s/public/private/ spotted by Walter Cleverly.

[sgt/putty] / ssh.c

diff --git a/ssh.c b/ssh.c
index 6fe865b..8b986ff 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -4632,14 +4632,23 @@ static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
        ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
                                       data, sizeof(data), ssh->cfg.x11_auth);
         x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display);
+       /*
+        * Note that while we blank the X authentication data here, we don't
+        * take any special action to blank the start of an X11 channel,
+        * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
+        * without having session blanking enabled is likely to leak your
+        * cookie into the log.
+        */
        if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) {
            send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
-                       PKT_STR, proto, PKT_STR, data,
+                       PKT_STR, proto,
+                       PKTT_PASSWORD, PKT_STR, data, PKTT_OTHER,
                        PKT_INT, x11_get_screen_number(ssh->cfg.x11_display),
                        PKT_END);
        } else {
            send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
-                       PKT_STR, proto, PKT_STR, data, PKT_END);
+                       PKT_STR, proto,
+                       PKTT_PASSWORD, PKT_STR, data, PKTT_OTHER, PKT_END);
        }
        do {
            crReturnV;
@@ -6419,6 +6428,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
                AUTH_TYPE_KEYBOARD_INTERACTIVE,
                AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
        } type;
+       int done_service_req;
        int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter;
        int tried_pubkey_config, tried_agent;
        int kbd_inter_running, kbd_inter_refused;
@@ -6446,16 +6456,33 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 
     crBegin(ssh->do_ssh2_authconn_crstate);
 
-    /*
-     * Request userauth protocol, and await a response to it.
-     */
-    s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
-    ssh2_pkt_addstring(s->pktout, "ssh-userauth");
-    ssh2_pkt_send(ssh, s->pktout);
-    crWaitUntilV(pktin);
-    if (pktin->type != SSH2_MSG_SERVICE_ACCEPT) {
-       bombout(("Server refused user authentication protocol"));
-       crStopV;
+    s->done_service_req = FALSE;
+    s->we_are_in = FALSE;
+    if (!ssh->cfg.ssh_no_userauth) {
+       /*
+        * Request userauth protocol, and await a response to it.
+        */
+       s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
+       ssh2_pkt_addstring(s->pktout, "ssh-userauth");
+       ssh2_pkt_send(ssh, s->pktout);
+       crWaitUntilV(pktin);
+       if (pktin->type == SSH2_MSG_SERVICE_ACCEPT)
+           s->done_service_req = TRUE;
+    }
+    if (!s->done_service_req) {
+       /*
+        * Request connection protocol directly, without authentication.
+        */
+       s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
+       ssh2_pkt_addstring(s->pktout, "ssh-connection");
+       ssh2_pkt_send(ssh, s->pktout);
+       crWaitUntilV(pktin);
+       if (pktin->type == SSH2_MSG_SERVICE_ACCEPT) {
+           s->we_are_in = TRUE; /* no auth required */
+       } else {
+           bombout(("Server refused service request"));
+           crStopV;
+       }
     }
 
     /*
@@ -6484,7 +6511,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
      */
     s->username[0] = '\0';
     s->got_username = FALSE;
-    do {
+    while (!s->we_are_in) {
        /*
         * Get a username.
         */
@@ -7225,12 +7252,10 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
                crStopV;
            }
        }
-    } while (!s->we_are_in);
+    }
 
     /*
-     * Now we're authenticated for the connection protocol. The
-     * connection protocol will automatically have started at this
-     * point; there's no need to send SERVICE_REQUEST.
+     * Now the connection protocol has started, one way or another.
      */
 
     ssh->channels = newtree234(ssh_channelcmp);
@@ -7314,6 +7339,13 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
        ssh2_pkt_addbool(s->pktout, 1);        /* want reply */
        ssh2_pkt_addbool(s->pktout, 0);        /* many connections */
        ssh2_pkt_addstring(s->pktout, proto);
+       /*
+        * Note that while we blank the X authentication data here, we don't
+        * take any special action to blank the start of an X11 channel,
+        * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
+        * without having session blanking enabled is likely to leak your
+        * cookie into the log.
+        */
        dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
        ssh2_pkt_addstring(s->pktout, data);
        end_log_omission(ssh, s->pktout);