X-Git-Url: https://git.distorted.org.uk/~mdw/sgt/putty/blobdiff_plain/93b581bd031b2270deb7f45440e61a1044fe94da..1dd353b59d3feeaef262801cde4a023eed3c983e:/ssh.c diff --git a/ssh.c b/ssh.c index d03de083..339b98ea 100644 --- a/ssh.c +++ b/ssh.c @@ -19,9 +19,21 @@ if ((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)) \ { fprintf(stderr, "%s\n", s); fflush(stderr); } } +/* logevent, only printf-formatted. */ +void logeventf(char *fmt, ...) +{ + va_list ap; + char stuff[200]; + + va_start(ap, fmt); + vsprintf(stuff, fmt, ap); + va_end(ap); + logevent(stuff); +} + #define bombout(msg) ( ssh_state = SSH_STATE_CLOSED, \ (s ? sk_close(s), s = NULL : 0), \ - connection_fatal msg ) + logeventf msg, connection_fatal msg ) #define SSH1_MSG_DISCONNECT 1 /* 0x1 */ #define SSH1_SMSG_PUBLIC_KEY 2 /* 0x2 */ @@ -169,6 +181,7 @@ static const char *const ssh2_disconnect_reasons[] = { #define BUG_SSH2_HMAC 2 #define BUG_NEEDS_SSH1_PLAIN_PASSWORD 4 #define BUG_CHOKES_ON_RSA 8 +#define BUG_SSH2_RSA_PADDING 16 static int ssh_pkt_ctx = 0; @@ -817,7 +830,7 @@ static int ssh1_rdpkt(unsigned char **data, int *datalen) msglen = sizeof(buf) - nowlen - 1; memcpy(buf + nowlen, pktin.body + 4, msglen); buf[nowlen + msglen] = '\0'; - logevent(buf); + /* logevent(buf); (this is now done within the bombout macro) */ bombout(("Server sent disconnect message:\n\"%s\"", buf+nowlen)); crReturn(0); } @@ -1555,6 +1568,75 @@ static Bignum ssh2_pkt_getmp(void) } /* + * Helper function to add an SSH2 signature blob to a packet. + * Expects to be shown the public key blob as well as the signature + * blob. Normally works just like ssh2_pkt_addstring, but will + * fiddle with the signature packet if necessary for + * BUG_SSH2_RSA_PADDING. + */ +static void ssh2_add_sigblob(void *pkblob_v, int pkblob_len, + void *sigblob_v, int sigblob_len) +{ + unsigned char *pkblob = (unsigned char *)pkblob_v; + unsigned char *sigblob = (unsigned char *)sigblob_v; + + /* dmemdump(pkblob, pkblob_len); */ + /* dmemdump(sigblob, sigblob_len); */ + + /* + * See if this is in fact an ssh-rsa signature and a buggy + * server; otherwise we can just do this the easy way. + */ + if ((ssh_remote_bugs & BUG_SSH2_RSA_PADDING) && + (GET_32BIT(pkblob) == 7 && !memcmp(pkblob+4, "ssh-rsa", 7))) { + int pos, len, siglen; + + /* + * Find the byte length of the modulus. + */ + + pos = 4+7; /* skip over "ssh-rsa" */ + pos += 4 + GET_32BIT(pkblob+pos); /* skip over exponent */ + len = GET_32BIT(pkblob+pos); /* find length of modulus */ + pos += 4; /* find modulus itself */ + while (len > 0 && pkblob[pos] == 0) + len--, pos++; + /* debug(("modulus length is %d\n", len)); */ + + /* + * Now find the signature integer. + */ + pos = 4+7; /* skip over "ssh-rsa" */ + siglen = GET_32BIT(sigblob+pos); + /* debug(("signature length is %d\n", siglen)); */ + + if (len != siglen) { + unsigned char newlen[4]; + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(sigblob, pos); + /* dmemdump(sigblob, pos); */ + pos += 4; /* point to start of actual sig */ + PUT_32BIT(newlen, len); + ssh2_pkt_addstring_data(newlen, 4); + /* dmemdump(newlen, 4); */ + newlen[0] = 0; + while (len-- > siglen) { + ssh2_pkt_addstring_data(newlen, 1); + /* dmemdump(newlen, 1); */ + } + ssh2_pkt_addstring_data(sigblob+pos, siglen); + /* dmemdump(sigblob+pos, siglen); */ + return; + } + + /* Otherwise fall through and do it the easy way. */ + } + + ssh2_pkt_addstring_start(); + ssh2_pkt_addstring_data(sigblob, sigblob_len); +} + +/* * Examine the remote side's version string and compare it against * a list of known buggy implementations. */ @@ -1610,6 +1692,15 @@ static void ssh_detect_bugs(char *vstring) ssh_remote_bugs |= BUG_SSH2_HMAC; logevent("We believe remote version has SSH2 HMAC bug"); } + + if ((!strncmp(imp, "OpenSSH_2.", 10) && imp[10]>='5' && imp[10]<='9') || + (!strncmp(imp, "OpenSSH_3.", 10) && imp[10]>='0' && imp[10]<='2')) { + /* + * These versions have the SSH2 RSA padding bug. + */ + ssh_remote_bugs |= BUG_SSH2_RSA_PADDING; + logevent("We believe remote version has SSH2 RSA padding bug"); + } } static int do_ssh_init(unsigned char c) @@ -1710,6 +1801,12 @@ static int do_ssh_init(unsigned char c) sprintf(vlog, "We claim version: %s", verstring); logevent(vlog); strcat(verstring, "\n"); + + if (cfg.sshprot == 3) { + bombout(("SSH protocol version 2 required by user but not provided by server")); + crReturn(0); + } + logevent("Using SSH protocol version 1"); sk_write(s, verstring, strlen(verstring)); ssh_protocol = ssh1_protocol; @@ -1779,6 +1876,7 @@ static int ssh_closing(Plug plug, char *error_msg, int error_code, } if (error_msg) { /* A socket error has occurred. */ + logevent(error_msg); connection_fatal(error_msg); } else { /* Otherwise, the remote side closed the connection normally. */ @@ -1872,7 +1970,7 @@ static char *connect_to_host(char *host, int port, char **realhost, int nodelay) sprintf(buf, "Connecting to %.100s port %d", addrbuf, port); logevent(buf); } - s = sk_new(addr, port, 0, 1, nodelay, &fn_table_ptr); + s = new_connection(addr, *realhost, port, 0, 1, nodelay, &fn_table_ptr); if ((err = sk_socket_error(s))) { s = NULL; return err; @@ -2417,8 +2515,22 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) } if (pwpkt_type == SSH1_CMSG_AUTH_RSA) { char *comment = NULL; + int type; + char msgbuf[256]; if (flags & FLAG_VERBOSE) c_write_str("Trying public key authentication.\r\n"); + sprintf(msgbuf, "Trying public key \"%.200s\"", cfg.keyfile); + logevent(msgbuf); + type = key_type(cfg.keyfile); + if (type != SSH_KEYTYPE_SSH1) { + sprintf(msgbuf, "Key is of wrong type (%s)", + key_type_to_str(type)); + logevent(msgbuf); + c_write_str(msgbuf); + c_write_str("\r\n"); + tried_publickey = 1; + continue; + } if (!rsakey_encrypted(cfg.keyfile, &comment)) { if (flags & FLAG_VERBOSE) c_write_str("No passphrase required.\r\n"); @@ -2443,6 +2555,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt) send_packet(SSH1_MSG_DISCONNECT, PKT_STR, "No more passwords available to try", PKT_END); + logevent("Unable to authenticate"); connection_fatal("Unable to authenticate"); ssh_state = SSH_STATE_CLOSED; crReturn(1); @@ -2705,7 +2818,7 @@ void sshfwd_close(struct ssh_channel *c) * on it now, and then when the server acks the channel * open, we can close it then. */ - if (c->remoteid != -1) { + if (((int)c->remoteid) != -1) { if (ssh_version == 1) { send_packet(SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid, PKT_END); @@ -2817,11 +2930,13 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) } { - char type, *e; + char type; + static char *e; int n; - int sport,dport; + int sport,dport,sserv,dserv; char sports[256], dports[256], host[256]; char buf[1024]; + struct servent *se; ssh_rportfwds = newtree234(ssh_rportcmp_ssh1); /* Add port forwardings. */ @@ -2846,12 +2961,43 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) dports[n] = 0; e++; dport = atoi(dports); + dserv = 0; + if (dport == 0) { + dserv = 1; + se = getservbyname(dports, NULL); + if (se != NULL) { + dport = ntohs(se->s_port); + } else { + sprintf(buf, + "Service lookup failed for destination port \"%s\"", + dports); + logevent(buf); + } + } sport = atoi(sports); + sserv = 0; + if (sport == 0) { + sserv = 1; + se = getservbyname(sports, NULL); + if (se != NULL) { + sport = ntohs(se->s_port); + } else { + sprintf(buf, + "Service lookup failed for source port \"%s\"", + sports); + logevent(buf); + } + } if (sport && dport) { if (type == 'L') { pfd_addforward(host, dport, sport); - sprintf(buf, "Local port %d forwarding to %s:%d", - sport, host, dport); + sprintf(buf, "Local port %.*s%.*s%d%.*s forwarding to" + " %s:%.*s%.*s%d%.*s", + sserv ? strlen(sports) : 0, sports, + sserv, "(", sport, sserv, ")", + host, + dserv ? strlen(dports) : 0, dports, + dserv, "(", dport, dserv, ")"); logevent(buf); } else { struct ssh_rportfwd *pf; @@ -2865,14 +3011,31 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) logevent(buf); sfree(pf); } else { - sprintf(buf, "Requesting remote port %d forward to %s:%d", - sport, host, dport); + sprintf(buf, "Requesting remote port %.*s%.*s%d%.*s" + " forward to %s:%.*s%.*s%d%.*s", + sserv ? strlen(sports) : 0, sports, + sserv, "(", sport, sserv, ")", + host, + dserv ? strlen(dports) : 0, dports, + dserv, "(", dport, dserv, ")"); logevent(buf); send_packet(SSH1_CMSG_PORT_FORWARD_REQUEST, PKT_INT, sport, PKT_STR, host, PKT_INT, dport, PKT_END); + do { + crReturnV; + } while (!ispkt); + if (pktin.type != SSH1_SMSG_SUCCESS + && pktin.type != SSH1_SMSG_FAILURE) { + bombout(("Protocol confusion")); + crReturnV; + } else if (pktin.type == SSH1_SMSG_FAILURE) { + c_write_str("Server refused port forwarding\r\n"); + ssh_editing = ssh_echoing = 1; + } + logevent("Remote port forwarding enabled"); } } } @@ -3873,6 +4036,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) static int we_are_in; static int num_prompts, echo; static char username[100]; + static int got_username; static char pwprompt[200]; static char password[100]; static void *publickey_blob; @@ -3917,6 +4081,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) * retype it! */ username[0] = '\0'; + got_username = FALSE; do { static int pos; static char c; @@ -3925,7 +4090,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) * Get a username. */ pos = 0; - if (*username && !cfg.change_username) { + if (got_username && !cfg.change_username) { /* * We got a username last time round this loop, and * with change_username turned off we don't try to get @@ -3995,6 +4160,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) c_write_str(stuff); } } + got_username = TRUE; /* * Send an authentication request using method "none": (a) @@ -4018,8 +4184,21 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) kbd_inter_running = FALSE; /* Load the pub half of cfg.keyfile so we notice if it's in Pageant */ if (*cfg.keyfile) { - publickey_blob = ssh2_userkey_loadpub(cfg.keyfile, NULL, - &publickey_bloblen); + int keytype; + logeventf("Reading private key file \"%.150s\"", cfg.keyfile); + keytype = key_type(cfg.keyfile); + if (keytype == SSH_KEYTYPE_SSH2) + publickey_blob = ssh2_userkey_loadpub(cfg.keyfile, NULL, + &publickey_bloblen); + else { + char msgbuf[256]; + logeventf("Unable to use this key file (%s)", + key_type_to_str(keytype)); + sprintf(msgbuf, "Unable to use key file \"%.150s\" (%s)\r\n", + cfg.keyfile, key_type_to_str(keytype)); + c_write_str(msgbuf); + publickey_blob = NULL; + } } else publickey_blob = NULL; @@ -4259,10 +4438,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) if (ret) { if (ret[4] == SSH2_AGENT_SIGN_RESPONSE) { logevent("Sending Pageant's response"); - ssh2_pkt_addstring_start(); - ssh2_pkt_addstring_data(ret + 9, - GET_32BIT(ret + - 5)); + ssh2_add_sigblob(pkblob, pklen, + ret + 9, GET_32BIT(ret + 5)); ssh2_pkt_send(); authed = TRUE; break; @@ -4278,7 +4455,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) } } - if (!method && can_pubkey && *cfg.keyfile + if (!method && can_pubkey && publickey_blob && !tried_pubkey_config) { unsigned char *pub_blob; char *algorithm, *comment; @@ -4417,6 +4594,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) ("No more passwords available to try"); ssh2_pkt_addstring("en"); /* language tag */ ssh2_pkt_send(); + logevent("Unable to authenticate"); connection_fatal("Unable to authenticate"); ssh_state = SSH_STATE_CLOSED; crReturnV; @@ -4484,8 +4662,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) ssh2_pkt_send(); type = AUTH_TYPE_NONE; } else { - unsigned char *blob, *sigdata; - int blob_len, sigdata_len; + unsigned char *pkblob, *sigblob, *sigdata; + int pkblob_len, sigblob_len, sigdata_len; /* * We have loaded the private key and the server @@ -4498,10 +4676,9 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) ssh2_pkt_addstring("publickey"); /* method */ ssh2_pkt_addbool(TRUE); ssh2_pkt_addstring(key->alg->name); - blob = key->alg->public_blob(key->data, &blob_len); + pkblob = key->alg->public_blob(key->data, &pkblob_len); ssh2_pkt_addstring_start(); - ssh2_pkt_addstring_data(blob, blob_len); - sfree(blob); + ssh2_pkt_addstring_data(pkblob, pkblob_len); /* * The data to be signed is: @@ -4517,12 +4694,12 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) memcpy(sigdata + 4, ssh2_session_id, 20); memcpy(sigdata + 24, pktout.data + 5, pktout.length - 5); - blob = - key->alg->sign(key->data, sigdata, sigdata_len, - &blob_len); - ssh2_pkt_addstring_start(); - ssh2_pkt_addstring_data(blob, blob_len); - sfree(blob); + sigblob = key->alg->sign(key->data, sigdata, + sigdata_len, &sigblob_len); + ssh2_add_sigblob(pkblob, pkblob_len, + sigblob, sigblob_len); + sfree(pkblob); + sfree(sigblob); sfree(sigdata); ssh2_pkt_send(); @@ -4696,9 +4873,10 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) static char *e; /* preserve across crReturn */ char type; int n; - int sport,dport; + int sport,dport,sserv,dserv; char sports[256], dports[256], host[256]; char buf[1024]; + struct servent *se; ssh_rportfwds = newtree234(ssh_rportcmp_ssh2); /* Add port forwardings. */ @@ -4723,12 +4901,43 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) dports[n] = 0; e++; dport = atoi(dports); + dserv = 0; + if (dport == 0) { + dserv = 1; + se = getservbyname(dports, NULL); + if (se != NULL) { + dport = ntohs(se->s_port); + } else { + sprintf(buf, + "Service lookup failed for destination port \"%s\"", + dports); + logevent(buf); + } + } sport = atoi(sports); + sserv = 0; + if (sport == 0) { + sserv = 1; + se = getservbyname(sports, NULL); + if (se != NULL) { + sport = ntohs(se->s_port); + } else { + sprintf(buf, + "Service lookup failed for source port \"%s\"", + sports); + logevent(buf); + } + } if (sport && dport) { if (type == 'L') { pfd_addforward(host, dport, sport); - sprintf(buf, "Local port %d forwarding to %s:%d", - sport, host, dport); + sprintf(buf, "Local port %.*s%.*s%d%.*s forwarding to" + " %s:%.*s%.*s%d%.*s", + sserv ? strlen(sports) : 0, sports, + sserv, "(", sport, sserv, ")", + host, + dserv ? strlen(dports) : 0, dports, + dserv, "(", dport, dserv, ")"); logevent(buf); } else { struct ssh_rportfwd *pf; @@ -4743,8 +4952,13 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) logevent(buf); sfree(pf); } else { - sprintf(buf, "Requesting remote port %d (forwarded to %s:%d)", - sport, host, dport); + sprintf(buf, "Requesting remote port %.*s%.*s%d%.*s" + " forward to %s:%.*s%.*s%d%.*s", + sserv ? strlen(sports) : 0, sports, + sserv, "(", sport, sserv, ")", + host, + dserv ? strlen(dports) : 0, dports, + dserv, "(", dport, dserv, ")"); logevent(buf); ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST); ssh2_pkt_addstring("tcpip-forward"); @@ -5197,7 +5411,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt) ssh2_pkt_addstring(buf); ssh2_pkt_addstring("en"); /* language tag */ ssh2_pkt_send(); - connection_fatal(buf); + connection_fatal("%s", buf); ssh_state = SSH_STATE_CLOSED; crReturnV; }