X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/1408a8777732536ede3b60bf21c8606af2782339..6e9e952088e8aa586060aa2464a19186f3d58341:/ssh.c diff --git a/ssh.c b/ssh.c index 326f50f3..da2ca51f 100644 --- a/ssh.c +++ b/ssh.c @@ -68,15 +68,6 @@ #define SSH1_AUTH_TIS 5 /* 0x5 */ #define SSH1_AUTH_CCARD 16 /* 0x10 */ -#define SSH_AGENTC_REQUEST_RSA_IDENTITIES 1 /* 0x1 */ -#define SSH_AGENT_RSA_IDENTITIES_ANSWER 2 /* 0x2 */ -#define SSH_AGENTC_RSA_CHALLENGE 3 /* 0x3 */ -#define SSH_AGENT_RSA_RESPONSE 4 /* 0x4 */ -#define SSH_AGENT_FAILURE 5 /* 0x5 */ -#define SSH_AGENT_SUCCESS 6 /* 0x6 */ -#define SSH_AGENTC_ADD_RSA_IDENTITY 7 /* 0x7 */ -#define SSH_AGENTC_REMOVE_RSA_IDENTITY 8 /* 0x8 */ - #define SSH2_MSG_DISCONNECT 1 /* 0x1 */ #define SSH2_MSG_IGNORE 2 /* 0x2 */ #define SSH2_MSG_UNIMPLEMENTED 3 /* 0x3 */ @@ -662,7 +653,7 @@ static void s_wrpkt_start(int type, int len) { pktout.type = type; } -static void s_wrpkt(void) { +static int s_wrpkt_prepare(void) { int pad, len, biglen, i; unsigned long crc; @@ -709,93 +700,118 @@ static void s_wrpkt(void) { if (cipher) cipher->encrypt(pktout.data+4, biglen); - sk_write(s, pktout.data, biglen+4); + return biglen+4; +} + +static void s_wrpkt(void) { + int len; + len = s_wrpkt_prepare(); + sk_write(s, pktout.data, len); +} + +static void s_wrpkt_defer(void) { + int len; + len = s_wrpkt_prepare(); + if (deferred_len + len > deferred_size) { + deferred_size = deferred_len + len + 128; + deferred_send_data = srealloc(deferred_send_data, deferred_size); + } + memcpy(deferred_send_data+deferred_len, pktout.data, len); + deferred_len += len; } /* - * Construct a packet with the specified contents and - * send it to the server. + * Construct a packet with the specified contents. */ -static void send_packet(int pkttype, ...) +static void construct_packet(int pkttype, va_list ap1, va_list ap2) { - va_list args; unsigned char *p, *argp, argchar; unsigned long argint; int pktlen, argtype, arglen; Bignum bn; pktlen = 0; - va_start(args, pkttype); - while ((argtype = va_arg(args, int)) != PKT_END) { + while ((argtype = va_arg(ap1, int)) != PKT_END) { switch (argtype) { case PKT_INT: - (void) va_arg(args, int); + (void) va_arg(ap1, int); pktlen += 4; break; case PKT_CHAR: - (void) va_arg(args, char); + (void) va_arg(ap1, char); pktlen++; break; case PKT_DATA: - (void) va_arg(args, unsigned char *); - arglen = va_arg(args, int); + (void) va_arg(ap1, unsigned char *); + arglen = va_arg(ap1, int); pktlen += arglen; break; case PKT_STR: - argp = va_arg(args, unsigned char *); + argp = va_arg(ap1, unsigned char *); arglen = strlen(argp); pktlen += 4 + arglen; break; case PKT_BIGNUM: - bn = va_arg(args, Bignum); + bn = va_arg(ap1, Bignum); pktlen += ssh1_bignum_length(bn); break; default: assert(0); } } - va_end(args); s_wrpkt_start(pkttype, pktlen); p = pktout.body; - va_start(args, pkttype); - while ((argtype = va_arg(args, int)) != PKT_END) { + while ((argtype = va_arg(ap2, int)) != PKT_END) { switch (argtype) { case PKT_INT: - argint = va_arg(args, int); + argint = va_arg(ap2, int); PUT_32BIT(p, argint); p += 4; break; case PKT_CHAR: - argchar = va_arg(args, unsigned char); + argchar = va_arg(ap2, unsigned char); *p = argchar; p++; break; case PKT_DATA: - argp = va_arg(args, unsigned char *); - arglen = va_arg(args, int); + argp = va_arg(ap2, unsigned char *); + arglen = va_arg(ap2, int); memcpy(p, argp, arglen); p += arglen; break; case PKT_STR: - argp = va_arg(args, unsigned char *); + argp = va_arg(ap2, unsigned char *); arglen = strlen(argp); PUT_32BIT(p, arglen); memcpy(p + 4, argp, arglen); p += 4 + arglen; break; case PKT_BIGNUM: - bn = va_arg(args, Bignum); + bn = va_arg(ap2, Bignum); p += ssh1_write_bignum(p, bn); break; } } - va_end(args); +} +static void send_packet(int pkttype, ...) { + va_list ap1, ap2; + va_start(ap1, pkttype); + va_start(ap2, pkttype); + construct_packet(pkttype, ap1, ap2); s_wrpkt(); } +static void defer_packet(int pkttype, ...) { + va_list ap1, ap2; + va_start(ap1, pkttype); + va_start(ap2, pkttype); + construct_packet(pkttype, ap1, ap2); + s_wrpkt_defer(); +} + static int ssh_versioncmp(char *a, char *b) { char *ae, *be; unsigned long av, bv; @@ -998,9 +1014,9 @@ static void ssh2_pkt_defer(void) { /* * Send the whole deferred data block constructed by - * ssh2_pkt_defer(). + * ssh2_pkt_defer() or SSH1's defer_packet(). */ -static void ssh2_pkt_defersend(void) { +static void ssh_pkt_defersend(void) { sk_write(s, deferred_send_data, deferred_len); deferred_len = deferred_size = 0; sfree(deferred_send_data); @@ -1527,7 +1543,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) /* Request the keys held by the agent. */ PUT_32BIT(request, 1); - request[4] = SSH_AGENTC_REQUEST_RSA_IDENTITIES; + request[4] = SSH1_AGENTC_REQUEST_RSA_IDENTITIES; agent_query(request, 5, &r, &responselen); response = (unsigned char *)r; if (response) { @@ -1569,7 +1585,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) agentreq = smalloc(4 + len); PUT_32BIT(agentreq, len); q = agentreq + 4; - *q++ = SSH_AGENTC_RSA_CHALLENGE; + *q++ = SSH1_AGENTC_RSA_CHALLENGE; PUT_32BIT(q, ssh1_bignum_bitcount(key.modulus)); q += 4; q += ssh1_write_bignum(q, key.exponent); @@ -1580,7 +1596,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) agent_query(agentreq, len+4, &ret, &retlen); sfree(agentreq); if (ret) { - if (ret[4] == SSH_AGENT_RSA_RESPONSE) { + if (ret[4] == SSH1_AGENT_RSA_RESPONSE) { logevent("Sending Pageant's response"); send_packet(SSH1_CMSG_AUTH_RSA_RESPONSE, PKT_DATA, ret+5, 16, PKT_END); @@ -1793,7 +1809,67 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) break; /* we're through! */ } else { - send_packet(pwpkt_type, PKT_STR, password, PKT_END); + if (pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) { + /* + * Defence against traffic analysis: we send a + * whole bunch of packets containing strings of + * different lengths. One of these strings is the + * password, in a SSH1_CMSG_AUTH_PASSWORD packet. + * The others are all random data in + * SSH1_MSG_IGNORE packets. This way a passive + * listener can't tell which is the password, and + * hence can't deduce the password length. + * + * Anybody with a password length greater than 16 + * bytes is going to have enough entropy in their + * password that a listener won't find it _that_ + * much help to know how long it is. So what we'll + * do is: + * + * - if password length < 16, we send 15 packets + * containing string lengths 1 through 15 + * + * - otherwise, we let N be the nearest multiple + * of 8 below the password length, and send 8 + * packets containing string lengths N through + * N+7. This won't obscure the order of + * magnitude of the password length, but it will + * introduce a bit of extra uncertainty. + */ + int bottom, top, pwlen, i; + char *randomstr; + + pwlen = strlen(password); + if (pwlen < 16) { + bottom = 1; + top = 15; + } else { + bottom = pwlen &~ 7; + top = bottom + 7; + } + + assert(pwlen >= bottom && pwlen <= top); + + randomstr = smalloc(top+1); + + for (i = bottom; i <= top; i++) { + if (i == pwlen) + defer_packet(pwpkt_type, PKT_STR, password, PKT_END); + else { + for (j = 0; j < i; j++) { + do { + randomstr[j] = random_byte(); + } while (randomstr[j] == '\0'); + } + randomstr[i] = '\0'; + defer_packet(SSH1_MSG_IGNORE, + PKT_STR, randomstr, PKT_END); + } + } + ssh_pkt_defersend(); + } else { + send_packet(pwpkt_type, PKT_STR, password, PKT_END); + } } logevent("Sent password"); memset(password, 0, strlen(password)); @@ -2638,7 +2714,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) AUTH_TYPE_PUBLICKEY_OFFER_QUIET, AUTH_TYPE_PASSWORD } type; - static int gotit, need_pw, can_pubkey, can_passwd, tried_pubkey_config; + static int gotit, need_pw, can_pubkey, can_passwd; + static int tried_pubkey_config, tried_agent; static int we_are_in; static char username[100]; static char pwprompt[200]; @@ -2752,6 +2829,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) we_are_in = FALSE; tried_pubkey_config = FALSE; + tried_agent = FALSE; while (1) { /* @@ -2833,6 +2911,119 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) method = 0; + if (!method && can_pubkey && agent_exists && !tried_agent) { + /* + * Attempt public-key authentication using Pageant. + */ + static unsigned char request[5], *response, *p; + static int responselen; + static int i, nkeys; + static int authed = FALSE; + void *r; + + tried_agent = TRUE; + + logevent("Pageant is running. Requesting keys."); + + /* Request the keys held by the agent. */ + PUT_32BIT(request, 1); + request[4] = SSH2_AGENTC_REQUEST_IDENTITIES; + agent_query(request, 5, &r, &responselen); + response = (unsigned char *)r; + if (response) { + p = response + 5; + nkeys = GET_32BIT(p); p += 4; + { char buf[64]; sprintf(buf, "Pageant has %d keys", nkeys); + logevent(buf); } + for (i = 0; i < nkeys; i++) { + static char *pkblob, *alg, *commentp; + static int pklen, alglen, commentlen; + static int siglen, retlen, len; + static char *q, *agentreq, *ret; + + { char buf[64]; sprintf(buf, "Trying Pageant key #%d", i); + logevent(buf); } + pklen = GET_32BIT(p); p += 4; + pkblob = p; p += pklen; + alglen = GET_32BIT(pkblob); + alg = pkblob + 4; + commentlen = GET_32BIT(p); p += 4; + commentp = p; p += commentlen; + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection");/* service requested */ + ssh2_pkt_addstring("publickey");/* method */ + ssh2_pkt_addbool(FALSE); /* no signature included */ + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(alg, alglen); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(pkblob, pklen); + ssh2_pkt_send(); + + crWaitUntilV(ispkt); + if (pktin.type != SSH2_MSG_USERAUTH_PK_OK) { + logevent("Key refused"); + continue; + } + + c_write_str("Authenticating with public key \""); + c_write(commentp, commentlen); + c_write_str("\" from agent\r\n"); + + /* + * Server is willing to accept the key. + * Construct a SIGN_REQUEST. + */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("publickey"); /* method */ + ssh2_pkt_addbool(TRUE); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(alg, alglen); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(pkblob, pklen); + + siglen = pktout.length - 5 + 4 + 20; + len = 1; /* message type */ + len += 4 + pklen; /* key blob */ + len += 4 + siglen; /* data to sign */ + len += 4; /* flags */ + agentreq = smalloc(4 + len); + PUT_32BIT(agentreq, len); + q = agentreq + 4; + *q++ = SSH2_AGENTC_SIGN_REQUEST; + PUT_32BIT(q, pklen); q += 4; + memcpy(q, pkblob, pklen); q += pklen; + PUT_32BIT(q, siglen); q += 4; + /* Now the data to be signed... */ + PUT_32BIT(q, 20); q += 4; + memcpy(q, ssh2_session_id, 20); q += 20; + memcpy(q, pktout.data+5, pktout.length-5); + q += pktout.length-5; + /* And finally the (zero) flags word. */ + PUT_32BIT(q, 0); + agent_query(agentreq, len+4, &ret, &retlen); + sfree(agentreq); + if (ret) { + if (ret[4] == SSH2_AGENT_SIGN_RESPONSE) { + logevent("Sending Pageant's response"); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(ret+9, GET_32BIT(ret+5)); + ssh2_pkt_send(); + authed = TRUE; + break; + } else { + logevent("Pageant failed to answer challenge"); + sfree(ret); + } + } + } + if (authed) + continue; + } + } + if (!method && can_pubkey && *cfg.keyfile && !tried_pubkey_config) { unsigned char *pub_blob; char *algorithm, *comment; @@ -3033,19 +3224,34 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) * reason, we don't do this trick at all because we gain * nothing by it. */ - if (cscipher) { - int i, j; + if (cscipher) { + int stringlen, i; + + stringlen = (256 - deferred_len); + stringlen += cscipher->blksize - 1; + stringlen -= (stringlen % cscipher->blksize); + if (cscomp) { + /* + * Temporarily disable actual compression, + * so we can guarantee to get this string + * exactly the length we want it. The + * compression-disabling routine should + * return an integer indicating how many + * bytes we should adjust our string length + * by. + */ + stringlen -= cscomp->disable_compression(); + } ssh2_pkt_init(SSH2_MSG_IGNORE); ssh2_pkt_addstring_start(); - for (i = deferred_len; i <= 256; i += cscipher->blksize) { - for (j = 0; j < cscipher->blksize; j++) { - char c = (char)random_byte(); - ssh2_pkt_addstring_data(&c, 1); - } + for (i = 0; i < stringlen; i++) { + char c = (char)random_byte(); + ssh2_pkt_addstring_data(&c, 1); } ssh2_pkt_defer(); } - ssh2_pkt_defersend(); + ssh_pkt_defersend(); + logevent("Sent password"); type = AUTH_TYPE_PASSWORD; } else { c_write_str("No supported authentication methods left to try!\r\n"); @@ -3141,6 +3347,43 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } /* + * Potentially enable agent forwarding. + */ + if (cfg.agentfwd && agent_exists()) { + char proto[20], data[64]; + logevent("Requesting OpenSSH-style agent forwarding"); + x11_invent_auth(proto, sizeof(proto), data, sizeof(data)); + ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST); + ssh2_pkt_adduint32(mainchan->remoteid); + ssh2_pkt_addstring("auth-agent-req@openssh.com"); + ssh2_pkt_addbool(1); /* want reply */ + ssh2_pkt_send(); + + do { + crWaitUntilV(ispkt); + if (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { + unsigned i = ssh2_pkt_getuint32(); + struct ssh_channel *c; + c = find234(ssh_channels, &i, ssh_channelfind); + if (!c) + continue; /* nonexistent channel */ + c->v2.remwindow += ssh2_pkt_getuint32(); + } + } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + + if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) { + if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) { + bombout(("Server got confused by agent forwarding request")); + crReturnV; + } + logevent("Agent forwarding refused"); + } else { + logevent("Agent forwarding enabled"); + ssh_agentfwd_enabled = TRUE; + } + } + + /* * Now allocate a pty for the session. */ if (!cfg.nopty) { @@ -3262,6 +3505,45 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) case CHAN_X11: x11_send(c->u.x11.s, data, length); break; + case CHAN_AGENT: + while (length > 0) { + if (c->u.a.lensofar < 4) { + int l = min(4 - c->u.a.lensofar, length); + memcpy(c->u.a.msglen + c->u.a.lensofar, data, l); + data += l; length -= l; c->u.a.lensofar += l; + } + if (c->u.a.lensofar == 4) { + c->u.a.totallen = 4 + GET_32BIT(c->u.a.msglen); + c->u.a.message = smalloc(c->u.a.totallen); + memcpy(c->u.a.message, c->u.a.msglen, 4); + } + if (c->u.a.lensofar >= 4 && length > 0) { + int l = min(c->u.a.totallen - c->u.a.lensofar, + length); + memcpy(c->u.a.message + c->u.a.lensofar, data, l); + data += l; length -= l; c->u.a.lensofar += l; + } + if (c->u.a.lensofar == c->u.a.totallen) { + void *reply, *sentreply; + int replylen; + agent_query(c->u.a.message, c->u.a.totallen, + &reply, &replylen); + if (reply) + sentreply = reply; + else { + /* Fake SSH_AGENT_FAILURE. */ + sentreply = "\0\0\0\1\5"; + replylen = 5; + } + ssh2_add_channel_data(c, sentreply, replylen); + try_send = TRUE; + if (reply) + sfree(reply); + sfree(c->u.a.message); + c->u.a.lensofar = 0; + } + } + break; } /* * Enlarge the window again at the remote @@ -3294,7 +3576,9 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) */ x11_close(c->u.x11.s); sshfwd_close(c); - } + } else if (c->type == CHAN_AGENT) { + sshfwd_close(c); + } } else if (pktin.type == SSH2_MSG_CHANNEL_CLOSE) { unsigned i = ssh2_pkt_getuint32(); struct ssh_channel *c; @@ -3314,6 +3598,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) break; /* nothing to see here, move along */ case CHAN_X11: break; + case CHAN_AGENT: + break; } del234(ssh_channels, c); sfree(c->v2.outbuffer); @@ -3358,6 +3644,14 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } else { c->type = CHAN_X11; } + } else if (typelen == 22 && + !memcmp(type, "auth-agent@openssh.com", 3)) { + if (!ssh_agentfwd_enabled) + error = "Agent forwarding is not enabled"; + else { + c->type = CHAN_AGENT; /* identify channel type */ + c->u.a.lensofar = 0; + } } else { error = "Unsupported channel type requested"; }