23 #define SSH1_MSG_DISCONNECT 1 /* 0x1 */
24 #define SSH1_SMSG_PUBLIC_KEY 2 /* 0x2 */
25 #define SSH1_CMSG_SESSION_KEY 3 /* 0x3 */
26 #define SSH1_CMSG_USER 4 /* 0x4 */
27 #define SSH1_CMSG_AUTH_RSA 6 /* 0x6 */
28 #define SSH1_SMSG_AUTH_RSA_CHALLENGE 7 /* 0x7 */
29 #define SSH1_CMSG_AUTH_RSA_RESPONSE 8 /* 0x8 */
30 #define SSH1_CMSG_AUTH_PASSWORD 9 /* 0x9 */
31 #define SSH1_CMSG_REQUEST_PTY 10 /* 0xa */
32 #define SSH1_CMSG_WINDOW_SIZE 11 /* 0xb */
33 #define SSH1_CMSG_EXEC_SHELL 12 /* 0xc */
34 #define SSH1_CMSG_EXEC_CMD 13 /* 0xd */
35 #define SSH1_SMSG_SUCCESS 14 /* 0xe */
36 #define SSH1_SMSG_FAILURE 15 /* 0xf */
37 #define SSH1_CMSG_STDIN_DATA 16 /* 0x10 */
38 #define SSH1_SMSG_STDOUT_DATA 17 /* 0x11 */
39 #define SSH1_SMSG_STDERR_DATA 18 /* 0x12 */
40 #define SSH1_CMSG_EOF 19 /* 0x13 */
41 #define SSH1_SMSG_EXIT_STATUS 20 /* 0x14 */
42 #define SSH1_MSG_CHANNEL_OPEN_CONFIRMATION 21 /* 0x15 */
43 #define SSH1_MSG_CHANNEL_OPEN_FAILURE 22 /* 0x16 */
44 #define SSH1_MSG_CHANNEL_DATA 23 /* 0x17 */
45 #define SSH1_MSG_CHANNEL_CLOSE 24 /* 0x18 */
46 #define SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION 25 /* 0x19 */
47 #define SSH1_SMSG_X11_OPEN 27 /* 0x1b */
48 #define SSH1_CMSG_PORT_FORWARD_REQUEST 28 /* 0x1c */
49 #define SSH1_MSG_PORT_OPEN 29 /* 0x1d */
50 #define SSH1_CMSG_AGENT_REQUEST_FORWARDING 30 /* 0x1e */
51 #define SSH1_SMSG_AGENT_OPEN 31 /* 0x1f */
52 #define SSH1_MSG_IGNORE 32 /* 0x20 */
53 #define SSH1_CMSG_EXIT_CONFIRMATION 33 /* 0x21 */
54 #define SSH1_CMSG_X11_REQUEST_FORWARDING 34 /* 0x22 */
55 #define SSH1_CMSG_AUTH_RHOSTS_RSA 35 /* 0x23 */
56 #define SSH1_MSG_DEBUG 36 /* 0x24 */
57 #define SSH1_CMSG_REQUEST_COMPRESSION 37 /* 0x25 */
58 #define SSH1_CMSG_AUTH_TIS 39 /* 0x27 */
59 #define SSH1_SMSG_AUTH_TIS_CHALLENGE 40 /* 0x28 */
60 #define SSH1_CMSG_AUTH_TIS_RESPONSE 41 /* 0x29 */
61 #define SSH1_CMSG_AUTH_CCARD 70 /* 0x46 */
62 #define SSH1_SMSG_AUTH_CCARD_CHALLENGE 71 /* 0x47 */
63 #define SSH1_CMSG_AUTH_CCARD_RESPONSE 72 /* 0x48 */
65 #define SSH1_AUTH_TIS 5 /* 0x5 */
66 #define SSH1_AUTH_CCARD 16 /* 0x10 */
68 #define SSH1_PROTOFLAG_SCREEN_NUMBER 1 /* 0x1 */
69 /* Mask for protoflags we will echo back to server if seen */
70 #define SSH1_PROTOFLAGS_SUPPORTED 0 /* 0x1 */
72 #define SSH2_MSG_DISCONNECT 1 /* 0x1 */
73 #define SSH2_MSG_IGNORE 2 /* 0x2 */
74 #define SSH2_MSG_UNIMPLEMENTED 3 /* 0x3 */
75 #define SSH2_MSG_DEBUG 4 /* 0x4 */
76 #define SSH2_MSG_SERVICE_REQUEST 5 /* 0x5 */
77 #define SSH2_MSG_SERVICE_ACCEPT 6 /* 0x6 */
78 #define SSH2_MSG_KEXINIT 20 /* 0x14 */
79 #define SSH2_MSG_NEWKEYS 21 /* 0x15 */
80 #define SSH2_MSG_KEXDH_INIT 30 /* 0x1e */
81 #define SSH2_MSG_KEXDH_REPLY 31 /* 0x1f */
82 #define SSH2_MSG_KEX_DH_GEX_REQUEST 30 /* 0x1e */
83 #define SSH2_MSG_KEX_DH_GEX_GROUP 31 /* 0x1f */
84 #define SSH2_MSG_KEX_DH_GEX_INIT 32 /* 0x20 */
85 #define SSH2_MSG_KEX_DH_GEX_REPLY 33 /* 0x21 */
86 #define SSH2_MSG_USERAUTH_REQUEST 50 /* 0x32 */
87 #define SSH2_MSG_USERAUTH_FAILURE 51 /* 0x33 */
88 #define SSH2_MSG_USERAUTH_SUCCESS 52 /* 0x34 */
89 #define SSH2_MSG_USERAUTH_BANNER 53 /* 0x35 */
90 #define SSH2_MSG_USERAUTH_PK_OK 60 /* 0x3c */
91 #define SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ 60 /* 0x3c */
92 #define SSH2_MSG_USERAUTH_INFO_REQUEST 60 /* 0x3c */
93 #define SSH2_MSG_USERAUTH_INFO_RESPONSE 61 /* 0x3d */
94 #define SSH2_MSG_GLOBAL_REQUEST 80 /* 0x50 */
95 #define SSH2_MSG_REQUEST_SUCCESS 81 /* 0x51 */
96 #define SSH2_MSG_REQUEST_FAILURE 82 /* 0x52 */
97 #define SSH2_MSG_CHANNEL_OPEN 90 /* 0x5a */
98 #define SSH2_MSG_CHANNEL_OPEN_CONFIRMATION 91 /* 0x5b */
99 #define SSH2_MSG_CHANNEL_OPEN_FAILURE 92 /* 0x5c */
100 #define SSH2_MSG_CHANNEL_WINDOW_ADJUST 93 /* 0x5d */
101 #define SSH2_MSG_CHANNEL_DATA 94 /* 0x5e */
102 #define SSH2_MSG_CHANNEL_EXTENDED_DATA 95 /* 0x5f */
103 #define SSH2_MSG_CHANNEL_EOF 96 /* 0x60 */
104 #define SSH2_MSG_CHANNEL_CLOSE 97 /* 0x61 */
105 #define SSH2_MSG_CHANNEL_REQUEST 98 /* 0x62 */
106 #define SSH2_MSG_CHANNEL_SUCCESS 99 /* 0x63 */
107 #define SSH2_MSG_CHANNEL_FAILURE 100 /* 0x64 */
110 * Packet type contexts, so that ssh2_pkt_type can correctly decode
111 * the ambiguous type numbers back into the correct type strings.
113 #define SSH2_PKTCTX_DHGROUP 0x0001
114 #define SSH2_PKTCTX_DHGEX 0x0002
115 #define SSH2_PKTCTX_KEX_MASK 0x000F
116 #define SSH2_PKTCTX_PUBLICKEY 0x0010
117 #define SSH2_PKTCTX_PASSWORD 0x0020
118 #define SSH2_PKTCTX_KBDINTER 0x0040
119 #define SSH2_PKTCTX_AUTH_MASK 0x00F0
121 #define SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1 /* 0x1 */
122 #define SSH2_DISCONNECT_PROTOCOL_ERROR 2 /* 0x2 */
123 #define SSH2_DISCONNECT_KEY_EXCHANGE_FAILED 3 /* 0x3 */
124 #define SSH2_DISCONNECT_HOST_AUTHENTICATION_FAILED 4 /* 0x4 */
125 #define SSH2_DISCONNECT_MAC_ERROR 5 /* 0x5 */
126 #define SSH2_DISCONNECT_COMPRESSION_ERROR 6 /* 0x6 */
127 #define SSH2_DISCONNECT_SERVICE_NOT_AVAILABLE 7 /* 0x7 */
128 #define SSH2_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED 8 /* 0x8 */
129 #define SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9 /* 0x9 */
130 #define SSH2_DISCONNECT_CONNECTION_LOST 10 /* 0xa */
131 #define SSH2_DISCONNECT_BY_APPLICATION 11 /* 0xb */
132 #define SSH2_DISCONNECT_TOO_MANY_CONNECTIONS 12 /* 0xc */
133 #define SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER 13 /* 0xd */
134 #define SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14 /* 0xe */
135 #define SSH2_DISCONNECT_ILLEGAL_USER_NAME 15 /* 0xf */
137 static const char *const ssh2_disconnect_reasons[] = {
139 "host not allowed to connect",
141 "key exchange failed",
142 "host authentication failed",
145 "service not available",
146 "protocol version not supported",
147 "host key not verifiable",
150 "too many connections",
151 "auth cancelled by user",
152 "no more auth methods available",
156 #define SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED 1 /* 0x1 */
157 #define SSH2_OPEN_CONNECT_FAILED 2 /* 0x2 */
158 #define SSH2_OPEN_UNKNOWN_CHANNEL_TYPE 3 /* 0x3 */
159 #define SSH2_OPEN_RESOURCE_SHORTAGE 4 /* 0x4 */
161 #define SSH2_EXTENDED_DATA_STDERR 1 /* 0x1 */
164 * Various remote-bug flags.
166 #define BUG_CHOKES_ON_SSH1_IGNORE 1
167 #define BUG_SSH2_HMAC 2
168 #define BUG_NEEDS_SSH1_PLAIN_PASSWORD 4
169 #define BUG_CHOKES_ON_RSA 8
170 #define BUG_SSH2_RSA_PADDING 16
171 #define BUG_SSH2_DERIVEKEY 32
172 #define BUG_SSH2_REKEY 64
173 #define BUG_SSH2_PK_SESSIONID 128
176 * Codes for terminal modes.
177 * Most of these are the same in SSH-1 and SSH-2.
178 * This list is derived from draft-ietf-secsh-connect-25 and
181 static const struct {
182 const char* const mode;
184 enum { TTY_OP_CHAR, TTY_OP_BOOL } type;
186 /* "V" prefix discarded for special characters relative to SSH specs */
187 { "INTR", 1, TTY_OP_CHAR },
188 { "QUIT", 2, TTY_OP_CHAR },
189 { "ERASE", 3, TTY_OP_CHAR },
190 { "KILL", 4, TTY_OP_CHAR },
191 { "EOF", 5, TTY_OP_CHAR },
192 { "EOL", 6, TTY_OP_CHAR },
193 { "EOL2", 7, TTY_OP_CHAR },
194 { "START", 8, TTY_OP_CHAR },
195 { "STOP", 9, TTY_OP_CHAR },
196 { "SUSP", 10, TTY_OP_CHAR },
197 { "DSUSP", 11, TTY_OP_CHAR },
198 { "REPRINT", 12, TTY_OP_CHAR },
199 { "WERASE", 13, TTY_OP_CHAR },
200 { "LNEXT", 14, TTY_OP_CHAR },
201 { "FLUSH", 15, TTY_OP_CHAR },
202 { "SWTCH", 16, TTY_OP_CHAR },
203 { "STATUS", 17, TTY_OP_CHAR },
204 { "DISCARD", 18, TTY_OP_CHAR },
205 { "IGNPAR", 30, TTY_OP_BOOL },
206 { "PARMRK", 31, TTY_OP_BOOL },
207 { "INPCK", 32, TTY_OP_BOOL },
208 { "ISTRIP", 33, TTY_OP_BOOL },
209 { "INLCR", 34, TTY_OP_BOOL },
210 { "IGNCR", 35, TTY_OP_BOOL },
211 { "ICRNL", 36, TTY_OP_BOOL },
212 { "IUCLC", 37, TTY_OP_BOOL },
213 { "IXON", 38, TTY_OP_BOOL },
214 { "IXANY", 39, TTY_OP_BOOL },
215 { "IXOFF", 40, TTY_OP_BOOL },
216 { "IMAXBEL", 41, TTY_OP_BOOL },
217 { "ISIG", 50, TTY_OP_BOOL },
218 { "ICANON", 51, TTY_OP_BOOL },
219 { "XCASE", 52, TTY_OP_BOOL },
220 { "ECHO", 53, TTY_OP_BOOL },
221 { "ECHOE", 54, TTY_OP_BOOL },
222 { "ECHOK", 55, TTY_OP_BOOL },
223 { "ECHONL", 56, TTY_OP_BOOL },
224 { "NOFLSH", 57, TTY_OP_BOOL },
225 { "TOSTOP", 58, TTY_OP_BOOL },
226 { "IEXTEN", 59, TTY_OP_BOOL },
227 { "ECHOCTL", 60, TTY_OP_BOOL },
228 { "ECHOKE", 61, TTY_OP_BOOL },
229 { "PENDIN", 62, TTY_OP_BOOL }, /* XXX is this a real mode? */
230 { "OPOST", 70, TTY_OP_BOOL },
231 { "OLCUC", 71, TTY_OP_BOOL },
232 { "ONLCR", 72, TTY_OP_BOOL },
233 { "OCRNL", 73, TTY_OP_BOOL },
234 { "ONOCR", 74, TTY_OP_BOOL },
235 { "ONLRET", 75, TTY_OP_BOOL },
236 { "CS7", 90, TTY_OP_BOOL },
237 { "CS8", 91, TTY_OP_BOOL },
238 { "PARENB", 92, TTY_OP_BOOL },
239 { "PARODD", 93, TTY_OP_BOOL }
242 /* Miscellaneous other tty-related constants. */
243 #define SSH_TTY_OP_END 0
244 /* The opcodes for ISPEED/OSPEED differ between SSH-1 and SSH-2. */
245 #define SSH1_TTY_OP_ISPEED 192
246 #define SSH1_TTY_OP_OSPEED 193
247 #define SSH2_TTY_OP_ISPEED 128
248 #define SSH2_TTY_OP_OSPEED 129
250 /* Helper functions for parsing tty-related config. */
251 static unsigned int ssh_tty_parse_specchar(char *s)
256 ret = ctrlparse(s, &next);
257 if (!next) ret = s[0];
259 ret = 255; /* special value meaning "don't set" */
263 static unsigned int ssh_tty_parse_boolean(char *s)
265 if (stricmp(s, "yes") == 0 ||
266 stricmp(s, "on") == 0 ||
267 stricmp(s, "true") == 0 ||
268 stricmp(s, "+") == 0)
270 else if (stricmp(s, "no") == 0 ||
271 stricmp(s, "off") == 0 ||
272 stricmp(s, "false") == 0 ||
273 stricmp(s, "-") == 0)
274 return 0; /* false */
276 return (atoi(s) != 0);
279 #define translate(x) if (type == x) return #x
280 #define translatec(x,ctx) if (type == x && (pkt_ctx & ctx)) return #x
281 static char *ssh1_pkt_type(int type)
283 translate(SSH1_MSG_DISCONNECT);
284 translate(SSH1_SMSG_PUBLIC_KEY);
285 translate(SSH1_CMSG_SESSION_KEY);
286 translate(SSH1_CMSG_USER);
287 translate(SSH1_CMSG_AUTH_RSA);
288 translate(SSH1_SMSG_AUTH_RSA_CHALLENGE);
289 translate(SSH1_CMSG_AUTH_RSA_RESPONSE);
290 translate(SSH1_CMSG_AUTH_PASSWORD);
291 translate(SSH1_CMSG_REQUEST_PTY);
292 translate(SSH1_CMSG_WINDOW_SIZE);
293 translate(SSH1_CMSG_EXEC_SHELL);
294 translate(SSH1_CMSG_EXEC_CMD);
295 translate(SSH1_SMSG_SUCCESS);
296 translate(SSH1_SMSG_FAILURE);
297 translate(SSH1_CMSG_STDIN_DATA);
298 translate(SSH1_SMSG_STDOUT_DATA);
299 translate(SSH1_SMSG_STDERR_DATA);
300 translate(SSH1_CMSG_EOF);
301 translate(SSH1_SMSG_EXIT_STATUS);
302 translate(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
303 translate(SSH1_MSG_CHANNEL_OPEN_FAILURE);
304 translate(SSH1_MSG_CHANNEL_DATA);
305 translate(SSH1_MSG_CHANNEL_CLOSE);
306 translate(SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION);
307 translate(SSH1_SMSG_X11_OPEN);
308 translate(SSH1_CMSG_PORT_FORWARD_REQUEST);
309 translate(SSH1_MSG_PORT_OPEN);
310 translate(SSH1_CMSG_AGENT_REQUEST_FORWARDING);
311 translate(SSH1_SMSG_AGENT_OPEN);
312 translate(SSH1_MSG_IGNORE);
313 translate(SSH1_CMSG_EXIT_CONFIRMATION);
314 translate(SSH1_CMSG_X11_REQUEST_FORWARDING);
315 translate(SSH1_CMSG_AUTH_RHOSTS_RSA);
316 translate(SSH1_MSG_DEBUG);
317 translate(SSH1_CMSG_REQUEST_COMPRESSION);
318 translate(SSH1_CMSG_AUTH_TIS);
319 translate(SSH1_SMSG_AUTH_TIS_CHALLENGE);
320 translate(SSH1_CMSG_AUTH_TIS_RESPONSE);
321 translate(SSH1_CMSG_AUTH_CCARD);
322 translate(SSH1_SMSG_AUTH_CCARD_CHALLENGE);
323 translate(SSH1_CMSG_AUTH_CCARD_RESPONSE);
326 static char *ssh2_pkt_type(int pkt_ctx, int type)
328 translate(SSH2_MSG_DISCONNECT);
329 translate(SSH2_MSG_IGNORE);
330 translate(SSH2_MSG_UNIMPLEMENTED);
331 translate(SSH2_MSG_DEBUG);
332 translate(SSH2_MSG_SERVICE_REQUEST);
333 translate(SSH2_MSG_SERVICE_ACCEPT);
334 translate(SSH2_MSG_KEXINIT);
335 translate(SSH2_MSG_NEWKEYS);
336 translatec(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP);
337 translatec(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP);
338 translatec(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX);
339 translatec(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX);
340 translatec(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX);
341 translatec(SSH2_MSG_KEX_DH_GEX_REPLY, SSH2_PKTCTX_DHGEX);
342 translate(SSH2_MSG_USERAUTH_REQUEST);
343 translate(SSH2_MSG_USERAUTH_FAILURE);
344 translate(SSH2_MSG_USERAUTH_SUCCESS);
345 translate(SSH2_MSG_USERAUTH_BANNER);
346 translatec(SSH2_MSG_USERAUTH_PK_OK, SSH2_PKTCTX_PUBLICKEY);
347 translatec(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, SSH2_PKTCTX_PASSWORD);
348 translatec(SSH2_MSG_USERAUTH_INFO_REQUEST, SSH2_PKTCTX_KBDINTER);
349 translatec(SSH2_MSG_USERAUTH_INFO_RESPONSE, SSH2_PKTCTX_KBDINTER);
350 translate(SSH2_MSG_GLOBAL_REQUEST);
351 translate(SSH2_MSG_REQUEST_SUCCESS);
352 translate(SSH2_MSG_REQUEST_FAILURE);
353 translate(SSH2_MSG_CHANNEL_OPEN);
354 translate(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
355 translate(SSH2_MSG_CHANNEL_OPEN_FAILURE);
356 translate(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
357 translate(SSH2_MSG_CHANNEL_DATA);
358 translate(SSH2_MSG_CHANNEL_EXTENDED_DATA);
359 translate(SSH2_MSG_CHANNEL_EOF);
360 translate(SSH2_MSG_CHANNEL_CLOSE);
361 translate(SSH2_MSG_CHANNEL_REQUEST);
362 translate(SSH2_MSG_CHANNEL_SUCCESS);
363 translate(SSH2_MSG_CHANNEL_FAILURE);
369 /* Enumeration values for fields in SSH-1 packets */
371 PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM,
372 /* These values are for communicating relevant semantics of
373 * fields to the packet logging code. */
374 PKTT_OTHER, PKTT_PASSWORD, PKTT_DATA
378 * Coroutine mechanics for the sillier bits of the code. If these
379 * macros look impenetrable to you, you might find it helpful to
382 * http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html
384 * which explains the theory behind these macros.
386 * In particular, if you are getting `case expression not constant'
387 * errors when building with MS Visual Studio, this is because MS's
388 * Edit and Continue debugging feature causes their compiler to
389 * violate ANSI C. To disable Edit and Continue debugging:
391 * - right-click ssh.c in the FileView
393 * - select the C/C++ tab and the General category
394 * - under `Debug info:', select anything _other_ than `Program
395 * Database for Edit and Continue'.
397 #define crBegin(v) { int *crLine = &v; switch(v) { case 0:;
400 if (!ssh->t) ssh->t = snew(struct t); \
402 #define crFinish(z) } *crLine = 0; return (z); }
403 #define crFinishV } *crLine = 0; return; }
404 #define crReturn(z) \
406 *crLine =__LINE__; return (z); case __LINE__:;\
410 *crLine=__LINE__; return; case __LINE__:;\
412 #define crStop(z) do{ *crLine = 0; return (z); }while(0)
413 #define crStopV do{ *crLine = 0; return; }while(0)
414 #define crWaitUntil(c) do { crReturn(0); } while (!(c))
415 #define crWaitUntilV(c) do { crReturnV; } while (!(c))
417 typedef struct ssh_tag *Ssh;
420 static struct Packet *ssh1_pkt_init(int pkt_type);
421 static struct Packet *ssh2_pkt_init(int pkt_type);
422 static void ssh_pkt_ensure(struct Packet *, int length);
423 static void ssh_pkt_adddata(struct Packet *, void *data, int len);
424 static void ssh_pkt_addbyte(struct Packet *, unsigned char value);
425 static void ssh2_pkt_addbool(struct Packet *, unsigned char value);
426 static void ssh_pkt_adduint32(struct Packet *, unsigned long value);
427 static void ssh_pkt_addstring_start(struct Packet *);
428 static void ssh_pkt_addstring_str(struct Packet *, char *data);
429 static void ssh_pkt_addstring_data(struct Packet *, char *data, int len);
430 static void ssh_pkt_addstring(struct Packet *, char *data);
431 static unsigned char *ssh2_mpint_fmt(Bignum b, int *len);
432 static void ssh1_pkt_addmp(struct Packet *, Bignum b);
433 static void ssh2_pkt_addmp(struct Packet *, Bignum b);
434 static int ssh2_pkt_construct(Ssh, struct Packet *);
435 static void ssh2_pkt_send(Ssh, struct Packet *);
436 static void ssh2_pkt_send_noqueue(Ssh, struct Packet *);
437 static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
438 struct Packet *pktin);
439 static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
440 struct Packet *pktin);
443 * Buffer management constants. There are several of these for
444 * various different purposes:
446 * - SSH1_BUFFER_LIMIT is the amount of backlog that must build up
447 * on a local data stream before we throttle the whole SSH
448 * connection (in SSH-1 only). Throttling the whole connection is
449 * pretty drastic so we set this high in the hope it won't
452 * - SSH_MAX_BACKLOG is the amount of backlog that must build up
453 * on the SSH connection itself before we defensively throttle
454 * _all_ local data streams. This is pretty drastic too (though
455 * thankfully unlikely in SSH-2 since the window mechanism should
456 * ensure that the server never has any need to throttle its end
457 * of the connection), so we set this high as well.
459 * - OUR_V2_WINSIZE is the maximum window size we present on SSH-2
463 #define SSH1_BUFFER_LIMIT 32768
464 #define SSH_MAX_BACKLOG 32768
465 #define OUR_V2_WINSIZE 16384
466 #define OUR_V2_MAXPKT 0x4000UL
468 /* Maximum length of passwords/passphrases (arbitrary) */
469 #define SSH_MAX_PASSWORD_LEN 100
471 const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss };
473 const static struct ssh_mac *macs[] = {
474 &ssh_hmac_sha1, &ssh_hmac_sha1_96, &ssh_hmac_md5
476 const static struct ssh_mac *buggymacs[] = {
477 &ssh_hmac_sha1_buggy, &ssh_hmac_sha1_96_buggy, &ssh_hmac_md5
480 static void *ssh_comp_none_init(void)
484 static void ssh_comp_none_cleanup(void *handle)
487 static int ssh_comp_none_block(void *handle, unsigned char *block, int len,
488 unsigned char **outblock, int *outlen)
492 static int ssh_comp_none_disable(void *handle)
496 const static struct ssh_compress ssh_comp_none = {
498 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
499 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
500 ssh_comp_none_disable, NULL
502 extern const struct ssh_compress ssh_zlib;
503 const static struct ssh_compress *compressions[] = {
504 &ssh_zlib, &ssh_comp_none
507 enum { /* channel types */
512 CHAN_SOCKDATA_DORMANT /* one the remote hasn't confirmed */
516 * 2-3-4 tree storing channels.
519 Ssh ssh; /* pointer back to main context */
520 unsigned remoteid, localid;
522 /* True if we opened this channel but server hasn't confirmed. */
525 * In SSH-1, this value contains four bits:
527 * 1 We have sent SSH1_MSG_CHANNEL_CLOSE.
528 * 2 We have sent SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
529 * 4 We have received SSH1_MSG_CHANNEL_CLOSE.
530 * 8 We have received SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
532 * A channel is completely finished with when all four bits are set.
536 struct ssh1_data_channel {
539 struct ssh2_data_channel {
541 unsigned remwindow, remmaxpkt;
546 struct ssh_agent_channel {
547 unsigned char *message;
548 unsigned char msglen[4];
549 unsigned lensofar, totallen;
551 struct ssh_x11_channel {
554 struct ssh_pfd_channel {
561 * 2-3-4 tree storing remote->local port forwardings. SSH-1 and SSH-2
562 * use this structure in different ways, reflecting SSH-2's
563 * altogether saner approach to port forwarding.
565 * In SSH-1, you arrange a remote forwarding by sending the server
566 * the remote port number, and the local destination host:port.
567 * When a connection comes in, the server sends you back that
568 * host:port pair, and you connect to it. This is a ready-made
569 * security hole if you're not on the ball: a malicious server
570 * could send you back _any_ host:port pair, so if you trustingly
571 * connect to the address it gives you then you've just opened the
572 * entire inside of your corporate network just by connecting
573 * through it to a dodgy SSH server. Hence, we must store a list of
574 * host:port pairs we _are_ trying to forward to, and reject a
575 * connection request from the server if it's not in the list.
577 * In SSH-2, each side of the connection minds its own business and
578 * doesn't send unnecessary information to the other. You arrange a
579 * remote forwarding by sending the server just the remote port
580 * number. When a connection comes in, the server tells you which
581 * of its ports was connected to; and _you_ have to remember what
582 * local host:port pair went with that port number.
584 * Hence, in SSH-1 this structure is indexed by destination
585 * host:port pair, whereas in SSH-2 it is indexed by source port.
587 struct ssh_portfwd; /* forward declaration */
589 struct ssh_rportfwd {
590 unsigned sport, dport;
593 struct ssh_portfwd *pfrec;
595 #define free_rportfwd(pf) ( \
596 ((pf) ? (sfree((pf)->sportdesc)) : (void)0 ), sfree(pf) )
599 * Separately to the rportfwd tree (which is for looking up port
600 * open requests from the server), a tree of _these_ structures is
601 * used to keep track of all the currently open port forwardings,
602 * so that we can reconfigure in mid-session if the user requests
606 enum { DESTROY, KEEP, CREATE } status;
608 unsigned sport, dport;
611 struct ssh_rportfwd *remote;
615 #define free_portfwd(pf) ( \
616 ((pf) ? (sfree((pf)->saddr), sfree((pf)->daddr), \
617 sfree((pf)->sserv), sfree((pf)->dserv)) : (void)0 ), sfree(pf) )
620 long length; /* length of `data' actually used */
621 long forcepad; /* SSH-2: force padding to at least this length */
622 int type; /* only used for incoming packets */
623 unsigned long sequence; /* SSH-2 incoming sequence number */
624 unsigned char *data; /* allocated storage */
625 unsigned char *body; /* offset of payload within `data' */
626 long savedpos; /* temporary index into `data' (for strings) */
627 long maxlen; /* amount of storage allocated for `data' */
628 long encrypted_len; /* for SSH-2 total-size counting */
631 * State associated with packet logging
635 struct logblank_t *blanks;
638 static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
639 struct Packet *pktin);
640 static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
641 struct Packet *pktin);
642 static void ssh1_protocol_setup(Ssh ssh);
643 static void ssh2_protocol_setup(Ssh ssh);
644 static void ssh_size(void *handle, int width, int height);
645 static void ssh_special(void *handle, Telnet_Special);
646 static int ssh2_try_send(struct ssh_channel *c);
647 static void ssh2_add_channel_data(struct ssh_channel *c, char *buf, int len);
648 static void ssh_throttle_all(Ssh ssh, int enable, int bufsize);
649 static void ssh2_set_window(struct ssh_channel *c, unsigned newwin);
650 static int ssh_sendbuffer(void *handle);
651 static int ssh_do_close(Ssh ssh, int notify_exit);
652 static unsigned long ssh_pkt_getuint32(struct Packet *pkt);
653 static int ssh2_pkt_getbool(struct Packet *pkt);
654 static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length);
655 static void ssh2_timer(void *ctx, long now);
656 static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
657 struct Packet *pktin);
659 struct rdpkt1_state_tag {
660 long len, pad, biglen, to_read;
661 unsigned long realcrc, gotcrc;
665 struct Packet *pktin;
668 struct rdpkt2_state_tag {
669 long len, pad, payload, packetlen, maclen;
672 unsigned long incoming_sequence;
673 struct Packet *pktin;
676 typedef void (*handler_fn_t)(Ssh ssh, struct Packet *pktin);
677 typedef void (*chandler_fn_t)(Ssh ssh, struct Packet *pktin, void *ctx);
679 struct queued_handler;
680 struct queued_handler {
682 chandler_fn_t handler;
684 struct queued_handler *next;
688 const struct plug_function_table *fn;
689 /* the above field _must_ be first in the structure */
699 unsigned char session_key[32];
701 int v1_remote_protoflags;
702 int v1_local_protoflags;
703 int agentfwd_enabled;
706 const struct ssh_cipher *cipher;
709 const struct ssh2_cipher *cscipher, *sccipher;
710 void *cs_cipher_ctx, *sc_cipher_ctx;
711 const struct ssh_mac *csmac, *scmac;
712 void *cs_mac_ctx, *sc_mac_ctx;
713 const struct ssh_compress *cscomp, *sccomp;
714 void *cs_comp_ctx, *sc_comp_ctx;
715 const struct ssh_kex *kex;
716 const struct ssh_signkey *hostkey;
717 unsigned char v2_session_id[SSH2_KEX_MAX_HASH_LEN];
718 int v2_session_id_len;
724 int echoing, editing;
728 int ospeed, ispeed; /* temporaries */
729 int term_width, term_height;
731 tree234 *channels; /* indexed by local id */
732 struct ssh_channel *mainchan; /* primary session channel */
733 int ncmode; /* is primary channel direct-tcpip? */
738 tree234 *rportfwds, *portfwds;
742 SSH_STATE_BEFORE_SIZE,
748 int size_needed, eof_needed;
750 struct Packet **queue;
751 int queuelen, queuesize;
753 unsigned char *deferred_send_data;
754 int deferred_len, deferred_size;
757 * Gross hack: pscp will try to start SFTP but fall back to
758 * scp1 if that fails. This variable is the means by which
759 * scp.c can reach into the SSH code and find out which one it
764 bufchain banner; /* accumulates banners during do_ssh2_authconn */
771 int v1_throttle_count;
774 int v1_stdout_throttling;
775 unsigned long v2_outgoing_sequence;
777 int ssh1_rdpkt_crstate;
778 int ssh2_rdpkt_crstate;
779 int do_ssh_init_crstate;
780 int ssh_gotdata_crstate;
781 int do_ssh1_login_crstate;
782 int do_ssh1_connection_crstate;
783 int do_ssh2_transport_crstate;
784 int do_ssh2_authconn_crstate;
786 void *do_ssh_init_state;
787 void *do_ssh1_login_state;
788 void *do_ssh2_transport_state;
789 void *do_ssh2_authconn_state;
791 struct rdpkt1_state_tag rdpkt1_state;
792 struct rdpkt2_state_tag rdpkt2_state;
794 /* SSH-1 and SSH-2 use this for different things, but both use it */
795 int protocol_initial_phase_done;
797 void (*protocol) (Ssh ssh, void *vin, int inlen,
799 struct Packet *(*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen);
802 * We maintain a full _copy_ of a Config structure here, not
803 * merely a pointer to it. That way, when we're passed a new
804 * one for reconfiguration, we can check the differences and
805 * potentially reconfigure port forwardings etc in mid-session.
810 * Used to transfer data back from async callbacks.
812 void *agent_response;
813 int agent_response_len;
817 * The SSH connection can be set as `frozen', meaning we are
818 * not currently accepting incoming data from the network. This
819 * is slightly more serious than setting the _socket_ as
820 * frozen, because we may already have had data passed to us
821 * from the network which we need to delay processing until
822 * after the freeze is lifted, so we also need a bufchain to
826 bufchain queued_incoming_data;
829 * Dispatch table for packet types that we may have to deal
832 handler_fn_t packet_dispatch[256];
835 * Queues of one-off handler functions for success/failure
836 * indications from a request.
838 struct queued_handler *qhead, *qtail;
841 * This module deals with sending keepalives.
846 * Track incoming and outgoing data sizes and time, for
849 unsigned long incoming_data_size, outgoing_data_size, deferred_data_size;
850 unsigned long max_data_size;
852 long next_rekey, last_rekey;
853 char *deferred_rekey_reason; /* points to STATIC string; don't free */
856 #define logevent(s) logevent(ssh->frontend, s)
858 /* logevent, only printf-formatted. */
859 static void logeventf(Ssh ssh, const char *fmt, ...)
865 buf = dupvprintf(fmt, ap);
871 #define bombout(msg) \
873 char *text = dupprintf msg; \
874 ssh_do_close(ssh, FALSE); \
876 connection_fatal(ssh->frontend, "%s", text); \
880 /* Functions to leave bits out of the SSH packet log file. */
882 static void dont_log_password(Ssh ssh, struct Packet *pkt, int blanktype)
884 if (ssh->cfg.logomitpass)
885 pkt->logmode = blanktype;
888 static void dont_log_data(Ssh ssh, struct Packet *pkt, int blanktype)
890 if (ssh->cfg.logomitdata)
891 pkt->logmode = blanktype;
894 static void end_log_omission(Ssh ssh, struct Packet *pkt)
896 pkt->logmode = PKTLOG_EMIT;
899 /* Helper function for common bits of parsing cfg.ttymodes. */
900 static void parse_ttymodes(Ssh ssh, char *modes,
901 void (*do_mode)(void *data, char *mode, char *val),
905 char *t = strchr(modes, '\t');
906 char *m = snewn(t-modes+1, char);
908 strncpy(m, modes, t-modes);
911 val = get_ttymode(ssh->frontend, m);
915 do_mode(data, m, val);
918 modes += strlen(modes) + 1;
922 static int ssh_channelcmp(void *av, void *bv)
924 struct ssh_channel *a = (struct ssh_channel *) av;
925 struct ssh_channel *b = (struct ssh_channel *) bv;
926 if (a->localid < b->localid)
928 if (a->localid > b->localid)
932 static int ssh_channelfind(void *av, void *bv)
934 unsigned *a = (unsigned *) av;
935 struct ssh_channel *b = (struct ssh_channel *) bv;
943 static int ssh_rportcmp_ssh1(void *av, void *bv)
945 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
946 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
948 if ( (i = strcmp(a->dhost, b->dhost)) != 0)
949 return i < 0 ? -1 : +1;
950 if (a->dport > b->dport)
952 if (a->dport < b->dport)
957 static int ssh_rportcmp_ssh2(void *av, void *bv)
959 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
960 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
962 if (a->sport > b->sport)
964 if (a->sport < b->sport)
970 * Special form of strcmp which can cope with NULL inputs. NULL is
971 * defined to sort before even the empty string.
973 static int nullstrcmp(const char *a, const char *b)
975 if (a == NULL && b == NULL)
984 static int ssh_portcmp(void *av, void *bv)
986 struct ssh_portfwd *a = (struct ssh_portfwd *) av;
987 struct ssh_portfwd *b = (struct ssh_portfwd *) bv;
989 if (a->type > b->type)
991 if (a->type < b->type)
993 if (a->addressfamily > b->addressfamily)
995 if (a->addressfamily < b->addressfamily)
997 if ( (i = nullstrcmp(a->saddr, b->saddr)) != 0)
998 return i < 0 ? -1 : +1;
999 if (a->sport > b->sport)
1001 if (a->sport < b->sport)
1003 if (a->type != 'D') {
1004 if ( (i = nullstrcmp(a->daddr, b->daddr)) != 0)
1005 return i < 0 ? -1 : +1;
1006 if (a->dport > b->dport)
1008 if (a->dport < b->dport)
1014 static int alloc_channel_id(Ssh ssh)
1016 const unsigned CHANNEL_NUMBER_OFFSET = 256;
1017 unsigned low, high, mid;
1019 struct ssh_channel *c;
1022 * First-fit allocation of channel numbers: always pick the
1023 * lowest unused one. To do this, binary-search using the
1024 * counted B-tree to find the largest channel ID which is in a
1025 * contiguous sequence from the beginning. (Precisely
1026 * everything in that sequence must have ID equal to its tree
1027 * index plus CHANNEL_NUMBER_OFFSET.)
1029 tsize = count234(ssh->channels);
1033 while (high - low > 1) {
1034 mid = (high + low) / 2;
1035 c = index234(ssh->channels, mid);
1036 if (c->localid == mid + CHANNEL_NUMBER_OFFSET)
1037 low = mid; /* this one is fine */
1039 high = mid; /* this one is past it */
1042 * Now low points to either -1, or the tree index of the
1043 * largest ID in the initial sequence.
1046 unsigned i = low + 1 + CHANNEL_NUMBER_OFFSET;
1047 assert(NULL == find234(ssh->channels, &i, ssh_channelfind));
1049 return low + 1 + CHANNEL_NUMBER_OFFSET;
1052 static void c_write_stderr(int trusted, const char *buf, int len)
1055 for (i = 0; i < len; i++)
1056 if (buf[i] != '\r' && (trusted || buf[i] == '\n' || (buf[i] & 0x60)))
1057 fputc(buf[i], stderr);
1060 static void c_write(Ssh ssh, const char *buf, int len)
1062 if (flags & FLAG_STDERR)
1063 c_write_stderr(1, buf, len);
1065 from_backend(ssh->frontend, 1, buf, len);
1068 static void c_write_untrusted(Ssh ssh, const char *buf, int len)
1070 if (flags & FLAG_STDERR)
1071 c_write_stderr(0, buf, len);
1073 from_backend_untrusted(ssh->frontend, buf, len);
1076 static void c_write_str(Ssh ssh, const char *buf)
1078 c_write(ssh, buf, strlen(buf));
1081 static void ssh_free_packet(struct Packet *pkt)
1086 static struct Packet *ssh_new_packet(void)
1088 struct Packet *pkt = snew(struct Packet);
1090 pkt->body = pkt->data = NULL;
1092 pkt->logmode = PKTLOG_EMIT;
1100 * Collect incoming data in the incoming packet buffer.
1101 * Decipher and verify the packet when it is completely read.
1102 * Drop SSH1_MSG_DEBUG and SSH1_MSG_IGNORE packets.
1103 * Update the *data and *datalen variables.
1104 * Return a Packet structure when a packet is completed.
1106 static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
1108 struct rdpkt1_state_tag *st = &ssh->rdpkt1_state;
1110 crBegin(ssh->ssh1_rdpkt_crstate);
1112 st->pktin = ssh_new_packet();
1114 st->pktin->type = 0;
1115 st->pktin->length = 0;
1117 for (st->i = st->len = 0; st->i < 4; st->i++) {
1118 while ((*datalen) == 0)
1120 st->len = (st->len << 8) + **data;
1121 (*data)++, (*datalen)--;
1124 st->pad = 8 - (st->len % 8);
1125 st->biglen = st->len + st->pad;
1126 st->pktin->length = st->len - 5;
1128 if (st->biglen < 0) {
1129 bombout(("Extremely large packet length from server suggests"
1130 " data stream corruption"));
1131 ssh_free_packet(st->pktin);
1135 st->pktin->maxlen = st->biglen;
1136 st->pktin->data = snewn(st->biglen + APIEXTRA, unsigned char);
1138 st->to_read = st->biglen;
1139 st->p = st->pktin->data;
1140 while (st->to_read > 0) {
1141 st->chunk = st->to_read;
1142 while ((*datalen) == 0)
1144 if (st->chunk > (*datalen))
1145 st->chunk = (*datalen);
1146 memcpy(st->p, *data, st->chunk);
1148 *datalen -= st->chunk;
1150 st->to_read -= st->chunk;
1153 if (ssh->cipher && detect_attack(ssh->crcda_ctx, st->pktin->data,
1154 st->biglen, NULL)) {
1155 bombout(("Network attack (CRC compensation) detected!"));
1156 ssh_free_packet(st->pktin);
1161 ssh->cipher->decrypt(ssh->v1_cipher_ctx, st->pktin->data, st->biglen);
1163 st->realcrc = crc32_compute(st->pktin->data, st->biglen - 4);
1164 st->gotcrc = GET_32BIT(st->pktin->data + st->biglen - 4);
1165 if (st->gotcrc != st->realcrc) {
1166 bombout(("Incorrect CRC received on packet"));
1167 ssh_free_packet(st->pktin);
1171 st->pktin->body = st->pktin->data + st->pad + 1;
1172 st->pktin->savedpos = 0;
1174 if (ssh->v1_compressing) {
1175 unsigned char *decompblk;
1177 if (!zlib_decompress_block(ssh->sc_comp_ctx,
1178 st->pktin->body - 1, st->pktin->length + 1,
1179 &decompblk, &decomplen)) {
1180 bombout(("Zlib decompression encountered invalid data"));
1181 ssh_free_packet(st->pktin);
1185 if (st->pktin->maxlen < st->pad + decomplen) {
1186 st->pktin->maxlen = st->pad + decomplen;
1187 st->pktin->data = sresize(st->pktin->data,
1188 st->pktin->maxlen + APIEXTRA,
1190 st->pktin->body = st->pktin->data + st->pad + 1;
1193 memcpy(st->pktin->body - 1, decompblk, decomplen);
1195 st->pktin->length = decomplen - 1;
1198 st->pktin->type = st->pktin->body[-1];
1201 * Log incoming packet, possibly omitting sensitive fields.
1205 struct logblank_t blank;
1206 if (ssh->cfg.logomitdata) {
1207 int do_blank = FALSE, blank_prefix = 0;
1208 /* "Session data" packets - omit the data field */
1209 if ((st->pktin->type == SSH1_SMSG_STDOUT_DATA) ||
1210 (st->pktin->type == SSH1_SMSG_STDERR_DATA)) {
1211 do_blank = TRUE; blank_prefix = 0;
1212 } else if (st->pktin->type == SSH1_MSG_CHANNEL_DATA) {
1213 do_blank = TRUE; blank_prefix = 4;
1216 blank.offset = blank_prefix;
1217 blank.len = st->pktin->length;
1218 blank.type = PKTLOG_OMIT;
1222 log_packet(ssh->logctx,
1223 PKT_INCOMING, st->pktin->type,
1224 ssh1_pkt_type(st->pktin->type),
1225 st->pktin->body, st->pktin->length,
1229 crFinish(st->pktin);
1232 static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
1234 struct rdpkt2_state_tag *st = &ssh->rdpkt2_state;
1236 crBegin(ssh->ssh2_rdpkt_crstate);
1238 st->pktin = ssh_new_packet();
1240 st->pktin->type = 0;
1241 st->pktin->length = 0;
1243 st->cipherblk = ssh->sccipher->blksize;
1246 if (st->cipherblk < 8)
1249 st->pktin->data = snewn(st->cipherblk + APIEXTRA, unsigned char);
1252 * Acquire and decrypt the first block of the packet. This will
1253 * contain the length and padding details.
1255 for (st->i = st->len = 0; st->i < st->cipherblk; st->i++) {
1256 while ((*datalen) == 0)
1258 st->pktin->data[st->i] = *(*data)++;
1263 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1264 st->pktin->data, st->cipherblk);
1267 * Now get the length and padding figures.
1269 st->len = GET_32BIT(st->pktin->data);
1270 st->pad = st->pktin->data[4];
1273 * _Completely_ silly lengths should be stomped on before they
1274 * do us any more damage.
1276 if (st->len < 0 || st->len > 35000 || st->pad < 4 ||
1277 st->len - st->pad < 1 || (st->len + 4) % st->cipherblk != 0) {
1278 bombout(("Incoming packet was garbled on decryption"));
1279 ssh_free_packet(st->pktin);
1284 * This enables us to deduce the payload length.
1286 st->payload = st->len - st->pad - 1;
1288 st->pktin->length = st->payload + 5;
1291 * So now we can work out the total packet length.
1293 st->packetlen = st->len + 4;
1294 st->maclen = ssh->scmac ? ssh->scmac->len : 0;
1297 * Allocate memory for the rest of the packet.
1299 st->pktin->maxlen = st->packetlen + st->maclen;
1300 st->pktin->data = sresize(st->pktin->data,
1301 st->pktin->maxlen + APIEXTRA,
1305 * Read and decrypt the remainder of the packet.
1307 for (st->i = st->cipherblk; st->i < st->packetlen + st->maclen;
1309 while ((*datalen) == 0)
1311 st->pktin->data[st->i] = *(*data)++;
1314 /* Decrypt everything _except_ the MAC. */
1316 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1317 st->pktin->data + st->cipherblk,
1318 st->packetlen - st->cipherblk);
1320 st->pktin->encrypted_len = st->packetlen;
1326 && !ssh->scmac->verify(ssh->sc_mac_ctx, st->pktin->data, st->len + 4,
1327 st->incoming_sequence)) {
1328 bombout(("Incorrect MAC received on packet"));
1329 ssh_free_packet(st->pktin);
1333 st->pktin->sequence = st->incoming_sequence++;
1336 * Decompress packet payload.
1339 unsigned char *newpayload;
1342 ssh->sccomp->decompress(ssh->sc_comp_ctx,
1343 st->pktin->data + 5, st->pktin->length - 5,
1344 &newpayload, &newlen)) {
1345 if (st->pktin->maxlen < newlen + 5) {
1346 st->pktin->maxlen = newlen + 5;
1347 st->pktin->data = sresize(st->pktin->data,
1348 st->pktin->maxlen + APIEXTRA,
1351 st->pktin->length = 5 + newlen;
1352 memcpy(st->pktin->data + 5, newpayload, newlen);
1357 st->pktin->savedpos = 6;
1358 st->pktin->body = st->pktin->data;
1359 st->pktin->type = st->pktin->data[5];
1362 * Log incoming packet, possibly omitting sensitive fields.
1366 struct logblank_t blank;
1367 if (ssh->cfg.logomitdata) {
1368 int do_blank = FALSE, blank_prefix = 0;
1369 /* "Session data" packets - omit the data field */
1370 if (st->pktin->type == SSH2_MSG_CHANNEL_DATA) {
1371 do_blank = TRUE; blank_prefix = 4;
1372 } else if (st->pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA) {
1373 do_blank = TRUE; blank_prefix = 8;
1376 blank.offset = blank_prefix;
1377 blank.len = (st->pktin->length-6) - blank_prefix;
1378 blank.type = PKTLOG_OMIT;
1382 log_packet(ssh->logctx, PKT_INCOMING, st->pktin->type,
1383 ssh2_pkt_type(ssh->pkt_ctx, st->pktin->type),
1384 st->pktin->data+6, st->pktin->length-6,
1388 crFinish(st->pktin);
1391 static int s_wrpkt_prepare(Ssh ssh, struct Packet *pkt, int *offset_p)
1393 int pad, biglen, i, pktoffs;
1397 * XXX various versions of SC (including 8.8.4) screw up the
1398 * register allocation in this function and use the same register
1399 * (D6) for len and as a temporary, with predictable results. The
1400 * following sledgehammer prevents this.
1407 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[12],
1408 ssh1_pkt_type(pkt->data[12]),
1409 pkt->body, pkt->length - (pkt->body - pkt->data),
1410 pkt->nblanks, pkt->blanks);
1411 sfree(pkt->blanks); pkt->blanks = NULL;
1414 if (ssh->v1_compressing) {
1415 unsigned char *compblk;
1417 zlib_compress_block(ssh->cs_comp_ctx,
1418 pkt->data + 12, pkt->length - 12,
1419 &compblk, &complen);
1420 memcpy(pkt->data + 12, compblk, complen);
1422 pkt->length = complen + 12;
1425 ssh_pkt_ensure(pkt, pkt->length + 4); /* space for CRC */
1427 len = pkt->length - 4 - 8; /* len(type+data+CRC) */
1428 pad = 8 - (len % 8);
1430 biglen = len + pad; /* len(padding+type+data+CRC) */
1432 for (i = pktoffs; i < 4+8; i++)
1433 pkt->data[i] = random_byte();
1434 crc = crc32_compute(pkt->data + pktoffs + 4, biglen - 4); /* all ex len */
1435 PUT_32BIT(pkt->data + pktoffs + 4 + biglen - 4, crc);
1436 PUT_32BIT(pkt->data + pktoffs, len);
1439 ssh->cipher->encrypt(ssh->v1_cipher_ctx,
1440 pkt->data + pktoffs + 4, biglen);
1442 if (offset_p) *offset_p = pktoffs;
1443 return biglen + 4; /* len(length+padding+type+data+CRC) */
1446 static int s_write(Ssh ssh, void *data, int len)
1448 log_packet(ssh->logctx, PKT_OUTGOING, -1, NULL, data, len, 0, NULL);
1449 return sk_write(ssh->s, (char *)data, len);
1452 static void s_wrpkt(Ssh ssh, struct Packet *pkt)
1454 int len, backlog, offset;
1455 len = s_wrpkt_prepare(ssh, pkt, &offset);
1456 backlog = s_write(ssh, pkt->data + offset, len);
1457 if (backlog > SSH_MAX_BACKLOG)
1458 ssh_throttle_all(ssh, 1, backlog);
1459 ssh_free_packet(pkt);
1462 static void s_wrpkt_defer(Ssh ssh, struct Packet *pkt)
1465 len = s_wrpkt_prepare(ssh, pkt, &offset);
1466 if (ssh->deferred_len + len > ssh->deferred_size) {
1467 ssh->deferred_size = ssh->deferred_len + len + 128;
1468 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
1472 memcpy(ssh->deferred_send_data + ssh->deferred_len,
1473 pkt->data + offset, len);
1474 ssh->deferred_len += len;
1475 ssh_free_packet(pkt);
1479 * Construct a SSH-1 packet with the specified contents.
1480 * (This all-at-once interface used to be the only one, but now SSH-1
1481 * packets can also be constructed incrementally.)
1483 static struct Packet *construct_packet(Ssh ssh, int pkttype, va_list ap)
1489 pkt = ssh1_pkt_init(pkttype);
1491 while ((argtype = va_arg(ap, int)) != PKT_END) {
1492 unsigned char *argp, argchar;
1494 unsigned long argint;
1497 /* Actual fields in the packet */
1499 argint = va_arg(ap, int);
1500 ssh_pkt_adduint32(pkt, argint);
1503 argchar = (unsigned char) va_arg(ap, int);
1504 ssh_pkt_addbyte(pkt, argchar);
1507 argp = va_arg(ap, unsigned char *);
1508 arglen = va_arg(ap, int);
1509 ssh_pkt_adddata(pkt, argp, arglen);
1512 sargp = va_arg(ap, char *);
1513 ssh_pkt_addstring(pkt, sargp);
1516 bn = va_arg(ap, Bignum);
1517 ssh1_pkt_addmp(pkt, bn);
1519 /* Tokens for modifications to packet logging */
1521 dont_log_password(ssh, pkt, PKTLOG_BLANK);
1524 dont_log_data(ssh, pkt, PKTLOG_OMIT);
1527 end_log_omission(ssh, pkt);
1535 static void send_packet(Ssh ssh, int pkttype, ...)
1539 va_start(ap, pkttype);
1540 pkt = construct_packet(ssh, pkttype, ap);
1545 static void defer_packet(Ssh ssh, int pkttype, ...)
1549 va_start(ap, pkttype);
1550 pkt = construct_packet(ssh, pkttype, ap);
1552 s_wrpkt_defer(ssh, pkt);
1555 static int ssh_versioncmp(char *a, char *b)
1558 unsigned long av, bv;
1560 av = strtoul(a, &ae, 10);
1561 bv = strtoul(b, &be, 10);
1563 return (av < bv ? -1 : +1);
1568 av = strtoul(ae, &ae, 10);
1569 bv = strtoul(be, &be, 10);
1571 return (av < bv ? -1 : +1);
1576 * Utility routines for putting an SSH-protocol `string' and
1577 * `uint32' into a hash state.
1579 static void hash_string(const struct ssh_hash *h, void *s, void *str, int len)
1581 unsigned char lenblk[4];
1582 PUT_32BIT(lenblk, len);
1583 h->bytes(s, lenblk, 4);
1584 h->bytes(s, str, len);
1587 static void hash_uint32(const struct ssh_hash *h, void *s, unsigned i)
1589 unsigned char intblk[4];
1590 PUT_32BIT(intblk, i);
1591 h->bytes(s, intblk, 4);
1595 * Packet construction functions. Mostly shared between SSH-1 and SSH-2.
1597 static void ssh_pkt_ensure(struct Packet *pkt, int length)
1599 if (pkt->maxlen < length) {
1600 unsigned char *body = pkt->body;
1601 int offset = body ? body - pkt->data : 0;
1602 pkt->maxlen = length + 256;
1603 pkt->data = sresize(pkt->data, pkt->maxlen + APIEXTRA, unsigned char);
1604 if (body) pkt->body = pkt->data + offset;
1607 static void ssh_pkt_adddata(struct Packet *pkt, void *data, int len)
1609 if (pkt->logmode != PKTLOG_EMIT) {
1611 pkt->blanks = sresize(pkt->blanks, pkt->nblanks, struct logblank_t);
1613 pkt->blanks[pkt->nblanks-1].offset = pkt->length -
1614 (pkt->body - pkt->data);
1615 pkt->blanks[pkt->nblanks-1].len = len;
1616 pkt->blanks[pkt->nblanks-1].type = pkt->logmode;
1619 ssh_pkt_ensure(pkt, pkt->length);
1620 memcpy(pkt->data + pkt->length - len, data, len);
1622 static void ssh_pkt_addbyte(struct Packet *pkt, unsigned char byte)
1624 ssh_pkt_adddata(pkt, &byte, 1);
1626 static void ssh2_pkt_addbool(struct Packet *pkt, unsigned char value)
1628 ssh_pkt_adddata(pkt, &value, 1);
1630 static void ssh_pkt_adduint32(struct Packet *pkt, unsigned long value)
1633 PUT_32BIT(x, value);
1634 ssh_pkt_adddata(pkt, x, 4);
1636 static void ssh_pkt_addstring_start(struct Packet *pkt)
1638 ssh_pkt_adduint32(pkt, 0);
1639 pkt->savedpos = pkt->length;
1641 static void ssh_pkt_addstring_str(struct Packet *pkt, char *data)
1643 ssh_pkt_adddata(pkt, data, strlen(data));
1644 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
1646 static void ssh_pkt_addstring_data(struct Packet *pkt, char *data, int len)
1648 ssh_pkt_adddata(pkt, data, len);
1649 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
1651 static void ssh_pkt_addstring(struct Packet *pkt, char *data)
1653 ssh_pkt_addstring_start(pkt);
1654 ssh_pkt_addstring_str(pkt, data);
1656 static void ssh1_pkt_addmp(struct Packet *pkt, Bignum b)
1658 int len = ssh1_bignum_length(b);
1659 unsigned char *data = snewn(len, unsigned char);
1660 (void) ssh1_write_bignum(data, b);
1661 ssh_pkt_adddata(pkt, data, len);
1664 static unsigned char *ssh2_mpint_fmt(Bignum b, int *len)
1667 int i, n = (bignum_bitcount(b) + 7) / 8;
1668 p = snewn(n + 1, unsigned char);
1670 for (i = 1; i <= n; i++)
1671 p[i] = bignum_byte(b, n - i);
1673 while (i <= n && p[i] == 0 && (p[i + 1] & 0x80) == 0)
1675 memmove(p, p + i, n + 1 - i);
1679 static void ssh2_pkt_addmp(struct Packet *pkt, Bignum b)
1683 p = ssh2_mpint_fmt(b, &len);
1684 ssh_pkt_addstring_start(pkt);
1685 ssh_pkt_addstring_data(pkt, (char *)p, len);
1689 static struct Packet *ssh1_pkt_init(int pkt_type)
1691 struct Packet *pkt = ssh_new_packet();
1692 pkt->length = 4 + 8; /* space for length + max padding */
1693 ssh_pkt_addbyte(pkt, pkt_type);
1694 pkt->body = pkt->data + pkt->length;
1698 /* For legacy code (SSH-1 and -2 packet construction used to be separate) */
1699 #define ssh2_pkt_ensure(pkt, length) ssh_pkt_ensure(pkt, length)
1700 #define ssh2_pkt_adddata(pkt, data, len) ssh_pkt_adddata(pkt, data, len)
1701 #define ssh2_pkt_addbyte(pkt, byte) ssh_pkt_addbyte(pkt, byte)
1702 #define ssh2_pkt_adduint32(pkt, value) ssh_pkt_adduint32(pkt, value)
1703 #define ssh2_pkt_addstring_start(pkt) ssh_pkt_addstring_start(pkt)
1704 #define ssh2_pkt_addstring_str(pkt, data) ssh_pkt_addstring_str(pkt, data)
1705 #define ssh2_pkt_addstring_data(pkt, data, len) ssh_pkt_addstring_data(pkt, data, len)
1706 #define ssh2_pkt_addstring(pkt, data) ssh_pkt_addstring(pkt, data)
1708 static struct Packet *ssh2_pkt_init(int pkt_type)
1710 struct Packet *pkt = ssh_new_packet();
1711 pkt->length = 5; /* space for packet length + padding length */
1713 ssh_pkt_addbyte(pkt, (unsigned char) pkt_type);
1714 pkt->body = pkt->data + pkt->length; /* after packet type */
1719 * Construct an SSH-2 final-form packet: compress it, encrypt it,
1720 * put the MAC on it. Final packet, ready to be sent, is stored in
1721 * pkt->data. Total length is returned.
1723 static int ssh2_pkt_construct(Ssh ssh, struct Packet *pkt)
1725 int cipherblk, maclen, padding, i;
1728 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[5],
1729 ssh2_pkt_type(ssh->pkt_ctx, pkt->data[5]),
1730 pkt->body, pkt->length - (pkt->body - pkt->data),
1731 pkt->nblanks, pkt->blanks);
1732 sfree(pkt->blanks); pkt->blanks = NULL;
1736 * Compress packet payload.
1739 unsigned char *newpayload;
1742 ssh->cscomp->compress(ssh->cs_comp_ctx, pkt->data + 5,
1744 &newpayload, &newlen)) {
1746 ssh2_pkt_adddata(pkt, newpayload, newlen);
1752 * Add padding. At least four bytes, and must also bring total
1753 * length (minus MAC) up to a multiple of the block size.
1754 * If pkt->forcepad is set, make sure the packet is at least that size
1757 cipherblk = ssh->cscipher ? ssh->cscipher->blksize : 8; /* block size */
1758 cipherblk = cipherblk < 8 ? 8 : cipherblk; /* or 8 if blksize < 8 */
1760 if (pkt->length + padding < pkt->forcepad)
1761 padding = pkt->forcepad - pkt->length;
1763 (cipherblk - (pkt->length + padding) % cipherblk) % cipherblk;
1764 assert(padding <= 255);
1765 maclen = ssh->csmac ? ssh->csmac->len : 0;
1766 ssh2_pkt_ensure(pkt, pkt->length + padding + maclen);
1767 pkt->data[4] = padding;
1768 for (i = 0; i < padding; i++)
1769 pkt->data[pkt->length + i] = random_byte();
1770 PUT_32BIT(pkt->data, pkt->length + padding - 4);
1772 ssh->csmac->generate(ssh->cs_mac_ctx, pkt->data,
1773 pkt->length + padding,
1774 ssh->v2_outgoing_sequence);
1775 ssh->v2_outgoing_sequence++; /* whether or not we MACed */
1778 ssh->cscipher->encrypt(ssh->cs_cipher_ctx,
1779 pkt->data, pkt->length + padding);
1781 pkt->encrypted_len = pkt->length + padding;
1783 /* Ready-to-send packet starts at pkt->data. We return length. */
1784 return pkt->length + padding + maclen;
1788 * Routines called from the main SSH code to send packets. There
1789 * are quite a few of these, because we have two separate
1790 * mechanisms for delaying the sending of packets:
1792 * - In order to send an IGNORE message and a password message in
1793 * a single fixed-length blob, we require the ability to
1794 * concatenate the encrypted forms of those two packets _into_ a
1795 * single blob and then pass it to our <network.h> transport
1796 * layer in one go. Hence, there's a deferment mechanism which
1797 * works after packet encryption.
1799 * - In order to avoid sending any connection-layer messages
1800 * during repeat key exchange, we have to queue up any such
1801 * outgoing messages _before_ they are encrypted (and in
1802 * particular before they're allocated sequence numbers), and
1803 * then send them once we've finished.
1805 * I call these mechanisms `defer' and `queue' respectively, so as
1806 * to distinguish them reasonably easily.
1808 * The functions send_noqueue() and defer_noqueue() free the packet
1809 * structure they are passed. Every outgoing packet goes through
1810 * precisely one of these functions in its life; packets passed to
1811 * ssh2_pkt_send() or ssh2_pkt_defer() either go straight to one of
1812 * these or get queued, and then when the queue is later emptied
1813 * the packets are all passed to defer_noqueue().
1815 * When using a CBC-mode cipher, it's necessary to ensure that an
1816 * attacker can't provide data to be encrypted using an IV that they
1817 * know. We ensure this by prefixing each packet that might contain
1818 * user data with an SSH_MSG_IGNORE. This is done using the deferral
1819 * mechanism, so in this case send_noqueue() ends up redirecting to
1820 * defer_noqueue(). If you don't like this inefficiency, don't use
1824 static void ssh2_pkt_defer_noqueue(Ssh, struct Packet *, int);
1825 static void ssh_pkt_defersend(Ssh);
1828 * Send an SSH-2 packet immediately, without queuing or deferring.
1830 static void ssh2_pkt_send_noqueue(Ssh ssh, struct Packet *pkt)
1834 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC)) {
1835 /* We need to send two packets, so use the deferral mechanism. */
1836 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
1837 ssh_pkt_defersend(ssh);
1840 len = ssh2_pkt_construct(ssh, pkt);
1841 backlog = s_write(ssh, pkt->data, len);
1842 if (backlog > SSH_MAX_BACKLOG)
1843 ssh_throttle_all(ssh, 1, backlog);
1845 ssh->outgoing_data_size += pkt->encrypted_len;
1846 if (!ssh->kex_in_progress &&
1847 ssh->max_data_size != 0 &&
1848 ssh->outgoing_data_size > ssh->max_data_size)
1849 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
1851 ssh_free_packet(pkt);
1855 * Defer an SSH-2 packet.
1857 static void ssh2_pkt_defer_noqueue(Ssh ssh, struct Packet *pkt, int noignore)
1860 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC) &&
1861 ssh->deferred_len == 0 && !noignore) {
1863 * Interpose an SSH_MSG_IGNORE to ensure that user data don't
1864 * get encrypted with a known IV.
1866 struct Packet *ipkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
1867 ssh2_pkt_addstring_start(ipkt);
1868 ssh2_pkt_defer_noqueue(ssh, ipkt, TRUE);
1870 len = ssh2_pkt_construct(ssh, pkt);
1871 if (ssh->deferred_len + len > ssh->deferred_size) {
1872 ssh->deferred_size = ssh->deferred_len + len + 128;
1873 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
1877 memcpy(ssh->deferred_send_data + ssh->deferred_len, pkt->data, len);
1878 ssh->deferred_len += len;
1879 ssh->deferred_data_size += pkt->encrypted_len;
1880 ssh_free_packet(pkt);
1884 * Queue an SSH-2 packet.
1886 static void ssh2_pkt_queue(Ssh ssh, struct Packet *pkt)
1888 assert(ssh->queueing);
1890 if (ssh->queuelen >= ssh->queuesize) {
1891 ssh->queuesize = ssh->queuelen + 32;
1892 ssh->queue = sresize(ssh->queue, ssh->queuesize, struct Packet *);
1895 ssh->queue[ssh->queuelen++] = pkt;
1899 * Either queue or send a packet, depending on whether queueing is
1902 static void ssh2_pkt_send(Ssh ssh, struct Packet *pkt)
1905 ssh2_pkt_queue(ssh, pkt);
1907 ssh2_pkt_send_noqueue(ssh, pkt);
1911 * Either queue or defer a packet, depending on whether queueing is
1914 static void ssh2_pkt_defer(Ssh ssh, struct Packet *pkt)
1917 ssh2_pkt_queue(ssh, pkt);
1919 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
1923 * Send the whole deferred data block constructed by
1924 * ssh2_pkt_defer() or SSH-1's defer_packet().
1926 * The expected use of the defer mechanism is that you call
1927 * ssh2_pkt_defer() a few times, then call ssh_pkt_defersend(). If
1928 * not currently queueing, this simply sets up deferred_send_data
1929 * and then sends it. If we _are_ currently queueing, the calls to
1930 * ssh2_pkt_defer() put the deferred packets on to the queue
1931 * instead, and therefore ssh_pkt_defersend() has no deferred data
1932 * to send. Hence, there's no need to make it conditional on
1935 static void ssh_pkt_defersend(Ssh ssh)
1938 backlog = s_write(ssh, ssh->deferred_send_data, ssh->deferred_len);
1939 ssh->deferred_len = ssh->deferred_size = 0;
1940 sfree(ssh->deferred_send_data);
1941 ssh->deferred_send_data = NULL;
1942 if (backlog > SSH_MAX_BACKLOG)
1943 ssh_throttle_all(ssh, 1, backlog);
1945 ssh->outgoing_data_size += ssh->deferred_data_size;
1946 if (!ssh->kex_in_progress &&
1947 ssh->max_data_size != 0 &&
1948 ssh->outgoing_data_size > ssh->max_data_size)
1949 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
1950 ssh->deferred_data_size = 0;
1954 * Send a packet whose length needs to be disguised (typically
1955 * passwords or keyboard-interactive responses).
1957 static void ssh2_pkt_send_with_padding(Ssh ssh, struct Packet *pkt,
1963 * The simplest way to do this is to adjust the
1964 * variable-length padding field in the outgoing packet.
1966 * Currently compiled out, because some Cisco SSH servers
1967 * don't like excessively padded packets (bah, why's it
1970 pkt->forcepad = padsize;
1971 ssh2_pkt_send(ssh, pkt);
1976 * If we can't do that, however, an alternative approach is
1977 * to use the pkt_defer mechanism to bundle the packet
1978 * tightly together with an SSH_MSG_IGNORE such that their
1979 * combined length is a constant. So first we construct the
1980 * final form of this packet and defer its sending.
1982 ssh2_pkt_defer(ssh, pkt);
1985 * Now construct an SSH_MSG_IGNORE which includes a string
1986 * that's an exact multiple of the cipher block size. (If
1987 * the cipher is NULL so that the block size is
1988 * unavailable, we don't do this trick at all, because we
1989 * gain nothing by it.)
1991 if (ssh->cscipher) {
1994 stringlen = (256 - ssh->deferred_len);
1995 stringlen += ssh->cscipher->blksize - 1;
1996 stringlen -= (stringlen % ssh->cscipher->blksize);
1999 * Temporarily disable actual compression, so we
2000 * can guarantee to get this string exactly the
2001 * length we want it. The compression-disabling
2002 * routine should return an integer indicating how
2003 * many bytes we should adjust our string length
2007 ssh->cscomp->disable_compression(ssh->cs_comp_ctx);
2009 pkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
2010 ssh2_pkt_addstring_start(pkt);
2011 for (i = 0; i < stringlen; i++) {
2012 char c = (char) random_byte();
2013 ssh2_pkt_addstring_data(pkt, &c, 1);
2015 ssh2_pkt_defer(ssh, pkt);
2017 ssh_pkt_defersend(ssh);
2022 * Send all queued SSH-2 packets. We send them by means of
2023 * ssh2_pkt_defer_noqueue(), in case they included a pair of
2024 * packets that needed to be lumped together.
2026 static void ssh2_pkt_queuesend(Ssh ssh)
2030 assert(!ssh->queueing);
2032 for (i = 0; i < ssh->queuelen; i++)
2033 ssh2_pkt_defer_noqueue(ssh, ssh->queue[i], FALSE);
2036 ssh_pkt_defersend(ssh);
2040 void bndebug(char *string, Bignum b)
2044 p = ssh2_mpint_fmt(b, &len);
2045 debug(("%s", string));
2046 for (i = 0; i < len; i++)
2047 debug((" %02x", p[i]));
2053 static void hash_mpint(const struct ssh_hash *h, void *s, Bignum b)
2057 p = ssh2_mpint_fmt(b, &len);
2058 hash_string(h, s, p, len);
2063 * Packet decode functions for both SSH-1 and SSH-2.
2065 static unsigned long ssh_pkt_getuint32(struct Packet *pkt)
2067 unsigned long value;
2068 if (pkt->length - pkt->savedpos < 4)
2069 return 0; /* arrgh, no way to decline (FIXME?) */
2070 value = GET_32BIT(pkt->body + pkt->savedpos);
2074 static int ssh2_pkt_getbool(struct Packet *pkt)
2076 unsigned long value;
2077 if (pkt->length - pkt->savedpos < 1)
2078 return 0; /* arrgh, no way to decline (FIXME?) */
2079 value = pkt->body[pkt->savedpos] != 0;
2083 static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length)
2088 if (pkt->length - pkt->savedpos < 4)
2090 len = GET_32BIT(pkt->body + pkt->savedpos);
2095 if (pkt->length - pkt->savedpos < *length)
2097 *p = (char *)(pkt->body + pkt->savedpos);
2098 pkt->savedpos += *length;
2100 static void *ssh_pkt_getdata(struct Packet *pkt, int length)
2102 if (pkt->length - pkt->savedpos < length)
2104 pkt->savedpos += length;
2105 return pkt->body + (pkt->savedpos - length);
2107 static int ssh1_pkt_getrsakey(struct Packet *pkt, struct RSAKey *key,
2108 unsigned char **keystr)
2112 j = makekey(pkt->body + pkt->savedpos,
2113 pkt->length - pkt->savedpos,
2120 assert(pkt->savedpos < pkt->length);
2124 static Bignum ssh1_pkt_getmp(struct Packet *pkt)
2129 j = ssh1_read_bignum(pkt->body + pkt->savedpos,
2130 pkt->length - pkt->savedpos, &b);
2138 static Bignum ssh2_pkt_getmp(struct Packet *pkt)
2144 ssh_pkt_getstring(pkt, &p, &length);
2149 b = bignum_from_bytes((unsigned char *)p, length);
2154 * Helper function to add an SSH-2 signature blob to a packet.
2155 * Expects to be shown the public key blob as well as the signature
2156 * blob. Normally works just like ssh2_pkt_addstring, but will
2157 * fiddle with the signature packet if necessary for
2158 * BUG_SSH2_RSA_PADDING.
2160 static void ssh2_add_sigblob(Ssh ssh, struct Packet *pkt,
2161 void *pkblob_v, int pkblob_len,
2162 void *sigblob_v, int sigblob_len)
2164 unsigned char *pkblob = (unsigned char *)pkblob_v;
2165 unsigned char *sigblob = (unsigned char *)sigblob_v;
2167 /* dmemdump(pkblob, pkblob_len); */
2168 /* dmemdump(sigblob, sigblob_len); */
2171 * See if this is in fact an ssh-rsa signature and a buggy
2172 * server; otherwise we can just do this the easy way.
2174 if ((ssh->remote_bugs & BUG_SSH2_RSA_PADDING) &&
2175 (GET_32BIT(pkblob) == 7 && !memcmp(pkblob+4, "ssh-rsa", 7))) {
2176 int pos, len, siglen;
2179 * Find the byte length of the modulus.
2182 pos = 4+7; /* skip over "ssh-rsa" */
2183 pos += 4 + GET_32BIT(pkblob+pos); /* skip over exponent */
2184 len = GET_32BIT(pkblob+pos); /* find length of modulus */
2185 pos += 4; /* find modulus itself */
2186 while (len > 0 && pkblob[pos] == 0)
2188 /* debug(("modulus length is %d\n", len)); */
2191 * Now find the signature integer.
2193 pos = 4+7; /* skip over "ssh-rsa" */
2194 siglen = GET_32BIT(sigblob+pos);
2195 /* debug(("signature length is %d\n", siglen)); */
2197 if (len != siglen) {
2198 unsigned char newlen[4];
2199 ssh2_pkt_addstring_start(pkt);
2200 ssh2_pkt_addstring_data(pkt, (char *)sigblob, pos);
2201 /* dmemdump(sigblob, pos); */
2202 pos += 4; /* point to start of actual sig */
2203 PUT_32BIT(newlen, len);
2204 ssh2_pkt_addstring_data(pkt, (char *)newlen, 4);
2205 /* dmemdump(newlen, 4); */
2207 while (len-- > siglen) {
2208 ssh2_pkt_addstring_data(pkt, (char *)newlen, 1);
2209 /* dmemdump(newlen, 1); */
2211 ssh2_pkt_addstring_data(pkt, (char *)(sigblob+pos), siglen);
2212 /* dmemdump(sigblob+pos, siglen); */
2216 /* Otherwise fall through and do it the easy way. */
2219 ssh2_pkt_addstring_start(pkt);
2220 ssh2_pkt_addstring_data(pkt, (char *)sigblob, sigblob_len);
2224 * Examine the remote side's version string and compare it against
2225 * a list of known buggy implementations.
2227 static void ssh_detect_bugs(Ssh ssh, char *vstring)
2229 char *imp; /* pointer to implementation part */
2231 imp += strcspn(imp, "-");
2233 imp += strcspn(imp, "-");
2236 ssh->remote_bugs = 0;
2239 * General notes on server version strings:
2240 * - Not all servers reporting "Cisco-1.25" have all the bugs listed
2241 * here -- in particular, we've heard of one that's perfectly happy
2242 * with SSH1_MSG_IGNOREs -- but this string never seems to change,
2243 * so we can't distinguish them.
2245 if (ssh->cfg.sshbug_ignore1 == FORCE_ON ||
2246 (ssh->cfg.sshbug_ignore1 == AUTO &&
2247 (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
2248 !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
2249 !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25") ||
2250 !strcmp(imp, "OSU_1.4alpha3") || !strcmp(imp, "OSU_1.5alpha4")))) {
2252 * These versions don't support SSH1_MSG_IGNORE, so we have
2253 * to use a different defence against password length
2256 ssh->remote_bugs |= BUG_CHOKES_ON_SSH1_IGNORE;
2257 logevent("We believe remote version has SSH-1 ignore bug");
2260 if (ssh->cfg.sshbug_plainpw1 == FORCE_ON ||
2261 (ssh->cfg.sshbug_plainpw1 == AUTO &&
2262 (!strcmp(imp, "Cisco-1.25") || !strcmp(imp, "OSU_1.4alpha3")))) {
2264 * These versions need a plain password sent; they can't
2265 * handle having a null and a random length of data after
2268 ssh->remote_bugs |= BUG_NEEDS_SSH1_PLAIN_PASSWORD;
2269 logevent("We believe remote version needs a plain SSH-1 password");
2272 if (ssh->cfg.sshbug_rsa1 == FORCE_ON ||
2273 (ssh->cfg.sshbug_rsa1 == AUTO &&
2274 (!strcmp(imp, "Cisco-1.25")))) {
2276 * These versions apparently have no clue whatever about
2277 * RSA authentication and will panic and die if they see
2278 * an AUTH_RSA message.
2280 ssh->remote_bugs |= BUG_CHOKES_ON_RSA;
2281 logevent("We believe remote version can't handle SSH-1 RSA authentication");
2284 if (ssh->cfg.sshbug_hmac2 == FORCE_ON ||
2285 (ssh->cfg.sshbug_hmac2 == AUTO &&
2286 !wc_match("* VShell", imp) &&
2287 (wc_match("2.1.0*", imp) || wc_match("2.0.*", imp) ||
2288 wc_match("2.2.0*", imp) || wc_match("2.3.0*", imp) ||
2289 wc_match("2.1 *", imp)))) {
2291 * These versions have the HMAC bug.
2293 ssh->remote_bugs |= BUG_SSH2_HMAC;
2294 logevent("We believe remote version has SSH-2 HMAC bug");
2297 if (ssh->cfg.sshbug_derivekey2 == FORCE_ON ||
2298 (ssh->cfg.sshbug_derivekey2 == AUTO &&
2299 !wc_match("* VShell", imp) &&
2300 (wc_match("2.0.0*", imp) || wc_match("2.0.10*", imp) ))) {
2302 * These versions have the key-derivation bug (failing to
2303 * include the literal shared secret in the hashes that
2304 * generate the keys).
2306 ssh->remote_bugs |= BUG_SSH2_DERIVEKEY;
2307 logevent("We believe remote version has SSH-2 key-derivation bug");
2310 if (ssh->cfg.sshbug_rsapad2 == FORCE_ON ||
2311 (ssh->cfg.sshbug_rsapad2 == AUTO &&
2312 (wc_match("OpenSSH_2.[5-9]*", imp) ||
2313 wc_match("OpenSSH_3.[0-2]*", imp)))) {
2315 * These versions have the SSH-2 RSA padding bug.
2317 ssh->remote_bugs |= BUG_SSH2_RSA_PADDING;
2318 logevent("We believe remote version has SSH-2 RSA padding bug");
2321 if (ssh->cfg.sshbug_pksessid2 == FORCE_ON ||
2322 (ssh->cfg.sshbug_pksessid2 == AUTO &&
2323 wc_match("OpenSSH_2.[0-2]*", imp))) {
2325 * These versions have the SSH-2 session-ID bug in
2326 * public-key authentication.
2328 ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID;
2329 logevent("We believe remote version has SSH-2 public-key-session-ID bug");
2332 if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
2333 (ssh->cfg.sshbug_rekey2 == AUTO &&
2334 (wc_match("DigiSSH_2.0", imp) ||
2335 wc_match("OpenSSH_2.[0-4]*", imp) ||
2336 wc_match("OpenSSH_2.5.[0-3]*", imp) ||
2337 wc_match("Sun_SSH_1.0", imp) ||
2338 wc_match("Sun_SSH_1.0.1", imp) ||
2339 /* All versions <= 1.2.6 (they changed their format in 1.2.7) */
2340 wc_match("WeOnlyDo-*", imp)))) {
2342 * These versions have the SSH-2 rekey bug.
2344 ssh->remote_bugs |= BUG_SSH2_REKEY;
2345 logevent("We believe remote version has SSH-2 rekey bug");
2350 * The `software version' part of an SSH version string is required
2351 * to contain no spaces or minus signs.
2353 static void ssh_fix_verstring(char *str)
2355 /* Eat "SSH-<protoversion>-". */
2356 assert(*str == 'S'); str++;
2357 assert(*str == 'S'); str++;
2358 assert(*str == 'H'); str++;
2359 assert(*str == '-'); str++;
2360 while (*str && *str != '-') str++;
2361 assert(*str == '-'); str++;
2363 /* Convert minus signs and spaces in the remaining string into
2366 if (*str == '-' || *str == ' ')
2372 static int do_ssh_init(Ssh ssh, unsigned char c)
2374 struct do_ssh_init_state {
2382 crState(do_ssh_init_state);
2384 crBegin(ssh->do_ssh_init_crstate);
2386 /* Search for a line beginning with the string "SSH-" in the input. */
2388 if (c != 'S') goto no;
2390 if (c != 'S') goto no;
2392 if (c != 'H') goto no;
2394 if (c != '-') goto no;
2403 s->vstring = snewn(s->vstrsize, char);
2404 strcpy(s->vstring, "SSH-");
2408 crReturn(1); /* get another char */
2409 if (s->vslen >= s->vstrsize - 1) {
2411 s->vstring = sresize(s->vstring, s->vstrsize, char);
2413 s->vstring[s->vslen++] = c;
2416 s->version[s->i] = '\0';
2418 } else if (s->i < sizeof(s->version) - 1)
2419 s->version[s->i++] = c;
2420 } else if (c == '\012')
2424 ssh->agentfwd_enabled = FALSE;
2425 ssh->rdpkt2_state.incoming_sequence = 0;
2427 s->vstring[s->vslen] = 0;
2428 s->vstring[strcspn(s->vstring, "\015\012")] = '\0';/* remove EOL chars */
2429 logeventf(ssh, "Server version: %s", s->vstring);
2430 ssh_detect_bugs(ssh, s->vstring);
2433 * Decide which SSH protocol version to support.
2436 /* Anything strictly below "2.0" means protocol 1 is supported. */
2437 s->proto1 = ssh_versioncmp(s->version, "2.0") < 0;
2438 /* Anything greater or equal to "1.99" means protocol 2 is supported. */
2439 s->proto2 = ssh_versioncmp(s->version, "1.99") >= 0;
2441 if (ssh->cfg.sshprot == 0 && !s->proto1) {
2442 bombout(("SSH protocol version 1 required by user but not provided by server"));
2445 if (ssh->cfg.sshprot == 3 && !s->proto2) {
2446 bombout(("SSH protocol version 2 required by user but not provided by server"));
2453 if (s->proto2 && (ssh->cfg.sshprot >= 2 || !s->proto1)) {
2455 * Construct a v2 version string.
2457 verstring = dupprintf("SSH-2.0-%s\015\012", sshver);
2461 * Construct a v1 version string.
2463 verstring = dupprintf("SSH-%s-%s\012",
2464 (ssh_versioncmp(s->version, "1.5") <= 0 ?
2465 s->version : "1.5"),
2470 ssh_fix_verstring(verstring);
2472 if (ssh->version == 2) {
2475 * Hash our version string and their version string.
2477 len = strcspn(verstring, "\015\012");
2478 ssh->v_c = snewn(len + 1, char);
2479 memcpy(ssh->v_c, verstring, len);
2481 len = strcspn(s->vstring, "\015\012");
2482 ssh->v_s = snewn(len + 1, char);
2483 memcpy(ssh->v_s, s->vstring, len);
2487 * Initialise SSH-2 protocol.
2489 ssh->protocol = ssh2_protocol;
2490 ssh2_protocol_setup(ssh);
2491 ssh->s_rdpkt = ssh2_rdpkt;
2494 * Initialise SSH-1 protocol.
2496 ssh->protocol = ssh1_protocol;
2497 ssh1_protocol_setup(ssh);
2498 ssh->s_rdpkt = ssh1_rdpkt;
2500 logeventf(ssh, "We claim version: %.*s",
2501 strcspn(verstring, "\015\012"), verstring);
2502 s_write(ssh, verstring, strlen(verstring));
2504 if (ssh->version == 2)
2505 do_ssh2_transport(ssh, NULL, -1, NULL);
2508 logeventf(ssh, "Using SSH protocol version %d", ssh->version);
2510 update_specials_menu(ssh->frontend);
2511 ssh->state = SSH_STATE_BEFORE_SIZE;
2512 ssh->pinger = pinger_new(&ssh->cfg, &ssh_backend, ssh);
2519 static void ssh_process_incoming_data(Ssh ssh,
2520 unsigned char **data, int *datalen)
2522 struct Packet *pktin;
2524 pktin = ssh->s_rdpkt(ssh, data, datalen);
2526 ssh->protocol(ssh, NULL, 0, pktin);
2527 ssh_free_packet(pktin);
2531 static void ssh_queue_incoming_data(Ssh ssh,
2532 unsigned char **data, int *datalen)
2534 bufchain_add(&ssh->queued_incoming_data, *data, *datalen);
2539 static void ssh_process_queued_incoming_data(Ssh ssh)
2542 unsigned char *data;
2545 while (!ssh->frozen && bufchain_size(&ssh->queued_incoming_data)) {
2546 bufchain_prefix(&ssh->queued_incoming_data, &vdata, &len);
2550 while (!ssh->frozen && len > 0)
2551 ssh_process_incoming_data(ssh, &data, &len);
2554 bufchain_consume(&ssh->queued_incoming_data, origlen - len);
2558 static void ssh_set_frozen(Ssh ssh, int frozen)
2561 sk_set_frozen(ssh->s, frozen);
2562 ssh->frozen = frozen;
2565 static void ssh_gotdata(Ssh ssh, unsigned char *data, int datalen)
2567 /* Log raw data, if we're in that mode. */
2568 log_packet(ssh->logctx, PKT_INCOMING, -1, NULL, data, datalen, 0, NULL);
2570 crBegin(ssh->ssh_gotdata_crstate);
2573 * To begin with, feed the characters one by one to the
2574 * protocol initialisation / selection function do_ssh_init().
2575 * When that returns 0, we're done with the initial greeting
2576 * exchange and can move on to packet discipline.
2579 int ret; /* need not be kept across crReturn */
2581 crReturnV; /* more data please */
2582 ret = do_ssh_init(ssh, *data);
2590 * We emerge from that loop when the initial negotiation is
2591 * over and we have selected an s_rdpkt function. Now pass
2592 * everything to s_rdpkt, and then pass the resulting packets
2593 * to the proper protocol handler.
2597 while (bufchain_size(&ssh->queued_incoming_data) > 0 || datalen > 0) {
2599 ssh_queue_incoming_data(ssh, &data, &datalen);
2600 /* This uses up all data and cannot cause anything interesting
2601 * to happen; indeed, for anything to happen at all, we must
2602 * return, so break out. */
2604 } else if (bufchain_size(&ssh->queued_incoming_data) > 0) {
2605 /* This uses up some or all data, and may freeze the
2607 ssh_process_queued_incoming_data(ssh);
2609 /* This uses up some or all data, and may freeze the
2611 ssh_process_incoming_data(ssh, &data, &datalen);
2613 /* FIXME this is probably EBW. */
2614 if (ssh->state == SSH_STATE_CLOSED)
2617 /* We're out of data. Go and get some more. */
2623 static int ssh_do_close(Ssh ssh, int notify_exit)
2626 struct ssh_channel *c;
2628 ssh->state = SSH_STATE_CLOSED;
2629 expire_timer_context(ssh);
2634 notify_remote_exit(ssh->frontend);
2639 * Now we must shut down any port- and X-forwarded channels going
2640 * through this connection.
2642 if (ssh->channels) {
2643 while (NULL != (c = index234(ssh->channels, 0))) {
2646 x11_close(c->u.x11.s);
2649 pfd_close(c->u.pfd.s);
2652 del234(ssh->channels, c); /* moving next one to index 0 */
2653 if (ssh->version == 2)
2654 bufchain_clear(&c->v.v2.outbuffer);
2659 * Go through port-forwardings, and close any associated
2660 * listening sockets.
2662 if (ssh->portfwds) {
2663 struct ssh_portfwd *pf;
2664 while (NULL != (pf = index234(ssh->portfwds, 0))) {
2665 /* Dispose of any listening socket. */
2667 pfd_terminate(pf->local);
2668 del234(ssh->portfwds, pf); /* moving next one to index 0 */
2676 static void ssh_log(Plug plug, int type, SockAddr addr, int port,
2677 const char *error_msg, int error_code)
2679 Ssh ssh = (Ssh) plug;
2680 char addrbuf[256], *msg;
2682 sk_getaddr(addr, addrbuf, lenof(addrbuf));
2685 msg = dupprintf("Connecting to %s port %d", addrbuf, port);
2687 msg = dupprintf("Failed to connect to %s: %s", addrbuf, error_msg);
2693 static int ssh_closing(Plug plug, const char *error_msg, int error_code,
2696 Ssh ssh = (Ssh) plug;
2697 int need_notify = ssh_do_close(ssh, FALSE);
2700 if (!ssh->close_expected)
2701 error_msg = "Server unexpectedly closed network connection";
2703 error_msg = "Server closed network connection";
2706 if (ssh->close_expected && ssh->clean_exit && ssh->exitcode < 0)
2710 notify_remote_exit(ssh->frontend);
2713 logevent(error_msg);
2714 if (!ssh->close_expected || !ssh->clean_exit)
2715 connection_fatal(ssh->frontend, "%s", error_msg);
2719 static int ssh_receive(Plug plug, int urgent, char *data, int len)
2721 Ssh ssh = (Ssh) plug;
2722 ssh_gotdata(ssh, (unsigned char *)data, len);
2723 if (ssh->state == SSH_STATE_CLOSED) {
2724 ssh_do_close(ssh, TRUE);
2730 static void ssh_sent(Plug plug, int bufsize)
2732 Ssh ssh = (Ssh) plug;
2734 * If the send backlog on the SSH socket itself clears, we
2735 * should unthrottle the whole world if it was throttled.
2737 if (bufsize < SSH_MAX_BACKLOG)
2738 ssh_throttle_all(ssh, 0, bufsize);
2742 * Connect to specified host and port.
2743 * Returns an error message, or NULL on success.
2744 * Also places the canonical host name into `realhost'. It must be
2745 * freed by the caller.
2747 static const char *connect_to_host(Ssh ssh, char *host, int port,
2748 char **realhost, int nodelay, int keepalive)
2750 static const struct plug_function_table fn_table = {
2761 ssh->savedhost = snewn(1 + strlen(host), char);
2762 strcpy(ssh->savedhost, host);
2765 port = 22; /* default ssh port */
2766 ssh->savedport = port;
2771 logeventf(ssh, "Looking up host \"%s\"%s", host,
2772 (ssh->cfg.addressfamily == ADDRTYPE_IPV4 ? " (IPv4)" :
2773 (ssh->cfg.addressfamily == ADDRTYPE_IPV6 ? " (IPv6)" : "")));
2774 addr = name_lookup(host, port, realhost, &ssh->cfg,
2775 ssh->cfg.addressfamily);
2776 if ((err = sk_addr_error(addr)) != NULL) {
2784 ssh->fn = &fn_table;
2785 ssh->s = new_connection(addr, *realhost, port,
2786 0, 1, nodelay, keepalive, (Plug) ssh, &ssh->cfg);
2787 if ((err = sk_socket_error(ssh->s)) != NULL) {
2789 notify_remote_exit(ssh->frontend);
2797 * Throttle or unthrottle the SSH connection.
2799 static void ssh1_throttle(Ssh ssh, int adjust)
2801 int old_count = ssh->v1_throttle_count;
2802 ssh->v1_throttle_count += adjust;
2803 assert(ssh->v1_throttle_count >= 0);
2804 if (ssh->v1_throttle_count && !old_count) {
2805 ssh_set_frozen(ssh, 1);
2806 } else if (!ssh->v1_throttle_count && old_count) {
2807 ssh_set_frozen(ssh, 0);
2812 * Throttle or unthrottle _all_ local data streams (for when sends
2813 * on the SSH connection itself back up).
2815 static void ssh_throttle_all(Ssh ssh, int enable, int bufsize)
2818 struct ssh_channel *c;
2820 if (enable == ssh->throttled_all)
2822 ssh->throttled_all = enable;
2823 ssh->overall_bufsize = bufsize;
2826 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++) {
2828 case CHAN_MAINSESSION:
2830 * This is treated separately, outside the switch.
2834 x11_override_throttle(c->u.x11.s, enable);
2837 /* Agent channels require no buffer management. */
2840 pfd_override_throttle(c->u.pfd.s, enable);
2846 static void ssh_agent_callback(void *sshv, void *reply, int replylen)
2848 Ssh ssh = (Ssh) sshv;
2850 ssh->agent_response = reply;
2851 ssh->agent_response_len = replylen;
2853 if (ssh->version == 1)
2854 do_ssh1_login(ssh, NULL, -1, NULL);
2856 do_ssh2_authconn(ssh, NULL, -1, NULL);
2859 static void ssh_dialog_callback(void *sshv, int ret)
2861 Ssh ssh = (Ssh) sshv;
2863 ssh->user_response = ret;
2865 if (ssh->version == 1)
2866 do_ssh1_login(ssh, NULL, -1, NULL);
2868 do_ssh2_transport(ssh, NULL, -1, NULL);
2871 * This may have unfrozen the SSH connection, so do a
2874 ssh_process_queued_incoming_data(ssh);
2877 static void ssh_agentf_callback(void *cv, void *reply, int replylen)
2879 struct ssh_channel *c = (struct ssh_channel *)cv;
2881 void *sentreply = reply;
2884 /* Fake SSH_AGENT_FAILURE. */
2885 sentreply = "\0\0\0\1\5";
2888 if (ssh->version == 2) {
2889 ssh2_add_channel_data(c, sentreply, replylen);
2892 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
2893 PKT_INT, c->remoteid,
2896 PKT_DATA, sentreply, replylen,
2905 * Client-initiated disconnection. Send a DISCONNECT if `wire_reason'
2906 * non-NULL, otherwise just close the connection. `client_reason' == NULL
2907 * => log `wire_reason'.
2909 static void ssh_disconnect(Ssh ssh, char *client_reason, char *wire_reason,
2910 int code, int clean_exit)
2914 client_reason = wire_reason;
2916 error = dupprintf("Disconnected: %s", client_reason);
2918 error = dupstr("Disconnected");
2920 if (ssh->version == 1) {
2921 send_packet(ssh, SSH1_MSG_DISCONNECT, PKT_STR, wire_reason,
2923 } else if (ssh->version == 2) {
2924 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT);
2925 ssh2_pkt_adduint32(pktout, code);
2926 ssh2_pkt_addstring(pktout, wire_reason);
2927 ssh2_pkt_addstring(pktout, "en"); /* language tag */
2928 ssh2_pkt_send_noqueue(ssh, pktout);
2931 ssh->close_expected = TRUE;
2932 ssh->clean_exit = clean_exit;
2933 ssh_closing((Plug)ssh, error, 0, 0);
2938 * Handle the key exchange and user authentication phases.
2940 static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
2941 struct Packet *pktin)
2944 unsigned char cookie[8], *ptr;
2945 struct RSAKey servkey, hostkey;
2946 struct MD5Context md5c;
2947 struct do_ssh1_login_state {
2949 unsigned char *rsabuf, *keystr1, *keystr2;
2950 unsigned long supported_ciphers_mask, supported_auths_mask;
2951 int tried_publickey, tried_agent;
2952 int tis_auth_refused, ccard_auth_refused;
2953 unsigned char session_id[16];
2956 void *publickey_blob;
2957 int publickey_bloblen;
2958 char *publickey_comment;
2959 int publickey_encrypted;
2960 prompts_t *cur_prompt;
2963 unsigned char request[5], *response, *p;
2973 crState(do_ssh1_login_state);
2975 crBegin(ssh->do_ssh1_login_crstate);
2980 if (pktin->type != SSH1_SMSG_PUBLIC_KEY) {
2981 bombout(("Public key packet not received"));
2985 logevent("Received public keys");
2987 ptr = ssh_pkt_getdata(pktin, 8);
2989 bombout(("SSH-1 public key packet stopped before random cookie"));
2992 memcpy(cookie, ptr, 8);
2994 if (!ssh1_pkt_getrsakey(pktin, &servkey, &s->keystr1) ||
2995 !ssh1_pkt_getrsakey(pktin, &hostkey, &s->keystr2)) {
2996 bombout(("Failed to read SSH-1 public keys from public key packet"));
3001 * Log the host key fingerprint.
3005 logevent("Host key fingerprint is:");
3006 strcpy(logmsg, " ");
3007 hostkey.comment = NULL;
3008 rsa_fingerprint(logmsg + strlen(logmsg),
3009 sizeof(logmsg) - strlen(logmsg), &hostkey);
3013 ssh->v1_remote_protoflags = ssh_pkt_getuint32(pktin);
3014 s->supported_ciphers_mask = ssh_pkt_getuint32(pktin);
3015 s->supported_auths_mask = ssh_pkt_getuint32(pktin);
3017 ssh->v1_local_protoflags =
3018 ssh->v1_remote_protoflags & SSH1_PROTOFLAGS_SUPPORTED;
3019 ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
3022 MD5Update(&md5c, s->keystr2, hostkey.bytes);
3023 MD5Update(&md5c, s->keystr1, servkey.bytes);
3024 MD5Update(&md5c, cookie, 8);
3025 MD5Final(s->session_id, &md5c);
3027 for (i = 0; i < 32; i++)
3028 ssh->session_key[i] = random_byte();
3031 * Verify that the `bits' and `bytes' parameters match.
3033 if (hostkey.bits > hostkey.bytes * 8 ||
3034 servkey.bits > servkey.bytes * 8) {
3035 bombout(("SSH-1 public keys were badly formatted"));
3039 s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
3041 s->rsabuf = snewn(s->len, unsigned char);
3044 * Verify the host key.
3048 * First format the key into a string.
3050 int len = rsastr_len(&hostkey);
3051 char fingerprint[100];
3052 char *keystr = snewn(len, char);
3053 rsastr_fmt(keystr, &hostkey);
3054 rsa_fingerprint(fingerprint, sizeof(fingerprint), &hostkey);
3056 ssh_set_frozen(ssh, 1);
3057 s->dlgret = verify_ssh_host_key(ssh->frontend,
3058 ssh->savedhost, ssh->savedport,
3059 "rsa", keystr, fingerprint,
3060 ssh_dialog_callback, ssh);
3062 if (s->dlgret < 0) {
3066 bombout(("Unexpected data from server while waiting"
3067 " for user host key response"));
3070 } while (pktin || inlen > 0);
3071 s->dlgret = ssh->user_response;
3073 ssh_set_frozen(ssh, 0);
3075 if (s->dlgret == 0) {
3076 ssh_disconnect(ssh, "User aborted at host key verification",
3082 for (i = 0; i < 32; i++) {
3083 s->rsabuf[i] = ssh->session_key[i];
3085 s->rsabuf[i] ^= s->session_id[i];
3088 if (hostkey.bytes > servkey.bytes) {
3089 ret = rsaencrypt(s->rsabuf, 32, &servkey);
3091 ret = rsaencrypt(s->rsabuf, servkey.bytes, &hostkey);
3093 ret = rsaencrypt(s->rsabuf, 32, &hostkey);
3095 ret = rsaencrypt(s->rsabuf, hostkey.bytes, &servkey);
3098 bombout(("SSH-1 public key encryptions failed due to bad formatting"));
3102 logevent("Encrypted session key");
3105 int cipher_chosen = 0, warn = 0;
3106 char *cipher_string = NULL;
3108 for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) {
3109 int next_cipher = ssh->cfg.ssh_cipherlist[i];
3110 if (next_cipher == CIPHER_WARN) {
3111 /* If/when we choose a cipher, warn about it */
3113 } else if (next_cipher == CIPHER_AES) {
3114 /* XXX Probably don't need to mention this. */
3115 logevent("AES not supported in SSH-1, skipping");
3117 switch (next_cipher) {
3118 case CIPHER_3DES: s->cipher_type = SSH_CIPHER_3DES;
3119 cipher_string = "3DES"; break;
3120 case CIPHER_BLOWFISH: s->cipher_type = SSH_CIPHER_BLOWFISH;
3121 cipher_string = "Blowfish"; break;
3122 case CIPHER_DES: s->cipher_type = SSH_CIPHER_DES;
3123 cipher_string = "single-DES"; break;
3125 if (s->supported_ciphers_mask & (1 << s->cipher_type))
3129 if (!cipher_chosen) {
3130 if ((s->supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0)
3131 bombout(("Server violates SSH-1 protocol by not "
3132 "supporting 3DES encryption"));
3134 /* shouldn't happen */
3135 bombout(("No supported ciphers found"));
3139 /* Warn about chosen cipher if necessary. */
3141 ssh_set_frozen(ssh, 1);
3142 s->dlgret = askalg(ssh->frontend, "cipher", cipher_string,
3143 ssh_dialog_callback, ssh);
3144 if (s->dlgret < 0) {
3148 bombout(("Unexpected data from server while waiting"
3149 " for user response"));
3152 } while (pktin || inlen > 0);
3153 s->dlgret = ssh->user_response;
3155 ssh_set_frozen(ssh, 0);
3156 if (s->dlgret == 0) {
3157 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
3164 switch (s->cipher_type) {
3165 case SSH_CIPHER_3DES:
3166 logevent("Using 3DES encryption");
3168 case SSH_CIPHER_DES:
3169 logevent("Using single-DES encryption");
3171 case SSH_CIPHER_BLOWFISH:
3172 logevent("Using Blowfish encryption");
3176 send_packet(ssh, SSH1_CMSG_SESSION_KEY,
3177 PKT_CHAR, s->cipher_type,
3178 PKT_DATA, cookie, 8,
3179 PKT_CHAR, (s->len * 8) >> 8, PKT_CHAR, (s->len * 8) & 0xFF,
3180 PKT_DATA, s->rsabuf, s->len,
3181 PKT_INT, ssh->v1_local_protoflags, PKT_END);
3183 logevent("Trying to enable encryption...");
3187 ssh->cipher = (s->cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish_ssh1 :
3188 s->cipher_type == SSH_CIPHER_DES ? &ssh_des :
3190 ssh->v1_cipher_ctx = ssh->cipher->make_context();
3191 ssh->cipher->sesskey(ssh->v1_cipher_ctx, ssh->session_key);
3192 logeventf(ssh, "Initialised %s encryption", ssh->cipher->text_name);
3194 ssh->crcda_ctx = crcda_make_context();
3195 logevent("Installing CRC compensation attack detector");
3197 if (servkey.modulus) {
3198 sfree(servkey.modulus);
3199 servkey.modulus = NULL;
3201 if (servkey.exponent) {
3202 sfree(servkey.exponent);
3203 servkey.exponent = NULL;
3205 if (hostkey.modulus) {
3206 sfree(hostkey.modulus);
3207 hostkey.modulus = NULL;
3209 if (hostkey.exponent) {
3210 sfree(hostkey.exponent);
3211 hostkey.exponent = NULL;
3215 if (pktin->type != SSH1_SMSG_SUCCESS) {
3216 bombout(("Encryption not successfully enabled"));
3220 logevent("Successfully started encryption");
3222 fflush(stdout); /* FIXME eh? */
3224 if (!*ssh->cfg.username) {
3225 int ret; /* need not be kept over crReturn */
3226 s->cur_prompt = new_prompts(ssh->frontend);
3227 s->cur_prompt->to_server = TRUE;
3228 s->cur_prompt->name = dupstr("SSH login name");
3229 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
3230 lenof(s->username));
3231 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3234 crWaitUntil(!pktin);
3235 ret = get_userpass_input(s->cur_prompt, in, inlen);
3240 * Failed to get a username. Terminate.
3242 free_prompts(s->cur_prompt);
3243 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
3246 memcpy(s->username, s->cur_prompt->prompts[0]->result,
3247 lenof(s->username));
3248 free_prompts(s->cur_prompt);
3250 strncpy(s->username, ssh->cfg.username, sizeof(s->username));
3251 s->username[sizeof(s->username)-1] = '\0';
3254 send_packet(ssh, SSH1_CMSG_USER, PKT_STR, s->username, PKT_END);
3256 char *userlog = dupprintf("Sent username \"%s\"", s->username);
3258 if (flags & FLAG_INTERACTIVE &&
3259 (!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) {
3260 c_write_str(ssh, userlog);
3261 c_write_str(ssh, "\r\n");
3269 if ((ssh->remote_bugs & BUG_CHOKES_ON_RSA)) {
3270 /* We must not attempt PK auth. Pretend we've already tried it. */
3271 s->tried_publickey = s->tried_agent = 1;
3273 s->tried_publickey = s->tried_agent = 0;
3275 s->tis_auth_refused = s->ccard_auth_refused = 0;
3277 * Load the public half of any configured keyfile for later use.
3279 if (!filename_is_null(ssh->cfg.keyfile)) {
3281 logeventf(ssh, "Reading private key file \"%.150s\"",
3282 filename_to_str(&ssh->cfg.keyfile));
3283 keytype = key_type(&ssh->cfg.keyfile);
3284 if (keytype == SSH_KEYTYPE_SSH1) {
3286 if (rsakey_pubblob(&ssh->cfg.keyfile,
3287 &s->publickey_blob, &s->publickey_bloblen,
3288 &s->publickey_comment, &error)) {
3289 s->publickey_encrypted = rsakey_encrypted(&ssh->cfg.keyfile,
3293 logeventf(ssh, "Unable to load private key (%s)", error);
3294 msgbuf = dupprintf("Unable to load private key file "
3295 "\"%.150s\" (%s)\r\n",
3296 filename_to_str(&ssh->cfg.keyfile),
3298 c_write_str(ssh, msgbuf);
3300 s->publickey_blob = NULL;
3304 logeventf(ssh, "Unable to use this key file (%s)",
3305 key_type_to_str(keytype));
3306 msgbuf = dupprintf("Unable to use key file \"%.150s\""
3308 filename_to_str(&ssh->cfg.keyfile),
3309 key_type_to_str(keytype));
3310 c_write_str(ssh, msgbuf);
3312 s->publickey_blob = NULL;
3315 s->publickey_blob = NULL;
3317 while (pktin->type == SSH1_SMSG_FAILURE) {
3318 s->pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
3320 if (ssh->cfg.tryagent && agent_exists() && !s->tried_agent) {
3322 * Attempt RSA authentication using Pageant.
3328 logevent("Pageant is running. Requesting keys.");
3330 /* Request the keys held by the agent. */
3331 PUT_32BIT(s->request, 1);
3332 s->request[4] = SSH1_AGENTC_REQUEST_RSA_IDENTITIES;
3333 if (!agent_query(s->request, 5, &r, &s->responselen,
3334 ssh_agent_callback, ssh)) {
3338 bombout(("Unexpected data from server while waiting"
3339 " for agent response"));
3342 } while (pktin || inlen > 0);
3343 r = ssh->agent_response;
3344 s->responselen = ssh->agent_response_len;
3346 s->response = (unsigned char *) r;
3347 if (s->response && s->responselen >= 5 &&
3348 s->response[4] == SSH1_AGENT_RSA_IDENTITIES_ANSWER) {
3349 s->p = s->response + 5;
3350 s->nkeys = GET_32BIT(s->p);
3352 logeventf(ssh, "Pageant has %d SSH-1 keys", s->nkeys);
3353 for (s->keyi = 0; s->keyi < s->nkeys; s->keyi++) {
3354 unsigned char *pkblob = s->p;
3358 do { /* do while (0) to make breaking easy */
3359 n = ssh1_read_bignum
3360 (s->p, s->responselen-(s->p-s->response),
3365 n = ssh1_read_bignum
3366 (s->p, s->responselen-(s->p-s->response),
3371 if (s->responselen - (s->p-s->response) < 4)
3373 s->commentlen = GET_32BIT(s->p);
3375 if (s->responselen - (s->p-s->response) <
3378 s->commentp = (char *)s->p;
3379 s->p += s->commentlen;
3383 logevent("Pageant key list packet was truncated");
3387 if (s->publickey_blob) {
3388 if (!memcmp(pkblob, s->publickey_blob,
3389 s->publickey_bloblen)) {
3390 logeventf(ssh, "Pageant key #%d matches "
3391 "configured key file", s->keyi);
3392 s->tried_publickey = 1;
3394 /* Skip non-configured key */
3397 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
3398 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3399 PKT_BIGNUM, s->key.modulus, PKT_END);
3401 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
3402 logevent("Key refused");
3405 logevent("Received RSA challenge");
3406 if ((s->challenge = ssh1_pkt_getmp(pktin)) == NULL) {
3407 bombout(("Server's RSA challenge was badly formatted"));
3412 char *agentreq, *q, *ret;
3415 len = 1 + 4; /* message type, bit count */
3416 len += ssh1_bignum_length(s->key.exponent);
3417 len += ssh1_bignum_length(s->key.modulus);
3418 len += ssh1_bignum_length(s->challenge);
3419 len += 16; /* session id */
3420 len += 4; /* response format */
3421 agentreq = snewn(4 + len, char);
3422 PUT_32BIT(agentreq, len);
3424 *q++ = SSH1_AGENTC_RSA_CHALLENGE;
3425 PUT_32BIT(q, bignum_bitcount(s->key.modulus));
3427 q += ssh1_write_bignum(q, s->key.exponent);
3428 q += ssh1_write_bignum(q, s->key.modulus);
3429 q += ssh1_write_bignum(q, s->challenge);
3430 memcpy(q, s->session_id, 16);
3432 PUT_32BIT(q, 1); /* response format */
3433 if (!agent_query(agentreq, len + 4, &vret, &retlen,
3434 ssh_agent_callback, ssh)) {
3439 bombout(("Unexpected data from server"
3440 " while waiting for agent"
3444 } while (pktin || inlen > 0);
3445 vret = ssh->agent_response;
3446 retlen = ssh->agent_response_len;
3451 if (ret[4] == SSH1_AGENT_RSA_RESPONSE) {
3452 logevent("Sending Pageant's response");
3453 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
3454 PKT_DATA, ret + 5, 16,
3458 if (pktin->type == SSH1_SMSG_SUCCESS) {
3460 ("Pageant's response accepted");
3461 if (flags & FLAG_VERBOSE) {
3462 c_write_str(ssh, "Authenticated using"
3464 c_write(ssh, s->commentp,
3466 c_write_str(ssh, "\" from agent\r\n");
3471 ("Pageant's response not accepted");
3474 ("Pageant failed to answer challenge");
3478 logevent("No reply received from Pageant");
3481 freebn(s->key.exponent);
3482 freebn(s->key.modulus);
3483 freebn(s->challenge);
3488 if (s->publickey_blob && !s->tried_publickey)
3489 logevent("Configured key file not in Pageant");
3494 if (s->publickey_blob && !s->tried_publickey) {
3496 * Try public key authentication with the specified
3499 int got_passphrase; /* need not be kept over crReturn */
3500 if (flags & FLAG_VERBOSE)
3501 c_write_str(ssh, "Trying public key authentication.\r\n");
3502 logeventf(ssh, "Trying public key \"%s\"",
3503 filename_to_str(&ssh->cfg.keyfile));
3504 s->tried_publickey = 1;
3505 got_passphrase = FALSE;
3506 while (!got_passphrase) {
3508 * Get a passphrase, if necessary.
3510 char *passphrase = NULL; /* only written after crReturn */
3512 if (!s->publickey_encrypted) {
3513 if (flags & FLAG_VERBOSE)
3514 c_write_str(ssh, "No passphrase required.\r\n");
3517 int ret; /* need not be kept over crReturn */
3518 s->cur_prompt = new_prompts(ssh->frontend);
3519 s->cur_prompt->to_server = FALSE;
3520 s->cur_prompt->name = dupstr("SSH key passphrase");
3521 add_prompt(s->cur_prompt,
3522 dupprintf("Passphrase for key \"%.100s\": ",
3523 s->publickey_comment),
3524 FALSE, SSH_MAX_PASSWORD_LEN);
3525 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3528 crWaitUntil(!pktin);
3529 ret = get_userpass_input(s->cur_prompt, in, inlen);
3533 /* Failed to get a passphrase. Terminate. */
3534 free_prompts(s->cur_prompt);
3535 ssh_disconnect(ssh, NULL, "Unable to authenticate",
3539 passphrase = dupstr(s->cur_prompt->prompts[0]->result);
3540 free_prompts(s->cur_prompt);
3543 * Try decrypting key with passphrase.
3545 ret = loadrsakey(&ssh->cfg.keyfile, &s->key, passphrase,
3548 memset(passphrase, 0, strlen(passphrase));
3552 /* Correct passphrase. */
3553 got_passphrase = TRUE;
3554 } else if (ret == 0) {
3555 c_write_str(ssh, "Couldn't load private key from ");
3556 c_write_str(ssh, filename_to_str(&ssh->cfg.keyfile));
3557 c_write_str(ssh, " (");
3558 c_write_str(ssh, error);
3559 c_write_str(ssh, ").\r\n");
3560 got_passphrase = FALSE;
3561 break; /* go and try something else */
3562 } else if (ret == -1) {
3563 c_write_str(ssh, "Wrong passphrase.\r\n"); /* FIXME */
3564 got_passphrase = FALSE;
3567 assert(0 && "unexpected return from loadrsakey()");
3568 got_passphrase = FALSE; /* placate optimisers */
3572 if (got_passphrase) {
3575 * Send a public key attempt.
3577 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3578 PKT_BIGNUM, s->key.modulus, PKT_END);
3581 if (pktin->type == SSH1_SMSG_FAILURE) {
3582 c_write_str(ssh, "Server refused our public key.\r\n");
3583 continue; /* go and try something else */
3585 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
3586 bombout(("Bizarre response to offer of public key"));
3592 unsigned char buffer[32];
3593 Bignum challenge, response;
3595 if ((challenge = ssh1_pkt_getmp(pktin)) == NULL) {
3596 bombout(("Server's RSA challenge was badly formatted"));
3599 response = rsadecrypt(challenge, &s->key);
3600 freebn(s->key.private_exponent);/* burn the evidence */
3602 for (i = 0; i < 32; i++) {
3603 buffer[i] = bignum_byte(response, 31 - i);
3607 MD5Update(&md5c, buffer, 32);
3608 MD5Update(&md5c, s->session_id, 16);
3609 MD5Final(buffer, &md5c);
3611 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
3612 PKT_DATA, buffer, 16, PKT_END);
3619 if (pktin->type == SSH1_SMSG_FAILURE) {
3620 if (flags & FLAG_VERBOSE)
3621 c_write_str(ssh, "Failed to authenticate with"
3622 " our public key.\r\n");
3623 continue; /* go and try something else */
3624 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
3625 bombout(("Bizarre response to RSA authentication response"));
3629 break; /* we're through! */
3635 * Otherwise, try various forms of password-like authentication.
3637 s->cur_prompt = new_prompts(ssh->frontend);
3639 if (ssh->cfg.try_tis_auth &&
3640 (s->supported_auths_mask & (1 << SSH1_AUTH_TIS)) &&
3641 !s->tis_auth_refused) {
3642 s->pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
3643 logevent("Requested TIS authentication");
3644 send_packet(ssh, SSH1_CMSG_AUTH_TIS, PKT_END);
3646 if (pktin->type != SSH1_SMSG_AUTH_TIS_CHALLENGE) {
3647 logevent("TIS authentication declined");
3648 if (flags & FLAG_INTERACTIVE)
3649 c_write_str(ssh, "TIS authentication refused.\r\n");
3650 s->tis_auth_refused = 1;
3655 char *instr_suf, *prompt;
3657 ssh_pkt_getstring(pktin, &challenge, &challengelen);
3659 bombout(("TIS challenge packet was badly formed"));
3662 logevent("Received TIS challenge");
3663 s->cur_prompt->to_server = TRUE;
3664 s->cur_prompt->name = dupstr("SSH TIS authentication");
3665 /* Prompt heuristic comes from OpenSSH */
3666 if (memchr(challenge, '\n', challengelen)) {
3667 instr_suf = dupstr("");
3668 prompt = dupprintf("%.*s", challengelen, challenge);
3670 instr_suf = dupprintf("%.*s", challengelen, challenge);
3671 prompt = dupstr("Response: ");
3673 s->cur_prompt->instruction =
3674 dupprintf("Using TIS authentication.%s%s",
3675 (*instr_suf) ? "\n" : "",
3677 s->cur_prompt->instr_reqd = TRUE;
3678 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3682 if (ssh->cfg.try_tis_auth &&
3683 (s->supported_auths_mask & (1 << SSH1_AUTH_CCARD)) &&
3684 !s->ccard_auth_refused) {
3685 s->pwpkt_type = SSH1_CMSG_AUTH_CCARD_RESPONSE;
3686 logevent("Requested CryptoCard authentication");
3687 send_packet(ssh, SSH1_CMSG_AUTH_CCARD, PKT_END);
3689 if (pktin->type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
3690 logevent("CryptoCard authentication declined");
3691 c_write_str(ssh, "CryptoCard authentication refused.\r\n");
3692 s->ccard_auth_refused = 1;
3697 char *instr_suf, *prompt;
3699 ssh_pkt_getstring(pktin, &challenge, &challengelen);
3701 bombout(("CryptoCard challenge packet was badly formed"));
3704 logevent("Received CryptoCard challenge");
3705 s->cur_prompt->to_server = TRUE;
3706 s->cur_prompt->name = dupstr("SSH CryptoCard authentication");
3707 s->cur_prompt->name_reqd = FALSE;
3708 /* Prompt heuristic comes from OpenSSH */
3709 if (memchr(challenge, '\n', challengelen)) {
3710 instr_suf = dupstr("");
3711 prompt = dupprintf("%.*s", challengelen, challenge);
3713 instr_suf = dupprintf("%.*s", challengelen, challenge);
3714 prompt = dupstr("Response: ");
3716 s->cur_prompt->instruction =
3717 dupprintf("Using CryptoCard authentication.%s%s",
3718 (*instr_suf) ? "\n" : "",
3720 s->cur_prompt->instr_reqd = TRUE;
3721 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3725 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
3726 s->cur_prompt->to_server = TRUE;
3727 s->cur_prompt->name = dupstr("SSH password");
3728 add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
3729 s->username, ssh->savedhost),
3730 FALSE, SSH_MAX_PASSWORD_LEN);
3734 * Show password prompt, having first obtained it via a TIS
3735 * or CryptoCard exchange if we're doing TIS or CryptoCard
3739 int ret; /* need not be kept over crReturn */
3740 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3743 crWaitUntil(!pktin);
3744 ret = get_userpass_input(s->cur_prompt, in, inlen);
3749 * Failed to get a password (for example
3750 * because one was supplied on the command line
3751 * which has already failed to work). Terminate.
3753 free_prompts(s->cur_prompt);
3754 ssh_disconnect(ssh, NULL, "Unable to authenticate", 0, TRUE);
3759 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
3761 * Defence against traffic analysis: we send a
3762 * whole bunch of packets containing strings of
3763 * different lengths. One of these strings is the
3764 * password, in a SSH1_CMSG_AUTH_PASSWORD packet.
3765 * The others are all random data in
3766 * SSH1_MSG_IGNORE packets. This way a passive
3767 * listener can't tell which is the password, and
3768 * hence can't deduce the password length.
3770 * Anybody with a password length greater than 16
3771 * bytes is going to have enough entropy in their
3772 * password that a listener won't find it _that_
3773 * much help to know how long it is. So what we'll
3776 * - if password length < 16, we send 15 packets
3777 * containing string lengths 1 through 15
3779 * - otherwise, we let N be the nearest multiple
3780 * of 8 below the password length, and send 8
3781 * packets containing string lengths N through
3782 * N+7. This won't obscure the order of
3783 * magnitude of the password length, but it will
3784 * introduce a bit of extra uncertainty.
3786 * A few servers can't deal with SSH1_MSG_IGNORE, at
3787 * least in this context. For these servers, we need
3788 * an alternative defence. We make use of the fact
3789 * that the password is interpreted as a C string:
3790 * so we can append a NUL, then some random data.
3792 * A few servers can deal with neither SSH1_MSG_IGNORE
3793 * here _nor_ a padded password string.
3794 * For these servers we are left with no defences
3795 * against password length sniffing.
3797 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE) &&
3798 !(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
3800 * The server can deal with SSH1_MSG_IGNORE, so
3801 * we can use the primary defence.
3803 int bottom, top, pwlen, i;
3806 pwlen = strlen(s->cur_prompt->prompts[0]->result);
3808 bottom = 0; /* zero length passwords are OK! :-) */
3811 bottom = pwlen & ~7;
3815 assert(pwlen >= bottom && pwlen <= top);
3817 randomstr = snewn(top + 1, char);
3819 for (i = bottom; i <= top; i++) {
3821 defer_packet(ssh, s->pwpkt_type,
3822 PKTT_PASSWORD, PKT_STR,
3823 s->cur_prompt->prompts[0]->result,
3824 PKTT_OTHER, PKT_END);
3826 for (j = 0; j < i; j++) {
3828 randomstr[j] = random_byte();
3829 } while (randomstr[j] == '\0');
3831 randomstr[i] = '\0';
3832 defer_packet(ssh, SSH1_MSG_IGNORE,
3833 PKT_STR, randomstr, PKT_END);
3836 logevent("Sending password with camouflage packets");
3837 ssh_pkt_defersend(ssh);
3840 else if (!(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
3842 * The server can't deal with SSH1_MSG_IGNORE
3843 * but can deal with padded passwords, so we
3844 * can use the secondary defence.
3850 len = strlen(s->cur_prompt->prompts[0]->result);
3851 if (len < sizeof(string)) {
3853 strcpy(string, s->cur_prompt->prompts[0]->result);
3854 len++; /* cover the zero byte */
3855 while (len < sizeof(string)) {
3856 string[len++] = (char) random_byte();
3859 ss = s->cur_prompt->prompts[0]->result;
3861 logevent("Sending length-padded password");
3862 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
3863 PKT_INT, len, PKT_DATA, ss, len,
3864 PKTT_OTHER, PKT_END);
3867 * The server is believed unable to cope with
3868 * any of our password camouflage methods.
3871 len = strlen(s->cur_prompt->prompts[0]->result);
3872 logevent("Sending unpadded password");
3873 send_packet(ssh, s->pwpkt_type,
3874 PKTT_PASSWORD, PKT_INT, len,
3875 PKT_DATA, s->cur_prompt->prompts[0]->result, len,
3876 PKTT_OTHER, PKT_END);
3879 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
3880 PKT_STR, s->cur_prompt->prompts[0]->result,
3881 PKTT_OTHER, PKT_END);
3883 logevent("Sent password");
3884 free_prompts(s->cur_prompt);
3886 if (pktin->type == SSH1_SMSG_FAILURE) {
3887 if (flags & FLAG_VERBOSE)
3888 c_write_str(ssh, "Access denied\r\n");
3889 logevent("Authentication refused");
3890 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
3891 bombout(("Strange packet received, type %d", pktin->type));
3897 if (s->publickey_blob) {
3898 sfree(s->publickey_blob);
3899 sfree(s->publickey_comment);
3902 logevent("Authentication successful");
3907 void sshfwd_close(struct ssh_channel *c)
3911 if (ssh->state == SSH_STATE_CLOSED)
3914 if (c && !c->closes) {
3916 * If halfopen is true, we have sent
3917 * CHANNEL_OPEN for this channel, but it hasn't even been
3918 * acknowledged by the server. So we must set a close flag
3919 * on it now, and then when the server acks the channel
3920 * open, we can close it then.
3923 if (ssh->version == 1) {
3924 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
3927 struct Packet *pktout;
3928 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
3929 ssh2_pkt_adduint32(pktout, c->remoteid);
3930 ssh2_pkt_send(ssh, pktout);
3933 c->closes = 1; /* sent MSG_CLOSE */
3934 if (c->type == CHAN_X11) {
3936 logevent("Forwarded X11 connection terminated");
3937 } else if (c->type == CHAN_SOCKDATA ||
3938 c->type == CHAN_SOCKDATA_DORMANT) {
3940 logevent("Forwarded port closed");
3945 int sshfwd_write(struct ssh_channel *c, char *buf, int len)
3949 if (ssh->state == SSH_STATE_CLOSED)
3952 if (ssh->version == 1) {
3953 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
3954 PKT_INT, c->remoteid,
3956 PKT_INT, len, PKT_DATA, buf, len,
3957 PKTT_OTHER, PKT_END);
3959 * In SSH-1 we can return 0 here - implying that forwarded
3960 * connections are never individually throttled - because
3961 * the only circumstance that can cause throttling will be
3962 * the whole SSH connection backing up, in which case
3963 * _everything_ will be throttled as a whole.
3967 ssh2_add_channel_data(c, buf, len);
3968 return ssh2_try_send(c);
3972 void sshfwd_unthrottle(struct ssh_channel *c, int bufsize)
3976 if (ssh->state == SSH_STATE_CLOSED)
3979 if (ssh->version == 1) {
3980 if (c->v.v1.throttling && bufsize < SSH1_BUFFER_LIMIT) {
3981 c->v.v1.throttling = 0;
3982 ssh1_throttle(ssh, -1);
3985 ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
3989 static void ssh_queueing_handler(Ssh ssh, struct Packet *pktin)
3991 struct queued_handler *qh = ssh->qhead;
3995 assert(pktin->type == qh->msg1 || pktin->type == qh->msg2);
3998 assert(ssh->packet_dispatch[qh->msg1] == ssh_queueing_handler);
3999 ssh->packet_dispatch[qh->msg1] = NULL;
4002 assert(ssh->packet_dispatch[qh->msg2] == ssh_queueing_handler);
4003 ssh->packet_dispatch[qh->msg2] = NULL;
4007 ssh->qhead = qh->next;
4009 if (ssh->qhead->msg1 > 0) {
4010 assert(ssh->packet_dispatch[ssh->qhead->msg1] == NULL);
4011 ssh->packet_dispatch[ssh->qhead->msg1] = ssh_queueing_handler;
4013 if (ssh->qhead->msg2 > 0) {
4014 assert(ssh->packet_dispatch[ssh->qhead->msg2] == NULL);
4015 ssh->packet_dispatch[ssh->qhead->msg2] = ssh_queueing_handler;
4018 ssh->qhead = ssh->qtail = NULL;
4019 ssh->packet_dispatch[pktin->type] = NULL;
4022 qh->handler(ssh, pktin, qh->ctx);
4027 static void ssh_queue_handler(Ssh ssh, int msg1, int msg2,
4028 chandler_fn_t handler, void *ctx)
4030 struct queued_handler *qh;
4032 qh = snew(struct queued_handler);
4035 qh->handler = handler;
4039 if (ssh->qtail == NULL) {
4043 assert(ssh->packet_dispatch[qh->msg1] == NULL);
4044 ssh->packet_dispatch[qh->msg1] = ssh_queueing_handler;
4047 assert(ssh->packet_dispatch[qh->msg2] == NULL);
4048 ssh->packet_dispatch[qh->msg2] = ssh_queueing_handler;
4051 ssh->qtail->next = qh;
4056 static void ssh_rportfwd_succfail(Ssh ssh, struct Packet *pktin, void *ctx)
4058 struct ssh_rportfwd *rpf, *pf = (struct ssh_rportfwd *)ctx;
4060 if (pktin->type == (ssh->version == 1 ? SSH1_SMSG_SUCCESS :
4061 SSH2_MSG_REQUEST_SUCCESS)) {
4062 logeventf(ssh, "Remote port forwarding from %s enabled",
4065 logeventf(ssh, "Remote port forwarding from %s refused",
4068 rpf = del234(ssh->rportfwds, pf);
4074 static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
4076 const char *portfwd_strptr = cfg->portfwd;
4077 struct ssh_portfwd *epf;
4080 if (!ssh->portfwds) {
4081 ssh->portfwds = newtree234(ssh_portcmp);
4084 * Go through the existing port forwardings and tag them
4085 * with status==DESTROY. Any that we want to keep will be
4086 * re-enabled (status==KEEP) as we go through the
4087 * configuration and find out which bits are the same as
4090 struct ssh_portfwd *epf;
4092 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4093 epf->status = DESTROY;
4096 while (*portfwd_strptr) {
4097 char address_family, type;
4098 int sport,dport,sserv,dserv;
4099 char sports[256], dports[256], saddr[256], host[256];
4102 address_family = 'A';
4104 if (*portfwd_strptr == 'A' ||
4105 *portfwd_strptr == '4' ||
4106 *portfwd_strptr == '6')
4107 address_family = *portfwd_strptr++;
4108 if (*portfwd_strptr == 'L' ||
4109 *portfwd_strptr == 'R' ||
4110 *portfwd_strptr == 'D')
4111 type = *portfwd_strptr++;
4116 while (*portfwd_strptr && *portfwd_strptr != '\t') {
4117 if (*portfwd_strptr == ':') {
4119 * We've seen a colon in the middle of the
4120 * source port number. This means that
4121 * everything we've seen until now is the
4122 * source _address_, so we'll move it into
4123 * saddr and start sports from the beginning
4128 if (ssh->version == 1 && type == 'R') {
4129 logeventf(ssh, "SSH-1 cannot handle remote source address "
4130 "spec \"%s\"; ignoring", sports);
4132 strcpy(saddr, sports);
4135 if (n < lenof(sports)-1) sports[n++] = *portfwd_strptr++;
4139 if (*portfwd_strptr == '\t')
4142 while (*portfwd_strptr && *portfwd_strptr != ':') {
4143 if (n < lenof(host)-1) host[n++] = *portfwd_strptr++;
4146 if (*portfwd_strptr == ':')
4149 while (*portfwd_strptr) {
4150 if (n < lenof(dports)-1) dports[n++] = *portfwd_strptr++;
4154 dport = atoi(dports);
4158 dport = net_service_lookup(dports);
4160 logeventf(ssh, "Service lookup failed for destination"
4161 " port \"%s\"", dports);
4165 while (*portfwd_strptr) portfwd_strptr++;
4169 portfwd_strptr++; /* eat the NUL and move to next one */
4171 sport = atoi(sports);
4175 sport = net_service_lookup(sports);
4177 logeventf(ssh, "Service lookup failed for source"
4178 " port \"%s\"", sports);
4181 if (sport && dport) {
4182 /* Set up a description of the source port. */
4183 struct ssh_portfwd *pfrec, *epfrec;
4185 pfrec = snew(struct ssh_portfwd);
4187 pfrec->saddr = *saddr ? dupstr(saddr) : NULL;
4188 pfrec->sserv = sserv ? dupstr(sports) : NULL;
4189 pfrec->sport = sport;
4190 pfrec->daddr = *host ? dupstr(host) : NULL;
4191 pfrec->dserv = dserv ? dupstr(dports) : NULL;
4192 pfrec->dport = dport;
4193 pfrec->local = NULL;
4194 pfrec->remote = NULL;
4195 pfrec->addressfamily = (address_family == '4' ? ADDRTYPE_IPV4 :
4196 address_family == '6' ? ADDRTYPE_IPV6 :
4199 epfrec = add234(ssh->portfwds, pfrec);
4200 if (epfrec != pfrec) {
4202 * We already have a port forwarding with precisely
4203 * these parameters. Hence, no need to do anything;
4204 * simply tag the existing one as KEEP.
4206 epfrec->status = KEEP;
4207 free_portfwd(pfrec);
4209 pfrec->status = CREATE;
4215 * Now go through and destroy any port forwardings which were
4218 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4219 if (epf->status == DESTROY) {
4222 message = dupprintf("%s port forwarding from %s%s%d",
4223 epf->type == 'L' ? "local" :
4224 epf->type == 'R' ? "remote" : "dynamic",
4225 epf->saddr ? epf->saddr : "",
4226 epf->saddr ? ":" : "",
4229 if (epf->type != 'D') {
4230 char *msg2 = dupprintf("%s to %s:%d", message,
4231 epf->daddr, epf->dport);
4236 logeventf(ssh, "Cancelling %s", message);
4240 struct ssh_rportfwd *rpf = epf->remote;
4241 struct Packet *pktout;
4244 * Cancel the port forwarding at the server
4247 if (ssh->version == 1) {
4249 * We cannot cancel listening ports on the
4250 * server side in SSH-1! There's no message
4251 * to support it. Instead, we simply remove
4252 * the rportfwd record from the local end
4253 * so that any connections the server tries
4254 * to make on it are rejected.
4257 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4258 ssh2_pkt_addstring(pktout, "cancel-tcpip-forward");
4259 ssh2_pkt_addbool(pktout, 0);/* _don't_ want reply */
4261 ssh2_pkt_addstring(pktout, epf->saddr);
4262 } else if (ssh->cfg.rport_acceptall) {
4263 /* XXX: ssh->cfg.rport_acceptall may not represent
4264 * what was used to open the original connection,
4265 * since it's reconfigurable. */
4266 ssh2_pkt_addstring(pktout, "0.0.0.0");
4268 ssh2_pkt_addstring(pktout, "127.0.0.1");
4270 ssh2_pkt_adduint32(pktout, epf->sport);
4271 ssh2_pkt_send(ssh, pktout);
4274 del234(ssh->rportfwds, rpf);
4276 } else if (epf->local) {
4277 pfd_terminate(epf->local);
4280 delpos234(ssh->portfwds, i);
4282 i--; /* so we don't skip one in the list */
4286 * And finally, set up any new port forwardings (status==CREATE).
4288 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4289 if (epf->status == CREATE) {
4290 char *sportdesc, *dportdesc;
4291 sportdesc = dupprintf("%s%s%s%s%d%s",
4292 epf->saddr ? epf->saddr : "",
4293 epf->saddr ? ":" : "",
4294 epf->sserv ? epf->sserv : "",
4295 epf->sserv ? "(" : "",
4297 epf->sserv ? ")" : "");
4298 if (epf->type == 'D') {
4301 dportdesc = dupprintf("%s:%s%s%d%s",
4303 epf->dserv ? epf->dserv : "",
4304 epf->dserv ? "(" : "",
4306 epf->dserv ? ")" : "");
4309 if (epf->type == 'L') {
4310 const char *err = pfd_addforward(epf->daddr, epf->dport,
4311 epf->saddr, epf->sport,
4314 epf->addressfamily);
4316 logeventf(ssh, "Local %sport %s forwarding to %s%s%s",
4317 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4318 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4319 sportdesc, dportdesc,
4320 err ? " failed: " : "", err ? err : "");
4321 } else if (epf->type == 'D') {
4322 const char *err = pfd_addforward(NULL, -1,
4323 epf->saddr, epf->sport,
4326 epf->addressfamily);
4328 logeventf(ssh, "Local %sport %s SOCKS dynamic forwarding%s%s",
4329 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4330 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4332 err ? " failed: " : "", err ? err : "");
4334 struct ssh_rportfwd *pf;
4337 * Ensure the remote port forwardings tree exists.
4339 if (!ssh->rportfwds) {
4340 if (ssh->version == 1)
4341 ssh->rportfwds = newtree234(ssh_rportcmp_ssh1);
4343 ssh->rportfwds = newtree234(ssh_rportcmp_ssh2);
4346 pf = snew(struct ssh_rportfwd);
4347 strncpy(pf->dhost, epf->daddr, lenof(pf->dhost)-1);
4348 pf->dhost[lenof(pf->dhost)-1] = '\0';
4349 pf->dport = epf->dport;
4350 pf->sport = epf->sport;
4351 if (add234(ssh->rportfwds, pf) != pf) {
4352 logeventf(ssh, "Duplicate remote port forwarding to %s:%d",
4353 epf->daddr, epf->dport);
4356 logeventf(ssh, "Requesting remote port %s"
4357 " forward to %s", sportdesc, dportdesc);
4359 pf->sportdesc = sportdesc;
4364 if (ssh->version == 1) {
4365 send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST,
4366 PKT_INT, epf->sport,
4367 PKT_STR, epf->daddr,
4368 PKT_INT, epf->dport,
4370 ssh_queue_handler(ssh, SSH1_SMSG_SUCCESS,
4372 ssh_rportfwd_succfail, pf);
4374 struct Packet *pktout;
4375 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4376 ssh2_pkt_addstring(pktout, "tcpip-forward");
4377 ssh2_pkt_addbool(pktout, 1);/* want reply */
4379 ssh2_pkt_addstring(pktout, epf->saddr);
4380 } else if (cfg->rport_acceptall) {
4381 ssh2_pkt_addstring(pktout, "0.0.0.0");
4383 ssh2_pkt_addstring(pktout, "127.0.0.1");
4385 ssh2_pkt_adduint32(pktout, epf->sport);
4386 ssh2_pkt_send(ssh, pktout);
4388 ssh_queue_handler(ssh, SSH2_MSG_REQUEST_SUCCESS,
4389 SSH2_MSG_REQUEST_FAILURE,
4390 ssh_rportfwd_succfail, pf);
4399 static void ssh1_smsg_stdout_stderr_data(Ssh ssh, struct Packet *pktin)
4402 int stringlen, bufsize;
4404 ssh_pkt_getstring(pktin, &string, &stringlen);
4405 if (string == NULL) {
4406 bombout(("Incoming terminal data packet was badly formed"));
4410 bufsize = from_backend(ssh->frontend, pktin->type == SSH1_SMSG_STDERR_DATA,
4412 if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
4413 ssh->v1_stdout_throttling = 1;
4414 ssh1_throttle(ssh, +1);
4418 static void ssh1_smsg_x11_open(Ssh ssh, struct Packet *pktin)
4420 /* Remote side is trying to open a channel to talk to our
4421 * X-Server. Give them back a local channel number. */
4422 struct ssh_channel *c;
4423 int remoteid = ssh_pkt_getuint32(pktin);
4425 logevent("Received X11 connect request");
4426 /* Refuse if X11 forwarding is disabled. */
4427 if (!ssh->X11_fwd_enabled) {
4428 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4429 PKT_INT, remoteid, PKT_END);
4430 logevent("Rejected X11 connect request");
4432 c = snew(struct ssh_channel);
4435 if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c,
4436 ssh->x11auth, NULL, -1, &ssh->cfg) != NULL) {
4437 logevent("Opening X11 forward connection failed");
4439 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4440 PKT_INT, remoteid, PKT_END);
4443 ("Opening X11 forward connection succeeded");
4444 c->remoteid = remoteid;
4445 c->halfopen = FALSE;
4446 c->localid = alloc_channel_id(ssh);
4448 c->v.v1.throttling = 0;
4449 c->type = CHAN_X11; /* identify channel type */
4450 add234(ssh->channels, c);
4451 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4452 PKT_INT, c->remoteid, PKT_INT,
4453 c->localid, PKT_END);
4454 logevent("Opened X11 forward channel");
4459 static void ssh1_smsg_agent_open(Ssh ssh, struct Packet *pktin)
4461 /* Remote side is trying to open a channel to talk to our
4462 * agent. Give them back a local channel number. */
4463 struct ssh_channel *c;
4464 int remoteid = ssh_pkt_getuint32(pktin);
4466 /* Refuse if agent forwarding is disabled. */
4467 if (!ssh->agentfwd_enabled) {
4468 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4469 PKT_INT, remoteid, PKT_END);
4471 c = snew(struct ssh_channel);
4473 c->remoteid = remoteid;
4474 c->halfopen = FALSE;
4475 c->localid = alloc_channel_id(ssh);
4477 c->v.v1.throttling = 0;
4478 c->type = CHAN_AGENT; /* identify channel type */
4479 c->u.a.lensofar = 0;
4480 add234(ssh->channels, c);
4481 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4482 PKT_INT, c->remoteid, PKT_INT, c->localid,
4487 static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin)
4489 /* Remote side is trying to open a channel to talk to a
4490 * forwarded port. Give them back a local channel number. */
4491 struct ssh_channel *c;
4492 struct ssh_rportfwd pf, *pfp;
4497 c = snew(struct ssh_channel);
4500 remoteid = ssh_pkt_getuint32(pktin);
4501 ssh_pkt_getstring(pktin, &host, &hostsize);
4502 port = ssh_pkt_getuint32(pktin);
4504 if (hostsize >= lenof(pf.dhost))
4505 hostsize = lenof(pf.dhost)-1;
4506 memcpy(pf.dhost, host, hostsize);
4507 pf.dhost[hostsize] = '\0';
4509 pfp = find234(ssh->rportfwds, &pf, NULL);
4512 logeventf(ssh, "Rejected remote port open request for %s:%d",
4514 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4515 PKT_INT, remoteid, PKT_END);
4517 logeventf(ssh, "Received remote port open request for %s:%d",
4519 e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port,
4520 c, &ssh->cfg, pfp->pfrec->addressfamily);
4522 logeventf(ssh, "Port open failed: %s", e);
4524 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4525 PKT_INT, remoteid, PKT_END);
4527 c->remoteid = remoteid;
4528 c->halfopen = FALSE;
4529 c->localid = alloc_channel_id(ssh);
4531 c->v.v1.throttling = 0;
4532 c->type = CHAN_SOCKDATA; /* identify channel type */
4533 add234(ssh->channels, c);
4534 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4535 PKT_INT, c->remoteid, PKT_INT,
4536 c->localid, PKT_END);
4537 logevent("Forwarded port opened successfully");
4542 static void ssh1_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
4544 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4545 unsigned int localid = ssh_pkt_getuint32(pktin);
4546 struct ssh_channel *c;
4548 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4549 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4550 c->remoteid = localid;
4551 c->halfopen = FALSE;
4552 c->type = CHAN_SOCKDATA;
4553 c->v.v1.throttling = 0;
4554 pfd_confirm(c->u.pfd.s);
4557 if (c && c->closes) {
4559 * We have a pending close on this channel,
4560 * which we decided on before the server acked
4561 * the channel open. So now we know the
4562 * remoteid, we can close it again.
4564 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE,
4565 PKT_INT, c->remoteid, PKT_END);
4569 static void ssh1_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
4571 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4572 struct ssh_channel *c;
4574 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4575 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4576 logevent("Forwarded connection refused by server");
4577 pfd_close(c->u.pfd.s);
4578 del234(ssh->channels, c);
4583 static void ssh1_msg_channel_close(Ssh ssh, struct Packet *pktin)
4585 /* Remote side closes a channel. */
4586 unsigned i = ssh_pkt_getuint32(pktin);
4587 struct ssh_channel *c;
4588 c = find234(ssh->channels, &i, ssh_channelfind);
4589 if (c && !c->halfopen) {
4592 (pktin->type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2);
4594 if ((c->closes == 0) && (c->type == CHAN_X11)) {
4595 logevent("Forwarded X11 connection terminated");
4596 assert(c->u.x11.s != NULL);
4597 x11_close(c->u.x11.s);
4600 if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) {
4601 logevent("Forwarded port closed");
4602 assert(c->u.pfd.s != NULL);
4603 pfd_close(c->u.pfd.s);
4607 c->closes |= (closetype << 2); /* seen this message */
4608 if (!(c->closes & closetype)) {
4609 send_packet(ssh, pktin->type, PKT_INT, c->remoteid,
4611 c->closes |= closetype; /* sent it too */
4614 if (c->closes == 15) {
4615 del234(ssh->channels, c);
4619 bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n",
4620 pktin->type == SSH1_MSG_CHANNEL_CLOSE ? "" :
4621 "_CONFIRMATION", c ? "half-open" : "nonexistent",
4626 static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin)
4628 /* Data sent down one of our channels. */
4629 int i = ssh_pkt_getuint32(pktin);
4632 struct ssh_channel *c;
4634 ssh_pkt_getstring(pktin, &p, &len);
4636 c = find234(ssh->channels, &i, ssh_channelfind);
4641 bufsize = x11_send(c->u.x11.s, p, len);
4644 bufsize = pfd_send(c->u.pfd.s, p, len);
4647 /* Data for an agent message. Buffer it. */
4649 if (c->u.a.lensofar < 4) {
4650 unsigned int l = min(4 - c->u.a.lensofar, (unsigned)len);
4651 memcpy(c->u.a.msglen + c->u.a.lensofar, p,
4655 c->u.a.lensofar += l;
4657 if (c->u.a.lensofar == 4) {
4659 4 + GET_32BIT(c->u.a.msglen);
4660 c->u.a.message = snewn(c->u.a.totallen,
4662 memcpy(c->u.a.message, c->u.a.msglen, 4);
4664 if (c->u.a.lensofar >= 4 && len > 0) {
4666 min(c->u.a.totallen - c->u.a.lensofar,
4668 memcpy(c->u.a.message + c->u.a.lensofar, p,
4672 c->u.a.lensofar += l;
4674 if (c->u.a.lensofar == c->u.a.totallen) {
4677 if (agent_query(c->u.a.message,
4680 ssh_agentf_callback, c))
4681 ssh_agentf_callback(c, reply, replylen);
4682 sfree(c->u.a.message);
4683 c->u.a.lensofar = 0;
4686 bufsize = 0; /* agent channels never back up */
4689 if (!c->v.v1.throttling && bufsize > SSH1_BUFFER_LIMIT) {
4690 c->v.v1.throttling = 1;
4691 ssh1_throttle(ssh, +1);
4696 static void ssh1_smsg_exit_status(Ssh ssh, struct Packet *pktin)
4698 ssh->exitcode = ssh_pkt_getuint32(pktin);
4699 logeventf(ssh, "Server sent command exit status %d", ssh->exitcode);
4700 send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
4702 * In case `helpful' firewalls or proxies tack
4703 * extra human-readable text on the end of the
4704 * session which we might mistake for another
4705 * encrypted packet, we close the session once
4706 * we've sent EXIT_CONFIRMATION.
4708 ssh_disconnect(ssh, NULL, NULL, 0, TRUE);
4711 /* Helper function to deal with sending tty modes for REQUEST_PTY */
4712 static void ssh1_send_ttymode(void *data, char *mode, char *val)
4714 struct Packet *pktout = (struct Packet *)data;
4716 unsigned int arg = 0;
4717 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
4718 if (i == lenof(ssh_ttymodes)) return;
4719 switch (ssh_ttymodes[i].type) {
4721 arg = ssh_tty_parse_specchar(val);
4724 arg = ssh_tty_parse_boolean(val);
4727 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
4728 ssh2_pkt_addbyte(pktout, arg);
4732 static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
4733 struct Packet *pktin)
4735 crBegin(ssh->do_ssh1_connection_crstate);
4737 ssh->packet_dispatch[SSH1_SMSG_STDOUT_DATA] =
4738 ssh->packet_dispatch[SSH1_SMSG_STDERR_DATA] =
4739 ssh1_smsg_stdout_stderr_data;
4741 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_CONFIRMATION] =
4742 ssh1_msg_channel_open_confirmation;
4743 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_FAILURE] =
4744 ssh1_msg_channel_open_failure;
4745 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE] =
4746 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION] =
4747 ssh1_msg_channel_close;
4748 ssh->packet_dispatch[SSH1_MSG_CHANNEL_DATA] = ssh1_msg_channel_data;
4749 ssh->packet_dispatch[SSH1_SMSG_EXIT_STATUS] = ssh1_smsg_exit_status;
4751 if (ssh->cfg.agentfwd && agent_exists()) {
4752 logevent("Requesting agent forwarding");
4753 send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END);
4757 if (pktin->type != SSH1_SMSG_SUCCESS
4758 && pktin->type != SSH1_SMSG_FAILURE) {
4759 bombout(("Protocol confusion"));
4761 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4762 logevent("Agent forwarding refused");
4764 logevent("Agent forwarding enabled");
4765 ssh->agentfwd_enabled = TRUE;
4766 ssh->packet_dispatch[SSH1_SMSG_AGENT_OPEN] = ssh1_smsg_agent_open;
4770 if (ssh->cfg.x11_forward) {
4771 char proto[20], data[64];
4772 logevent("Requesting X11 forwarding");
4773 ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
4774 data, sizeof(data), ssh->cfg.x11_auth);
4775 x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display);
4777 * Note that while we blank the X authentication data here, we don't
4778 * take any special action to blank the start of an X11 channel,
4779 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
4780 * without having session blanking enabled is likely to leak your
4781 * cookie into the log.
4783 if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) {
4784 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
4786 PKTT_PASSWORD, PKT_STR, data, PKTT_OTHER,
4787 PKT_INT, x11_get_screen_number(ssh->cfg.x11_display),
4790 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
4792 PKTT_PASSWORD, PKT_STR, data, PKTT_OTHER, PKT_END);
4797 if (pktin->type != SSH1_SMSG_SUCCESS
4798 && pktin->type != SSH1_SMSG_FAILURE) {
4799 bombout(("Protocol confusion"));
4801 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4802 logevent("X11 forwarding refused");
4804 logevent("X11 forwarding enabled");
4805 ssh->X11_fwd_enabled = TRUE;
4806 ssh->packet_dispatch[SSH1_SMSG_X11_OPEN] = ssh1_smsg_x11_open;
4810 ssh_setup_portfwd(ssh, &ssh->cfg);
4811 ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = ssh1_msg_port_open;
4813 if (!ssh->cfg.nopty) {
4815 /* Unpick the terminal-speed string. */
4816 /* XXX perhaps we should allow no speeds to be sent. */
4817 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
4818 sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
4819 /* Send the pty request. */
4820 pkt = ssh1_pkt_init(SSH1_CMSG_REQUEST_PTY);
4821 ssh_pkt_addstring(pkt, ssh->cfg.termtype);
4822 ssh_pkt_adduint32(pkt, ssh->term_height);
4823 ssh_pkt_adduint32(pkt, ssh->term_width);
4824 ssh_pkt_adduint32(pkt, 0); /* width in pixels */
4825 ssh_pkt_adduint32(pkt, 0); /* height in pixels */
4826 parse_ttymodes(ssh, ssh->cfg.ttymodes,
4827 ssh1_send_ttymode, (void *)pkt);
4828 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_ISPEED);
4829 ssh_pkt_adduint32(pkt, ssh->ispeed);
4830 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_OSPEED);
4831 ssh_pkt_adduint32(pkt, ssh->ospeed);
4832 ssh_pkt_addbyte(pkt, SSH_TTY_OP_END);
4834 ssh->state = SSH_STATE_INTERMED;
4838 if (pktin->type != SSH1_SMSG_SUCCESS
4839 && pktin->type != SSH1_SMSG_FAILURE) {
4840 bombout(("Protocol confusion"));
4842 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4843 c_write_str(ssh, "Server refused to allocate pty\r\n");
4844 ssh->editing = ssh->echoing = 1;
4846 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
4847 ssh->ospeed, ssh->ispeed);
4849 ssh->editing = ssh->echoing = 1;
4852 if (ssh->cfg.compression) {
4853 send_packet(ssh, SSH1_CMSG_REQUEST_COMPRESSION, PKT_INT, 6, PKT_END);
4857 if (pktin->type != SSH1_SMSG_SUCCESS
4858 && pktin->type != SSH1_SMSG_FAILURE) {
4859 bombout(("Protocol confusion"));
4861 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4862 c_write_str(ssh, "Server refused to compress\r\n");
4864 logevent("Started compression");
4865 ssh->v1_compressing = TRUE;
4866 ssh->cs_comp_ctx = zlib_compress_init();
4867 logevent("Initialised zlib (RFC1950) compression");
4868 ssh->sc_comp_ctx = zlib_decompress_init();
4869 logevent("Initialised zlib (RFC1950) decompression");
4873 * Start the shell or command.
4875 * Special case: if the first-choice command is an SSH-2
4876 * subsystem (hence not usable here) and the second choice
4877 * exists, we fall straight back to that.
4880 char *cmd = ssh->cfg.remote_cmd_ptr;
4882 if (!cmd) cmd = ssh->cfg.remote_cmd;
4884 if (ssh->cfg.ssh_subsys && ssh->cfg.remote_cmd_ptr2) {
4885 cmd = ssh->cfg.remote_cmd_ptr2;
4886 ssh->fallback_cmd = TRUE;
4889 send_packet(ssh, SSH1_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END);
4891 send_packet(ssh, SSH1_CMSG_EXEC_SHELL, PKT_END);
4892 logevent("Started session");
4895 ssh->state = SSH_STATE_SESSION;
4896 if (ssh->size_needed)
4897 ssh_size(ssh, ssh->term_width, ssh->term_height);
4898 if (ssh->eof_needed)
4899 ssh_special(ssh, TS_EOF);
4902 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
4904 ssh->channels = newtree234(ssh_channelcmp);
4908 * By this point, most incoming packets are already being
4909 * handled by the dispatch table, and we need only pay
4910 * attention to the unusual ones.
4915 if (pktin->type == SSH1_SMSG_SUCCESS) {
4916 /* may be from EXEC_SHELL on some servers */
4917 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4918 /* may be from EXEC_SHELL on some servers
4919 * if no pty is available or in other odd cases. Ignore */
4921 bombout(("Strange packet received: type %d", pktin->type));
4926 int len = min(inlen, 512);
4927 send_packet(ssh, SSH1_CMSG_STDIN_DATA, PKTT_DATA,
4928 PKT_INT, len, PKT_DATA, in, len,
4929 PKTT_OTHER, PKT_END);
4940 * Handle the top-level SSH-2 protocol.
4942 static void ssh1_msg_debug(Ssh ssh, struct Packet *pktin)
4947 ssh_pkt_getstring(pktin, &msg, &msglen);
4948 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
4951 static void ssh1_msg_disconnect(Ssh ssh, struct Packet *pktin)
4953 /* log reason code in disconnect message */
4957 ssh_pkt_getstring(pktin, &msg, &msglen);
4958 bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg));
4961 static void ssh_msg_ignore(Ssh ssh, struct Packet *pktin)
4963 /* Do nothing, because we're ignoring it! Duhh. */
4966 static void ssh1_protocol_setup(Ssh ssh)
4971 * Most messages are handled by the coroutines.
4973 for (i = 0; i < 256; i++)
4974 ssh->packet_dispatch[i] = NULL;
4977 * These special message types we install handlers for.
4979 ssh->packet_dispatch[SSH1_MSG_DISCONNECT] = ssh1_msg_disconnect;
4980 ssh->packet_dispatch[SSH1_MSG_IGNORE] = ssh_msg_ignore;
4981 ssh->packet_dispatch[SSH1_MSG_DEBUG] = ssh1_msg_debug;
4984 static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
4985 struct Packet *pktin)
4987 unsigned char *in=(unsigned char*)vin;
4988 if (ssh->state == SSH_STATE_CLOSED)
4991 if (pktin && ssh->packet_dispatch[pktin->type]) {
4992 ssh->packet_dispatch[pktin->type](ssh, pktin);
4996 if (!ssh->protocol_initial_phase_done) {
4997 if (do_ssh1_login(ssh, in, inlen, pktin))
4998 ssh->protocol_initial_phase_done = TRUE;
5003 do_ssh1_connection(ssh, in, inlen, pktin);
5007 * Utility routine for decoding comma-separated strings in KEXINIT.
5009 static int in_commasep_string(char *needle, char *haystack, int haylen)
5012 if (!needle || !haystack) /* protect against null pointers */
5014 needlen = strlen(needle);
5017 * Is it at the start of the string?
5019 if (haylen >= needlen && /* haystack is long enough */
5020 !memcmp(needle, haystack, needlen) && /* initial match */
5021 (haylen == needlen || haystack[needlen] == ',')
5022 /* either , or EOS follows */
5026 * If not, search for the next comma and resume after that.
5027 * If no comma found, terminate.
5029 while (haylen > 0 && *haystack != ',')
5030 haylen--, haystack++;
5033 haylen--, haystack++; /* skip over comma itself */
5038 * Similar routine for checking whether we have the first string in a list.
5040 static int first_in_commasep_string(char *needle, char *haystack, int haylen)
5043 if (!needle || !haystack) /* protect against null pointers */
5045 needlen = strlen(needle);
5047 * Is it at the start of the string?
5049 if (haylen >= needlen && /* haystack is long enough */
5050 !memcmp(needle, haystack, needlen) && /* initial match */
5051 (haylen == needlen || haystack[needlen] == ',')
5052 /* either , or EOS follows */
5060 * SSH-2 key creation method.
5061 * (Currently assumes 2 lots of any hash are sufficient to generate
5062 * keys/IVs for any cipher/MAC. SSH2_MKKEY_ITERS documents this assumption.)
5064 #define SSH2_MKKEY_ITERS (2)
5065 static void ssh2_mkkey(Ssh ssh, Bignum K, unsigned char *H, char chr,
5066 unsigned char *keyspace)
5068 const struct ssh_hash *h = ssh->kex->hash;
5070 /* First hlen bytes. */
5072 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
5073 hash_mpint(h, s, K);
5074 h->bytes(s, H, h->hlen);
5075 h->bytes(s, &chr, 1);
5076 h->bytes(s, ssh->v2_session_id, ssh->v2_session_id_len);
5077 h->final(s, keyspace);
5078 /* Next hlen bytes. */
5080 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
5081 hash_mpint(h, s, K);
5082 h->bytes(s, H, h->hlen);
5083 h->bytes(s, keyspace, h->hlen);
5084 h->final(s, keyspace + h->hlen);
5088 * Handle the SSH-2 transport layer.
5090 static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
5091 struct Packet *pktin)
5093 unsigned char *in = (unsigned char *)vin;
5094 struct do_ssh2_transport_state {
5095 int nbits, pbits, warn_kex, warn_cscipher, warn_sccipher;
5096 Bignum p, g, e, f, K;
5099 int kex_init_value, kex_reply_value;
5100 const struct ssh_mac **maclist;
5102 const struct ssh2_cipher *cscipher_tobe;
5103 const struct ssh2_cipher *sccipher_tobe;
5104 const struct ssh_mac *csmac_tobe;
5105 const struct ssh_mac *scmac_tobe;
5106 const struct ssh_compress *cscomp_tobe;
5107 const struct ssh_compress *sccomp_tobe;
5108 char *hostkeydata, *sigdata, *keystr, *fingerprint;
5109 int hostkeylen, siglen;
5110 void *hkey; /* actual host key */
5111 unsigned char exchange_hash[SSH2_KEX_MAX_HASH_LEN];
5112 int n_preferred_kex;
5113 const struct ssh_kexes *preferred_kex[KEX_MAX];
5114 int n_preferred_ciphers;
5115 const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX];
5116 const struct ssh_compress *preferred_comp;
5117 int got_session_id, activated_authconn;
5118 struct Packet *pktout;
5123 crState(do_ssh2_transport_state);
5125 crBegin(ssh->do_ssh2_transport_crstate);
5127 s->cscipher_tobe = s->sccipher_tobe = NULL;
5128 s->csmac_tobe = s->scmac_tobe = NULL;
5129 s->cscomp_tobe = s->sccomp_tobe = NULL;
5131 s->got_session_id = s->activated_authconn = FALSE;
5134 * Be prepared to work around the buggy MAC problem.
5136 if (ssh->remote_bugs & BUG_SSH2_HMAC)
5137 s->maclist = buggymacs, s->nmacs = lenof(buggymacs);
5139 s->maclist = macs, s->nmacs = lenof(macs);
5142 ssh->pkt_ctx &= ~SSH2_PKTCTX_KEX_MASK;
5144 int i, j, commalist_started;
5147 * Set up the preferred key exchange. (NULL => warn below here)
5149 s->n_preferred_kex = 0;
5150 for (i = 0; i < KEX_MAX; i++) {
5151 switch (ssh->cfg.ssh_kexlist[i]) {
5153 s->preferred_kex[s->n_preferred_kex++] =
5154 &ssh_diffiehellman_gex;
5157 s->preferred_kex[s->n_preferred_kex++] =
5158 &ssh_diffiehellman_group14;
5161 s->preferred_kex[s->n_preferred_kex++] =
5162 &ssh_diffiehellman_group1;
5165 /* Flag for later. Don't bother if it's the last in
5167 if (i < KEX_MAX - 1) {
5168 s->preferred_kex[s->n_preferred_kex++] = NULL;
5175 * Set up the preferred ciphers. (NULL => warn below here)
5177 s->n_preferred_ciphers = 0;
5178 for (i = 0; i < CIPHER_MAX; i++) {
5179 switch (ssh->cfg.ssh_cipherlist[i]) {
5180 case CIPHER_BLOWFISH:
5181 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_blowfish;
5184 if (ssh->cfg.ssh2_des_cbc) {
5185 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_des;
5189 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_3des;
5192 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_aes;
5194 case CIPHER_ARCFOUR:
5195 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_arcfour;
5198 /* Flag for later. Don't bother if it's the last in
5200 if (i < CIPHER_MAX - 1) {
5201 s->preferred_ciphers[s->n_preferred_ciphers++] = NULL;
5208 * Set up preferred compression.
5210 if (ssh->cfg.compression)
5211 s->preferred_comp = &ssh_zlib;
5213 s->preferred_comp = &ssh_comp_none;
5216 * Enable queueing of outgoing auth- or connection-layer
5217 * packets while we are in the middle of a key exchange.
5219 ssh->queueing = TRUE;
5222 * Flag that KEX is in progress.
5224 ssh->kex_in_progress = TRUE;
5227 * Construct and send our key exchange packet.
5229 s->pktout = ssh2_pkt_init(SSH2_MSG_KEXINIT);
5230 for (i = 0; i < 16; i++)
5231 ssh2_pkt_addbyte(s->pktout, (unsigned char) random_byte());
5232 /* List key exchange algorithms. */
5233 ssh2_pkt_addstring_start(s->pktout);
5234 commalist_started = 0;
5235 for (i = 0; i < s->n_preferred_kex; i++) {
5236 const struct ssh_kexes *k = s->preferred_kex[i];
5237 if (!k) continue; /* warning flag */
5238 for (j = 0; j < k->nkexes; j++) {
5239 if (commalist_started)
5240 ssh2_pkt_addstring_str(s->pktout, ",");
5241 ssh2_pkt_addstring_str(s->pktout, k->list[j]->name);
5242 commalist_started = 1;
5245 /* List server host key algorithms. */
5246 ssh2_pkt_addstring_start(s->pktout);
5247 for (i = 0; i < lenof(hostkey_algs); i++) {
5248 ssh2_pkt_addstring_str(s->pktout, hostkey_algs[i]->name);
5249 if (i < lenof(hostkey_algs) - 1)
5250 ssh2_pkt_addstring_str(s->pktout, ",");
5252 /* List client->server encryption algorithms. */
5253 ssh2_pkt_addstring_start(s->pktout);
5254 commalist_started = 0;
5255 for (i = 0; i < s->n_preferred_ciphers; i++) {
5256 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5257 if (!c) continue; /* warning flag */
5258 for (j = 0; j < c->nciphers; j++) {
5259 if (commalist_started)
5260 ssh2_pkt_addstring_str(s->pktout, ",");
5261 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
5262 commalist_started = 1;
5265 /* List server->client encryption algorithms. */
5266 ssh2_pkt_addstring_start(s->pktout);
5267 commalist_started = 0;
5268 for (i = 0; i < s->n_preferred_ciphers; i++) {
5269 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5270 if (!c) continue; /* warning flag */
5271 for (j = 0; j < c->nciphers; j++) {
5272 if (commalist_started)
5273 ssh2_pkt_addstring_str(s->pktout, ",");
5274 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
5275 commalist_started = 1;
5278 /* List client->server MAC algorithms. */
5279 ssh2_pkt_addstring_start(s->pktout);
5280 for (i = 0; i < s->nmacs; i++) {
5281 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
5282 if (i < s->nmacs - 1)
5283 ssh2_pkt_addstring_str(s->pktout, ",");
5285 /* List server->client MAC algorithms. */
5286 ssh2_pkt_addstring_start(s->pktout);
5287 for (i = 0; i < s->nmacs; i++) {
5288 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
5289 if (i < s->nmacs - 1)
5290 ssh2_pkt_addstring_str(s->pktout, ",");
5292 /* List client->server compression algorithms. */
5293 ssh2_pkt_addstring_start(s->pktout);
5294 assert(lenof(compressions) > 1);
5295 ssh2_pkt_addstring_str(s->pktout, s->preferred_comp->name);
5296 for (i = 0; i < lenof(compressions); i++) {
5297 const struct ssh_compress *c = compressions[i];
5298 if (c != s->preferred_comp) {
5299 ssh2_pkt_addstring_str(s->pktout, ",");
5300 ssh2_pkt_addstring_str(s->pktout, c->name);
5303 /* List server->client compression algorithms. */
5304 ssh2_pkt_addstring_start(s->pktout);
5305 assert(lenof(compressions) > 1);
5306 ssh2_pkt_addstring_str(s->pktout, s->preferred_comp->name);
5307 for (i = 0; i < lenof(compressions); i++) {
5308 const struct ssh_compress *c = compressions[i];
5309 if (c != s->preferred_comp) {
5310 ssh2_pkt_addstring_str(s->pktout, ",");
5311 ssh2_pkt_addstring_str(s->pktout, c->name);
5314 /* List client->server languages. Empty list. */
5315 ssh2_pkt_addstring_start(s->pktout);
5316 /* List server->client languages. Empty list. */
5317 ssh2_pkt_addstring_start(s->pktout);
5318 /* First KEX packet does _not_ follow, because we're not that brave. */
5319 ssh2_pkt_addbool(s->pktout, FALSE);
5321 ssh2_pkt_adduint32(s->pktout, 0);
5324 s->our_kexinitlen = s->pktout->length - 5;
5325 s->our_kexinit = snewn(s->our_kexinitlen, unsigned char);
5326 memcpy(s->our_kexinit, s->pktout->data + 5, s->our_kexinitlen);
5328 ssh2_pkt_send_noqueue(ssh, s->pktout);
5334 * Now examine the other side's KEXINIT to see what we're up
5338 char *str, *preferred;
5341 if (pktin->type != SSH2_MSG_KEXINIT) {
5342 bombout(("expected key exchange packet from server"));
5346 ssh->hostkey = NULL;
5347 s->cscipher_tobe = NULL;
5348 s->sccipher_tobe = NULL;
5349 s->csmac_tobe = NULL;
5350 s->scmac_tobe = NULL;
5351 s->cscomp_tobe = NULL;
5352 s->sccomp_tobe = NULL;
5353 s->warn_kex = s->warn_cscipher = s->warn_sccipher = FALSE;
5355 pktin->savedpos += 16; /* skip garbage cookie */
5356 ssh_pkt_getstring(pktin, &str, &len); /* key exchange algorithms */
5359 for (i = 0; i < s->n_preferred_kex; i++) {
5360 const struct ssh_kexes *k = s->preferred_kex[i];
5364 for (j = 0; j < k->nkexes; j++) {
5365 if (!preferred) preferred = k->list[j]->name;
5366 if (in_commasep_string(k->list[j]->name, str, len)) {
5367 ssh->kex = k->list[j];
5376 bombout(("Couldn't agree a key exchange algorithm (available: %s)",
5377 str ? str : "(null)"));
5381 * Note that the server's guess is considered wrong if it doesn't match
5382 * the first algorithm in our list, even if it's still the algorithm
5385 s->guessok = first_in_commasep_string(preferred, str, len);
5386 ssh_pkt_getstring(pktin, &str, &len); /* host key algorithms */
5387 for (i = 0; i < lenof(hostkey_algs); i++) {
5388 if (in_commasep_string(hostkey_algs[i]->name, str, len)) {
5389 ssh->hostkey = hostkey_algs[i];
5393 s->guessok = s->guessok &&
5394 first_in_commasep_string(hostkey_algs[0]->name, str, len);
5395 ssh_pkt_getstring(pktin, &str, &len); /* client->server cipher */
5396 for (i = 0; i < s->n_preferred_ciphers; i++) {
5397 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5399 s->warn_cscipher = TRUE;
5401 for (j = 0; j < c->nciphers; j++) {
5402 if (in_commasep_string(c->list[j]->name, str, len)) {
5403 s->cscipher_tobe = c->list[j];
5408 if (s->cscipher_tobe)
5411 if (!s->cscipher_tobe) {
5412 bombout(("Couldn't agree a client-to-server cipher (available: %s)",
5413 str ? str : "(null)"));
5417 ssh_pkt_getstring(pktin, &str, &len); /* server->client cipher */
5418 for (i = 0; i < s->n_preferred_ciphers; i++) {
5419 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5421 s->warn_sccipher = TRUE;
5423 for (j = 0; j < c->nciphers; j++) {
5424 if (in_commasep_string(c->list[j]->name, str, len)) {
5425 s->sccipher_tobe = c->list[j];
5430 if (s->sccipher_tobe)
5433 if (!s->sccipher_tobe) {
5434 bombout(("Couldn't agree a server-to-client cipher (available: %s)",
5435 str ? str : "(null)"));
5439 ssh_pkt_getstring(pktin, &str, &len); /* client->server mac */
5440 for (i = 0; i < s->nmacs; i++) {
5441 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5442 s->csmac_tobe = s->maclist[i];
5446 ssh_pkt_getstring(pktin, &str, &len); /* server->client mac */
5447 for (i = 0; i < s->nmacs; i++) {
5448 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5449 s->scmac_tobe = s->maclist[i];
5453 ssh_pkt_getstring(pktin, &str, &len); /* client->server compression */
5454 for (i = 0; i < lenof(compressions) + 1; i++) {
5455 const struct ssh_compress *c =
5456 i == 0 ? s->preferred_comp : compressions[i - 1];
5457 if (in_commasep_string(c->name, str, len)) {
5462 ssh_pkt_getstring(pktin, &str, &len); /* server->client compression */
5463 for (i = 0; i < lenof(compressions) + 1; i++) {
5464 const struct ssh_compress *c =
5465 i == 0 ? s->preferred_comp : compressions[i - 1];
5466 if (in_commasep_string(c->name, str, len)) {
5471 ssh_pkt_getstring(pktin, &str, &len); /* client->server language */
5472 ssh_pkt_getstring(pktin, &str, &len); /* server->client language */
5473 s->ignorepkt = ssh2_pkt_getbool(pktin) && !s->guessok;
5476 ssh_set_frozen(ssh, 1);
5477 s->dlgret = askalg(ssh->frontend, "key-exchange algorithm",
5479 ssh_dialog_callback, ssh);
5480 if (s->dlgret < 0) {
5484 bombout(("Unexpected data from server while"
5485 " waiting for user response"));
5488 } while (pktin || inlen > 0);
5489 s->dlgret = ssh->user_response;
5491 ssh_set_frozen(ssh, 0);
5492 if (s->dlgret == 0) {
5493 ssh_disconnect(ssh, "User aborted at kex warning", NULL,
5499 if (s->warn_cscipher) {
5500 ssh_set_frozen(ssh, 1);
5501 s->dlgret = askalg(ssh->frontend,
5502 "client-to-server cipher",
5503 s->cscipher_tobe->name,
5504 ssh_dialog_callback, ssh);
5505 if (s->dlgret < 0) {
5509 bombout(("Unexpected data from server while"
5510 " waiting for user response"));
5513 } while (pktin || inlen > 0);
5514 s->dlgret = ssh->user_response;
5516 ssh_set_frozen(ssh, 0);
5517 if (s->dlgret == 0) {
5518 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5524 if (s->warn_sccipher) {
5525 ssh_set_frozen(ssh, 1);
5526 s->dlgret = askalg(ssh->frontend,
5527 "server-to-client cipher",
5528 s->sccipher_tobe->name,
5529 ssh_dialog_callback, ssh);
5530 if (s->dlgret < 0) {
5534 bombout(("Unexpected data from server while"
5535 " waiting for user response"));
5538 } while (pktin || inlen > 0);
5539 s->dlgret = ssh->user_response;
5541 ssh_set_frozen(ssh, 0);
5542 if (s->dlgret == 0) {
5543 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5549 ssh->exhash = ssh->kex->hash->init();
5550 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_c, strlen(ssh->v_c));
5551 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_s, strlen(ssh->v_s));
5552 hash_string(ssh->kex->hash, ssh->exhash,
5553 s->our_kexinit, s->our_kexinitlen);
5554 sfree(s->our_kexinit);
5555 if (pktin->length > 5)
5556 hash_string(ssh->kex->hash, ssh->exhash,
5557 pktin->data + 5, pktin->length - 5);
5559 if (s->ignorepkt) /* first_kex_packet_follows */
5560 crWaitUntil(pktin); /* Ignore packet */
5564 * Work out the number of bits of key we will need from the key
5565 * exchange. We start with the maximum key length of either
5571 csbits = s->cscipher_tobe->keylen;
5572 scbits = s->sccipher_tobe->keylen;
5573 s->nbits = (csbits > scbits ? csbits : scbits);
5575 /* The keys only have hlen-bit entropy, since they're based on
5576 * a hash. So cap the key size at hlen bits. */
5577 if (s->nbits > ssh->kex->hash->hlen * 8)
5578 s->nbits = ssh->kex->hash->hlen * 8;
5581 * If we're doing Diffie-Hellman group exchange, start by
5582 * requesting a group.
5584 if (!ssh->kex->pdata) {
5585 logevent("Doing Diffie-Hellman group exchange");
5586 ssh->pkt_ctx |= SSH2_PKTCTX_DHGEX;
5588 * Work out how big a DH group we will need to allow that
5591 s->pbits = 512 << ((s->nbits - 1) / 64);
5592 s->pktout = ssh2_pkt_init(SSH2_MSG_KEX_DH_GEX_REQUEST);
5593 ssh2_pkt_adduint32(s->pktout, s->pbits);
5594 ssh2_pkt_send_noqueue(ssh, s->pktout);
5597 if (pktin->type != SSH2_MSG_KEX_DH_GEX_GROUP) {
5598 bombout(("expected key exchange group packet from server"));
5601 s->p = ssh2_pkt_getmp(pktin);
5602 s->g = ssh2_pkt_getmp(pktin);
5603 if (!s->p || !s->g) {
5604 bombout(("unable to read mp-ints from incoming group packet"));
5607 ssh->kex_ctx = dh_setup_gex(s->p, s->g);
5608 s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT;
5609 s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY;
5611 ssh->pkt_ctx |= SSH2_PKTCTX_DHGROUP;
5612 ssh->kex_ctx = dh_setup_group(ssh->kex);
5613 s->kex_init_value = SSH2_MSG_KEXDH_INIT;
5614 s->kex_reply_value = SSH2_MSG_KEXDH_REPLY;
5615 logeventf(ssh, "Using Diffie-Hellman with standard group \"%s\"",
5616 ssh->kex->groupname);
5619 logeventf(ssh, "Doing Diffie-Hellman key exchange with hash %s",
5620 ssh->kex->hash->text_name);
5622 * Now generate and send e for Diffie-Hellman.
5624 set_busy_status(ssh->frontend, BUSY_CPU); /* this can take a while */
5625 s->e = dh_create_e(ssh->kex_ctx, s->nbits * 2);
5626 s->pktout = ssh2_pkt_init(s->kex_init_value);
5627 ssh2_pkt_addmp(s->pktout, s->e);
5628 ssh2_pkt_send_noqueue(ssh, s->pktout);
5630 set_busy_status(ssh->frontend, BUSY_WAITING); /* wait for server */
5632 if (pktin->type != s->kex_reply_value) {
5633 bombout(("expected key exchange reply packet from server"));
5636 set_busy_status(ssh->frontend, BUSY_CPU); /* cogitate */
5637 ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
5638 s->f = ssh2_pkt_getmp(pktin);
5640 bombout(("unable to parse key exchange reply packet"));
5643 ssh_pkt_getstring(pktin, &s->sigdata, &s->siglen);
5645 s->K = dh_find_K(ssh->kex_ctx, s->f);
5647 /* We assume everything from now on will be quick, and it might
5648 * involve user interaction. */
5649 set_busy_status(ssh->frontend, BUSY_NOT);
5651 hash_string(ssh->kex->hash, ssh->exhash, s->hostkeydata, s->hostkeylen);
5652 if (!ssh->kex->pdata) {
5653 hash_uint32(ssh->kex->hash, ssh->exhash, s->pbits);
5654 hash_mpint(ssh->kex->hash, ssh->exhash, s->p);
5655 hash_mpint(ssh->kex->hash, ssh->exhash, s->g);
5657 hash_mpint(ssh->kex->hash, ssh->exhash, s->e);
5658 hash_mpint(ssh->kex->hash, ssh->exhash, s->f);
5659 hash_mpint(ssh->kex->hash, ssh->exhash, s->K);
5660 assert(ssh->kex->hash->hlen <= sizeof(s->exchange_hash));
5661 ssh->kex->hash->final(ssh->exhash, s->exchange_hash);
5663 dh_cleanup(ssh->kex_ctx);
5664 ssh->kex_ctx = NULL;
5667 debug(("Exchange hash is:\n"));
5668 dmemdump(s->exchange_hash, ssh->kex->hash->hlen);
5671 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
5673 !ssh->hostkey->verifysig(s->hkey, s->sigdata, s->siglen,
5674 (char *)s->exchange_hash,
5675 ssh->kex->hash->hlen)) {
5676 bombout(("Server's host key did not match the signature supplied"));
5681 * Authenticate remote host: verify host key. (We've already
5682 * checked the signature of the exchange hash.)
5684 s->keystr = ssh->hostkey->fmtkey(s->hkey);
5685 s->fingerprint = ssh->hostkey->fingerprint(s->hkey);
5686 ssh_set_frozen(ssh, 1);
5687 s->dlgret = verify_ssh_host_key(ssh->frontend,
5688 ssh->savedhost, ssh->savedport,
5689 ssh->hostkey->keytype, s->keystr,
5691 ssh_dialog_callback, ssh);
5692 if (s->dlgret < 0) {
5696 bombout(("Unexpected data from server while waiting"
5697 " for user host key response"));
5700 } while (pktin || inlen > 0);
5701 s->dlgret = ssh->user_response;
5703 ssh_set_frozen(ssh, 0);
5704 if (s->dlgret == 0) {
5705 ssh_disconnect(ssh, "User aborted at host key verification", NULL,
5709 if (!s->got_session_id) { /* don't bother logging this in rekeys */
5710 logevent("Host key fingerprint is:");
5711 logevent(s->fingerprint);
5713 sfree(s->fingerprint);
5715 ssh->hostkey->freekey(s->hkey);
5718 * The exchange hash from the very first key exchange is also
5719 * the session id, used in session key construction and
5722 if (!s->got_session_id) {
5723 assert(sizeof(s->exchange_hash) <= sizeof(ssh->v2_session_id));
5724 memcpy(ssh->v2_session_id, s->exchange_hash,
5725 sizeof(s->exchange_hash));
5726 ssh->v2_session_id_len = ssh->kex->hash->hlen;
5727 assert(ssh->v2_session_id_len <= sizeof(ssh->v2_session_id));
5728 s->got_session_id = TRUE;
5732 * Send SSH2_MSG_NEWKEYS.
5734 s->pktout = ssh2_pkt_init(SSH2_MSG_NEWKEYS);
5735 ssh2_pkt_send_noqueue(ssh, s->pktout);
5736 ssh->outgoing_data_size = 0; /* start counting from here */
5739 * We've sent client NEWKEYS, so create and initialise
5740 * client-to-server session keys.
5742 if (ssh->cs_cipher_ctx)
5743 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
5744 ssh->cscipher = s->cscipher_tobe;
5745 ssh->cs_cipher_ctx = ssh->cscipher->make_context();
5747 if (ssh->cs_mac_ctx)
5748 ssh->csmac->free_context(ssh->cs_mac_ctx);
5749 ssh->csmac = s->csmac_tobe;
5750 ssh->cs_mac_ctx = ssh->csmac->make_context();
5752 if (ssh->cs_comp_ctx)
5753 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
5754 ssh->cscomp = s->cscomp_tobe;
5755 ssh->cs_comp_ctx = ssh->cscomp->compress_init();
5758 * Set IVs on client-to-server keys. Here we use the exchange
5759 * hash from the _first_ key exchange.
5762 unsigned char keyspace[SSH2_KEX_MAX_HASH_LEN * SSH2_MKKEY_ITERS];
5763 assert(sizeof(keyspace) >= ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5764 ssh2_mkkey(ssh,s->K,s->exchange_hash,'C',keyspace);
5765 assert((ssh->cscipher->keylen+7) / 8 <=
5766 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5767 ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace);
5768 ssh2_mkkey(ssh,s->K,s->exchange_hash,'A',keyspace);
5769 assert(ssh->cscipher->blksize <=
5770 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5771 ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace);
5772 ssh2_mkkey(ssh,s->K,s->exchange_hash,'E',keyspace);
5773 assert(ssh->csmac->len <=
5774 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5775 ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace);
5776 memset(keyspace, 0, sizeof(keyspace));
5779 logeventf(ssh, "Initialised %.200s client->server encryption",
5780 ssh->cscipher->text_name);
5781 logeventf(ssh, "Initialised %.200s client->server MAC algorithm",
5782 ssh->csmac->text_name);
5783 if (ssh->cscomp->text_name)
5784 logeventf(ssh, "Initialised %s compression",
5785 ssh->cscomp->text_name);
5788 * Now our end of the key exchange is complete, we can send all
5789 * our queued higher-layer packets.
5791 ssh->queueing = FALSE;
5792 ssh2_pkt_queuesend(ssh);
5795 * Expect SSH2_MSG_NEWKEYS from server.
5798 if (pktin->type != SSH2_MSG_NEWKEYS) {
5799 bombout(("expected new-keys packet from server"));
5802 ssh->incoming_data_size = 0; /* start counting from here */
5805 * We've seen server NEWKEYS, so create and initialise
5806 * server-to-client session keys.
5808 if (ssh->sc_cipher_ctx)
5809 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
5810 ssh->sccipher = s->sccipher_tobe;
5811 ssh->sc_cipher_ctx = ssh->sccipher->make_context();
5813 if (ssh->sc_mac_ctx)
5814 ssh->scmac->free_context(ssh->sc_mac_ctx);
5815 ssh->scmac = s->scmac_tobe;
5816 ssh->sc_mac_ctx = ssh->scmac->make_context();
5818 if (ssh->sc_comp_ctx)
5819 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
5820 ssh->sccomp = s->sccomp_tobe;
5821 ssh->sc_comp_ctx = ssh->sccomp->decompress_init();
5824 * Set IVs on server-to-client keys. Here we use the exchange
5825 * hash from the _first_ key exchange.
5828 unsigned char keyspace[SSH2_KEX_MAX_HASH_LEN * SSH2_MKKEY_ITERS];
5829 assert(sizeof(keyspace) >= ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5830 ssh2_mkkey(ssh,s->K,s->exchange_hash,'D',keyspace);
5831 assert((ssh->sccipher->keylen+7) / 8 <=
5832 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5833 ssh->sccipher->setkey(ssh->sc_cipher_ctx, keyspace);
5834 ssh2_mkkey(ssh,s->K,s->exchange_hash,'B',keyspace);
5835 assert(ssh->sccipher->blksize <=
5836 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5837 ssh->sccipher->setiv(ssh->sc_cipher_ctx, keyspace);
5838 ssh2_mkkey(ssh,s->K,s->exchange_hash,'F',keyspace);
5839 assert(ssh->scmac->len <=
5840 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5841 ssh->scmac->setkey(ssh->sc_mac_ctx, keyspace);
5842 memset(keyspace, 0, sizeof(keyspace));
5844 logeventf(ssh, "Initialised %.200s server->client encryption",
5845 ssh->sccipher->text_name);
5846 logeventf(ssh, "Initialised %.200s server->client MAC algorithm",
5847 ssh->scmac->text_name);
5848 if (ssh->sccomp->text_name)
5849 logeventf(ssh, "Initialised %s decompression",
5850 ssh->sccomp->text_name);
5853 * Free key exchange data.
5857 if (!ssh->kex->pdata) {
5863 * Key exchange is over. Loop straight back round if we have a
5864 * deferred rekey reason.
5866 if (ssh->deferred_rekey_reason) {
5867 logevent(ssh->deferred_rekey_reason);
5869 ssh->deferred_rekey_reason = NULL;
5870 goto begin_key_exchange;
5874 * Otherwise, schedule a timer for our next rekey.
5876 ssh->kex_in_progress = FALSE;
5877 ssh->last_rekey = GETTICKCOUNT();
5878 if (ssh->cfg.ssh_rekey_time != 0)
5879 ssh->next_rekey = schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
5883 * If this is the first key exchange phase, we must pass the
5884 * SSH2_MSG_NEWKEYS packet to the next layer, not because it
5885 * wants to see it but because it will need time to initialise
5886 * itself before it sees an actual packet. In subsequent key
5887 * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because
5888 * it would only confuse the layer above.
5890 if (s->activated_authconn) {
5893 s->activated_authconn = TRUE;
5896 * Now we're encrypting. Begin returning 1 to the protocol main
5897 * function so that other things can run on top of the
5898 * transport. If we ever see a KEXINIT, we must go back to the
5901 * We _also_ go back to the start if we see pktin==NULL and
5902 * inlen==-1, because this is a special signal meaning
5903 * `initiate client-driven rekey', and `in' contains a message
5904 * giving the reason for the rekey.
5906 while (!((pktin && pktin->type == SSH2_MSG_KEXINIT) ||
5907 (!pktin && inlen == -1))) {
5912 logevent("Server initiated key re-exchange");
5915 * Special case: if the server bug is set that doesn't
5916 * allow rekeying, we give a different log message and
5917 * continue waiting. (If such a server _initiates_ a rekey,
5918 * we process it anyway!)
5920 if ((ssh->remote_bugs & BUG_SSH2_REKEY)) {
5921 logeventf(ssh, "Server bug prevents key re-exchange (%s)",
5923 /* Reset the counters, so that at least this message doesn't
5924 * hit the event log _too_ often. */
5925 ssh->outgoing_data_size = 0;
5926 ssh->incoming_data_size = 0;
5927 if (ssh->cfg.ssh_rekey_time != 0) {
5929 schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
5932 goto wait_for_rekey; /* this is utterly horrid */
5934 logeventf(ssh, "Initiating key re-exchange (%s)", (char *)in);
5937 goto begin_key_exchange;
5943 * Add data to an SSH-2 channel output buffer.
5945 static void ssh2_add_channel_data(struct ssh_channel *c, char *buf,
5948 bufchain_add(&c->v.v2.outbuffer, buf, len);
5952 * Attempt to send data on an SSH-2 channel.
5954 static int ssh2_try_send(struct ssh_channel *c)
5957 struct Packet *pktout;
5959 while (c->v.v2.remwindow > 0 && bufchain_size(&c->v.v2.outbuffer) > 0) {
5962 bufchain_prefix(&c->v.v2.outbuffer, &data, &len);
5963 if ((unsigned)len > c->v.v2.remwindow)
5964 len = c->v.v2.remwindow;
5965 if ((unsigned)len > c->v.v2.remmaxpkt)
5966 len = c->v.v2.remmaxpkt;
5967 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_DATA);
5968 ssh2_pkt_adduint32(pktout, c->remoteid);
5969 dont_log_data(ssh, pktout, PKTLOG_OMIT);
5970 ssh2_pkt_addstring_start(pktout);
5971 ssh2_pkt_addstring_data(pktout, data, len);
5972 end_log_omission(ssh, pktout);
5973 ssh2_pkt_send(ssh, pktout);
5974 bufchain_consume(&c->v.v2.outbuffer, len);
5975 c->v.v2.remwindow -= len;
5979 * After having sent as much data as we can, return the amount
5982 return bufchain_size(&c->v.v2.outbuffer);
5985 static void ssh2_try_send_and_unthrottle(struct ssh_channel *c)
5989 return; /* don't send on closing channels */
5990 bufsize = ssh2_try_send(c);
5993 case CHAN_MAINSESSION:
5994 /* stdin need not receive an unthrottle
5995 * notification since it will be polled */
5998 x11_unthrottle(c->u.x11.s);
6001 /* agent sockets are request/response and need no
6002 * buffer management */
6005 pfd_unthrottle(c->u.pfd.s);
6012 * Potentially enlarge the window on an SSH-2 channel.
6014 static void ssh2_set_window(struct ssh_channel *c, unsigned newwin)
6019 * Never send WINDOW_ADJUST for a channel that the remote side
6020 * already thinks it's closed; there's no point, since it won't
6021 * be sending any more data anyway.
6027 * Only send a WINDOW_ADJUST if there's significantly more window
6028 * available than the other end thinks there is. This saves us
6029 * sending a WINDOW_ADJUST for every character in a shell session.
6031 * "Significant" is arbitrarily defined as half the window size.
6033 if (newwin > c->v.v2.locwindow * 2) {
6034 struct Packet *pktout;
6036 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
6037 ssh2_pkt_adduint32(pktout, c->remoteid);
6038 ssh2_pkt_adduint32(pktout, newwin - c->v.v2.locwindow);
6039 ssh2_pkt_send(ssh, pktout);
6040 c->v.v2.locwindow = newwin;
6044 static void ssh2_msg_channel_window_adjust(Ssh ssh, struct Packet *pktin)
6046 unsigned i = ssh_pkt_getuint32(pktin);
6047 struct ssh_channel *c;
6048 c = find234(ssh->channels, &i, ssh_channelfind);
6049 if (c && !c->closes) {
6050 c->v.v2.remwindow += ssh_pkt_getuint32(pktin);
6051 ssh2_try_send_and_unthrottle(c);
6055 static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin)
6059 unsigned i = ssh_pkt_getuint32(pktin);
6060 struct ssh_channel *c;
6061 c = find234(ssh->channels, &i, ssh_channelfind);
6063 return; /* nonexistent channel */
6064 if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA &&
6065 ssh_pkt_getuint32(pktin) != SSH2_EXTENDED_DATA_STDERR)
6066 return; /* extended but not stderr */
6067 ssh_pkt_getstring(pktin, &data, &length);
6070 c->v.v2.locwindow -= length;
6072 case CHAN_MAINSESSION:
6074 from_backend(ssh->frontend, pktin->type ==
6075 SSH2_MSG_CHANNEL_EXTENDED_DATA,
6079 bufsize = x11_send(c->u.x11.s, data, length);
6082 bufsize = pfd_send(c->u.pfd.s, data, length);
6085 while (length > 0) {
6086 if (c->u.a.lensofar < 4) {
6087 unsigned int l = min(4 - c->u.a.lensofar,
6089 memcpy(c->u.a.msglen + c->u.a.lensofar,
6093 c->u.a.lensofar += l;
6095 if (c->u.a.lensofar == 4) {
6097 4 + GET_32BIT(c->u.a.msglen);
6098 c->u.a.message = snewn(c->u.a.totallen,
6100 memcpy(c->u.a.message, c->u.a.msglen, 4);
6102 if (c->u.a.lensofar >= 4 && length > 0) {
6104 min(c->u.a.totallen - c->u.a.lensofar,
6106 memcpy(c->u.a.message + c->u.a.lensofar,
6110 c->u.a.lensofar += l;
6112 if (c->u.a.lensofar == c->u.a.totallen) {
6115 if (agent_query(c->u.a.message,
6118 ssh_agentf_callback, c))
6119 ssh_agentf_callback(c, reply, replylen);
6120 sfree(c->u.a.message);
6121 c->u.a.lensofar = 0;
6128 * If we are not buffering too much data,
6129 * enlarge the window again at the remote side.
6131 if (bufsize < OUR_V2_WINSIZE)
6132 ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
6136 static void ssh2_msg_channel_eof(Ssh ssh, struct Packet *pktin)
6138 unsigned i = ssh_pkt_getuint32(pktin);
6139 struct ssh_channel *c;
6141 c = find234(ssh->channels, &i, ssh_channelfind);
6143 return; /* nonexistent channel */
6145 if (c->type == CHAN_X11) {
6147 * Remote EOF on an X11 channel means we should
6148 * wrap up and close the channel ourselves.
6150 x11_close(c->u.x11.s);
6152 } else if (c->type == CHAN_AGENT) {
6154 } else if (c->type == CHAN_SOCKDATA) {
6155 pfd_close(c->u.pfd.s);
6160 static void ssh2_msg_channel_close(Ssh ssh, struct Packet *pktin)
6162 unsigned i = ssh_pkt_getuint32(pktin);
6163 struct ssh_channel *c;
6164 struct Packet *pktout;
6166 c = find234(ssh->channels, &i, ssh_channelfind);
6167 if (!c || c->halfopen) {
6168 bombout(("Received CHANNEL_CLOSE for %s channel %d\n",
6169 c ? "half-open" : "nonexistent", i));
6172 /* Do pre-close processing on the channel. */
6174 case CHAN_MAINSESSION:
6175 ssh->mainchan = NULL;
6176 update_specials_menu(ssh->frontend);
6179 if (c->u.x11.s != NULL)
6180 x11_close(c->u.x11.s);
6187 if (c->u.pfd.s != NULL)
6188 pfd_close(c->u.pfd.s);
6192 if (c->closes == 0) {
6193 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6194 ssh2_pkt_adduint32(pktout, c->remoteid);
6195 ssh2_pkt_send(ssh, pktout);
6197 del234(ssh->channels, c);
6198 bufchain_clear(&c->v.v2.outbuffer);
6202 * See if that was the last channel left open.
6203 * (This is only our termination condition if we're
6204 * not running in -N mode.)
6206 if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) {
6208 * We used to send SSH_MSG_DISCONNECT here,
6209 * because I'd believed that _every_ conforming
6210 * SSH-2 connection had to end with a disconnect
6211 * being sent by at least one side; apparently
6212 * I was wrong and it's perfectly OK to
6213 * unceremoniously slam the connection shut
6214 * when you're done, and indeed OpenSSH feels
6215 * this is more polite than sending a
6216 * DISCONNECT. So now we don't.
6218 ssh_disconnect(ssh, "All channels closed", NULL, 0, TRUE);
6222 static void ssh2_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
6224 unsigned i = ssh_pkt_getuint32(pktin);
6225 struct ssh_channel *c;
6226 struct Packet *pktout;
6228 c = find234(ssh->channels, &i, ssh_channelfind);
6230 return; /* nonexistent channel */
6231 if (c->type != CHAN_SOCKDATA_DORMANT)
6232 return; /* dunno why they're confirming this */
6233 c->remoteid = ssh_pkt_getuint32(pktin);
6234 c->halfopen = FALSE;
6235 c->type = CHAN_SOCKDATA;
6236 c->v.v2.remwindow = ssh_pkt_getuint32(pktin);
6237 c->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
6239 pfd_confirm(c->u.pfd.s);
6242 * We have a pending close on this channel,
6243 * which we decided on before the server acked
6244 * the channel open. So now we know the
6245 * remoteid, we can close it again.
6247 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6248 ssh2_pkt_adduint32(pktout, c->remoteid);
6249 ssh2_pkt_send(ssh, pktout);
6253 static void ssh2_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
6255 static const char *const reasons[] = {
6256 "<unknown reason code>",
6257 "Administratively prohibited",
6259 "Unknown channel type",
6260 "Resource shortage",
6262 unsigned i = ssh_pkt_getuint32(pktin);
6263 unsigned reason_code;
6264 char *reason_string;
6266 struct ssh_channel *c;
6267 c = find234(ssh->channels, &i, ssh_channelfind);
6269 return; /* nonexistent channel */
6270 if (c->type != CHAN_SOCKDATA_DORMANT)
6271 return; /* dunno why they're failing this */
6273 reason_code = ssh_pkt_getuint32(pktin);
6274 if (reason_code >= lenof(reasons))
6275 reason_code = 0; /* ensure reasons[reason_code] in range */
6276 ssh_pkt_getstring(pktin, &reason_string, &reason_length);
6277 logeventf(ssh, "Forwarded connection refused by server: %s [%.*s]",
6278 reasons[reason_code], reason_length, reason_string);
6280 pfd_close(c->u.pfd.s);
6282 del234(ssh->channels, c);
6286 static void ssh2_msg_channel_request(Ssh ssh, struct Packet *pktin)
6290 int typelen, want_reply;
6291 int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */
6292 struct ssh_channel *c;
6293 struct Packet *pktout;
6295 localid = ssh_pkt_getuint32(pktin);
6296 ssh_pkt_getstring(pktin, &type, &typelen);
6297 want_reply = ssh2_pkt_getbool(pktin);
6300 * First, check that the channel exists. Otherwise,
6301 * we can instantly disconnect with a rude message.
6303 c = find234(ssh->channels, &localid, ssh_channelfind);
6305 char *buf = dupprintf("Received channel request for nonexistent"
6306 " channel %d", localid);
6307 ssh_disconnect(ssh, NULL, buf, SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6313 * Having got the channel number, we now look at
6314 * the request type string to see if it's something
6317 if (c == ssh->mainchan) {
6319 * We recognise "exit-status" and "exit-signal" on
6320 * the primary channel.
6322 if (typelen == 11 &&
6323 !memcmp(type, "exit-status", 11)) {
6325 ssh->exitcode = ssh_pkt_getuint32(pktin);
6326 logeventf(ssh, "Server sent command exit status %d",
6328 reply = SSH2_MSG_CHANNEL_SUCCESS;
6330 } else if (typelen == 11 &&
6331 !memcmp(type, "exit-signal", 11)) {
6333 int is_plausible = TRUE, is_int = FALSE;
6334 char *fmt_sig = "", *fmt_msg = "";
6336 int msglen = 0, core = FALSE;
6337 /* ICK: older versions of OpenSSH (e.g. 3.4p1)
6338 * provide an `int' for the signal, despite its
6339 * having been a `string' in the drafts since at
6340 * least 2001. (Fixed in session.c 1.147.) Try to
6341 * infer which we can safely parse it as. */
6343 unsigned char *p = pktin->body +
6345 long len = pktin->length - pktin->savedpos;
6346 unsigned long num = GET_32BIT(p); /* what is it? */
6347 /* If it's 0, it hardly matters; assume string */
6351 int maybe_int = FALSE, maybe_str = FALSE;
6352 #define CHECK_HYPOTHESIS(offset, result) \
6355 if (q >= 0 && q+4 <= len) { \
6356 q = q + 4 + GET_32BIT(p+q); \
6357 if (q >= 0 && q+4 <= len && \
6358 ((q = q + 4 + GET_32BIT(p+q))!= 0) && q == len) \
6362 CHECK_HYPOTHESIS(4+1, maybe_int);
6363 CHECK_HYPOTHESIS(4+num+1, maybe_str);
6364 #undef CHECK_HYPOTHESIS
6365 if (maybe_int && !maybe_str)
6367 else if (!maybe_int && maybe_str)
6370 /* Crikey. Either or neither. Panic. */
6371 is_plausible = FALSE;
6374 ssh->exitcode = 128; /* means `unknown signal' */
6377 /* Old non-standard OpenSSH. */
6378 int signum = ssh_pkt_getuint32(pktin);
6379 fmt_sig = dupprintf(" %d", signum);
6380 ssh->exitcode = 128 + signum;
6382 /* As per the drafts. */
6385 ssh_pkt_getstring(pktin, &sig, &siglen);
6386 /* Signal name isn't supposed to be blank, but
6387 * let's cope gracefully if it is. */
6389 fmt_sig = dupprintf(" \"%.*s\"",
6394 * Really hideous method of translating the
6395 * signal description back into a locally
6396 * meaningful number.
6402 else if (siglen == lenof("ABRT")-1 &&
6403 !memcmp(sig, "ABRT", siglen))
6404 ssh->exitcode = 128 + SIGABRT;
6407 else if (siglen == lenof("ALRM")-1 &&
6408 !memcmp(sig, "ALRM", siglen))
6409 ssh->exitcode = 128 + SIGALRM;
6412 else if (siglen == lenof("FPE")-1 &&
6413 !memcmp(sig, "FPE", siglen))
6414 ssh->exitcode = 128 + SIGFPE;
6417 else if (siglen == lenof("HUP")-1 &&
6418 !memcmp(sig, "HUP", siglen))
6419 ssh->exitcode = 128 + SIGHUP;
6422 else if (siglen == lenof("ILL")-1 &&
6423 !memcmp(sig, "ILL", siglen))
6424 ssh->exitcode = 128 + SIGILL;
6427 else if (siglen == lenof("INT")-1 &&
6428 !memcmp(sig, "INT", siglen))
6429 ssh->exitcode = 128 + SIGINT;
6432 else if (siglen == lenof("KILL")-1 &&
6433 !memcmp(sig, "KILL", siglen))
6434 ssh->exitcode = 128 + SIGKILL;
6437 else if (siglen == lenof("PIPE")-1 &&
6438 !memcmp(sig, "PIPE", siglen))
6439 ssh->exitcode = 128 + SIGPIPE;
6442 else if (siglen == lenof("QUIT")-1 &&
6443 !memcmp(sig, "QUIT", siglen))
6444 ssh->exitcode = 128 + SIGQUIT;
6447 else if (siglen == lenof("SEGV")-1 &&
6448 !memcmp(sig, "SEGV", siglen))
6449 ssh->exitcode = 128 + SIGSEGV;
6452 else if (siglen == lenof("TERM")-1 &&
6453 !memcmp(sig, "TERM", siglen))
6454 ssh->exitcode = 128 + SIGTERM;
6457 else if (siglen == lenof("USR1")-1 &&
6458 !memcmp(sig, "USR1", siglen))
6459 ssh->exitcode = 128 + SIGUSR1;
6462 else if (siglen == lenof("USR2")-1 &&
6463 !memcmp(sig, "USR2", siglen))
6464 ssh->exitcode = 128 + SIGUSR2;
6467 ssh->exitcode = 128;
6469 core = ssh2_pkt_getbool(pktin);
6470 ssh_pkt_getstring(pktin, &msg, &msglen);
6472 fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg);
6474 /* ignore lang tag */
6475 } /* else don't attempt to parse */
6476 logeventf(ssh, "Server exited on signal%s%s%s",
6477 fmt_sig, core ? " (core dumped)" : "",
6479 if (*fmt_sig) sfree(fmt_sig);
6480 if (*fmt_msg) sfree(fmt_msg);
6481 reply = SSH2_MSG_CHANNEL_SUCCESS;
6486 * This is a channel request we don't know
6487 * about, so we now either ignore the request
6488 * or respond with CHANNEL_FAILURE, depending
6491 reply = SSH2_MSG_CHANNEL_FAILURE;
6494 pktout = ssh2_pkt_init(reply);
6495 ssh2_pkt_adduint32(pktout, c->remoteid);
6496 ssh2_pkt_send(ssh, pktout);
6500 static void ssh2_msg_global_request(Ssh ssh, struct Packet *pktin)
6503 int typelen, want_reply;
6504 struct Packet *pktout;
6506 ssh_pkt_getstring(pktin, &type, &typelen);
6507 want_reply = ssh2_pkt_getbool(pktin);
6510 * We currently don't support any global requests
6511 * at all, so we either ignore the request or
6512 * respond with REQUEST_FAILURE, depending on
6516 pktout = ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE);
6517 ssh2_pkt_send(ssh, pktout);
6521 static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin)
6529 struct ssh_channel *c;
6530 unsigned remid, winsize, pktsize;
6531 struct Packet *pktout;
6533 ssh_pkt_getstring(pktin, &type, &typelen);
6534 c = snew(struct ssh_channel);
6537 remid = ssh_pkt_getuint32(pktin);
6538 winsize = ssh_pkt_getuint32(pktin);
6539 pktsize = ssh_pkt_getuint32(pktin);
6541 if (typelen == 3 && !memcmp(type, "x11", 3)) {
6544 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
6545 addrstr = snewn(peeraddrlen+1, char);
6546 memcpy(addrstr, peeraddr, peeraddrlen);
6547 addrstr[peeraddrlen] = '\0';
6548 peerport = ssh_pkt_getuint32(pktin);
6550 logeventf(ssh, "Received X11 connect request from %s:%d",
6553 if (!ssh->X11_fwd_enabled)
6554 error = "X11 forwarding is not enabled";
6555 else if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c,
6556 ssh->x11auth, addrstr, peerport,
6557 &ssh->cfg) != NULL) {
6558 error = "Unable to open an X11 connection";
6560 logevent("Opening X11 forward connection succeeded");
6565 } else if (typelen == 15 &&
6566 !memcmp(type, "forwarded-tcpip", 15)) {
6567 struct ssh_rportfwd pf, *realpf;
6570 ssh_pkt_getstring(pktin, &dummy, &dummylen);/* skip address */
6571 pf.sport = ssh_pkt_getuint32(pktin);
6572 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
6573 peerport = ssh_pkt_getuint32(pktin);
6574 realpf = find234(ssh->rportfwds, &pf, NULL);
6575 logeventf(ssh, "Received remote port %d open request "
6576 "from %s:%d", pf.sport, peeraddr, peerport);
6577 if (realpf == NULL) {
6578 error = "Remote port is not recognised";
6580 const char *e = pfd_newconnect(&c->u.pfd.s,
6584 realpf->pfrec->addressfamily);
6585 logeventf(ssh, "Attempting to forward remote port to "
6586 "%s:%d", realpf->dhost, realpf->dport);
6588 logeventf(ssh, "Port open failed: %s", e);
6589 error = "Port open failed";
6591 logevent("Forwarded port opened successfully");
6592 c->type = CHAN_SOCKDATA;
6595 } else if (typelen == 22 &&
6596 !memcmp(type, "auth-agent@openssh.com", 22)) {
6597 if (!ssh->agentfwd_enabled)
6598 error = "Agent forwarding is not enabled";
6600 c->type = CHAN_AGENT; /* identify channel type */
6601 c->u.a.lensofar = 0;
6604 error = "Unsupported channel type requested";
6607 c->remoteid = remid;
6608 c->halfopen = FALSE;
6610 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE);
6611 ssh2_pkt_adduint32(pktout, c->remoteid);
6612 ssh2_pkt_adduint32(pktout, SSH2_OPEN_CONNECT_FAILED);
6613 ssh2_pkt_addstring(pktout, error);
6614 ssh2_pkt_addstring(pktout, "en"); /* language tag */
6615 ssh2_pkt_send(ssh, pktout);
6616 logeventf(ssh, "Rejected channel open: %s", error);
6619 c->localid = alloc_channel_id(ssh);
6621 c->v.v2.locwindow = OUR_V2_WINSIZE;
6622 c->v.v2.remwindow = winsize;
6623 c->v.v2.remmaxpkt = pktsize;
6624 bufchain_init(&c->v.v2.outbuffer);
6625 add234(ssh->channels, c);
6626 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
6627 ssh2_pkt_adduint32(pktout, c->remoteid);
6628 ssh2_pkt_adduint32(pktout, c->localid);
6629 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);
6630 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
6631 ssh2_pkt_send(ssh, pktout);
6636 * Buffer banner messages for later display at some convenient point.
6638 static void ssh2_msg_userauth_banner(Ssh ssh, struct Packet *pktin)
6640 /* Arbitrary limit to prevent unbounded inflation of buffer */
6641 if (bufchain_size(&ssh->banner) <= 131072) {
6642 char *banner = NULL;
6644 ssh_pkt_getstring(pktin, &banner, &size);
6646 bufchain_add(&ssh->banner, banner, size);
6650 /* Helper function to deal with sending tty modes for "pty-req" */
6651 static void ssh2_send_ttymode(void *data, char *mode, char *val)
6653 struct Packet *pktout = (struct Packet *)data;
6655 unsigned int arg = 0;
6656 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
6657 if (i == lenof(ssh_ttymodes)) return;
6658 switch (ssh_ttymodes[i].type) {
6660 arg = ssh_tty_parse_specchar(val);
6663 arg = ssh_tty_parse_boolean(val);
6666 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
6667 ssh2_pkt_adduint32(pktout, arg);
6671 * Handle the SSH-2 userauth and connection layers.
6673 static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
6674 struct Packet *pktin)
6676 struct do_ssh2_authconn_state {
6679 AUTH_TYPE_PUBLICKEY,
6680 AUTH_TYPE_PUBLICKEY_OFFER_LOUD,
6681 AUTH_TYPE_PUBLICKEY_OFFER_QUIET,
6683 AUTH_TYPE_KEYBOARD_INTERACTIVE,
6684 AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
6686 int done_service_req;
6687 int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter;
6688 int tried_pubkey_config, done_agent;
6689 int kbd_inter_refused;
6691 prompts_t *cur_prompt;
6696 void *publickey_blob;
6697 int publickey_bloblen;
6698 int publickey_encrypted;
6699 char *publickey_algorithm;
6700 char *publickey_comment;
6701 unsigned char agent_request[5], *agent_response, *agentp;
6702 int agent_responselen;
6703 unsigned char *pkblob_in_agent;
6705 char *pkblob, *alg, *commentp;
6706 int pklen, alglen, commentlen;
6707 int siglen, retlen, len;
6708 char *q, *agentreq, *ret;
6710 int num_env, env_left, env_ok;
6711 struct Packet *pktout;
6713 crState(do_ssh2_authconn_state);
6715 crBegin(ssh->do_ssh2_authconn_crstate);
6717 s->done_service_req = FALSE;
6718 s->we_are_in = FALSE;
6719 if (!ssh->cfg.ssh_no_userauth) {
6721 * Request userauth protocol, and await a response to it.
6723 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
6724 ssh2_pkt_addstring(s->pktout, "ssh-userauth");
6725 ssh2_pkt_send(ssh, s->pktout);
6726 crWaitUntilV(pktin);
6727 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT)
6728 s->done_service_req = TRUE;
6730 if (!s->done_service_req) {
6732 * Request connection protocol directly, without authentication.
6734 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
6735 ssh2_pkt_addstring(s->pktout, "ssh-connection");
6736 ssh2_pkt_send(ssh, s->pktout);
6737 crWaitUntilV(pktin);
6738 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT) {
6739 s->we_are_in = TRUE; /* no auth required */
6741 bombout(("Server refused service request"));
6746 /* Arrange to be able to deal with any BANNERs that come in.
6747 * (We do this now as packets may come in during the next bit.) */
6748 bufchain_init(&ssh->banner);
6749 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] =
6750 ssh2_msg_userauth_banner;
6753 * Misc one-time setup for authentication.
6755 s->publickey_blob = NULL;
6756 if (!s->we_are_in) {
6759 * Load the public half of any configured public key file
6762 if (!filename_is_null(ssh->cfg.keyfile)) {
6764 logeventf(ssh, "Reading private key file \"%.150s\"",
6765 filename_to_str(&ssh->cfg.keyfile));
6766 keytype = key_type(&ssh->cfg.keyfile);
6767 if (keytype == SSH_KEYTYPE_SSH2) {
6770 ssh2_userkey_loadpub(&ssh->cfg.keyfile,
6771 &s->publickey_algorithm,
6772 &s->publickey_bloblen,
6773 &s->publickey_comment, &error);
6774 if (s->publickey_blob) {
6775 s->publickey_encrypted =
6776 ssh2_userkey_encrypted(&ssh->cfg.keyfile, NULL);
6779 logeventf(ssh, "Unable to load private key (%s)",
6781 msgbuf = dupprintf("Unable to load private key file "
6782 "\"%.150s\" (%s)\r\n",
6783 filename_to_str(&ssh->cfg.keyfile),
6785 c_write_str(ssh, msgbuf);
6790 logeventf(ssh, "Unable to use this key file (%s)",
6791 key_type_to_str(keytype));
6792 msgbuf = dupprintf("Unable to use key file \"%.150s\""
6794 filename_to_str(&ssh->cfg.keyfile),
6795 key_type_to_str(keytype));
6796 c_write_str(ssh, msgbuf);
6798 s->publickey_blob = NULL;
6803 * Find out about any keys Pageant has (but if there's a
6804 * public key configured, filter out all others).
6807 s->agent_response = NULL;
6808 s->pkblob_in_agent = NULL;
6809 if (ssh->cfg.tryagent && agent_exists()) {
6813 logevent("Pageant is running. Requesting keys.");
6815 /* Request the keys held by the agent. */
6816 PUT_32BIT(s->agent_request, 1);
6817 s->agent_request[4] = SSH2_AGENTC_REQUEST_IDENTITIES;
6818 if (!agent_query(s->agent_request, 5, &r, &s->agent_responselen,
6819 ssh_agent_callback, ssh)) {
6823 bombout(("Unexpected data from server while"
6824 " waiting for agent response"));
6827 } while (pktin || inlen > 0);
6828 r = ssh->agent_response;
6829 s->agent_responselen = ssh->agent_response_len;
6831 s->agent_response = (unsigned char *) r;
6832 if (s->agent_response && s->agent_responselen >= 5 &&
6833 s->agent_response[4] == SSH2_AGENT_IDENTITIES_ANSWER) {
6836 p = s->agent_response + 5;
6837 s->nkeys = GET_32BIT(p);
6839 logeventf(ssh, "Pageant has %d SSH-2 keys", s->nkeys);
6840 if (s->publickey_blob) {
6841 /* See if configured key is in agent. */
6842 for (keyi = 0; keyi < s->nkeys; keyi++) {
6843 s->pklen = GET_32BIT(p);
6844 if (s->pklen == s->publickey_bloblen &&
6845 !memcmp(p+4, s->publickey_blob,
6846 s->publickey_bloblen)) {
6847 logeventf(ssh, "Pageant key #%d matches "
6848 "configured key file", keyi);
6850 s->pkblob_in_agent = p;
6854 p += GET_32BIT(p) + 4; /* comment */
6856 if (!s->pkblob_in_agent) {
6857 logevent("Configured key file not in Pageant");
6867 * We repeat this whole loop, including the username prompt,
6868 * until we manage a successful authentication. If the user
6869 * types the wrong _password_, they can be sent back to the
6870 * beginning to try another username, if this is configured on.
6871 * (If they specify a username in the config, they are never
6872 * asked, even if they do give a wrong password.)
6874 * I think this best serves the needs of
6876 * - the people who have no configuration, no keys, and just
6877 * want to try repeated (username,password) pairs until they
6878 * type both correctly
6880 * - people who have keys and configuration but occasionally
6881 * need to fall back to passwords
6883 * - people with a key held in Pageant, who might not have
6884 * logged in to a particular machine before; so they want to
6885 * type a username, and then _either_ their key will be
6886 * accepted, _or_ they will type a password. If they mistype
6887 * the username they will want to be able to get back and
6890 s->username[0] = '\0';
6891 s->got_username = FALSE;
6892 while (!s->we_are_in) {
6896 if (s->got_username && !ssh->cfg.change_username) {
6898 * We got a username last time round this loop, and
6899 * with change_username turned off we don't try to get
6902 } else if (!*ssh->cfg.username) {
6903 int ret; /* need not be kept over crReturn */
6904 s->cur_prompt = new_prompts(ssh->frontend);
6905 s->cur_prompt->to_server = TRUE;
6906 s->cur_prompt->name = dupstr("SSH login name");
6907 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
6908 lenof(s->username));
6909 ret = get_userpass_input(s->cur_prompt, NULL, 0);
6912 crWaitUntilV(!pktin);
6913 ret = get_userpass_input(s->cur_prompt, in, inlen);
6918 * get_userpass_input() failed to get a username.
6921 free_prompts(s->cur_prompt);
6922 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
6925 memcpy(s->username, s->cur_prompt->prompts[0]->result,
6926 lenof(s->username));
6927 free_prompts(s->cur_prompt);
6930 strncpy(s->username, ssh->cfg.username, sizeof(s->username));
6931 s->username[sizeof(s->username)-1] = '\0';
6932 if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
6933 stuff = dupprintf("Using username \"%s\".\r\n", s->username);
6934 c_write_str(ssh, stuff);
6938 s->got_username = TRUE;
6941 * Send an authentication request using method "none": (a)
6942 * just in case it succeeds, and (b) so that we know what
6943 * authentication methods we can usefully try next.
6945 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
6947 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
6948 ssh2_pkt_addstring(s->pktout, s->username);
6949 ssh2_pkt_addstring(s->pktout, "ssh-connection");/* service requested */
6950 ssh2_pkt_addstring(s->pktout, "none"); /* method */
6951 ssh2_pkt_send(ssh, s->pktout);
6952 s->type = AUTH_TYPE_NONE;
6954 s->we_are_in = FALSE;
6956 s->tried_pubkey_config = FALSE;
6957 s->kbd_inter_refused = FALSE;
6959 /* Reset agent request state. */
6960 s->done_agent = FALSE;
6961 if (s->agent_response) {
6962 if (s->pkblob_in_agent) {
6963 s->agentp = s->pkblob_in_agent;
6965 s->agentp = s->agent_response + 5 + 4;
6972 * Wait for the result of the last authentication request.
6975 crWaitUntilV(pktin);
6977 * Now is a convenient point to spew any banner material
6978 * that we've accumulated. (This should ensure that when
6979 * we exit the auth loop, we haven't any left to deal
6983 int size = bufchain_size(&ssh->banner);
6985 * Don't show the banner if we're operating in
6986 * non-verbose non-interactive mode. (It's probably
6987 * a script, which means nobody will read the
6988 * banner _anyway_, and moreover the printing of
6989 * the banner will screw up processing on the
6990 * output of (say) plink.)
6992 if (size && (flags & (FLAG_VERBOSE | FLAG_INTERACTIVE))) {
6993 char *banner = snewn(size, char);
6994 bufchain_fetch(&ssh->banner, banner, size);
6995 c_write_untrusted(ssh, banner, size);
6998 bufchain_clear(&ssh->banner);
7000 if (pktin->type == SSH2_MSG_USERAUTH_SUCCESS) {
7001 logevent("Access granted");
7002 s->we_are_in = TRUE;
7006 if (pktin->type != SSH2_MSG_USERAUTH_FAILURE) {
7007 bombout(("Strange packet received during authentication: "
7008 "type %d", pktin->type));
7015 * OK, we're now sitting on a USERAUTH_FAILURE message, so
7016 * we can look at the string in it and know what we can
7017 * helpfully try next.
7019 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE) {
7022 ssh_pkt_getstring(pktin, &methods, &methlen);
7023 if (!ssh2_pkt_getbool(pktin)) {
7025 * We have received an unequivocal Access
7026 * Denied. This can translate to a variety of
7029 * - if we'd just tried "none" authentication,
7030 * it's not worth printing anything at all
7032 * - if we'd just tried a public key _offer_,
7033 * the message should be "Server refused our
7034 * key" (or no message at all if the key
7035 * came from Pageant)
7037 * - if we'd just tried anything else, the
7038 * message really should be "Access denied".
7040 * Additionally, if we'd just tried password
7041 * authentication, we should break out of this
7042 * whole loop so as to go back to the username
7043 * prompt (iff we're configured to allow
7044 * username change attempts).
7046 if (s->type == AUTH_TYPE_NONE) {
7048 } else if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD ||
7049 s->type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) {
7050 if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD)
7051 c_write_str(ssh, "Server refused our key\r\n");
7052 logevent("Server refused public key");
7053 } else if (s->type==AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) {
7054 /* server declined keyboard-interactive; ignore */
7056 c_write_str(ssh, "Access denied\r\n");
7057 logevent("Access denied");
7058 if (s->type == AUTH_TYPE_PASSWORD &&
7059 ssh->cfg.change_username) {
7060 /* XXX perhaps we should allow
7061 * keyboard-interactive to do this too? */
7062 s->we_are_in = FALSE;
7067 c_write_str(ssh, "Further authentication required\r\n");
7068 logevent("Further authentication required");
7072 in_commasep_string("publickey", methods, methlen);
7074 in_commasep_string("password", methods, methlen);
7075 s->can_keyb_inter = ssh->cfg.try_ki_auth &&
7076 in_commasep_string("keyboard-interactive", methods, methlen);
7079 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7081 if (s->can_pubkey && !s->done_agent && s->nkeys) {
7084 * Attempt public-key authentication using a key from Pageant.
7087 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7088 ssh->pkt_ctx |= SSH2_PKTCTX_PUBLICKEY;
7090 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
7092 /* Unpack key from agent response */
7093 s->pklen = GET_32BIT(s->agentp);
7095 s->pkblob = (char *)s->agentp;
7096 s->agentp += s->pklen;
7097 s->alglen = GET_32BIT(s->pkblob);
7098 s->alg = s->pkblob + 4;
7099 s->commentlen = GET_32BIT(s->agentp);
7101 s->commentp = (char *)s->agentp;
7102 s->agentp += s->commentlen;
7103 /* s->agentp now points at next key, if any */
7105 /* See if server will accept it */
7106 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7107 ssh2_pkt_addstring(s->pktout, s->username);
7108 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7109 /* service requested */
7110 ssh2_pkt_addstring(s->pktout, "publickey");
7112 ssh2_pkt_addbool(s->pktout, FALSE); /* no signature included */
7113 ssh2_pkt_addstring_start(s->pktout);
7114 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
7115 ssh2_pkt_addstring_start(s->pktout);
7116 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
7117 ssh2_pkt_send(ssh, s->pktout);
7118 s->type = AUTH_TYPE_PUBLICKEY_OFFER_QUIET;
7120 crWaitUntilV(pktin);
7121 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
7123 /* Offer of key refused. */
7130 if (flags & FLAG_VERBOSE) {
7131 c_write_str(ssh, "Authenticating with "
7133 c_write(ssh, s->commentp, s->commentlen);
7134 c_write_str(ssh, "\" from agent\r\n");
7138 * Server is willing to accept the key.
7139 * Construct a SIGN_REQUEST.
7141 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7142 ssh2_pkt_addstring(s->pktout, s->username);
7143 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7144 /* service requested */
7145 ssh2_pkt_addstring(s->pktout, "publickey");
7147 ssh2_pkt_addbool(s->pktout, TRUE); /* signature included */
7148 ssh2_pkt_addstring_start(s->pktout);
7149 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
7150 ssh2_pkt_addstring_start(s->pktout);
7151 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
7153 /* Ask agent for signature. */
7154 s->siglen = s->pktout->length - 5 + 4 +
7155 ssh->v2_session_id_len;
7156 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
7158 s->len = 1; /* message type */
7159 s->len += 4 + s->pklen; /* key blob */
7160 s->len += 4 + s->siglen; /* data to sign */
7161 s->len += 4; /* flags */
7162 s->agentreq = snewn(4 + s->len, char);
7163 PUT_32BIT(s->agentreq, s->len);
7164 s->q = s->agentreq + 4;
7165 *s->q++ = SSH2_AGENTC_SIGN_REQUEST;
7166 PUT_32BIT(s->q, s->pklen);
7168 memcpy(s->q, s->pkblob, s->pklen);
7170 PUT_32BIT(s->q, s->siglen);
7172 /* Now the data to be signed... */
7173 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
7174 PUT_32BIT(s->q, ssh->v2_session_id_len);
7177 memcpy(s->q, ssh->v2_session_id,
7178 ssh->v2_session_id_len);
7179 s->q += ssh->v2_session_id_len;
7180 memcpy(s->q, s->pktout->data + 5,
7181 s->pktout->length - 5);
7182 s->q += s->pktout->length - 5;
7183 /* And finally the (zero) flags word. */
7185 if (!agent_query(s->agentreq, s->len + 4,
7187 ssh_agent_callback, ssh)) {
7191 bombout(("Unexpected data from server"
7192 " while waiting for agent"
7196 } while (pktin || inlen > 0);
7197 vret = ssh->agent_response;
7198 s->retlen = ssh->agent_response_len;
7203 if (s->ret[4] == SSH2_AGENT_SIGN_RESPONSE) {
7204 logevent("Sending Pageant's response");
7205 ssh2_add_sigblob(ssh, s->pktout,
7206 s->pkblob, s->pklen,
7208 GET_32BIT(s->ret + 5));
7209 ssh2_pkt_send(ssh, s->pktout);
7210 s->type = AUTH_TYPE_PUBLICKEY;
7212 /* FIXME: less drastic response */
7213 bombout(("Pageant failed to answer challenge"));
7219 /* Do we have any keys left to try? */
7220 if (s->pkblob_in_agent) {
7221 s->done_agent = TRUE;
7222 s->tried_pubkey_config = TRUE;
7225 if (s->keyi >= s->nkeys)
7226 s->done_agent = TRUE;
7229 } else if (s->can_pubkey && s->publickey_blob &&
7230 !s->tried_pubkey_config) {
7232 struct ssh2_userkey *key; /* not live over crReturn */
7233 char *passphrase; /* not live over crReturn */
7235 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7236 ssh->pkt_ctx |= SSH2_PKTCTX_PUBLICKEY;
7238 s->tried_pubkey_config = TRUE;
7241 * Try the public key supplied in the configuration.
7243 * First, offer the public blob to see if the server is
7244 * willing to accept it.
7246 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7247 ssh2_pkt_addstring(s->pktout, s->username);
7248 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7249 /* service requested */
7250 ssh2_pkt_addstring(s->pktout, "publickey"); /* method */
7251 ssh2_pkt_addbool(s->pktout, FALSE);
7252 /* no signature included */
7253 ssh2_pkt_addstring(s->pktout, s->publickey_algorithm);
7254 ssh2_pkt_addstring_start(s->pktout);
7255 ssh2_pkt_addstring_data(s->pktout,
7256 (char *)s->publickey_blob,
7257 s->publickey_bloblen);
7258 ssh2_pkt_send(ssh, s->pktout);
7259 logevent("Offered public key");
7261 crWaitUntilV(pktin);
7262 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
7263 /* Key refused. Give up. */
7264 s->gotit = TRUE; /* reconsider message next loop */
7265 s->type = AUTH_TYPE_PUBLICKEY_OFFER_LOUD;
7266 continue; /* process this new message */
7268 logevent("Offer of public key accepted");
7271 * Actually attempt a serious authentication using
7274 if (flags & FLAG_VERBOSE) {
7275 c_write_str(ssh, "Authenticating with public key \"");
7276 c_write_str(ssh, s->publickey_comment);
7277 c_write_str(ssh, "\"\r\n");
7281 const char *error; /* not live over crReturn */
7282 if (s->publickey_encrypted) {
7284 * Get a passphrase from the user.
7286 int ret; /* need not be kept over crReturn */
7287 s->cur_prompt = new_prompts(ssh->frontend);
7288 s->cur_prompt->to_server = FALSE;
7289 s->cur_prompt->name = dupstr("SSH key passphrase");
7290 add_prompt(s->cur_prompt,
7291 dupprintf("Passphrase for key \"%.100s\": ",
7292 s->publickey_comment),
7293 FALSE, SSH_MAX_PASSWORD_LEN);
7294 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7297 crWaitUntilV(!pktin);
7298 ret = get_userpass_input(s->cur_prompt,
7303 /* Failed to get a passphrase. Terminate. */
7304 free_prompts(s->cur_prompt);
7305 ssh_disconnect(ssh, NULL,
7306 "Unable to authenticate",
7307 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7312 dupstr(s->cur_prompt->prompts[0]->result);
7313 free_prompts(s->cur_prompt);
7315 passphrase = NULL; /* no passphrase needed */
7319 * Try decrypting the key.
7321 key = ssh2_load_userkey(&ssh->cfg.keyfile, passphrase,
7324 /* burn the evidence */
7325 memset(passphrase, 0, strlen(passphrase));
7328 if (key == SSH2_WRONG_PASSPHRASE || key == NULL) {
7330 (key == SSH2_WRONG_PASSPHRASE)) {
7331 c_write_str(ssh, "Wrong passphrase\r\n");
7333 /* and loop again */
7335 c_write_str(ssh, "Unable to load private key (");
7336 c_write_str(ssh, error);
7337 c_write_str(ssh, ")\r\n");
7339 break; /* try something else */
7345 unsigned char *pkblob, *sigblob, *sigdata;
7346 int pkblob_len, sigblob_len, sigdata_len;
7350 * We have loaded the private key and the server
7351 * has announced that it's willing to accept it.
7352 * Hallelujah. Generate a signature and send it.
7354 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7355 ssh2_pkt_addstring(s->pktout, s->username);
7356 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7357 /* service requested */
7358 ssh2_pkt_addstring(s->pktout, "publickey");
7360 ssh2_pkt_addbool(s->pktout, TRUE);
7361 /* signature follows */
7362 ssh2_pkt_addstring(s->pktout, key->alg->name);
7363 pkblob = key->alg->public_blob(key->data,
7365 ssh2_pkt_addstring_start(s->pktout);
7366 ssh2_pkt_addstring_data(s->pktout, (char *)pkblob,
7370 * The data to be signed is:
7374 * followed by everything so far placed in the
7377 sigdata_len = s->pktout->length - 5 + 4 +
7378 ssh->v2_session_id_len;
7379 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
7381 sigdata = snewn(sigdata_len, unsigned char);
7383 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
7384 PUT_32BIT(sigdata+p, ssh->v2_session_id_len);
7387 memcpy(sigdata+p, ssh->v2_session_id,
7388 ssh->v2_session_id_len);
7389 p += ssh->v2_session_id_len;
7390 memcpy(sigdata+p, s->pktout->data + 5,
7391 s->pktout->length - 5);
7392 p += s->pktout->length - 5;
7393 assert(p == sigdata_len);
7394 sigblob = key->alg->sign(key->data, (char *)sigdata,
7395 sigdata_len, &sigblob_len);
7396 ssh2_add_sigblob(ssh, s->pktout, pkblob, pkblob_len,
7397 sigblob, sigblob_len);
7402 ssh2_pkt_send(ssh, s->pktout);
7403 s->type = AUTH_TYPE_PUBLICKEY;
7404 key->alg->freekey(key->data);
7407 } else if (s->can_keyb_inter && !s->kbd_inter_refused) {
7410 * Keyboard-interactive authentication.
7413 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
7415 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7416 ssh->pkt_ctx |= SSH2_PKTCTX_KBDINTER;
7418 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7419 ssh2_pkt_addstring(s->pktout, s->username);
7420 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7421 /* service requested */
7422 ssh2_pkt_addstring(s->pktout, "keyboard-interactive");
7424 ssh2_pkt_addstring(s->pktout, ""); /* lang */
7425 ssh2_pkt_addstring(s->pktout, ""); /* submethods */
7426 ssh2_pkt_send(ssh, s->pktout);
7428 crWaitUntilV(pktin);
7429 if (pktin->type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
7430 /* Server is not willing to do keyboard-interactive
7431 * at all (or, bizarrely but legally, accepts the
7432 * user without actually issuing any prompts).
7433 * Give up on it entirely. */
7435 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE)
7436 logevent("Keyboard-interactive authentication refused");
7437 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET;
7438 s->kbd_inter_refused = TRUE; /* don't try it again */
7443 * Loop while the server continues to send INFO_REQUESTs.
7445 while (pktin->type == SSH2_MSG_USERAUTH_INFO_REQUEST) {
7447 char *name, *inst, *lang;
7448 int name_len, inst_len, lang_len;
7452 * We've got a fresh USERAUTH_INFO_REQUEST.
7453 * Get the preamble and start building a prompt.
7455 ssh_pkt_getstring(pktin, &name, &name_len);
7456 ssh_pkt_getstring(pktin, &inst, &inst_len);
7457 ssh_pkt_getstring(pktin, &lang, &lang_len);
7458 s->cur_prompt = new_prompts(ssh->frontend);
7459 s->cur_prompt->to_server = TRUE;
7461 /* FIXME: better prefix to distinguish from
7463 s->cur_prompt->name =
7464 dupprintf("SSH server: %.*s", name_len, name);
7465 s->cur_prompt->name_reqd = TRUE;
7467 s->cur_prompt->name =
7468 dupstr("SSH server authentication");
7469 s->cur_prompt->name_reqd = FALSE;
7471 /* FIXME: ugly to print "Using..." in prompt _every_
7472 * time round. Can this be done more subtly? */
7473 s->cur_prompt->instruction =
7474 dupprintf("Using keyboard-interactive authentication.%s%.*s",
7475 inst_len ? "\n" : "", inst_len, inst);
7476 s->cur_prompt->instr_reqd = TRUE;
7479 * Get the prompts from the packet.
7481 s->num_prompts = ssh_pkt_getuint32(pktin);
7482 for (i = 0; i < s->num_prompts; i++) {
7486 static char noprompt[] =
7487 "<server failed to send prompt>: ";
7489 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
7490 echo = ssh2_pkt_getbool(pktin);
7493 prompt_len = lenof(noprompt)-1;
7495 add_prompt(s->cur_prompt,
7496 dupprintf("%.*s", prompt_len, prompt),
7497 echo, SSH_MAX_PASSWORD_LEN);
7501 * Get the user's responses.
7503 if (s->num_prompts) {
7504 int ret; /* not live over crReturn */
7505 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7508 crWaitUntilV(!pktin);
7509 ret = get_userpass_input(s->cur_prompt, in, inlen);
7514 * Failed to get responses. Terminate.
7516 free_prompts(s->cur_prompt);
7517 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7518 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7525 * Send the responses to the server.
7527 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_INFO_RESPONSE);
7528 ssh2_pkt_adduint32(s->pktout, s->num_prompts);
7529 for (i=0; i < s->num_prompts; i++) {
7530 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7531 ssh2_pkt_addstring(s->pktout,
7532 s->cur_prompt->prompts[i]->result);
7533 end_log_omission(ssh, s->pktout);
7535 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
7538 * Get the next packet in case it's another
7541 crWaitUntilV(pktin);
7546 * We should have SUCCESS or FAILURE now.
7550 } else if (s->can_passwd) {
7553 * Plain old password authentication.
7555 int ret; /* not live over crReturn */
7556 int changereq_first_time; /* not live over crReturn */
7558 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7559 ssh->pkt_ctx |= SSH2_PKTCTX_PASSWORD;
7561 s->cur_prompt = new_prompts(ssh->frontend);
7562 s->cur_prompt->to_server = TRUE;
7563 s->cur_prompt->name = dupstr("SSH password");
7564 add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
7567 FALSE, SSH_MAX_PASSWORD_LEN);
7569 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7572 crWaitUntilV(!pktin);
7573 ret = get_userpass_input(s->cur_prompt, in, inlen);
7578 * Failed to get responses. Terminate.
7580 free_prompts(s->cur_prompt);
7581 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7582 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7587 * Squirrel away the password. (We may need it later if
7588 * asked to change it.)
7590 s->password = dupstr(s->cur_prompt->prompts[0]->result);
7591 free_prompts(s->cur_prompt);
7594 * Send the password packet.
7596 * We pad out the password packet to 256 bytes to make
7597 * it harder for an attacker to find the length of the
7600 * Anyone using a password longer than 256 bytes
7601 * probably doesn't have much to worry about from
7602 * people who find out how long their password is!
7604 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7605 ssh2_pkt_addstring(s->pktout, s->username);
7606 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7607 /* service requested */
7608 ssh2_pkt_addstring(s->pktout, "password");
7609 ssh2_pkt_addbool(s->pktout, FALSE);
7610 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7611 ssh2_pkt_addstring(s->pktout, s->password);
7612 end_log_omission(ssh, s->pktout);
7613 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
7614 logevent("Sent password");
7615 s->type = AUTH_TYPE_PASSWORD;
7618 * Wait for next packet, in case it's a password change
7621 crWaitUntilV(pktin);
7622 changereq_first_time = TRUE;
7624 while (pktin->type == SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ) {
7627 * We're being asked for a new password
7628 * (perhaps not for the first time).
7629 * Loop until the server accepts it.
7632 int got_new = FALSE; /* not live over crReturn */
7633 char *prompt; /* not live over crReturn */
7634 int prompt_len; /* not live over crReturn */
7638 if (changereq_first_time)
7639 msg = "Server requested password change";
7641 msg = "Server rejected new password";
7643 c_write_str(ssh, msg);
7644 c_write_str(ssh, "\r\n");
7647 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
7649 s->cur_prompt = new_prompts(ssh->frontend);
7650 s->cur_prompt->to_server = TRUE;
7651 s->cur_prompt->name = dupstr("New SSH password");
7652 s->cur_prompt->instruction =
7653 dupprintf("%.*s", prompt_len, prompt);
7654 s->cur_prompt->instr_reqd = TRUE;
7656 * There's no explicit requirement in the protocol
7657 * for the "old" passwords in the original and
7658 * password-change messages to be the same, and
7659 * apparently some Cisco kit supports password change
7660 * by the user entering a blank password originally
7661 * and the real password subsequently, so,
7662 * reluctantly, we prompt for the old password again.
7664 * (On the other hand, some servers don't even bother
7665 * to check this field.)
7667 add_prompt(s->cur_prompt,
7668 dupstr("Current password (blank for previously entered password): "),
7669 FALSE, SSH_MAX_PASSWORD_LEN);
7670 add_prompt(s->cur_prompt, dupstr("Enter new password: "),
7671 FALSE, SSH_MAX_PASSWORD_LEN);
7672 add_prompt(s->cur_prompt, dupstr("Confirm new password: "),
7673 FALSE, SSH_MAX_PASSWORD_LEN);
7676 * Loop until the user manages to enter the same
7681 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7684 crWaitUntilV(!pktin);
7685 ret = get_userpass_input(s->cur_prompt, in, inlen);
7690 * Failed to get responses. Terminate.
7692 /* burn the evidence */
7693 free_prompts(s->cur_prompt);
7694 memset(s->password, 0, strlen(s->password));
7696 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7697 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7703 * If the user specified a new original password
7704 * (IYSWIM), overwrite any previously specified
7706 * (A side effect is that the user doesn't have to
7707 * re-enter it if they louse up the new password.)
7709 if (s->cur_prompt->prompts[0]->result[0]) {
7710 memset(s->password, 0, strlen(s->password));
7711 /* burn the evidence */
7714 dupstr(s->cur_prompt->prompts[0]->result);
7718 * Check the two new passwords match.
7720 got_new = (strcmp(s->cur_prompt->prompts[1]->result,
7721 s->cur_prompt->prompts[2]->result)
7724 /* They don't. Silly user. */
7725 c_write_str(ssh, "Passwords do not match\r\n");
7730 * Send the new password (along with the old one).
7731 * (see above for padding rationale)
7733 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7734 ssh2_pkt_addstring(s->pktout, s->username);
7735 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7736 /* service requested */
7737 ssh2_pkt_addstring(s->pktout, "password");
7738 ssh2_pkt_addbool(s->pktout, TRUE);
7739 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7740 ssh2_pkt_addstring(s->pktout, s->password);
7741 ssh2_pkt_addstring(s->pktout,
7742 s->cur_prompt->prompts[1]->result);
7743 free_prompts(s->cur_prompt);
7744 end_log_omission(ssh, s->pktout);
7745 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
7746 logevent("Sent new password");
7749 * Now see what the server has to say about it.
7750 * (If it's CHANGEREQ again, it's not happy with the
7753 crWaitUntilV(pktin);
7754 changereq_first_time = FALSE;
7759 * We need to reexamine the current pktin at the top
7760 * of the loop. Either:
7761 * - we weren't asked to change password at all, in
7762 * which case it's a SUCCESS or FAILURE with the
7764 * - we sent a new password, and the server was
7765 * either OK with it (SUCCESS or FAILURE w/partial
7766 * success) or unhappy with the _old_ password
7767 * (FAILURE w/o partial success)
7768 * In any of these cases, we go back to the top of
7769 * the loop and start again.
7774 * We don't need the old password any more, in any
7775 * case. Burn the evidence.
7777 memset(s->password, 0, strlen(s->password));
7782 ssh_disconnect(ssh, NULL,
7783 "No supported authentication methods available",
7784 SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
7792 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
7794 /* Clear up various bits and pieces from authentication. */
7795 if (s->publickey_blob) {
7796 sfree(s->publickey_blob);
7797 sfree(s->publickey_comment);
7799 if (s->agent_response)
7800 sfree(s->agent_response);
7803 * Now the connection protocol has started, one way or another.
7806 ssh->channels = newtree234(ssh_channelcmp);
7809 * Set up handlers for some connection protocol messages, so we
7810 * don't have to handle them repeatedly in this coroutine.
7812 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] =
7813 ssh2_msg_channel_window_adjust;
7814 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] =
7815 ssh2_msg_global_request;
7818 * Create the main session channel.
7820 if (ssh->cfg.ssh_no_shell) {
7821 ssh->mainchan = NULL;
7822 } else if (*ssh->cfg.ssh_nc_host) {
7824 * Just start a direct-tcpip channel and use it as the main
7827 ssh->mainchan = snew(struct ssh_channel);
7828 ssh->mainchan->ssh = ssh;
7829 ssh->mainchan->localid = alloc_channel_id(ssh);
7831 "Opening direct-tcpip channel to %s:%d in place of session",
7832 ssh->cfg.ssh_nc_host, ssh->cfg.ssh_nc_port);
7833 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
7834 ssh2_pkt_addstring(s->pktout, "direct-tcpip");
7835 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
7836 ssh->mainchan->v.v2.locwindow = OUR_V2_WINSIZE;
7837 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
7838 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
7839 ssh2_pkt_addstring(s->pktout, ssh->cfg.ssh_nc_host);
7840 ssh2_pkt_adduint32(s->pktout, ssh->cfg.ssh_nc_port);
7842 * There's nothing meaningful to put in the originator
7843 * fields, but some servers insist on syntactically correct
7846 ssh2_pkt_addstring(s->pktout, "0.0.0.0");
7847 ssh2_pkt_adduint32(s->pktout, 0);
7848 ssh2_pkt_send(ssh, s->pktout);
7850 crWaitUntilV(pktin);
7851 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
7852 bombout(("Server refused to open a direct-tcpip channel"));
7854 /* FIXME: error data comes back in FAILURE packet */
7856 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
7857 bombout(("Server's channel confirmation cited wrong channel"));
7860 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
7861 ssh->mainchan->halfopen = FALSE;
7862 ssh->mainchan->type = CHAN_MAINSESSION;
7863 ssh->mainchan->closes = 0;
7864 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
7865 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
7866 bufchain_init(&ssh->mainchan->v.v2.outbuffer);
7867 add234(ssh->channels, ssh->mainchan);
7868 update_specials_menu(ssh->frontend);
7869 logevent("Opened direct-tcpip channel");
7872 ssh->mainchan = snew(struct ssh_channel);
7873 ssh->mainchan->ssh = ssh;
7874 ssh->mainchan->localid = alloc_channel_id(ssh);
7875 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
7876 ssh2_pkt_addstring(s->pktout, "session");
7877 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
7878 ssh->mainchan->v.v2.locwindow = OUR_V2_WINSIZE;
7879 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
7880 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
7881 ssh2_pkt_send(ssh, s->pktout);
7882 crWaitUntilV(pktin);
7883 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
7884 bombout(("Server refused to open a session"));
7886 /* FIXME: error data comes back in FAILURE packet */
7888 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
7889 bombout(("Server's channel confirmation cited wrong channel"));
7892 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
7893 ssh->mainchan->halfopen = FALSE;
7894 ssh->mainchan->type = CHAN_MAINSESSION;
7895 ssh->mainchan->closes = 0;
7896 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
7897 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
7898 bufchain_init(&ssh->mainchan->v.v2.outbuffer);
7899 add234(ssh->channels, ssh->mainchan);
7900 update_specials_menu(ssh->frontend);
7901 logevent("Opened channel for session");
7902 ssh->ncmode = FALSE;
7906 * Now we have a channel, make dispatch table entries for
7907 * general channel-based messages.
7909 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] =
7910 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] =
7911 ssh2_msg_channel_data;
7912 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_channel_eof;
7913 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_channel_close;
7914 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] =
7915 ssh2_msg_channel_open_confirmation;
7916 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] =
7917 ssh2_msg_channel_open_failure;
7918 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] =
7919 ssh2_msg_channel_request;
7920 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] =
7921 ssh2_msg_channel_open;
7924 * Potentially enable X11 forwarding.
7926 if (ssh->mainchan && !ssh->ncmode && ssh->cfg.x11_forward) {
7927 char proto[20], data[64];
7928 logevent("Requesting X11 forwarding");
7929 ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
7930 data, sizeof(data), ssh->cfg.x11_auth);
7931 x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display);
7932 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
7933 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
7934 ssh2_pkt_addstring(s->pktout, "x11-req");
7935 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
7936 ssh2_pkt_addbool(s->pktout, 0); /* many connections */
7937 ssh2_pkt_addstring(s->pktout, proto);
7939 * Note that while we blank the X authentication data here, we don't
7940 * take any special action to blank the start of an X11 channel,
7941 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
7942 * without having session blanking enabled is likely to leak your
7943 * cookie into the log.
7945 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7946 ssh2_pkt_addstring(s->pktout, data);
7947 end_log_omission(ssh, s->pktout);
7948 ssh2_pkt_adduint32(s->pktout, x11_get_screen_number(ssh->cfg.x11_display));
7949 ssh2_pkt_send(ssh, s->pktout);
7951 crWaitUntilV(pktin);
7953 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
7954 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
7955 bombout(("Unexpected response to X11 forwarding request:"
7956 " packet type %d", pktin->type));
7959 logevent("X11 forwarding refused");
7961 logevent("X11 forwarding enabled");
7962 ssh->X11_fwd_enabled = TRUE;
7967 * Enable port forwardings.
7969 ssh_setup_portfwd(ssh, &ssh->cfg);
7972 * Potentially enable agent forwarding.
7974 if (ssh->mainchan && !ssh->ncmode && ssh->cfg.agentfwd && agent_exists()) {
7975 logevent("Requesting OpenSSH-style agent forwarding");
7976 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
7977 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
7978 ssh2_pkt_addstring(s->pktout, "auth-agent-req@openssh.com");
7979 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
7980 ssh2_pkt_send(ssh, s->pktout);
7982 crWaitUntilV(pktin);
7984 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
7985 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
7986 bombout(("Unexpected response to agent forwarding request:"
7987 " packet type %d", pktin->type));
7990 logevent("Agent forwarding refused");
7992 logevent("Agent forwarding enabled");
7993 ssh->agentfwd_enabled = TRUE;
7998 * Now allocate a pty for the session.
8000 if (ssh->mainchan && !ssh->ncmode && !ssh->cfg.nopty) {
8001 /* Unpick the terminal-speed string. */
8002 /* XXX perhaps we should allow no speeds to be sent. */
8003 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
8004 sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
8005 /* Build the pty request. */
8006 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8007 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
8008 ssh2_pkt_addstring(s->pktout, "pty-req");
8009 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8010 ssh2_pkt_addstring(s->pktout, ssh->cfg.termtype);
8011 ssh2_pkt_adduint32(s->pktout, ssh->term_width);
8012 ssh2_pkt_adduint32(s->pktout, ssh->term_height);
8013 ssh2_pkt_adduint32(s->pktout, 0); /* pixel width */
8014 ssh2_pkt_adduint32(s->pktout, 0); /* pixel height */
8015 ssh2_pkt_addstring_start(s->pktout);
8016 parse_ttymodes(ssh, ssh->cfg.ttymodes,
8017 ssh2_send_ttymode, (void *)s->pktout);
8018 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_ISPEED);
8019 ssh2_pkt_adduint32(s->pktout, ssh->ispeed);
8020 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_OSPEED);
8021 ssh2_pkt_adduint32(s->pktout, ssh->ospeed);
8022 ssh2_pkt_addstring_data(s->pktout, "\0", 1); /* TTY_OP_END */
8023 ssh2_pkt_send(ssh, s->pktout);
8024 ssh->state = SSH_STATE_INTERMED;
8026 crWaitUntilV(pktin);
8028 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8029 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8030 bombout(("Unexpected response to pty request:"
8031 " packet type %d", pktin->type));
8034 c_write_str(ssh, "Server refused to allocate pty\r\n");
8035 ssh->editing = ssh->echoing = 1;
8037 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
8038 ssh->ospeed, ssh->ispeed);
8041 ssh->editing = ssh->echoing = 1;
8045 * Send environment variables.
8047 * Simplest thing here is to send all the requests at once, and
8048 * then wait for a whole bunch of successes or failures.
8050 if (ssh->mainchan && !ssh->ncmode && *ssh->cfg.environmt) {
8051 char *e = ssh->cfg.environmt;
8052 char *var, *varend, *val;
8058 while (*e && *e != '\t') e++;
8060 if (*e == '\t') e++;
8065 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8066 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8067 ssh2_pkt_addstring(s->pktout, "env");
8068 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8069 ssh2_pkt_addstring_start(s->pktout);
8070 ssh2_pkt_addstring_data(s->pktout, var, varend-var);
8071 ssh2_pkt_addstring(s->pktout, val);
8072 ssh2_pkt_send(ssh, s->pktout);
8077 logeventf(ssh, "Sent %d environment variables", s->num_env);
8080 s->env_left = s->num_env;
8082 while (s->env_left > 0) {
8083 crWaitUntilV(pktin);
8085 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8086 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8087 bombout(("Unexpected response to environment request:"
8088 " packet type %d", pktin->type));
8098 if (s->env_ok == s->num_env) {
8099 logevent("All environment variables successfully set");
8100 } else if (s->env_ok == 0) {
8101 logevent("All environment variables refused");
8102 c_write_str(ssh, "Server refused to set environment variables\r\n");
8104 logeventf(ssh, "%d environment variables refused",
8105 s->num_env - s->env_ok);
8106 c_write_str(ssh, "Server refused to set all environment variables\r\n");
8111 * Start a shell or a remote command. We may have to attempt
8112 * this twice if the config data has provided a second choice
8115 if (ssh->mainchan && !ssh->ncmode) while (1) {
8119 if (ssh->fallback_cmd) {
8120 subsys = ssh->cfg.ssh_subsys2;
8121 cmd = ssh->cfg.remote_cmd_ptr2;
8123 subsys = ssh->cfg.ssh_subsys;
8124 cmd = ssh->cfg.remote_cmd_ptr;
8125 if (!cmd) cmd = ssh->cfg.remote_cmd;
8128 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8129 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
8131 ssh2_pkt_addstring(s->pktout, "subsystem");
8132 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8133 ssh2_pkt_addstring(s->pktout, cmd);
8135 ssh2_pkt_addstring(s->pktout, "exec");
8136 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8137 ssh2_pkt_addstring(s->pktout, cmd);
8139 ssh2_pkt_addstring(s->pktout, "shell");
8140 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8142 ssh2_pkt_send(ssh, s->pktout);
8144 crWaitUntilV(pktin);
8146 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8147 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8148 bombout(("Unexpected response to shell/command request:"
8149 " packet type %d", pktin->type));
8153 * We failed to start the command. If this is the
8154 * fallback command, we really are finished; if it's
8155 * not, and if the fallback command exists, try falling
8156 * back to it before complaining.
8158 if (!ssh->fallback_cmd && ssh->cfg.remote_cmd_ptr2 != NULL) {
8159 logevent("Primary command failed; attempting fallback");
8160 ssh->fallback_cmd = TRUE;
8163 bombout(("Server refused to start a shell/command"));
8166 logevent("Started a shell/command");
8171 ssh->state = SSH_STATE_SESSION;
8172 if (ssh->size_needed)
8173 ssh_size(ssh, ssh->term_width, ssh->term_height);
8174 if (ssh->eof_needed)
8175 ssh_special(ssh, TS_EOF);
8181 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
8186 s->try_send = FALSE;
8190 * _All_ the connection-layer packets we expect to
8191 * receive are now handled by the dispatch table.
8192 * Anything that reaches here must be bogus.
8195 bombout(("Strange packet received: type %d", pktin->type));
8197 } else if (ssh->mainchan) {
8199 * We have spare data. Add it to the channel buffer.
8201 ssh2_add_channel_data(ssh->mainchan, (char *)in, inlen);
8206 struct ssh_channel *c;
8208 * Try to send data on all channels if we can.
8210 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++)
8211 ssh2_try_send_and_unthrottle(c);
8219 * Handlers for SSH-2 messages that might arrive at any moment.
8221 static void ssh2_msg_disconnect(Ssh ssh, struct Packet *pktin)
8223 /* log reason code in disconnect message */
8225 int nowlen, reason, msglen;
8227 reason = ssh_pkt_getuint32(pktin);
8228 ssh_pkt_getstring(pktin, &msg, &msglen);
8230 if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
8231 buf = dupprintf("Received disconnect message (%s)",
8232 ssh2_disconnect_reasons[reason]);
8234 buf = dupprintf("Received disconnect message (unknown"
8235 " type %d)", reason);
8239 buf = dupprintf("Disconnection message text: %n%.*s",
8240 &nowlen, msglen, msg);
8242 bombout(("Server sent disconnect message\ntype %d (%s):\n\"%s\"",
8244 (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ?
8245 ssh2_disconnect_reasons[reason] : "unknown",
8250 static void ssh2_msg_debug(Ssh ssh, struct Packet *pktin)
8252 /* log the debug message */
8257 /* XXX maybe we should actually take notice of this */
8258 always_display = ssh2_pkt_getbool(pktin);
8259 ssh_pkt_getstring(pktin, &msg, &msglen);
8261 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
8264 static void ssh2_msg_something_unimplemented(Ssh ssh, struct Packet *pktin)
8266 struct Packet *pktout;
8267 pktout = ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED);
8268 ssh2_pkt_adduint32(pktout, pktin->sequence);
8270 * UNIMPLEMENTED messages MUST appear in the same order as the
8271 * messages they respond to. Hence, never queue them.
8273 ssh2_pkt_send_noqueue(ssh, pktout);
8277 * Handle the top-level SSH-2 protocol.
8279 static void ssh2_protocol_setup(Ssh ssh)
8284 * Most messages cause SSH2_MSG_UNIMPLEMENTED.
8286 for (i = 0; i < 256; i++)
8287 ssh->packet_dispatch[i] = ssh2_msg_something_unimplemented;
8290 * Any message we actually understand, we set to NULL so that
8291 * the coroutines will get it.
8293 ssh->packet_dispatch[SSH2_MSG_UNIMPLEMENTED] = NULL;
8294 ssh->packet_dispatch[SSH2_MSG_SERVICE_REQUEST] = NULL;
8295 ssh->packet_dispatch[SSH2_MSG_SERVICE_ACCEPT] = NULL;
8296 ssh->packet_dispatch[SSH2_MSG_KEXINIT] = NULL;
8297 ssh->packet_dispatch[SSH2_MSG_NEWKEYS] = NULL;
8298 ssh->packet_dispatch[SSH2_MSG_KEXDH_INIT] = NULL;
8299 ssh->packet_dispatch[SSH2_MSG_KEXDH_REPLY] = NULL;
8300 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REQUEST] = NULL; duplicate case value */
8301 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_GROUP] = NULL; duplicate case value */
8302 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_INIT] = NULL;
8303 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REPLY] = NULL;
8304 ssh->packet_dispatch[SSH2_MSG_USERAUTH_REQUEST] = NULL;
8305 ssh->packet_dispatch[SSH2_MSG_USERAUTH_FAILURE] = NULL;
8306 ssh->packet_dispatch[SSH2_MSG_USERAUTH_SUCCESS] = NULL;
8307 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
8308 ssh->packet_dispatch[SSH2_MSG_USERAUTH_PK_OK] = NULL;
8309 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ] = NULL; duplicate case value */
8310 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_REQUEST] = NULL; duplicate case value */
8311 ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_RESPONSE] = NULL;
8312 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = NULL;
8313 ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = NULL;
8314 ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = NULL;
8315 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = NULL;
8316 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = NULL;
8317 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = NULL;
8318 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = NULL;
8319 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = NULL;
8320 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = NULL;
8321 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = NULL;
8322 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = NULL;
8323 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = NULL;
8324 ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = NULL;
8325 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = NULL;
8328 * These special message types we install handlers for.
8330 ssh->packet_dispatch[SSH2_MSG_DISCONNECT] = ssh2_msg_disconnect;
8331 ssh->packet_dispatch[SSH2_MSG_IGNORE] = ssh_msg_ignore; /* shared with SSH-1 */
8332 ssh->packet_dispatch[SSH2_MSG_DEBUG] = ssh2_msg_debug;
8335 static void ssh2_timer(void *ctx, long now)
8339 if (ssh->state == SSH_STATE_CLOSED)
8342 if (!ssh->kex_in_progress && ssh->cfg.ssh_rekey_time != 0 &&
8343 now - ssh->next_rekey >= 0) {
8344 do_ssh2_transport(ssh, "timeout", -1, NULL);
8348 static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
8349 struct Packet *pktin)
8351 unsigned char *in = (unsigned char *)vin;
8352 if (ssh->state == SSH_STATE_CLOSED)
8356 ssh->incoming_data_size += pktin->encrypted_len;
8357 if (!ssh->kex_in_progress &&
8358 ssh->max_data_size != 0 &&
8359 ssh->incoming_data_size > ssh->max_data_size)
8360 do_ssh2_transport(ssh, "too much data received", -1, NULL);
8363 if (pktin && ssh->packet_dispatch[pktin->type]) {
8364 ssh->packet_dispatch[pktin->type](ssh, pktin);
8368 if (!ssh->protocol_initial_phase_done ||
8369 (pktin && pktin->type >= 20 && pktin->type < 50)) {
8370 if (do_ssh2_transport(ssh, in, inlen, pktin) &&
8371 !ssh->protocol_initial_phase_done) {
8372 ssh->protocol_initial_phase_done = TRUE;
8374 * Allow authconn to initialise itself.
8376 do_ssh2_authconn(ssh, NULL, 0, NULL);
8379 do_ssh2_authconn(ssh, in, inlen, pktin);
8384 * Called to set up the connection.
8386 * Returns an error message, or NULL on success.
8388 static const char *ssh_init(void *frontend_handle, void **backend_handle,
8390 char *host, int port, char **realhost, int nodelay,
8396 ssh = snew(struct ssh_tag);
8397 ssh->cfg = *cfg; /* STRUCTURE COPY */
8398 ssh->version = 0; /* when not ready yet */
8401 ssh->v1_cipher_ctx = NULL;
8402 ssh->crcda_ctx = NULL;
8403 ssh->cscipher = NULL;
8404 ssh->cs_cipher_ctx = NULL;
8405 ssh->sccipher = NULL;
8406 ssh->sc_cipher_ctx = NULL;
8408 ssh->cs_mac_ctx = NULL;
8410 ssh->sc_mac_ctx = NULL;
8412 ssh->cs_comp_ctx = NULL;
8414 ssh->sc_comp_ctx = NULL;
8416 ssh->kex_ctx = NULL;
8417 ssh->hostkey = NULL;
8419 ssh->close_expected = FALSE;
8420 ssh->clean_exit = FALSE;
8421 ssh->state = SSH_STATE_PREPACKET;
8422 ssh->size_needed = FALSE;
8423 ssh->eof_needed = FALSE;
8426 ssh->deferred_send_data = NULL;
8427 ssh->deferred_len = 0;
8428 ssh->deferred_size = 0;
8429 ssh->fallback_cmd = 0;
8431 ssh->x11auth = NULL;
8432 ssh->v1_compressing = FALSE;
8433 ssh->v2_outgoing_sequence = 0;
8434 ssh->ssh1_rdpkt_crstate = 0;
8435 ssh->ssh2_rdpkt_crstate = 0;
8436 ssh->do_ssh_init_crstate = 0;
8437 ssh->ssh_gotdata_crstate = 0;
8438 ssh->do_ssh1_connection_crstate = 0;
8439 ssh->do_ssh1_login_crstate = 0;
8440 ssh->do_ssh2_transport_crstate = 0;
8441 ssh->do_ssh2_authconn_crstate = 0;
8442 ssh->do_ssh_init_state = NULL;
8443 ssh->do_ssh1_login_state = NULL;
8444 ssh->do_ssh2_transport_state = NULL;
8445 ssh->do_ssh2_authconn_state = NULL;
8448 ssh->mainchan = NULL;
8449 ssh->throttled_all = 0;
8450 ssh->v1_stdout_throttling = 0;
8452 ssh->queuelen = ssh->queuesize = 0;
8453 ssh->queueing = FALSE;
8454 ssh->qhead = ssh->qtail = NULL;
8455 ssh->deferred_rekey_reason = NULL;
8456 bufchain_init(&ssh->queued_incoming_data);
8457 ssh->frozen = FALSE;
8459 *backend_handle = ssh;
8462 if (crypto_startup() == 0)
8463 return "Microsoft high encryption pack not installed!";
8466 ssh->frontend = frontend_handle;
8467 ssh->term_width = ssh->cfg.width;
8468 ssh->term_height = ssh->cfg.height;
8470 ssh->channels = NULL;
8471 ssh->rportfwds = NULL;
8472 ssh->portfwds = NULL;
8477 ssh->v1_throttle_count = 0;
8478 ssh->overall_bufsize = 0;
8479 ssh->fallback_cmd = 0;
8481 ssh->protocol = NULL;
8483 ssh->protocol_initial_phase_done = FALSE;
8487 ssh->incoming_data_size = ssh->outgoing_data_size =
8488 ssh->deferred_data_size = 0L;
8489 ssh->max_data_size = parse_blocksize(ssh->cfg.ssh_rekey_data);
8490 ssh->kex_in_progress = FALSE;
8492 p = connect_to_host(ssh, host, port, realhost, nodelay, keepalive);
8501 static void ssh_free(void *handle)
8503 Ssh ssh = (Ssh) handle;
8504 struct ssh_channel *c;
8505 struct ssh_rportfwd *pf;
8507 if (ssh->v1_cipher_ctx)
8508 ssh->cipher->free_context(ssh->v1_cipher_ctx);
8509 if (ssh->cs_cipher_ctx)
8510 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
8511 if (ssh->sc_cipher_ctx)
8512 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
8513 if (ssh->cs_mac_ctx)
8514 ssh->csmac->free_context(ssh->cs_mac_ctx);
8515 if (ssh->sc_mac_ctx)
8516 ssh->scmac->free_context(ssh->sc_mac_ctx);
8517 if (ssh->cs_comp_ctx) {
8519 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
8521 zlib_compress_cleanup(ssh->cs_comp_ctx);
8523 if (ssh->sc_comp_ctx) {
8525 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
8527 zlib_decompress_cleanup(ssh->sc_comp_ctx);
8530 dh_cleanup(ssh->kex_ctx);
8531 sfree(ssh->savedhost);
8533 while (ssh->queuelen-- > 0)
8534 ssh_free_packet(ssh->queue[ssh->queuelen]);
8537 while (ssh->qhead) {
8538 struct queued_handler *qh = ssh->qhead;
8539 ssh->qhead = qh->next;
8542 ssh->qhead = ssh->qtail = NULL;
8544 if (ssh->channels) {
8545 while ((c = delpos234(ssh->channels, 0)) != NULL) {
8548 if (c->u.x11.s != NULL)
8549 x11_close(c->u.x11.s);
8552 if (c->u.pfd.s != NULL)
8553 pfd_close(c->u.pfd.s);
8558 freetree234(ssh->channels);
8559 ssh->channels = NULL;
8562 if (ssh->rportfwds) {
8563 while ((pf = delpos234(ssh->rportfwds, 0)) != NULL)
8565 freetree234(ssh->rportfwds);
8566 ssh->rportfwds = NULL;
8568 sfree(ssh->deferred_send_data);
8570 x11_free_auth(ssh->x11auth);
8571 sfree(ssh->do_ssh_init_state);
8572 sfree(ssh->do_ssh1_login_state);
8573 sfree(ssh->do_ssh2_transport_state);
8574 sfree(ssh->do_ssh2_authconn_state);
8577 if (ssh->crcda_ctx) {
8578 crcda_free_context(ssh->crcda_ctx);
8579 ssh->crcda_ctx = NULL;
8582 ssh_do_close(ssh, TRUE);
8583 expire_timer_context(ssh);
8585 pinger_free(ssh->pinger);
8586 bufchain_clear(&ssh->queued_incoming_data);
8593 * Reconfigure the SSH backend.
8595 static void ssh_reconfig(void *handle, Config *cfg)
8597 Ssh ssh = (Ssh) handle;
8598 char *rekeying = NULL, rekey_mandatory = FALSE;
8599 unsigned long old_max_data_size;
8601 pinger_reconfig(ssh->pinger, &ssh->cfg, cfg);
8603 ssh_setup_portfwd(ssh, cfg);
8605 if (ssh->cfg.ssh_rekey_time != cfg->ssh_rekey_time &&
8606 cfg->ssh_rekey_time != 0) {
8607 long new_next = ssh->last_rekey + cfg->ssh_rekey_time*60*TICKSPERSEC;
8608 long now = GETTICKCOUNT();
8610 if (new_next - now < 0) {
8611 rekeying = "timeout shortened";
8613 ssh->next_rekey = schedule_timer(new_next - now, ssh2_timer, ssh);
8617 old_max_data_size = ssh->max_data_size;
8618 ssh->max_data_size = parse_blocksize(cfg->ssh_rekey_data);
8619 if (old_max_data_size != ssh->max_data_size &&
8620 ssh->max_data_size != 0) {
8621 if (ssh->outgoing_data_size > ssh->max_data_size ||
8622 ssh->incoming_data_size > ssh->max_data_size)
8623 rekeying = "data limit lowered";
8626 if (ssh->cfg.compression != cfg->compression) {
8627 rekeying = "compression setting changed";
8628 rekey_mandatory = TRUE;
8631 if (ssh->cfg.ssh2_des_cbc != cfg->ssh2_des_cbc ||
8632 memcmp(ssh->cfg.ssh_cipherlist, cfg->ssh_cipherlist,
8633 sizeof(ssh->cfg.ssh_cipherlist))) {
8634 rekeying = "cipher settings changed";
8635 rekey_mandatory = TRUE;
8638 ssh->cfg = *cfg; /* STRUCTURE COPY */
8641 if (!ssh->kex_in_progress) {
8642 do_ssh2_transport(ssh, rekeying, -1, NULL);
8643 } else if (rekey_mandatory) {
8644 ssh->deferred_rekey_reason = rekeying;
8650 * Called to send data down the SSH connection.
8652 static int ssh_send(void *handle, char *buf, int len)
8654 Ssh ssh = (Ssh) handle;
8656 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
8659 ssh->protocol(ssh, (unsigned char *)buf, len, 0);
8661 return ssh_sendbuffer(ssh);
8665 * Called to query the current amount of buffered stdin data.
8667 static int ssh_sendbuffer(void *handle)
8669 Ssh ssh = (Ssh) handle;
8672 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
8676 * If the SSH socket itself has backed up, add the total backup
8677 * size on that to any individual buffer on the stdin channel.
8680 if (ssh->throttled_all)
8681 override_value = ssh->overall_bufsize;
8683 if (ssh->version == 1) {
8684 return override_value;
8685 } else if (ssh->version == 2) {
8686 if (!ssh->mainchan || ssh->mainchan->closes > 0)
8687 return override_value;
8689 return (override_value +
8690 bufchain_size(&ssh->mainchan->v.v2.outbuffer));
8697 * Called to set the size of the window from SSH's POV.
8699 static void ssh_size(void *handle, int width, int height)
8701 Ssh ssh = (Ssh) handle;
8702 struct Packet *pktout;
8704 ssh->term_width = width;
8705 ssh->term_height = height;
8707 switch (ssh->state) {
8708 case SSH_STATE_BEFORE_SIZE:
8709 case SSH_STATE_PREPACKET:
8710 case SSH_STATE_CLOSED:
8711 break; /* do nothing */
8712 case SSH_STATE_INTERMED:
8713 ssh->size_needed = TRUE; /* buffer for later */
8715 case SSH_STATE_SESSION:
8716 if (!ssh->cfg.nopty) {
8717 if (ssh->version == 1) {
8718 send_packet(ssh, SSH1_CMSG_WINDOW_SIZE,
8719 PKT_INT, ssh->term_height,
8720 PKT_INT, ssh->term_width,
8721 PKT_INT, 0, PKT_INT, 0, PKT_END);
8722 } else if (ssh->mainchan) {
8723 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8724 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8725 ssh2_pkt_addstring(pktout, "window-change");
8726 ssh2_pkt_addbool(pktout, 0);
8727 ssh2_pkt_adduint32(pktout, ssh->term_width);
8728 ssh2_pkt_adduint32(pktout, ssh->term_height);
8729 ssh2_pkt_adduint32(pktout, 0);
8730 ssh2_pkt_adduint32(pktout, 0);
8731 ssh2_pkt_send(ssh, pktout);
8739 * Return a list of the special codes that make sense in this
8742 static const struct telnet_special *ssh_get_specials(void *handle)
8744 static const struct telnet_special ssh1_ignore_special[] = {
8745 {"IGNORE message", TS_NOP}
8747 static const struct telnet_special ssh2_transport_specials[] = {
8748 {"IGNORE message", TS_NOP},
8749 {"Repeat key exchange", TS_REKEY},
8751 static const struct telnet_special ssh2_session_specials[] = {
8754 /* These are the signal names defined by draft-ietf-secsh-connect-23.
8755 * They include all the ISO C signals, but are a subset of the POSIX
8756 * required signals. */
8757 {"SIGINT (Interrupt)", TS_SIGINT},
8758 {"SIGTERM (Terminate)", TS_SIGTERM},
8759 {"SIGKILL (Kill)", TS_SIGKILL},
8760 {"SIGQUIT (Quit)", TS_SIGQUIT},
8761 {"SIGHUP (Hangup)", TS_SIGHUP},
8762 {"More signals", TS_SUBMENU},
8763 {"SIGABRT", TS_SIGABRT}, {"SIGALRM", TS_SIGALRM},
8764 {"SIGFPE", TS_SIGFPE}, {"SIGILL", TS_SIGILL},
8765 {"SIGPIPE", TS_SIGPIPE}, {"SIGSEGV", TS_SIGSEGV},
8766 {"SIGUSR1", TS_SIGUSR1}, {"SIGUSR2", TS_SIGUSR2},
8769 static const struct telnet_special specials_end[] = {
8772 /* XXX review this length for any changes: */
8773 static struct telnet_special ssh_specials[lenof(ssh2_transport_specials) +
8774 lenof(ssh2_session_specials) +
8775 lenof(specials_end)];
8776 Ssh ssh = (Ssh) handle;
8778 #define ADD_SPECIALS(name) \
8780 assert((i + lenof(name)) <= lenof(ssh_specials)); \
8781 memcpy(&ssh_specials[i], name, sizeof name); \
8785 if (ssh->version == 1) {
8786 /* Don't bother offering IGNORE if we've decided the remote
8787 * won't cope with it, since we wouldn't bother sending it if
8789 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
8790 ADD_SPECIALS(ssh1_ignore_special);
8791 } else if (ssh->version == 2) {
8792 ADD_SPECIALS(ssh2_transport_specials);
8794 ADD_SPECIALS(ssh2_session_specials);
8795 } /* else we're not ready yet */
8798 ADD_SPECIALS(specials_end);
8799 return ssh_specials;
8807 * Send special codes. TS_EOF is useful for `plink', so you
8808 * can send an EOF and collect resulting output (e.g. `plink
8811 static void ssh_special(void *handle, Telnet_Special code)
8813 Ssh ssh = (Ssh) handle;
8814 struct Packet *pktout;
8816 if (code == TS_EOF) {
8817 if (ssh->state != SSH_STATE_SESSION) {
8819 * Buffer the EOF in case we are pre-SESSION, so we can
8820 * send it as soon as we reach SESSION.
8823 ssh->eof_needed = TRUE;
8826 if (ssh->version == 1) {
8827 send_packet(ssh, SSH1_CMSG_EOF, PKT_END);
8828 } else if (ssh->mainchan) {
8829 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_EOF);
8830 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8831 ssh2_pkt_send(ssh, pktout);
8832 ssh->send_ok = 0; /* now stop trying to read from stdin */
8834 logevent("Sent EOF message");
8835 } else if (code == TS_PING || code == TS_NOP) {
8836 if (ssh->state == SSH_STATE_CLOSED
8837 || ssh->state == SSH_STATE_PREPACKET) return;
8838 if (ssh->version == 1) {
8839 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
8840 send_packet(ssh, SSH1_MSG_IGNORE, PKT_STR, "", PKT_END);
8842 pktout = ssh2_pkt_init(SSH2_MSG_IGNORE);
8843 ssh2_pkt_addstring_start(pktout);
8844 ssh2_pkt_send_noqueue(ssh, pktout);
8846 } else if (code == TS_REKEY) {
8847 if (!ssh->kex_in_progress && ssh->version == 2) {
8848 do_ssh2_transport(ssh, "at user request", -1, NULL);
8850 } else if (code == TS_BRK) {
8851 if (ssh->state == SSH_STATE_CLOSED
8852 || ssh->state == SSH_STATE_PREPACKET) return;
8853 if (ssh->version == 1) {
8854 logevent("Unable to send BREAK signal in SSH-1");
8855 } else if (ssh->mainchan) {
8856 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8857 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8858 ssh2_pkt_addstring(pktout, "break");
8859 ssh2_pkt_addbool(pktout, 0);
8860 ssh2_pkt_adduint32(pktout, 0); /* default break length */
8861 ssh2_pkt_send(ssh, pktout);
8864 /* Is is a POSIX signal? */
8865 char *signame = NULL;
8866 if (code == TS_SIGABRT) signame = "ABRT";
8867 if (code == TS_SIGALRM) signame = "ALRM";
8868 if (code == TS_SIGFPE) signame = "FPE";
8869 if (code == TS_SIGHUP) signame = "HUP";
8870 if (code == TS_SIGILL) signame = "ILL";
8871 if (code == TS_SIGINT) signame = "INT";
8872 if (code == TS_SIGKILL) signame = "KILL";
8873 if (code == TS_SIGPIPE) signame = "PIPE";
8874 if (code == TS_SIGQUIT) signame = "QUIT";
8875 if (code == TS_SIGSEGV) signame = "SEGV";
8876 if (code == TS_SIGTERM) signame = "TERM";
8877 if (code == TS_SIGUSR1) signame = "USR1";
8878 if (code == TS_SIGUSR2) signame = "USR2";
8879 /* The SSH-2 protocol does in principle support arbitrary named
8880 * signals, including signame@domain, but we don't support those. */
8882 /* It's a signal. */
8883 if (ssh->version == 2 && ssh->mainchan) {
8884 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8885 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8886 ssh2_pkt_addstring(pktout, "signal");
8887 ssh2_pkt_addbool(pktout, 0);
8888 ssh2_pkt_addstring(pktout, signame);
8889 ssh2_pkt_send(ssh, pktout);
8890 logeventf(ssh, "Sent signal SIG%s", signame);
8893 /* Never heard of it. Do nothing */
8898 void *new_sock_channel(void *handle, Socket s)
8900 Ssh ssh = (Ssh) handle;
8901 struct ssh_channel *c;
8902 c = snew(struct ssh_channel);
8907 c->localid = alloc_channel_id(ssh);
8909 c->type = CHAN_SOCKDATA_DORMANT;/* identify channel type */
8911 bufchain_init(&c->v.v2.outbuffer);
8912 add234(ssh->channels, c);
8918 * This is called when stdout/stderr (the entity to which
8919 * from_backend sends data) manages to clear some backlog.
8921 static void ssh_unthrottle(void *handle, int bufsize)
8923 Ssh ssh = (Ssh) handle;
8924 if (ssh->version == 1) {
8925 if (ssh->v1_stdout_throttling && bufsize < SSH1_BUFFER_LIMIT) {
8926 ssh->v1_stdout_throttling = 0;
8927 ssh1_throttle(ssh, -1);
8930 if (ssh->mainchan && ssh->mainchan->closes == 0)
8931 ssh2_set_window(ssh->mainchan, OUR_V2_WINSIZE - bufsize);
8935 void ssh_send_port_open(void *channel, char *hostname, int port, char *org)
8937 struct ssh_channel *c = (struct ssh_channel *)channel;
8939 struct Packet *pktout;
8941 logeventf(ssh, "Opening forwarded connection to %s:%d", hostname, port);
8943 if (ssh->version == 1) {
8944 send_packet(ssh, SSH1_MSG_PORT_OPEN,
8945 PKT_INT, c->localid,
8948 /* PKT_STR, <org:orgport>, */
8951 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
8952 ssh2_pkt_addstring(pktout, "direct-tcpip");
8953 ssh2_pkt_adduint32(pktout, c->localid);
8954 c->v.v2.locwindow = OUR_V2_WINSIZE;
8955 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);/* our window size */
8956 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
8957 ssh2_pkt_addstring(pktout, hostname);
8958 ssh2_pkt_adduint32(pktout, port);
8960 * We make up values for the originator data; partly it's
8961 * too much hassle to keep track, and partly I'm not
8962 * convinced the server should be told details like that
8963 * about my local network configuration.
8964 * The "originator IP address" is syntactically a numeric
8965 * IP address, and some servers (e.g., Tectia) get upset
8966 * if it doesn't match this syntax.
8968 ssh2_pkt_addstring(pktout, "0.0.0.0");
8969 ssh2_pkt_adduint32(pktout, 0);
8970 ssh2_pkt_send(ssh, pktout);
8974 static int ssh_connected(void *handle)
8976 Ssh ssh = (Ssh) handle;
8977 return ssh->s != NULL;
8980 static int ssh_sendok(void *handle)
8982 Ssh ssh = (Ssh) handle;
8983 return ssh->send_ok;
8986 static int ssh_ldisc(void *handle, int option)
8988 Ssh ssh = (Ssh) handle;
8989 if (option == LD_ECHO)
8990 return ssh->echoing;
8991 if (option == LD_EDIT)
8992 return ssh->editing;
8996 static void ssh_provide_ldisc(void *handle, void *ldisc)
8998 Ssh ssh = (Ssh) handle;
9002 static void ssh_provide_logctx(void *handle, void *logctx)
9004 Ssh ssh = (Ssh) handle;
9005 ssh->logctx = logctx;
9008 static int ssh_return_exitcode(void *handle)
9010 Ssh ssh = (Ssh) handle;
9014 return (ssh->exitcode >= 0 ? ssh->exitcode : INT_MAX);
9018 * cfg_info for SSH is the currently running version of the
9019 * protocol. (1 for 1; 2 for 2; 0 for not-decided-yet.)
9021 static int ssh_cfg_info(void *handle)
9023 Ssh ssh = (Ssh) handle;
9024 return ssh->version;
9028 * Gross hack: pscp will try to start SFTP but fall back to scp1 if
9029 * that fails. This variable is the means by which scp.c can reach
9030 * into the SSH code and find out which one it got.
9032 extern int ssh_fallback_cmd(void *handle)
9034 Ssh ssh = (Ssh) handle;
9035 return ssh->fallback_cmd;
9038 Backend ssh_backend = {
9048 ssh_return_exitcode,