#define SSH1_MSG_CHANNEL_DATA 23 /* 0x17 */
#define SSH1_MSG_CHANNEL_CLOSE 24 /* 0x18 */
#define SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION 25 /* 0x19 */
+#define SSH1_SMSG_X11_OPEN 27 /* 0x1b */
+#define SSH1_CMSG_PORT_FORWARD_REQUEST 28 /* 0x1c */
+#define SSH1_MSG_PORT_OPEN 29 /* 0x1d */
#define SSH1_CMSG_AGENT_REQUEST_FORWARDING 30 /* 0x1e */
#define SSH1_SMSG_AGENT_OPEN 31 /* 0x1f */
-#define SSH1_CMSG_EXIT_CONFIRMATION 33 /* 0x21 */
#define SSH1_MSG_IGNORE 32 /* 0x20 */
+#define SSH1_CMSG_EXIT_CONFIRMATION 33 /* 0x21 */
+#define SSH1_CMSG_X11_REQUEST_FORWARDING 34 /* 0x22 */
+#define SSH1_CMSG_AUTH_RHOSTS_RSA 35 /* 0x23 */
#define SSH1_MSG_DEBUG 36 /* 0x24 */
#define SSH1_CMSG_REQUEST_COMPRESSION 37 /* 0x25 */
#define SSH1_CMSG_AUTH_TIS 39 /* 0x27 */
extern const struct ssh_cipher ssh_blowfish_ssh1;
extern const struct ssh_cipher ssh_blowfish_ssh2;
+extern char *x11_init (Socket *, char *, void *, char **);
+extern void x11_close (Socket);
+extern void x11_send (Socket , char *, int);
+extern void x11_invent_auth(char *, int, char *, int);
+
/*
* Ciphers for SSH2. We miss out single-DES because it isn't
* supported; also 3DES and Blowfish are both done differently from
unsigned char msglen[4];
int lensofar, totallen;
} a;
+ struct ssh_x11_channel {
+ Socket s;
+ } x11;
struct ssh2_data_channel {
unsigned char *outbuffer;
unsigned outbuflen, outbufsize;
long maxlen;
};
-static SHA_State exhash;
+static SHA_State exhash, exhashbase;
static Socket s = NULL;
static unsigned char session_key[32];
static int ssh1_compressing;
static int ssh_agentfwd_enabled;
+static int ssh_X11_fwd_enabled;
static const struct ssh_cipher *cipher = NULL;
static const struct ssh_cipher *cscipher = NULL;
static const struct ssh_cipher *sccipher = NULL;
static struct ssh_channel *mainchan; /* primary session channel */
static enum {
+ SSH_STATE_PREPACKET,
SSH_STATE_BEFORE_SIZE,
SSH_STATE_INTERMED,
SSH_STATE_SESSION,
SSH_STATE_CLOSED
-} ssh_state = SSH_STATE_BEFORE_SIZE;
+} ssh_state = SSH_STATE_PREPACKET;
-static int size_needed = FALSE;
+static int size_needed = FALSE, eof_needed = FALSE;
static struct Packet pktin = { 0, 0, NULL, NULL, 0 };
static struct Packet pktout = { 0, 0, NULL, NULL, 0 };
static void ssh1_protocol(unsigned char *in, int inlen, int ispkt);
static void ssh2_protocol(unsigned char *in, int inlen, int ispkt);
static void ssh_size(void);
+static void ssh_special (Telnet_Special);
static int (*s_rdpkt)(unsigned char **data, int *datalen);
if (pktin.maxlen < st->biglen) {
pktin.maxlen = st->biglen;
- pktin.data = (pktin.data == NULL ? malloc(st->biglen+APIEXTRA) :
- realloc(pktin.data, st->biglen+APIEXTRA));
+ pktin.data = (pktin.data == NULL ? smalloc(st->biglen+APIEXTRA) :
+ srealloc(pktin.data, st->biglen+APIEXTRA));
if (!pktin.data)
fatalbox("Out of memory");
}
if (pktin.maxlen < st->pad + decomplen) {
pktin.maxlen = st->pad + decomplen;
- pktin.data = realloc(pktin.data, pktin.maxlen+APIEXTRA);
+ pktin.data = srealloc(pktin.data, pktin.maxlen+APIEXTRA);
+ pktin.body = pktin.data + st->pad + 1;
if (!pktin.data)
fatalbox("Out of memory");
}
memcpy(pktin.body-1, decompblk, decomplen);
- free(decompblk);
+ sfree(decompblk);
pktin.length = decomplen-1;
#if 0
debug(("Packet payload post-decompression:\n"));
if (pktin.maxlen < st->cipherblk) {
pktin.maxlen = st->cipherblk;
- pktin.data = (pktin.data == NULL ? malloc(st->cipherblk+APIEXTRA) :
- realloc(pktin.data, st->cipherblk+APIEXTRA));
+ pktin.data = (pktin.data == NULL ? smalloc(st->cipherblk+APIEXTRA) :
+ srealloc(pktin.data, st->cipherblk+APIEXTRA));
if (!pktin.data)
fatalbox("Out of memory");
}
*/
if (pktin.maxlen < st->packetlen+st->maclen) {
pktin.maxlen = st->packetlen+st->maclen;
- pktin.data = (pktin.data == NULL ? malloc(pktin.maxlen+APIEXTRA) :
- realloc(pktin.data, pktin.maxlen+APIEXTRA));
+ pktin.data = (pktin.data == NULL ? smalloc(pktin.maxlen+APIEXTRA) :
+ srealloc(pktin.data, pktin.maxlen+APIEXTRA));
if (!pktin.data)
fatalbox("Out of memory");
}
&newpayload, &newlen)) {
if (pktin.maxlen < newlen+5) {
pktin.maxlen = newlen+5;
- pktin.data = (pktin.data == NULL ? malloc(pktin.maxlen+APIEXTRA) :
- realloc(pktin.data, pktin.maxlen+APIEXTRA));
+ pktin.data = (pktin.data == NULL ? smalloc(pktin.maxlen+APIEXTRA) :
+ srealloc(pktin.data, pktin.maxlen+APIEXTRA));
if (!pktin.data)
fatalbox("Out of memory");
}
debug(("\r\n"));
#endif
- free(newpayload);
+ sfree(newpayload);
}
}
#ifdef MSCRYPTOAPI
/* Allocate enough buffer space for extra block
* for MS CryptEncrypt() */
- pktout.data = (pktout.data == NULL ? malloc(biglen+12) :
- realloc(pktout.data, biglen+12));
+ pktout.data = (pktout.data == NULL ? smalloc(biglen+12) :
+ srealloc(pktout.data, biglen+12));
#else
- pktout.data = (pktout.data == NULL ? malloc(biglen+4) :
- realloc(pktout.data, biglen+4));
+ pktout.data = (pktout.data == NULL ? smalloc(biglen+4) :
+ srealloc(pktout.data, biglen+4));
#endif
if (!pktout.data)
fatalbox("Out of memory");
&compblk, &complen);
ssh1_pktout_size(complen-1);
memcpy(pktout.body-1, compblk, complen);
- free(compblk);
+ sfree(compblk);
#if 0
debug(("Packet payload post-compression:\n"));
for (i = -1; i < pktout.length; i++)
pktout.length += len;
if (pktout.maxlen < pktout.length) {
pktout.maxlen = pktout.length + 256;
- pktout.data = (pktout.data == NULL ? malloc(pktout.maxlen+APIEXTRA) :
- realloc(pktout.data, pktout.maxlen+APIEXTRA));
+ pktout.data = (pktout.data == NULL ? smalloc(pktout.maxlen+APIEXTRA) :
+ srealloc(pktout.data, pktout.maxlen+APIEXTRA));
if (!pktout.data)
fatalbox("Out of memory");
}
static char *ssh2_mpint_fmt(Bignum b, int *len) {
unsigned char *p;
int i, n = b[0];
- p = malloc(n * 2 + 1);
+ p = smalloc(n * 2 + 1);
if (!p)
fatalbox("out of memory");
p[0] = 0;
p = ssh2_mpint_fmt(b, &len);
ssh2_pkt_addstring_start();
ssh2_pkt_addstring_data(p, len);
- free(p);
+ sfree(p);
}
static void ssh2_pkt_send(void) {
int cipherblk, maclen, padding, i;
&newpayload, &newlen)) {
pktout.length = 5;
ssh2_pkt_adddata(newpayload, newlen);
- free(newpayload);
+ sfree(newpayload);
}
}
for (i = 0; i < len; i++)
debug((" %02x", p[i]));
debug(("\r\n"));
- free(p);
+ sfree(p);
}
#endif
int len;
p = ssh2_mpint_fmt(b, &len);
sha_string(s, p, len);
- free(p);
+ sfree(p);
}
/*
* This is a v2 server. Begin v2 protocol.
*/
char *verstring = "SSH-2.0-PuTTY";
- SHA_Init(&exhash);
+ SHA_Init(&exhashbase);
/*
* Hash our version string and their version string.
*/
- sha_string(&exhash, verstring, strlen(verstring));
- sha_string(&exhash, vstring, strcspn(vstring, "\r\n"));
+ sha_string(&exhashbase, verstring, strlen(verstring));
+ sha_string(&exhashbase, vstring, strcspn(vstring, "\r\n"));
sprintf(vstring, "%s\n", verstring);
sprintf(vlog, "We claim version: %s", verstring);
logevent(vlog);
ssh_version = 1;
s_rdpkt = ssh1_rdpkt;
}
+ ssh_state = SSH_STATE_BEFORE_SIZE;
crFinish(0);
}
static int ssh_receive(Socket skt, int urgent, char *data, int len) {
if (!len) {
/* Connection has closed. */
+ ssh_state = SSH_STATE_CLOSED;
sk_close(s);
s = NULL;
return 0;
int FWport;
#endif
- savedhost = malloc(1+strlen(host));
+ savedhost = smalloc(1+strlen(host));
if (!savedhost)
fatalbox("Out of memory");
strcpy(savedhost, host);
/*
* Open socket.
*/
- s = sk_new(addr, port, ssh_receive);
+ s = sk_new(addr, port, 0, ssh_receive);
if ( (err = sk_socket_error(s)) )
return err;
len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
- rsabuf = malloc(len);
+ rsabuf = smalloc(len);
if (!rsabuf)
fatalbox("Out of memory");
*/
int len = rsastr_len(&hostkey);
char fingerprint[100];
- char *keystr = malloc(len);
+ char *keystr = smalloc(len);
if (!keystr)
fatalbox("Out of memory");
rsastr_fmt(keystr, &hostkey);
rsa_fingerprint(fingerprint, sizeof(fingerprint), &hostkey);
verify_ssh_host_key(savedhost, savedport, "rsa", keystr, fingerprint);
- free(keystr);
+ sfree(keystr);
}
for (i=0; i<32; i++) {
logevent("Trying to enable encryption...");
- free(rsabuf);
+ sfree(rsabuf);
cipher = cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish_ssh1 :
cipher_type == SSH_CIPHER_DES ? &ssh_des :
len += ssh1_bignum_length(challenge);
len += 16; /* session id */
len += 4; /* response format */
- agentreq = malloc(4 + len);
+ agentreq = smalloc(4 + len);
PUT_32BIT(agentreq, len);
q = agentreq + 4;
*q++ = SSH_AGENTC_RSA_CHALLENGE;
memcpy(q, session_id, 16); q += 16;
PUT_32BIT(q, 1); /* response format */
agent_query(agentreq, len+4, &ret, &retlen);
- free(agentreq);
+ sfree(agentreq);
if (ret) {
if (ret[4] == SSH_AGENT_RSA_RESPONSE) {
logevent("Sending Pageant's response");
send_packet(SSH1_CMSG_AUTH_RSA_RESPONSE,
PKT_DATA, ret+5, 16, PKT_END);
- free(ret);
+ sfree(ret);
crWaitUntil(ispkt);
if (pktin.type == SSH1_SMSG_SUCCESS) {
logevent("Pageant's response accepted");
logevent("Pageant's response not accepted");
} else {
logevent("Pageant failed to answer challenge");
- free(ret);
+ sfree(ret);
}
} else {
logevent("No reply received from Pageant");
goto tryauth;
}
sprintf(prompt, "Passphrase for key \"%.100s\": ", comment);
- free(comment);
+ sfree(comment);
}
if (ssh_get_password) {
crFinish(1);
}
+void sshfwd_close(struct ssh_channel *c) {
+
+ if (c) {
+ send_packet(SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid, PKT_END);
+ logevent("X11 connection terminated");
+ c->closes = 1;
+ c->u.x11.s = NULL;
+ }
+}
+
+void sshfwd_write(struct ssh_channel *c, char *buf, int len) {
+
+ send_packet(SSH1_MSG_CHANNEL_DATA,
+ PKT_INT, c->remoteid,
+ PKT_INT, len,
+ PKT_DATA, buf, len,
+ PKT_END);
+}
+
static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) {
crBegin;
}
}
+ if (cfg.x11_forward) {
+ char proto[20], data[64];
+ logevent("Requesting X11 forwarding");
+ x11_invent_auth(proto, sizeof(proto), data, sizeof(data));
+ send_packet(SSH1_CMSG_X11_REQUEST_FORWARDING,
+ PKT_STR, proto, PKT_STR, data,
+ PKT_INT, 0,
+ PKT_END);
+ do { crReturnV; } while (!ispkt);
+ if (pktin.type != SSH1_SMSG_SUCCESS && pktin.type != SSH1_SMSG_FAILURE) {
+ bombout(("Protocol confusion"));
+ crReturnV;
+ } else if (pktin.type == SSH1_SMSG_FAILURE) {
+ logevent("X11 forwarding refused");
+ } else {
+ logevent("X11 forwarding enabled");
+ ssh_X11_fwd_enabled = TRUE;
+ }
+ }
+
if (!cfg.nopty) {
send_packet(SSH1_CMSG_REQUEST_PTY,
PKT_STR, cfg.termtype,
ssh_state = SSH_STATE_SESSION;
if (size_needed)
ssh_size();
+ if (eof_needed)
+ ssh_special(TS_EOF);
ssh_send_ok = 1;
ssh_channels = newtree234(ssh_channelcmp);
ssh_state = SSH_STATE_CLOSED;
logevent("Received disconnect request");
crReturnV;
+ } else if (pktin.type == SSH1_SMSG_X11_OPEN) {
+ /* Remote side is trying to open a channel to talk to our
+ * X-Server. Give them back a local channel number. */
+ unsigned i;
+ struct ssh_channel *c, *d;
+ enum234 e;
+
+ logevent("Received X11 connect request");
+ /* Refuse if X11 forwarding is disabled. */
+ if (!ssh_X11_fwd_enabled) {
+ send_packet(SSH1_MSG_CHANNEL_OPEN_FAILURE,
+ PKT_INT, GET_32BIT(pktin.body),
+ PKT_END);
+ logevent("Rejected X11 connect request");
+ } else {
+ char *rh;
+
+ c = smalloc(sizeof(struct ssh_channel));
+
+ if ( x11_init(&c->u.x11.s, cfg.x11_display, c, &rh) != NULL ) {
+ logevent("opening X11 forward connection failed");
+ sfree(c);
+ send_packet(SSH1_MSG_CHANNEL_OPEN_FAILURE,
+ PKT_INT, GET_32BIT(pktin.body),
+ PKT_END);
+ } else {
+ logevent("opening X11 forward connection succeeded");
+ for (i=1, d = first234(ssh_channels, &e); d; d = next234(&e)) {
+ if (d->localid > i)
+ break; /* found a free number */
+ i = d->localid + 1;
+ }
+ c->remoteid = GET_32BIT(pktin.body);
+ c->localid = i;
+ c->closes = 0;
+ c->type = SSH1_SMSG_X11_OPEN;/* identify channel type */
+ add234(ssh_channels, c);
+ send_packet(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
+ PKT_INT, c->remoteid, PKT_INT, c->localid,
+ PKT_END);
+ logevent("Opened X11 forward channel");
+ }
+ }
} else if (pktin.type == SSH1_SMSG_AGENT_OPEN) {
/* Remote side is trying to open a channel to talk to our
* agent. Give them back a local channel number. */
break; /* found a free number */
i = c->localid + 1;
}
- c = malloc(sizeof(struct ssh_channel));
+ c = smalloc(sizeof(struct ssh_channel));
c->remoteid = GET_32BIT(pktin.body);
c->localid = i;
c->closes = 0;
int closetype;
closetype = (pktin.type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2);
send_packet(pktin.type, PKT_INT, c->remoteid, PKT_END);
+ if ((c->closes == 0) && (c->type == SSH1_SMSG_X11_OPEN)) {
+ logevent("X11 connection closed");
+ assert(c->u.x11.s != NULL);
+ x11_close(c->u.x11.s);
+ c->u.x11.s = NULL;
+ }
c->closes |= closetype;
if (c->closes == 3) {
del234(ssh_channels, c);
- free(c);
+ sfree(c);
}
}
} else if (pktin.type == SSH1_MSG_CHANNEL_DATA) {
c = find234(ssh_channels, &i, ssh_channelfind);
if (c) {
switch(c->type) {
+ case SSH1_SMSG_X11_OPEN:
+ x11_send(c->u.x11.s, p, len);
+ break;
case SSH1_SMSG_AGENT_OPEN:
/* Data for an agent message. Buffer it. */
while (len > 0) {
}
if (c->u.a.lensofar == 4) {
c->u.a.totallen = 4 + GET_32BIT(c->u.a.msglen);
- c->u.a.message = malloc(c->u.a.totallen);
+ c->u.a.message = smalloc(c->u.a.totallen);
memcpy(c->u.a.message, c->u.a.msglen, 4);
}
if (c->u.a.lensofar >= 4 && len > 0) {
PKT_DATA, sentreply, replylen,
PKT_END);
if (reply)
- free(reply);
- free(c->u.a.message);
+ sfree(reply);
+ sfree(c->u.a.message);
c->u.a.lensofar = 0;
}
}
static unsigned char keyspace[40];
static const struct ssh_cipher *preferred_cipher;
static const struct ssh_compress *preferred_comp;
+ static int first_kex;
crBegin;
random_init();
+ first_kex = 1;
/*
* Set up the preferred cipher and compression.
ssh2_pkt_addbool(FALSE);
/* Reserved. */
ssh2_pkt_adduint32(0);
+
+ exhash = exhashbase;
sha_string(&exhash, pktout.data+5, pktout.length-5);
+
ssh2_pkt_send();
if (!ispkt) crWaitUntil(ispkt);
keystr, fingerprint);
logevent("Host key fingerprint is:");
logevent(fingerprint);
- free(fingerprint);
- free(keystr);
+ sfree(fingerprint);
+ sfree(keystr);
hostkey->freekey(hkey);
/*
* Set IVs after keys.
*/
ssh2_mkkey(K, exchange_hash, 'C', keyspace); cscipher->setcskey(keyspace);
- ssh2_mkkey(K, exchange_hash, 'D', keyspace); cscipher->setsckey(keyspace);
+ ssh2_mkkey(K, exchange_hash, 'D', keyspace); sccipher->setsckey(keyspace);
ssh2_mkkey(K, exchange_hash, 'A', keyspace); cscipher->setcsiv(keyspace);
ssh2_mkkey(K, exchange_hash, 'B', keyspace); sccipher->setsciv(keyspace);
ssh2_mkkey(K, exchange_hash, 'E', keyspace); csmac->setcskey(keyspace);
ssh2_mkkey(K, exchange_hash, 'F', keyspace); scmac->setsckey(keyspace);
/*
+ * If this is the first key exchange phase, we must pass the
+ * SSH2_MSG_NEWKEYS packet to the next layer, not because it
+ * wants to see it but because it will need time to initialise
+ * itself before it sees an actual packet. In subsequent key
+ * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because
+ * it would only confuse the layer above.
+ */
+ if (!first_kex) {
+ crReturn(0);
+ }
+ first_kex = 0;
+
+ /*
* Now we're encrypting. Begin returning 1 to the protocol main
* function so that other things can run on top of the
* transport. If we ever see a KEXINIT, we must go back to the
/*
* So now create a channel with a session in it.
*/
- mainchan = malloc(sizeof(struct ssh_channel));
+ mainchan = smalloc(sizeof(struct ssh_channel));
mainchan->localid = 100; /* as good as any */
ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
ssh2_pkt_addstring("session");
ssh_state = SSH_STATE_SESSION;
if (size_needed)
ssh_size();
+ if (eof_needed)
+ ssh_special(TS_EOF);
/*
* Transfer data!
static void ssh_size(void) {
switch (ssh_state) {
case SSH_STATE_BEFORE_SIZE:
+ case SSH_STATE_PREPACKET:
case SSH_STATE_CLOSED:
break; /* do nothing */
case SSH_STATE_INTERMED:
ssh2_pkt_send();
}
}
+ break;
}
}
*/
static void ssh_special (Telnet_Special code) {
if (code == TS_EOF) {
+ if (ssh_state != SSH_STATE_SESSION) {
+ /*
+ * Buffer the EOF in case we are pre-SESSION, so we can
+ * send it as soon as we reach SESSION.
+ */
+ if (code == TS_EOF)
+ eof_needed = TRUE;
+ return;
+ }
if (ssh_version == 1) {
send_packet(SSH1_CMSG_EOF, PKT_END);
} else {
}
logevent("Sent EOF message");
} else if (code == TS_PING) {
+ if (ssh_state == SSH_STATE_CLOSED || ssh_state == SSH_STATE_PREPACKET)
+ return;
if (ssh_version == 1) {
send_packet(SSH1_MSG_IGNORE, PKT_STR, "", PKT_END);
} else {