH2_HMAC))
+ if (ssh_remote_bugs & BUG_SSH2_HMAC)
maclist = buggymacs, nmacs = lenof(buggymacs);
else
maclist = macs, nmacs = lenof(macs);
/* List key exchange algorithms. */
ssh2_pkt_addstring_start();
for (i = 0; i < lenof(kex_algs); i++) {
+ if (kex_algs[i] == &ssh_diffiehellman_gex &&
+ (ssh_remote_bugs & BUG_SSH2_DH_GEX))
+ continue;
ssh2_pkt_addstring_str(kex_algs[i]->name);
if (i < lenof(kex_algs) - 1)
ssh2_pkt_addstring_str(",");
pktin.savedpos += 16; /* skip garbage cookie */
ssh2_pkt_getstring(&str, &len); /* key exchange algorithms */
for (i = 0; i < lenof(kex_algs); i++) {
+ if (kex_algs[i] == &ssh_diffiehellman_gex &&
+ (ssh_remote_bugs & BUG_SSH2_DH_GEX))
+ continue;
if (in_commasep_string(kex_algs[i]->name, str, len)) {
kex = kex_algs[i];
break;
username[strcspn(username, "\n\r")] = '\0';
} else {
char stuff[200];
- strncpy(username, cfg.username, 99);
- username[99] = '\0';
+ strncpy(username, cfg.username, sizeof(username));
+ username[sizeof(username)-1] = '\0';
if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
sprintf(stuff, "Using username \"%s\".\r\n", username);
c_write_str(stuff);
ssh2_pkt_addstring("pty-req");
ssh2_pkt_addbool(1); /* want reply */
ssh2_pkt_addstring(cfg.termtype);
- ssh2_pkt_adduint32(cols);
- ssh2_pkt_adduint32(rows);
+ ssh2_pkt_adduint32(ssh_term_width);
+ ssh2_pkt_adduint32(ssh_term_height);
ssh2_pkt_adduint32(0); /* pixel width */
ssh2_pkt_adduint32(0); /* pixel height */
ssh2_pkt_addstring_start();
ssh_state = SSH_STATE_SESSION;
if (size_needed)
- ssh_size();
+ ssh_size(ssh_term_width, ssh_term_height);
if (eof_needed)
ssh_special(TS_EOF);
switch (c->type) {
case CHAN_MAINSESSION:
bufsize =
- from_backend(pktin.type ==
+ from_backend(frontend, pktin.type ==
SSH2_MSG_CHANNEL_EXTENDED_DATA,
data, length);
break;
struct ssh_channel *c;
c = find234(ssh_channels, &i, ssh_channelfind);
- if (!c)
- continue; /* nonexistent channel */
+ if (!c || ((int)c->remoteid) == -1) {
+ bombout(("Received CHANNEL_CLOSE for %s channel %d\n",
+ c ? "half-open" : "nonexistent", i));
+ }
/* Do pre-close processing on the channel. */
switch (c->type) {
case CHAN_MAINSESSION:
*
* Returns an error message, or NULL on success.
*/
-static char *ssh_init(char *host, int port, char **realhost, int nodelay)
+static char *ssh_init(void *frontend_handle,
+ char *host, int port, char **realhost, int nodelay)
{
char *p;
return "Microsoft high encryption pack not installed!";
#endif
+ frontend = frontend_handle;
+ ssh_term_width = cfg.width;
+ ssh_term_height = cfg.height;
+
ssh_send_ok = 0;
ssh_editing = 0;
ssh_echoing = 0;
/*
* Called to set the size of the window from SSH's POV.
*/
-static void ssh_size(void)
+static void ssh_size(int width, int height)
{
+ ssh_term_width = width;
+ ssh_term_height = height;
+
switch (ssh_state) {
case SSH_STATE_BEFORE_SIZE:
case SSH_STATE_PREPACKET:
break;
case SSH_STATE_SESSION:
if (!cfg.nopty) {
+ if (!term)
+ return;
if (ssh_version == 1) {
send_packet(SSH1_CMSG_WINDOW_SIZE,
- PKT_INT, rows, PKT_INT, cols,
+ PKT_INT, ssh_term_height, PKT_INT, ssh_term_width,
PKT_INT, 0, PKT_INT, 0, PKT_END);
} else {
ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
ssh2_pkt_adduint32(mainchan->remoteid);
ssh2_pkt_addstring("window-change");
ssh2_pkt_addbool(0);
- ssh2_pkt_adduint32(cols);
- ssh2_pkt_adduint32(rows);
+ ssh2_pkt_adduint32(ssh_term_width);
+ ssh2_pkt_adduint32(ssh_term_height);
ssh2_pkt_adduint32(0);
ssh2_pkt_adduint32(0);
ssh2_pkt_send();
if (ssh_state == SSH_STATE_CLOSED
|| ssh_state == SSH_STATE_PREPACKET) return;
if (ssh_version == 1) {
- send_packet(SSH1_MSG_IGNORE, PKT_STR, "", PKT_END);
+ if (!(ssh_remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
+ send_packet(SSH1_MSG_IGNORE, PKT_STR, "", PKT_END);
} else {
ssh2_pkt_init(SSH2_MSG_IGNORE);
ssh2_pkt_addstring_start();
projects / u / mdw / putty / blobdiff