23 #define SSH1_MSG_DISCONNECT 1 /* 0x1 */
24 #define SSH1_SMSG_PUBLIC_KEY 2 /* 0x2 */
25 #define SSH1_CMSG_SESSION_KEY 3 /* 0x3 */
26 #define SSH1_CMSG_USER 4 /* 0x4 */
27 #define SSH1_CMSG_AUTH_RSA 6 /* 0x6 */
28 #define SSH1_SMSG_AUTH_RSA_CHALLENGE 7 /* 0x7 */
29 #define SSH1_CMSG_AUTH_RSA_RESPONSE 8 /* 0x8 */
30 #define SSH1_CMSG_AUTH_PASSWORD 9 /* 0x9 */
31 #define SSH1_CMSG_REQUEST_PTY 10 /* 0xa */
32 #define SSH1_CMSG_WINDOW_SIZE 11 /* 0xb */
33 #define SSH1_CMSG_EXEC_SHELL 12 /* 0xc */
34 #define SSH1_CMSG_EXEC_CMD 13 /* 0xd */
35 #define SSH1_SMSG_SUCCESS 14 /* 0xe */
36 #define SSH1_SMSG_FAILURE 15 /* 0xf */
37 #define SSH1_CMSG_STDIN_DATA 16 /* 0x10 */
38 #define SSH1_SMSG_STDOUT_DATA 17 /* 0x11 */
39 #define SSH1_SMSG_STDERR_DATA 18 /* 0x12 */
40 #define SSH1_CMSG_EOF 19 /* 0x13 */
41 #define SSH1_SMSG_EXIT_STATUS 20 /* 0x14 */
42 #define SSH1_MSG_CHANNEL_OPEN_CONFIRMATION 21 /* 0x15 */
43 #define SSH1_MSG_CHANNEL_OPEN_FAILURE 22 /* 0x16 */
44 #define SSH1_MSG_CHANNEL_DATA 23 /* 0x17 */
45 #define SSH1_MSG_CHANNEL_CLOSE 24 /* 0x18 */
46 #define SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION 25 /* 0x19 */
47 #define SSH1_SMSG_X11_OPEN 27 /* 0x1b */
48 #define SSH1_CMSG_PORT_FORWARD_REQUEST 28 /* 0x1c */
49 #define SSH1_MSG_PORT_OPEN 29 /* 0x1d */
50 #define SSH1_CMSG_AGENT_REQUEST_FORWARDING 30 /* 0x1e */
51 #define SSH1_SMSG_AGENT_OPEN 31 /* 0x1f */
52 #define SSH1_MSG_IGNORE 32 /* 0x20 */
53 #define SSH1_CMSG_EXIT_CONFIRMATION 33 /* 0x21 */
54 #define SSH1_CMSG_X11_REQUEST_FORWARDING 34 /* 0x22 */
55 #define SSH1_CMSG_AUTH_RHOSTS_RSA 35 /* 0x23 */
56 #define SSH1_MSG_DEBUG 36 /* 0x24 */
57 #define SSH1_CMSG_REQUEST_COMPRESSION 37 /* 0x25 */
58 #define SSH1_CMSG_AUTH_TIS 39 /* 0x27 */
59 #define SSH1_SMSG_AUTH_TIS_CHALLENGE 40 /* 0x28 */
60 #define SSH1_CMSG_AUTH_TIS_RESPONSE 41 /* 0x29 */
61 #define SSH1_CMSG_AUTH_CCARD 70 /* 0x46 */
62 #define SSH1_SMSG_AUTH_CCARD_CHALLENGE 71 /* 0x47 */
63 #define SSH1_CMSG_AUTH_CCARD_RESPONSE 72 /* 0x48 */
65 #define SSH1_AUTH_RHOSTS 1 /* 0x1 */
66 #define SSH1_AUTH_RSA 2 /* 0x2 */
67 #define SSH1_AUTH_PASSWORD 3 /* 0x3 */
68 #define SSH1_AUTH_RHOSTS_RSA 4 /* 0x4 */
69 #define SSH1_AUTH_TIS 5 /* 0x5 */
70 #define SSH1_AUTH_CCARD 16 /* 0x10 */
72 #define SSH1_PROTOFLAG_SCREEN_NUMBER 1 /* 0x1 */
73 /* Mask for protoflags we will echo back to server if seen */
74 #define SSH1_PROTOFLAGS_SUPPORTED 0 /* 0x1 */
76 #define SSH2_MSG_DISCONNECT 1 /* 0x1 */
77 #define SSH2_MSG_IGNORE 2 /* 0x2 */
78 #define SSH2_MSG_UNIMPLEMENTED 3 /* 0x3 */
79 #define SSH2_MSG_DEBUG 4 /* 0x4 */
80 #define SSH2_MSG_SERVICE_REQUEST 5 /* 0x5 */
81 #define SSH2_MSG_SERVICE_ACCEPT 6 /* 0x6 */
82 #define SSH2_MSG_KEXINIT 20 /* 0x14 */
83 #define SSH2_MSG_NEWKEYS 21 /* 0x15 */
84 #define SSH2_MSG_KEXDH_INIT 30 /* 0x1e */
85 #define SSH2_MSG_KEXDH_REPLY 31 /* 0x1f */
86 #define SSH2_MSG_KEX_DH_GEX_REQUEST 30 /* 0x1e */
87 #define SSH2_MSG_KEX_DH_GEX_GROUP 31 /* 0x1f */
88 #define SSH2_MSG_KEX_DH_GEX_INIT 32 /* 0x20 */
89 #define SSH2_MSG_KEX_DH_GEX_REPLY 33 /* 0x21 */
90 #define SSH2_MSG_KEXRSA_PUBKEY 30 /* 0x1e */
91 #define SSH2_MSG_KEXRSA_SECRET 31 /* 0x1f */
92 #define SSH2_MSG_KEXRSA_DONE 32 /* 0x20 */
93 #define SSH2_MSG_USERAUTH_REQUEST 50 /* 0x32 */
94 #define SSH2_MSG_USERAUTH_FAILURE 51 /* 0x33 */
95 #define SSH2_MSG_USERAUTH_SUCCESS 52 /* 0x34 */
96 #define SSH2_MSG_USERAUTH_BANNER 53 /* 0x35 */
97 #define SSH2_MSG_USERAUTH_PK_OK 60 /* 0x3c */
98 #define SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ 60 /* 0x3c */
99 #define SSH2_MSG_USERAUTH_INFO_REQUEST 60 /* 0x3c */
100 #define SSH2_MSG_USERAUTH_INFO_RESPONSE 61 /* 0x3d */
101 #define SSH2_MSG_GLOBAL_REQUEST 80 /* 0x50 */
102 #define SSH2_MSG_REQUEST_SUCCESS 81 /* 0x51 */
103 #define SSH2_MSG_REQUEST_FAILURE 82 /* 0x52 */
104 #define SSH2_MSG_CHANNEL_OPEN 90 /* 0x5a */
105 #define SSH2_MSG_CHANNEL_OPEN_CONFIRMATION 91 /* 0x5b */
106 #define SSH2_MSG_CHANNEL_OPEN_FAILURE 92 /* 0x5c */
107 #define SSH2_MSG_CHANNEL_WINDOW_ADJUST 93 /* 0x5d */
108 #define SSH2_MSG_CHANNEL_DATA 94 /* 0x5e */
109 #define SSH2_MSG_CHANNEL_EXTENDED_DATA 95 /* 0x5f */
110 #define SSH2_MSG_CHANNEL_EOF 96 /* 0x60 */
111 #define SSH2_MSG_CHANNEL_CLOSE 97 /* 0x61 */
112 #define SSH2_MSG_CHANNEL_REQUEST 98 /* 0x62 */
113 #define SSH2_MSG_CHANNEL_SUCCESS 99 /* 0x63 */
114 #define SSH2_MSG_CHANNEL_FAILURE 100 /* 0x64 */
117 * Packet type contexts, so that ssh2_pkt_type can correctly decode
118 * the ambiguous type numbers back into the correct type strings.
128 SSH2_PKTCTX_PUBLICKEY,
129 SSH2_PKTCTX_PASSWORD,
133 #define SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1 /* 0x1 */
134 #define SSH2_DISCONNECT_PROTOCOL_ERROR 2 /* 0x2 */
135 #define SSH2_DISCONNECT_KEY_EXCHANGE_FAILED 3 /* 0x3 */
136 #define SSH2_DISCONNECT_HOST_AUTHENTICATION_FAILED 4 /* 0x4 */
137 #define SSH2_DISCONNECT_MAC_ERROR 5 /* 0x5 */
138 #define SSH2_DISCONNECT_COMPRESSION_ERROR 6 /* 0x6 */
139 #define SSH2_DISCONNECT_SERVICE_NOT_AVAILABLE 7 /* 0x7 */
140 #define SSH2_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED 8 /* 0x8 */
141 #define SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9 /* 0x9 */
142 #define SSH2_DISCONNECT_CONNECTION_LOST 10 /* 0xa */
143 #define SSH2_DISCONNECT_BY_APPLICATION 11 /* 0xb */
144 #define SSH2_DISCONNECT_TOO_MANY_CONNECTIONS 12 /* 0xc */
145 #define SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER 13 /* 0xd */
146 #define SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14 /* 0xe */
147 #define SSH2_DISCONNECT_ILLEGAL_USER_NAME 15 /* 0xf */
149 static const char *const ssh2_disconnect_reasons[] = {
151 "host not allowed to connect",
153 "key exchange failed",
154 "host authentication failed",
157 "service not available",
158 "protocol version not supported",
159 "host key not verifiable",
162 "too many connections",
163 "auth cancelled by user",
164 "no more auth methods available",
168 #define SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED 1 /* 0x1 */
169 #define SSH2_OPEN_CONNECT_FAILED 2 /* 0x2 */
170 #define SSH2_OPEN_UNKNOWN_CHANNEL_TYPE 3 /* 0x3 */
171 #define SSH2_OPEN_RESOURCE_SHORTAGE 4 /* 0x4 */
173 #define SSH2_EXTENDED_DATA_STDERR 1 /* 0x1 */
176 * Various remote-bug flags.
178 #define BUG_CHOKES_ON_SSH1_IGNORE 1
179 #define BUG_SSH2_HMAC 2
180 #define BUG_NEEDS_SSH1_PLAIN_PASSWORD 4
181 #define BUG_CHOKES_ON_RSA 8
182 #define BUG_SSH2_RSA_PADDING 16
183 #define BUG_SSH2_DERIVEKEY 32
184 #define BUG_SSH2_REKEY 64
185 #define BUG_SSH2_PK_SESSIONID 128
186 #define BUG_SSH2_MAXPKT 256
189 * Codes for terminal modes.
190 * Most of these are the same in SSH-1 and SSH-2.
191 * This list is derived from RFC 4254 and
194 static const struct {
195 const char* const mode;
197 enum { TTY_OP_CHAR, TTY_OP_BOOL } type;
199 /* "V" prefix discarded for special characters relative to SSH specs */
200 { "INTR", 1, TTY_OP_CHAR },
201 { "QUIT", 2, TTY_OP_CHAR },
202 { "ERASE", 3, TTY_OP_CHAR },
203 { "KILL", 4, TTY_OP_CHAR },
204 { "EOF", 5, TTY_OP_CHAR },
205 { "EOL", 6, TTY_OP_CHAR },
206 { "EOL2", 7, TTY_OP_CHAR },
207 { "START", 8, TTY_OP_CHAR },
208 { "STOP", 9, TTY_OP_CHAR },
209 { "SUSP", 10, TTY_OP_CHAR },
210 { "DSUSP", 11, TTY_OP_CHAR },
211 { "REPRINT", 12, TTY_OP_CHAR },
212 { "WERASE", 13, TTY_OP_CHAR },
213 { "LNEXT", 14, TTY_OP_CHAR },
214 { "FLUSH", 15, TTY_OP_CHAR },
215 { "SWTCH", 16, TTY_OP_CHAR },
216 { "STATUS", 17, TTY_OP_CHAR },
217 { "DISCARD", 18, TTY_OP_CHAR },
218 { "IGNPAR", 30, TTY_OP_BOOL },
219 { "PARMRK", 31, TTY_OP_BOOL },
220 { "INPCK", 32, TTY_OP_BOOL },
221 { "ISTRIP", 33, TTY_OP_BOOL },
222 { "INLCR", 34, TTY_OP_BOOL },
223 { "IGNCR", 35, TTY_OP_BOOL },
224 { "ICRNL", 36, TTY_OP_BOOL },
225 { "IUCLC", 37, TTY_OP_BOOL },
226 { "IXON", 38, TTY_OP_BOOL },
227 { "IXANY", 39, TTY_OP_BOOL },
228 { "IXOFF", 40, TTY_OP_BOOL },
229 { "IMAXBEL", 41, TTY_OP_BOOL },
230 { "ISIG", 50, TTY_OP_BOOL },
231 { "ICANON", 51, TTY_OP_BOOL },
232 { "XCASE", 52, TTY_OP_BOOL },
233 { "ECHO", 53, TTY_OP_BOOL },
234 { "ECHOE", 54, TTY_OP_BOOL },
235 { "ECHOK", 55, TTY_OP_BOOL },
236 { "ECHONL", 56, TTY_OP_BOOL },
237 { "NOFLSH", 57, TTY_OP_BOOL },
238 { "TOSTOP", 58, TTY_OP_BOOL },
239 { "IEXTEN", 59, TTY_OP_BOOL },
240 { "ECHOCTL", 60, TTY_OP_BOOL },
241 { "ECHOKE", 61, TTY_OP_BOOL },
242 { "PENDIN", 62, TTY_OP_BOOL }, /* XXX is this a real mode? */
243 { "OPOST", 70, TTY_OP_BOOL },
244 { "OLCUC", 71, TTY_OP_BOOL },
245 { "ONLCR", 72, TTY_OP_BOOL },
246 { "OCRNL", 73, TTY_OP_BOOL },
247 { "ONOCR", 74, TTY_OP_BOOL },
248 { "ONLRET", 75, TTY_OP_BOOL },
249 { "CS7", 90, TTY_OP_BOOL },
250 { "CS8", 91, TTY_OP_BOOL },
251 { "PARENB", 92, TTY_OP_BOOL },
252 { "PARODD", 93, TTY_OP_BOOL }
255 /* Miscellaneous other tty-related constants. */
256 #define SSH_TTY_OP_END 0
257 /* The opcodes for ISPEED/OSPEED differ between SSH-1 and SSH-2. */
258 #define SSH1_TTY_OP_ISPEED 192
259 #define SSH1_TTY_OP_OSPEED 193
260 #define SSH2_TTY_OP_ISPEED 128
261 #define SSH2_TTY_OP_OSPEED 129
263 /* Helper functions for parsing tty-related config. */
264 static unsigned int ssh_tty_parse_specchar(char *s)
269 ret = ctrlparse(s, &next);
270 if (!next) ret = s[0];
272 ret = 255; /* special value meaning "don't set" */
276 static unsigned int ssh_tty_parse_boolean(char *s)
278 if (stricmp(s, "yes") == 0 ||
279 stricmp(s, "on") == 0 ||
280 stricmp(s, "true") == 0 ||
281 stricmp(s, "+") == 0)
283 else if (stricmp(s, "no") == 0 ||
284 stricmp(s, "off") == 0 ||
285 stricmp(s, "false") == 0 ||
286 stricmp(s, "-") == 0)
287 return 0; /* false */
289 return (atoi(s) != 0);
292 #define translate(x) if (type == x) return #x
293 #define translatek(x,ctx) if (type == x && (pkt_kctx == ctx)) return #x
294 #define translatea(x,ctx) if (type == x && (pkt_actx == ctx)) return #x
295 static char *ssh1_pkt_type(int type)
297 translate(SSH1_MSG_DISCONNECT);
298 translate(SSH1_SMSG_PUBLIC_KEY);
299 translate(SSH1_CMSG_SESSION_KEY);
300 translate(SSH1_CMSG_USER);
301 translate(SSH1_CMSG_AUTH_RSA);
302 translate(SSH1_SMSG_AUTH_RSA_CHALLENGE);
303 translate(SSH1_CMSG_AUTH_RSA_RESPONSE);
304 translate(SSH1_CMSG_AUTH_PASSWORD);
305 translate(SSH1_CMSG_REQUEST_PTY);
306 translate(SSH1_CMSG_WINDOW_SIZE);
307 translate(SSH1_CMSG_EXEC_SHELL);
308 translate(SSH1_CMSG_EXEC_CMD);
309 translate(SSH1_SMSG_SUCCESS);
310 translate(SSH1_SMSG_FAILURE);
311 translate(SSH1_CMSG_STDIN_DATA);
312 translate(SSH1_SMSG_STDOUT_DATA);
313 translate(SSH1_SMSG_STDERR_DATA);
314 translate(SSH1_CMSG_EOF);
315 translate(SSH1_SMSG_EXIT_STATUS);
316 translate(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
317 translate(SSH1_MSG_CHANNEL_OPEN_FAILURE);
318 translate(SSH1_MSG_CHANNEL_DATA);
319 translate(SSH1_MSG_CHANNEL_CLOSE);
320 translate(SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION);
321 translate(SSH1_SMSG_X11_OPEN);
322 translate(SSH1_CMSG_PORT_FORWARD_REQUEST);
323 translate(SSH1_MSG_PORT_OPEN);
324 translate(SSH1_CMSG_AGENT_REQUEST_FORWARDING);
325 translate(SSH1_SMSG_AGENT_OPEN);
326 translate(SSH1_MSG_IGNORE);
327 translate(SSH1_CMSG_EXIT_CONFIRMATION);
328 translate(SSH1_CMSG_X11_REQUEST_FORWARDING);
329 translate(SSH1_CMSG_AUTH_RHOSTS_RSA);
330 translate(SSH1_MSG_DEBUG);
331 translate(SSH1_CMSG_REQUEST_COMPRESSION);
332 translate(SSH1_CMSG_AUTH_TIS);
333 translate(SSH1_SMSG_AUTH_TIS_CHALLENGE);
334 translate(SSH1_CMSG_AUTH_TIS_RESPONSE);
335 translate(SSH1_CMSG_AUTH_CCARD);
336 translate(SSH1_SMSG_AUTH_CCARD_CHALLENGE);
337 translate(SSH1_CMSG_AUTH_CCARD_RESPONSE);
340 static char *ssh2_pkt_type(Pkt_KCtx pkt_kctx, Pkt_ACtx pkt_actx, int type)
342 translate(SSH2_MSG_DISCONNECT);
343 translate(SSH2_MSG_IGNORE);
344 translate(SSH2_MSG_UNIMPLEMENTED);
345 translate(SSH2_MSG_DEBUG);
346 translate(SSH2_MSG_SERVICE_REQUEST);
347 translate(SSH2_MSG_SERVICE_ACCEPT);
348 translate(SSH2_MSG_KEXINIT);
349 translate(SSH2_MSG_NEWKEYS);
350 translatek(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP);
351 translatek(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP);
352 translatek(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX);
353 translatek(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX);
354 translatek(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX);
355 translatek(SSH2_MSG_KEX_DH_GEX_REPLY, SSH2_PKTCTX_DHGEX);
356 translatek(SSH2_MSG_KEXRSA_PUBKEY, SSH2_PKTCTX_RSAKEX);
357 translatek(SSH2_MSG_KEXRSA_SECRET, SSH2_PKTCTX_RSAKEX);
358 translatek(SSH2_MSG_KEXRSA_DONE, SSH2_PKTCTX_RSAKEX);
359 translate(SSH2_MSG_USERAUTH_REQUEST);
360 translate(SSH2_MSG_USERAUTH_FAILURE);
361 translate(SSH2_MSG_USERAUTH_SUCCESS);
362 translate(SSH2_MSG_USERAUTH_BANNER);
363 translatea(SSH2_MSG_USERAUTH_PK_OK, SSH2_PKTCTX_PUBLICKEY);
364 translatea(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, SSH2_PKTCTX_PASSWORD);
365 translatea(SSH2_MSG_USERAUTH_INFO_REQUEST, SSH2_PKTCTX_KBDINTER);
366 translatea(SSH2_MSG_USERAUTH_INFO_RESPONSE, SSH2_PKTCTX_KBDINTER);
367 translate(SSH2_MSG_GLOBAL_REQUEST);
368 translate(SSH2_MSG_REQUEST_SUCCESS);
369 translate(SSH2_MSG_REQUEST_FAILURE);
370 translate(SSH2_MSG_CHANNEL_OPEN);
371 translate(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
372 translate(SSH2_MSG_CHANNEL_OPEN_FAILURE);
373 translate(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
374 translate(SSH2_MSG_CHANNEL_DATA);
375 translate(SSH2_MSG_CHANNEL_EXTENDED_DATA);
376 translate(SSH2_MSG_CHANNEL_EOF);
377 translate(SSH2_MSG_CHANNEL_CLOSE);
378 translate(SSH2_MSG_CHANNEL_REQUEST);
379 translate(SSH2_MSG_CHANNEL_SUCCESS);
380 translate(SSH2_MSG_CHANNEL_FAILURE);
386 /* Enumeration values for fields in SSH-1 packets */
388 PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM,
389 /* These values are for communicating relevant semantics of
390 * fields to the packet logging code. */
391 PKTT_OTHER, PKTT_PASSWORD, PKTT_DATA
395 * Coroutine mechanics for the sillier bits of the code. If these
396 * macros look impenetrable to you, you might find it helpful to
399 * http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html
401 * which explains the theory behind these macros.
403 * In particular, if you are getting `case expression not constant'
404 * errors when building with MS Visual Studio, this is because MS's
405 * Edit and Continue debugging feature causes their compiler to
406 * violate ANSI C. To disable Edit and Continue debugging:
408 * - right-click ssh.c in the FileView
410 * - select the C/C++ tab and the General category
411 * - under `Debug info:', select anything _other_ than `Program
412 * Database for Edit and Continue'.
414 #define crBegin(v) { int *crLine = &v; switch(v) { case 0:;
417 if (!ssh->t) ssh->t = snew(struct t); \
419 #define crFinish(z) } *crLine = 0; return (z); }
420 #define crFinishV } *crLine = 0; return; }
421 #define crReturn(z) \
423 *crLine =__LINE__; return (z); case __LINE__:;\
427 *crLine=__LINE__; return; case __LINE__:;\
429 #define crStop(z) do{ *crLine = 0; return (z); }while(0)
430 #define crStopV do{ *crLine = 0; return; }while(0)
431 #define crWaitUntil(c) do { crReturn(0); } while (!(c))
432 #define crWaitUntilV(c) do { crReturnV; } while (!(c))
434 typedef struct ssh_tag *Ssh;
437 static struct Packet *ssh1_pkt_init(int pkt_type);
438 static struct Packet *ssh2_pkt_init(int pkt_type);
439 static void ssh_pkt_ensure(struct Packet *, int length);
440 static void ssh_pkt_adddata(struct Packet *, void *data, int len);
441 static void ssh_pkt_addbyte(struct Packet *, unsigned char value);
442 static void ssh2_pkt_addbool(struct Packet *, unsigned char value);
443 static void ssh_pkt_adduint32(struct Packet *, unsigned long value);
444 static void ssh_pkt_addstring_start(struct Packet *);
445 static void ssh_pkt_addstring_str(struct Packet *, char *data);
446 static void ssh_pkt_addstring_data(struct Packet *, char *data, int len);
447 static void ssh_pkt_addstring(struct Packet *, char *data);
448 static unsigned char *ssh2_mpint_fmt(Bignum b, int *len);
449 static void ssh1_pkt_addmp(struct Packet *, Bignum b);
450 static void ssh2_pkt_addmp(struct Packet *, Bignum b);
451 static int ssh2_pkt_construct(Ssh, struct Packet *);
452 static void ssh2_pkt_send(Ssh, struct Packet *);
453 static void ssh2_pkt_send_noqueue(Ssh, struct Packet *);
454 static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
455 struct Packet *pktin);
456 static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
457 struct Packet *pktin);
460 * Buffer management constants. There are several of these for
461 * various different purposes:
463 * - SSH1_BUFFER_LIMIT is the amount of backlog that must build up
464 * on a local data stream before we throttle the whole SSH
465 * connection (in SSH-1 only). Throttling the whole connection is
466 * pretty drastic so we set this high in the hope it won't
469 * - SSH_MAX_BACKLOG is the amount of backlog that must build up
470 * on the SSH connection itself before we defensively throttle
471 * _all_ local data streams. This is pretty drastic too (though
472 * thankfully unlikely in SSH-2 since the window mechanism should
473 * ensure that the server never has any need to throttle its end
474 * of the connection), so we set this high as well.
476 * - OUR_V2_WINSIZE is the maximum window size we present on SSH-2
479 * - OUR_V2_BIGWIN is the window size we advertise for the only
480 * channel in a simple connection. It must be <= INT_MAX.
483 #define SSH1_BUFFER_LIMIT 32768
484 #define SSH_MAX_BACKLOG 32768
485 #define OUR_V2_WINSIZE 16384
486 #define OUR_V2_BIGWIN 0x7fffffff
487 #define OUR_V2_MAXPKT 0x4000UL
489 /* Maximum length of passwords/passphrases (arbitrary) */
490 #define SSH_MAX_PASSWORD_LEN 100
492 const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss };
494 const static struct ssh_mac *macs[] = {
495 &ssh_hmac_sha1, &ssh_hmac_sha1_96, &ssh_hmac_md5
497 const static struct ssh_mac *buggymacs[] = {
498 &ssh_hmac_sha1_buggy, &ssh_hmac_sha1_96_buggy, &ssh_hmac_md5
501 static void *ssh_comp_none_init(void)
505 static void ssh_comp_none_cleanup(void *handle)
508 static int ssh_comp_none_block(void *handle, unsigned char *block, int len,
509 unsigned char **outblock, int *outlen)
513 static int ssh_comp_none_disable(void *handle)
517 const static struct ssh_compress ssh_comp_none = {
519 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
520 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
521 ssh_comp_none_disable, NULL
523 extern const struct ssh_compress ssh_zlib;
524 const static struct ssh_compress *compressions[] = {
525 &ssh_zlib, &ssh_comp_none
528 enum { /* channel types */
533 CHAN_SOCKDATA_DORMANT /* one the remote hasn't confirmed */
537 * little structure to keep track of outstanding WINDOW_ADJUSTs
545 * 2-3-4 tree storing channels.
548 Ssh ssh; /* pointer back to main context */
549 unsigned remoteid, localid;
551 /* True if we opened this channel but server hasn't confirmed. */
554 * In SSH-1, this value contains four bits:
556 * 1 We have sent SSH1_MSG_CHANNEL_CLOSE.
557 * 2 We have sent SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
558 * 4 We have received SSH1_MSG_CHANNEL_CLOSE.
559 * 8 We have received SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
561 * A channel is completely finished with when all four bits are set.
565 * True if this channel is causing the underlying connection to be
570 struct ssh2_data_channel {
572 unsigned remwindow, remmaxpkt;
573 /* locwindow is signed so we can cope with excess data. */
574 int locwindow, locmaxwin;
576 * remlocwin is the amount of local window that we think
577 * the remote end had available to it after it sent the
578 * last data packet or window adjust ack.
582 * These store the list of window adjusts that haven't
585 struct winadj *winadj_head, *winadj_tail;
586 enum { THROTTLED, UNTHROTTLING, UNTHROTTLED } throttle_state;
590 struct ssh_agent_channel {
591 unsigned char *message;
592 unsigned char msglen[4];
593 unsigned lensofar, totallen;
595 struct ssh_x11_channel {
598 struct ssh_pfd_channel {
605 * 2-3-4 tree storing remote->local port forwardings. SSH-1 and SSH-2
606 * use this structure in different ways, reflecting SSH-2's
607 * altogether saner approach to port forwarding.
609 * In SSH-1, you arrange a remote forwarding by sending the server
610 * the remote port number, and the local destination host:port.
611 * When a connection comes in, the server sends you back that
612 * host:port pair, and you connect to it. This is a ready-made
613 * security hole if you're not on the ball: a malicious server
614 * could send you back _any_ host:port pair, so if you trustingly
615 * connect to the address it gives you then you've just opened the
616 * entire inside of your corporate network just by connecting
617 * through it to a dodgy SSH server. Hence, we must store a list of
618 * host:port pairs we _are_ trying to forward to, and reject a
619 * connection request from the server if it's not in the list.
621 * In SSH-2, each side of the connection minds its own business and
622 * doesn't send unnecessary information to the other. You arrange a
623 * remote forwarding by sending the server just the remote port
624 * number. When a connection comes in, the server tells you which
625 * of its ports was connected to; and _you_ have to remember what
626 * local host:port pair went with that port number.
628 * Hence, in SSH-1 this structure is indexed by destination
629 * host:port pair, whereas in SSH-2 it is indexed by source port.
631 struct ssh_portfwd; /* forward declaration */
633 struct ssh_rportfwd {
634 unsigned sport, dport;
637 struct ssh_portfwd *pfrec;
639 #define free_rportfwd(pf) ( \
640 ((pf) ? (sfree((pf)->sportdesc)) : (void)0 ), sfree(pf) )
643 * Separately to the rportfwd tree (which is for looking up port
644 * open requests from the server), a tree of _these_ structures is
645 * used to keep track of all the currently open port forwardings,
646 * so that we can reconfigure in mid-session if the user requests
650 enum { DESTROY, KEEP, CREATE } status;
652 unsigned sport, dport;
655 struct ssh_rportfwd *remote;
659 #define free_portfwd(pf) ( \
660 ((pf) ? (sfree((pf)->saddr), sfree((pf)->daddr), \
661 sfree((pf)->sserv), sfree((pf)->dserv)) : (void)0 ), sfree(pf) )
664 long length; /* length of `data' actually used */
665 long forcepad; /* SSH-2: force padding to at least this length */
666 int type; /* only used for incoming packets */
667 unsigned long sequence; /* SSH-2 incoming sequence number */
668 unsigned char *data; /* allocated storage */
669 unsigned char *body; /* offset of payload within `data' */
670 long savedpos; /* temporary index into `data' (for strings) */
671 long maxlen; /* amount of storage allocated for `data' */
672 long encrypted_len; /* for SSH-2 total-size counting */
675 * State associated with packet logging
679 struct logblank_t *blanks;
682 static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
683 struct Packet *pktin);
684 static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
685 struct Packet *pktin);
686 static void ssh1_protocol_setup(Ssh ssh);
687 static void ssh2_protocol_setup(Ssh ssh);
688 static void ssh_size(void *handle, int width, int height);
689 static void ssh_special(void *handle, Telnet_Special);
690 static int ssh2_try_send(struct ssh_channel *c);
691 static void ssh2_add_channel_data(struct ssh_channel *c, char *buf, int len);
692 static void ssh_throttle_all(Ssh ssh, int enable, int bufsize);
693 static void ssh2_set_window(struct ssh_channel *c, int newwin);
694 static int ssh_sendbuffer(void *handle);
695 static int ssh_do_close(Ssh ssh, int notify_exit);
696 static unsigned long ssh_pkt_getuint32(struct Packet *pkt);
697 static int ssh2_pkt_getbool(struct Packet *pkt);
698 static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length);
699 static void ssh2_timer(void *ctx, long now);
700 static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
701 struct Packet *pktin);
703 struct rdpkt1_state_tag {
704 long len, pad, biglen, to_read;
705 unsigned long realcrc, gotcrc;
709 struct Packet *pktin;
712 struct rdpkt2_state_tag {
713 long len, pad, payload, packetlen, maclen;
716 unsigned long incoming_sequence;
717 struct Packet *pktin;
720 typedef void (*handler_fn_t)(Ssh ssh, struct Packet *pktin);
721 typedef void (*chandler_fn_t)(Ssh ssh, struct Packet *pktin, void *ctx);
723 struct queued_handler;
724 struct queued_handler {
726 chandler_fn_t handler;
728 struct queued_handler *next;
732 const struct plug_function_table *fn;
733 /* the above field _must_ be first in the structure */
743 unsigned char session_key[32];
745 int v1_remote_protoflags;
746 int v1_local_protoflags;
747 int agentfwd_enabled;
750 const struct ssh_cipher *cipher;
753 const struct ssh2_cipher *cscipher, *sccipher;
754 void *cs_cipher_ctx, *sc_cipher_ctx;
755 const struct ssh_mac *csmac, *scmac;
756 void *cs_mac_ctx, *sc_mac_ctx;
757 const struct ssh_compress *cscomp, *sccomp;
758 void *cs_comp_ctx, *sc_comp_ctx;
759 const struct ssh_kex *kex;
760 const struct ssh_signkey *hostkey;
761 unsigned char v2_session_id[SSH2_KEX_MAX_HASH_LEN];
762 int v2_session_id_len;
768 int echoing, editing;
772 int ospeed, ispeed; /* temporaries */
773 int term_width, term_height;
775 tree234 *channels; /* indexed by local id */
776 struct ssh_channel *mainchan; /* primary session channel */
777 int ncmode; /* is primary channel direct-tcpip? */
782 tree234 *rportfwds, *portfwds;
786 SSH_STATE_BEFORE_SIZE,
792 int size_needed, eof_needed;
794 struct Packet **queue;
795 int queuelen, queuesize;
797 unsigned char *deferred_send_data;
798 int deferred_len, deferred_size;
801 * Gross hack: pscp will try to start SFTP but fall back to
802 * scp1 if that fails. This variable is the means by which
803 * scp.c can reach into the SSH code and find out which one it
808 bufchain banner; /* accumulates banners during do_ssh2_authconn */
816 int conn_throttle_count;
819 int v1_stdout_throttling;
820 unsigned long v2_outgoing_sequence;
822 int ssh1_rdpkt_crstate;
823 int ssh2_rdpkt_crstate;
824 int do_ssh_init_crstate;
825 int ssh_gotdata_crstate;
826 int do_ssh1_login_crstate;
827 int do_ssh1_connection_crstate;
828 int do_ssh2_transport_crstate;
829 int do_ssh2_authconn_crstate;
831 void *do_ssh_init_state;
832 void *do_ssh1_login_state;
833 void *do_ssh2_transport_state;
834 void *do_ssh2_authconn_state;
836 struct rdpkt1_state_tag rdpkt1_state;
837 struct rdpkt2_state_tag rdpkt2_state;
839 /* SSH-1 and SSH-2 use this for different things, but both use it */
840 int protocol_initial_phase_done;
842 void (*protocol) (Ssh ssh, void *vin, int inlen,
844 struct Packet *(*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen);
847 * We maintain a full _copy_ of a Config structure here, not
848 * merely a pointer to it. That way, when we're passed a new
849 * one for reconfiguration, we can check the differences and
850 * potentially reconfigure port forwardings etc in mid-session.
855 * Used to transfer data back from async callbacks.
857 void *agent_response;
858 int agent_response_len;
862 * The SSH connection can be set as `frozen', meaning we are
863 * not currently accepting incoming data from the network. This
864 * is slightly more serious than setting the _socket_ as
865 * frozen, because we may already have had data passed to us
866 * from the network which we need to delay processing until
867 * after the freeze is lifted, so we also need a bufchain to
871 bufchain queued_incoming_data;
874 * Dispatch table for packet types that we may have to deal
877 handler_fn_t packet_dispatch[256];
880 * Queues of one-off handler functions for success/failure
881 * indications from a request.
883 struct queued_handler *qhead, *qtail;
886 * This module deals with sending keepalives.
891 * Track incoming and outgoing data sizes and time, for
894 unsigned long incoming_data_size, outgoing_data_size, deferred_data_size;
895 unsigned long max_data_size;
897 long next_rekey, last_rekey;
898 char *deferred_rekey_reason; /* points to STATIC string; don't free */
901 #define logevent(s) logevent(ssh->frontend, s)
903 /* logevent, only printf-formatted. */
904 static void logeventf(Ssh ssh, const char *fmt, ...)
910 buf = dupvprintf(fmt, ap);
916 #define bombout(msg) \
918 char *text = dupprintf msg; \
919 ssh_do_close(ssh, FALSE); \
921 connection_fatal(ssh->frontend, "%s", text); \
925 /* Functions to leave bits out of the SSH packet log file. */
927 static void dont_log_password(Ssh ssh, struct Packet *pkt, int blanktype)
929 if (ssh->cfg.logomitpass)
930 pkt->logmode = blanktype;
933 static void dont_log_data(Ssh ssh, struct Packet *pkt, int blanktype)
935 if (ssh->cfg.logomitdata)
936 pkt->logmode = blanktype;
939 static void end_log_omission(Ssh ssh, struct Packet *pkt)
941 pkt->logmode = PKTLOG_EMIT;
944 /* Helper function for common bits of parsing cfg.ttymodes. */
945 static void parse_ttymodes(Ssh ssh, char *modes,
946 void (*do_mode)(void *data, char *mode, char *val),
950 char *t = strchr(modes, '\t');
951 char *m = snewn(t-modes+1, char);
953 strncpy(m, modes, t-modes);
956 val = get_ttymode(ssh->frontend, m);
960 do_mode(data, m, val);
963 modes += strlen(modes) + 1;
967 static int ssh_channelcmp(void *av, void *bv)
969 struct ssh_channel *a = (struct ssh_channel *) av;
970 struct ssh_channel *b = (struct ssh_channel *) bv;
971 if (a->localid < b->localid)
973 if (a->localid > b->localid)
977 static int ssh_channelfind(void *av, void *bv)
979 unsigned *a = (unsigned *) av;
980 struct ssh_channel *b = (struct ssh_channel *) bv;
988 static int ssh_rportcmp_ssh1(void *av, void *bv)
990 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
991 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
993 if ( (i = strcmp(a->dhost, b->dhost)) != 0)
994 return i < 0 ? -1 : +1;
995 if (a->dport > b->dport)
997 if (a->dport < b->dport)
1002 static int ssh_rportcmp_ssh2(void *av, void *bv)
1004 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
1005 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
1007 if (a->sport > b->sport)
1009 if (a->sport < b->sport)
1015 * Special form of strcmp which can cope with NULL inputs. NULL is
1016 * defined to sort before even the empty string.
1018 static int nullstrcmp(const char *a, const char *b)
1020 if (a == NULL && b == NULL)
1026 return strcmp(a, b);
1029 static int ssh_portcmp(void *av, void *bv)
1031 struct ssh_portfwd *a = (struct ssh_portfwd *) av;
1032 struct ssh_portfwd *b = (struct ssh_portfwd *) bv;
1034 if (a->type > b->type)
1036 if (a->type < b->type)
1038 if (a->addressfamily > b->addressfamily)
1040 if (a->addressfamily < b->addressfamily)
1042 if ( (i = nullstrcmp(a->saddr, b->saddr)) != 0)
1043 return i < 0 ? -1 : +1;
1044 if (a->sport > b->sport)
1046 if (a->sport < b->sport)
1048 if (a->type != 'D') {
1049 if ( (i = nullstrcmp(a->daddr, b->daddr)) != 0)
1050 return i < 0 ? -1 : +1;
1051 if (a->dport > b->dport)
1053 if (a->dport < b->dport)
1059 static int alloc_channel_id(Ssh ssh)
1061 const unsigned CHANNEL_NUMBER_OFFSET = 256;
1062 unsigned low, high, mid;
1064 struct ssh_channel *c;
1067 * First-fit allocation of channel numbers: always pick the
1068 * lowest unused one. To do this, binary-search using the
1069 * counted B-tree to find the largest channel ID which is in a
1070 * contiguous sequence from the beginning. (Precisely
1071 * everything in that sequence must have ID equal to its tree
1072 * index plus CHANNEL_NUMBER_OFFSET.)
1074 tsize = count234(ssh->channels);
1078 while (high - low > 1) {
1079 mid = (high + low) / 2;
1080 c = index234(ssh->channels, mid);
1081 if (c->localid == mid + CHANNEL_NUMBER_OFFSET)
1082 low = mid; /* this one is fine */
1084 high = mid; /* this one is past it */
1087 * Now low points to either -1, or the tree index of the
1088 * largest ID in the initial sequence.
1091 unsigned i = low + 1 + CHANNEL_NUMBER_OFFSET;
1092 assert(NULL == find234(ssh->channels, &i, ssh_channelfind));
1094 return low + 1 + CHANNEL_NUMBER_OFFSET;
1097 static void c_write_stderr(int trusted, const char *buf, int len)
1100 for (i = 0; i < len; i++)
1101 if (buf[i] != '\r' && (trusted || buf[i] == '\n' || (buf[i] & 0x60)))
1102 fputc(buf[i], stderr);
1105 static void c_write(Ssh ssh, const char *buf, int len)
1107 if (flags & FLAG_STDERR)
1108 c_write_stderr(1, buf, len);
1110 from_backend(ssh->frontend, 1, buf, len);
1113 static void c_write_untrusted(Ssh ssh, const char *buf, int len)
1115 if (flags & FLAG_STDERR)
1116 c_write_stderr(0, buf, len);
1118 from_backend_untrusted(ssh->frontend, buf, len);
1121 static void c_write_str(Ssh ssh, const char *buf)
1123 c_write(ssh, buf, strlen(buf));
1126 static void ssh_free_packet(struct Packet *pkt)
1131 static struct Packet *ssh_new_packet(void)
1133 struct Packet *pkt = snew(struct Packet);
1135 pkt->body = pkt->data = NULL;
1137 pkt->logmode = PKTLOG_EMIT;
1145 * Collect incoming data in the incoming packet buffer.
1146 * Decipher and verify the packet when it is completely read.
1147 * Drop SSH1_MSG_DEBUG and SSH1_MSG_IGNORE packets.
1148 * Update the *data and *datalen variables.
1149 * Return a Packet structure when a packet is completed.
1151 static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
1153 struct rdpkt1_state_tag *st = &ssh->rdpkt1_state;
1155 crBegin(ssh->ssh1_rdpkt_crstate);
1157 st->pktin = ssh_new_packet();
1159 st->pktin->type = 0;
1160 st->pktin->length = 0;
1162 for (st->i = st->len = 0; st->i < 4; st->i++) {
1163 while ((*datalen) == 0)
1165 st->len = (st->len << 8) + **data;
1166 (*data)++, (*datalen)--;
1169 st->pad = 8 - (st->len % 8);
1170 st->biglen = st->len + st->pad;
1171 st->pktin->length = st->len - 5;
1173 if (st->biglen < 0) {
1174 bombout(("Extremely large packet length from server suggests"
1175 " data stream corruption"));
1176 ssh_free_packet(st->pktin);
1180 st->pktin->maxlen = st->biglen;
1181 st->pktin->data = snewn(st->biglen + APIEXTRA, unsigned char);
1183 st->to_read = st->biglen;
1184 st->p = st->pktin->data;
1185 while (st->to_read > 0) {
1186 st->chunk = st->to_read;
1187 while ((*datalen) == 0)
1189 if (st->chunk > (*datalen))
1190 st->chunk = (*datalen);
1191 memcpy(st->p, *data, st->chunk);
1193 *datalen -= st->chunk;
1195 st->to_read -= st->chunk;
1198 if (ssh->cipher && detect_attack(ssh->crcda_ctx, st->pktin->data,
1199 st->biglen, NULL)) {
1200 bombout(("Network attack (CRC compensation) detected!"));
1201 ssh_free_packet(st->pktin);
1206 ssh->cipher->decrypt(ssh->v1_cipher_ctx, st->pktin->data, st->biglen);
1208 st->realcrc = crc32_compute(st->pktin->data, st->biglen - 4);
1209 st->gotcrc = GET_32BIT(st->pktin->data + st->biglen - 4);
1210 if (st->gotcrc != st->realcrc) {
1211 bombout(("Incorrect CRC received on packet"));
1212 ssh_free_packet(st->pktin);
1216 st->pktin->body = st->pktin->data + st->pad + 1;
1217 st->pktin->savedpos = 0;
1219 if (ssh->v1_compressing) {
1220 unsigned char *decompblk;
1222 if (!zlib_decompress_block(ssh->sc_comp_ctx,
1223 st->pktin->body - 1, st->pktin->length + 1,
1224 &decompblk, &decomplen)) {
1225 bombout(("Zlib decompression encountered invalid data"));
1226 ssh_free_packet(st->pktin);
1230 if (st->pktin->maxlen < st->pad + decomplen) {
1231 st->pktin->maxlen = st->pad + decomplen;
1232 st->pktin->data = sresize(st->pktin->data,
1233 st->pktin->maxlen + APIEXTRA,
1235 st->pktin->body = st->pktin->data + st->pad + 1;
1238 memcpy(st->pktin->body - 1, decompblk, decomplen);
1240 st->pktin->length = decomplen - 1;
1243 st->pktin->type = st->pktin->body[-1];
1246 * Log incoming packet, possibly omitting sensitive fields.
1250 struct logblank_t blank;
1251 if (ssh->cfg.logomitdata) {
1252 int do_blank = FALSE, blank_prefix = 0;
1253 /* "Session data" packets - omit the data field */
1254 if ((st->pktin->type == SSH1_SMSG_STDOUT_DATA) ||
1255 (st->pktin->type == SSH1_SMSG_STDERR_DATA)) {
1256 do_blank = TRUE; blank_prefix = 4;
1257 } else if (st->pktin->type == SSH1_MSG_CHANNEL_DATA) {
1258 do_blank = TRUE; blank_prefix = 8;
1261 blank.offset = blank_prefix;
1262 blank.len = st->pktin->length;
1263 blank.type = PKTLOG_OMIT;
1267 log_packet(ssh->logctx,
1268 PKT_INCOMING, st->pktin->type,
1269 ssh1_pkt_type(st->pktin->type),
1270 st->pktin->body, st->pktin->length,
1274 crFinish(st->pktin);
1277 static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
1279 struct rdpkt2_state_tag *st = &ssh->rdpkt2_state;
1281 crBegin(ssh->ssh2_rdpkt_crstate);
1283 st->pktin = ssh_new_packet();
1285 st->pktin->type = 0;
1286 st->pktin->length = 0;
1288 st->cipherblk = ssh->sccipher->blksize;
1291 if (st->cipherblk < 8)
1294 st->pktin->data = snewn(st->cipherblk + APIEXTRA, unsigned char);
1297 * Acquire and decrypt the first block of the packet. This will
1298 * contain the length and padding details.
1300 for (st->i = st->len = 0; st->i < st->cipherblk; st->i++) {
1301 while ((*datalen) == 0)
1303 st->pktin->data[st->i] = *(*data)++;
1308 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1309 st->pktin->data, st->cipherblk);
1312 * Now get the length and padding figures.
1314 st->len = GET_32BIT(st->pktin->data);
1315 st->pad = st->pktin->data[4];
1318 * _Completely_ silly lengths should be stomped on before they
1319 * do us any more damage.
1321 if (st->len < 0 || st->len > 35000 || st->pad < 4 ||
1322 st->len - st->pad < 1 || (st->len + 4) % st->cipherblk != 0) {
1323 bombout(("Incoming packet was garbled on decryption"));
1324 ssh_free_packet(st->pktin);
1329 * This enables us to deduce the payload length.
1331 st->payload = st->len - st->pad - 1;
1333 st->pktin->length = st->payload + 5;
1336 * So now we can work out the total packet length.
1338 st->packetlen = st->len + 4;
1339 st->maclen = ssh->scmac ? ssh->scmac->len : 0;
1342 * Allocate memory for the rest of the packet.
1344 st->pktin->maxlen = st->packetlen + st->maclen;
1345 st->pktin->data = sresize(st->pktin->data,
1346 st->pktin->maxlen + APIEXTRA,
1350 * Read and decrypt the remainder of the packet.
1352 for (st->i = st->cipherblk; st->i < st->packetlen + st->maclen;
1354 while ((*datalen) == 0)
1356 st->pktin->data[st->i] = *(*data)++;
1359 /* Decrypt everything _except_ the MAC. */
1361 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1362 st->pktin->data + st->cipherblk,
1363 st->packetlen - st->cipherblk);
1365 st->pktin->encrypted_len = st->packetlen;
1371 && !ssh->scmac->verify(ssh->sc_mac_ctx, st->pktin->data, st->len + 4,
1372 st->incoming_sequence)) {
1373 bombout(("Incorrect MAC received on packet"));
1374 ssh_free_packet(st->pktin);
1378 st->pktin->sequence = st->incoming_sequence++;
1381 * Decompress packet payload.
1384 unsigned char *newpayload;
1387 ssh->sccomp->decompress(ssh->sc_comp_ctx,
1388 st->pktin->data + 5, st->pktin->length - 5,
1389 &newpayload, &newlen)) {
1390 if (st->pktin->maxlen < newlen + 5) {
1391 st->pktin->maxlen = newlen + 5;
1392 st->pktin->data = sresize(st->pktin->data,
1393 st->pktin->maxlen + APIEXTRA,
1396 st->pktin->length = 5 + newlen;
1397 memcpy(st->pktin->data + 5, newpayload, newlen);
1402 st->pktin->savedpos = 6;
1403 st->pktin->body = st->pktin->data;
1404 st->pktin->type = st->pktin->data[5];
1407 * Log incoming packet, possibly omitting sensitive fields.
1411 struct logblank_t blank;
1412 if (ssh->cfg.logomitdata) {
1413 int do_blank = FALSE, blank_prefix = 0;
1414 /* "Session data" packets - omit the data field */
1415 if (st->pktin->type == SSH2_MSG_CHANNEL_DATA) {
1416 do_blank = TRUE; blank_prefix = 8;
1417 } else if (st->pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA) {
1418 do_blank = TRUE; blank_prefix = 12;
1421 blank.offset = blank_prefix;
1422 blank.len = (st->pktin->length-6) - blank_prefix;
1423 blank.type = PKTLOG_OMIT;
1427 log_packet(ssh->logctx, PKT_INCOMING, st->pktin->type,
1428 ssh2_pkt_type(ssh->pkt_kctx, ssh->pkt_actx,
1430 st->pktin->data+6, st->pktin->length-6,
1434 crFinish(st->pktin);
1437 static int s_wrpkt_prepare(Ssh ssh, struct Packet *pkt, int *offset_p)
1439 int pad, biglen, i, pktoffs;
1443 * XXX various versions of SC (including 8.8.4) screw up the
1444 * register allocation in this function and use the same register
1445 * (D6) for len and as a temporary, with predictable results. The
1446 * following sledgehammer prevents this.
1453 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[12],
1454 ssh1_pkt_type(pkt->data[12]),
1455 pkt->body, pkt->length - (pkt->body - pkt->data),
1456 pkt->nblanks, pkt->blanks);
1457 sfree(pkt->blanks); pkt->blanks = NULL;
1460 if (ssh->v1_compressing) {
1461 unsigned char *compblk;
1463 zlib_compress_block(ssh->cs_comp_ctx,
1464 pkt->data + 12, pkt->length - 12,
1465 &compblk, &complen);
1466 ssh_pkt_ensure(pkt, complen + 2); /* just in case it's got bigger */
1467 memcpy(pkt->data + 12, compblk, complen);
1469 pkt->length = complen + 12;
1472 ssh_pkt_ensure(pkt, pkt->length + 4); /* space for CRC */
1474 len = pkt->length - 4 - 8; /* len(type+data+CRC) */
1475 pad = 8 - (len % 8);
1477 biglen = len + pad; /* len(padding+type+data+CRC) */
1479 for (i = pktoffs; i < 4+8; i++)
1480 pkt->data[i] = random_byte();
1481 crc = crc32_compute(pkt->data + pktoffs + 4, biglen - 4); /* all ex len */
1482 PUT_32BIT(pkt->data + pktoffs + 4 + biglen - 4, crc);
1483 PUT_32BIT(pkt->data + pktoffs, len);
1486 ssh->cipher->encrypt(ssh->v1_cipher_ctx,
1487 pkt->data + pktoffs + 4, biglen);
1489 if (offset_p) *offset_p = pktoffs;
1490 return biglen + 4; /* len(length+padding+type+data+CRC) */
1493 static int s_write(Ssh ssh, void *data, int len)
1496 log_packet(ssh->logctx, PKT_OUTGOING, -1, NULL, data, len, 0, NULL);
1497 return sk_write(ssh->s, (char *)data, len);
1500 static void s_wrpkt(Ssh ssh, struct Packet *pkt)
1502 int len, backlog, offset;
1503 len = s_wrpkt_prepare(ssh, pkt, &offset);
1504 backlog = s_write(ssh, pkt->data + offset, len);
1505 if (backlog > SSH_MAX_BACKLOG)
1506 ssh_throttle_all(ssh, 1, backlog);
1507 ssh_free_packet(pkt);
1510 static void s_wrpkt_defer(Ssh ssh, struct Packet *pkt)
1513 len = s_wrpkt_prepare(ssh, pkt, &offset);
1514 if (ssh->deferred_len + len > ssh->deferred_size) {
1515 ssh->deferred_size = ssh->deferred_len + len + 128;
1516 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
1520 memcpy(ssh->deferred_send_data + ssh->deferred_len,
1521 pkt->data + offset, len);
1522 ssh->deferred_len += len;
1523 ssh_free_packet(pkt);
1527 * Construct a SSH-1 packet with the specified contents.
1528 * (This all-at-once interface used to be the only one, but now SSH-1
1529 * packets can also be constructed incrementally.)
1531 static struct Packet *construct_packet(Ssh ssh, int pkttype, va_list ap)
1537 pkt = ssh1_pkt_init(pkttype);
1539 while ((argtype = va_arg(ap, int)) != PKT_END) {
1540 unsigned char *argp, argchar;
1542 unsigned long argint;
1545 /* Actual fields in the packet */
1547 argint = va_arg(ap, int);
1548 ssh_pkt_adduint32(pkt, argint);
1551 argchar = (unsigned char) va_arg(ap, int);
1552 ssh_pkt_addbyte(pkt, argchar);
1555 argp = va_arg(ap, unsigned char *);
1556 arglen = va_arg(ap, int);
1557 ssh_pkt_adddata(pkt, argp, arglen);
1560 sargp = va_arg(ap, char *);
1561 ssh_pkt_addstring(pkt, sargp);
1564 bn = va_arg(ap, Bignum);
1565 ssh1_pkt_addmp(pkt, bn);
1567 /* Tokens for modifications to packet logging */
1569 dont_log_password(ssh, pkt, PKTLOG_BLANK);
1572 dont_log_data(ssh, pkt, PKTLOG_OMIT);
1575 end_log_omission(ssh, pkt);
1583 static void send_packet(Ssh ssh, int pkttype, ...)
1587 va_start(ap, pkttype);
1588 pkt = construct_packet(ssh, pkttype, ap);
1593 static void defer_packet(Ssh ssh, int pkttype, ...)
1597 va_start(ap, pkttype);
1598 pkt = construct_packet(ssh, pkttype, ap);
1600 s_wrpkt_defer(ssh, pkt);
1603 static int ssh_versioncmp(char *a, char *b)
1606 unsigned long av, bv;
1608 av = strtoul(a, &ae, 10);
1609 bv = strtoul(b, &be, 10);
1611 return (av < bv ? -1 : +1);
1616 av = strtoul(ae, &ae, 10);
1617 bv = strtoul(be, &be, 10);
1619 return (av < bv ? -1 : +1);
1624 * Utility routines for putting an SSH-protocol `string' and
1625 * `uint32' into a hash state.
1627 static void hash_string(const struct ssh_hash *h, void *s, void *str, int len)
1629 unsigned char lenblk[4];
1630 PUT_32BIT(lenblk, len);
1631 h->bytes(s, lenblk, 4);
1632 h->bytes(s, str, len);
1635 static void hash_uint32(const struct ssh_hash *h, void *s, unsigned i)
1637 unsigned char intblk[4];
1638 PUT_32BIT(intblk, i);
1639 h->bytes(s, intblk, 4);
1643 * Packet construction functions. Mostly shared between SSH-1 and SSH-2.
1645 static void ssh_pkt_ensure(struct Packet *pkt, int length)
1647 if (pkt->maxlen < length) {
1648 unsigned char *body = pkt->body;
1649 int offset = body ? body - pkt->data : 0;
1650 pkt->maxlen = length + 256;
1651 pkt->data = sresize(pkt->data, pkt->maxlen + APIEXTRA, unsigned char);
1652 if (body) pkt->body = pkt->data + offset;
1655 static void ssh_pkt_adddata(struct Packet *pkt, void *data, int len)
1657 if (pkt->logmode != PKTLOG_EMIT) {
1659 pkt->blanks = sresize(pkt->blanks, pkt->nblanks, struct logblank_t);
1661 pkt->blanks[pkt->nblanks-1].offset = pkt->length -
1662 (pkt->body - pkt->data);
1663 pkt->blanks[pkt->nblanks-1].len = len;
1664 pkt->blanks[pkt->nblanks-1].type = pkt->logmode;
1667 ssh_pkt_ensure(pkt, pkt->length);
1668 memcpy(pkt->data + pkt->length - len, data, len);
1670 static void ssh_pkt_addbyte(struct Packet *pkt, unsigned char byte)
1672 ssh_pkt_adddata(pkt, &byte, 1);
1674 static void ssh2_pkt_addbool(struct Packet *pkt, unsigned char value)
1676 ssh_pkt_adddata(pkt, &value, 1);
1678 static void ssh_pkt_adduint32(struct Packet *pkt, unsigned long value)
1681 PUT_32BIT(x, value);
1682 ssh_pkt_adddata(pkt, x, 4);
1684 static void ssh_pkt_addstring_start(struct Packet *pkt)
1686 ssh_pkt_adduint32(pkt, 0);
1687 pkt->savedpos = pkt->length;
1689 static void ssh_pkt_addstring_str(struct Packet *pkt, char *data)
1691 ssh_pkt_adddata(pkt, data, strlen(data));
1692 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
1694 static void ssh_pkt_addstring_data(struct Packet *pkt, char *data, int len)
1696 ssh_pkt_adddata(pkt, data, len);
1697 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
1699 static void ssh_pkt_addstring(struct Packet *pkt, char *data)
1701 ssh_pkt_addstring_start(pkt);
1702 ssh_pkt_addstring_str(pkt, data);
1704 static void ssh1_pkt_addmp(struct Packet *pkt, Bignum b)
1706 int len = ssh1_bignum_length(b);
1707 unsigned char *data = snewn(len, unsigned char);
1708 (void) ssh1_write_bignum(data, b);
1709 ssh_pkt_adddata(pkt, data, len);
1712 static unsigned char *ssh2_mpint_fmt(Bignum b, int *len)
1715 int i, n = (bignum_bitcount(b) + 7) / 8;
1716 p = snewn(n + 1, unsigned char);
1718 for (i = 1; i <= n; i++)
1719 p[i] = bignum_byte(b, n - i);
1721 while (i <= n && p[i] == 0 && (p[i + 1] & 0x80) == 0)
1723 memmove(p, p + i, n + 1 - i);
1727 static void ssh2_pkt_addmp(struct Packet *pkt, Bignum b)
1731 p = ssh2_mpint_fmt(b, &len);
1732 ssh_pkt_addstring_start(pkt);
1733 ssh_pkt_addstring_data(pkt, (char *)p, len);
1737 static struct Packet *ssh1_pkt_init(int pkt_type)
1739 struct Packet *pkt = ssh_new_packet();
1740 pkt->length = 4 + 8; /* space for length + max padding */
1741 ssh_pkt_addbyte(pkt, pkt_type);
1742 pkt->body = pkt->data + pkt->length;
1746 /* For legacy code (SSH-1 and -2 packet construction used to be separate) */
1747 #define ssh2_pkt_ensure(pkt, length) ssh_pkt_ensure(pkt, length)
1748 #define ssh2_pkt_adddata(pkt, data, len) ssh_pkt_adddata(pkt, data, len)
1749 #define ssh2_pkt_addbyte(pkt, byte) ssh_pkt_addbyte(pkt, byte)
1750 #define ssh2_pkt_adduint32(pkt, value) ssh_pkt_adduint32(pkt, value)
1751 #define ssh2_pkt_addstring_start(pkt) ssh_pkt_addstring_start(pkt)
1752 #define ssh2_pkt_addstring_str(pkt, data) ssh_pkt_addstring_str(pkt, data)
1753 #define ssh2_pkt_addstring_data(pkt, data, len) ssh_pkt_addstring_data(pkt, data, len)
1754 #define ssh2_pkt_addstring(pkt, data) ssh_pkt_addstring(pkt, data)
1756 static struct Packet *ssh2_pkt_init(int pkt_type)
1758 struct Packet *pkt = ssh_new_packet();
1759 pkt->length = 5; /* space for packet length + padding length */
1761 ssh_pkt_addbyte(pkt, (unsigned char) pkt_type);
1762 pkt->body = pkt->data + pkt->length; /* after packet type */
1767 * Construct an SSH-2 final-form packet: compress it, encrypt it,
1768 * put the MAC on it. Final packet, ready to be sent, is stored in
1769 * pkt->data. Total length is returned.
1771 static int ssh2_pkt_construct(Ssh ssh, struct Packet *pkt)
1773 int cipherblk, maclen, padding, i;
1776 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[5],
1777 ssh2_pkt_type(ssh->pkt_kctx, ssh->pkt_actx, pkt->data[5]),
1778 pkt->body, pkt->length - (pkt->body - pkt->data),
1779 pkt->nblanks, pkt->blanks);
1780 sfree(pkt->blanks); pkt->blanks = NULL;
1784 * Compress packet payload.
1787 unsigned char *newpayload;
1790 ssh->cscomp->compress(ssh->cs_comp_ctx, pkt->data + 5,
1792 &newpayload, &newlen)) {
1794 ssh2_pkt_adddata(pkt, newpayload, newlen);
1800 * Add padding. At least four bytes, and must also bring total
1801 * length (minus MAC) up to a multiple of the block size.
1802 * If pkt->forcepad is set, make sure the packet is at least that size
1805 cipherblk = ssh->cscipher ? ssh->cscipher->blksize : 8; /* block size */
1806 cipherblk = cipherblk < 8 ? 8 : cipherblk; /* or 8 if blksize < 8 */
1808 if (pkt->length + padding < pkt->forcepad)
1809 padding = pkt->forcepad - pkt->length;
1811 (cipherblk - (pkt->length + padding) % cipherblk) % cipherblk;
1812 assert(padding <= 255);
1813 maclen = ssh->csmac ? ssh->csmac->len : 0;
1814 ssh2_pkt_ensure(pkt, pkt->length + padding + maclen);
1815 pkt->data[4] = padding;
1816 for (i = 0; i < padding; i++)
1817 pkt->data[pkt->length + i] = random_byte();
1818 PUT_32BIT(pkt->data, pkt->length + padding - 4);
1820 ssh->csmac->generate(ssh->cs_mac_ctx, pkt->data,
1821 pkt->length + padding,
1822 ssh->v2_outgoing_sequence);
1823 ssh->v2_outgoing_sequence++; /* whether or not we MACed */
1826 ssh->cscipher->encrypt(ssh->cs_cipher_ctx,
1827 pkt->data, pkt->length + padding);
1829 pkt->encrypted_len = pkt->length + padding;
1831 /* Ready-to-send packet starts at pkt->data. We return length. */
1832 return pkt->length + padding + maclen;
1836 * Routines called from the main SSH code to send packets. There
1837 * are quite a few of these, because we have two separate
1838 * mechanisms for delaying the sending of packets:
1840 * - In order to send an IGNORE message and a password message in
1841 * a single fixed-length blob, we require the ability to
1842 * concatenate the encrypted forms of those two packets _into_ a
1843 * single blob and then pass it to our <network.h> transport
1844 * layer in one go. Hence, there's a deferment mechanism which
1845 * works after packet encryption.
1847 * - In order to avoid sending any connection-layer messages
1848 * during repeat key exchange, we have to queue up any such
1849 * outgoing messages _before_ they are encrypted (and in
1850 * particular before they're allocated sequence numbers), and
1851 * then send them once we've finished.
1853 * I call these mechanisms `defer' and `queue' respectively, so as
1854 * to distinguish them reasonably easily.
1856 * The functions send_noqueue() and defer_noqueue() free the packet
1857 * structure they are passed. Every outgoing packet goes through
1858 * precisely one of these functions in its life; packets passed to
1859 * ssh2_pkt_send() or ssh2_pkt_defer() either go straight to one of
1860 * these or get queued, and then when the queue is later emptied
1861 * the packets are all passed to defer_noqueue().
1863 * When using a CBC-mode cipher, it's necessary to ensure that an
1864 * attacker can't provide data to be encrypted using an IV that they
1865 * know. We ensure this by prefixing each packet that might contain
1866 * user data with an SSH_MSG_IGNORE. This is done using the deferral
1867 * mechanism, so in this case send_noqueue() ends up redirecting to
1868 * defer_noqueue(). If you don't like this inefficiency, don't use
1872 static void ssh2_pkt_defer_noqueue(Ssh, struct Packet *, int);
1873 static void ssh_pkt_defersend(Ssh);
1876 * Send an SSH-2 packet immediately, without queuing or deferring.
1878 static void ssh2_pkt_send_noqueue(Ssh ssh, struct Packet *pkt)
1882 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC)) {
1883 /* We need to send two packets, so use the deferral mechanism. */
1884 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
1885 ssh_pkt_defersend(ssh);
1888 len = ssh2_pkt_construct(ssh, pkt);
1889 backlog = s_write(ssh, pkt->data, len);
1890 if (backlog > SSH_MAX_BACKLOG)
1891 ssh_throttle_all(ssh, 1, backlog);
1893 ssh->outgoing_data_size += pkt->encrypted_len;
1894 if (!ssh->kex_in_progress &&
1895 ssh->max_data_size != 0 &&
1896 ssh->outgoing_data_size > ssh->max_data_size)
1897 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
1899 ssh_free_packet(pkt);
1903 * Defer an SSH-2 packet.
1905 static void ssh2_pkt_defer_noqueue(Ssh ssh, struct Packet *pkt, int noignore)
1908 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC) &&
1909 ssh->deferred_len == 0 && !noignore) {
1911 * Interpose an SSH_MSG_IGNORE to ensure that user data don't
1912 * get encrypted with a known IV.
1914 struct Packet *ipkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
1915 ssh2_pkt_addstring_start(ipkt);
1916 ssh2_pkt_defer_noqueue(ssh, ipkt, TRUE);
1918 len = ssh2_pkt_construct(ssh, pkt);
1919 if (ssh->deferred_len + len > ssh->deferred_size) {
1920 ssh->deferred_size = ssh->deferred_len + len + 128;
1921 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
1925 memcpy(ssh->deferred_send_data + ssh->deferred_len, pkt->data, len);
1926 ssh->deferred_len += len;
1927 ssh->deferred_data_size += pkt->encrypted_len;
1928 ssh_free_packet(pkt);
1932 * Queue an SSH-2 packet.
1934 static void ssh2_pkt_queue(Ssh ssh, struct Packet *pkt)
1936 assert(ssh->queueing);
1938 if (ssh->queuelen >= ssh->queuesize) {
1939 ssh->queuesize = ssh->queuelen + 32;
1940 ssh->queue = sresize(ssh->queue, ssh->queuesize, struct Packet *);
1943 ssh->queue[ssh->queuelen++] = pkt;
1947 * Either queue or send a packet, depending on whether queueing is
1950 static void ssh2_pkt_send(Ssh ssh, struct Packet *pkt)
1953 ssh2_pkt_queue(ssh, pkt);
1955 ssh2_pkt_send_noqueue(ssh, pkt);
1959 * Either queue or defer a packet, depending on whether queueing is
1962 static void ssh2_pkt_defer(Ssh ssh, struct Packet *pkt)
1965 ssh2_pkt_queue(ssh, pkt);
1967 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
1971 * Send the whole deferred data block constructed by
1972 * ssh2_pkt_defer() or SSH-1's defer_packet().
1974 * The expected use of the defer mechanism is that you call
1975 * ssh2_pkt_defer() a few times, then call ssh_pkt_defersend(). If
1976 * not currently queueing, this simply sets up deferred_send_data
1977 * and then sends it. If we _are_ currently queueing, the calls to
1978 * ssh2_pkt_defer() put the deferred packets on to the queue
1979 * instead, and therefore ssh_pkt_defersend() has no deferred data
1980 * to send. Hence, there's no need to make it conditional on
1983 static void ssh_pkt_defersend(Ssh ssh)
1986 backlog = s_write(ssh, ssh->deferred_send_data, ssh->deferred_len);
1987 ssh->deferred_len = ssh->deferred_size = 0;
1988 sfree(ssh->deferred_send_data);
1989 ssh->deferred_send_data = NULL;
1990 if (backlog > SSH_MAX_BACKLOG)
1991 ssh_throttle_all(ssh, 1, backlog);
1993 ssh->outgoing_data_size += ssh->deferred_data_size;
1994 if (!ssh->kex_in_progress &&
1995 ssh->max_data_size != 0 &&
1996 ssh->outgoing_data_size > ssh->max_data_size)
1997 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
1998 ssh->deferred_data_size = 0;
2002 * Send a packet whose length needs to be disguised (typically
2003 * passwords or keyboard-interactive responses).
2005 static void ssh2_pkt_send_with_padding(Ssh ssh, struct Packet *pkt,
2011 * The simplest way to do this is to adjust the
2012 * variable-length padding field in the outgoing packet.
2014 * Currently compiled out, because some Cisco SSH servers
2015 * don't like excessively padded packets (bah, why's it
2018 pkt->forcepad = padsize;
2019 ssh2_pkt_send(ssh, pkt);
2024 * If we can't do that, however, an alternative approach is
2025 * to use the pkt_defer mechanism to bundle the packet
2026 * tightly together with an SSH_MSG_IGNORE such that their
2027 * combined length is a constant. So first we construct the
2028 * final form of this packet and defer its sending.
2030 ssh2_pkt_defer(ssh, pkt);
2033 * Now construct an SSH_MSG_IGNORE which includes a string
2034 * that's an exact multiple of the cipher block size. (If
2035 * the cipher is NULL so that the block size is
2036 * unavailable, we don't do this trick at all, because we
2037 * gain nothing by it.)
2039 if (ssh->cscipher) {
2042 stringlen = (256 - ssh->deferred_len);
2043 stringlen += ssh->cscipher->blksize - 1;
2044 stringlen -= (stringlen % ssh->cscipher->blksize);
2047 * Temporarily disable actual compression, so we
2048 * can guarantee to get this string exactly the
2049 * length we want it. The compression-disabling
2050 * routine should return an integer indicating how
2051 * many bytes we should adjust our string length
2055 ssh->cscomp->disable_compression(ssh->cs_comp_ctx);
2057 pkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
2058 ssh2_pkt_addstring_start(pkt);
2059 for (i = 0; i < stringlen; i++) {
2060 char c = (char) random_byte();
2061 ssh2_pkt_addstring_data(pkt, &c, 1);
2063 ssh2_pkt_defer(ssh, pkt);
2065 ssh_pkt_defersend(ssh);
2070 * Send all queued SSH-2 packets. We send them by means of
2071 * ssh2_pkt_defer_noqueue(), in case they included a pair of
2072 * packets that needed to be lumped together.
2074 static void ssh2_pkt_queuesend(Ssh ssh)
2078 assert(!ssh->queueing);
2080 for (i = 0; i < ssh->queuelen; i++)
2081 ssh2_pkt_defer_noqueue(ssh, ssh->queue[i], FALSE);
2084 ssh_pkt_defersend(ssh);
2088 void bndebug(char *string, Bignum b)
2092 p = ssh2_mpint_fmt(b, &len);
2093 debug(("%s", string));
2094 for (i = 0; i < len; i++)
2095 debug((" %02x", p[i]));
2101 static void hash_mpint(const struct ssh_hash *h, void *s, Bignum b)
2105 p = ssh2_mpint_fmt(b, &len);
2106 hash_string(h, s, p, len);
2111 * Packet decode functions for both SSH-1 and SSH-2.
2113 static unsigned long ssh_pkt_getuint32(struct Packet *pkt)
2115 unsigned long value;
2116 if (pkt->length - pkt->savedpos < 4)
2117 return 0; /* arrgh, no way to decline (FIXME?) */
2118 value = GET_32BIT(pkt->body + pkt->savedpos);
2122 static int ssh2_pkt_getbool(struct Packet *pkt)
2124 unsigned long value;
2125 if (pkt->length - pkt->savedpos < 1)
2126 return 0; /* arrgh, no way to decline (FIXME?) */
2127 value = pkt->body[pkt->savedpos] != 0;
2131 static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length)
2136 if (pkt->length - pkt->savedpos < 4)
2138 len = GET_32BIT(pkt->body + pkt->savedpos);
2143 if (pkt->length - pkt->savedpos < *length)
2145 *p = (char *)(pkt->body + pkt->savedpos);
2146 pkt->savedpos += *length;
2148 static void *ssh_pkt_getdata(struct Packet *pkt, int length)
2150 if (pkt->length - pkt->savedpos < length)
2152 pkt->savedpos += length;
2153 return pkt->body + (pkt->savedpos - length);
2155 static int ssh1_pkt_getrsakey(struct Packet *pkt, struct RSAKey *key,
2156 unsigned char **keystr)
2160 j = makekey(pkt->body + pkt->savedpos,
2161 pkt->length - pkt->savedpos,
2168 assert(pkt->savedpos < pkt->length);
2172 static Bignum ssh1_pkt_getmp(struct Packet *pkt)
2177 j = ssh1_read_bignum(pkt->body + pkt->savedpos,
2178 pkt->length - pkt->savedpos, &b);
2186 static Bignum ssh2_pkt_getmp(struct Packet *pkt)
2192 ssh_pkt_getstring(pkt, &p, &length);
2197 b = bignum_from_bytes((unsigned char *)p, length);
2202 * Helper function to add an SSH-2 signature blob to a packet.
2203 * Expects to be shown the public key blob as well as the signature
2204 * blob. Normally works just like ssh2_pkt_addstring, but will
2205 * fiddle with the signature packet if necessary for
2206 * BUG_SSH2_RSA_PADDING.
2208 static void ssh2_add_sigblob(Ssh ssh, struct Packet *pkt,
2209 void *pkblob_v, int pkblob_len,
2210 void *sigblob_v, int sigblob_len)
2212 unsigned char *pkblob = (unsigned char *)pkblob_v;
2213 unsigned char *sigblob = (unsigned char *)sigblob_v;
2215 /* dmemdump(pkblob, pkblob_len); */
2216 /* dmemdump(sigblob, sigblob_len); */
2219 * See if this is in fact an ssh-rsa signature and a buggy
2220 * server; otherwise we can just do this the easy way.
2222 if ((ssh->remote_bugs & BUG_SSH2_RSA_PADDING) &&
2223 (GET_32BIT(pkblob) == 7 && !memcmp(pkblob+4, "ssh-rsa", 7))) {
2224 int pos, len, siglen;
2227 * Find the byte length of the modulus.
2230 pos = 4+7; /* skip over "ssh-rsa" */
2231 pos += 4 + GET_32BIT(pkblob+pos); /* skip over exponent */
2232 len = GET_32BIT(pkblob+pos); /* find length of modulus */
2233 pos += 4; /* find modulus itself */
2234 while (len > 0 && pkblob[pos] == 0)
2236 /* debug(("modulus length is %d\n", len)); */
2239 * Now find the signature integer.
2241 pos = 4+7; /* skip over "ssh-rsa" */
2242 siglen = GET_32BIT(sigblob+pos);
2243 /* debug(("signature length is %d\n", siglen)); */
2245 if (len != siglen) {
2246 unsigned char newlen[4];
2247 ssh2_pkt_addstring_start(pkt);
2248 ssh2_pkt_addstring_data(pkt, (char *)sigblob, pos);
2249 /* dmemdump(sigblob, pos); */
2250 pos += 4; /* point to start of actual sig */
2251 PUT_32BIT(newlen, len);
2252 ssh2_pkt_addstring_data(pkt, (char *)newlen, 4);
2253 /* dmemdump(newlen, 4); */
2255 while (len-- > siglen) {
2256 ssh2_pkt_addstring_data(pkt, (char *)newlen, 1);
2257 /* dmemdump(newlen, 1); */
2259 ssh2_pkt_addstring_data(pkt, (char *)(sigblob+pos), siglen);
2260 /* dmemdump(sigblob+pos, siglen); */
2264 /* Otherwise fall through and do it the easy way. */
2267 ssh2_pkt_addstring_start(pkt);
2268 ssh2_pkt_addstring_data(pkt, (char *)sigblob, sigblob_len);
2272 * Examine the remote side's version string and compare it against
2273 * a list of known buggy implementations.
2275 static void ssh_detect_bugs(Ssh ssh, char *vstring)
2277 char *imp; /* pointer to implementation part */
2279 imp += strcspn(imp, "-");
2281 imp += strcspn(imp, "-");
2284 ssh->remote_bugs = 0;
2287 * General notes on server version strings:
2288 * - Not all servers reporting "Cisco-1.25" have all the bugs listed
2289 * here -- in particular, we've heard of one that's perfectly happy
2290 * with SSH1_MSG_IGNOREs -- but this string never seems to change,
2291 * so we can't distinguish them.
2293 if (ssh->cfg.sshbug_ignore1 == FORCE_ON ||
2294 (ssh->cfg.sshbug_ignore1 == AUTO &&
2295 (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
2296 !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
2297 !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25") ||
2298 !strcmp(imp, "OSU_1.4alpha3") || !strcmp(imp, "OSU_1.5alpha4")))) {
2300 * These versions don't support SSH1_MSG_IGNORE, so we have
2301 * to use a different defence against password length
2304 ssh->remote_bugs |= BUG_CHOKES_ON_SSH1_IGNORE;
2305 logevent("We believe remote version has SSH-1 ignore bug");
2308 if (ssh->cfg.sshbug_plainpw1 == FORCE_ON ||
2309 (ssh->cfg.sshbug_plainpw1 == AUTO &&
2310 (!strcmp(imp, "Cisco-1.25") || !strcmp(imp, "OSU_1.4alpha3")))) {
2312 * These versions need a plain password sent; they can't
2313 * handle having a null and a random length of data after
2316 ssh->remote_bugs |= BUG_NEEDS_SSH1_PLAIN_PASSWORD;
2317 logevent("We believe remote version needs a plain SSH-1 password");
2320 if (ssh->cfg.sshbug_rsa1 == FORCE_ON ||
2321 (ssh->cfg.sshbug_rsa1 == AUTO &&
2322 (!strcmp(imp, "Cisco-1.25")))) {
2324 * These versions apparently have no clue whatever about
2325 * RSA authentication and will panic and die if they see
2326 * an AUTH_RSA message.
2328 ssh->remote_bugs |= BUG_CHOKES_ON_RSA;
2329 logevent("We believe remote version can't handle SSH-1 RSA authentication");
2332 if (ssh->cfg.sshbug_hmac2 == FORCE_ON ||
2333 (ssh->cfg.sshbug_hmac2 == AUTO &&
2334 !wc_match("* VShell", imp) &&
2335 (wc_match("2.1.0*", imp) || wc_match("2.0.*", imp) ||
2336 wc_match("2.2.0*", imp) || wc_match("2.3.0*", imp) ||
2337 wc_match("2.1 *", imp)))) {
2339 * These versions have the HMAC bug.
2341 ssh->remote_bugs |= BUG_SSH2_HMAC;
2342 logevent("We believe remote version has SSH-2 HMAC bug");
2345 if (ssh->cfg.sshbug_derivekey2 == FORCE_ON ||
2346 (ssh->cfg.sshbug_derivekey2 == AUTO &&
2347 !wc_match("* VShell", imp) &&
2348 (wc_match("2.0.0*", imp) || wc_match("2.0.10*", imp) ))) {
2350 * These versions have the key-derivation bug (failing to
2351 * include the literal shared secret in the hashes that
2352 * generate the keys).
2354 ssh->remote_bugs |= BUG_SSH2_DERIVEKEY;
2355 logevent("We believe remote version has SSH-2 key-derivation bug");
2358 if (ssh->cfg.sshbug_rsapad2 == FORCE_ON ||
2359 (ssh->cfg.sshbug_rsapad2 == AUTO &&
2360 (wc_match("OpenSSH_2.[5-9]*", imp) ||
2361 wc_match("OpenSSH_3.[0-2]*", imp)))) {
2363 * These versions have the SSH-2 RSA padding bug.
2365 ssh->remote_bugs |= BUG_SSH2_RSA_PADDING;
2366 logevent("We believe remote version has SSH-2 RSA padding bug");
2369 if (ssh->cfg.sshbug_pksessid2 == FORCE_ON ||
2370 (ssh->cfg.sshbug_pksessid2 == AUTO &&
2371 wc_match("OpenSSH_2.[0-2]*", imp))) {
2373 * These versions have the SSH-2 session-ID bug in
2374 * public-key authentication.
2376 ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID;
2377 logevent("We believe remote version has SSH-2 public-key-session-ID bug");
2380 if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
2381 (ssh->cfg.sshbug_rekey2 == AUTO &&
2382 (wc_match("DigiSSH_2.0", imp) ||
2383 wc_match("OpenSSH_2.[0-4]*", imp) ||
2384 wc_match("OpenSSH_2.5.[0-3]*", imp) ||
2385 wc_match("Sun_SSH_1.0", imp) ||
2386 wc_match("Sun_SSH_1.0.1", imp) ||
2387 /* All versions <= 1.2.6 (they changed their format in 1.2.7) */
2388 wc_match("WeOnlyDo-*", imp)))) {
2390 * These versions have the SSH-2 rekey bug.
2392 ssh->remote_bugs |= BUG_SSH2_REKEY;
2393 logevent("We believe remote version has SSH-2 rekey bug");
2396 if (ssh->cfg.sshbug_maxpkt2 == FORCE_ON ||
2397 (ssh->cfg.sshbug_maxpkt2 == AUTO &&
2398 (wc_match("1.36_sshlib GlobalSCAPE", imp)))) {
2400 * This version ignores our makpkt and needs to be throttled.
2402 ssh->remote_bugs |= BUG_SSH2_MAXPKT;
2403 logevent("We believe remote version ignores SSH-2 maximum packet size");
2408 * The `software version' part of an SSH version string is required
2409 * to contain no spaces or minus signs.
2411 static void ssh_fix_verstring(char *str)
2413 /* Eat "SSH-<protoversion>-". */
2414 assert(*str == 'S'); str++;
2415 assert(*str == 'S'); str++;
2416 assert(*str == 'H'); str++;
2417 assert(*str == '-'); str++;
2418 while (*str && *str != '-') str++;
2419 assert(*str == '-'); str++;
2421 /* Convert minus signs and spaces in the remaining string into
2424 if (*str == '-' || *str == ' ')
2431 * Send an appropriate SSH version string.
2433 static void ssh_send_verstring(Ssh ssh, char *svers)
2437 if (ssh->version == 2) {
2439 * Construct a v2 version string.
2441 verstring = dupprintf("SSH-2.0-%s\015\012", sshver);
2444 * Construct a v1 version string.
2446 verstring = dupprintf("SSH-%s-%s\012",
2447 (ssh_versioncmp(svers, "1.5") <= 0 ?
2452 ssh_fix_verstring(verstring);
2454 if (ssh->version == 2) {
2457 * Record our version string.
2459 len = strcspn(verstring, "\015\012");
2460 ssh->v_c = snewn(len + 1, char);
2461 memcpy(ssh->v_c, verstring, len);
2465 logeventf(ssh, "We claim version: %.*s",
2466 strcspn(verstring, "\015\012"), verstring);
2467 s_write(ssh, verstring, strlen(verstring));
2471 static int do_ssh_init(Ssh ssh, unsigned char c)
2473 struct do_ssh_init_state {
2481 crState(do_ssh_init_state);
2483 crBegin(ssh->do_ssh_init_crstate);
2485 /* Search for a line beginning with the string "SSH-" in the input. */
2487 if (c != 'S') goto no;
2489 if (c != 'S') goto no;
2491 if (c != 'H') goto no;
2493 if (c != '-') goto no;
2502 s->vstring = snewn(s->vstrsize, char);
2503 strcpy(s->vstring, "SSH-");
2507 crReturn(1); /* get another char */
2508 if (s->vslen >= s->vstrsize - 1) {
2510 s->vstring = sresize(s->vstring, s->vstrsize, char);
2512 s->vstring[s->vslen++] = c;
2515 s->version[s->i] = '\0';
2517 } else if (s->i < sizeof(s->version) - 1)
2518 s->version[s->i++] = c;
2519 } else if (c == '\012')
2523 ssh->agentfwd_enabled = FALSE;
2524 ssh->rdpkt2_state.incoming_sequence = 0;
2526 s->vstring[s->vslen] = 0;
2527 s->vstring[strcspn(s->vstring, "\015\012")] = '\0';/* remove EOL chars */
2528 logeventf(ssh, "Server version: %s", s->vstring);
2529 ssh_detect_bugs(ssh, s->vstring);
2532 * Decide which SSH protocol version to support.
2535 /* Anything strictly below "2.0" means protocol 1 is supported. */
2536 s->proto1 = ssh_versioncmp(s->version, "2.0") < 0;
2537 /* Anything greater or equal to "1.99" means protocol 2 is supported. */
2538 s->proto2 = ssh_versioncmp(s->version, "1.99") >= 0;
2540 if (ssh->cfg.sshprot == 0 && !s->proto1) {
2541 bombout(("SSH protocol version 1 required by user but not provided by server"));
2544 if (ssh->cfg.sshprot == 3 && !s->proto2) {
2545 bombout(("SSH protocol version 2 required by user but not provided by server"));
2549 if (s->proto2 && (ssh->cfg.sshprot >= 2 || !s->proto1))
2554 logeventf(ssh, "Using SSH protocol version %d", ssh->version);
2556 /* Send the version string, if we haven't already */
2557 if (ssh->cfg.sshprot != 3)
2558 ssh_send_verstring(ssh, s->version);
2560 if (ssh->version == 2) {
2563 * Record their version string.
2565 len = strcspn(s->vstring, "\015\012");
2566 ssh->v_s = snewn(len + 1, char);
2567 memcpy(ssh->v_s, s->vstring, len);
2571 * Initialise SSH-2 protocol.
2573 ssh->protocol = ssh2_protocol;
2574 ssh2_protocol_setup(ssh);
2575 ssh->s_rdpkt = ssh2_rdpkt;
2578 * Initialise SSH-1 protocol.
2580 ssh->protocol = ssh1_protocol;
2581 ssh1_protocol_setup(ssh);
2582 ssh->s_rdpkt = ssh1_rdpkt;
2584 if (ssh->version == 2)
2585 do_ssh2_transport(ssh, NULL, -1, NULL);
2587 update_specials_menu(ssh->frontend);
2588 ssh->state = SSH_STATE_BEFORE_SIZE;
2589 ssh->pinger = pinger_new(&ssh->cfg, &ssh_backend, ssh);
2596 static void ssh_process_incoming_data(Ssh ssh,
2597 unsigned char **data, int *datalen)
2599 struct Packet *pktin;
2601 pktin = ssh->s_rdpkt(ssh, data, datalen);
2603 ssh->protocol(ssh, NULL, 0, pktin);
2604 ssh_free_packet(pktin);
2608 static void ssh_queue_incoming_data(Ssh ssh,
2609 unsigned char **data, int *datalen)
2611 bufchain_add(&ssh->queued_incoming_data, *data, *datalen);
2616 static void ssh_process_queued_incoming_data(Ssh ssh)
2619 unsigned char *data;
2622 while (!ssh->frozen && bufchain_size(&ssh->queued_incoming_data)) {
2623 bufchain_prefix(&ssh->queued_incoming_data, &vdata, &len);
2627 while (!ssh->frozen && len > 0)
2628 ssh_process_incoming_data(ssh, &data, &len);
2631 bufchain_consume(&ssh->queued_incoming_data, origlen - len);
2635 static void ssh_set_frozen(Ssh ssh, int frozen)
2638 sk_set_frozen(ssh->s, frozen);
2639 ssh->frozen = frozen;
2642 static void ssh_gotdata(Ssh ssh, unsigned char *data, int datalen)
2644 /* Log raw data, if we're in that mode. */
2646 log_packet(ssh->logctx, PKT_INCOMING, -1, NULL, data, datalen,
2649 crBegin(ssh->ssh_gotdata_crstate);
2652 * To begin with, feed the characters one by one to the
2653 * protocol initialisation / selection function do_ssh_init().
2654 * When that returns 0, we're done with the initial greeting
2655 * exchange and can move on to packet discipline.
2658 int ret; /* need not be kept across crReturn */
2660 crReturnV; /* more data please */
2661 ret = do_ssh_init(ssh, *data);
2669 * We emerge from that loop when the initial negotiation is
2670 * over and we have selected an s_rdpkt function. Now pass
2671 * everything to s_rdpkt, and then pass the resulting packets
2672 * to the proper protocol handler.
2676 while (bufchain_size(&ssh->queued_incoming_data) > 0 || datalen > 0) {
2678 ssh_queue_incoming_data(ssh, &data, &datalen);
2679 /* This uses up all data and cannot cause anything interesting
2680 * to happen; indeed, for anything to happen at all, we must
2681 * return, so break out. */
2683 } else if (bufchain_size(&ssh->queued_incoming_data) > 0) {
2684 /* This uses up some or all data, and may freeze the
2686 ssh_process_queued_incoming_data(ssh);
2688 /* This uses up some or all data, and may freeze the
2690 ssh_process_incoming_data(ssh, &data, &datalen);
2692 /* FIXME this is probably EBW. */
2693 if (ssh->state == SSH_STATE_CLOSED)
2696 /* We're out of data. Go and get some more. */
2702 static int ssh_do_close(Ssh ssh, int notify_exit)
2705 struct ssh_channel *c;
2707 ssh->state = SSH_STATE_CLOSED;
2708 expire_timer_context(ssh);
2713 notify_remote_exit(ssh->frontend);
2718 * Now we must shut down any port- and X-forwarded channels going
2719 * through this connection.
2721 if (ssh->channels) {
2722 while (NULL != (c = index234(ssh->channels, 0))) {
2725 x11_close(c->u.x11.s);
2728 pfd_close(c->u.pfd.s);
2731 del234(ssh->channels, c); /* moving next one to index 0 */
2732 if (ssh->version == 2)
2733 bufchain_clear(&c->v.v2.outbuffer);
2738 * Go through port-forwardings, and close any associated
2739 * listening sockets.
2741 if (ssh->portfwds) {
2742 struct ssh_portfwd *pf;
2743 while (NULL != (pf = index234(ssh->portfwds, 0))) {
2744 /* Dispose of any listening socket. */
2746 pfd_terminate(pf->local);
2747 del234(ssh->portfwds, pf); /* moving next one to index 0 */
2755 static void ssh_log(Plug plug, int type, SockAddr addr, int port,
2756 const char *error_msg, int error_code)
2758 Ssh ssh = (Ssh) plug;
2759 char addrbuf[256], *msg;
2761 sk_getaddr(addr, addrbuf, lenof(addrbuf));
2764 msg = dupprintf("Connecting to %s port %d", addrbuf, port);
2766 msg = dupprintf("Failed to connect to %s: %s", addrbuf, error_msg);
2772 static int ssh_closing(Plug plug, const char *error_msg, int error_code,
2775 Ssh ssh = (Ssh) plug;
2776 int need_notify = ssh_do_close(ssh, FALSE);
2779 if (!ssh->close_expected)
2780 error_msg = "Server unexpectedly closed network connection";
2782 error_msg = "Server closed network connection";
2785 if (ssh->close_expected && ssh->clean_exit && ssh->exitcode < 0)
2789 notify_remote_exit(ssh->frontend);
2792 logevent(error_msg);
2793 if (!ssh->close_expected || !ssh->clean_exit)
2794 connection_fatal(ssh->frontend, "%s", error_msg);
2798 static int ssh_receive(Plug plug, int urgent, char *data, int len)
2800 Ssh ssh = (Ssh) plug;
2801 ssh_gotdata(ssh, (unsigned char *)data, len);
2802 if (ssh->state == SSH_STATE_CLOSED) {
2803 ssh_do_close(ssh, TRUE);
2809 static void ssh_sent(Plug plug, int bufsize)
2811 Ssh ssh = (Ssh) plug;
2813 * If the send backlog on the SSH socket itself clears, we
2814 * should unthrottle the whole world if it was throttled.
2816 if (bufsize < SSH_MAX_BACKLOG)
2817 ssh_throttle_all(ssh, 0, bufsize);
2821 * Connect to specified host and port.
2822 * Returns an error message, or NULL on success.
2823 * Also places the canonical host name into `realhost'. It must be
2824 * freed by the caller.
2826 static const char *connect_to_host(Ssh ssh, char *host, int port,
2827 char **realhost, int nodelay, int keepalive)
2829 static const struct plug_function_table fn_table = {
2840 if (*ssh->cfg.loghost) {
2843 ssh->savedhost = dupstr(ssh->cfg.loghost);
2844 ssh->savedport = 22; /* default ssh port */
2847 * A colon suffix on savedhost also lets us affect
2850 * (FIXME: do something about IPv6 address literals here.)
2852 colon = strrchr(ssh->savedhost, ':');
2856 ssh->savedport = atoi(colon);
2859 ssh->savedhost = dupstr(host);
2861 port = 22; /* default ssh port */
2862 ssh->savedport = port;
2868 logeventf(ssh, "Looking up host \"%s\"%s", host,
2869 (ssh->cfg.addressfamily == ADDRTYPE_IPV4 ? " (IPv4)" :
2870 (ssh->cfg.addressfamily == ADDRTYPE_IPV6 ? " (IPv6)" : "")));
2871 addr = name_lookup(host, port, realhost, &ssh->cfg,
2872 ssh->cfg.addressfamily);
2873 if ((err = sk_addr_error(addr)) != NULL) {
2881 ssh->fn = &fn_table;
2882 ssh->s = new_connection(addr, *realhost, port,
2883 0, 1, nodelay, keepalive, (Plug) ssh, &ssh->cfg);
2884 if ((err = sk_socket_error(ssh->s)) != NULL) {
2886 notify_remote_exit(ssh->frontend);
2891 * If the SSH version number's fixed, set it now, and if it's SSH-2,
2892 * send the version string too.
2894 if (ssh->cfg.sshprot == 0)
2896 if (ssh->cfg.sshprot == 3) {
2898 ssh_send_verstring(ssh, NULL);
2902 * loghost, if configured, overrides realhost.
2904 if (*ssh->cfg.loghost) {
2906 *realhost = dupstr(ssh->cfg.loghost);
2913 * Throttle or unthrottle the SSH connection.
2915 static void ssh_throttle_conn(Ssh ssh, int adjust)
2917 int old_count = ssh->conn_throttle_count;
2918 ssh->conn_throttle_count += adjust;
2919 assert(ssh->conn_throttle_count >= 0);
2920 if (ssh->conn_throttle_count && !old_count) {
2921 ssh_set_frozen(ssh, 1);
2922 } else if (!ssh->conn_throttle_count && old_count) {
2923 ssh_set_frozen(ssh, 0);
2928 * Throttle or unthrottle _all_ local data streams (for when sends
2929 * on the SSH connection itself back up).
2931 static void ssh_throttle_all(Ssh ssh, int enable, int bufsize)
2934 struct ssh_channel *c;
2936 if (enable == ssh->throttled_all)
2938 ssh->throttled_all = enable;
2939 ssh->overall_bufsize = bufsize;
2942 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++) {
2944 case CHAN_MAINSESSION:
2946 * This is treated separately, outside the switch.
2950 x11_override_throttle(c->u.x11.s, enable);
2953 /* Agent channels require no buffer management. */
2956 pfd_override_throttle(c->u.pfd.s, enable);
2962 static void ssh_agent_callback(void *sshv, void *reply, int replylen)
2964 Ssh ssh = (Ssh) sshv;
2966 ssh->agent_response = reply;
2967 ssh->agent_response_len = replylen;
2969 if (ssh->version == 1)
2970 do_ssh1_login(ssh, NULL, -1, NULL);
2972 do_ssh2_authconn(ssh, NULL, -1, NULL);
2975 static void ssh_dialog_callback(void *sshv, int ret)
2977 Ssh ssh = (Ssh) sshv;
2979 ssh->user_response = ret;
2981 if (ssh->version == 1)
2982 do_ssh1_login(ssh, NULL, -1, NULL);
2984 do_ssh2_transport(ssh, NULL, -1, NULL);
2987 * This may have unfrozen the SSH connection, so do a
2990 ssh_process_queued_incoming_data(ssh);
2993 static void ssh_agentf_callback(void *cv, void *reply, int replylen)
2995 struct ssh_channel *c = (struct ssh_channel *)cv;
2997 void *sentreply = reply;
3000 /* Fake SSH_AGENT_FAILURE. */
3001 sentreply = "\0\0\0\1\5";
3004 if (ssh->version == 2) {
3005 ssh2_add_channel_data(c, sentreply, replylen);
3008 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
3009 PKT_INT, c->remoteid,
3012 PKT_DATA, sentreply, replylen,
3021 * Client-initiated disconnection. Send a DISCONNECT if `wire_reason'
3022 * non-NULL, otherwise just close the connection. `client_reason' == NULL
3023 * => log `wire_reason'.
3025 static void ssh_disconnect(Ssh ssh, char *client_reason, char *wire_reason,
3026 int code, int clean_exit)
3030 client_reason = wire_reason;
3032 error = dupprintf("Disconnected: %s", client_reason);
3034 error = dupstr("Disconnected");
3036 if (ssh->version == 1) {
3037 send_packet(ssh, SSH1_MSG_DISCONNECT, PKT_STR, wire_reason,
3039 } else if (ssh->version == 2) {
3040 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT);
3041 ssh2_pkt_adduint32(pktout, code);
3042 ssh2_pkt_addstring(pktout, wire_reason);
3043 ssh2_pkt_addstring(pktout, "en"); /* language tag */
3044 ssh2_pkt_send_noqueue(ssh, pktout);
3047 ssh->close_expected = TRUE;
3048 ssh->clean_exit = clean_exit;
3049 ssh_closing((Plug)ssh, error, 0, 0);
3054 * Handle the key exchange and user authentication phases.
3056 static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
3057 struct Packet *pktin)
3060 unsigned char cookie[8], *ptr;
3061 struct RSAKey servkey, hostkey;
3062 struct MD5Context md5c;
3063 struct do_ssh1_login_state {
3065 unsigned char *rsabuf, *keystr1, *keystr2;
3066 unsigned long supported_ciphers_mask, supported_auths_mask;
3067 int tried_publickey, tried_agent;
3068 int tis_auth_refused, ccard_auth_refused;
3069 unsigned char session_id[16];
3072 void *publickey_blob;
3073 int publickey_bloblen;
3074 char *publickey_comment;
3075 int publickey_encrypted;
3076 prompts_t *cur_prompt;
3079 unsigned char request[5], *response, *p;
3089 crState(do_ssh1_login_state);
3091 crBegin(ssh->do_ssh1_login_crstate);
3096 if (pktin->type != SSH1_SMSG_PUBLIC_KEY) {
3097 bombout(("Public key packet not received"));
3101 logevent("Received public keys");
3103 ptr = ssh_pkt_getdata(pktin, 8);
3105 bombout(("SSH-1 public key packet stopped before random cookie"));
3108 memcpy(cookie, ptr, 8);
3110 if (!ssh1_pkt_getrsakey(pktin, &servkey, &s->keystr1) ||
3111 !ssh1_pkt_getrsakey(pktin, &hostkey, &s->keystr2)) {
3112 bombout(("Failed to read SSH-1 public keys from public key packet"));
3117 * Log the host key fingerprint.
3121 logevent("Host key fingerprint is:");
3122 strcpy(logmsg, " ");
3123 hostkey.comment = NULL;
3124 rsa_fingerprint(logmsg + strlen(logmsg),
3125 sizeof(logmsg) - strlen(logmsg), &hostkey);
3129 ssh->v1_remote_protoflags = ssh_pkt_getuint32(pktin);
3130 s->supported_ciphers_mask = ssh_pkt_getuint32(pktin);
3131 s->supported_auths_mask = ssh_pkt_getuint32(pktin);
3132 if ((ssh->remote_bugs & BUG_CHOKES_ON_RSA))
3133 s->supported_auths_mask &= ~(1 << SSH1_AUTH_RSA);
3135 ssh->v1_local_protoflags =
3136 ssh->v1_remote_protoflags & SSH1_PROTOFLAGS_SUPPORTED;
3137 ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
3140 MD5Update(&md5c, s->keystr2, hostkey.bytes);
3141 MD5Update(&md5c, s->keystr1, servkey.bytes);
3142 MD5Update(&md5c, cookie, 8);
3143 MD5Final(s->session_id, &md5c);
3145 for (i = 0; i < 32; i++)
3146 ssh->session_key[i] = random_byte();
3149 * Verify that the `bits' and `bytes' parameters match.
3151 if (hostkey.bits > hostkey.bytes * 8 ||
3152 servkey.bits > servkey.bytes * 8) {
3153 bombout(("SSH-1 public keys were badly formatted"));
3157 s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
3159 s->rsabuf = snewn(s->len, unsigned char);
3162 * Verify the host key.
3166 * First format the key into a string.
3168 int len = rsastr_len(&hostkey);
3169 char fingerprint[100];
3170 char *keystr = snewn(len, char);
3171 rsastr_fmt(keystr, &hostkey);
3172 rsa_fingerprint(fingerprint, sizeof(fingerprint), &hostkey);
3174 ssh_set_frozen(ssh, 1);
3175 s->dlgret = verify_ssh_host_key(ssh->frontend,
3176 ssh->savedhost, ssh->savedport,
3177 "rsa", keystr, fingerprint,
3178 ssh_dialog_callback, ssh);
3180 if (s->dlgret < 0) {
3184 bombout(("Unexpected data from server while waiting"
3185 " for user host key response"));
3188 } while (pktin || inlen > 0);
3189 s->dlgret = ssh->user_response;
3191 ssh_set_frozen(ssh, 0);
3193 if (s->dlgret == 0) {
3194 ssh_disconnect(ssh, "User aborted at host key verification",
3200 for (i = 0; i < 32; i++) {
3201 s->rsabuf[i] = ssh->session_key[i];
3203 s->rsabuf[i] ^= s->session_id[i];
3206 if (hostkey.bytes > servkey.bytes) {
3207 ret = rsaencrypt(s->rsabuf, 32, &servkey);
3209 ret = rsaencrypt(s->rsabuf, servkey.bytes, &hostkey);
3211 ret = rsaencrypt(s->rsabuf, 32, &hostkey);
3213 ret = rsaencrypt(s->rsabuf, hostkey.bytes, &servkey);
3216 bombout(("SSH-1 public key encryptions failed due to bad formatting"));
3220 logevent("Encrypted session key");
3223 int cipher_chosen = 0, warn = 0;
3224 char *cipher_string = NULL;
3226 for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) {
3227 int next_cipher = ssh->cfg.ssh_cipherlist[i];
3228 if (next_cipher == CIPHER_WARN) {
3229 /* If/when we choose a cipher, warn about it */
3231 } else if (next_cipher == CIPHER_AES) {
3232 /* XXX Probably don't need to mention this. */
3233 logevent("AES not supported in SSH-1, skipping");
3235 switch (next_cipher) {
3236 case CIPHER_3DES: s->cipher_type = SSH_CIPHER_3DES;
3237 cipher_string = "3DES"; break;
3238 case CIPHER_BLOWFISH: s->cipher_type = SSH_CIPHER_BLOWFISH;
3239 cipher_string = "Blowfish"; break;
3240 case CIPHER_DES: s->cipher_type = SSH_CIPHER_DES;
3241 cipher_string = "single-DES"; break;
3243 if (s->supported_ciphers_mask & (1 << s->cipher_type))
3247 if (!cipher_chosen) {
3248 if ((s->supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0)
3249 bombout(("Server violates SSH-1 protocol by not "
3250 "supporting 3DES encryption"));
3252 /* shouldn't happen */
3253 bombout(("No supported ciphers found"));
3257 /* Warn about chosen cipher if necessary. */
3259 ssh_set_frozen(ssh, 1);
3260 s->dlgret = askalg(ssh->frontend, "cipher", cipher_string,
3261 ssh_dialog_callback, ssh);
3262 if (s->dlgret < 0) {
3266 bombout(("Unexpected data from server while waiting"
3267 " for user response"));
3270 } while (pktin || inlen > 0);
3271 s->dlgret = ssh->user_response;
3273 ssh_set_frozen(ssh, 0);
3274 if (s->dlgret == 0) {
3275 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
3282 switch (s->cipher_type) {
3283 case SSH_CIPHER_3DES:
3284 logevent("Using 3DES encryption");
3286 case SSH_CIPHER_DES:
3287 logevent("Using single-DES encryption");
3289 case SSH_CIPHER_BLOWFISH:
3290 logevent("Using Blowfish encryption");
3294 send_packet(ssh, SSH1_CMSG_SESSION_KEY,
3295 PKT_CHAR, s->cipher_type,
3296 PKT_DATA, cookie, 8,
3297 PKT_CHAR, (s->len * 8) >> 8, PKT_CHAR, (s->len * 8) & 0xFF,
3298 PKT_DATA, s->rsabuf, s->len,
3299 PKT_INT, ssh->v1_local_protoflags, PKT_END);
3301 logevent("Trying to enable encryption...");
3305 ssh->cipher = (s->cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish_ssh1 :
3306 s->cipher_type == SSH_CIPHER_DES ? &ssh_des :
3308 ssh->v1_cipher_ctx = ssh->cipher->make_context();
3309 ssh->cipher->sesskey(ssh->v1_cipher_ctx, ssh->session_key);
3310 logeventf(ssh, "Initialised %s encryption", ssh->cipher->text_name);
3312 ssh->crcda_ctx = crcda_make_context();
3313 logevent("Installing CRC compensation attack detector");
3315 if (servkey.modulus) {
3316 sfree(servkey.modulus);
3317 servkey.modulus = NULL;
3319 if (servkey.exponent) {
3320 sfree(servkey.exponent);
3321 servkey.exponent = NULL;
3323 if (hostkey.modulus) {
3324 sfree(hostkey.modulus);
3325 hostkey.modulus = NULL;
3327 if (hostkey.exponent) {
3328 sfree(hostkey.exponent);
3329 hostkey.exponent = NULL;
3333 if (pktin->type != SSH1_SMSG_SUCCESS) {
3334 bombout(("Encryption not successfully enabled"));
3338 logevent("Successfully started encryption");
3340 fflush(stdout); /* FIXME eh? */
3342 if (!*ssh->cfg.username) {
3343 int ret; /* need not be kept over crReturn */
3344 s->cur_prompt = new_prompts(ssh->frontend);
3345 s->cur_prompt->to_server = TRUE;
3346 s->cur_prompt->name = dupstr("SSH login name");
3347 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
3348 lenof(s->username));
3349 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3352 crWaitUntil(!pktin);
3353 ret = get_userpass_input(s->cur_prompt, in, inlen);
3358 * Failed to get a username. Terminate.
3360 free_prompts(s->cur_prompt);
3361 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
3364 memcpy(s->username, s->cur_prompt->prompts[0]->result,
3365 lenof(s->username));
3366 free_prompts(s->cur_prompt);
3368 strncpy(s->username, ssh->cfg.username, sizeof(s->username));
3369 s->username[sizeof(s->username)-1] = '\0';
3372 send_packet(ssh, SSH1_CMSG_USER, PKT_STR, s->username, PKT_END);
3374 char *userlog = dupprintf("Sent username \"%s\"", s->username);
3376 if (flags & FLAG_INTERACTIVE &&
3377 (!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) {
3378 c_write_str(ssh, userlog);
3379 c_write_str(ssh, "\r\n");
3387 if ((s->supported_auths_mask & (1 << SSH1_AUTH_RSA)) == 0) {
3388 /* We must not attempt PK auth. Pretend we've already tried it. */
3389 s->tried_publickey = s->tried_agent = 1;
3391 s->tried_publickey = s->tried_agent = 0;
3393 s->tis_auth_refused = s->ccard_auth_refused = 0;
3395 * Load the public half of any configured keyfile for later use.
3397 if (!filename_is_null(ssh->cfg.keyfile)) {
3399 logeventf(ssh, "Reading private key file \"%.150s\"",
3400 filename_to_str(&ssh->cfg.keyfile));
3401 keytype = key_type(&ssh->cfg.keyfile);
3402 if (keytype == SSH_KEYTYPE_SSH1) {
3404 if (rsakey_pubblob(&ssh->cfg.keyfile,
3405 &s->publickey_blob, &s->publickey_bloblen,
3406 &s->publickey_comment, &error)) {
3407 s->publickey_encrypted = rsakey_encrypted(&ssh->cfg.keyfile,
3411 logeventf(ssh, "Unable to load private key (%s)", error);
3412 msgbuf = dupprintf("Unable to load private key file "
3413 "\"%.150s\" (%s)\r\n",
3414 filename_to_str(&ssh->cfg.keyfile),
3416 c_write_str(ssh, msgbuf);
3418 s->publickey_blob = NULL;
3422 logeventf(ssh, "Unable to use this key file (%s)",
3423 key_type_to_str(keytype));
3424 msgbuf = dupprintf("Unable to use key file \"%.150s\""
3426 filename_to_str(&ssh->cfg.keyfile),
3427 key_type_to_str(keytype));
3428 c_write_str(ssh, msgbuf);
3430 s->publickey_blob = NULL;
3433 s->publickey_blob = NULL;
3435 while (pktin->type == SSH1_SMSG_FAILURE) {
3436 s->pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
3438 if (ssh->cfg.tryagent && agent_exists() && !s->tried_agent) {
3440 * Attempt RSA authentication using Pageant.
3446 logevent("Pageant is running. Requesting keys.");
3448 /* Request the keys held by the agent. */
3449 PUT_32BIT(s->request, 1);
3450 s->request[4] = SSH1_AGENTC_REQUEST_RSA_IDENTITIES;
3451 if (!agent_query(s->request, 5, &r, &s->responselen,
3452 ssh_agent_callback, ssh)) {
3456 bombout(("Unexpected data from server while waiting"
3457 " for agent response"));
3460 } while (pktin || inlen > 0);
3461 r = ssh->agent_response;
3462 s->responselen = ssh->agent_response_len;
3464 s->response = (unsigned char *) r;
3465 if (s->response && s->responselen >= 5 &&
3466 s->response[4] == SSH1_AGENT_RSA_IDENTITIES_ANSWER) {
3467 s->p = s->response + 5;
3468 s->nkeys = GET_32BIT(s->p);
3470 logeventf(ssh, "Pageant has %d SSH-1 keys", s->nkeys);
3471 for (s->keyi = 0; s->keyi < s->nkeys; s->keyi++) {
3472 unsigned char *pkblob = s->p;
3476 do { /* do while (0) to make breaking easy */
3477 n = ssh1_read_bignum
3478 (s->p, s->responselen-(s->p-s->response),
3483 n = ssh1_read_bignum
3484 (s->p, s->responselen-(s->p-s->response),
3489 if (s->responselen - (s->p-s->response) < 4)
3491 s->commentlen = GET_32BIT(s->p);
3493 if (s->responselen - (s->p-s->response) <
3496 s->commentp = (char *)s->p;
3497 s->p += s->commentlen;
3501 logevent("Pageant key list packet was truncated");
3505 if (s->publickey_blob) {
3506 if (!memcmp(pkblob, s->publickey_blob,
3507 s->publickey_bloblen)) {
3508 logeventf(ssh, "Pageant key #%d matches "
3509 "configured key file", s->keyi);
3510 s->tried_publickey = 1;
3512 /* Skip non-configured key */
3515 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
3516 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3517 PKT_BIGNUM, s->key.modulus, PKT_END);
3519 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
3520 logevent("Key refused");
3523 logevent("Received RSA challenge");
3524 if ((s->challenge = ssh1_pkt_getmp(pktin)) == NULL) {
3525 bombout(("Server's RSA challenge was badly formatted"));
3530 char *agentreq, *q, *ret;
3533 len = 1 + 4; /* message type, bit count */
3534 len += ssh1_bignum_length(s->key.exponent);
3535 len += ssh1_bignum_length(s->key.modulus);
3536 len += ssh1_bignum_length(s->challenge);
3537 len += 16; /* session id */
3538 len += 4; /* response format */
3539 agentreq = snewn(4 + len, char);
3540 PUT_32BIT(agentreq, len);
3542 *q++ = SSH1_AGENTC_RSA_CHALLENGE;
3543 PUT_32BIT(q, bignum_bitcount(s->key.modulus));
3545 q += ssh1_write_bignum(q, s->key.exponent);
3546 q += ssh1_write_bignum(q, s->key.modulus);
3547 q += ssh1_write_bignum(q, s->challenge);
3548 memcpy(q, s->session_id, 16);
3550 PUT_32BIT(q, 1); /* response format */
3551 if (!agent_query(agentreq, len + 4, &vret, &retlen,
3552 ssh_agent_callback, ssh)) {
3557 bombout(("Unexpected data from server"
3558 " while waiting for agent"
3562 } while (pktin || inlen > 0);
3563 vret = ssh->agent_response;
3564 retlen = ssh->agent_response_len;
3569 if (ret[4] == SSH1_AGENT_RSA_RESPONSE) {
3570 logevent("Sending Pageant's response");
3571 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
3572 PKT_DATA, ret + 5, 16,
3576 if (pktin->type == SSH1_SMSG_SUCCESS) {
3578 ("Pageant's response accepted");
3579 if (flags & FLAG_VERBOSE) {
3580 c_write_str(ssh, "Authenticated using"
3582 c_write(ssh, s->commentp,
3584 c_write_str(ssh, "\" from agent\r\n");
3589 ("Pageant's response not accepted");
3592 ("Pageant failed to answer challenge");
3596 logevent("No reply received from Pageant");
3599 freebn(s->key.exponent);
3600 freebn(s->key.modulus);
3601 freebn(s->challenge);
3606 if (s->publickey_blob && !s->tried_publickey)
3607 logevent("Configured key file not in Pageant");
3612 if (s->publickey_blob && !s->tried_publickey) {
3614 * Try public key authentication with the specified
3617 int got_passphrase; /* need not be kept over crReturn */
3618 if (flags & FLAG_VERBOSE)
3619 c_write_str(ssh, "Trying public key authentication.\r\n");
3620 logeventf(ssh, "Trying public key \"%s\"",
3621 filename_to_str(&ssh->cfg.keyfile));
3622 s->tried_publickey = 1;
3623 got_passphrase = FALSE;
3624 while (!got_passphrase) {
3626 * Get a passphrase, if necessary.
3628 char *passphrase = NULL; /* only written after crReturn */
3630 if (!s->publickey_encrypted) {
3631 if (flags & FLAG_VERBOSE)
3632 c_write_str(ssh, "No passphrase required.\r\n");
3635 int ret; /* need not be kept over crReturn */
3636 s->cur_prompt = new_prompts(ssh->frontend);
3637 s->cur_prompt->to_server = FALSE;
3638 s->cur_prompt->name = dupstr("SSH key passphrase");
3639 add_prompt(s->cur_prompt,
3640 dupprintf("Passphrase for key \"%.100s\": ",
3641 s->publickey_comment),
3642 FALSE, SSH_MAX_PASSWORD_LEN);
3643 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3646 crWaitUntil(!pktin);
3647 ret = get_userpass_input(s->cur_prompt, in, inlen);
3651 /* Failed to get a passphrase. Terminate. */
3652 free_prompts(s->cur_prompt);
3653 ssh_disconnect(ssh, NULL, "Unable to authenticate",
3657 passphrase = dupstr(s->cur_prompt->prompts[0]->result);
3658 free_prompts(s->cur_prompt);
3661 * Try decrypting key with passphrase.
3663 ret = loadrsakey(&ssh->cfg.keyfile, &s->key, passphrase,
3666 memset(passphrase, 0, strlen(passphrase));
3670 /* Correct passphrase. */
3671 got_passphrase = TRUE;
3672 } else if (ret == 0) {
3673 c_write_str(ssh, "Couldn't load private key from ");
3674 c_write_str(ssh, filename_to_str(&ssh->cfg.keyfile));
3675 c_write_str(ssh, " (");
3676 c_write_str(ssh, error);
3677 c_write_str(ssh, ").\r\n");
3678 got_passphrase = FALSE;
3679 break; /* go and try something else */
3680 } else if (ret == -1) {
3681 c_write_str(ssh, "Wrong passphrase.\r\n"); /* FIXME */
3682 got_passphrase = FALSE;
3685 assert(0 && "unexpected return from loadrsakey()");
3686 got_passphrase = FALSE; /* placate optimisers */
3690 if (got_passphrase) {
3693 * Send a public key attempt.
3695 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3696 PKT_BIGNUM, s->key.modulus, PKT_END);
3699 if (pktin->type == SSH1_SMSG_FAILURE) {
3700 c_write_str(ssh, "Server refused our public key.\r\n");
3701 continue; /* go and try something else */
3703 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
3704 bombout(("Bizarre response to offer of public key"));
3710 unsigned char buffer[32];
3711 Bignum challenge, response;
3713 if ((challenge = ssh1_pkt_getmp(pktin)) == NULL) {
3714 bombout(("Server's RSA challenge was badly formatted"));
3717 response = rsadecrypt(challenge, &s->key);
3718 freebn(s->key.private_exponent);/* burn the evidence */
3720 for (i = 0; i < 32; i++) {
3721 buffer[i] = bignum_byte(response, 31 - i);
3725 MD5Update(&md5c, buffer, 32);
3726 MD5Update(&md5c, s->session_id, 16);
3727 MD5Final(buffer, &md5c);
3729 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
3730 PKT_DATA, buffer, 16, PKT_END);
3737 if (pktin->type == SSH1_SMSG_FAILURE) {
3738 if (flags & FLAG_VERBOSE)
3739 c_write_str(ssh, "Failed to authenticate with"
3740 " our public key.\r\n");
3741 continue; /* go and try something else */
3742 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
3743 bombout(("Bizarre response to RSA authentication response"));
3747 break; /* we're through! */
3753 * Otherwise, try various forms of password-like authentication.
3755 s->cur_prompt = new_prompts(ssh->frontend);
3757 if (ssh->cfg.try_tis_auth &&
3758 (s->supported_auths_mask & (1 << SSH1_AUTH_TIS)) &&
3759 !s->tis_auth_refused) {
3760 s->pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
3761 logevent("Requested TIS authentication");
3762 send_packet(ssh, SSH1_CMSG_AUTH_TIS, PKT_END);
3764 if (pktin->type != SSH1_SMSG_AUTH_TIS_CHALLENGE) {
3765 logevent("TIS authentication declined");
3766 if (flags & FLAG_INTERACTIVE)
3767 c_write_str(ssh, "TIS authentication refused.\r\n");
3768 s->tis_auth_refused = 1;
3773 char *instr_suf, *prompt;
3775 ssh_pkt_getstring(pktin, &challenge, &challengelen);
3777 bombout(("TIS challenge packet was badly formed"));
3780 logevent("Received TIS challenge");
3781 s->cur_prompt->to_server = TRUE;
3782 s->cur_prompt->name = dupstr("SSH TIS authentication");
3783 /* Prompt heuristic comes from OpenSSH */
3784 if (memchr(challenge, '\n', challengelen)) {
3785 instr_suf = dupstr("");
3786 prompt = dupprintf("%.*s", challengelen, challenge);
3788 instr_suf = dupprintf("%.*s", challengelen, challenge);
3789 prompt = dupstr("Response: ");
3791 s->cur_prompt->instruction =
3792 dupprintf("Using TIS authentication.%s%s",
3793 (*instr_suf) ? "\n" : "",
3795 s->cur_prompt->instr_reqd = TRUE;
3796 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3800 if (ssh->cfg.try_tis_auth &&
3801 (s->supported_auths_mask & (1 << SSH1_AUTH_CCARD)) &&
3802 !s->ccard_auth_refused) {
3803 s->pwpkt_type = SSH1_CMSG_AUTH_CCARD_RESPONSE;
3804 logevent("Requested CryptoCard authentication");
3805 send_packet(ssh, SSH1_CMSG_AUTH_CCARD, PKT_END);
3807 if (pktin->type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
3808 logevent("CryptoCard authentication declined");
3809 c_write_str(ssh, "CryptoCard authentication refused.\r\n");
3810 s->ccard_auth_refused = 1;
3815 char *instr_suf, *prompt;
3817 ssh_pkt_getstring(pktin, &challenge, &challengelen);
3819 bombout(("CryptoCard challenge packet was badly formed"));
3822 logevent("Received CryptoCard challenge");
3823 s->cur_prompt->to_server = TRUE;
3824 s->cur_prompt->name = dupstr("SSH CryptoCard authentication");
3825 s->cur_prompt->name_reqd = FALSE;
3826 /* Prompt heuristic comes from OpenSSH */
3827 if (memchr(challenge, '\n', challengelen)) {
3828 instr_suf = dupstr("");
3829 prompt = dupprintf("%.*s", challengelen, challenge);
3831 instr_suf = dupprintf("%.*s", challengelen, challenge);
3832 prompt = dupstr("Response: ");
3834 s->cur_prompt->instruction =
3835 dupprintf("Using CryptoCard authentication.%s%s",
3836 (*instr_suf) ? "\n" : "",
3838 s->cur_prompt->instr_reqd = TRUE;
3839 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3843 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
3844 if ((s->supported_auths_mask & (1 << SSH1_AUTH_PASSWORD)) == 0) {
3845 bombout(("No supported authentication methods available"));
3848 s->cur_prompt->to_server = TRUE;
3849 s->cur_prompt->name = dupstr("SSH password");
3850 add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
3851 s->username, ssh->savedhost),
3852 FALSE, SSH_MAX_PASSWORD_LEN);
3856 * Show password prompt, having first obtained it via a TIS
3857 * or CryptoCard exchange if we're doing TIS or CryptoCard
3861 int ret; /* need not be kept over crReturn */
3862 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3865 crWaitUntil(!pktin);
3866 ret = get_userpass_input(s->cur_prompt, in, inlen);
3871 * Failed to get a password (for example
3872 * because one was supplied on the command line
3873 * which has already failed to work). Terminate.
3875 free_prompts(s->cur_prompt);
3876 ssh_disconnect(ssh, NULL, "Unable to authenticate", 0, TRUE);
3881 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
3883 * Defence against traffic analysis: we send a
3884 * whole bunch of packets containing strings of
3885 * different lengths. One of these strings is the
3886 * password, in a SSH1_CMSG_AUTH_PASSWORD packet.
3887 * The others are all random data in
3888 * SSH1_MSG_IGNORE packets. This way a passive
3889 * listener can't tell which is the password, and
3890 * hence can't deduce the password length.
3892 * Anybody with a password length greater than 16
3893 * bytes is going to have enough entropy in their
3894 * password that a listener won't find it _that_
3895 * much help to know how long it is. So what we'll
3898 * - if password length < 16, we send 15 packets
3899 * containing string lengths 1 through 15
3901 * - otherwise, we let N be the nearest multiple
3902 * of 8 below the password length, and send 8
3903 * packets containing string lengths N through
3904 * N+7. This won't obscure the order of
3905 * magnitude of the password length, but it will
3906 * introduce a bit of extra uncertainty.
3908 * A few servers can't deal with SSH1_MSG_IGNORE, at
3909 * least in this context. For these servers, we need
3910 * an alternative defence. We make use of the fact
3911 * that the password is interpreted as a C string:
3912 * so we can append a NUL, then some random data.
3914 * A few servers can deal with neither SSH1_MSG_IGNORE
3915 * here _nor_ a padded password string.
3916 * For these servers we are left with no defences
3917 * against password length sniffing.
3919 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE) &&
3920 !(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
3922 * The server can deal with SSH1_MSG_IGNORE, so
3923 * we can use the primary defence.
3925 int bottom, top, pwlen, i;
3928 pwlen = strlen(s->cur_prompt->prompts[0]->result);
3930 bottom = 0; /* zero length passwords are OK! :-) */
3933 bottom = pwlen & ~7;
3937 assert(pwlen >= bottom && pwlen <= top);
3939 randomstr = snewn(top + 1, char);
3941 for (i = bottom; i <= top; i++) {
3943 defer_packet(ssh, s->pwpkt_type,
3944 PKTT_PASSWORD, PKT_STR,
3945 s->cur_prompt->prompts[0]->result,
3946 PKTT_OTHER, PKT_END);
3948 for (j = 0; j < i; j++) {
3950 randomstr[j] = random_byte();
3951 } while (randomstr[j] == '\0');
3953 randomstr[i] = '\0';
3954 defer_packet(ssh, SSH1_MSG_IGNORE,
3955 PKT_STR, randomstr, PKT_END);
3958 logevent("Sending password with camouflage packets");
3959 ssh_pkt_defersend(ssh);
3962 else if (!(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
3964 * The server can't deal with SSH1_MSG_IGNORE
3965 * but can deal with padded passwords, so we
3966 * can use the secondary defence.
3972 len = strlen(s->cur_prompt->prompts[0]->result);
3973 if (len < sizeof(string)) {
3975 strcpy(string, s->cur_prompt->prompts[0]->result);
3976 len++; /* cover the zero byte */
3977 while (len < sizeof(string)) {
3978 string[len++] = (char) random_byte();
3981 ss = s->cur_prompt->prompts[0]->result;
3983 logevent("Sending length-padded password");
3984 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
3985 PKT_INT, len, PKT_DATA, ss, len,
3986 PKTT_OTHER, PKT_END);
3989 * The server is believed unable to cope with
3990 * any of our password camouflage methods.
3993 len = strlen(s->cur_prompt->prompts[0]->result);
3994 logevent("Sending unpadded password");
3995 send_packet(ssh, s->pwpkt_type,
3996 PKTT_PASSWORD, PKT_INT, len,
3997 PKT_DATA, s->cur_prompt->prompts[0]->result, len,
3998 PKTT_OTHER, PKT_END);
4001 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
4002 PKT_STR, s->cur_prompt->prompts[0]->result,
4003 PKTT_OTHER, PKT_END);
4005 logevent("Sent password");
4006 free_prompts(s->cur_prompt);
4008 if (pktin->type == SSH1_SMSG_FAILURE) {
4009 if (flags & FLAG_VERBOSE)
4010 c_write_str(ssh, "Access denied\r\n");
4011 logevent("Authentication refused");
4012 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
4013 bombout(("Strange packet received, type %d", pktin->type));
4019 if (s->publickey_blob) {
4020 sfree(s->publickey_blob);
4021 sfree(s->publickey_comment);
4024 logevent("Authentication successful");
4029 void sshfwd_close(struct ssh_channel *c)
4033 if (ssh->state == SSH_STATE_CLOSED)
4036 if (c && !c->closes) {
4038 * If halfopen is true, we have sent
4039 * CHANNEL_OPEN for this channel, but it hasn't even been
4040 * acknowledged by the server. So we must set a close flag
4041 * on it now, and then when the server acks the channel
4042 * open, we can close it then.
4045 if (ssh->version == 1) {
4046 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
4049 struct Packet *pktout;
4050 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
4051 ssh2_pkt_adduint32(pktout, c->remoteid);
4052 ssh2_pkt_send(ssh, pktout);
4055 c->closes = 1; /* sent MSG_CLOSE */
4056 if (c->type == CHAN_X11) {
4058 logevent("Forwarded X11 connection terminated");
4059 } else if (c->type == CHAN_SOCKDATA ||
4060 c->type == CHAN_SOCKDATA_DORMANT) {
4062 logevent("Forwarded port closed");
4067 int sshfwd_write(struct ssh_channel *c, char *buf, int len)
4071 if (ssh->state == SSH_STATE_CLOSED)
4074 if (ssh->version == 1) {
4075 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
4076 PKT_INT, c->remoteid,
4077 PKT_INT, len, PKTT_DATA, PKT_DATA, buf, len,
4078 PKTT_OTHER, PKT_END);
4080 * In SSH-1 we can return 0 here - implying that forwarded
4081 * connections are never individually throttled - because
4082 * the only circumstance that can cause throttling will be
4083 * the whole SSH connection backing up, in which case
4084 * _everything_ will be throttled as a whole.
4088 ssh2_add_channel_data(c, buf, len);
4089 return ssh2_try_send(c);
4093 void sshfwd_unthrottle(struct ssh_channel *c, int bufsize)
4098 if (ssh->state == SSH_STATE_CLOSED)
4101 if (ssh->version == 1) {
4102 buflimit = SSH1_BUFFER_LIMIT;
4104 buflimit = c->v.v2.locmaxwin;
4105 ssh2_set_window(c, bufsize < buflimit ? buflimit - bufsize : 0);
4107 if (c->throttling_conn && bufsize <= buflimit) {
4108 c->throttling_conn = 0;
4109 ssh_throttle_conn(ssh, -1);
4113 static void ssh_queueing_handler(Ssh ssh, struct Packet *pktin)
4115 struct queued_handler *qh = ssh->qhead;
4119 assert(pktin->type == qh->msg1 || pktin->type == qh->msg2);
4122 assert(ssh->packet_dispatch[qh->msg1] == ssh_queueing_handler);
4123 ssh->packet_dispatch[qh->msg1] = NULL;
4126 assert(ssh->packet_dispatch[qh->msg2] == ssh_queueing_handler);
4127 ssh->packet_dispatch[qh->msg2] = NULL;
4131 ssh->qhead = qh->next;
4133 if (ssh->qhead->msg1 > 0) {
4134 assert(ssh->packet_dispatch[ssh->qhead->msg1] == NULL);
4135 ssh->packet_dispatch[ssh->qhead->msg1] = ssh_queueing_handler;
4137 if (ssh->qhead->msg2 > 0) {
4138 assert(ssh->packet_dispatch[ssh->qhead->msg2] == NULL);
4139 ssh->packet_dispatch[ssh->qhead->msg2] = ssh_queueing_handler;
4142 ssh->qhead = ssh->qtail = NULL;
4143 ssh->packet_dispatch[pktin->type] = NULL;
4146 qh->handler(ssh, pktin, qh->ctx);
4151 static void ssh_queue_handler(Ssh ssh, int msg1, int msg2,
4152 chandler_fn_t handler, void *ctx)
4154 struct queued_handler *qh;
4156 qh = snew(struct queued_handler);
4159 qh->handler = handler;
4163 if (ssh->qtail == NULL) {
4167 assert(ssh->packet_dispatch[qh->msg1] == NULL);
4168 ssh->packet_dispatch[qh->msg1] = ssh_queueing_handler;
4171 assert(ssh->packet_dispatch[qh->msg2] == NULL);
4172 ssh->packet_dispatch[qh->msg2] = ssh_queueing_handler;
4175 ssh->qtail->next = qh;
4180 static void ssh_rportfwd_succfail(Ssh ssh, struct Packet *pktin, void *ctx)
4182 struct ssh_rportfwd *rpf, *pf = (struct ssh_rportfwd *)ctx;
4184 if (pktin->type == (ssh->version == 1 ? SSH1_SMSG_SUCCESS :
4185 SSH2_MSG_REQUEST_SUCCESS)) {
4186 logeventf(ssh, "Remote port forwarding from %s enabled",
4189 logeventf(ssh, "Remote port forwarding from %s refused",
4192 rpf = del234(ssh->rportfwds, pf);
4198 static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
4200 const char *portfwd_strptr = cfg->portfwd;
4201 struct ssh_portfwd *epf;
4204 if (!ssh->portfwds) {
4205 ssh->portfwds = newtree234(ssh_portcmp);
4208 * Go through the existing port forwardings and tag them
4209 * with status==DESTROY. Any that we want to keep will be
4210 * re-enabled (status==KEEP) as we go through the
4211 * configuration and find out which bits are the same as
4214 struct ssh_portfwd *epf;
4216 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4217 epf->status = DESTROY;
4220 while (*portfwd_strptr) {
4221 char address_family, type;
4222 int sport,dport,sserv,dserv;
4223 char sports[256], dports[256], saddr[256], host[256];
4226 address_family = 'A';
4228 if (*portfwd_strptr == 'A' ||
4229 *portfwd_strptr == '4' ||
4230 *portfwd_strptr == '6')
4231 address_family = *portfwd_strptr++;
4232 if (*portfwd_strptr == 'L' ||
4233 *portfwd_strptr == 'R' ||
4234 *portfwd_strptr == 'D')
4235 type = *portfwd_strptr++;
4240 while (*portfwd_strptr && *portfwd_strptr != '\t') {
4241 if (*portfwd_strptr == ':') {
4243 * We've seen a colon in the middle of the
4244 * source port number. This means that
4245 * everything we've seen until now is the
4246 * source _address_, so we'll move it into
4247 * saddr and start sports from the beginning
4252 if (ssh->version == 1 && type == 'R') {
4253 logeventf(ssh, "SSH-1 cannot handle remote source address "
4254 "spec \"%s\"; ignoring", sports);
4256 strcpy(saddr, sports);
4259 if (n < lenof(sports)-1) sports[n++] = *portfwd_strptr++;
4263 if (*portfwd_strptr == '\t')
4266 while (*portfwd_strptr && *portfwd_strptr != ':') {
4267 if (n < lenof(host)-1) host[n++] = *portfwd_strptr++;
4270 if (*portfwd_strptr == ':')
4273 while (*portfwd_strptr) {
4274 if (n < lenof(dports)-1) dports[n++] = *portfwd_strptr++;
4278 dport = atoi(dports);
4282 dport = net_service_lookup(dports);
4284 logeventf(ssh, "Service lookup failed for destination"
4285 " port \"%s\"", dports);
4289 while (*portfwd_strptr) portfwd_strptr++;
4293 portfwd_strptr++; /* eat the NUL and move to next one */
4295 sport = atoi(sports);
4299 sport = net_service_lookup(sports);
4301 logeventf(ssh, "Service lookup failed for source"
4302 " port \"%s\"", sports);
4305 if (sport && dport) {
4306 /* Set up a description of the source port. */
4307 struct ssh_portfwd *pfrec, *epfrec;
4309 pfrec = snew(struct ssh_portfwd);
4311 pfrec->saddr = *saddr ? dupstr(saddr) : NULL;
4312 pfrec->sserv = sserv ? dupstr(sports) : NULL;
4313 pfrec->sport = sport;
4314 pfrec->daddr = *host ? dupstr(host) : NULL;
4315 pfrec->dserv = dserv ? dupstr(dports) : NULL;
4316 pfrec->dport = dport;
4317 pfrec->local = NULL;
4318 pfrec->remote = NULL;
4319 pfrec->addressfamily = (address_family == '4' ? ADDRTYPE_IPV4 :
4320 address_family == '6' ? ADDRTYPE_IPV6 :
4323 epfrec = add234(ssh->portfwds, pfrec);
4324 if (epfrec != pfrec) {
4326 * We already have a port forwarding with precisely
4327 * these parameters. Hence, no need to do anything;
4328 * simply tag the existing one as KEEP.
4330 epfrec->status = KEEP;
4331 free_portfwd(pfrec);
4333 pfrec->status = CREATE;
4339 * Now go through and destroy any port forwardings which were
4342 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4343 if (epf->status == DESTROY) {
4346 message = dupprintf("%s port forwarding from %s%s%d",
4347 epf->type == 'L' ? "local" :
4348 epf->type == 'R' ? "remote" : "dynamic",
4349 epf->saddr ? epf->saddr : "",
4350 epf->saddr ? ":" : "",
4353 if (epf->type != 'D') {
4354 char *msg2 = dupprintf("%s to %s:%d", message,
4355 epf->daddr, epf->dport);
4360 logeventf(ssh, "Cancelling %s", message);
4364 struct ssh_rportfwd *rpf = epf->remote;
4365 struct Packet *pktout;
4368 * Cancel the port forwarding at the server
4371 if (ssh->version == 1) {
4373 * We cannot cancel listening ports on the
4374 * server side in SSH-1! There's no message
4375 * to support it. Instead, we simply remove
4376 * the rportfwd record from the local end
4377 * so that any connections the server tries
4378 * to make on it are rejected.
4381 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4382 ssh2_pkt_addstring(pktout, "cancel-tcpip-forward");
4383 ssh2_pkt_addbool(pktout, 0);/* _don't_ want reply */
4385 ssh2_pkt_addstring(pktout, epf->saddr);
4386 } else if (ssh->cfg.rport_acceptall) {
4387 /* XXX: ssh->cfg.rport_acceptall may not represent
4388 * what was used to open the original connection,
4389 * since it's reconfigurable. */
4390 ssh2_pkt_addstring(pktout, "0.0.0.0");
4392 ssh2_pkt_addstring(pktout, "127.0.0.1");
4394 ssh2_pkt_adduint32(pktout, epf->sport);
4395 ssh2_pkt_send(ssh, pktout);
4398 del234(ssh->rportfwds, rpf);
4400 } else if (epf->local) {
4401 pfd_terminate(epf->local);
4404 delpos234(ssh->portfwds, i);
4406 i--; /* so we don't skip one in the list */
4410 * And finally, set up any new port forwardings (status==CREATE).
4412 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4413 if (epf->status == CREATE) {
4414 char *sportdesc, *dportdesc;
4415 sportdesc = dupprintf("%s%s%s%s%d%s",
4416 epf->saddr ? epf->saddr : "",
4417 epf->saddr ? ":" : "",
4418 epf->sserv ? epf->sserv : "",
4419 epf->sserv ? "(" : "",
4421 epf->sserv ? ")" : "");
4422 if (epf->type == 'D') {
4425 dportdesc = dupprintf("%s:%s%s%d%s",
4427 epf->dserv ? epf->dserv : "",
4428 epf->dserv ? "(" : "",
4430 epf->dserv ? ")" : "");
4433 if (epf->type == 'L') {
4434 const char *err = pfd_addforward(epf->daddr, epf->dport,
4435 epf->saddr, epf->sport,
4438 epf->addressfamily);
4440 logeventf(ssh, "Local %sport %s forwarding to %s%s%s",
4441 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4442 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4443 sportdesc, dportdesc,
4444 err ? " failed: " : "", err ? err : "");
4445 } else if (epf->type == 'D') {
4446 const char *err = pfd_addforward(NULL, -1,
4447 epf->saddr, epf->sport,
4450 epf->addressfamily);
4452 logeventf(ssh, "Local %sport %s SOCKS dynamic forwarding%s%s",
4453 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4454 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4456 err ? " failed: " : "", err ? err : "");
4458 struct ssh_rportfwd *pf;
4461 * Ensure the remote port forwardings tree exists.
4463 if (!ssh->rportfwds) {
4464 if (ssh->version == 1)
4465 ssh->rportfwds = newtree234(ssh_rportcmp_ssh1);
4467 ssh->rportfwds = newtree234(ssh_rportcmp_ssh2);
4470 pf = snew(struct ssh_rportfwd);
4471 strncpy(pf->dhost, epf->daddr, lenof(pf->dhost)-1);
4472 pf->dhost[lenof(pf->dhost)-1] = '\0';
4473 pf->dport = epf->dport;
4474 pf->sport = epf->sport;
4475 if (add234(ssh->rportfwds, pf) != pf) {
4476 logeventf(ssh, "Duplicate remote port forwarding to %s:%d",
4477 epf->daddr, epf->dport);
4480 logeventf(ssh, "Requesting remote port %s"
4481 " forward to %s", sportdesc, dportdesc);
4483 pf->sportdesc = sportdesc;
4488 if (ssh->version == 1) {
4489 send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST,
4490 PKT_INT, epf->sport,
4491 PKT_STR, epf->daddr,
4492 PKT_INT, epf->dport,
4494 ssh_queue_handler(ssh, SSH1_SMSG_SUCCESS,
4496 ssh_rportfwd_succfail, pf);
4498 struct Packet *pktout;
4499 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4500 ssh2_pkt_addstring(pktout, "tcpip-forward");
4501 ssh2_pkt_addbool(pktout, 1);/* want reply */
4503 ssh2_pkt_addstring(pktout, epf->saddr);
4504 } else if (cfg->rport_acceptall) {
4505 ssh2_pkt_addstring(pktout, "0.0.0.0");
4507 ssh2_pkt_addstring(pktout, "127.0.0.1");
4509 ssh2_pkt_adduint32(pktout, epf->sport);
4510 ssh2_pkt_send(ssh, pktout);
4512 ssh_queue_handler(ssh, SSH2_MSG_REQUEST_SUCCESS,
4513 SSH2_MSG_REQUEST_FAILURE,
4514 ssh_rportfwd_succfail, pf);
4523 static void ssh1_smsg_stdout_stderr_data(Ssh ssh, struct Packet *pktin)
4526 int stringlen, bufsize;
4528 ssh_pkt_getstring(pktin, &string, &stringlen);
4529 if (string == NULL) {
4530 bombout(("Incoming terminal data packet was badly formed"));
4534 bufsize = from_backend(ssh->frontend, pktin->type == SSH1_SMSG_STDERR_DATA,
4536 if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
4537 ssh->v1_stdout_throttling = 1;
4538 ssh_throttle_conn(ssh, +1);
4542 static void ssh1_smsg_x11_open(Ssh ssh, struct Packet *pktin)
4544 /* Remote side is trying to open a channel to talk to our
4545 * X-Server. Give them back a local channel number. */
4546 struct ssh_channel *c;
4547 int remoteid = ssh_pkt_getuint32(pktin);
4549 logevent("Received X11 connect request");
4550 /* Refuse if X11 forwarding is disabled. */
4551 if (!ssh->X11_fwd_enabled) {
4552 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4553 PKT_INT, remoteid, PKT_END);
4554 logevent("Rejected X11 connect request");
4556 c = snew(struct ssh_channel);
4559 if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c,
4560 ssh->x11auth, NULL, -1, &ssh->cfg) != NULL) {
4561 logevent("Opening X11 forward connection failed");
4563 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4564 PKT_INT, remoteid, PKT_END);
4567 ("Opening X11 forward connection succeeded");
4568 c->remoteid = remoteid;
4569 c->halfopen = FALSE;
4570 c->localid = alloc_channel_id(ssh);
4572 c->throttling_conn = 0;
4573 c->type = CHAN_X11; /* identify channel type */
4574 add234(ssh->channels, c);
4575 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4576 PKT_INT, c->remoteid, PKT_INT,
4577 c->localid, PKT_END);
4578 logevent("Opened X11 forward channel");
4583 static void ssh1_smsg_agent_open(Ssh ssh, struct Packet *pktin)
4585 /* Remote side is trying to open a channel to talk to our
4586 * agent. Give them back a local channel number. */
4587 struct ssh_channel *c;
4588 int remoteid = ssh_pkt_getuint32(pktin);
4590 /* Refuse if agent forwarding is disabled. */
4591 if (!ssh->agentfwd_enabled) {
4592 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4593 PKT_INT, remoteid, PKT_END);
4595 c = snew(struct ssh_channel);
4597 c->remoteid = remoteid;
4598 c->halfopen = FALSE;
4599 c->localid = alloc_channel_id(ssh);
4601 c->throttling_conn = 0;
4602 c->type = CHAN_AGENT; /* identify channel type */
4603 c->u.a.lensofar = 0;
4604 add234(ssh->channels, c);
4605 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4606 PKT_INT, c->remoteid, PKT_INT, c->localid,
4611 static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin)
4613 /* Remote side is trying to open a channel to talk to a
4614 * forwarded port. Give them back a local channel number. */
4615 struct ssh_channel *c;
4616 struct ssh_rportfwd pf, *pfp;
4621 c = snew(struct ssh_channel);
4624 remoteid = ssh_pkt_getuint32(pktin);
4625 ssh_pkt_getstring(pktin, &host, &hostsize);
4626 port = ssh_pkt_getuint32(pktin);
4628 if (hostsize >= lenof(pf.dhost))
4629 hostsize = lenof(pf.dhost)-1;
4630 memcpy(pf.dhost, host, hostsize);
4631 pf.dhost[hostsize] = '\0';
4633 pfp = find234(ssh->rportfwds, &pf, NULL);
4636 logeventf(ssh, "Rejected remote port open request for %s:%d",
4638 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4639 PKT_INT, remoteid, PKT_END);
4641 logeventf(ssh, "Received remote port open request for %s:%d",
4643 e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port,
4644 c, &ssh->cfg, pfp->pfrec->addressfamily);
4646 logeventf(ssh, "Port open failed: %s", e);
4648 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4649 PKT_INT, remoteid, PKT_END);
4651 c->remoteid = remoteid;
4652 c->halfopen = FALSE;
4653 c->localid = alloc_channel_id(ssh);
4655 c->throttling_conn = 0;
4656 c->type = CHAN_SOCKDATA; /* identify channel type */
4657 add234(ssh->channels, c);
4658 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4659 PKT_INT, c->remoteid, PKT_INT,
4660 c->localid, PKT_END);
4661 logevent("Forwarded port opened successfully");
4666 static void ssh1_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
4668 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4669 unsigned int localid = ssh_pkt_getuint32(pktin);
4670 struct ssh_channel *c;
4672 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4673 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4674 c->remoteid = localid;
4675 c->halfopen = FALSE;
4676 c->type = CHAN_SOCKDATA;
4677 c->throttling_conn = 0;
4678 pfd_confirm(c->u.pfd.s);
4681 if (c && c->closes) {
4683 * We have a pending close on this channel,
4684 * which we decided on before the server acked
4685 * the channel open. So now we know the
4686 * remoteid, we can close it again.
4688 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE,
4689 PKT_INT, c->remoteid, PKT_END);
4693 static void ssh1_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
4695 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4696 struct ssh_channel *c;
4698 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4699 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4700 logevent("Forwarded connection refused by server");
4701 pfd_close(c->u.pfd.s);
4702 del234(ssh->channels, c);
4707 static void ssh1_msg_channel_close(Ssh ssh, struct Packet *pktin)
4709 /* Remote side closes a channel. */
4710 unsigned i = ssh_pkt_getuint32(pktin);
4711 struct ssh_channel *c;
4712 c = find234(ssh->channels, &i, ssh_channelfind);
4713 if (c && !c->halfopen) {
4716 (pktin->type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2);
4718 if ((c->closes == 0) && (c->type == CHAN_X11)) {
4719 logevent("Forwarded X11 connection terminated");
4720 assert(c->u.x11.s != NULL);
4721 x11_close(c->u.x11.s);
4724 if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) {
4725 logevent("Forwarded port closed");
4726 assert(c->u.pfd.s != NULL);
4727 pfd_close(c->u.pfd.s);
4731 c->closes |= (closetype << 2); /* seen this message */
4732 if (!(c->closes & closetype)) {
4733 send_packet(ssh, pktin->type, PKT_INT, c->remoteid,
4735 c->closes |= closetype; /* sent it too */
4738 if (c->closes == 15) {
4739 del234(ssh->channels, c);
4743 bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n",
4744 pktin->type == SSH1_MSG_CHANNEL_CLOSE ? "" :
4745 "_CONFIRMATION", c ? "half-open" : "nonexistent",
4750 static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin)
4752 /* Data sent down one of our channels. */
4753 int i = ssh_pkt_getuint32(pktin);
4756 struct ssh_channel *c;
4758 ssh_pkt_getstring(pktin, &p, &len);
4760 c = find234(ssh->channels, &i, ssh_channelfind);
4765 bufsize = x11_send(c->u.x11.s, p, len);
4768 bufsize = pfd_send(c->u.pfd.s, p, len);
4771 /* Data for an agent message. Buffer it. */
4773 if (c->u.a.lensofar < 4) {
4774 unsigned int l = min(4 - c->u.a.lensofar, (unsigned)len);
4775 memcpy(c->u.a.msglen + c->u.a.lensofar, p,
4779 c->u.a.lensofar += l;
4781 if (c->u.a.lensofar == 4) {
4783 4 + GET_32BIT(c->u.a.msglen);
4784 c->u.a.message = snewn(c->u.a.totallen,
4786 memcpy(c->u.a.message, c->u.a.msglen, 4);
4788 if (c->u.a.lensofar >= 4 && len > 0) {
4790 min(c->u.a.totallen - c->u.a.lensofar,
4792 memcpy(c->u.a.message + c->u.a.lensofar, p,
4796 c->u.a.lensofar += l;
4798 if (c->u.a.lensofar == c->u.a.totallen) {
4801 if (agent_query(c->u.a.message,
4804 ssh_agentf_callback, c))
4805 ssh_agentf_callback(c, reply, replylen);
4806 sfree(c->u.a.message);
4807 c->u.a.lensofar = 0;
4810 bufsize = 0; /* agent channels never back up */
4813 if (!c->throttling_conn && bufsize > SSH1_BUFFER_LIMIT) {
4814 c->throttling_conn = 1;
4815 ssh_throttle_conn(ssh, +1);
4820 static void ssh1_smsg_exit_status(Ssh ssh, struct Packet *pktin)
4822 ssh->exitcode = ssh_pkt_getuint32(pktin);
4823 logeventf(ssh, "Server sent command exit status %d", ssh->exitcode);
4824 send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
4826 * In case `helpful' firewalls or proxies tack
4827 * extra human-readable text on the end of the
4828 * session which we might mistake for another
4829 * encrypted packet, we close the session once
4830 * we've sent EXIT_CONFIRMATION.
4832 ssh_disconnect(ssh, NULL, NULL, 0, TRUE);
4835 /* Helper function to deal with sending tty modes for REQUEST_PTY */
4836 static void ssh1_send_ttymode(void *data, char *mode, char *val)
4838 struct Packet *pktout = (struct Packet *)data;
4840 unsigned int arg = 0;
4841 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
4842 if (i == lenof(ssh_ttymodes)) return;
4843 switch (ssh_ttymodes[i].type) {
4845 arg = ssh_tty_parse_specchar(val);
4848 arg = ssh_tty_parse_boolean(val);
4851 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
4852 ssh2_pkt_addbyte(pktout, arg);
4856 static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
4857 struct Packet *pktin)
4859 crBegin(ssh->do_ssh1_connection_crstate);
4861 ssh->packet_dispatch[SSH1_SMSG_STDOUT_DATA] =
4862 ssh->packet_dispatch[SSH1_SMSG_STDERR_DATA] =
4863 ssh1_smsg_stdout_stderr_data;
4865 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_CONFIRMATION] =
4866 ssh1_msg_channel_open_confirmation;
4867 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_FAILURE] =
4868 ssh1_msg_channel_open_failure;
4869 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE] =
4870 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION] =
4871 ssh1_msg_channel_close;
4872 ssh->packet_dispatch[SSH1_MSG_CHANNEL_DATA] = ssh1_msg_channel_data;
4873 ssh->packet_dispatch[SSH1_SMSG_EXIT_STATUS] = ssh1_smsg_exit_status;
4875 if (ssh->cfg.agentfwd && agent_exists()) {
4876 logevent("Requesting agent forwarding");
4877 send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END);
4881 if (pktin->type != SSH1_SMSG_SUCCESS
4882 && pktin->type != SSH1_SMSG_FAILURE) {
4883 bombout(("Protocol confusion"));
4885 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4886 logevent("Agent forwarding refused");
4888 logevent("Agent forwarding enabled");
4889 ssh->agentfwd_enabled = TRUE;
4890 ssh->packet_dispatch[SSH1_SMSG_AGENT_OPEN] = ssh1_smsg_agent_open;
4894 if (ssh->cfg.x11_forward) {
4895 char proto[20], data[64];
4896 logevent("Requesting X11 forwarding");
4897 ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
4898 data, sizeof(data), ssh->cfg.x11_auth);
4899 x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display);
4901 * Note that while we blank the X authentication data here, we don't
4902 * take any special action to blank the start of an X11 channel,
4903 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
4904 * without having session blanking enabled is likely to leak your
4905 * cookie into the log.
4907 if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) {
4908 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
4910 PKTT_PASSWORD, PKT_STR, data, PKTT_OTHER,
4911 PKT_INT, x11_get_screen_number(ssh->cfg.x11_display),
4914 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
4916 PKTT_PASSWORD, PKT_STR, data, PKTT_OTHER, PKT_END);
4921 if (pktin->type != SSH1_SMSG_SUCCESS
4922 && pktin->type != SSH1_SMSG_FAILURE) {
4923 bombout(("Protocol confusion"));
4925 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4926 logevent("X11 forwarding refused");
4928 logevent("X11 forwarding enabled");
4929 ssh->X11_fwd_enabled = TRUE;
4930 ssh->packet_dispatch[SSH1_SMSG_X11_OPEN] = ssh1_smsg_x11_open;
4934 ssh_setup_portfwd(ssh, &ssh->cfg);
4935 ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = ssh1_msg_port_open;
4937 if (!ssh->cfg.nopty) {
4939 /* Unpick the terminal-speed string. */
4940 /* XXX perhaps we should allow no speeds to be sent. */
4941 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
4942 sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
4943 /* Send the pty request. */
4944 pkt = ssh1_pkt_init(SSH1_CMSG_REQUEST_PTY);
4945 ssh_pkt_addstring(pkt, ssh->cfg.termtype);
4946 ssh_pkt_adduint32(pkt, ssh->term_height);
4947 ssh_pkt_adduint32(pkt, ssh->term_width);
4948 ssh_pkt_adduint32(pkt, 0); /* width in pixels */
4949 ssh_pkt_adduint32(pkt, 0); /* height in pixels */
4950 parse_ttymodes(ssh, ssh->cfg.ttymodes,
4951 ssh1_send_ttymode, (void *)pkt);
4952 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_ISPEED);
4953 ssh_pkt_adduint32(pkt, ssh->ispeed);
4954 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_OSPEED);
4955 ssh_pkt_adduint32(pkt, ssh->ospeed);
4956 ssh_pkt_addbyte(pkt, SSH_TTY_OP_END);
4958 ssh->state = SSH_STATE_INTERMED;
4962 if (pktin->type != SSH1_SMSG_SUCCESS
4963 && pktin->type != SSH1_SMSG_FAILURE) {
4964 bombout(("Protocol confusion"));
4966 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4967 c_write_str(ssh, "Server refused to allocate pty\r\n");
4968 ssh->editing = ssh->echoing = 1;
4970 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
4971 ssh->ospeed, ssh->ispeed);
4973 ssh->editing = ssh->echoing = 1;
4976 if (ssh->cfg.compression) {
4977 send_packet(ssh, SSH1_CMSG_REQUEST_COMPRESSION, PKT_INT, 6, PKT_END);
4981 if (pktin->type != SSH1_SMSG_SUCCESS
4982 && pktin->type != SSH1_SMSG_FAILURE) {
4983 bombout(("Protocol confusion"));
4985 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4986 c_write_str(ssh, "Server refused to compress\r\n");
4988 logevent("Started compression");
4989 ssh->v1_compressing = TRUE;
4990 ssh->cs_comp_ctx = zlib_compress_init();
4991 logevent("Initialised zlib (RFC1950) compression");
4992 ssh->sc_comp_ctx = zlib_decompress_init();
4993 logevent("Initialised zlib (RFC1950) decompression");
4997 * Start the shell or command.
4999 * Special case: if the first-choice command is an SSH-2
5000 * subsystem (hence not usable here) and the second choice
5001 * exists, we fall straight back to that.
5004 char *cmd = ssh->cfg.remote_cmd_ptr;
5006 if (!cmd) cmd = ssh->cfg.remote_cmd;
5008 if (ssh->cfg.ssh_subsys && ssh->cfg.remote_cmd_ptr2) {
5009 cmd = ssh->cfg.remote_cmd_ptr2;
5010 ssh->fallback_cmd = TRUE;
5013 send_packet(ssh, SSH1_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END);
5015 send_packet(ssh, SSH1_CMSG_EXEC_SHELL, PKT_END);
5016 logevent("Started session");
5019 ssh->state = SSH_STATE_SESSION;
5020 if (ssh->size_needed)
5021 ssh_size(ssh, ssh->term_width, ssh->term_height);
5022 if (ssh->eof_needed)
5023 ssh_special(ssh, TS_EOF);
5026 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
5028 ssh->channels = newtree234(ssh_channelcmp);
5032 * By this point, most incoming packets are already being
5033 * handled by the dispatch table, and we need only pay
5034 * attention to the unusual ones.
5039 if (pktin->type == SSH1_SMSG_SUCCESS) {
5040 /* may be from EXEC_SHELL on some servers */
5041 } else if (pktin->type == SSH1_SMSG_FAILURE) {
5042 /* may be from EXEC_SHELL on some servers
5043 * if no pty is available or in other odd cases. Ignore */
5045 bombout(("Strange packet received: type %d", pktin->type));
5050 int len = min(inlen, 512);
5051 send_packet(ssh, SSH1_CMSG_STDIN_DATA,
5052 PKT_INT, len, PKTT_DATA, PKT_DATA, in, len,
5053 PKTT_OTHER, PKT_END);
5064 * Handle the top-level SSH-2 protocol.
5066 static void ssh1_msg_debug(Ssh ssh, struct Packet *pktin)
5071 ssh_pkt_getstring(pktin, &msg, &msglen);
5072 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
5075 static void ssh1_msg_disconnect(Ssh ssh, struct Packet *pktin)
5077 /* log reason code in disconnect message */
5081 ssh_pkt_getstring(pktin, &msg, &msglen);
5082 bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg));
5085 static void ssh_msg_ignore(Ssh ssh, struct Packet *pktin)
5087 /* Do nothing, because we're ignoring it! Duhh. */
5090 static void ssh1_protocol_setup(Ssh ssh)
5095 * Most messages are handled by the coroutines.
5097 for (i = 0; i < 256; i++)
5098 ssh->packet_dispatch[i] = NULL;
5101 * These special message types we install handlers for.
5103 ssh->packet_dispatch[SSH1_MSG_DISCONNECT] = ssh1_msg_disconnect;
5104 ssh->packet_dispatch[SSH1_MSG_IGNORE] = ssh_msg_ignore;
5105 ssh->packet_dispatch[SSH1_MSG_DEBUG] = ssh1_msg_debug;
5108 static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
5109 struct Packet *pktin)
5111 unsigned char *in=(unsigned char*)vin;
5112 if (ssh->state == SSH_STATE_CLOSED)
5115 if (pktin && ssh->packet_dispatch[pktin->type]) {
5116 ssh->packet_dispatch[pktin->type](ssh, pktin);
5120 if (!ssh->protocol_initial_phase_done) {
5121 if (do_ssh1_login(ssh, in, inlen, pktin))
5122 ssh->protocol_initial_phase_done = TRUE;
5127 do_ssh1_connection(ssh, in, inlen, pktin);
5131 * Utility routine for decoding comma-separated strings in KEXINIT.
5133 static int in_commasep_string(char *needle, char *haystack, int haylen)
5136 if (!needle || !haystack) /* protect against null pointers */
5138 needlen = strlen(needle);
5141 * Is it at the start of the string?
5143 if (haylen >= needlen && /* haystack is long enough */
5144 !memcmp(needle, haystack, needlen) && /* initial match */
5145 (haylen == needlen || haystack[needlen] == ',')
5146 /* either , or EOS follows */
5150 * If not, search for the next comma and resume after that.
5151 * If no comma found, terminate.
5153 while (haylen > 0 && *haystack != ',')
5154 haylen--, haystack++;
5157 haylen--, haystack++; /* skip over comma itself */
5162 * Similar routine for checking whether we have the first string in a list.
5164 static int first_in_commasep_string(char *needle, char *haystack, int haylen)
5167 if (!needle || !haystack) /* protect against null pointers */
5169 needlen = strlen(needle);
5171 * Is it at the start of the string?
5173 if (haylen >= needlen && /* haystack is long enough */
5174 !memcmp(needle, haystack, needlen) && /* initial match */
5175 (haylen == needlen || haystack[needlen] == ',')
5176 /* either , or EOS follows */
5184 * SSH-2 key creation method.
5185 * (Currently assumes 2 lots of any hash are sufficient to generate
5186 * keys/IVs for any cipher/MAC. SSH2_MKKEY_ITERS documents this assumption.)
5188 #define SSH2_MKKEY_ITERS (2)
5189 static void ssh2_mkkey(Ssh ssh, Bignum K, unsigned char *H, char chr,
5190 unsigned char *keyspace)
5192 const struct ssh_hash *h = ssh->kex->hash;
5194 /* First hlen bytes. */
5196 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
5197 hash_mpint(h, s, K);
5198 h->bytes(s, H, h->hlen);
5199 h->bytes(s, &chr, 1);
5200 h->bytes(s, ssh->v2_session_id, ssh->v2_session_id_len);
5201 h->final(s, keyspace);
5202 /* Next hlen bytes. */
5204 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
5205 hash_mpint(h, s, K);
5206 h->bytes(s, H, h->hlen);
5207 h->bytes(s, keyspace, h->hlen);
5208 h->final(s, keyspace + h->hlen);
5212 * Handle the SSH-2 transport layer.
5214 static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
5215 struct Packet *pktin)
5217 unsigned char *in = (unsigned char *)vin;
5218 struct do_ssh2_transport_state {
5219 int nbits, pbits, warn_kex, warn_cscipher, warn_sccipher;
5220 Bignum p, g, e, f, K;
5223 int kex_init_value, kex_reply_value;
5224 const struct ssh_mac **maclist;
5226 const struct ssh2_cipher *cscipher_tobe;
5227 const struct ssh2_cipher *sccipher_tobe;
5228 const struct ssh_mac *csmac_tobe;
5229 const struct ssh_mac *scmac_tobe;
5230 const struct ssh_compress *cscomp_tobe;
5231 const struct ssh_compress *sccomp_tobe;
5232 char *hostkeydata, *sigdata, *rsakeydata, *keystr, *fingerprint;
5233 int hostkeylen, siglen, rsakeylen;
5234 void *hkey; /* actual host key */
5235 void *rsakey; /* for RSA kex */
5236 unsigned char exchange_hash[SSH2_KEX_MAX_HASH_LEN];
5237 int n_preferred_kex;
5238 const struct ssh_kexes *preferred_kex[KEX_MAX];
5239 int n_preferred_ciphers;
5240 const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX];
5241 const struct ssh_compress *preferred_comp;
5242 int got_session_id, activated_authconn;
5243 struct Packet *pktout;
5248 crState(do_ssh2_transport_state);
5250 crBegin(ssh->do_ssh2_transport_crstate);
5252 s->cscipher_tobe = s->sccipher_tobe = NULL;
5253 s->csmac_tobe = s->scmac_tobe = NULL;
5254 s->cscomp_tobe = s->sccomp_tobe = NULL;
5256 s->got_session_id = s->activated_authconn = FALSE;
5259 * Be prepared to work around the buggy MAC problem.
5261 if (ssh->remote_bugs & BUG_SSH2_HMAC)
5262 s->maclist = buggymacs, s->nmacs = lenof(buggymacs);
5264 s->maclist = macs, s->nmacs = lenof(macs);
5267 ssh->pkt_kctx = SSH2_PKTCTX_NOKEX;
5269 int i, j, commalist_started;
5272 * Set up the preferred key exchange. (NULL => warn below here)
5274 s->n_preferred_kex = 0;
5275 for (i = 0; i < KEX_MAX; i++) {
5276 switch (ssh->cfg.ssh_kexlist[i]) {
5278 s->preferred_kex[s->n_preferred_kex++] =
5279 &ssh_diffiehellman_gex;
5282 s->preferred_kex[s->n_preferred_kex++] =
5283 &ssh_diffiehellman_group14;
5286 s->preferred_kex[s->n_preferred_kex++] =
5287 &ssh_diffiehellman_group1;
5290 s->preferred_kex[s->n_preferred_kex++] =
5294 /* Flag for later. Don't bother if it's the last in
5296 if (i < KEX_MAX - 1) {
5297 s->preferred_kex[s->n_preferred_kex++] = NULL;
5304 * Set up the preferred ciphers. (NULL => warn below here)
5306 s->n_preferred_ciphers = 0;
5307 for (i = 0; i < CIPHER_MAX; i++) {
5308 switch (ssh->cfg.ssh_cipherlist[i]) {
5309 case CIPHER_BLOWFISH:
5310 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_blowfish;
5313 if (ssh->cfg.ssh2_des_cbc) {
5314 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_des;
5318 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_3des;
5321 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_aes;
5323 case CIPHER_ARCFOUR:
5324 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_arcfour;
5327 /* Flag for later. Don't bother if it's the last in
5329 if (i < CIPHER_MAX - 1) {
5330 s->preferred_ciphers[s->n_preferred_ciphers++] = NULL;
5337 * Set up preferred compression.
5339 if (ssh->cfg.compression)
5340 s->preferred_comp = &ssh_zlib;
5342 s->preferred_comp = &ssh_comp_none;
5345 * Enable queueing of outgoing auth- or connection-layer
5346 * packets while we are in the middle of a key exchange.
5348 ssh->queueing = TRUE;
5351 * Flag that KEX is in progress.
5353 ssh->kex_in_progress = TRUE;
5356 * Construct and send our key exchange packet.
5358 s->pktout = ssh2_pkt_init(SSH2_MSG_KEXINIT);
5359 for (i = 0; i < 16; i++)
5360 ssh2_pkt_addbyte(s->pktout, (unsigned char) random_byte());
5361 /* List key exchange algorithms. */
5362 ssh2_pkt_addstring_start(s->pktout);
5363 commalist_started = 0;
5364 for (i = 0; i < s->n_preferred_kex; i++) {
5365 const struct ssh_kexes *k = s->preferred_kex[i];
5366 if (!k) continue; /* warning flag */
5367 for (j = 0; j < k->nkexes; j++) {
5368 if (commalist_started)
5369 ssh2_pkt_addstring_str(s->pktout, ",");
5370 ssh2_pkt_addstring_str(s->pktout, k->list[j]->name);
5371 commalist_started = 1;
5374 /* List server host key algorithms. */
5375 ssh2_pkt_addstring_start(s->pktout);
5376 for (i = 0; i < lenof(hostkey_algs); i++) {
5377 ssh2_pkt_addstring_str(s->pktout, hostkey_algs[i]->name);
5378 if (i < lenof(hostkey_algs) - 1)
5379 ssh2_pkt_addstring_str(s->pktout, ",");
5381 /* List client->server encryption algorithms. */
5382 ssh2_pkt_addstring_start(s->pktout);
5383 commalist_started = 0;
5384 for (i = 0; i < s->n_preferred_ciphers; i++) {
5385 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5386 if (!c) continue; /* warning flag */
5387 for (j = 0; j < c->nciphers; j++) {
5388 if (commalist_started)
5389 ssh2_pkt_addstring_str(s->pktout, ",");
5390 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
5391 commalist_started = 1;
5394 /* List server->client encryption algorithms. */
5395 ssh2_pkt_addstring_start(s->pktout);
5396 commalist_started = 0;
5397 for (i = 0; i < s->n_preferred_ciphers; i++) {
5398 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5399 if (!c) continue; /* warning flag */
5400 for (j = 0; j < c->nciphers; j++) {
5401 if (commalist_started)
5402 ssh2_pkt_addstring_str(s->pktout, ",");
5403 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
5404 commalist_started = 1;
5407 /* List client->server MAC algorithms. */
5408 ssh2_pkt_addstring_start(s->pktout);
5409 for (i = 0; i < s->nmacs; i++) {
5410 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
5411 if (i < s->nmacs - 1)
5412 ssh2_pkt_addstring_str(s->pktout, ",");
5414 /* List server->client MAC algorithms. */
5415 ssh2_pkt_addstring_start(s->pktout);
5416 for (i = 0; i < s->nmacs; i++) {
5417 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
5418 if (i < s->nmacs - 1)
5419 ssh2_pkt_addstring_str(s->pktout, ",");
5421 /* List client->server compression algorithms. */
5422 ssh2_pkt_addstring_start(s->pktout);
5423 assert(lenof(compressions) > 1);
5424 ssh2_pkt_addstring_str(s->pktout, s->preferred_comp->name);
5425 for (i = 0; i < lenof(compressions); i++) {
5426 const struct ssh_compress *c = compressions[i];
5427 if (c != s->preferred_comp) {
5428 ssh2_pkt_addstring_str(s->pktout, ",");
5429 ssh2_pkt_addstring_str(s->pktout, c->name);
5432 /* List server->client compression algorithms. */
5433 ssh2_pkt_addstring_start(s->pktout);
5434 assert(lenof(compressions) > 1);
5435 ssh2_pkt_addstring_str(s->pktout, s->preferred_comp->name);
5436 for (i = 0; i < lenof(compressions); i++) {
5437 const struct ssh_compress *c = compressions[i];
5438 if (c != s->preferred_comp) {
5439 ssh2_pkt_addstring_str(s->pktout, ",");
5440 ssh2_pkt_addstring_str(s->pktout, c->name);
5443 /* List client->server languages. Empty list. */
5444 ssh2_pkt_addstring_start(s->pktout);
5445 /* List server->client languages. Empty list. */
5446 ssh2_pkt_addstring_start(s->pktout);
5447 /* First KEX packet does _not_ follow, because we're not that brave. */
5448 ssh2_pkt_addbool(s->pktout, FALSE);
5450 ssh2_pkt_adduint32(s->pktout, 0);
5453 s->our_kexinitlen = s->pktout->length - 5;
5454 s->our_kexinit = snewn(s->our_kexinitlen, unsigned char);
5455 memcpy(s->our_kexinit, s->pktout->data + 5, s->our_kexinitlen);
5457 ssh2_pkt_send_noqueue(ssh, s->pktout);
5463 * Now examine the other side's KEXINIT to see what we're up
5467 char *str, *preferred;
5470 if (pktin->type != SSH2_MSG_KEXINIT) {
5471 bombout(("expected key exchange packet from server"));
5475 ssh->hostkey = NULL;
5476 s->cscipher_tobe = NULL;
5477 s->sccipher_tobe = NULL;
5478 s->csmac_tobe = NULL;
5479 s->scmac_tobe = NULL;
5480 s->cscomp_tobe = NULL;
5481 s->sccomp_tobe = NULL;
5482 s->warn_kex = s->warn_cscipher = s->warn_sccipher = FALSE;
5484 pktin->savedpos += 16; /* skip garbage cookie */
5485 ssh_pkt_getstring(pktin, &str, &len); /* key exchange algorithms */
5488 for (i = 0; i < s->n_preferred_kex; i++) {
5489 const struct ssh_kexes *k = s->preferred_kex[i];
5493 for (j = 0; j < k->nkexes; j++) {
5494 if (!preferred) preferred = k->list[j]->name;
5495 if (in_commasep_string(k->list[j]->name, str, len)) {
5496 ssh->kex = k->list[j];
5505 bombout(("Couldn't agree a key exchange algorithm (available: %s)",
5506 str ? str : "(null)"));
5510 * Note that the server's guess is considered wrong if it doesn't match
5511 * the first algorithm in our list, even if it's still the algorithm
5514 s->guessok = first_in_commasep_string(preferred, str, len);
5515 ssh_pkt_getstring(pktin, &str, &len); /* host key algorithms */
5516 for (i = 0; i < lenof(hostkey_algs); i++) {
5517 if (in_commasep_string(hostkey_algs[i]->name, str, len)) {
5518 ssh->hostkey = hostkey_algs[i];
5522 s->guessok = s->guessok &&
5523 first_in_commasep_string(hostkey_algs[0]->name, str, len);
5524 ssh_pkt_getstring(pktin, &str, &len); /* client->server cipher */
5525 for (i = 0; i < s->n_preferred_ciphers; i++) {
5526 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5528 s->warn_cscipher = TRUE;
5530 for (j = 0; j < c->nciphers; j++) {
5531 if (in_commasep_string(c->list[j]->name, str, len)) {
5532 s->cscipher_tobe = c->list[j];
5537 if (s->cscipher_tobe)
5540 if (!s->cscipher_tobe) {
5541 bombout(("Couldn't agree a client-to-server cipher (available: %s)",
5542 str ? str : "(null)"));
5546 ssh_pkt_getstring(pktin, &str, &len); /* server->client cipher */
5547 for (i = 0; i < s->n_preferred_ciphers; i++) {
5548 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5550 s->warn_sccipher = TRUE;
5552 for (j = 0; j < c->nciphers; j++) {
5553 if (in_commasep_string(c->list[j]->name, str, len)) {
5554 s->sccipher_tobe = c->list[j];
5559 if (s->sccipher_tobe)
5562 if (!s->sccipher_tobe) {
5563 bombout(("Couldn't agree a server-to-client cipher (available: %s)",
5564 str ? str : "(null)"));
5568 ssh_pkt_getstring(pktin, &str, &len); /* client->server mac */
5569 for (i = 0; i < s->nmacs; i++) {
5570 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5571 s->csmac_tobe = s->maclist[i];
5575 ssh_pkt_getstring(pktin, &str, &len); /* server->client mac */
5576 for (i = 0; i < s->nmacs; i++) {
5577 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5578 s->scmac_tobe = s->maclist[i];
5582 ssh_pkt_getstring(pktin, &str, &len); /* client->server compression */
5583 for (i = 0; i < lenof(compressions) + 1; i++) {
5584 const struct ssh_compress *c =
5585 i == 0 ? s->preferred_comp : compressions[i - 1];
5586 if (in_commasep_string(c->name, str, len)) {
5591 ssh_pkt_getstring(pktin, &str, &len); /* server->client compression */
5592 for (i = 0; i < lenof(compressions) + 1; i++) {
5593 const struct ssh_compress *c =
5594 i == 0 ? s->preferred_comp : compressions[i - 1];
5595 if (in_commasep_string(c->name, str, len)) {
5600 ssh_pkt_getstring(pktin, &str, &len); /* client->server language */
5601 ssh_pkt_getstring(pktin, &str, &len); /* server->client language */
5602 s->ignorepkt = ssh2_pkt_getbool(pktin) && !s->guessok;
5605 ssh_set_frozen(ssh, 1);
5606 s->dlgret = askalg(ssh->frontend, "key-exchange algorithm",
5608 ssh_dialog_callback, ssh);
5609 if (s->dlgret < 0) {
5613 bombout(("Unexpected data from server while"
5614 " waiting for user response"));
5617 } while (pktin || inlen > 0);
5618 s->dlgret = ssh->user_response;
5620 ssh_set_frozen(ssh, 0);
5621 if (s->dlgret == 0) {
5622 ssh_disconnect(ssh, "User aborted at kex warning", NULL,
5628 if (s->warn_cscipher) {
5629 ssh_set_frozen(ssh, 1);
5630 s->dlgret = askalg(ssh->frontend,
5631 "client-to-server cipher",
5632 s->cscipher_tobe->name,
5633 ssh_dialog_callback, ssh);
5634 if (s->dlgret < 0) {
5638 bombout(("Unexpected data from server while"
5639 " waiting for user response"));
5642 } while (pktin || inlen > 0);
5643 s->dlgret = ssh->user_response;
5645 ssh_set_frozen(ssh, 0);
5646 if (s->dlgret == 0) {
5647 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5653 if (s->warn_sccipher) {
5654 ssh_set_frozen(ssh, 1);
5655 s->dlgret = askalg(ssh->frontend,
5656 "server-to-client cipher",
5657 s->sccipher_tobe->name,
5658 ssh_dialog_callback, ssh);
5659 if (s->dlgret < 0) {
5663 bombout(("Unexpected data from server while"
5664 " waiting for user response"));
5667 } while (pktin || inlen > 0);
5668 s->dlgret = ssh->user_response;
5670 ssh_set_frozen(ssh, 0);
5671 if (s->dlgret == 0) {
5672 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5678 ssh->exhash = ssh->kex->hash->init();
5679 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_c, strlen(ssh->v_c));
5680 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_s, strlen(ssh->v_s));
5681 hash_string(ssh->kex->hash, ssh->exhash,
5682 s->our_kexinit, s->our_kexinitlen);
5683 sfree(s->our_kexinit);
5684 if (pktin->length > 5)
5685 hash_string(ssh->kex->hash, ssh->exhash,
5686 pktin->data + 5, pktin->length - 5);
5688 if (s->ignorepkt) /* first_kex_packet_follows */
5689 crWaitUntil(pktin); /* Ignore packet */
5692 if (ssh->kex->main_type == KEXTYPE_DH) {
5694 * Work out the number of bits of key we will need from the
5695 * key exchange. We start with the maximum key length of
5701 csbits = s->cscipher_tobe->keylen;
5702 scbits = s->sccipher_tobe->keylen;
5703 s->nbits = (csbits > scbits ? csbits : scbits);
5705 /* The keys only have hlen-bit entropy, since they're based on
5706 * a hash. So cap the key size at hlen bits. */
5707 if (s->nbits > ssh->kex->hash->hlen * 8)
5708 s->nbits = ssh->kex->hash->hlen * 8;
5711 * If we're doing Diffie-Hellman group exchange, start by
5712 * requesting a group.
5714 if (!ssh->kex->pdata) {
5715 logevent("Doing Diffie-Hellman group exchange");
5716 ssh->pkt_kctx = SSH2_PKTCTX_DHGEX;
5718 * Work out how big a DH group we will need to allow that
5721 s->pbits = 512 << ((s->nbits - 1) / 64);
5722 s->pktout = ssh2_pkt_init(SSH2_MSG_KEX_DH_GEX_REQUEST);
5723 ssh2_pkt_adduint32(s->pktout, s->pbits);
5724 ssh2_pkt_send_noqueue(ssh, s->pktout);
5727 if (pktin->type != SSH2_MSG_KEX_DH_GEX_GROUP) {
5728 bombout(("expected key exchange group packet from server"));
5731 s->p = ssh2_pkt_getmp(pktin);
5732 s->g = ssh2_pkt_getmp(pktin);
5733 if (!s->p || !s->g) {
5734 bombout(("unable to read mp-ints from incoming group packet"));
5737 ssh->kex_ctx = dh_setup_gex(s->p, s->g);
5738 s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT;
5739 s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY;
5741 ssh->pkt_kctx = SSH2_PKTCTX_DHGROUP;
5742 ssh->kex_ctx = dh_setup_group(ssh->kex);
5743 s->kex_init_value = SSH2_MSG_KEXDH_INIT;
5744 s->kex_reply_value = SSH2_MSG_KEXDH_REPLY;
5745 logeventf(ssh, "Using Diffie-Hellman with standard group \"%s\"",
5746 ssh->kex->groupname);
5749 logeventf(ssh, "Doing Diffie-Hellman key exchange with hash %s",
5750 ssh->kex->hash->text_name);
5752 * Now generate and send e for Diffie-Hellman.
5754 set_busy_status(ssh->frontend, BUSY_CPU); /* this can take a while */
5755 s->e = dh_create_e(ssh->kex_ctx, s->nbits * 2);
5756 s->pktout = ssh2_pkt_init(s->kex_init_value);
5757 ssh2_pkt_addmp(s->pktout, s->e);
5758 ssh2_pkt_send_noqueue(ssh, s->pktout);
5760 set_busy_status(ssh->frontend, BUSY_WAITING); /* wait for server */
5762 if (pktin->type != s->kex_reply_value) {
5763 bombout(("expected key exchange reply packet from server"));
5766 set_busy_status(ssh->frontend, BUSY_CPU); /* cogitate */
5767 ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
5768 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
5769 s->f = ssh2_pkt_getmp(pktin);
5771 bombout(("unable to parse key exchange reply packet"));
5774 ssh_pkt_getstring(pktin, &s->sigdata, &s->siglen);
5776 s->K = dh_find_K(ssh->kex_ctx, s->f);
5778 /* We assume everything from now on will be quick, and it might
5779 * involve user interaction. */
5780 set_busy_status(ssh->frontend, BUSY_NOT);
5782 hash_string(ssh->kex->hash, ssh->exhash, s->hostkeydata, s->hostkeylen);
5783 if (!ssh->kex->pdata) {
5784 hash_uint32(ssh->kex->hash, ssh->exhash, s->pbits);
5785 hash_mpint(ssh->kex->hash, ssh->exhash, s->p);
5786 hash_mpint(ssh->kex->hash, ssh->exhash, s->g);
5788 hash_mpint(ssh->kex->hash, ssh->exhash, s->e);
5789 hash_mpint(ssh->kex->hash, ssh->exhash, s->f);
5791 dh_cleanup(ssh->kex_ctx);
5793 if (!ssh->kex->pdata) {
5798 logeventf(ssh, "Doing RSA key exchange with hash %s",
5799 ssh->kex->hash->text_name);
5800 ssh->pkt_kctx = SSH2_PKTCTX_RSAKEX;
5802 * RSA key exchange. First expect a KEXRSA_PUBKEY packet
5806 if (pktin->type != SSH2_MSG_KEXRSA_PUBKEY) {
5807 bombout(("expected RSA public key packet from server"));
5811 ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
5812 hash_string(ssh->kex->hash, ssh->exhash,
5813 s->hostkeydata, s->hostkeylen);
5814 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
5818 ssh_pkt_getstring(pktin, &keydata, &s->rsakeylen);
5819 s->rsakeydata = snewn(s->rsakeylen, char);
5820 memcpy(s->rsakeydata, keydata, s->rsakeylen);
5823 s->rsakey = ssh_rsakex_newkey(s->rsakeydata, s->rsakeylen);
5825 sfree(s->rsakeydata);
5826 bombout(("unable to parse RSA public key from server"));
5830 hash_string(ssh->kex->hash, ssh->exhash, s->rsakeydata, s->rsakeylen);
5833 * Next, set up a shared secret K, of precisely KLEN -
5834 * 2*HLEN - 49 bits, where KLEN is the bit length of the
5835 * RSA key modulus and HLEN is the bit length of the hash
5839 int klen = ssh_rsakex_klen(s->rsakey);
5840 int nbits = klen - (2*ssh->kex->hash->hlen*8 + 49);
5842 unsigned char *kstr1, *kstr2, *outstr;
5843 int kstr1len, kstr2len, outstrlen;
5845 s->K = bn_power_2(nbits - 1);
5847 for (i = 0; i < nbits; i++) {
5849 byte = random_byte();
5851 bignum_set_bit(s->K, i, (byte >> (i & 7)) & 1);
5855 * Encode this as an mpint.
5857 kstr1 = ssh2_mpint_fmt(s->K, &kstr1len);
5858 kstr2 = snewn(kstr2len = 4 + kstr1len, unsigned char);
5859 PUT_32BIT(kstr2, kstr1len);
5860 memcpy(kstr2 + 4, kstr1, kstr1len);
5863 * Encrypt it with the given RSA key.
5865 outstrlen = (klen + 7) / 8;
5866 outstr = snewn(outstrlen, unsigned char);
5867 ssh_rsakex_encrypt(ssh->kex->hash, kstr2, kstr2len,
5868 outstr, outstrlen, s->rsakey);
5871 * And send it off in a return packet.
5873 s->pktout = ssh2_pkt_init(SSH2_MSG_KEXRSA_SECRET);
5874 ssh2_pkt_addstring_start(s->pktout);
5875 ssh2_pkt_addstring_data(s->pktout, (char *)outstr, outstrlen);
5876 ssh2_pkt_send_noqueue(ssh, s->pktout);
5878 hash_string(ssh->kex->hash, ssh->exhash, outstr, outstrlen);
5885 ssh_rsakex_freekey(s->rsakey);
5888 if (pktin->type != SSH2_MSG_KEXRSA_DONE) {
5889 sfree(s->rsakeydata);
5890 bombout(("expected signature packet from server"));
5894 ssh_pkt_getstring(pktin, &s->sigdata, &s->siglen);
5896 sfree(s->rsakeydata);
5899 hash_mpint(ssh->kex->hash, ssh->exhash, s->K);
5900 assert(ssh->kex->hash->hlen <= sizeof(s->exchange_hash));
5901 ssh->kex->hash->final(ssh->exhash, s->exchange_hash);
5903 ssh->kex_ctx = NULL;
5906 debug(("Exchange hash is:\n"));
5907 dmemdump(s->exchange_hash, ssh->kex->hash->hlen);
5911 !ssh->hostkey->verifysig(s->hkey, s->sigdata, s->siglen,
5912 (char *)s->exchange_hash,
5913 ssh->kex->hash->hlen)) {
5914 bombout(("Server's host key did not match the signature supplied"));
5919 * Authenticate remote host: verify host key. (We've already
5920 * checked the signature of the exchange hash.)
5922 s->keystr = ssh->hostkey->fmtkey(s->hkey);
5923 s->fingerprint = ssh->hostkey->fingerprint(s->hkey);
5924 ssh_set_frozen(ssh, 1);
5925 s->dlgret = verify_ssh_host_key(ssh->frontend,
5926 ssh->savedhost, ssh->savedport,
5927 ssh->hostkey->keytype, s->keystr,
5929 ssh_dialog_callback, ssh);
5930 if (s->dlgret < 0) {
5934 bombout(("Unexpected data from server while waiting"
5935 " for user host key response"));
5938 } while (pktin || inlen > 0);
5939 s->dlgret = ssh->user_response;
5941 ssh_set_frozen(ssh, 0);
5942 if (s->dlgret == 0) {
5943 ssh_disconnect(ssh, "User aborted at host key verification", NULL,
5947 if (!s->got_session_id) { /* don't bother logging this in rekeys */
5948 logevent("Host key fingerprint is:");
5949 logevent(s->fingerprint);
5951 sfree(s->fingerprint);
5953 ssh->hostkey->freekey(s->hkey);
5956 * The exchange hash from the very first key exchange is also
5957 * the session id, used in session key construction and
5960 if (!s->got_session_id) {
5961 assert(sizeof(s->exchange_hash) <= sizeof(ssh->v2_session_id));
5962 memcpy(ssh->v2_session_id, s->exchange_hash,
5963 sizeof(s->exchange_hash));
5964 ssh->v2_session_id_len = ssh->kex->hash->hlen;
5965 assert(ssh->v2_session_id_len <= sizeof(ssh->v2_session_id));
5966 s->got_session_id = TRUE;
5970 * Send SSH2_MSG_NEWKEYS.
5972 s->pktout = ssh2_pkt_init(SSH2_MSG_NEWKEYS);
5973 ssh2_pkt_send_noqueue(ssh, s->pktout);
5974 ssh->outgoing_data_size = 0; /* start counting from here */
5977 * We've sent client NEWKEYS, so create and initialise
5978 * client-to-server session keys.
5980 if (ssh->cs_cipher_ctx)
5981 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
5982 ssh->cscipher = s->cscipher_tobe;
5983 ssh->cs_cipher_ctx = ssh->cscipher->make_context();
5985 if (ssh->cs_mac_ctx)
5986 ssh->csmac->free_context(ssh->cs_mac_ctx);
5987 ssh->csmac = s->csmac_tobe;
5988 ssh->cs_mac_ctx = ssh->csmac->make_context();
5990 if (ssh->cs_comp_ctx)
5991 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
5992 ssh->cscomp = s->cscomp_tobe;
5993 ssh->cs_comp_ctx = ssh->cscomp->compress_init();
5996 * Set IVs on client-to-server keys. Here we use the exchange
5997 * hash from the _first_ key exchange.
6000 unsigned char keyspace[SSH2_KEX_MAX_HASH_LEN * SSH2_MKKEY_ITERS];
6001 assert(sizeof(keyspace) >= ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
6002 ssh2_mkkey(ssh,s->K,s->exchange_hash,'C',keyspace);
6003 assert((ssh->cscipher->keylen+7) / 8 <=
6004 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
6005 ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace);
6006 ssh2_mkkey(ssh,s->K,s->exchange_hash,'A',keyspace);
6007 assert(ssh->cscipher->blksize <=
6008 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
6009 ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace);
6010 ssh2_mkkey(ssh,s->K,s->exchange_hash,'E',keyspace);
6011 assert(ssh->csmac->len <=
6012 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
6013 ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace);
6014 memset(keyspace, 0, sizeof(keyspace));
6017 logeventf(ssh, "Initialised %.200s client->server encryption",
6018 ssh->cscipher->text_name);
6019 logeventf(ssh, "Initialised %.200s client->server MAC algorithm",
6020 ssh->csmac->text_name);
6021 if (ssh->cscomp->text_name)
6022 logeventf(ssh, "Initialised %s compression",
6023 ssh->cscomp->text_name);
6026 * Now our end of the key exchange is complete, we can send all
6027 * our queued higher-layer packets.
6029 ssh->queueing = FALSE;
6030 ssh2_pkt_queuesend(ssh);
6033 * Expect SSH2_MSG_NEWKEYS from server.
6036 if (pktin->type != SSH2_MSG_NEWKEYS) {
6037 bombout(("expected new-keys packet from server"));
6040 ssh->incoming_data_size = 0; /* start counting from here */
6043 * We've seen server NEWKEYS, so create and initialise
6044 * server-to-client session keys.
6046 if (ssh->sc_cipher_ctx)
6047 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
6048 ssh->sccipher = s->sccipher_tobe;
6049 ssh->sc_cipher_ctx = ssh->sccipher->make_context();
6051 if (ssh->sc_mac_ctx)
6052 ssh->scmac->free_context(ssh->sc_mac_ctx);
6053 ssh->scmac = s->scmac_tobe;
6054 ssh->sc_mac_ctx = ssh->scmac->make_context();
6056 if (ssh->sc_comp_ctx)
6057 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
6058 ssh->sccomp = s->sccomp_tobe;
6059 ssh->sc_comp_ctx = ssh->sccomp->decompress_init();
6062 * Set IVs on server-to-client keys. Here we use the exchange
6063 * hash from the _first_ key exchange.
6066 unsigned char keyspace[SSH2_KEX_MAX_HASH_LEN * SSH2_MKKEY_ITERS];
6067 assert(sizeof(keyspace) >= ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
6068 ssh2_mkkey(ssh,s->K,s->exchange_hash,'D',keyspace);
6069 assert((ssh->sccipher->keylen+7) / 8 <=
6070 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
6071 ssh->sccipher->setkey(ssh->sc_cipher_ctx, keyspace);
6072 ssh2_mkkey(ssh,s->K,s->exchange_hash,'B',keyspace);
6073 assert(ssh->sccipher->blksize <=
6074 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
6075 ssh->sccipher->setiv(ssh->sc_cipher_ctx, keyspace);
6076 ssh2_mkkey(ssh,s->K,s->exchange_hash,'F',keyspace);
6077 assert(ssh->scmac->len <=
6078 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
6079 ssh->scmac->setkey(ssh->sc_mac_ctx, keyspace);
6080 memset(keyspace, 0, sizeof(keyspace));
6082 logeventf(ssh, "Initialised %.200s server->client encryption",
6083 ssh->sccipher->text_name);
6084 logeventf(ssh, "Initialised %.200s server->client MAC algorithm",
6085 ssh->scmac->text_name);
6086 if (ssh->sccomp->text_name)
6087 logeventf(ssh, "Initialised %s decompression",
6088 ssh->sccomp->text_name);
6091 * Free shared secret.
6096 * Key exchange is over. Loop straight back round if we have a
6097 * deferred rekey reason.
6099 if (ssh->deferred_rekey_reason) {
6100 logevent(ssh->deferred_rekey_reason);
6102 ssh->deferred_rekey_reason = NULL;
6103 goto begin_key_exchange;
6107 * Otherwise, schedule a timer for our next rekey.
6109 ssh->kex_in_progress = FALSE;
6110 ssh->last_rekey = GETTICKCOUNT();
6111 if (ssh->cfg.ssh_rekey_time != 0)
6112 ssh->next_rekey = schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
6116 * If this is the first key exchange phase, we must pass the
6117 * SSH2_MSG_NEWKEYS packet to the next layer, not because it
6118 * wants to see it but because it will need time to initialise
6119 * itself before it sees an actual packet. In subsequent key
6120 * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because
6121 * it would only confuse the layer above.
6123 if (s->activated_authconn) {
6126 s->activated_authconn = TRUE;
6129 * Now we're encrypting. Begin returning 1 to the protocol main
6130 * function so that other things can run on top of the
6131 * transport. If we ever see a KEXINIT, we must go back to the
6134 * We _also_ go back to the start if we see pktin==NULL and
6135 * inlen==-1, because this is a special signal meaning
6136 * `initiate client-driven rekey', and `in' contains a message
6137 * giving the reason for the rekey.
6139 while (!((pktin && pktin->type == SSH2_MSG_KEXINIT) ||
6140 (!pktin && inlen == -1))) {
6145 logevent("Server initiated key re-exchange");
6148 * Special case: if the server bug is set that doesn't
6149 * allow rekeying, we give a different log message and
6150 * continue waiting. (If such a server _initiates_ a rekey,
6151 * we process it anyway!)
6153 if ((ssh->remote_bugs & BUG_SSH2_REKEY)) {
6154 logeventf(ssh, "Server bug prevents key re-exchange (%s)",
6156 /* Reset the counters, so that at least this message doesn't
6157 * hit the event log _too_ often. */
6158 ssh->outgoing_data_size = 0;
6159 ssh->incoming_data_size = 0;
6160 if (ssh->cfg.ssh_rekey_time != 0) {
6162 schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
6165 goto wait_for_rekey; /* this is utterly horrid */
6167 logeventf(ssh, "Initiating key re-exchange (%s)", (char *)in);
6170 goto begin_key_exchange;
6176 * Add data to an SSH-2 channel output buffer.
6178 static void ssh2_add_channel_data(struct ssh_channel *c, char *buf,
6181 bufchain_add(&c->v.v2.outbuffer, buf, len);
6185 * Attempt to send data on an SSH-2 channel.
6187 static int ssh2_try_send(struct ssh_channel *c)
6190 struct Packet *pktout;
6192 while (c->v.v2.remwindow > 0 && bufchain_size(&c->v.v2.outbuffer) > 0) {
6195 bufchain_prefix(&c->v.v2.outbuffer, &data, &len);
6196 if ((unsigned)len > c->v.v2.remwindow)
6197 len = c->v.v2.remwindow;
6198 if ((unsigned)len > c->v.v2.remmaxpkt)
6199 len = c->v.v2.remmaxpkt;
6200 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_DATA);
6201 ssh2_pkt_adduint32(pktout, c->remoteid);
6202 ssh2_pkt_addstring_start(pktout);
6203 dont_log_data(ssh, pktout, PKTLOG_OMIT);
6204 ssh2_pkt_addstring_data(pktout, data, len);
6205 end_log_omission(ssh, pktout);
6206 ssh2_pkt_send(ssh, pktout);
6207 bufchain_consume(&c->v.v2.outbuffer, len);
6208 c->v.v2.remwindow -= len;
6212 * After having sent as much data as we can, return the amount
6215 return bufchain_size(&c->v.v2.outbuffer);
6218 static void ssh2_try_send_and_unthrottle(struct ssh_channel *c)
6222 return; /* don't send on closing channels */
6223 bufsize = ssh2_try_send(c);
6226 case CHAN_MAINSESSION:
6227 /* stdin need not receive an unthrottle
6228 * notification since it will be polled */
6231 x11_unthrottle(c->u.x11.s);
6234 /* agent sockets are request/response and need no
6235 * buffer management */
6238 pfd_unthrottle(c->u.pfd.s);
6245 * Set up most of a new ssh_channel for SSH-2.
6247 static void ssh2_channel_init(struct ssh_channel *c)
6250 c->localid = alloc_channel_id(ssh);
6252 c->throttling_conn = FALSE;
6253 c->v.v2.locwindow = c->v.v2.locmaxwin = c->v.v2.remlocwin =
6254 ssh->cfg.ssh_simple ? OUR_V2_BIGWIN : OUR_V2_WINSIZE;
6255 c->v.v2.winadj_head = c->v.v2.winadj_tail = NULL;
6256 c->v.v2.throttle_state = UNTHROTTLED;
6257 bufchain_init(&c->v.v2.outbuffer);
6261 * Potentially enlarge the window on an SSH-2 channel.
6263 static void ssh2_set_window(struct ssh_channel *c, int newwin)
6268 * Never send WINDOW_ADJUST for a channel that the remote side
6269 * already thinks it's closed; there's no point, since it won't
6270 * be sending any more data anyway.
6276 * If the remote end has a habit of ignoring maxpkt, limit the
6277 * window so that it has no choice (assuming it doesn't ignore the
6280 if ((ssh->remote_bugs & BUG_SSH2_MAXPKT) && newwin > OUR_V2_MAXPKT)
6281 newwin = OUR_V2_MAXPKT;
6285 * Only send a WINDOW_ADJUST if there's significantly more window
6286 * available than the other end thinks there is. This saves us
6287 * sending a WINDOW_ADJUST for every character in a shell session.
6289 * "Significant" is arbitrarily defined as half the window size.
6291 if (newwin / 2 >= c->v.v2.locwindow) {
6292 struct Packet *pktout;
6296 * In order to keep track of how much window the client
6297 * actually has available, we'd like it to acknowledge each
6298 * WINDOW_ADJUST. We can't do that directly, so we accompany
6299 * it with a CHANNEL_REQUEST that has to be acknowledged.
6301 * This is only necessary if we're opening the window wide.
6302 * If we're not, then throughput is being constrained by
6303 * something other than the maximum window size anyway.
6305 * We also only send this if the main channel has finished its
6306 * initial CHANNEL_REQUESTs and installed the default
6307 * CHANNEL_FAILURE handler, so as not to risk giving it
6308 * unexpected CHANNEL_FAILUREs.
6310 if (newwin == c->v.v2.locmaxwin &&
6311 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE]) {
6312 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
6313 ssh2_pkt_adduint32(pktout, c->remoteid);
6314 ssh2_pkt_addstring(pktout, "winadj@putty.projects.tartarus.org");
6315 ssh2_pkt_addbool(pktout, TRUE);
6316 ssh2_pkt_send(ssh, pktout);
6319 * CHANNEL_FAILURE doesn't come with any indication of
6320 * what message caused it, so we have to keep track of the
6321 * outstanding CHANNEL_REQUESTs ourselves.
6323 wa = snew(struct winadj);
6324 wa->size = newwin - c->v.v2.locwindow;
6326 if (!c->v.v2.winadj_head)
6327 c->v.v2.winadj_head = wa;
6329 c->v.v2.winadj_tail->next = wa;
6330 c->v.v2.winadj_tail = wa;
6331 if (c->v.v2.throttle_state != UNTHROTTLED)
6332 c->v.v2.throttle_state = UNTHROTTLING;
6334 /* Pretend the WINDOW_ADJUST was acked immediately. */
6335 c->v.v2.remlocwin = newwin;
6336 c->v.v2.throttle_state = THROTTLED;
6338 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
6339 ssh2_pkt_adduint32(pktout, c->remoteid);
6340 ssh2_pkt_adduint32(pktout, newwin - c->v.v2.locwindow);
6341 ssh2_pkt_send(ssh, pktout);
6342 c->v.v2.locwindow = newwin;
6347 * Find the channel associated with a message. If there's no channel,
6348 * or it's not properly open, make a noise about it and return NULL.
6350 static struct ssh_channel *ssh2_channel_msg(Ssh ssh, struct Packet *pktin)
6352 unsigned localid = ssh_pkt_getuint32(pktin);
6353 struct ssh_channel *c;
6355 c = find234(ssh->channels, &localid, ssh_channelfind);
6357 (c->halfopen && pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION &&
6358 pktin->type != SSH2_MSG_CHANNEL_OPEN_FAILURE)) {
6359 char *buf = dupprintf("Received %s for %s channel %u",
6360 ssh2_pkt_type(ssh->pkt_kctx, ssh->pkt_actx,
6362 c ? "half-open" : "nonexistent", localid);
6363 ssh_disconnect(ssh, NULL, buf, SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6370 static void ssh2_msg_channel_success(Ssh ssh, struct Packet *pktin)
6373 * This should never get called. All channel requests are either
6374 * sent with want_reply false or are sent before this handler gets
6377 struct ssh_channel *c;
6380 c = ssh2_channel_msg(ssh, pktin);
6383 wa = c->v.v2.winadj_head;
6385 ssh_disconnect(ssh, NULL, "Received SSH_MSG_CHANNEL_SUCCESS for "
6386 "\"winadj@putty.projects.tartarus.org\"",
6387 SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6389 ssh_disconnect(ssh, NULL,
6390 "Received unsolicited SSH_MSG_CHANNEL_SUCCESS",
6391 SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6394 static void ssh2_msg_channel_failure(Ssh ssh, struct Packet *pktin)
6397 * The only time this should get called is for "winadj@putty"
6398 * messages sent above. All other channel requests are either
6399 * sent with want_reply false or are sent before this handler gets
6402 struct ssh_channel *c;
6405 c = ssh2_channel_msg(ssh, pktin);
6408 wa = c->v.v2.winadj_head;
6410 ssh_disconnect(ssh, NULL,
6411 "Received unsolicited SSH_MSG_CHANNEL_FAILURE",
6412 SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6415 c->v.v2.winadj_head = wa->next;
6416 c->v.v2.remlocwin += wa->size;
6419 * winadj messages are only sent when the window is fully open, so
6420 * if we get an ack of one, we know any pending unthrottle is
6423 if (c->v.v2.throttle_state == UNTHROTTLING)
6424 c->v.v2.throttle_state = UNTHROTTLED;
6427 static void ssh2_msg_channel_window_adjust(Ssh ssh, struct Packet *pktin)
6429 struct ssh_channel *c;
6430 c = ssh2_channel_msg(ssh, pktin);
6434 c->v.v2.remwindow += ssh_pkt_getuint32(pktin);
6435 ssh2_try_send_and_unthrottle(c);
6439 static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin)
6443 struct ssh_channel *c;
6444 c = ssh2_channel_msg(ssh, pktin);
6447 if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA &&
6448 ssh_pkt_getuint32(pktin) != SSH2_EXTENDED_DATA_STDERR)
6449 return; /* extended but not stderr */
6450 ssh_pkt_getstring(pktin, &data, &length);
6453 c->v.v2.locwindow -= length;
6454 c->v.v2.remlocwin -= length;
6456 case CHAN_MAINSESSION:
6458 from_backend(ssh->frontend, pktin->type ==
6459 SSH2_MSG_CHANNEL_EXTENDED_DATA,
6463 bufsize = x11_send(c->u.x11.s, data, length);
6466 bufsize = pfd_send(c->u.pfd.s, data, length);
6469 while (length > 0) {
6470 if (c->u.a.lensofar < 4) {
6471 unsigned int l = min(4 - c->u.a.lensofar,
6473 memcpy(c->u.a.msglen + c->u.a.lensofar,
6477 c->u.a.lensofar += l;
6479 if (c->u.a.lensofar == 4) {
6481 4 + GET_32BIT(c->u.a.msglen);
6482 c->u.a.message = snewn(c->u.a.totallen,
6484 memcpy(c->u.a.message, c->u.a.msglen, 4);
6486 if (c->u.a.lensofar >= 4 && length > 0) {
6488 min(c->u.a.totallen - c->u.a.lensofar,
6490 memcpy(c->u.a.message + c->u.a.lensofar,
6494 c->u.a.lensofar += l;
6496 if (c->u.a.lensofar == c->u.a.totallen) {
6499 if (agent_query(c->u.a.message,
6502 ssh_agentf_callback, c))
6503 ssh_agentf_callback(c, reply, replylen);
6504 sfree(c->u.a.message);
6505 c->u.a.lensofar = 0;
6512 * If it looks like the remote end hit the end of its window,
6513 * and we didn't want it to do that, think about using a
6516 if (c->v.v2.remlocwin <= 0 && c->v.v2.throttle_state == UNTHROTTLED &&
6517 c->v.v2.locmaxwin < 0x40000000)
6518 c->v.v2.locmaxwin += OUR_V2_WINSIZE;
6520 * If we are not buffering too much data,
6521 * enlarge the window again at the remote side.
6522 * If we are buffering too much, we may still
6523 * need to adjust the window if the server's
6526 ssh2_set_window(c, bufsize < c->v.v2.locmaxwin ?
6527 c->v.v2.locmaxwin - bufsize : 0);
6529 * If we're either buffering way too much data, or if we're
6530 * buffering anything at all and we're in "simple" mode,
6531 * throttle the whole channel.
6533 if ((bufsize > c->v.v2.locmaxwin ||
6534 (ssh->cfg.ssh_simple && bufsize > 0)) &&
6535 !c->throttling_conn) {
6536 c->throttling_conn = 1;
6537 ssh_throttle_conn(ssh, +1);
6542 static void ssh2_msg_channel_eof(Ssh ssh, struct Packet *pktin)
6544 struct ssh_channel *c;
6546 c = ssh2_channel_msg(ssh, pktin);
6550 if (c->type == CHAN_X11) {
6552 * Remote EOF on an X11 channel means we should
6553 * wrap up and close the channel ourselves.
6555 x11_close(c->u.x11.s);
6557 } else if (c->type == CHAN_AGENT) {
6559 } else if (c->type == CHAN_SOCKDATA) {
6560 pfd_close(c->u.pfd.s);
6565 static void ssh2_msg_channel_close(Ssh ssh, struct Packet *pktin)
6567 struct ssh_channel *c;
6568 struct Packet *pktout;
6570 c = ssh2_channel_msg(ssh, pktin);
6573 /* Do pre-close processing on the channel. */
6575 case CHAN_MAINSESSION:
6576 ssh->mainchan = NULL;
6577 update_specials_menu(ssh->frontend);
6580 if (c->u.x11.s != NULL)
6581 x11_close(c->u.x11.s);
6588 if (c->u.pfd.s != NULL)
6589 pfd_close(c->u.pfd.s);
6593 if (c->closes == 0) {
6594 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6595 ssh2_pkt_adduint32(pktout, c->remoteid);
6596 ssh2_pkt_send(ssh, pktout);
6598 del234(ssh->channels, c);
6599 bufchain_clear(&c->v.v2.outbuffer);
6603 * See if that was the last channel left open.
6604 * (This is only our termination condition if we're
6605 * not running in -N mode.)
6607 if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) {
6609 * We used to send SSH_MSG_DISCONNECT here,
6610 * because I'd believed that _every_ conforming
6611 * SSH-2 connection had to end with a disconnect
6612 * being sent by at least one side; apparently
6613 * I was wrong and it's perfectly OK to
6614 * unceremoniously slam the connection shut
6615 * when you're done, and indeed OpenSSH feels
6616 * this is more polite than sending a
6617 * DISCONNECT. So now we don't.
6619 ssh_disconnect(ssh, "All channels closed", NULL, 0, TRUE);
6623 static void ssh2_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
6625 struct ssh_channel *c;
6626 struct Packet *pktout;
6628 c = ssh2_channel_msg(ssh, pktin);
6631 if (c->type != CHAN_SOCKDATA_DORMANT)
6632 return; /* dunno why they're confirming this */
6633 c->remoteid = ssh_pkt_getuint32(pktin);
6634 c->halfopen = FALSE;
6635 c->type = CHAN_SOCKDATA;
6636 c->v.v2.remwindow = ssh_pkt_getuint32(pktin);
6637 c->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
6639 pfd_confirm(c->u.pfd.s);
6642 * We have a pending close on this channel,
6643 * which we decided on before the server acked
6644 * the channel open. So now we know the
6645 * remoteid, we can close it again.
6647 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6648 ssh2_pkt_adduint32(pktout, c->remoteid);
6649 ssh2_pkt_send(ssh, pktout);
6653 static void ssh2_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
6655 static const char *const reasons[] = {
6656 "<unknown reason code>",
6657 "Administratively prohibited",
6659 "Unknown channel type",
6660 "Resource shortage",
6662 unsigned reason_code;
6663 char *reason_string;
6665 struct ssh_channel *c;
6666 c = ssh2_channel_msg(ssh, pktin);
6669 if (c->type != CHAN_SOCKDATA_DORMANT)
6670 return; /* dunno why they're failing this */
6672 reason_code = ssh_pkt_getuint32(pktin);
6673 if (reason_code >= lenof(reasons))
6674 reason_code = 0; /* ensure reasons[reason_code] in range */
6675 ssh_pkt_getstring(pktin, &reason_string, &reason_length);
6676 logeventf(ssh, "Forwarded connection refused by server: %s [%.*s]",
6677 reasons[reason_code], reason_length, reason_string);
6679 pfd_close(c->u.pfd.s);
6681 del234(ssh->channels, c);
6685 static void ssh2_msg_channel_request(Ssh ssh, struct Packet *pktin)
6688 int typelen, want_reply;
6689 int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */
6690 struct ssh_channel *c;
6691 struct Packet *pktout;
6693 c = ssh2_channel_msg(ssh, pktin);
6696 ssh_pkt_getstring(pktin, &type, &typelen);
6697 want_reply = ssh2_pkt_getbool(pktin);
6700 * Having got the channel number, we now look at
6701 * the request type string to see if it's something
6704 if (c == ssh->mainchan) {
6706 * We recognise "exit-status" and "exit-signal" on
6707 * the primary channel.
6709 if (typelen == 11 &&
6710 !memcmp(type, "exit-status", 11)) {
6712 ssh->exitcode = ssh_pkt_getuint32(pktin);
6713 logeventf(ssh, "Server sent command exit status %d",
6715 reply = SSH2_MSG_CHANNEL_SUCCESS;
6717 } else if (typelen == 11 &&
6718 !memcmp(type, "exit-signal", 11)) {
6720 int is_plausible = TRUE, is_int = FALSE;
6721 char *fmt_sig = "", *fmt_msg = "";
6723 int msglen = 0, core = FALSE;
6724 /* ICK: older versions of OpenSSH (e.g. 3.4p1)
6725 * provide an `int' for the signal, despite its
6726 * having been a `string' in the drafts of RFC 4254 since at
6727 * least 2001. (Fixed in session.c 1.147.) Try to
6728 * infer which we can safely parse it as. */
6730 unsigned char *p = pktin->body +
6732 long len = pktin->length - pktin->savedpos;
6733 unsigned long num = GET_32BIT(p); /* what is it? */
6734 /* If it's 0, it hardly matters; assume string */
6738 int maybe_int = FALSE, maybe_str = FALSE;
6739 #define CHECK_HYPOTHESIS(offset, result) \
6742 if (q >= 0 && q+4 <= len) { \
6743 q = q + 4 + GET_32BIT(p+q); \
6744 if (q >= 0 && q+4 <= len && \
6745 ((q = q + 4 + GET_32BIT(p+q))!= 0) && q == len) \
6749 CHECK_HYPOTHESIS(4+1, maybe_int);
6750 CHECK_HYPOTHESIS(4+num+1, maybe_str);
6751 #undef CHECK_HYPOTHESIS
6752 if (maybe_int && !maybe_str)
6754 else if (!maybe_int && maybe_str)
6757 /* Crikey. Either or neither. Panic. */
6758 is_plausible = FALSE;
6761 ssh->exitcode = 128; /* means `unknown signal' */
6764 /* Old non-standard OpenSSH. */
6765 int signum = ssh_pkt_getuint32(pktin);
6766 fmt_sig = dupprintf(" %d", signum);
6767 ssh->exitcode = 128 + signum;
6769 /* As per RFC 4254. */
6772 ssh_pkt_getstring(pktin, &sig, &siglen);
6773 /* Signal name isn't supposed to be blank, but
6774 * let's cope gracefully if it is. */
6776 fmt_sig = dupprintf(" \"%.*s\"",
6781 * Really hideous method of translating the
6782 * signal description back into a locally
6783 * meaningful number.
6788 #define TRANSLATE_SIGNAL(s) \
6789 else if (siglen == lenof(#s)-1 && !memcmp(sig, #s, siglen)) \
6790 ssh->exitcode = 128 + SIG ## s
6792 TRANSLATE_SIGNAL(ABRT);
6795 TRANSLATE_SIGNAL(ALRM);
6798 TRANSLATE_SIGNAL(FPE);
6801 TRANSLATE_SIGNAL(HUP);
6804 TRANSLATE_SIGNAL(ILL);
6807 TRANSLATE_SIGNAL(INT);
6810 TRANSLATE_SIGNAL(KILL);
6813 TRANSLATE_SIGNAL(PIPE);
6816 TRANSLATE_SIGNAL(QUIT);
6819 TRANSLATE_SIGNAL(SEGV);
6822 TRANSLATE_SIGNAL(TERM);
6825 TRANSLATE_SIGNAL(USR1);
6828 TRANSLATE_SIGNAL(USR2);
6830 #undef TRANSLATE_SIGNAL
6832 ssh->exitcode = 128;
6834 core = ssh2_pkt_getbool(pktin);
6835 ssh_pkt_getstring(pktin, &msg, &msglen);
6837 fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg);
6839 /* ignore lang tag */
6840 } /* else don't attempt to parse */
6841 logeventf(ssh, "Server exited on signal%s%s%s",
6842 fmt_sig, core ? " (core dumped)" : "",
6844 if (*fmt_sig) sfree(fmt_sig);
6845 if (*fmt_msg) sfree(fmt_msg);
6846 reply = SSH2_MSG_CHANNEL_SUCCESS;
6851 * This is a channel request we don't know
6852 * about, so we now either ignore the request
6853 * or respond with CHANNEL_FAILURE, depending
6856 reply = SSH2_MSG_CHANNEL_FAILURE;
6859 pktout = ssh2_pkt_init(reply);
6860 ssh2_pkt_adduint32(pktout, c->remoteid);
6861 ssh2_pkt_send(ssh, pktout);
6865 static void ssh2_msg_global_request(Ssh ssh, struct Packet *pktin)
6868 int typelen, want_reply;
6869 struct Packet *pktout;
6871 ssh_pkt_getstring(pktin, &type, &typelen);
6872 want_reply = ssh2_pkt_getbool(pktin);
6875 * We currently don't support any global requests
6876 * at all, so we either ignore the request or
6877 * respond with REQUEST_FAILURE, depending on
6881 pktout = ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE);
6882 ssh2_pkt_send(ssh, pktout);
6886 static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin)
6894 struct ssh_channel *c;
6895 unsigned remid, winsize, pktsize;
6896 struct Packet *pktout;
6898 ssh_pkt_getstring(pktin, &type, &typelen);
6899 c = snew(struct ssh_channel);
6902 remid = ssh_pkt_getuint32(pktin);
6903 winsize = ssh_pkt_getuint32(pktin);
6904 pktsize = ssh_pkt_getuint32(pktin);
6906 if (typelen == 3 && !memcmp(type, "x11", 3)) {
6909 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
6910 addrstr = snewn(peeraddrlen+1, char);
6911 memcpy(addrstr, peeraddr, peeraddrlen);
6912 addrstr[peeraddrlen] = '\0';
6913 peerport = ssh_pkt_getuint32(pktin);
6915 logeventf(ssh, "Received X11 connect request from %s:%d",
6918 if (!ssh->X11_fwd_enabled)
6919 error = "X11 forwarding is not enabled";
6920 else if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c,
6921 ssh->x11auth, addrstr, peerport,
6922 &ssh->cfg) != NULL) {
6923 error = "Unable to open an X11 connection";
6925 logevent("Opening X11 forward connection succeeded");
6930 } else if (typelen == 15 &&
6931 !memcmp(type, "forwarded-tcpip", 15)) {
6932 struct ssh_rportfwd pf, *realpf;
6935 ssh_pkt_getstring(pktin, &dummy, &dummylen);/* skip address */
6936 pf.sport = ssh_pkt_getuint32(pktin);
6937 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
6938 peerport = ssh_pkt_getuint32(pktin);
6939 realpf = find234(ssh->rportfwds, &pf, NULL);
6940 logeventf(ssh, "Received remote port %d open request "
6941 "from %s:%d", pf.sport, peeraddr, peerport);
6942 if (realpf == NULL) {
6943 error = "Remote port is not recognised";
6945 const char *e = pfd_newconnect(&c->u.pfd.s,
6949 realpf->pfrec->addressfamily);
6950 logeventf(ssh, "Attempting to forward remote port to "
6951 "%s:%d", realpf->dhost, realpf->dport);
6953 logeventf(ssh, "Port open failed: %s", e);
6954 error = "Port open failed";
6956 logevent("Forwarded port opened successfully");
6957 c->type = CHAN_SOCKDATA;
6960 } else if (typelen == 22 &&
6961 !memcmp(type, "auth-agent@openssh.com", 22)) {
6962 if (!ssh->agentfwd_enabled)
6963 error = "Agent forwarding is not enabled";
6965 c->type = CHAN_AGENT; /* identify channel type */
6966 c->u.a.lensofar = 0;
6969 error = "Unsupported channel type requested";
6972 c->remoteid = remid;
6973 c->halfopen = FALSE;
6975 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE);
6976 ssh2_pkt_adduint32(pktout, c->remoteid);
6977 ssh2_pkt_adduint32(pktout, SSH2_OPEN_CONNECT_FAILED);
6978 ssh2_pkt_addstring(pktout, error);
6979 ssh2_pkt_addstring(pktout, "en"); /* language tag */
6980 ssh2_pkt_send(ssh, pktout);
6981 logeventf(ssh, "Rejected channel open: %s", error);
6984 ssh2_channel_init(c);
6985 c->v.v2.remwindow = winsize;
6986 c->v.v2.remmaxpkt = pktsize;
6987 add234(ssh->channels, c);
6988 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
6989 ssh2_pkt_adduint32(pktout, c->remoteid);
6990 ssh2_pkt_adduint32(pktout, c->localid);
6991 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);
6992 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
6993 ssh2_pkt_send(ssh, pktout);
6998 * Buffer banner messages for later display at some convenient point.
7000 static void ssh2_msg_userauth_banner(Ssh ssh, struct Packet *pktin)
7002 /* Arbitrary limit to prevent unbounded inflation of buffer */
7003 if (bufchain_size(&ssh->banner) <= 131072) {
7004 char *banner = NULL;
7006 ssh_pkt_getstring(pktin, &banner, &size);
7008 bufchain_add(&ssh->banner, banner, size);
7012 /* Helper function to deal with sending tty modes for "pty-req" */
7013 static void ssh2_send_ttymode(void *data, char *mode, char *val)
7015 struct Packet *pktout = (struct Packet *)data;
7017 unsigned int arg = 0;
7018 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
7019 if (i == lenof(ssh_ttymodes)) return;
7020 switch (ssh_ttymodes[i].type) {
7022 arg = ssh_tty_parse_specchar(val);
7025 arg = ssh_tty_parse_boolean(val);
7028 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
7029 ssh2_pkt_adduint32(pktout, arg);
7033 * Handle the SSH-2 userauth and connection layers.
7035 static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
7036 struct Packet *pktin)
7038 struct do_ssh2_authconn_state {
7041 AUTH_TYPE_PUBLICKEY,
7042 AUTH_TYPE_PUBLICKEY_OFFER_LOUD,
7043 AUTH_TYPE_PUBLICKEY_OFFER_QUIET,
7045 AUTH_TYPE_KEYBOARD_INTERACTIVE,
7046 AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
7048 int done_service_req;
7049 int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter;
7050 int tried_pubkey_config, done_agent;
7051 int kbd_inter_refused;
7053 prompts_t *cur_prompt;
7058 void *publickey_blob;
7059 int publickey_bloblen;
7060 int publickey_encrypted;
7061 char *publickey_algorithm;
7062 char *publickey_comment;
7063 unsigned char agent_request[5], *agent_response, *agentp;
7064 int agent_responselen;
7065 unsigned char *pkblob_in_agent;
7067 char *pkblob, *alg, *commentp;
7068 int pklen, alglen, commentlen;
7069 int siglen, retlen, len;
7070 char *q, *agentreq, *ret;
7072 int num_env, env_left, env_ok;
7073 struct Packet *pktout;
7075 crState(do_ssh2_authconn_state);
7077 crBegin(ssh->do_ssh2_authconn_crstate);
7079 s->done_service_req = FALSE;
7080 s->we_are_in = FALSE;
7081 if (!ssh->cfg.ssh_no_userauth) {
7083 * Request userauth protocol, and await a response to it.
7085 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
7086 ssh2_pkt_addstring(s->pktout, "ssh-userauth");
7087 ssh2_pkt_send(ssh, s->pktout);
7088 crWaitUntilV(pktin);
7089 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT)
7090 s->done_service_req = TRUE;
7092 if (!s->done_service_req) {
7094 * Request connection protocol directly, without authentication.
7096 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
7097 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7098 ssh2_pkt_send(ssh, s->pktout);
7099 crWaitUntilV(pktin);
7100 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT) {
7101 s->we_are_in = TRUE; /* no auth required */
7103 bombout(("Server refused service request"));
7108 /* Arrange to be able to deal with any BANNERs that come in.
7109 * (We do this now as packets may come in during the next bit.) */
7110 bufchain_init(&ssh->banner);
7111 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] =
7112 ssh2_msg_userauth_banner;
7115 * Misc one-time setup for authentication.
7117 s->publickey_blob = NULL;
7118 if (!s->we_are_in) {
7121 * Load the public half of any configured public key file
7124 if (!filename_is_null(ssh->cfg.keyfile)) {
7126 logeventf(ssh, "Reading private key file \"%.150s\"",
7127 filename_to_str(&ssh->cfg.keyfile));
7128 keytype = key_type(&ssh->cfg.keyfile);
7129 if (keytype == SSH_KEYTYPE_SSH2) {
7132 ssh2_userkey_loadpub(&ssh->cfg.keyfile,
7133 &s->publickey_algorithm,
7134 &s->publickey_bloblen,
7135 &s->publickey_comment, &error);
7136 if (s->publickey_blob) {
7137 s->publickey_encrypted =
7138 ssh2_userkey_encrypted(&ssh->cfg.keyfile, NULL);
7141 logeventf(ssh, "Unable to load private key (%s)",
7143 msgbuf = dupprintf("Unable to load private key file "
7144 "\"%.150s\" (%s)\r\n",
7145 filename_to_str(&ssh->cfg.keyfile),
7147 c_write_str(ssh, msgbuf);
7152 logeventf(ssh, "Unable to use this key file (%s)",
7153 key_type_to_str(keytype));
7154 msgbuf = dupprintf("Unable to use key file \"%.150s\""
7156 filename_to_str(&ssh->cfg.keyfile),
7157 key_type_to_str(keytype));
7158 c_write_str(ssh, msgbuf);
7160 s->publickey_blob = NULL;
7165 * Find out about any keys Pageant has (but if there's a
7166 * public key configured, filter out all others).
7169 s->agent_response = NULL;
7170 s->pkblob_in_agent = NULL;
7171 if (ssh->cfg.tryagent && agent_exists()) {
7175 logevent("Pageant is running. Requesting keys.");
7177 /* Request the keys held by the agent. */
7178 PUT_32BIT(s->agent_request, 1);
7179 s->agent_request[4] = SSH2_AGENTC_REQUEST_IDENTITIES;
7180 if (!agent_query(s->agent_request, 5, &r, &s->agent_responselen,
7181 ssh_agent_callback, ssh)) {
7185 bombout(("Unexpected data from server while"
7186 " waiting for agent response"));
7189 } while (pktin || inlen > 0);
7190 r = ssh->agent_response;
7191 s->agent_responselen = ssh->agent_response_len;
7193 s->agent_response = (unsigned char *) r;
7194 if (s->agent_response && s->agent_responselen >= 5 &&
7195 s->agent_response[4] == SSH2_AGENT_IDENTITIES_ANSWER) {
7198 p = s->agent_response + 5;
7199 s->nkeys = GET_32BIT(p);
7201 logeventf(ssh, "Pageant has %d SSH-2 keys", s->nkeys);
7202 if (s->publickey_blob) {
7203 /* See if configured key is in agent. */
7204 for (keyi = 0; keyi < s->nkeys; keyi++) {
7205 s->pklen = GET_32BIT(p);
7206 if (s->pklen == s->publickey_bloblen &&
7207 !memcmp(p+4, s->publickey_blob,
7208 s->publickey_bloblen)) {
7209 logeventf(ssh, "Pageant key #%d matches "
7210 "configured key file", keyi);
7212 s->pkblob_in_agent = p;
7216 p += GET_32BIT(p) + 4; /* comment */
7218 if (!s->pkblob_in_agent) {
7219 logevent("Configured key file not in Pageant");
7229 * We repeat this whole loop, including the username prompt,
7230 * until we manage a successful authentication. If the user
7231 * types the wrong _password_, they can be sent back to the
7232 * beginning to try another username, if this is configured on.
7233 * (If they specify a username in the config, they are never
7234 * asked, even if they do give a wrong password.)
7236 * I think this best serves the needs of
7238 * - the people who have no configuration, no keys, and just
7239 * want to try repeated (username,password) pairs until they
7240 * type both correctly
7242 * - people who have keys and configuration but occasionally
7243 * need to fall back to passwords
7245 * - people with a key held in Pageant, who might not have
7246 * logged in to a particular machine before; so they want to
7247 * type a username, and then _either_ their key will be
7248 * accepted, _or_ they will type a password. If they mistype
7249 * the username they will want to be able to get back and
7252 s->username[0] = '\0';
7253 s->got_username = FALSE;
7254 while (!s->we_are_in) {
7258 if (s->got_username && !ssh->cfg.change_username) {
7260 * We got a username last time round this loop, and
7261 * with change_username turned off we don't try to get
7264 } else if (!*ssh->cfg.username) {
7265 int ret; /* need not be kept over crReturn */
7266 s->cur_prompt = new_prompts(ssh->frontend);
7267 s->cur_prompt->to_server = TRUE;
7268 s->cur_prompt->name = dupstr("SSH login name");
7269 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
7270 lenof(s->username));
7271 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7274 crWaitUntilV(!pktin);
7275 ret = get_userpass_input(s->cur_prompt, in, inlen);
7280 * get_userpass_input() failed to get a username.
7283 free_prompts(s->cur_prompt);
7284 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
7287 memcpy(s->username, s->cur_prompt->prompts[0]->result,
7288 lenof(s->username));
7289 free_prompts(s->cur_prompt);
7292 strncpy(s->username, ssh->cfg.username, sizeof(s->username));
7293 s->username[sizeof(s->username)-1] = '\0';
7294 if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
7295 stuff = dupprintf("Using username \"%s\".\r\n", s->username);
7296 c_write_str(ssh, stuff);
7300 s->got_username = TRUE;
7303 * Send an authentication request using method "none": (a)
7304 * just in case it succeeds, and (b) so that we know what
7305 * authentication methods we can usefully try next.
7307 ssh->pkt_actx = SSH2_PKTCTX_NOAUTH;
7309 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7310 ssh2_pkt_addstring(s->pktout, s->username);
7311 ssh2_pkt_addstring(s->pktout, "ssh-connection");/* service requested */
7312 ssh2_pkt_addstring(s->pktout, "none"); /* method */
7313 ssh2_pkt_send(ssh, s->pktout);
7314 s->type = AUTH_TYPE_NONE;
7316 s->we_are_in = FALSE;
7318 s->tried_pubkey_config = FALSE;
7319 s->kbd_inter_refused = FALSE;
7321 /* Reset agent request state. */
7322 s->done_agent = FALSE;
7323 if (s->agent_response) {
7324 if (s->pkblob_in_agent) {
7325 s->agentp = s->pkblob_in_agent;
7327 s->agentp = s->agent_response + 5 + 4;
7334 * Wait for the result of the last authentication request.
7337 crWaitUntilV(pktin);
7339 * Now is a convenient point to spew any banner material
7340 * that we've accumulated. (This should ensure that when
7341 * we exit the auth loop, we haven't any left to deal
7345 int size = bufchain_size(&ssh->banner);
7347 * Don't show the banner if we're operating in
7348 * non-verbose non-interactive mode. (It's probably
7349 * a script, which means nobody will read the
7350 * banner _anyway_, and moreover the printing of
7351 * the banner will screw up processing on the
7352 * output of (say) plink.)
7354 if (size && (flags & (FLAG_VERBOSE | FLAG_INTERACTIVE))) {
7355 char *banner = snewn(size, char);
7356 bufchain_fetch(&ssh->banner, banner, size);
7357 c_write_untrusted(ssh, banner, size);
7360 bufchain_clear(&ssh->banner);
7362 if (pktin->type == SSH2_MSG_USERAUTH_SUCCESS) {
7363 logevent("Access granted");
7364 s->we_are_in = TRUE;
7368 if (pktin->type != SSH2_MSG_USERAUTH_FAILURE) {
7369 bombout(("Strange packet received during authentication: "
7370 "type %d", pktin->type));
7377 * OK, we're now sitting on a USERAUTH_FAILURE message, so
7378 * we can look at the string in it and know what we can
7379 * helpfully try next.
7381 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE) {
7384 ssh_pkt_getstring(pktin, &methods, &methlen);
7385 if (!ssh2_pkt_getbool(pktin)) {
7387 * We have received an unequivocal Access
7388 * Denied. This can translate to a variety of
7391 * - if we'd just tried "none" authentication,
7392 * it's not worth printing anything at all
7394 * - if we'd just tried a public key _offer_,
7395 * the message should be "Server refused our
7396 * key" (or no message at all if the key
7397 * came from Pageant)
7399 * - if we'd just tried anything else, the
7400 * message really should be "Access denied".
7402 * Additionally, if we'd just tried password
7403 * authentication, we should break out of this
7404 * whole loop so as to go back to the username
7405 * prompt (iff we're configured to allow
7406 * username change attempts).
7408 if (s->type == AUTH_TYPE_NONE) {
7410 } else if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD ||
7411 s->type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) {
7412 if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD)
7413 c_write_str(ssh, "Server refused our key\r\n");
7414 logevent("Server refused public key");
7415 } else if (s->type==AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) {
7416 /* server declined keyboard-interactive; ignore */
7418 c_write_str(ssh, "Access denied\r\n");
7419 logevent("Access denied");
7420 if (s->type == AUTH_TYPE_PASSWORD &&
7421 ssh->cfg.change_username) {
7422 /* XXX perhaps we should allow
7423 * keyboard-interactive to do this too? */
7424 s->we_are_in = FALSE;
7429 c_write_str(ssh, "Further authentication required\r\n");
7430 logevent("Further authentication required");
7434 in_commasep_string("publickey", methods, methlen);
7436 in_commasep_string("password", methods, methlen);
7437 s->can_keyb_inter = ssh->cfg.try_ki_auth &&
7438 in_commasep_string("keyboard-interactive", methods, methlen);
7441 ssh->pkt_actx = SSH2_PKTCTX_NOAUTH;
7443 if (s->can_pubkey && !s->done_agent && s->nkeys) {
7446 * Attempt public-key authentication using a key from Pageant.
7449 ssh->pkt_actx = SSH2_PKTCTX_PUBLICKEY;
7451 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
7453 /* Unpack key from agent response */
7454 s->pklen = GET_32BIT(s->agentp);
7456 s->pkblob = (char *)s->agentp;
7457 s->agentp += s->pklen;
7458 s->alglen = GET_32BIT(s->pkblob);
7459 s->alg = s->pkblob + 4;
7460 s->commentlen = GET_32BIT(s->agentp);
7462 s->commentp = (char *)s->agentp;
7463 s->agentp += s->commentlen;
7464 /* s->agentp now points at next key, if any */
7466 /* See if server will accept it */
7467 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7468 ssh2_pkt_addstring(s->pktout, s->username);
7469 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7470 /* service requested */
7471 ssh2_pkt_addstring(s->pktout, "publickey");
7473 ssh2_pkt_addbool(s->pktout, FALSE); /* no signature included */
7474 ssh2_pkt_addstring_start(s->pktout);
7475 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
7476 ssh2_pkt_addstring_start(s->pktout);
7477 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
7478 ssh2_pkt_send(ssh, s->pktout);
7479 s->type = AUTH_TYPE_PUBLICKEY_OFFER_QUIET;
7481 crWaitUntilV(pktin);
7482 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
7484 /* Offer of key refused. */
7491 if (flags & FLAG_VERBOSE) {
7492 c_write_str(ssh, "Authenticating with "
7494 c_write(ssh, s->commentp, s->commentlen);
7495 c_write_str(ssh, "\" from agent\r\n");
7499 * Server is willing to accept the key.
7500 * Construct a SIGN_REQUEST.
7502 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7503 ssh2_pkt_addstring(s->pktout, s->username);
7504 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7505 /* service requested */
7506 ssh2_pkt_addstring(s->pktout, "publickey");
7508 ssh2_pkt_addbool(s->pktout, TRUE); /* signature included */
7509 ssh2_pkt_addstring_start(s->pktout);
7510 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
7511 ssh2_pkt_addstring_start(s->pktout);
7512 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
7514 /* Ask agent for signature. */
7515 s->siglen = s->pktout->length - 5 + 4 +
7516 ssh->v2_session_id_len;
7517 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
7519 s->len = 1; /* message type */
7520 s->len += 4 + s->pklen; /* key blob */
7521 s->len += 4 + s->siglen; /* data to sign */
7522 s->len += 4; /* flags */
7523 s->agentreq = snewn(4 + s->len, char);
7524 PUT_32BIT(s->agentreq, s->len);
7525 s->q = s->agentreq + 4;
7526 *s->q++ = SSH2_AGENTC_SIGN_REQUEST;
7527 PUT_32BIT(s->q, s->pklen);
7529 memcpy(s->q, s->pkblob, s->pklen);
7531 PUT_32BIT(s->q, s->siglen);
7533 /* Now the data to be signed... */
7534 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
7535 PUT_32BIT(s->q, ssh->v2_session_id_len);
7538 memcpy(s->q, ssh->v2_session_id,
7539 ssh->v2_session_id_len);
7540 s->q += ssh->v2_session_id_len;
7541 memcpy(s->q, s->pktout->data + 5,
7542 s->pktout->length - 5);
7543 s->q += s->pktout->length - 5;
7544 /* And finally the (zero) flags word. */
7546 if (!agent_query(s->agentreq, s->len + 4,
7548 ssh_agent_callback, ssh)) {
7552 bombout(("Unexpected data from server"
7553 " while waiting for agent"
7557 } while (pktin || inlen > 0);
7558 vret = ssh->agent_response;
7559 s->retlen = ssh->agent_response_len;
7564 if (s->ret[4] == SSH2_AGENT_SIGN_RESPONSE) {
7565 logevent("Sending Pageant's response");
7566 ssh2_add_sigblob(ssh, s->pktout,
7567 s->pkblob, s->pklen,
7569 GET_32BIT(s->ret + 5));
7570 ssh2_pkt_send(ssh, s->pktout);
7571 s->type = AUTH_TYPE_PUBLICKEY;
7573 /* FIXME: less drastic response */
7574 bombout(("Pageant failed to answer challenge"));
7580 /* Do we have any keys left to try? */
7581 if (s->pkblob_in_agent) {
7582 s->done_agent = TRUE;
7583 s->tried_pubkey_config = TRUE;
7586 if (s->keyi >= s->nkeys)
7587 s->done_agent = TRUE;
7590 } else if (s->can_pubkey && s->publickey_blob &&
7591 !s->tried_pubkey_config) {
7593 struct ssh2_userkey *key; /* not live over crReturn */
7594 char *passphrase; /* not live over crReturn */
7596 ssh->pkt_actx = SSH2_PKTCTX_PUBLICKEY;
7598 s->tried_pubkey_config = TRUE;
7601 * Try the public key supplied in the configuration.
7603 * First, offer the public blob to see if the server is
7604 * willing to accept it.
7606 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7607 ssh2_pkt_addstring(s->pktout, s->username);
7608 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7609 /* service requested */
7610 ssh2_pkt_addstring(s->pktout, "publickey"); /* method */
7611 ssh2_pkt_addbool(s->pktout, FALSE);
7612 /* no signature included */
7613 ssh2_pkt_addstring(s->pktout, s->publickey_algorithm);
7614 ssh2_pkt_addstring_start(s->pktout);
7615 ssh2_pkt_addstring_data(s->pktout,
7616 (char *)s->publickey_blob,
7617 s->publickey_bloblen);
7618 ssh2_pkt_send(ssh, s->pktout);
7619 logevent("Offered public key");
7621 crWaitUntilV(pktin);
7622 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
7623 /* Key refused. Give up. */
7624 s->gotit = TRUE; /* reconsider message next loop */
7625 s->type = AUTH_TYPE_PUBLICKEY_OFFER_LOUD;
7626 continue; /* process this new message */
7628 logevent("Offer of public key accepted");
7631 * Actually attempt a serious authentication using
7634 if (flags & FLAG_VERBOSE) {
7635 c_write_str(ssh, "Authenticating with public key \"");
7636 c_write_str(ssh, s->publickey_comment);
7637 c_write_str(ssh, "\"\r\n");
7641 const char *error; /* not live over crReturn */
7642 if (s->publickey_encrypted) {
7644 * Get a passphrase from the user.
7646 int ret; /* need not be kept over crReturn */
7647 s->cur_prompt = new_prompts(ssh->frontend);
7648 s->cur_prompt->to_server = FALSE;
7649 s->cur_prompt->name = dupstr("SSH key passphrase");
7650 add_prompt(s->cur_prompt,
7651 dupprintf("Passphrase for key \"%.100s\": ",
7652 s->publickey_comment),
7653 FALSE, SSH_MAX_PASSWORD_LEN);
7654 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7657 crWaitUntilV(!pktin);
7658 ret = get_userpass_input(s->cur_prompt,
7663 /* Failed to get a passphrase. Terminate. */
7664 free_prompts(s->cur_prompt);
7665 ssh_disconnect(ssh, NULL,
7666 "Unable to authenticate",
7667 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7672 dupstr(s->cur_prompt->prompts[0]->result);
7673 free_prompts(s->cur_prompt);
7675 passphrase = NULL; /* no passphrase needed */
7679 * Try decrypting the key.
7681 key = ssh2_load_userkey(&ssh->cfg.keyfile, passphrase,
7684 /* burn the evidence */
7685 memset(passphrase, 0, strlen(passphrase));
7688 if (key == SSH2_WRONG_PASSPHRASE || key == NULL) {
7690 (key == SSH2_WRONG_PASSPHRASE)) {
7691 c_write_str(ssh, "Wrong passphrase\r\n");
7693 /* and loop again */
7695 c_write_str(ssh, "Unable to load private key (");
7696 c_write_str(ssh, error);
7697 c_write_str(ssh, ")\r\n");
7699 break; /* try something else */
7705 unsigned char *pkblob, *sigblob, *sigdata;
7706 int pkblob_len, sigblob_len, sigdata_len;
7710 * We have loaded the private key and the server
7711 * has announced that it's willing to accept it.
7712 * Hallelujah. Generate a signature and send it.
7714 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7715 ssh2_pkt_addstring(s->pktout, s->username);
7716 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7717 /* service requested */
7718 ssh2_pkt_addstring(s->pktout, "publickey");
7720 ssh2_pkt_addbool(s->pktout, TRUE);
7721 /* signature follows */
7722 ssh2_pkt_addstring(s->pktout, key->alg->name);
7723 pkblob = key->alg->public_blob(key->data,
7725 ssh2_pkt_addstring_start(s->pktout);
7726 ssh2_pkt_addstring_data(s->pktout, (char *)pkblob,
7730 * The data to be signed is:
7734 * followed by everything so far placed in the
7737 sigdata_len = s->pktout->length - 5 + 4 +
7738 ssh->v2_session_id_len;
7739 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
7741 sigdata = snewn(sigdata_len, unsigned char);
7743 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
7744 PUT_32BIT(sigdata+p, ssh->v2_session_id_len);
7747 memcpy(sigdata+p, ssh->v2_session_id,
7748 ssh->v2_session_id_len);
7749 p += ssh->v2_session_id_len;
7750 memcpy(sigdata+p, s->pktout->data + 5,
7751 s->pktout->length - 5);
7752 p += s->pktout->length - 5;
7753 assert(p == sigdata_len);
7754 sigblob = key->alg->sign(key->data, (char *)sigdata,
7755 sigdata_len, &sigblob_len);
7756 ssh2_add_sigblob(ssh, s->pktout, pkblob, pkblob_len,
7757 sigblob, sigblob_len);
7762 ssh2_pkt_send(ssh, s->pktout);
7763 s->type = AUTH_TYPE_PUBLICKEY;
7764 key->alg->freekey(key->data);
7767 } else if (s->can_keyb_inter && !s->kbd_inter_refused) {
7770 * Keyboard-interactive authentication.
7773 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
7775 ssh->pkt_actx = SSH2_PKTCTX_KBDINTER;
7777 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7778 ssh2_pkt_addstring(s->pktout, s->username);
7779 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7780 /* service requested */
7781 ssh2_pkt_addstring(s->pktout, "keyboard-interactive");
7783 ssh2_pkt_addstring(s->pktout, ""); /* lang */
7784 ssh2_pkt_addstring(s->pktout, ""); /* submethods */
7785 ssh2_pkt_send(ssh, s->pktout);
7787 crWaitUntilV(pktin);
7788 if (pktin->type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
7789 /* Server is not willing to do keyboard-interactive
7790 * at all (or, bizarrely but legally, accepts the
7791 * user without actually issuing any prompts).
7792 * Give up on it entirely. */
7794 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE)
7795 logevent("Keyboard-interactive authentication refused");
7796 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET;
7797 s->kbd_inter_refused = TRUE; /* don't try it again */
7802 * Loop while the server continues to send INFO_REQUESTs.
7804 while (pktin->type == SSH2_MSG_USERAUTH_INFO_REQUEST) {
7806 char *name, *inst, *lang;
7807 int name_len, inst_len, lang_len;
7811 * We've got a fresh USERAUTH_INFO_REQUEST.
7812 * Get the preamble and start building a prompt.
7814 ssh_pkt_getstring(pktin, &name, &name_len);
7815 ssh_pkt_getstring(pktin, &inst, &inst_len);
7816 ssh_pkt_getstring(pktin, &lang, &lang_len);
7817 s->cur_prompt = new_prompts(ssh->frontend);
7818 s->cur_prompt->to_server = TRUE;
7820 /* FIXME: better prefix to distinguish from
7822 s->cur_prompt->name =
7823 dupprintf("SSH server: %.*s", name_len, name);
7824 s->cur_prompt->name_reqd = TRUE;
7826 s->cur_prompt->name =
7827 dupstr("SSH server authentication");
7828 s->cur_prompt->name_reqd = FALSE;
7830 /* FIXME: ugly to print "Using..." in prompt _every_
7831 * time round. Can this be done more subtly? */
7832 s->cur_prompt->instruction =
7833 dupprintf("Using keyboard-interactive authentication.%s%.*s",
7834 inst_len ? "\n" : "", inst_len, inst);
7835 s->cur_prompt->instr_reqd = TRUE;
7838 * Get the prompts from the packet.
7840 s->num_prompts = ssh_pkt_getuint32(pktin);
7841 for (i = 0; i < s->num_prompts; i++) {
7845 static char noprompt[] =
7846 "<server failed to send prompt>: ";
7848 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
7849 echo = ssh2_pkt_getbool(pktin);
7852 prompt_len = lenof(noprompt)-1;
7854 add_prompt(s->cur_prompt,
7855 dupprintf("%.*s", prompt_len, prompt),
7856 echo, SSH_MAX_PASSWORD_LEN);
7860 * Get the user's responses.
7862 if (s->num_prompts) {
7863 int ret; /* not live over crReturn */
7864 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7867 crWaitUntilV(!pktin);
7868 ret = get_userpass_input(s->cur_prompt, in, inlen);
7873 * Failed to get responses. Terminate.
7875 free_prompts(s->cur_prompt);
7876 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7877 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7884 * Send the responses to the server.
7886 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_INFO_RESPONSE);
7887 ssh2_pkt_adduint32(s->pktout, s->num_prompts);
7888 for (i=0; i < s->num_prompts; i++) {
7889 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7890 ssh2_pkt_addstring(s->pktout,
7891 s->cur_prompt->prompts[i]->result);
7892 end_log_omission(ssh, s->pktout);
7894 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
7897 * Get the next packet in case it's another
7900 crWaitUntilV(pktin);
7905 * We should have SUCCESS or FAILURE now.
7909 } else if (s->can_passwd) {
7912 * Plain old password authentication.
7914 int ret; /* not live over crReturn */
7915 int changereq_first_time; /* not live over crReturn */
7917 ssh->pkt_actx = SSH2_PKTCTX_PASSWORD;
7919 s->cur_prompt = new_prompts(ssh->frontend);
7920 s->cur_prompt->to_server = TRUE;
7921 s->cur_prompt->name = dupstr("SSH password");
7922 add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
7925 FALSE, SSH_MAX_PASSWORD_LEN);
7927 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7930 crWaitUntilV(!pktin);
7931 ret = get_userpass_input(s->cur_prompt, in, inlen);
7936 * Failed to get responses. Terminate.
7938 free_prompts(s->cur_prompt);
7939 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7940 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7945 * Squirrel away the password. (We may need it later if
7946 * asked to change it.)
7948 s->password = dupstr(s->cur_prompt->prompts[0]->result);
7949 free_prompts(s->cur_prompt);
7952 * Send the password packet.
7954 * We pad out the password packet to 256 bytes to make
7955 * it harder for an attacker to find the length of the
7958 * Anyone using a password longer than 256 bytes
7959 * probably doesn't have much to worry about from
7960 * people who find out how long their password is!
7962 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7963 ssh2_pkt_addstring(s->pktout, s->username);
7964 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7965 /* service requested */
7966 ssh2_pkt_addstring(s->pktout, "password");
7967 ssh2_pkt_addbool(s->pktout, FALSE);
7968 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7969 ssh2_pkt_addstring(s->pktout, s->password);
7970 end_log_omission(ssh, s->pktout);
7971 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
7972 logevent("Sent password");
7973 s->type = AUTH_TYPE_PASSWORD;
7976 * Wait for next packet, in case it's a password change
7979 crWaitUntilV(pktin);
7980 changereq_first_time = TRUE;
7982 while (pktin->type == SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ) {
7985 * We're being asked for a new password
7986 * (perhaps not for the first time).
7987 * Loop until the server accepts it.
7990 int got_new = FALSE; /* not live over crReturn */
7991 char *prompt; /* not live over crReturn */
7992 int prompt_len; /* not live over crReturn */
7996 if (changereq_first_time)
7997 msg = "Server requested password change";
7999 msg = "Server rejected new password";
8001 c_write_str(ssh, msg);
8002 c_write_str(ssh, "\r\n");
8005 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
8007 s->cur_prompt = new_prompts(ssh->frontend);
8008 s->cur_prompt->to_server = TRUE;
8009 s->cur_prompt->name = dupstr("New SSH password");
8010 s->cur_prompt->instruction =
8011 dupprintf("%.*s", prompt_len, prompt);
8012 s->cur_prompt->instr_reqd = TRUE;
8014 * There's no explicit requirement in the protocol
8015 * for the "old" passwords in the original and
8016 * password-change messages to be the same, and
8017 * apparently some Cisco kit supports password change
8018 * by the user entering a blank password originally
8019 * and the real password subsequently, so,
8020 * reluctantly, we prompt for the old password again.
8022 * (On the other hand, some servers don't even bother
8023 * to check this field.)
8025 add_prompt(s->cur_prompt,
8026 dupstr("Current password (blank for previously entered password): "),
8027 FALSE, SSH_MAX_PASSWORD_LEN);
8028 add_prompt(s->cur_prompt, dupstr("Enter new password: "),
8029 FALSE, SSH_MAX_PASSWORD_LEN);
8030 add_prompt(s->cur_prompt, dupstr("Confirm new password: "),
8031 FALSE, SSH_MAX_PASSWORD_LEN);
8034 * Loop until the user manages to enter the same
8039 ret = get_userpass_input(s->cur_prompt, NULL, 0);
8042 crWaitUntilV(!pktin);
8043 ret = get_userpass_input(s->cur_prompt, in, inlen);
8048 * Failed to get responses. Terminate.
8050 /* burn the evidence */
8051 free_prompts(s->cur_prompt);
8052 memset(s->password, 0, strlen(s->password));
8054 ssh_disconnect(ssh, NULL, "Unable to authenticate",
8055 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
8061 * If the user specified a new original password
8062 * (IYSWIM), overwrite any previously specified
8064 * (A side effect is that the user doesn't have to
8065 * re-enter it if they louse up the new password.)
8067 if (s->cur_prompt->prompts[0]->result[0]) {
8068 memset(s->password, 0, strlen(s->password));
8069 /* burn the evidence */
8072 dupstr(s->cur_prompt->prompts[0]->result);
8076 * Check the two new passwords match.
8078 got_new = (strcmp(s->cur_prompt->prompts[1]->result,
8079 s->cur_prompt->prompts[2]->result)
8082 /* They don't. Silly user. */
8083 c_write_str(ssh, "Passwords do not match\r\n");
8088 * Send the new password (along with the old one).
8089 * (see above for padding rationale)
8091 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
8092 ssh2_pkt_addstring(s->pktout, s->username);
8093 ssh2_pkt_addstring(s->pktout, "ssh-connection");
8094 /* service requested */
8095 ssh2_pkt_addstring(s->pktout, "password");
8096 ssh2_pkt_addbool(s->pktout, TRUE);
8097 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
8098 ssh2_pkt_addstring(s->pktout, s->password);
8099 ssh2_pkt_addstring(s->pktout,
8100 s->cur_prompt->prompts[1]->result);
8101 free_prompts(s->cur_prompt);
8102 end_log_omission(ssh, s->pktout);
8103 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
8104 logevent("Sent new password");
8107 * Now see what the server has to say about it.
8108 * (If it's CHANGEREQ again, it's not happy with the
8111 crWaitUntilV(pktin);
8112 changereq_first_time = FALSE;
8117 * We need to reexamine the current pktin at the top
8118 * of the loop. Either:
8119 * - we weren't asked to change password at all, in
8120 * which case it's a SUCCESS or FAILURE with the
8122 * - we sent a new password, and the server was
8123 * either OK with it (SUCCESS or FAILURE w/partial
8124 * success) or unhappy with the _old_ password
8125 * (FAILURE w/o partial success)
8126 * In any of these cases, we go back to the top of
8127 * the loop and start again.
8132 * We don't need the old password any more, in any
8133 * case. Burn the evidence.
8135 memset(s->password, 0, strlen(s->password));
8140 ssh_disconnect(ssh, NULL,
8141 "No supported authentication methods available",
8142 SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
8150 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
8152 /* Clear up various bits and pieces from authentication. */
8153 if (s->publickey_blob) {
8154 sfree(s->publickey_blob);
8155 sfree(s->publickey_comment);
8157 if (s->agent_response)
8158 sfree(s->agent_response);
8161 * Now the connection protocol has started, one way or another.
8164 ssh->channels = newtree234(ssh_channelcmp);
8167 * Set up handlers for some connection protocol messages, so we
8168 * don't have to handle them repeatedly in this coroutine.
8170 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] =
8171 ssh2_msg_channel_window_adjust;
8172 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] =
8173 ssh2_msg_global_request;
8176 * Create the main session channel.
8178 if (ssh->cfg.ssh_no_shell) {
8179 ssh->mainchan = NULL;
8180 } else if (*ssh->cfg.ssh_nc_host) {
8182 * Just start a direct-tcpip channel and use it as the main
8185 ssh->mainchan = snew(struct ssh_channel);
8186 ssh->mainchan->ssh = ssh;
8187 ssh2_channel_init(ssh->mainchan);
8189 "Opening direct-tcpip channel to %s:%d in place of session",
8190 ssh->cfg.ssh_nc_host, ssh->cfg.ssh_nc_port);
8191 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
8192 ssh2_pkt_addstring(s->pktout, "direct-tcpip");
8193 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
8194 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
8195 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
8196 ssh2_pkt_addstring(s->pktout, ssh->cfg.ssh_nc_host);
8197 ssh2_pkt_adduint32(s->pktout, ssh->cfg.ssh_nc_port);
8199 * There's nothing meaningful to put in the originator
8200 * fields, but some servers insist on syntactically correct
8203 ssh2_pkt_addstring(s->pktout, "0.0.0.0");
8204 ssh2_pkt_adduint32(s->pktout, 0);
8205 ssh2_pkt_send(ssh, s->pktout);
8207 crWaitUntilV(pktin);
8208 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
8209 bombout(("Server refused to open a direct-tcpip channel"));
8211 /* FIXME: error data comes back in FAILURE packet */
8213 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
8214 bombout(("Server's channel confirmation cited wrong channel"));
8217 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
8218 ssh->mainchan->halfopen = FALSE;
8219 ssh->mainchan->type = CHAN_MAINSESSION;
8220 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
8221 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
8222 add234(ssh->channels, ssh->mainchan);
8223 update_specials_menu(ssh->frontend);
8224 logevent("Opened direct-tcpip channel");
8227 ssh->mainchan = snew(struct ssh_channel);
8228 ssh->mainchan->ssh = ssh;
8229 ssh2_channel_init(ssh->mainchan);
8230 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
8231 ssh2_pkt_addstring(s->pktout, "session");
8232 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
8233 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
8234 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
8235 ssh2_pkt_send(ssh, s->pktout);
8236 crWaitUntilV(pktin);
8237 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
8238 bombout(("Server refused to open a session"));
8240 /* FIXME: error data comes back in FAILURE packet */
8242 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
8243 bombout(("Server's channel confirmation cited wrong channel"));
8246 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
8247 ssh->mainchan->halfopen = FALSE;
8248 ssh->mainchan->type = CHAN_MAINSESSION;
8249 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
8250 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
8251 add234(ssh->channels, ssh->mainchan);
8252 update_specials_menu(ssh->frontend);
8253 logevent("Opened channel for session");
8254 ssh->ncmode = FALSE;
8258 * Now we have a channel, make dispatch table entries for
8259 * general channel-based messages.
8261 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] =
8262 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] =
8263 ssh2_msg_channel_data;
8264 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_channel_eof;
8265 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_channel_close;
8266 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] =
8267 ssh2_msg_channel_open_confirmation;
8268 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] =
8269 ssh2_msg_channel_open_failure;
8270 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] =
8271 ssh2_msg_channel_request;
8272 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] =
8273 ssh2_msg_channel_open;
8275 if (ssh->cfg.ssh_simple) {
8277 * This message indicates to the server that we promise
8278 * not to try to run any other channel in parallel with
8279 * this one, so it's safe for it to advertise a very large
8280 * window and leave the flow control to TCP.
8282 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8283 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8284 ssh2_pkt_addstring(s->pktout, "simple@putty.projects.tartarus.org");
8285 ssh2_pkt_addbool(s->pktout, 0); /* no reply */
8286 ssh2_pkt_send(ssh, s->pktout);
8290 * Potentially enable X11 forwarding.
8292 if (ssh->mainchan && !ssh->ncmode && ssh->cfg.x11_forward) {
8293 char proto[20], data[64];
8294 logevent("Requesting X11 forwarding");
8295 ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
8296 data, sizeof(data), ssh->cfg.x11_auth);
8297 x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display);
8298 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8299 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8300 ssh2_pkt_addstring(s->pktout, "x11-req");
8301 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8302 ssh2_pkt_addbool(s->pktout, 0); /* many connections */
8303 ssh2_pkt_addstring(s->pktout, proto);
8305 * Note that while we blank the X authentication data here, we don't
8306 * take any special action to blank the start of an X11 channel,
8307 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
8308 * without having session blanking enabled is likely to leak your
8309 * cookie into the log.
8311 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
8312 ssh2_pkt_addstring(s->pktout, data);
8313 end_log_omission(ssh, s->pktout);
8314 ssh2_pkt_adduint32(s->pktout, x11_get_screen_number(ssh->cfg.x11_display));
8315 ssh2_pkt_send(ssh, s->pktout);
8317 crWaitUntilV(pktin);
8319 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8320 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8321 bombout(("Unexpected response to X11 forwarding request:"
8322 " packet type %d", pktin->type));
8325 logevent("X11 forwarding refused");
8327 logevent("X11 forwarding enabled");
8328 ssh->X11_fwd_enabled = TRUE;
8333 * Enable port forwardings.
8335 ssh_setup_portfwd(ssh, &ssh->cfg);
8338 * Potentially enable agent forwarding.
8340 if (ssh->mainchan && !ssh->ncmode && ssh->cfg.agentfwd && agent_exists()) {
8341 logevent("Requesting OpenSSH-style agent forwarding");
8342 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8343 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8344 ssh2_pkt_addstring(s->pktout, "auth-agent-req@openssh.com");
8345 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8346 ssh2_pkt_send(ssh, s->pktout);
8348 crWaitUntilV(pktin);
8350 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8351 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8352 bombout(("Unexpected response to agent forwarding request:"
8353 " packet type %d", pktin->type));
8356 logevent("Agent forwarding refused");
8358 logevent("Agent forwarding enabled");
8359 ssh->agentfwd_enabled = TRUE;
8364 * Now allocate a pty for the session.
8366 if (ssh->mainchan && !ssh->ncmode && !ssh->cfg.nopty) {
8367 /* Unpick the terminal-speed string. */
8368 /* XXX perhaps we should allow no speeds to be sent. */
8369 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
8370 sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
8371 /* Build the pty request. */
8372 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8373 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
8374 ssh2_pkt_addstring(s->pktout, "pty-req");
8375 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8376 ssh2_pkt_addstring(s->pktout, ssh->cfg.termtype);
8377 ssh2_pkt_adduint32(s->pktout, ssh->term_width);
8378 ssh2_pkt_adduint32(s->pktout, ssh->term_height);
8379 ssh2_pkt_adduint32(s->pktout, 0); /* pixel width */
8380 ssh2_pkt_adduint32(s->pktout, 0); /* pixel height */
8381 ssh2_pkt_addstring_start(s->pktout);
8382 parse_ttymodes(ssh, ssh->cfg.ttymodes,
8383 ssh2_send_ttymode, (void *)s->pktout);
8384 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_ISPEED);
8385 ssh2_pkt_adduint32(s->pktout, ssh->ispeed);
8386 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_OSPEED);
8387 ssh2_pkt_adduint32(s->pktout, ssh->ospeed);
8388 ssh2_pkt_addstring_data(s->pktout, "\0", 1); /* TTY_OP_END */
8389 ssh2_pkt_send(ssh, s->pktout);
8390 ssh->state = SSH_STATE_INTERMED;
8392 crWaitUntilV(pktin);
8394 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8395 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8396 bombout(("Unexpected response to pty request:"
8397 " packet type %d", pktin->type));
8400 c_write_str(ssh, "Server refused to allocate pty\r\n");
8401 ssh->editing = ssh->echoing = 1;
8403 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
8404 ssh->ospeed, ssh->ispeed);
8407 ssh->editing = ssh->echoing = 1;
8411 * Send environment variables.
8413 * Simplest thing here is to send all the requests at once, and
8414 * then wait for a whole bunch of successes or failures.
8416 if (ssh->mainchan && !ssh->ncmode && *ssh->cfg.environmt) {
8417 char *e = ssh->cfg.environmt;
8418 char *var, *varend, *val;
8424 while (*e && *e != '\t') e++;
8426 if (*e == '\t') e++;
8431 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8432 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8433 ssh2_pkt_addstring(s->pktout, "env");
8434 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8435 ssh2_pkt_addstring_start(s->pktout);
8436 ssh2_pkt_addstring_data(s->pktout, var, varend-var);
8437 ssh2_pkt_addstring(s->pktout, val);
8438 ssh2_pkt_send(ssh, s->pktout);
8443 logeventf(ssh, "Sent %d environment variables", s->num_env);
8446 s->env_left = s->num_env;
8448 while (s->env_left > 0) {
8449 crWaitUntilV(pktin);
8451 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8452 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8453 bombout(("Unexpected response to environment request:"
8454 " packet type %d", pktin->type));
8464 if (s->env_ok == s->num_env) {
8465 logevent("All environment variables successfully set");
8466 } else if (s->env_ok == 0) {
8467 logevent("All environment variables refused");
8468 c_write_str(ssh, "Server refused to set environment variables\r\n");
8470 logeventf(ssh, "%d environment variables refused",
8471 s->num_env - s->env_ok);
8472 c_write_str(ssh, "Server refused to set all environment variables\r\n");
8477 * Start a shell or a remote command. We may have to attempt
8478 * this twice if the config data has provided a second choice
8481 if (ssh->mainchan && !ssh->ncmode) while (1) {
8485 if (ssh->fallback_cmd) {
8486 subsys = ssh->cfg.ssh_subsys2;
8487 cmd = ssh->cfg.remote_cmd_ptr2;
8489 subsys = ssh->cfg.ssh_subsys;
8490 cmd = ssh->cfg.remote_cmd_ptr;
8491 if (!cmd) cmd = ssh->cfg.remote_cmd;
8494 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8495 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
8497 ssh2_pkt_addstring(s->pktout, "subsystem");
8498 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8499 ssh2_pkt_addstring(s->pktout, cmd);
8501 ssh2_pkt_addstring(s->pktout, "exec");
8502 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8503 ssh2_pkt_addstring(s->pktout, cmd);
8505 ssh2_pkt_addstring(s->pktout, "shell");
8506 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8508 ssh2_pkt_send(ssh, s->pktout);
8510 crWaitUntilV(pktin);
8512 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8513 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8514 bombout(("Unexpected response to shell/command request:"
8515 " packet type %d", pktin->type));
8519 * We failed to start the command. If this is the
8520 * fallback command, we really are finished; if it's
8521 * not, and if the fallback command exists, try falling
8522 * back to it before complaining.
8524 if (!ssh->fallback_cmd && ssh->cfg.remote_cmd_ptr2 != NULL) {
8525 logevent("Primary command failed; attempting fallback");
8526 ssh->fallback_cmd = TRUE;
8529 bombout(("Server refused to start a shell/command"));
8532 logevent("Started a shell/command");
8537 ssh->state = SSH_STATE_SESSION;
8538 if (ssh->size_needed)
8539 ssh_size(ssh, ssh->term_width, ssh->term_height);
8540 if (ssh->eof_needed)
8541 ssh_special(ssh, TS_EOF);
8544 * All the initial channel requests are done, so install the default
8547 ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = ssh2_msg_channel_success;
8548 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = ssh2_msg_channel_failure;
8554 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
8559 s->try_send = FALSE;
8563 * _All_ the connection-layer packets we expect to
8564 * receive are now handled by the dispatch table.
8565 * Anything that reaches here must be bogus.
8568 bombout(("Strange packet received: type %d", pktin->type));
8570 } else if (ssh->mainchan) {
8572 * We have spare data. Add it to the channel buffer.
8574 ssh2_add_channel_data(ssh->mainchan, (char *)in, inlen);
8579 struct ssh_channel *c;
8581 * Try to send data on all channels if we can.
8583 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++)
8584 ssh2_try_send_and_unthrottle(c);
8592 * Handlers for SSH-2 messages that might arrive at any moment.
8594 static void ssh2_msg_disconnect(Ssh ssh, struct Packet *pktin)
8596 /* log reason code in disconnect message */
8600 reason = ssh_pkt_getuint32(pktin);
8601 ssh_pkt_getstring(pktin, &msg, &msglen);
8603 if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
8604 buf = dupprintf("Received disconnect message (%s)",
8605 ssh2_disconnect_reasons[reason]);
8607 buf = dupprintf("Received disconnect message (unknown"
8608 " type %d)", reason);
8612 buf = dupprintf("Disconnection message text: %.*s",
8615 bombout(("Server sent disconnect message\ntype %d (%s):\n\"%.*s\"",
8617 (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ?
8618 ssh2_disconnect_reasons[reason] : "unknown",
8623 static void ssh2_msg_debug(Ssh ssh, struct Packet *pktin)
8625 /* log the debug message */
8630 /* XXX maybe we should actually take notice of this */
8631 always_display = ssh2_pkt_getbool(pktin);
8632 ssh_pkt_getstring(pktin, &msg, &msglen);
8634 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
8637 static void ssh2_msg_something_unimplemented(Ssh ssh, struct Packet *pktin)
8639 struct Packet *pktout;
8640 pktout = ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED);
8641 ssh2_pkt_adduint32(pktout, pktin->sequence);
8643 * UNIMPLEMENTED messages MUST appear in the same order as the
8644 * messages they respond to. Hence, never queue them.
8646 ssh2_pkt_send_noqueue(ssh, pktout);
8650 * Handle the top-level SSH-2 protocol.
8652 static void ssh2_protocol_setup(Ssh ssh)
8657 * Most messages cause SSH2_MSG_UNIMPLEMENTED.
8659 for (i = 0; i < 256; i++)
8660 ssh->packet_dispatch[i] = ssh2_msg_something_unimplemented;
8663 * Any message we actually understand, we set to NULL so that
8664 * the coroutines will get it.
8666 ssh->packet_dispatch[SSH2_MSG_UNIMPLEMENTED] = NULL;
8667 ssh->packet_dispatch[SSH2_MSG_SERVICE_REQUEST] = NULL;
8668 ssh->packet_dispatch[SSH2_MSG_SERVICE_ACCEPT] = NULL;
8669 ssh->packet_dispatch[SSH2_MSG_KEXINIT] = NULL;
8670 ssh->packet_dispatch[SSH2_MSG_NEWKEYS] = NULL;
8671 ssh->packet_dispatch[SSH2_MSG_KEXDH_INIT] = NULL;
8672 ssh->packet_dispatch[SSH2_MSG_KEXDH_REPLY] = NULL;
8673 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REQUEST] = NULL; duplicate case value */
8674 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_GROUP] = NULL; duplicate case value */
8675 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_INIT] = NULL;
8676 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REPLY] = NULL;
8677 ssh->packet_dispatch[SSH2_MSG_USERAUTH_REQUEST] = NULL;
8678 ssh->packet_dispatch[SSH2_MSG_USERAUTH_FAILURE] = NULL;
8679 ssh->packet_dispatch[SSH2_MSG_USERAUTH_SUCCESS] = NULL;
8680 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
8681 ssh->packet_dispatch[SSH2_MSG_USERAUTH_PK_OK] = NULL;
8682 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ] = NULL; duplicate case value */
8683 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_REQUEST] = NULL; duplicate case value */
8684 ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_RESPONSE] = NULL;
8685 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = NULL;
8686 ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = NULL;
8687 ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = NULL;
8688 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = NULL;
8689 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = NULL;
8690 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = NULL;
8691 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = NULL;
8692 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = NULL;
8693 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = NULL;
8694 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = NULL;
8695 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = NULL;
8696 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = NULL;
8697 ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = NULL;
8698 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = NULL;
8701 * These special message types we install handlers for.
8703 ssh->packet_dispatch[SSH2_MSG_DISCONNECT] = ssh2_msg_disconnect;
8704 ssh->packet_dispatch[SSH2_MSG_IGNORE] = ssh_msg_ignore; /* shared with SSH-1 */
8705 ssh->packet_dispatch[SSH2_MSG_DEBUG] = ssh2_msg_debug;
8708 static void ssh2_timer(void *ctx, long now)
8712 if (ssh->state == SSH_STATE_CLOSED)
8715 if (!ssh->kex_in_progress && ssh->cfg.ssh_rekey_time != 0 &&
8716 now - ssh->next_rekey >= 0) {
8717 do_ssh2_transport(ssh, "timeout", -1, NULL);
8721 static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
8722 struct Packet *pktin)
8724 unsigned char *in = (unsigned char *)vin;
8725 if (ssh->state == SSH_STATE_CLOSED)
8729 ssh->incoming_data_size += pktin->encrypted_len;
8730 if (!ssh->kex_in_progress &&
8731 ssh->max_data_size != 0 &&
8732 ssh->incoming_data_size > ssh->max_data_size)
8733 do_ssh2_transport(ssh, "too much data received", -1, NULL);
8736 if (pktin && ssh->packet_dispatch[pktin->type]) {
8737 ssh->packet_dispatch[pktin->type](ssh, pktin);
8741 if (!ssh->protocol_initial_phase_done ||
8742 (pktin && pktin->type >= 20 && pktin->type < 50)) {
8743 if (do_ssh2_transport(ssh, in, inlen, pktin) &&
8744 !ssh->protocol_initial_phase_done) {
8745 ssh->protocol_initial_phase_done = TRUE;
8747 * Allow authconn to initialise itself.
8749 do_ssh2_authconn(ssh, NULL, 0, NULL);
8752 do_ssh2_authconn(ssh, in, inlen, pktin);
8757 * Called to set up the connection.
8759 * Returns an error message, or NULL on success.
8761 static const char *ssh_init(void *frontend_handle, void **backend_handle,
8763 char *host, int port, char **realhost, int nodelay,
8769 ssh = snew(struct ssh_tag);
8770 ssh->cfg = *cfg; /* STRUCTURE COPY */
8771 ssh->version = 0; /* when not ready yet */
8774 ssh->v1_cipher_ctx = NULL;
8775 ssh->crcda_ctx = NULL;
8776 ssh->cscipher = NULL;
8777 ssh->cs_cipher_ctx = NULL;
8778 ssh->sccipher = NULL;
8779 ssh->sc_cipher_ctx = NULL;
8781 ssh->cs_mac_ctx = NULL;
8783 ssh->sc_mac_ctx = NULL;
8785 ssh->cs_comp_ctx = NULL;
8787 ssh->sc_comp_ctx = NULL;
8789 ssh->kex_ctx = NULL;
8790 ssh->hostkey = NULL;
8792 ssh->close_expected = FALSE;
8793 ssh->clean_exit = FALSE;
8794 ssh->state = SSH_STATE_PREPACKET;
8795 ssh->size_needed = FALSE;
8796 ssh->eof_needed = FALSE;
8799 ssh->deferred_send_data = NULL;
8800 ssh->deferred_len = 0;
8801 ssh->deferred_size = 0;
8802 ssh->fallback_cmd = 0;
8803 ssh->pkt_kctx = SSH2_PKTCTX_NOKEX;
8804 ssh->pkt_actx = SSH2_PKTCTX_NOAUTH;
8805 ssh->x11auth = NULL;
8806 ssh->v1_compressing = FALSE;
8807 ssh->v2_outgoing_sequence = 0;
8808 ssh->ssh1_rdpkt_crstate = 0;
8809 ssh->ssh2_rdpkt_crstate = 0;
8810 ssh->do_ssh_init_crstate = 0;
8811 ssh->ssh_gotdata_crstate = 0;
8812 ssh->do_ssh1_connection_crstate = 0;
8813 ssh->do_ssh1_login_crstate = 0;
8814 ssh->do_ssh2_transport_crstate = 0;
8815 ssh->do_ssh2_authconn_crstate = 0;
8816 ssh->do_ssh_init_state = NULL;
8817 ssh->do_ssh1_login_state = NULL;
8818 ssh->do_ssh2_transport_state = NULL;
8819 ssh->do_ssh2_authconn_state = NULL;
8822 ssh->mainchan = NULL;
8823 ssh->throttled_all = 0;
8824 ssh->v1_stdout_throttling = 0;
8826 ssh->queuelen = ssh->queuesize = 0;
8827 ssh->queueing = FALSE;
8828 ssh->qhead = ssh->qtail = NULL;
8829 ssh->deferred_rekey_reason = NULL;
8830 bufchain_init(&ssh->queued_incoming_data);
8831 ssh->frozen = FALSE;
8833 *backend_handle = ssh;
8836 if (crypto_startup() == 0)
8837 return "Microsoft high encryption pack not installed!";
8840 ssh->frontend = frontend_handle;
8841 ssh->term_width = ssh->cfg.width;
8842 ssh->term_height = ssh->cfg.height;
8844 ssh->channels = NULL;
8845 ssh->rportfwds = NULL;
8846 ssh->portfwds = NULL;
8851 ssh->conn_throttle_count = 0;
8852 ssh->overall_bufsize = 0;
8853 ssh->fallback_cmd = 0;
8855 ssh->protocol = NULL;
8857 ssh->protocol_initial_phase_done = FALSE;
8861 ssh->incoming_data_size = ssh->outgoing_data_size =
8862 ssh->deferred_data_size = 0L;
8863 ssh->max_data_size = parse_blocksize(ssh->cfg.ssh_rekey_data);
8864 ssh->kex_in_progress = FALSE;
8866 p = connect_to_host(ssh, host, port, realhost, nodelay, keepalive);
8875 static void ssh_free(void *handle)
8877 Ssh ssh = (Ssh) handle;
8878 struct ssh_channel *c;
8879 struct ssh_rportfwd *pf;
8881 if (ssh->v1_cipher_ctx)
8882 ssh->cipher->free_context(ssh->v1_cipher_ctx);
8883 if (ssh->cs_cipher_ctx)
8884 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
8885 if (ssh->sc_cipher_ctx)
8886 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
8887 if (ssh->cs_mac_ctx)
8888 ssh->csmac->free_context(ssh->cs_mac_ctx);
8889 if (ssh->sc_mac_ctx)
8890 ssh->scmac->free_context(ssh->sc_mac_ctx);
8891 if (ssh->cs_comp_ctx) {
8893 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
8895 zlib_compress_cleanup(ssh->cs_comp_ctx);
8897 if (ssh->sc_comp_ctx) {
8899 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
8901 zlib_decompress_cleanup(ssh->sc_comp_ctx);
8904 dh_cleanup(ssh->kex_ctx);
8905 sfree(ssh->savedhost);
8907 while (ssh->queuelen-- > 0)
8908 ssh_free_packet(ssh->queue[ssh->queuelen]);
8911 while (ssh->qhead) {
8912 struct queued_handler *qh = ssh->qhead;
8913 ssh->qhead = qh->next;
8916 ssh->qhead = ssh->qtail = NULL;
8918 if (ssh->channels) {
8919 while ((c = delpos234(ssh->channels, 0)) != NULL) {
8922 if (c->u.x11.s != NULL)
8923 x11_close(c->u.x11.s);
8926 if (c->u.pfd.s != NULL)
8927 pfd_close(c->u.pfd.s);
8932 freetree234(ssh->channels);
8933 ssh->channels = NULL;
8936 if (ssh->rportfwds) {
8937 while ((pf = delpos234(ssh->rportfwds, 0)) != NULL)
8939 freetree234(ssh->rportfwds);
8940 ssh->rportfwds = NULL;
8942 sfree(ssh->deferred_send_data);
8944 x11_free_auth(ssh->x11auth);
8945 sfree(ssh->do_ssh_init_state);
8946 sfree(ssh->do_ssh1_login_state);
8947 sfree(ssh->do_ssh2_transport_state);
8948 sfree(ssh->do_ssh2_authconn_state);
8951 if (ssh->crcda_ctx) {
8952 crcda_free_context(ssh->crcda_ctx);
8953 ssh->crcda_ctx = NULL;
8956 ssh_do_close(ssh, TRUE);
8957 expire_timer_context(ssh);
8959 pinger_free(ssh->pinger);
8960 bufchain_clear(&ssh->queued_incoming_data);
8967 * Reconfigure the SSH backend.
8969 static void ssh_reconfig(void *handle, Config *cfg)
8971 Ssh ssh = (Ssh) handle;
8972 char *rekeying = NULL, rekey_mandatory = FALSE;
8973 unsigned long old_max_data_size;
8975 pinger_reconfig(ssh->pinger, &ssh->cfg, cfg);
8977 ssh_setup_portfwd(ssh, cfg);
8979 if (ssh->cfg.ssh_rekey_time != cfg->ssh_rekey_time &&
8980 cfg->ssh_rekey_time != 0) {
8981 long new_next = ssh->last_rekey + cfg->ssh_rekey_time*60*TICKSPERSEC;
8982 long now = GETTICKCOUNT();
8984 if (new_next - now < 0) {
8985 rekeying = "timeout shortened";
8987 ssh->next_rekey = schedule_timer(new_next - now, ssh2_timer, ssh);
8991 old_max_data_size = ssh->max_data_size;
8992 ssh->max_data_size = parse_blocksize(cfg->ssh_rekey_data);
8993 if (old_max_data_size != ssh->max_data_size &&
8994 ssh->max_data_size != 0) {
8995 if (ssh->outgoing_data_size > ssh->max_data_size ||
8996 ssh->incoming_data_size > ssh->max_data_size)
8997 rekeying = "data limit lowered";
9000 if (ssh->cfg.compression != cfg->compression) {
9001 rekeying = "compression setting changed";
9002 rekey_mandatory = TRUE;
9005 if (ssh->cfg.ssh2_des_cbc != cfg->ssh2_des_cbc ||
9006 memcmp(ssh->cfg.ssh_cipherlist, cfg->ssh_cipherlist,
9007 sizeof(ssh->cfg.ssh_cipherlist))) {
9008 rekeying = "cipher settings changed";
9009 rekey_mandatory = TRUE;
9012 ssh->cfg = *cfg; /* STRUCTURE COPY */
9015 if (!ssh->kex_in_progress) {
9016 do_ssh2_transport(ssh, rekeying, -1, NULL);
9017 } else if (rekey_mandatory) {
9018 ssh->deferred_rekey_reason = rekeying;
9024 * Called to send data down the SSH connection.
9026 static int ssh_send(void *handle, char *buf, int len)
9028 Ssh ssh = (Ssh) handle;
9030 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
9033 ssh->protocol(ssh, (unsigned char *)buf, len, 0);
9035 return ssh_sendbuffer(ssh);
9039 * Called to query the current amount of buffered stdin data.
9041 static int ssh_sendbuffer(void *handle)
9043 Ssh ssh = (Ssh) handle;
9046 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
9050 * If the SSH socket itself has backed up, add the total backup
9051 * size on that to any individual buffer on the stdin channel.
9054 if (ssh->throttled_all)
9055 override_value = ssh->overall_bufsize;
9057 if (ssh->version == 1) {
9058 return override_value;
9059 } else if (ssh->version == 2) {
9060 if (!ssh->mainchan || ssh->mainchan->closes > 0)
9061 return override_value;
9063 return (override_value +
9064 bufchain_size(&ssh->mainchan->v.v2.outbuffer));
9071 * Called to set the size of the window from SSH's POV.
9073 static void ssh_size(void *handle, int width, int height)
9075 Ssh ssh = (Ssh) handle;
9076 struct Packet *pktout;
9078 ssh->term_width = width;
9079 ssh->term_height = height;
9081 switch (ssh->state) {
9082 case SSH_STATE_BEFORE_SIZE:
9083 case SSH_STATE_PREPACKET:
9084 case SSH_STATE_CLOSED:
9085 break; /* do nothing */
9086 case SSH_STATE_INTERMED:
9087 ssh->size_needed = TRUE; /* buffer for later */
9089 case SSH_STATE_SESSION:
9090 if (!ssh->cfg.nopty) {
9091 if (ssh->version == 1) {
9092 send_packet(ssh, SSH1_CMSG_WINDOW_SIZE,
9093 PKT_INT, ssh->term_height,
9094 PKT_INT, ssh->term_width,
9095 PKT_INT, 0, PKT_INT, 0, PKT_END);
9096 } else if (ssh->mainchan) {
9097 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9098 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9099 ssh2_pkt_addstring(pktout, "window-change");
9100 ssh2_pkt_addbool(pktout, 0);
9101 ssh2_pkt_adduint32(pktout, ssh->term_width);
9102 ssh2_pkt_adduint32(pktout, ssh->term_height);
9103 ssh2_pkt_adduint32(pktout, 0);
9104 ssh2_pkt_adduint32(pktout, 0);
9105 ssh2_pkt_send(ssh, pktout);
9113 * Return a list of the special codes that make sense in this
9116 static const struct telnet_special *ssh_get_specials(void *handle)
9118 static const struct telnet_special ssh1_ignore_special[] = {
9119 {"IGNORE message", TS_NOP}
9121 static const struct telnet_special ssh2_transport_specials[] = {
9122 {"IGNORE message", TS_NOP},
9123 {"Repeat key exchange", TS_REKEY},
9125 static const struct telnet_special ssh2_session_specials[] = {
9128 /* These are the signal names defined by RFC 4254.
9129 * They include all the ISO C signals, but are a subset of the POSIX
9130 * required signals. */
9131 {"SIGINT (Interrupt)", TS_SIGINT},
9132 {"SIGTERM (Terminate)", TS_SIGTERM},
9133 {"SIGKILL (Kill)", TS_SIGKILL},
9134 {"SIGQUIT (Quit)", TS_SIGQUIT},
9135 {"SIGHUP (Hangup)", TS_SIGHUP},
9136 {"More signals", TS_SUBMENU},
9137 {"SIGABRT", TS_SIGABRT}, {"SIGALRM", TS_SIGALRM},
9138 {"SIGFPE", TS_SIGFPE}, {"SIGILL", TS_SIGILL},
9139 {"SIGPIPE", TS_SIGPIPE}, {"SIGSEGV", TS_SIGSEGV},
9140 {"SIGUSR1", TS_SIGUSR1}, {"SIGUSR2", TS_SIGUSR2},
9143 static const struct telnet_special specials_end[] = {
9146 /* XXX review this length for any changes: */
9147 static struct telnet_special ssh_specials[lenof(ssh2_transport_specials) +
9148 lenof(ssh2_session_specials) +
9149 lenof(specials_end)];
9150 Ssh ssh = (Ssh) handle;
9152 #define ADD_SPECIALS(name) \
9154 assert((i + lenof(name)) <= lenof(ssh_specials)); \
9155 memcpy(&ssh_specials[i], name, sizeof name); \
9159 if (ssh->version == 1) {
9160 /* Don't bother offering IGNORE if we've decided the remote
9161 * won't cope with it, since we wouldn't bother sending it if
9163 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
9164 ADD_SPECIALS(ssh1_ignore_special);
9165 } else if (ssh->version == 2) {
9166 ADD_SPECIALS(ssh2_transport_specials);
9168 ADD_SPECIALS(ssh2_session_specials);
9169 } /* else we're not ready yet */
9172 ADD_SPECIALS(specials_end);
9173 return ssh_specials;
9181 * Send special codes. TS_EOF is useful for `plink', so you
9182 * can send an EOF and collect resulting output (e.g. `plink
9185 static void ssh_special(void *handle, Telnet_Special code)
9187 Ssh ssh = (Ssh) handle;
9188 struct Packet *pktout;
9190 if (code == TS_EOF) {
9191 if (ssh->state != SSH_STATE_SESSION) {
9193 * Buffer the EOF in case we are pre-SESSION, so we can
9194 * send it as soon as we reach SESSION.
9197 ssh->eof_needed = TRUE;
9200 if (ssh->version == 1) {
9201 send_packet(ssh, SSH1_CMSG_EOF, PKT_END);
9202 } else if (ssh->mainchan) {
9203 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_EOF);
9204 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9205 ssh2_pkt_send(ssh, pktout);
9206 ssh->send_ok = 0; /* now stop trying to read from stdin */
9208 logevent("Sent EOF message");
9209 } else if (code == TS_PING || code == TS_NOP) {
9210 if (ssh->state == SSH_STATE_CLOSED
9211 || ssh->state == SSH_STATE_PREPACKET) return;
9212 if (ssh->version == 1) {
9213 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
9214 send_packet(ssh, SSH1_MSG_IGNORE, PKT_STR, "", PKT_END);
9216 pktout = ssh2_pkt_init(SSH2_MSG_IGNORE);
9217 ssh2_pkt_addstring_start(pktout);
9218 ssh2_pkt_send_noqueue(ssh, pktout);
9220 } else if (code == TS_REKEY) {
9221 if (!ssh->kex_in_progress && ssh->version == 2) {
9222 do_ssh2_transport(ssh, "at user request", -1, NULL);
9224 } else if (code == TS_BRK) {
9225 if (ssh->state == SSH_STATE_CLOSED
9226 || ssh->state == SSH_STATE_PREPACKET) return;
9227 if (ssh->version == 1) {
9228 logevent("Unable to send BREAK signal in SSH-1");
9229 } else if (ssh->mainchan) {
9230 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9231 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9232 ssh2_pkt_addstring(pktout, "break");
9233 ssh2_pkt_addbool(pktout, 0);
9234 ssh2_pkt_adduint32(pktout, 0); /* default break length */
9235 ssh2_pkt_send(ssh, pktout);
9238 /* Is is a POSIX signal? */
9239 char *signame = NULL;
9240 if (code == TS_SIGABRT) signame = "ABRT";
9241 if (code == TS_SIGALRM) signame = "ALRM";
9242 if (code == TS_SIGFPE) signame = "FPE";
9243 if (code == TS_SIGHUP) signame = "HUP";
9244 if (code == TS_SIGILL) signame = "ILL";
9245 if (code == TS_SIGINT) signame = "INT";
9246 if (code == TS_SIGKILL) signame = "KILL";
9247 if (code == TS_SIGPIPE) signame = "PIPE";
9248 if (code == TS_SIGQUIT) signame = "QUIT";
9249 if (code == TS_SIGSEGV) signame = "SEGV";
9250 if (code == TS_SIGTERM) signame = "TERM";
9251 if (code == TS_SIGUSR1) signame = "USR1";
9252 if (code == TS_SIGUSR2) signame = "USR2";
9253 /* The SSH-2 protocol does in principle support arbitrary named
9254 * signals, including signame@domain, but we don't support those. */
9256 /* It's a signal. */
9257 if (ssh->version == 2 && ssh->mainchan) {
9258 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
9259 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
9260 ssh2_pkt_addstring(pktout, "signal");
9261 ssh2_pkt_addbool(pktout, 0);
9262 ssh2_pkt_addstring(pktout, signame);
9263 ssh2_pkt_send(ssh, pktout);
9264 logeventf(ssh, "Sent signal SIG%s", signame);
9267 /* Never heard of it. Do nothing */
9272 void *new_sock_channel(void *handle, Socket s)
9274 Ssh ssh = (Ssh) handle;
9275 struct ssh_channel *c;
9276 c = snew(struct ssh_channel);
9279 ssh2_channel_init(c);
9281 c->type = CHAN_SOCKDATA_DORMANT;/* identify channel type */
9283 add234(ssh->channels, c);
9288 * This is called when stdout/stderr (the entity to which
9289 * from_backend sends data) manages to clear some backlog.
9291 static void ssh_unthrottle(void *handle, int bufsize)
9293 Ssh ssh = (Ssh) handle;
9296 if (ssh->version == 1) {
9297 if (ssh->v1_stdout_throttling && bufsize < SSH1_BUFFER_LIMIT) {
9298 ssh->v1_stdout_throttling = 0;
9299 ssh_throttle_conn(ssh, -1);
9302 if (ssh->mainchan) {
9303 ssh2_set_window(ssh->mainchan,
9304 bufsize < ssh->mainchan->v.v2.locmaxwin ?
9305 ssh->mainchan->v.v2.locmaxwin - bufsize : 0);
9306 if (ssh->cfg.ssh_simple)
9309 buflimit = ssh->mainchan->v.v2.locmaxwin;
9310 if (ssh->mainchan->throttling_conn && bufsize <= buflimit) {
9311 ssh->mainchan->throttling_conn = 0;
9312 ssh_throttle_conn(ssh, -1);
9318 void ssh_send_port_open(void *channel, char *hostname, int port, char *org)
9320 struct ssh_channel *c = (struct ssh_channel *)channel;
9322 struct Packet *pktout;
9324 logeventf(ssh, "Opening forwarded connection to %s:%d", hostname, port);
9326 if (ssh->version == 1) {
9327 send_packet(ssh, SSH1_MSG_PORT_OPEN,
9328 PKT_INT, c->localid,
9331 /* PKT_STR, <org:orgport>, */
9334 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
9335 ssh2_pkt_addstring(pktout, "direct-tcpip");
9336 ssh2_pkt_adduint32(pktout, c->localid);
9337 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);/* our window size */
9338 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
9339 ssh2_pkt_addstring(pktout, hostname);
9340 ssh2_pkt_adduint32(pktout, port);
9342 * We make up values for the originator data; partly it's
9343 * too much hassle to keep track, and partly I'm not
9344 * convinced the server should be told details like that
9345 * about my local network configuration.
9346 * The "originator IP address" is syntactically a numeric
9347 * IP address, and some servers (e.g., Tectia) get upset
9348 * if it doesn't match this syntax.
9350 ssh2_pkt_addstring(pktout, "0.0.0.0");
9351 ssh2_pkt_adduint32(pktout, 0);
9352 ssh2_pkt_send(ssh, pktout);
9356 static int ssh_connected(void *handle)
9358 Ssh ssh = (Ssh) handle;
9359 return ssh->s != NULL;
9362 static int ssh_sendok(void *handle)
9364 Ssh ssh = (Ssh) handle;
9365 return ssh->send_ok;
9368 static int ssh_ldisc(void *handle, int option)
9370 Ssh ssh = (Ssh) handle;
9371 if (option == LD_ECHO)
9372 return ssh->echoing;
9373 if (option == LD_EDIT)
9374 return ssh->editing;
9378 static void ssh_provide_ldisc(void *handle, void *ldisc)
9380 Ssh ssh = (Ssh) handle;
9384 static void ssh_provide_logctx(void *handle, void *logctx)
9386 Ssh ssh = (Ssh) handle;
9387 ssh->logctx = logctx;
9390 static int ssh_return_exitcode(void *handle)
9392 Ssh ssh = (Ssh) handle;
9396 return (ssh->exitcode >= 0 ? ssh->exitcode : INT_MAX);
9400 * cfg_info for SSH is the currently running version of the
9401 * protocol. (1 for 1; 2 for 2; 0 for not-decided-yet.)
9403 static int ssh_cfg_info(void *handle)
9405 Ssh ssh = (Ssh) handle;
9406 return ssh->version;
9410 * Gross hack: pscp will try to start SFTP but fall back to scp1 if
9411 * that fails. This variable is the means by which scp.c can reach
9412 * into the SSH code and find out which one it got.
9414 extern int ssh_fallback_cmd(void *handle)
9416 Ssh ssh = (Ssh) handle;
9417 return ssh->fallback_cmd;
9420 Backend ssh_backend = {
9430 ssh_return_exitcode,