X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/590f6a5ffcb58408a57a82ee2f70e686421a53ed..055817455466c8eb60392f30bb7c689763962e17:/ssh.c diff --git a/ssh.c b/ssh.c index 700aa70d..170253b2 100644 --- a/ssh.c +++ b/ssh.c @@ -104,7 +104,7 @@ * Packet type contexts, so that ssh2_pkt_type can correctly decode * the ambiguous type numbers back into the correct type strings. */ -#define SSH2_PKTCTX_DHGROUP1 0x0001 +#define SSH2_PKTCTX_DHGROUP 0x0001 #define SSH2_PKTCTX_DHGEX 0x0002 #define SSH2_PKTCTX_PUBLICKEY 0x0010 #define SSH2_PKTCTX_PASSWORD 0x0020 @@ -162,7 +162,7 @@ static const char *const ssh2_disconnect_reasons[] = { #define BUG_CHOKES_ON_RSA 8 #define BUG_SSH2_RSA_PADDING 16 #define BUG_SSH2_DERIVEKEY 32 -#define BUG_SSH2_DH_GEX 64 +/* 64 was BUG_SSH2_DH_GEX, now spare */ #define BUG_SSH2_PK_SESSIONID 128 #define translate(x) if (type == x) return #x @@ -222,8 +222,8 @@ static char *ssh2_pkt_type(int pkt_ctx, int type) translate(SSH2_MSG_SERVICE_ACCEPT); translate(SSH2_MSG_KEXINIT); translate(SSH2_MSG_NEWKEYS); - translatec(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP1); - translatec(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP1); + translatec(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP); + translatec(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP); translatec(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX); translatec(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX); translatec(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX); @@ -360,11 +360,6 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, #define SSH_MAX_BACKLOG 32768 #define OUR_V2_WINSIZE 16384 -const static struct ssh_kex *kex_algs[] = { - &ssh_diffiehellman_gex, - &ssh_diffiehellman -}; - const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss }; static void *nullmac_make_context(void) @@ -499,23 +494,48 @@ struct ssh_channel { * of its ports was connected to; and _you_ have to remember what * local host:port pair went with that port number. * - * Hence: in SSH 1 this structure stores host:port pairs we intend - * to allow connections to, and is indexed by those host:port - * pairs. In SSH 2 it stores a mapping from source port to - * destination host:port pair, and is indexed by source port. + * Hence, in SSH 1 this structure is indexed by destination + * host:port pair, whereas in SSH 2 it is indexed by source port. */ +struct ssh_portfwd; /* forward declaration */ + struct ssh_rportfwd { unsigned sport, dport; char dhost[256]; + char *sportdesc; + struct ssh_portfwd *pfrec; +}; +#define free_rportfwd(pf) ( \ + ((pf) ? (sfree((pf)->sportdesc)) : (void)0 ), sfree(pf) ) + +/* + * Separately to the rportfwd tree (which is for looking up port + * open requests from the server), a tree of _these_ structures is + * used to keep track of all the currently open port forwardings, + * so that we can reconfigure in mid-session if the user requests + * it. + */ +struct ssh_portfwd { + int keep; + int type; + unsigned sport, dport; + char *saddr, *daddr; + struct ssh_rportfwd *remote; + int addressfamily; + void *local; }; +#define free_portfwd(pf) ( \ + ((pf) ? (sfree((pf)->saddr), sfree((pf)->daddr)) : (void)0 ), sfree(pf) ) struct Packet { long length; int type; + unsigned long sequence; unsigned char *data; unsigned char *body; long savedpos; long maxlen; + long encrypted_len; /* for SSH2 total-size counting */ /* * State associated with packet logging @@ -529,6 +549,8 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, struct Packet *pktin); static void ssh2_protocol(Ssh ssh, unsigned char *in, int inlen, struct Packet *pktin); +static void ssh1_protocol_setup(Ssh ssh); +static void ssh2_protocol_setup(Ssh ssh); static void ssh_size(void *handle, int width, int height); static void ssh_special(void *handle, Telnet_Special); static int ssh2_try_send(struct ssh_channel *c); @@ -540,6 +562,9 @@ static void ssh_do_close(Ssh ssh); static unsigned long ssh_pkt_getuint32(struct Packet *pkt); static int ssh2_pkt_getbool(struct Packet *pkt); static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length); +static void ssh2_timer(void *ctx, long now); +static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, + struct Packet *pktin); struct rdpkt1_state_tag { long len, pad, biglen, to_read; @@ -558,6 +583,17 @@ struct rdpkt2_state_tag { struct Packet *pktin; }; +typedef void (*handler_fn_t)(Ssh ssh, struct Packet *pktin); +typedef void (*chandler_fn_t)(Ssh ssh, struct Packet *pktin, void *ctx); + +struct queued_handler; +struct queued_handler { + int msg1, msg2; + chandler_fn_t handler; + void *ctx; + struct queued_handler *next; +}; + struct ssh_tag { const struct plug_function_table *fn; /* the above field _must_ be first in the structure */ @@ -604,7 +640,7 @@ struct ssh_tag { struct ssh_channel *mainchan; /* primary session channel */ int exitcode; - tree234 *rportfwds; + tree234 *rportfwds, *portfwds; enum { SSH_STATE_PREPACKET, @@ -638,7 +674,6 @@ struct ssh_tag { int userpass_input_bufpos; int userpass_input_echo; - char *portfwd_strptr; int pkt_ctx; void *x11auth; @@ -654,8 +689,8 @@ struct ssh_tag { int ssh2_rdpkt_crstate; int do_ssh_init_crstate; int ssh_gotdata_crstate; - int ssh1_protocol_crstate; int do_ssh1_login_crstate; + int do_ssh1_connection_crstate; int do_ssh2_transport_crstate; int do_ssh2_authconn_crstate; @@ -667,6 +702,9 @@ struct ssh_tag { struct rdpkt1_state_tag rdpkt1_state; struct rdpkt2_state_tag rdpkt2_state; + /* ssh1 and ssh2 use this for different things, but both use it */ + int protocol_initial_phase_done; + void (*protocol) (Ssh ssh, unsigned char *in, int inlen, struct Packet *pkt); struct Packet *(*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen); @@ -684,6 +722,32 @@ struct ssh_tag { */ void *agent_response; int agent_response_len; + + /* + * Dispatch table for packet types that we may have to deal + * with at any time. + */ + handler_fn_t packet_dispatch[256]; + + /* + * Queues of one-off handler functions for success/failure + * indications from a request. + */ + struct queued_handler *qhead, *qtail; + + /* + * This module deals with sending keepalives. + */ + Pinger pinger; + + /* + * Track incoming and outgoing data sizes and time, for + * size-based rekeys. + */ + unsigned long incoming_data_size, outgoing_data_size, deferred_data_size; + unsigned long max_data_size; + int kex_in_progress; + long next_rekey, last_rekey; }; #define logevent(s) logevent(ssh->frontend, s) @@ -776,6 +840,47 @@ static int ssh_rportcmp_ssh2(void *av, void *bv) return 0; } +/* + * Special form of strcmp which can cope with NULL inputs. NULL is + * defined to sort before even the empty string. + */ +static int nullstrcmp(const char *a, const char *b) +{ + if (a == NULL && b == NULL) + return 0; + if (a == NULL) + return -1; + if (b == NULL) + return +1; + return strcmp(a, b); +} + +static int ssh_portcmp(void *av, void *bv) +{ + struct ssh_portfwd *a = (struct ssh_portfwd *) av; + struct ssh_portfwd *b = (struct ssh_portfwd *) bv; + int i; + if (a->type > b->type) + return +1; + if (a->type < b->type) + return -1; + if ( (i = nullstrcmp(a->saddr, b->saddr)) != 0) + return i < 0 ? -1 : +1; + if (a->sport > b->sport) + return +1; + if (a->sport < b->sport) + return -1; + if (a->type != 'D') { + if ( (i = nullstrcmp(a->daddr, b->daddr)) != 0) + return i < 0 ? -1 : +1; + if (a->dport > b->dport) + return +1; + if (a->dport < b->dport) + return -1; + } + return 0; +} + static int alloc_channel_id(Ssh ssh) { const unsigned CHANNEL_NUMBER_OFFSET = 256; @@ -873,8 +978,6 @@ static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen) crBegin(ssh->ssh1_rdpkt_crstate); - next_packet: - st->pktin = ssh_new_packet(); st->pktin->type = 0; @@ -992,48 +1095,6 @@ static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen) nblanks, &blank); } - if (st->pktin->type == SSH1_SMSG_STDOUT_DATA || - st->pktin->type == SSH1_SMSG_STDERR_DATA || - st->pktin->type == SSH1_MSG_DEBUG || - st->pktin->type == SSH1_SMSG_AUTH_TIS_CHALLENGE || - st->pktin->type == SSH1_SMSG_AUTH_CCARD_CHALLENGE) { - long stringlen = GET_32BIT(st->pktin->body); - if (stringlen + 4 != st->pktin->length) { - bombout(("Received data packet with bogus string length")); - ssh_free_packet(st->pktin); - crStop(NULL); - } - } - - if (st->pktin->type == SSH1_MSG_DEBUG) { - char *buf, *msg; - int msglen; - - ssh_pkt_getstring(st->pktin, &msg, &msglen); - buf = dupprintf("Remote debug message: %.*s", msglen, msg); - logevent(buf); - sfree(buf); - - ssh_free_packet(st->pktin); - goto next_packet; - } else if (st->pktin->type == SSH1_MSG_IGNORE) { - /* do nothing */ - ssh_free_packet(st->pktin); - goto next_packet; - } - - if (st->pktin->type == SSH1_MSG_DISCONNECT) { - /* log reason code in disconnect message */ - char *msg; - int msglen; - - ssh_pkt_getstring(st->pktin, &msg, &msglen); - - bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg)); - ssh_free_packet(st->pktin); - crStop(NULL); - } - crFinish(st->pktin); } @@ -1043,8 +1104,6 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) crBegin(ssh->ssh2_rdpkt_crstate); - next_packet: - st->pktin = ssh_new_packet(); st->pktin->type = 0; @@ -1126,6 +1185,8 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) st->pktin->data + st->cipherblk, st->packetlen - st->cipherblk); + st->pktin->encrypted_len = st->packetlen; + /* * Check the MAC. */ @@ -1136,7 +1197,8 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) ssh_free_packet(st->pktin); crStop(NULL); } - st->incoming_sequence++; /* whether or not we MACed */ + + st->pktin->sequence = st->incoming_sequence++; /* * Decompress packet payload. @@ -1191,115 +1253,6 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) nblanks, &blank); } - switch (st->pktin->type) { - /* - * These packets we must handle instantly. - */ - case SSH2_MSG_DISCONNECT: - { - /* log reason code in disconnect message */ - char *buf, *msg; - int nowlen, reason, msglen; - - reason = ssh_pkt_getuint32(st->pktin); - ssh_pkt_getstring(st->pktin, &msg, &msglen); - - if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) { - buf = dupprintf("Received disconnect message (%s)", - ssh2_disconnect_reasons[reason]); - } else { - buf = dupprintf("Received disconnect message (unknown" - " type %d)", reason); - } - logevent(buf); - sfree(buf); - buf = dupprintf("Disconnection message text: %n%.*s", - &nowlen, msglen, msg); - logevent(buf); - bombout(("Server sent disconnect message\ntype %d (%s):\n\"%s\"", - reason, - (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ? - ssh2_disconnect_reasons[reason] : "unknown", - buf+nowlen)); - sfree(buf); - ssh_free_packet(st->pktin); - crStop(NULL); - } - break; - case SSH2_MSG_IGNORE: - ssh_free_packet(st->pktin); - goto next_packet; - case SSH2_MSG_DEBUG: - { - /* log the debug message */ - char *buf, *msg; - int msglen; - int always_display; - - /* XXX maybe we should actually take notice of this */ - always_display = ssh2_pkt_getbool(st->pktin); - ssh_pkt_getstring(st->pktin, &msg, &msglen); - - buf = dupprintf("Remote debug message: %.*s", msglen, msg); - logevent(buf); - sfree(buf); - } - ssh_free_packet(st->pktin); - goto next_packet; - - /* - * These packets we need do nothing about here. - */ - case SSH2_MSG_UNIMPLEMENTED: - case SSH2_MSG_SERVICE_REQUEST: - case SSH2_MSG_SERVICE_ACCEPT: - case SSH2_MSG_KEXINIT: - case SSH2_MSG_NEWKEYS: - case SSH2_MSG_KEXDH_INIT: - case SSH2_MSG_KEXDH_REPLY: - /* case SSH2_MSG_KEX_DH_GEX_REQUEST: duplicate case value */ - /* case SSH2_MSG_KEX_DH_GEX_GROUP: duplicate case value */ - case SSH2_MSG_KEX_DH_GEX_INIT: - case SSH2_MSG_KEX_DH_GEX_REPLY: - case SSH2_MSG_USERAUTH_REQUEST: - case SSH2_MSG_USERAUTH_FAILURE: - case SSH2_MSG_USERAUTH_SUCCESS: - case SSH2_MSG_USERAUTH_BANNER: - case SSH2_MSG_USERAUTH_PK_OK: - /* case SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ: duplicate case value */ - /* case SSH2_MSG_USERAUTH_INFO_REQUEST: duplicate case value */ - case SSH2_MSG_USERAUTH_INFO_RESPONSE: - case SSH2_MSG_GLOBAL_REQUEST: - case SSH2_MSG_REQUEST_SUCCESS: - case SSH2_MSG_REQUEST_FAILURE: - case SSH2_MSG_CHANNEL_OPEN: - case SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: - case SSH2_MSG_CHANNEL_OPEN_FAILURE: - case SSH2_MSG_CHANNEL_WINDOW_ADJUST: - case SSH2_MSG_CHANNEL_DATA: - case SSH2_MSG_CHANNEL_EXTENDED_DATA: - case SSH2_MSG_CHANNEL_EOF: - case SSH2_MSG_CHANNEL_CLOSE: - case SSH2_MSG_CHANNEL_REQUEST: - case SSH2_MSG_CHANNEL_SUCCESS: - case SSH2_MSG_CHANNEL_FAILURE: - break; - - /* - * For anything else we send SSH2_MSG_UNIMPLEMENTED. - */ - default: - { - struct Packet *pktout; - pktout = ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED); - ssh2_pkt_adduint32(pktout, st->incoming_sequence - 1); - /* UNIMPLEMENTED messages MUST appear in the same order as - * the messages they respond to. Hence, never queue them. */ - ssh2_pkt_send_noqueue(ssh, pktout); - } - break; - } - crFinish(st->pktin); } @@ -1727,6 +1680,8 @@ static int ssh2_pkt_construct(Ssh ssh, struct Packet *pkt) ssh->cscipher->encrypt(ssh->cs_cipher_ctx, pkt->data, pkt->length + padding); + pkt->encrypted_len = pkt->length + padding; + /* Ready-to-send packet starts at pkt->data. We return length. */ return pkt->length + padding + maclen; } @@ -1771,6 +1726,14 @@ static void ssh2_pkt_send_noqueue(Ssh ssh, struct Packet *pkt) backlog = sk_write(ssh->s, (char *)pkt->data, len); if (backlog > SSH_MAX_BACKLOG) ssh_throttle_all(ssh, 1, backlog); + + ssh->outgoing_data_size += pkt->encrypted_len; + if (!ssh->kex_in_progress && + ssh->max_data_size != 0 && + ssh->outgoing_data_size > ssh->max_data_size) + do_ssh2_transport(ssh, "Initiating key re-exchange " + "(too much data sent)", -1, NULL); + ssh_free_packet(pkt); } @@ -1788,6 +1751,7 @@ static void ssh2_pkt_defer_noqueue(Ssh ssh, struct Packet *pkt) } memcpy(ssh->deferred_send_data + ssh->deferred_len, pkt->data, len); ssh->deferred_len += len; + ssh->deferred_data_size += pkt->encrypted_len; ssh_free_packet(pkt); } @@ -1853,6 +1817,14 @@ static void ssh_pkt_defersend(Ssh ssh) ssh->deferred_send_data = NULL; if (backlog > SSH_MAX_BACKLOG) ssh_throttle_all(ssh, 1, backlog); + + ssh->outgoing_data_size += ssh->deferred_data_size; + if (!ssh->kex_in_progress && + ssh->max_data_size != 0 && + ssh->outgoing_data_size > ssh->max_data_size) + do_ssh2_transport(ssh, "Initiating key re-exchange " + "(too much data sent)", -1, NULL); + ssh->deferred_data_size = 0; } /* @@ -2158,13 +2130,28 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring) ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID; logevent("We believe remote version has SSH2 public-key-session-ID bug"); } +} - if (ssh->cfg.sshbug_dhgex2 == FORCE_ON) { - /* - * User specified the SSH2 DH GEX bug. - */ - ssh->remote_bugs |= BUG_SSH2_DH_GEX; - logevent("We believe remote version has SSH2 DH group exchange bug"); +/* + * The `software version' part of an SSH version string is required + * to contain no spaces or minus signs. + */ +static void ssh_fix_verstring(char *str) +{ + /* Eat "SSH--". */ + assert(*str == 'S'); str++; + assert(*str == 'S'); str++; + assert(*str == 'H'); str++; + assert(*str == '-'); str++; + while (*str && *str != '-') str++; + assert(*str == '-'); str++; + + /* Convert minus signs and spaces in the remaining string into + * underscores. */ + while (*str) { + if (*str == '-' || *str == ' ') + *str = '_'; + str++; } } @@ -2227,7 +2214,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c) ssh->rdpkt2_state.incoming_sequence = 0; s->vstring[s->vslen] = 0; - s->vstring[strcspn(s->vstring, "\r\n")] = '\0';/* remove EOL chars */ + s->vstring[strcspn(s->vstring, "\015\012")] = '\0';/* remove EOL chars */ { char *vlog; vlog = snewn(20 + s->vslen, char); @@ -2255,46 +2242,63 @@ static int do_ssh_init(Ssh ssh, unsigned char c) crStop(0); } - if (s->proto2 && (ssh->cfg.sshprot >= 2 || !s->proto1)) { - /* - * Use v2 protocol. - */ - char verstring[80], vlog[100]; - sprintf(verstring, "SSH-2.0-%s", sshver); - SHA_Init(&ssh->exhashbase); - /* - * Hash our version string and their version string. - */ - sha_string(&ssh->exhashbase, verstring, strlen(verstring)); - sha_string(&ssh->exhashbase, s->vstring, strcspn(s->vstring, "\r\n")); - sprintf(vlog, "We claim version: %s", verstring); - logevent(vlog); - strcat(verstring, "\012"); - logevent("Using SSH protocol version 2"); - sk_write(ssh->s, verstring, strlen(verstring)); - ssh->protocol = ssh2_protocol; - ssh->version = 2; - ssh->s_rdpkt = ssh2_rdpkt; - } else { - /* - * Use v1 protocol. - */ - char verstring[80], vlog[100]; - sprintf(verstring, "SSH-%s-%s", - (ssh_versioncmp(s->version, "1.5") <= 0 ? s->version : "1.5"), - sshver); - sprintf(vlog, "We claim version: %s", verstring); - logevent(vlog); - strcat(verstring, "\012"); + { + char *verstring; + + if (s->proto2 && (ssh->cfg.sshprot >= 2 || !s->proto1)) { + /* + * Construct a v2 version string. + */ + verstring = dupprintf("SSH-2.0-%s\015\012", sshver); + ssh->version = 2; + } else { + /* + * Construct a v1 version string. + */ + verstring = dupprintf("SSH-%s-%s\012", + (ssh_versioncmp(s->version, "1.5") <= 0 ? + s->version : "1.5"), + sshver); + ssh->version = 1; + } - logevent("Using SSH protocol version 1"); + ssh_fix_verstring(verstring); + + if (ssh->version == 2) { + /* + * Hash our version string and their version string. + */ + SHA_Init(&ssh->exhashbase); + sha_string(&ssh->exhashbase, verstring, + strcspn(verstring, "\015\012")); + sha_string(&ssh->exhashbase, s->vstring, + strcspn(s->vstring, "\015\012")); + + /* + * Initialise SSHv2 protocol. + */ + ssh->protocol = ssh2_protocol; + ssh2_protocol_setup(ssh); + ssh->s_rdpkt = ssh2_rdpkt; + } else { + /* + * Initialise SSHv1 protocol. + */ + ssh->protocol = ssh1_protocol; + ssh1_protocol_setup(ssh); + ssh->s_rdpkt = ssh1_rdpkt; + } + logeventf(ssh, "We claim version: %.*s", + strcspn(verstring, "\015\012"), verstring); sk_write(ssh->s, verstring, strlen(verstring)); - ssh->protocol = ssh1_protocol; - ssh->version = 1; - ssh->s_rdpkt = ssh1_rdpkt; + sfree(verstring); } + + logeventf(ssh, "Using SSH protocol version %d", ssh->version); + update_specials_menu(ssh->frontend); ssh->state = SSH_STATE_BEFORE_SIZE; + ssh->pinger = pinger_new(&ssh->cfg, &ssh_backend, ssh); sfree(s->vstring); @@ -2354,6 +2358,7 @@ static void ssh_do_close(Ssh ssh) if (ssh->s) { sk_close(ssh->s); ssh->s = NULL; + notify_remote_exit(ssh->frontend); } /* * Now we must shut down any port and X forwardings going @@ -2445,8 +2450,11 @@ static const char *connect_to_host(Ssh ssh, char *host, int port, /* * Try to find host. */ - logeventf(ssh, "Looking up host \"%s\"", host); - addr = name_lookup(host, port, realhost, &ssh->cfg); + logeventf(ssh, "Looking up host \"%s\"%s", host, + (ssh->cfg.addressfamily == ADDRTYPE_IPV4 ? " (IPv4)" : + (ssh->cfg.addressfamily == ADDRTYPE_IPV6 ? " (IPv6)" : ""))); + addr = name_lookup(host, port, realhost, &ssh->cfg, + ssh->cfg.addressfamily); if ((err = sk_addr_error(addr)) != NULL) { sk_addr_free(addr); return err; @@ -2465,6 +2473,7 @@ static const char *connect_to_host(Ssh ssh, char *host, int port, 0, 1, nodelay, keepalive, (Plug) ssh, &ssh->cfg); if ((err = sk_socket_error(ssh->s)) != NULL) { ssh->s = NULL; + notify_remote_exit(ssh->frontend); return err; } @@ -2819,7 +2828,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, /* Warn about chosen cipher if necessary. */ if (warn) - askcipher(ssh->frontend, cipher_string, 0); + askalg(ssh->frontend, "cipher", cipher_string); } switch (s->cipher_type) { @@ -3574,243 +3583,807 @@ void sshfwd_unthrottle(struct ssh_channel *c, int bufsize) } } -static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, - struct Packet *pktin) +static void ssh_queueing_handler(Ssh ssh, struct Packet *pktin) { - crBegin(ssh->ssh1_protocol_crstate); + struct queued_handler *qh = ssh->qhead; - random_init(); + assert(qh != NULL); - while (!do_ssh1_login(ssh, in, inlen, pktin)) { - crReturnV; + assert(pktin->type == qh->msg1 || pktin->type == qh->msg2); + + if (qh->msg1 > 0) { + assert(ssh->packet_dispatch[qh->msg1] == ssh_queueing_handler); + ssh->packet_dispatch[qh->msg1] = NULL; + } + if (qh->msg2 > 0) { + assert(ssh->packet_dispatch[qh->msg2] == ssh_queueing_handler); + ssh->packet_dispatch[qh->msg2] = NULL; } - if (ssh->state == SSH_STATE_CLOSED) - crReturnV; - if (ssh->cfg.agentfwd && agent_exists()) { - logevent("Requesting agent forwarding"); - send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END); - do { - crReturnV; - } while (!pktin); - if (pktin->type != SSH1_SMSG_SUCCESS - && pktin->type != SSH1_SMSG_FAILURE) { - bombout(("Protocol confusion")); - crStopV; - } else if (pktin->type == SSH1_SMSG_FAILURE) { - logevent("Agent forwarding refused"); - } else { - logevent("Agent forwarding enabled"); - ssh->agentfwd_enabled = TRUE; + if (qh->next) { + ssh->qhead = qh->next; + + if (ssh->qhead->msg1 > 0) { + assert(ssh->packet_dispatch[ssh->qhead->msg1] == NULL); + ssh->packet_dispatch[ssh->qhead->msg1] = ssh_queueing_handler; } + if (ssh->qhead->msg2 > 0) { + assert(ssh->packet_dispatch[ssh->qhead->msg2] == NULL); + ssh->packet_dispatch[ssh->qhead->msg2] = ssh_queueing_handler; + } + } else { + ssh->qhead = ssh->qtail = NULL; + ssh->packet_dispatch[pktin->type] = NULL; } - if (ssh->cfg.x11_forward) { - char proto[20], data[64]; - logevent("Requesting X11 forwarding"); - ssh->x11auth = x11_invent_auth(proto, sizeof(proto), - data, sizeof(data), ssh->cfg.x11_auth); - x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display); - if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) { - send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING, - PKT_STR, proto, PKT_STR, data, - PKT_INT, x11_get_screen_number(ssh->cfg.x11_display), - PKT_END); - } else { - send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING, - PKT_STR, proto, PKT_STR, data, PKT_END); + qh->handler(ssh, pktin, qh->ctx); + + sfree(qh); +} + +static void ssh_queue_handler(Ssh ssh, int msg1, int msg2, + chandler_fn_t handler, void *ctx) +{ + struct queued_handler *qh; + + qh = snew(struct queued_handler); + qh->msg1 = msg1; + qh->msg2 = msg2; + qh->handler = handler; + qh->ctx = ctx; + qh->next = NULL; + + if (ssh->qtail == NULL) { + ssh->qhead = qh; + + if (qh->msg1 > 0) { + assert(ssh->packet_dispatch[qh->msg1] == NULL); + ssh->packet_dispatch[qh->msg1] = ssh_queueing_handler; } - do { - crReturnV; - } while (!pktin); - if (pktin->type != SSH1_SMSG_SUCCESS - && pktin->type != SSH1_SMSG_FAILURE) { - bombout(("Protocol confusion")); - crStopV; - } else if (pktin->type == SSH1_SMSG_FAILURE) { - logevent("X11 forwarding refused"); - } else { - logevent("X11 forwarding enabled"); - ssh->X11_fwd_enabled = TRUE; + if (qh->msg2 > 0) { + assert(ssh->packet_dispatch[qh->msg2] == NULL); + ssh->packet_dispatch[qh->msg2] = ssh_queueing_handler; } + } else { + ssh->qtail->next = qh; } + ssh->qtail = qh; +} - { - char type; - int n; - int sport,dport,sserv,dserv; - char sports[256], dports[256], saddr[256], host[256]; - - ssh->rportfwds = newtree234(ssh_rportcmp_ssh1); - /* Add port forwardings. */ - ssh->portfwd_strptr = ssh->cfg.portfwd; - while (*ssh->portfwd_strptr) { - type = *ssh->portfwd_strptr++; - saddr[0] = '\0'; - n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') { - if (*ssh->portfwd_strptr == ':') { - /* - * We've seen a colon in the middle of the - * source port number. This means that - * everything we've seen until now is the - * source _address_, so we'll move it into - * saddr and start sports from the beginning - * again. - */ - ssh->portfwd_strptr++; - sports[n] = '\0'; +static void ssh_rportfwd_succfail(Ssh ssh, struct Packet *pktin, void *ctx) +{ + struct ssh_rportfwd *rpf, *pf = (struct ssh_rportfwd *)ctx; + + if (pktin->type == (ssh->version == 1 ? SSH1_SMSG_SUCCESS : + SSH2_MSG_REQUEST_SUCCESS)) { + logeventf(ssh, "Remote port forwarding from %s enabled", + pf->sportdesc); + } else { + logeventf(ssh, "Remote port forwarding from %s refused", + pf->sportdesc); + + rpf = del234(ssh->rportfwds, pf); + assert(rpf == pf); + free_rportfwd(pf); + } +} + +static void ssh_setup_portfwd(Ssh ssh, const Config *cfg) +{ + char address_family, type; + int n; + int sport,dport,sserv,dserv; + char sports[256], dports[256], saddr[256], host[256]; + const char *portfwd_strptr; + + portfwd_strptr = cfg->portfwd; + + if (!ssh->portfwds) { + ssh->portfwds = newtree234(ssh_portcmp); + } else { + /* + * Go through the existing port forwardings and tag them + * with keep==FALSE. Any that we want to keep will be + * re-enabled as we go through the configuration and find + * out which bits are the same as they were before. + */ + struct ssh_portfwd *epf; + int i; + for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++) + epf->keep = FALSE; + } + + while (*portfwd_strptr) { + address_family = 'A'; + type = 'L'; + while (*portfwd_strptr && *portfwd_strptr != '\t') { + if (*portfwd_strptr == 'A' || + *portfwd_strptr == '4' || + *portfwd_strptr == '6') + address_family = *portfwd_strptr; + else if (*portfwd_strptr == 'L' || + *portfwd_strptr == 'R' || + *portfwd_strptr == 'D') + type = *portfwd_strptr; + portfwd_strptr++; + } + + saddr[0] = '\0'; + + n = 0; + while (*portfwd_strptr && *portfwd_strptr != '\t') { + if (*portfwd_strptr == ':') { + /* + * We've seen a colon in the middle of the + * source port number. This means that + * everything we've seen until now is the + * source _address_, so we'll move it into + * saddr and start sports from the beginning + * again. + */ + portfwd_strptr++; + sports[n] = '\0'; + if (ssh->version == 1 && type == 'R') { + logeventf(ssh, "SSH1 cannot handle remote source address " + "spec \"%s\"; ignoring", sports); + } else strcpy(saddr, sports); - n = 0; - } - if (n < 255) sports[n++] = *ssh->portfwd_strptr++; - } - sports[n] = 0; - if (type != 'D') { - if (*ssh->portfwd_strptr == '\t') - ssh->portfwd_strptr++; - n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') { - if (n < 255) host[n++] = *ssh->portfwd_strptr++; - } - host[n] = 0; - if (*ssh->portfwd_strptr == ':') - ssh->portfwd_strptr++; n = 0; - while (*ssh->portfwd_strptr) { - if (n < 255) dports[n++] = *ssh->portfwd_strptr++; - } - dports[n] = 0; - ssh->portfwd_strptr++; - dport = atoi(dports); - dserv = 0; - if (dport == 0) { - dserv = 1; - dport = net_service_lookup(dports); - if (!dport) { - logeventf(ssh, "Service lookup failed for" - " destination port \"%s\"", dports); - } - } - } else { - while (*ssh->portfwd_strptr) ssh->portfwd_strptr++; - dport = dserv = -1; - ssh->portfwd_strptr++; /* eat the NUL and move to next one */ } - sport = atoi(sports); - sserv = 0; - if (sport == 0) { - sserv = 1; - sport = net_service_lookup(sports); - if (!sport) { - logeventf(ssh, "Service lookup failed for source" - " port \"%s\"", sports); + if (n < 255) sports[n++] = *portfwd_strptr++; + } + sports[n] = 0; + if (type != 'D') { + if (*portfwd_strptr == '\t') + portfwd_strptr++; + n = 0; + while (*portfwd_strptr && *portfwd_strptr != ':') { + if (n < 255) host[n++] = *portfwd_strptr++; + } + host[n] = 0; + if (*portfwd_strptr == ':') + portfwd_strptr++; + n = 0; + while (*portfwd_strptr) { + if (n < 255) dports[n++] = *portfwd_strptr++; + } + dports[n] = 0; + portfwd_strptr++; + dport = atoi(dports); + dserv = 0; + if (dport == 0) { + dserv = 1; + dport = net_service_lookup(dports); + if (!dport) { + logeventf(ssh, "Service lookup failed for destination" + " port \"%s\"", dports); } } - if (sport && dport) { - /* Set up a description of the source port. */ - static char *sportdesc; - sportdesc = dupprintf("%.*s%.*s%.*s%.*s%d%.*s", - (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL, - (int)(*saddr?1:0), ":", - (int)(sserv ? strlen(sports) : 0), sports, - sserv, "(", sport, sserv, ")"); - if (type == 'L') { - /* Verbose description of the destination port */ - char *dportdesc = dupprintf("%s:%.*s%.*s%d%.*s", - host, - (int)(dserv ? strlen(dports) : 0), dports, - dserv, "(", dport, dserv, ")"); - const char *err = pfd_addforward(host, dport, - *saddr ? saddr : NULL, - sport, ssh, &ssh->cfg); - if (err) { - logeventf(ssh, "Local port %s forward to %s" - " failed: %s", sportdesc, dportdesc, err); - } else { - logeventf(ssh, "Local port %s forwarding to %s", - sportdesc, dportdesc); - } - sfree(dportdesc); - } else if (type == 'D') { - const char *err = pfd_addforward(NULL, -1, - *saddr ? saddr : NULL, - sport, ssh, &ssh->cfg); - if (err) { - logeventf(ssh, "Local port %s SOCKS dynamic forward" - " setup failed: %s", sportdesc, err); - } else { - logeventf(ssh, "Local port %s doing SOCKS" - " dynamic forwarding", sportdesc); - } - } else { - struct ssh_rportfwd *pf; - pf = snew(struct ssh_rportfwd); - strcpy(pf->dhost, host); - pf->dport = dport; - if (*saddr) { - logeventf(ssh, - "SSH1 cannot handle source address spec \"%s:%d\"; ignoring", - saddr, sport); - } - if (add234(ssh->rportfwds, pf) != pf) { - logeventf(ssh, - "Duplicate remote port forwarding to %s:%d", - host, dport); - sfree(pf); - } else { - logeventf(ssh, "Requesting remote port %.*s%.*s%d%.*s" - " forward to %s:%.*s%.*s%d%.*s", + } else { + while (*portfwd_strptr) portfwd_strptr++; + dport = dserv = -1; + portfwd_strptr++; /* eat the NUL and move to next one */ + } + sport = atoi(sports); + sserv = 0; + if (sport == 0) { + sserv = 1; + sport = net_service_lookup(sports); + if (!sport) { + logeventf(ssh, "Service lookup failed for source" + " port \"%s\"", sports); + } + } + if (sport && dport) { + /* Set up a description of the source port. */ + struct ssh_portfwd *pfrec, *epfrec; + char *sportdesc; + sportdesc = dupprintf("%.*s%.*s%.*s%.*s%d%.*s", + (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL, + (int)(*saddr?1:0), ":", (int)(sserv ? strlen(sports) : 0), sports, - sserv, "(", sport, sserv, ")", - host, - (int)(dserv ? strlen(dports) : 0), dports, - dserv, "(", dport, dserv, ")"); + sserv, "(", sport, sserv, ")"); + + pfrec = snew(struct ssh_portfwd); + pfrec->type = type; + pfrec->saddr = *saddr ? dupstr(saddr) : NULL; + pfrec->sport = sport; + pfrec->daddr = dupstr(host); + pfrec->dport = dport; + pfrec->local = NULL; + pfrec->remote = NULL; + pfrec->addressfamily = (address_family == '4' ? ADDRTYPE_IPV4 : + address_family == '6' ? ADDRTYPE_IPV6 : + ADDRTYPE_UNSPEC); + + epfrec = add234(ssh->portfwds, pfrec); + if (epfrec != pfrec) { + /* + * We already have a port forwarding with precisely + * these parameters. Hence, no need to do anything; + * simply tag the existing one as `keep'. + */ + epfrec->keep = TRUE; + free_portfwd(pfrec); + } else if (type == 'L') { + /* Verbose description of the destination port */ + char *dportdesc = dupprintf("%s:%.*s%.*s%d%.*s", + host, + (int)(dserv ? strlen(dports) : 0), dports, + dserv, "(", dport, dserv, ")"); + const char *err = pfd_addforward(host, dport, + *saddr ? saddr : NULL, + sport, ssh, &ssh->cfg, + &pfrec->local, + pfrec->addressfamily); + + logeventf(ssh, "Local %sport %s forward to %s%s%s", + pfrec->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " : + pfrec->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "", + sportdesc, dportdesc, + err ? " failed: " : "", err); + + sfree(dportdesc); + } else if (type == 'D') { + const char *err = pfd_addforward(NULL, -1, + *saddr ? saddr : NULL, + sport, ssh, &ssh->cfg, + &pfrec->local, + pfrec->addressfamily); + + logeventf(ssh, "Local %sport %s SOCKS dynamic forward%s%s", + pfrec->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " : + pfrec->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "", + sportdesc, + err ? " setup failed: " : "", err); + } else { + struct ssh_rportfwd *pf; + + /* + * Ensure the remote port forwardings tree exists. + */ + if (!ssh->rportfwds) { + if (ssh->version == 1) + ssh->rportfwds = newtree234(ssh_rportcmp_ssh1); + else + ssh->rportfwds = newtree234(ssh_rportcmp_ssh2); + } + + pf = snew(struct ssh_rportfwd); + strcpy(pf->dhost, host); + pf->dport = dport; + pf->sport = sport; + if (add234(ssh->rportfwds, pf) != pf) { + logeventf(ssh, "Duplicate remote port forwarding to %s:%d", + host, dport); + sfree(pf); + } else { + logeventf(ssh, "Requesting remote port %s" + " forward to %s:%.*s%.*s%d%.*s", + sportdesc, host, + (int)(dserv ? strlen(dports) : 0), dports, + dserv, "(", dport, dserv, ")"); + + pf->sportdesc = sportdesc; + sportdesc = NULL; + pfrec->remote = pf; + pf->pfrec = pfrec; + + if (ssh->version == 1) { send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST, PKT_INT, sport, PKT_STR, host, PKT_INT, dport, PKT_END); - do { - crReturnV; - } while (!pktin); - if (pktin->type != SSH1_SMSG_SUCCESS - && pktin->type != SSH1_SMSG_FAILURE) { - bombout(("Protocol confusion")); - crStopV; - } else if (pktin->type == SSH1_SMSG_FAILURE) { - c_write_str(ssh, "Server refused port" - " forwarding\r\n"); + ssh_queue_handler(ssh, SSH1_SMSG_SUCCESS, + SSH1_SMSG_FAILURE, + ssh_rportfwd_succfail, pf); + } else { + struct Packet *pktout; + pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST); + ssh2_pkt_addstring(pktout, "tcpip-forward"); + ssh2_pkt_addbool(pktout, 1);/* want reply */ + if (*saddr) { + ssh2_pkt_addstring(pktout, saddr); + } else if (ssh->cfg.rport_acceptall) { + ssh2_pkt_addstring(pktout, "0.0.0.0"); + } else { + ssh2_pkt_addstring(pktout, "127.0.0.1"); } - logevent("Remote port forwarding enabled"); + ssh2_pkt_adduint32(pktout, sport); + ssh2_pkt_send(ssh, pktout); + + ssh_queue_handler(ssh, SSH2_MSG_REQUEST_SUCCESS, + SSH2_MSG_REQUEST_FAILURE, + ssh_rportfwd_succfail, pf); } } - sfree(sportdesc); } + sfree(sportdesc); } } - if (!ssh->cfg.nopty) { - /* Unpick the terminal-speed string. */ - /* XXX perhaps we should allow no speeds to be sent. */ - ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */ - sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed); - /* Send the pty request. */ - send_packet(ssh, SSH1_CMSG_REQUEST_PTY, - PKT_STR, ssh->cfg.termtype, - PKT_INT, ssh->term_height, - PKT_INT, ssh->term_width, - PKT_INT, 0, PKT_INT, 0, /* width,height in pixels */ - PKT_CHAR, 192, PKT_INT, ssh->ispeed, /* TTY_OP_ISPEED */ - PKT_CHAR, 193, PKT_INT, ssh->ospeed, /* TTY_OP_OSPEED */ - PKT_CHAR, 0, PKT_END); - ssh->state = SSH_STATE_INTERMED; - do { - crReturnV; - } while (!pktin); - if (pktin->type != SSH1_SMSG_SUCCESS - && pktin->type != SSH1_SMSG_FAILURE) { - bombout(("Protocol confusion")); + /* + * Now go through and destroy any port forwardings which were + * not re-enabled. + */ + { + struct ssh_portfwd *epf; + int i; + for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++) + if (!epf->keep) { + char *message; + + message = dupprintf("%s port forwarding from %s%s%d", + epf->type == 'L' ? "local" : + epf->type == 'R' ? "remote" : "dynamic", + epf->saddr ? epf->saddr : "", + epf->saddr ? ":" : "", + epf->sport); + + if (epf->type != 'D') { + char *msg2 = dupprintf("%s to %s:%d", message, + epf->daddr, epf->dport); + sfree(message); + message = msg2; + } + + logeventf(ssh, "Cancelling %s", message); + sfree(message); + + if (epf->remote) { + struct ssh_rportfwd *rpf = epf->remote; + struct Packet *pktout; + + /* + * Cancel the port forwarding at the server + * end. + */ + if (ssh->version == 1) { + /* + * We cannot cancel listening ports on the + * server side in SSH1! There's no message + * to support it. Instead, we simply remove + * the rportfwd record from the local end + * so that any connections the server tries + * to make on it are rejected. + */ + } else { + pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST); + ssh2_pkt_addstring(pktout, "cancel-tcpip-forward"); + ssh2_pkt_addbool(pktout, 0);/* _don't_ want reply */ + if (epf->saddr) { + ssh2_pkt_addstring(pktout, epf->saddr); + } else if (ssh->cfg.rport_acceptall) { + ssh2_pkt_addstring(pktout, "0.0.0.0"); + } else { + ssh2_pkt_addstring(pktout, "127.0.0.1"); + } + ssh2_pkt_adduint32(pktout, epf->sport); + ssh2_pkt_send(ssh, pktout); + } + + del234(ssh->rportfwds, rpf); + free_rportfwd(rpf); + } else if (epf->local) { + pfd_terminate(epf->local); + } + + delpos234(ssh->portfwds, i); + free_portfwd(epf); + i--; /* so we don't skip one in the list */ + } + } +} + +static void ssh1_smsg_stdout_stderr_data(Ssh ssh, struct Packet *pktin) +{ + char *string; + int stringlen, bufsize; + + ssh_pkt_getstring(pktin, &string, &stringlen); + if (string == NULL) { + bombout(("Incoming terminal data packet was badly formed")); + return; + } + + bufsize = from_backend(ssh->frontend, pktin->type == SSH1_SMSG_STDERR_DATA, + string, stringlen); + if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) { + ssh->v1_stdout_throttling = 1; + ssh1_throttle(ssh, +1); + } +} + +static void ssh1_smsg_x11_open(Ssh ssh, struct Packet *pktin) +{ + /* Remote side is trying to open a channel to talk to our + * X-Server. Give them back a local channel number. */ + struct ssh_channel *c; + int remoteid = ssh_pkt_getuint32(pktin); + + logevent("Received X11 connect request"); + /* Refuse if X11 forwarding is disabled. */ + if (!ssh->X11_fwd_enabled) { + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, remoteid, PKT_END); + logevent("Rejected X11 connect request"); + } else { + c = snew(struct ssh_channel); + c->ssh = ssh; + + if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c, + ssh->x11auth, NULL, -1, &ssh->cfg) != NULL) { + logevent("Opening X11 forward connection failed"); + sfree(c); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, remoteid, PKT_END); + } else { + logevent + ("Opening X11 forward connection succeeded"); + c->remoteid = remoteid; + c->localid = alloc_channel_id(ssh); + c->closes = 0; + c->v.v1.throttling = 0; + c->type = CHAN_X11; /* identify channel type */ + add234(ssh->channels, c); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, + PKT_INT, c->remoteid, PKT_INT, + c->localid, PKT_END); + logevent("Opened X11 forward channel"); + } + } +} + +static void ssh1_smsg_agent_open(Ssh ssh, struct Packet *pktin) +{ + /* Remote side is trying to open a channel to talk to our + * agent. Give them back a local channel number. */ + struct ssh_channel *c; + int remoteid = ssh_pkt_getuint32(pktin); + + /* Refuse if agent forwarding is disabled. */ + if (!ssh->agentfwd_enabled) { + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, remoteid, PKT_END); + } else { + c = snew(struct ssh_channel); + c->ssh = ssh; + c->remoteid = remoteid; + c->localid = alloc_channel_id(ssh); + c->closes = 0; + c->v.v1.throttling = 0; + c->type = CHAN_AGENT; /* identify channel type */ + c->u.a.lensofar = 0; + add234(ssh->channels, c); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, + PKT_INT, c->remoteid, PKT_INT, c->localid, + PKT_END); + } +} + +static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin) +{ + /* Remote side is trying to open a channel to talk to a + * forwarded port. Give them back a local channel number. */ + struct ssh_channel *c; + struct ssh_rportfwd pf, *pfp; + int remoteid; + int hostsize, port; + char *host, buf[1024]; + const char *e; + c = snew(struct ssh_channel); + c->ssh = ssh; + + remoteid = ssh_pkt_getuint32(pktin); + ssh_pkt_getstring(pktin, &host, &hostsize); + port = ssh_pkt_getuint32(pktin); + + if (hostsize >= lenof(pf.dhost)) + hostsize = lenof(pf.dhost)-1; + memcpy(pf.dhost, host, hostsize); + pf.dhost[hostsize] = '\0'; + pf.dport = port; + pfp = find234(ssh->rportfwds, &pf, NULL); + + if (pfp == NULL) { + sprintf(buf, "Rejected remote port open request for %s:%d", + pf.dhost, port); + logevent(buf); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, remoteid, PKT_END); + } else { + sprintf(buf, "Received remote port open request for %s:%d", + pf.dhost, port); + logevent(buf); + e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port, + c, &ssh->cfg, pfp->pfrec->addressfamily); + if (e != NULL) { + char buf[256]; + sprintf(buf, "Port open failed: %s", e); + logevent(buf); + sfree(c); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, remoteid, PKT_END); + } else { + c->remoteid = remoteid; + c->localid = alloc_channel_id(ssh); + c->closes = 0; + c->v.v1.throttling = 0; + c->type = CHAN_SOCKDATA; /* identify channel type */ + add234(ssh->channels, c); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, + PKT_INT, c->remoteid, PKT_INT, + c->localid, PKT_END); + logevent("Forwarded port opened successfully"); + } + } +} + +static void ssh1_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin) +{ + unsigned int remoteid = ssh_pkt_getuint32(pktin); + unsigned int localid = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + + c = find234(ssh->channels, &remoteid, ssh_channelfind); + if (c && c->type == CHAN_SOCKDATA_DORMANT) { + c->remoteid = localid; + c->type = CHAN_SOCKDATA; + c->v.v1.throttling = 0; + pfd_confirm(c->u.pfd.s); + } + + if (c && c->closes) { + /* + * We have a pending close on this channel, + * which we decided on before the server acked + * the channel open. So now we know the + * remoteid, we can close it again. + */ + send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, + PKT_INT, c->remoteid, PKT_END); + } +} + +static void ssh1_msg_channel_open_failure(Ssh ssh, struct Packet *pktin) +{ + unsigned int remoteid = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + + c = find234(ssh->channels, &remoteid, ssh_channelfind); + if (c && c->type == CHAN_SOCKDATA_DORMANT) { + logevent("Forwarded connection refused by server"); + pfd_close(c->u.pfd.s); + del234(ssh->channels, c); + sfree(c); + } +} + +static void ssh1_msg_channel_close(Ssh ssh, struct Packet *pktin) +{ + /* Remote side closes a channel. */ + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + c = find234(ssh->channels, &i, ssh_channelfind); + if (c && ((int)c->remoteid) != -1) { + int closetype; + closetype = + (pktin->type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2); + + if ((c->closes == 0) && (c->type == CHAN_X11)) { + logevent("Forwarded X11 connection terminated"); + assert(c->u.x11.s != NULL); + x11_close(c->u.x11.s); + c->u.x11.s = NULL; + } + if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) { + logevent("Forwarded port closed"); + assert(c->u.pfd.s != NULL); + pfd_close(c->u.pfd.s); + c->u.pfd.s = NULL; + } + + c->closes |= (closetype << 2); /* seen this message */ + if (!(c->closes & closetype)) { + send_packet(ssh, pktin->type, PKT_INT, c->remoteid, + PKT_END); + c->closes |= closetype; /* sent it too */ + } + + if (c->closes == 15) { + del234(ssh->channels, c); + sfree(c); + } + } else { + bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n", + pktin->type == SSH1_MSG_CHANNEL_CLOSE ? "" : + "_CONFIRMATION", c ? "half-open" : "nonexistent", + i)); + } +} + +static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin) +{ + /* Data sent down one of our channels. */ + int i = ssh_pkt_getuint32(pktin); + char *p; + unsigned int len; + struct ssh_channel *c; + + ssh_pkt_getstring(pktin, &p, &len); + + c = find234(ssh->channels, &i, ssh_channelfind); + if (c) { + int bufsize = 0; + switch (c->type) { + case CHAN_X11: + bufsize = x11_send(c->u.x11.s, p, len); + break; + case CHAN_SOCKDATA: + bufsize = pfd_send(c->u.pfd.s, p, len); + break; + case CHAN_AGENT: + /* Data for an agent message. Buffer it. */ + while (len > 0) { + if (c->u.a.lensofar < 4) { + unsigned int l = min(4 - c->u.a.lensofar, len); + memcpy(c->u.a.msglen + c->u.a.lensofar, p, + l); + p += l; + len -= l; + c->u.a.lensofar += l; + } + if (c->u.a.lensofar == 4) { + c->u.a.totallen = + 4 + GET_32BIT(c->u.a.msglen); + c->u.a.message = snewn(c->u.a.totallen, + unsigned char); + memcpy(c->u.a.message, c->u.a.msglen, 4); + } + if (c->u.a.lensofar >= 4 && len > 0) { + unsigned int l = + min(c->u.a.totallen - c->u.a.lensofar, + len); + memcpy(c->u.a.message + c->u.a.lensofar, p, + l); + p += l; + len -= l; + c->u.a.lensofar += l; + } + if (c->u.a.lensofar == c->u.a.totallen) { + void *reply; + int replylen; + if (agent_query(c->u.a.message, + c->u.a.totallen, + &reply, &replylen, + ssh_agentf_callback, c)) + ssh_agentf_callback(c, reply, replylen); + sfree(c->u.a.message); + c->u.a.lensofar = 0; + } + } + bufsize = 0; /* agent channels never back up */ + break; + } + if (!c->v.v1.throttling && bufsize > SSH1_BUFFER_LIMIT) { + c->v.v1.throttling = 1; + ssh1_throttle(ssh, +1); + } + } +} + +static void ssh1_smsg_exit_status(Ssh ssh, struct Packet *pktin) +{ + char buf[100]; + ssh->exitcode = ssh_pkt_getuint32(pktin); + sprintf(buf, "Server sent command exit status %d", + ssh->exitcode); + logevent(buf); + send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END); + /* + * In case `helpful' firewalls or proxies tack + * extra human-readable text on the end of the + * session which we might mistake for another + * encrypted packet, we close the session once + * we've sent EXIT_CONFIRMATION. + */ + ssh_closing((Plug)ssh, NULL, 0, 0); +} + +static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen, + struct Packet *pktin) +{ + crBegin(ssh->do_ssh1_connection_crstate); + + ssh->packet_dispatch[SSH1_SMSG_STDOUT_DATA] = + ssh->packet_dispatch[SSH1_SMSG_STDERR_DATA] = + ssh1_smsg_stdout_stderr_data; + + ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_CONFIRMATION] = + ssh1_msg_channel_open_confirmation; + ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_FAILURE] = + ssh1_msg_channel_open_failure; + ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE] = + ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION] = + ssh1_msg_channel_close; + ssh->packet_dispatch[SSH1_MSG_CHANNEL_DATA] = ssh1_msg_channel_data; + ssh->packet_dispatch[SSH1_SMSG_EXIT_STATUS] = ssh1_smsg_exit_status; + + if (ssh->cfg.agentfwd && agent_exists()) { + logevent("Requesting agent forwarding"); + send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END); + do { + crReturnV; + } while (!pktin); + if (pktin->type != SSH1_SMSG_SUCCESS + && pktin->type != SSH1_SMSG_FAILURE) { + bombout(("Protocol confusion")); + crStopV; + } else if (pktin->type == SSH1_SMSG_FAILURE) { + logevent("Agent forwarding refused"); + } else { + logevent("Agent forwarding enabled"); + ssh->agentfwd_enabled = TRUE; + ssh->packet_dispatch[SSH1_SMSG_AGENT_OPEN] = ssh1_smsg_agent_open; + } + } + + if (ssh->cfg.x11_forward) { + char proto[20], data[64]; + logevent("Requesting X11 forwarding"); + ssh->x11auth = x11_invent_auth(proto, sizeof(proto), + data, sizeof(data), ssh->cfg.x11_auth); + x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display); + if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) { + send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING, + PKT_STR, proto, PKT_STR, data, + PKT_INT, x11_get_screen_number(ssh->cfg.x11_display), + PKT_END); + } else { + send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING, + PKT_STR, proto, PKT_STR, data, PKT_END); + } + do { + crReturnV; + } while (!pktin); + if (pktin->type != SSH1_SMSG_SUCCESS + && pktin->type != SSH1_SMSG_FAILURE) { + bombout(("Protocol confusion")); + crStopV; + } else if (pktin->type == SSH1_SMSG_FAILURE) { + logevent("X11 forwarding refused"); + } else { + logevent("X11 forwarding enabled"); + ssh->X11_fwd_enabled = TRUE; + ssh->packet_dispatch[SSH1_SMSG_X11_OPEN] = ssh1_smsg_x11_open; + } + } + + ssh_setup_portfwd(ssh, &ssh->cfg); + ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = ssh1_msg_port_open; + + if (!ssh->cfg.nopty) { + /* Unpick the terminal-speed string. */ + /* XXX perhaps we should allow no speeds to be sent. */ + ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */ + sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed); + /* Send the pty request. */ + send_packet(ssh, SSH1_CMSG_REQUEST_PTY, + PKT_STR, ssh->cfg.termtype, + PKT_INT, ssh->term_height, + PKT_INT, ssh->term_width, + PKT_INT, 0, PKT_INT, 0, /* width,height in pixels */ + PKT_CHAR, 192, PKT_INT, ssh->ispeed, /* TTY_OP_ISPEED */ + PKT_CHAR, 193, PKT_INT, ssh->ospeed, /* TTY_OP_OSPEED */ + PKT_CHAR, 0, PKT_END); + ssh->state = SSH_STATE_INTERMED; + do { + crReturnV; + } while (!pktin); + if (pktin->type != SSH1_SMSG_SUCCESS + && pktin->type != SSH1_SMSG_FAILURE) { + bombout(("Protocol confusion")); crStopV; } else if (pktin->type == SSH1_SMSG_FAILURE) { c_write_str(ssh, "Server refused to allocate pty\r\n"); @@ -3874,313 +4447,20 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, ssh->send_ok = 1; ssh->channels = newtree234(ssh_channelcmp); while (1) { - crReturnV; - if (pktin) { - if (pktin->type == SSH1_SMSG_STDOUT_DATA || - pktin->type == SSH1_SMSG_STDERR_DATA) { - char *string; - int stringlen, bufsize; - - ssh_pkt_getstring(pktin, &string, &stringlen); - if (string == NULL) { - bombout(("Incoming terminal data packet was badly formed")); - crStopV; - } - - bufsize = - from_backend(ssh->frontend, - pktin->type == SSH1_SMSG_STDERR_DATA, - string, stringlen); - if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) { - ssh->v1_stdout_throttling = 1; - ssh1_throttle(ssh, +1); - } - } else if (pktin->type == SSH1_MSG_DISCONNECT) { - ssh_closing((Plug)ssh, NULL, 0, 0); - logevent("Received disconnect request"); - crStopV; - } else if (pktin->type == SSH1_SMSG_X11_OPEN) { - /* Remote side is trying to open a channel to talk to our - * X-Server. Give them back a local channel number. */ - struct ssh_channel *c; - int remoteid = ssh_pkt_getuint32(pktin); - - logevent("Received X11 connect request"); - /* Refuse if X11 forwarding is disabled. */ - if (!ssh->X11_fwd_enabled) { - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, - PKT_INT, remoteid, PKT_END); - logevent("Rejected X11 connect request"); - } else { - c = snew(struct ssh_channel); - c->ssh = ssh; - - if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c, - ssh->x11auth, NULL, -1, &ssh->cfg) != NULL) { - logevent("Opening X11 forward connection failed"); - sfree(c); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, - PKT_INT, remoteid, PKT_END); - } else { - logevent - ("Opening X11 forward connection succeeded"); - c->remoteid = remoteid; - c->localid = alloc_channel_id(ssh); - c->closes = 0; - c->v.v1.throttling = 0; - c->type = CHAN_X11; /* identify channel type */ - add234(ssh->channels, c); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, - PKT_INT, c->remoteid, PKT_INT, - c->localid, PKT_END); - logevent("Opened X11 forward channel"); - } - } - } else if (pktin->type == SSH1_SMSG_AGENT_OPEN) { - /* Remote side is trying to open a channel to talk to our - * agent. Give them back a local channel number. */ - struct ssh_channel *c; - int remoteid = ssh_pkt_getuint32(pktin); - - /* Refuse if agent forwarding is disabled. */ - if (!ssh->agentfwd_enabled) { - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, - PKT_INT, remoteid, PKT_END); - } else { - c = snew(struct ssh_channel); - c->ssh = ssh; - c->remoteid = remoteid; - c->localid = alloc_channel_id(ssh); - c->closes = 0; - c->v.v1.throttling = 0; - c->type = CHAN_AGENT; /* identify channel type */ - c->u.a.lensofar = 0; - add234(ssh->channels, c); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, - PKT_INT, c->remoteid, PKT_INT, c->localid, - PKT_END); - } - } else if (pktin->type == SSH1_MSG_PORT_OPEN) { - /* Remote side is trying to open a channel to talk to a - * forwarded port. Give them back a local channel number. */ - struct ssh_channel *c; - struct ssh_rportfwd pf; - int remoteid; - int hostsize, port; - char *host, buf[1024]; - const char *e; - c = snew(struct ssh_channel); - c->ssh = ssh; - - remoteid = ssh_pkt_getuint32(pktin); - ssh_pkt_getstring(pktin, &host, &hostsize); - port = ssh_pkt_getuint32(pktin); - - if (hostsize >= lenof(pf.dhost)) - hostsize = lenof(pf.dhost)-1; - memcpy(pf.dhost, host, hostsize); - pf.dhost[hostsize] = '\0'; - pf.dport = port; - - if (find234(ssh->rportfwds, &pf, NULL) == NULL) { - sprintf(buf, "Rejected remote port open request for %s:%d", - pf.dhost, port); - logevent(buf); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, - PKT_INT, remoteid, PKT_END); - } else { - sprintf(buf, "Received remote port open request for %s:%d", - pf.dhost, port); - logevent(buf); - e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port, - c, &ssh->cfg); - if (e != NULL) { - char buf[256]; - sprintf(buf, "Port open failed: %s", e); - logevent(buf); - sfree(c); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, - PKT_INT, remoteid, PKT_END); - } else { - c->remoteid = remoteid; - c->localid = alloc_channel_id(ssh); - c->closes = 0; - c->v.v1.throttling = 0; - c->type = CHAN_SOCKDATA; /* identify channel type */ - add234(ssh->channels, c); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, - PKT_INT, c->remoteid, PKT_INT, - c->localid, PKT_END); - logevent("Forwarded port opened successfully"); - } - } - - } else if (pktin->type == SSH1_MSG_CHANNEL_OPEN_CONFIRMATION) { - unsigned int remoteid = ssh_pkt_getuint32(pktin); - unsigned int localid = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - - c = find234(ssh->channels, &remoteid, ssh_channelfind); - if (c && c->type == CHAN_SOCKDATA_DORMANT) { - c->remoteid = localid; - c->type = CHAN_SOCKDATA; - c->v.v1.throttling = 0; - pfd_confirm(c->u.pfd.s); - } - - if (c && c->closes) { - /* - * We have a pending close on this channel, - * which we decided on before the server acked - * the channel open. So now we know the - * remoteid, we can close it again. - */ - send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, - PKT_INT, c->remoteid, PKT_END); - } - - } else if (pktin->type == SSH1_MSG_CHANNEL_OPEN_FAILURE) { - unsigned int remoteid = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - - c = find234(ssh->channels, &remoteid, ssh_channelfind); - if (c && c->type == CHAN_SOCKDATA_DORMANT) { - logevent("Forwarded connection refused by server"); - pfd_close(c->u.pfd.s); - del234(ssh->channels, c); - sfree(c); - } - } else if (pktin->type == SSH1_MSG_CHANNEL_CLOSE || - pktin->type == SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION) { - /* Remote side closes a channel. */ - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (c && ((int)c->remoteid) != -1) { - int closetype; - closetype = - (pktin->type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2); - - if ((c->closes == 0) && (c->type == CHAN_X11)) { - logevent("Forwarded X11 connection terminated"); - assert(c->u.x11.s != NULL); - x11_close(c->u.x11.s); - c->u.x11.s = NULL; - } - if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) { - logevent("Forwarded port closed"); - assert(c->u.pfd.s != NULL); - pfd_close(c->u.pfd.s); - c->u.pfd.s = NULL; - } - - c->closes |= (closetype << 2); /* seen this message */ - if (!(c->closes & closetype)) { - send_packet(ssh, pktin->type, PKT_INT, c->remoteid, - PKT_END); - c->closes |= closetype; /* sent it too */ - } + /* + * By this point, most incoming packets are already being + * handled by the dispatch table, and we need only pay + * attention to the unusual ones. + */ - if (c->closes == 15) { - del234(ssh->channels, c); - sfree(c); - } - } else { - bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n", - pktin->type == SSH1_MSG_CHANNEL_CLOSE ? "" : - "_CONFIRMATION", c ? "half-open" : "nonexistent", - i)); - crStopV; - } - } else if (pktin->type == SSH1_MSG_CHANNEL_DATA) { - /* Data sent down one of our channels. */ - int i = ssh_pkt_getuint32(pktin); - char *p; - int len; - struct ssh_channel *c; - - ssh_pkt_getstring(pktin, &p, &len); - - c = find234(ssh->channels, &i, ssh_channelfind); - if (c) { - int bufsize = 0; - switch (c->type) { - case CHAN_X11: - bufsize = x11_send(c->u.x11.s, p, len); - break; - case CHAN_SOCKDATA: - bufsize = pfd_send(c->u.pfd.s, p, len); - break; - case CHAN_AGENT: - /* Data for an agent message. Buffer it. */ - while (len > 0) { - if (c->u.a.lensofar < 4) { - int l = min(4 - c->u.a.lensofar, len); - memcpy(c->u.a.msglen + c->u.a.lensofar, p, - l); - p += l; - len -= l; - c->u.a.lensofar += l; - } - if (c->u.a.lensofar == 4) { - c->u.a.totallen = - 4 + GET_32BIT(c->u.a.msglen); - c->u.a.message = snewn(c->u.a.totallen, - unsigned char); - memcpy(c->u.a.message, c->u.a.msglen, 4); - } - if (c->u.a.lensofar >= 4 && len > 0) { - int l = - min(c->u.a.totallen - c->u.a.lensofar, - len); - memcpy(c->u.a.message + c->u.a.lensofar, p, - l); - p += l; - len -= l; - c->u.a.lensofar += l; - } - if (c->u.a.lensofar == c->u.a.totallen) { - void *reply; - int replylen; - if (agent_query(c->u.a.message, - c->u.a.totallen, - &reply, &replylen, - ssh_agentf_callback, c)) - ssh_agentf_callback(c, reply, replylen); - sfree(c->u.a.message); - c->u.a.lensofar = 0; - } - } - bufsize = 0; /* agent channels never back up */ - break; - } - if (!c->v.v1.throttling && bufsize > SSH1_BUFFER_LIMIT) { - c->v.v1.throttling = 1; - ssh1_throttle(ssh, +1); - } - } - } else if (pktin->type == SSH1_SMSG_SUCCESS) { + crReturnV; + if (pktin) { + if (pktin->type == SSH1_SMSG_SUCCESS) { /* may be from EXEC_SHELL on some servers */ } else if (pktin->type == SSH1_SMSG_FAILURE) { /* may be from EXEC_SHELL on some servers * if no pty is available or in other odd cases. Ignore */ - } else if (pktin->type == SSH1_SMSG_EXIT_STATUS) { - char buf[100]; - ssh->exitcode = ssh_pkt_getuint32(pktin); - sprintf(buf, "Server sent command exit status %d", - ssh->exitcode); - logevent(buf); - send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END); - /* - * In case `helpful' firewalls or proxies tack - * extra human-readable text on the end of the - * session which we might mistake for another - * encrypted packet, we close the session once - * we've sent EXIT_CONFIRMATION. - */ - ssh_closing((Plug)ssh, NULL, 0, 0); - crStopV; } else { bombout(("Strange packet received: type %d", pktin->type)); crStopV; @@ -4201,6 +4481,74 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, } /* + * Handle the top-level SSH2 protocol. + */ +static void ssh1_msg_debug(Ssh ssh, struct Packet *pktin) +{ + char *buf, *msg; + int msglen; + + ssh_pkt_getstring(pktin, &msg, &msglen); + buf = dupprintf("Remote debug message: %.*s", msglen, msg); + logevent(buf); + sfree(buf); +} + +static void ssh1_msg_disconnect(Ssh ssh, struct Packet *pktin) +{ + /* log reason code in disconnect message */ + char *msg; + int msglen; + + ssh_pkt_getstring(pktin, &msg, &msglen); + bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg)); +} + +void ssh_msg_ignore(Ssh ssh, struct Packet *pktin) +{ + /* Do nothing, because we're ignoring it! Duhh. */ +} + +static void ssh1_protocol_setup(Ssh ssh) +{ + int i; + + /* + * Most messages are handled by the coroutines. + */ + for (i = 0; i < 256; i++) + ssh->packet_dispatch[i] = NULL; + + /* + * These special message types we install handlers for. + */ + ssh->packet_dispatch[SSH1_MSG_DISCONNECT] = ssh1_msg_disconnect; + ssh->packet_dispatch[SSH1_MSG_IGNORE] = ssh_msg_ignore; + ssh->packet_dispatch[SSH1_MSG_DEBUG] = ssh1_msg_debug; +} + +static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, + struct Packet *pktin) +{ + if (ssh->state == SSH_STATE_CLOSED) + return; + + if (pktin && ssh->packet_dispatch[pktin->type]) { + ssh->packet_dispatch[pktin->type](ssh, pktin); + return; + } + + if (!ssh->protocol_initial_phase_done) { + if (do_ssh1_login(ssh, in, inlen, pktin)) + ssh->protocol_initial_phase_done = TRUE; + else + return; + } + + do_ssh1_connection(ssh, in, inlen, pktin); +} + +/* * Utility routine for decoding comma-separated strings in KEXINIT. */ static int in_commasep_string(char *needle, char *haystack, int haylen) @@ -4278,6 +4626,8 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int hostkeylen, siglen; void *hkey; /* actual host key */ unsigned char exchange_hash[20]; + int n_preferred_kex; + const struct ssh_kex *preferred_kex[KEX_MAX]; int n_preferred_ciphers; const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX]; const struct ssh_compress *preferred_comp; @@ -4292,12 +4642,42 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, s->csmac_tobe = s->scmac_tobe = NULL; s->cscomp_tobe = s->sccomp_tobe = NULL; - random_init(); s->first_kex = 1; { int i; /* + * Set up the preferred key exchange. (NULL => warn below here) + */ + s->n_preferred_kex = 0; + for (i = 0; i < KEX_MAX; i++) { + switch (ssh->cfg.ssh_kexlist[i]) { + case KEX_DHGEX: + s->preferred_kex[s->n_preferred_kex++] = + &ssh_diffiehellman_gex; + break; + case KEX_DHGROUP14: + s->preferred_kex[s->n_preferred_kex++] = + &ssh_diffiehellman_group14; + break; + case KEX_DHGROUP1: + s->preferred_kex[s->n_preferred_kex++] = + &ssh_diffiehellman_group1; + break; + case CIPHER_WARN: + /* Flag for later. Don't bother if it's the last in + * the list. */ + if (i < KEX_MAX - 1) { + s->preferred_kex[s->n_preferred_kex++] = NULL; + } + break; + } + } + } + + { + int i; + /* * Set up the preferred ciphers. (NULL => warn below here) */ s->n_preferred_ciphers = 0; @@ -4346,7 +4726,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, begin_key_exchange: { - int i, j, cipherstr_started; + int i, j, commalist_started; /* * Enable queueing of outgoing auth- or connection-layer @@ -4355,6 +4735,11 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, ssh->queueing = TRUE; /* + * Flag that KEX is in progress. + */ + ssh->kex_in_progress = TRUE; + + /* * Construct and send our key exchange packet. */ s->pktout = ssh2_pkt_init(SSH2_MSG_KEXINIT); @@ -4362,13 +4747,14 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_addbyte(s->pktout, (unsigned char) random_byte()); /* List key exchange algorithms. */ ssh2_pkt_addstring_start(s->pktout); - for (i = 0; i < lenof(kex_algs); i++) { - if (kex_algs[i] == &ssh_diffiehellman_gex && - (ssh->remote_bugs & BUG_SSH2_DH_GEX)) - continue; - ssh2_pkt_addstring_str(s->pktout, kex_algs[i]->name); - if (i < lenof(kex_algs) - 1) + commalist_started = 0; + for (i = 0; i < s->n_preferred_kex; i++) { + const struct ssh_kex *k = s->preferred_kex[i]; + if (!k) continue; /* warning flag */ + if (commalist_started) ssh2_pkt_addstring_str(s->pktout, ","); + ssh2_pkt_addstring_str(s->pktout, s->preferred_kex[i]->name); + commalist_started = 1; } /* List server host key algorithms. */ ssh2_pkt_addstring_start(s->pktout); @@ -4379,28 +4765,28 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, } /* List client->server encryption algorithms. */ ssh2_pkt_addstring_start(s->pktout); - cipherstr_started = 0; + commalist_started = 0; for (i = 0; i < s->n_preferred_ciphers; i++) { const struct ssh2_ciphers *c = s->preferred_ciphers[i]; if (!c) continue; /* warning flag */ for (j = 0; j < c->nciphers; j++) { - if (cipherstr_started) + if (commalist_started) ssh2_pkt_addstring_str(s->pktout, ","); ssh2_pkt_addstring_str(s->pktout, c->list[j]->name); - cipherstr_started = 1; + commalist_started = 1; } } /* List server->client encryption algorithms. */ ssh2_pkt_addstring_start(s->pktout); - cipherstr_started = 0; + commalist_started = 0; for (i = 0; i < s->n_preferred_ciphers; i++) { const struct ssh2_ciphers *c = s->preferred_ciphers[i]; if (!c) continue; /* warning flag */ for (j = 0; j < c->nciphers; j++) { - if (cipherstr_started) + if (commalist_started) ssh2_pkt_addstring_str(s->pktout, ","); ssh2_pkt_addstring_str(s->pktout, c->list[j]->name); - cipherstr_started = 1; + commalist_started = 1; } } /* List client->server MAC algorithms. */ @@ -4481,15 +4867,26 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, s->sccomp_tobe = NULL; pktin->savedpos += 16; /* skip garbage cookie */ ssh_pkt_getstring(pktin, &str, &len); /* key exchange algorithms */ - for (i = 0; i < lenof(kex_algs); i++) { - if (kex_algs[i] == &ssh_diffiehellman_gex && - (ssh->remote_bugs & BUG_SSH2_DH_GEX)) - continue; - if (in_commasep_string(kex_algs[i]->name, str, len)) { - ssh->kex = kex_algs[i]; + s->warn = 0; + for (i = 0; i < s->n_preferred_kex; i++) { + const struct ssh_kex *k = s->preferred_kex[i]; + if (!k) { + s->warn = 1; + } else if (in_commasep_string(k->name, str, len)) { + ssh->kex = k; + } + if (ssh->kex) { + if (s->warn) + askalg(ssh->frontend, "key-exchange algorithm", + ssh->kex->name); break; } } + if (!ssh->kex) { + bombout(("Couldn't agree a key exchange algorithm (available: %s)", + str ? str : "(null)")); + crStop(0); + } ssh_pkt_getstring(pktin, &str, &len); /* host key algorithms */ for (i = 0; i < lenof(hostkey_algs); i++) { if (in_commasep_string(hostkey_algs[i]->name, str, len)) { @@ -4513,7 +4910,8 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, } if (s->cscipher_tobe) { if (s->warn) - askcipher(ssh->frontend, s->cscipher_tobe->name, 1); + askalg(ssh->frontend, "client-to-server cipher", + s->cscipher_tobe->name); break; } } @@ -4539,7 +4937,8 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, } if (s->sccipher_tobe) { if (s->warn) - askcipher(ssh->frontend, s->sccipher_tobe->name, 2); + askalg(ssh->frontend, "server-to-client cipher", + s->sccipher_tobe->name); break; } } @@ -4604,7 +5003,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, * If we're doing Diffie-Hellman group exchange, start by * requesting a group. */ - if (ssh->kex == &ssh_diffiehellman_gex) { + if (!ssh->kex->pdata) { logevent("Doing Diffie-Hellman group exchange"); ssh->pkt_ctx |= SSH2_PKTCTX_DHGEX; /* @@ -4627,14 +5026,16 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, bombout(("unable to read mp-ints from incoming group packet")); crStop(0); } - ssh->kex_ctx = dh_setup_group(s->p, s->g); + ssh->kex_ctx = dh_setup_gex(s->p, s->g); s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT; s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY; } else { - ssh->pkt_ctx |= SSH2_PKTCTX_DHGROUP1; - ssh->kex_ctx = dh_setup_group1(); + ssh->pkt_ctx |= SSH2_PKTCTX_DHGROUP; + ssh->kex_ctx = dh_setup_group(ssh->kex); s->kex_init_value = SSH2_MSG_KEXDH_INIT; s->kex_reply_value = SSH2_MSG_KEXDH_REPLY; + logeventf(ssh, "Using Diffie-Hellman with standard group \"%s\"", + ssh->kex->groupname); } logevent("Doing Diffie-Hellman key exchange"); @@ -4706,10 +5107,61 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, ssh->hostkey->freekey(s->hkey); /* + * The exchange hash from the very first key exchange is also + * the session id, used in session key construction and + * authentication. + */ + if (s->first_kex) + memcpy(ssh->v2_session_id, s->exchange_hash, + sizeof(s->exchange_hash)); + + /* * Send SSH2_MSG_NEWKEYS. */ s->pktout = ssh2_pkt_init(SSH2_MSG_NEWKEYS); ssh2_pkt_send_noqueue(ssh, s->pktout); + ssh->outgoing_data_size = 0; /* start counting from here */ + + /* + * We've sent client NEWKEYS, so create and initialise + * client-to-server session keys. + */ + if (ssh->cs_cipher_ctx) + ssh->cscipher->free_context(ssh->cs_cipher_ctx); + ssh->cscipher = s->cscipher_tobe; + ssh->cs_cipher_ctx = ssh->cscipher->make_context(); + + if (ssh->cs_mac_ctx) + ssh->csmac->free_context(ssh->cs_mac_ctx); + ssh->csmac = s->csmac_tobe; + ssh->cs_mac_ctx = ssh->csmac->make_context(); + + if (ssh->cs_comp_ctx) + ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx); + ssh->cscomp = s->cscomp_tobe; + ssh->cs_comp_ctx = ssh->cscomp->compress_init(); + + /* + * Set IVs on client-to-server keys. Here we use the exchange + * hash from the _first_ key exchange. + */ + { + unsigned char keyspace[40]; + ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'C',keyspace); + ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace); + ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'A',keyspace); + ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace); + ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'E',keyspace); + ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace); + } + + logeventf(ssh, "Initialised %.200s client->server encryption", + ssh->cscipher->text_name); + logeventf(ssh, "Initialised %.200s client->server MAC algorithm", + ssh->csmac->text_name); + if (ssh->cscomp->text_name) + logeventf(ssh, "Initialised %s compression", + ssh->cscomp->text_name); /* * Now our end of the key exchange is complete, we can send all @@ -4726,76 +5178,51 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, bombout(("expected new-keys packet from server")); crStop(0); } + ssh->incoming_data_size = 0; /* start counting from here */ /* - * Create and initialise session keys. + * We've seen server NEWKEYS, so create and initialise + * server-to-client session keys. */ - if (ssh->cs_cipher_ctx) - ssh->cscipher->free_context(ssh->cs_cipher_ctx); - ssh->cscipher = s->cscipher_tobe; - ssh->cs_cipher_ctx = ssh->cscipher->make_context(); - if (ssh->sc_cipher_ctx) ssh->sccipher->free_context(ssh->sc_cipher_ctx); ssh->sccipher = s->sccipher_tobe; ssh->sc_cipher_ctx = ssh->sccipher->make_context(); - if (ssh->cs_mac_ctx) - ssh->csmac->free_context(ssh->cs_mac_ctx); - ssh->csmac = s->csmac_tobe; - ssh->cs_mac_ctx = ssh->csmac->make_context(); - if (ssh->sc_mac_ctx) ssh->scmac->free_context(ssh->sc_mac_ctx); ssh->scmac = s->scmac_tobe; ssh->sc_mac_ctx = ssh->scmac->make_context(); - if (ssh->cs_comp_ctx) - ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx); - ssh->cscomp = s->cscomp_tobe; - ssh->cs_comp_ctx = ssh->cscomp->compress_init(); - if (ssh->sc_comp_ctx) ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx); ssh->sccomp = s->sccomp_tobe; ssh->sc_comp_ctx = ssh->sccomp->decompress_init(); /* - * Set IVs after keys. Here we use the exchange hash from the - * _first_ key exchange. + * Set IVs on server-to-client keys. Here we use the exchange + * hash from the _first_ key exchange. */ { unsigned char keyspace[40]; - if (s->first_kex) - memcpy(ssh->v2_session_id, s->exchange_hash, - sizeof(s->exchange_hash)); - ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'C',keyspace); - ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace); ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'D',keyspace); ssh->sccipher->setkey(ssh->sc_cipher_ctx, keyspace); - ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'A',keyspace); - ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace); ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'B',keyspace); ssh->sccipher->setiv(ssh->sc_cipher_ctx, keyspace); - ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'E',keyspace); - ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace); ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'F',keyspace); ssh->scmac->setkey(ssh->sc_mac_ctx, keyspace); } - logeventf(ssh, "Initialised %.200s client->server encryption", - ssh->cscipher->text_name); logeventf(ssh, "Initialised %.200s server->client encryption", ssh->sccipher->text_name); - logeventf(ssh, "Initialised %.200s client->server MAC algorithm", - ssh->csmac->text_name); logeventf(ssh, "Initialised %.200s server->client MAC algorithm", ssh->scmac->text_name); - if (ssh->cscomp->text_name) - logeventf(ssh, "Initialised %s compression", - ssh->cscomp->text_name); if (ssh->sccomp->text_name) logeventf(ssh, "Initialised %s decompression", ssh->sccomp->text_name); + + /* + * Free key exchange data. + */ freebn(s->f); freebn(s->K); if (ssh->kex == &ssh_diffiehellman_gex) { @@ -4804,6 +5231,15 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, } /* + * Key exchange is over. Schedule a timer for our next rekey. + */ + ssh->kex_in_progress = FALSE; + ssh->last_rekey = GETTICKCOUNT(); + if (ssh->cfg.ssh_rekey_time != 0) + ssh->next_rekey = schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC, + ssh2_timer, ssh); + + /* * If this is the first key exchange phase, we must pass the * SSH2_MSG_NEWKEYS packet to the next layer, not because it * wants to see it but because it will need time to initialise @@ -4812,7 +5248,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, * it would only confuse the layer above. */ if (!s->first_kex) { - crReturn(0); + crReturn(1); } s->first_kex = 0; @@ -4821,11 +5257,21 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, * function so that other things can run on top of the * transport. If we ever see a KEXINIT, we must go back to the * start. + * + * We _also_ go back to the start if we see pktin==NULL and + * inlen==-1, because this is a special signal meaning + * `initiate client-driven rekey', and `in' contains a message + * giving the reason for the rekey. */ - while (!(pktin && pktin->type == SSH2_MSG_KEXINIT)) { + while (!((pktin && pktin->type == SSH2_MSG_KEXINIT) || + (!pktin && inlen == -1))) { crReturn(1); } - logevent("Server initiated key re-exchange"); + if (pktin) { + logevent("Server initiated key re-exchange"); + } else { + logevent((char *)in); + } goto begin_key_exchange; crFinish(1); @@ -4900,6 +5346,533 @@ static void ssh2_set_window(struct ssh_channel *c, unsigned newwin) } } +static void ssh2_msg_channel_window_adjust(Ssh ssh, struct Packet *pktin) +{ + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + c = find234(ssh->channels, &i, ssh_channelfind); + if (c && !c->closes) + c->v.v2.remwindow += ssh_pkt_getuint32(pktin); +} + +static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin) +{ + char *data; + unsigned int length; + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + c = find234(ssh->channels, &i, ssh_channelfind); + if (!c) + return; /* nonexistent channel */ + if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA && + ssh_pkt_getuint32(pktin) != SSH2_EXTENDED_DATA_STDERR) + return; /* extended but not stderr */ + ssh_pkt_getstring(pktin, &data, &length); + if (data) { + int bufsize = 0; + c->v.v2.locwindow -= length; + switch (c->type) { + case CHAN_MAINSESSION: + bufsize = + from_backend(ssh->frontend, pktin->type == + SSH2_MSG_CHANNEL_EXTENDED_DATA, + data, length); + break; + case CHAN_X11: + bufsize = x11_send(c->u.x11.s, data, length); + break; + case CHAN_SOCKDATA: + bufsize = pfd_send(c->u.pfd.s, data, length); + break; + case CHAN_AGENT: + while (length > 0) { + if (c->u.a.lensofar < 4) { + unsigned int l = min(4 - c->u.a.lensofar, length); + memcpy(c->u.a.msglen + c->u.a.lensofar, + data, l); + data += l; + length -= l; + c->u.a.lensofar += l; + } + if (c->u.a.lensofar == 4) { + c->u.a.totallen = + 4 + GET_32BIT(c->u.a.msglen); + c->u.a.message = snewn(c->u.a.totallen, + unsigned char); + memcpy(c->u.a.message, c->u.a.msglen, 4); + } + if (c->u.a.lensofar >= 4 && length > 0) { + unsigned int l = + min(c->u.a.totallen - c->u.a.lensofar, + length); + memcpy(c->u.a.message + c->u.a.lensofar, + data, l); + data += l; + length -= l; + c->u.a.lensofar += l; + } + if (c->u.a.lensofar == c->u.a.totallen) { + void *reply; + int replylen; + if (agent_query(c->u.a.message, + c->u.a.totallen, + &reply, &replylen, + ssh_agentf_callback, c)) + ssh_agentf_callback(c, reply, replylen); + sfree(c->u.a.message); + c->u.a.lensofar = 0; + } + } + bufsize = 0; + break; + } + /* + * If we are not buffering too much data, + * enlarge the window again at the remote side. + */ + if (bufsize < OUR_V2_WINSIZE) + ssh2_set_window(c, OUR_V2_WINSIZE - bufsize); + } +} + +static void ssh2_msg_channel_eof(Ssh ssh, struct Packet *pktin) +{ + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + + c = find234(ssh->channels, &i, ssh_channelfind); + if (!c) + return; /* nonexistent channel */ + + if (c->type == CHAN_X11) { + /* + * Remote EOF on an X11 channel means we should + * wrap up and close the channel ourselves. + */ + x11_close(c->u.x11.s); + sshfwd_close(c); + } else if (c->type == CHAN_AGENT) { + sshfwd_close(c); + } else if (c->type == CHAN_SOCKDATA) { + pfd_close(c->u.pfd.s); + sshfwd_close(c); + } +} + +static void ssh2_msg_channel_close(Ssh ssh, struct Packet *pktin) +{ + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + struct Packet *pktout; + + c = find234(ssh->channels, &i, ssh_channelfind); + if (!c || ((int)c->remoteid) == -1) { + bombout(("Received CHANNEL_CLOSE for %s channel %d\n", + c ? "half-open" : "nonexistent", i)); + return; + } + /* Do pre-close processing on the channel. */ + switch (c->type) { + case CHAN_MAINSESSION: + ssh->mainchan = NULL; + update_specials_menu(ssh->frontend); + break; + case CHAN_X11: + if (c->u.x11.s != NULL) + x11_close(c->u.x11.s); + sshfwd_close(c); + break; + case CHAN_AGENT: + sshfwd_close(c); + break; + case CHAN_SOCKDATA: + if (c->u.pfd.s != NULL) + pfd_close(c->u.pfd.s); + sshfwd_close(c); + break; + } + if (c->closes == 0) { + pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE); + ssh2_pkt_adduint32(pktout, c->remoteid); + ssh2_pkt_send(ssh, pktout); + } + del234(ssh->channels, c); + bufchain_clear(&c->v.v2.outbuffer); + sfree(c); + + /* + * See if that was the last channel left open. + * (This is only our termination condition if we're + * not running in -N mode.) + */ + if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) { + logevent("All channels closed. Disconnecting"); +#if 0 + /* + * We used to send SSH_MSG_DISCONNECT here, + * because I'd believed that _every_ conforming + * SSH2 connection had to end with a disconnect + * being sent by at least one side; apparently + * I was wrong and it's perfectly OK to + * unceremoniously slam the connection shut + * when you're done, and indeed OpenSSH feels + * this is more polite than sending a + * DISCONNECT. So now we don't. + */ + s->pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT); + ssh2_pkt_adduint32(s->pktout, SSH2_DISCONNECT_BY_APPLICATION); + ssh2_pkt_addstring(s->pktout, "All open channels closed"); + ssh2_pkt_addstring(s->pktout, "en"); /* language tag */ + ssh2_pkt_send_noqueue(ssh, s->pktout); +#endif + ssh_closing((Plug)ssh, NULL, 0, 0); + } +} + +static void ssh2_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin) +{ + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + struct Packet *pktout; + + c = find234(ssh->channels, &i, ssh_channelfind); + if (!c) + return; /* nonexistent channel */ + if (c->type != CHAN_SOCKDATA_DORMANT) + return; /* dunno why they're confirming this */ + c->remoteid = ssh_pkt_getuint32(pktin); + c->type = CHAN_SOCKDATA; + c->v.v2.remwindow = ssh_pkt_getuint32(pktin); + c->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin); + if (c->u.pfd.s) + pfd_confirm(c->u.pfd.s); + if (c->closes) { + /* + * We have a pending close on this channel, + * which we decided on before the server acked + * the channel open. So now we know the + * remoteid, we can close it again. + */ + pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE); + ssh2_pkt_adduint32(pktout, c->remoteid); + ssh2_pkt_send(ssh, pktout); + } +} + +static void ssh2_msg_channel_open_failure(Ssh ssh, struct Packet *pktin) +{ + static const char *const reasons[] = { + "", + "Administratively prohibited", + "Connect failed", + "Unknown channel type", + "Resource shortage", + }; + unsigned i = ssh_pkt_getuint32(pktin); + unsigned reason_code; + char *reason_string; + int reason_length; + char *message; + struct ssh_channel *c; + c = find234(ssh->channels, &i, ssh_channelfind); + if (!c) + return; /* nonexistent channel */ + if (c->type != CHAN_SOCKDATA_DORMANT) + return; /* dunno why they're failing this */ + + reason_code = ssh_pkt_getuint32(pktin); + if (reason_code >= lenof(reasons)) + reason_code = 0; /* ensure reasons[reason_code] in range */ + ssh_pkt_getstring(pktin, &reason_string, &reason_length); + message = dupprintf("Forwarded connection refused by" + " server: %s [%.*s]", reasons[reason_code], + reason_length, reason_string); + logevent(message); + sfree(message); + + pfd_close(c->u.pfd.s); + + del234(ssh->channels, c); + sfree(c); +} + +static void ssh2_msg_channel_request(Ssh ssh, struct Packet *pktin) +{ + unsigned localid; + char *type; + int typelen, want_reply; + int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */ + struct ssh_channel *c; + struct Packet *pktout; + + localid = ssh_pkt_getuint32(pktin); + ssh_pkt_getstring(pktin, &type, &typelen); + want_reply = ssh2_pkt_getbool(pktin); + + /* + * First, check that the channel exists. Otherwise, + * we can instantly disconnect with a rude message. + */ + c = find234(ssh->channels, &localid, ssh_channelfind); + if (!c) { + char buf[80]; + sprintf(buf, "Received channel request for nonexistent" + " channel %d", localid); + logevent(buf); + pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT); + ssh2_pkt_adduint32(pktout, SSH2_DISCONNECT_BY_APPLICATION); + ssh2_pkt_addstring(pktout, buf); + ssh2_pkt_addstring(pktout, "en"); /* language tag */ + ssh2_pkt_send_noqueue(ssh, pktout); + connection_fatal(ssh->frontend, "%s", buf); + ssh_closing((Plug)ssh, NULL, 0, 0); + return; + } + + /* + * Having got the channel number, we now look at + * the request type string to see if it's something + * we recognise. + */ + if (c == ssh->mainchan) { + /* + * We recognise "exit-status" and "exit-signal" on + * the primary channel. + */ + if (typelen == 11 && + !memcmp(type, "exit-status", 11)) { + + ssh->exitcode = ssh_pkt_getuint32(pktin); + logeventf(ssh, "Server sent command exit status %d", + ssh->exitcode); + reply = SSH2_MSG_CHANNEL_SUCCESS; + + } else if (typelen == 11 && + !memcmp(type, "exit-signal", 11)) { + + int is_plausible = TRUE, is_int = FALSE; + char *fmt_sig = "", *fmt_msg = ""; + char *msg; + int msglen = 0, core = FALSE; + /* ICK: older versions of OpenSSH (e.g. 3.4p1) + * provide an `int' for the signal, despite its + * having been a `string' in the drafts since at + * least 2001. (Fixed in session.c 1.147.) Try to + * infer which we can safely parse it as. */ + { + unsigned char *p = pktin->body + + pktin->savedpos; + long len = pktin->length - pktin->savedpos; + unsigned long num = GET_32BIT(p); /* what is it? */ + /* If it's 0, it hardly matters; assume string */ + if (num == 0) { + is_int = FALSE; + } else { + int maybe_int = FALSE, maybe_str = FALSE; +#define CHECK_HYPOTHESIS(offset, result) \ + do { \ + long q = offset; \ + if (q >= 0 && q+4 <= len) { \ + q = q + 4 + GET_32BIT(p+q); \ + if (q >= 0 && q+4 <= len && \ + (q = q + 4 + GET_32BIT(p+q)) && q == len) \ + result = TRUE; \ + } \ + } while(0) + CHECK_HYPOTHESIS(4+1, maybe_int); + CHECK_HYPOTHESIS(4+num+1, maybe_str); +#undef CHECK_HYPOTHESIS + if (maybe_int && !maybe_str) + is_int = TRUE; + else if (!maybe_int && maybe_str) + is_int = FALSE; + else + /* Crikey. Either or neither. Panic. */ + is_plausible = FALSE; + } + } + if (is_plausible) { + if (is_int) { + /* Old non-standard OpenSSH. */ + int signum = ssh_pkt_getuint32(pktin); + fmt_sig = dupprintf(" %d", signum); + } else { + /* As per the drafts. */ + char *sig; + int siglen; + ssh_pkt_getstring(pktin, &sig, &siglen); + /* Signal name isn't supposed to be blank, but + * let's cope gracefully if it is. */ + if (siglen) { + fmt_sig = dupprintf(" \"%.*s\"", + siglen, sig); + } + } + core = ssh2_pkt_getbool(pktin); + ssh_pkt_getstring(pktin, &msg, &msglen); + if (msglen) { + fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg); + } + /* ignore lang tag */ + } /* else don't attempt to parse */ + logeventf(ssh, "Server exited on signal%s%s%s", + fmt_sig, core ? " (core dumped)" : "", + fmt_msg); + if (*fmt_sig) sfree(fmt_sig); + if (*fmt_msg) sfree(fmt_msg); + reply = SSH2_MSG_CHANNEL_SUCCESS; + + } + } else { + /* + * This is a channel request we don't know + * about, so we now either ignore the request + * or respond with CHANNEL_FAILURE, depending + * on want_reply. + */ + reply = SSH2_MSG_CHANNEL_FAILURE; + } + if (want_reply) { + pktout = ssh2_pkt_init(reply); + ssh2_pkt_adduint32(pktout, c->remoteid); + ssh2_pkt_send(ssh, pktout); + } +} + +static void ssh2_msg_global_request(Ssh ssh, struct Packet *pktin) +{ + char *type; + int typelen, want_reply; + struct Packet *pktout; + + ssh_pkt_getstring(pktin, &type, &typelen); + want_reply = ssh2_pkt_getbool(pktin); + + /* + * We currently don't support any global requests + * at all, so we either ignore the request or + * respond with REQUEST_FAILURE, depending on + * want_reply. + */ + if (want_reply) { + pktout = ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE); + ssh2_pkt_send(ssh, pktout); + } +} + +static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin) +{ + char *type; + int typelen; + char *peeraddr; + int peeraddrlen; + int peerport; + char *error = NULL; + struct ssh_channel *c; + unsigned remid, winsize, pktsize; + struct Packet *pktout; + + ssh_pkt_getstring(pktin, &type, &typelen); + c = snew(struct ssh_channel); + c->ssh = ssh; + + remid = ssh_pkt_getuint32(pktin); + winsize = ssh_pkt_getuint32(pktin); + pktsize = ssh_pkt_getuint32(pktin); + + if (typelen == 3 && !memcmp(type, "x11", 3)) { + char *addrstr; + + ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen); + addrstr = snewn(peeraddrlen+1, char); + memcpy(addrstr, peeraddr, peeraddrlen); + addrstr[peeraddrlen] = '\0'; + peerport = ssh_pkt_getuint32(pktin); + + logeventf(ssh, "Received X11 connect request from %s:%d", + addrstr, peerport); + + if (!ssh->X11_fwd_enabled) + error = "X11 forwarding is not enabled"; + else if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c, + ssh->x11auth, addrstr, peerport, + &ssh->cfg) != NULL) { + error = "Unable to open an X11 connection"; + } else { + logevent("Opening X11 forward connection succeeded"); + c->type = CHAN_X11; + } + + sfree(addrstr); + } else if (typelen == 15 && + !memcmp(type, "forwarded-tcpip", 15)) { + struct ssh_rportfwd pf, *realpf; + char *dummy; + int dummylen; + ssh_pkt_getstring(pktin, &dummy, &dummylen);/* skip address */ + pf.sport = ssh_pkt_getuint32(pktin); + ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen); + peerport = ssh_pkt_getuint32(pktin); + realpf = find234(ssh->rportfwds, &pf, NULL); + logeventf(ssh, "Received remote port %d open request " + "from %s:%d", pf.sport, peeraddr, peerport); + if (realpf == NULL) { + error = "Remote port is not recognised"; + } else { + const char *e = pfd_newconnect(&c->u.pfd.s, + realpf->dhost, + realpf->dport, c, + &ssh->cfg, + realpf->pfrec->addressfamily); + logeventf(ssh, "Attempting to forward remote port to " + "%s:%d", realpf->dhost, realpf->dport); + if (e != NULL) { + logeventf(ssh, "Port open failed: %s", e); + error = "Port open failed"; + } else { + logevent("Forwarded port opened successfully"); + c->type = CHAN_SOCKDATA; + } + } + } else if (typelen == 22 && + !memcmp(type, "auth-agent@openssh.com", 3)) { + if (!ssh->agentfwd_enabled) + error = "Agent forwarding is not enabled"; + else { + c->type = CHAN_AGENT; /* identify channel type */ + c->u.a.lensofar = 0; + } + } else { + error = "Unsupported channel type requested"; + } + + c->remoteid = remid; + if (error) { + pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE); + ssh2_pkt_adduint32(pktout, c->remoteid); + ssh2_pkt_adduint32(pktout, SSH2_OPEN_CONNECT_FAILED); + ssh2_pkt_addstring(pktout, error); + ssh2_pkt_addstring(pktout, "en"); /* language tag */ + ssh2_pkt_send(ssh, pktout); + logeventf(ssh, "Rejected channel open: %s", error); + sfree(c); + } else { + c->localid = alloc_channel_id(ssh); + c->closes = 0; + c->v.v2.locwindow = OUR_V2_WINSIZE; + c->v.v2.remwindow = winsize; + c->v.v2.remmaxpkt = pktsize; + bufchain_init(&c->v.v2.outbuffer); + add234(ssh->channels, c); + pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); + ssh2_pkt_adduint32(pktout, c->remoteid); + ssh2_pkt_adduint32(pktout, c->localid); + ssh2_pkt_adduint32(pktout, c->v.v2.locwindow); + ssh2_pkt_adduint32(pktout, 0x4000UL); /* our max pkt size */ + ssh2_pkt_send(ssh, pktout); + } +} + /* * Handle the SSH2 userauth and connection layers. */ @@ -5775,6 +6748,15 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh->channels = newtree234(ssh_channelcmp); /* + * Set up handlers for some connection protocol messages, so we + * don't have to handle them repeatedly in this coroutine. + */ + ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = + ssh2_msg_channel_window_adjust; + ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = + ssh2_msg_global_request; + + /* * Create the main session channel. */ if (!ssh->cfg.ssh_no_shell) { @@ -5811,6 +6793,24 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh->mainchan = NULL; /* + * Now we have a channel, make dispatch table entries for + * general channel-based messages. + */ + ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = + ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = + ssh2_msg_channel_data; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_channel_eof; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_channel_close; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = + ssh2_msg_channel_open_confirmation; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = + ssh2_msg_channel_open_failure; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = + ssh2_msg_channel_request; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = + ssh2_msg_channel_open; + + /* * Potentially enable X11 forwarding. */ if (ssh->mainchan && ssh->cfg.x11_forward) { @@ -5829,17 +6829,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_adduint32(s->pktout, x11_get_screen_number(ssh->cfg.x11_display)); ssh2_pkt_send(ssh, s->pktout); - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + crWaitUntilV(pktin); if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) { if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) { @@ -5857,173 +6847,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, /* * Enable port forwardings. */ - { - char type; - int n; - int sport,dport,sserv,dserv; - char sports[256], dports[256], saddr[256], host[256]; - - ssh->rportfwds = newtree234(ssh_rportcmp_ssh2); - /* Add port forwardings. */ - ssh->portfwd_strptr = ssh->cfg.portfwd; - while (*ssh->portfwd_strptr) { - type = *ssh->portfwd_strptr++; - saddr[0] = '\0'; - n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') { - if (*ssh->portfwd_strptr == ':') { - /* - * We've seen a colon in the middle of the - * source port number. This means that - * everything we've seen until now is the - * source _address_, so we'll move it into - * saddr and start sports from the beginning - * again. - */ - ssh->portfwd_strptr++; - sports[n] = '\0'; - strcpy(saddr, sports); - n = 0; - } - if (n < 255) sports[n++] = *ssh->portfwd_strptr++; - } - sports[n] = 0; - if (type != 'D') { - if (*ssh->portfwd_strptr == '\t') - ssh->portfwd_strptr++; - n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') { - if (n < 255) host[n++] = *ssh->portfwd_strptr++; - } - host[n] = 0; - if (*ssh->portfwd_strptr == ':') - ssh->portfwd_strptr++; - n = 0; - while (*ssh->portfwd_strptr) { - if (n < 255) dports[n++] = *ssh->portfwd_strptr++; - } - dports[n] = 0; - ssh->portfwd_strptr++; - dport = atoi(dports); - dserv = 0; - if (dport == 0) { - dserv = 1; - dport = net_service_lookup(dports); - if (!dport) { - logeventf(ssh, "Service lookup failed for destination" - " port \"%s\"", dports); - } - } - } else { - while (*ssh->portfwd_strptr) ssh->portfwd_strptr++; - dport = dserv = -1; - ssh->portfwd_strptr++; /* eat the NUL and move to next one */ - } - sport = atoi(sports); - sserv = 0; - if (sport == 0) { - sserv = 1; - sport = net_service_lookup(sports); - if (!sport) { - logeventf(ssh, "Service lookup failed for source" - " port \"%s\"", sports); - } - } - if (sport && dport) { - /* Set up a description of the source port. */ - static char *sportdesc; - sportdesc = dupprintf("%.*s%.*s%.*s%.*s%d%.*s", - (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL, - (int)(*saddr?1:0), ":", - (int)(sserv ? strlen(sports) : 0), sports, - sserv, "(", sport, sserv, ")"); - if (type == 'L') { - /* Verbose description of the destination port */ - char *dportdesc = dupprintf("%s:%.*s%.*s%d%.*s", - host, - (int)(dserv ? strlen(dports) : 0), dports, - dserv, "(", dport, dserv, ")"); - const char *err = pfd_addforward(host, dport, - *saddr ? saddr : NULL, - sport, ssh, &ssh->cfg); - if (err) { - logeventf(ssh, "Local port %s forward to %s" - " failed: %s", sportdesc, dportdesc, err); - } else { - logeventf(ssh, "Local port %s forwarding to %s", - sportdesc, dportdesc); - } - sfree(dportdesc); - } else if (type == 'D') { - const char *err = pfd_addforward(NULL, -1, - *saddr ? saddr : NULL, - sport, ssh, &ssh->cfg); - if (err) { - logeventf(ssh, "Local port %s SOCKS dynamic forward" - " setup failed: %s", sportdesc, err); - } else { - logeventf(ssh, "Local port %s doing SOCKS" - " dynamic forwarding", sportdesc); - } - } else { - struct ssh_rportfwd *pf; - pf = snew(struct ssh_rportfwd); - strcpy(pf->dhost, host); - pf->dport = dport; - pf->sport = sport; - if (add234(ssh->rportfwds, pf) != pf) { - logeventf(ssh, "Duplicate remote port forwarding" - " to %s:%d", host, dport); - sfree(pf); - } else { - logeventf(ssh, "Requesting remote port %s" - " forward to %s:%.*s%.*s%d%.*s", - sportdesc, - host, - (int)(dserv ? strlen(dports) : 0), dports, - dserv, "(", dport, dserv, ")"); - s->pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST); - ssh2_pkt_addstring(s->pktout, "tcpip-forward"); - ssh2_pkt_addbool(s->pktout, 1);/* want reply */ - if (*saddr) { - ssh2_pkt_addstring(s->pktout, saddr); - } else if (ssh->cfg.rport_acceptall) { - ssh2_pkt_addstring(s->pktout, "0.0.0.0"); - } else { - ssh2_pkt_addstring(s->pktout, "127.0.0.1"); - } - ssh2_pkt_adduint32(s->pktout, sport); - ssh2_pkt_send(ssh, s->pktout); - - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue;/* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); - - if (pktin->type != SSH2_MSG_REQUEST_SUCCESS) { - if (pktin->type != SSH2_MSG_REQUEST_FAILURE) { - bombout(("Unexpected response to port " - "forwarding request: packet type %d", - pktin->type)); - crStopV; - } - logevent("Server refused this port forwarding"); - } else { - logevent("Remote port forwarding enabled"); - } - } - } - sfree(sportdesc); - } - } - } + ssh_setup_portfwd(ssh, &ssh->cfg); /* * Potentially enable agent forwarding. @@ -6036,17 +6860,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_addbool(s->pktout, 1); /* want reply */ ssh2_pkt_send(ssh, s->pktout); - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + crWaitUntilV(pktin); if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) { if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) { @@ -6088,17 +6902,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_send(ssh, s->pktout); ssh->state = SSH_STATE_INTERMED; - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + crWaitUntilV(pktin); if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) { if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) { @@ -6155,17 +6959,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, s->env_left = s->num_env; while (s->env_left > 0) { - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + crWaitUntilV(pktin); if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) { if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) { @@ -6224,17 +7018,9 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_addbool(s->pktout, 1); /* want reply */ } ssh2_pkt_send(ssh, s->pktout); - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + + crWaitUntilV(pktin); + if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) { if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) { bombout(("Unexpected response to shell/command request:" @@ -6277,507 +7063,15 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, crReturnV; s->try_send = FALSE; if (pktin) { - if (pktin->type == SSH2_MSG_CHANNEL_DATA || - pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA) { - char *data; - int length; - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA && - ssh_pkt_getuint32(pktin) != SSH2_EXTENDED_DATA_STDERR) - continue; /* extended but not stderr */ - ssh_pkt_getstring(pktin, &data, &length); - if (data) { - int bufsize = 0; - c->v.v2.locwindow -= length; - switch (c->type) { - case CHAN_MAINSESSION: - bufsize = - from_backend(ssh->frontend, pktin->type == - SSH2_MSG_CHANNEL_EXTENDED_DATA, - data, length); - break; - case CHAN_X11: - bufsize = x11_send(c->u.x11.s, data, length); - break; - case CHAN_SOCKDATA: - bufsize = pfd_send(c->u.pfd.s, data, length); - break; - case CHAN_AGENT: - while (length > 0) { - if (c->u.a.lensofar < 4) { - int l = min(4 - c->u.a.lensofar, length); - memcpy(c->u.a.msglen + c->u.a.lensofar, - data, l); - data += l; - length -= l; - c->u.a.lensofar += l; - } - if (c->u.a.lensofar == 4) { - c->u.a.totallen = - 4 + GET_32BIT(c->u.a.msglen); - c->u.a.message = snewn(c->u.a.totallen, - unsigned char); - memcpy(c->u.a.message, c->u.a.msglen, 4); - } - if (c->u.a.lensofar >= 4 && length > 0) { - int l = - min(c->u.a.totallen - c->u.a.lensofar, - length); - memcpy(c->u.a.message + c->u.a.lensofar, - data, l); - data += l; - length -= l; - c->u.a.lensofar += l; - } - if (c->u.a.lensofar == c->u.a.totallen) { - void *reply; - int replylen; - if (agent_query(c->u.a.message, - c->u.a.totallen, - &reply, &replylen, - ssh_agentf_callback, c)) - ssh_agentf_callback(c, reply, replylen); - sfree(c->u.a.message); - c->u.a.lensofar = 0; - } - } - bufsize = 0; - break; - } - /* - * If we are not buffering too much data, - * enlarge the window again at the remote side. - */ - if (bufsize < OUR_V2_WINSIZE) - ssh2_set_window(c, OUR_V2_WINSIZE - bufsize); - } - } else if (pktin->type == SSH2_MSG_CHANNEL_EOF) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - - if (c->type == CHAN_X11) { - /* - * Remote EOF on an X11 channel means we should - * wrap up and close the channel ourselves. - */ - x11_close(c->u.x11.s); - sshfwd_close(c); - } else if (c->type == CHAN_AGENT) { - sshfwd_close(c); - } else if (c->type == CHAN_SOCKDATA) { - pfd_close(c->u.pfd.s); - sshfwd_close(c); - } - } else if (pktin->type == SSH2_MSG_CHANNEL_CLOSE) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c || ((int)c->remoteid) == -1) { - bombout(("Received CHANNEL_CLOSE for %s channel %d\n", - c ? "half-open" : "nonexistent", i)); - crStopV; - } - /* Do pre-close processing on the channel. */ - switch (c->type) { - case CHAN_MAINSESSION: - ssh->mainchan = NULL; - update_specials_menu(ssh->frontend); - break; - case CHAN_X11: - if (c->u.x11.s != NULL) - x11_close(c->u.x11.s); - sshfwd_close(c); - break; - case CHAN_AGENT: - sshfwd_close(c); - break; - case CHAN_SOCKDATA: - if (c->u.pfd.s != NULL) - pfd_close(c->u.pfd.s); - sshfwd_close(c); - break; - } - if (c->closes == 0) { - s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE); - ssh2_pkt_adduint32(s->pktout, c->remoteid); - ssh2_pkt_send(ssh, s->pktout); - } - del234(ssh->channels, c); - bufchain_clear(&c->v.v2.outbuffer); - sfree(c); - - /* - * See if that was the last channel left open. - * (This is only our termination condition if we're - * not running in -N mode.) - */ - if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) { - logevent("All channels closed. Disconnecting"); -#if 0 - /* - * We used to send SSH_MSG_DISCONNECT here, - * because I'd believed that _every_ conforming - * SSH2 connection had to end with a disconnect - * being sent by at least one side; apparently - * I was wrong and it's perfectly OK to - * unceremoniously slam the connection shut - * when you're done, and indeed OpenSSH feels - * this is more polite than sending a - * DISCONNECT. So now we don't. - */ - s->pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT); - ssh2_pkt_adduint32(s->pktout, SSH2_DISCONNECT_BY_APPLICATION); - ssh2_pkt_addstring(s->pktout, "All open channels closed"); - ssh2_pkt_addstring(s->pktout, "en"); /* language tag */ - ssh2_pkt_send_noqueue(ssh, s->pktout); -#endif - ssh_closing((Plug)ssh, NULL, 0, 0); - crStopV; - } - continue; /* remote sends close; ignore (FIXME) */ - } else if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c || c->closes) - continue; /* nonexistent or closing channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - s->try_send = TRUE; - } else if (pktin->type == SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - if (c->type != CHAN_SOCKDATA_DORMANT) - continue; /* dunno why they're confirming this */ - c->remoteid = ssh_pkt_getuint32(pktin); - c->type = CHAN_SOCKDATA; - c->v.v2.remwindow = ssh_pkt_getuint32(pktin); - c->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin); - if (c->u.pfd.s) - pfd_confirm(c->u.pfd.s); - if (c->closes) { - /* - * We have a pending close on this channel, - * which we decided on before the server acked - * the channel open. So now we know the - * remoteid, we can close it again. - */ - s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE); - ssh2_pkt_adduint32(s->pktout, c->remoteid); - ssh2_pkt_send(ssh, s->pktout); - } - } else if (pktin->type == SSH2_MSG_CHANNEL_OPEN_FAILURE) { - static const char *const reasons[] = { - "", - "Administratively prohibited", - "Connect failed", - "Unknown channel type", - "Resource shortage", - }; - unsigned i = ssh_pkt_getuint32(pktin); - unsigned reason_code; - char *reason_string; - int reason_length; - char *message; - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - if (c->type != CHAN_SOCKDATA_DORMANT) - continue; /* dunno why they're failing this */ - - reason_code = ssh_pkt_getuint32(pktin); - if (reason_code >= lenof(reasons)) - reason_code = 0; /* ensure reasons[reason_code] in range */ - ssh_pkt_getstring(pktin, &reason_string, &reason_length); - message = dupprintf("Forwarded connection refused by" - " server: %s [%.*s]", reasons[reason_code], - reason_length, reason_string); - logevent(message); - sfree(message); - - pfd_close(c->u.pfd.s); - - del234(ssh->channels, c); - sfree(c); - } else if (pktin->type == SSH2_MSG_CHANNEL_REQUEST) { - unsigned localid; - char *type; - int typelen, want_reply; - int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */ - struct ssh_channel *c; - - localid = ssh_pkt_getuint32(pktin); - ssh_pkt_getstring(pktin, &type, &typelen); - want_reply = ssh2_pkt_getbool(pktin); - - /* - * First, check that the channel exists. Otherwise, - * we can instantly disconnect with a rude message. - */ - c = find234(ssh->channels, &localid, ssh_channelfind); - if (!c) { - char buf[80]; - sprintf(buf, "Received channel request for nonexistent" - " channel %d", localid); - logevent(buf); - s->pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT); - ssh2_pkt_adduint32(s->pktout, SSH2_DISCONNECT_BY_APPLICATION); - ssh2_pkt_addstring(s->pktout, buf); - ssh2_pkt_addstring(s->pktout, "en"); /* language tag */ - ssh2_pkt_send_noqueue(ssh, s->pktout); - connection_fatal(ssh->frontend, "%s", buf); - ssh_closing((Plug)ssh, NULL, 0, 0); - crStopV; - } - - /* - * Having got the channel number, we now look at - * the request type string to see if it's something - * we recognise. - */ - if (c == ssh->mainchan) { - /* - * We recognise "exit-status" and "exit-signal" on - * the primary channel. - */ - if (typelen == 11 && - !memcmp(type, "exit-status", 11)) { - - ssh->exitcode = ssh_pkt_getuint32(pktin); - logeventf(ssh, "Server sent command exit status %d", - ssh->exitcode); - reply = SSH2_MSG_CHANNEL_SUCCESS; - - } else if (typelen == 11 && - !memcmp(type, "exit-signal", 11)) { - - int is_plausible = TRUE, is_int = FALSE; - char *fmt_sig = "", *fmt_msg = ""; - char *msg; - int msglen = 0, core = FALSE; - /* ICK: older versions of OpenSSH (e.g. 3.4p1) - * provide an `int' for the signal, despite its - * having been a `string' in the drafts since at - * least 2001. (Fixed in session.c 1.147.) Try to - * infer which we can safely parse it as. */ - { - unsigned char *p = pktin->body + - pktin->savedpos; - long len = pktin->length - pktin->savedpos; - unsigned long num = GET_32BIT(p); /* what is it? */ - /* If it's 0, it hardly matters; assume string */ - if (num == 0) { - is_int = FALSE; - } else { - int maybe_int = FALSE, maybe_str = FALSE; -#define CHECK_HYPOTHESIS(offset, result) \ - do { \ - long q = offset; \ - if (q >= 0 && q+4 <= len) { \ - q = q + 4 + GET_32BIT(p+q); \ - if (q >= 0 && q+4 <= len && \ - (q = q + 4 + GET_32BIT(p+q)) && q == len) \ - result = TRUE; \ - } \ - } while(0) - CHECK_HYPOTHESIS(4+1, maybe_int); - CHECK_HYPOTHESIS(4+num+1, maybe_str); -#undef CHECK_HYPOTHESIS - if (maybe_int && !maybe_str) - is_int = TRUE; - else if (!maybe_int && maybe_str) - is_int = FALSE; - else - /* Crikey. Either or neither. Panic. */ - is_plausible = FALSE; - } - } - if (is_plausible) { - if (is_int) { - /* Old non-standard OpenSSH. */ - int signum = ssh_pkt_getuint32(pktin); - fmt_sig = dupprintf(" %d", signum); - } else { - /* As per the drafts. */ - char *sig; - int siglen; - ssh_pkt_getstring(pktin, &sig, &siglen); - /* Signal name isn't supposed to be blank, but - * let's cope gracefully if it is. */ - if (siglen) { - fmt_sig = dupprintf(" \"%.*s\"", - siglen, sig); - } - } - core = ssh2_pkt_getbool(pktin); - ssh_pkt_getstring(pktin, &msg, &msglen); - if (msglen) { - fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg); - } - /* ignore lang tag */ - } /* else don't attempt to parse */ - logeventf(ssh, "Server exited on signal%s%s%s", - fmt_sig, core ? " (core dumped)" : "", - fmt_msg); - if (*fmt_sig) sfree(fmt_sig); - if (*fmt_msg) sfree(fmt_msg); - reply = SSH2_MSG_CHANNEL_SUCCESS; - } - } else { - /* - * This is a channel request we don't know - * about, so we now either ignore the request - * or respond with CHANNEL_FAILURE, depending - * on want_reply. - */ - reply = SSH2_MSG_CHANNEL_FAILURE; - } - if (want_reply) { - s->pktout = ssh2_pkt_init(reply); - ssh2_pkt_adduint32(s->pktout, c->remoteid); - ssh2_pkt_send(ssh, s->pktout); - } - } else if (pktin->type == SSH2_MSG_GLOBAL_REQUEST) { - char *type; - int typelen, want_reply; - - ssh_pkt_getstring(pktin, &type, &typelen); - want_reply = ssh2_pkt_getbool(pktin); - - /* - * We currently don't support any global requests - * at all, so we either ignore the request or - * respond with REQUEST_FAILURE, depending on - * want_reply. - */ - if (want_reply) { - s->pktout = ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE); - ssh2_pkt_send(ssh, s->pktout); - } - } else if (pktin->type == SSH2_MSG_CHANNEL_OPEN) { - char *type; - int typelen; - char *peeraddr; - int peeraddrlen; - int peerport; - char *error = NULL; - struct ssh_channel *c; - unsigned remid, winsize, pktsize; - ssh_pkt_getstring(pktin, &type, &typelen); - c = snew(struct ssh_channel); - c->ssh = ssh; - - remid = ssh_pkt_getuint32(pktin); - winsize = ssh_pkt_getuint32(pktin); - pktsize = ssh_pkt_getuint32(pktin); - - if (typelen == 3 && !memcmp(type, "x11", 3)) { - char *addrstr; - - ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen); - addrstr = snewn(peeraddrlen+1, char); - memcpy(addrstr, peeraddr, peeraddrlen); - addrstr[peeraddrlen] = '\0'; - peerport = ssh_pkt_getuint32(pktin); - - logeventf(ssh, "Received X11 connect request from %s:%d", - addrstr, peerport); - - if (!ssh->X11_fwd_enabled) - error = "X11 forwarding is not enabled"; - else if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c, - ssh->x11auth, addrstr, peerport, - &ssh->cfg) != NULL) { - error = "Unable to open an X11 connection"; - } else { - logevent("Opening X11 forward connection succeeded"); - c->type = CHAN_X11; - } - - sfree(addrstr); - } else if (typelen == 15 && - !memcmp(type, "forwarded-tcpip", 15)) { - struct ssh_rportfwd pf, *realpf; - char *dummy; - int dummylen; - ssh_pkt_getstring(pktin, &dummy, &dummylen);/* skip address */ - pf.sport = ssh_pkt_getuint32(pktin); - ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen); - peerport = ssh_pkt_getuint32(pktin); - realpf = find234(ssh->rportfwds, &pf, NULL); - logeventf(ssh, "Received remote port %d open request " - "from %s:%d", pf.sport, peeraddr, peerport); - if (realpf == NULL) { - error = "Remote port is not recognised"; - } else { - const char *e = pfd_newconnect(&c->u.pfd.s, - realpf->dhost, - realpf->dport, c, - &ssh->cfg); - logeventf(ssh, "Attempting to forward remote port to " - "%s:%d", realpf->dhost, realpf->dport); - if (e != NULL) { - logeventf(ssh, "Port open failed: %s", e); - error = "Port open failed"; - } else { - logevent("Forwarded port opened successfully"); - c->type = CHAN_SOCKDATA; - } - } - } else if (typelen == 22 && - !memcmp(type, "auth-agent@openssh.com", 3)) { - if (!ssh->agentfwd_enabled) - error = "Agent forwarding is not enabled"; - else { - c->type = CHAN_AGENT; /* identify channel type */ - c->u.a.lensofar = 0; - } - } else { - error = "Unsupported channel type requested"; - } + /* + * _All_ the connection-layer packets we expect to + * receive are now handled by the dispatch table. + * Anything that reaches here must be bogus. + */ - c->remoteid = remid; - if (error) { - s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE); - ssh2_pkt_adduint32(s->pktout, c->remoteid); - ssh2_pkt_adduint32(s->pktout, SSH2_OPEN_CONNECT_FAILED); - ssh2_pkt_addstring(s->pktout, error); - ssh2_pkt_addstring(s->pktout, "en"); /* language tag */ - ssh2_pkt_send(ssh, s->pktout); - logeventf(ssh, "Rejected channel open: %s", error); - sfree(c); - } else { - c->localid = alloc_channel_id(ssh); - c->closes = 0; - c->v.v2.locwindow = OUR_V2_WINSIZE; - c->v.v2.remwindow = winsize; - c->v.v2.remmaxpkt = pktsize; - bufchain_init(&c->v.v2.outbuffer); - add234(ssh->channels, c); - s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); - ssh2_pkt_adduint32(s->pktout, c->remoteid); - ssh2_pkt_adduint32(s->pktout, c->localid); - ssh2_pkt_adduint32(s->pktout, c->v.v2.locwindow); - ssh2_pkt_adduint32(s->pktout, 0x4000UL); /* our max pkt size */ - ssh2_pkt_send(ssh, s->pktout); - } - } else { - bombout(("Strange packet received: type %d", pktin->type)); - crStopV; - } + bombout(("Strange packet received: type %d", pktin->type)); + crStopV; } else if (ssh->mainchan) { /* * We have spare data. Add it to the channel buffer. @@ -6822,14 +7116,168 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, } /* + * Handlers for SSH2 messages that might arrive at any moment. + */ +void ssh2_msg_disconnect(Ssh ssh, struct Packet *pktin) +{ + /* log reason code in disconnect message */ + char *buf, *msg; + int nowlen, reason, msglen; + + reason = ssh_pkt_getuint32(pktin); + ssh_pkt_getstring(pktin, &msg, &msglen); + + if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) { + buf = dupprintf("Received disconnect message (%s)", + ssh2_disconnect_reasons[reason]); + } else { + buf = dupprintf("Received disconnect message (unknown" + " type %d)", reason); + } + logevent(buf); + sfree(buf); + buf = dupprintf("Disconnection message text: %n%.*s", + &nowlen, msglen, msg); + logevent(buf); + bombout(("Server sent disconnect message\ntype %d (%s):\n\"%s\"", + reason, + (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ? + ssh2_disconnect_reasons[reason] : "unknown", + buf+nowlen)); + sfree(buf); +} + +void ssh2_msg_debug(Ssh ssh, struct Packet *pktin) +{ + /* log the debug message */ + char *buf, *msg; + int msglen; + int always_display; + + /* XXX maybe we should actually take notice of this */ + always_display = ssh2_pkt_getbool(pktin); + ssh_pkt_getstring(pktin, &msg, &msglen); + + buf = dupprintf("Remote debug message: %.*s", msglen, msg); + logevent(buf); + sfree(buf); +} + +void ssh2_msg_something_unimplemented(Ssh ssh, struct Packet *pktin) +{ + struct Packet *pktout; + pktout = ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED); + ssh2_pkt_adduint32(pktout, pktin->sequence); + /* + * UNIMPLEMENTED messages MUST appear in the same order as the + * messages they respond to. Hence, never queue them. + */ + ssh2_pkt_send_noqueue(ssh, pktout); +} + +/* * Handle the top-level SSH2 protocol. */ +static void ssh2_protocol_setup(Ssh ssh) +{ + int i; + + /* + * Most messages cause SSH2_MSG_UNIMPLEMENTED. + */ + for (i = 0; i < 256; i++) + ssh->packet_dispatch[i] = ssh2_msg_something_unimplemented; + + /* + * Any message we actually understand, we set to NULL so that + * the coroutines will get it. + */ + ssh->packet_dispatch[SSH2_MSG_UNIMPLEMENTED] = NULL; + ssh->packet_dispatch[SSH2_MSG_SERVICE_REQUEST] = NULL; + ssh->packet_dispatch[SSH2_MSG_SERVICE_ACCEPT] = NULL; + ssh->packet_dispatch[SSH2_MSG_KEXINIT] = NULL; + ssh->packet_dispatch[SSH2_MSG_NEWKEYS] = NULL; + ssh->packet_dispatch[SSH2_MSG_KEXDH_INIT] = NULL; + ssh->packet_dispatch[SSH2_MSG_KEXDH_REPLY] = NULL; + /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REQUEST] = NULL; duplicate case value */ + /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_GROUP] = NULL; duplicate case value */ + ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_INIT] = NULL; + ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REPLY] = NULL; + ssh->packet_dispatch[SSH2_MSG_USERAUTH_REQUEST] = NULL; + ssh->packet_dispatch[SSH2_MSG_USERAUTH_FAILURE] = NULL; + ssh->packet_dispatch[SSH2_MSG_USERAUTH_SUCCESS] = NULL; + ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL; + ssh->packet_dispatch[SSH2_MSG_USERAUTH_PK_OK] = NULL; + /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ] = NULL; duplicate case value */ + /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_REQUEST] = NULL; duplicate case value */ + ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_RESPONSE] = NULL; + ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = NULL; + ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = NULL; + ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = NULL; + + /* + * These special message types we install handlers for. + */ + ssh->packet_dispatch[SSH2_MSG_DISCONNECT] = ssh2_msg_disconnect; + ssh->packet_dispatch[SSH2_MSG_IGNORE] = ssh_msg_ignore; /* shared with ssh1 */ + ssh->packet_dispatch[SSH2_MSG_DEBUG] = ssh2_msg_debug; +} + +static void ssh2_timer(void *ctx, long now) +{ + Ssh ssh = (Ssh)ctx; + + if (!ssh->kex_in_progress && ssh->cfg.ssh_rekey_time != 0 && + now - ssh->next_rekey >= 0) { + do_ssh2_transport(ssh, "Initiating key re-exchange (timeout)", + -1, NULL); + } +} + static void ssh2_protocol(Ssh ssh, unsigned char *in, int inlen, struct Packet *pktin) { - if (do_ssh2_transport(ssh, in, inlen, pktin) == 0) + if (ssh->state == SSH_STATE_CLOSED) + return; + + if (pktin) { + ssh->incoming_data_size += pktin->encrypted_len; + if (!ssh->kex_in_progress && + ssh->max_data_size != 0 && + ssh->incoming_data_size > ssh->max_data_size) + do_ssh2_transport(ssh, "Initiating key re-exchange " + "(too much data received)", -1, NULL); + } + + if (pktin && ssh->packet_dispatch[pktin->type]) { + ssh->packet_dispatch[pktin->type](ssh, pktin); return; - do_ssh2_authconn(ssh, in, inlen, pktin); + } + + if (!ssh->protocol_initial_phase_done || + (pktin && pktin->type >= 20 && pktin->type < 50)) { + if (do_ssh2_transport(ssh, in, inlen, pktin) && + !ssh->protocol_initial_phase_done) { + ssh->protocol_initial_phase_done = TRUE; + /* + * Allow authconn to initialise itself. + */ + do_ssh2_authconn(ssh, NULL, 0, NULL); + } + } else { + do_ssh2_authconn(ssh, in, inlen, pktin); + } } /* @@ -6885,7 +7333,7 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle, ssh->ssh2_rdpkt_crstate = 0; ssh->do_ssh_init_crstate = 0; ssh->ssh_gotdata_crstate = 0; - ssh->ssh1_protocol_crstate = 0; + ssh->do_ssh1_connection_crstate = 0; ssh->do_ssh1_login_crstate = 0; ssh->do_ssh2_transport_crstate = 0; ssh->do_ssh2_authconn_crstate = 0; @@ -6899,6 +7347,7 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle, ssh->queue = NULL; ssh->queuelen = ssh->queuesize = 0; ssh->queueing = FALSE; + ssh->qhead = ssh->qtail = NULL; *backend_handle = ssh; @@ -6913,6 +7362,7 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle, ssh->channels = NULL; ssh->rportfwds = NULL; + ssh->portfwds = NULL; ssh->send_ok = 0; ssh->editing = 0; @@ -6923,10 +7373,21 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle, ssh->protocol = NULL; + ssh->protocol_initial_phase_done = FALSE; + + ssh->pinger = NULL; + + ssh->incoming_data_size = ssh->outgoing_data_size = + ssh->deferred_data_size = 0L; + ssh->max_data_size = parse_blocksize(ssh->cfg.ssh_rekey_data); + ssh->kex_in_progress = FALSE; + p = connect_to_host(ssh, host, port, realhost, nodelay, keepalive); if (p != NULL) return p; + random_ref(); + return NULL; } @@ -6966,6 +7427,13 @@ static void ssh_free(void *handle) ssh_free_packet(ssh->queue[ssh->queuelen]); sfree(ssh->queue); + while (ssh->qhead) { + struct queued_handler *qh = ssh->qhead; + ssh->qhead = qh->next; + sfree(ssh->qhead); + } + ssh->qhead = ssh->qtail = NULL; + if (ssh->channels) { while ((c = delpos234(ssh->channels, 0)) != NULL) { switch (c->type) { @@ -6981,12 +7449,14 @@ static void ssh_free(void *handle) sfree(c); } freetree234(ssh->channels); + ssh->channels = NULL; } if (ssh->rportfwds) { while ((pf = delpos234(ssh->rportfwds, 0)) != NULL) sfree(pf); freetree234(ssh->rportfwds); + ssh->rportfwds = NULL; } sfree(ssh->deferred_send_data); if (ssh->x11auth) @@ -7001,21 +7471,51 @@ static void ssh_free(void *handle) } if (ssh->s) ssh_do_close(ssh); + expire_timer_context(ssh); + if (ssh->pinger) + pinger_free(ssh->pinger); sfree(ssh); + + random_unref(); } /* * Reconfigure the SSH backend. - * - * Currently, this function does nothing very useful. In future, - * however, we could do some handy things with it. For example, we - * could make the port forwarding configurer active in the Change - * Settings box, and this routine could close down existing - * forwardings and open up new ones in response to changes. */ static void ssh_reconfig(void *handle, Config *cfg) { Ssh ssh = (Ssh) handle; + char *rekeying = NULL; + unsigned long old_max_data_size; + + pinger_reconfig(ssh->pinger, &ssh->cfg, cfg); + ssh_setup_portfwd(ssh, cfg); + + if (ssh->cfg.ssh_rekey_time != cfg->ssh_rekey_time && + cfg->ssh_rekey_time != 0) { + long new_next = ssh->last_rekey + cfg->ssh_rekey_time*60*TICKSPERSEC; + long now = GETTICKCOUNT(); + + if (new_next - now < 0) { + rekeying = "Initiating key re-exchange (timeout shortened)"; + } else { + ssh->next_rekey = schedule_timer(new_next - now, ssh2_timer, ssh); + } + } + + old_max_data_size = ssh->max_data_size; + ssh->max_data_size = parse_blocksize(cfg->ssh_rekey_data); + if (old_max_data_size != ssh->max_data_size && + ssh->max_data_size != 0) { + if (ssh->outgoing_data_size > ssh->max_data_size || + ssh->incoming_data_size > ssh->max_data_size) + rekeying = "Initiating key re-exchange (data limit lowered)"; + } + + if (rekeying && !ssh->kex_in_progress) { + do_ssh2_transport(ssh, rekeying, -1, NULL); + } + ssh->cfg = *cfg; /* STRUCTURE COPY */ } @@ -7114,13 +7614,17 @@ static void ssh_size(void *handle, int width, int height) */ static const struct telnet_special *ssh_get_specials(void *handle) { - static const struct telnet_special ignore_special[] = { + static const struct telnet_special ssh1_ignore_special[] = { + {"IGNORE message", TS_NOP} + }; + static const struct telnet_special ssh2_transport_specials[] = { {"IGNORE message", TS_NOP}, + {"Repeat key exchange", TS_REKEY}, }; static const struct telnet_special ssh2_session_specials[] = { {NULL, TS_SEP}, {"Break", TS_BRK}, - /* These are the signal names defined by draft-ietf-secsh-connect-19. + /* These are the signal names defined by draft-ietf-secsh-connect-23. * They include all the ISO C signals, but are a subset of the POSIX * required signals. */ {"SIGINT (Interrupt)", TS_SIGINT}, @@ -7138,7 +7642,8 @@ static const struct telnet_special *ssh_get_specials(void *handle) static const struct telnet_special specials_end[] = { {NULL, TS_EXITMENU} }; - static struct telnet_special ssh_specials[lenof(ignore_special) + + /* XXX review this length for any changes: */ + static struct telnet_special ssh_specials[lenof(ssh2_transport_specials) + lenof(ssh2_session_specials) + lenof(specials_end)]; Ssh ssh = (Ssh) handle; @@ -7155,10 +7660,9 @@ static const struct telnet_special *ssh_get_specials(void *handle) * won't cope with it, since we wouldn't bother sending it if * asked anyway. */ if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE)) - ADD_SPECIALS(ignore_special); + ADD_SPECIALS(ssh1_ignore_special); } else if (ssh->version == 2) { - /* XXX add rekey, when implemented */ - ADD_SPECIALS(ignore_special); + ADD_SPECIALS(ssh2_transport_specials); if (ssh->mainchan) ADD_SPECIALS(ssh2_session_specials); } /* else we're not ready yet */ @@ -7211,6 +7715,11 @@ static void ssh_special(void *handle, Telnet_Special code) ssh2_pkt_addstring_start(pktout); ssh2_pkt_send_noqueue(ssh, pktout); } + } else if (code == TS_REKEY) { + if (!ssh->kex_in_progress && ssh->version == 2) { + do_ssh2_transport(ssh, "Initiating key re-exchange at" + " user request", -1, NULL); + } } else if (code == TS_BRK) { if (ssh->state == SSH_STATE_CLOSED || ssh->state == SSH_STATE_PREPACKET) return; @@ -7309,7 +7818,7 @@ void ssh_send_port_open(void *channel, char *hostname, int port, char *org) PKT_INT, c->localid, PKT_STR, hostname, PKT_INT, port, - //PKT_STR, , + /* PKT_STR, , */ PKT_END); } else { pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN); @@ -7376,6 +7885,16 @@ static int ssh_return_exitcode(void *handle) } /* + * cfg_info for SSH is the currently running version of the + * protocol. (1 for 1; 2 for 2; 0 for not-decided-yet.) + */ +static int ssh_cfg_info(void *handle) +{ + Ssh ssh = (Ssh) handle; + return ssh->version; +} + +/* * Gross hack: pscp will try to start SFTP but fall back to scp1 if * that fails. This variable is the means by which scp.c can reach * into the SSH code and find out which one it got. @@ -7402,5 +7921,6 @@ Backend ssh_backend = { ssh_provide_ldisc, ssh_provide_logctx, ssh_unthrottle, + ssh_cfg_info, 22 };