X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/2c9c6388caa7e80195bffd93be7be7369c20bb98..2df34b4321465f778e00edfdd2b44ae8f3d2dc8f:/ssh.c diff --git a/ssh.c b/ssh.c index 58b6b427..31d4cc49 100644 --- a/ssh.c +++ b/ssh.c @@ -5,6 +5,7 @@ #include #include "putty.h" +#include "terminal.h" #include "tree234.h" #include "ssh.h" @@ -183,6 +184,7 @@ static const char *const ssh2_disconnect_reasons[] = { #define BUG_CHOKES_ON_RSA 8 #define BUG_SSH2_RSA_PADDING 16 #define BUG_SSH2_DERIVEKEY 32 +#define BUG_SSH2_DH_GEX 64 static int ssh_pkt_ctx = 0; @@ -426,6 +428,16 @@ enum { /* channel types */ struct ssh_channel { unsigned remoteid, localid; int type; + /* + * In SSH1, this value contains four bits: + * + * 1 We have sent SSH1_MSG_CHANNEL_CLOSE. + * 2 We have sent SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION. + * 4 We have received SSH1_MSG_CHANNEL_CLOSE. + * 8 We have received SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION. + * + * A channel is completely finished with when all four bits are set. + */ int closes; union { struct ssh1_data_channel { @@ -522,6 +534,8 @@ static int savedport; static int ssh_send_ok; static int ssh_echoing, ssh_editing; +static void *frontend; + static tree234 *ssh_channels; /* indexed by local id */ static struct ssh_channel *mainchan; /* primary session channel */ static int ssh_exitcode = -1; @@ -677,7 +691,7 @@ static void c_write(char *buf, int len) fputc(buf[i], stderr); return; } - from_backend(1, buf, len); + from_backend(frontend, 1, buf, len); } static void c_write_untrusted(char *buf, int len) @@ -1732,6 +1746,14 @@ static void ssh_detect_bugs(char *vstring) ssh_remote_bugs |= BUG_SSH2_RSA_PADDING; logevent("We believe remote version has SSH2 RSA padding bug"); } + + if (cfg.sshbug_dhgex2 == BUG_ON) { + /* + * These versions have the SSH2 DH GEX bug. + */ + ssh_remote_bugs |= BUG_SSH2_DH_GEX; + logevent("We believe remote version has SSH2 DH group exchange bug"); + } } static int do_ssh_init(unsigned char c) @@ -2362,8 +2384,8 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) c_write_str("\r\n"); } } else { - strncpy(username, cfg.username, 99); - username[99] = '\0'; + strncpy(username, cfg.username, sizeof(username)); + username[sizeof(username)-1] = '\0'; } send_packet(SSH1_CMSG_USER, PKT_STR, username, PKT_END); @@ -2888,7 +2910,7 @@ void sshfwd_close(struct ssh_channel *c) ssh2_pkt_send(); } } - c->closes = 1; + c->closes = 1; /* sent MSG_CLOSE */ if (c->type == CHAN_X11) { c->u.x11.s = NULL; logevent("Forwarded X11 connection terminated"); @@ -3105,7 +3127,8 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) if (!cfg.nopty) { send_packet(SSH1_CMSG_REQUEST_PTY, PKT_STR, cfg.termtype, - PKT_INT, rows, PKT_INT, cols, + PKT_INT, term ? term->rows : 24, + PKT_INT, term ? term->cols : 80, PKT_INT, 0, PKT_INT, 0, PKT_CHAR, 0, PKT_END); ssh_state = SSH_STATE_INTERMED; do { @@ -3179,7 +3202,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) pktin.type == SSH1_SMSG_STDERR_DATA) { long len = GET_32BIT(pktin.body); int bufsize = - from_backend(pktin.type == SSH1_SMSG_STDERR_DATA, + from_backend(frontend, pktin.type == SSH1_SMSG_STDERR_DATA, pktin.body + 4, len); if (!ssh1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) { ssh1_stdout_throttling = 1; @@ -3344,13 +3367,11 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) unsigned i = GET_32BIT(pktin.body); struct ssh_channel *c; c = find234(ssh_channels, &i, ssh_channelfind); - if (c) { + if (c && ((int)c->remoteid) != -1) { int closetype; closetype = (pktin.type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2); - if (!(c->closes & closetype)) - send_packet(pktin.type, PKT_INT, c->remoteid, - PKT_END); + if ((c->closes == 0) && (c->type == CHAN_X11)) { logevent("Forwarded X11 connection terminated"); assert(c->u.x11.s != NULL); @@ -3363,11 +3384,23 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) pfd_close(c->u.pfd.s); c->u.pfd.s = NULL; } - c->closes |= closetype; - if (c->closes == 3) { + + c->closes |= (closetype << 2); /* seen this message */ + if (!(c->closes & closetype)) { + send_packet(pktin.type, PKT_INT, c->remoteid, + PKT_END); + c->closes |= closetype; /* sent it too */ + } + + if (c->closes == 15) { del234(ssh_channels, c); sfree(c); } + } else { + bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n", + pktin.type == SSH1_MSG_CHANNEL_CLOSE ? "" : + "_CONFIRMATION", c ? "half-open" : "nonexistent", + i)); } } else if (pktin.type == SSH1_MSG_CHANNEL_DATA) { /* Data sent down one of our channels. */ @@ -3613,7 +3646,7 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) /* * Be prepared to work around the buggy MAC problem. */ - if (cfg.buggymac || (ssh_remote_bugs & BUG_SSH2_HMAC)) + if (ssh_remote_bugs & BUG_SSH2_HMAC) maclist = buggymacs, nmacs = lenof(buggymacs); else maclist = macs, nmacs = lenof(macs); @@ -3628,6 +3661,9 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) /* List key exchange algorithms. */ ssh2_pkt_addstring_start(); for (i = 0; i < lenof(kex_algs); i++) { + if (kex_algs[i] == &ssh_diffiehellman_gex && + (ssh_remote_bugs & BUG_SSH2_DH_GEX)) + continue; ssh2_pkt_addstring_str(kex_algs[i]->name); if (i < lenof(kex_algs) - 1) ssh2_pkt_addstring_str(","); @@ -3734,6 +3770,9 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) pktin.savedpos += 16; /* skip garbage cookie */ ssh2_pkt_getstring(&str, &len); /* key exchange algorithms */ for (i = 0; i < lenof(kex_algs); i++) { + if (kex_algs[i] == &ssh_diffiehellman_gex && + (ssh_remote_bugs & BUG_SSH2_DH_GEX)) + continue; if (in_commasep_string(kex_algs[i]->name, str, len)) { kex = kex_algs[i]; break; @@ -4182,8 +4221,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) username[strcspn(username, "\n\r")] = '\0'; } else { char stuff[200]; - strncpy(username, cfg.username, 99); - username[99] = '\0'; + strncpy(username, cfg.username, sizeof(username)); + username[sizeof(username)-1] = '\0'; if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) { sprintf(stuff, "Using username \"%s\".\r\n", username); c_write_str(stuff); @@ -5107,8 +5146,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) ssh2_pkt_addstring("pty-req"); ssh2_pkt_addbool(1); /* want reply */ ssh2_pkt_addstring(cfg.termtype); - ssh2_pkt_adduint32(cols); - ssh2_pkt_adduint32(rows); + ssh2_pkt_adduint32(term ? term->cols : 80); + ssh2_pkt_adduint32(term ? term->rows : 24); ssh2_pkt_adduint32(0); /* pixel width */ ssh2_pkt_adduint32(0); /* pixel height */ ssh2_pkt_addstring_start(); @@ -5246,7 +5285,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) switch (c->type) { case CHAN_MAINSESSION: bufsize = - from_backend(pktin.type == + from_backend(frontend, pktin.type == SSH2_MSG_CHANNEL_EXTENDED_DATA, data, length); break; @@ -5344,8 +5383,10 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) struct ssh_channel *c; c = find234(ssh_channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ + if (!c || ((int)c->remoteid) == -1) { + bombout(("Received CHANNEL_CLOSE for %s channel %d\n", + c ? "half-open" : "nonexistent", i)); + } /* Do pre-close processing on the channel. */ switch (c->type) { case CHAN_MAINSESSION: @@ -5669,7 +5710,8 @@ static void ssh2_protocol(unsigned char *in, int inlen, int ispkt) * * Returns an error message, or NULL on success. */ -static char *ssh_init(char *host, int port, char **realhost, int nodelay) +static char *ssh_init(void *frontend_handle, + char *host, int port, char **realhost, int nodelay) { char *p; @@ -5678,6 +5720,8 @@ static char *ssh_init(char *host, int port, char **realhost, int nodelay) return "Microsoft high encryption pack not installed!"; #endif + frontend = frontend_handle; + ssh_send_ok = 0; ssh_editing = 0; ssh_echoing = 0; @@ -5750,17 +5794,19 @@ static void ssh_size(void) break; case SSH_STATE_SESSION: if (!cfg.nopty) { + if (!term) + return; if (ssh_version == 1) { send_packet(SSH1_CMSG_WINDOW_SIZE, - PKT_INT, rows, PKT_INT, cols, + PKT_INT, term->rows, PKT_INT, term->cols, PKT_INT, 0, PKT_INT, 0, PKT_END); } else { ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST); ssh2_pkt_adduint32(mainchan->remoteid); ssh2_pkt_addstring("window-change"); ssh2_pkt_addbool(0); - ssh2_pkt_adduint32(cols); - ssh2_pkt_adduint32(rows); + ssh2_pkt_adduint32(term->cols); + ssh2_pkt_adduint32(term->rows); ssh2_pkt_adduint32(0); ssh2_pkt_adduint32(0); ssh2_pkt_send();