X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/cdb5270507ec9ad0d07cbccac1e358a94bfb3590..7555d6a50b05d96de39b5e95cf11a8f05f0c4fd9:/ssh.c diff --git a/ssh.c b/ssh.c index 8c552b1e..e693fb6a 100644 --- a/ssh.c +++ b/ssh.c @@ -104,8 +104,9 @@ * Packet type contexts, so that ssh2_pkt_type can correctly decode * the ambiguous type numbers back into the correct type strings. */ -#define SSH2_PKTCTX_DHGROUP1 0x0001 +#define SSH2_PKTCTX_DHGROUP 0x0001 #define SSH2_PKTCTX_DHGEX 0x0002 +#define SSH2_PKTCTX_KEX_MASK 0x000F #define SSH2_PKTCTX_PUBLICKEY 0x0010 #define SSH2_PKTCTX_PASSWORD 0x0020 #define SSH2_PKTCTX_KBDINTER 0x0040 @@ -162,7 +163,7 @@ static const char *const ssh2_disconnect_reasons[] = { #define BUG_CHOKES_ON_RSA 8 #define BUG_SSH2_RSA_PADDING 16 #define BUG_SSH2_DERIVEKEY 32 -#define BUG_SSH2_DH_GEX 64 +#define BUG_SSH2_REKEY 64 #define BUG_SSH2_PK_SESSIONID 128 #define translate(x) if (type == x) return #x @@ -222,8 +223,8 @@ static char *ssh2_pkt_type(int pkt_ctx, int type) translate(SSH2_MSG_SERVICE_ACCEPT); translate(SSH2_MSG_KEXINIT); translate(SSH2_MSG_NEWKEYS); - translatec(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP1); - translatec(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP1); + translatec(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP); + translatec(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP); translatec(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX); translatec(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX); translatec(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX); @@ -359,11 +360,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, #define SSH1_BUFFER_LIMIT 32768 #define SSH_MAX_BACKLOG 32768 #define OUR_V2_WINSIZE 16384 - -const static struct ssh_kex *kex_algs[] = { - &ssh_diffiehellman_gex, - &ssh_diffiehellman -}; +#define OUR_V2_MAXPKT 0x4000UL const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss }; @@ -499,15 +496,40 @@ struct ssh_channel { * of its ports was connected to; and _you_ have to remember what * local host:port pair went with that port number. * - * Hence: in SSH 1 this structure stores host:port pairs we intend - * to allow connections to, and is indexed by those host:port - * pairs. In SSH 2 it stores a mapping from source port to - * destination host:port pair, and is indexed by source port. + * Hence, in SSH 1 this structure is indexed by destination + * host:port pair, whereas in SSH 2 it is indexed by source port. */ +struct ssh_portfwd; /* forward declaration */ + struct ssh_rportfwd { unsigned sport, dport; char dhost[256]; + char *sportdesc; + struct ssh_portfwd *pfrec; }; +#define free_rportfwd(pf) ( \ + ((pf) ? (sfree((pf)->sportdesc)) : (void)0 ), sfree(pf) ) + +/* + * Separately to the rportfwd tree (which is for looking up port + * open requests from the server), a tree of _these_ structures is + * used to keep track of all the currently open port forwardings, + * so that we can reconfigure in mid-session if the user requests + * it. + */ +struct ssh_portfwd { + enum { DESTROY, KEEP, CREATE } status; + int type; + unsigned sport, dport; + char *saddr, *daddr; + char *sserv, *dserv; + struct ssh_rportfwd *remote; + int addressfamily; + void *local; +}; +#define free_portfwd(pf) ( \ + ((pf) ? (sfree((pf)->saddr), sfree((pf)->daddr), \ + sfree((pf)->sserv), sfree((pf)->dserv)) : (void)0 ), sfree(pf) ) struct Packet { long length; @@ -540,7 +562,7 @@ static void ssh2_add_channel_data(struct ssh_channel *c, char *buf, int len); static void ssh_throttle_all(Ssh ssh, int enable, int bufsize); static void ssh2_set_window(struct ssh_channel *c, unsigned newwin); static int ssh_sendbuffer(void *handle); -static void ssh_do_close(Ssh ssh); +static int ssh_do_close(Ssh ssh, int notify_exit); static unsigned long ssh_pkt_getuint32(struct Packet *pkt); static int ssh2_pkt_getbool(struct Packet *pkt); static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length); @@ -566,6 +588,15 @@ struct rdpkt2_state_tag { }; typedef void (*handler_fn_t)(Ssh ssh, struct Packet *pktin); +typedef void (*chandler_fn_t)(Ssh ssh, struct Packet *pktin, void *ctx); + +struct queued_handler; +struct queued_handler { + int msg1, msg2; + chandler_fn_t handler; + void *ctx; + struct queued_handler *next; +}; struct ssh_tag { const struct plug_function_table *fn; @@ -612,8 +643,9 @@ struct ssh_tag { tree234 *channels; /* indexed by local id */ struct ssh_channel *mainchan; /* primary session channel */ int exitcode; + int close_expected; - tree234 *rportfwds; + tree234 *rportfwds, *portfwds; enum { SSH_STATE_PREPACKET, @@ -647,7 +679,6 @@ struct ssh_tag { int userpass_input_bufpos; int userpass_input_echo; - char *portfwd_strptr; int pkt_ctx; void *x11auth; @@ -704,6 +735,12 @@ struct ssh_tag { handler_fn_t packet_dispatch[256]; /* + * Queues of one-off handler functions for success/failure + * indications from a request. + */ + struct queued_handler *qhead, *qtail; + + /* * This module deals with sending keepalives. */ Pinger pinger; @@ -713,13 +750,12 @@ struct ssh_tag { * size-based rekeys. */ unsigned long incoming_data_size, outgoing_data_size, deferred_data_size; + unsigned long max_data_size; int kex_in_progress; - long next_rekey; + long next_rekey, last_rekey; + char *deferred_rekey_reason; /* points to STATIC string; don't free */ }; -#define MAX_DATA_BEFORE_REKEY (0x40000000UL) -#define REKEY_TIMEOUT (3600 * TICKSPERSEC) - #define logevent(s) logevent(ssh->frontend, s) /* logevent, only printf-formatted. */ @@ -738,7 +774,7 @@ static void logeventf(Ssh ssh, const char *fmt, ...) #define bombout(msg) \ do { \ char *text = dupprintf msg; \ - ssh_do_close(ssh); \ + ssh_do_close(ssh, FALSE); \ logevent(text); \ connection_fatal(ssh->frontend, "%s", text); \ sfree(text); \ @@ -810,6 +846,51 @@ static int ssh_rportcmp_ssh2(void *av, void *bv) return 0; } +/* + * Special form of strcmp which can cope with NULL inputs. NULL is + * defined to sort before even the empty string. + */ +static int nullstrcmp(const char *a, const char *b) +{ + if (a == NULL && b == NULL) + return 0; + if (a == NULL) + return -1; + if (b == NULL) + return +1; + return strcmp(a, b); +} + +static int ssh_portcmp(void *av, void *bv) +{ + struct ssh_portfwd *a = (struct ssh_portfwd *) av; + struct ssh_portfwd *b = (struct ssh_portfwd *) bv; + int i; + if (a->type > b->type) + return +1; + if (a->type < b->type) + return -1; + if (a->addressfamily > b->addressfamily) + return +1; + if (a->addressfamily < b->addressfamily) + return -1; + if ( (i = nullstrcmp(a->saddr, b->saddr)) != 0) + return i < 0 ? -1 : +1; + if (a->sport > b->sport) + return +1; + if (a->sport < b->sport) + return -1; + if (a->type != 'D') { + if ( (i = nullstrcmp(a->daddr, b->daddr)) != 0) + return i < 0 ? -1 : +1; + if (a->dport > b->dport) + return +1; + if (a->dport < b->dport) + return -1; + } + return 0; +} + static int alloc_channel_id(Ssh ssh) { const unsigned CHANNEL_NUMBER_OFFSET = 256; @@ -1658,9 +1739,9 @@ static void ssh2_pkt_send_noqueue(Ssh ssh, struct Packet *pkt) ssh->outgoing_data_size += pkt->encrypted_len; if (!ssh->kex_in_progress && - ssh->outgoing_data_size > MAX_DATA_BEFORE_REKEY) - do_ssh2_transport(ssh, "Initiating key re-exchange " - "(too much data sent)", -1, NULL); + ssh->max_data_size != 0 && + ssh->outgoing_data_size > ssh->max_data_size) + do_ssh2_transport(ssh, "too much data sent", -1, NULL); ssh_free_packet(pkt); } @@ -1748,9 +1829,9 @@ static void ssh_pkt_defersend(Ssh ssh) ssh->outgoing_data_size += ssh->deferred_data_size; if (!ssh->kex_in_progress && - ssh->outgoing_data_size > MAX_DATA_BEFORE_REKEY) - do_ssh2_transport(ssh, "Initiating key re-exchange " - "(too much data sent)", -1, NULL); + ssh->max_data_size != 0 && + ssh->outgoing_data_size > ssh->max_data_size) + do_ssh2_transport(ssh, "too much data sent", -1, NULL); ssh->deferred_data_size = 0; } @@ -2058,12 +2139,17 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring) logevent("We believe remote version has SSH2 public-key-session-ID bug"); } - if (ssh->cfg.sshbug_dhgex2 == FORCE_ON) { + if (ssh->cfg.sshbug_rekey2 == FORCE_ON || + (ssh->cfg.sshbug_rekey2 == AUTO && + (wc_match("OpenSSH_2.[0-4]*", imp) || + wc_match("OpenSSH_2.5.[0-3]*", imp) || + wc_match("Sun_SSH_1.0", imp) || + wc_match("Sun_SSH_1.0.1", imp)))) { /* - * User specified the SSH2 DH GEX bug. + * These versions have the SSH2 rekey bug. */ - ssh->remote_bugs |= BUG_SSH2_DH_GEX; - logevent("We believe remote version has SSH2 DH group exchange bug"); + ssh->remote_bugs |= BUG_SSH2_REKEY; + logevent("We believe remote version has SSH2 rekey bug"); } } @@ -2284,16 +2370,19 @@ static void ssh_gotdata(Ssh ssh, unsigned char *data, int datalen) crFinishV; } -static void ssh_do_close(Ssh ssh) +static int ssh_do_close(Ssh ssh, int notify_exit) { - int i; + int i, ret = 0; struct ssh_channel *c; ssh->state = SSH_STATE_CLOSED; if (ssh->s) { sk_close(ssh->s); ssh->s = NULL; - notify_remote_exit(ssh->frontend); + if (notify_exit) + notify_remote_exit(ssh->frontend); + else + ret = 1; } /* * Now we must shut down any port and X forwardings going @@ -2315,20 +2404,45 @@ static void ssh_do_close(Ssh ssh) sfree(c); } } + + return ret; +} + +static void ssh_log(Plug plug, int type, SockAddr addr, int port, + const char *error_msg, int error_code) +{ + Ssh ssh = (Ssh) plug; + char addrbuf[256], *msg; + + sk_getaddr(addr, addrbuf, lenof(addrbuf)); + + if (type == 0) + msg = dupprintf("Connecting to %s port %d", addrbuf, port); + else + msg = dupprintf("Failed to connect to %s: %s", addrbuf, error_msg); + + logevent(msg); } static int ssh_closing(Plug plug, const char *error_msg, int error_code, int calling_back) { Ssh ssh = (Ssh) plug; - ssh_do_close(ssh); + int need_notify = ssh_do_close(ssh, FALSE); + + if (!error_msg && !ssh->close_expected) { + error_msg = "Server unexpectedly closed network connection"; + } + if (error_msg) { /* A socket error has occurred. */ logevent(error_msg); connection_fatal(ssh->frontend, "%s", error_msg); } else { - /* Otherwise, the remote side closed the connection normally. */ + logevent("Server closed network connection"); } + if (need_notify) + notify_remote_exit(ssh->frontend); return 0; } @@ -2337,7 +2451,7 @@ static int ssh_receive(Plug plug, int urgent, char *data, int len) Ssh ssh = (Ssh) plug; ssh_gotdata(ssh, (unsigned char *)data, len); if (ssh->state == SSH_STATE_CLOSED) { - ssh_do_close(ssh); + ssh_do_close(ssh, TRUE); return 0; } return 1; @@ -2364,6 +2478,7 @@ static const char *connect_to_host(Ssh ssh, char *host, int port, char **realhost, int nodelay, int keepalive) { static const struct plug_function_table fn_table = { + ssh_log, ssh_closing, ssh_receive, ssh_sent, @@ -2385,8 +2500,11 @@ static const char *connect_to_host(Ssh ssh, char *host, int port, /* * Try to find host. */ - logeventf(ssh, "Looking up host \"%s\"", host); - addr = name_lookup(host, port, realhost, &ssh->cfg); + logeventf(ssh, "Looking up host \"%s\"%s", host, + (ssh->cfg.addressfamily == ADDRTYPE_IPV4 ? " (IPv4)" : + (ssh->cfg.addressfamily == ADDRTYPE_IPV6 ? " (IPv6)" : ""))); + addr = name_lookup(host, port, realhost, &ssh->cfg, + ssh->cfg.addressfamily); if ((err = sk_addr_error(addr)) != NULL) { sk_addr_free(addr); return err; @@ -2395,11 +2513,6 @@ static const char *connect_to_host(Ssh ssh, char *host, int port, /* * Open socket. */ - { - char addrbuf[100]; - sk_getaddr(addr, addrbuf, 100); - logeventf(ssh, "Connecting to %s port %d", addrbuf, port); - } ssh->fn = &fn_table; ssh->s = new_connection(addr, *realhost, port, 0, 1, nodelay, keepalive, (Plug) ssh, &ssh->cfg); @@ -2759,8 +2872,11 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, } /* Warn about chosen cipher if necessary. */ - if (warn) - askcipher(ssh->frontend, cipher_string, 0); + if (warn) { + sk_set_frozen(ssh->s, 1); + askalg(ssh->frontend, "cipher", cipher_string); + sk_set_frozen(ssh->s, 0); + } } switch (s->cipher_type) { @@ -2832,6 +2948,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, * Terminate. */ logevent("No username provided. Abandoning session."); + ssh->close_expected = TRUE; ssh_closing((Plug)ssh, NULL, 0, 0); crStop(1); } @@ -3180,6 +3297,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, PKT_END); logevent("Unable to authenticate"); connection_fatal(ssh->frontend, "Unable to authenticate"); + ssh->close_expected = TRUE; ssh_closing((Plug)ssh, NULL, 0, 0); crStop(1); } @@ -3515,6 +3633,411 @@ void sshfwd_unthrottle(struct ssh_channel *c, int bufsize) } } +static void ssh_queueing_handler(Ssh ssh, struct Packet *pktin) +{ + struct queued_handler *qh = ssh->qhead; + + assert(qh != NULL); + + assert(pktin->type == qh->msg1 || pktin->type == qh->msg2); + + if (qh->msg1 > 0) { + assert(ssh->packet_dispatch[qh->msg1] == ssh_queueing_handler); + ssh->packet_dispatch[qh->msg1] = NULL; + } + if (qh->msg2 > 0) { + assert(ssh->packet_dispatch[qh->msg2] == ssh_queueing_handler); + ssh->packet_dispatch[qh->msg2] = NULL; + } + + if (qh->next) { + ssh->qhead = qh->next; + + if (ssh->qhead->msg1 > 0) { + assert(ssh->packet_dispatch[ssh->qhead->msg1] == NULL); + ssh->packet_dispatch[ssh->qhead->msg1] = ssh_queueing_handler; + } + if (ssh->qhead->msg2 > 0) { + assert(ssh->packet_dispatch[ssh->qhead->msg2] == NULL); + ssh->packet_dispatch[ssh->qhead->msg2] = ssh_queueing_handler; + } + } else { + ssh->qhead = ssh->qtail = NULL; + ssh->packet_dispatch[pktin->type] = NULL; + } + + qh->handler(ssh, pktin, qh->ctx); + + sfree(qh); +} + +static void ssh_queue_handler(Ssh ssh, int msg1, int msg2, + chandler_fn_t handler, void *ctx) +{ + struct queued_handler *qh; + + qh = snew(struct queued_handler); + qh->msg1 = msg1; + qh->msg2 = msg2; + qh->handler = handler; + qh->ctx = ctx; + qh->next = NULL; + + if (ssh->qtail == NULL) { + ssh->qhead = qh; + + if (qh->msg1 > 0) { + assert(ssh->packet_dispatch[qh->msg1] == NULL); + ssh->packet_dispatch[qh->msg1] = ssh_queueing_handler; + } + if (qh->msg2 > 0) { + assert(ssh->packet_dispatch[qh->msg2] == NULL); + ssh->packet_dispatch[qh->msg2] = ssh_queueing_handler; + } + } else { + ssh->qtail->next = qh; + } + ssh->qtail = qh; +} + +static void ssh_rportfwd_succfail(Ssh ssh, struct Packet *pktin, void *ctx) +{ + struct ssh_rportfwd *rpf, *pf = (struct ssh_rportfwd *)ctx; + + if (pktin->type == (ssh->version == 1 ? SSH1_SMSG_SUCCESS : + SSH2_MSG_REQUEST_SUCCESS)) { + logeventf(ssh, "Remote port forwarding from %s enabled", + pf->sportdesc); + } else { + logeventf(ssh, "Remote port forwarding from %s refused", + pf->sportdesc); + + rpf = del234(ssh->rportfwds, pf); + assert(rpf == pf); + free_rportfwd(pf); + } +} + +static void ssh_setup_portfwd(Ssh ssh, const Config *cfg) +{ + const char *portfwd_strptr = cfg->portfwd; + struct ssh_portfwd *epf; + int i; + + if (!ssh->portfwds) { + ssh->portfwds = newtree234(ssh_portcmp); + } else { + /* + * Go through the existing port forwardings and tag them + * with status==DESTROY. Any that we want to keep will be + * re-enabled (status==KEEP) as we go through the + * configuration and find out which bits are the same as + * they were before. + */ + struct ssh_portfwd *epf; + int i; + for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++) + epf->status = DESTROY; + } + + while (*portfwd_strptr) { + char address_family, type; + int sport,dport,sserv,dserv; + char sports[256], dports[256], saddr[256], host[256]; + int n; + + address_family = 'A'; + type = 'L'; + if (*portfwd_strptr == 'A' || + *portfwd_strptr == '4' || + *portfwd_strptr == '6') + address_family = *portfwd_strptr++; + if (*portfwd_strptr == 'L' || + *portfwd_strptr == 'R' || + *portfwd_strptr == 'D') + type = *portfwd_strptr++; + + saddr[0] = '\0'; + + n = 0; + while (*portfwd_strptr && *portfwd_strptr != '\t') { + if (*portfwd_strptr == ':') { + /* + * We've seen a colon in the middle of the + * source port number. This means that + * everything we've seen until now is the + * source _address_, so we'll move it into + * saddr and start sports from the beginning + * again. + */ + portfwd_strptr++; + sports[n] = '\0'; + if (ssh->version == 1 && type == 'R') { + logeventf(ssh, "SSH1 cannot handle remote source address " + "spec \"%s\"; ignoring", sports); + } else + strcpy(saddr, sports); + n = 0; + } + if (n < 255) sports[n++] = *portfwd_strptr++; + } + sports[n] = 0; + if (type != 'D') { + if (*portfwd_strptr == '\t') + portfwd_strptr++; + n = 0; + while (*portfwd_strptr && *portfwd_strptr != ':') { + if (n < 255) host[n++] = *portfwd_strptr++; + } + host[n] = 0; + if (*portfwd_strptr == ':') + portfwd_strptr++; + n = 0; + while (*portfwd_strptr) { + if (n < 255) dports[n++] = *portfwd_strptr++; + } + dports[n] = 0; + portfwd_strptr++; + dport = atoi(dports); + dserv = 0; + if (dport == 0) { + dserv = 1; + dport = net_service_lookup(dports); + if (!dport) { + logeventf(ssh, "Service lookup failed for destination" + " port \"%s\"", dports); + } + } + } else { + while (*portfwd_strptr) portfwd_strptr++; + dport = dserv = -1; + portfwd_strptr++; /* eat the NUL and move to next one */ + } + sport = atoi(sports); + sserv = 0; + if (sport == 0) { + sserv = 1; + sport = net_service_lookup(sports); + if (!sport) { + logeventf(ssh, "Service lookup failed for source" + " port \"%s\"", sports); + } + } + if (sport && dport) { + /* Set up a description of the source port. */ + struct ssh_portfwd *pfrec, *epfrec; + + pfrec = snew(struct ssh_portfwd); + pfrec->type = type; + pfrec->saddr = *saddr ? dupstr(saddr) : NULL; + pfrec->sserv = sserv ? dupstr(sports) : NULL; + pfrec->sport = sport; + pfrec->daddr = *host ? dupstr(host) : NULL; + pfrec->dserv = dserv ? dupstr(dports) : NULL; + pfrec->dport = dport; + pfrec->local = NULL; + pfrec->remote = NULL; + pfrec->addressfamily = (address_family == '4' ? ADDRTYPE_IPV4 : + address_family == '6' ? ADDRTYPE_IPV6 : + ADDRTYPE_UNSPEC); + + epfrec = add234(ssh->portfwds, pfrec); + if (epfrec != pfrec) { + /* + * We already have a port forwarding with precisely + * these parameters. Hence, no need to do anything; + * simply tag the existing one as KEEP. + */ + epfrec->status = KEEP; + free_portfwd(pfrec); + } else { + pfrec->status = CREATE; + } + } + } + + /* + * Now go through and destroy any port forwardings which were + * not re-enabled. + */ + for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++) + if (epf->status == DESTROY) { + char *message; + + message = dupprintf("%s port forwarding from %s%s%d", + epf->type == 'L' ? "local" : + epf->type == 'R' ? "remote" : "dynamic", + epf->saddr ? epf->saddr : "", + epf->saddr ? ":" : "", + epf->sport); + + if (epf->type != 'D') { + char *msg2 = dupprintf("%s to %s:%d", message, + epf->daddr, epf->dport); + sfree(message); + message = msg2; + } + + logeventf(ssh, "Cancelling %s", message); + sfree(message); + + if (epf->remote) { + struct ssh_rportfwd *rpf = epf->remote; + struct Packet *pktout; + + /* + * Cancel the port forwarding at the server + * end. + */ + if (ssh->version == 1) { + /* + * We cannot cancel listening ports on the + * server side in SSH1! There's no message + * to support it. Instead, we simply remove + * the rportfwd record from the local end + * so that any connections the server tries + * to make on it are rejected. + */ + } else { + pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST); + ssh2_pkt_addstring(pktout, "cancel-tcpip-forward"); + ssh2_pkt_addbool(pktout, 0);/* _don't_ want reply */ + if (epf->saddr) { + ssh2_pkt_addstring(pktout, epf->saddr); + } else if (ssh->cfg.rport_acceptall) { + ssh2_pkt_addstring(pktout, "0.0.0.0"); + } else { + ssh2_pkt_addstring(pktout, "127.0.0.1"); + } + ssh2_pkt_adduint32(pktout, epf->sport); + ssh2_pkt_send(ssh, pktout); + } + + del234(ssh->rportfwds, rpf); + free_rportfwd(rpf); + } else if (epf->local) { + pfd_terminate(epf->local); + } + + delpos234(ssh->portfwds, i); + free_portfwd(epf); + i--; /* so we don't skip one in the list */ + } + + /* + * And finally, set up any new port forwardings (status==CREATE). + */ + for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++) + if (epf->status == CREATE) { + char *sportdesc, *dportdesc; + sportdesc = dupprintf("%s%s%s%s%d%s", + epf->saddr ? epf->saddr : "", + epf->saddr ? ":" : "", + epf->sserv ? epf->sserv : "", + epf->sserv ? "(" : "", + epf->sport, + epf->sserv ? ")" : ""); + if (epf->type == 'D') { + dportdesc = NULL; + } else { + dportdesc = dupprintf("%s:%s%s%d%s", + epf->daddr, + epf->dserv ? epf->dserv : "", + epf->dserv ? "(" : "", + epf->dport, + epf->dserv ? ")" : ""); + } + + if (epf->type == 'L') { + const char *err = pfd_addforward(epf->daddr, epf->dport, + epf->saddr, epf->sport, + ssh, &ssh->cfg, + &epf->local, + epf->addressfamily); + + logeventf(ssh, "Local %sport %s forwarding to %s%s%s", + epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " : + epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "", + sportdesc, dportdesc, + err ? " failed: " : "", err ? err : ""); + } else if (epf->type == 'D') { + const char *err = pfd_addforward(NULL, -1, + epf->saddr, epf->sport, + ssh, &ssh->cfg, + &epf->local, + epf->addressfamily); + + logeventf(ssh, "Local %sport %s SOCKS dynamic forwarding%s%s", + epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " : + epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "", + sportdesc, + err ? " failed: " : "", err ? err : ""); + } else { + struct ssh_rportfwd *pf; + + /* + * Ensure the remote port forwardings tree exists. + */ + if (!ssh->rportfwds) { + if (ssh->version == 1) + ssh->rportfwds = newtree234(ssh_rportcmp_ssh1); + else + ssh->rportfwds = newtree234(ssh_rportcmp_ssh2); + } + + pf = snew(struct ssh_rportfwd); + strncpy(pf->dhost, epf->daddr, lenof(pf->dhost)-1); + pf->dhost[lenof(pf->dhost)-1] = '\0'; + pf->dport = epf->dport; + pf->sport = epf->sport; + if (add234(ssh->rportfwds, pf) != pf) { + logeventf(ssh, "Duplicate remote port forwarding to %s:%d", + epf->daddr, epf->dport); + sfree(pf); + } else { + logeventf(ssh, "Requesting remote port %s" + " forward to %s", sportdesc, dportdesc); + + pf->sportdesc = sportdesc; + sportdesc = NULL; + epf->remote = pf; + pf->pfrec = epf; + + if (ssh->version == 1) { + send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST, + PKT_INT, epf->sport, + PKT_STR, epf->daddr, + PKT_INT, epf->dport, + PKT_END); + ssh_queue_handler(ssh, SSH1_SMSG_SUCCESS, + SSH1_SMSG_FAILURE, + ssh_rportfwd_succfail, pf); + } else { + struct Packet *pktout; + pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST); + ssh2_pkt_addstring(pktout, "tcpip-forward"); + ssh2_pkt_addbool(pktout, 1);/* want reply */ + if (epf->saddr) { + ssh2_pkt_addstring(pktout, epf->saddr); + } else if (ssh->cfg.rport_acceptall) { + ssh2_pkt_addstring(pktout, "0.0.0.0"); + } else { + ssh2_pkt_addstring(pktout, "127.0.0.1"); + } + ssh2_pkt_adduint32(pktout, epf->sport); + ssh2_pkt_send(ssh, pktout); + + ssh_queue_handler(ssh, SSH2_MSG_REQUEST_SUCCESS, + SSH2_MSG_REQUEST_FAILURE, + ssh_rportfwd_succfail, pf); + } + } + } + sfree(sportdesc); + sfree(dportdesc); + } +} + static void ssh1_smsg_stdout_stderr_data(Ssh ssh, struct Packet *pktin) { char *string; @@ -3606,7 +4129,7 @@ static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin) /* Remote side is trying to open a channel to talk to a * forwarded port. Give them back a local channel number. */ struct ssh_channel *c; - struct ssh_rportfwd pf; + struct ssh_rportfwd pf, *pfp; int remoteid; int hostsize, port; char *host, buf[1024]; @@ -3623,8 +4146,9 @@ static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin) memcpy(pf.dhost, host, hostsize); pf.dhost[hostsize] = '\0'; pf.dport = port; + pfp = find234(ssh->rportfwds, &pf, NULL); - if (find234(ssh->rportfwds, &pf, NULL) == NULL) { + if (pfp == NULL) { sprintf(buf, "Rejected remote port open request for %s:%d", pf.dhost, port); logevent(buf); @@ -3635,7 +4159,7 @@ static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin) pf.dhost, port); logevent(buf); e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port, - c, &ssh->cfg); + c, &ssh->cfg, pfp->pfrec->addressfamily); if (e != NULL) { char buf[256]; sprintf(buf, "Port open failed: %s", e); @@ -3746,7 +4270,7 @@ static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin) /* Data sent down one of our channels. */ int i = ssh_pkt_getuint32(pktin); char *p; - int len; + unsigned int len; struct ssh_channel *c; ssh_pkt_getstring(pktin, &p, &len); @@ -3765,7 +4289,7 @@ static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin) /* Data for an agent message. Buffer it. */ while (len > 0) { if (c->u.a.lensofar < 4) { - int l = min(4 - c->u.a.lensofar, len); + unsigned int l = min(4 - c->u.a.lensofar, len); memcpy(c->u.a.msglen + c->u.a.lensofar, p, l); p += l; @@ -3780,7 +4304,7 @@ static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin) memcpy(c->u.a.message, c->u.a.msglen, 4); } if (c->u.a.lensofar >= 4 && len > 0) { - int l = + unsigned int l = min(c->u.a.totallen - c->u.a.lensofar, len); memcpy(c->u.a.message + c->u.a.lensofar, p, @@ -3826,6 +4350,7 @@ static void ssh1_smsg_exit_status(Ssh ssh, struct Packet *pktin) * encrypted packet, we close the session once * we've sent EXIT_CONFIRMATION. */ + ssh->close_expected = TRUE; ssh_closing((Plug)ssh, NULL, 0, 0); } @@ -3898,164 +4423,8 @@ static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen, } } - { - char type; - int n; - int sport,dport,sserv,dserv; - char sports[256], dports[256], saddr[256], host[256]; - - ssh->rportfwds = newtree234(ssh_rportcmp_ssh1); - /* Add port forwardings. */ - ssh->portfwd_strptr = ssh->cfg.portfwd; - while (*ssh->portfwd_strptr) { - type = *ssh->portfwd_strptr++; - saddr[0] = '\0'; - n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') { - if (*ssh->portfwd_strptr == ':') { - /* - * We've seen a colon in the middle of the - * source port number. This means that - * everything we've seen until now is the - * source _address_, so we'll move it into - * saddr and start sports from the beginning - * again. - */ - ssh->portfwd_strptr++; - sports[n] = '\0'; - strcpy(saddr, sports); - n = 0; - } - if (n < 255) sports[n++] = *ssh->portfwd_strptr++; - } - sports[n] = 0; - if (type != 'D') { - if (*ssh->portfwd_strptr == '\t') - ssh->portfwd_strptr++; - n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') { - if (n < 255) host[n++] = *ssh->portfwd_strptr++; - } - host[n] = 0; - if (*ssh->portfwd_strptr == ':') - ssh->portfwd_strptr++; - n = 0; - while (*ssh->portfwd_strptr) { - if (n < 255) dports[n++] = *ssh->portfwd_strptr++; - } - dports[n] = 0; - ssh->portfwd_strptr++; - dport = atoi(dports); - dserv = 0; - if (dport == 0) { - dserv = 1; - dport = net_service_lookup(dports); - if (!dport) { - logeventf(ssh, "Service lookup failed for" - " destination port \"%s\"", dports); - } - } - } else { - while (*ssh->portfwd_strptr) ssh->portfwd_strptr++; - dport = dserv = -1; - ssh->portfwd_strptr++; /* eat the NUL and move to next one */ - } - sport = atoi(sports); - sserv = 0; - if (sport == 0) { - sserv = 1; - sport = net_service_lookup(sports); - if (!sport) { - logeventf(ssh, "Service lookup failed for source" - " port \"%s\"", sports); - } - } - if (sport && dport) { - /* Set up a description of the source port. */ - static char *sportdesc; - sportdesc = dupprintf("%.*s%.*s%.*s%.*s%d%.*s", - (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL, - (int)(*saddr?1:0), ":", - (int)(sserv ? strlen(sports) : 0), sports, - sserv, "(", sport, sserv, ")"); - if (type == 'L') { - /* Verbose description of the destination port */ - char *dportdesc = dupprintf("%s:%.*s%.*s%d%.*s", - host, - (int)(dserv ? strlen(dports) : 0), dports, - dserv, "(", dport, dserv, ")"); - const char *err = pfd_addforward(host, dport, - *saddr ? saddr : NULL, - sport, ssh, &ssh->cfg); - if (err) { - logeventf(ssh, "Local port %s forward to %s" - " failed: %s", sportdesc, dportdesc, err); - } else { - logeventf(ssh, "Local port %s forwarding to %s", - sportdesc, dportdesc); - } - sfree(dportdesc); - } else if (type == 'D') { - const char *err = pfd_addforward(NULL, -1, - *saddr ? saddr : NULL, - sport, ssh, &ssh->cfg); - if (err) { - logeventf(ssh, "Local port %s SOCKS dynamic forward" - " setup failed: %s", sportdesc, err); - } else { - logeventf(ssh, "Local port %s doing SOCKS" - " dynamic forwarding", sportdesc); - } - } else { - struct ssh_rportfwd *pf; - pf = snew(struct ssh_rportfwd); - strcpy(pf->dhost, host); - pf->dport = dport; - if (*saddr) { - logeventf(ssh, - "SSH1 cannot handle source address spec \"%s:%d\"; ignoring", - saddr, sport); - } - if (add234(ssh->rportfwds, pf) != pf) { - logeventf(ssh, - "Duplicate remote port forwarding to %s:%d", - host, dport); - sfree(pf); - } else { - logeventf(ssh, "Requesting remote port %.*s%.*s%d%.*s" - " forward to %s:%.*s%.*s%d%.*s", - (int)(sserv ? strlen(sports) : 0), sports, - sserv, "(", sport, sserv, ")", - host, - (int)(dserv ? strlen(dports) : 0), dports, - dserv, "(", dport, dserv, ")"); - send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST, - PKT_INT, sport, - PKT_STR, host, - PKT_INT, dport, - PKT_END); - do { - crReturnV; - } while (!pktin); - if (pktin->type != SSH1_SMSG_SUCCESS - && pktin->type != SSH1_SMSG_FAILURE) { - bombout(("Protocol confusion")); - crStopV; - } else if (pktin->type == SSH1_SMSG_FAILURE) { - c_write_str(ssh, "Server refused port" - " forwarding\r\n"); - logevent("Server refused this port forwarding"); - } else { - logevent("Remote port forwarding enabled"); - ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = - ssh1_msg_port_open; - } - } - } - sfree(sportdesc); - } - } - } + ssh_setup_portfwd(ssh, &ssh->cfg); + ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = ssh1_msg_port_open; if (!ssh->cfg.nopty) { /* Unpick the terminal-speed string. */ @@ -4320,10 +4689,12 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int hostkeylen, siglen; void *hkey; /* actual host key */ unsigned char exchange_hash[20]; + int n_preferred_kex; + const struct ssh_kex *preferred_kex[KEX_MAX]; int n_preferred_ciphers; const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX]; const struct ssh_compress *preferred_comp; - int first_kex; + int got_session_id, activated_authconn; struct Packet *pktout; }; crState(do_ssh2_transport_state); @@ -4334,10 +4705,49 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, s->csmac_tobe = s->scmac_tobe = NULL; s->cscomp_tobe = s->sccomp_tobe = NULL; - s->first_kex = 1; + s->got_session_id = s->activated_authconn = FALSE; + + /* + * Be prepared to work around the buggy MAC problem. + */ + if (ssh->remote_bugs & BUG_SSH2_HMAC) + s->maclist = buggymacs, s->nmacs = lenof(buggymacs); + else + s->maclist = macs, s->nmacs = lenof(macs); + begin_key_exchange: + ssh->pkt_ctx &= ~SSH2_PKTCTX_KEX_MASK; { - int i; + int i, j, commalist_started; + + /* + * Set up the preferred key exchange. (NULL => warn below here) + */ + s->n_preferred_kex = 0; + for (i = 0; i < KEX_MAX; i++) { + switch (ssh->cfg.ssh_kexlist[i]) { + case KEX_DHGEX: + s->preferred_kex[s->n_preferred_kex++] = + &ssh_diffiehellman_gex; + break; + case KEX_DHGROUP14: + s->preferred_kex[s->n_preferred_kex++] = + &ssh_diffiehellman_group14; + break; + case KEX_DHGROUP1: + s->preferred_kex[s->n_preferred_kex++] = + &ssh_diffiehellman_group1; + break; + case CIPHER_WARN: + /* Flag for later. Don't bother if it's the last in + * the list. */ + if (i < KEX_MAX - 1) { + s->preferred_kex[s->n_preferred_kex++] = NULL; + } + break; + } + } + /* * Set up the preferred ciphers. (NULL => warn below here) */ @@ -4367,27 +4777,14 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, break; } } - } - - /* - * Set up preferred compression. - */ - if (ssh->cfg.compression) - s->preferred_comp = &ssh_zlib; - else - s->preferred_comp = &ssh_comp_none; - /* - * Be prepared to work around the buggy MAC problem. - */ - if (ssh->remote_bugs & BUG_SSH2_HMAC) - s->maclist = buggymacs, s->nmacs = lenof(buggymacs); - else - s->maclist = macs, s->nmacs = lenof(macs); - - begin_key_exchange: - { - int i, j, cipherstr_started; + /* + * Set up preferred compression. + */ + if (ssh->cfg.compression) + s->preferred_comp = &ssh_zlib; + else + s->preferred_comp = &ssh_comp_none; /* * Enable queueing of outgoing auth- or connection-layer @@ -4408,13 +4805,14 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_addbyte(s->pktout, (unsigned char) random_byte()); /* List key exchange algorithms. */ ssh2_pkt_addstring_start(s->pktout); - for (i = 0; i < lenof(kex_algs); i++) { - if (kex_algs[i] == &ssh_diffiehellman_gex && - (ssh->remote_bugs & BUG_SSH2_DH_GEX)) - continue; - ssh2_pkt_addstring_str(s->pktout, kex_algs[i]->name); - if (i < lenof(kex_algs) - 1) + commalist_started = 0; + for (i = 0; i < s->n_preferred_kex; i++) { + const struct ssh_kex *k = s->preferred_kex[i]; + if (!k) continue; /* warning flag */ + if (commalist_started) ssh2_pkt_addstring_str(s->pktout, ","); + ssh2_pkt_addstring_str(s->pktout, s->preferred_kex[i]->name); + commalist_started = 1; } /* List server host key algorithms. */ ssh2_pkt_addstring_start(s->pktout); @@ -4425,28 +4823,28 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, } /* List client->server encryption algorithms. */ ssh2_pkt_addstring_start(s->pktout); - cipherstr_started = 0; + commalist_started = 0; for (i = 0; i < s->n_preferred_ciphers; i++) { const struct ssh2_ciphers *c = s->preferred_ciphers[i]; if (!c) continue; /* warning flag */ for (j = 0; j < c->nciphers; j++) { - if (cipherstr_started) + if (commalist_started) ssh2_pkt_addstring_str(s->pktout, ","); ssh2_pkt_addstring_str(s->pktout, c->list[j]->name); - cipherstr_started = 1; + commalist_started = 1; } } /* List server->client encryption algorithms. */ ssh2_pkt_addstring_start(s->pktout); - cipherstr_started = 0; + commalist_started = 0; for (i = 0; i < s->n_preferred_ciphers; i++) { const struct ssh2_ciphers *c = s->preferred_ciphers[i]; if (!c) continue; /* warning flag */ for (j = 0; j < c->nciphers; j++) { - if (cipherstr_started) + if (commalist_started) ssh2_pkt_addstring_str(s->pktout, ","); ssh2_pkt_addstring_str(s->pktout, c->list[j]->name); - cipherstr_started = 1; + commalist_started = 1; } } /* List client->server MAC algorithms. */ @@ -4527,15 +4925,29 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, s->sccomp_tobe = NULL; pktin->savedpos += 16; /* skip garbage cookie */ ssh_pkt_getstring(pktin, &str, &len); /* key exchange algorithms */ - for (i = 0; i < lenof(kex_algs); i++) { - if (kex_algs[i] == &ssh_diffiehellman_gex && - (ssh->remote_bugs & BUG_SSH2_DH_GEX)) - continue; - if (in_commasep_string(kex_algs[i]->name, str, len)) { - ssh->kex = kex_algs[i]; + s->warn = 0; + for (i = 0; i < s->n_preferred_kex; i++) { + const struct ssh_kex *k = s->preferred_kex[i]; + if (!k) { + s->warn = 1; + } else if (in_commasep_string(k->name, str, len)) { + ssh->kex = k; + } + if (ssh->kex) { + if (s->warn) { + sk_set_frozen(ssh->s, 1); + askalg(ssh->frontend, "key-exchange algorithm", + ssh->kex->name); + sk_set_frozen(ssh->s, 0); + } break; } } + if (!ssh->kex) { + bombout(("Couldn't agree a key exchange algorithm (available: %s)", + str ? str : "(null)")); + crStop(0); + } ssh_pkt_getstring(pktin, &str, &len); /* host key algorithms */ for (i = 0; i < lenof(hostkey_algs); i++) { if (in_commasep_string(hostkey_algs[i]->name, str, len)) { @@ -4558,8 +4970,12 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, } } if (s->cscipher_tobe) { - if (s->warn) - askcipher(ssh->frontend, s->cscipher_tobe->name, 1); + if (s->warn) { + sk_set_frozen(ssh->s, 1); + askalg(ssh->frontend, "client-to-server cipher", + s->cscipher_tobe->name); + sk_set_frozen(ssh->s, 0); + } break; } } @@ -4584,8 +5000,12 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, } } if (s->sccipher_tobe) { - if (s->warn) - askcipher(ssh->frontend, s->sccipher_tobe->name, 2); + if (s->warn) { + sk_set_frozen(ssh->s, 1); + askalg(ssh->frontend, "server-to-client cipher", + s->sccipher_tobe->name); + sk_set_frozen(ssh->s, 0); + } break; } } @@ -4650,7 +5070,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, * If we're doing Diffie-Hellman group exchange, start by * requesting a group. */ - if (ssh->kex == &ssh_diffiehellman_gex) { + if (!ssh->kex->pdata) { logevent("Doing Diffie-Hellman group exchange"); ssh->pkt_ctx |= SSH2_PKTCTX_DHGEX; /* @@ -4673,14 +5093,16 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, bombout(("unable to read mp-ints from incoming group packet")); crStop(0); } - ssh->kex_ctx = dh_setup_group(s->p, s->g); + ssh->kex_ctx = dh_setup_gex(s->p, s->g); s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT; s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY; } else { - ssh->pkt_ctx |= SSH2_PKTCTX_DHGROUP1; - ssh->kex_ctx = dh_setup_group1(); + ssh->pkt_ctx |= SSH2_PKTCTX_DHGROUP; + ssh->kex_ctx = dh_setup_group(ssh->kex); s->kex_init_value = SSH2_MSG_KEXDH_INIT; s->kex_reply_value = SSH2_MSG_KEXDH_REPLY; + logeventf(ssh, "Using Diffie-Hellman with standard group \"%s\"", + ssh->kex->groupname); } logevent("Doing Diffie-Hellman key exchange"); @@ -4740,10 +5162,12 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, */ s->keystr = ssh->hostkey->fmtkey(s->hkey); s->fingerprint = ssh->hostkey->fingerprint(s->hkey); + sk_set_frozen(ssh->s, 1); verify_ssh_host_key(ssh->frontend, ssh->savedhost, ssh->savedport, ssh->hostkey->keytype, s->keystr, s->fingerprint); - if (s->first_kex) { /* don't bother logging this in rekeys */ + sk_set_frozen(ssh->s, 0); + if (!s->got_session_id) { /* don't bother logging this in rekeys */ logevent("Host key fingerprint is:"); logevent(s->fingerprint); } @@ -4756,9 +5180,11 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, * the session id, used in session key construction and * authentication. */ - if (s->first_kex) + if (!s->got_session_id) { memcpy(ssh->v2_session_id, s->exchange_hash, sizeof(s->exchange_hash)); + s->got_session_id = TRUE; + } /* * Send SSH2_MSG_NEWKEYS. @@ -4876,10 +5302,24 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, } /* - * Key exchange is over. Schedule a timer for our next rekey. + * Key exchange is over. Loop straight back round if we have a + * deferred rekey reason. + */ + if (ssh->deferred_rekey_reason) { + logevent(ssh->deferred_rekey_reason); + pktin = NULL; + ssh->deferred_rekey_reason = NULL; + goto begin_key_exchange; + } + + /* + * Otherwise, schedule a timer for our next rekey. */ ssh->kex_in_progress = FALSE; - ssh->next_rekey = schedule_timer(REKEY_TIMEOUT, ssh2_timer, ssh); + ssh->last_rekey = GETTICKCOUNT(); + if (ssh->cfg.ssh_rekey_time != 0) + ssh->next_rekey = schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC, + ssh2_timer, ssh); /* * If this is the first key exchange phase, we must pass the @@ -4889,10 +5329,10 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because * it would only confuse the layer above. */ - if (!s->first_kex) { + if (s->activated_authconn) { crReturn(1); } - s->first_kex = 0; + s->activated_authconn = TRUE; /* * Now we're encrypting. Begin returning 1 to the protocol main @@ -4907,12 +5347,34 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, */ while (!((pktin && pktin->type == SSH2_MSG_KEXINIT) || (!pktin && inlen == -1))) { + wait_for_rekey: crReturn(1); } if (pktin) { logevent("Server initiated key re-exchange"); } else { - logevent((char *)in); + /* + * Special case: if the server bug is set that doesn't + * allow rekeying, we give a different log message and + * continue waiting. (If such a server _initiates_ a rekey, + * we process it anyway!) + */ + if ((ssh->remote_bugs & BUG_SSH2_REKEY)) { + logeventf(ssh, "Server bug prevents key re-exchange (%s)", + (char *)in); + /* Reset the counters, so that at least this message doesn't + * hit the event log _too_ often. */ + ssh->outgoing_data_size = 0; + ssh->incoming_data_size = 0; + if (ssh->cfg.ssh_rekey_time != 0) { + ssh->next_rekey = + schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC, + ssh2_timer, ssh); + } + goto wait_for_rekey; /* this is utterly horrid */ + } else { + logeventf(ssh, "Initiating key re-exchange (%s)", (char *)in); + } } goto begin_key_exchange; @@ -5000,7 +5462,7 @@ static void ssh2_msg_channel_window_adjust(Ssh ssh, struct Packet *pktin) static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin) { char *data; - int length; + unsigned int length; unsigned i = ssh_pkt_getuint32(pktin); struct ssh_channel *c; c = find234(ssh->channels, &i, ssh_channelfind); @@ -5029,7 +5491,7 @@ static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin) case CHAN_AGENT: while (length > 0) { if (c->u.a.lensofar < 4) { - int l = min(4 - c->u.a.lensofar, length); + unsigned int l = min(4 - c->u.a.lensofar, length); memcpy(c->u.a.msglen + c->u.a.lensofar, data, l); data += l; @@ -5044,7 +5506,7 @@ static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin) memcpy(c->u.a.message, c->u.a.msglen, 4); } if (c->u.a.lensofar >= 4 && length > 0) { - int l = + unsigned int l = min(c->u.a.totallen - c->u.a.lensofar, length); memcpy(c->u.a.message + c->u.a.lensofar, @@ -5167,6 +5629,7 @@ static void ssh2_msg_channel_close(Ssh ssh, struct Packet *pktin) ssh2_pkt_addstring(s->pktout, "en"); /* language tag */ ssh2_pkt_send_noqueue(ssh, s->pktout); #endif + ssh->close_expected = TRUE; ssh_closing((Plug)ssh, NULL, 0, 0); } } @@ -5267,6 +5730,7 @@ static void ssh2_msg_channel_request(Ssh ssh, struct Packet *pktin) ssh2_pkt_addstring(pktout, "en"); /* language tag */ ssh2_pkt_send_noqueue(ssh, pktout); connection_fatal(ssh->frontend, "%s", buf); + ssh->close_expected = TRUE; ssh_closing((Plug)ssh, NULL, 0, 0); return; } @@ -5464,7 +5928,8 @@ static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin) const char *e = pfd_newconnect(&c->u.pfd.s, realpf->dhost, realpf->dport, c, - &ssh->cfg); + &ssh->cfg, + realpf->pfrec->addressfamily); logeventf(ssh, "Attempting to forward remote port to " "%s:%d", realpf->dhost, realpf->dport); if (e != NULL) { @@ -5509,7 +5974,7 @@ static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin) ssh2_pkt_adduint32(pktout, c->remoteid); ssh2_pkt_adduint32(pktout, c->localid); ssh2_pkt_adduint32(pktout, c->v.v2.locwindow); - ssh2_pkt_adduint32(pktout, 0x4000UL); /* our max pkt size */ + ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */ ssh2_pkt_send(ssh, pktout); } } @@ -5536,8 +6001,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET } type; int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter; - int tried_pubkey_config, tried_agent, tried_keyb_inter; - int kbd_inter_running; + int tried_pubkey_config, tried_agent; + int kbd_inter_running, kbd_inter_refused; int we_are_in; int num_prompts, curr_prompt, echo; char username[100]; @@ -5619,6 +6084,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, * Terminate. */ logevent("No username provided. Abandoning session."); + ssh->close_expected = TRUE; ssh_closing((Plug)ssh, NULL, 0, 0); crStopV; } @@ -5666,8 +6132,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, s->tried_pubkey_config = FALSE; s->tried_agent = FALSE; - s->tried_keyb_inter = FALSE; s->kbd_inter_running = FALSE; + s->kbd_inter_refused = FALSE; /* Load the pub half of ssh->cfg.keyfile so we notice if it's in Pageant */ if (!filename_is_null(ssh->cfg.keyfile)) { int keytype; @@ -5734,6 +6200,10 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, */ if (!s->gotit) s->curr_prompt = 0; + } else if (pktin->type == SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ) { + /* FIXME: perhaps we should support this? */ + bombout(("PASSWD_CHANGEREQ not yet supported")); + crStopV; } else if (pktin->type != SSH2_MSG_USERAUTH_FAILURE) { bombout(("Strange packet received during authentication: type %d", pktin->type)); @@ -6058,10 +6528,10 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, } } - if (!s->method && s->can_keyb_inter && !s->tried_keyb_inter) { + if (!s->method && s->can_keyb_inter && !s->kbd_inter_refused && + !s->kbd_inter_running) { s->method = AUTH_KEYBOARD_INTERACTIVE; s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE; - s->tried_keyb_inter = TRUE; ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK; ssh->pkt_ctx |= SSH2_PKTCTX_KBDINTER; @@ -6080,6 +6550,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, s->gotit = TRUE; logevent("Keyboard-interactive authentication refused"); s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET; + s->kbd_inter_refused = TRUE; /* don't try it again */ continue; } @@ -6090,7 +6561,6 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, if (s->kbd_inter_running) { s->method = AUTH_KEYBOARD_INTERACTIVE; s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE; - s->tried_keyb_inter = TRUE; ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK; ssh->pkt_ctx |= SSH2_PKTCTX_KBDINTER; @@ -6176,6 +6646,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, logevent("Unable to authenticate"); connection_fatal(ssh->frontend, "Unable to authenticate"); + ssh->close_expected = TRUE; ssh_closing((Plug)ssh, NULL, 0, 0); crStopV; } @@ -6374,6 +6845,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, " methods available"); ssh2_pkt_addstring(s->pktout, "en"); /* language tag */ ssh2_pkt_send_noqueue(ssh, s->pktout); + ssh->close_expected = TRUE; ssh_closing((Plug)ssh, NULL, 0, 0); crStopV; } @@ -6409,7 +6881,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid); ssh->mainchan->v.v2.locwindow = OUR_V2_WINSIZE; ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */ - ssh2_pkt_adduint32(s->pktout, 0x4000UL); /* our max pkt size */ + ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */ ssh2_pkt_send(ssh, s->pktout); crWaitUntilV(pktin); if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) { @@ -6488,163 +6960,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, /* * Enable port forwardings. */ - { - char type; - int n; - int sport,dport,sserv,dserv; - char sports[256], dports[256], saddr[256], host[256]; - - ssh->rportfwds = newtree234(ssh_rportcmp_ssh2); - /* Add port forwardings. */ - ssh->portfwd_strptr = ssh->cfg.portfwd; - while (*ssh->portfwd_strptr) { - type = *ssh->portfwd_strptr++; - saddr[0] = '\0'; - n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') { - if (*ssh->portfwd_strptr == ':') { - /* - * We've seen a colon in the middle of the - * source port number. This means that - * everything we've seen until now is the - * source _address_, so we'll move it into - * saddr and start sports from the beginning - * again. - */ - ssh->portfwd_strptr++; - sports[n] = '\0'; - strcpy(saddr, sports); - n = 0; - } - if (n < 255) sports[n++] = *ssh->portfwd_strptr++; - } - sports[n] = 0; - if (type != 'D') { - if (*ssh->portfwd_strptr == '\t') - ssh->portfwd_strptr++; - n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') { - if (n < 255) host[n++] = *ssh->portfwd_strptr++; - } - host[n] = 0; - if (*ssh->portfwd_strptr == ':') - ssh->portfwd_strptr++; - n = 0; - while (*ssh->portfwd_strptr) { - if (n < 255) dports[n++] = *ssh->portfwd_strptr++; - } - dports[n] = 0; - ssh->portfwd_strptr++; - dport = atoi(dports); - dserv = 0; - if (dport == 0) { - dserv = 1; - dport = net_service_lookup(dports); - if (!dport) { - logeventf(ssh, "Service lookup failed for destination" - " port \"%s\"", dports); - } - } - } else { - while (*ssh->portfwd_strptr) ssh->portfwd_strptr++; - dport = dserv = -1; - ssh->portfwd_strptr++; /* eat the NUL and move to next one */ - } - sport = atoi(sports); - sserv = 0; - if (sport == 0) { - sserv = 1; - sport = net_service_lookup(sports); - if (!sport) { - logeventf(ssh, "Service lookup failed for source" - " port \"%s\"", sports); - } - } - if (sport && dport) { - /* Set up a description of the source port. */ - static char *sportdesc; - sportdesc = dupprintf("%.*s%.*s%.*s%.*s%d%.*s", - (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL, - (int)(*saddr?1:0), ":", - (int)(sserv ? strlen(sports) : 0), sports, - sserv, "(", sport, sserv, ")"); - if (type == 'L') { - /* Verbose description of the destination port */ - char *dportdesc = dupprintf("%s:%.*s%.*s%d%.*s", - host, - (int)(dserv ? strlen(dports) : 0), dports, - dserv, "(", dport, dserv, ")"); - const char *err = pfd_addforward(host, dport, - *saddr ? saddr : NULL, - sport, ssh, &ssh->cfg); - if (err) { - logeventf(ssh, "Local port %s forward to %s" - " failed: %s", sportdesc, dportdesc, err); - } else { - logeventf(ssh, "Local port %s forwarding to %s", - sportdesc, dportdesc); - } - sfree(dportdesc); - } else if (type == 'D') { - const char *err = pfd_addforward(NULL, -1, - *saddr ? saddr : NULL, - sport, ssh, &ssh->cfg); - if (err) { - logeventf(ssh, "Local port %s SOCKS dynamic forward" - " setup failed: %s", sportdesc, err); - } else { - logeventf(ssh, "Local port %s doing SOCKS" - " dynamic forwarding", sportdesc); - } - } else { - struct ssh_rportfwd *pf; - pf = snew(struct ssh_rportfwd); - strcpy(pf->dhost, host); - pf->dport = dport; - pf->sport = sport; - if (add234(ssh->rportfwds, pf) != pf) { - logeventf(ssh, "Duplicate remote port forwarding" - " to %s:%d", host, dport); - sfree(pf); - } else { - logeventf(ssh, "Requesting remote port %s" - " forward to %s:%.*s%.*s%d%.*s", - sportdesc, - host, - (int)(dserv ? strlen(dports) : 0), dports, - dserv, "(", dport, dserv, ")"); - s->pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST); - ssh2_pkt_addstring(s->pktout, "tcpip-forward"); - ssh2_pkt_addbool(s->pktout, 1);/* want reply */ - if (*saddr) { - ssh2_pkt_addstring(s->pktout, saddr); - } else if (ssh->cfg.rport_acceptall) { - ssh2_pkt_addstring(s->pktout, "0.0.0.0"); - } else { - ssh2_pkt_addstring(s->pktout, "127.0.0.1"); - } - ssh2_pkt_adduint32(s->pktout, sport); - ssh2_pkt_send(ssh, s->pktout); - - crWaitUntilV(pktin); - - if (pktin->type != SSH2_MSG_REQUEST_SUCCESS) { - if (pktin->type != SSH2_MSG_REQUEST_FAILURE) { - bombout(("Unexpected response to port " - "forwarding request: packet type %d", - pktin->type)); - crStopV; - } - logevent("Server refused this port forwarding"); - } else { - logevent("Remote port forwarding enabled"); - } - } - } - sfree(sportdesc); - } - } - } + ssh_setup_portfwd(ssh, &ssh->cfg); /* * Potentially enable agent forwarding. @@ -7035,10 +7351,9 @@ static void ssh2_timer(void *ctx, long now) { Ssh ssh = (Ssh)ctx; - if (!ssh->kex_in_progress && + if (!ssh->kex_in_progress && ssh->cfg.ssh_rekey_time != 0 && now - ssh->next_rekey >= 0) { - do_ssh2_transport(ssh, "Initiating key re-exchange (timeout)", - -1, NULL); + do_ssh2_transport(ssh, "timeout", -1, NULL); } } @@ -7051,9 +7366,9 @@ static void ssh2_protocol(Ssh ssh, unsigned char *in, int inlen, if (pktin) { ssh->incoming_data_size += pktin->encrypted_len; if (!ssh->kex_in_progress && - ssh->incoming_data_size > MAX_DATA_BEFORE_REKEY) - do_ssh2_transport(ssh, "Initiating key re-exchange " - "(too much data received)", -1, NULL); + ssh->max_data_size != 0 && + ssh->incoming_data_size > ssh->max_data_size) + do_ssh2_transport(ssh, "too much data received", -1, NULL); } if (pktin && ssh->packet_dispatch[pktin->type]) { @@ -7112,6 +7427,7 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle, ssh->kex_ctx = NULL; ssh->hostkey = NULL; ssh->exitcode = -1; + ssh->close_expected = FALSE; ssh->state = SSH_STATE_PREPACKET; ssh->size_needed = FALSE; ssh->eof_needed = FALSE; @@ -7143,6 +7459,8 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle, ssh->queue = NULL; ssh->queuelen = ssh->queuesize = 0; ssh->queueing = FALSE; + ssh->qhead = ssh->qtail = NULL; + ssh->deferred_rekey_reason = NULL; *backend_handle = ssh; @@ -7157,6 +7475,7 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle, ssh->channels = NULL; ssh->rportfwds = NULL; + ssh->portfwds = NULL; ssh->send_ok = 0; ssh->editing = 0; @@ -7173,6 +7492,7 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle, ssh->incoming_data_size = ssh->outgoing_data_size = ssh->deferred_data_size = 0L; + ssh->max_data_size = parse_blocksize(ssh->cfg.ssh_rekey_data); ssh->kex_in_progress = FALSE; p = connect_to_host(ssh, host, port, realhost, nodelay, keepalive); @@ -7220,6 +7540,13 @@ static void ssh_free(void *handle) ssh_free_packet(ssh->queue[ssh->queuelen]); sfree(ssh->queue); + while (ssh->qhead) { + struct queued_handler *qh = ssh->qhead; + ssh->qhead = qh->next; + sfree(ssh->qhead); + } + ssh->qhead = ssh->qtail = NULL; + if (ssh->channels) { while ((c = delpos234(ssh->channels, 0)) != NULL) { switch (c->type) { @@ -7256,29 +7583,69 @@ static void ssh_free(void *handle) ssh->crcda_ctx = NULL; } if (ssh->s) - ssh_do_close(ssh); + ssh_do_close(ssh, TRUE); expire_timer_context(ssh); - sfree(ssh); if (ssh->pinger) pinger_free(ssh->pinger); + sfree(ssh); random_unref(); } /* * Reconfigure the SSH backend. - * - * Currently, this function does nothing very useful. In future, - * however, we could do some handy things with it. For example, we - * could make the port forwarding configurer active in the Change - * Settings box, and this routine could close down existing - * forwardings and open up new ones in response to changes. */ static void ssh_reconfig(void *handle, Config *cfg) { Ssh ssh = (Ssh) handle; + char *rekeying = NULL, rekey_mandatory = FALSE; + unsigned long old_max_data_size; + pinger_reconfig(ssh->pinger, &ssh->cfg, cfg); + ssh_setup_portfwd(ssh, cfg); + + if (ssh->cfg.ssh_rekey_time != cfg->ssh_rekey_time && + cfg->ssh_rekey_time != 0) { + long new_next = ssh->last_rekey + cfg->ssh_rekey_time*60*TICKSPERSEC; + long now = GETTICKCOUNT(); + + if (new_next - now < 0) { + rekeying = "timeout shortened"; + } else { + ssh->next_rekey = schedule_timer(new_next - now, ssh2_timer, ssh); + } + } + + old_max_data_size = ssh->max_data_size; + ssh->max_data_size = parse_blocksize(cfg->ssh_rekey_data); + if (old_max_data_size != ssh->max_data_size && + ssh->max_data_size != 0) { + if (ssh->outgoing_data_size > ssh->max_data_size || + ssh->incoming_data_size > ssh->max_data_size) + rekeying = "data limit lowered"; + } + + if (ssh->cfg.compression != cfg->compression) { + rekeying = "compression setting changed"; + rekey_mandatory = TRUE; + } + + if (ssh->cfg.ssh2_des_cbc != cfg->ssh2_des_cbc || + memcmp(ssh->cfg.ssh_cipherlist, cfg->ssh_cipherlist, + sizeof(ssh->cfg.ssh_cipherlist))) { + rekeying = "cipher settings changed"; + rekey_mandatory = TRUE; + } + ssh->cfg = *cfg; /* STRUCTURE COPY */ + + if (rekeying) { + if (!ssh->kex_in_progress) { + do_ssh2_transport(ssh, rekeying, -1, NULL); + } else if (rekey_mandatory) { + ssh->deferred_rekey_reason = rekeying; + } + } } /* @@ -7376,14 +7743,17 @@ static void ssh_size(void *handle, int width, int height) */ static const struct telnet_special *ssh_get_specials(void *handle) { - static const struct telnet_special ignore_special[] = { + static const struct telnet_special ssh1_ignore_special[] = { + {"IGNORE message", TS_NOP} + }; + static const struct telnet_special ssh2_transport_specials[] = { {"IGNORE message", TS_NOP}, {"Repeat key exchange", TS_REKEY}, }; static const struct telnet_special ssh2_session_specials[] = { {NULL, TS_SEP}, {"Break", TS_BRK}, - /* These are the signal names defined by draft-ietf-secsh-connect-19. + /* These are the signal names defined by draft-ietf-secsh-connect-23. * They include all the ISO C signals, but are a subset of the POSIX * required signals. */ {"SIGINT (Interrupt)", TS_SIGINT}, @@ -7401,7 +7771,8 @@ static const struct telnet_special *ssh_get_specials(void *handle) static const struct telnet_special specials_end[] = { {NULL, TS_EXITMENU} }; - static struct telnet_special ssh_specials[lenof(ignore_special) + + /* XXX review this length for any changes: */ + static struct telnet_special ssh_specials[lenof(ssh2_transport_specials) + lenof(ssh2_session_specials) + lenof(specials_end)]; Ssh ssh = (Ssh) handle; @@ -7418,9 +7789,9 @@ static const struct telnet_special *ssh_get_specials(void *handle) * won't cope with it, since we wouldn't bother sending it if * asked anyway. */ if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE)) - ADD_SPECIALS(ignore_special); + ADD_SPECIALS(ssh1_ignore_special); } else if (ssh->version == 2) { - ADD_SPECIALS(ignore_special); + ADD_SPECIALS(ssh2_transport_specials); if (ssh->mainchan) ADD_SPECIALS(ssh2_session_specials); } /* else we're not ready yet */ @@ -7475,8 +7846,7 @@ static void ssh_special(void *handle, Telnet_Special code) } } else if (code == TS_REKEY) { if (!ssh->kex_in_progress && ssh->version == 2) { - do_ssh2_transport(ssh, "Initiating key re-exchange at" - " user request", -1, NULL); + do_ssh2_transport(ssh, "at user request", -1, NULL); } } else if (code == TS_BRK) { if (ssh->state == SSH_STATE_CLOSED @@ -7576,7 +7946,7 @@ void ssh_send_port_open(void *channel, char *hostname, int port, char *org) PKT_INT, c->localid, PKT_STR, hostname, PKT_INT, port, - //PKT_STR, , + /* PKT_STR, , */ PKT_END); } else { pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN); @@ -7584,7 +7954,7 @@ void ssh_send_port_open(void *channel, char *hostname, int port, char *org) ssh2_pkt_adduint32(pktout, c->localid); c->v.v2.locwindow = OUR_V2_WINSIZE; ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);/* our window size */ - ssh2_pkt_adduint32(pktout, 0x4000UL); /* our max pkt size */ + ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */ ssh2_pkt_addstring(pktout, hostname); ssh2_pkt_adduint32(pktout, port); /* @@ -7643,6 +8013,16 @@ static int ssh_return_exitcode(void *handle) } /* + * cfg_info for SSH is the currently running version of the + * protocol. (1 for 1; 2 for 2; 0 for not-decided-yet.) + */ +static int ssh_cfg_info(void *handle) +{ + Ssh ssh = (Ssh) handle; + return ssh->version; +} + +/* * Gross hack: pscp will try to start SFTP but fall back to scp1 if * that fails. This variable is the means by which scp.c can reach * into the SSH code and find out which one it got. @@ -7669,5 +8049,6 @@ Backend ssh_backend = { ssh_provide_ldisc, ssh_provide_logctx, ssh_unthrottle, + ssh_cfg_info, 22 };