X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/590f6a5ffcb58408a57a82ee2f70e686421a53ed..1c63e24602c01c5d7e5587088969d90a25807386:/ssh.c diff --git a/ssh.c b/ssh.c index 700aa70d..8c552b1e 100644 --- a/ssh.c +++ b/ssh.c @@ -512,10 +512,12 @@ struct ssh_rportfwd { struct Packet { long length; int type; + unsigned long sequence; unsigned char *data; unsigned char *body; long savedpos; long maxlen; + long encrypted_len; /* for SSH2 total-size counting */ /* * State associated with packet logging @@ -529,6 +531,8 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, struct Packet *pktin); static void ssh2_protocol(Ssh ssh, unsigned char *in, int inlen, struct Packet *pktin); +static void ssh1_protocol_setup(Ssh ssh); +static void ssh2_protocol_setup(Ssh ssh); static void ssh_size(void *handle, int width, int height); static void ssh_special(void *handle, Telnet_Special); static int ssh2_try_send(struct ssh_channel *c); @@ -540,6 +544,9 @@ static void ssh_do_close(Ssh ssh); static unsigned long ssh_pkt_getuint32(struct Packet *pkt); static int ssh2_pkt_getbool(struct Packet *pkt); static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length); +static void ssh2_timer(void *ctx, long now); +static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, + struct Packet *pktin); struct rdpkt1_state_tag { long len, pad, biglen, to_read; @@ -558,6 +565,8 @@ struct rdpkt2_state_tag { struct Packet *pktin; }; +typedef void (*handler_fn_t)(Ssh ssh, struct Packet *pktin); + struct ssh_tag { const struct plug_function_table *fn; /* the above field _must_ be first in the structure */ @@ -654,8 +663,8 @@ struct ssh_tag { int ssh2_rdpkt_crstate; int do_ssh_init_crstate; int ssh_gotdata_crstate; - int ssh1_protocol_crstate; int do_ssh1_login_crstate; + int do_ssh1_connection_crstate; int do_ssh2_transport_crstate; int do_ssh2_authconn_crstate; @@ -667,6 +676,9 @@ struct ssh_tag { struct rdpkt1_state_tag rdpkt1_state; struct rdpkt2_state_tag rdpkt2_state; + /* ssh1 and ssh2 use this for different things, but both use it */ + int protocol_initial_phase_done; + void (*protocol) (Ssh ssh, unsigned char *in, int inlen, struct Packet *pkt); struct Packet *(*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen); @@ -684,8 +696,30 @@ struct ssh_tag { */ void *agent_response; int agent_response_len; + + /* + * Dispatch table for packet types that we may have to deal + * with at any time. + */ + handler_fn_t packet_dispatch[256]; + + /* + * This module deals with sending keepalives. + */ + Pinger pinger; + + /* + * Track incoming and outgoing data sizes and time, for + * size-based rekeys. + */ + unsigned long incoming_data_size, outgoing_data_size, deferred_data_size; + int kex_in_progress; + long next_rekey; }; +#define MAX_DATA_BEFORE_REKEY (0x40000000UL) +#define REKEY_TIMEOUT (3600 * TICKSPERSEC) + #define logevent(s) logevent(ssh->frontend, s) /* logevent, only printf-formatted. */ @@ -873,8 +907,6 @@ static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen) crBegin(ssh->ssh1_rdpkt_crstate); - next_packet: - st->pktin = ssh_new_packet(); st->pktin->type = 0; @@ -992,48 +1024,6 @@ static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen) nblanks, &blank); } - if (st->pktin->type == SSH1_SMSG_STDOUT_DATA || - st->pktin->type == SSH1_SMSG_STDERR_DATA || - st->pktin->type == SSH1_MSG_DEBUG || - st->pktin->type == SSH1_SMSG_AUTH_TIS_CHALLENGE || - st->pktin->type == SSH1_SMSG_AUTH_CCARD_CHALLENGE) { - long stringlen = GET_32BIT(st->pktin->body); - if (stringlen + 4 != st->pktin->length) { - bombout(("Received data packet with bogus string length")); - ssh_free_packet(st->pktin); - crStop(NULL); - } - } - - if (st->pktin->type == SSH1_MSG_DEBUG) { - char *buf, *msg; - int msglen; - - ssh_pkt_getstring(st->pktin, &msg, &msglen); - buf = dupprintf("Remote debug message: %.*s", msglen, msg); - logevent(buf); - sfree(buf); - - ssh_free_packet(st->pktin); - goto next_packet; - } else if (st->pktin->type == SSH1_MSG_IGNORE) { - /* do nothing */ - ssh_free_packet(st->pktin); - goto next_packet; - } - - if (st->pktin->type == SSH1_MSG_DISCONNECT) { - /* log reason code in disconnect message */ - char *msg; - int msglen; - - ssh_pkt_getstring(st->pktin, &msg, &msglen); - - bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg)); - ssh_free_packet(st->pktin); - crStop(NULL); - } - crFinish(st->pktin); } @@ -1043,8 +1033,6 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) crBegin(ssh->ssh2_rdpkt_crstate); - next_packet: - st->pktin = ssh_new_packet(); st->pktin->type = 0; @@ -1126,6 +1114,8 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) st->pktin->data + st->cipherblk, st->packetlen - st->cipherblk); + st->pktin->encrypted_len = st->packetlen; + /* * Check the MAC. */ @@ -1136,7 +1126,8 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) ssh_free_packet(st->pktin); crStop(NULL); } - st->incoming_sequence++; /* whether or not we MACed */ + + st->pktin->sequence = st->incoming_sequence++; /* * Decompress packet payload. @@ -1191,115 +1182,6 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) nblanks, &blank); } - switch (st->pktin->type) { - /* - * These packets we must handle instantly. - */ - case SSH2_MSG_DISCONNECT: - { - /* log reason code in disconnect message */ - char *buf, *msg; - int nowlen, reason, msglen; - - reason = ssh_pkt_getuint32(st->pktin); - ssh_pkt_getstring(st->pktin, &msg, &msglen); - - if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) { - buf = dupprintf("Received disconnect message (%s)", - ssh2_disconnect_reasons[reason]); - } else { - buf = dupprintf("Received disconnect message (unknown" - " type %d)", reason); - } - logevent(buf); - sfree(buf); - buf = dupprintf("Disconnection message text: %n%.*s", - &nowlen, msglen, msg); - logevent(buf); - bombout(("Server sent disconnect message\ntype %d (%s):\n\"%s\"", - reason, - (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ? - ssh2_disconnect_reasons[reason] : "unknown", - buf+nowlen)); - sfree(buf); - ssh_free_packet(st->pktin); - crStop(NULL); - } - break; - case SSH2_MSG_IGNORE: - ssh_free_packet(st->pktin); - goto next_packet; - case SSH2_MSG_DEBUG: - { - /* log the debug message */ - char *buf, *msg; - int msglen; - int always_display; - - /* XXX maybe we should actually take notice of this */ - always_display = ssh2_pkt_getbool(st->pktin); - ssh_pkt_getstring(st->pktin, &msg, &msglen); - - buf = dupprintf("Remote debug message: %.*s", msglen, msg); - logevent(buf); - sfree(buf); - } - ssh_free_packet(st->pktin); - goto next_packet; - - /* - * These packets we need do nothing about here. - */ - case SSH2_MSG_UNIMPLEMENTED: - case SSH2_MSG_SERVICE_REQUEST: - case SSH2_MSG_SERVICE_ACCEPT: - case SSH2_MSG_KEXINIT: - case SSH2_MSG_NEWKEYS: - case SSH2_MSG_KEXDH_INIT: - case SSH2_MSG_KEXDH_REPLY: - /* case SSH2_MSG_KEX_DH_GEX_REQUEST: duplicate case value */ - /* case SSH2_MSG_KEX_DH_GEX_GROUP: duplicate case value */ - case SSH2_MSG_KEX_DH_GEX_INIT: - case SSH2_MSG_KEX_DH_GEX_REPLY: - case SSH2_MSG_USERAUTH_REQUEST: - case SSH2_MSG_USERAUTH_FAILURE: - case SSH2_MSG_USERAUTH_SUCCESS: - case SSH2_MSG_USERAUTH_BANNER: - case SSH2_MSG_USERAUTH_PK_OK: - /* case SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ: duplicate case value */ - /* case SSH2_MSG_USERAUTH_INFO_REQUEST: duplicate case value */ - case SSH2_MSG_USERAUTH_INFO_RESPONSE: - case SSH2_MSG_GLOBAL_REQUEST: - case SSH2_MSG_REQUEST_SUCCESS: - case SSH2_MSG_REQUEST_FAILURE: - case SSH2_MSG_CHANNEL_OPEN: - case SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: - case SSH2_MSG_CHANNEL_OPEN_FAILURE: - case SSH2_MSG_CHANNEL_WINDOW_ADJUST: - case SSH2_MSG_CHANNEL_DATA: - case SSH2_MSG_CHANNEL_EXTENDED_DATA: - case SSH2_MSG_CHANNEL_EOF: - case SSH2_MSG_CHANNEL_CLOSE: - case SSH2_MSG_CHANNEL_REQUEST: - case SSH2_MSG_CHANNEL_SUCCESS: - case SSH2_MSG_CHANNEL_FAILURE: - break; - - /* - * For anything else we send SSH2_MSG_UNIMPLEMENTED. - */ - default: - { - struct Packet *pktout; - pktout = ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED); - ssh2_pkt_adduint32(pktout, st->incoming_sequence - 1); - /* UNIMPLEMENTED messages MUST appear in the same order as - * the messages they respond to. Hence, never queue them. */ - ssh2_pkt_send_noqueue(ssh, pktout); - } - break; - } - crFinish(st->pktin); } @@ -1727,6 +1609,8 @@ static int ssh2_pkt_construct(Ssh ssh, struct Packet *pkt) ssh->cscipher->encrypt(ssh->cs_cipher_ctx, pkt->data, pkt->length + padding); + pkt->encrypted_len = pkt->length + padding; + /* Ready-to-send packet starts at pkt->data. We return length. */ return pkt->length + padding + maclen; } @@ -1771,6 +1655,13 @@ static void ssh2_pkt_send_noqueue(Ssh ssh, struct Packet *pkt) backlog = sk_write(ssh->s, (char *)pkt->data, len); if (backlog > SSH_MAX_BACKLOG) ssh_throttle_all(ssh, 1, backlog); + + ssh->outgoing_data_size += pkt->encrypted_len; + if (!ssh->kex_in_progress && + ssh->outgoing_data_size > MAX_DATA_BEFORE_REKEY) + do_ssh2_transport(ssh, "Initiating key re-exchange " + "(too much data sent)", -1, NULL); + ssh_free_packet(pkt); } @@ -1788,6 +1679,7 @@ static void ssh2_pkt_defer_noqueue(Ssh ssh, struct Packet *pkt) } memcpy(ssh->deferred_send_data + ssh->deferred_len, pkt->data, len); ssh->deferred_len += len; + ssh->deferred_data_size += pkt->encrypted_len; ssh_free_packet(pkt); } @@ -1853,6 +1745,13 @@ static void ssh_pkt_defersend(Ssh ssh) ssh->deferred_send_data = NULL; if (backlog > SSH_MAX_BACKLOG) ssh_throttle_all(ssh, 1, backlog); + + ssh->outgoing_data_size += ssh->deferred_data_size; + if (!ssh->kex_in_progress && + ssh->outgoing_data_size > MAX_DATA_BEFORE_REKEY) + do_ssh2_transport(ssh, "Initiating key re-exchange " + "(too much data sent)", -1, NULL); + ssh->deferred_data_size = 0; } /* @@ -2168,6 +2067,29 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring) } } +/* + * The `software version' part of an SSH version string is required + * to contain no spaces or minus signs. + */ +static void ssh_fix_verstring(char *str) +{ + /* Eat "SSH--". */ + assert(*str == 'S'); str++; + assert(*str == 'S'); str++; + assert(*str == 'H'); str++; + assert(*str == '-'); str++; + while (*str && *str != '-') str++; + assert(*str == '-'); str++; + + /* Convert minus signs and spaces in the remaining string into + * underscores. */ + while (*str) { + if (*str == '-' || *str == ' ') + *str = '_'; + str++; + } +} + static int do_ssh_init(Ssh ssh, unsigned char c) { struct do_ssh_init_state { @@ -2227,7 +2149,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c) ssh->rdpkt2_state.incoming_sequence = 0; s->vstring[s->vslen] = 0; - s->vstring[strcspn(s->vstring, "\r\n")] = '\0';/* remove EOL chars */ + s->vstring[strcspn(s->vstring, "\015\012")] = '\0';/* remove EOL chars */ { char *vlog; vlog = snewn(20 + s->vslen, char); @@ -2255,46 +2177,63 @@ static int do_ssh_init(Ssh ssh, unsigned char c) crStop(0); } - if (s->proto2 && (ssh->cfg.sshprot >= 2 || !s->proto1)) { - /* - * Use v2 protocol. - */ - char verstring[80], vlog[100]; - sprintf(verstring, "SSH-2.0-%s", sshver); - SHA_Init(&ssh->exhashbase); - /* - * Hash our version string and their version string. - */ - sha_string(&ssh->exhashbase, verstring, strlen(verstring)); - sha_string(&ssh->exhashbase, s->vstring, strcspn(s->vstring, "\r\n")); - sprintf(vlog, "We claim version: %s", verstring); - logevent(vlog); - strcat(verstring, "\012"); - logevent("Using SSH protocol version 2"); - sk_write(ssh->s, verstring, strlen(verstring)); - ssh->protocol = ssh2_protocol; - ssh->version = 2; - ssh->s_rdpkt = ssh2_rdpkt; - } else { - /* - * Use v1 protocol. - */ - char verstring[80], vlog[100]; - sprintf(verstring, "SSH-%s-%s", - (ssh_versioncmp(s->version, "1.5") <= 0 ? s->version : "1.5"), - sshver); - sprintf(vlog, "We claim version: %s", verstring); - logevent(vlog); - strcat(verstring, "\012"); + { + char *verstring; + + if (s->proto2 && (ssh->cfg.sshprot >= 2 || !s->proto1)) { + /* + * Construct a v2 version string. + */ + verstring = dupprintf("SSH-2.0-%s\015\012", sshver); + ssh->version = 2; + } else { + /* + * Construct a v1 version string. + */ + verstring = dupprintf("SSH-%s-%s\012", + (ssh_versioncmp(s->version, "1.5") <= 0 ? + s->version : "1.5"), + sshver); + ssh->version = 1; + } - logevent("Using SSH protocol version 1"); + ssh_fix_verstring(verstring); + + if (ssh->version == 2) { + /* + * Hash our version string and their version string. + */ + SHA_Init(&ssh->exhashbase); + sha_string(&ssh->exhashbase, verstring, + strcspn(verstring, "\015\012")); + sha_string(&ssh->exhashbase, s->vstring, + strcspn(s->vstring, "\015\012")); + + /* + * Initialise SSHv2 protocol. + */ + ssh->protocol = ssh2_protocol; + ssh2_protocol_setup(ssh); + ssh->s_rdpkt = ssh2_rdpkt; + } else { + /* + * Initialise SSHv1 protocol. + */ + ssh->protocol = ssh1_protocol; + ssh1_protocol_setup(ssh); + ssh->s_rdpkt = ssh1_rdpkt; + } + logeventf(ssh, "We claim version: %.*s", + strcspn(verstring, "\015\012"), verstring); sk_write(ssh->s, verstring, strlen(verstring)); - ssh->protocol = ssh1_protocol; - ssh->version = 1; - ssh->s_rdpkt = ssh1_rdpkt; + sfree(verstring); } + + logeventf(ssh, "Using SSH protocol version %d", ssh->version); + update_specials_menu(ssh->frontend); ssh->state = SSH_STATE_BEFORE_SIZE; + ssh->pinger = pinger_new(&ssh->cfg, &ssh_backend, ssh); sfree(s->vstring); @@ -2354,6 +2293,7 @@ static void ssh_do_close(Ssh ssh) if (ssh->s) { sk_close(ssh->s); ssh->s = NULL; + notify_remote_exit(ssh->frontend); } /* * Now we must shut down any port and X forwardings going @@ -2465,6 +2405,7 @@ static const char *connect_to_host(Ssh ssh, char *host, int port, 0, 1, nodelay, keepalive, (Plug) ssh, &ssh->cfg); if ((err = sk_socket_error(ssh->s)) != NULL) { ssh->s = NULL; + notify_remote_exit(ssh->frontend); return err; } @@ -3574,18 +3515,338 @@ void sshfwd_unthrottle(struct ssh_channel *c, int bufsize) } } -static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, - struct Packet *pktin) +static void ssh1_smsg_stdout_stderr_data(Ssh ssh, struct Packet *pktin) { - crBegin(ssh->ssh1_protocol_crstate); + char *string; + int stringlen, bufsize; - random_init(); + ssh_pkt_getstring(pktin, &string, &stringlen); + if (string == NULL) { + bombout(("Incoming terminal data packet was badly formed")); + return; + } - while (!do_ssh1_login(ssh, in, inlen, pktin)) { - crReturnV; + bufsize = from_backend(ssh->frontend, pktin->type == SSH1_SMSG_STDERR_DATA, + string, stringlen); + if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) { + ssh->v1_stdout_throttling = 1; + ssh1_throttle(ssh, +1); + } +} + +static void ssh1_smsg_x11_open(Ssh ssh, struct Packet *pktin) +{ + /* Remote side is trying to open a channel to talk to our + * X-Server. Give them back a local channel number. */ + struct ssh_channel *c; + int remoteid = ssh_pkt_getuint32(pktin); + + logevent("Received X11 connect request"); + /* Refuse if X11 forwarding is disabled. */ + if (!ssh->X11_fwd_enabled) { + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, remoteid, PKT_END); + logevent("Rejected X11 connect request"); + } else { + c = snew(struct ssh_channel); + c->ssh = ssh; + + if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c, + ssh->x11auth, NULL, -1, &ssh->cfg) != NULL) { + logevent("Opening X11 forward connection failed"); + sfree(c); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, remoteid, PKT_END); + } else { + logevent + ("Opening X11 forward connection succeeded"); + c->remoteid = remoteid; + c->localid = alloc_channel_id(ssh); + c->closes = 0; + c->v.v1.throttling = 0; + c->type = CHAN_X11; /* identify channel type */ + add234(ssh->channels, c); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, + PKT_INT, c->remoteid, PKT_INT, + c->localid, PKT_END); + logevent("Opened X11 forward channel"); + } + } +} + +static void ssh1_smsg_agent_open(Ssh ssh, struct Packet *pktin) +{ + /* Remote side is trying to open a channel to talk to our + * agent. Give them back a local channel number. */ + struct ssh_channel *c; + int remoteid = ssh_pkt_getuint32(pktin); + + /* Refuse if agent forwarding is disabled. */ + if (!ssh->agentfwd_enabled) { + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, remoteid, PKT_END); + } else { + c = snew(struct ssh_channel); + c->ssh = ssh; + c->remoteid = remoteid; + c->localid = alloc_channel_id(ssh); + c->closes = 0; + c->v.v1.throttling = 0; + c->type = CHAN_AGENT; /* identify channel type */ + c->u.a.lensofar = 0; + add234(ssh->channels, c); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, + PKT_INT, c->remoteid, PKT_INT, c->localid, + PKT_END); + } +} + +static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin) +{ + /* Remote side is trying to open a channel to talk to a + * forwarded port. Give them back a local channel number. */ + struct ssh_channel *c; + struct ssh_rportfwd pf; + int remoteid; + int hostsize, port; + char *host, buf[1024]; + const char *e; + c = snew(struct ssh_channel); + c->ssh = ssh; + + remoteid = ssh_pkt_getuint32(pktin); + ssh_pkt_getstring(pktin, &host, &hostsize); + port = ssh_pkt_getuint32(pktin); + + if (hostsize >= lenof(pf.dhost)) + hostsize = lenof(pf.dhost)-1; + memcpy(pf.dhost, host, hostsize); + pf.dhost[hostsize] = '\0'; + pf.dport = port; + + if (find234(ssh->rportfwds, &pf, NULL) == NULL) { + sprintf(buf, "Rejected remote port open request for %s:%d", + pf.dhost, port); + logevent(buf); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, remoteid, PKT_END); + } else { + sprintf(buf, "Received remote port open request for %s:%d", + pf.dhost, port); + logevent(buf); + e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port, + c, &ssh->cfg); + if (e != NULL) { + char buf[256]; + sprintf(buf, "Port open failed: %s", e); + logevent(buf); + sfree(c); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, + PKT_INT, remoteid, PKT_END); + } else { + c->remoteid = remoteid; + c->localid = alloc_channel_id(ssh); + c->closes = 0; + c->v.v1.throttling = 0; + c->type = CHAN_SOCKDATA; /* identify channel type */ + add234(ssh->channels, c); + send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, + PKT_INT, c->remoteid, PKT_INT, + c->localid, PKT_END); + logevent("Forwarded port opened successfully"); + } + } +} + +static void ssh1_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin) +{ + unsigned int remoteid = ssh_pkt_getuint32(pktin); + unsigned int localid = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + + c = find234(ssh->channels, &remoteid, ssh_channelfind); + if (c && c->type == CHAN_SOCKDATA_DORMANT) { + c->remoteid = localid; + c->type = CHAN_SOCKDATA; + c->v.v1.throttling = 0; + pfd_confirm(c->u.pfd.s); } - if (ssh->state == SSH_STATE_CLOSED) - crReturnV; + + if (c && c->closes) { + /* + * We have a pending close on this channel, + * which we decided on before the server acked + * the channel open. So now we know the + * remoteid, we can close it again. + */ + send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, + PKT_INT, c->remoteid, PKT_END); + } +} + +static void ssh1_msg_channel_open_failure(Ssh ssh, struct Packet *pktin) +{ + unsigned int remoteid = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + + c = find234(ssh->channels, &remoteid, ssh_channelfind); + if (c && c->type == CHAN_SOCKDATA_DORMANT) { + logevent("Forwarded connection refused by server"); + pfd_close(c->u.pfd.s); + del234(ssh->channels, c); + sfree(c); + } +} + +static void ssh1_msg_channel_close(Ssh ssh, struct Packet *pktin) +{ + /* Remote side closes a channel. */ + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + c = find234(ssh->channels, &i, ssh_channelfind); + if (c && ((int)c->remoteid) != -1) { + int closetype; + closetype = + (pktin->type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2); + + if ((c->closes == 0) && (c->type == CHAN_X11)) { + logevent("Forwarded X11 connection terminated"); + assert(c->u.x11.s != NULL); + x11_close(c->u.x11.s); + c->u.x11.s = NULL; + } + if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) { + logevent("Forwarded port closed"); + assert(c->u.pfd.s != NULL); + pfd_close(c->u.pfd.s); + c->u.pfd.s = NULL; + } + + c->closes |= (closetype << 2); /* seen this message */ + if (!(c->closes & closetype)) { + send_packet(ssh, pktin->type, PKT_INT, c->remoteid, + PKT_END); + c->closes |= closetype; /* sent it too */ + } + + if (c->closes == 15) { + del234(ssh->channels, c); + sfree(c); + } + } else { + bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n", + pktin->type == SSH1_MSG_CHANNEL_CLOSE ? "" : + "_CONFIRMATION", c ? "half-open" : "nonexistent", + i)); + } +} + +static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin) +{ + /* Data sent down one of our channels. */ + int i = ssh_pkt_getuint32(pktin); + char *p; + int len; + struct ssh_channel *c; + + ssh_pkt_getstring(pktin, &p, &len); + + c = find234(ssh->channels, &i, ssh_channelfind); + if (c) { + int bufsize = 0; + switch (c->type) { + case CHAN_X11: + bufsize = x11_send(c->u.x11.s, p, len); + break; + case CHAN_SOCKDATA: + bufsize = pfd_send(c->u.pfd.s, p, len); + break; + case CHAN_AGENT: + /* Data for an agent message. Buffer it. */ + while (len > 0) { + if (c->u.a.lensofar < 4) { + int l = min(4 - c->u.a.lensofar, len); + memcpy(c->u.a.msglen + c->u.a.lensofar, p, + l); + p += l; + len -= l; + c->u.a.lensofar += l; + } + if (c->u.a.lensofar == 4) { + c->u.a.totallen = + 4 + GET_32BIT(c->u.a.msglen); + c->u.a.message = snewn(c->u.a.totallen, + unsigned char); + memcpy(c->u.a.message, c->u.a.msglen, 4); + } + if (c->u.a.lensofar >= 4 && len > 0) { + int l = + min(c->u.a.totallen - c->u.a.lensofar, + len); + memcpy(c->u.a.message + c->u.a.lensofar, p, + l); + p += l; + len -= l; + c->u.a.lensofar += l; + } + if (c->u.a.lensofar == c->u.a.totallen) { + void *reply; + int replylen; + if (agent_query(c->u.a.message, + c->u.a.totallen, + &reply, &replylen, + ssh_agentf_callback, c)) + ssh_agentf_callback(c, reply, replylen); + sfree(c->u.a.message); + c->u.a.lensofar = 0; + } + } + bufsize = 0; /* agent channels never back up */ + break; + } + if (!c->v.v1.throttling && bufsize > SSH1_BUFFER_LIMIT) { + c->v.v1.throttling = 1; + ssh1_throttle(ssh, +1); + } + } +} + +static void ssh1_smsg_exit_status(Ssh ssh, struct Packet *pktin) +{ + char buf[100]; + ssh->exitcode = ssh_pkt_getuint32(pktin); + sprintf(buf, "Server sent command exit status %d", + ssh->exitcode); + logevent(buf); + send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END); + /* + * In case `helpful' firewalls or proxies tack + * extra human-readable text on the end of the + * session which we might mistake for another + * encrypted packet, we close the session once + * we've sent EXIT_CONFIRMATION. + */ + ssh_closing((Plug)ssh, NULL, 0, 0); +} + +static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen, + struct Packet *pktin) +{ + crBegin(ssh->do_ssh1_connection_crstate); + + ssh->packet_dispatch[SSH1_SMSG_STDOUT_DATA] = + ssh->packet_dispatch[SSH1_SMSG_STDERR_DATA] = + ssh1_smsg_stdout_stderr_data; + + ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_CONFIRMATION] = + ssh1_msg_channel_open_confirmation; + ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_FAILURE] = + ssh1_msg_channel_open_failure; + ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE] = + ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION] = + ssh1_msg_channel_close; + ssh->packet_dispatch[SSH1_MSG_CHANNEL_DATA] = ssh1_msg_channel_data; + ssh->packet_dispatch[SSH1_SMSG_EXIT_STATUS] = ssh1_smsg_exit_status; if (ssh->cfg.agentfwd && agent_exists()) { logevent("Requesting agent forwarding"); @@ -3602,6 +3863,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, } else { logevent("Agent forwarding enabled"); ssh->agentfwd_enabled = TRUE; + ssh->packet_dispatch[SSH1_SMSG_AGENT_OPEN] = ssh1_smsg_agent_open; } } @@ -3632,6 +3894,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, } else { logevent("X11 forwarding enabled"); ssh->X11_fwd_enabled = TRUE; + ssh->packet_dispatch[SSH1_SMSG_X11_OPEN] = ssh1_smsg_x11_open; } } @@ -3781,8 +4044,12 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, } else if (pktin->type == SSH1_SMSG_FAILURE) { c_write_str(ssh, "Server refused port" " forwarding\r\n"); + logevent("Server refused this port forwarding"); + } else { + logevent("Remote port forwarding enabled"); + ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = + ssh1_msg_port_open; } - logevent("Remote port forwarding enabled"); } } sfree(sportdesc); @@ -3874,313 +4141,20 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, ssh->send_ok = 1; ssh->channels = newtree234(ssh_channelcmp); while (1) { - crReturnV; - if (pktin) { - if (pktin->type == SSH1_SMSG_STDOUT_DATA || - pktin->type == SSH1_SMSG_STDERR_DATA) { - char *string; - int stringlen, bufsize; - - ssh_pkt_getstring(pktin, &string, &stringlen); - if (string == NULL) { - bombout(("Incoming terminal data packet was badly formed")); - crStopV; - } - - bufsize = - from_backend(ssh->frontend, - pktin->type == SSH1_SMSG_STDERR_DATA, - string, stringlen); - if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) { - ssh->v1_stdout_throttling = 1; - ssh1_throttle(ssh, +1); - } - } else if (pktin->type == SSH1_MSG_DISCONNECT) { - ssh_closing((Plug)ssh, NULL, 0, 0); - logevent("Received disconnect request"); - crStopV; - } else if (pktin->type == SSH1_SMSG_X11_OPEN) { - /* Remote side is trying to open a channel to talk to our - * X-Server. Give them back a local channel number. */ - struct ssh_channel *c; - int remoteid = ssh_pkt_getuint32(pktin); - - logevent("Received X11 connect request"); - /* Refuse if X11 forwarding is disabled. */ - if (!ssh->X11_fwd_enabled) { - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, - PKT_INT, remoteid, PKT_END); - logevent("Rejected X11 connect request"); - } else { - c = snew(struct ssh_channel); - c->ssh = ssh; - - if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c, - ssh->x11auth, NULL, -1, &ssh->cfg) != NULL) { - logevent("Opening X11 forward connection failed"); - sfree(c); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, - PKT_INT, remoteid, PKT_END); - } else { - logevent - ("Opening X11 forward connection succeeded"); - c->remoteid = remoteid; - c->localid = alloc_channel_id(ssh); - c->closes = 0; - c->v.v1.throttling = 0; - c->type = CHAN_X11; /* identify channel type */ - add234(ssh->channels, c); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, - PKT_INT, c->remoteid, PKT_INT, - c->localid, PKT_END); - logevent("Opened X11 forward channel"); - } - } - } else if (pktin->type == SSH1_SMSG_AGENT_OPEN) { - /* Remote side is trying to open a channel to talk to our - * agent. Give them back a local channel number. */ - struct ssh_channel *c; - int remoteid = ssh_pkt_getuint32(pktin); - - /* Refuse if agent forwarding is disabled. */ - if (!ssh->agentfwd_enabled) { - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, - PKT_INT, remoteid, PKT_END); - } else { - c = snew(struct ssh_channel); - c->ssh = ssh; - c->remoteid = remoteid; - c->localid = alloc_channel_id(ssh); - c->closes = 0; - c->v.v1.throttling = 0; - c->type = CHAN_AGENT; /* identify channel type */ - c->u.a.lensofar = 0; - add234(ssh->channels, c); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, - PKT_INT, c->remoteid, PKT_INT, c->localid, - PKT_END); - } - } else if (pktin->type == SSH1_MSG_PORT_OPEN) { - /* Remote side is trying to open a channel to talk to a - * forwarded port. Give them back a local channel number. */ - struct ssh_channel *c; - struct ssh_rportfwd pf; - int remoteid; - int hostsize, port; - char *host, buf[1024]; - const char *e; - c = snew(struct ssh_channel); - c->ssh = ssh; - - remoteid = ssh_pkt_getuint32(pktin); - ssh_pkt_getstring(pktin, &host, &hostsize); - port = ssh_pkt_getuint32(pktin); - - if (hostsize >= lenof(pf.dhost)) - hostsize = lenof(pf.dhost)-1; - memcpy(pf.dhost, host, hostsize); - pf.dhost[hostsize] = '\0'; - pf.dport = port; - - if (find234(ssh->rportfwds, &pf, NULL) == NULL) { - sprintf(buf, "Rejected remote port open request for %s:%d", - pf.dhost, port); - logevent(buf); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, - PKT_INT, remoteid, PKT_END); - } else { - sprintf(buf, "Received remote port open request for %s:%d", - pf.dhost, port); - logevent(buf); - e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port, - c, &ssh->cfg); - if (e != NULL) { - char buf[256]; - sprintf(buf, "Port open failed: %s", e); - logevent(buf); - sfree(c); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, - PKT_INT, remoteid, PKT_END); - } else { - c->remoteid = remoteid; - c->localid = alloc_channel_id(ssh); - c->closes = 0; - c->v.v1.throttling = 0; - c->type = CHAN_SOCKDATA; /* identify channel type */ - add234(ssh->channels, c); - send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION, - PKT_INT, c->remoteid, PKT_INT, - c->localid, PKT_END); - logevent("Forwarded port opened successfully"); - } - } - - } else if (pktin->type == SSH1_MSG_CHANNEL_OPEN_CONFIRMATION) { - unsigned int remoteid = ssh_pkt_getuint32(pktin); - unsigned int localid = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - - c = find234(ssh->channels, &remoteid, ssh_channelfind); - if (c && c->type == CHAN_SOCKDATA_DORMANT) { - c->remoteid = localid; - c->type = CHAN_SOCKDATA; - c->v.v1.throttling = 0; - pfd_confirm(c->u.pfd.s); - } - - if (c && c->closes) { - /* - * We have a pending close on this channel, - * which we decided on before the server acked - * the channel open. So now we know the - * remoteid, we can close it again. - */ - send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, - PKT_INT, c->remoteid, PKT_END); - } - - } else if (pktin->type == SSH1_MSG_CHANNEL_OPEN_FAILURE) { - unsigned int remoteid = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &remoteid, ssh_channelfind); - if (c && c->type == CHAN_SOCKDATA_DORMANT) { - logevent("Forwarded connection refused by server"); - pfd_close(c->u.pfd.s); - del234(ssh->channels, c); - sfree(c); - } - - } else if (pktin->type == SSH1_MSG_CHANNEL_CLOSE || - pktin->type == SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION) { - /* Remote side closes a channel. */ - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (c && ((int)c->remoteid) != -1) { - int closetype; - closetype = - (pktin->type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2); - - if ((c->closes == 0) && (c->type == CHAN_X11)) { - logevent("Forwarded X11 connection terminated"); - assert(c->u.x11.s != NULL); - x11_close(c->u.x11.s); - c->u.x11.s = NULL; - } - if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) { - logevent("Forwarded port closed"); - assert(c->u.pfd.s != NULL); - pfd_close(c->u.pfd.s); - c->u.pfd.s = NULL; - } - - c->closes |= (closetype << 2); /* seen this message */ - if (!(c->closes & closetype)) { - send_packet(ssh, pktin->type, PKT_INT, c->remoteid, - PKT_END); - c->closes |= closetype; /* sent it too */ - } + /* + * By this point, most incoming packets are already being + * handled by the dispatch table, and we need only pay + * attention to the unusual ones. + */ - if (c->closes == 15) { - del234(ssh->channels, c); - sfree(c); - } - } else { - bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n", - pktin->type == SSH1_MSG_CHANNEL_CLOSE ? "" : - "_CONFIRMATION", c ? "half-open" : "nonexistent", - i)); - crStopV; - } - } else if (pktin->type == SSH1_MSG_CHANNEL_DATA) { - /* Data sent down one of our channels. */ - int i = ssh_pkt_getuint32(pktin); - char *p; - int len; - struct ssh_channel *c; - - ssh_pkt_getstring(pktin, &p, &len); - - c = find234(ssh->channels, &i, ssh_channelfind); - if (c) { - int bufsize = 0; - switch (c->type) { - case CHAN_X11: - bufsize = x11_send(c->u.x11.s, p, len); - break; - case CHAN_SOCKDATA: - bufsize = pfd_send(c->u.pfd.s, p, len); - break; - case CHAN_AGENT: - /* Data for an agent message. Buffer it. */ - while (len > 0) { - if (c->u.a.lensofar < 4) { - int l = min(4 - c->u.a.lensofar, len); - memcpy(c->u.a.msglen + c->u.a.lensofar, p, - l); - p += l; - len -= l; - c->u.a.lensofar += l; - } - if (c->u.a.lensofar == 4) { - c->u.a.totallen = - 4 + GET_32BIT(c->u.a.msglen); - c->u.a.message = snewn(c->u.a.totallen, - unsigned char); - memcpy(c->u.a.message, c->u.a.msglen, 4); - } - if (c->u.a.lensofar >= 4 && len > 0) { - int l = - min(c->u.a.totallen - c->u.a.lensofar, - len); - memcpy(c->u.a.message + c->u.a.lensofar, p, - l); - p += l; - len -= l; - c->u.a.lensofar += l; - } - if (c->u.a.lensofar == c->u.a.totallen) { - void *reply; - int replylen; - if (agent_query(c->u.a.message, - c->u.a.totallen, - &reply, &replylen, - ssh_agentf_callback, c)) - ssh_agentf_callback(c, reply, replylen); - sfree(c->u.a.message); - c->u.a.lensofar = 0; - } - } - bufsize = 0; /* agent channels never back up */ - break; - } - if (!c->v.v1.throttling && bufsize > SSH1_BUFFER_LIMIT) { - c->v.v1.throttling = 1; - ssh1_throttle(ssh, +1); - } - } - } else if (pktin->type == SSH1_SMSG_SUCCESS) { + crReturnV; + if (pktin) { + if (pktin->type == SSH1_SMSG_SUCCESS) { /* may be from EXEC_SHELL on some servers */ } else if (pktin->type == SSH1_SMSG_FAILURE) { /* may be from EXEC_SHELL on some servers * if no pty is available or in other odd cases. Ignore */ - } else if (pktin->type == SSH1_SMSG_EXIT_STATUS) { - char buf[100]; - ssh->exitcode = ssh_pkt_getuint32(pktin); - sprintf(buf, "Server sent command exit status %d", - ssh->exitcode); - logevent(buf); - send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END); - /* - * In case `helpful' firewalls or proxies tack - * extra human-readable text on the end of the - * session which we might mistake for another - * encrypted packet, we close the session once - * we've sent EXIT_CONFIRMATION. - */ - ssh_closing((Plug)ssh, NULL, 0, 0); - crStopV; } else { bombout(("Strange packet received: type %d", pktin->type)); crStopV; @@ -4201,6 +4175,74 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, } /* + * Handle the top-level SSH2 protocol. + */ +static void ssh1_msg_debug(Ssh ssh, struct Packet *pktin) +{ + char *buf, *msg; + int msglen; + + ssh_pkt_getstring(pktin, &msg, &msglen); + buf = dupprintf("Remote debug message: %.*s", msglen, msg); + logevent(buf); + sfree(buf); +} + +static void ssh1_msg_disconnect(Ssh ssh, struct Packet *pktin) +{ + /* log reason code in disconnect message */ + char *msg; + int msglen; + + ssh_pkt_getstring(pktin, &msg, &msglen); + bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg)); +} + +void ssh_msg_ignore(Ssh ssh, struct Packet *pktin) +{ + /* Do nothing, because we're ignoring it! Duhh. */ +} + +static void ssh1_protocol_setup(Ssh ssh) +{ + int i; + + /* + * Most messages are handled by the coroutines. + */ + for (i = 0; i < 256; i++) + ssh->packet_dispatch[i] = NULL; + + /* + * These special message types we install handlers for. + */ + ssh->packet_dispatch[SSH1_MSG_DISCONNECT] = ssh1_msg_disconnect; + ssh->packet_dispatch[SSH1_MSG_IGNORE] = ssh_msg_ignore; + ssh->packet_dispatch[SSH1_MSG_DEBUG] = ssh1_msg_debug; +} + +static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, + struct Packet *pktin) +{ + if (ssh->state == SSH_STATE_CLOSED) + return; + + if (pktin && ssh->packet_dispatch[pktin->type]) { + ssh->packet_dispatch[pktin->type](ssh, pktin); + return; + } + + if (!ssh->protocol_initial_phase_done) { + if (do_ssh1_login(ssh, in, inlen, pktin)) + ssh->protocol_initial_phase_done = TRUE; + else + return; + } + + do_ssh1_connection(ssh, in, inlen, pktin); +} + +/* * Utility routine for decoding comma-separated strings in KEXINIT. */ static int in_commasep_string(char *needle, char *haystack, int haylen) @@ -4292,7 +4334,6 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, s->csmac_tobe = s->scmac_tobe = NULL; s->cscomp_tobe = s->sccomp_tobe = NULL; - random_init(); s->first_kex = 1; { @@ -4355,6 +4396,11 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, ssh->queueing = TRUE; /* + * Flag that KEX is in progress. + */ + ssh->kex_in_progress = TRUE; + + /* * Construct and send our key exchange packet. */ s->pktout = ssh2_pkt_init(SSH2_MSG_KEXINIT); @@ -4706,10 +4752,61 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, ssh->hostkey->freekey(s->hkey); /* + * The exchange hash from the very first key exchange is also + * the session id, used in session key construction and + * authentication. + */ + if (s->first_kex) + memcpy(ssh->v2_session_id, s->exchange_hash, + sizeof(s->exchange_hash)); + + /* * Send SSH2_MSG_NEWKEYS. */ s->pktout = ssh2_pkt_init(SSH2_MSG_NEWKEYS); ssh2_pkt_send_noqueue(ssh, s->pktout); + ssh->outgoing_data_size = 0; /* start counting from here */ + + /* + * We've sent client NEWKEYS, so create and initialise + * client-to-server session keys. + */ + if (ssh->cs_cipher_ctx) + ssh->cscipher->free_context(ssh->cs_cipher_ctx); + ssh->cscipher = s->cscipher_tobe; + ssh->cs_cipher_ctx = ssh->cscipher->make_context(); + + if (ssh->cs_mac_ctx) + ssh->csmac->free_context(ssh->cs_mac_ctx); + ssh->csmac = s->csmac_tobe; + ssh->cs_mac_ctx = ssh->csmac->make_context(); + + if (ssh->cs_comp_ctx) + ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx); + ssh->cscomp = s->cscomp_tobe; + ssh->cs_comp_ctx = ssh->cscomp->compress_init(); + + /* + * Set IVs on client-to-server keys. Here we use the exchange + * hash from the _first_ key exchange. + */ + { + unsigned char keyspace[40]; + ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'C',keyspace); + ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace); + ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'A',keyspace); + ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace); + ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'E',keyspace); + ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace); + } + + logeventf(ssh, "Initialised %.200s client->server encryption", + ssh->cscipher->text_name); + logeventf(ssh, "Initialised %.200s client->server MAC algorithm", + ssh->csmac->text_name); + if (ssh->cscomp->text_name) + logeventf(ssh, "Initialised %s compression", + ssh->cscomp->text_name); /* * Now our end of the key exchange is complete, we can send all @@ -4726,76 +4823,51 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, bombout(("expected new-keys packet from server")); crStop(0); } + ssh->incoming_data_size = 0; /* start counting from here */ /* - * Create and initialise session keys. + * We've seen server NEWKEYS, so create and initialise + * server-to-client session keys. */ - if (ssh->cs_cipher_ctx) - ssh->cscipher->free_context(ssh->cs_cipher_ctx); - ssh->cscipher = s->cscipher_tobe; - ssh->cs_cipher_ctx = ssh->cscipher->make_context(); - if (ssh->sc_cipher_ctx) ssh->sccipher->free_context(ssh->sc_cipher_ctx); ssh->sccipher = s->sccipher_tobe; ssh->sc_cipher_ctx = ssh->sccipher->make_context(); - if (ssh->cs_mac_ctx) - ssh->csmac->free_context(ssh->cs_mac_ctx); - ssh->csmac = s->csmac_tobe; - ssh->cs_mac_ctx = ssh->csmac->make_context(); - if (ssh->sc_mac_ctx) ssh->scmac->free_context(ssh->sc_mac_ctx); ssh->scmac = s->scmac_tobe; ssh->sc_mac_ctx = ssh->scmac->make_context(); - if (ssh->cs_comp_ctx) - ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx); - ssh->cscomp = s->cscomp_tobe; - ssh->cs_comp_ctx = ssh->cscomp->compress_init(); - if (ssh->sc_comp_ctx) ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx); ssh->sccomp = s->sccomp_tobe; ssh->sc_comp_ctx = ssh->sccomp->decompress_init(); /* - * Set IVs after keys. Here we use the exchange hash from the - * _first_ key exchange. + * Set IVs on server-to-client keys. Here we use the exchange + * hash from the _first_ key exchange. */ { unsigned char keyspace[40]; - if (s->first_kex) - memcpy(ssh->v2_session_id, s->exchange_hash, - sizeof(s->exchange_hash)); - ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'C',keyspace); - ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace); ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'D',keyspace); ssh->sccipher->setkey(ssh->sc_cipher_ctx, keyspace); - ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'A',keyspace); - ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace); ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'B',keyspace); ssh->sccipher->setiv(ssh->sc_cipher_ctx, keyspace); - ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'E',keyspace); - ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace); ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'F',keyspace); ssh->scmac->setkey(ssh->sc_mac_ctx, keyspace); } - logeventf(ssh, "Initialised %.200s client->server encryption", - ssh->cscipher->text_name); logeventf(ssh, "Initialised %.200s server->client encryption", ssh->sccipher->text_name); - logeventf(ssh, "Initialised %.200s client->server MAC algorithm", - ssh->csmac->text_name); logeventf(ssh, "Initialised %.200s server->client MAC algorithm", ssh->scmac->text_name); - if (ssh->cscomp->text_name) - logeventf(ssh, "Initialised %s compression", - ssh->cscomp->text_name); if (ssh->sccomp->text_name) logeventf(ssh, "Initialised %s decompression", ssh->sccomp->text_name); + + /* + * Free key exchange data. + */ freebn(s->f); freebn(s->K); if (ssh->kex == &ssh_diffiehellman_gex) { @@ -4804,6 +4876,12 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, } /* + * Key exchange is over. Schedule a timer for our next rekey. + */ + ssh->kex_in_progress = FALSE; + ssh->next_rekey = schedule_timer(REKEY_TIMEOUT, ssh2_timer, ssh); + + /* * If this is the first key exchange phase, we must pass the * SSH2_MSG_NEWKEYS packet to the next layer, not because it * wants to see it but because it will need time to initialise @@ -4812,7 +4890,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, * it would only confuse the layer above. */ if (!s->first_kex) { - crReturn(0); + crReturn(1); } s->first_kex = 0; @@ -4821,11 +4899,21 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, * function so that other things can run on top of the * transport. If we ever see a KEXINIT, we must go back to the * start. + * + * We _also_ go back to the start if we see pktin==NULL and + * inlen==-1, because this is a special signal meaning + * `initiate client-driven rekey', and `in' contains a message + * giving the reason for the rekey. */ - while (!(pktin && pktin->type == SSH2_MSG_KEXINIT)) { + while (!((pktin && pktin->type == SSH2_MSG_KEXINIT) || + (!pktin && inlen == -1))) { crReturn(1); } - logevent("Server initiated key re-exchange"); + if (pktin) { + logevent("Server initiated key re-exchange"); + } else { + logevent((char *)in); + } goto begin_key_exchange; crFinish(1); @@ -4900,6 +4988,532 @@ static void ssh2_set_window(struct ssh_channel *c, unsigned newwin) } } +static void ssh2_msg_channel_window_adjust(Ssh ssh, struct Packet *pktin) +{ + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + c = find234(ssh->channels, &i, ssh_channelfind); + if (c && !c->closes) + c->v.v2.remwindow += ssh_pkt_getuint32(pktin); +} + +static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin) +{ + char *data; + int length; + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + c = find234(ssh->channels, &i, ssh_channelfind); + if (!c) + return; /* nonexistent channel */ + if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA && + ssh_pkt_getuint32(pktin) != SSH2_EXTENDED_DATA_STDERR) + return; /* extended but not stderr */ + ssh_pkt_getstring(pktin, &data, &length); + if (data) { + int bufsize = 0; + c->v.v2.locwindow -= length; + switch (c->type) { + case CHAN_MAINSESSION: + bufsize = + from_backend(ssh->frontend, pktin->type == + SSH2_MSG_CHANNEL_EXTENDED_DATA, + data, length); + break; + case CHAN_X11: + bufsize = x11_send(c->u.x11.s, data, length); + break; + case CHAN_SOCKDATA: + bufsize = pfd_send(c->u.pfd.s, data, length); + break; + case CHAN_AGENT: + while (length > 0) { + if (c->u.a.lensofar < 4) { + int l = min(4 - c->u.a.lensofar, length); + memcpy(c->u.a.msglen + c->u.a.lensofar, + data, l); + data += l; + length -= l; + c->u.a.lensofar += l; + } + if (c->u.a.lensofar == 4) { + c->u.a.totallen = + 4 + GET_32BIT(c->u.a.msglen); + c->u.a.message = snewn(c->u.a.totallen, + unsigned char); + memcpy(c->u.a.message, c->u.a.msglen, 4); + } + if (c->u.a.lensofar >= 4 && length > 0) { + int l = + min(c->u.a.totallen - c->u.a.lensofar, + length); + memcpy(c->u.a.message + c->u.a.lensofar, + data, l); + data += l; + length -= l; + c->u.a.lensofar += l; + } + if (c->u.a.lensofar == c->u.a.totallen) { + void *reply; + int replylen; + if (agent_query(c->u.a.message, + c->u.a.totallen, + &reply, &replylen, + ssh_agentf_callback, c)) + ssh_agentf_callback(c, reply, replylen); + sfree(c->u.a.message); + c->u.a.lensofar = 0; + } + } + bufsize = 0; + break; + } + /* + * If we are not buffering too much data, + * enlarge the window again at the remote side. + */ + if (bufsize < OUR_V2_WINSIZE) + ssh2_set_window(c, OUR_V2_WINSIZE - bufsize); + } +} + +static void ssh2_msg_channel_eof(Ssh ssh, struct Packet *pktin) +{ + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + + c = find234(ssh->channels, &i, ssh_channelfind); + if (!c) + return; /* nonexistent channel */ + + if (c->type == CHAN_X11) { + /* + * Remote EOF on an X11 channel means we should + * wrap up and close the channel ourselves. + */ + x11_close(c->u.x11.s); + sshfwd_close(c); + } else if (c->type == CHAN_AGENT) { + sshfwd_close(c); + } else if (c->type == CHAN_SOCKDATA) { + pfd_close(c->u.pfd.s); + sshfwd_close(c); + } +} + +static void ssh2_msg_channel_close(Ssh ssh, struct Packet *pktin) +{ + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + struct Packet *pktout; + + c = find234(ssh->channels, &i, ssh_channelfind); + if (!c || ((int)c->remoteid) == -1) { + bombout(("Received CHANNEL_CLOSE for %s channel %d\n", + c ? "half-open" : "nonexistent", i)); + return; + } + /* Do pre-close processing on the channel. */ + switch (c->type) { + case CHAN_MAINSESSION: + ssh->mainchan = NULL; + update_specials_menu(ssh->frontend); + break; + case CHAN_X11: + if (c->u.x11.s != NULL) + x11_close(c->u.x11.s); + sshfwd_close(c); + break; + case CHAN_AGENT: + sshfwd_close(c); + break; + case CHAN_SOCKDATA: + if (c->u.pfd.s != NULL) + pfd_close(c->u.pfd.s); + sshfwd_close(c); + break; + } + if (c->closes == 0) { + pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE); + ssh2_pkt_adduint32(pktout, c->remoteid); + ssh2_pkt_send(ssh, pktout); + } + del234(ssh->channels, c); + bufchain_clear(&c->v.v2.outbuffer); + sfree(c); + + /* + * See if that was the last channel left open. + * (This is only our termination condition if we're + * not running in -N mode.) + */ + if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) { + logevent("All channels closed. Disconnecting"); +#if 0 + /* + * We used to send SSH_MSG_DISCONNECT here, + * because I'd believed that _every_ conforming + * SSH2 connection had to end with a disconnect + * being sent by at least one side; apparently + * I was wrong and it's perfectly OK to + * unceremoniously slam the connection shut + * when you're done, and indeed OpenSSH feels + * this is more polite than sending a + * DISCONNECT. So now we don't. + */ + s->pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT); + ssh2_pkt_adduint32(s->pktout, SSH2_DISCONNECT_BY_APPLICATION); + ssh2_pkt_addstring(s->pktout, "All open channels closed"); + ssh2_pkt_addstring(s->pktout, "en"); /* language tag */ + ssh2_pkt_send_noqueue(ssh, s->pktout); +#endif + ssh_closing((Plug)ssh, NULL, 0, 0); + } +} + +static void ssh2_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin) +{ + unsigned i = ssh_pkt_getuint32(pktin); + struct ssh_channel *c; + struct Packet *pktout; + + c = find234(ssh->channels, &i, ssh_channelfind); + if (!c) + return; /* nonexistent channel */ + if (c->type != CHAN_SOCKDATA_DORMANT) + return; /* dunno why they're confirming this */ + c->remoteid = ssh_pkt_getuint32(pktin); + c->type = CHAN_SOCKDATA; + c->v.v2.remwindow = ssh_pkt_getuint32(pktin); + c->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin); + if (c->u.pfd.s) + pfd_confirm(c->u.pfd.s); + if (c->closes) { + /* + * We have a pending close on this channel, + * which we decided on before the server acked + * the channel open. So now we know the + * remoteid, we can close it again. + */ + pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE); + ssh2_pkt_adduint32(pktout, c->remoteid); + ssh2_pkt_send(ssh, pktout); + } +} + +static void ssh2_msg_channel_open_failure(Ssh ssh, struct Packet *pktin) +{ + static const char *const reasons[] = { + "", + "Administratively prohibited", + "Connect failed", + "Unknown channel type", + "Resource shortage", + }; + unsigned i = ssh_pkt_getuint32(pktin); + unsigned reason_code; + char *reason_string; + int reason_length; + char *message; + struct ssh_channel *c; + c = find234(ssh->channels, &i, ssh_channelfind); + if (!c) + return; /* nonexistent channel */ + if (c->type != CHAN_SOCKDATA_DORMANT) + return; /* dunno why they're failing this */ + + reason_code = ssh_pkt_getuint32(pktin); + if (reason_code >= lenof(reasons)) + reason_code = 0; /* ensure reasons[reason_code] in range */ + ssh_pkt_getstring(pktin, &reason_string, &reason_length); + message = dupprintf("Forwarded connection refused by" + " server: %s [%.*s]", reasons[reason_code], + reason_length, reason_string); + logevent(message); + sfree(message); + + pfd_close(c->u.pfd.s); + + del234(ssh->channels, c); + sfree(c); +} + +static void ssh2_msg_channel_request(Ssh ssh, struct Packet *pktin) +{ + unsigned localid; + char *type; + int typelen, want_reply; + int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */ + struct ssh_channel *c; + struct Packet *pktout; + + localid = ssh_pkt_getuint32(pktin); + ssh_pkt_getstring(pktin, &type, &typelen); + want_reply = ssh2_pkt_getbool(pktin); + + /* + * First, check that the channel exists. Otherwise, + * we can instantly disconnect with a rude message. + */ + c = find234(ssh->channels, &localid, ssh_channelfind); + if (!c) { + char buf[80]; + sprintf(buf, "Received channel request for nonexistent" + " channel %d", localid); + logevent(buf); + pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT); + ssh2_pkt_adduint32(pktout, SSH2_DISCONNECT_BY_APPLICATION); + ssh2_pkt_addstring(pktout, buf); + ssh2_pkt_addstring(pktout, "en"); /* language tag */ + ssh2_pkt_send_noqueue(ssh, pktout); + connection_fatal(ssh->frontend, "%s", buf); + ssh_closing((Plug)ssh, NULL, 0, 0); + return; + } + + /* + * Having got the channel number, we now look at + * the request type string to see if it's something + * we recognise. + */ + if (c == ssh->mainchan) { + /* + * We recognise "exit-status" and "exit-signal" on + * the primary channel. + */ + if (typelen == 11 && + !memcmp(type, "exit-status", 11)) { + + ssh->exitcode = ssh_pkt_getuint32(pktin); + logeventf(ssh, "Server sent command exit status %d", + ssh->exitcode); + reply = SSH2_MSG_CHANNEL_SUCCESS; + + } else if (typelen == 11 && + !memcmp(type, "exit-signal", 11)) { + + int is_plausible = TRUE, is_int = FALSE; + char *fmt_sig = "", *fmt_msg = ""; + char *msg; + int msglen = 0, core = FALSE; + /* ICK: older versions of OpenSSH (e.g. 3.4p1) + * provide an `int' for the signal, despite its + * having been a `string' in the drafts since at + * least 2001. (Fixed in session.c 1.147.) Try to + * infer which we can safely parse it as. */ + { + unsigned char *p = pktin->body + + pktin->savedpos; + long len = pktin->length - pktin->savedpos; + unsigned long num = GET_32BIT(p); /* what is it? */ + /* If it's 0, it hardly matters; assume string */ + if (num == 0) { + is_int = FALSE; + } else { + int maybe_int = FALSE, maybe_str = FALSE; +#define CHECK_HYPOTHESIS(offset, result) \ + do { \ + long q = offset; \ + if (q >= 0 && q+4 <= len) { \ + q = q + 4 + GET_32BIT(p+q); \ + if (q >= 0 && q+4 <= len && \ + (q = q + 4 + GET_32BIT(p+q)) && q == len) \ + result = TRUE; \ + } \ + } while(0) + CHECK_HYPOTHESIS(4+1, maybe_int); + CHECK_HYPOTHESIS(4+num+1, maybe_str); +#undef CHECK_HYPOTHESIS + if (maybe_int && !maybe_str) + is_int = TRUE; + else if (!maybe_int && maybe_str) + is_int = FALSE; + else + /* Crikey. Either or neither. Panic. */ + is_plausible = FALSE; + } + } + if (is_plausible) { + if (is_int) { + /* Old non-standard OpenSSH. */ + int signum = ssh_pkt_getuint32(pktin); + fmt_sig = dupprintf(" %d", signum); + } else { + /* As per the drafts. */ + char *sig; + int siglen; + ssh_pkt_getstring(pktin, &sig, &siglen); + /* Signal name isn't supposed to be blank, but + * let's cope gracefully if it is. */ + if (siglen) { + fmt_sig = dupprintf(" \"%.*s\"", + siglen, sig); + } + } + core = ssh2_pkt_getbool(pktin); + ssh_pkt_getstring(pktin, &msg, &msglen); + if (msglen) { + fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg); + } + /* ignore lang tag */ + } /* else don't attempt to parse */ + logeventf(ssh, "Server exited on signal%s%s%s", + fmt_sig, core ? " (core dumped)" : "", + fmt_msg); + if (*fmt_sig) sfree(fmt_sig); + if (*fmt_msg) sfree(fmt_msg); + reply = SSH2_MSG_CHANNEL_SUCCESS; + + } + } else { + /* + * This is a channel request we don't know + * about, so we now either ignore the request + * or respond with CHANNEL_FAILURE, depending + * on want_reply. + */ + reply = SSH2_MSG_CHANNEL_FAILURE; + } + if (want_reply) { + pktout = ssh2_pkt_init(reply); + ssh2_pkt_adduint32(pktout, c->remoteid); + ssh2_pkt_send(ssh, pktout); + } +} + +static void ssh2_msg_global_request(Ssh ssh, struct Packet *pktin) +{ + char *type; + int typelen, want_reply; + struct Packet *pktout; + + ssh_pkt_getstring(pktin, &type, &typelen); + want_reply = ssh2_pkt_getbool(pktin); + + /* + * We currently don't support any global requests + * at all, so we either ignore the request or + * respond with REQUEST_FAILURE, depending on + * want_reply. + */ + if (want_reply) { + pktout = ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE); + ssh2_pkt_send(ssh, pktout); + } +} + +static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin) +{ + char *type; + int typelen; + char *peeraddr; + int peeraddrlen; + int peerport; + char *error = NULL; + struct ssh_channel *c; + unsigned remid, winsize, pktsize; + struct Packet *pktout; + + ssh_pkt_getstring(pktin, &type, &typelen); + c = snew(struct ssh_channel); + c->ssh = ssh; + + remid = ssh_pkt_getuint32(pktin); + winsize = ssh_pkt_getuint32(pktin); + pktsize = ssh_pkt_getuint32(pktin); + + if (typelen == 3 && !memcmp(type, "x11", 3)) { + char *addrstr; + + ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen); + addrstr = snewn(peeraddrlen+1, char); + memcpy(addrstr, peeraddr, peeraddrlen); + addrstr[peeraddrlen] = '\0'; + peerport = ssh_pkt_getuint32(pktin); + + logeventf(ssh, "Received X11 connect request from %s:%d", + addrstr, peerport); + + if (!ssh->X11_fwd_enabled) + error = "X11 forwarding is not enabled"; + else if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c, + ssh->x11auth, addrstr, peerport, + &ssh->cfg) != NULL) { + error = "Unable to open an X11 connection"; + } else { + logevent("Opening X11 forward connection succeeded"); + c->type = CHAN_X11; + } + + sfree(addrstr); + } else if (typelen == 15 && + !memcmp(type, "forwarded-tcpip", 15)) { + struct ssh_rportfwd pf, *realpf; + char *dummy; + int dummylen; + ssh_pkt_getstring(pktin, &dummy, &dummylen);/* skip address */ + pf.sport = ssh_pkt_getuint32(pktin); + ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen); + peerport = ssh_pkt_getuint32(pktin); + realpf = find234(ssh->rportfwds, &pf, NULL); + logeventf(ssh, "Received remote port %d open request " + "from %s:%d", pf.sport, peeraddr, peerport); + if (realpf == NULL) { + error = "Remote port is not recognised"; + } else { + const char *e = pfd_newconnect(&c->u.pfd.s, + realpf->dhost, + realpf->dport, c, + &ssh->cfg); + logeventf(ssh, "Attempting to forward remote port to " + "%s:%d", realpf->dhost, realpf->dport); + if (e != NULL) { + logeventf(ssh, "Port open failed: %s", e); + error = "Port open failed"; + } else { + logevent("Forwarded port opened successfully"); + c->type = CHAN_SOCKDATA; + } + } + } else if (typelen == 22 && + !memcmp(type, "auth-agent@openssh.com", 3)) { + if (!ssh->agentfwd_enabled) + error = "Agent forwarding is not enabled"; + else { + c->type = CHAN_AGENT; /* identify channel type */ + c->u.a.lensofar = 0; + } + } else { + error = "Unsupported channel type requested"; + } + + c->remoteid = remid; + if (error) { + pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE); + ssh2_pkt_adduint32(pktout, c->remoteid); + ssh2_pkt_adduint32(pktout, SSH2_OPEN_CONNECT_FAILED); + ssh2_pkt_addstring(pktout, error); + ssh2_pkt_addstring(pktout, "en"); /* language tag */ + ssh2_pkt_send(ssh, pktout); + logeventf(ssh, "Rejected channel open: %s", error); + sfree(c); + } else { + c->localid = alloc_channel_id(ssh); + c->closes = 0; + c->v.v2.locwindow = OUR_V2_WINSIZE; + c->v.v2.remwindow = winsize; + c->v.v2.remmaxpkt = pktsize; + bufchain_init(&c->v.v2.outbuffer); + add234(ssh->channels, c); + pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); + ssh2_pkt_adduint32(pktout, c->remoteid); + ssh2_pkt_adduint32(pktout, c->localid); + ssh2_pkt_adduint32(pktout, c->v.v2.locwindow); + ssh2_pkt_adduint32(pktout, 0x4000UL); /* our max pkt size */ + ssh2_pkt_send(ssh, pktout); + } +} + /* * Handle the SSH2 userauth and connection layers. */ @@ -5775,6 +6389,15 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh->channels = newtree234(ssh_channelcmp); /* + * Set up handlers for some connection protocol messages, so we + * don't have to handle them repeatedly in this coroutine. + */ + ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = + ssh2_msg_channel_window_adjust; + ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = + ssh2_msg_global_request; + + /* * Create the main session channel. */ if (!ssh->cfg.ssh_no_shell) { @@ -5811,6 +6434,24 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh->mainchan = NULL; /* + * Now we have a channel, make dispatch table entries for + * general channel-based messages. + */ + ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = + ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = + ssh2_msg_channel_data; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_channel_eof; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_channel_close; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = + ssh2_msg_channel_open_confirmation; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = + ssh2_msg_channel_open_failure; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = + ssh2_msg_channel_request; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = + ssh2_msg_channel_open; + + /* * Potentially enable X11 forwarding. */ if (ssh->mainchan && ssh->cfg.x11_forward) { @@ -5829,17 +6470,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_adduint32(s->pktout, x11_get_screen_number(ssh->cfg.x11_display)); ssh2_pkt_send(ssh, s->pktout); - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + crWaitUntilV(pktin); if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) { if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) { @@ -5995,17 +6626,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_adduint32(s->pktout, sport); ssh2_pkt_send(ssh, s->pktout); - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue;/* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + crWaitUntilV(pktin); if (pktin->type != SSH2_MSG_REQUEST_SUCCESS) { if (pktin->type != SSH2_MSG_REQUEST_FAILURE) { @@ -6036,17 +6657,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_addbool(s->pktout, 1); /* want reply */ ssh2_pkt_send(ssh, s->pktout); - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + crWaitUntilV(pktin); if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) { if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) { @@ -6088,17 +6699,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_send(ssh, s->pktout); ssh->state = SSH_STATE_INTERMED; - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + crWaitUntilV(pktin); if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) { if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) { @@ -6155,17 +6756,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, s->env_left = s->num_env; while (s->env_left > 0) { - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + crWaitUntilV(pktin); if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) { if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) { @@ -6224,17 +6815,9 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_addbool(s->pktout, 1); /* want reply */ } ssh2_pkt_send(ssh, s->pktout); - do { - crWaitUntilV(pktin); - if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - } - } while (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); + + crWaitUntilV(pktin); + if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) { if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) { bombout(("Unexpected response to shell/command request:" @@ -6277,507 +6860,15 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, crReturnV; s->try_send = FALSE; if (pktin) { - if (pktin->type == SSH2_MSG_CHANNEL_DATA || - pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA) { - char *data; - int length; - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA && - ssh_pkt_getuint32(pktin) != SSH2_EXTENDED_DATA_STDERR) - continue; /* extended but not stderr */ - ssh_pkt_getstring(pktin, &data, &length); - if (data) { - int bufsize = 0; - c->v.v2.locwindow -= length; - switch (c->type) { - case CHAN_MAINSESSION: - bufsize = - from_backend(ssh->frontend, pktin->type == - SSH2_MSG_CHANNEL_EXTENDED_DATA, - data, length); - break; - case CHAN_X11: - bufsize = x11_send(c->u.x11.s, data, length); - break; - case CHAN_SOCKDATA: - bufsize = pfd_send(c->u.pfd.s, data, length); - break; - case CHAN_AGENT: - while (length > 0) { - if (c->u.a.lensofar < 4) { - int l = min(4 - c->u.a.lensofar, length); - memcpy(c->u.a.msglen + c->u.a.lensofar, - data, l); - data += l; - length -= l; - c->u.a.lensofar += l; - } - if (c->u.a.lensofar == 4) { - c->u.a.totallen = - 4 + GET_32BIT(c->u.a.msglen); - c->u.a.message = snewn(c->u.a.totallen, - unsigned char); - memcpy(c->u.a.message, c->u.a.msglen, 4); - } - if (c->u.a.lensofar >= 4 && length > 0) { - int l = - min(c->u.a.totallen - c->u.a.lensofar, - length); - memcpy(c->u.a.message + c->u.a.lensofar, - data, l); - data += l; - length -= l; - c->u.a.lensofar += l; - } - if (c->u.a.lensofar == c->u.a.totallen) { - void *reply; - int replylen; - if (agent_query(c->u.a.message, - c->u.a.totallen, - &reply, &replylen, - ssh_agentf_callback, c)) - ssh_agentf_callback(c, reply, replylen); - sfree(c->u.a.message); - c->u.a.lensofar = 0; - } - } - bufsize = 0; - break; - } - /* - * If we are not buffering too much data, - * enlarge the window again at the remote side. - */ - if (bufsize < OUR_V2_WINSIZE) - ssh2_set_window(c, OUR_V2_WINSIZE - bufsize); - } - } else if (pktin->type == SSH2_MSG_CHANNEL_EOF) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - - if (c->type == CHAN_X11) { - /* - * Remote EOF on an X11 channel means we should - * wrap up and close the channel ourselves. - */ - x11_close(c->u.x11.s); - sshfwd_close(c); - } else if (c->type == CHAN_AGENT) { - sshfwd_close(c); - } else if (c->type == CHAN_SOCKDATA) { - pfd_close(c->u.pfd.s); - sshfwd_close(c); - } - } else if (pktin->type == SSH2_MSG_CHANNEL_CLOSE) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c || ((int)c->remoteid) == -1) { - bombout(("Received CHANNEL_CLOSE for %s channel %d\n", - c ? "half-open" : "nonexistent", i)); - crStopV; - } - /* Do pre-close processing on the channel. */ - switch (c->type) { - case CHAN_MAINSESSION: - ssh->mainchan = NULL; - update_specials_menu(ssh->frontend); - break; - case CHAN_X11: - if (c->u.x11.s != NULL) - x11_close(c->u.x11.s); - sshfwd_close(c); - break; - case CHAN_AGENT: - sshfwd_close(c); - break; - case CHAN_SOCKDATA: - if (c->u.pfd.s != NULL) - pfd_close(c->u.pfd.s); - sshfwd_close(c); - break; - } - if (c->closes == 0) { - s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE); - ssh2_pkt_adduint32(s->pktout, c->remoteid); - ssh2_pkt_send(ssh, s->pktout); - } - del234(ssh->channels, c); - bufchain_clear(&c->v.v2.outbuffer); - sfree(c); - - /* - * See if that was the last channel left open. - * (This is only our termination condition if we're - * not running in -N mode.) - */ - if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) { - logevent("All channels closed. Disconnecting"); -#if 0 - /* - * We used to send SSH_MSG_DISCONNECT here, - * because I'd believed that _every_ conforming - * SSH2 connection had to end with a disconnect - * being sent by at least one side; apparently - * I was wrong and it's perfectly OK to - * unceremoniously slam the connection shut - * when you're done, and indeed OpenSSH feels - * this is more polite than sending a - * DISCONNECT. So now we don't. - */ - s->pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT); - ssh2_pkt_adduint32(s->pktout, SSH2_DISCONNECT_BY_APPLICATION); - ssh2_pkt_addstring(s->pktout, "All open channels closed"); - ssh2_pkt_addstring(s->pktout, "en"); /* language tag */ - ssh2_pkt_send_noqueue(ssh, s->pktout); -#endif - ssh_closing((Plug)ssh, NULL, 0, 0); - crStopV; - } - continue; /* remote sends close; ignore (FIXME) */ - } else if (pktin->type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c || c->closes) - continue; /* nonexistent or closing channel */ - c->v.v2.remwindow += ssh_pkt_getuint32(pktin); - s->try_send = TRUE; - } else if (pktin->type == SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) { - unsigned i = ssh_pkt_getuint32(pktin); - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - if (c->type != CHAN_SOCKDATA_DORMANT) - continue; /* dunno why they're confirming this */ - c->remoteid = ssh_pkt_getuint32(pktin); - c->type = CHAN_SOCKDATA; - c->v.v2.remwindow = ssh_pkt_getuint32(pktin); - c->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin); - if (c->u.pfd.s) - pfd_confirm(c->u.pfd.s); - if (c->closes) { - /* - * We have a pending close on this channel, - * which we decided on before the server acked - * the channel open. So now we know the - * remoteid, we can close it again. - */ - s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE); - ssh2_pkt_adduint32(s->pktout, c->remoteid); - ssh2_pkt_send(ssh, s->pktout); - } - } else if (pktin->type == SSH2_MSG_CHANNEL_OPEN_FAILURE) { - static const char *const reasons[] = { - "", - "Administratively prohibited", - "Connect failed", - "Unknown channel type", - "Resource shortage", - }; - unsigned i = ssh_pkt_getuint32(pktin); - unsigned reason_code; - char *reason_string; - int reason_length; - char *message; - struct ssh_channel *c; - c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ - if (c->type != CHAN_SOCKDATA_DORMANT) - continue; /* dunno why they're failing this */ - - reason_code = ssh_pkt_getuint32(pktin); - if (reason_code >= lenof(reasons)) - reason_code = 0; /* ensure reasons[reason_code] in range */ - ssh_pkt_getstring(pktin, &reason_string, &reason_length); - message = dupprintf("Forwarded connection refused by" - " server: %s [%.*s]", reasons[reason_code], - reason_length, reason_string); - logevent(message); - sfree(message); - - pfd_close(c->u.pfd.s); - - del234(ssh->channels, c); - sfree(c); - } else if (pktin->type == SSH2_MSG_CHANNEL_REQUEST) { - unsigned localid; - char *type; - int typelen, want_reply; - int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */ - struct ssh_channel *c; - localid = ssh_pkt_getuint32(pktin); - ssh_pkt_getstring(pktin, &type, &typelen); - want_reply = ssh2_pkt_getbool(pktin); - - /* - * First, check that the channel exists. Otherwise, - * we can instantly disconnect with a rude message. - */ - c = find234(ssh->channels, &localid, ssh_channelfind); - if (!c) { - char buf[80]; - sprintf(buf, "Received channel request for nonexistent" - " channel %d", localid); - logevent(buf); - s->pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT); - ssh2_pkt_adduint32(s->pktout, SSH2_DISCONNECT_BY_APPLICATION); - ssh2_pkt_addstring(s->pktout, buf); - ssh2_pkt_addstring(s->pktout, "en"); /* language tag */ - ssh2_pkt_send_noqueue(ssh, s->pktout); - connection_fatal(ssh->frontend, "%s", buf); - ssh_closing((Plug)ssh, NULL, 0, 0); - crStopV; - } - - /* - * Having got the channel number, we now look at - * the request type string to see if it's something - * we recognise. - */ - if (c == ssh->mainchan) { - /* - * We recognise "exit-status" and "exit-signal" on - * the primary channel. - */ - if (typelen == 11 && - !memcmp(type, "exit-status", 11)) { - - ssh->exitcode = ssh_pkt_getuint32(pktin); - logeventf(ssh, "Server sent command exit status %d", - ssh->exitcode); - reply = SSH2_MSG_CHANNEL_SUCCESS; - - } else if (typelen == 11 && - !memcmp(type, "exit-signal", 11)) { - - int is_plausible = TRUE, is_int = FALSE; - char *fmt_sig = "", *fmt_msg = ""; - char *msg; - int msglen = 0, core = FALSE; - /* ICK: older versions of OpenSSH (e.g. 3.4p1) - * provide an `int' for the signal, despite its - * having been a `string' in the drafts since at - * least 2001. (Fixed in session.c 1.147.) Try to - * infer which we can safely parse it as. */ - { - unsigned char *p = pktin->body + - pktin->savedpos; - long len = pktin->length - pktin->savedpos; - unsigned long num = GET_32BIT(p); /* what is it? */ - /* If it's 0, it hardly matters; assume string */ - if (num == 0) { - is_int = FALSE; - } else { - int maybe_int = FALSE, maybe_str = FALSE; -#define CHECK_HYPOTHESIS(offset, result) \ - do { \ - long q = offset; \ - if (q >= 0 && q+4 <= len) { \ - q = q + 4 + GET_32BIT(p+q); \ - if (q >= 0 && q+4 <= len && \ - (q = q + 4 + GET_32BIT(p+q)) && q == len) \ - result = TRUE; \ - } \ - } while(0) - CHECK_HYPOTHESIS(4+1, maybe_int); - CHECK_HYPOTHESIS(4+num+1, maybe_str); -#undef CHECK_HYPOTHESIS - if (maybe_int && !maybe_str) - is_int = TRUE; - else if (!maybe_int && maybe_str) - is_int = FALSE; - else - /* Crikey. Either or neither. Panic. */ - is_plausible = FALSE; - } - } - if (is_plausible) { - if (is_int) { - /* Old non-standard OpenSSH. */ - int signum = ssh_pkt_getuint32(pktin); - fmt_sig = dupprintf(" %d", signum); - } else { - /* As per the drafts. */ - char *sig; - int siglen; - ssh_pkt_getstring(pktin, &sig, &siglen); - /* Signal name isn't supposed to be blank, but - * let's cope gracefully if it is. */ - if (siglen) { - fmt_sig = dupprintf(" \"%.*s\"", - siglen, sig); - } - } - core = ssh2_pkt_getbool(pktin); - ssh_pkt_getstring(pktin, &msg, &msglen); - if (msglen) { - fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg); - } - /* ignore lang tag */ - } /* else don't attempt to parse */ - logeventf(ssh, "Server exited on signal%s%s%s", - fmt_sig, core ? " (core dumped)" : "", - fmt_msg); - if (*fmt_sig) sfree(fmt_sig); - if (*fmt_msg) sfree(fmt_msg); - reply = SSH2_MSG_CHANNEL_SUCCESS; - - } - } else { - /* - * This is a channel request we don't know - * about, so we now either ignore the request - * or respond with CHANNEL_FAILURE, depending - * on want_reply. - */ - reply = SSH2_MSG_CHANNEL_FAILURE; - } - if (want_reply) { - s->pktout = ssh2_pkt_init(reply); - ssh2_pkt_adduint32(s->pktout, c->remoteid); - ssh2_pkt_send(ssh, s->pktout); - } - } else if (pktin->type == SSH2_MSG_GLOBAL_REQUEST) { - char *type; - int typelen, want_reply; - - ssh_pkt_getstring(pktin, &type, &typelen); - want_reply = ssh2_pkt_getbool(pktin); - - /* - * We currently don't support any global requests - * at all, so we either ignore the request or - * respond with REQUEST_FAILURE, depending on - * want_reply. - */ - if (want_reply) { - s->pktout = ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE); - ssh2_pkt_send(ssh, s->pktout); - } - } else if (pktin->type == SSH2_MSG_CHANNEL_OPEN) { - char *type; - int typelen; - char *peeraddr; - int peeraddrlen; - int peerport; - char *error = NULL; - struct ssh_channel *c; - unsigned remid, winsize, pktsize; - ssh_pkt_getstring(pktin, &type, &typelen); - c = snew(struct ssh_channel); - c->ssh = ssh; - - remid = ssh_pkt_getuint32(pktin); - winsize = ssh_pkt_getuint32(pktin); - pktsize = ssh_pkt_getuint32(pktin); - - if (typelen == 3 && !memcmp(type, "x11", 3)) { - char *addrstr; - - ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen); - addrstr = snewn(peeraddrlen+1, char); - memcpy(addrstr, peeraddr, peeraddrlen); - addrstr[peeraddrlen] = '\0'; - peerport = ssh_pkt_getuint32(pktin); - - logeventf(ssh, "Received X11 connect request from %s:%d", - addrstr, peerport); - - if (!ssh->X11_fwd_enabled) - error = "X11 forwarding is not enabled"; - else if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c, - ssh->x11auth, addrstr, peerport, - &ssh->cfg) != NULL) { - error = "Unable to open an X11 connection"; - } else { - logevent("Opening X11 forward connection succeeded"); - c->type = CHAN_X11; - } - - sfree(addrstr); - } else if (typelen == 15 && - !memcmp(type, "forwarded-tcpip", 15)) { - struct ssh_rportfwd pf, *realpf; - char *dummy; - int dummylen; - ssh_pkt_getstring(pktin, &dummy, &dummylen);/* skip address */ - pf.sport = ssh_pkt_getuint32(pktin); - ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen); - peerport = ssh_pkt_getuint32(pktin); - realpf = find234(ssh->rportfwds, &pf, NULL); - logeventf(ssh, "Received remote port %d open request " - "from %s:%d", pf.sport, peeraddr, peerport); - if (realpf == NULL) { - error = "Remote port is not recognised"; - } else { - const char *e = pfd_newconnect(&c->u.pfd.s, - realpf->dhost, - realpf->dport, c, - &ssh->cfg); - logeventf(ssh, "Attempting to forward remote port to " - "%s:%d", realpf->dhost, realpf->dport); - if (e != NULL) { - logeventf(ssh, "Port open failed: %s", e); - error = "Port open failed"; - } else { - logevent("Forwarded port opened successfully"); - c->type = CHAN_SOCKDATA; - } - } - } else if (typelen == 22 && - !memcmp(type, "auth-agent@openssh.com", 3)) { - if (!ssh->agentfwd_enabled) - error = "Agent forwarding is not enabled"; - else { - c->type = CHAN_AGENT; /* identify channel type */ - c->u.a.lensofar = 0; - } - } else { - error = "Unsupported channel type requested"; - } + /* + * _All_ the connection-layer packets we expect to + * receive are now handled by the dispatch table. + * Anything that reaches here must be bogus. + */ - c->remoteid = remid; - if (error) { - s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE); - ssh2_pkt_adduint32(s->pktout, c->remoteid); - ssh2_pkt_adduint32(s->pktout, SSH2_OPEN_CONNECT_FAILED); - ssh2_pkt_addstring(s->pktout, error); - ssh2_pkt_addstring(s->pktout, "en"); /* language tag */ - ssh2_pkt_send(ssh, s->pktout); - logeventf(ssh, "Rejected channel open: %s", error); - sfree(c); - } else { - c->localid = alloc_channel_id(ssh); - c->closes = 0; - c->v.v2.locwindow = OUR_V2_WINSIZE; - c->v.v2.remwindow = winsize; - c->v.v2.remmaxpkt = pktsize; - bufchain_init(&c->v.v2.outbuffer); - add234(ssh->channels, c); - s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); - ssh2_pkt_adduint32(s->pktout, c->remoteid); - ssh2_pkt_adduint32(s->pktout, c->localid); - ssh2_pkt_adduint32(s->pktout, c->v.v2.locwindow); - ssh2_pkt_adduint32(s->pktout, 0x4000UL); /* our max pkt size */ - ssh2_pkt_send(ssh, s->pktout); - } - } else { - bombout(("Strange packet received: type %d", pktin->type)); - crStopV; - } + bombout(("Strange packet received: type %d", pktin->type)); + crStopV; } else if (ssh->mainchan) { /* * We have spare data. Add it to the channel buffer. @@ -6822,14 +6913,167 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, } /* + * Handlers for SSH2 messages that might arrive at any moment. + */ +void ssh2_msg_disconnect(Ssh ssh, struct Packet *pktin) +{ + /* log reason code in disconnect message */ + char *buf, *msg; + int nowlen, reason, msglen; + + reason = ssh_pkt_getuint32(pktin); + ssh_pkt_getstring(pktin, &msg, &msglen); + + if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) { + buf = dupprintf("Received disconnect message (%s)", + ssh2_disconnect_reasons[reason]); + } else { + buf = dupprintf("Received disconnect message (unknown" + " type %d)", reason); + } + logevent(buf); + sfree(buf); + buf = dupprintf("Disconnection message text: %n%.*s", + &nowlen, msglen, msg); + logevent(buf); + bombout(("Server sent disconnect message\ntype %d (%s):\n\"%s\"", + reason, + (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ? + ssh2_disconnect_reasons[reason] : "unknown", + buf+nowlen)); + sfree(buf); +} + +void ssh2_msg_debug(Ssh ssh, struct Packet *pktin) +{ + /* log the debug message */ + char *buf, *msg; + int msglen; + int always_display; + + /* XXX maybe we should actually take notice of this */ + always_display = ssh2_pkt_getbool(pktin); + ssh_pkt_getstring(pktin, &msg, &msglen); + + buf = dupprintf("Remote debug message: %.*s", msglen, msg); + logevent(buf); + sfree(buf); +} + +void ssh2_msg_something_unimplemented(Ssh ssh, struct Packet *pktin) +{ + struct Packet *pktout; + pktout = ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED); + ssh2_pkt_adduint32(pktout, pktin->sequence); + /* + * UNIMPLEMENTED messages MUST appear in the same order as the + * messages they respond to. Hence, never queue them. + */ + ssh2_pkt_send_noqueue(ssh, pktout); +} + +/* * Handle the top-level SSH2 protocol. */ +static void ssh2_protocol_setup(Ssh ssh) +{ + int i; + + /* + * Most messages cause SSH2_MSG_UNIMPLEMENTED. + */ + for (i = 0; i < 256; i++) + ssh->packet_dispatch[i] = ssh2_msg_something_unimplemented; + + /* + * Any message we actually understand, we set to NULL so that + * the coroutines will get it. + */ + ssh->packet_dispatch[SSH2_MSG_UNIMPLEMENTED] = NULL; + ssh->packet_dispatch[SSH2_MSG_SERVICE_REQUEST] = NULL; + ssh->packet_dispatch[SSH2_MSG_SERVICE_ACCEPT] = NULL; + ssh->packet_dispatch[SSH2_MSG_KEXINIT] = NULL; + ssh->packet_dispatch[SSH2_MSG_NEWKEYS] = NULL; + ssh->packet_dispatch[SSH2_MSG_KEXDH_INIT] = NULL; + ssh->packet_dispatch[SSH2_MSG_KEXDH_REPLY] = NULL; + /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REQUEST] = NULL; duplicate case value */ + /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_GROUP] = NULL; duplicate case value */ + ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_INIT] = NULL; + ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REPLY] = NULL; + ssh->packet_dispatch[SSH2_MSG_USERAUTH_REQUEST] = NULL; + ssh->packet_dispatch[SSH2_MSG_USERAUTH_FAILURE] = NULL; + ssh->packet_dispatch[SSH2_MSG_USERAUTH_SUCCESS] = NULL; + ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL; + ssh->packet_dispatch[SSH2_MSG_USERAUTH_PK_OK] = NULL; + /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ] = NULL; duplicate case value */ + /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_REQUEST] = NULL; duplicate case value */ + ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_RESPONSE] = NULL; + ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = NULL; + ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = NULL; + ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = NULL; + ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = NULL; + + /* + * These special message types we install handlers for. + */ + ssh->packet_dispatch[SSH2_MSG_DISCONNECT] = ssh2_msg_disconnect; + ssh->packet_dispatch[SSH2_MSG_IGNORE] = ssh_msg_ignore; /* shared with ssh1 */ + ssh->packet_dispatch[SSH2_MSG_DEBUG] = ssh2_msg_debug; +} + +static void ssh2_timer(void *ctx, long now) +{ + Ssh ssh = (Ssh)ctx; + + if (!ssh->kex_in_progress && + now - ssh->next_rekey >= 0) { + do_ssh2_transport(ssh, "Initiating key re-exchange (timeout)", + -1, NULL); + } +} + static void ssh2_protocol(Ssh ssh, unsigned char *in, int inlen, struct Packet *pktin) { - if (do_ssh2_transport(ssh, in, inlen, pktin) == 0) + if (ssh->state == SSH_STATE_CLOSED) + return; + + if (pktin) { + ssh->incoming_data_size += pktin->encrypted_len; + if (!ssh->kex_in_progress && + ssh->incoming_data_size > MAX_DATA_BEFORE_REKEY) + do_ssh2_transport(ssh, "Initiating key re-exchange " + "(too much data received)", -1, NULL); + } + + if (pktin && ssh->packet_dispatch[pktin->type]) { + ssh->packet_dispatch[pktin->type](ssh, pktin); return; - do_ssh2_authconn(ssh, in, inlen, pktin); + } + + if (!ssh->protocol_initial_phase_done || + (pktin && pktin->type >= 20 && pktin->type < 50)) { + if (do_ssh2_transport(ssh, in, inlen, pktin) && + !ssh->protocol_initial_phase_done) { + ssh->protocol_initial_phase_done = TRUE; + /* + * Allow authconn to initialise itself. + */ + do_ssh2_authconn(ssh, NULL, 0, NULL); + } + } else { + do_ssh2_authconn(ssh, in, inlen, pktin); + } } /* @@ -6885,7 +7129,7 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle, ssh->ssh2_rdpkt_crstate = 0; ssh->do_ssh_init_crstate = 0; ssh->ssh_gotdata_crstate = 0; - ssh->ssh1_protocol_crstate = 0; + ssh->do_ssh1_connection_crstate = 0; ssh->do_ssh1_login_crstate = 0; ssh->do_ssh2_transport_crstate = 0; ssh->do_ssh2_authconn_crstate = 0; @@ -6923,10 +7167,20 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle, ssh->protocol = NULL; + ssh->protocol_initial_phase_done = FALSE; + + ssh->pinger = NULL; + + ssh->incoming_data_size = ssh->outgoing_data_size = + ssh->deferred_data_size = 0L; + ssh->kex_in_progress = FALSE; + p = connect_to_host(ssh, host, port, realhost, nodelay, keepalive); if (p != NULL) return p; + random_ref(); + return NULL; } @@ -6981,12 +7235,14 @@ static void ssh_free(void *handle) sfree(c); } freetree234(ssh->channels); + ssh->channels = NULL; } if (ssh->rportfwds) { while ((pf = delpos234(ssh->rportfwds, 0)) != NULL) sfree(pf); freetree234(ssh->rportfwds); + ssh->rportfwds = NULL; } sfree(ssh->deferred_send_data); if (ssh->x11auth) @@ -7001,7 +7257,12 @@ static void ssh_free(void *handle) } if (ssh->s) ssh_do_close(ssh); + expire_timer_context(ssh); sfree(ssh); + if (ssh->pinger) + pinger_free(ssh->pinger); + + random_unref(); } /* @@ -7016,6 +7277,7 @@ static void ssh_free(void *handle) static void ssh_reconfig(void *handle, Config *cfg) { Ssh ssh = (Ssh) handle; + pinger_reconfig(ssh->pinger, &ssh->cfg, cfg); ssh->cfg = *cfg; /* STRUCTURE COPY */ } @@ -7116,6 +7378,7 @@ static const struct telnet_special *ssh_get_specials(void *handle) { static const struct telnet_special ignore_special[] = { {"IGNORE message", TS_NOP}, + {"Repeat key exchange", TS_REKEY}, }; static const struct telnet_special ssh2_session_specials[] = { {NULL, TS_SEP}, @@ -7157,7 +7420,6 @@ static const struct telnet_special *ssh_get_specials(void *handle) if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE)) ADD_SPECIALS(ignore_special); } else if (ssh->version == 2) { - /* XXX add rekey, when implemented */ ADD_SPECIALS(ignore_special); if (ssh->mainchan) ADD_SPECIALS(ssh2_session_specials); @@ -7211,6 +7473,11 @@ static void ssh_special(void *handle, Telnet_Special code) ssh2_pkt_addstring_start(pktout); ssh2_pkt_send_noqueue(ssh, pktout); } + } else if (code == TS_REKEY) { + if (!ssh->kex_in_progress && ssh->version == 2) { + do_ssh2_transport(ssh, "Initiating key re-exchange at" + " user request", -1, NULL); + } } else if (code == TS_BRK) { if (ssh->state == SSH_STATE_CLOSED || ssh->state == SSH_STATE_PREPACKET) return;