static const char *const ssh2_disconnect_reasons[] = {
NULL,
- "SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT",
- "SSH_DISCONNECT_PROTOCOL_ERROR",
- "SSH_DISCONNECT_KEY_EXCHANGE_FAILED",
- "SSH_DISCONNECT_HOST_AUTHENTICATION_FAILED",
- "SSH_DISCONNECT_MAC_ERROR",
- "SSH_DISCONNECT_COMPRESSION_ERROR",
- "SSH_DISCONNECT_SERVICE_NOT_AVAILABLE",
- "SSH_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED",
- "SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE",
- "SSH_DISCONNECT_CONNECTION_LOST",
- "SSH_DISCONNECT_BY_APPLICATION",
- "SSH_DISCONNECT_TOO_MANY_CONNECTIONS",
- "SSH_DISCONNECT_AUTH_CANCELLED_BY_USER",
- "SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE",
- "SSH_DISCONNECT_ILLEGAL_USER_NAME",
+ "host not allowed to connect",
+ "protocol error",
+ "key exchange failed",
+ "host authentication failed",
+ "MAC error",
+ "compression error",
+ "service not available",
+ "protocol version not supported",
+ "host key not verifiable",
+ "connection lost",
+ "by application",
+ "too many connections",
+ "auth cancelled by user",
+ "no more auth methods available",
+ "illegal user name",
};
#define SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED 1 /* 0x1 */
const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss };
const static struct ssh_mac *macs[] = {
- &ssh_hmac_sha1, &ssh_hmac_md5
+ &ssh_hmac_sha1, &ssh_hmac_sha1_96, &ssh_hmac_md5
};
const static struct ssh_mac *buggymacs[] = {
- &ssh_hmac_sha1_buggy, &ssh_hmac_md5
+ &ssh_hmac_sha1_buggy, &ssh_hmac_sha1_96_buggy, &ssh_hmac_md5
};
static void *ssh_comp_none_init(void)
void *cs_comp_ctx, *sc_comp_ctx;
const struct ssh_kex *kex;
const struct ssh_signkey *hostkey;
- unsigned char v2_session_id[20];
+ unsigned char v2_session_id[32];
int v2_session_id_len;
void *kex_ctx;
{
if (pkt->maxlen < length) {
unsigned char *body = pkt->body;
- int offset = body ? pkt->data - body : 0;
+ int offset = body ? body - pkt->data : 0;
pkt->maxlen = length + 256;
pkt->data = sresize(pkt->data, pkt->maxlen + APIEXTRA, unsigned char);
if (body) pkt->body = pkt->data + offset;
static struct Packet *ssh2_pkt_init(int pkt_type)
{
struct Packet *pkt = ssh_new_packet();
- pkt->length = 5;
+ pkt->length = 5; /* space for packet length + padding length */
pkt->forcepad = 0;
ssh_pkt_addbyte(pkt, (unsigned char) pkt_type);
- pkt->body = pkt->data + pkt->length;
+ pkt->body = pkt->data + pkt->length; /* after packet type */
return pkt;
}
/* Load the public half of ssh->cfg.keyfile so we notice if it's in Pageant */
if (!filename_is_null(ssh->cfg.keyfile)) {
if (!rsakey_pubblob(&ssh->cfg.keyfile,
- &s->publickey_blob, &s->publickey_bloblen, NULL))
+ &s->publickey_blob, &s->publickey_bloblen,
+ NULL, NULL))
s->publickey_blob = NULL;
} else
s->publickey_blob = NULL;
char *hostkeydata, *sigdata, *keystr, *fingerprint;
int hostkeylen, siglen;
void *hkey; /* actual host key */
- unsigned char exchange_hash[20];
+ unsigned char exchange_hash[32];
int n_preferred_kex;
- const struct ssh_kex *preferred_kex[KEX_MAX];
+ const struct ssh_kexes *preferred_kex[KEX_MAX];
int n_preferred_ciphers;
const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX];
const struct ssh_compress *preferred_comp;
ssh2_pkt_addstring_start(s->pktout);
commalist_started = 0;
for (i = 0; i < s->n_preferred_kex; i++) {
- const struct ssh_kex *k = s->preferred_kex[i];
+ const struct ssh_kexes *k = s->preferred_kex[i];
if (!k) continue; /* warning flag */
- if (commalist_started)
- ssh2_pkt_addstring_str(s->pktout, ",");
- ssh2_pkt_addstring_str(s->pktout, s->preferred_kex[i]->name);
- commalist_started = 1;
+ for (j = 0; j < k->nkexes; j++) {
+ if (commalist_started)
+ ssh2_pkt_addstring_str(s->pktout, ",");
+ ssh2_pkt_addstring_str(s->pktout, k->list[j]->name);
+ commalist_started = 1;
+ }
}
/* List server host key algorithms. */
ssh2_pkt_addstring_start(s->pktout);
preferred = NULL;
for (i = 0; i < s->n_preferred_kex; i++) {
- const struct ssh_kex *k = s->preferred_kex[i];
+ const struct ssh_kexes *k = s->preferred_kex[i];
if (!k) {
s->warn_kex = TRUE;
} else {
- if (!preferred) preferred = k->name;
- if (in_commasep_string(k->name, str, len))
- ssh->kex = k;
+ for (j = 0; j < k->nkexes; j++) {
+ if (!preferred) preferred = k->list[j]->name;
+ if (in_commasep_string(k->list[j]->name, str, len)) {
+ ssh->kex = k->list[j];
+ break;
+ }
+ }
}
if (ssh->kex)
break;
set_busy_status(ssh->frontend, BUSY_NOT);
hash_string(ssh->kex->hash, ssh->exhash, s->hostkeydata, s->hostkeylen);
- if (ssh->kex == &ssh_diffiehellman_gex) {
+ if (!ssh->kex->pdata) {
hash_uint32(ssh->kex->hash, ssh->exhash, s->pbits);
hash_mpint(ssh->kex->hash, ssh->exhash, s->p);
hash_mpint(ssh->kex->hash, ssh->exhash, s->g);
assert(sizeof(s->exchange_hash) <= sizeof(ssh->v2_session_id));
memcpy(ssh->v2_session_id, s->exchange_hash,
sizeof(s->exchange_hash));
- assert(ssh->v2_session_id_len <= sizeof(ssh->v2_session_id));
ssh->v2_session_id_len = ssh->kex->hash->hlen;
+ assert(ssh->v2_session_id_len <= sizeof(ssh->v2_session_id));
s->got_session_id = TRUE;
}
*/
freebn(s->f);
freebn(s->K);
- if (ssh->kex == &ssh_diffiehellman_gex) {
+ if (!ssh->kex->pdata) {
freebn(s->g);
freebn(s->p);
}
if (keytype == SSH_KEYTYPE_SSH2) {
s->publickey_blob =
ssh2_userkey_loadpub(&ssh->cfg.keyfile, NULL,
- &s->publickey_bloblen, NULL);
+ &s->publickey_bloblen, NULL, NULL);
} else {
char *msgbuf;
logeventf(ssh, "Unable to use this key file (%s)",
(unsigned char *)ssh2_userkey_loadpub(&ssh->cfg.keyfile,
&algorithm,
&pub_blob_len,
- NULL);
+ NULL, NULL);
if (pub_blob) {
s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
ssh2_pkt_addstring(s->pktout, s->username);