X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/32874aeac8dacbca26663777b39a79efc5d8dc4b..fd5e5847eb0f834ce8124f0574bd3cfaf878db53:/ssh.c diff --git a/ssh.c b/ssh.c index 9f0fe618..2c538239 100644 --- a/ssh.c +++ b/ssh.c @@ -95,6 +95,8 @@ #define SSH2_MSG_USERAUTH_BANNER 53 /* 0x35 */ #define SSH2_MSG_USERAUTH_PK_OK 60 /* 0x3c */ #define SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ 60 /* 0x3c */ +#define SSH2_MSG_USERAUTH_INFO_REQUEST 60 /* 0x3c */ +#define SSH2_MSG_USERAUTH_INFO_RESPONSE 61 /* 0x3d */ #define SSH2_MSG_GLOBAL_REQUEST 80 /* 0x50 */ #define SSH2_MSG_REQUEST_SUCCESS 81 /* 0x51 */ #define SSH2_MSG_REQUEST_FAILURE 82 /* 0x52 */ @@ -193,8 +195,43 @@ enum { PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM }; extern char *x11_init(Socket *, char *, void *); extern void x11_close(Socket); -extern void x11_send(Socket, char *, int); +extern int x11_send(Socket, char *, int); extern void x11_invent_auth(char *, int, char *, int); +extern void x11_unthrottle(Socket s); +extern void x11_override_throttle(Socket s, int enable); + +extern char *pfd_newconnect(Socket * s, char *hostname, int port, void *c); +extern char *pfd_addforward(char *desthost, int destport, int port); +extern void pfd_close(Socket s); +extern int pfd_send(Socket s, char *data, int len); +extern void pfd_confirm(Socket s); +extern void pfd_unthrottle(Socket s); +extern void pfd_override_throttle(Socket s, int enable); + +/* + * Buffer management constants. There are several of these for + * various different purposes: + * + * - SSH1_BUFFER_LIMIT is the amount of backlog that must build up + * on a local data stream before we throttle the whole SSH + * connection (in SSH1 only). Throttling the whole connection is + * pretty drastic so we set this high in the hope it won't + * happen very often. + * + * - SSH_MAX_BACKLOG is the amount of backlog that must build up + * on the SSH connection itself before we defensively throttle + * _all_ local data streams. This is pretty drastic too (though + * thankfully unlikely in SSH2 since the window mechanism should + * ensure that the server never has any need to throttle its end + * of the connection), so we set this high as well. + * + * - OUR_V2_WINSIZE is the maximum window size we present on SSH2 + * channels. + */ + +#define SSH1_BUFFER_LIMIT 32768 +#define SSH_MAX_BACKLOG 32768 +#define OUR_V2_WINSIZE 16384 /* * Ciphers for SSH2. We miss out single-DES because it isn't @@ -263,6 +300,8 @@ enum { /* channel types */ CHAN_MAINSESSION, CHAN_X11, CHAN_AGENT, + CHAN_SOCKDATA, + CHAN_SOCKDATA_DORMANT /* one the remote hasn't confirmed */ }; /* @@ -272,11 +311,16 @@ struct ssh_channel { unsigned remoteid, localid; int type; int closes; - struct ssh2_data_channel { - unsigned char *outbuffer; - unsigned outbuflen, outbufsize; - unsigned remwindow, remmaxpkt; - } v2; + union { + struct ssh1_data_channel { + int throttling; + } v1; + struct ssh2_data_channel { + bufchain outbuffer; + unsigned remwindow, remmaxpkt; + unsigned locwindow; + } v2; + } v; union { struct ssh_agent_channel { unsigned char *message; @@ -286,9 +330,46 @@ struct ssh_channel { struct ssh_x11_channel { Socket s; } x11; + struct ssh_pfd_channel { + Socket s; + } pfd; } u; }; +/* + * 2-3-4 tree storing remote->local port forwardings. SSH 1 and SSH + * 2 use this structure in different ways, reflecting SSH 2's + * altogether saner approach to port forwarding. + * + * In SSH 1, you arrange a remote forwarding by sending the server + * the remote port number, and the local destination host:port. + * When a connection comes in, the server sends you back that + * host:port pair, and you connect to it. This is a ready-made + * security hole if you're not on the ball: a malicious server + * could send you back _any_ host:port pair, so if you trustingly + * connect to the address it gives you then you've just opened the + * entire inside of your corporate network just by connecting + * through it to a dodgy SSH server. Hence, we must store a list of + * host:port pairs we _are_ trying to forward to, and reject a + * connection request from the server if it's not in the list. + * + * In SSH 2, each side of the connection minds its own business and + * doesn't send unnecessary information to the other. You arrange a + * remote forwarding by sending the server just the remote port + * number. When a connection comes in, the server tells you which + * of its ports was connected to; and _you_ have to remember what + * local host:port pair went with that port number. + * + * Hence: in SSH 1 this structure stores host:port pairs we intend + * to allow connections to, and is indexed by those host:port + * pairs. In SSH 2 it stores a mapping from source port to + * destination host:port pair, and is indexed by source port. + */ +struct ssh_rportfwd { + unsigned sport, dport; + char dhost[256]; +}; + struct Packet { long length; int type; @@ -330,6 +411,8 @@ static int ssh_echoing, ssh_editing; static tree234 *ssh_channels; /* indexed by local id */ static struct ssh_channel *mainchan; /* primary session channel */ +static tree234 *ssh_rportfwds; + static enum { SSH_STATE_PREPACKET, SSH_STATE_BEFORE_SIZE, @@ -345,17 +428,30 @@ static struct Packet pktout = { 0, 0, NULL, NULL, 0 }; static unsigned char *deferred_send_data = NULL; static int deferred_len = 0, deferred_size = 0; +/* + * Gross hack: pscp will try to start SFTP but fall back to scp1 if + * that fails. This variable is the means by which scp.c can reach + * into the SSH code and find out which one it got. + */ +int ssh_fallback_cmd = 0; + static int ssh_version; +static int ssh1_throttle_count; +static int ssh_overall_bufsize; +static int ssh_throttled_all; +static int ssh1_stdout_throttling; static void (*ssh_protocol) (unsigned char *in, int inlen, int ispkt); static void ssh1_protocol(unsigned char *in, int inlen, int ispkt); static void ssh2_protocol(unsigned char *in, int inlen, int ispkt); static void ssh_size(void); static void ssh_special(Telnet_Special); -static void ssh2_try_send(struct ssh_channel *c); +static int ssh2_try_send(struct ssh_channel *c); static void ssh2_add_channel_data(struct ssh_channel *c, char *buf, int len); - +static void ssh_throttle_all(int enable, int bufsize); +static void ssh2_set_window(struct ssh_channel *c, unsigned newwin); static int (*s_rdpkt) (unsigned char **data, int *datalen); +static int ssh_sendbuffer(void); static struct rdpkt1_state_tag { long len, pad, biglen, to_read; @@ -393,6 +489,32 @@ static int ssh_channelfind(void *av, void *bv) return 0; } +static int ssh_rportcmp_ssh1(void *av, void *bv) +{ + struct ssh_rportfwd *a = (struct ssh_rportfwd *) av; + struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv; + int i; + if ( (i = strcmp(a->dhost, b->dhost)) != 0) + return i < 0 ? -1 : +1; + if (a->dport > b->dport) + return +1; + if (a->dport < b->dport) + return -1; + return 0; +} + +static int ssh_rportcmp_ssh2(void *av, void *bv) +{ + struct ssh_rportfwd *a = (struct ssh_rportfwd *) av; + struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv; + int i; + if (a->sport > b->sport) + return +1; + if (a->sport < b->sport) + return -1; + return 0; +} + static int alloc_channel_id(void) { const unsigned CHANNEL_NUMBER_OFFSET = 256; @@ -861,9 +983,11 @@ static int s_wrpkt_prepare(void) static void s_wrpkt(void) { - int len; + int len, backlog; len = s_wrpkt_prepare(); - sk_write(s, pktout.data, len); + backlog = sk_write(s, pktout.data, len); + if (backlog > SSH_MAX_BACKLOG) + ssh_throttle_all(1, backlog); } static void s_wrpkt_defer(void) @@ -1169,8 +1293,12 @@ static int ssh2_pkt_construct(void) */ static void ssh2_pkt_send(void) { - int len = ssh2_pkt_construct(); - sk_write(s, pktout.data, len); + int len; + int backlog; + len = ssh2_pkt_construct(); + backlog = sk_write(s, pktout.data, len); + if (backlog > SSH_MAX_BACKLOG) + ssh_throttle_all(1, backlog); } /* @@ -1201,10 +1329,13 @@ static void ssh2_pkt_defer(void) */ static void ssh_pkt_defersend(void) { - sk_write(s, deferred_send_data, deferred_len); + int backlog; + backlog = sk_write(s, deferred_send_data, deferred_len); deferred_len = deferred_size = 0; sfree(deferred_send_data); deferred_send_data = NULL; + if (backlog > SSH_MAX_BACKLOG) + ssh_throttle_all(1, backlog); } #if 0 @@ -1322,7 +1453,7 @@ static void ssh_detect_bugs(char *vstring) static int do_ssh_init(unsigned char c) { - static char vslen; + static int vslen; static char version[10]; static char *vstring; static int vstrsize; @@ -1478,8 +1609,10 @@ static int ssh_closing(Plug plug, char *error_msg, int error_code, int calling_back) { ssh_state = SSH_STATE_CLOSED; - sk_close(s); - s = NULL; + if (s) { + sk_close(s); + s = NULL; + } if (error_msg) { /* A socket error has occurred. */ connection_fatal(error_msg); @@ -1502,16 +1635,29 @@ static int ssh_receive(Plug plug, int urgent, char *data, int len) return 1; } +static void ssh_sent(Plug plug, int bufsize) +{ + /* + * If the send backlog on the SSH socket itself clears, we + * should unthrottle the whole world if it was throttled. + */ + if (bufsize < SSH_MAX_BACKLOG) + ssh_throttle_all(0, bufsize); +} + /* * Connect to specified host and port. * Returns an error message, or NULL on success. - * Also places the canonical host name into `realhost'. + * Also places the canonical host name into `realhost'. It must be + * freed by the caller. */ static char *connect_to_host(char *host, int port, char **realhost) { static struct plug_function_table fn_table = { ssh_closing, - ssh_receive + ssh_receive, + ssh_sent, + NULL }, *fn_table_ptr = &fn_table; SockAddr addr; @@ -1545,7 +1691,7 @@ static char *connect_to_host(char *host, int port, char **realhost) return err; #ifdef FWHACK - *realhost = FWhost; + *realhost = strdup(FWhost); #endif /* @@ -1569,19 +1715,70 @@ static char *connect_to_host(char *host, int port, char **realhost) } /* + * Throttle or unthrottle the SSH connection. + */ +static void ssh1_throttle(int adjust) +{ + int old_count = ssh1_throttle_count; + ssh1_throttle_count += adjust; + assert(ssh1_throttle_count >= 0); + if (ssh1_throttle_count && !old_count) { + sk_set_frozen(s, 1); + } else if (!ssh1_throttle_count && old_count) { + sk_set_frozen(s, 0); + } +} + +/* + * Throttle or unthrottle _all_ local data streams (for when sends + * on the SSH connection itself back up). + */ +static void ssh_throttle_all(int enable, int bufsize) +{ + int i; + struct ssh_channel *c; + + if (enable == ssh_throttled_all) + return; + ssh_throttled_all = enable; + ssh_overall_bufsize = bufsize; + if (!ssh_channels) + return; + for (i = 0; NULL != (c = index234(ssh_channels, i)); i++) { + switch (c->type) { + case CHAN_MAINSESSION: + /* + * This is treated separately, outside the switch. + */ + break; + case CHAN_X11: + x11_override_throttle(c->u.x11.s, enable); + break; + case CHAN_AGENT: + /* Agent channels require no buffer management. */ + break; + case CHAN_SOCKDATA: + pfd_override_throttle(c->u.x11.s, enable); + break; + } + } +} + +/* * Handle the key exchange and user authentication phases. */ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) { - int i, j, len; - unsigned char *rsabuf, *keystr1, *keystr2; + int i, j; + static int len; + static unsigned char *rsabuf, *keystr1, *keystr2; unsigned char cookie[8]; struct RSAKey servkey, hostkey; struct MD5Context md5c; static unsigned long supported_ciphers_mask, supported_auths_mask; static int tried_publickey; static unsigned char session_id[16]; - int cipher_type; + static int cipher_type; static char username[100]; crBegin; @@ -1672,31 +1869,45 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) logevent("Encrypted session key"); - switch (cfg.cipher) { - case CIPHER_BLOWFISH: - cipher_type = SSH_CIPHER_BLOWFISH; - break; - case CIPHER_DES: - cipher_type = SSH_CIPHER_DES; - break; - case CIPHER_3DES: - cipher_type = SSH_CIPHER_3DES; - break; - case CIPHER_AES: - c_write_str("AES not supported in SSH1, falling back to 3DES\r\n"); - cipher_type = SSH_CIPHER_3DES; - break; - } - if ((supported_ciphers_mask & (1 << cipher_type)) == 0) { - c_write_str - ("Selected cipher not supported, falling back to 3DES\r\n"); - cipher_type = SSH_CIPHER_3DES; - if ((supported_ciphers_mask & (1 << cipher_type)) == 0) { - bombout(("Server violates SSH 1 protocol by " - "not supporting 3DES encryption")); + { + int cipher_chosen = 0, warn = 0; + char *cipher_string = NULL; + for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) { + int next_cipher = cfg.ssh_cipherlist[i]; + if (next_cipher == CIPHER_WARN) { + /* If/when we choose a cipher, warn about it */ + warn = 1; + } else if (next_cipher == CIPHER_AES) { + /* XXX Probably don't need to mention this. */ + logevent("AES not supported in SSH1, skipping"); + } else { + switch (next_cipher) { + case CIPHER_3DES: cipher_type = SSH_CIPHER_3DES; + cipher_string = "3DES"; break; + case CIPHER_BLOWFISH: cipher_type = SSH_CIPHER_BLOWFISH; + cipher_string = "Blowfish"; break; + case CIPHER_DES: cipher_type = SSH_CIPHER_DES; + cipher_string = "single-DES"; break; + } + if (supported_ciphers_mask & (1 << cipher_type)) + cipher_chosen = 1; + } + } + if (!cipher_chosen) { + if ((supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0) + bombout(("Server violates SSH 1 protocol by not " + "supporting 3DES encryption")); + else + /* shouldn't happen */ + bombout(("No supported ciphers found")); crReturn(0); } + + /* Warn about chosen cipher if necessary. */ + if (warn) + askcipher(cipher_string, 0); } + switch (cipher_type) { case SSH_CIPHER_3DES: logevent("Using 3DES encryption"); @@ -1782,7 +1993,8 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) break; default: if (((c >= ' ' && c <= '~') || - ((unsigned char) c >= 160)) && pos < 40) { + ((unsigned char) c >= 160)) + && pos < sizeof(username)-1) { username[pos++] = c; c_write(&c, 1); } @@ -1882,6 +2094,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) ssh1_read_bignum(pktin.body, &challenge); { char *agentreq, *q, *ret; + void *vret; int len, retlen; len = 1 + 4; /* message type, bit count */ len += ssh1_bignum_length(key.exponent); @@ -1901,7 +2114,8 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) memcpy(q, session_id, 16); q += 16; PUT_32BIT(q, 1); /* response format */ - agent_query(agentreq, len + 4, &ret, &retlen); + agent_query(agentreq, len + 4, &vret, &retlen); + ret = vret; sfree(agentreq); if (ret) { if (ret[4] == SSH1_AGENT_RSA_RESPONSE) { @@ -2017,7 +2231,10 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) * because one was supplied on the command line * which has already failed to work). Terminate. */ - logevent("No more passwords to try"); + send_packet(SSH1_MSG_DISCONNECT, + PKT_STR, "No more passwords available to try", + PKT_END); + connection_fatal("Unable to authenticate"); ssh_state = SSH_STATE_CLOSED; crReturn(1); } @@ -2049,9 +2266,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) exit(0); break; default: - if (((c >= ' ' && c <= '~') || - ((unsigned char) c >= 160)) - && pos < sizeof(password)) + if (pos < sizeof(password)-1) password[pos++] = c; break; } @@ -2255,20 +2470,43 @@ void sshfwd_close(struct ssh_channel *c) c->closes = 1; if (c->type == CHAN_X11) { c->u.x11.s = NULL; - logevent("X11 connection terminated"); + logevent("Forwarded X11 connection terminated"); + } else if (c->type == CHAN_SOCKDATA) { + c->u.pfd.s = NULL; + logevent("Forwarded port closed"); } } } -void sshfwd_write(struct ssh_channel *c, char *buf, int len) +int sshfwd_write(struct ssh_channel *c, char *buf, int len) { if (ssh_version == 1) { send_packet(SSH1_MSG_CHANNEL_DATA, PKT_INT, c->remoteid, PKT_INT, len, PKT_DATA, buf, len, PKT_END); + /* + * In SSH1 we can return 0 here - implying that forwarded + * connections are never individually throttled - because + * the only circumstance that can cause throttling will be + * the whole SSH connection backing up, in which case + * _everything_ will be throttled as a whole. + */ + return 0; } else { ssh2_add_channel_data(c, buf, len); - ssh2_try_send(c); + return ssh2_try_send(c); + } +} + +void sshfwd_unthrottle(struct ssh_channel *c, int bufsize) +{ + if (ssh_version == 1) { + if (c->v.v1.throttling && bufsize < SSH1_BUFFER_LIMIT) { + c->v.v1.throttling = 0; + ssh1_throttle(-1); + } + } else { + ssh2_set_window(c, OUR_V2_WINSIZE - bufsize); } } @@ -2329,6 +2567,69 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) } } + { + char type, *e; + int n; + int sport,dport; + char sports[256], dports[256], host[256]; + char buf[1024]; + + ssh_rportfwds = newtree234(ssh_rportcmp_ssh1); + /* Add port forwardings. */ + e = cfg.portfwd; + while (*e) { + type = *e++; + n = 0; + while (*e && *e != '\t') + sports[n++] = *e++; + sports[n] = 0; + if (*e == '\t') + e++; + n = 0; + while (*e && *e != ':') + host[n++] = *e++; + host[n] = 0; + if (*e == ':') + e++; + n = 0; + while (*e) + dports[n++] = *e++; + dports[n] = 0; + e++; + dport = atoi(dports); + sport = atoi(sports); + if (sport && dport) { + if (type == 'L') { + pfd_addforward(host, dport, sport); + sprintf(buf, "Local port %d forwarding to %s:%d", + sport, host, dport); + logevent(buf); + } else { + struct ssh_rportfwd *pf; + pf = smalloc(sizeof(*pf)); + strcpy(pf->dhost, host); + pf->dport = dport; + if (add234(ssh_rportfwds, pf) != pf) { + sprintf(buf, + "Duplicate remote port forwarding to %s:%d", + host, dport); + logevent(buf); + sfree(pf); + } else { + sprintf(buf, "Requesting remote port %d forward to %s:%d", + sport, host, dport); + logevent(buf); + send_packet(SSH1_CMSG_PORT_FORWARD_REQUEST, + PKT_INT, sport, + PKT_STR, host, + PKT_INT, dport, + PKT_END); + } + } + } + } + } + if (!cfg.nopty) { send_packet(SSH1_CMSG_REQUEST_PTY, PKT_STR, cfg.termtype, @@ -2369,12 +2670,26 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) zlib_decompress_init(); } - if (*cfg.remote_cmd_ptr) - send_packet(SSH1_CMSG_EXEC_CMD, PKT_STR, cfg.remote_cmd_ptr, - PKT_END); - else - send_packet(SSH1_CMSG_EXEC_SHELL, PKT_END); - logevent("Started session"); + /* + * Start the shell or command. + * + * Special case: if the first-choice command is an SSH2 + * subsystem (hence not usable here) and the second choice + * exists, we fall straight back to that. + */ + { + char *cmd = cfg.remote_cmd_ptr; + + if (cfg.ssh_subsys && cfg.remote_cmd_ptr2) { + cmd = cfg.remote_cmd_ptr2; + ssh_fallback_cmd = TRUE; + } + if (*cmd) + send_packet(SSH1_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END); + else + send_packet(SSH1_CMSG_EXEC_SHELL, PKT_END); + logevent("Started session"); + } ssh_state = SSH_STATE_SESSION; if (size_needed) @@ -2391,8 +2706,13 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) if (pktin.type == SSH1_SMSG_STDOUT_DATA || pktin.type == SSH1_SMSG_STDERR_DATA) { long len = GET_32BIT(pktin.body); - from_backend(pktin.type == SSH1_SMSG_STDERR_DATA, - pktin.body + 4, len); + int bufsize = + from_backend(pktin.type == SSH1_SMSG_STDERR_DATA, + pktin.body + 4, len); + if (bufsize > SSH1_BUFFER_LIMIT) { + ssh1_stdout_throttling = 1; + ssh1_throttle(+1); + } } else if (pktin.type == SSH1_MSG_DISCONNECT) { ssh_state = SSH_STATE_CLOSED; logevent("Received disconnect request"); @@ -2423,6 +2743,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) c->remoteid = GET_32BIT(pktin.body); c->localid = alloc_channel_id(); c->closes = 0; + c->v.v1.throttling = 0; c->type = CHAN_X11; /* identify channel type */ add234(ssh_channels, c); send_packet(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, @@ -2445,6 +2766,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) c->remoteid = GET_32BIT(pktin.body); c->localid = alloc_channel_id(); c->closes = 0; + c->v.v1.throttling = 0; c->type = CHAN_AGENT; /* identify channel type */ c->u.a.lensofar = 0; add234(ssh_channels, c); @@ -2452,6 +2774,73 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) PKT_INT, c->remoteid, PKT_INT, c->localid, PKT_END); } + } else if (pktin.type == SSH1_MSG_PORT_OPEN) { + /* Remote side is trying to open a channel to talk to a + * forwarded port. Give them back a local channel number. */ + struct ssh_channel *c; + struct ssh_rportfwd pf; + int hostsize, port; + char host[256], buf[1024]; + char *p, *h, *e; + c = smalloc(sizeof(struct ssh_channel)); + + hostsize = GET_32BIT(pktin.body+4); + for(h = host, p = pktin.body+8; hostsize != 0; hostsize--) { + if (h+1 < host+sizeof(host)) + *h++ = *p; + p++; + } + *h = 0; + port = GET_32BIT(p); + + strcpy(pf.dhost, host); + pf.dport = port; + + if (find234(ssh_rportfwds, &pf, NULL) == NULL) { + sprintf(buf, "Rejected remote port open request for %s:%d", + host, port); + logevent(buf); + send_packet(SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, GET_32BIT(pktin.body), PKT_END); + } else { + sprintf(buf, "Received remote port open request for %s:%d", + host, port); + logevent(buf); + e = pfd_newconnect(&c->u.pfd.s, host, port, c); + if (e != NULL) { + char buf[256]; + sprintf(buf, "Port open failed: %s", e); + logevent(buf); + sfree(c); + send_packet(SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, GET_32BIT(pktin.body), + PKT_END); + } else { + c->remoteid = GET_32BIT(pktin.body); + c->localid = alloc_channel_id(); + c->closes = 0; + c->v.v1.throttling = 0; + c->type = CHAN_SOCKDATA; /* identify channel type */ + add234(ssh_channels, c); + send_packet(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, + PKT_INT, c->remoteid, PKT_INT, + c->localid, PKT_END); + logevent("Forwarded port opened successfully"); + } + } + + } else if (pktin.type == SSH1_MSG_CHANNEL_OPEN_CONFIRMATION) { + unsigned int remoteid = GET_32BIT(pktin.body); + unsigned int localid = GET_32BIT(pktin.body+4); + struct ssh_channel *c; + + c = find234(ssh_channels, &remoteid, ssh_channelfind); + if (c && c->type == CHAN_SOCKDATA_DORMANT) { + c->remoteid = localid; + c->type = CHAN_SOCKDATA; + pfd_confirm(c->u.pfd.s); + } + } else if (pktin.type == SSH1_MSG_CHANNEL_CLOSE || pktin.type == SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION) { /* Remote side closes a channel. */ @@ -2466,11 +2855,17 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) send_packet(pktin.type, PKT_INT, c->remoteid, PKT_END); if ((c->closes == 0) && (c->type == CHAN_X11)) { - logevent("X11 connection closed"); + logevent("Forwarded X11 connection terminated"); assert(c->u.x11.s != NULL); x11_close(c->u.x11.s); c->u.x11.s = NULL; } + if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) { + logevent("Forwarded port closed"); + assert(c->u.pfd.s != NULL); + pfd_close(c->u.pfd.s); + c->u.pfd.s = NULL; + } c->closes |= closetype; if (c->closes == 3) { del234(ssh_channels, c); @@ -2485,9 +2880,13 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) struct ssh_channel *c; c = find234(ssh_channels, &i, ssh_channelfind); if (c) { + int bufsize; switch (c->type) { case CHAN_X11: - x11_send(c->u.x11.s, p, len); + bufsize = x11_send(c->u.x11.s, p, len); + break; + case CHAN_SOCKDATA: + bufsize = pfd_send(c->u.pfd.s, p, len); break; case CHAN_AGENT: /* Data for an agent message. Buffer it. */ @@ -2540,8 +2939,13 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) c->u.a.lensofar = 0; } } + bufsize = 0; /* agent channels never back up */ break; } + if (bufsize > SSH1_BUFFER_LIMIT) { + c->v.v1.throttling = 1; + ssh1_throttle(+1); + } } } else if (pktin.type == SSH1_SMSG_SUCCESS) { /* may be from EXEC_SHELL on some servers */ @@ -2623,7 +3027,7 @@ static void ssh2_mkkey(Bignum K, char *H, char *sessid, char chr, */ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) { - static int i, j, len, nbits, pbits; + static int i, j, len, nbits, pbits, warn; static char *str; static Bignum p, g, e, f, K; static int kex_init_value, kex_reply_value; @@ -2640,7 +3044,8 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) static void *hkey; /* actual host key */ static unsigned char exchange_hash[20]; static unsigned char keyspace[40]; - static const struct ssh2_ciphers *preferred_cipher; + static int n_preferred_ciphers; + static const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX]; static const struct ssh_compress *preferred_comp; static int first_kex; @@ -2649,21 +3054,40 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) first_kex = 1; /* - * Set up the preferred cipher and compression. + * Set up the preferred ciphers. (NULL => warn below here) */ - if (cfg.cipher == CIPHER_BLOWFISH) { - preferred_cipher = &ssh2_blowfish; - } else if (cfg.cipher == CIPHER_DES) { - logevent("Single DES not supported in SSH2; using 3DES"); - preferred_cipher = &ssh2_3des; - } else if (cfg.cipher == CIPHER_3DES) { - preferred_cipher = &ssh2_3des; - } else if (cfg.cipher == CIPHER_AES) { - preferred_cipher = &ssh2_aes; - } else { - /* Shouldn't happen, but we do want to initialise to _something_. */ - preferred_cipher = &ssh2_3des; + n_preferred_ciphers = 0; + for (i = 0; i < CIPHER_MAX; i++) { + switch (cfg.ssh_cipherlist[i]) { + case CIPHER_BLOWFISH: + preferred_ciphers[n_preferred_ciphers] = &ssh2_blowfish; + n_preferred_ciphers++; + break; + case CIPHER_DES: + /* Not supported in SSH2; silently drop */ + break; + case CIPHER_3DES: + preferred_ciphers[n_preferred_ciphers] = &ssh2_3des; + n_preferred_ciphers++; + break; + case CIPHER_AES: + preferred_ciphers[n_preferred_ciphers] = &ssh2_aes; + n_preferred_ciphers++; + break; + case CIPHER_WARN: + /* Flag for later. Don't bother if it's the last in + * the list. */ + if (i < CIPHER_MAX - 1) { + preferred_ciphers[n_preferred_ciphers] = NULL; + n_preferred_ciphers++; + } + break; + } } + + /* + * Set up preferred compression. + */ if (cfg.compression) preferred_comp = &ssh_zlib; else @@ -2700,23 +3124,23 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) } /* List client->server encryption algorithms. */ ssh2_pkt_addstring_start(); - for (i = 0; i < lenof(ciphers) + 1; i++) { - const struct ssh2_ciphers *c = - i == 0 ? preferred_cipher : ciphers[i - 1]; + for (i = 0; i < n_preferred_ciphers; i++) { + const struct ssh2_ciphers *c = preferred_ciphers[i]; + if (!c) continue; /* warning flag */ for (j = 0; j < c->nciphers; j++) { ssh2_pkt_addstring_str(c->list[j]->name); - if (i < lenof(ciphers) || j < c->nciphers - 1) + if (i < n_preferred_ciphers || j < c->nciphers - 1) ssh2_pkt_addstring_str(","); } } /* List server->client encryption algorithms. */ ssh2_pkt_addstring_start(); - for (i = 0; i < lenof(ciphers) + 1; i++) { - const struct ssh2_ciphers *c = - i == 0 ? preferred_cipher : ciphers[i - 1]; + for (i = 0; i < n_preferred_ciphers; i++) { + const struct ssh2_ciphers *c = preferred_ciphers[i]; + if (!c) continue; /* warning flag */ for (j = 0; j < c->nciphers; j++) { ssh2_pkt_addstring_str(c->list[j]->name); - if (i < lenof(ciphers) || j < c->nciphers - 1) + if (i < n_preferred_ciphers || j < c->nciphers - 1) ssh2_pkt_addstring_str(","); } } @@ -2802,30 +3226,44 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) } } ssh2_pkt_getstring(&str, &len); /* client->server cipher */ - for (i = 0; i < lenof(ciphers) + 1; i++) { - const struct ssh2_ciphers *c = - i == 0 ? preferred_cipher : ciphers[i - 1]; - for (j = 0; j < c->nciphers; j++) { - if (in_commasep_string(c->list[j]->name, str, len)) { - cscipher_tobe = c->list[j]; - break; + warn = 0; + for (i = 0; i < n_preferred_ciphers; i++) { + const struct ssh2_ciphers *c = preferred_ciphers[i]; + if (!c) { + warn = 1; + } else { + for (j = 0; j < c->nciphers; j++) { + if (in_commasep_string(c->list[j]->name, str, len)) { + cscipher_tobe = c->list[j]; + break; + } } } - if (cscipher_tobe) + if (cscipher_tobe) { + if (warn) + askcipher(cscipher_tobe->name, 1); break; + } } ssh2_pkt_getstring(&str, &len); /* server->client cipher */ - for (i = 0; i < lenof(ciphers) + 1; i++) { - const struct ssh2_ciphers *c = - i == 0 ? preferred_cipher : ciphers[i - 1]; - for (j = 0; j < c->nciphers; j++) { - if (in_commasep_string(c->list[j]->name, str, len)) { - sccipher_tobe = c->list[j]; - break; + warn = 0; + for (i = 0; i < n_preferred_ciphers; i++) { + const struct ssh2_ciphers *c = preferred_ciphers[i]; + if (!c) { + warn = 1; + } else { + for (j = 0; j < c->nciphers; j++) { + if (in_commasep_string(c->list[j]->name, str, len)) { + sccipher_tobe = c->list[j]; + break; + } } } - if (sccipher_tobe) + if (sccipher_tobe) { + if (warn) + askcipher(sccipher_tobe->name, 2); break; + } } ssh2_pkt_getstring(&str, &len); /* client->server mac */ for (i = 0; i < nmacs; i++) { @@ -2947,8 +3385,9 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) #endif hkey = hostkey->newkey(hostkeydata, hostkeylen); - if (!hostkey->verifysig(hkey, sigdata, siglen, exchange_hash, 20)) { - bombout(("Server failed host key check")); + if (!hkey || + !hostkey->verifysig(hkey, sigdata, siglen, exchange_hash, 20)) { + bombout(("Server's host key did not match the signature supplied")); crReturn(0); } @@ -3047,33 +3486,49 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt) static void ssh2_add_channel_data(struct ssh_channel *c, char *buf, int len) { - if (c->v2.outbufsize < c->v2.outbuflen + len) { - c->v2.outbufsize = c->v2.outbuflen + len + 1024; - c->v2.outbuffer = srealloc(c->v2.outbuffer, c->v2.outbufsize); - } - memcpy(c->v2.outbuffer + c->v2.outbuflen, buf, len); - c->v2.outbuflen += len; + bufchain_add(&c->v.v2.outbuffer, buf, len); } /* * Attempt to send data on an SSH2 channel. */ -static void ssh2_try_send(struct ssh_channel *c) +static int ssh2_try_send(struct ssh_channel *c) { - while (c->v2.remwindow > 0 && c->v2.outbuflen > 0) { - unsigned len = c->v2.remwindow; - if (len > c->v2.outbuflen) - len = c->v2.outbuflen; - if (len > c->v2.remmaxpkt) - len = c->v2.remmaxpkt; + while (c->v.v2.remwindow > 0 && bufchain_size(&c->v.v2.outbuffer) > 0) { + int len; + void *data; + bufchain_prefix(&c->v.v2.outbuffer, &data, &len); + if ((unsigned)len > c->v.v2.remwindow) + len = c->v.v2.remwindow; + if ((unsigned)len > c->v.v2.remmaxpkt) + len = c->v.v2.remmaxpkt; ssh2_pkt_init(SSH2_MSG_CHANNEL_DATA); ssh2_pkt_adduint32(c->remoteid); ssh2_pkt_addstring_start(); - ssh2_pkt_addstring_data(c->v2.outbuffer, len); + ssh2_pkt_addstring_data(data, len); ssh2_pkt_send(); - c->v2.outbuflen -= len; - memmove(c->v2.outbuffer, c->v2.outbuffer + len, c->v2.outbuflen); - c->v2.remwindow -= len; + bufchain_consume(&c->v.v2.outbuffer, len); + c->v.v2.remwindow -= len; + } + + /* + * After having sent as much data as we can, return the amount + * still buffered. + */ + return bufchain_size(&c->v.v2.outbuffer); +} + +/* + * Potentially enlarge the window on an SSH2 channel. + */ +static void ssh2_set_window(struct ssh_channel *c, unsigned newwin) +{ + if (newwin > c->v.v2.locwindow) { + ssh2_pkt_init(SSH2_MSG_CHANNEL_WINDOW_ADJUST); + ssh2_pkt_adduint32(c->remoteid); + ssh2_pkt_adduint32(newwin - c->v.v2.locwindow); + ssh2_pkt_send(); + c->v.v2.locwindow = newwin; } } @@ -3082,22 +3537,25 @@ static void ssh2_try_send(struct ssh_channel *c) */ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) { - static unsigned long remote_winsize; - static unsigned long remote_maxpkt; static enum { AUTH_INVALID, AUTH_PUBLICKEY_AGENT, AUTH_PUBLICKEY_FILE, - AUTH_PASSWORD + AUTH_PASSWORD, + AUTH_KEYBOARD_INTERACTIVE } method; static enum { AUTH_TYPE_NONE, AUTH_TYPE_PUBLICKEY, AUTH_TYPE_PUBLICKEY_OFFER_LOUD, AUTH_TYPE_PUBLICKEY_OFFER_QUIET, - AUTH_TYPE_PASSWORD + AUTH_TYPE_PASSWORD, + AUTH_TYPE_KEYBOARD_INTERACTIVE, + AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET } type; - static int gotit, need_pw, can_pubkey, can_passwd; - static int tried_pubkey_config, tried_agent; + static int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter; + static int tried_pubkey_config, tried_agent, tried_keyb_inter; + static int kbd_inter_running; static int we_are_in; + static int num_prompts, echo; static char username[100]; static char pwprompt[200]; static char password[100]; @@ -3193,7 +3651,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) break; default: if (((c >= ' ' && c <= '~') || - ((unsigned char) c >= 160)) && pos < 40) { + ((unsigned char) c >= 160)) + && pos < sizeof(username)-1) { username[pos++] = c; c_write(&c, 1); } @@ -3229,6 +3688,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) tried_pubkey_config = FALSE; tried_agent = FALSE; + tried_keyb_inter = FALSE; + kbd_inter_running = FALSE; while (1) { /* @@ -3260,9 +3721,14 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) break; } - if (pktin.type != SSH2_MSG_USERAUTH_FAILURE) { - bombout( - ("Strange packet received during authentication: type %d", + if (kbd_inter_running && + pktin.type == SSH2_MSG_USERAUTH_INFO_REQUEST) { + /* + * This is a further prompt in keyboard-interactive + * authentication. Do nothing. + */ + } else if (pktin.type != SSH2_MSG_USERAUTH_FAILURE) { + bombout(("Strange packet received during authentication: type %d", pktin.type)); crReturnV; } @@ -3274,10 +3740,11 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) * we can look at the string in it and know what we can * helpfully try next. */ - { + if (pktin.type == SSH2_MSG_USERAUTH_FAILURE) { char *methods; int methlen; ssh2_pkt_getstring(&methods, &methlen); + kbd_inter_running = FALSE; if (!ssh2_pkt_getbool()) { /* * We have received an unequivocal Access @@ -3307,6 +3774,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) if (type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD) c_write_str("Server refused our key\r\n"); logevent("Server refused public key"); + } else if (type == AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) { + /* server declined keyboard-interactive; ignore */ } else { c_write_str("Access denied\r\n"); logevent("Access denied"); @@ -3324,10 +3793,66 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) in_commasep_string("publickey", methods, methlen); can_passwd = in_commasep_string("password", methods, methlen); + can_passwd = + in_commasep_string("password", methods, methlen); + can_keyb_inter = + in_commasep_string("keyboard-interactive", methods, methlen); } method = 0; + if (!method && can_keyb_inter && !tried_keyb_inter) { + method = AUTH_KEYBOARD_INTERACTIVE; + type = AUTH_TYPE_KEYBOARD_INTERACTIVE; + tried_keyb_inter = TRUE; + + ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST); + ssh2_pkt_addstring(username); + ssh2_pkt_addstring("ssh-connection"); /* service requested */ + ssh2_pkt_addstring("keyboard-interactive"); /* method */ + ssh2_pkt_addstring(""); /* lang */ + ssh2_pkt_addstring(""); + ssh2_pkt_send(); + + crWaitUntilV(ispkt); + if (pktin.type != SSH2_MSG_USERAUTH_INFO_REQUEST) { + if (pktin.type == SSH2_MSG_USERAUTH_FAILURE) + gotit = TRUE; + logevent("Keyboard-interactive authentication refused"); + type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET; + continue; + } + + kbd_inter_running = TRUE; + } + + if (kbd_inter_running) { + method = AUTH_KEYBOARD_INTERACTIVE; + type = AUTH_TYPE_KEYBOARD_INTERACTIVE; + tried_keyb_inter = TRUE; + + /* We've got packet with that "interactive" info + dump banners, and set its prompt as ours */ + { + char *name, *inst, *lang, *prompt; + int name_len, inst_len, lang_len, prompt_len; + ssh2_pkt_getstring(&name, &name_len); + ssh2_pkt_getstring(&inst, &inst_len); + ssh2_pkt_getstring(&lang, &lang_len); + if (name_len > 0) + c_write_untrusted(name, name_len); + if (inst_len > 0) + c_write_untrusted(inst, inst_len); + num_prompts = ssh2_pkt_getuint32(); + + ssh2_pkt_getstring(&prompt, &prompt_len); + strncpy(pwprompt, prompt, sizeof(pwprompt)); + need_pw = TRUE; + + echo = ssh2_pkt_getbool(); + } + } + if (!method && can_pubkey && agent_exists() && !tried_agent) { /* * Attempt public-key authentication using Pageant. @@ -3362,6 +3887,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) static int pklen, alglen, commentlen; static int siglen, retlen, len; static char *q, *agentreq, *ret; + void *vret; { char buf[64]; @@ -3440,7 +3966,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) q += pktout.length - 5; /* And finally the (zero) flags word. */ PUT_32BIT(q, 0); - agent_query(agentreq, len + 4, &ret, &retlen); + agent_query(agentreq, len + 4, &vret, &retlen); + ret = vret; sfree(agentreq); if (ret) { if (ret[4] == SSH2_AGENT_SIGN_RESPONSE) { @@ -3536,7 +4063,13 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) * command line which has already failed to * work). Terminate. */ - logevent("No more passwords to try"); + ssh2_pkt_init(SSH2_MSG_DISCONNECT); + ssh2_pkt_adduint32(SSH2_DISCONNECT_BY_APPLICATION); + ssh2_pkt_addstring + ("No more passwords available to try"); + ssh2_pkt_addstring("en"); /* language tag */ + ssh2_pkt_send(); + connection_fatal("Unable to authenticate"); ssh_state = SSH_STATE_CLOSED; crReturnV; } @@ -3544,7 +4077,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) static int pos = 0; static char c; - c_write_str(pwprompt); + c_write_untrusted(pwprompt, strlen(pwprompt)); ssh_send_ok = 1; pos = 0; @@ -3572,9 +4105,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) exit(0); break; default: - if (((c >= ' ' && c <= '~') || - ((unsigned char) c >= 160)) - && pos < 40) + if (pos < sizeof(password)-1) password[pos++] = c; break; } @@ -3707,6 +4238,13 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) ssh_pkt_defersend(); logevent("Sent password"); type = AUTH_TYPE_PASSWORD; + } else if (method == AUTH_KEYBOARD_INTERACTIVE) { + ssh2_pkt_init(SSH2_MSG_USERAUTH_INFO_RESPONSE); + ssh2_pkt_adduint32(num_prompts); + ssh2_pkt_addstring(password); + memset(password, 0, sizeof(password)); + ssh2_pkt_send(); + type = AUTH_TYPE_KEYBOARD_INTERACTIVE; } else { c_write_str ("No supported authentication methods left to try!\r\n"); @@ -3739,7 +4277,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN); ssh2_pkt_addstring("session"); ssh2_pkt_adduint32(mainchan->localid); - ssh2_pkt_adduint32(0x8000UL); /* our window size */ + mainchan->v.v2.locwindow = OUR_V2_WINSIZE; + ssh2_pkt_adduint32(mainchan->v.v2.locwindow); /* our window size */ ssh2_pkt_adduint32(0x4000UL); /* our max pkt size */ ssh2_pkt_send(); crWaitUntilV(ispkt); @@ -3755,10 +4294,9 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) mainchan->remoteid = ssh2_pkt_getuint32(); mainchan->type = CHAN_MAINSESSION; mainchan->closes = 0; - mainchan->v2.remwindow = ssh2_pkt_getuint32(); - mainchan->v2.remmaxpkt = ssh2_pkt_getuint32(); - mainchan->v2.outbuffer = NULL; - mainchan->v2.outbuflen = mainchan->v2.outbufsize = 0; + mainchan->v.v2.remwindow = ssh2_pkt_getuint32(); + mainchan->v.v2.remmaxpkt = ssh2_pkt_getuint32(); + bufchain_init(&mainchan->v.v2.outbuffer); add234(ssh_channels, mainchan); logevent("Opened channel for session"); @@ -3787,7 +4325,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) c = find234(ssh_channels, &i, ssh_channelfind); if (!c) continue; /* nonexistent channel */ - c->v2.remwindow += ssh2_pkt_getuint32(); + c->v.v2.remwindow += ssh2_pkt_getuint32(); } } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); @@ -3804,6 +4342,97 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } /* + * Enable port forwardings. + */ + { + static char *e; /* preserve across crReturn */ + char type; + int n; + int sport,dport; + char sports[256], dports[256], host[256]; + char buf[1024]; + + ssh_rportfwds = newtree234(ssh_rportcmp_ssh2); + /* Add port forwardings. */ + e = cfg.portfwd; + while (*e) { + type = *e++; + n = 0; + while (*e && *e != '\t') + sports[n++] = *e++; + sports[n] = 0; + if (*e == '\t') + e++; + n = 0; + while (*e && *e != ':') + host[n++] = *e++; + host[n] = 0; + if (*e == ':') + e++; + n = 0; + while (*e) + dports[n++] = *e++; + dports[n] = 0; + e++; + dport = atoi(dports); + sport = atoi(sports); + if (sport && dport) { + if (type == 'L') { + pfd_addforward(host, dport, sport); + sprintf(buf, "Local port %d forwarding to %s:%d", + sport, host, dport); + logevent(buf); + } else { + struct ssh_rportfwd *pf; + pf = smalloc(sizeof(*pf)); + strcpy(pf->dhost, host); + pf->dport = dport; + pf->sport = sport; + if (add234(ssh_rportfwds, pf) != pf) { + sprintf(buf, + "Duplicate remote port forwarding to %s:%d", + host, dport); + logevent(buf); + sfree(pf); + } else { + sprintf(buf, "Requesting remote port %d (forwarded to %s:%d)", + sport, host, dport); + logevent(buf); + ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST); + ssh2_pkt_addstring("tcpip-forward"); + ssh2_pkt_addbool(1);/* want reply */ + ssh2_pkt_addstring("127.0.0.1"); + ssh2_pkt_adduint32(sport); + ssh2_pkt_send(); + + do { + crWaitUntilV(ispkt); + if (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { + unsigned i = ssh2_pkt_getuint32(); + struct ssh_channel *c; + c = find234(ssh_channels, &i, ssh_channelfind); + if (!c) + continue;/* nonexistent channel */ + c->v.v2.remwindow += ssh2_pkt_getuint32(); + } + } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + + if (pktin.type != SSH2_MSG_REQUEST_SUCCESS) { + if (pktin.type != SSH2_MSG_REQUEST_FAILURE) { + bombout(("Server got confused by port forwarding request")); + crReturnV; + } + logevent("Server refused this port forwarding"); + } else { + logevent("Remote port forwarding enabled"); + } + } + } + } + } + } + + /* * Potentially enable agent forwarding. */ if (cfg.agentfwd && agent_exists()) { @@ -3822,7 +4451,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) c = find234(ssh_channels, &i, ssh_channelfind); if (!c) continue; /* nonexistent channel */ - c->v2.remwindow += ssh2_pkt_getuint32(); + c->v.v2.remwindow += ssh2_pkt_getuint32(); } } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); @@ -3865,7 +4494,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) c = find234(ssh_channels, &i, ssh_channelfind); if (!c) continue; /* nonexistent channel */ - c->v2.remwindow += ssh2_pkt_getuint32(); + c->v.v2.remwindow += ssh2_pkt_getuint32(); } } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); @@ -3884,43 +4513,70 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } /* - * Start a shell or a remote command. + * Start a shell or a remote command. We may have to attempt + * this twice if the config data has provided a second choice + * of command. */ - ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST); - ssh2_pkt_adduint32(mainchan->remoteid); /* recipient channel */ - if (cfg.ssh_subsys) { - ssh2_pkt_addstring("subsystem"); - ssh2_pkt_addbool(1); /* want reply */ - ssh2_pkt_addstring(cfg.remote_cmd_ptr); - } else if (*cfg.remote_cmd_ptr) { - ssh2_pkt_addstring("exec"); - ssh2_pkt_addbool(1); /* want reply */ - ssh2_pkt_addstring(cfg.remote_cmd_ptr); - } else { - ssh2_pkt_addstring("shell"); - ssh2_pkt_addbool(1); /* want reply */ - } - ssh2_pkt_send(); - do { - crWaitUntilV(ispkt); - if (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh2_pkt_getuint32(); - struct ssh_channel *c; - c = find234(ssh_channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v2.remwindow += ssh2_pkt_getuint32(); + while (1) { + int subsys; + char *cmd; + + if (ssh_fallback_cmd) { + subsys = cfg.ssh_subsys2; + cmd = cfg.remote_cmd_ptr2; + } else { + subsys = cfg.ssh_subsys; + cmd = cfg.remote_cmd_ptr; } - } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); - if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) { - if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) { - bombout(("Server got confused by shell/command request")); + + ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST); + ssh2_pkt_adduint32(mainchan->remoteid); /* recipient channel */ + if (subsys) { + ssh2_pkt_addstring("subsystem"); + ssh2_pkt_addbool(1); /* want reply */ + ssh2_pkt_addstring(cmd); + } else if (*cmd) { + ssh2_pkt_addstring("exec"); + ssh2_pkt_addbool(1); /* want reply */ + ssh2_pkt_addstring(cmd); + } else { + ssh2_pkt_addstring("shell"); + ssh2_pkt_addbool(1); /* want reply */ + } + ssh2_pkt_send(); + do { + crWaitUntilV(ispkt); + if (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { + unsigned i = ssh2_pkt_getuint32(); + struct ssh_channel *c; + c = find234(ssh_channels, &i, ssh_channelfind); + if (!c) + continue; /* nonexistent channel */ + c->v.v2.remwindow += ssh2_pkt_getuint32(); + } + } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) { + if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) { + bombout(("Server got confused by shell/command request")); + crReturnV; + } + /* + * We failed to start the command. If this is the + * fallback command, we really are finished; if it's + * not, and if the fallback command exists, try falling + * back to it before complaining. + */ + if (!ssh_fallback_cmd && cfg.remote_cmd_ptr2 != NULL) { + logevent("Primary command failed; attempting fallback"); + ssh_fallback_cmd = TRUE; + continue; + } + bombout(("Server refused to start a shell/command")); crReturnV; + } else { + logevent("Started a shell/command"); } - bombout(("Server refused to start a shell/command")); - crReturnV; - } else { - logevent("Started a shell/command"); + break; } ssh_state = SSH_STATE_SESSION; @@ -3953,14 +4609,20 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) continue; /* extended but not stderr */ ssh2_pkt_getstring(&data, &length); if (data) { + int bufsize; + c->v.v2.locwindow -= length; switch (c->type) { case CHAN_MAINSESSION: - from_backend(pktin.type == - SSH2_MSG_CHANNEL_EXTENDED_DATA, data, - length); + bufsize = + from_backend(pktin.type == + SSH2_MSG_CHANNEL_EXTENDED_DATA, + data, length); break; case CHAN_X11: - x11_send(c->u.x11.s, data, length); + bufsize = x11_send(c->u.x11.s, data, length); + break; + case CHAN_SOCKDATA: + bufsize = pfd_send(c->u.pfd.s, data, length); break; case CHAN_AGENT: while (length > 0) { @@ -4010,17 +4672,15 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) c->u.a.lensofar = 0; } } + bufsize = 0; break; } /* - * Enlarge the window again at the remote - * side, just in case it ever runs down and - * they fail to send us any more data. + * If we are not buffering too much data, + * enlarge the window again at the remote side. */ - ssh2_pkt_init(SSH2_MSG_CHANNEL_WINDOW_ADJUST); - ssh2_pkt_adduint32(c->remoteid); - ssh2_pkt_adduint32(length); - ssh2_pkt_send(); + if (bufsize < OUR_V2_WINSIZE) + ssh2_set_window(c, OUR_V2_WINSIZE - bufsize); } } else if (pktin.type == SSH2_MSG_DISCONNECT) { ssh_state = SSH_STATE_CLOSED; @@ -4045,6 +4705,9 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) sshfwd_close(c); } else if (c->type == CHAN_AGENT) { sshfwd_close(c); + } else if (c->type == CHAN_SOCKDATA) { + pfd_close(c->u.pfd.s); + sshfwd_close(c); } } else if (pktin.type == SSH2_MSG_CHANNEL_CLOSE) { unsigned i = ssh2_pkt_getuint32(); @@ -4066,9 +4729,11 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) break; case CHAN_AGENT: break; + case CHAN_SOCKDATA: + break; } del234(ssh_channels, c); - sfree(c->v2.outbuffer); + bufchain_clear(&c->v.v2.outbuffer); sfree(c); /* @@ -4091,16 +4756,36 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) c = find234(ssh_channels, &i, ssh_channelfind); if (!c) continue; /* nonexistent channel */ - c->v2.remwindow += ssh2_pkt_getuint32(); + c->v.v2.remwindow += ssh2_pkt_getuint32(); try_send = TRUE; + } else if (pktin.type == SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) { + unsigned i = ssh2_pkt_getuint32(); + struct ssh_channel *c; + c = find234(ssh_channels, &i, ssh_channelfind); + if (!c) + continue; /* nonexistent channel */ + if (c->type != CHAN_SOCKDATA_DORMANT) + continue; /* dunno why they're confirming this */ + c->remoteid = ssh2_pkt_getuint32(); + c->type = CHAN_SOCKDATA; + c->closes = 0; + c->v.v2.remwindow = ssh2_pkt_getuint32(); + c->v.v2.remmaxpkt = ssh2_pkt_getuint32(); + bufchain_init(&c->v.v2.outbuffer); + pfd_confirm(c->u.pfd.s); } else if (pktin.type == SSH2_MSG_CHANNEL_OPEN) { char *type; int typelen; char *error = NULL; struct ssh_channel *c; + unsigned remid, winsize, pktsize; ssh2_pkt_getstring(&type, &typelen); c = smalloc(sizeof(struct ssh_channel)); + remid = ssh2_pkt_getuint32(); + winsize = ssh2_pkt_getuint32(); + pktsize = ssh2_pkt_getuint32(); + if (typelen == 3 && !memcmp(type, "x11", 3)) { if (!ssh_X11_fwd_enabled) error = "X11 forwarding is not enabled"; @@ -4110,6 +4795,32 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } else { c->type = CHAN_X11; } + } else if (typelen == 15 && + !memcmp(type, "forwarded-tcpip", 15)) { + struct ssh_rportfwd pf, *realpf; + char *dummy; + int dummylen; + ssh2_pkt_getstring(&dummy, &dummylen);/* skip address */ + pf.sport = ssh2_pkt_getuint32(); + realpf = find234(ssh_rportfwds, &pf, NULL); + if (realpf == NULL) { + error = "Remote port is not recognised"; + } else { + char *e = pfd_newconnect(&c->u.pfd.s, realpf->dhost, + realpf->dport, c); + char buf[1024]; + sprintf(buf, "Received remote port open request for %s:%d", + realpf->dhost, realpf->dport); + logevent(buf); + if (e != NULL) { + sprintf(buf, "Port open failed: %s", e); + logevent(buf); + error = "Port open failed"; + } else { + logevent("Forwarded port opened successfully"); + c->type = CHAN_SOCKDATA; + } + } } else if (typelen == 22 && !memcmp(type, "auth-agent@openssh.com", 3)) { if (!ssh_agentfwd_enabled) @@ -4122,7 +4833,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) error = "Unsupported channel type requested"; } - c->remoteid = ssh2_pkt_getuint32(); + c->remoteid = remid; if (error) { ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE); ssh2_pkt_adduint32(c->remoteid); @@ -4134,15 +4845,15 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } else { c->localid = alloc_channel_id(); c->closes = 0; - c->v2.remwindow = ssh2_pkt_getuint32(); - c->v2.remmaxpkt = ssh2_pkt_getuint32(); - c->v2.outbuffer = NULL; - c->v2.outbuflen = c->v2.outbufsize = 0; + c->v.v2.locwindow = OUR_V2_WINSIZE; + c->v.v2.remwindow = winsize; + c->v.v2.remmaxpkt = pktsize; + bufchain_init(&c->v.v2.outbuffer); add234(ssh_channels, c); ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); ssh2_pkt_adduint32(c->remoteid); ssh2_pkt_adduint32(c->localid); - ssh2_pkt_adduint32(0x8000UL); /* our window size */ + ssh2_pkt_adduint32(c->v.v2.locwindow); ssh2_pkt_adduint32(0x4000UL); /* our max pkt size */ ssh2_pkt_send(); } @@ -4163,8 +4874,27 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) /* * Try to send data on all channels if we can. */ - for (i = 0; NULL != (c = index234(ssh_channels, i)); i++) - ssh2_try_send(c); + for (i = 0; NULL != (c = index234(ssh_channels, i)); i++) { + int bufsize = ssh2_try_send(c); + if (bufsize == 0) { + switch (c->type) { + case CHAN_MAINSESSION: + /* stdin need not receive an unthrottle + * notification since it will be polled */ + break; + case CHAN_X11: + x11_unthrottle(c->u.x11.s); + break; + case CHAN_AGENT: + /* agent sockets are request/response and need no + * buffer management */ + break; + case CHAN_SOCKDATA: + pfd_unthrottle(c->u.pfd.s); + break; + } + } + } } } @@ -4198,6 +4928,9 @@ static char *ssh_init(char *host, int port, char **realhost) ssh_send_ok = 0; ssh_editing = 0; ssh_echoing = 0; + ssh1_throttle_count = 0; + ssh_overall_bufsize = 0; + ssh_fallback_cmd = 0; p = connect_to_host(host, port, realhost); if (p != NULL) @@ -4209,12 +4942,44 @@ static char *ssh_init(char *host, int port, char **realhost) /* * Called to send data down the Telnet connection. */ -static void ssh_send(char *buf, int len) +static int ssh_send(char *buf, int len) { if (s == NULL || ssh_protocol == NULL) - return; + return 0; ssh_protocol(buf, len, 0); + + return ssh_sendbuffer(); +} + +/* + * Called to query the current amount of buffered stdin data. + */ +static int ssh_sendbuffer(void) +{ + int override_value; + + if (s == NULL || ssh_protocol == NULL) + return 0; + + /* + * If the SSH socket itself has backed up, add the total backup + * size on that to any individual buffer on the stdin channel. + */ + override_value = 0; + if (ssh_throttled_all) + override_value = ssh_overall_bufsize; + + if (ssh_version == 1) { + return override_value; + } else if (ssh_version == 2) { + if (!mainchan || mainchan->closes > 0) + return override_value; + else + return override_value + bufchain_size(&mainchan->v.v2.outbuffer); + } + + return 0; } /* @@ -4292,6 +5057,76 @@ static void ssh_special(Telnet_Special code) } } +void *new_sock_channel(Socket s) +{ + struct ssh_channel *c; + c = smalloc(sizeof(struct ssh_channel)); + + if (c) { + c->remoteid = -1; /* to be set when open confirmed */ + c->localid = alloc_channel_id(); + c->closes = 0; + c->type = CHAN_SOCKDATA_DORMANT;/* identify channel type */ + c->u.pfd.s = s; + add234(ssh_channels, c); + } + return c; +} + +/* + * This is called when stdout/stderr (the entity to which + * from_backend sends data) manages to clear some backlog. + */ +void ssh_unthrottle(int bufsize) +{ + if (ssh_version == 1) { + if (bufsize < SSH1_BUFFER_LIMIT) { + ssh1_stdout_throttling = 0; + ssh1_throttle(-1); + } + } else { + if (mainchan && mainchan->closes == 0) + ssh2_set_window(mainchan, OUR_V2_WINSIZE - bufsize); + } +} + +void ssh_send_port_open(void *channel, char *hostname, int port, char *org) +{ + struct ssh_channel *c = (struct ssh_channel *)channel; + char buf[1024]; + + sprintf(buf, "Opening forwarded connection to %.512s:%d", hostname, port); + logevent(buf); + + if (ssh_version == 1) { + send_packet(SSH1_MSG_PORT_OPEN, + PKT_INT, c->localid, + PKT_STR, hostname, + PKT_INT, port, + //PKT_STR, , + PKT_END); + } else { + ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN); + ssh2_pkt_addstring("direct-tcpip"); + ssh2_pkt_adduint32(c->localid); + c->v.v2.locwindow = OUR_V2_WINSIZE; + ssh2_pkt_adduint32(c->v.v2.locwindow);/* our window size */ + ssh2_pkt_adduint32(0x4000UL); /* our max pkt size */ + ssh2_pkt_addstring(hostname); + ssh2_pkt_adduint32(port); + /* + * We make up values for the originator data; partly it's + * too much hassle to keep track, and partly I'm not + * convinced the server should be told details like that + * about my local network configuration. + */ + ssh2_pkt_addstring("client-side-connection"); + ssh2_pkt_adduint32(0); + ssh2_pkt_send(); + } +} + + static Socket ssh_socket(void) { return s; @@ -4314,10 +5149,12 @@ static int ssh_ldisc(int option) Backend ssh_backend = { ssh_init, ssh_send, + ssh_sendbuffer, ssh_size, ssh_special, ssh_socket, ssh_sendok, ssh_ldisc, + ssh_unthrottle, 22 };