X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/2c94fd1cbf32093be173ea6c4378caa109f73dd4..ff89646a8828ce862d53b96a19ee6469dabce71a:/ssh.c diff --git a/ssh.c b/ssh.c index 3845264c..f48d1426 100644 --- a/ssh.c +++ b/ssh.c @@ -17,10 +17,11 @@ #define logevent(s) { logevent(s); \ if ((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)) \ - fprintf(stderr, "%s\n", s); } + { fprintf(stderr, "%s\n", s); fflush(stderr); } } -#define bombout(msg) ( ssh_state = SSH_STATE_CLOSED, sk_close(s), \ - s = NULL, connection_fatal msg ) +#define bombout(msg) ( ssh_state = SSH_STATE_CLOSED, \ + (s ? sk_close(s), s = NULL : 0), \ + connection_fatal msg ) #define SSH1_MSG_DISCONNECT 1 /* 0x1 */ #define SSH1_SMSG_PUBLIC_KEY 2 /* 0x2 */ @@ -67,14 +68,9 @@ #define SSH1_AUTH_TIS 5 /* 0x5 */ #define SSH1_AUTH_CCARD 16 /* 0x10 */ -#define SSH_AGENTC_REQUEST_RSA_IDENTITIES 1 /* 0x1 */ -#define SSH_AGENT_RSA_IDENTITIES_ANSWER 2 /* 0x2 */ -#define SSH_AGENTC_RSA_CHALLENGE 3 /* 0x3 */ -#define SSH_AGENT_RSA_RESPONSE 4 /* 0x4 */ -#define SSH_AGENT_FAILURE 5 /* 0x5 */ -#define SSH_AGENT_SUCCESS 6 /* 0x6 */ -#define SSH_AGENTC_ADD_RSA_IDENTITY 7 /* 0x7 */ -#define SSH_AGENTC_REMOVE_RSA_IDENTITY 8 /* 0x8 */ +#define SSH1_PROTOFLAG_SCREEN_NUMBER 1 /* 0x1 */ +/* Mask for protoflags we will echo back to server if seen */ +#define SSH1_PROTOFLAGS_SUPPORTED 0 /* 0x1 */ #define SSH2_MSG_DISCONNECT 1 /* 0x1 */ #define SSH2_MSG_IGNORE 2 /* 0x2 */ @@ -86,6 +82,10 @@ #define SSH2_MSG_NEWKEYS 21 /* 0x15 */ #define SSH2_MSG_KEXDH_INIT 30 /* 0x1e */ #define SSH2_MSG_KEXDH_REPLY 31 /* 0x1f */ +#define SSH2_MSG_KEX_DH_GEX_REQUEST 30 /* 0x1e */ +#define SSH2_MSG_KEX_DH_GEX_GROUP 31 /* 0x1f */ +#define SSH2_MSG_KEX_DH_GEX_INIT 32 /* 0x20 */ +#define SSH2_MSG_KEX_DH_GEX_REPLY 33 /* 0x21 */ #define SSH2_MSG_USERAUTH_REQUEST 50 /* 0x32 */ #define SSH2_MSG_USERAUTH_FAILURE 51 /* 0x33 */ #define SSH2_MSG_USERAUTH_SUCCESS 52 /* 0x34 */ @@ -118,6 +118,29 @@ #define SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9 /* 0x9 */ #define SSH2_DISCONNECT_CONNECTION_LOST 10 /* 0xa */ #define SSH2_DISCONNECT_BY_APPLICATION 11 /* 0xb */ +#define SSH2_DISCONNECT_TOO_MANY_CONNECTIONS 12 /* 0xc */ +#define SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER 13 /* 0xd */ +#define SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14 /* 0xe */ +#define SSH2_DISCONNECT_ILLEGAL_USER_NAME 15 /* 0xf */ + +static const char *const ssh2_disconnect_reasons[] = { + NULL, + "SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT", + "SSH_DISCONNECT_PROTOCOL_ERROR", + "SSH_DISCONNECT_KEY_EXCHANGE_FAILED", + "SSH_DISCONNECT_HOST_AUTHENTICATION_FAILED", + "SSH_DISCONNECT_MAC_ERROR", + "SSH_DISCONNECT_COMPRESSION_ERROR", + "SSH_DISCONNECT_SERVICE_NOT_AVAILABLE", + "SSH_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED", + "SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE", + "SSH_DISCONNECT_CONNECTION_LOST", + "SSH_DISCONNECT_BY_APPLICATION", + "SSH_DISCONNECT_TOO_MANY_CONNECTIONS", + "SSH_DISCONNECT_AUTH_CANCELLED_BY_USER", + "SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE", + "SSH_DISCONNECT_ILLEGAL_USER_NAME", +}; #define SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED 1 /* 0x1 */ #define SSH2_OPEN_CONNECT_FAILED 2 /* 0x2 */ @@ -126,6 +149,12 @@ #define SSH2_EXTENDED_DATA_STDERR 1 /* 0x1 */ +/* + * Various remote-bug flags. + */ +#define BUG_CHOKES_ON_SSH1_IGNORE 1 +#define BUG_SSH2_HMAC 2 + #define GET_32BIT(cp) \ (((unsigned long)(unsigned char)(cp)[0] << 24) | \ ((unsigned long)(unsigned char)(cp)[1] << 16) | \ @@ -159,12 +188,6 @@ enum { PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM }; #define crWaitUntil(c) do { crReturn(0); } while (!(c)) #define crWaitUntilV(c) do { crReturnV; } while (!(c)) -extern const struct ssh_cipher ssh_3des; -extern const struct ssh_cipher ssh_3des_ssh2; -extern const struct ssh_cipher ssh_des; -extern const struct ssh_cipher ssh_blowfish_ssh1; -extern const struct ssh_cipher ssh_blowfish_ssh2; - extern char *x11_init (Socket *, char *, void *); extern void x11_close (Socket); extern void x11_send (Socket , char *, int); @@ -176,15 +199,17 @@ extern void x11_invent_auth(char *, int, char *, int); * SSH1. (3DES uses outer chaining; Blowfish has the opposite * endianness and different-sized keys.) */ -const static struct ssh_cipher *ciphers[] = { &ssh_blowfish_ssh2, &ssh_3des_ssh2 }; - -extern const struct ssh_kex ssh_diffiehellman; -const static struct ssh_kex *kex_algs[] = { &ssh_diffiehellman }; +const static struct ssh2_ciphers *ciphers[] = { + &ssh2_aes, + &ssh2_blowfish, + &ssh2_3des, +}; -extern const struct ssh_signkey ssh_dss; -const static struct ssh_signkey *hostkey_algs[] = { &ssh_dss }; +const static struct ssh_kex *kex_algs[] = { + &ssh_diffiehellman_gex, + &ssh_diffiehellman }; -extern const struct ssh_mac ssh_md5, ssh_sha1, ssh_sha1_buggy; +const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss }; static void nullmac_key(unsigned char *key) { } static void nullmac_generate(unsigned char *blk, int len, unsigned long seq) { } @@ -202,10 +227,12 @@ static int ssh_comp_none_block(unsigned char *block, int len, unsigned char **outblock, int *outlen) { return 0; } +static int ssh_comp_none_disable(void) { return 0; } const static struct ssh_compress ssh_comp_none = { "none", ssh_comp_none_init, ssh_comp_none_block, - ssh_comp_none_init, ssh_comp_none_block + ssh_comp_none_init, ssh_comp_none_block, + ssh_comp_none_disable }; extern const struct ssh_compress ssh_zlib; const static struct ssh_compress *compressions[] = { @@ -256,22 +283,28 @@ static Socket s = NULL; static unsigned char session_key[32]; static int ssh1_compressing; +static int ssh1_remote_protoflags; +static int ssh1_local_protoflags; static int ssh_agentfwd_enabled; static int ssh_X11_fwd_enabled; +static int ssh_remote_bugs; static const struct ssh_cipher *cipher = NULL; -static const struct ssh_cipher *cscipher = NULL; -static const struct ssh_cipher *sccipher = NULL; +static const struct ssh2_cipher *cscipher = NULL; +static const struct ssh2_cipher *sccipher = NULL; static const struct ssh_mac *csmac = NULL; static const struct ssh_mac *scmac = NULL; static const struct ssh_compress *cscomp = NULL; static const struct ssh_compress *sccomp = NULL; static const struct ssh_kex *kex = NULL; static const struct ssh_signkey *hostkey = NULL; -int (*ssh_get_password)(const char *prompt, char *str, int maxlen) = NULL; +static unsigned char ssh2_session_id[20]; +int (*ssh_get_line)(const char *prompt, char *str, int maxlen, + int is_pw) = NULL; static char *savedhost; static int savedport; static int ssh_send_ok; +static int ssh_echoing, ssh_editing; static tree234 *ssh_channels; /* indexed by local id */ static struct ssh_channel *mainchan; /* primary session channel */ @@ -288,6 +321,8 @@ static int size_needed = FALSE, eof_needed = FALSE; static struct Packet pktin = { 0, 0, NULL, NULL, 0 }; static struct Packet pktout = { 0, 0, NULL, NULL, 0 }; +static unsigned char *deferred_send_data = NULL; +static int deferred_len = 0, deferred_size = 0; static int ssh_version; static void (*ssh_protocol)(unsigned char *in, int inlen, int ispkt); @@ -330,6 +365,42 @@ static int ssh_channelfind(void *av, void *bv) { return 0; } +static int alloc_channel_id(void) { + const unsigned CHANNEL_NUMBER_OFFSET = 256; + unsigned low, high, mid; + int tsize; + struct ssh_channel *c; + + /* + * First-fit allocation of channel numbers: always pick the + * lowest unused one. To do this, binary-search using the + * counted B-tree to find the largest channel ID which is in a + * contiguous sequence from the beginning. (Precisely + * everything in that sequence must have ID equal to its tree + * index plus CHANNEL_NUMBER_OFFSET.) + */ + tsize = count234(ssh_channels); + + low = -1; high = tsize; + while (high - low > 1) { + mid = (high + low) / 2; + c = index234(ssh_channels, mid); + if (c->localid == mid + CHANNEL_NUMBER_OFFSET) + low = mid; /* this one is fine */ + else + high = mid; /* this one is past it */ + } + /* + * Now low points to either -1, or the tree index of the + * largest ID in the initial sequence. + */ + { + unsigned i = low + 1 + CHANNEL_NUMBER_OFFSET; + assert(NULL == find234(ssh_channels, &i, ssh_channelfind)); + } + return low + 1 + CHANNEL_NUMBER_OFFSET; +} + static void c_write (char *buf, int len) { if ((flags & FLAG_STDERR)) { int i; @@ -341,6 +412,20 @@ static void c_write (char *buf, int len) { from_backend(1, buf, len); } +static void c_write_untrusted(char *buf, int len) { + int i; + for (i = 0; i < len; i++) { + if (buf[i] == '\n') + c_write("\r\n", 2); + else if ((buf[i] & 0x60) || (buf[i] == '\r')) + c_write(buf+i, 1); + } +} + +static void c_write_str (char *buf) { + c_write(buf, strlen(buf)); +} + /* * Collect incoming data in the incoming packet buffer. * Decipher and verify the packet when it is completely read. @@ -422,11 +507,13 @@ next_packet: unsigned char *decompblk; int decomplen; #if 0 - int i; - debug(("Packet payload pre-decompression:\n")); - for (i = -1; i < pktin.length; i++) - debug((" %02x", (unsigned char)pktin.body[i])); - debug(("\r\n")); + { + int i; + debug(("Packet payload pre-decompression:\n")); + for (i = -1; i < pktin.length; i++) + debug((" %02x", (unsigned char)pktin.body[i])); + debug(("\r\n")); + } #endif zlib_decompress_block(pktin.body-1, pktin.length+1, &decompblk, &decomplen); @@ -443,10 +530,13 @@ next_packet: sfree(decompblk); pktin.length = decomplen-1; #if 0 - debug(("Packet payload post-decompression:\n")); - for (i = -1; i < pktin.length; i++) - debug((" %02x", (unsigned char)pktin.body[i])); - debug(("\r\n")); + { + int i; + debug(("Packet payload post-decompression:\n")); + for (i = -1; i < pktin.length; i++) + debug((" %02x", (unsigned char)pktin.body[i])); + debug(("\r\n")); + } #endif } @@ -479,6 +569,20 @@ next_packet: goto next_packet; } + if (pktin.type == SSH1_MSG_DISCONNECT) { + /* log reason code in disconnect message */ + char buf[256]; + unsigned msglen = GET_32BIT(pktin.body); + unsigned nowlen; + strcpy(buf, "Remote sent disconnect: "); + nowlen = strlen(buf); + if (msglen > sizeof(buf)-nowlen-1) + msglen = sizeof(buf)-nowlen-1; + memcpy(buf+nowlen, pktin.body+4, msglen); + buf[nowlen+msglen] = '\0'; + logevent(buf); + } + crFinish(0); } @@ -618,6 +722,28 @@ next_packet: if (pktin.type == SSH2_MSG_IGNORE || pktin.type == SSH2_MSG_DEBUG) goto next_packet; /* FIXME: print DEBUG message */ + if (pktin.type == SSH2_MSG_DISCONNECT) { + /* log reason code in disconnect message */ + char buf[256]; + int reason = GET_32BIT(pktin.data+6); + unsigned msglen = GET_32BIT(pktin.data+10); + unsigned nowlen; + if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) { + sprintf(buf, "Received disconnect message (%s)", + ssh2_disconnect_reasons[reason]); + } else { + sprintf(buf, "Received disconnect message (unknown type %d)", reason); + } + logevent(buf); + strcpy(buf, "Disconnection message text: "); + nowlen = strlen(buf); + if (msglen > sizeof(buf)-nowlen-1) + msglen = sizeof(buf)-nowlen-1; + memcpy(buf+nowlen, pktin.data+14, msglen); + buf[nowlen+msglen] = '\0'; + logevent(buf); + } + crFinish(0); } @@ -651,21 +777,22 @@ static void s_wrpkt_start(int type, int len) { pktout.type = type; } -static void s_wrpkt(void) { +static int s_wrpkt_prepare(void) { int pad, len, biglen, i; unsigned long crc; pktout.body[-1] = pktout.type; +#if 0 + debug(("Packet payload pre-compression:\n")); + for (i = -1; i < pktout.length; i++) + debug((" %02x", (unsigned char)pktout.body[i])); + debug(("\r\n")); +#endif + if (ssh1_compressing) { unsigned char *compblk; int complen; -#if 0 - debug(("Packet payload pre-compression:\n")); - for (i = -1; i < pktout.length; i++) - debug((" %02x", (unsigned char)pktout.body[i])); - debug(("\r\n")); -#endif zlib_compress_block(pktout.body-1, pktout.length+1, &compblk, &complen); ssh1_pktout_size(complen-1); @@ -698,93 +825,118 @@ static void s_wrpkt(void) { if (cipher) cipher->encrypt(pktout.data+4, biglen); - sk_write(s, pktout.data, biglen+4); + return biglen+4; +} + +static void s_wrpkt(void) { + int len; + len = s_wrpkt_prepare(); + sk_write(s, pktout.data, len); +} + +static void s_wrpkt_defer(void) { + int len; + len = s_wrpkt_prepare(); + if (deferred_len + len > deferred_size) { + deferred_size = deferred_len + len + 128; + deferred_send_data = srealloc(deferred_send_data, deferred_size); + } + memcpy(deferred_send_data+deferred_len, pktout.data, len); + deferred_len += len; } /* - * Construct a packet with the specified contents and - * send it to the server. + * Construct a packet with the specified contents. */ -static void send_packet(int pkttype, ...) +static void construct_packet(int pkttype, va_list ap1, va_list ap2) { - va_list args; unsigned char *p, *argp, argchar; unsigned long argint; int pktlen, argtype, arglen; Bignum bn; pktlen = 0; - va_start(args, pkttype); - while ((argtype = va_arg(args, int)) != PKT_END) { + while ((argtype = va_arg(ap1, int)) != PKT_END) { switch (argtype) { case PKT_INT: - (void) va_arg(args, int); + (void) va_arg(ap1, int); pktlen += 4; break; case PKT_CHAR: - (void) va_arg(args, char); + (void) va_arg(ap1, char); pktlen++; break; case PKT_DATA: - (void) va_arg(args, unsigned char *); - arglen = va_arg(args, int); + (void) va_arg(ap1, unsigned char *); + arglen = va_arg(ap1, int); pktlen += arglen; break; case PKT_STR: - argp = va_arg(args, unsigned char *); + argp = va_arg(ap1, unsigned char *); arglen = strlen(argp); pktlen += 4 + arglen; break; case PKT_BIGNUM: - bn = va_arg(args, Bignum); + bn = va_arg(ap1, Bignum); pktlen += ssh1_bignum_length(bn); break; default: assert(0); } } - va_end(args); s_wrpkt_start(pkttype, pktlen); p = pktout.body; - va_start(args, pkttype); - while ((argtype = va_arg(args, int)) != PKT_END) { + while ((argtype = va_arg(ap2, int)) != PKT_END) { switch (argtype) { case PKT_INT: - argint = va_arg(args, int); + argint = va_arg(ap2, int); PUT_32BIT(p, argint); p += 4; break; case PKT_CHAR: - argchar = va_arg(args, unsigned char); + argchar = va_arg(ap2, unsigned char); *p = argchar; p++; break; case PKT_DATA: - argp = va_arg(args, unsigned char *); - arglen = va_arg(args, int); + argp = va_arg(ap2, unsigned char *); + arglen = va_arg(ap2, int); memcpy(p, argp, arglen); p += arglen; break; case PKT_STR: - argp = va_arg(args, unsigned char *); + argp = va_arg(ap2, unsigned char *); arglen = strlen(argp); PUT_32BIT(p, arglen); memcpy(p + 4, argp, arglen); p += 4 + arglen; break; case PKT_BIGNUM: - bn = va_arg(args, Bignum); + bn = va_arg(ap2, Bignum); p += ssh1_write_bignum(p, bn); break; } } - va_end(args); +} +static void send_packet(int pkttype, ...) { + va_list ap1, ap2; + va_start(ap1, pkttype); + va_start(ap2, pkttype); + construct_packet(pkttype, ap1, ap2); s_wrpkt(); } +static void defer_packet(int pkttype, ...) { + va_list ap1, ap2; + va_start(ap1, pkttype); + va_start(ap2, pkttype); + construct_packet(pkttype, ap1, ap2); + s_wrpkt_defer(); +} + static int ssh_versioncmp(char *a, char *b) { char *ae, *be; unsigned long av, bv; @@ -802,8 +954,8 @@ static int ssh_versioncmp(char *a, char *b) { /* - * Utility routine for putting an SSH-protocol `string' into a SHA - * state. + * Utility routines for putting an SSH-protocol `string' and + * `uint32' into a SHA state. */ #include static void sha_string(SHA_State *s, void *str, int len) { @@ -813,6 +965,12 @@ static void sha_string(SHA_State *s, void *str, int len) { SHA_Bytes(s, str, len); } +static void sha_uint32(SHA_State *s, unsigned i) { + unsigned char intblk[4]; + PUT_32BIT(intblk, i); + SHA_Bytes(s, intblk, 4); +} + /* * SSH2 packet construction functions. */ @@ -865,20 +1023,18 @@ static void ssh2_pkt_addstring(char *data) { } static char *ssh2_mpint_fmt(Bignum b, int *len) { unsigned char *p; - int i, n = b[0]; - p = smalloc(n * 2 + 1); + int i, n = (bignum_bitcount(b)+7)/8; + p = smalloc(n + 1); if (!p) fatalbox("out of memory"); p[0] = 0; - for (i = 0; i < n; i++) { - p[i*2+1] = (b[n-i] >> 8) & 0xFF; - p[i*2+2] = (b[n-i] ) & 0xFF; - } + for (i = 1; i <= n; i++) + p[i] = bignum_byte(b, n-i); i = 0; - while (p[i] == 0 && (p[i+1] & 0x80) == 0) + while (i <= n && p[i] == 0 && (p[i+1] & 0x80) == 0) i++; - memmove(p, p+i, n*2+1-i); - *len = n*2+1-i; + memmove(p, p+i, n+1-i); + *len = n+1-i; return p; } static void ssh2_pkt_addmp(Bignum b) { @@ -889,7 +1045,13 @@ static void ssh2_pkt_addmp(Bignum b) { ssh2_pkt_addstring_data(p, len); sfree(p); } -static void ssh2_pkt_send(void) { + +/* + * Construct an SSH2 final-form packet: compress it, encrypt it, + * put the MAC on it. Final packet, ready to be sent, is stored in + * pktout.data. Total length is returned. + */ +static int ssh2_pkt_construct(void) { int cipherblk, maclen, padding, i; static unsigned long outgoing_sequence = 0; @@ -917,7 +1079,7 @@ static void ssh2_pkt_send(void) { * Add padding. At least four bytes, and must also bring total * length (minus MAC) up to a multiple of the block size. */ - cipherblk = cipher ? cipher->blksize : 8; /* block size */ + cipherblk = cscipher ? cscipher->blksize : 8; /* block size */ cipherblk = cipherblk < 8 ? 8 : cipherblk; /* or 8 if blksize < 8 */ padding = 4; padding += (cipherblk - (pktout.length + padding) % cipherblk) % cipherblk; @@ -942,7 +1104,48 @@ static void ssh2_pkt_send(void) { if (cscipher) cscipher->encrypt(pktout.data, pktout.length + padding); - sk_write(s, pktout.data, pktout.length + padding + maclen); + /* Ready-to-send packet starts at pktout.data. We return length. */ + return pktout.length + padding + maclen; +} + +/* + * Construct and send an SSH2 packet immediately. + */ +static void ssh2_pkt_send(void) { + int len = ssh2_pkt_construct(); + sk_write(s, pktout.data, len); +} + +/* + * Construct an SSH2 packet and add it to a deferred data block. + * Useful for sending multiple packets in a single sk_write() call, + * to prevent a traffic-analysing listener from being able to work + * out the length of any particular packet (such as the password + * packet). + * + * Note that because SSH2 sequence-numbers its packets, this can + * NOT be used as an m4-style `defer' allowing packets to be + * constructed in one order and sent in another. + */ +static void ssh2_pkt_defer(void) { + int len = ssh2_pkt_construct(); + if (deferred_len + len > deferred_size) { + deferred_size = deferred_len + len + 128; + deferred_send_data = srealloc(deferred_send_data, deferred_size); + } + memcpy(deferred_send_data+deferred_len, pktout.data, len); + deferred_len += len; +} + +/* + * Send the whole deferred data block constructed by + * ssh2_pkt_defer() or SSH1's defer_packet(). + */ +static void ssh_pkt_defersend(void) { + sk_write(s, deferred_send_data, deferred_len); + deferred_len = deferred_size = 0; + sfree(deferred_send_data); + deferred_send_data = NULL; } #if 0 @@ -977,6 +1180,14 @@ static unsigned long ssh2_pkt_getuint32(void) { pktin.savedpos += 4; return value; } +static int ssh2_pkt_getbool(void) { + unsigned long value; + if (pktin.length - pktin.savedpos < 1) + return 0; /* arrgh, no way to decline (FIXME?) */ + value = pktin.data[pktin.savedpos] != 0; + pktin.savedpos++; + return value; +} static void ssh2_pkt_getstring(char **p, int *length) { *p = NULL; if (pktin.length - pktin.savedpos < 4) @@ -990,7 +1201,7 @@ static void ssh2_pkt_getstring(char **p, int *length) { } static Bignum ssh2_pkt_getmp(void) { char *p; - int i, j, length; + int length; Bignum b; ssh2_pkt_getstring(&p, &length); @@ -1000,23 +1211,53 @@ static Bignum ssh2_pkt_getmp(void) { bombout(("internal error: Can't handle negative mpints")); return NULL; } - b = newbn((length+1)/2); - for (i = 0; i < length; i++) { - j = length - 1 - i; - if (j & 1) - b[j/2+1] |= ((unsigned char)p[i]) << 8; - else - b[j/2+1] |= ((unsigned char)p[i]); - } - while (b[0] > 1 && b[b[0]] == 0) b[0]--; + b = bignum_from_bytes(p, length); return b; } +/* + * Examine the remote side's version string and compare it against + * a list of known buggy implementations. + */ +static void ssh_detect_bugs(char *vstring) { + char *imp; /* pointer to implementation part */ + imp = vstring; + imp += strcspn(imp, "-"); + if (*imp) imp++; + imp += strcspn(imp, "-"); + if (*imp) imp++; + + ssh_remote_bugs = 0; + + if (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") || + !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") || + !strcmp(imp, "1.2.22")) { + /* + * These versions don't support SSH1_MSG_IGNORE, so we have + * to use a different defence against password length + * sniffing. + */ + ssh_remote_bugs |= BUG_CHOKES_ON_SSH1_IGNORE; + logevent("We believe remote version has SSH1 ignore bug"); + } + + if (!strncmp(imp, "2.1.0", 5) || !strncmp(imp, "2.0.", 4) || + !strncmp(imp, "2.2.0", 5) || !strncmp(imp, "2.3.0", 5) || + !strncmp(imp, "2.1 ", 4)) { + /* + * These versions have the HMAC bug. + */ + ssh_remote_bugs |= BUG_SSH2_HMAC; + logevent("We believe remote version has SSH2 HMAC bug"); + } +} + static int do_ssh_init(unsigned char c) { - static char *vsp; + static char vslen; static char version[10]; - static char vstring[80]; - static char vlog[sizeof(vstring)+20]; + static char *vstring; + static int vstrsize; + static char *vlog; static int i; crBegin; @@ -1036,13 +1277,18 @@ static int do_ssh_init(unsigned char c) { crReturn(1); /* get another character */ } + vstring = smalloc(16); + vstrsize = 16; strcpy(vstring, "SSH-"); - vsp = vstring+4; + vslen = 4; i = 0; while (1) { crReturn(1); /* get another char */ - if (vsp < vstring+sizeof(vstring)-1) - *vsp++ = c; + if (vslen >= vstrsize-1) { + vstrsize += 16; + vstring = srealloc(vstring, vstrsize); + } + vstring[vslen++] = c; if (i >= 0) { if (c == '-') { version[i] = '\0'; @@ -1057,10 +1303,13 @@ static int do_ssh_init(unsigned char c) { ssh_agentfwd_enabled = FALSE; rdpkt2_state.incoming_sequence = 0; - *vsp = 0; + vstring[vslen] = 0; + vlog = smalloc(20 + vslen); sprintf(vlog, "Server version: %s", vstring); + ssh_detect_bugs(vstring); vlog[strcspn(vlog, "\r\n")] = '\0'; logevent(vlog); + sfree(vlog); /* * Server version "1.99" means we can choose whether we use v1 @@ -1070,18 +1319,19 @@ static int do_ssh_init(unsigned char c) { /* * This is a v2 server. Begin v2 protocol. */ - char *verstring = "SSH-2.0-PuTTY"; + char verstring[80], vlog[100]; + sprintf(verstring, "SSH-2.0-%s", sshver); SHA_Init(&exhashbase); /* * Hash our version string and their version string. */ sha_string(&exhashbase, verstring, strlen(verstring)); sha_string(&exhashbase, vstring, strcspn(vstring, "\r\n")); - sprintf(vstring, "%s\n", verstring); sprintf(vlog, "We claim version: %s", verstring); logevent(vlog); + strcat(verstring, "\n"); logevent("Using SSH protocol version 2"); - sk_write(s, vstring, strlen(vstring)); + sk_write(s, verstring, strlen(verstring)); ssh_protocol = ssh2_protocol; ssh_version = 2; s_rdpkt = ssh2_rdpkt; @@ -1089,19 +1339,23 @@ static int do_ssh_init(unsigned char c) { /* * This is a v1 server. Begin v1 protocol. */ - sprintf(vstring, "SSH-%s-PuTTY\n", - (ssh_versioncmp(version, "1.5") <= 0 ? version : "1.5")); - sprintf(vlog, "We claim version: %s", vstring); - vlog[strcspn(vlog, "\r\n")] = '\0'; + char verstring[80], vlog[100]; + sprintf(verstring, "SSH-%s-%s", + (ssh_versioncmp(version, "1.5") <= 0 ? version : "1.5"), + sshver); + sprintf(vlog, "We claim version: %s", verstring); logevent(vlog); + strcat(verstring, "\n"); logevent("Using SSH protocol version 1"); - sk_write(s, vstring, strlen(vstring)); + sk_write(s, verstring, strlen(verstring)); ssh_protocol = ssh1_protocol; ssh_version = 1; s_rdpkt = ssh1_rdpkt; } ssh_state = SSH_STATE_BEFORE_SIZE; + sfree(vstring); + crFinish(0); } @@ -1147,19 +1401,20 @@ static void ssh_gotdata(unsigned char *data, int datalen) crFinishV; } -static int ssh_receive(Socket skt, int urgent, char *data, int len) { - if (urgent==3) { +static int ssh_closing (Plug plug, char *error_msg, int error_code, int calling_back) { + ssh_state = SSH_STATE_CLOSED; + sk_close(s); + s = NULL; + if (error_msg) { /* A socket error has occurred. */ - connection_fatal(data); - len = 0; - } - if (!len) { - /* Connection has closed. */ - ssh_state = SSH_STATE_CLOSED; - sk_close(s); - s = NULL; - return 0; + connection_fatal (error_msg); + } else { + /* Otherwise, the remote side closed the connection normally. */ } + return 0; +} + +static int ssh_receive(Plug plug, int urgent, char *data, int len) { ssh_gotdata (data, len); if (ssh_state == SSH_STATE_CLOSED) { if (s) { @@ -1178,6 +1433,11 @@ static int ssh_receive(Socket skt, int urgent, char *data, int len) { */ static char *connect_to_host(char *host, int port, char **realhost) { + static struct plug_function_table fn_table = { + ssh_closing, + ssh_receive + }, *fn_table_ptr = &fn_table; + SockAddr addr; char *err; #ifdef FWHACK @@ -1215,7 +1475,7 @@ static char *connect_to_host(char *host, int port, char **realhost) /* * Open socket. */ - s = sk_new(addr, port, 0, ssh_receive); + s = sk_new(addr, port, 0, 1, &fn_table_ptr); if ( (err = sk_socket_error(s)) ) return err; @@ -1277,9 +1537,13 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) logevent(logmsg); } + ssh1_remote_protoflags = GET_32BIT(pktin.body+8+i+j); supported_ciphers_mask = GET_32BIT(pktin.body+12+i+j); supported_auths_mask = GET_32BIT(pktin.body+16+i+j); + ssh1_local_protoflags = ssh1_remote_protoflags & SSH1_PROTOFLAGS_SUPPORTED; + ssh1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER; + MD5Init(&md5c); MD5Update(&md5c, keystr2, hostkey.bytes); MD5Update(&md5c, keystr1, servkey.bytes); @@ -1329,12 +1593,23 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) logevent("Encrypted session key"); - cipher_type = cfg.cipher == CIPHER_BLOWFISH ? SSH_CIPHER_BLOWFISH : - cfg.cipher == CIPHER_DES ? SSH_CIPHER_DES : - SSH_CIPHER_3DES; + switch (cfg.cipher) { + case CIPHER_BLOWFISH: cipher_type = SSH_CIPHER_BLOWFISH; break; + case CIPHER_DES: cipher_type = SSH_CIPHER_DES; break; + case CIPHER_3DES: cipher_type = SSH_CIPHER_3DES; break; + case CIPHER_AES: + c_write_str("AES not supported in SSH1, falling back to 3DES\r\n"); + cipher_type = SSH_CIPHER_3DES; + break; + } if ((supported_ciphers_mask & (1 << cipher_type)) == 0) { - c_write("Selected cipher not supported, falling back to 3DES\r\n", 53); + c_write_str("Selected cipher not supported, falling back to 3DES\r\n"); cipher_type = SSH_CIPHER_3DES; + if ((supported_ciphers_mask & (1 << cipher_type)) == 0) { + bombout(("Server violates SSH 1 protocol by " + "not supporting 3DES encryption")); + crReturn(0); + } } switch (cipher_type) { case SSH_CIPHER_3DES: logevent("Using 3DES encryption"); break; @@ -1347,7 +1622,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) PKT_DATA, cookie, 8, PKT_CHAR, (len*8) >> 8, PKT_CHAR, (len*8) & 0xFF, PKT_DATA, rsabuf, len, - PKT_INT, 0, + PKT_INT, ssh1_local_protoflags, PKT_END); logevent("Trying to enable encryption..."); @@ -1373,43 +1648,56 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) static int pos = 0; static char c; if ((flags & FLAG_INTERACTIVE) && !*cfg.username) { - c_write("login as: ", 10); - ssh_send_ok = 1; - while (pos >= 0) { - crWaitUntil(!ispkt); - while (inlen--) switch (c = *in++) { - case 10: case 13: - username[pos] = 0; - pos = -1; - break; - case 8: case 127: - if (pos > 0) { - c_write("\b \b", 3); - pos--; - } - break; - case 21: case 27: - while (pos > 0) { - c_write("\b \b", 3); - pos--; - } - break; - case 3: case 4: - random_save_seed(); - exit(0); - break; - default: - if (((c >= ' ' && c <= '~') || - ((unsigned char)c >= 160)) && pos < 40) { - username[pos++] = c; - c_write(&c, 1); - } - break; - } - } - c_write("\r\n", 2); - username[strcspn(username, "\n\r")] = '\0'; - } else { + if (ssh_get_line) { + if (!ssh_get_line("login as: ", + username, sizeof(username), FALSE)) { + /* + * get_line failed to get a username. + * Terminate. + */ + logevent("No username provided. Abandoning session."); + ssh_state = SSH_STATE_CLOSED; + crReturn(1); + } + } else { + c_write_str("login as: "); + ssh_send_ok = 1; + while (pos >= 0) { + crWaitUntil(!ispkt); + while (inlen--) switch (c = *in++) { + case 10: case 13: + username[pos] = 0; + pos = -1; + break; + case 8: case 127: + if (pos > 0) { + c_write_str("\b \b"); + pos--; + } + break; + case 21: case 27: + while (pos > 0) { + c_write_str("\b \b"); + pos--; + } + break; + case 3: case 4: + random_save_seed(); + exit(0); + break; + default: + if (((c >= ' ' && c <= '~') || + ((unsigned char)c >= 160)) && pos < 40) { + username[pos++] = c; + c_write(&c, 1); + } + break; + } + } + c_write_str("\r\n"); + username[strcspn(username, "\n\r")] = '\0'; + } + } else { strncpy(username, cfg.username, 99); username[99] = '\0'; } @@ -1422,7 +1710,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) if (flags & FLAG_INTERACTIVE && (!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) { strcat(userlog, "\r\n"); - c_write(userlog, strlen(userlog)); + c_write_str(userlog); } } } @@ -1457,13 +1745,14 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) /* Request the keys held by the agent. */ PUT_32BIT(request, 1); - request[4] = SSH_AGENTC_REQUEST_RSA_IDENTITIES; + request[4] = SSH1_AGENTC_REQUEST_RSA_IDENTITIES; agent_query(request, 5, &r, &responselen); response = (unsigned char *)r; - if (response) { + if (response && responselen >= 5 && + response[4] == SSH1_AGENT_RSA_IDENTITIES_ANSWER) { p = response + 5; nkeys = GET_32BIT(p); p += 4; - { char buf[64]; sprintf(buf, "Pageant has %d keys", nkeys); + { char buf[64]; sprintf(buf, "Pageant has %d SSH1 keys", nkeys); logevent(buf); } for (i = 0; i < nkeys; i++) { static struct RSAKey key; @@ -1499,8 +1788,8 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) agentreq = smalloc(4 + len); PUT_32BIT(agentreq, len); q = agentreq + 4; - *q++ = SSH_AGENTC_RSA_CHALLENGE; - PUT_32BIT(q, ssh1_bignum_bitcount(key.modulus)); + *q++ = SSH1_AGENTC_RSA_CHALLENGE; + PUT_32BIT(q, bignum_bitcount(key.modulus)); q += 4; q += ssh1_write_bignum(q, key.exponent); q += ssh1_write_bignum(q, key.modulus); @@ -1510,7 +1799,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) agent_query(agentreq, len+4, &ret, &retlen); sfree(agentreq); if (ret) { - if (ret[4] == SSH_AGENT_RSA_RESPONSE) { + if (ret[4] == SSH1_AGENT_RSA_RESPONSE) { logevent("Sending Pageant's response"); send_packet(SSH1_CMSG_AUTH_RSA_RESPONSE, PKT_DATA, ret+5, 16, PKT_END); @@ -1519,10 +1808,9 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) if (pktin.type == SSH1_SMSG_SUCCESS) { logevent("Pageant's response accepted"); if (flags & FLAG_VERBOSE) { - c_write("Authenticated using RSA key \"", - 29); + c_write_str("Authenticated using RSA key \""); c_write(commentp, commentlen); - c_write("\" from agent\r\n", 14); + c_write_str("\" from agent\r\n"); } authed = TRUE; } else @@ -1558,7 +1846,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) if (pktin.type != SSH1_SMSG_AUTH_TIS_CHALLENGE) { logevent("TIS authentication declined"); if (flags & FLAG_INTERACTIVE) - c_write("TIS authentication refused.\r\n", 29); + c_write_str("TIS authentication refused.\r\n"); } else { int challengelen = ((pktin.body[0] << 24) | (pktin.body[1] << 16) | @@ -1580,7 +1868,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) crWaitUntil(ispkt); if (pktin.type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) { logevent("CryptoCard authentication declined"); - c_write("CryptoCard authentication refused.\r\n", 29); + c_write_str("CryptoCard authentication refused.\r\n"); } else { int challengelen = ((pktin.body[0] << 24) | (pktin.body[1] << 16) | @@ -1602,30 +1890,29 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) if (pwpkt_type == SSH1_CMSG_AUTH_RSA) { char *comment = NULL; if (flags & FLAG_VERBOSE) - c_write("Trying public key authentication.\r\n", 35); + c_write_str("Trying public key authentication.\r\n"); if (!rsakey_encrypted(cfg.keyfile, &comment)) { if (flags & FLAG_VERBOSE) - c_write("No passphrase required.\r\n", 25); + c_write_str("No passphrase required.\r\n"); goto tryauth; } sprintf(prompt, "Passphrase for key \"%.100s\": ", comment); sfree(comment); } - if (ssh_get_password) { - if (!ssh_get_password(prompt, password, sizeof(password))) { + if (ssh_get_line) { + if (!ssh_get_line(prompt, password, sizeof(password), TRUE)) { /* - * get_password failed to get a password (for - * example because one was supplied on the command - * line which has already failed to work). - * Terminate. + * get_line failed to get a password (for example + * because one was supplied on the command line + * which has already failed to work). Terminate. */ logevent("No more passwords to try"); ssh_state = SSH_STATE_CLOSED; crReturn(1); } } else { - c_write(prompt, strlen(prompt)); + c_write_str(prompt); pos = 0; ssh_send_ok = 1; while (pos >= 0) { @@ -1653,7 +1940,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) break; } } - c_write("\r\n", 2); + c_write_str("\r\n"); } tryauth: @@ -1668,15 +1955,15 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) static unsigned char buffer[32]; tried_publickey = 1; - i = loadrsakey(cfg.keyfile, &pubkey, NULL, password); + i = loadrsakey(cfg.keyfile, &pubkey, password); if (i == 0) { - c_write("Couldn't load public key from ", 30); - c_write(cfg.keyfile, strlen(cfg.keyfile)); - c_write(".\r\n", 3); + c_write_str("Couldn't load public key from "); + c_write_str(cfg.keyfile); + c_write_str(".\r\n"); continue; /* go and try password */ } if (i == -1) { - c_write("Wrong passphrase.\r\n", 19); + c_write_str("Wrong passphrase.\r\n"); tried_publickey = 0; continue; /* try again */ } @@ -1689,7 +1976,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) crWaitUntil(ispkt); if (pktin.type == SSH1_SMSG_FAILURE) { - c_write("Server refused our public key.\r\n", 32); + c_write_str("Server refused our public key.\r\n"); continue; /* go and try password */ } if (pktin.type != SSH1_SMSG_AUTH_RSA_CHALLENGE) { @@ -1700,9 +1987,8 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) response = rsadecrypt(challenge, &pubkey); freebn(pubkey.private_exponent); /* burn the evidence */ - for (i = 0; i < 32; i += 2) { - buffer[i] = response[16-i/2] >> 8; - buffer[i+1] = response[16-i/2] & 0xFF; + for (i = 0; i < 32; i++) { + buffer[i] = bignum_byte(response, 31-i); } MD5Init(&md5c); @@ -1716,8 +2002,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) crWaitUntil(ispkt); if (pktin.type == SSH1_SMSG_FAILURE) { if (flags & FLAG_VERBOSE) - c_write("Failed to authenticate with our public key.\r\n", - 45); + c_write_str("Failed to authenticate with our public key.\r\n"); continue; /* go and try password */ } else if (pktin.type != SSH1_SMSG_SUCCESS) { bombout(("Bizarre response to RSA authentication response")); @@ -1726,14 +2011,101 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) break; /* we're through! */ } else { - send_packet(pwpkt_type, PKT_STR, password, PKT_END); + if (pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) { + /* + * Defence against traffic analysis: we send a + * whole bunch of packets containing strings of + * different lengths. One of these strings is the + * password, in a SSH1_CMSG_AUTH_PASSWORD packet. + * The others are all random data in + * SSH1_MSG_IGNORE packets. This way a passive + * listener can't tell which is the password, and + * hence can't deduce the password length. + * + * Anybody with a password length greater than 16 + * bytes is going to have enough entropy in their + * password that a listener won't find it _that_ + * much help to know how long it is. So what we'll + * do is: + * + * - if password length < 16, we send 15 packets + * containing string lengths 1 through 15 + * + * - otherwise, we let N be the nearest multiple + * of 8 below the password length, and send 8 + * packets containing string lengths N through + * N+7. This won't obscure the order of + * magnitude of the password length, but it will + * introduce a bit of extra uncertainty. + * + * A few servers (the old 1.2.18 through 1.2.22) + * can't deal with SSH1_MSG_IGNORE. For these + * servers, we need an alternative defence. We make + * use of the fact that the password is interpreted + * as a C string: so we can append a NUL, then some + * random data. + */ + if (ssh_remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE) { + char string[64]; + char *s; + int len; + + len = strlen(password); + if (len < sizeof(string)) { + s = string; + strcpy(string, password); + len++; /* cover the zero byte */ + while (len < sizeof(string)) { + string[len++] = (char)random_byte(); + } + } else { + s = password; + } + send_packet(pwpkt_type, PKT_INT, len, + PKT_DATA, s, len, PKT_END); + } else { + int bottom, top, pwlen, i; + char *randomstr; + + pwlen = strlen(password); + if (pwlen < 16) { + bottom = 0; /* zero length passwords are OK! :-) */ + top = 15; + } else { + bottom = pwlen &~ 7; + top = bottom + 7; + } + + assert(pwlen >= bottom && pwlen <= top); + + randomstr = smalloc(top+1); + + for (i = bottom; i <= top; i++) { + if (i == pwlen) + defer_packet(pwpkt_type, PKT_STR, password, PKT_END); + else { + for (j = 0; j < i; j++) { + do { + randomstr[j] = random_byte(); + } while (randomstr[j] == '\0'); + } + randomstr[i] = '\0'; + defer_packet(SSH1_MSG_IGNORE, + PKT_STR, randomstr, PKT_END); + } + } + ssh_pkt_defersend(); + } + } else { + send_packet(pwpkt_type, PKT_STR, password, PKT_END); + } } logevent("Sent password"); memset(password, 0, strlen(password)); crWaitUntil(ispkt); if (pktin.type == SSH1_SMSG_FAILURE) { if (flags & FLAG_VERBOSE) - c_write("Access denied\r\n", 15); + c_write_str("Access denied\r\n"); logevent("Authentication refused"); } else if (pktin.type == SSH1_MSG_DISCONNECT) { logevent("Received disconnect request"); @@ -1751,7 +2123,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) } void sshfwd_close(struct ssh_channel *c) { - if (c) { + if (c && !c->closes) { if (ssh_version == 1) { send_packet(SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid, PKT_END); } else { @@ -1810,10 +2182,16 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { char proto[20], data[64]; logevent("Requesting X11 forwarding"); x11_invent_auth(proto, sizeof(proto), data, sizeof(data)); - send_packet(SSH1_CMSG_X11_REQUEST_FORWARDING, - PKT_STR, proto, PKT_STR, data, - PKT_INT, 0, - PKT_END); + if (ssh1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) { + send_packet(SSH1_CMSG_X11_REQUEST_FORWARDING, + PKT_STR, proto, PKT_STR, data, + PKT_INT, 0, + PKT_END); + } else { + send_packet(SSH1_CMSG_X11_REQUEST_FORWARDING, + PKT_STR, proto, PKT_STR, data, + PKT_END); + } do { crReturnV; } while (!ispkt); if (pktin.type != SSH1_SMSG_SUCCESS && pktin.type != SSH1_SMSG_FAILURE) { bombout(("Protocol confusion")); @@ -1839,9 +2217,12 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { bombout(("Protocol confusion")); crReturnV; } else if (pktin.type == SSH1_SMSG_FAILURE) { - c_write("Server refused to allocate pty\r\n", 32); + c_write_str("Server refused to allocate pty\r\n"); + ssh_editing = ssh_echoing = 1; } logevent("Allocated pty"); + } else { + ssh_editing = ssh_echoing = 1; } if (cfg.compression) { @@ -1851,7 +2232,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { bombout(("Protocol confusion")); crReturnV; } else if (pktin.type == SSH1_SMSG_FAILURE) { - c_write("Server refused to compress\r\n", 32); + c_write_str("Server refused to compress\r\n"); } logevent("Started compression"); ssh1_compressing = TRUE; @@ -1859,8 +2240,8 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { zlib_decompress_init(); } - if (*cfg.remote_cmd) - send_packet(SSH1_CMSG_EXEC_CMD, PKT_STR, cfg.remote_cmd, PKT_END); + if (*cfg.remote_cmd_ptr) + send_packet(SSH1_CMSG_EXEC_CMD, PKT_STR, cfg.remote_cmd_ptr, PKT_END); else send_packet(SSH1_CMSG_EXEC_SHELL, PKT_END); logevent("Started session"); @@ -1871,9 +2252,9 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { if (eof_needed) ssh_special(TS_EOF); + ldisc_send(NULL, 0); /* cause ldisc to notice changes */ ssh_send_ok = 1; ssh_channels = newtree234(ssh_channelcmp); - begin_session(); while (1) { crReturnV; if (ispkt) { @@ -1889,9 +2270,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { } else if (pktin.type == SSH1_SMSG_X11_OPEN) { /* Remote side is trying to open a channel to talk to our * X-Server. Give them back a local channel number. */ - unsigned i; - struct ssh_channel *c, *d; - enum234 e; + struct ssh_channel *c; logevent("Received X11 connect request"); /* Refuse if X11 forwarding is disabled. */ @@ -1911,13 +2290,8 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { PKT_END); } else { logevent("opening X11 forward connection succeeded"); - for (i=1, d = first234(ssh_channels, &e); d; d = next234(&e)) { - if (d->localid > i) - break; /* found a free number */ - i = d->localid + 1; - } c->remoteid = GET_32BIT(pktin.body); - c->localid = i; + c->localid = alloc_channel_id(); c->closes = 0; c->type = CHAN_X11; /* identify channel type */ add234(ssh_channels, c); @@ -1930,9 +2304,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { } else if (pktin.type == SSH1_SMSG_AGENT_OPEN) { /* Remote side is trying to open a channel to talk to our * agent. Give them back a local channel number. */ - unsigned i; struct ssh_channel *c; - enum234 e; /* Refuse if agent forwarding is disabled. */ if (!ssh_agentfwd_enabled) { @@ -1940,15 +2312,9 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { PKT_INT, GET_32BIT(pktin.body), PKT_END); } else { - i = 1; - for (c = first234(ssh_channels, &e); c; c = next234(&e)) { - if (c->localid > i) - break; /* found a free number */ - i = c->localid + 1; - } c = smalloc(sizeof(struct ssh_channel)); c->remoteid = GET_32BIT(pktin.body); - c->localid = i; + c->localid = alloc_channel_id(); c->closes = 0; c->type = CHAN_AGENT; /* identify channel type */ c->u.a.lensofar = 0; @@ -1966,7 +2332,8 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) { if (c) { int closetype; closetype = (pktin.type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2); - send_packet(pktin.type, PKT_INT, c->remoteid, PKT_END); + if (!(c->closes & closetype)) + send_packet(pktin.type, PKT_INT, c->remoteid, PKT_END); if ((c->closes == 0) && (c->type == CHAN_X11)) { logevent("X11 connection closed"); assert(c->u.x11.s != NULL); @@ -2090,14 +2457,14 @@ static int in_commasep_string(char *needle, char *haystack, int haylen) { /* * SSH2 key creation method. */ -static void ssh2_mkkey(Bignum K, char *H, char chr, char *keyspace) { +static void ssh2_mkkey(Bignum K, char *H, char *sessid, char chr, char *keyspace) { SHA_State s; /* First 20 bytes. */ SHA_Init(&s); sha_mpint(&s, K); SHA_Bytes(&s, H, 20); SHA_Bytes(&s, &chr, 1); - SHA_Bytes(&s, H, 20); + SHA_Bytes(&s, sessid, 20); SHA_Final(&s, keyspace); /* Next 20 bytes. */ SHA_Init(&s); @@ -2112,13 +2479,14 @@ static void ssh2_mkkey(Bignum K, char *H, char chr, char *keyspace) { */ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) { - static int i, len; + static int i, j, len, nbits, pbits; static char *str; - static Bignum e, f, K; + static Bignum p, g, e, f, K; + static int kex_init_value, kex_reply_value; static const struct ssh_mac **maclist; static int nmacs; - static const struct ssh_cipher *cscipher_tobe = NULL; - static const struct ssh_cipher *sccipher_tobe = NULL; + static const struct ssh2_cipher *cscipher_tobe = NULL; + static const struct ssh2_cipher *sccipher_tobe = NULL; static const struct ssh_mac *csmac_tobe = NULL; static const struct ssh_mac *scmac_tobe = NULL; static const struct ssh_compress *cscomp_tobe = NULL; @@ -2128,7 +2496,7 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) static void *hkey; /* actual host key */ static unsigned char exchange_hash[20]; static unsigned char keyspace[40]; - static const struct ssh_cipher *preferred_cipher; + static const struct ssh2_ciphers *preferred_cipher; static const struct ssh_compress *preferred_comp; static int first_kex; @@ -2140,15 +2508,17 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) * Set up the preferred cipher and compression. */ if (cfg.cipher == CIPHER_BLOWFISH) { - preferred_cipher = &ssh_blowfish_ssh2; + preferred_cipher = &ssh2_blowfish; } else if (cfg.cipher == CIPHER_DES) { logevent("Single DES not supported in SSH2; using 3DES"); - preferred_cipher = &ssh_3des_ssh2; + preferred_cipher = &ssh2_3des; } else if (cfg.cipher == CIPHER_3DES) { - preferred_cipher = &ssh_3des_ssh2; + preferred_cipher = &ssh2_3des; + } else if (cfg.cipher == CIPHER_AES) { + preferred_cipher = &ssh2_aes; } else { /* Shouldn't happen, but we do want to initialise to _something_. */ - preferred_cipher = &ssh_3des_ssh2; + preferred_cipher = &ssh2_3des; } if (cfg.compression) preferred_comp = &ssh_zlib; @@ -2158,7 +2528,7 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) /* * Be prepared to work around the buggy MAC problem. */ - if (cfg.buggymac) + if (cfg.buggymac || (ssh_remote_bugs & BUG_SSH2_HMAC)) maclist = buggymacs, nmacs = lenof(buggymacs); else maclist = macs, nmacs = lenof(macs); @@ -2187,18 +2557,22 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) /* List client->server encryption algorithms. */ ssh2_pkt_addstring_start(); for (i = 0; i < lenof(ciphers)+1; i++) { - const struct ssh_cipher *c = i==0 ? preferred_cipher : ciphers[i-1]; - ssh2_pkt_addstring_str(c->name); - if (i < lenof(ciphers)) - ssh2_pkt_addstring_str(","); + const struct ssh2_ciphers *c = i==0 ? preferred_cipher : ciphers[i-1]; + for (j = 0; j < c->nciphers; j++) { + ssh2_pkt_addstring_str(c->list[j]->name); + if (i < lenof(ciphers) || j < c->nciphers-1) + ssh2_pkt_addstring_str(","); + } } /* List server->client encryption algorithms. */ ssh2_pkt_addstring_start(); for (i = 0; i < lenof(ciphers)+1; i++) { - const struct ssh_cipher *c = i==0 ? preferred_cipher : ciphers[i-1]; - ssh2_pkt_addstring_str(c->name); - if (i < lenof(ciphers)) - ssh2_pkt_addstring_str(","); + const struct ssh2_ciphers *c = i==0 ? preferred_cipher : ciphers[i-1]; + for (j = 0; j < c->nciphers; j++) { + ssh2_pkt_addstring_str(c->list[j]->name); + if (i < lenof(ciphers) || j < c->nciphers-1) + ssh2_pkt_addstring_str(","); + } } /* List client->server MAC algorithms. */ ssh2_pkt_addstring_start(); @@ -2274,19 +2648,27 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) } ssh2_pkt_getstring(&str, &len); /* client->server cipher */ for (i = 0; i < lenof(ciphers)+1; i++) { - const struct ssh_cipher *c = i==0 ? preferred_cipher : ciphers[i-1]; - if (in_commasep_string(c->name, str, len)) { - cscipher_tobe = c; - break; + const struct ssh2_ciphers *c = i==0 ? preferred_cipher : ciphers[i-1]; + for (j = 0; j < c->nciphers; j++) { + if (in_commasep_string(c->list[j]->name, str, len)) { + cscipher_tobe = c->list[j]; + break; + } } + if (cscipher_tobe) + break; } ssh2_pkt_getstring(&str, &len); /* server->client cipher */ for (i = 0; i < lenof(ciphers)+1; i++) { - const struct ssh_cipher *c = i==0 ? preferred_cipher : ciphers[i-1]; - if (in_commasep_string(c->name, str, len)) { - sccipher_tobe = c; - break; + const struct ssh2_ciphers *c = i==0 ? preferred_cipher : ciphers[i-1]; + for (j = 0; j < c->nciphers; j++) { + if (in_commasep_string(c->list[j]->name, str, len)) { + sccipher_tobe = c->list[j]; + break; + } } + if (sccipher_tobe) + break; } ssh2_pkt_getstring(&str, &len); /* client->server mac */ for (i = 0; i < nmacs; i++) { @@ -2320,25 +2702,64 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) } /* - * Currently we only support Diffie-Hellman and DSS, so let's - * bomb out if those aren't selected. + * Work out the number of bits of key we will need from the key + * exchange. We start with the maximum key length of either + * cipher... */ - if (kex != &ssh_diffiehellman || hostkey != &ssh_dss) { - bombout(("internal fault: chaos in SSH 2 transport layer")); - crReturn(0); + { + int csbits, scbits; + + csbits = cscipher_tobe->keylen; + scbits = sccipher_tobe->keylen; + nbits = (csbits > scbits ? csbits : scbits); + } + /* The keys only have 160-bit entropy, since they're based on + * a SHA-1 hash. So cap the key size at 160 bits. */ + if (nbits > 160) nbits = 160; + + /* + * If we're doing Diffie-Hellman group exchange, start by + * requesting a group. + */ + if (kex == &ssh_diffiehellman_gex) { + logevent("Doing Diffie-Hellman group exchange"); + /* + * Work out how big a DH group we will need to allow that + * much data. + */ + pbits = 512 << ((nbits-1) / 64); + ssh2_pkt_init(SSH2_MSG_KEX_DH_GEX_REQUEST); + ssh2_pkt_adduint32(pbits); + ssh2_pkt_send(); + + crWaitUntil(ispkt); + if (pktin.type != SSH2_MSG_KEX_DH_GEX_GROUP) { + bombout(("expected key exchange group packet from server")); + crReturn(0); + } + p = ssh2_pkt_getmp(); + g = ssh2_pkt_getmp(); + dh_setup_group(p, g); + kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT; + kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY; + } else { + dh_setup_group1(); + kex_init_value = SSH2_MSG_KEXDH_INIT; + kex_reply_value = SSH2_MSG_KEXDH_REPLY; } + logevent("Doing Diffie-Hellman key exchange"); /* - * Now we begin the fun. Generate and send e for Diffie-Hellman. + * Now generate and send e for Diffie-Hellman. */ - e = dh_create_e(); - ssh2_pkt_init(SSH2_MSG_KEXDH_INIT); + e = dh_create_e(nbits*2); + ssh2_pkt_init(kex_init_value); ssh2_pkt_addmp(e); ssh2_pkt_send(); crWaitUntil(ispkt); - if (pktin.type != SSH2_MSG_KEXDH_REPLY) { - bombout(("expected key exchange packet from server")); + if (pktin.type != kex_reply_value) { + bombout(("expected key exchange reply packet from server")); crReturn(0); } ssh2_pkt_getstring(&hostkeydata, &hostkeylen); @@ -2348,11 +2769,18 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) K = dh_find_K(f); sha_string(&exhash, hostkeydata, hostkeylen); + if (kex == &ssh_diffiehellman_gex) { + sha_uint32(&exhash, pbits); + sha_mpint(&exhash, p); + sha_mpint(&exhash, g); + } sha_mpint(&exhash, e); sha_mpint(&exhash, f); sha_mpint(&exhash, K); SHA_Final(&exhash, exchange_hash); + dh_cleanup(); + #if 0 debug(("Exchange hash is:\r\n")); for (i = 0; i < 20; i++) @@ -2383,8 +2811,10 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) fingerprint = hostkey->fingerprint(hkey); verify_ssh_host_key(savedhost, savedport, hostkey->keytype, keystr, fingerprint); - logevent("Host key fingerprint is:"); - logevent(fingerprint); + if (first_kex) { /* don't bother logging this in rekeys */ + logevent("Host key fingerprint is:"); + logevent(fingerprint); + } sfree(fingerprint); sfree(keystr); hostkey->freekey(hkey); @@ -2407,14 +2837,23 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) cscomp->compress_init(); sccomp->decompress_init(); /* - * Set IVs after keys. + * Set IVs after keys. Here we use the exchange hash from the + * _first_ key exchange. */ - ssh2_mkkey(K, exchange_hash, 'C', keyspace); cscipher->setcskey(keyspace); - ssh2_mkkey(K, exchange_hash, 'D', keyspace); sccipher->setsckey(keyspace); - ssh2_mkkey(K, exchange_hash, 'A', keyspace); cscipher->setcsiv(keyspace); - ssh2_mkkey(K, exchange_hash, 'B', keyspace); sccipher->setsciv(keyspace); - ssh2_mkkey(K, exchange_hash, 'E', keyspace); csmac->setcskey(keyspace); - ssh2_mkkey(K, exchange_hash, 'F', keyspace); scmac->setsckey(keyspace); + if (first_kex) + memcpy(ssh2_session_id, exchange_hash, sizeof(exchange_hash)); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'C', keyspace); + cscipher->setcskey(keyspace); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'D', keyspace); + sccipher->setsckey(keyspace); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'A', keyspace); + cscipher->setcsiv(keyspace); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'B', keyspace); + sccipher->setsciv(keyspace); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'E', keyspace); + csmac->setcskey(keyspace); + ssh2_mkkey(K, exchange_hash, ssh2_session_id, 'F', keyspace); + scmac->setsckey(keyspace); /* * If this is the first key exchange phase, we must pass the @@ -2435,9 +2874,10 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) * transport. If we ever see a KEXINIT, we must go back to the * start. */ - do { + while (!(ispkt && pktin.type == SSH2_MSG_KEXINIT)) { crReturn(1); - } while (!(ispkt && pktin.type == SSH2_MSG_KEXINIT)); + } + logevent("Server initiated key re-exchange"); goto begin_key_exchange; crFinish(1); @@ -2489,6 +2929,22 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) { static unsigned long remote_winsize; static unsigned long remote_maxpkt; + static enum { + AUTH_INVALID, AUTH_PUBLICKEY_AGENT, AUTH_PUBLICKEY_FILE, AUTH_PASSWORD + } method; + static enum { + AUTH_TYPE_NONE, + AUTH_TYPE_PUBLICKEY, + AUTH_TYPE_PUBLICKEY_OFFER_LOUD, + AUTH_TYPE_PUBLICKEY_OFFER_QUIET, + AUTH_TYPE_PASSWORD + } type; + static int gotit, need_pw, can_pubkey, can_passwd; + static int tried_pubkey_config, tried_agent; + static int we_are_in; + static char username[100]; + static char pwprompt[200]; + static char password[100]; crBegin; @@ -2505,128 +2961,568 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } /* - * FIXME: currently we support only password authentication. - * (This places us technically in violation of the SSH2 spec. - * We must fix this.) + * We repeat this whole loop, including the username prompt, + * until we manage a successful authentication. If the user + * types the wrong _password_, they are sent back to the + * beginning to try another username. (If they specify a + * username in the config, they are never asked, even if they + * do give a wrong password.) + * + * I think this best serves the needs of + * + * - the people who have no configuration, no keys, and just + * want to try repeated (username,password) pairs until they + * type both correctly + * + * - people who have keys and configuration but occasionally + * need to fall back to passwords + * + * - people with a key held in Pageant, who might not have + * logged in to a particular machine before; so they want to + * type a username, and then _either_ their key will be + * accepted, _or_ they will type a password. If they mistype + * the username they will want to be able to get back and + * retype it! */ - while (1) { - /* - * Get a username and a password. - */ - static char username[100]; - static char password[100]; - static int pos = 0; + do { + static int pos; static char c; + /* + * Get a username. + */ + pos = 0; if ((flags & FLAG_INTERACTIVE) && !*cfg.username) { - c_write("login as: ", 10); - ssh_send_ok = 1; - while (pos >= 0) { - crWaitUntilV(!ispkt); - while (inlen--) switch (c = *in++) { - case 10: case 13: - username[pos] = 0; - pos = -1; - break; - case 8: case 127: - if (pos > 0) { - c_write("\b \b", 3); - pos--; - } - break; - case 21: case 27: - while (pos > 0) { - c_write("\b \b", 3); - pos--; - } - break; - case 3: case 4: - random_save_seed(); - exit(0); - break; - default: - if (((c >= ' ' && c <= '~') || - ((unsigned char)c >= 160)) && pos < 40) { - username[pos++] = c; - c_write(&c, 1); - } - break; - } - } - c_write("\r\n", 2); + if (ssh_get_line) { + if (!ssh_get_line("login as: ", + username, sizeof(username), FALSE)) { + /* + * get_line failed to get a username. + * Terminate. + */ + logevent("No username provided. Abandoning session."); + ssh_state = SSH_STATE_CLOSED; + crReturnV; + } + } else { + c_write_str("login as: "); + ssh_send_ok = 1; + while (pos >= 0) { + crWaitUntilV(!ispkt); + while (inlen--) switch (c = *in++) { + case 10: case 13: + username[pos] = 0; + pos = -1; + break; + case 8: case 127: + if (pos > 0) { + c_write_str("\b \b"); + pos--; + } + break; + case 21: case 27: + while (pos > 0) { + c_write_str("\b \b"); + pos--; + } + break; + case 3: case 4: + random_save_seed(); + exit(0); + break; + default: + if (((c >= ' ' && c <= '~') || + ((unsigned char)c >= 160)) && pos < 40) { + username[pos++] = c; + c_write(&c, 1); + } + break; + } + } + } + c_write_str("\r\n"); username[strcspn(username, "\n\r")] = '\0'; } else { char stuff[200]; strncpy(username, cfg.username, 99); username[99] = '\0'; - if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) { + if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) { sprintf(stuff, "Using username \"%s\".\r\n", username); - c_write(stuff, strlen(stuff)); + c_write_str(stuff); } } - if (ssh_get_password) { - char prompt[200]; - sprintf(prompt, "%.90s@%.90s's password: ", username, savedhost); - if (!ssh_get_password(prompt, password, sizeof(password))) { + /* + * Send an authentication request using method "none": (a) + * just in case it succeeds, and (b) so that we know what + * authentication methods we can usefully try next. + */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("none"); /* method */ + ssh2_pkt_send(); + type = AUTH_TYPE_NONE; + gotit = FALSE; + we_are_in = FALSE; + + tried_pubkey_config = FALSE; + tried_agent = FALSE; + + while (1) { + /* + * Wait for the result of the last authentication request. + */ + if (!gotit) + crWaitUntilV(ispkt); + while (pktin.type == SSH2_MSG_USERAUTH_BANNER) { + char *banner; + int size; /* - * get_password failed to get a password (for - * example because one was supplied on the command - * line which has already failed to work). - * Terminate. + * Don't show the banner if we're operating in + * non-verbose non-interactive mode. (It's probably + * a script, which means nobody will read the + * banner _anyway_, and moreover the printing of + * the banner will screw up processing on the + * output of (say) plink.) */ - logevent("No more passwords to try"); - ssh_state = SSH_STATE_CLOSED; - crReturnV; - } - } else { - c_write("password: ", 10); - ssh_send_ok = 1; - - pos = 0; - while (pos >= 0) { - crWaitUntilV(!ispkt); - while (inlen--) switch (c = *in++) { - case 10: case 13: - password[pos] = 0; - pos = -1; - break; - case 8: case 127: - if (pos > 0) - pos--; - break; - case 21: case 27: - pos = 0; - break; - case 3: case 4: - random_save_seed(); - exit(0); - break; - default: - if (((c >= ' ' && c <= '~') || - ((unsigned char)c >= 160)) && pos < 40) - password[pos++] = c; - break; + if (flags & (FLAG_VERBOSE | FLAG_INTERACTIVE)) { + ssh2_pkt_getstring(&banner, &size); + if (banner) + c_write_untrusted(banner, size); } - } - c_write("\r\n", 2); - } + crWaitUntilV(ispkt); + } + if (pktin.type == SSH2_MSG_USERAUTH_SUCCESS) { + logevent("Access granted"); + we_are_in = TRUE; + break; + } - ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); - ssh2_pkt_addstring(username); - ssh2_pkt_addstring("ssh-connection"); /* service requested */ - ssh2_pkt_addstring("password"); - ssh2_pkt_addbool(FALSE); - ssh2_pkt_addstring(password); - ssh2_pkt_send(); + if (pktin.type != SSH2_MSG_USERAUTH_FAILURE) { + bombout(("Strange packet received during authentication: type %d", + pktin.type)); + crReturnV; + } - crWaitUntilV(ispkt); - if (pktin.type != SSH2_MSG_USERAUTH_SUCCESS) { - c_write("Access denied\r\n", 15); - logevent("Authentication refused"); - } else - break; - } + gotit = FALSE; + + /* + * OK, we're now sitting on a USERAUTH_FAILURE message, so + * we can look at the string in it and know what we can + * helpfully try next. + */ + { + char *methods; + int methlen; + ssh2_pkt_getstring(&methods, &methlen); + if (!ssh2_pkt_getbool()) { + /* + * We have received an unequivocal Access + * Denied. This can translate to a variety of + * messages: + * + * - if we'd just tried "none" authentication, + * it's not worth printing anything at all + * + * - if we'd just tried a public key _offer_, + * the message should be "Server refused our + * key" (or no message at all if the key + * came from Pageant) + * + * - if we'd just tried anything else, the + * message really should be "Access denied". + * + * Additionally, if we'd just tried password + * authentication, we should break out of this + * whole loop so as to go back to the username + * prompt. + */ + if (type == AUTH_TYPE_NONE) { + /* do nothing */ + } else if (type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD || + type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) { + if (type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD) + c_write_str("Server refused our key\r\n"); + logevent("Server refused public key"); + } else { + c_write_str("Access denied\r\n"); + logevent("Access denied"); + if (type == AUTH_TYPE_PASSWORD) { + we_are_in = FALSE; + break; + } + } + } else { + c_write_str("Further authentication required\r\n"); + logevent("Further authentication required"); + } + + can_pubkey = in_commasep_string("publickey", methods, methlen); + can_passwd = in_commasep_string("password", methods, methlen); + } + + method = 0; + + if (!method && can_pubkey && agent_exists() && !tried_agent) { + /* + * Attempt public-key authentication using Pageant. + */ + static unsigned char request[5], *response, *p; + static int responselen; + static int i, nkeys; + static int authed = FALSE; + void *r; + + tried_agent = TRUE; + + logevent("Pageant is running. Requesting keys."); + + /* Request the keys held by the agent. */ + PUT_32BIT(request, 1); + request[4] = SSH2_AGENTC_REQUEST_IDENTITIES; + agent_query(request, 5, &r, &responselen); + response = (unsigned char *)r; + if (response && responselen >= 5 && + response[4] == SSH2_AGENT_IDENTITIES_ANSWER) { + p = response + 5; + nkeys = GET_32BIT(p); p += 4; + { char buf[64]; sprintf(buf, "Pageant has %d SSH2 keys", nkeys); + logevent(buf); } + for (i = 0; i < nkeys; i++) { + static char *pkblob, *alg, *commentp; + static int pklen, alglen, commentlen; + static int siglen, retlen, len; + static char *q, *agentreq, *ret; + + { char buf[64]; sprintf(buf, "Trying Pageant key #%d", i); + logevent(buf); } + pklen = GET_32BIT(p); p += 4; + pkblob = p; p += pklen; + alglen = GET_32BIT(pkblob); + alg = pkblob + 4; + commentlen = GET_32BIT(p); p += 4; + commentp = p; p += commentlen; + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection");/* service requested */ + ssh2_pkt_addstring("publickey");/* method */ + ssh2_pkt_addbool(FALSE); /* no signature included */ + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(alg, alglen); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(pkblob, pklen); + ssh2_pkt_send(); + + crWaitUntilV(ispkt); + if (pktin.type != SSH2_MSG_USERAUTH_PK_OK) { + logevent("Key refused"); + continue; + } + + if (flags & FLAG_VERBOSE) { + c_write_str("Authenticating with public key \""); + c_write(commentp, commentlen); + c_write_str("\" from agent\r\n"); + } + + /* + * Server is willing to accept the key. + * Construct a SIGN_REQUEST. + */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("publickey"); /* method */ + ssh2_pkt_addbool(TRUE); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(alg, alglen); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(pkblob, pklen); + + siglen = pktout.length - 5 + 4 + 20; + len = 1; /* message type */ + len += 4 + pklen; /* key blob */ + len += 4 + siglen; /* data to sign */ + len += 4; /* flags */ + agentreq = smalloc(4 + len); + PUT_32BIT(agentreq, len); + q = agentreq + 4; + *q++ = SSH2_AGENTC_SIGN_REQUEST; + PUT_32BIT(q, pklen); q += 4; + memcpy(q, pkblob, pklen); q += pklen; + PUT_32BIT(q, siglen); q += 4; + /* Now the data to be signed... */ + PUT_32BIT(q, 20); q += 4; + memcpy(q, ssh2_session_id, 20); q += 20; + memcpy(q, pktout.data+5, pktout.length-5); + q += pktout.length-5; + /* And finally the (zero) flags word. */ + PUT_32BIT(q, 0); + agent_query(agentreq, len+4, &ret, &retlen); + sfree(agentreq); + if (ret) { + if (ret[4] == SSH2_AGENT_SIGN_RESPONSE) { + logevent("Sending Pageant's response"); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(ret+9, GET_32BIT(ret+5)); + ssh2_pkt_send(); + authed = TRUE; + break; + } else { + logevent("Pageant failed to answer challenge"); + sfree(ret); + } + } + } + if (authed) + continue; + } + } + + if (!method && can_pubkey && *cfg.keyfile && !tried_pubkey_config) { + unsigned char *pub_blob; + char *algorithm, *comment; + int pub_blob_len; + + tried_pubkey_config = TRUE; + + /* + * Try the public key supplied in the configuration. + * + * First, offer the public blob to see if the server is + * willing to accept it. + */ + pub_blob = ssh2_userkey_loadpub(cfg.keyfile, &algorithm, + &pub_blob_len); + if (pub_blob) { + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("publickey");/* method */ + ssh2_pkt_addbool(FALSE); /* no signature included */ + ssh2_pkt_addstring(algorithm); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(pub_blob, pub_blob_len); + ssh2_pkt_send(); + logevent("Offered public key"); /* FIXME */ + + crWaitUntilV(ispkt); + if (pktin.type != SSH2_MSG_USERAUTH_PK_OK) { + gotit = TRUE; + type = AUTH_TYPE_PUBLICKEY_OFFER_LOUD; + continue; /* key refused; give up on it */ + } + + logevent("Offer of public key accepted"); + /* + * Actually attempt a serious authentication using + * the key. + */ + if (ssh2_userkey_encrypted(cfg.keyfile, &comment)) { + sprintf(pwprompt, "Passphrase for key \"%.100s\": ", comment); + need_pw = TRUE; + } else { + need_pw = FALSE; + } + c_write_str("Authenticating with public key \""); + c_write_str(comment); + c_write_str("\"\r\n"); + method = AUTH_PUBLICKEY_FILE; + } + } + + if (!method && can_passwd) { + method = AUTH_PASSWORD; + sprintf(pwprompt, "%.90s@%.90s's password: ", username, savedhost); + need_pw = TRUE; + } + + if (need_pw) { + if (ssh_get_line) { + if (!ssh_get_line(pwprompt, password, + sizeof(password), TRUE)) { + /* + * get_line failed to get a password (for + * example because one was supplied on the + * command line which has already failed to + * work). Terminate. + */ + logevent("No more passwords to try"); + ssh_state = SSH_STATE_CLOSED; + crReturnV; + } + } else { + static int pos = 0; + static char c; + + c_write_str(pwprompt); + ssh_send_ok = 1; + + pos = 0; + while (pos >= 0) { + crWaitUntilV(!ispkt); + while (inlen--) switch (c = *in++) { + case 10: case 13: + password[pos] = 0; + pos = -1; + break; + case 8: case 127: + if (pos > 0) + pos--; + break; + case 21: case 27: + pos = 0; + break; + case 3: case 4: + random_save_seed(); + exit(0); + break; + default: + if (((c >= ' ' && c <= '~') || + ((unsigned char)c >= 160)) && pos < 40) + password[pos++] = c; + break; + } + } + c_write_str("\r\n"); + } + } + + if (method == AUTH_PUBLICKEY_FILE) { + /* + * We have our passphrase. Now try the actual authentication. + */ + struct ssh2_userkey *key; + + key = ssh2_load_userkey(cfg.keyfile, password); + if (key == SSH2_WRONG_PASSPHRASE || key == NULL) { + if (key == SSH2_WRONG_PASSPHRASE) { + c_write_str("Wrong passphrase\r\n"); + tried_pubkey_config = FALSE; + } else { + c_write_str("Unable to load private key\r\n"); + tried_pubkey_config = TRUE; + } + /* Send a spurious AUTH_NONE to return to the top. */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("none"); /* method */ + ssh2_pkt_send(); + type = AUTH_TYPE_NONE; + } else { + unsigned char *blob, *sigdata; + int blob_len, sigdata_len; + + /* + * We have loaded the private key and the server + * has announced that it's willing to accept it. + * Hallelujah. Generate a signature and send it. + */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("publickey"); /* method */ + ssh2_pkt_addbool(TRUE); + ssh2_pkt_addstring(key->alg->name); + blob = key->alg->public_blob(key->data, &blob_len); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(blob, blob_len); + sfree(blob); + + /* + * The data to be signed is: + * + * string session-id + * + * followed by everything so far placed in the + * outgoing packet. + */ + sigdata_len = pktout.length - 5 + 4 + 20; + sigdata = smalloc(sigdata_len); + PUT_32BIT(sigdata, 20); + memcpy(sigdata+4, ssh2_session_id, 20); + memcpy(sigdata+24, pktout.data+5, pktout.length-5); + blob = key->alg->sign(key->data, sigdata, sigdata_len, &blob_len); + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(blob, blob_len); + sfree(blob); + sfree(sigdata); + + ssh2_pkt_send(); + type = AUTH_TYPE_PUBLICKEY; + } + } else if (method == AUTH_PASSWORD) { + /* + * We send the password packet lumped tightly together with + * an SSH_MSG_IGNORE packet. The IGNORE packet contains a + * string long enough to make the total length of the two + * packets constant. This should ensure that a passive + * listener doing traffic analyis can't work out the length + * of the password. + * + * For this to work, we need an assumption about the + * maximum length of the password packet. I think 256 is + * pretty conservative. Anyone using a password longer than + * that probably doesn't have much to worry about from + * people who find out how long their password is! + */ + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("password"); + ssh2_pkt_addbool(FALSE); + ssh2_pkt_addstring(password); + ssh2_pkt_defer(); + /* + * We'll include a string that's an exact multiple of the + * cipher block size. If the cipher is NULL for some + * reason, we don't do this trick at all because we gain + * nothing by it. + */ + if (cscipher) { + int stringlen, i; + + stringlen = (256 - deferred_len); + stringlen += cscipher->blksize - 1; + stringlen -= (stringlen % cscipher->blksize); + if (cscomp) { + /* + * Temporarily disable actual compression, + * so we can guarantee to get this string + * exactly the length we want it. The + * compression-disabling routine should + * return an integer indicating how many + * bytes we should adjust our string length + * by. + */ + stringlen -= cscomp->disable_compression(); + } + ssh2_pkt_init(SSH2_MSG_IGNORE); + ssh2_pkt_addstring_start(); + for (i = 0; i < stringlen; i++) { + char c = (char)random_byte(); + ssh2_pkt_addstring_data(&c, 1); + } + ssh2_pkt_defer(); + } + ssh_pkt_defersend(); + logevent("Sent password"); + type = AUTH_TYPE_PASSWORD; + } else { + c_write_str("No supported authentication methods left to try!\r\n"); + logevent("No supported authentications offered. Disconnecting"); + ssh2_pkt_init(SSH2_MSG_DISCONNECT); + ssh2_pkt_adduint32(SSH2_DISCONNECT_BY_APPLICATION); + ssh2_pkt_addstring("No supported authentication methods available"); + ssh2_pkt_addstring("en"); /* language tag */ + ssh2_pkt_send(); + ssh_state = SSH_STATE_CLOSED; + crReturnV; + } + } + } while (!we_are_in); /* * Now we're authenticated for the connection protocol. The @@ -2637,8 +3533,9 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) /* * So now create a channel with a session in it. */ + ssh_channels = newtree234(ssh_channelcmp); mainchan = smalloc(sizeof(struct ssh_channel)); - mainchan->localid = 100; /* as good as any */ + mainchan->localid = alloc_channel_id(); ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN); ssh2_pkt_addstring("session"); ssh2_pkt_adduint32(mainchan->localid); @@ -2662,7 +3559,6 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) mainchan->v2.remmaxpkt = ssh2_pkt_getuint32(); mainchan->v2.outbuffer = NULL; mainchan->v2.outbuflen = mainchan->v2.outbufsize = 0; - ssh_channels = newtree234(ssh_channelcmp); add234(ssh_channels, mainchan); logevent("Opened channel for session"); @@ -2708,6 +3604,41 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } /* + * Potentially enable agent forwarding. + */ + if (cfg.agentfwd && agent_exists()) { + logevent("Requesting OpenSSH-style agent forwarding"); + ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST); + ssh2_pkt_adduint32(mainchan->remoteid); + ssh2_pkt_addstring("auth-agent-req@openssh.com"); + ssh2_pkt_addbool(1); /* want reply */ + ssh2_pkt_send(); + + do { + crWaitUntilV(ispkt); + if (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { + unsigned i = ssh2_pkt_getuint32(); + struct ssh_channel *c; + c = find234(ssh_channels, &i, ssh_channelfind); + if (!c) + continue; /* nonexistent channel */ + c->v2.remwindow += ssh2_pkt_getuint32(); + } + } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + + if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) { + if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) { + bombout(("Server got confused by agent forwarding request")); + crReturnV; + } + logevent("Agent forwarding refused"); + } else { + logevent("Agent forwarding enabled"); + ssh_agentfwd_enabled = TRUE; + } + } + + /* * Now allocate a pty for the session. */ if (!cfg.nopty) { @@ -2742,10 +3673,13 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) bombout(("Server got confused by pty request")); crReturnV; } - c_write("Server refused to allocate pty\r\n", 32); + c_write_str("Server refused to allocate pty\r\n"); + ssh_editing = ssh_echoing = 1; } else { logevent("Allocated pty"); } + } else { + ssh_editing = ssh_echoing = 1; } /* @@ -2753,10 +3687,14 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) */ ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST); ssh2_pkt_adduint32(mainchan->remoteid); /* recipient channel */ - if (*cfg.remote_cmd) { + if (cfg.ssh_subsys) { + ssh2_pkt_addstring("subsystem"); + ssh2_pkt_addbool(1); /* want reply */ + ssh2_pkt_addstring(cfg.remote_cmd_ptr); + } else if (*cfg.remote_cmd_ptr) { ssh2_pkt_addstring("exec"); ssh2_pkt_addbool(1); /* want reply */ - ssh2_pkt_addstring(cfg.remote_cmd); + ssh2_pkt_addstring(cfg.remote_cmd_ptr); } else { ssh2_pkt_addstring("shell"); ssh2_pkt_addbool(1); /* want reply */ @@ -2793,8 +3731,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) /* * Transfer data! */ + ldisc_send(NULL, 0); /* cause ldisc to notice changes */ ssh_send_ok = 1; - begin_session(); while (1) { static int try_send; crReturnV; @@ -2822,6 +3760,45 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) case CHAN_X11: x11_send(c->u.x11.s, data, length); break; + case CHAN_AGENT: + while (length > 0) { + if (c->u.a.lensofar < 4) { + int l = min(4 - c->u.a.lensofar, length); + memcpy(c->u.a.msglen + c->u.a.lensofar, data, l); + data += l; length -= l; c->u.a.lensofar += l; + } + if (c->u.a.lensofar == 4) { + c->u.a.totallen = 4 + GET_32BIT(c->u.a.msglen); + c->u.a.message = smalloc(c->u.a.totallen); + memcpy(c->u.a.message, c->u.a.msglen, 4); + } + if (c->u.a.lensofar >= 4 && length > 0) { + int l = min(c->u.a.totallen - c->u.a.lensofar, + length); + memcpy(c->u.a.message + c->u.a.lensofar, data, l); + data += l; length -= l; c->u.a.lensofar += l; + } + if (c->u.a.lensofar == c->u.a.totallen) { + void *reply, *sentreply; + int replylen; + agent_query(c->u.a.message, c->u.a.totallen, + &reply, &replylen); + if (reply) + sentreply = reply; + else { + /* Fake SSH_AGENT_FAILURE. */ + sentreply = "\0\0\0\1\5"; + replylen = 5; + } + ssh2_add_channel_data(c, sentreply, replylen); + try_send = TRUE; + if (reply) + sfree(reply); + sfree(c->u.a.message); + c->u.a.lensofar = 0; + } + } + break; } /* * Enlarge the window again at the remote @@ -2854,11 +3831,12 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) */ x11_close(c->u.x11.s); sshfwd_close(c); - } + } else if (c->type == CHAN_AGENT) { + sshfwd_close(c); + } } else if (pktin.type == SSH2_MSG_CHANNEL_CLOSE) { unsigned i = ssh2_pkt_getuint32(); struct ssh_channel *c; - enum234 e; c = find234(ssh_channels, &i, ssh_channelfind); if (!c) @@ -2874,6 +3852,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) break; /* nothing to see here, move along */ case CHAN_X11: break; + case CHAN_AGENT: + break; } del234(ssh_channels, c); sfree(c->v2.outbuffer); @@ -2882,8 +3862,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) /* * See if that was the last channel left open. */ - c = first234(ssh_channels, &e); - if (!c) { + if (count234(ssh_channels) == 0) { logevent("All channels closed. Disconnecting"); ssh2_pkt_init(SSH2_MSG_DISCONNECT); ssh2_pkt_adduint32(SSH2_DISCONNECT_BY_APPLICATION); @@ -2900,7 +3879,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) c = find234(ssh_channels, &i, ssh_channelfind); if (!c) continue; /* nonexistent channel */ - mainchan->v2.remwindow += ssh2_pkt_getuint32(); + c->v2.remwindow += ssh2_pkt_getuint32(); try_send = TRUE; } else if (pktin.type == SSH2_MSG_CHANNEL_OPEN) { char *type; @@ -2918,6 +3897,14 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } else { c->type = CHAN_X11; } + } else if (typelen == 22 && + !memcmp(type, "auth-agent@openssh.com", 3)) { + if (!ssh_agentfwd_enabled) + error = "Agent forwarding is not enabled"; + else { + c->type = CHAN_AGENT; /* identify channel type */ + c->u.a.lensofar = 0; + } } else { error = "Unsupported channel type requested"; } @@ -2932,17 +3919,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) ssh2_pkt_send(); sfree(c); } else { - struct ssh_channel *d; - unsigned i; - enum234 e; - - for (i=1, d = first234(ssh_channels, &e); d; - d = next234(&e)) { - if (d->localid > i) - break; /* found a free number */ - i = d->localid + 1; - } - c->localid = i; + c->localid = alloc_channel_id(); c->closes = 0; c->v2.remwindow = ssh2_pkt_getuint32(); c->v2.remmaxpkt = ssh2_pkt_getuint32(); @@ -2968,12 +3945,12 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) try_send = TRUE; } if (try_send) { - enum234 e; + int i; struct ssh_channel *c; /* * Try to send data on all channels if we can. */ - for (c = first234(ssh_channels, &e); c; c = next234(&e)) + for (i = 0; NULL != (c = index234(ssh_channels, i)); i++) ssh2_try_send(c); } } @@ -3005,6 +3982,8 @@ static char *ssh_init (char *host, int port, char **realhost) { #endif ssh_send_ok = 0; + ssh_editing = 0; + ssh_echoing = 0; p = connect_to_host(host, port, realhost); if (p != NULL) @@ -3100,6 +4079,12 @@ static Socket ssh_socket(void) { return s; } static int ssh_sendok(void) { return ssh_send_ok; } +static int ssh_ldisc(int option) { + if (option == LD_ECHO) return ssh_echoing; + if (option == LD_EDIT) return ssh_editing; + return FALSE; +} + Backend ssh_backend = { ssh_init, ssh_send, @@ -3107,5 +4092,6 @@ Backend ssh_backend = { ssh_special, ssh_socket, ssh_sendok, + ssh_ldisc, 22 };