X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/6c6d9ed9511ad9f76dcf9fcb3e184937bb1555f0..125105d16c788398562ac03e91ce7a0dc0292492:/ssh.c diff --git a/ssh.c b/ssh.c index 88af2480..b696e46a 100644 --- a/ssh.c +++ b/ssh.c @@ -163,6 +163,7 @@ static const char *const ssh2_disconnect_reasons[] = { #define BUG_SSH2_RSA_PADDING 16 #define BUG_SSH2_DERIVEKEY 32 #define BUG_SSH2_DH_GEX 64 +#define BUG_SSH2_PK_SESSIONID 128 #define translate(x) if (type == x) return #x #define translatec(x,ctx) if (type == x && (pkt_ctx & ctx)) return #x @@ -268,11 +269,30 @@ static char *ssh2_pkt_type(int pkt_ctx, int type) enum { PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM }; -/* Coroutine mechanics for the sillier bits of the code */ +/* + * Coroutine mechanics for the sillier bits of the code. If these + * macros look impenetrable to you, you might find it helpful to + * read + * + * http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html + * + * which explains the theory behind these macros. + * + * In particular, if you are getting `case expression not constant' + * errors when building with MS Visual Studio, this is because MS's + * Edit and Continue debugging feature causes their compiler to + * violate ANSI C. To disable Edit and Continue debugging: + * + * - right-click ssh.c in the FileView + * - click Settings + * - select the C/C++ tab and the General category + * - under `Debug info:', select anything _other_ than `Program + * Database for Edit and Continue'. + */ #define crBegin(v) { int *crLine = &v; switch(v) { case 0:; #define crState(t) \ struct t *s; \ - if (!ssh->t) ssh->t = smalloc(sizeof(struct t)); \ + if (!ssh->t) ssh->t = snew(struct t); \ s = ssh->t; #define crFinish(z) } *crLine = 0; return (z); } #define crFinishV } *crLine = 0; return; } @@ -645,9 +665,15 @@ static void logeventf(Ssh ssh, char *fmt, ...) sfree(buf); } -#define bombout(msg) ( ssh->state = SSH_STATE_CLOSED, \ - (ssh->s ? sk_close(ssh->s), ssh->s = NULL : 0), \ - logeventf msg, connection_fatal msg ) +#define bombout(msg) \ + do { \ + char *text = dupprintf msg; \ + ssh->state = SSH_STATE_CLOSED; \ + if (ssh->s) { sk_close(ssh->s); ssh->s = NULL; } \ + logevent(text); \ + connection_fatal(ssh->frontend, "%s", text); \ + sfree(text); \ + } while (0) static int ssh_channelcmp(void *av, void *bv) { @@ -794,7 +820,8 @@ static int ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen) if (ssh->pktin.maxlen < st->biglen) { ssh->pktin.maxlen = st->biglen; - ssh->pktin.data = srealloc(ssh->pktin.data, st->biglen + APIEXTRA); + ssh->pktin.data = sresize(ssh->pktin.data, st->biglen + APIEXTRA, + unsigned char); } st->to_read = st->biglen; @@ -814,7 +841,7 @@ static int ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen) if (ssh->cipher && detect_attack(ssh->crcda_ctx, ssh->pktin.data, st->biglen, NULL)) { - bombout((ssh,"Network attack (CRC compensation) detected!")); + bombout(("Network attack (CRC compensation) detected!")); crReturn(0); } @@ -824,7 +851,7 @@ static int ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen) st->realcrc = crc32(ssh->pktin.data, st->biglen - 4); st->gotcrc = GET_32BIT(ssh->pktin.data + st->biglen - 4); if (st->gotcrc != st->realcrc) { - bombout((ssh,"Incorrect CRC received on packet")); + bombout(("Incorrect CRC received on packet")); crReturn(0); } @@ -839,8 +866,9 @@ static int ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen) if (ssh->pktin.maxlen < st->pad + decomplen) { ssh->pktin.maxlen = st->pad + decomplen; - ssh->pktin.data = srealloc(ssh->pktin.data, - ssh->pktin.maxlen + APIEXTRA); + ssh->pktin.data = sresize(ssh->pktin.data, + ssh->pktin.maxlen + APIEXTRA, + unsigned char); ssh->pktin.body = ssh->pktin.data + st->pad + 1; } @@ -864,7 +892,7 @@ static int ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen) ssh->pktin.type == SSH1_SMSG_AUTH_CCARD_CHALLENGE) { long stringlen = GET_32BIT(ssh->pktin.body); if (stringlen + 4 != ssh->pktin.length) { - bombout((ssh,"Received data packet with bogus string length")); + bombout(("Received data packet with bogus string length")); crReturn(0); } } @@ -897,7 +925,7 @@ static int ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen) memcpy(buf + nowlen, ssh->pktin.body + 4, msglen); buf[nowlen + msglen] = '\0'; /* logevent(buf); (this is now done within the bombout macro) */ - bombout((ssh,"Server sent disconnect message:\n\"%s\"", buf+nowlen)); + bombout(("Server sent disconnect message:\n\"%s\"", buf+nowlen)); crReturn(0); } @@ -922,7 +950,8 @@ static int ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) if (ssh->pktin.maxlen < st->cipherblk) { ssh->pktin.maxlen = st->cipherblk; - ssh->pktin.data = srealloc(ssh->pktin.data, st->cipherblk + APIEXTRA); + ssh->pktin.data = sresize(ssh->pktin.data, st->cipherblk + APIEXTRA, + unsigned char); } /* @@ -951,7 +980,7 @@ static int ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) * do us any more damage. */ if (st->len < 0 || st->pad < 0 || st->len + st->pad < 0) { - bombout((ssh,"Incoming packet was garbled on decryption")); + bombout(("Incoming packet was garbled on decryption")); crReturn(0); } @@ -973,8 +1002,9 @@ static int ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) */ if (ssh->pktin.maxlen < st->packetlen + st->maclen) { ssh->pktin.maxlen = st->packetlen + st->maclen; - ssh->pktin.data = srealloc(ssh->pktin.data, - ssh->pktin.maxlen + APIEXTRA); + ssh->pktin.data = sresize(ssh->pktin.data, + ssh->pktin.maxlen + APIEXTRA, + unsigned char); } /* @@ -999,7 +1029,7 @@ static int ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) if (ssh->scmac && !ssh->scmac->verify(ssh->sc_mac_ctx, ssh->pktin.data, st->len + 4, st->incoming_sequence)) { - bombout((ssh,"Incorrect MAC received on packet")); + bombout(("Incorrect MAC received on packet")); crReturn(0); } st->incoming_sequence++; /* whether or not we MACed */ @@ -1016,8 +1046,9 @@ static int ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) &newpayload, &newlen)) { if (ssh->pktin.maxlen < newlen + 5) { ssh->pktin.maxlen = newlen + 5; - ssh->pktin.data = srealloc(ssh->pktin.data, - ssh->pktin.maxlen + APIEXTRA); + ssh->pktin.data = sresize(ssh->pktin.data, + ssh->pktin.maxlen + APIEXTRA, + unsigned char); } ssh->pktin.length = 5 + newlen; memcpy(ssh->pktin.data + 5, newpayload, newlen); @@ -1057,7 +1088,7 @@ static int ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen) buf = dupprintf("Disconnection message text: %n%.*s", &nowlen, msglen, ssh->pktin.data + 14); logevent(buf); - bombout((ssh,"Server sent disconnect message\ntype %d (%s):\n\"%s\"", + bombout(("Server sent disconnect message\ntype %d (%s):\n\"%s\"", reason, (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ? ssh2_disconnect_reasons[reason] : "unknown", @@ -1150,9 +1181,11 @@ static void ssh1_pktout_size(Ssh ssh, int len) #ifdef MSCRYPTOAPI /* Allocate enough buffer space for extra block * for MS CryptEncrypt() */ - ssh->pktout.data = srealloc(ssh->pktout.data, biglen + 12); + ssh->pktout.data = sresize(ssh->pktout.data, biglen + 12, + unsigned char); #else - ssh->pktout.data = srealloc(ssh->pktout.data, biglen + 4); + ssh->pktout.data = sresize(ssh->pktout.data, biglen + 4, + unsigned char); #endif } ssh->pktout.body = ssh->pktout.data + 4 + pad + 1; @@ -1166,8 +1199,18 @@ static void s_wrpkt_start(Ssh ssh, int type, int len) static int s_wrpkt_prepare(Ssh ssh) { - int pad, len, biglen, i; + int pad, biglen, i; unsigned long crc; +#ifdef __SC__ + /* + * XXX various versions of SC (including 8.8.4) screw up the + * register allocation in this function and use the same register + * (D6) for len and as a temporary, with predictable results. The + * following sledgehammer prevents this. + */ + volatile +#endif + int len; ssh->pktout.body[-1] = ssh->pktout.type; @@ -1218,8 +1261,9 @@ static void s_wrpkt_defer(Ssh ssh) len = s_wrpkt_prepare(ssh); if (ssh->deferred_len + len > ssh->deferred_size) { ssh->deferred_size = ssh->deferred_len + len + 128; - ssh->deferred_send_data = srealloc(ssh->deferred_send_data, - ssh->deferred_size); + ssh->deferred_send_data = sresize(ssh->deferred_send_data, + ssh->deferred_size, + unsigned char); } memcpy(ssh->deferred_send_data + ssh->deferred_len, ssh->pktout.data, len); ssh->deferred_len += len; @@ -1366,8 +1410,9 @@ static void ssh2_pkt_ensure(Ssh ssh, int length) { if (ssh->pktout.maxlen < length) { ssh->pktout.maxlen = length + 256; - ssh->pktout.data = srealloc(ssh->pktout.data, - ssh->pktout.maxlen + APIEXTRA); + ssh->pktout.data = sresize(ssh->pktout.data, + ssh->pktout.maxlen + APIEXTRA, + unsigned char); if (!ssh->pktout.data) fatalbox("Out of memory"); } @@ -1423,7 +1468,7 @@ static unsigned char *ssh2_mpint_fmt(Bignum b, int *len) { unsigned char *p; int i, n = (bignum_bitcount(b) + 7) / 8; - p = smalloc(n + 1); + p = snewn(n + 1, unsigned char); if (!p) fatalbox("out of memory"); p[0] = 0; @@ -1534,8 +1579,9 @@ static void ssh2_pkt_defer(Ssh ssh) int len = ssh2_pkt_construct(ssh); if (ssh->deferred_len + len > ssh->deferred_size) { ssh->deferred_size = ssh->deferred_len + len + 128; - ssh->deferred_send_data = srealloc(ssh->deferred_send_data, - ssh->deferred_size); + ssh->deferred_send_data = sresize(ssh->deferred_send_data, + ssh->deferred_size, + unsigned char); } memcpy(ssh->deferred_send_data + ssh->deferred_len, ssh->pktout.data, len); ssh->deferred_len += len; @@ -1628,7 +1674,7 @@ static Bignum ssh2_pkt_getmp(Ssh ssh) if (!p) return NULL; if (p[0] & 0x80) { - bombout((ssh,"internal error: Can't handle negative mpints")); + bombout(("internal error: Can't handle negative mpints")); return NULL; } b = bignum_from_bytes((unsigned char *)p, length); @@ -1771,7 +1817,7 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring) if (ssh->cfg.sshbug_derivekey2 == FORCE_ON || (ssh->cfg.sshbug_derivekey2 == AUTO && - (wc_match("2.0.0*", imp) || wc_match("2.0.1[01]*", imp) ))) { + (wc_match("2.0.0*", imp) || wc_match("2.0.10*", imp) ))) { /* * These versions have the key-derivation bug (failing to * include the literal shared secret in the hashes that @@ -1792,6 +1838,17 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring) logevent("We believe remote version has SSH2 RSA padding bug"); } + if (ssh->cfg.sshbug_pksessid2 == FORCE_ON || + (ssh->cfg.sshbug_pksessid2 == AUTO && + wc_match("OpenSSH_2.[0-2]*", imp))) { + /* + * These versions have the SSH2 session-ID bug in + * public-key authentication. + */ + ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID; + logevent("We believe remote version has SSH2 public-key-session-ID bug"); + } + if (ssh->cfg.sshbug_dhgex2 == FORCE_ON) { /* * User specified the SSH2 DH GEX bug. @@ -1835,7 +1892,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c) } s->vstrsize = 16; - s->vstring = smalloc(s->vstrsize); + s->vstring = snewn(s->vstrsize, char); strcpy(s->vstring, "SSH-"); s->vslen = 4; s->i = 0; @@ -1843,7 +1900,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c) crReturn(1); /* get another char */ if (s->vslen >= s->vstrsize - 1) { s->vstrsize += 16; - s->vstring = srealloc(s->vstring, s->vstrsize); + s->vstring = sresize(s->vstring, s->vstrsize, char); } s->vstring[s->vslen++] = c; if (s->i >= 0) { @@ -1863,7 +1920,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c) s->vstring[strcspn(s->vstring, "\r\n")] = '\0';/* remove EOL chars */ { char *vlog; - vlog = smalloc(20 + s->vslen); + vlog = snewn(20 + s->vslen, char); sprintf(vlog, "Server version: %s", s->vstring); logevent(vlog); sfree(vlog); @@ -1880,11 +1937,11 @@ static int do_ssh_init(Ssh ssh, unsigned char c) s->proto2 = ssh_versioncmp(s->version, "1.99") >= 0; if (ssh->cfg.sshprot == 0 && !s->proto1) { - bombout((ssh,"SSH protocol version 1 required by user but not provided by server")); + bombout(("SSH protocol version 1 required by user but not provided by server")); crReturn(0); } if (ssh->cfg.sshprot == 3 && !s->proto2) { - bombout((ssh,"SSH protocol version 2 required by user but not provided by server")); + bombout(("SSH protocol version 2 required by user but not provided by server")); crReturn(0); } @@ -1926,6 +1983,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c) ssh->version = 1; ssh->s_rdpkt = ssh1_rdpkt; } + update_specials_menu(ssh->frontend); ssh->state = SSH_STATE_BEFORE_SIZE; sfree(s->vstring); @@ -2042,7 +2100,7 @@ static char *connect_to_host(Ssh ssh, char *host, int port, SockAddr addr; char *err; - ssh->savedhost = smalloc(1 + strlen(host)); + ssh->savedhost = snewn(1 + strlen(host), char); if (!ssh->savedhost) fatalbox("Out of memory"); strcpy(ssh->savedhost, host); @@ -2181,7 +2239,13 @@ static int process_userpass_input(Ssh ssh, unsigned char *in, int inlen) return -1; break; default: - if (((c >= ' ' && c <= '~') || + /* + * This simplistic check for printability is disabled + * when we're doing password input, because some people + * have control characters in their passwords.o + */ + if ((!ssh->userpass_input_echo || + (c >= ' ' && c <= '~') || ((unsigned char) c >= 160)) && ssh->userpass_input_bufpos < ssh->userpass_input_buflen-1) { ssh->userpass_input_buffer[ssh->userpass_input_bufpos++] = c; @@ -2236,7 +2300,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) crWaitUntil(ispkt); if (ssh->pktin.type != SSH1_SMSG_PUBLIC_KEY) { - bombout((ssh,"Public key packet not received")); + bombout(("Public key packet not received")); crReturn(0); } @@ -2279,7 +2343,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes); - s->rsabuf = smalloc(s->len); + s->rsabuf = snewn(s->len, unsigned char); if (!s->rsabuf) fatalbox("Out of memory"); @@ -2292,7 +2356,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) */ int len = rsastr_len(&hostkey); char fingerprint[100]; - char *keystr = smalloc(len); + char *keystr = snewn(len, char); if (!keystr) fatalbox("Out of memory"); rsastr_fmt(keystr, &hostkey); @@ -2346,11 +2410,11 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) } if (!cipher_chosen) { if ((s->supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0) - bombout((ssh,"Server violates SSH 1 protocol by not " + bombout(("Server violates SSH 1 protocol by not " "supporting 3DES encryption")); else /* shouldn't happen */ - bombout((ssh,"No supported ciphers found")); + bombout(("No supported ciphers found")); crReturn(0); } @@ -2395,7 +2459,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) crWaitUntil(ispkt); if (ssh->pktin.type != SSH1_SMSG_SUCCESS) { - bombout((ssh,"Encryption not successfully enabled")); + bombout(("Encryption not successfully enabled")); crReturn(0); } @@ -2412,7 +2476,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) * Terminate. */ logevent("No username provided. Abandoning session."); - ssh->state = SSH_STATE_CLOSED; + ssh_closing((Plug)ssh, NULL, 0, 0); crReturn(1); } } else { @@ -2530,7 +2594,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) len += ssh1_bignum_length(s->challenge); len += 16; /* session id */ len += 4; /* response format */ - agentreq = smalloc(4 + len); + agentreq = snewn(4 + len, char); PUT_32BIT(agentreq, len); q = agentreq + 4; *q++ = SSH1_AGENTC_RSA_CHALLENGE; @@ -2690,7 +2754,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) PKT_END); logevent("Unable to authenticate"); connection_fatal(ssh->frontend, "Unable to authenticate"); - ssh->state = SSH_STATE_CLOSED; + ssh_closing((Plug)ssh, NULL, 0, 0); crReturn(1); } } else { @@ -2745,7 +2809,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) continue; /* go and try password */ } if (ssh->pktin.type != SSH1_SMSG_AUTH_RSA_CHALLENGE) { - bombout((ssh,"Bizarre response to offer of public key")); + bombout(("Bizarre response to offer of public key")); crReturn(0); } @@ -2781,7 +2845,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) " our public key.\r\n"); continue; /* go and try password */ } else if (ssh->pktin.type != SSH1_SMSG_SUCCESS) { - bombout((ssh,"Bizarre response to RSA authentication response")); + bombout(("Bizarre response to RSA authentication response")); crReturn(0); } @@ -2845,7 +2909,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) assert(pwlen >= bottom && pwlen <= top); - randomstr = smalloc(top + 1); + randomstr = snewn(top + 1, char); for (i = bottom; i <= top; i++) { if (i == pwlen) @@ -2914,7 +2978,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) c_write_str(ssh, "Access denied\r\n"); logevent("Authentication refused"); } else if (ssh->pktin.type != SSH1_SMSG_SUCCESS) { - bombout((ssh,"Strange packet received, type %d", ssh->pktin.type)); + bombout(("Strange packet received, type %d", ssh->pktin.type)); crReturn(0); } } @@ -3014,7 +3078,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) } while (!ispkt); if (ssh->pktin.type != SSH1_SMSG_SUCCESS && ssh->pktin.type != SSH1_SMSG_FAILURE) { - bombout((ssh,"Protocol confusion")); + bombout(("Protocol confusion")); crReturnV; } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) { logevent("Agent forwarding refused"); @@ -3044,7 +3108,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) } while (!ispkt); if (ssh->pktin.type != SSH1_SMSG_SUCCESS && ssh->pktin.type != SSH1_SMSG_FAILURE) { - bombout((ssh,"Protocol confusion")); + bombout(("Protocol confusion")); crReturnV; } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) { logevent("X11 forwarding refused"); @@ -3135,7 +3199,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) dserv, "(", dport, dserv, ")"); } else { struct ssh_rportfwd *pf; - pf = smalloc(sizeof(*pf)); + pf = snew(struct ssh_rportfwd); strcpy(pf->dhost, host); pf->dport = dport; if (saddr) { @@ -3166,7 +3230,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) } while (!ispkt); if (ssh->pktin.type != SSH1_SMSG_SUCCESS && ssh->pktin.type != SSH1_SMSG_FAILURE) { - bombout((ssh,"Protocol confusion")); + bombout(("Protocol confusion")); crReturnV; } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) { c_write_str(ssh, "Server refused port" @@ -3191,7 +3255,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) } while (!ispkt); if (ssh->pktin.type != SSH1_SMSG_SUCCESS && ssh->pktin.type != SSH1_SMSG_FAILURE) { - bombout((ssh,"Protocol confusion")); + bombout(("Protocol confusion")); crReturnV; } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) { c_write_str(ssh, "Server refused to allocate pty\r\n"); @@ -3209,7 +3273,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) } while (!ispkt); if (ssh->pktin.type != SSH1_SMSG_SUCCESS && ssh->pktin.type != SSH1_SMSG_FAILURE) { - bombout((ssh,"Protocol confusion")); + bombout(("Protocol confusion")); crReturnV; } else if (ssh->pktin.type == SSH1_SMSG_FAILURE) { c_write_str(ssh, "Server refused to compress\r\n"); @@ -3268,7 +3332,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh1_throttle(ssh, +1); } } else if (ssh->pktin.type == SSH1_MSG_DISCONNECT) { - ssh->state = SSH_STATE_CLOSED; + ssh_closing((Plug)ssh, NULL, 0, 0); logevent("Received disconnect request"); crReturnV; } else if (ssh->pktin.type == SSH1_SMSG_X11_OPEN) { @@ -3283,7 +3347,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) PKT_INT, GET_32BIT(ssh->pktin.body), PKT_END); logevent("Rejected X11 connect request"); } else { - c = smalloc(sizeof(struct ssh_channel)); + c = snew(struct ssh_channel); c->ssh = ssh; if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c, @@ -3318,7 +3382,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, PKT_INT, GET_32BIT(ssh->pktin.body), PKT_END); } else { - c = smalloc(sizeof(struct ssh_channel)); + c = snew(struct ssh_channel); c->ssh = ssh; c->remoteid = GET_32BIT(ssh->pktin.body); c->localid = alloc_channel_id(ssh); @@ -3339,7 +3403,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) int hostsize, port; char host[256], buf[1024]; char *p, *h, *e; - c = smalloc(sizeof(struct ssh_channel)); + c = snew(struct ssh_channel); c->ssh = ssh; hostsize = GET_32BIT(ssh->pktin.body+4); @@ -3460,7 +3524,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) sfree(c); } } else { - bombout((ssh,"Received CHANNEL_CLOSE%s for %s channel %d\n", + bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n", ssh->pktin.type == SSH1_MSG_CHANNEL_CLOSE ? "" : "_CONFIRMATION", c ? "half-open" : "nonexistent", i)); @@ -3495,7 +3559,8 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) if (c->u.a.lensofar == 4) { c->u.a.totallen = 4 + GET_32BIT(c->u.a.msglen); - c->u.a.message = smalloc(c->u.a.totallen); + c->u.a.message = snewn(c->u.a.totallen, + unsigned char); memcpy(c->u.a.message, c->u.a.msglen, 4); } if (c->u.a.lensofar >= 4 && len > 0) { @@ -3559,10 +3624,10 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) * encrypted packet, we close the session once * we've sent EXIT_CONFIRMATION. */ - ssh->state = SSH_STATE_CLOSED; + ssh_closing((Plug)ssh, NULL, 0, 0); crReturnV; } else { - bombout((ssh,"Strange packet received: type %d", ssh->pktin.type)); + bombout(("Strange packet received: type %d", ssh->pktin.type)); crReturnV; } } else { @@ -3835,7 +3900,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt) int i, j, len; if (ssh->pktin.type != SSH2_MSG_KEXINIT) { - bombout((ssh,"expected key exchange packet from server")); + bombout(("expected key exchange packet from server")); crReturn(0); } ssh->kex = NULL; @@ -3885,7 +3950,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt) } } if (!s->cscipher_tobe) { - bombout((ssh,"Couldn't agree a client-to-server cipher (available: %s)", + bombout(("Couldn't agree a client-to-server cipher (available: %s)", str ? str : "(null)")); crReturn(0); } @@ -3911,7 +3976,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt) } } if (!s->sccipher_tobe) { - bombout((ssh,"Couldn't agree a server-to-client cipher (available: %s)", + bombout(("Couldn't agree a server-to-client cipher (available: %s)", str ? str : "(null)")); crReturn(0); } @@ -3985,7 +4050,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt) crWaitUntil(ispkt); if (ssh->pktin.type != SSH2_MSG_KEX_DH_GEX_GROUP) { - bombout((ssh,"expected key exchange group packet from server")); + bombout(("expected key exchange group packet from server")); crReturn(0); } s->p = ssh2_pkt_getmp(ssh); @@ -4011,7 +4076,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt) crWaitUntil(ispkt); if (ssh->pktin.type != s->kex_reply_value) { - bombout((ssh,"expected key exchange reply packet from server")); + bombout(("expected key exchange reply packet from server")); crReturn(0); } ssh2_pkt_getstring(ssh, &s->hostkeydata, &s->hostkeylen); @@ -4043,7 +4108,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt) if (!s->hkey || !ssh->hostkey->verifysig(s->hkey, s->sigdata, s->siglen, (char *)s->exchange_hash, 20)) { - bombout((ssh,"Server's host key did not match the signature supplied")); + bombout(("Server's host key did not match the signature supplied")); crReturn(0); } @@ -4075,7 +4140,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt) */ crWaitUntil(ispkt); if (ssh->pktin.type != SSH2_MSG_NEWKEYS) { - bombout((ssh,"expected new-keys packet from server")); + bombout(("expected new-keys packet from server")); crReturn(0); } @@ -4290,7 +4355,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh2_pkt_send(ssh); crWaitUntilV(ispkt); if (ssh->pktin.type != SSH2_MSG_SERVICE_ACCEPT) { - bombout((ssh,"Server refused user authentication protocol")); + bombout(("Server refused user authentication protocol")); crReturnV; } @@ -4339,7 +4404,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) * Terminate. */ logevent("No username provided. Abandoning session."); - ssh->state = SSH_STATE_CLOSED; + ssh_closing((Plug)ssh, NULL, 0, 0); crReturnV; } } else { @@ -4455,7 +4520,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) if (!s->gotit) s->curr_prompt = 0; } else if (ssh->pktin.type != SSH2_MSG_USERAUTH_FAILURE) { - bombout((ssh,"Strange packet received during authentication: type %d", + bombout(("Strange packet received during authentication: type %d", ssh->pktin.type)); crReturnV; } @@ -4629,11 +4694,13 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh2_pkt_addstring_data(ssh, s->pkblob, s->pklen); s->siglen = ssh->pktout.length - 5 + 4 + 20; + if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID) + s->siglen -= 4; s->len = 1; /* message type */ s->len += 4 + s->pklen; /* key blob */ s->len += 4 + s->siglen; /* data to sign */ s->len += 4; /* flags */ - s->agentreq = smalloc(4 + s->len); + s->agentreq = snewn(4 + s->len, char); PUT_32BIT(s->agentreq, s->len); s->q = s->agentreq + 4; *s->q++ = SSH2_AGENTC_SIGN_REQUEST; @@ -4644,8 +4711,10 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) PUT_32BIT(s->q, s->siglen); s->q += 4; /* Now the data to be signed... */ - PUT_32BIT(s->q, 20); - s->q += 4; + if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) { + PUT_32BIT(s->q, 20); + s->q += 4; + } memcpy(s->q, ssh->v2_session_id, 20); s->q += 20; memcpy(s->q, ssh->pktout.data + 5, @@ -4849,7 +4918,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) logevent("Unable to authenticate"); connection_fatal(ssh->frontend, "Unable to authenticate"); - ssh->state = SSH_STATE_CLOSED; + ssh_closing((Plug)ssh, NULL, 0, 0); crReturnV; } } else { @@ -4894,6 +4963,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) } else { unsigned char *pkblob, *sigblob, *sigdata; int pkblob_len, sigblob_len, sigdata_len; + int p; /* * We have loaded the private key and the server @@ -4919,11 +4989,19 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) * outgoing packet. */ sigdata_len = ssh->pktout.length - 5 + 4 + 20; - sigdata = smalloc(sigdata_len); - PUT_32BIT(sigdata, 20); - memcpy(sigdata + 4, ssh->v2_session_id, 20); - memcpy(sigdata + 24, ssh->pktout.data + 5, + if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID) + sigdata_len -= 4; + sigdata = snewn(sigdata_len, unsigned char); + p = 0; + if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) { + PUT_32BIT(sigdata+p, 20); + p += 4; + } + memcpy(sigdata+p, ssh->v2_session_id, 20); p += 20; + memcpy(sigdata+p, ssh->pktout.data + 5, ssh->pktout.length - 5); + p += ssh->pktout.length - 5; + assert(p == sigdata_len); sigblob = key->alg->sign(key->data, (char *)sigdata, sigdata_len, &sigblob_len); ssh2_add_sigblob(ssh, pkblob, pkblob_len, @@ -5029,7 +5107,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) " methods available"); ssh2_pkt_addstring(ssh, "en"); /* language tag */ ssh2_pkt_send(ssh); - ssh->state = SSH_STATE_CLOSED; + ssh_closing((Plug)ssh, NULL, 0, 0); crReturnV; } } @@ -5045,7 +5123,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) * So now create a channel with a session in it. */ ssh->channels = newtree234(ssh_channelcmp); - ssh->mainchan = smalloc(sizeof(struct ssh_channel)); + ssh->mainchan = snew(struct ssh_channel); ssh->mainchan->ssh = ssh; ssh->mainchan->localid = alloc_channel_id(ssh); ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_OPEN); @@ -5057,12 +5135,12 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh2_pkt_send(ssh); crWaitUntilV(ispkt); if (ssh->pktin.type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) { - bombout((ssh,"Server refused to open a session")); + bombout(("Server refused to open a session")); crReturnV; /* FIXME: error data comes back in FAILURE packet */ } if (ssh2_pkt_getuint32(ssh) != ssh->mainchan->localid) { - bombout((ssh,"Server's channel confirmation cited wrong channel")); + bombout(("Server's channel confirmation cited wrong channel")); crReturnV; } ssh->mainchan->remoteid = ssh2_pkt_getuint32(ssh); @@ -5107,7 +5185,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) { if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) { - bombout((ssh,"Unexpected response to X11 forwarding request:" + bombout(("Unexpected response to X11 forwarding request:" " packet type %d", ssh->pktin.type)); crReturnV; } @@ -5202,7 +5280,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) dserv, "(", dport, dserv, ")"); } else { struct ssh_rportfwd *pf; - pf = smalloc(sizeof(*pf)); + pf = snew(struct ssh_rportfwd); strcpy(pf->dhost, host); pf->dport = dport; pf->sport = sport; @@ -5248,7 +5326,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) if (ssh->pktin.type != SSH2_MSG_REQUEST_SUCCESS) { if (ssh->pktin.type != SSH2_MSG_REQUEST_FAILURE) { - bombout((ssh,"Unexpected response to port " + bombout(("Unexpected response to port " "forwarding request: packet type %d", ssh->pktin.type)); crReturnV; @@ -5288,7 +5366,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) { if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) { - bombout((ssh,"Unexpected response to agent forwarding request:" + bombout(("Unexpected response to agent forwarding request:" " packet type %d", ssh->pktin.type)); crReturnV; } @@ -5331,7 +5409,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) { if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) { - bombout((ssh,"Unexpected response to pty request:" + bombout(("Unexpected response to pty request:" " packet type %d", ssh->pktin.type)); crReturnV; } @@ -5389,7 +5467,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) } while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST); if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) { if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) { - bombout((ssh,"Unexpected response to shell/command request:" + bombout(("Unexpected response to shell/command request:" " packet type %d", ssh->pktin.type)); crReturnV; } @@ -5404,7 +5482,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh->fallback_cmd = TRUE; continue; } - bombout((ssh,"Server refused to start a shell/command")); + bombout(("Server refused to start a shell/command")); crReturnV; } else { logevent("Started a shell/command"); @@ -5470,7 +5548,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) if (c->u.a.lensofar == 4) { c->u.a.totallen = 4 + GET_32BIT(c->u.a.msglen); - c->u.a.message = smalloc(c->u.a.totallen); + c->u.a.message = snewn(c->u.a.totallen, + unsigned char); memcpy(c->u.a.message, c->u.a.msglen, 4); } if (c->u.a.lensofar >= 4 && length > 0) { @@ -5541,7 +5620,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) c = find234(ssh->channels, &i, ssh_channelfind); if (!c || ((int)c->remoteid) == -1) { - bombout((ssh,"Received CHANNEL_CLOSE for %s channel %d\n", + bombout(("Received CHANNEL_CLOSE for %s channel %d\n", c ? "half-open" : "nonexistent", i)); } /* Do pre-close processing on the channel. */ @@ -5575,6 +5654,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) * See if that was the last channel left open. */ if (count234(ssh->channels) == 0) { + logevent("All channels closed. Disconnecting"); #if 0 /* * We used to send SSH_MSG_DISCONNECT here, @@ -5587,14 +5667,13 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) * this is more polite than sending a * DISCONNECT. So now we don't. */ - logevent("All channels closed. Disconnecting"); ssh2_pkt_init(ssh, SSH2_MSG_DISCONNECT); ssh2_pkt_adduint32(ssh, SSH2_DISCONNECT_BY_APPLICATION); ssh2_pkt_addstring(ssh, "All open channels closed"); ssh2_pkt_addstring(ssh, "en"); /* language tag */ ssh2_pkt_send(ssh); #endif - ssh->state = SSH_STATE_CLOSED; + ssh_closing((Plug)ssh, NULL, 0, 0); crReturnV; } continue; /* remote sends close; ignore (FIXME) */ @@ -5671,8 +5750,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh2_pkt_addstring(ssh, buf); ssh2_pkt_addstring(ssh, "en"); /* language tag */ ssh2_pkt_send(ssh); - connection_fatal("%s", buf); - ssh->state = SSH_STATE_CLOSED; + connection_fatal(ssh->frontend, "%s", buf); + ssh_closing((Plug)ssh, NULL, 0, 0); crReturnV; } @@ -5734,7 +5813,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) struct ssh_channel *c; unsigned remid, winsize, pktsize; ssh2_pkt_getstring(ssh, &type, &typelen); - c = smalloc(sizeof(struct ssh_channel)); + c = snew(struct ssh_channel); c->ssh = ssh; remid = ssh2_pkt_getuint32(ssh); @@ -5744,7 +5823,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) port = ssh2_pkt_getuint32(ssh); if (typelen == 3 && !memcmp(type, "x11", 3)) { - char *addrstr = smalloc(peeraddrlen+1); + char *addrstr = snewn(peeraddrlen+1, char); memcpy(addrstr, peeraddr, peeraddrlen); peeraddr[peeraddrlen] = '\0'; @@ -5819,7 +5898,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh2_pkt_send(ssh); } } else { - bombout((ssh,"Strange packet received: type %d", ssh->pktin.type)); + bombout(("Strange packet received: type %d", ssh->pktin.type)); crReturnV; } } else { @@ -5887,8 +5966,9 @@ static char *ssh_init(void *frontend_handle, void **backend_handle, char *p; Ssh ssh; - ssh = smalloc(sizeof(*ssh)); + ssh = snew(struct ssh_tag); ssh->cfg = *cfg; /* STRUCTURE COPY */ + ssh->version = 0; /* when not ready yet */ ssh->s = NULL; ssh->cipher = NULL; ssh->v1_cipher_ctx = NULL; @@ -6135,6 +6215,31 @@ static void ssh_size(void *handle, int width, int height) } /* + * Return a list of the special codes that make sense in this + * protocol. + */ +static const struct telnet_special *ssh_get_specials(void *handle) +{ + Ssh ssh = (Ssh) handle; + + if (ssh->version == 1) { + static const struct telnet_special ssh1_specials[] = { + {"IGNORE message", TS_NOP}, + {NULL, 0} + }; + return ssh1_specials; + } else if (ssh->version == 2) { + static const struct telnet_special ssh2_specials[] = { + {"Break", TS_BRK}, + {"IGNORE message", TS_NOP}, + {NULL, 0} + }; + return ssh2_specials; + } else + return NULL; +} + +/* * Send Telnet special codes. TS_EOF is useful for `plink', so you * can send an EOF and collect resulting output (e.g. `plink * hostname sort'). @@ -6161,7 +6266,7 @@ static void ssh_special(void *handle, Telnet_Special code) ssh2_pkt_send(ssh); } logevent("Sent EOF message"); - } else if (code == TS_PING) { + } else if (code == TS_PING || code == TS_NOP) { if (ssh->state == SSH_STATE_CLOSED || ssh->state == SSH_STATE_PREPACKET) return; if (ssh->version == 1) { @@ -6172,6 +6277,19 @@ static void ssh_special(void *handle, Telnet_Special code) ssh2_pkt_addstring_start(ssh); ssh2_pkt_send(ssh); } + } else if (code == TS_BRK) { + if (ssh->state == SSH_STATE_CLOSED + || ssh->state == SSH_STATE_PREPACKET) return; + if (ssh->version == 1) { + logevent("Unable to send BREAK signal in SSH1"); + } else { + ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST); + ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid); + ssh2_pkt_addstring(ssh, "break"); + ssh2_pkt_addbool(ssh, 0); + ssh2_pkt_adduint32(ssh, 0); /* default break length */ + ssh2_pkt_send(ssh); + } } else { /* do nothing */ } @@ -6181,7 +6299,7 @@ void *new_sock_channel(void *handle, Socket s) { Ssh ssh = (Ssh) handle; struct ssh_channel *c; - c = smalloc(sizeof(struct ssh_channel)); + c = snew(struct ssh_channel); c->ssh = ssh; if (c) { @@ -6287,7 +6405,10 @@ static void ssh_provide_logctx(void *handle, void *logctx) static int ssh_return_exitcode(void *handle) { Ssh ssh = (Ssh) handle; - return ssh->exitcode; + if (ssh->s != NULL) + return -1; + else + return (ssh->exitcode >= 0 ? ssh->exitcode : 0); } /* @@ -6309,6 +6430,7 @@ Backend ssh_backend = { ssh_sendbuffer, ssh_size, ssh_special, + ssh_get_specials, ssh_socket, ssh_return_exitcode, ssh_sendok,