X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/0a3f1d48f7f8779690073685f057bc5705d61006..d40a94b97d318ea943d466abf6c123a71bcbf87a:/ssh.c diff --git a/ssh.c b/ssh.c index 5996fd39..1077b335 100644 --- a/ssh.c +++ b/ssh.c @@ -68,15 +68,6 @@ #define SSH1_AUTH_TIS 5 /* 0x5 */ #define SSH1_AUTH_CCARD 16 /* 0x10 */ -#define SSH_AGENTC_REQUEST_RSA_IDENTITIES 1 /* 0x1 */ -#define SSH_AGENT_RSA_IDENTITIES_ANSWER 2 /* 0x2 */ -#define SSH_AGENTC_RSA_CHALLENGE 3 /* 0x3 */ -#define SSH_AGENT_RSA_RESPONSE 4 /* 0x4 */ -#define SSH_AGENT_FAILURE 5 /* 0x5 */ -#define SSH_AGENT_SUCCESS 6 /* 0x6 */ -#define SSH_AGENTC_ADD_RSA_IDENTITY 7 /* 0x7 */ -#define SSH_AGENTC_REMOVE_RSA_IDENTITY 8 /* 0x8 */ - #define SSH2_MSG_DISCONNECT 1 /* 0x1 */ #define SSH2_MSG_IGNORE 2 /* 0x2 */ #define SSH2_MSG_UNIMPLEMENTED 3 /* 0x3 */ @@ -131,6 +122,12 @@ #define SSH2_EXTENDED_DATA_STDERR 1 /* 0x1 */ +/* + * Various remote-bug flags. + */ +#define BUG_CHOKES_ON_SSH1_IGNORE 1 +#define BUG_SSH2_HMAC 2 + #define GET_32BIT(cp) \ (((unsigned long)(unsigned char)(cp)[0] << 24) | \ ((unsigned long)(unsigned char)(cp)[1] << 16) | \ @@ -164,13 +161,6 @@ enum { PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM }; #define crWaitUntil(c) do { crReturn(0); } while (!(c)) #define crWaitUntilV(c) do { crReturnV; } while (!(c)) -extern const struct ssh_cipher ssh_3des; -extern const struct ssh2_ciphers ssh2_3des; -extern const struct ssh_cipher ssh_des; -extern const struct ssh2_ciphers ssh2_aes; -extern const struct ssh_cipher ssh_blowfish_ssh1; -extern const struct ssh2_ciphers ssh2_blowfish; - extern char *x11_init (Socket *, char *, void *); extern void x11_close (Socket); extern void x11_send (Socket , char *, int); @@ -188,18 +178,11 @@ const static struct ssh2_ciphers *ciphers[] = { &ssh2_3des, }; -extern const struct ssh_kex ssh_diffiehellman; -extern const struct ssh_kex ssh_diffiehellman_gex; const static struct ssh_kex *kex_algs[] = { -#ifdef DO_DIFFIE_HELLMAN_GEX &ssh_diffiehellman_gex, -#endif &ssh_diffiehellman }; -extern const struct ssh_signkey ssh_dss; -const static struct ssh_signkey *hostkey_algs[] = { &ssh_dss }; - -extern const struct ssh_mac ssh_md5, ssh_sha1, ssh_sha1_buggy; +const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss }; static void nullmac_key(unsigned char *key) { } static void nullmac_generate(unsigned char *blk, int len, unsigned long seq) { } @@ -217,10 +200,12 @@ static int ssh_comp_none_block(unsigned char *block, int len, unsigned char **outblock, int *outlen) { return 0; } +static int ssh_comp_none_disable(void) { return 0; } const static struct ssh_compress ssh_comp_none = { "none", ssh_comp_none_init, ssh_comp_none_block, - ssh_comp_none_init, ssh_comp_none_block + ssh_comp_none_init, ssh_comp_none_block, + ssh_comp_none_disable }; extern const struct ssh_compress ssh_zlib; const static struct ssh_compress *compressions[] = { @@ -273,6 +258,7 @@ static unsigned char session_key[32]; static int ssh1_compressing; static int ssh_agentfwd_enabled; static int ssh_X11_fwd_enabled; +static int ssh_remote_bugs; static const struct ssh_cipher *cipher = NULL; static const struct ssh2_cipher *cscipher = NULL; static const struct ssh2_cipher *sccipher = NULL; @@ -282,7 +268,9 @@ static const struct ssh_compress *cscomp = NULL; static const struct ssh_compress *sccomp = NULL; static const struct ssh_kex *kex = NULL; static const struct ssh_signkey *hostkey = NULL; -int (*ssh_get_password)(const char *prompt, char *str, int maxlen) = NULL; +static unsigned char ssh2_session_id[20]; +int (*ssh_get_line)(const char *prompt, char *str, int maxlen, + int is_pw) = NULL; static char *savedhost; static int savedport; @@ -359,6 +347,10 @@ static void c_write (char *buf, int len) { from_backend(1, buf, len); } +static void c_write_str (char *buf) { + c_write(buf, strlen(buf)); +} + /* * Collect incoming data in the incoming packet buffer. * Decipher and verify the packet when it is completely read. @@ -669,21 +661,22 @@ static void s_wrpkt_start(int type, int len) { pktout.type = type; } -static void s_wrpkt(void) { +static int s_wrpkt_prepare(void) { int pad, len, biglen, i; unsigned long crc; pktout.body[-1] = pktout.type; +#if 0 + debug(("Packet payload pre-compression:\n")); + for (i = -1; i < pktout.length; i++) + debug((" %02x", (unsigned char)pktout.body[i])); + debug(("\r\n")); +#endif + if (ssh1_compressing) { unsigned char *compblk; int complen; -#if 0 - debug(("Packet payload pre-compression:\n")); - for (i = -1; i < pktout.length; i++) - debug((" %02x", (unsigned char)pktout.body[i])); - debug(("\r\n")); -#endif zlib_compress_block(pktout.body-1, pktout.length+1, &compblk, &complen); ssh1_pktout_size(complen-1); @@ -716,93 +709,118 @@ static void s_wrpkt(void) { if (cipher) cipher->encrypt(pktout.data+4, biglen); - sk_write(s, pktout.data, biglen+4); + return biglen+4; +} + +static void s_wrpkt(void) { + int len; + len = s_wrpkt_prepare(); + sk_write(s, pktout.data, len); +} + +static void s_wrpkt_defer(void) { + int len; + len = s_wrpkt_prepare(); + if (deferred_len + len > deferred_size) { + deferred_size = deferred_len + len + 128; + deferred_send_data = srealloc(deferred_send_data, deferred_size); + } + memcpy(deferred_send_data+deferred_len, pktout.data, len); + deferred_len += len; } /* - * Construct a packet with the specified contents and - * send it to the server. + * Construct a packet with the specified contents. */ -static void send_packet(int pkttype, ...) +static void construct_packet(int pkttype, va_list ap1, va_list ap2) { - va_list args; unsigned char *p, *argp, argchar; unsigned long argint; int pktlen, argtype, arglen; Bignum bn; pktlen = 0; - va_start(args, pkttype); - while ((argtype = va_arg(args, int)) != PKT_END) { + while ((argtype = va_arg(ap1, int)) != PKT_END) { switch (argtype) { case PKT_INT: - (void) va_arg(args, int); + (void) va_arg(ap1, int); pktlen += 4; break; case PKT_CHAR: - (void) va_arg(args, char); + (void) va_arg(ap1, char); pktlen++; break; case PKT_DATA: - (void) va_arg(args, unsigned char *); - arglen = va_arg(args, int); + (void) va_arg(ap1, unsigned char *); + arglen = va_arg(ap1, int); pktlen += arglen; break; case PKT_STR: - argp = va_arg(args, unsigned char *); + argp = va_arg(ap1, unsigned char *); arglen = strlen(argp); pktlen += 4 + arglen; break; case PKT_BIGNUM: - bn = va_arg(args, Bignum); + bn = va_arg(ap1, Bignum); pktlen += ssh1_bignum_length(bn); break; default: assert(0); } } - va_end(args); s_wrpkt_start(pkttype, pktlen); p = pktout.body; - va_start(args, pkttype); - while ((argtype = va_arg(args, int)) != PKT_END) { + while ((argtype = va_arg(ap2, int)) != PKT_END) { switch (argtype) { case PKT_INT: - argint = va_arg(args, int); + argint = va_arg(ap2, int); PUT_32BIT(p, argint); p += 4; break; case PKT_CHAR: - argchar = va_arg(args, unsigned char); + argchar = va_arg(ap2, unsigned char); *p = argchar; p++; break; case PKT_DATA: - argp = va_arg(args, unsigned char *); - arglen = va_arg(args, int); + argp = va_arg(ap2, unsigned char *); + arglen = va_arg(ap2, int); memcpy(p, argp, arglen); p += arglen; break; case PKT_STR: - argp = va_arg(args, unsigned char *); + argp = va_arg(ap2, unsigned char *); arglen = strlen(argp); PUT_32BIT(p, arglen); memcpy(p + 4, argp, arglen); p += 4 + arglen; break; case PKT_BIGNUM: - bn = va_arg(args, Bignum); + bn = va_arg(ap2, Bignum); p += ssh1_write_bignum(p, bn); break; } } - va_end(args); +} +static void send_packet(int pkttype, ...) { + va_list ap1, ap2; + va_start(ap1, pkttype); + va_start(ap2, pkttype); + construct_packet(pkttype, ap1, ap2); s_wrpkt(); } +static void defer_packet(int pkttype, ...) { + va_list ap1, ap2; + va_start(ap1, pkttype); + va_start(ap2, pkttype); + construct_packet(pkttype, ap1, ap2); + s_wrpkt_defer(); +} + static int ssh_versioncmp(char *a, char *b) { char *ae, *be; unsigned long av, bv; @@ -1005,9 +1023,9 @@ static void ssh2_pkt_defer(void) { /* * Send the whole deferred data block constructed by - * ssh2_pkt_defer(). + * ssh2_pkt_defer() or SSH1's defer_packet(). */ -static void ssh2_pkt_defersend(void) { +static void ssh_pkt_defersend(void) { sk_write(s, deferred_send_data, deferred_len); deferred_len = deferred_size = 0; sfree(deferred_send_data); @@ -1046,6 +1064,14 @@ static unsigned long ssh2_pkt_getuint32(void) { pktin.savedpos += 4; return value; } +static int ssh2_pkt_getbool(void) { + unsigned long value; + if (pktin.length - pktin.savedpos < 1) + return 0; /* arrgh, no way to decline (FIXME?) */ + value = pktin.data[pktin.savedpos] != 0; + pktin.savedpos++; + return value; +} static void ssh2_pkt_getstring(char **p, int *length) { *p = NULL; if (pktin.length - pktin.savedpos < 4) @@ -1073,6 +1099,41 @@ static Bignum ssh2_pkt_getmp(void) { return b; } +/* + * Examine the remote side's version string and compare it against + * a list of known buggy implementations. + */ +static void ssh_detect_bugs(char *vstring) { + char *imp; /* pointer to implementation part */ + imp = vstring; + imp += strcspn(imp, "-"); + imp += strcspn(imp, "-"); + + ssh_remote_bugs = 0; + + if (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") || + !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") || + !strcmp(imp, "1.2.22")) { + /* + * These versions don't support SSH1_MSG_IGNORE, so we have + * to use a different defence against password length + * sniffing. + */ + ssh_remote_bugs |= BUG_CHOKES_ON_SSH1_IGNORE; + logevent("We believe remote version has SSH1 ignore bug"); + } + + if (!strncmp(imp, "2.1.0", 5) || !strncmp(imp, "2.0.", 4) || + !strncmp(imp, "2.2.0", 5) || !strncmp(imp, "2.3.0", 5) || + !strncmp(imp, "2.1 ", 4)) { + /* + * These versions have the HMAC bug. + */ + ssh_remote_bugs |= BUG_SSH2_HMAC; + logevent("We believe remote version has SSH2 HMAC bug"); + } +} + static int do_ssh_init(unsigned char c) { static char *vsp; static char version[10]; @@ -1120,6 +1181,7 @@ static int do_ssh_init(unsigned char c) { *vsp = 0; sprintf(vlog, "Server version: %s", vstring); + ssh_detect_bugs(vstring); vlog[strcspn(vlog, "\r\n")] = '\0'; logevent(vlog); @@ -1131,7 +1193,8 @@ static int do_ssh_init(unsigned char c) { /* * This is a v2 server. Begin v2 protocol. */ - char *verstring = "SSH-2.0-PuTTY"; + char verstring[80]; + sprintf(verstring, "SSH-2.0-%s", sshver); SHA_Init(&exhashbase); /* * Hash our version string and their version string. @@ -1150,8 +1213,9 @@ static int do_ssh_init(unsigned char c) { /* * This is a v1 server. Begin v1 protocol. */ - sprintf(vstring, "SSH-%s-PuTTY\n", - (ssh_versioncmp(version, "1.5") <= 0 ? version : "1.5")); + sprintf(vstring, "SSH-%s-%s\n", + (ssh_versioncmp(version, "1.5") <= 0 ? version : "1.5"), + sshver); sprintf(vlog, "We claim version: %s", vstring); vlog[strcspn(vlog, "\r\n")] = '\0'; logevent(vlog); @@ -1208,21 +1272,20 @@ static void ssh_gotdata(unsigned char *data, int datalen) crFinishV; } -static int ssh_receive(Socket skt, int urgent, char *data, int len) { - if (urgent==3) { +static int ssh_closing (Plug plug, char *error_msg, int error_code, int calling_back) { + ssh_state = SSH_STATE_CLOSED; + sk_close(s); + s = NULL; + if (error_msg) { /* A socket error has occurred. */ - ssh_state = SSH_STATE_CLOSED; - sk_close(s); - s = NULL; - connection_fatal(data); - return 0; - } else if (!len) { - /* Connection has closed. */ - ssh_state = SSH_STATE_CLOSED; - sk_close(s); - s = NULL; - return 0; + connection_fatal (error_msg); + } else { + /* Otherwise, the remote side closed the connection normally. */ } + return 0; +} + +static int ssh_receive(Plug plug, int urgent, char *data, int len) { ssh_gotdata (data, len); if (ssh_state == SSH_STATE_CLOSED) { if (s) { @@ -1241,6 +1304,11 @@ static int ssh_receive(Socket skt, int urgent, char *data, int len) { */ static char *connect_to_host(char *host, int port, char **realhost) { + static struct plug_function_table fn_table = { + ssh_closing, + ssh_receive + }, *fn_table_ptr = &fn_table; + SockAddr addr; char *err; #ifdef FWHACK @@ -1278,7 +1346,7 @@ static char *connect_to_host(char *host, int port, char **realhost) /* * Open socket. */ - s = sk_new(addr, port, 0, 1, ssh_receive); + s = sk_new(addr, port, 0, 1, &fn_table_ptr); if ( (err = sk_socket_error(s)) ) return err; @@ -1397,12 +1465,12 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) case CIPHER_DES: cipher_type = SSH_CIPHER_DES; break; case CIPHER_3DES: cipher_type = SSH_CIPHER_3DES; break; case CIPHER_AES: - c_write("AES not supported in SSH1, falling back to 3DES\r\n", 49); + c_write_str("AES not supported in SSH1, falling back to 3DES\r\n"); cipher_type = SSH_CIPHER_3DES; break; } if ((supported_ciphers_mask & (1 << cipher_type)) == 0) { - c_write("Selected cipher not supported, falling back to 3DES\r\n", 53); + c_write_str("Selected cipher not supported, falling back to 3DES\r\n"); cipher_type = SSH_CIPHER_3DES; } switch (cipher_type) { @@ -1442,43 +1510,56 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) static int pos = 0; static char c; if ((flags & FLAG_INTERACTIVE) && !*cfg.username) { - c_write("login as: ", 10); - ssh_send_ok = 1; - while (pos >= 0) { - crWaitUntil(!ispkt); - while (inlen--) switch (c = *in++) { - case 10: case 13: - username[pos] = 0; - pos = -1; - break; - case 8: case 127: - if (pos > 0) { - c_write("\b \b", 3); - pos--; - } - break; - case 21: case 27: - while (pos > 0) { - c_write("\b \b", 3); - pos--; - } - break; - case 3: case 4: - random_save_seed(); - exit(0); - break; - default: - if (((c >= ' ' && c <= '~') || - ((unsigned char)c >= 160)) && pos < 40) { - username[pos++] = c; - c_write(&c, 1); - } - break; - } - } - c_write("\r\n", 2); - username[strcspn(username, "\n\r")] = '\0'; - } else { + if (ssh_get_line) { + if (!ssh_get_line("login as: ", + username, sizeof(username), FALSE)) { + /* + * get_line failed to get a username. + * Terminate. + */ + logevent("No username provided. Abandoning session."); + ssh_state = SSH_STATE_CLOSED; + crReturn(1); + } + } else { + c_write_str("login as: "); + ssh_send_ok = 1; + while (pos >= 0) { + crWaitUntil(!ispkt); + while (inlen--) switch (c = *in++) { + case 10: case 13: + username[pos] = 0; + pos = -1; + break; + case 8: case 127: + if (pos > 0) { + c_write_str("\b \b"); + pos--; + } + break; + case 21: case 27: + while (pos > 0) { + c_write_str("\b \b"); + pos--; + } + break; + case 3: case 4: + random_save_seed(); + exit(0); + break; + default: + if (((c >= ' ' && c <= '~') || + ((unsigned char)c >= 160)) && pos < 40) { + username[pos++] = c; + c_write(&c, 1); + } + break; + } + } + c_write_str("\r\n"); + username[strcspn(username, "\n\r")] = '\0'; + } + } else { strncpy(username, cfg.username, 99); username[99] = '\0'; } @@ -1491,7 +1572,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) if (flags & FLAG_INTERACTIVE && (!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) { strcat(userlog, "\r\n"); - c_write(userlog, strlen(userlog)); + c_write_str(userlog); } } } @@ -1526,13 +1607,14 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) /* Request the keys held by the agent. */ PUT_32BIT(request, 1); - request[4] = SSH_AGENTC_REQUEST_RSA_IDENTITIES; + request[4] = SSH1_AGENTC_REQUEST_RSA_IDENTITIES; agent_query(request, 5, &r, &responselen); response = (unsigned char *)r; - if (response) { + if (response && responselen >= 5 && + response[4] == SSH1_AGENT_RSA_IDENTITIES_ANSWER) { p = response + 5; nkeys = GET_32BIT(p); p += 4; - { char buf[64]; sprintf(buf, "Pageant has %d keys", nkeys); + { char buf[64]; sprintf(buf, "Pageant has %d SSH1 keys", nkeys); logevent(buf); } for (i = 0; i < nkeys; i++) { static struct RSAKey key; @@ -1568,7 +1650,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) agentreq = smalloc(4 + len); PUT_32BIT(agentreq, len); q = agentreq + 4; - *q++ = SSH_AGENTC_RSA_CHALLENGE; + *q++ = SSH1_AGENTC_RSA_CHALLENGE; PUT_32BIT(q, ssh1_bignum_bitcount(key.modulus)); q += 4; q += ssh1_write_bignum(q, key.exponent); @@ -1579,7 +1661,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) agent_query(agentreq, len+4, &ret, &retlen); sfree(agentreq); if (ret) { - if (ret[4] == SSH_AGENT_RSA_RESPONSE) { + if (ret[4] == SSH1_AGENT_RSA_RESPONSE) { logevent("Sending Pageant's response"); send_packet(SSH1_CMSG_AUTH_RSA_RESPONSE, PKT_DATA, ret+5, 16, PKT_END); @@ -1588,10 +1670,9 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) if (pktin.type == SSH1_SMSG_SUCCESS) { logevent("Pageant's response accepted"); if (flags & FLAG_VERBOSE) { - c_write("Authenticated using RSA key \"", - 29); + c_write_str("Authenticated using RSA key \""); c_write(commentp, commentlen); - c_write("\" from agent\r\n", 14); + c_write_str("\" from agent\r\n"); } authed = TRUE; } else @@ -1627,7 +1708,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) if (pktin.type != SSH1_SMSG_AUTH_TIS_CHALLENGE) { logevent("TIS authentication declined"); if (flags & FLAG_INTERACTIVE) - c_write("TIS authentication refused.\r\n", 29); + c_write_str("TIS authentication refused.\r\n"); } else { int challengelen = ((pktin.body[0] << 24) | (pktin.body[1] << 16) | @@ -1649,7 +1730,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) crWaitUntil(ispkt); if (pktin.type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) { logevent("CryptoCard authentication declined"); - c_write("CryptoCard authentication refused.\r\n", 29); + c_write_str("CryptoCard authentication refused.\r\n"); } else { int challengelen = ((pktin.body[0] << 24) | (pktin.body[1] << 16) | @@ -1671,30 +1752,29 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) if (pwpkt_type == SSH1_CMSG_AUTH_RSA) { char *comment = NULL; if (flags & FLAG_VERBOSE) - c_write("Trying public key authentication.\r\n", 35); + c_write_str("Trying public key authentication.\r\n"); if (!rsakey_encrypted(cfg.keyfile, &comment)) { if (flags & FLAG_VERBOSE) - c_write("No passphrase required.\r\n", 25); + c_write_str("No passphrase required.\r\n"); goto tryauth; } sprintf(prompt, "Passphrase for key \"%.100s\": ", comment); sfree(comment); } - if (ssh_get_password) { - if (!ssh_get_password(prompt, password, sizeof(password))) { + if (ssh_get_line) { + if (!ssh_get_line(prompt, password, sizeof(password), TRUE)) { /* - * get_password failed to get a password (for - * example because one was supplied on the command - * line which has already failed to work). - * Terminate. + * get_line failed to get a password (for example + * because one was supplied on the command line + * which has already failed to work). Terminate. */ logevent("No more passwords to try"); ssh_state = SSH_STATE_CLOSED; crReturn(1); } } else { - c_write(prompt, strlen(prompt)); + c_write_str(prompt); pos = 0; ssh_send_ok = 1; while (pos >= 0) { @@ -1722,7 +1802,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) break; } } - c_write("\r\n", 2); + c_write_str("\r\n"); } tryauth: @@ -1737,15 +1817,15 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) static unsigned char buffer[32]; tried_publickey = 1; - i = loadrsakey(cfg.keyfile, &pubkey, NULL, password); + i = loadrsakey(cfg.keyfile, &pubkey, password); if (i == 0) { - c_write("Couldn't load public key from ", 30); - c_write(cfg.keyfile, strlen(cfg.keyfile)); - c_write(".\r\n", 3); + c_write_str("Couldn't load public key from "); + c_write_str(cfg.keyfile); + c_write_str(".\r\n"); continue; /* go and try password */ } if (i == -1) { - c_write("Wrong passphrase.\r\n", 19); + c_write_str("Wrong passphrase.\r\n"); tried_publickey = 0; continue; /* try again */ } @@ -1758,7 +1838,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) crWaitUntil(ispkt); if (pktin.type == SSH1_SMSG_FAILURE) { - c_write("Server refused our public key.\r\n", 32); + c_write_str("Server refused our public key.\r\n"); continue; /* go and try password */ } if (pktin.type != SSH1_SMSG_AUTH_RSA_CHALLENGE) { @@ -1784,8 +1864,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) crWaitUntil(ispkt); if (pktin.type == SSH1_SMSG_FAILURE) { if (flags & FLAG_VERBOSE) - c_write("Failed to authenticate with our public key.\r\n", - 45); + c_write_str("Failed to authenticate with our public key.\r\n"); continue; /* go and try password */ } else if (pktin.type != SSH1_SMSG_SUCCESS) { bombout(("Bizarre response to RSA authentication response")); @@ -1794,14 +1873,101 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) break; /* we're through! */ } else { - send_packet(pwpkt_type, PKT_STR, password, PKT_END); + if (pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) { + /* + * Defence against traffic analysis: we send a + * whole bunch of packets containing strings of + * different lengths. One of these strings is the + * password, in a SSH1_CMSG_AUTH_PASSWORD packet. + * The others are all random data in + * SSH1_MSG_IGNORE packets. This way a passive + * listener can't tell which is the password, and + * hence can't deduce the password length. + * + * Anybody with a password length greater than 16 + * bytes is going to have enough entropy in their + * password that a listener won't find it _that_ + * much help to know how long it is. So what we'll + * do is: + * + * - if password length < 16, we send 15 packets + * containing string lengths 1 through 15 + * + * - otherwise, we let N be the nearest multiple + * of 8 below the password length, and send 8 + * packets containing string lengths N through + * N+7. This won't obscure the order of + * magnitude of the password length, but it will + * introduce a bit of extra uncertainty. + * + * A few servers (the old 1.2.18 through 1.2.22) + * can't deal with SSH1_MSG_IGNORE. For these + * servers, we need an alternative defence. We make + * use of the fact that the password is interpreted + * as a C string: so we can append a NUL, then some + * random data. + */ + if (ssh_remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE) { + char string[64]; + char *s; + int len; + + len = strlen(password); + if (len < sizeof(string)) { + s = string; + strcpy(string, password); + len++; /* cover the zero byte */ + while (len < sizeof(string)) { + string[len++] = (char)random_byte(); + } + } else { + s = password; + } + send_packet(pwpkt_type, PKT_INT, len, + PKT_DATA, s, len, PKT_END); + } else { + int bottom, top, pwlen, i; + char *randomstr; + + pwlen = strlen(password); + if (pwlen < 16) { + bottom = 0; /* zero length passwords are OK! :-) */ + top = 15; + } else { + bottom = pwlen &~ 7; + top = bottom + 7; + } + + assert(pwlen >= bottom && pwlen <= top); + + randomstr = smalloc(top+1); + + for (i = bottom; i <= top; i++) { + if (i == pwlen) + defer_packet(pwpkt_type, PKT_STR, password, PKT_END); + else { + for (j = 0; j < i; j++) { + do { + randomstr[j] = random_byte(); + } while (randomstr[j] == '\0'); + } + randomstr[i] = '\0'; + defer_packet(SSH1_MSG_IGNORE, + PKT_STR, randomstr, PKT_END); + } + } + ssh_pkt_defersend(); + } + } else { + send_packet(pwpkt_type, PKT_STR, password, PKT_END); + } } logevent("Sent password"); memset(password, 0, strlen(password)); crWaitUntil(ispkt); if (pktin.type == SSH1_SMSG_FAILURE) { if (flags & FLAG_VERBOSE) - c_write("Access denied\r\n", 15); + c_write_str("Access denied\r\n"); logevent("Authentication refused"); } else if (pktin.type == SSH1_MSG_DISCONNECT) { logevent("Received disconnect request"); @@ -1819,7 +1985,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) } void sshfwd_close(struct ssh_channel *c) { - if (c) { + if (c && !c->closes) { if (ssh_version == 1) { send_packet(SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid, PKT_END); } else { @@ -1907,7 +2073,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { bombout(("Protocol confusion")); crReturnV; } else if (pktin.type == SSH1_SMSG_FAILURE) { - c_write("Server refused to allocate pty\r\n", 32); + c_write_str("Server refused to allocate pty\r\n"); ssh_editing = ssh_echoing = 1; } logevent("Allocated pty"); @@ -1922,7 +2088,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { bombout(("Protocol confusion")); crReturnV; } else if (pktin.type == SSH1_SMSG_FAILURE) { - c_write("Server refused to compress\r\n", 32); + c_write_str("Server refused to compress\r\n"); } logevent("Started compression"); ssh1_compressing = TRUE; @@ -2183,7 +2349,7 @@ static void ssh2_mkkey(Bignum K, char *H, char *sessid, char chr, char *keyspace */ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) { - static int i, j, len, nbits; + static int i, j, len, nbits, pbits; static char *str; static Bignum p, g, e, f, K; static int kex_init_value, kex_reply_value; @@ -2199,7 +2365,6 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) static int hostkeylen, siglen; static void *hkey; /* actual host key */ static unsigned char exchange_hash[20]; - static unsigned char first_exchange_hash[20]; static unsigned char keyspace[40]; static const struct ssh2_ciphers *preferred_cipher; static const struct ssh_compress *preferred_comp; @@ -2233,7 +2398,7 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) /* * Be prepared to work around the buggy MAC problem. */ - if (cfg.buggymac) + if (cfg.buggymac || (ssh_remote_bugs & BUG_SSH2_HMAC)) maclist = buggymacs, nmacs = lenof(buggymacs); else maclist = macs, nmacs = lenof(macs); @@ -2407,30 +2572,34 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) } /* + * Work out the number of bits of key we will need from the key + * exchange. We start with the maximum key length of either + * cipher... + */ + { + int csbits, scbits; + + csbits = cscipher_tobe->keylen; + scbits = sccipher_tobe->keylen; + nbits = (csbits > scbits ? csbits : scbits); + } + /* The keys only have 160-bit entropy, since they're based on + * a SHA-1 hash. So cap the key size at 160 bits. */ + if (nbits > 160) nbits = 160; + + /* * If we're doing Diffie-Hellman group exchange, start by * requesting a group. */ if (kex == &ssh_diffiehellman_gex) { - int csbits, scbits; - logevent("Doing Diffie-Hellman group exchange"); /* - * Work out number of bits. We start with the maximum key - * length of either cipher... - */ - csbits = cscipher_tobe->keylen; - scbits = sccipher_tobe->keylen; - nbits = (csbits > scbits ? csbits : scbits); - /* The keys only have 160-bit entropy, since they're based on - * a SHA-1 hash. So cap the key size at 160 bits. */ - if (nbits > 160) nbits = 160; - /* - * ... and then work out how big a DH group we will need to - * allow that much data. - */ - nbits = 512 << ((nbits-1) / 64); + * Work out how big a DH group we will need to allow that + * much data. + */ + pbits = 512 << ((nbits-1) / 64); ssh2_pkt_init(SSH2_MSG_KEX_DH_GEX_REQUEST); - ssh2_pkt_adduint32(nbits); + ssh2_pkt_adduint32(pbits); ssh2_pkt_send(); crWaitUntil(ispkt); @@ -2453,7 +2622,7 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) /* * Now generate and send e for Diffie-Hellman. */ - e = dh_create_e(); + e = dh_create_e(nbits*2); ssh2_pkt_init(kex_init_value); ssh2_pkt_addmp(e); ssh2_pkt_send(); @@ -2471,7 +2640,7 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) sha_string(&exhash, hostkeydata, hostkeylen); if (kex == &ssh_diffiehellman_gex) { - sha_uint32(&exhash, nbits); + sha_uint32(&exhash, pbits); sha_mpint(&exhash, p); sha_mpint(&exhash, g); } @@ -2542,18 +2711,18 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) * _first_ key exchange. */ if (first_kex) - memcpy(first_exchange_hash, exchange_hash, sizeof(exchange_hash)); - ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'C', keyspace); + memcpy(ssh2_session_id, exchange_hash, sizeof(exchange_hash)); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'C', keyspace); cscipher->setcskey(keyspace); - ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'D', keyspace); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'D', keyspace); sccipher->setsckey(keyspace); - ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'A', keyspace); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'A', keyspace); cscipher->setcsiv(keyspace); - ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'B', keyspace); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'B', keyspace); sccipher->setsciv(keyspace); - ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'E', keyspace); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'E', keyspace); csmac->setcskey(keyspace); - ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'F', keyspace); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'F', keyspace); scmac->setsckey(keyspace); /* @@ -2630,6 +2799,22 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) { static unsigned long remote_winsize; static unsigned long remote_maxpkt; + static enum { + AUTH_INVALID, AUTH_PUBLICKEY_AGENT, AUTH_PUBLICKEY_FILE, AUTH_PASSWORD + } method; + static enum { + AUTH_TYPE_NONE, + AUTH_TYPE_PUBLICKEY, + AUTH_TYPE_PUBLICKEY_OFFER_LOUD, + AUTH_TYPE_PUBLICKEY_OFFER_QUIET, + AUTH_TYPE_PASSWORD + } type; + static int gotit, need_pw, can_pubkey, can_passwd; + static int tried_pubkey_config, tried_agent; + static int we_are_in; + static char username[100]; + static char pwprompt[200]; + static char password[100]; crBegin; @@ -2646,161 +2831,551 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } /* - * FIXME: currently we support only password authentication. - * (This places us technically in violation of the SSH2 spec. - * We must fix this.) + * We repeat this whole loop, including the username prompt, + * until we manage a successful authentication. If the user + * types the wrong _password_, they are sent back to the + * beginning to try another username. (If they specify a + * username in the config, they are never asked, even if they + * do give a wrong password.) + * + * I think this best serves the needs of + * + * - the people who have no configuration, no keys, and just + * want to try repeated (username,password) pairs until they + * type both correctly + * + * - people who have keys and configuration but occasionally + * need to fall back to passwords + * + * - people with a key held in Pageant, who might not have + * logged in to a particular machine before; so they want to + * type a username, and then _either_ their key will be + * accepted, _or_ they will type a password. If they mistype + * the username they will want to be able to get back and + * retype it! */ - while (1) { - /* - * Get a username and a password. - */ - static char username[100]; - static char password[100]; - static int pos = 0; + do { + static int pos; static char c; + /* + * Get a username. + */ + pos = 0; if ((flags & FLAG_INTERACTIVE) && !*cfg.username) { - c_write("login as: ", 10); - ssh_send_ok = 1; - while (pos >= 0) { - crWaitUntilV(!ispkt); - while (inlen--) switch (c = *in++) { - case 10: case 13: - username[pos] = 0; - pos = -1; - break; - case 8: case 127: - if (pos > 0) { - c_write("\b \b", 3); - pos--; - } - break; - case 21: case 27: - while (pos > 0) { - c_write("\b \b", 3); - pos--; - } - break; - case 3: case 4: - random_save_seed(); - exit(0); - break; - default: - if (((c >= ' ' && c <= '~') || - ((unsigned char)c >= 160)) && pos < 40) { - username[pos++] = c; - c_write(&c, 1); - } - break; - } - } - c_write("\r\n", 2); + if (ssh_get_line) { + if (!ssh_get_line("login as: ", + username, sizeof(username), FALSE)) { + /* + * get_line failed to get a username. + * Terminate. + */ + logevent("No username provided. Abandoning session."); + ssh_state = SSH_STATE_CLOSED; + crReturnV; + } + } else { + c_write_str("login as: "); + ssh_send_ok = 1; + while (pos >= 0) { + crWaitUntilV(!ispkt); + while (inlen--) switch (c = *in++) { + case 10: case 13: + username[pos] = 0; + pos = -1; + break; + case 8: case 127: + if (pos > 0) { + c_write_str("\b \b"); + pos--; + } + break; + case 21: case 27: + while (pos > 0) { + c_write_str("\b \b"); + pos--; + } + break; + case 3: case 4: + random_save_seed(); + exit(0); + break; + default: + if (((c >= ' ' && c <= '~') || + ((unsigned char)c >= 160)) && pos < 40) { + username[pos++] = c; + c_write(&c, 1); + } + break; + } + } + } + c_write_str("\r\n"); username[strcspn(username, "\n\r")] = '\0'; } else { char stuff[200]; strncpy(username, cfg.username, 99); username[99] = '\0'; - if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) { + if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) { sprintf(stuff, "Using username \"%s\".\r\n", username); - c_write(stuff, strlen(stuff)); + c_write_str(stuff); } } - if (ssh_get_password) { - char prompt[200]; - sprintf(prompt, "%.90s@%.90s's password: ", username, savedhost); - if (!ssh_get_password(prompt, password, sizeof(password))) { - /* - * get_password failed to get a password (for - * example because one was supplied on the command - * line which has already failed to work). - * Terminate. - */ - logevent("No more passwords to try"); - ssh_state = SSH_STATE_CLOSED; - crReturnV; - } - } else { - c_write("password: ", 10); - ssh_send_ok = 1; + /* + * Send an authentication request using method "none": (a) + * just in case it succeeds, and (b) so that we know what + * authentication methods we can usefully try next. + */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("none"); /* method */ + ssh2_pkt_send(); + type = AUTH_TYPE_NONE; + gotit = FALSE; + we_are_in = FALSE; + + tried_pubkey_config = FALSE; + tried_agent = FALSE; + + while (1) { + /* + * Wait for the result of the last authentication request. + */ + if (!gotit) + crWaitUntilV(ispkt); + while (pktin.type == SSH2_MSG_USERAUTH_BANNER) { + /* FIXME: should support this */ + crWaitUntilV(ispkt); + } + if (pktin.type == SSH2_MSG_USERAUTH_SUCCESS) { + logevent("Access granted"); + we_are_in = TRUE; + break; + } - pos = 0; - while (pos >= 0) { - crWaitUntilV(!ispkt); - while (inlen--) switch (c = *in++) { - case 10: case 13: - password[pos] = 0; - pos = -1; - break; - case 8: case 127: - if (pos > 0) - pos--; - break; - case 21: case 27: - pos = 0; - break; - case 3: case 4: - random_save_seed(); - exit(0); - break; - default: - if (((c >= ' ' && c <= '~') || - ((unsigned char)c >= 160)) && pos < 40) - password[pos++] = c; - break; - } - } - c_write("\r\n", 2); - } + if (pktin.type != SSH2_MSG_USERAUTH_FAILURE) { + bombout(("Strange packet received during authentication: type %d", + pktin.type)); + } - /* - * We send the password packet lumped tightly together with - * an SSH_MSG_IGNORE packet. The IGNORE packet contains a - * string long enough to make the total length of the two - * packets constant. This should ensure that a passive - * listener doing traffic analyis can't work out the length - * of the password. - * - * For this to work, we need an assumption about the - * maximum length of the password packet. I think 256 is - * pretty conservative. Anyone using a password longer than - * that probably doesn't have much to worry about from - * people who find out how long their password is! - */ - ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); - ssh2_pkt_addstring(username); - ssh2_pkt_addstring("ssh-connection"); /* service requested */ - ssh2_pkt_addstring("password"); - ssh2_pkt_addbool(FALSE); - ssh2_pkt_addstring(password); - ssh2_pkt_defer(); - /* - * We'll include a string that's an exact multiple of the - * cipher block size. If the cipher is NULL for some - * reason, we don't do this trick at all because we gain - * nothing by it. - */ - if (cscipher) { - int i, j; - ssh2_pkt_init(SSH2_MSG_IGNORE); - ssh2_pkt_addstring_start(); - for (i = deferred_len; i <= 256; i += cscipher->blksize) { - for (j = 0; j < cscipher->blksize; j++) { - char c = (char)random_byte(); - ssh2_pkt_addstring_data(&c, 1); - } - } - ssh2_pkt_defer(); - } - ssh2_pkt_defersend(); + gotit = FALSE; + + /* + * OK, we're now sitting on a USERAUTH_FAILURE message, so + * we can look at the string in it and know what we can + * helpfully try next. + */ + { + char *methods; + int methlen; + ssh2_pkt_getstring(&methods, &methlen); + if (!ssh2_pkt_getbool()) { + /* + * We have received an unequivocal Access + * Denied. This can translate to a variety of + * messages: + * + * - if we'd just tried "none" authentication, + * it's not worth printing anything at all + * + * - if we'd just tried a public key _offer_, + * the message should be "Server refused our + * key" (or no message at all if the key + * came from Pageant) + * + * - if we'd just tried anything else, the + * message really should be "Access denied". + * + * Additionally, if we'd just tried password + * authentication, we should break out of this + * whole loop so as to go back to the username + * prompt. + */ + if (type == AUTH_TYPE_NONE) { + /* do nothing */ + } else if (type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD || + type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) { + if (type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD) + c_write_str("Server refused our key\r\n"); + logevent("Server refused public key"); + } else { + c_write_str("Access denied\r\n"); + logevent("Access denied"); + if (type == AUTH_TYPE_PASSWORD) { + we_are_in = FALSE; + break; + } + } + } else { + c_write_str("Further authentication required\r\n"); + logevent("Further authentication required"); + } - crWaitUntilV(ispkt); - if (pktin.type != SSH2_MSG_USERAUTH_SUCCESS) { - c_write("Access denied\r\n", 15); - logevent("Authentication refused"); - } else - break; - } + can_pubkey = in_commasep_string("publickey", methods, methlen); + can_passwd = in_commasep_string("password", methods, methlen); + } + + method = 0; + + if (!method && can_pubkey && agent_exists && !tried_agent) { + /* + * Attempt public-key authentication using Pageant. + */ + static unsigned char request[5], *response, *p; + static int responselen; + static int i, nkeys; + static int authed = FALSE; + void *r; + + tried_agent = TRUE; + + logevent("Pageant is running. Requesting keys."); + + /* Request the keys held by the agent. */ + PUT_32BIT(request, 1); + request[4] = SSH2_AGENTC_REQUEST_IDENTITIES; + agent_query(request, 5, &r, &responselen); + response = (unsigned char *)r; + if (response && responselen >= 5 && + response[4] == SSH2_AGENT_IDENTITIES_ANSWER) { + p = response + 5; + nkeys = GET_32BIT(p); p += 4; + { char buf[64]; sprintf(buf, "Pageant has %d SSH2 keys", nkeys); + logevent(buf); } + for (i = 0; i < nkeys; i++) { + static char *pkblob, *alg, *commentp; + static int pklen, alglen, commentlen; + static int siglen, retlen, len; + static char *q, *agentreq, *ret; + + { char buf[64]; sprintf(buf, "Trying Pageant key #%d", i); + logevent(buf); } + pklen = GET_32BIT(p); p += 4; + pkblob = p; p += pklen; + alglen = GET_32BIT(pkblob); + alg = pkblob + 4; + commentlen = GET_32BIT(p); p += 4; + commentp = p; p += commentlen; + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection");/* service requested */ + ssh2_pkt_addstring("publickey");/* method */ + ssh2_pkt_addbool(FALSE); /* no signature included */ + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(alg, alglen); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(pkblob, pklen); + ssh2_pkt_send(); + + crWaitUntilV(ispkt); + if (pktin.type != SSH2_MSG_USERAUTH_PK_OK) { + logevent("Key refused"); + continue; + } + + c_write_str("Authenticating with public key \""); + c_write(commentp, commentlen); + c_write_str("\" from agent\r\n"); + + /* + * Server is willing to accept the key. + * Construct a SIGN_REQUEST. + */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("publickey"); /* method */ + ssh2_pkt_addbool(TRUE); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(alg, alglen); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(pkblob, pklen); + + siglen = pktout.length - 5 + 4 + 20; + len = 1; /* message type */ + len += 4 + pklen; /* key blob */ + len += 4 + siglen; /* data to sign */ + len += 4; /* flags */ + agentreq = smalloc(4 + len); + PUT_32BIT(agentreq, len); + q = agentreq + 4; + *q++ = SSH2_AGENTC_SIGN_REQUEST; + PUT_32BIT(q, pklen); q += 4; + memcpy(q, pkblob, pklen); q += pklen; + PUT_32BIT(q, siglen); q += 4; + /* Now the data to be signed... */ + PUT_32BIT(q, 20); q += 4; + memcpy(q, ssh2_session_id, 20); q += 20; + memcpy(q, pktout.data+5, pktout.length-5); + q += pktout.length-5; + /* And finally the (zero) flags word. */ + PUT_32BIT(q, 0); + agent_query(agentreq, len+4, &ret, &retlen); + sfree(agentreq); + if (ret) { + if (ret[4] == SSH2_AGENT_SIGN_RESPONSE) { + logevent("Sending Pageant's response"); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(ret+9, GET_32BIT(ret+5)); + ssh2_pkt_send(); + authed = TRUE; + break; + } else { + logevent("Pageant failed to answer challenge"); + sfree(ret); + } + } + } + if (authed) + continue; + } + } + + if (!method && can_pubkey && *cfg.keyfile && !tried_pubkey_config) { + unsigned char *pub_blob; + char *algorithm, *comment; + int pub_blob_len; + + tried_pubkey_config = TRUE; + + /* + * Try the public key supplied in the configuration. + * + * First, offer the public blob to see if the server is + * willing to accept it. + */ + pub_blob = ssh2_userkey_loadpub(cfg.keyfile, &algorithm, + &pub_blob_len); + if (pub_blob) { + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("publickey");/* method */ + ssh2_pkt_addbool(FALSE); /* no signature included */ + ssh2_pkt_addstring(algorithm); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(pub_blob, pub_blob_len); + ssh2_pkt_send(); + logevent("Offered public key"); /* FIXME */ + + crWaitUntilV(ispkt); + if (pktin.type != SSH2_MSG_USERAUTH_PK_OK) { + gotit = TRUE; + type = AUTH_TYPE_PUBLICKEY_OFFER_LOUD; + continue; /* key refused; give up on it */ + } + + logevent("Offer of public key accepted"); + /* + * Actually attempt a serious authentication using + * the key. + */ + if (ssh2_userkey_encrypted(cfg.keyfile, &comment)) { + sprintf(pwprompt, "Passphrase for key \"%.100s\": ", comment); + need_pw = TRUE; + } else { + need_pw = FALSE; + } + c_write_str("Authenticating with public key \""); + c_write_str(comment); + c_write_str("\"\r\n"); + method = AUTH_PUBLICKEY_FILE; + } + } + + if (!method && can_passwd) { + method = AUTH_PASSWORD; + sprintf(pwprompt, "%.90s@%.90s's password: ", username, savedhost); + need_pw = TRUE; + } + + if (need_pw) { + if (ssh_get_line) { + if (!ssh_get_line(pwprompt, password, + sizeof(password), TRUE)) { + /* + * get_line failed to get a password (for + * example because one was supplied on the + * command line which has already failed to + * work). Terminate. + */ + logevent("No more passwords to try"); + ssh_state = SSH_STATE_CLOSED; + crReturnV; + } + } else { + static int pos = 0; + static char c; + + c_write_str(pwprompt); + ssh_send_ok = 1; + + pos = 0; + while (pos >= 0) { + crWaitUntilV(!ispkt); + while (inlen--) switch (c = *in++) { + case 10: case 13: + password[pos] = 0; + pos = -1; + break; + case 8: case 127: + if (pos > 0) + pos--; + break; + case 21: case 27: + pos = 0; + break; + case 3: case 4: + random_save_seed(); + exit(0); + break; + default: + if (((c >= ' ' && c <= '~') || + ((unsigned char)c >= 160)) && pos < 40) + password[pos++] = c; + break; + } + } + c_write_str("\r\n"); + } + } + + if (method == AUTH_PUBLICKEY_FILE) { + /* + * We have our passphrase. Now try the actual authentication. + */ + struct ssh2_userkey *key; + + key = ssh2_load_userkey(cfg.keyfile, password); + if (key == SSH2_WRONG_PASSPHRASE || key == NULL) { + if (key == SSH2_WRONG_PASSPHRASE) { + c_write_str("Wrong passphrase\r\n"); + tried_pubkey_config = FALSE; + } else { + c_write_str("Unable to load private key\r\n"); + tried_pubkey_config = TRUE; + } + /* Send a spurious AUTH_NONE to return to the top. */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("none"); /* method */ + ssh2_pkt_send(); + type = AUTH_TYPE_NONE; + } else { + unsigned char *blob, *sigdata; + int blob_len, sigdata_len; + + /* + * We have loaded the private key and the server + * has announced that it's willing to accept it. + * Hallelujah. Generate a signature and send it. + */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("publickey"); /* method */ + ssh2_pkt_addbool(TRUE); + ssh2_pkt_addstring(key->alg->name); + blob = key->alg->public_blob(key->data, &blob_len); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(blob, blob_len); + sfree(blob); + + /* + * The data to be signed is: + * + * string session-id + * + * followed by everything so far placed in the + * outgoing packet. + */ + sigdata_len = pktout.length - 5 + 4 + 20; + sigdata = smalloc(sigdata_len); + PUT_32BIT(sigdata, 20); + memcpy(sigdata+4, ssh2_session_id, 20); + memcpy(sigdata+24, pktout.data+5, pktout.length-5); + blob = key->alg->sign(key->data, sigdata, sigdata_len, &blob_len); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(blob, blob_len); + sfree(blob); + sfree(sigdata); + + ssh2_pkt_send(); + type = AUTH_TYPE_PUBLICKEY; + } + } else if (method == AUTH_PASSWORD) { + /* + * We send the password packet lumped tightly together with + * an SSH_MSG_IGNORE packet. The IGNORE packet contains a + * string long enough to make the total length of the two + * packets constant. This should ensure that a passive + * listener doing traffic analyis can't work out the length + * of the password. + * + * For this to work, we need an assumption about the + * maximum length of the password packet. I think 256 is + * pretty conservative. Anyone using a password longer than + * that probably doesn't have much to worry about from + * people who find out how long their password is! + */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("password"); + ssh2_pkt_addbool(FALSE); + ssh2_pkt_addstring(password); + ssh2_pkt_defer(); + /* + * We'll include a string that's an exact multiple of the + * cipher block size. If the cipher is NULL for some + * reason, we don't do this trick at all because we gain + * nothing by it. + */ + if (cscipher) { + int stringlen, i; + + stringlen = (256 - deferred_len); + stringlen += cscipher->blksize - 1; + stringlen -= (stringlen % cscipher->blksize); + if (cscomp) { + /* + * Temporarily disable actual compression, + * so we can guarantee to get this string + * exactly the length we want it. The + * compression-disabling routine should + * return an integer indicating how many + * bytes we should adjust our string length + * by. + */ + stringlen -= cscomp->disable_compression(); + } + ssh2_pkt_init(SSH2_MSG_IGNORE); + ssh2_pkt_addstring_start(); + for (i = 0; i < stringlen; i++) { + char c = (char)random_byte(); + ssh2_pkt_addstring_data(&c, 1); + } + ssh2_pkt_defer(); + } + ssh_pkt_defersend(); + logevent("Sent password"); + type = AUTH_TYPE_PASSWORD; + } else { + c_write_str("No supported authentication methods left to try!\r\n"); + logevent("No supported authentications offered. Disconnecting"); + ssh2_pkt_init(SSH2_MSG_DISCONNECT); + ssh2_pkt_adduint32(SSH2_DISCONNECT_BY_APPLICATION); + ssh2_pkt_addstring("No supported authentication methods available"); + ssh2_pkt_addstring("en"); /* language tag */ + ssh2_pkt_send(); + ssh_state = SSH_STATE_CLOSED; + crReturnV; + } + } + } while (!we_are_in); /* * Now we're authenticated for the connection protocol. The @@ -2882,6 +3457,41 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } /* + * Potentially enable agent forwarding. + */ + if (cfg.agentfwd && agent_exists()) { + logevent("Requesting OpenSSH-style agent forwarding"); + ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST); + ssh2_pkt_adduint32(mainchan->remoteid); + ssh2_pkt_addstring("auth-agent-req@openssh.com"); + ssh2_pkt_addbool(1); /* want reply */ + ssh2_pkt_send(); + + do { + crWaitUntilV(ispkt); + if (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { + unsigned i = ssh2_pkt_getuint32(); + struct ssh_channel *c; + c = find234(ssh_channels, &i, ssh_channelfind); + if (!c) + continue; /* nonexistent channel */ + c->v2.remwindow += ssh2_pkt_getuint32(); + } + } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + + if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) { + if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) { + bombout(("Server got confused by agent forwarding request")); + crReturnV; + } + logevent("Agent forwarding refused"); + } else { + logevent("Agent forwarding enabled"); + ssh_agentfwd_enabled = TRUE; + } + } + + /* * Now allocate a pty for the session. */ if (!cfg.nopty) { @@ -2916,7 +3526,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) bombout(("Server got confused by pty request")); crReturnV; } - c_write("Server refused to allocate pty\r\n", 32); + c_write_str("Server refused to allocate pty\r\n"); ssh_editing = ssh_echoing = 1; } else { logevent("Allocated pty"); @@ -3003,6 +3613,45 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) case CHAN_X11: x11_send(c->u.x11.s, data, length); break; + case CHAN_AGENT: + while (length > 0) { + if (c->u.a.lensofar < 4) { + int l = min(4 - c->u.a.lensofar, length); + memcpy(c->u.a.msglen + c->u.a.lensofar, data, l); + data += l; length -= l; c->u.a.lensofar += l; + } + if (c->u.a.lensofar == 4) { + c->u.a.totallen = 4 + GET_32BIT(c->u.a.msglen); + c->u.a.message = smalloc(c->u.a.totallen); + memcpy(c->u.a.message, c->u.a.msglen, 4); + } + if (c->u.a.lensofar >= 4 && length > 0) { + int l = min(c->u.a.totallen - c->u.a.lensofar, + length); + memcpy(c->u.a.message + c->u.a.lensofar, data, l); + data += l; length -= l; c->u.a.lensofar += l; + } + if (c->u.a.lensofar == c->u.a.totallen) { + void *reply, *sentreply; + int replylen; + agent_query(c->u.a.message, c->u.a.totallen, + &reply, &replylen); + if (reply) + sentreply = reply; + else { + /* Fake SSH_AGENT_FAILURE. */ + sentreply = "\0\0\0\1\5"; + replylen = 5; + } + ssh2_add_channel_data(c, sentreply, replylen); + try_send = TRUE; + if (reply) + sfree(reply); + sfree(c->u.a.message); + c->u.a.lensofar = 0; + } + } + break; } /* * Enlarge the window again at the remote @@ -3035,7 +3684,9 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) */ x11_close(c->u.x11.s); sshfwd_close(c); - } + } else if (c->type == CHAN_AGENT) { + sshfwd_close(c); + } } else if (pktin.type == SSH2_MSG_CHANNEL_CLOSE) { unsigned i = ssh2_pkt_getuint32(); struct ssh_channel *c; @@ -3055,6 +3706,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) break; /* nothing to see here, move along */ case CHAN_X11: break; + case CHAN_AGENT: + break; } del234(ssh_channels, c); sfree(c->v2.outbuffer); @@ -3099,6 +3752,14 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } else { c->type = CHAN_X11; } + } else if (typelen == 22 && + !memcmp(type, "auth-agent@openssh.com", 3)) { + if (!ssh_agentfwd_enabled) + error = "Agent forwarding is not enabled"; + else { + c->type = CHAN_AGENT; /* identify channel type */ + c->u.a.lensofar = 0; + } } else { error = "Unsupported channel type requested"; }