+ assert(pwlen >= bottom && pwlen <= top);
+
+ randomstr = snewn(top + 1, char);
+
+ for (i = bottom; i <= top; i++) {
+ if (i == pwlen)
+ defer_packet(ssh, s->pwpkt_type,
+ PKT_STR, s->password, PKT_END);
+ else {
+ for (j = 0; j < i; j++) {
+ do {
+ randomstr[j] = random_byte();
+ } while (randomstr[j] == '\0');
+ }
+ randomstr[i] = '\0';
+ defer_packet(ssh, SSH1_MSG_IGNORE,
+ PKT_STR, randomstr, PKT_END);
+ }
+ }
+ logevent("Sending password with camouflage packets");
+ ssh_pkt_defersend(ssh);
+ }
+ else if (!(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
+ /*
+ * The server can't deal with SSH1_MSG_IGNORE
+ * but can deal with padded passwords, so we
+ * can use the secondary defence.
+ */
+ char string[64];
+ char *ss;
+ int len;
+
+ len = strlen(s->password);
+ if (len < sizeof(string)) {
+ ss = string;
+ strcpy(string, s->password);
+ len++; /* cover the zero byte */
+ while (len < sizeof(string)) {
+ string[len++] = (char) random_byte();
+ }
+ } else {
+ ss = s->password;
+ }
+ logevent("Sending length-padded password");
+ send_packet(ssh, s->pwpkt_type, PKT_INT, len,
+ PKT_DATA, ss, len, PKT_END);
+ } else {
+ /*
+ * The server has _both_
+ * BUG_CHOKES_ON_SSH1_IGNORE and
+ * BUG_NEEDS_SSH1_PLAIN_PASSWORD. There is
+ * therefore nothing we can do.
+ */
+ int len;
+ len = strlen(s->password);
+ logevent("Sending unpadded password");
+ send_packet(ssh, s->pwpkt_type, PKT_INT, len,
+ PKT_DATA, s->password, len, PKT_END);
+ }
+ } else {
+ send_packet(ssh, s->pwpkt_type, PKT_STR, s->password, PKT_END);
+ }
+ }
+ logevent("Sent password");
+ memset(s->password, 0, strlen(s->password));
+ crWaitUntil(ispkt);
+ if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
+ if (flags & FLAG_VERBOSE)
+ c_write_str(ssh, "Access denied\r\n");
+ logevent("Authentication refused");
+ } else if (ssh->pktin.type != SSH1_SMSG_SUCCESS) {
+ bombout(("Strange packet received, type %d", ssh->pktin.type));
+ crStop(0);
+ }
+ }
+
+ logevent("Authentication successful");
+
+ crFinish(1);
+}
+
+void sshfwd_close(struct ssh_channel *c)
+{
+ Ssh ssh = c->ssh;
+
+ if (ssh->state != SSH_STATE_SESSION) {
+ assert(ssh->state == SSH_STATE_CLOSED);
+ return;
+ }
+
+ if (c && !c->closes) {
+ /*
+ * If the channel's remoteid is -1, we have sent
+ * CHANNEL_OPEN for this channel, but it hasn't even been
+ * acknowledged by the server. So we must set a close flag
+ * on it now, and then when the server acks the channel
+ * open, we can close it then.
+ */
+ if (((int)c->remoteid) != -1) {
+ if (ssh->version == 1) {
+ send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
+ PKT_END);
+ } else {
+ ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_CLOSE);
+ ssh2_pkt_adduint32(ssh, c->remoteid);
+ ssh2_pkt_send(ssh);
+ }
+ }
+ c->closes = 1; /* sent MSG_CLOSE */
+ if (c->type == CHAN_X11) {
+ c->u.x11.s = NULL;
+ logevent("Forwarded X11 connection terminated");
+ } else if (c->type == CHAN_SOCKDATA ||
+ c->type == CHAN_SOCKDATA_DORMANT) {
+ c->u.pfd.s = NULL;
+ logevent("Forwarded port closed");
+ }
+ }
+}
+
+int sshfwd_write(struct ssh_channel *c, char *buf, int len)
+{
+ Ssh ssh = c->ssh;
+
+ if (ssh->state != SSH_STATE_SESSION) {
+ assert(ssh->state == SSH_STATE_CLOSED);
+ return 0;
+ }
+
+ if (ssh->version == 1) {
+ send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
+ PKT_INT, c->remoteid,
+ PKT_INT, len, PKT_DATA, buf, len, PKT_END);
+ /*
+ * In SSH1 we can return 0 here - implying that forwarded
+ * connections are never individually throttled - because
+ * the only circumstance that can cause throttling will be
+ * the whole SSH connection backing up, in which case
+ * _everything_ will be throttled as a whole.
+ */
+ return 0;
+ } else {
+ ssh2_add_channel_data(c, buf, len);
+ return ssh2_try_send(c);
+ }
+}
+
+void sshfwd_unthrottle(struct ssh_channel *c, int bufsize)
+{
+ Ssh ssh = c->ssh;
+
+ if (ssh->state != SSH_STATE_SESSION) {
+ assert(ssh->state == SSH_STATE_CLOSED);
+ return;
+ }
+
+ if (ssh->version == 1) {
+ if (c->v.v1.throttling && bufsize < SSH1_BUFFER_LIMIT) {
+ c->v.v1.throttling = 0;
+ ssh1_throttle(ssh, -1);
+ }
+ } else {
+ ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
+ }
+}
+
+static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt)
+{
+ crBegin(ssh->ssh1_protocol_crstate);
+
+ random_init();
+
+ while (!do_ssh1_login(ssh, in, inlen, ispkt)) {
+ crReturnV;
+ }
+ if (ssh->state == SSH_STATE_CLOSED)
+ crReturnV;
+
+ if (ssh->cfg.agentfwd && agent_exists()) {
+ logevent("Requesting agent forwarding");
+ send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END);
+ do {
+ crReturnV;
+ } while (!ispkt);
+ if (ssh->pktin.type != SSH1_SMSG_SUCCESS
+ && ssh->pktin.type != SSH1_SMSG_FAILURE) {
+ bombout(("Protocol confusion"));
+ crStopV;
+ } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
+ logevent("Agent forwarding refused");
+ } else {
+ logevent("Agent forwarding enabled");
+ ssh->agentfwd_enabled = TRUE;
+ }
+ }
+
+ if (ssh->cfg.x11_forward) {
+ char proto[20], data[64];
+ logevent("Requesting X11 forwarding");
+ ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
+ data, sizeof(data), ssh->cfg.x11_auth);
+ x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display);
+ if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) {
+ send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
+ PKT_STR, proto, PKT_STR, data,
+ PKT_INT, x11_get_screen_number(ssh->cfg.x11_display),
+ PKT_END);
+ } else {
+ send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
+ PKT_STR, proto, PKT_STR, data, PKT_END);
+ }
+ do {
+ crReturnV;
+ } while (!ispkt);
+ if (ssh->pktin.type != SSH1_SMSG_SUCCESS
+ && ssh->pktin.type != SSH1_SMSG_FAILURE) {
+ bombout(("Protocol confusion"));
+ crStopV;
+ } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
+ logevent("X11 forwarding refused");
+ } else {
+ logevent("X11 forwarding enabled");
+ ssh->X11_fwd_enabled = TRUE;
+ }
+ }
+
+ {
+ char type;
+ int n;
+ int sport,dport,sserv,dserv;
+ char sports[256], dports[256], saddr[256], host[256];
+
+ ssh->rportfwds = newtree234(ssh_rportcmp_ssh1);
+ /* Add port forwardings. */
+ ssh->portfwd_strptr = ssh->cfg.portfwd;
+ while (*ssh->portfwd_strptr) {
+ type = *ssh->portfwd_strptr++;
+ saddr[0] = '\0';
+ n = 0;
+ while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') {
+ if (*ssh->portfwd_strptr == ':') {
+ /*
+ * We've seen a colon in the middle of the
+ * source port number. This means that
+ * everything we've seen until now is the
+ * source _address_, so we'll move it into
+ * saddr and start sports from the beginning
+ * again.
+ */
+ ssh->portfwd_strptr++;
+ sports[n] = '\0';
+ strcpy(saddr, sports);
+ n = 0;
+ }
+ if (n < 255) sports[n++] = *ssh->portfwd_strptr++;
+ }
+ sports[n] = 0;
+ if (type != 'D') {
+ if (*ssh->portfwd_strptr == '\t')
+ ssh->portfwd_strptr++;
+ n = 0;
+ while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') {
+ if (n < 255) host[n++] = *ssh->portfwd_strptr++;
+ }
+ host[n] = 0;
+ if (*ssh->portfwd_strptr == ':')
+ ssh->portfwd_strptr++;
+ n = 0;
+ while (*ssh->portfwd_strptr) {
+ if (n < 255) dports[n++] = *ssh->portfwd_strptr++;
+ }
+ dports[n] = 0;
+ ssh->portfwd_strptr++;
+ dport = atoi(dports);
+ dserv = 0;
+ if (dport == 0) {
+ dserv = 1;
+ dport = net_service_lookup(dports);
+ if (!dport) {
+ logeventf(ssh, "Service lookup failed for"
+ " destination port \"%s\"", dports);
+ }
+ }
+ } else {
+ while (*ssh->portfwd_strptr) ssh->portfwd_strptr++;
+ dport = dserv = -1;
+ }
+ sport = atoi(sports);
+ sserv = 0;
+ if (sport == 0) {
+ sserv = 1;
+ sport = net_service_lookup(sports);
+ if (!sport) {
+ logeventf(ssh, "Service lookup failed for source"
+ " port \"%s\"", sports);
+ }
+ }
+ if (sport && dport) {
+ if (type == 'L') {
+ pfd_addforward(host, dport, *saddr ? saddr : NULL,
+ sport, ssh, &ssh->cfg);
+ logeventf(ssh, "Local port %.*s%.*s%.*s%.*s%d%.*s"
+ " forwarding to %s:%.*s%.*s%d%.*s",
+ (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL,
+ (int)(*saddr?1:0), ":",
+ (int)(sserv ? strlen(sports) : 0), sports,
+ sserv, "(", sport, sserv, ")",
+ host,
+ (int)(dserv ? strlen(dports) : 0), dports,
+ dserv, "(", dport, dserv, ")");
+ } else if (type == 'D') {
+ pfd_addforward(NULL, -1, *saddr ? saddr : NULL,
+ sport, ssh, &ssh->cfg);
+ logeventf(ssh, "Local port %.*s%.*s%.*s%.*s%d%.*s"
+ " doing SOCKS dynamic forwarding",
+ (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL,
+ (int)(*saddr?1:0), ":",
+ (int)(sserv ? strlen(sports) : 0), sports,
+ sserv, "(", sport, sserv, ")");
+ } else {
+ struct ssh_rportfwd *pf;
+ pf = snew(struct ssh_rportfwd);
+ strcpy(pf->dhost, host);
+ pf->dport = dport;
+ if (saddr) {
+ logeventf(ssh,
+ "SSH1 cannot handle source address spec \"%s:%d\"; ignoring",
+ saddr, sport);
+ }
+ if (add234(ssh->rportfwds, pf) != pf) {
+ logeventf(ssh,
+ "Duplicate remote port forwarding to %s:%d",
+ host, dport);
+ sfree(pf);
+ } else {
+ logeventf(ssh, "Requesting remote port %.*s%.*s%d%.*s"
+ " forward to %s:%.*s%.*s%d%.*s",
+ (int)(sserv ? strlen(sports) : 0), sports,
+ sserv, "(", sport, sserv, ")",
+ host,
+ (int)(dserv ? strlen(dports) : 0), dports,
+ dserv, "(", dport, dserv, ")");
+ send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST,
+ PKT_INT, sport,
+ PKT_STR, host,
+ PKT_INT, dport,
+ PKT_END);
+ do {
+ crReturnV;
+ } while (!ispkt);
+ if (ssh->pktin.type != SSH1_SMSG_SUCCESS
+ && ssh->pktin.type != SSH1_SMSG_FAILURE) {
+ bombout(("Protocol confusion"));
+ crStopV;
+ } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
+ c_write_str(ssh, "Server refused port"
+ " forwarding\r\n");
+ }
+ logevent("Remote port forwarding enabled");
+ }
+ }
+ }
+ }
+ }
+
+ if (!ssh->cfg.nopty) {
+ send_packet(ssh, SSH1_CMSG_REQUEST_PTY,
+ PKT_STR, ssh->cfg.termtype,
+ PKT_INT, ssh->term_height,
+ PKT_INT, ssh->term_width,
+ PKT_INT, 0, PKT_INT, 0, PKT_CHAR, 0, PKT_END);
+ ssh->state = SSH_STATE_INTERMED;
+ do {
+ crReturnV;
+ } while (!ispkt);
+ if (ssh->pktin.type != SSH1_SMSG_SUCCESS
+ && ssh->pktin.type != SSH1_SMSG_FAILURE) {
+ bombout(("Protocol confusion"));
+ crStopV;
+ } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
+ c_write_str(ssh, "Server refused to allocate pty\r\n");
+ ssh->editing = ssh->echoing = 1;
+ }
+ logevent("Allocated pty");
+ } else {
+ ssh->editing = ssh->echoing = 1;
+ }
+
+ if (ssh->cfg.compression) {
+ send_packet(ssh, SSH1_CMSG_REQUEST_COMPRESSION, PKT_INT, 6, PKT_END);
+ do {
+ crReturnV;
+ } while (!ispkt);
+ if (ssh->pktin.type != SSH1_SMSG_SUCCESS
+ && ssh->pktin.type != SSH1_SMSG_FAILURE) {
+ bombout(("Protocol confusion"));
+ crStopV;
+ } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
+ c_write_str(ssh, "Server refused to compress\r\n");
+ }