23 #define SSH1_MSG_DISCONNECT 1 /* 0x1 */
24 #define SSH1_SMSG_PUBLIC_KEY 2 /* 0x2 */
25 #define SSH1_CMSG_SESSION_KEY 3 /* 0x3 */
26 #define SSH1_CMSG_USER 4 /* 0x4 */
27 #define SSH1_CMSG_AUTH_RSA 6 /* 0x6 */
28 #define SSH1_SMSG_AUTH_RSA_CHALLENGE 7 /* 0x7 */
29 #define SSH1_CMSG_AUTH_RSA_RESPONSE 8 /* 0x8 */
30 #define SSH1_CMSG_AUTH_PASSWORD 9 /* 0x9 */
31 #define SSH1_CMSG_REQUEST_PTY 10 /* 0xa */
32 #define SSH1_CMSG_WINDOW_SIZE 11 /* 0xb */
33 #define SSH1_CMSG_EXEC_SHELL 12 /* 0xc */
34 #define SSH1_CMSG_EXEC_CMD 13 /* 0xd */
35 #define SSH1_SMSG_SUCCESS 14 /* 0xe */
36 #define SSH1_SMSG_FAILURE 15 /* 0xf */
37 #define SSH1_CMSG_STDIN_DATA 16 /* 0x10 */
38 #define SSH1_SMSG_STDOUT_DATA 17 /* 0x11 */
39 #define SSH1_SMSG_STDERR_DATA 18 /* 0x12 */
40 #define SSH1_CMSG_EOF 19 /* 0x13 */
41 #define SSH1_SMSG_EXIT_STATUS 20 /* 0x14 */
42 #define SSH1_MSG_CHANNEL_OPEN_CONFIRMATION 21 /* 0x15 */
43 #define SSH1_MSG_CHANNEL_OPEN_FAILURE 22 /* 0x16 */
44 #define SSH1_MSG_CHANNEL_DATA 23 /* 0x17 */
45 #define SSH1_MSG_CHANNEL_CLOSE 24 /* 0x18 */
46 #define SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION 25 /* 0x19 */
47 #define SSH1_SMSG_X11_OPEN 27 /* 0x1b */
48 #define SSH1_CMSG_PORT_FORWARD_REQUEST 28 /* 0x1c */
49 #define SSH1_MSG_PORT_OPEN 29 /* 0x1d */
50 #define SSH1_CMSG_AGENT_REQUEST_FORWARDING 30 /* 0x1e */
51 #define SSH1_SMSG_AGENT_OPEN 31 /* 0x1f */
52 #define SSH1_MSG_IGNORE 32 /* 0x20 */
53 #define SSH1_CMSG_EXIT_CONFIRMATION 33 /* 0x21 */
54 #define SSH1_CMSG_X11_REQUEST_FORWARDING 34 /* 0x22 */
55 #define SSH1_CMSG_AUTH_RHOSTS_RSA 35 /* 0x23 */
56 #define SSH1_MSG_DEBUG 36 /* 0x24 */
57 #define SSH1_CMSG_REQUEST_COMPRESSION 37 /* 0x25 */
58 #define SSH1_CMSG_AUTH_TIS 39 /* 0x27 */
59 #define SSH1_SMSG_AUTH_TIS_CHALLENGE 40 /* 0x28 */
60 #define SSH1_CMSG_AUTH_TIS_RESPONSE 41 /* 0x29 */
61 #define SSH1_CMSG_AUTH_CCARD 70 /* 0x46 */
62 #define SSH1_SMSG_AUTH_CCARD_CHALLENGE 71 /* 0x47 */
63 #define SSH1_CMSG_AUTH_CCARD_RESPONSE 72 /* 0x48 */
65 #define SSH1_AUTH_TIS 5 /* 0x5 */
66 #define SSH1_AUTH_CCARD 16 /* 0x10 */
68 #define SSH1_PROTOFLAG_SCREEN_NUMBER 1 /* 0x1 */
69 /* Mask for protoflags we will echo back to server if seen */
70 #define SSH1_PROTOFLAGS_SUPPORTED 0 /* 0x1 */
72 #define SSH2_MSG_DISCONNECT 1 /* 0x1 */
73 #define SSH2_MSG_IGNORE 2 /* 0x2 */
74 #define SSH2_MSG_UNIMPLEMENTED 3 /* 0x3 */
75 #define SSH2_MSG_DEBUG 4 /* 0x4 */
76 #define SSH2_MSG_SERVICE_REQUEST 5 /* 0x5 */
77 #define SSH2_MSG_SERVICE_ACCEPT 6 /* 0x6 */
78 #define SSH2_MSG_KEXINIT 20 /* 0x14 */
79 #define SSH2_MSG_NEWKEYS 21 /* 0x15 */
80 #define SSH2_MSG_KEXDH_INIT 30 /* 0x1e */
81 #define SSH2_MSG_KEXDH_REPLY 31 /* 0x1f */
82 #define SSH2_MSG_KEX_DH_GEX_REQUEST 30 /* 0x1e */
83 #define SSH2_MSG_KEX_DH_GEX_GROUP 31 /* 0x1f */
84 #define SSH2_MSG_KEX_DH_GEX_INIT 32 /* 0x20 */
85 #define SSH2_MSG_KEX_DH_GEX_REPLY 33 /* 0x21 */
86 #define SSH2_MSG_KEXRSA_PUBKEY 30 /* 0x1e */
87 #define SSH2_MSG_KEXRSA_SECRET 31 /* 0x1f */
88 #define SSH2_MSG_KEXRSA_DONE 32 /* 0x20 */
89 #define SSH2_MSG_USERAUTH_REQUEST 50 /* 0x32 */
90 #define SSH2_MSG_USERAUTH_FAILURE 51 /* 0x33 */
91 #define SSH2_MSG_USERAUTH_SUCCESS 52 /* 0x34 */
92 #define SSH2_MSG_USERAUTH_BANNER 53 /* 0x35 */
93 #define SSH2_MSG_USERAUTH_PK_OK 60 /* 0x3c */
94 #define SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ 60 /* 0x3c */
95 #define SSH2_MSG_USERAUTH_INFO_REQUEST 60 /* 0x3c */
96 #define SSH2_MSG_USERAUTH_INFO_RESPONSE 61 /* 0x3d */
97 #define SSH2_MSG_GLOBAL_REQUEST 80 /* 0x50 */
98 #define SSH2_MSG_REQUEST_SUCCESS 81 /* 0x51 */
99 #define SSH2_MSG_REQUEST_FAILURE 82 /* 0x52 */
100 #define SSH2_MSG_CHANNEL_OPEN 90 /* 0x5a */
101 #define SSH2_MSG_CHANNEL_OPEN_CONFIRMATION 91 /* 0x5b */
102 #define SSH2_MSG_CHANNEL_OPEN_FAILURE 92 /* 0x5c */
103 #define SSH2_MSG_CHANNEL_WINDOW_ADJUST 93 /* 0x5d */
104 #define SSH2_MSG_CHANNEL_DATA 94 /* 0x5e */
105 #define SSH2_MSG_CHANNEL_EXTENDED_DATA 95 /* 0x5f */
106 #define SSH2_MSG_CHANNEL_EOF 96 /* 0x60 */
107 #define SSH2_MSG_CHANNEL_CLOSE 97 /* 0x61 */
108 #define SSH2_MSG_CHANNEL_REQUEST 98 /* 0x62 */
109 #define SSH2_MSG_CHANNEL_SUCCESS 99 /* 0x63 */
110 #define SSH2_MSG_CHANNEL_FAILURE 100 /* 0x64 */
113 * Packet type contexts, so that ssh2_pkt_type can correctly decode
114 * the ambiguous type numbers back into the correct type strings.
116 #define SSH2_PKTCTX_DHGROUP 0x0001
117 #define SSH2_PKTCTX_DHGEX 0x0002
118 #define SSH2_PKTCTX_RSAKEX 0x0004
119 #define SSH2_PKTCTX_KEX_MASK 0x000F
120 #define SSH2_PKTCTX_PUBLICKEY 0x0010
121 #define SSH2_PKTCTX_PASSWORD 0x0020
122 #define SSH2_PKTCTX_KBDINTER 0x0040
123 #define SSH2_PKTCTX_AUTH_MASK 0x00F0
125 #define SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1 /* 0x1 */
126 #define SSH2_DISCONNECT_PROTOCOL_ERROR 2 /* 0x2 */
127 #define SSH2_DISCONNECT_KEY_EXCHANGE_FAILED 3 /* 0x3 */
128 #define SSH2_DISCONNECT_HOST_AUTHENTICATION_FAILED 4 /* 0x4 */
129 #define SSH2_DISCONNECT_MAC_ERROR 5 /* 0x5 */
130 #define SSH2_DISCONNECT_COMPRESSION_ERROR 6 /* 0x6 */
131 #define SSH2_DISCONNECT_SERVICE_NOT_AVAILABLE 7 /* 0x7 */
132 #define SSH2_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED 8 /* 0x8 */
133 #define SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9 /* 0x9 */
134 #define SSH2_DISCONNECT_CONNECTION_LOST 10 /* 0xa */
135 #define SSH2_DISCONNECT_BY_APPLICATION 11 /* 0xb */
136 #define SSH2_DISCONNECT_TOO_MANY_CONNECTIONS 12 /* 0xc */
137 #define SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER 13 /* 0xd */
138 #define SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14 /* 0xe */
139 #define SSH2_DISCONNECT_ILLEGAL_USER_NAME 15 /* 0xf */
141 static const char *const ssh2_disconnect_reasons[] = {
143 "host not allowed to connect",
145 "key exchange failed",
146 "host authentication failed",
149 "service not available",
150 "protocol version not supported",
151 "host key not verifiable",
154 "too many connections",
155 "auth cancelled by user",
156 "no more auth methods available",
160 #define SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED 1 /* 0x1 */
161 #define SSH2_OPEN_CONNECT_FAILED 2 /* 0x2 */
162 #define SSH2_OPEN_UNKNOWN_CHANNEL_TYPE 3 /* 0x3 */
163 #define SSH2_OPEN_RESOURCE_SHORTAGE 4 /* 0x4 */
165 #define SSH2_EXTENDED_DATA_STDERR 1 /* 0x1 */
168 * Various remote-bug flags.
170 #define BUG_CHOKES_ON_SSH1_IGNORE 1
171 #define BUG_SSH2_HMAC 2
172 #define BUG_NEEDS_SSH1_PLAIN_PASSWORD 4
173 #define BUG_CHOKES_ON_RSA 8
174 #define BUG_SSH2_RSA_PADDING 16
175 #define BUG_SSH2_DERIVEKEY 32
176 #define BUG_SSH2_REKEY 64
177 #define BUG_SSH2_PK_SESSIONID 128
180 * Codes for terminal modes.
181 * Most of these are the same in SSH-1 and SSH-2.
182 * This list is derived from draft-ietf-secsh-connect-25 and
185 static const struct {
186 const char* const mode;
188 enum { TTY_OP_CHAR, TTY_OP_BOOL } type;
190 /* "V" prefix discarded for special characters relative to SSH specs */
191 { "INTR", 1, TTY_OP_CHAR },
192 { "QUIT", 2, TTY_OP_CHAR },
193 { "ERASE", 3, TTY_OP_CHAR },
194 { "KILL", 4, TTY_OP_CHAR },
195 { "EOF", 5, TTY_OP_CHAR },
196 { "EOL", 6, TTY_OP_CHAR },
197 { "EOL2", 7, TTY_OP_CHAR },
198 { "START", 8, TTY_OP_CHAR },
199 { "STOP", 9, TTY_OP_CHAR },
200 { "SUSP", 10, TTY_OP_CHAR },
201 { "DSUSP", 11, TTY_OP_CHAR },
202 { "REPRINT", 12, TTY_OP_CHAR },
203 { "WERASE", 13, TTY_OP_CHAR },
204 { "LNEXT", 14, TTY_OP_CHAR },
205 { "FLUSH", 15, TTY_OP_CHAR },
206 { "SWTCH", 16, TTY_OP_CHAR },
207 { "STATUS", 17, TTY_OP_CHAR },
208 { "DISCARD", 18, TTY_OP_CHAR },
209 { "IGNPAR", 30, TTY_OP_BOOL },
210 { "PARMRK", 31, TTY_OP_BOOL },
211 { "INPCK", 32, TTY_OP_BOOL },
212 { "ISTRIP", 33, TTY_OP_BOOL },
213 { "INLCR", 34, TTY_OP_BOOL },
214 { "IGNCR", 35, TTY_OP_BOOL },
215 { "ICRNL", 36, TTY_OP_BOOL },
216 { "IUCLC", 37, TTY_OP_BOOL },
217 { "IXON", 38, TTY_OP_BOOL },
218 { "IXANY", 39, TTY_OP_BOOL },
219 { "IXOFF", 40, TTY_OP_BOOL },
220 { "IMAXBEL", 41, TTY_OP_BOOL },
221 { "ISIG", 50, TTY_OP_BOOL },
222 { "ICANON", 51, TTY_OP_BOOL },
223 { "XCASE", 52, TTY_OP_BOOL },
224 { "ECHO", 53, TTY_OP_BOOL },
225 { "ECHOE", 54, TTY_OP_BOOL },
226 { "ECHOK", 55, TTY_OP_BOOL },
227 { "ECHONL", 56, TTY_OP_BOOL },
228 { "NOFLSH", 57, TTY_OP_BOOL },
229 { "TOSTOP", 58, TTY_OP_BOOL },
230 { "IEXTEN", 59, TTY_OP_BOOL },
231 { "ECHOCTL", 60, TTY_OP_BOOL },
232 { "ECHOKE", 61, TTY_OP_BOOL },
233 { "PENDIN", 62, TTY_OP_BOOL }, /* XXX is this a real mode? */
234 { "OPOST", 70, TTY_OP_BOOL },
235 { "OLCUC", 71, TTY_OP_BOOL },
236 { "ONLCR", 72, TTY_OP_BOOL },
237 { "OCRNL", 73, TTY_OP_BOOL },
238 { "ONOCR", 74, TTY_OP_BOOL },
239 { "ONLRET", 75, TTY_OP_BOOL },
240 { "CS7", 90, TTY_OP_BOOL },
241 { "CS8", 91, TTY_OP_BOOL },
242 { "PARENB", 92, TTY_OP_BOOL },
243 { "PARODD", 93, TTY_OP_BOOL }
246 /* Miscellaneous other tty-related constants. */
247 #define SSH_TTY_OP_END 0
248 /* The opcodes for ISPEED/OSPEED differ between SSH-1 and SSH-2. */
249 #define SSH1_TTY_OP_ISPEED 192
250 #define SSH1_TTY_OP_OSPEED 193
251 #define SSH2_TTY_OP_ISPEED 128
252 #define SSH2_TTY_OP_OSPEED 129
254 /* Helper functions for parsing tty-related config. */
255 static unsigned int ssh_tty_parse_specchar(char *s)
260 ret = ctrlparse(s, &next);
261 if (!next) ret = s[0];
263 ret = 255; /* special value meaning "don't set" */
267 static unsigned int ssh_tty_parse_boolean(char *s)
269 if (stricmp(s, "yes") == 0 ||
270 stricmp(s, "on") == 0 ||
271 stricmp(s, "true") == 0 ||
272 stricmp(s, "+") == 0)
274 else if (stricmp(s, "no") == 0 ||
275 stricmp(s, "off") == 0 ||
276 stricmp(s, "false") == 0 ||
277 stricmp(s, "-") == 0)
278 return 0; /* false */
280 return (atoi(s) != 0);
283 #define translate(x) if (type == x) return #x
284 #define translatec(x,ctx) if (type == x && (pkt_ctx & ctx)) return #x
285 static char *ssh1_pkt_type(int type)
287 translate(SSH1_MSG_DISCONNECT);
288 translate(SSH1_SMSG_PUBLIC_KEY);
289 translate(SSH1_CMSG_SESSION_KEY);
290 translate(SSH1_CMSG_USER);
291 translate(SSH1_CMSG_AUTH_RSA);
292 translate(SSH1_SMSG_AUTH_RSA_CHALLENGE);
293 translate(SSH1_CMSG_AUTH_RSA_RESPONSE);
294 translate(SSH1_CMSG_AUTH_PASSWORD);
295 translate(SSH1_CMSG_REQUEST_PTY);
296 translate(SSH1_CMSG_WINDOW_SIZE);
297 translate(SSH1_CMSG_EXEC_SHELL);
298 translate(SSH1_CMSG_EXEC_CMD);
299 translate(SSH1_SMSG_SUCCESS);
300 translate(SSH1_SMSG_FAILURE);
301 translate(SSH1_CMSG_STDIN_DATA);
302 translate(SSH1_SMSG_STDOUT_DATA);
303 translate(SSH1_SMSG_STDERR_DATA);
304 translate(SSH1_CMSG_EOF);
305 translate(SSH1_SMSG_EXIT_STATUS);
306 translate(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
307 translate(SSH1_MSG_CHANNEL_OPEN_FAILURE);
308 translate(SSH1_MSG_CHANNEL_DATA);
309 translate(SSH1_MSG_CHANNEL_CLOSE);
310 translate(SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION);
311 translate(SSH1_SMSG_X11_OPEN);
312 translate(SSH1_CMSG_PORT_FORWARD_REQUEST);
313 translate(SSH1_MSG_PORT_OPEN);
314 translate(SSH1_CMSG_AGENT_REQUEST_FORWARDING);
315 translate(SSH1_SMSG_AGENT_OPEN);
316 translate(SSH1_MSG_IGNORE);
317 translate(SSH1_CMSG_EXIT_CONFIRMATION);
318 translate(SSH1_CMSG_X11_REQUEST_FORWARDING);
319 translate(SSH1_CMSG_AUTH_RHOSTS_RSA);
320 translate(SSH1_MSG_DEBUG);
321 translate(SSH1_CMSG_REQUEST_COMPRESSION);
322 translate(SSH1_CMSG_AUTH_TIS);
323 translate(SSH1_SMSG_AUTH_TIS_CHALLENGE);
324 translate(SSH1_CMSG_AUTH_TIS_RESPONSE);
325 translate(SSH1_CMSG_AUTH_CCARD);
326 translate(SSH1_SMSG_AUTH_CCARD_CHALLENGE);
327 translate(SSH1_CMSG_AUTH_CCARD_RESPONSE);
330 static char *ssh2_pkt_type(int pkt_ctx, int type)
332 translate(SSH2_MSG_DISCONNECT);
333 translate(SSH2_MSG_IGNORE);
334 translate(SSH2_MSG_UNIMPLEMENTED);
335 translate(SSH2_MSG_DEBUG);
336 translate(SSH2_MSG_SERVICE_REQUEST);
337 translate(SSH2_MSG_SERVICE_ACCEPT);
338 translate(SSH2_MSG_KEXINIT);
339 translate(SSH2_MSG_NEWKEYS);
340 translatec(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP);
341 translatec(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP);
342 translatec(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX);
343 translatec(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX);
344 translatec(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX);
345 translatec(SSH2_MSG_KEX_DH_GEX_REPLY, SSH2_PKTCTX_DHGEX);
346 translatec(SSH2_MSG_KEXRSA_PUBKEY, SSH2_PKTCTX_RSAKEX);
347 translatec(SSH2_MSG_KEXRSA_SECRET, SSH2_PKTCTX_RSAKEX);
348 translatec(SSH2_MSG_KEXRSA_DONE, SSH2_PKTCTX_RSAKEX);
349 translate(SSH2_MSG_USERAUTH_REQUEST);
350 translate(SSH2_MSG_USERAUTH_FAILURE);
351 translate(SSH2_MSG_USERAUTH_SUCCESS);
352 translate(SSH2_MSG_USERAUTH_BANNER);
353 translatec(SSH2_MSG_USERAUTH_PK_OK, SSH2_PKTCTX_PUBLICKEY);
354 translatec(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, SSH2_PKTCTX_PASSWORD);
355 translatec(SSH2_MSG_USERAUTH_INFO_REQUEST, SSH2_PKTCTX_KBDINTER);
356 translatec(SSH2_MSG_USERAUTH_INFO_RESPONSE, SSH2_PKTCTX_KBDINTER);
357 translate(SSH2_MSG_GLOBAL_REQUEST);
358 translate(SSH2_MSG_REQUEST_SUCCESS);
359 translate(SSH2_MSG_REQUEST_FAILURE);
360 translate(SSH2_MSG_CHANNEL_OPEN);
361 translate(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
362 translate(SSH2_MSG_CHANNEL_OPEN_FAILURE);
363 translate(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
364 translate(SSH2_MSG_CHANNEL_DATA);
365 translate(SSH2_MSG_CHANNEL_EXTENDED_DATA);
366 translate(SSH2_MSG_CHANNEL_EOF);
367 translate(SSH2_MSG_CHANNEL_CLOSE);
368 translate(SSH2_MSG_CHANNEL_REQUEST);
369 translate(SSH2_MSG_CHANNEL_SUCCESS);
370 translate(SSH2_MSG_CHANNEL_FAILURE);
376 /* Enumeration values for fields in SSH-1 packets */
378 PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM,
379 /* These values are for communicating relevant semantics of
380 * fields to the packet logging code. */
381 PKTT_OTHER, PKTT_PASSWORD, PKTT_DATA
385 * Coroutine mechanics for the sillier bits of the code. If these
386 * macros look impenetrable to you, you might find it helpful to
389 * http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html
391 * which explains the theory behind these macros.
393 * In particular, if you are getting `case expression not constant'
394 * errors when building with MS Visual Studio, this is because MS's
395 * Edit and Continue debugging feature causes their compiler to
396 * violate ANSI C. To disable Edit and Continue debugging:
398 * - right-click ssh.c in the FileView
400 * - select the C/C++ tab and the General category
401 * - under `Debug info:', select anything _other_ than `Program
402 * Database for Edit and Continue'.
404 #define crBegin(v) { int *crLine = &v; switch(v) { case 0:;
407 if (!ssh->t) ssh->t = snew(struct t); \
409 #define crFinish(z) } *crLine = 0; return (z); }
410 #define crFinishV } *crLine = 0; return; }
411 #define crReturn(z) \
413 *crLine =__LINE__; return (z); case __LINE__:;\
417 *crLine=__LINE__; return; case __LINE__:;\
419 #define crStop(z) do{ *crLine = 0; return (z); }while(0)
420 #define crStopV do{ *crLine = 0; return; }while(0)
421 #define crWaitUntil(c) do { crReturn(0); } while (!(c))
422 #define crWaitUntilV(c) do { crReturnV; } while (!(c))
424 typedef struct ssh_tag *Ssh;
427 static struct Packet *ssh1_pkt_init(int pkt_type);
428 static struct Packet *ssh2_pkt_init(int pkt_type);
429 static void ssh_pkt_ensure(struct Packet *, int length);
430 static void ssh_pkt_adddata(struct Packet *, void *data, int len);
431 static void ssh_pkt_addbyte(struct Packet *, unsigned char value);
432 static void ssh2_pkt_addbool(struct Packet *, unsigned char value);
433 static void ssh_pkt_adduint32(struct Packet *, unsigned long value);
434 static void ssh_pkt_addstring_start(struct Packet *);
435 static void ssh_pkt_addstring_str(struct Packet *, char *data);
436 static void ssh_pkt_addstring_data(struct Packet *, char *data, int len);
437 static void ssh_pkt_addstring(struct Packet *, char *data);
438 static unsigned char *ssh2_mpint_fmt(Bignum b, int *len);
439 static void ssh1_pkt_addmp(struct Packet *, Bignum b);
440 static void ssh2_pkt_addmp(struct Packet *, Bignum b);
441 static int ssh2_pkt_construct(Ssh, struct Packet *);
442 static void ssh2_pkt_send(Ssh, struct Packet *);
443 static void ssh2_pkt_send_noqueue(Ssh, struct Packet *);
444 static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
445 struct Packet *pktin);
446 static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
447 struct Packet *pktin);
450 * Buffer management constants. There are several of these for
451 * various different purposes:
453 * - SSH1_BUFFER_LIMIT is the amount of backlog that must build up
454 * on a local data stream before we throttle the whole SSH
455 * connection (in SSH-1 only). Throttling the whole connection is
456 * pretty drastic so we set this high in the hope it won't
459 * - SSH_MAX_BACKLOG is the amount of backlog that must build up
460 * on the SSH connection itself before we defensively throttle
461 * _all_ local data streams. This is pretty drastic too (though
462 * thankfully unlikely in SSH-2 since the window mechanism should
463 * ensure that the server never has any need to throttle its end
464 * of the connection), so we set this high as well.
466 * - OUR_V2_WINSIZE is the maximum window size we present on SSH-2
470 #define SSH1_BUFFER_LIMIT 32768
471 #define SSH_MAX_BACKLOG 32768
472 #define OUR_V2_WINSIZE 16384
473 #define OUR_V2_MAXPKT 0x4000UL
475 /* Maximum length of passwords/passphrases (arbitrary) */
476 #define SSH_MAX_PASSWORD_LEN 100
478 const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss };
480 const static struct ssh_mac *macs[] = {
481 &ssh_hmac_sha1, &ssh_hmac_sha1_96, &ssh_hmac_md5
483 const static struct ssh_mac *buggymacs[] = {
484 &ssh_hmac_sha1_buggy, &ssh_hmac_sha1_96_buggy, &ssh_hmac_md5
487 static void *ssh_comp_none_init(void)
491 static void ssh_comp_none_cleanup(void *handle)
494 static int ssh_comp_none_block(void *handle, unsigned char *block, int len,
495 unsigned char **outblock, int *outlen)
499 static int ssh_comp_none_disable(void *handle)
503 const static struct ssh_compress ssh_comp_none = {
505 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
506 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
507 ssh_comp_none_disable, NULL
509 extern const struct ssh_compress ssh_zlib;
510 const static struct ssh_compress *compressions[] = {
511 &ssh_zlib, &ssh_comp_none
514 enum { /* channel types */
519 CHAN_SOCKDATA_DORMANT /* one the remote hasn't confirmed */
523 * 2-3-4 tree storing channels.
526 Ssh ssh; /* pointer back to main context */
527 unsigned remoteid, localid;
529 /* True if we opened this channel but server hasn't confirmed. */
532 * In SSH-1, this value contains four bits:
534 * 1 We have sent SSH1_MSG_CHANNEL_CLOSE.
535 * 2 We have sent SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
536 * 4 We have received SSH1_MSG_CHANNEL_CLOSE.
537 * 8 We have received SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
539 * A channel is completely finished with when all four bits are set.
543 struct ssh1_data_channel {
546 struct ssh2_data_channel {
548 unsigned remwindow, remmaxpkt;
553 struct ssh_agent_channel {
554 unsigned char *message;
555 unsigned char msglen[4];
556 unsigned lensofar, totallen;
558 struct ssh_x11_channel {
561 struct ssh_pfd_channel {
568 * 2-3-4 tree storing remote->local port forwardings. SSH-1 and SSH-2
569 * use this structure in different ways, reflecting SSH-2's
570 * altogether saner approach to port forwarding.
572 * In SSH-1, you arrange a remote forwarding by sending the server
573 * the remote port number, and the local destination host:port.
574 * When a connection comes in, the server sends you back that
575 * host:port pair, and you connect to it. This is a ready-made
576 * security hole if you're not on the ball: a malicious server
577 * could send you back _any_ host:port pair, so if you trustingly
578 * connect to the address it gives you then you've just opened the
579 * entire inside of your corporate network just by connecting
580 * through it to a dodgy SSH server. Hence, we must store a list of
581 * host:port pairs we _are_ trying to forward to, and reject a
582 * connection request from the server if it's not in the list.
584 * In SSH-2, each side of the connection minds its own business and
585 * doesn't send unnecessary information to the other. You arrange a
586 * remote forwarding by sending the server just the remote port
587 * number. When a connection comes in, the server tells you which
588 * of its ports was connected to; and _you_ have to remember what
589 * local host:port pair went with that port number.
591 * Hence, in SSH-1 this structure is indexed by destination
592 * host:port pair, whereas in SSH-2 it is indexed by source port.
594 struct ssh_portfwd; /* forward declaration */
596 struct ssh_rportfwd {
597 unsigned sport, dport;
600 struct ssh_portfwd *pfrec;
602 #define free_rportfwd(pf) ( \
603 ((pf) ? (sfree((pf)->sportdesc)) : (void)0 ), sfree(pf) )
606 * Separately to the rportfwd tree (which is for looking up port
607 * open requests from the server), a tree of _these_ structures is
608 * used to keep track of all the currently open port forwardings,
609 * so that we can reconfigure in mid-session if the user requests
613 enum { DESTROY, KEEP, CREATE } status;
615 unsigned sport, dport;
618 struct ssh_rportfwd *remote;
622 #define free_portfwd(pf) ( \
623 ((pf) ? (sfree((pf)->saddr), sfree((pf)->daddr), \
624 sfree((pf)->sserv), sfree((pf)->dserv)) : (void)0 ), sfree(pf) )
627 long length; /* length of `data' actually used */
628 long forcepad; /* SSH-2: force padding to at least this length */
629 int type; /* only used for incoming packets */
630 unsigned long sequence; /* SSH-2 incoming sequence number */
631 unsigned char *data; /* allocated storage */
632 unsigned char *body; /* offset of payload within `data' */
633 long savedpos; /* temporary index into `data' (for strings) */
634 long maxlen; /* amount of storage allocated for `data' */
635 long encrypted_len; /* for SSH-2 total-size counting */
638 * State associated with packet logging
642 struct logblank_t *blanks;
645 static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
646 struct Packet *pktin);
647 static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
648 struct Packet *pktin);
649 static void ssh1_protocol_setup(Ssh ssh);
650 static void ssh2_protocol_setup(Ssh ssh);
651 static void ssh_size(void *handle, int width, int height);
652 static void ssh_special(void *handle, Telnet_Special);
653 static int ssh2_try_send(struct ssh_channel *c);
654 static void ssh2_add_channel_data(struct ssh_channel *c, char *buf, int len);
655 static void ssh_throttle_all(Ssh ssh, int enable, int bufsize);
656 static void ssh2_set_window(struct ssh_channel *c, unsigned newwin);
657 static int ssh_sendbuffer(void *handle);
658 static int ssh_do_close(Ssh ssh, int notify_exit);
659 static unsigned long ssh_pkt_getuint32(struct Packet *pkt);
660 static int ssh2_pkt_getbool(struct Packet *pkt);
661 static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length);
662 static void ssh2_timer(void *ctx, long now);
663 static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
664 struct Packet *pktin);
666 struct rdpkt1_state_tag {
667 long len, pad, biglen, to_read;
668 unsigned long realcrc, gotcrc;
672 struct Packet *pktin;
675 struct rdpkt2_state_tag {
676 long len, pad, payload, packetlen, maclen;
679 unsigned long incoming_sequence;
680 struct Packet *pktin;
683 typedef void (*handler_fn_t)(Ssh ssh, struct Packet *pktin);
684 typedef void (*chandler_fn_t)(Ssh ssh, struct Packet *pktin, void *ctx);
686 struct queued_handler;
687 struct queued_handler {
689 chandler_fn_t handler;
691 struct queued_handler *next;
695 const struct plug_function_table *fn;
696 /* the above field _must_ be first in the structure */
706 unsigned char session_key[32];
708 int v1_remote_protoflags;
709 int v1_local_protoflags;
710 int agentfwd_enabled;
713 const struct ssh_cipher *cipher;
716 const struct ssh2_cipher *cscipher, *sccipher;
717 void *cs_cipher_ctx, *sc_cipher_ctx;
718 const struct ssh_mac *csmac, *scmac;
719 void *cs_mac_ctx, *sc_mac_ctx;
720 const struct ssh_compress *cscomp, *sccomp;
721 void *cs_comp_ctx, *sc_comp_ctx;
722 const struct ssh_kex *kex;
723 const struct ssh_signkey *hostkey;
724 unsigned char v2_session_id[SSH2_KEX_MAX_HASH_LEN];
725 int v2_session_id_len;
731 int echoing, editing;
735 int ospeed, ispeed; /* temporaries */
736 int term_width, term_height;
738 tree234 *channels; /* indexed by local id */
739 struct ssh_channel *mainchan; /* primary session channel */
740 int ncmode; /* is primary channel direct-tcpip? */
745 tree234 *rportfwds, *portfwds;
749 SSH_STATE_BEFORE_SIZE,
755 int size_needed, eof_needed;
757 struct Packet **queue;
758 int queuelen, queuesize;
760 unsigned char *deferred_send_data;
761 int deferred_len, deferred_size;
764 * Gross hack: pscp will try to start SFTP but fall back to
765 * scp1 if that fails. This variable is the means by which
766 * scp.c can reach into the SSH code and find out which one it
771 bufchain banner; /* accumulates banners during do_ssh2_authconn */
778 int v1_throttle_count;
781 int v1_stdout_throttling;
782 unsigned long v2_outgoing_sequence;
784 int ssh1_rdpkt_crstate;
785 int ssh2_rdpkt_crstate;
786 int do_ssh_init_crstate;
787 int ssh_gotdata_crstate;
788 int do_ssh1_login_crstate;
789 int do_ssh1_connection_crstate;
790 int do_ssh2_transport_crstate;
791 int do_ssh2_authconn_crstate;
793 void *do_ssh_init_state;
794 void *do_ssh1_login_state;
795 void *do_ssh2_transport_state;
796 void *do_ssh2_authconn_state;
798 struct rdpkt1_state_tag rdpkt1_state;
799 struct rdpkt2_state_tag rdpkt2_state;
801 /* SSH-1 and SSH-2 use this for different things, but both use it */
802 int protocol_initial_phase_done;
804 void (*protocol) (Ssh ssh, void *vin, int inlen,
806 struct Packet *(*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen);
809 * We maintain a full _copy_ of a Config structure here, not
810 * merely a pointer to it. That way, when we're passed a new
811 * one for reconfiguration, we can check the differences and
812 * potentially reconfigure port forwardings etc in mid-session.
817 * Used to transfer data back from async callbacks.
819 void *agent_response;
820 int agent_response_len;
824 * The SSH connection can be set as `frozen', meaning we are
825 * not currently accepting incoming data from the network. This
826 * is slightly more serious than setting the _socket_ as
827 * frozen, because we may already have had data passed to us
828 * from the network which we need to delay processing until
829 * after the freeze is lifted, so we also need a bufchain to
833 bufchain queued_incoming_data;
836 * Dispatch table for packet types that we may have to deal
839 handler_fn_t packet_dispatch[256];
842 * Queues of one-off handler functions for success/failure
843 * indications from a request.
845 struct queued_handler *qhead, *qtail;
848 * This module deals with sending keepalives.
853 * Track incoming and outgoing data sizes and time, for
856 unsigned long incoming_data_size, outgoing_data_size, deferred_data_size;
857 unsigned long max_data_size;
859 long next_rekey, last_rekey;
860 char *deferred_rekey_reason; /* points to STATIC string; don't free */
863 #define logevent(s) logevent(ssh->frontend, s)
865 /* logevent, only printf-formatted. */
866 static void logeventf(Ssh ssh, const char *fmt, ...)
872 buf = dupvprintf(fmt, ap);
878 #define bombout(msg) \
880 char *text = dupprintf msg; \
881 ssh_do_close(ssh, FALSE); \
883 connection_fatal(ssh->frontend, "%s", text); \
887 /* Functions to leave bits out of the SSH packet log file. */
889 static void dont_log_password(Ssh ssh, struct Packet *pkt, int blanktype)
891 if (ssh->cfg.logomitpass)
892 pkt->logmode = blanktype;
895 static void dont_log_data(Ssh ssh, struct Packet *pkt, int blanktype)
897 if (ssh->cfg.logomitdata)
898 pkt->logmode = blanktype;
901 static void end_log_omission(Ssh ssh, struct Packet *pkt)
903 pkt->logmode = PKTLOG_EMIT;
906 /* Helper function for common bits of parsing cfg.ttymodes. */
907 static void parse_ttymodes(Ssh ssh, char *modes,
908 void (*do_mode)(void *data, char *mode, char *val),
912 char *t = strchr(modes, '\t');
913 char *m = snewn(t-modes+1, char);
915 strncpy(m, modes, t-modes);
918 val = get_ttymode(ssh->frontend, m);
922 do_mode(data, m, val);
925 modes += strlen(modes) + 1;
929 static int ssh_channelcmp(void *av, void *bv)
931 struct ssh_channel *a = (struct ssh_channel *) av;
932 struct ssh_channel *b = (struct ssh_channel *) bv;
933 if (a->localid < b->localid)
935 if (a->localid > b->localid)
939 static int ssh_channelfind(void *av, void *bv)
941 unsigned *a = (unsigned *) av;
942 struct ssh_channel *b = (struct ssh_channel *) bv;
950 static int ssh_rportcmp_ssh1(void *av, void *bv)
952 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
953 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
955 if ( (i = strcmp(a->dhost, b->dhost)) != 0)
956 return i < 0 ? -1 : +1;
957 if (a->dport > b->dport)
959 if (a->dport < b->dport)
964 static int ssh_rportcmp_ssh2(void *av, void *bv)
966 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
967 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
969 if (a->sport > b->sport)
971 if (a->sport < b->sport)
977 * Special form of strcmp which can cope with NULL inputs. NULL is
978 * defined to sort before even the empty string.
980 static int nullstrcmp(const char *a, const char *b)
982 if (a == NULL && b == NULL)
991 static int ssh_portcmp(void *av, void *bv)
993 struct ssh_portfwd *a = (struct ssh_portfwd *) av;
994 struct ssh_portfwd *b = (struct ssh_portfwd *) bv;
996 if (a->type > b->type)
998 if (a->type < b->type)
1000 if (a->addressfamily > b->addressfamily)
1002 if (a->addressfamily < b->addressfamily)
1004 if ( (i = nullstrcmp(a->saddr, b->saddr)) != 0)
1005 return i < 0 ? -1 : +1;
1006 if (a->sport > b->sport)
1008 if (a->sport < b->sport)
1010 if (a->type != 'D') {
1011 if ( (i = nullstrcmp(a->daddr, b->daddr)) != 0)
1012 return i < 0 ? -1 : +1;
1013 if (a->dport > b->dport)
1015 if (a->dport < b->dport)
1021 static int alloc_channel_id(Ssh ssh)
1023 const unsigned CHANNEL_NUMBER_OFFSET = 256;
1024 unsigned low, high, mid;
1026 struct ssh_channel *c;
1029 * First-fit allocation of channel numbers: always pick the
1030 * lowest unused one. To do this, binary-search using the
1031 * counted B-tree to find the largest channel ID which is in a
1032 * contiguous sequence from the beginning. (Precisely
1033 * everything in that sequence must have ID equal to its tree
1034 * index plus CHANNEL_NUMBER_OFFSET.)
1036 tsize = count234(ssh->channels);
1040 while (high - low > 1) {
1041 mid = (high + low) / 2;
1042 c = index234(ssh->channels, mid);
1043 if (c->localid == mid + CHANNEL_NUMBER_OFFSET)
1044 low = mid; /* this one is fine */
1046 high = mid; /* this one is past it */
1049 * Now low points to either -1, or the tree index of the
1050 * largest ID in the initial sequence.
1053 unsigned i = low + 1 + CHANNEL_NUMBER_OFFSET;
1054 assert(NULL == find234(ssh->channels, &i, ssh_channelfind));
1056 return low + 1 + CHANNEL_NUMBER_OFFSET;
1059 static void c_write_stderr(int trusted, const char *buf, int len)
1062 for (i = 0; i < len; i++)
1063 if (buf[i] != '\r' && (trusted || buf[i] == '\n' || (buf[i] & 0x60)))
1064 fputc(buf[i], stderr);
1067 static void c_write(Ssh ssh, const char *buf, int len)
1069 if (flags & FLAG_STDERR)
1070 c_write_stderr(1, buf, len);
1072 from_backend(ssh->frontend, 1, buf, len);
1075 static void c_write_untrusted(Ssh ssh, const char *buf, int len)
1077 if (flags & FLAG_STDERR)
1078 c_write_stderr(0, buf, len);
1080 from_backend_untrusted(ssh->frontend, buf, len);
1083 static void c_write_str(Ssh ssh, const char *buf)
1085 c_write(ssh, buf, strlen(buf));
1088 static void ssh_free_packet(struct Packet *pkt)
1093 static struct Packet *ssh_new_packet(void)
1095 struct Packet *pkt = snew(struct Packet);
1097 pkt->body = pkt->data = NULL;
1099 pkt->logmode = PKTLOG_EMIT;
1107 * Collect incoming data in the incoming packet buffer.
1108 * Decipher and verify the packet when it is completely read.
1109 * Drop SSH1_MSG_DEBUG and SSH1_MSG_IGNORE packets.
1110 * Update the *data and *datalen variables.
1111 * Return a Packet structure when a packet is completed.
1113 static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
1115 struct rdpkt1_state_tag *st = &ssh->rdpkt1_state;
1117 crBegin(ssh->ssh1_rdpkt_crstate);
1119 st->pktin = ssh_new_packet();
1121 st->pktin->type = 0;
1122 st->pktin->length = 0;
1124 for (st->i = st->len = 0; st->i < 4; st->i++) {
1125 while ((*datalen) == 0)
1127 st->len = (st->len << 8) + **data;
1128 (*data)++, (*datalen)--;
1131 st->pad = 8 - (st->len % 8);
1132 st->biglen = st->len + st->pad;
1133 st->pktin->length = st->len - 5;
1135 if (st->biglen < 0) {
1136 bombout(("Extremely large packet length from server suggests"
1137 " data stream corruption"));
1138 ssh_free_packet(st->pktin);
1142 st->pktin->maxlen = st->biglen;
1143 st->pktin->data = snewn(st->biglen + APIEXTRA, unsigned char);
1145 st->to_read = st->biglen;
1146 st->p = st->pktin->data;
1147 while (st->to_read > 0) {
1148 st->chunk = st->to_read;
1149 while ((*datalen) == 0)
1151 if (st->chunk > (*datalen))
1152 st->chunk = (*datalen);
1153 memcpy(st->p, *data, st->chunk);
1155 *datalen -= st->chunk;
1157 st->to_read -= st->chunk;
1160 if (ssh->cipher && detect_attack(ssh->crcda_ctx, st->pktin->data,
1161 st->biglen, NULL)) {
1162 bombout(("Network attack (CRC compensation) detected!"));
1163 ssh_free_packet(st->pktin);
1168 ssh->cipher->decrypt(ssh->v1_cipher_ctx, st->pktin->data, st->biglen);
1170 st->realcrc = crc32_compute(st->pktin->data, st->biglen - 4);
1171 st->gotcrc = GET_32BIT(st->pktin->data + st->biglen - 4);
1172 if (st->gotcrc != st->realcrc) {
1173 bombout(("Incorrect CRC received on packet"));
1174 ssh_free_packet(st->pktin);
1178 st->pktin->body = st->pktin->data + st->pad + 1;
1179 st->pktin->savedpos = 0;
1181 if (ssh->v1_compressing) {
1182 unsigned char *decompblk;
1184 if (!zlib_decompress_block(ssh->sc_comp_ctx,
1185 st->pktin->body - 1, st->pktin->length + 1,
1186 &decompblk, &decomplen)) {
1187 bombout(("Zlib decompression encountered invalid data"));
1188 ssh_free_packet(st->pktin);
1192 if (st->pktin->maxlen < st->pad + decomplen) {
1193 st->pktin->maxlen = st->pad + decomplen;
1194 st->pktin->data = sresize(st->pktin->data,
1195 st->pktin->maxlen + APIEXTRA,
1197 st->pktin->body = st->pktin->data + st->pad + 1;
1200 memcpy(st->pktin->body - 1, decompblk, decomplen);
1202 st->pktin->length = decomplen - 1;
1205 st->pktin->type = st->pktin->body[-1];
1208 * Log incoming packet, possibly omitting sensitive fields.
1212 struct logblank_t blank;
1213 if (ssh->cfg.logomitdata) {
1214 int do_blank = FALSE, blank_prefix = 0;
1215 /* "Session data" packets - omit the data field */
1216 if ((st->pktin->type == SSH1_SMSG_STDOUT_DATA) ||
1217 (st->pktin->type == SSH1_SMSG_STDERR_DATA)) {
1218 do_blank = TRUE; blank_prefix = 0;
1219 } else if (st->pktin->type == SSH1_MSG_CHANNEL_DATA) {
1220 do_blank = TRUE; blank_prefix = 4;
1223 blank.offset = blank_prefix;
1224 blank.len = st->pktin->length;
1225 blank.type = PKTLOG_OMIT;
1229 log_packet(ssh->logctx,
1230 PKT_INCOMING, st->pktin->type,
1231 ssh1_pkt_type(st->pktin->type),
1232 st->pktin->body, st->pktin->length,
1236 crFinish(st->pktin);
1239 static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
1241 struct rdpkt2_state_tag *st = &ssh->rdpkt2_state;
1243 crBegin(ssh->ssh2_rdpkt_crstate);
1245 st->pktin = ssh_new_packet();
1247 st->pktin->type = 0;
1248 st->pktin->length = 0;
1250 st->cipherblk = ssh->sccipher->blksize;
1253 if (st->cipherblk < 8)
1256 st->pktin->data = snewn(st->cipherblk + APIEXTRA, unsigned char);
1259 * Acquire and decrypt the first block of the packet. This will
1260 * contain the length and padding details.
1262 for (st->i = st->len = 0; st->i < st->cipherblk; st->i++) {
1263 while ((*datalen) == 0)
1265 st->pktin->data[st->i] = *(*data)++;
1270 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1271 st->pktin->data, st->cipherblk);
1274 * Now get the length and padding figures.
1276 st->len = GET_32BIT(st->pktin->data);
1277 st->pad = st->pktin->data[4];
1280 * _Completely_ silly lengths should be stomped on before they
1281 * do us any more damage.
1283 if (st->len < 0 || st->len > 35000 || st->pad < 4 ||
1284 st->len - st->pad < 1 || (st->len + 4) % st->cipherblk != 0) {
1285 bombout(("Incoming packet was garbled on decryption"));
1286 ssh_free_packet(st->pktin);
1291 * This enables us to deduce the payload length.
1293 st->payload = st->len - st->pad - 1;
1295 st->pktin->length = st->payload + 5;
1298 * So now we can work out the total packet length.
1300 st->packetlen = st->len + 4;
1301 st->maclen = ssh->scmac ? ssh->scmac->len : 0;
1304 * Allocate memory for the rest of the packet.
1306 st->pktin->maxlen = st->packetlen + st->maclen;
1307 st->pktin->data = sresize(st->pktin->data,
1308 st->pktin->maxlen + APIEXTRA,
1312 * Read and decrypt the remainder of the packet.
1314 for (st->i = st->cipherblk; st->i < st->packetlen + st->maclen;
1316 while ((*datalen) == 0)
1318 st->pktin->data[st->i] = *(*data)++;
1321 /* Decrypt everything _except_ the MAC. */
1323 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1324 st->pktin->data + st->cipherblk,
1325 st->packetlen - st->cipherblk);
1327 st->pktin->encrypted_len = st->packetlen;
1333 && !ssh->scmac->verify(ssh->sc_mac_ctx, st->pktin->data, st->len + 4,
1334 st->incoming_sequence)) {
1335 bombout(("Incorrect MAC received on packet"));
1336 ssh_free_packet(st->pktin);
1340 st->pktin->sequence = st->incoming_sequence++;
1343 * Decompress packet payload.
1346 unsigned char *newpayload;
1349 ssh->sccomp->decompress(ssh->sc_comp_ctx,
1350 st->pktin->data + 5, st->pktin->length - 5,
1351 &newpayload, &newlen)) {
1352 if (st->pktin->maxlen < newlen + 5) {
1353 st->pktin->maxlen = newlen + 5;
1354 st->pktin->data = sresize(st->pktin->data,
1355 st->pktin->maxlen + APIEXTRA,
1358 st->pktin->length = 5 + newlen;
1359 memcpy(st->pktin->data + 5, newpayload, newlen);
1364 st->pktin->savedpos = 6;
1365 st->pktin->body = st->pktin->data;
1366 st->pktin->type = st->pktin->data[5];
1369 * Log incoming packet, possibly omitting sensitive fields.
1373 struct logblank_t blank;
1374 if (ssh->cfg.logomitdata) {
1375 int do_blank = FALSE, blank_prefix = 0;
1376 /* "Session data" packets - omit the data field */
1377 if (st->pktin->type == SSH2_MSG_CHANNEL_DATA) {
1378 do_blank = TRUE; blank_prefix = 4;
1379 } else if (st->pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA) {
1380 do_blank = TRUE; blank_prefix = 8;
1383 blank.offset = blank_prefix;
1384 blank.len = (st->pktin->length-6) - blank_prefix;
1385 blank.type = PKTLOG_OMIT;
1389 log_packet(ssh->logctx, PKT_INCOMING, st->pktin->type,
1390 ssh2_pkt_type(ssh->pkt_ctx, st->pktin->type),
1391 st->pktin->data+6, st->pktin->length-6,
1395 crFinish(st->pktin);
1398 static int s_wrpkt_prepare(Ssh ssh, struct Packet *pkt, int *offset_p)
1400 int pad, biglen, i, pktoffs;
1404 * XXX various versions of SC (including 8.8.4) screw up the
1405 * register allocation in this function and use the same register
1406 * (D6) for len and as a temporary, with predictable results. The
1407 * following sledgehammer prevents this.
1414 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[12],
1415 ssh1_pkt_type(pkt->data[12]),
1416 pkt->body, pkt->length - (pkt->body - pkt->data),
1417 pkt->nblanks, pkt->blanks);
1418 sfree(pkt->blanks); pkt->blanks = NULL;
1421 if (ssh->v1_compressing) {
1422 unsigned char *compblk;
1424 zlib_compress_block(ssh->cs_comp_ctx,
1425 pkt->data + 12, pkt->length - 12,
1426 &compblk, &complen);
1427 ssh_pkt_ensure(pkt, complen + 2); /* just in case it's got bigger */
1428 memcpy(pkt->data + 12, compblk, complen);
1430 pkt->length = complen + 12;
1433 ssh_pkt_ensure(pkt, pkt->length + 4); /* space for CRC */
1435 len = pkt->length - 4 - 8; /* len(type+data+CRC) */
1436 pad = 8 - (len % 8);
1438 biglen = len + pad; /* len(padding+type+data+CRC) */
1440 for (i = pktoffs; i < 4+8; i++)
1441 pkt->data[i] = random_byte();
1442 crc = crc32_compute(pkt->data + pktoffs + 4, biglen - 4); /* all ex len */
1443 PUT_32BIT(pkt->data + pktoffs + 4 + biglen - 4, crc);
1444 PUT_32BIT(pkt->data + pktoffs, len);
1447 ssh->cipher->encrypt(ssh->v1_cipher_ctx,
1448 pkt->data + pktoffs + 4, biglen);
1450 if (offset_p) *offset_p = pktoffs;
1451 return biglen + 4; /* len(length+padding+type+data+CRC) */
1454 static int s_write(Ssh ssh, void *data, int len)
1456 log_packet(ssh->logctx, PKT_OUTGOING, -1, NULL, data, len, 0, NULL);
1457 return sk_write(ssh->s, (char *)data, len);
1460 static void s_wrpkt(Ssh ssh, struct Packet *pkt)
1462 int len, backlog, offset;
1463 len = s_wrpkt_prepare(ssh, pkt, &offset);
1464 backlog = s_write(ssh, pkt->data + offset, len);
1465 if (backlog > SSH_MAX_BACKLOG)
1466 ssh_throttle_all(ssh, 1, backlog);
1467 ssh_free_packet(pkt);
1470 static void s_wrpkt_defer(Ssh ssh, struct Packet *pkt)
1473 len = s_wrpkt_prepare(ssh, pkt, &offset);
1474 if (ssh->deferred_len + len > ssh->deferred_size) {
1475 ssh->deferred_size = ssh->deferred_len + len + 128;
1476 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
1480 memcpy(ssh->deferred_send_data + ssh->deferred_len,
1481 pkt->data + offset, len);
1482 ssh->deferred_len += len;
1483 ssh_free_packet(pkt);
1487 * Construct a SSH-1 packet with the specified contents.
1488 * (This all-at-once interface used to be the only one, but now SSH-1
1489 * packets can also be constructed incrementally.)
1491 static struct Packet *construct_packet(Ssh ssh, int pkttype, va_list ap)
1497 pkt = ssh1_pkt_init(pkttype);
1499 while ((argtype = va_arg(ap, int)) != PKT_END) {
1500 unsigned char *argp, argchar;
1502 unsigned long argint;
1505 /* Actual fields in the packet */
1507 argint = va_arg(ap, int);
1508 ssh_pkt_adduint32(pkt, argint);
1511 argchar = (unsigned char) va_arg(ap, int);
1512 ssh_pkt_addbyte(pkt, argchar);
1515 argp = va_arg(ap, unsigned char *);
1516 arglen = va_arg(ap, int);
1517 ssh_pkt_adddata(pkt, argp, arglen);
1520 sargp = va_arg(ap, char *);
1521 ssh_pkt_addstring(pkt, sargp);
1524 bn = va_arg(ap, Bignum);
1525 ssh1_pkt_addmp(pkt, bn);
1527 /* Tokens for modifications to packet logging */
1529 dont_log_password(ssh, pkt, PKTLOG_BLANK);
1532 dont_log_data(ssh, pkt, PKTLOG_OMIT);
1535 end_log_omission(ssh, pkt);
1543 static void send_packet(Ssh ssh, int pkttype, ...)
1547 va_start(ap, pkttype);
1548 pkt = construct_packet(ssh, pkttype, ap);
1553 static void defer_packet(Ssh ssh, int pkttype, ...)
1557 va_start(ap, pkttype);
1558 pkt = construct_packet(ssh, pkttype, ap);
1560 s_wrpkt_defer(ssh, pkt);
1563 static int ssh_versioncmp(char *a, char *b)
1566 unsigned long av, bv;
1568 av = strtoul(a, &ae, 10);
1569 bv = strtoul(b, &be, 10);
1571 return (av < bv ? -1 : +1);
1576 av = strtoul(ae, &ae, 10);
1577 bv = strtoul(be, &be, 10);
1579 return (av < bv ? -1 : +1);
1584 * Utility routines for putting an SSH-protocol `string' and
1585 * `uint32' into a hash state.
1587 static void hash_string(const struct ssh_hash *h, void *s, void *str, int len)
1589 unsigned char lenblk[4];
1590 PUT_32BIT(lenblk, len);
1591 h->bytes(s, lenblk, 4);
1592 h->bytes(s, str, len);
1595 static void hash_uint32(const struct ssh_hash *h, void *s, unsigned i)
1597 unsigned char intblk[4];
1598 PUT_32BIT(intblk, i);
1599 h->bytes(s, intblk, 4);
1603 * Packet construction functions. Mostly shared between SSH-1 and SSH-2.
1605 static void ssh_pkt_ensure(struct Packet *pkt, int length)
1607 if (pkt->maxlen < length) {
1608 unsigned char *body = pkt->body;
1609 int offset = body ? body - pkt->data : 0;
1610 pkt->maxlen = length + 256;
1611 pkt->data = sresize(pkt->data, pkt->maxlen + APIEXTRA, unsigned char);
1612 if (body) pkt->body = pkt->data + offset;
1615 static void ssh_pkt_adddata(struct Packet *pkt, void *data, int len)
1617 if (pkt->logmode != PKTLOG_EMIT) {
1619 pkt->blanks = sresize(pkt->blanks, pkt->nblanks, struct logblank_t);
1621 pkt->blanks[pkt->nblanks-1].offset = pkt->length -
1622 (pkt->body - pkt->data);
1623 pkt->blanks[pkt->nblanks-1].len = len;
1624 pkt->blanks[pkt->nblanks-1].type = pkt->logmode;
1627 ssh_pkt_ensure(pkt, pkt->length);
1628 memcpy(pkt->data + pkt->length - len, data, len);
1630 static void ssh_pkt_addbyte(struct Packet *pkt, unsigned char byte)
1632 ssh_pkt_adddata(pkt, &byte, 1);
1634 static void ssh2_pkt_addbool(struct Packet *pkt, unsigned char value)
1636 ssh_pkt_adddata(pkt, &value, 1);
1638 static void ssh_pkt_adduint32(struct Packet *pkt, unsigned long value)
1641 PUT_32BIT(x, value);
1642 ssh_pkt_adddata(pkt, x, 4);
1644 static void ssh_pkt_addstring_start(struct Packet *pkt)
1646 ssh_pkt_adduint32(pkt, 0);
1647 pkt->savedpos = pkt->length;
1649 static void ssh_pkt_addstring_str(struct Packet *pkt, char *data)
1651 ssh_pkt_adddata(pkt, data, strlen(data));
1652 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
1654 static void ssh_pkt_addstring_data(struct Packet *pkt, char *data, int len)
1656 ssh_pkt_adddata(pkt, data, len);
1657 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
1659 static void ssh_pkt_addstring(struct Packet *pkt, char *data)
1661 ssh_pkt_addstring_start(pkt);
1662 ssh_pkt_addstring_str(pkt, data);
1664 static void ssh1_pkt_addmp(struct Packet *pkt, Bignum b)
1666 int len = ssh1_bignum_length(b);
1667 unsigned char *data = snewn(len, unsigned char);
1668 (void) ssh1_write_bignum(data, b);
1669 ssh_pkt_adddata(pkt, data, len);
1672 static unsigned char *ssh2_mpint_fmt(Bignum b, int *len)
1675 int i, n = (bignum_bitcount(b) + 7) / 8;
1676 p = snewn(n + 1, unsigned char);
1678 for (i = 1; i <= n; i++)
1679 p[i] = bignum_byte(b, n - i);
1681 while (i <= n && p[i] == 0 && (p[i + 1] & 0x80) == 0)
1683 memmove(p, p + i, n + 1 - i);
1687 static void ssh2_pkt_addmp(struct Packet *pkt, Bignum b)
1691 p = ssh2_mpint_fmt(b, &len);
1692 ssh_pkt_addstring_start(pkt);
1693 ssh_pkt_addstring_data(pkt, (char *)p, len);
1697 static struct Packet *ssh1_pkt_init(int pkt_type)
1699 struct Packet *pkt = ssh_new_packet();
1700 pkt->length = 4 + 8; /* space for length + max padding */
1701 ssh_pkt_addbyte(pkt, pkt_type);
1702 pkt->body = pkt->data + pkt->length;
1706 /* For legacy code (SSH-1 and -2 packet construction used to be separate) */
1707 #define ssh2_pkt_ensure(pkt, length) ssh_pkt_ensure(pkt, length)
1708 #define ssh2_pkt_adddata(pkt, data, len) ssh_pkt_adddata(pkt, data, len)
1709 #define ssh2_pkt_addbyte(pkt, byte) ssh_pkt_addbyte(pkt, byte)
1710 #define ssh2_pkt_adduint32(pkt, value) ssh_pkt_adduint32(pkt, value)
1711 #define ssh2_pkt_addstring_start(pkt) ssh_pkt_addstring_start(pkt)
1712 #define ssh2_pkt_addstring_str(pkt, data) ssh_pkt_addstring_str(pkt, data)
1713 #define ssh2_pkt_addstring_data(pkt, data, len) ssh_pkt_addstring_data(pkt, data, len)
1714 #define ssh2_pkt_addstring(pkt, data) ssh_pkt_addstring(pkt, data)
1716 static struct Packet *ssh2_pkt_init(int pkt_type)
1718 struct Packet *pkt = ssh_new_packet();
1719 pkt->length = 5; /* space for packet length + padding length */
1721 ssh_pkt_addbyte(pkt, (unsigned char) pkt_type);
1722 pkt->body = pkt->data + pkt->length; /* after packet type */
1727 * Construct an SSH-2 final-form packet: compress it, encrypt it,
1728 * put the MAC on it. Final packet, ready to be sent, is stored in
1729 * pkt->data. Total length is returned.
1731 static int ssh2_pkt_construct(Ssh ssh, struct Packet *pkt)
1733 int cipherblk, maclen, padding, i;
1736 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[5],
1737 ssh2_pkt_type(ssh->pkt_ctx, pkt->data[5]),
1738 pkt->body, pkt->length - (pkt->body - pkt->data),
1739 pkt->nblanks, pkt->blanks);
1740 sfree(pkt->blanks); pkt->blanks = NULL;
1744 * Compress packet payload.
1747 unsigned char *newpayload;
1750 ssh->cscomp->compress(ssh->cs_comp_ctx, pkt->data + 5,
1752 &newpayload, &newlen)) {
1754 ssh2_pkt_adddata(pkt, newpayload, newlen);
1760 * Add padding. At least four bytes, and must also bring total
1761 * length (minus MAC) up to a multiple of the block size.
1762 * If pkt->forcepad is set, make sure the packet is at least that size
1765 cipherblk = ssh->cscipher ? ssh->cscipher->blksize : 8; /* block size */
1766 cipherblk = cipherblk < 8 ? 8 : cipherblk; /* or 8 if blksize < 8 */
1768 if (pkt->length + padding < pkt->forcepad)
1769 padding = pkt->forcepad - pkt->length;
1771 (cipherblk - (pkt->length + padding) % cipherblk) % cipherblk;
1772 assert(padding <= 255);
1773 maclen = ssh->csmac ? ssh->csmac->len : 0;
1774 ssh2_pkt_ensure(pkt, pkt->length + padding + maclen);
1775 pkt->data[4] = padding;
1776 for (i = 0; i < padding; i++)
1777 pkt->data[pkt->length + i] = random_byte();
1778 PUT_32BIT(pkt->data, pkt->length + padding - 4);
1780 ssh->csmac->generate(ssh->cs_mac_ctx, pkt->data,
1781 pkt->length + padding,
1782 ssh->v2_outgoing_sequence);
1783 ssh->v2_outgoing_sequence++; /* whether or not we MACed */
1786 ssh->cscipher->encrypt(ssh->cs_cipher_ctx,
1787 pkt->data, pkt->length + padding);
1789 pkt->encrypted_len = pkt->length + padding;
1791 /* Ready-to-send packet starts at pkt->data. We return length. */
1792 return pkt->length + padding + maclen;
1796 * Routines called from the main SSH code to send packets. There
1797 * are quite a few of these, because we have two separate
1798 * mechanisms for delaying the sending of packets:
1800 * - In order to send an IGNORE message and a password message in
1801 * a single fixed-length blob, we require the ability to
1802 * concatenate the encrypted forms of those two packets _into_ a
1803 * single blob and then pass it to our <network.h> transport
1804 * layer in one go. Hence, there's a deferment mechanism which
1805 * works after packet encryption.
1807 * - In order to avoid sending any connection-layer messages
1808 * during repeat key exchange, we have to queue up any such
1809 * outgoing messages _before_ they are encrypted (and in
1810 * particular before they're allocated sequence numbers), and
1811 * then send them once we've finished.
1813 * I call these mechanisms `defer' and `queue' respectively, so as
1814 * to distinguish them reasonably easily.
1816 * The functions send_noqueue() and defer_noqueue() free the packet
1817 * structure they are passed. Every outgoing packet goes through
1818 * precisely one of these functions in its life; packets passed to
1819 * ssh2_pkt_send() or ssh2_pkt_defer() either go straight to one of
1820 * these or get queued, and then when the queue is later emptied
1821 * the packets are all passed to defer_noqueue().
1823 * When using a CBC-mode cipher, it's necessary to ensure that an
1824 * attacker can't provide data to be encrypted using an IV that they
1825 * know. We ensure this by prefixing each packet that might contain
1826 * user data with an SSH_MSG_IGNORE. This is done using the deferral
1827 * mechanism, so in this case send_noqueue() ends up redirecting to
1828 * defer_noqueue(). If you don't like this inefficiency, don't use
1832 static void ssh2_pkt_defer_noqueue(Ssh, struct Packet *, int);
1833 static void ssh_pkt_defersend(Ssh);
1836 * Send an SSH-2 packet immediately, without queuing or deferring.
1838 static void ssh2_pkt_send_noqueue(Ssh ssh, struct Packet *pkt)
1842 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC)) {
1843 /* We need to send two packets, so use the deferral mechanism. */
1844 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
1845 ssh_pkt_defersend(ssh);
1848 len = ssh2_pkt_construct(ssh, pkt);
1849 backlog = s_write(ssh, pkt->data, len);
1850 if (backlog > SSH_MAX_BACKLOG)
1851 ssh_throttle_all(ssh, 1, backlog);
1853 ssh->outgoing_data_size += pkt->encrypted_len;
1854 if (!ssh->kex_in_progress &&
1855 ssh->max_data_size != 0 &&
1856 ssh->outgoing_data_size > ssh->max_data_size)
1857 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
1859 ssh_free_packet(pkt);
1863 * Defer an SSH-2 packet.
1865 static void ssh2_pkt_defer_noqueue(Ssh ssh, struct Packet *pkt, int noignore)
1868 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC) &&
1869 ssh->deferred_len == 0 && !noignore) {
1871 * Interpose an SSH_MSG_IGNORE to ensure that user data don't
1872 * get encrypted with a known IV.
1874 struct Packet *ipkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
1875 ssh2_pkt_addstring_start(ipkt);
1876 ssh2_pkt_defer_noqueue(ssh, ipkt, TRUE);
1878 len = ssh2_pkt_construct(ssh, pkt);
1879 if (ssh->deferred_len + len > ssh->deferred_size) {
1880 ssh->deferred_size = ssh->deferred_len + len + 128;
1881 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
1885 memcpy(ssh->deferred_send_data + ssh->deferred_len, pkt->data, len);
1886 ssh->deferred_len += len;
1887 ssh->deferred_data_size += pkt->encrypted_len;
1888 ssh_free_packet(pkt);
1892 * Queue an SSH-2 packet.
1894 static void ssh2_pkt_queue(Ssh ssh, struct Packet *pkt)
1896 assert(ssh->queueing);
1898 if (ssh->queuelen >= ssh->queuesize) {
1899 ssh->queuesize = ssh->queuelen + 32;
1900 ssh->queue = sresize(ssh->queue, ssh->queuesize, struct Packet *);
1903 ssh->queue[ssh->queuelen++] = pkt;
1907 * Either queue or send a packet, depending on whether queueing is
1910 static void ssh2_pkt_send(Ssh ssh, struct Packet *pkt)
1913 ssh2_pkt_queue(ssh, pkt);
1915 ssh2_pkt_send_noqueue(ssh, pkt);
1919 * Either queue or defer a packet, depending on whether queueing is
1922 static void ssh2_pkt_defer(Ssh ssh, struct Packet *pkt)
1925 ssh2_pkt_queue(ssh, pkt);
1927 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
1931 * Send the whole deferred data block constructed by
1932 * ssh2_pkt_defer() or SSH-1's defer_packet().
1934 * The expected use of the defer mechanism is that you call
1935 * ssh2_pkt_defer() a few times, then call ssh_pkt_defersend(). If
1936 * not currently queueing, this simply sets up deferred_send_data
1937 * and then sends it. If we _are_ currently queueing, the calls to
1938 * ssh2_pkt_defer() put the deferred packets on to the queue
1939 * instead, and therefore ssh_pkt_defersend() has no deferred data
1940 * to send. Hence, there's no need to make it conditional on
1943 static void ssh_pkt_defersend(Ssh ssh)
1946 backlog = s_write(ssh, ssh->deferred_send_data, ssh->deferred_len);
1947 ssh->deferred_len = ssh->deferred_size = 0;
1948 sfree(ssh->deferred_send_data);
1949 ssh->deferred_send_data = NULL;
1950 if (backlog > SSH_MAX_BACKLOG)
1951 ssh_throttle_all(ssh, 1, backlog);
1953 ssh->outgoing_data_size += ssh->deferred_data_size;
1954 if (!ssh->kex_in_progress &&
1955 ssh->max_data_size != 0 &&
1956 ssh->outgoing_data_size > ssh->max_data_size)
1957 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
1958 ssh->deferred_data_size = 0;
1962 * Send a packet whose length needs to be disguised (typically
1963 * passwords or keyboard-interactive responses).
1965 static void ssh2_pkt_send_with_padding(Ssh ssh, struct Packet *pkt,
1971 * The simplest way to do this is to adjust the
1972 * variable-length padding field in the outgoing packet.
1974 * Currently compiled out, because some Cisco SSH servers
1975 * don't like excessively padded packets (bah, why's it
1978 pkt->forcepad = padsize;
1979 ssh2_pkt_send(ssh, pkt);
1984 * If we can't do that, however, an alternative approach is
1985 * to use the pkt_defer mechanism to bundle the packet
1986 * tightly together with an SSH_MSG_IGNORE such that their
1987 * combined length is a constant. So first we construct the
1988 * final form of this packet and defer its sending.
1990 ssh2_pkt_defer(ssh, pkt);
1993 * Now construct an SSH_MSG_IGNORE which includes a string
1994 * that's an exact multiple of the cipher block size. (If
1995 * the cipher is NULL so that the block size is
1996 * unavailable, we don't do this trick at all, because we
1997 * gain nothing by it.)
1999 if (ssh->cscipher) {
2002 stringlen = (256 - ssh->deferred_len);
2003 stringlen += ssh->cscipher->blksize - 1;
2004 stringlen -= (stringlen % ssh->cscipher->blksize);
2007 * Temporarily disable actual compression, so we
2008 * can guarantee to get this string exactly the
2009 * length we want it. The compression-disabling
2010 * routine should return an integer indicating how
2011 * many bytes we should adjust our string length
2015 ssh->cscomp->disable_compression(ssh->cs_comp_ctx);
2017 pkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
2018 ssh2_pkt_addstring_start(pkt);
2019 for (i = 0; i < stringlen; i++) {
2020 char c = (char) random_byte();
2021 ssh2_pkt_addstring_data(pkt, &c, 1);
2023 ssh2_pkt_defer(ssh, pkt);
2025 ssh_pkt_defersend(ssh);
2030 * Send all queued SSH-2 packets. We send them by means of
2031 * ssh2_pkt_defer_noqueue(), in case they included a pair of
2032 * packets that needed to be lumped together.
2034 static void ssh2_pkt_queuesend(Ssh ssh)
2038 assert(!ssh->queueing);
2040 for (i = 0; i < ssh->queuelen; i++)
2041 ssh2_pkt_defer_noqueue(ssh, ssh->queue[i], FALSE);
2044 ssh_pkt_defersend(ssh);
2048 void bndebug(char *string, Bignum b)
2052 p = ssh2_mpint_fmt(b, &len);
2053 debug(("%s", string));
2054 for (i = 0; i < len; i++)
2055 debug((" %02x", p[i]));
2061 static void hash_mpint(const struct ssh_hash *h, void *s, Bignum b)
2065 p = ssh2_mpint_fmt(b, &len);
2066 hash_string(h, s, p, len);
2071 * Packet decode functions for both SSH-1 and SSH-2.
2073 static unsigned long ssh_pkt_getuint32(struct Packet *pkt)
2075 unsigned long value;
2076 if (pkt->length - pkt->savedpos < 4)
2077 return 0; /* arrgh, no way to decline (FIXME?) */
2078 value = GET_32BIT(pkt->body + pkt->savedpos);
2082 static int ssh2_pkt_getbool(struct Packet *pkt)
2084 unsigned long value;
2085 if (pkt->length - pkt->savedpos < 1)
2086 return 0; /* arrgh, no way to decline (FIXME?) */
2087 value = pkt->body[pkt->savedpos] != 0;
2091 static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length)
2096 if (pkt->length - pkt->savedpos < 4)
2098 len = GET_32BIT(pkt->body + pkt->savedpos);
2103 if (pkt->length - pkt->savedpos < *length)
2105 *p = (char *)(pkt->body + pkt->savedpos);
2106 pkt->savedpos += *length;
2108 static void *ssh_pkt_getdata(struct Packet *pkt, int length)
2110 if (pkt->length - pkt->savedpos < length)
2112 pkt->savedpos += length;
2113 return pkt->body + (pkt->savedpos - length);
2115 static int ssh1_pkt_getrsakey(struct Packet *pkt, struct RSAKey *key,
2116 unsigned char **keystr)
2120 j = makekey(pkt->body + pkt->savedpos,
2121 pkt->length - pkt->savedpos,
2128 assert(pkt->savedpos < pkt->length);
2132 static Bignum ssh1_pkt_getmp(struct Packet *pkt)
2137 j = ssh1_read_bignum(pkt->body + pkt->savedpos,
2138 pkt->length - pkt->savedpos, &b);
2146 static Bignum ssh2_pkt_getmp(struct Packet *pkt)
2152 ssh_pkt_getstring(pkt, &p, &length);
2157 b = bignum_from_bytes((unsigned char *)p, length);
2162 * Helper function to add an SSH-2 signature blob to a packet.
2163 * Expects to be shown the public key blob as well as the signature
2164 * blob. Normally works just like ssh2_pkt_addstring, but will
2165 * fiddle with the signature packet if necessary for
2166 * BUG_SSH2_RSA_PADDING.
2168 static void ssh2_add_sigblob(Ssh ssh, struct Packet *pkt,
2169 void *pkblob_v, int pkblob_len,
2170 void *sigblob_v, int sigblob_len)
2172 unsigned char *pkblob = (unsigned char *)pkblob_v;
2173 unsigned char *sigblob = (unsigned char *)sigblob_v;
2175 /* dmemdump(pkblob, pkblob_len); */
2176 /* dmemdump(sigblob, sigblob_len); */
2179 * See if this is in fact an ssh-rsa signature and a buggy
2180 * server; otherwise we can just do this the easy way.
2182 if ((ssh->remote_bugs & BUG_SSH2_RSA_PADDING) &&
2183 (GET_32BIT(pkblob) == 7 && !memcmp(pkblob+4, "ssh-rsa", 7))) {
2184 int pos, len, siglen;
2187 * Find the byte length of the modulus.
2190 pos = 4+7; /* skip over "ssh-rsa" */
2191 pos += 4 + GET_32BIT(pkblob+pos); /* skip over exponent */
2192 len = GET_32BIT(pkblob+pos); /* find length of modulus */
2193 pos += 4; /* find modulus itself */
2194 while (len > 0 && pkblob[pos] == 0)
2196 /* debug(("modulus length is %d\n", len)); */
2199 * Now find the signature integer.
2201 pos = 4+7; /* skip over "ssh-rsa" */
2202 siglen = GET_32BIT(sigblob+pos);
2203 /* debug(("signature length is %d\n", siglen)); */
2205 if (len != siglen) {
2206 unsigned char newlen[4];
2207 ssh2_pkt_addstring_start(pkt);
2208 ssh2_pkt_addstring_data(pkt, (char *)sigblob, pos);
2209 /* dmemdump(sigblob, pos); */
2210 pos += 4; /* point to start of actual sig */
2211 PUT_32BIT(newlen, len);
2212 ssh2_pkt_addstring_data(pkt, (char *)newlen, 4);
2213 /* dmemdump(newlen, 4); */
2215 while (len-- > siglen) {
2216 ssh2_pkt_addstring_data(pkt, (char *)newlen, 1);
2217 /* dmemdump(newlen, 1); */
2219 ssh2_pkt_addstring_data(pkt, (char *)(sigblob+pos), siglen);
2220 /* dmemdump(sigblob+pos, siglen); */
2224 /* Otherwise fall through and do it the easy way. */
2227 ssh2_pkt_addstring_start(pkt);
2228 ssh2_pkt_addstring_data(pkt, (char *)sigblob, sigblob_len);
2232 * Examine the remote side's version string and compare it against
2233 * a list of known buggy implementations.
2235 static void ssh_detect_bugs(Ssh ssh, char *vstring)
2237 char *imp; /* pointer to implementation part */
2239 imp += strcspn(imp, "-");
2241 imp += strcspn(imp, "-");
2244 ssh->remote_bugs = 0;
2247 * General notes on server version strings:
2248 * - Not all servers reporting "Cisco-1.25" have all the bugs listed
2249 * here -- in particular, we've heard of one that's perfectly happy
2250 * with SSH1_MSG_IGNOREs -- but this string never seems to change,
2251 * so we can't distinguish them.
2253 if (ssh->cfg.sshbug_ignore1 == FORCE_ON ||
2254 (ssh->cfg.sshbug_ignore1 == AUTO &&
2255 (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
2256 !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
2257 !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25") ||
2258 !strcmp(imp, "OSU_1.4alpha3") || !strcmp(imp, "OSU_1.5alpha4")))) {
2260 * These versions don't support SSH1_MSG_IGNORE, so we have
2261 * to use a different defence against password length
2264 ssh->remote_bugs |= BUG_CHOKES_ON_SSH1_IGNORE;
2265 logevent("We believe remote version has SSH-1 ignore bug");
2268 if (ssh->cfg.sshbug_plainpw1 == FORCE_ON ||
2269 (ssh->cfg.sshbug_plainpw1 == AUTO &&
2270 (!strcmp(imp, "Cisco-1.25") || !strcmp(imp, "OSU_1.4alpha3")))) {
2272 * These versions need a plain password sent; they can't
2273 * handle having a null and a random length of data after
2276 ssh->remote_bugs |= BUG_NEEDS_SSH1_PLAIN_PASSWORD;
2277 logevent("We believe remote version needs a plain SSH-1 password");
2280 if (ssh->cfg.sshbug_rsa1 == FORCE_ON ||
2281 (ssh->cfg.sshbug_rsa1 == AUTO &&
2282 (!strcmp(imp, "Cisco-1.25")))) {
2284 * These versions apparently have no clue whatever about
2285 * RSA authentication and will panic and die if they see
2286 * an AUTH_RSA message.
2288 ssh->remote_bugs |= BUG_CHOKES_ON_RSA;
2289 logevent("We believe remote version can't handle SSH-1 RSA authentication");
2292 if (ssh->cfg.sshbug_hmac2 == FORCE_ON ||
2293 (ssh->cfg.sshbug_hmac2 == AUTO &&
2294 !wc_match("* VShell", imp) &&
2295 (wc_match("2.1.0*", imp) || wc_match("2.0.*", imp) ||
2296 wc_match("2.2.0*", imp) || wc_match("2.3.0*", imp) ||
2297 wc_match("2.1 *", imp)))) {
2299 * These versions have the HMAC bug.
2301 ssh->remote_bugs |= BUG_SSH2_HMAC;
2302 logevent("We believe remote version has SSH-2 HMAC bug");
2305 if (ssh->cfg.sshbug_derivekey2 == FORCE_ON ||
2306 (ssh->cfg.sshbug_derivekey2 == AUTO &&
2307 !wc_match("* VShell", imp) &&
2308 (wc_match("2.0.0*", imp) || wc_match("2.0.10*", imp) ))) {
2310 * These versions have the key-derivation bug (failing to
2311 * include the literal shared secret in the hashes that
2312 * generate the keys).
2314 ssh->remote_bugs |= BUG_SSH2_DERIVEKEY;
2315 logevent("We believe remote version has SSH-2 key-derivation bug");
2318 if (ssh->cfg.sshbug_rsapad2 == FORCE_ON ||
2319 (ssh->cfg.sshbug_rsapad2 == AUTO &&
2320 (wc_match("OpenSSH_2.[5-9]*", imp) ||
2321 wc_match("OpenSSH_3.[0-2]*", imp)))) {
2323 * These versions have the SSH-2 RSA padding bug.
2325 ssh->remote_bugs |= BUG_SSH2_RSA_PADDING;
2326 logevent("We believe remote version has SSH-2 RSA padding bug");
2329 if (ssh->cfg.sshbug_pksessid2 == FORCE_ON ||
2330 (ssh->cfg.sshbug_pksessid2 == AUTO &&
2331 wc_match("OpenSSH_2.[0-2]*", imp))) {
2333 * These versions have the SSH-2 session-ID bug in
2334 * public-key authentication.
2336 ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID;
2337 logevent("We believe remote version has SSH-2 public-key-session-ID bug");
2340 if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
2341 (ssh->cfg.sshbug_rekey2 == AUTO &&
2342 (wc_match("DigiSSH_2.0", imp) ||
2343 wc_match("OpenSSH_2.[0-4]*", imp) ||
2344 wc_match("OpenSSH_2.5.[0-3]*", imp) ||
2345 wc_match("Sun_SSH_1.0", imp) ||
2346 wc_match("Sun_SSH_1.0.1", imp) ||
2347 /* All versions <= 1.2.6 (they changed their format in 1.2.7) */
2348 wc_match("WeOnlyDo-*", imp)))) {
2350 * These versions have the SSH-2 rekey bug.
2352 ssh->remote_bugs |= BUG_SSH2_REKEY;
2353 logevent("We believe remote version has SSH-2 rekey bug");
2358 * The `software version' part of an SSH version string is required
2359 * to contain no spaces or minus signs.
2361 static void ssh_fix_verstring(char *str)
2363 /* Eat "SSH-<protoversion>-". */
2364 assert(*str == 'S'); str++;
2365 assert(*str == 'S'); str++;
2366 assert(*str == 'H'); str++;
2367 assert(*str == '-'); str++;
2368 while (*str && *str != '-') str++;
2369 assert(*str == '-'); str++;
2371 /* Convert minus signs and spaces in the remaining string into
2374 if (*str == '-' || *str == ' ')
2380 static int do_ssh_init(Ssh ssh, unsigned char c)
2382 struct do_ssh_init_state {
2390 crState(do_ssh_init_state);
2392 crBegin(ssh->do_ssh_init_crstate);
2394 /* Search for a line beginning with the string "SSH-" in the input. */
2396 if (c != 'S') goto no;
2398 if (c != 'S') goto no;
2400 if (c != 'H') goto no;
2402 if (c != '-') goto no;
2411 s->vstring = snewn(s->vstrsize, char);
2412 strcpy(s->vstring, "SSH-");
2416 crReturn(1); /* get another char */
2417 if (s->vslen >= s->vstrsize - 1) {
2419 s->vstring = sresize(s->vstring, s->vstrsize, char);
2421 s->vstring[s->vslen++] = c;
2424 s->version[s->i] = '\0';
2426 } else if (s->i < sizeof(s->version) - 1)
2427 s->version[s->i++] = c;
2428 } else if (c == '\012')
2432 ssh->agentfwd_enabled = FALSE;
2433 ssh->rdpkt2_state.incoming_sequence = 0;
2435 s->vstring[s->vslen] = 0;
2436 s->vstring[strcspn(s->vstring, "\015\012")] = '\0';/* remove EOL chars */
2437 logeventf(ssh, "Server version: %s", s->vstring);
2438 ssh_detect_bugs(ssh, s->vstring);
2441 * Decide which SSH protocol version to support.
2444 /* Anything strictly below "2.0" means protocol 1 is supported. */
2445 s->proto1 = ssh_versioncmp(s->version, "2.0") < 0;
2446 /* Anything greater or equal to "1.99" means protocol 2 is supported. */
2447 s->proto2 = ssh_versioncmp(s->version, "1.99") >= 0;
2449 if (ssh->cfg.sshprot == 0 && !s->proto1) {
2450 bombout(("SSH protocol version 1 required by user but not provided by server"));
2453 if (ssh->cfg.sshprot == 3 && !s->proto2) {
2454 bombout(("SSH protocol version 2 required by user but not provided by server"));
2461 if (s->proto2 && (ssh->cfg.sshprot >= 2 || !s->proto1)) {
2463 * Construct a v2 version string.
2465 verstring = dupprintf("SSH-2.0-%s\015\012", sshver);
2469 * Construct a v1 version string.
2471 verstring = dupprintf("SSH-%s-%s\012",
2472 (ssh_versioncmp(s->version, "1.5") <= 0 ?
2473 s->version : "1.5"),
2478 ssh_fix_verstring(verstring);
2480 if (ssh->version == 2) {
2483 * Hash our version string and their version string.
2485 len = strcspn(verstring, "\015\012");
2486 ssh->v_c = snewn(len + 1, char);
2487 memcpy(ssh->v_c, verstring, len);
2489 len = strcspn(s->vstring, "\015\012");
2490 ssh->v_s = snewn(len + 1, char);
2491 memcpy(ssh->v_s, s->vstring, len);
2495 * Initialise SSH-2 protocol.
2497 ssh->protocol = ssh2_protocol;
2498 ssh2_protocol_setup(ssh);
2499 ssh->s_rdpkt = ssh2_rdpkt;
2502 * Initialise SSH-1 protocol.
2504 ssh->protocol = ssh1_protocol;
2505 ssh1_protocol_setup(ssh);
2506 ssh->s_rdpkt = ssh1_rdpkt;
2508 logeventf(ssh, "We claim version: %.*s",
2509 strcspn(verstring, "\015\012"), verstring);
2510 s_write(ssh, verstring, strlen(verstring));
2512 if (ssh->version == 2)
2513 do_ssh2_transport(ssh, NULL, -1, NULL);
2516 logeventf(ssh, "Using SSH protocol version %d", ssh->version);
2518 update_specials_menu(ssh->frontend);
2519 ssh->state = SSH_STATE_BEFORE_SIZE;
2520 ssh->pinger = pinger_new(&ssh->cfg, &ssh_backend, ssh);
2527 static void ssh_process_incoming_data(Ssh ssh,
2528 unsigned char **data, int *datalen)
2530 struct Packet *pktin;
2532 pktin = ssh->s_rdpkt(ssh, data, datalen);
2534 ssh->protocol(ssh, NULL, 0, pktin);
2535 ssh_free_packet(pktin);
2539 static void ssh_queue_incoming_data(Ssh ssh,
2540 unsigned char **data, int *datalen)
2542 bufchain_add(&ssh->queued_incoming_data, *data, *datalen);
2547 static void ssh_process_queued_incoming_data(Ssh ssh)
2550 unsigned char *data;
2553 while (!ssh->frozen && bufchain_size(&ssh->queued_incoming_data)) {
2554 bufchain_prefix(&ssh->queued_incoming_data, &vdata, &len);
2558 while (!ssh->frozen && len > 0)
2559 ssh_process_incoming_data(ssh, &data, &len);
2562 bufchain_consume(&ssh->queued_incoming_data, origlen - len);
2566 static void ssh_set_frozen(Ssh ssh, int frozen)
2569 sk_set_frozen(ssh->s, frozen);
2570 ssh->frozen = frozen;
2573 static void ssh_gotdata(Ssh ssh, unsigned char *data, int datalen)
2575 /* Log raw data, if we're in that mode. */
2576 log_packet(ssh->logctx, PKT_INCOMING, -1, NULL, data, datalen, 0, NULL);
2578 crBegin(ssh->ssh_gotdata_crstate);
2581 * To begin with, feed the characters one by one to the
2582 * protocol initialisation / selection function do_ssh_init().
2583 * When that returns 0, we're done with the initial greeting
2584 * exchange and can move on to packet discipline.
2587 int ret; /* need not be kept across crReturn */
2589 crReturnV; /* more data please */
2590 ret = do_ssh_init(ssh, *data);
2598 * We emerge from that loop when the initial negotiation is
2599 * over and we have selected an s_rdpkt function. Now pass
2600 * everything to s_rdpkt, and then pass the resulting packets
2601 * to the proper protocol handler.
2605 while (bufchain_size(&ssh->queued_incoming_data) > 0 || datalen > 0) {
2607 ssh_queue_incoming_data(ssh, &data, &datalen);
2608 /* This uses up all data and cannot cause anything interesting
2609 * to happen; indeed, for anything to happen at all, we must
2610 * return, so break out. */
2612 } else if (bufchain_size(&ssh->queued_incoming_data) > 0) {
2613 /* This uses up some or all data, and may freeze the
2615 ssh_process_queued_incoming_data(ssh);
2617 /* This uses up some or all data, and may freeze the
2619 ssh_process_incoming_data(ssh, &data, &datalen);
2621 /* FIXME this is probably EBW. */
2622 if (ssh->state == SSH_STATE_CLOSED)
2625 /* We're out of data. Go and get some more. */
2631 static int ssh_do_close(Ssh ssh, int notify_exit)
2634 struct ssh_channel *c;
2636 ssh->state = SSH_STATE_CLOSED;
2637 expire_timer_context(ssh);
2642 notify_remote_exit(ssh->frontend);
2647 * Now we must shut down any port- and X-forwarded channels going
2648 * through this connection.
2650 if (ssh->channels) {
2651 while (NULL != (c = index234(ssh->channels, 0))) {
2654 x11_close(c->u.x11.s);
2657 pfd_close(c->u.pfd.s);
2660 del234(ssh->channels, c); /* moving next one to index 0 */
2661 if (ssh->version == 2)
2662 bufchain_clear(&c->v.v2.outbuffer);
2667 * Go through port-forwardings, and close any associated
2668 * listening sockets.
2670 if (ssh->portfwds) {
2671 struct ssh_portfwd *pf;
2672 while (NULL != (pf = index234(ssh->portfwds, 0))) {
2673 /* Dispose of any listening socket. */
2675 pfd_terminate(pf->local);
2676 del234(ssh->portfwds, pf); /* moving next one to index 0 */
2684 static void ssh_log(Plug plug, int type, SockAddr addr, int port,
2685 const char *error_msg, int error_code)
2687 Ssh ssh = (Ssh) plug;
2688 char addrbuf[256], *msg;
2690 sk_getaddr(addr, addrbuf, lenof(addrbuf));
2693 msg = dupprintf("Connecting to %s port %d", addrbuf, port);
2695 msg = dupprintf("Failed to connect to %s: %s", addrbuf, error_msg);
2701 static int ssh_closing(Plug plug, const char *error_msg, int error_code,
2704 Ssh ssh = (Ssh) plug;
2705 int need_notify = ssh_do_close(ssh, FALSE);
2708 if (!ssh->close_expected)
2709 error_msg = "Server unexpectedly closed network connection";
2711 error_msg = "Server closed network connection";
2714 if (ssh->close_expected && ssh->clean_exit && ssh->exitcode < 0)
2718 notify_remote_exit(ssh->frontend);
2721 logevent(error_msg);
2722 if (!ssh->close_expected || !ssh->clean_exit)
2723 connection_fatal(ssh->frontend, "%s", error_msg);
2727 static int ssh_receive(Plug plug, int urgent, char *data, int len)
2729 Ssh ssh = (Ssh) plug;
2730 ssh_gotdata(ssh, (unsigned char *)data, len);
2731 if (ssh->state == SSH_STATE_CLOSED) {
2732 ssh_do_close(ssh, TRUE);
2738 static void ssh_sent(Plug plug, int bufsize)
2740 Ssh ssh = (Ssh) plug;
2742 * If the send backlog on the SSH socket itself clears, we
2743 * should unthrottle the whole world if it was throttled.
2745 if (bufsize < SSH_MAX_BACKLOG)
2746 ssh_throttle_all(ssh, 0, bufsize);
2750 * Connect to specified host and port.
2751 * Returns an error message, or NULL on success.
2752 * Also places the canonical host name into `realhost'. It must be
2753 * freed by the caller.
2755 static const char *connect_to_host(Ssh ssh, char *host, int port,
2756 char **realhost, int nodelay, int keepalive)
2758 static const struct plug_function_table fn_table = {
2769 ssh->savedhost = snewn(1 + strlen(host), char);
2770 strcpy(ssh->savedhost, host);
2773 port = 22; /* default ssh port */
2774 ssh->savedport = port;
2779 logeventf(ssh, "Looking up host \"%s\"%s", host,
2780 (ssh->cfg.addressfamily == ADDRTYPE_IPV4 ? " (IPv4)" :
2781 (ssh->cfg.addressfamily == ADDRTYPE_IPV6 ? " (IPv6)" : "")));
2782 addr = name_lookup(host, port, realhost, &ssh->cfg,
2783 ssh->cfg.addressfamily);
2784 if ((err = sk_addr_error(addr)) != NULL) {
2792 ssh->fn = &fn_table;
2793 ssh->s = new_connection(addr, *realhost, port,
2794 0, 1, nodelay, keepalive, (Plug) ssh, &ssh->cfg);
2795 if ((err = sk_socket_error(ssh->s)) != NULL) {
2797 notify_remote_exit(ssh->frontend);
2805 * Throttle or unthrottle the SSH connection.
2807 static void ssh1_throttle(Ssh ssh, int adjust)
2809 int old_count = ssh->v1_throttle_count;
2810 ssh->v1_throttle_count += adjust;
2811 assert(ssh->v1_throttle_count >= 0);
2812 if (ssh->v1_throttle_count && !old_count) {
2813 ssh_set_frozen(ssh, 1);
2814 } else if (!ssh->v1_throttle_count && old_count) {
2815 ssh_set_frozen(ssh, 0);
2820 * Throttle or unthrottle _all_ local data streams (for when sends
2821 * on the SSH connection itself back up).
2823 static void ssh_throttle_all(Ssh ssh, int enable, int bufsize)
2826 struct ssh_channel *c;
2828 if (enable == ssh->throttled_all)
2830 ssh->throttled_all = enable;
2831 ssh->overall_bufsize = bufsize;
2834 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++) {
2836 case CHAN_MAINSESSION:
2838 * This is treated separately, outside the switch.
2842 x11_override_throttle(c->u.x11.s, enable);
2845 /* Agent channels require no buffer management. */
2848 pfd_override_throttle(c->u.pfd.s, enable);
2854 static void ssh_agent_callback(void *sshv, void *reply, int replylen)
2856 Ssh ssh = (Ssh) sshv;
2858 ssh->agent_response = reply;
2859 ssh->agent_response_len = replylen;
2861 if (ssh->version == 1)
2862 do_ssh1_login(ssh, NULL, -1, NULL);
2864 do_ssh2_authconn(ssh, NULL, -1, NULL);
2867 static void ssh_dialog_callback(void *sshv, int ret)
2869 Ssh ssh = (Ssh) sshv;
2871 ssh->user_response = ret;
2873 if (ssh->version == 1)
2874 do_ssh1_login(ssh, NULL, -1, NULL);
2876 do_ssh2_transport(ssh, NULL, -1, NULL);
2879 * This may have unfrozen the SSH connection, so do a
2882 ssh_process_queued_incoming_data(ssh);
2885 static void ssh_agentf_callback(void *cv, void *reply, int replylen)
2887 struct ssh_channel *c = (struct ssh_channel *)cv;
2889 void *sentreply = reply;
2892 /* Fake SSH_AGENT_FAILURE. */
2893 sentreply = "\0\0\0\1\5";
2896 if (ssh->version == 2) {
2897 ssh2_add_channel_data(c, sentreply, replylen);
2900 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
2901 PKT_INT, c->remoteid,
2904 PKT_DATA, sentreply, replylen,
2913 * Client-initiated disconnection. Send a DISCONNECT if `wire_reason'
2914 * non-NULL, otherwise just close the connection. `client_reason' == NULL
2915 * => log `wire_reason'.
2917 static void ssh_disconnect(Ssh ssh, char *client_reason, char *wire_reason,
2918 int code, int clean_exit)
2922 client_reason = wire_reason;
2924 error = dupprintf("Disconnected: %s", client_reason);
2926 error = dupstr("Disconnected");
2928 if (ssh->version == 1) {
2929 send_packet(ssh, SSH1_MSG_DISCONNECT, PKT_STR, wire_reason,
2931 } else if (ssh->version == 2) {
2932 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT);
2933 ssh2_pkt_adduint32(pktout, code);
2934 ssh2_pkt_addstring(pktout, wire_reason);
2935 ssh2_pkt_addstring(pktout, "en"); /* language tag */
2936 ssh2_pkt_send_noqueue(ssh, pktout);
2939 ssh->close_expected = TRUE;
2940 ssh->clean_exit = clean_exit;
2941 ssh_closing((Plug)ssh, error, 0, 0);
2946 * Handle the key exchange and user authentication phases.
2948 static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
2949 struct Packet *pktin)
2952 unsigned char cookie[8], *ptr;
2953 struct RSAKey servkey, hostkey;
2954 struct MD5Context md5c;
2955 struct do_ssh1_login_state {
2957 unsigned char *rsabuf, *keystr1, *keystr2;
2958 unsigned long supported_ciphers_mask, supported_auths_mask;
2959 int tried_publickey, tried_agent;
2960 int tis_auth_refused, ccard_auth_refused;
2961 unsigned char session_id[16];
2964 void *publickey_blob;
2965 int publickey_bloblen;
2966 char *publickey_comment;
2967 int publickey_encrypted;
2968 prompts_t *cur_prompt;
2971 unsigned char request[5], *response, *p;
2981 crState(do_ssh1_login_state);
2983 crBegin(ssh->do_ssh1_login_crstate);
2988 if (pktin->type != SSH1_SMSG_PUBLIC_KEY) {
2989 bombout(("Public key packet not received"));
2993 logevent("Received public keys");
2995 ptr = ssh_pkt_getdata(pktin, 8);
2997 bombout(("SSH-1 public key packet stopped before random cookie"));
3000 memcpy(cookie, ptr, 8);
3002 if (!ssh1_pkt_getrsakey(pktin, &servkey, &s->keystr1) ||
3003 !ssh1_pkt_getrsakey(pktin, &hostkey, &s->keystr2)) {
3004 bombout(("Failed to read SSH-1 public keys from public key packet"));
3009 * Log the host key fingerprint.
3013 logevent("Host key fingerprint is:");
3014 strcpy(logmsg, " ");
3015 hostkey.comment = NULL;
3016 rsa_fingerprint(logmsg + strlen(logmsg),
3017 sizeof(logmsg) - strlen(logmsg), &hostkey);
3021 ssh->v1_remote_protoflags = ssh_pkt_getuint32(pktin);
3022 s->supported_ciphers_mask = ssh_pkt_getuint32(pktin);
3023 s->supported_auths_mask = ssh_pkt_getuint32(pktin);
3025 ssh->v1_local_protoflags =
3026 ssh->v1_remote_protoflags & SSH1_PROTOFLAGS_SUPPORTED;
3027 ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
3030 MD5Update(&md5c, s->keystr2, hostkey.bytes);
3031 MD5Update(&md5c, s->keystr1, servkey.bytes);
3032 MD5Update(&md5c, cookie, 8);
3033 MD5Final(s->session_id, &md5c);
3035 for (i = 0; i < 32; i++)
3036 ssh->session_key[i] = random_byte();
3039 * Verify that the `bits' and `bytes' parameters match.
3041 if (hostkey.bits > hostkey.bytes * 8 ||
3042 servkey.bits > servkey.bytes * 8) {
3043 bombout(("SSH-1 public keys were badly formatted"));
3047 s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
3049 s->rsabuf = snewn(s->len, unsigned char);
3052 * Verify the host key.
3056 * First format the key into a string.
3058 int len = rsastr_len(&hostkey);
3059 char fingerprint[100];
3060 char *keystr = snewn(len, char);
3061 rsastr_fmt(keystr, &hostkey);
3062 rsa_fingerprint(fingerprint, sizeof(fingerprint), &hostkey);
3064 ssh_set_frozen(ssh, 1);
3065 s->dlgret = verify_ssh_host_key(ssh->frontend,
3066 ssh->savedhost, ssh->savedport,
3067 "rsa", keystr, fingerprint,
3068 ssh_dialog_callback, ssh);
3070 if (s->dlgret < 0) {
3074 bombout(("Unexpected data from server while waiting"
3075 " for user host key response"));
3078 } while (pktin || inlen > 0);
3079 s->dlgret = ssh->user_response;
3081 ssh_set_frozen(ssh, 0);
3083 if (s->dlgret == 0) {
3084 ssh_disconnect(ssh, "User aborted at host key verification",
3090 for (i = 0; i < 32; i++) {
3091 s->rsabuf[i] = ssh->session_key[i];
3093 s->rsabuf[i] ^= s->session_id[i];
3096 if (hostkey.bytes > servkey.bytes) {
3097 ret = rsaencrypt(s->rsabuf, 32, &servkey);
3099 ret = rsaencrypt(s->rsabuf, servkey.bytes, &hostkey);
3101 ret = rsaencrypt(s->rsabuf, 32, &hostkey);
3103 ret = rsaencrypt(s->rsabuf, hostkey.bytes, &servkey);
3106 bombout(("SSH-1 public key encryptions failed due to bad formatting"));
3110 logevent("Encrypted session key");
3113 int cipher_chosen = 0, warn = 0;
3114 char *cipher_string = NULL;
3116 for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) {
3117 int next_cipher = ssh->cfg.ssh_cipherlist[i];
3118 if (next_cipher == CIPHER_WARN) {
3119 /* If/when we choose a cipher, warn about it */
3121 } else if (next_cipher == CIPHER_AES) {
3122 /* XXX Probably don't need to mention this. */
3123 logevent("AES not supported in SSH-1, skipping");
3125 switch (next_cipher) {
3126 case CIPHER_3DES: s->cipher_type = SSH_CIPHER_3DES;
3127 cipher_string = "3DES"; break;
3128 case CIPHER_BLOWFISH: s->cipher_type = SSH_CIPHER_BLOWFISH;
3129 cipher_string = "Blowfish"; break;
3130 case CIPHER_DES: s->cipher_type = SSH_CIPHER_DES;
3131 cipher_string = "single-DES"; break;
3133 if (s->supported_ciphers_mask & (1 << s->cipher_type))
3137 if (!cipher_chosen) {
3138 if ((s->supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0)
3139 bombout(("Server violates SSH-1 protocol by not "
3140 "supporting 3DES encryption"));
3142 /* shouldn't happen */
3143 bombout(("No supported ciphers found"));
3147 /* Warn about chosen cipher if necessary. */
3149 ssh_set_frozen(ssh, 1);
3150 s->dlgret = askalg(ssh->frontend, "cipher", cipher_string,
3151 ssh_dialog_callback, ssh);
3152 if (s->dlgret < 0) {
3156 bombout(("Unexpected data from server while waiting"
3157 " for user response"));
3160 } while (pktin || inlen > 0);
3161 s->dlgret = ssh->user_response;
3163 ssh_set_frozen(ssh, 0);
3164 if (s->dlgret == 0) {
3165 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
3172 switch (s->cipher_type) {
3173 case SSH_CIPHER_3DES:
3174 logevent("Using 3DES encryption");
3176 case SSH_CIPHER_DES:
3177 logevent("Using single-DES encryption");
3179 case SSH_CIPHER_BLOWFISH:
3180 logevent("Using Blowfish encryption");
3184 send_packet(ssh, SSH1_CMSG_SESSION_KEY,
3185 PKT_CHAR, s->cipher_type,
3186 PKT_DATA, cookie, 8,
3187 PKT_CHAR, (s->len * 8) >> 8, PKT_CHAR, (s->len * 8) & 0xFF,
3188 PKT_DATA, s->rsabuf, s->len,
3189 PKT_INT, ssh->v1_local_protoflags, PKT_END);
3191 logevent("Trying to enable encryption...");
3195 ssh->cipher = (s->cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish_ssh1 :
3196 s->cipher_type == SSH_CIPHER_DES ? &ssh_des :
3198 ssh->v1_cipher_ctx = ssh->cipher->make_context();
3199 ssh->cipher->sesskey(ssh->v1_cipher_ctx, ssh->session_key);
3200 logeventf(ssh, "Initialised %s encryption", ssh->cipher->text_name);
3202 ssh->crcda_ctx = crcda_make_context();
3203 logevent("Installing CRC compensation attack detector");
3205 if (servkey.modulus) {
3206 sfree(servkey.modulus);
3207 servkey.modulus = NULL;
3209 if (servkey.exponent) {
3210 sfree(servkey.exponent);
3211 servkey.exponent = NULL;
3213 if (hostkey.modulus) {
3214 sfree(hostkey.modulus);
3215 hostkey.modulus = NULL;
3217 if (hostkey.exponent) {
3218 sfree(hostkey.exponent);
3219 hostkey.exponent = NULL;
3223 if (pktin->type != SSH1_SMSG_SUCCESS) {
3224 bombout(("Encryption not successfully enabled"));
3228 logevent("Successfully started encryption");
3230 fflush(stdout); /* FIXME eh? */
3232 if (!*ssh->cfg.username) {
3233 int ret; /* need not be kept over crReturn */
3234 s->cur_prompt = new_prompts(ssh->frontend);
3235 s->cur_prompt->to_server = TRUE;
3236 s->cur_prompt->name = dupstr("SSH login name");
3237 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
3238 lenof(s->username));
3239 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3242 crWaitUntil(!pktin);
3243 ret = get_userpass_input(s->cur_prompt, in, inlen);
3248 * Failed to get a username. Terminate.
3250 free_prompts(s->cur_prompt);
3251 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
3254 memcpy(s->username, s->cur_prompt->prompts[0]->result,
3255 lenof(s->username));
3256 free_prompts(s->cur_prompt);
3258 strncpy(s->username, ssh->cfg.username, sizeof(s->username));
3259 s->username[sizeof(s->username)-1] = '\0';
3262 send_packet(ssh, SSH1_CMSG_USER, PKT_STR, s->username, PKT_END);
3264 char *userlog = dupprintf("Sent username \"%s\"", s->username);
3266 if (flags & FLAG_INTERACTIVE &&
3267 (!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) {
3268 c_write_str(ssh, userlog);
3269 c_write_str(ssh, "\r\n");
3277 if ((ssh->remote_bugs & BUG_CHOKES_ON_RSA)) {
3278 /* We must not attempt PK auth. Pretend we've already tried it. */
3279 s->tried_publickey = s->tried_agent = 1;
3281 s->tried_publickey = s->tried_agent = 0;
3283 s->tis_auth_refused = s->ccard_auth_refused = 0;
3285 * Load the public half of any configured keyfile for later use.
3287 if (!filename_is_null(ssh->cfg.keyfile)) {
3289 logeventf(ssh, "Reading private key file \"%.150s\"",
3290 filename_to_str(&ssh->cfg.keyfile));
3291 keytype = key_type(&ssh->cfg.keyfile);
3292 if (keytype == SSH_KEYTYPE_SSH1) {
3294 if (rsakey_pubblob(&ssh->cfg.keyfile,
3295 &s->publickey_blob, &s->publickey_bloblen,
3296 &s->publickey_comment, &error)) {
3297 s->publickey_encrypted = rsakey_encrypted(&ssh->cfg.keyfile,
3301 logeventf(ssh, "Unable to load private key (%s)", error);
3302 msgbuf = dupprintf("Unable to load private key file "
3303 "\"%.150s\" (%s)\r\n",
3304 filename_to_str(&ssh->cfg.keyfile),
3306 c_write_str(ssh, msgbuf);
3308 s->publickey_blob = NULL;
3312 logeventf(ssh, "Unable to use this key file (%s)",
3313 key_type_to_str(keytype));
3314 msgbuf = dupprintf("Unable to use key file \"%.150s\""
3316 filename_to_str(&ssh->cfg.keyfile),
3317 key_type_to_str(keytype));
3318 c_write_str(ssh, msgbuf);
3320 s->publickey_blob = NULL;
3323 s->publickey_blob = NULL;
3325 while (pktin->type == SSH1_SMSG_FAILURE) {
3326 s->pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
3328 if (ssh->cfg.tryagent && agent_exists() && !s->tried_agent) {
3330 * Attempt RSA authentication using Pageant.
3336 logevent("Pageant is running. Requesting keys.");
3338 /* Request the keys held by the agent. */
3339 PUT_32BIT(s->request, 1);
3340 s->request[4] = SSH1_AGENTC_REQUEST_RSA_IDENTITIES;
3341 if (!agent_query(s->request, 5, &r, &s->responselen,
3342 ssh_agent_callback, ssh)) {
3346 bombout(("Unexpected data from server while waiting"
3347 " for agent response"));
3350 } while (pktin || inlen > 0);
3351 r = ssh->agent_response;
3352 s->responselen = ssh->agent_response_len;
3354 s->response = (unsigned char *) r;
3355 if (s->response && s->responselen >= 5 &&
3356 s->response[4] == SSH1_AGENT_RSA_IDENTITIES_ANSWER) {
3357 s->p = s->response + 5;
3358 s->nkeys = GET_32BIT(s->p);
3360 logeventf(ssh, "Pageant has %d SSH-1 keys", s->nkeys);
3361 for (s->keyi = 0; s->keyi < s->nkeys; s->keyi++) {
3362 unsigned char *pkblob = s->p;
3366 do { /* do while (0) to make breaking easy */
3367 n = ssh1_read_bignum
3368 (s->p, s->responselen-(s->p-s->response),
3373 n = ssh1_read_bignum
3374 (s->p, s->responselen-(s->p-s->response),
3379 if (s->responselen - (s->p-s->response) < 4)
3381 s->commentlen = GET_32BIT(s->p);
3383 if (s->responselen - (s->p-s->response) <
3386 s->commentp = (char *)s->p;
3387 s->p += s->commentlen;
3391 logevent("Pageant key list packet was truncated");
3395 if (s->publickey_blob) {
3396 if (!memcmp(pkblob, s->publickey_blob,
3397 s->publickey_bloblen)) {
3398 logeventf(ssh, "Pageant key #%d matches "
3399 "configured key file", s->keyi);
3400 s->tried_publickey = 1;
3402 /* Skip non-configured key */
3405 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
3406 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3407 PKT_BIGNUM, s->key.modulus, PKT_END);
3409 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
3410 logevent("Key refused");
3413 logevent("Received RSA challenge");
3414 if ((s->challenge = ssh1_pkt_getmp(pktin)) == NULL) {
3415 bombout(("Server's RSA challenge was badly formatted"));
3420 char *agentreq, *q, *ret;
3423 len = 1 + 4; /* message type, bit count */
3424 len += ssh1_bignum_length(s->key.exponent);
3425 len += ssh1_bignum_length(s->key.modulus);
3426 len += ssh1_bignum_length(s->challenge);
3427 len += 16; /* session id */
3428 len += 4; /* response format */
3429 agentreq = snewn(4 + len, char);
3430 PUT_32BIT(agentreq, len);
3432 *q++ = SSH1_AGENTC_RSA_CHALLENGE;
3433 PUT_32BIT(q, bignum_bitcount(s->key.modulus));
3435 q += ssh1_write_bignum(q, s->key.exponent);
3436 q += ssh1_write_bignum(q, s->key.modulus);
3437 q += ssh1_write_bignum(q, s->challenge);
3438 memcpy(q, s->session_id, 16);
3440 PUT_32BIT(q, 1); /* response format */
3441 if (!agent_query(agentreq, len + 4, &vret, &retlen,
3442 ssh_agent_callback, ssh)) {
3447 bombout(("Unexpected data from server"
3448 " while waiting for agent"
3452 } while (pktin || inlen > 0);
3453 vret = ssh->agent_response;
3454 retlen = ssh->agent_response_len;
3459 if (ret[4] == SSH1_AGENT_RSA_RESPONSE) {
3460 logevent("Sending Pageant's response");
3461 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
3462 PKT_DATA, ret + 5, 16,
3466 if (pktin->type == SSH1_SMSG_SUCCESS) {
3468 ("Pageant's response accepted");
3469 if (flags & FLAG_VERBOSE) {
3470 c_write_str(ssh, "Authenticated using"
3472 c_write(ssh, s->commentp,
3474 c_write_str(ssh, "\" from agent\r\n");
3479 ("Pageant's response not accepted");
3482 ("Pageant failed to answer challenge");
3486 logevent("No reply received from Pageant");
3489 freebn(s->key.exponent);
3490 freebn(s->key.modulus);
3491 freebn(s->challenge);
3496 if (s->publickey_blob && !s->tried_publickey)
3497 logevent("Configured key file not in Pageant");
3502 if (s->publickey_blob && !s->tried_publickey) {
3504 * Try public key authentication with the specified
3507 int got_passphrase; /* need not be kept over crReturn */
3508 if (flags & FLAG_VERBOSE)
3509 c_write_str(ssh, "Trying public key authentication.\r\n");
3510 logeventf(ssh, "Trying public key \"%s\"",
3511 filename_to_str(&ssh->cfg.keyfile));
3512 s->tried_publickey = 1;
3513 got_passphrase = FALSE;
3514 while (!got_passphrase) {
3516 * Get a passphrase, if necessary.
3518 char *passphrase = NULL; /* only written after crReturn */
3520 if (!s->publickey_encrypted) {
3521 if (flags & FLAG_VERBOSE)
3522 c_write_str(ssh, "No passphrase required.\r\n");
3525 int ret; /* need not be kept over crReturn */
3526 s->cur_prompt = new_prompts(ssh->frontend);
3527 s->cur_prompt->to_server = FALSE;
3528 s->cur_prompt->name = dupstr("SSH key passphrase");
3529 add_prompt(s->cur_prompt,
3530 dupprintf("Passphrase for key \"%.100s\": ",
3531 s->publickey_comment),
3532 FALSE, SSH_MAX_PASSWORD_LEN);
3533 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3536 crWaitUntil(!pktin);
3537 ret = get_userpass_input(s->cur_prompt, in, inlen);
3541 /* Failed to get a passphrase. Terminate. */
3542 free_prompts(s->cur_prompt);
3543 ssh_disconnect(ssh, NULL, "Unable to authenticate",
3547 passphrase = dupstr(s->cur_prompt->prompts[0]->result);
3548 free_prompts(s->cur_prompt);
3551 * Try decrypting key with passphrase.
3553 ret = loadrsakey(&ssh->cfg.keyfile, &s->key, passphrase,
3556 memset(passphrase, 0, strlen(passphrase));
3560 /* Correct passphrase. */
3561 got_passphrase = TRUE;
3562 } else if (ret == 0) {
3563 c_write_str(ssh, "Couldn't load private key from ");
3564 c_write_str(ssh, filename_to_str(&ssh->cfg.keyfile));
3565 c_write_str(ssh, " (");
3566 c_write_str(ssh, error);
3567 c_write_str(ssh, ").\r\n");
3568 got_passphrase = FALSE;
3569 break; /* go and try something else */
3570 } else if (ret == -1) {
3571 c_write_str(ssh, "Wrong passphrase.\r\n"); /* FIXME */
3572 got_passphrase = FALSE;
3575 assert(0 && "unexpected return from loadrsakey()");
3576 got_passphrase = FALSE; /* placate optimisers */
3580 if (got_passphrase) {
3583 * Send a public key attempt.
3585 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3586 PKT_BIGNUM, s->key.modulus, PKT_END);
3589 if (pktin->type == SSH1_SMSG_FAILURE) {
3590 c_write_str(ssh, "Server refused our public key.\r\n");
3591 continue; /* go and try something else */
3593 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
3594 bombout(("Bizarre response to offer of public key"));
3600 unsigned char buffer[32];
3601 Bignum challenge, response;
3603 if ((challenge = ssh1_pkt_getmp(pktin)) == NULL) {
3604 bombout(("Server's RSA challenge was badly formatted"));
3607 response = rsadecrypt(challenge, &s->key);
3608 freebn(s->key.private_exponent);/* burn the evidence */
3610 for (i = 0; i < 32; i++) {
3611 buffer[i] = bignum_byte(response, 31 - i);
3615 MD5Update(&md5c, buffer, 32);
3616 MD5Update(&md5c, s->session_id, 16);
3617 MD5Final(buffer, &md5c);
3619 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
3620 PKT_DATA, buffer, 16, PKT_END);
3627 if (pktin->type == SSH1_SMSG_FAILURE) {
3628 if (flags & FLAG_VERBOSE)
3629 c_write_str(ssh, "Failed to authenticate with"
3630 " our public key.\r\n");
3631 continue; /* go and try something else */
3632 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
3633 bombout(("Bizarre response to RSA authentication response"));
3637 break; /* we're through! */
3643 * Otherwise, try various forms of password-like authentication.
3645 s->cur_prompt = new_prompts(ssh->frontend);
3647 if (ssh->cfg.try_tis_auth &&
3648 (s->supported_auths_mask & (1 << SSH1_AUTH_TIS)) &&
3649 !s->tis_auth_refused) {
3650 s->pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
3651 logevent("Requested TIS authentication");
3652 send_packet(ssh, SSH1_CMSG_AUTH_TIS, PKT_END);
3654 if (pktin->type != SSH1_SMSG_AUTH_TIS_CHALLENGE) {
3655 logevent("TIS authentication declined");
3656 if (flags & FLAG_INTERACTIVE)
3657 c_write_str(ssh, "TIS authentication refused.\r\n");
3658 s->tis_auth_refused = 1;
3663 char *instr_suf, *prompt;
3665 ssh_pkt_getstring(pktin, &challenge, &challengelen);
3667 bombout(("TIS challenge packet was badly formed"));
3670 logevent("Received TIS challenge");
3671 s->cur_prompt->to_server = TRUE;
3672 s->cur_prompt->name = dupstr("SSH TIS authentication");
3673 /* Prompt heuristic comes from OpenSSH */
3674 if (memchr(challenge, '\n', challengelen)) {
3675 instr_suf = dupstr("");
3676 prompt = dupprintf("%.*s", challengelen, challenge);
3678 instr_suf = dupprintf("%.*s", challengelen, challenge);
3679 prompt = dupstr("Response: ");
3681 s->cur_prompt->instruction =
3682 dupprintf("Using TIS authentication.%s%s",
3683 (*instr_suf) ? "\n" : "",
3685 s->cur_prompt->instr_reqd = TRUE;
3686 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3690 if (ssh->cfg.try_tis_auth &&
3691 (s->supported_auths_mask & (1 << SSH1_AUTH_CCARD)) &&
3692 !s->ccard_auth_refused) {
3693 s->pwpkt_type = SSH1_CMSG_AUTH_CCARD_RESPONSE;
3694 logevent("Requested CryptoCard authentication");
3695 send_packet(ssh, SSH1_CMSG_AUTH_CCARD, PKT_END);
3697 if (pktin->type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
3698 logevent("CryptoCard authentication declined");
3699 c_write_str(ssh, "CryptoCard authentication refused.\r\n");
3700 s->ccard_auth_refused = 1;
3705 char *instr_suf, *prompt;
3707 ssh_pkt_getstring(pktin, &challenge, &challengelen);
3709 bombout(("CryptoCard challenge packet was badly formed"));
3712 logevent("Received CryptoCard challenge");
3713 s->cur_prompt->to_server = TRUE;
3714 s->cur_prompt->name = dupstr("SSH CryptoCard authentication");
3715 s->cur_prompt->name_reqd = FALSE;
3716 /* Prompt heuristic comes from OpenSSH */
3717 if (memchr(challenge, '\n', challengelen)) {
3718 instr_suf = dupstr("");
3719 prompt = dupprintf("%.*s", challengelen, challenge);
3721 instr_suf = dupprintf("%.*s", challengelen, challenge);
3722 prompt = dupstr("Response: ");
3724 s->cur_prompt->instruction =
3725 dupprintf("Using CryptoCard authentication.%s%s",
3726 (*instr_suf) ? "\n" : "",
3728 s->cur_prompt->instr_reqd = TRUE;
3729 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3733 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
3734 s->cur_prompt->to_server = TRUE;
3735 s->cur_prompt->name = dupstr("SSH password");
3736 add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
3737 s->username, ssh->savedhost),
3738 FALSE, SSH_MAX_PASSWORD_LEN);
3742 * Show password prompt, having first obtained it via a TIS
3743 * or CryptoCard exchange if we're doing TIS or CryptoCard
3747 int ret; /* need not be kept over crReturn */
3748 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3751 crWaitUntil(!pktin);
3752 ret = get_userpass_input(s->cur_prompt, in, inlen);
3757 * Failed to get a password (for example
3758 * because one was supplied on the command line
3759 * which has already failed to work). Terminate.
3761 free_prompts(s->cur_prompt);
3762 ssh_disconnect(ssh, NULL, "Unable to authenticate", 0, TRUE);
3767 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
3769 * Defence against traffic analysis: we send a
3770 * whole bunch of packets containing strings of
3771 * different lengths. One of these strings is the
3772 * password, in a SSH1_CMSG_AUTH_PASSWORD packet.
3773 * The others are all random data in
3774 * SSH1_MSG_IGNORE packets. This way a passive
3775 * listener can't tell which is the password, and
3776 * hence can't deduce the password length.
3778 * Anybody with a password length greater than 16
3779 * bytes is going to have enough entropy in their
3780 * password that a listener won't find it _that_
3781 * much help to know how long it is. So what we'll
3784 * - if password length < 16, we send 15 packets
3785 * containing string lengths 1 through 15
3787 * - otherwise, we let N be the nearest multiple
3788 * of 8 below the password length, and send 8
3789 * packets containing string lengths N through
3790 * N+7. This won't obscure the order of
3791 * magnitude of the password length, but it will
3792 * introduce a bit of extra uncertainty.
3794 * A few servers can't deal with SSH1_MSG_IGNORE, at
3795 * least in this context. For these servers, we need
3796 * an alternative defence. We make use of the fact
3797 * that the password is interpreted as a C string:
3798 * so we can append a NUL, then some random data.
3800 * A few servers can deal with neither SSH1_MSG_IGNORE
3801 * here _nor_ a padded password string.
3802 * For these servers we are left with no defences
3803 * against password length sniffing.
3805 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE) &&
3806 !(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
3808 * The server can deal with SSH1_MSG_IGNORE, so
3809 * we can use the primary defence.
3811 int bottom, top, pwlen, i;
3814 pwlen = strlen(s->cur_prompt->prompts[0]->result);
3816 bottom = 0; /* zero length passwords are OK! :-) */
3819 bottom = pwlen & ~7;
3823 assert(pwlen >= bottom && pwlen <= top);
3825 randomstr = snewn(top + 1, char);
3827 for (i = bottom; i <= top; i++) {
3829 defer_packet(ssh, s->pwpkt_type,
3830 PKTT_PASSWORD, PKT_STR,
3831 s->cur_prompt->prompts[0]->result,
3832 PKTT_OTHER, PKT_END);
3834 for (j = 0; j < i; j++) {
3836 randomstr[j] = random_byte();
3837 } while (randomstr[j] == '\0');
3839 randomstr[i] = '\0';
3840 defer_packet(ssh, SSH1_MSG_IGNORE,
3841 PKT_STR, randomstr, PKT_END);
3844 logevent("Sending password with camouflage packets");
3845 ssh_pkt_defersend(ssh);
3848 else if (!(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
3850 * The server can't deal with SSH1_MSG_IGNORE
3851 * but can deal with padded passwords, so we
3852 * can use the secondary defence.
3858 len = strlen(s->cur_prompt->prompts[0]->result);
3859 if (len < sizeof(string)) {
3861 strcpy(string, s->cur_prompt->prompts[0]->result);
3862 len++; /* cover the zero byte */
3863 while (len < sizeof(string)) {
3864 string[len++] = (char) random_byte();
3867 ss = s->cur_prompt->prompts[0]->result;
3869 logevent("Sending length-padded password");
3870 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
3871 PKT_INT, len, PKT_DATA, ss, len,
3872 PKTT_OTHER, PKT_END);
3875 * The server is believed unable to cope with
3876 * any of our password camouflage methods.
3879 len = strlen(s->cur_prompt->prompts[0]->result);
3880 logevent("Sending unpadded password");
3881 send_packet(ssh, s->pwpkt_type,
3882 PKTT_PASSWORD, PKT_INT, len,
3883 PKT_DATA, s->cur_prompt->prompts[0]->result, len,
3884 PKTT_OTHER, PKT_END);
3887 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
3888 PKT_STR, s->cur_prompt->prompts[0]->result,
3889 PKTT_OTHER, PKT_END);
3891 logevent("Sent password");
3892 free_prompts(s->cur_prompt);
3894 if (pktin->type == SSH1_SMSG_FAILURE) {
3895 if (flags & FLAG_VERBOSE)
3896 c_write_str(ssh, "Access denied\r\n");
3897 logevent("Authentication refused");
3898 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
3899 bombout(("Strange packet received, type %d", pktin->type));
3905 if (s->publickey_blob) {
3906 sfree(s->publickey_blob);
3907 sfree(s->publickey_comment);
3910 logevent("Authentication successful");
3915 void sshfwd_close(struct ssh_channel *c)
3919 if (ssh->state == SSH_STATE_CLOSED)
3922 if (c && !c->closes) {
3924 * If halfopen is true, we have sent
3925 * CHANNEL_OPEN for this channel, but it hasn't even been
3926 * acknowledged by the server. So we must set a close flag
3927 * on it now, and then when the server acks the channel
3928 * open, we can close it then.
3931 if (ssh->version == 1) {
3932 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
3935 struct Packet *pktout;
3936 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
3937 ssh2_pkt_adduint32(pktout, c->remoteid);
3938 ssh2_pkt_send(ssh, pktout);
3941 c->closes = 1; /* sent MSG_CLOSE */
3942 if (c->type == CHAN_X11) {
3944 logevent("Forwarded X11 connection terminated");
3945 } else if (c->type == CHAN_SOCKDATA ||
3946 c->type == CHAN_SOCKDATA_DORMANT) {
3948 logevent("Forwarded port closed");
3953 int sshfwd_write(struct ssh_channel *c, char *buf, int len)
3957 if (ssh->state == SSH_STATE_CLOSED)
3960 if (ssh->version == 1) {
3961 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
3962 PKT_INT, c->remoteid,
3964 PKT_INT, len, PKT_DATA, buf, len,
3965 PKTT_OTHER, PKT_END);
3967 * In SSH-1 we can return 0 here - implying that forwarded
3968 * connections are never individually throttled - because
3969 * the only circumstance that can cause throttling will be
3970 * the whole SSH connection backing up, in which case
3971 * _everything_ will be throttled as a whole.
3975 ssh2_add_channel_data(c, buf, len);
3976 return ssh2_try_send(c);
3980 void sshfwd_unthrottle(struct ssh_channel *c, int bufsize)
3984 if (ssh->state == SSH_STATE_CLOSED)
3987 if (ssh->version == 1) {
3988 if (c->v.v1.throttling && bufsize < SSH1_BUFFER_LIMIT) {
3989 c->v.v1.throttling = 0;
3990 ssh1_throttle(ssh, -1);
3993 ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
3997 static void ssh_queueing_handler(Ssh ssh, struct Packet *pktin)
3999 struct queued_handler *qh = ssh->qhead;
4003 assert(pktin->type == qh->msg1 || pktin->type == qh->msg2);
4006 assert(ssh->packet_dispatch[qh->msg1] == ssh_queueing_handler);
4007 ssh->packet_dispatch[qh->msg1] = NULL;
4010 assert(ssh->packet_dispatch[qh->msg2] == ssh_queueing_handler);
4011 ssh->packet_dispatch[qh->msg2] = NULL;
4015 ssh->qhead = qh->next;
4017 if (ssh->qhead->msg1 > 0) {
4018 assert(ssh->packet_dispatch[ssh->qhead->msg1] == NULL);
4019 ssh->packet_dispatch[ssh->qhead->msg1] = ssh_queueing_handler;
4021 if (ssh->qhead->msg2 > 0) {
4022 assert(ssh->packet_dispatch[ssh->qhead->msg2] == NULL);
4023 ssh->packet_dispatch[ssh->qhead->msg2] = ssh_queueing_handler;
4026 ssh->qhead = ssh->qtail = NULL;
4027 ssh->packet_dispatch[pktin->type] = NULL;
4030 qh->handler(ssh, pktin, qh->ctx);
4035 static void ssh_queue_handler(Ssh ssh, int msg1, int msg2,
4036 chandler_fn_t handler, void *ctx)
4038 struct queued_handler *qh;
4040 qh = snew(struct queued_handler);
4043 qh->handler = handler;
4047 if (ssh->qtail == NULL) {
4051 assert(ssh->packet_dispatch[qh->msg1] == NULL);
4052 ssh->packet_dispatch[qh->msg1] = ssh_queueing_handler;
4055 assert(ssh->packet_dispatch[qh->msg2] == NULL);
4056 ssh->packet_dispatch[qh->msg2] = ssh_queueing_handler;
4059 ssh->qtail->next = qh;
4064 static void ssh_rportfwd_succfail(Ssh ssh, struct Packet *pktin, void *ctx)
4066 struct ssh_rportfwd *rpf, *pf = (struct ssh_rportfwd *)ctx;
4068 if (pktin->type == (ssh->version == 1 ? SSH1_SMSG_SUCCESS :
4069 SSH2_MSG_REQUEST_SUCCESS)) {
4070 logeventf(ssh, "Remote port forwarding from %s enabled",
4073 logeventf(ssh, "Remote port forwarding from %s refused",
4076 rpf = del234(ssh->rportfwds, pf);
4082 static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
4084 const char *portfwd_strptr = cfg->portfwd;
4085 struct ssh_portfwd *epf;
4088 if (!ssh->portfwds) {
4089 ssh->portfwds = newtree234(ssh_portcmp);
4092 * Go through the existing port forwardings and tag them
4093 * with status==DESTROY. Any that we want to keep will be
4094 * re-enabled (status==KEEP) as we go through the
4095 * configuration and find out which bits are the same as
4098 struct ssh_portfwd *epf;
4100 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4101 epf->status = DESTROY;
4104 while (*portfwd_strptr) {
4105 char address_family, type;
4106 int sport,dport,sserv,dserv;
4107 char sports[256], dports[256], saddr[256], host[256];
4110 address_family = 'A';
4112 if (*portfwd_strptr == 'A' ||
4113 *portfwd_strptr == '4' ||
4114 *portfwd_strptr == '6')
4115 address_family = *portfwd_strptr++;
4116 if (*portfwd_strptr == 'L' ||
4117 *portfwd_strptr == 'R' ||
4118 *portfwd_strptr == 'D')
4119 type = *portfwd_strptr++;
4124 while (*portfwd_strptr && *portfwd_strptr != '\t') {
4125 if (*portfwd_strptr == ':') {
4127 * We've seen a colon in the middle of the
4128 * source port number. This means that
4129 * everything we've seen until now is the
4130 * source _address_, so we'll move it into
4131 * saddr and start sports from the beginning
4136 if (ssh->version == 1 && type == 'R') {
4137 logeventf(ssh, "SSH-1 cannot handle remote source address "
4138 "spec \"%s\"; ignoring", sports);
4140 strcpy(saddr, sports);
4143 if (n < lenof(sports)-1) sports[n++] = *portfwd_strptr++;
4147 if (*portfwd_strptr == '\t')
4150 while (*portfwd_strptr && *portfwd_strptr != ':') {
4151 if (n < lenof(host)-1) host[n++] = *portfwd_strptr++;
4154 if (*portfwd_strptr == ':')
4157 while (*portfwd_strptr) {
4158 if (n < lenof(dports)-1) dports[n++] = *portfwd_strptr++;
4162 dport = atoi(dports);
4166 dport = net_service_lookup(dports);
4168 logeventf(ssh, "Service lookup failed for destination"
4169 " port \"%s\"", dports);
4173 while (*portfwd_strptr) portfwd_strptr++;
4177 portfwd_strptr++; /* eat the NUL and move to next one */
4179 sport = atoi(sports);
4183 sport = net_service_lookup(sports);
4185 logeventf(ssh, "Service lookup failed for source"
4186 " port \"%s\"", sports);
4189 if (sport && dport) {
4190 /* Set up a description of the source port. */
4191 struct ssh_portfwd *pfrec, *epfrec;
4193 pfrec = snew(struct ssh_portfwd);
4195 pfrec->saddr = *saddr ? dupstr(saddr) : NULL;
4196 pfrec->sserv = sserv ? dupstr(sports) : NULL;
4197 pfrec->sport = sport;
4198 pfrec->daddr = *host ? dupstr(host) : NULL;
4199 pfrec->dserv = dserv ? dupstr(dports) : NULL;
4200 pfrec->dport = dport;
4201 pfrec->local = NULL;
4202 pfrec->remote = NULL;
4203 pfrec->addressfamily = (address_family == '4' ? ADDRTYPE_IPV4 :
4204 address_family == '6' ? ADDRTYPE_IPV6 :
4207 epfrec = add234(ssh->portfwds, pfrec);
4208 if (epfrec != pfrec) {
4210 * We already have a port forwarding with precisely
4211 * these parameters. Hence, no need to do anything;
4212 * simply tag the existing one as KEEP.
4214 epfrec->status = KEEP;
4215 free_portfwd(pfrec);
4217 pfrec->status = CREATE;
4223 * Now go through and destroy any port forwardings which were
4226 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4227 if (epf->status == DESTROY) {
4230 message = dupprintf("%s port forwarding from %s%s%d",
4231 epf->type == 'L' ? "local" :
4232 epf->type == 'R' ? "remote" : "dynamic",
4233 epf->saddr ? epf->saddr : "",
4234 epf->saddr ? ":" : "",
4237 if (epf->type != 'D') {
4238 char *msg2 = dupprintf("%s to %s:%d", message,
4239 epf->daddr, epf->dport);
4244 logeventf(ssh, "Cancelling %s", message);
4248 struct ssh_rportfwd *rpf = epf->remote;
4249 struct Packet *pktout;
4252 * Cancel the port forwarding at the server
4255 if (ssh->version == 1) {
4257 * We cannot cancel listening ports on the
4258 * server side in SSH-1! There's no message
4259 * to support it. Instead, we simply remove
4260 * the rportfwd record from the local end
4261 * so that any connections the server tries
4262 * to make on it are rejected.
4265 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4266 ssh2_pkt_addstring(pktout, "cancel-tcpip-forward");
4267 ssh2_pkt_addbool(pktout, 0);/* _don't_ want reply */
4269 ssh2_pkt_addstring(pktout, epf->saddr);
4270 } else if (ssh->cfg.rport_acceptall) {
4271 /* XXX: ssh->cfg.rport_acceptall may not represent
4272 * what was used to open the original connection,
4273 * since it's reconfigurable. */
4274 ssh2_pkt_addstring(pktout, "0.0.0.0");
4276 ssh2_pkt_addstring(pktout, "127.0.0.1");
4278 ssh2_pkt_adduint32(pktout, epf->sport);
4279 ssh2_pkt_send(ssh, pktout);
4282 del234(ssh->rportfwds, rpf);
4284 } else if (epf->local) {
4285 pfd_terminate(epf->local);
4288 delpos234(ssh->portfwds, i);
4290 i--; /* so we don't skip one in the list */
4294 * And finally, set up any new port forwardings (status==CREATE).
4296 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4297 if (epf->status == CREATE) {
4298 char *sportdesc, *dportdesc;
4299 sportdesc = dupprintf("%s%s%s%s%d%s",
4300 epf->saddr ? epf->saddr : "",
4301 epf->saddr ? ":" : "",
4302 epf->sserv ? epf->sserv : "",
4303 epf->sserv ? "(" : "",
4305 epf->sserv ? ")" : "");
4306 if (epf->type == 'D') {
4309 dportdesc = dupprintf("%s:%s%s%d%s",
4311 epf->dserv ? epf->dserv : "",
4312 epf->dserv ? "(" : "",
4314 epf->dserv ? ")" : "");
4317 if (epf->type == 'L') {
4318 const char *err = pfd_addforward(epf->daddr, epf->dport,
4319 epf->saddr, epf->sport,
4322 epf->addressfamily);
4324 logeventf(ssh, "Local %sport %s forwarding to %s%s%s",
4325 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4326 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4327 sportdesc, dportdesc,
4328 err ? " failed: " : "", err ? err : "");
4329 } else if (epf->type == 'D') {
4330 const char *err = pfd_addforward(NULL, -1,
4331 epf->saddr, epf->sport,
4334 epf->addressfamily);
4336 logeventf(ssh, "Local %sport %s SOCKS dynamic forwarding%s%s",
4337 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4338 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4340 err ? " failed: " : "", err ? err : "");
4342 struct ssh_rportfwd *pf;
4345 * Ensure the remote port forwardings tree exists.
4347 if (!ssh->rportfwds) {
4348 if (ssh->version == 1)
4349 ssh->rportfwds = newtree234(ssh_rportcmp_ssh1);
4351 ssh->rportfwds = newtree234(ssh_rportcmp_ssh2);
4354 pf = snew(struct ssh_rportfwd);
4355 strncpy(pf->dhost, epf->daddr, lenof(pf->dhost)-1);
4356 pf->dhost[lenof(pf->dhost)-1] = '\0';
4357 pf->dport = epf->dport;
4358 pf->sport = epf->sport;
4359 if (add234(ssh->rportfwds, pf) != pf) {
4360 logeventf(ssh, "Duplicate remote port forwarding to %s:%d",
4361 epf->daddr, epf->dport);
4364 logeventf(ssh, "Requesting remote port %s"
4365 " forward to %s", sportdesc, dportdesc);
4367 pf->sportdesc = sportdesc;
4372 if (ssh->version == 1) {
4373 send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST,
4374 PKT_INT, epf->sport,
4375 PKT_STR, epf->daddr,
4376 PKT_INT, epf->dport,
4378 ssh_queue_handler(ssh, SSH1_SMSG_SUCCESS,
4380 ssh_rportfwd_succfail, pf);
4382 struct Packet *pktout;
4383 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4384 ssh2_pkt_addstring(pktout, "tcpip-forward");
4385 ssh2_pkt_addbool(pktout, 1);/* want reply */
4387 ssh2_pkt_addstring(pktout, epf->saddr);
4388 } else if (cfg->rport_acceptall) {
4389 ssh2_pkt_addstring(pktout, "0.0.0.0");
4391 ssh2_pkt_addstring(pktout, "127.0.0.1");
4393 ssh2_pkt_adduint32(pktout, epf->sport);
4394 ssh2_pkt_send(ssh, pktout);
4396 ssh_queue_handler(ssh, SSH2_MSG_REQUEST_SUCCESS,
4397 SSH2_MSG_REQUEST_FAILURE,
4398 ssh_rportfwd_succfail, pf);
4407 static void ssh1_smsg_stdout_stderr_data(Ssh ssh, struct Packet *pktin)
4410 int stringlen, bufsize;
4412 ssh_pkt_getstring(pktin, &string, &stringlen);
4413 if (string == NULL) {
4414 bombout(("Incoming terminal data packet was badly formed"));
4418 bufsize = from_backend(ssh->frontend, pktin->type == SSH1_SMSG_STDERR_DATA,
4420 if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
4421 ssh->v1_stdout_throttling = 1;
4422 ssh1_throttle(ssh, +1);
4426 static void ssh1_smsg_x11_open(Ssh ssh, struct Packet *pktin)
4428 /* Remote side is trying to open a channel to talk to our
4429 * X-Server. Give them back a local channel number. */
4430 struct ssh_channel *c;
4431 int remoteid = ssh_pkt_getuint32(pktin);
4433 logevent("Received X11 connect request");
4434 /* Refuse if X11 forwarding is disabled. */
4435 if (!ssh->X11_fwd_enabled) {
4436 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4437 PKT_INT, remoteid, PKT_END);
4438 logevent("Rejected X11 connect request");
4440 c = snew(struct ssh_channel);
4443 if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c,
4444 ssh->x11auth, NULL, -1, &ssh->cfg) != NULL) {
4445 logevent("Opening X11 forward connection failed");
4447 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4448 PKT_INT, remoteid, PKT_END);
4451 ("Opening X11 forward connection succeeded");
4452 c->remoteid = remoteid;
4453 c->halfopen = FALSE;
4454 c->localid = alloc_channel_id(ssh);
4456 c->v.v1.throttling = 0;
4457 c->type = CHAN_X11; /* identify channel type */
4458 add234(ssh->channels, c);
4459 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4460 PKT_INT, c->remoteid, PKT_INT,
4461 c->localid, PKT_END);
4462 logevent("Opened X11 forward channel");
4467 static void ssh1_smsg_agent_open(Ssh ssh, struct Packet *pktin)
4469 /* Remote side is trying to open a channel to talk to our
4470 * agent. Give them back a local channel number. */
4471 struct ssh_channel *c;
4472 int remoteid = ssh_pkt_getuint32(pktin);
4474 /* Refuse if agent forwarding is disabled. */
4475 if (!ssh->agentfwd_enabled) {
4476 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4477 PKT_INT, remoteid, PKT_END);
4479 c = snew(struct ssh_channel);
4481 c->remoteid = remoteid;
4482 c->halfopen = FALSE;
4483 c->localid = alloc_channel_id(ssh);
4485 c->v.v1.throttling = 0;
4486 c->type = CHAN_AGENT; /* identify channel type */
4487 c->u.a.lensofar = 0;
4488 add234(ssh->channels, c);
4489 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4490 PKT_INT, c->remoteid, PKT_INT, c->localid,
4495 static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin)
4497 /* Remote side is trying to open a channel to talk to a
4498 * forwarded port. Give them back a local channel number. */
4499 struct ssh_channel *c;
4500 struct ssh_rportfwd pf, *pfp;
4505 c = snew(struct ssh_channel);
4508 remoteid = ssh_pkt_getuint32(pktin);
4509 ssh_pkt_getstring(pktin, &host, &hostsize);
4510 port = ssh_pkt_getuint32(pktin);
4512 if (hostsize >= lenof(pf.dhost))
4513 hostsize = lenof(pf.dhost)-1;
4514 memcpy(pf.dhost, host, hostsize);
4515 pf.dhost[hostsize] = '\0';
4517 pfp = find234(ssh->rportfwds, &pf, NULL);
4520 logeventf(ssh, "Rejected remote port open request for %s:%d",
4522 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4523 PKT_INT, remoteid, PKT_END);
4525 logeventf(ssh, "Received remote port open request for %s:%d",
4527 e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port,
4528 c, &ssh->cfg, pfp->pfrec->addressfamily);
4530 logeventf(ssh, "Port open failed: %s", e);
4532 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4533 PKT_INT, remoteid, PKT_END);
4535 c->remoteid = remoteid;
4536 c->halfopen = FALSE;
4537 c->localid = alloc_channel_id(ssh);
4539 c->v.v1.throttling = 0;
4540 c->type = CHAN_SOCKDATA; /* identify channel type */
4541 add234(ssh->channels, c);
4542 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4543 PKT_INT, c->remoteid, PKT_INT,
4544 c->localid, PKT_END);
4545 logevent("Forwarded port opened successfully");
4550 static void ssh1_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
4552 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4553 unsigned int localid = ssh_pkt_getuint32(pktin);
4554 struct ssh_channel *c;
4556 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4557 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4558 c->remoteid = localid;
4559 c->halfopen = FALSE;
4560 c->type = CHAN_SOCKDATA;
4561 c->v.v1.throttling = 0;
4562 pfd_confirm(c->u.pfd.s);
4565 if (c && c->closes) {
4567 * We have a pending close on this channel,
4568 * which we decided on before the server acked
4569 * the channel open. So now we know the
4570 * remoteid, we can close it again.
4572 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE,
4573 PKT_INT, c->remoteid, PKT_END);
4577 static void ssh1_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
4579 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4580 struct ssh_channel *c;
4582 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4583 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4584 logevent("Forwarded connection refused by server");
4585 pfd_close(c->u.pfd.s);
4586 del234(ssh->channels, c);
4591 static void ssh1_msg_channel_close(Ssh ssh, struct Packet *pktin)
4593 /* Remote side closes a channel. */
4594 unsigned i = ssh_pkt_getuint32(pktin);
4595 struct ssh_channel *c;
4596 c = find234(ssh->channels, &i, ssh_channelfind);
4597 if (c && !c->halfopen) {
4600 (pktin->type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2);
4602 if ((c->closes == 0) && (c->type == CHAN_X11)) {
4603 logevent("Forwarded X11 connection terminated");
4604 assert(c->u.x11.s != NULL);
4605 x11_close(c->u.x11.s);
4608 if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) {
4609 logevent("Forwarded port closed");
4610 assert(c->u.pfd.s != NULL);
4611 pfd_close(c->u.pfd.s);
4615 c->closes |= (closetype << 2); /* seen this message */
4616 if (!(c->closes & closetype)) {
4617 send_packet(ssh, pktin->type, PKT_INT, c->remoteid,
4619 c->closes |= closetype; /* sent it too */
4622 if (c->closes == 15) {
4623 del234(ssh->channels, c);
4627 bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n",
4628 pktin->type == SSH1_MSG_CHANNEL_CLOSE ? "" :
4629 "_CONFIRMATION", c ? "half-open" : "nonexistent",
4634 static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin)
4636 /* Data sent down one of our channels. */
4637 int i = ssh_pkt_getuint32(pktin);
4640 struct ssh_channel *c;
4642 ssh_pkt_getstring(pktin, &p, &len);
4644 c = find234(ssh->channels, &i, ssh_channelfind);
4649 bufsize = x11_send(c->u.x11.s, p, len);
4652 bufsize = pfd_send(c->u.pfd.s, p, len);
4655 /* Data for an agent message. Buffer it. */
4657 if (c->u.a.lensofar < 4) {
4658 unsigned int l = min(4 - c->u.a.lensofar, (unsigned)len);
4659 memcpy(c->u.a.msglen + c->u.a.lensofar, p,
4663 c->u.a.lensofar += l;
4665 if (c->u.a.lensofar == 4) {
4667 4 + GET_32BIT(c->u.a.msglen);
4668 c->u.a.message = snewn(c->u.a.totallen,
4670 memcpy(c->u.a.message, c->u.a.msglen, 4);
4672 if (c->u.a.lensofar >= 4 && len > 0) {
4674 min(c->u.a.totallen - c->u.a.lensofar,
4676 memcpy(c->u.a.message + c->u.a.lensofar, p,
4680 c->u.a.lensofar += l;
4682 if (c->u.a.lensofar == c->u.a.totallen) {
4685 if (agent_query(c->u.a.message,
4688 ssh_agentf_callback, c))
4689 ssh_agentf_callback(c, reply, replylen);
4690 sfree(c->u.a.message);
4691 c->u.a.lensofar = 0;
4694 bufsize = 0; /* agent channels never back up */
4697 if (!c->v.v1.throttling && bufsize > SSH1_BUFFER_LIMIT) {
4698 c->v.v1.throttling = 1;
4699 ssh1_throttle(ssh, +1);
4704 static void ssh1_smsg_exit_status(Ssh ssh, struct Packet *pktin)
4706 ssh->exitcode = ssh_pkt_getuint32(pktin);
4707 logeventf(ssh, "Server sent command exit status %d", ssh->exitcode);
4708 send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
4710 * In case `helpful' firewalls or proxies tack
4711 * extra human-readable text on the end of the
4712 * session which we might mistake for another
4713 * encrypted packet, we close the session once
4714 * we've sent EXIT_CONFIRMATION.
4716 ssh_disconnect(ssh, NULL, NULL, 0, TRUE);
4719 /* Helper function to deal with sending tty modes for REQUEST_PTY */
4720 static void ssh1_send_ttymode(void *data, char *mode, char *val)
4722 struct Packet *pktout = (struct Packet *)data;
4724 unsigned int arg = 0;
4725 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
4726 if (i == lenof(ssh_ttymodes)) return;
4727 switch (ssh_ttymodes[i].type) {
4729 arg = ssh_tty_parse_specchar(val);
4732 arg = ssh_tty_parse_boolean(val);
4735 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
4736 ssh2_pkt_addbyte(pktout, arg);
4740 static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
4741 struct Packet *pktin)
4743 crBegin(ssh->do_ssh1_connection_crstate);
4745 ssh->packet_dispatch[SSH1_SMSG_STDOUT_DATA] =
4746 ssh->packet_dispatch[SSH1_SMSG_STDERR_DATA] =
4747 ssh1_smsg_stdout_stderr_data;
4749 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_CONFIRMATION] =
4750 ssh1_msg_channel_open_confirmation;
4751 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_FAILURE] =
4752 ssh1_msg_channel_open_failure;
4753 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE] =
4754 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION] =
4755 ssh1_msg_channel_close;
4756 ssh->packet_dispatch[SSH1_MSG_CHANNEL_DATA] = ssh1_msg_channel_data;
4757 ssh->packet_dispatch[SSH1_SMSG_EXIT_STATUS] = ssh1_smsg_exit_status;
4759 if (ssh->cfg.agentfwd && agent_exists()) {
4760 logevent("Requesting agent forwarding");
4761 send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END);
4765 if (pktin->type != SSH1_SMSG_SUCCESS
4766 && pktin->type != SSH1_SMSG_FAILURE) {
4767 bombout(("Protocol confusion"));
4769 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4770 logevent("Agent forwarding refused");
4772 logevent("Agent forwarding enabled");
4773 ssh->agentfwd_enabled = TRUE;
4774 ssh->packet_dispatch[SSH1_SMSG_AGENT_OPEN] = ssh1_smsg_agent_open;
4778 if (ssh->cfg.x11_forward) {
4779 char proto[20], data[64];
4780 logevent("Requesting X11 forwarding");
4781 ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
4782 data, sizeof(data), ssh->cfg.x11_auth);
4783 x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display);
4785 * Note that while we blank the X authentication data here, we don't
4786 * take any special action to blank the start of an X11 channel,
4787 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
4788 * without having session blanking enabled is likely to leak your
4789 * cookie into the log.
4791 if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) {
4792 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
4794 PKTT_PASSWORD, PKT_STR, data, PKTT_OTHER,
4795 PKT_INT, x11_get_screen_number(ssh->cfg.x11_display),
4798 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
4800 PKTT_PASSWORD, PKT_STR, data, PKTT_OTHER, PKT_END);
4805 if (pktin->type != SSH1_SMSG_SUCCESS
4806 && pktin->type != SSH1_SMSG_FAILURE) {
4807 bombout(("Protocol confusion"));
4809 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4810 logevent("X11 forwarding refused");
4812 logevent("X11 forwarding enabled");
4813 ssh->X11_fwd_enabled = TRUE;
4814 ssh->packet_dispatch[SSH1_SMSG_X11_OPEN] = ssh1_smsg_x11_open;
4818 ssh_setup_portfwd(ssh, &ssh->cfg);
4819 ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = ssh1_msg_port_open;
4821 if (!ssh->cfg.nopty) {
4823 /* Unpick the terminal-speed string. */
4824 /* XXX perhaps we should allow no speeds to be sent. */
4825 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
4826 sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
4827 /* Send the pty request. */
4828 pkt = ssh1_pkt_init(SSH1_CMSG_REQUEST_PTY);
4829 ssh_pkt_addstring(pkt, ssh->cfg.termtype);
4830 ssh_pkt_adduint32(pkt, ssh->term_height);
4831 ssh_pkt_adduint32(pkt, ssh->term_width);
4832 ssh_pkt_adduint32(pkt, 0); /* width in pixels */
4833 ssh_pkt_adduint32(pkt, 0); /* height in pixels */
4834 parse_ttymodes(ssh, ssh->cfg.ttymodes,
4835 ssh1_send_ttymode, (void *)pkt);
4836 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_ISPEED);
4837 ssh_pkt_adduint32(pkt, ssh->ispeed);
4838 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_OSPEED);
4839 ssh_pkt_adduint32(pkt, ssh->ospeed);
4840 ssh_pkt_addbyte(pkt, SSH_TTY_OP_END);
4842 ssh->state = SSH_STATE_INTERMED;
4846 if (pktin->type != SSH1_SMSG_SUCCESS
4847 && pktin->type != SSH1_SMSG_FAILURE) {
4848 bombout(("Protocol confusion"));
4850 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4851 c_write_str(ssh, "Server refused to allocate pty\r\n");
4852 ssh->editing = ssh->echoing = 1;
4854 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
4855 ssh->ospeed, ssh->ispeed);
4857 ssh->editing = ssh->echoing = 1;
4860 if (ssh->cfg.compression) {
4861 send_packet(ssh, SSH1_CMSG_REQUEST_COMPRESSION, PKT_INT, 6, PKT_END);
4865 if (pktin->type != SSH1_SMSG_SUCCESS
4866 && pktin->type != SSH1_SMSG_FAILURE) {
4867 bombout(("Protocol confusion"));
4869 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4870 c_write_str(ssh, "Server refused to compress\r\n");
4872 logevent("Started compression");
4873 ssh->v1_compressing = TRUE;
4874 ssh->cs_comp_ctx = zlib_compress_init();
4875 logevent("Initialised zlib (RFC1950) compression");
4876 ssh->sc_comp_ctx = zlib_decompress_init();
4877 logevent("Initialised zlib (RFC1950) decompression");
4881 * Start the shell or command.
4883 * Special case: if the first-choice command is an SSH-2
4884 * subsystem (hence not usable here) and the second choice
4885 * exists, we fall straight back to that.
4888 char *cmd = ssh->cfg.remote_cmd_ptr;
4890 if (!cmd) cmd = ssh->cfg.remote_cmd;
4892 if (ssh->cfg.ssh_subsys && ssh->cfg.remote_cmd_ptr2) {
4893 cmd = ssh->cfg.remote_cmd_ptr2;
4894 ssh->fallback_cmd = TRUE;
4897 send_packet(ssh, SSH1_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END);
4899 send_packet(ssh, SSH1_CMSG_EXEC_SHELL, PKT_END);
4900 logevent("Started session");
4903 ssh->state = SSH_STATE_SESSION;
4904 if (ssh->size_needed)
4905 ssh_size(ssh, ssh->term_width, ssh->term_height);
4906 if (ssh->eof_needed)
4907 ssh_special(ssh, TS_EOF);
4910 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
4912 ssh->channels = newtree234(ssh_channelcmp);
4916 * By this point, most incoming packets are already being
4917 * handled by the dispatch table, and we need only pay
4918 * attention to the unusual ones.
4923 if (pktin->type == SSH1_SMSG_SUCCESS) {
4924 /* may be from EXEC_SHELL on some servers */
4925 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4926 /* may be from EXEC_SHELL on some servers
4927 * if no pty is available or in other odd cases. Ignore */
4929 bombout(("Strange packet received: type %d", pktin->type));
4934 int len = min(inlen, 512);
4935 send_packet(ssh, SSH1_CMSG_STDIN_DATA, PKTT_DATA,
4936 PKT_INT, len, PKT_DATA, in, len,
4937 PKTT_OTHER, PKT_END);
4948 * Handle the top-level SSH-2 protocol.
4950 static void ssh1_msg_debug(Ssh ssh, struct Packet *pktin)
4955 ssh_pkt_getstring(pktin, &msg, &msglen);
4956 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
4959 static void ssh1_msg_disconnect(Ssh ssh, struct Packet *pktin)
4961 /* log reason code in disconnect message */
4965 ssh_pkt_getstring(pktin, &msg, &msglen);
4966 bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg));
4969 static void ssh_msg_ignore(Ssh ssh, struct Packet *pktin)
4971 /* Do nothing, because we're ignoring it! Duhh. */
4974 static void ssh1_protocol_setup(Ssh ssh)
4979 * Most messages are handled by the coroutines.
4981 for (i = 0; i < 256; i++)
4982 ssh->packet_dispatch[i] = NULL;
4985 * These special message types we install handlers for.
4987 ssh->packet_dispatch[SSH1_MSG_DISCONNECT] = ssh1_msg_disconnect;
4988 ssh->packet_dispatch[SSH1_MSG_IGNORE] = ssh_msg_ignore;
4989 ssh->packet_dispatch[SSH1_MSG_DEBUG] = ssh1_msg_debug;
4992 static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
4993 struct Packet *pktin)
4995 unsigned char *in=(unsigned char*)vin;
4996 if (ssh->state == SSH_STATE_CLOSED)
4999 if (pktin && ssh->packet_dispatch[pktin->type]) {
5000 ssh->packet_dispatch[pktin->type](ssh, pktin);
5004 if (!ssh->protocol_initial_phase_done) {
5005 if (do_ssh1_login(ssh, in, inlen, pktin))
5006 ssh->protocol_initial_phase_done = TRUE;
5011 do_ssh1_connection(ssh, in, inlen, pktin);
5015 * Utility routine for decoding comma-separated strings in KEXINIT.
5017 static int in_commasep_string(char *needle, char *haystack, int haylen)
5020 if (!needle || !haystack) /* protect against null pointers */
5022 needlen = strlen(needle);
5025 * Is it at the start of the string?
5027 if (haylen >= needlen && /* haystack is long enough */
5028 !memcmp(needle, haystack, needlen) && /* initial match */
5029 (haylen == needlen || haystack[needlen] == ',')
5030 /* either , or EOS follows */
5034 * If not, search for the next comma and resume after that.
5035 * If no comma found, terminate.
5037 while (haylen > 0 && *haystack != ',')
5038 haylen--, haystack++;
5041 haylen--, haystack++; /* skip over comma itself */
5046 * Similar routine for checking whether we have the first string in a list.
5048 static int first_in_commasep_string(char *needle, char *haystack, int haylen)
5051 if (!needle || !haystack) /* protect against null pointers */
5053 needlen = strlen(needle);
5055 * Is it at the start of the string?
5057 if (haylen >= needlen && /* haystack is long enough */
5058 !memcmp(needle, haystack, needlen) && /* initial match */
5059 (haylen == needlen || haystack[needlen] == ',')
5060 /* either , or EOS follows */
5068 * SSH-2 key creation method.
5069 * (Currently assumes 2 lots of any hash are sufficient to generate
5070 * keys/IVs for any cipher/MAC. SSH2_MKKEY_ITERS documents this assumption.)
5072 #define SSH2_MKKEY_ITERS (2)
5073 static void ssh2_mkkey(Ssh ssh, Bignum K, unsigned char *H, char chr,
5074 unsigned char *keyspace)
5076 const struct ssh_hash *h = ssh->kex->hash;
5078 /* First hlen bytes. */
5080 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
5081 hash_mpint(h, s, K);
5082 h->bytes(s, H, h->hlen);
5083 h->bytes(s, &chr, 1);
5084 h->bytes(s, ssh->v2_session_id, ssh->v2_session_id_len);
5085 h->final(s, keyspace);
5086 /* Next hlen bytes. */
5088 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
5089 hash_mpint(h, s, K);
5090 h->bytes(s, H, h->hlen);
5091 h->bytes(s, keyspace, h->hlen);
5092 h->final(s, keyspace + h->hlen);
5096 * Handle the SSH-2 transport layer.
5098 static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
5099 struct Packet *pktin)
5101 unsigned char *in = (unsigned char *)vin;
5102 struct do_ssh2_transport_state {
5103 int nbits, pbits, warn_kex, warn_cscipher, warn_sccipher;
5104 Bignum p, g, e, f, K;
5107 int kex_init_value, kex_reply_value;
5108 const struct ssh_mac **maclist;
5110 const struct ssh2_cipher *cscipher_tobe;
5111 const struct ssh2_cipher *sccipher_tobe;
5112 const struct ssh_mac *csmac_tobe;
5113 const struct ssh_mac *scmac_tobe;
5114 const struct ssh_compress *cscomp_tobe;
5115 const struct ssh_compress *sccomp_tobe;
5116 char *hostkeydata, *sigdata, *rsakeydata, *keystr, *fingerprint;
5117 int hostkeylen, siglen, rsakeylen;
5118 void *hkey; /* actual host key */
5119 void *rsakey; /* for RSA kex */
5120 unsigned char exchange_hash[SSH2_KEX_MAX_HASH_LEN];
5121 int n_preferred_kex;
5122 const struct ssh_kexes *preferred_kex[KEX_MAX];
5123 int n_preferred_ciphers;
5124 const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX];
5125 const struct ssh_compress *preferred_comp;
5126 int got_session_id, activated_authconn;
5127 struct Packet *pktout;
5132 crState(do_ssh2_transport_state);
5134 crBegin(ssh->do_ssh2_transport_crstate);
5136 s->cscipher_tobe = s->sccipher_tobe = NULL;
5137 s->csmac_tobe = s->scmac_tobe = NULL;
5138 s->cscomp_tobe = s->sccomp_tobe = NULL;
5140 s->got_session_id = s->activated_authconn = FALSE;
5143 * Be prepared to work around the buggy MAC problem.
5145 if (ssh->remote_bugs & BUG_SSH2_HMAC)
5146 s->maclist = buggymacs, s->nmacs = lenof(buggymacs);
5148 s->maclist = macs, s->nmacs = lenof(macs);
5151 ssh->pkt_ctx &= ~SSH2_PKTCTX_KEX_MASK;
5153 int i, j, commalist_started;
5156 * Set up the preferred key exchange. (NULL => warn below here)
5158 s->n_preferred_kex = 0;
5159 for (i = 0; i < KEX_MAX; i++) {
5160 switch (ssh->cfg.ssh_kexlist[i]) {
5162 s->preferred_kex[s->n_preferred_kex++] =
5163 &ssh_diffiehellman_gex;
5166 s->preferred_kex[s->n_preferred_kex++] =
5167 &ssh_diffiehellman_group14;
5170 s->preferred_kex[s->n_preferred_kex++] =
5171 &ssh_diffiehellman_group1;
5174 s->preferred_kex[s->n_preferred_kex++] =
5178 /* Flag for later. Don't bother if it's the last in
5180 if (i < KEX_MAX - 1) {
5181 s->preferred_kex[s->n_preferred_kex++] = NULL;
5188 * Set up the preferred ciphers. (NULL => warn below here)
5190 s->n_preferred_ciphers = 0;
5191 for (i = 0; i < CIPHER_MAX; i++) {
5192 switch (ssh->cfg.ssh_cipherlist[i]) {
5193 case CIPHER_BLOWFISH:
5194 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_blowfish;
5197 if (ssh->cfg.ssh2_des_cbc) {
5198 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_des;
5202 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_3des;
5205 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_aes;
5207 case CIPHER_ARCFOUR:
5208 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_arcfour;
5211 /* Flag for later. Don't bother if it's the last in
5213 if (i < CIPHER_MAX - 1) {
5214 s->preferred_ciphers[s->n_preferred_ciphers++] = NULL;
5221 * Set up preferred compression.
5223 if (ssh->cfg.compression)
5224 s->preferred_comp = &ssh_zlib;
5226 s->preferred_comp = &ssh_comp_none;
5229 * Enable queueing of outgoing auth- or connection-layer
5230 * packets while we are in the middle of a key exchange.
5232 ssh->queueing = TRUE;
5235 * Flag that KEX is in progress.
5237 ssh->kex_in_progress = TRUE;
5240 * Construct and send our key exchange packet.
5242 s->pktout = ssh2_pkt_init(SSH2_MSG_KEXINIT);
5243 for (i = 0; i < 16; i++)
5244 ssh2_pkt_addbyte(s->pktout, (unsigned char) random_byte());
5245 /* List key exchange algorithms. */
5246 ssh2_pkt_addstring_start(s->pktout);
5247 commalist_started = 0;
5248 for (i = 0; i < s->n_preferred_kex; i++) {
5249 const struct ssh_kexes *k = s->preferred_kex[i];
5250 if (!k) continue; /* warning flag */
5251 for (j = 0; j < k->nkexes; j++) {
5252 if (commalist_started)
5253 ssh2_pkt_addstring_str(s->pktout, ",");
5254 ssh2_pkt_addstring_str(s->pktout, k->list[j]->name);
5255 commalist_started = 1;
5258 /* List server host key algorithms. */
5259 ssh2_pkt_addstring_start(s->pktout);
5260 for (i = 0; i < lenof(hostkey_algs); i++) {
5261 ssh2_pkt_addstring_str(s->pktout, hostkey_algs[i]->name);
5262 if (i < lenof(hostkey_algs) - 1)
5263 ssh2_pkt_addstring_str(s->pktout, ",");
5265 /* List client->server encryption algorithms. */
5266 ssh2_pkt_addstring_start(s->pktout);
5267 commalist_started = 0;
5268 for (i = 0; i < s->n_preferred_ciphers; i++) {
5269 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5270 if (!c) continue; /* warning flag */
5271 for (j = 0; j < c->nciphers; j++) {
5272 if (commalist_started)
5273 ssh2_pkt_addstring_str(s->pktout, ",");
5274 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
5275 commalist_started = 1;
5278 /* List server->client encryption algorithms. */
5279 ssh2_pkt_addstring_start(s->pktout);
5280 commalist_started = 0;
5281 for (i = 0; i < s->n_preferred_ciphers; i++) {
5282 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5283 if (!c) continue; /* warning flag */
5284 for (j = 0; j < c->nciphers; j++) {
5285 if (commalist_started)
5286 ssh2_pkt_addstring_str(s->pktout, ",");
5287 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
5288 commalist_started = 1;
5291 /* List client->server MAC algorithms. */
5292 ssh2_pkt_addstring_start(s->pktout);
5293 for (i = 0; i < s->nmacs; i++) {
5294 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
5295 if (i < s->nmacs - 1)
5296 ssh2_pkt_addstring_str(s->pktout, ",");
5298 /* List server->client MAC algorithms. */
5299 ssh2_pkt_addstring_start(s->pktout);
5300 for (i = 0; i < s->nmacs; i++) {
5301 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
5302 if (i < s->nmacs - 1)
5303 ssh2_pkt_addstring_str(s->pktout, ",");
5305 /* List client->server compression algorithms. */
5306 ssh2_pkt_addstring_start(s->pktout);
5307 assert(lenof(compressions) > 1);
5308 ssh2_pkt_addstring_str(s->pktout, s->preferred_comp->name);
5309 for (i = 0; i < lenof(compressions); i++) {
5310 const struct ssh_compress *c = compressions[i];
5311 if (c != s->preferred_comp) {
5312 ssh2_pkt_addstring_str(s->pktout, ",");
5313 ssh2_pkt_addstring_str(s->pktout, c->name);
5316 /* List server->client compression algorithms. */
5317 ssh2_pkt_addstring_start(s->pktout);
5318 assert(lenof(compressions) > 1);
5319 ssh2_pkt_addstring_str(s->pktout, s->preferred_comp->name);
5320 for (i = 0; i < lenof(compressions); i++) {
5321 const struct ssh_compress *c = compressions[i];
5322 if (c != s->preferred_comp) {
5323 ssh2_pkt_addstring_str(s->pktout, ",");
5324 ssh2_pkt_addstring_str(s->pktout, c->name);
5327 /* List client->server languages. Empty list. */
5328 ssh2_pkt_addstring_start(s->pktout);
5329 /* List server->client languages. Empty list. */
5330 ssh2_pkt_addstring_start(s->pktout);
5331 /* First KEX packet does _not_ follow, because we're not that brave. */
5332 ssh2_pkt_addbool(s->pktout, FALSE);
5334 ssh2_pkt_adduint32(s->pktout, 0);
5337 s->our_kexinitlen = s->pktout->length - 5;
5338 s->our_kexinit = snewn(s->our_kexinitlen, unsigned char);
5339 memcpy(s->our_kexinit, s->pktout->data + 5, s->our_kexinitlen);
5341 ssh2_pkt_send_noqueue(ssh, s->pktout);
5347 * Now examine the other side's KEXINIT to see what we're up
5351 char *str, *preferred;
5354 if (pktin->type != SSH2_MSG_KEXINIT) {
5355 bombout(("expected key exchange packet from server"));
5359 ssh->hostkey = NULL;
5360 s->cscipher_tobe = NULL;
5361 s->sccipher_tobe = NULL;
5362 s->csmac_tobe = NULL;
5363 s->scmac_tobe = NULL;
5364 s->cscomp_tobe = NULL;
5365 s->sccomp_tobe = NULL;
5366 s->warn_kex = s->warn_cscipher = s->warn_sccipher = FALSE;
5368 pktin->savedpos += 16; /* skip garbage cookie */
5369 ssh_pkt_getstring(pktin, &str, &len); /* key exchange algorithms */
5372 for (i = 0; i < s->n_preferred_kex; i++) {
5373 const struct ssh_kexes *k = s->preferred_kex[i];
5377 for (j = 0; j < k->nkexes; j++) {
5378 if (!preferred) preferred = k->list[j]->name;
5379 if (in_commasep_string(k->list[j]->name, str, len)) {
5380 ssh->kex = k->list[j];
5389 bombout(("Couldn't agree a key exchange algorithm (available: %s)",
5390 str ? str : "(null)"));
5394 * Note that the server's guess is considered wrong if it doesn't match
5395 * the first algorithm in our list, even if it's still the algorithm
5398 s->guessok = first_in_commasep_string(preferred, str, len);
5399 ssh_pkt_getstring(pktin, &str, &len); /* host key algorithms */
5400 for (i = 0; i < lenof(hostkey_algs); i++) {
5401 if (in_commasep_string(hostkey_algs[i]->name, str, len)) {
5402 ssh->hostkey = hostkey_algs[i];
5406 s->guessok = s->guessok &&
5407 first_in_commasep_string(hostkey_algs[0]->name, str, len);
5408 ssh_pkt_getstring(pktin, &str, &len); /* client->server cipher */
5409 for (i = 0; i < s->n_preferred_ciphers; i++) {
5410 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5412 s->warn_cscipher = TRUE;
5414 for (j = 0; j < c->nciphers; j++) {
5415 if (in_commasep_string(c->list[j]->name, str, len)) {
5416 s->cscipher_tobe = c->list[j];
5421 if (s->cscipher_tobe)
5424 if (!s->cscipher_tobe) {
5425 bombout(("Couldn't agree a client-to-server cipher (available: %s)",
5426 str ? str : "(null)"));
5430 ssh_pkt_getstring(pktin, &str, &len); /* server->client cipher */
5431 for (i = 0; i < s->n_preferred_ciphers; i++) {
5432 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5434 s->warn_sccipher = TRUE;
5436 for (j = 0; j < c->nciphers; j++) {
5437 if (in_commasep_string(c->list[j]->name, str, len)) {
5438 s->sccipher_tobe = c->list[j];
5443 if (s->sccipher_tobe)
5446 if (!s->sccipher_tobe) {
5447 bombout(("Couldn't agree a server-to-client cipher (available: %s)",
5448 str ? str : "(null)"));
5452 ssh_pkt_getstring(pktin, &str, &len); /* client->server mac */
5453 for (i = 0; i < s->nmacs; i++) {
5454 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5455 s->csmac_tobe = s->maclist[i];
5459 ssh_pkt_getstring(pktin, &str, &len); /* server->client mac */
5460 for (i = 0; i < s->nmacs; i++) {
5461 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5462 s->scmac_tobe = s->maclist[i];
5466 ssh_pkt_getstring(pktin, &str, &len); /* client->server compression */
5467 for (i = 0; i < lenof(compressions) + 1; i++) {
5468 const struct ssh_compress *c =
5469 i == 0 ? s->preferred_comp : compressions[i - 1];
5470 if (in_commasep_string(c->name, str, len)) {
5475 ssh_pkt_getstring(pktin, &str, &len); /* server->client compression */
5476 for (i = 0; i < lenof(compressions) + 1; i++) {
5477 const struct ssh_compress *c =
5478 i == 0 ? s->preferred_comp : compressions[i - 1];
5479 if (in_commasep_string(c->name, str, len)) {
5484 ssh_pkt_getstring(pktin, &str, &len); /* client->server language */
5485 ssh_pkt_getstring(pktin, &str, &len); /* server->client language */
5486 s->ignorepkt = ssh2_pkt_getbool(pktin) && !s->guessok;
5489 ssh_set_frozen(ssh, 1);
5490 s->dlgret = askalg(ssh->frontend, "key-exchange algorithm",
5492 ssh_dialog_callback, ssh);
5493 if (s->dlgret < 0) {
5497 bombout(("Unexpected data from server while"
5498 " waiting for user response"));
5501 } while (pktin || inlen > 0);
5502 s->dlgret = ssh->user_response;
5504 ssh_set_frozen(ssh, 0);
5505 if (s->dlgret == 0) {
5506 ssh_disconnect(ssh, "User aborted at kex warning", NULL,
5512 if (s->warn_cscipher) {
5513 ssh_set_frozen(ssh, 1);
5514 s->dlgret = askalg(ssh->frontend,
5515 "client-to-server cipher",
5516 s->cscipher_tobe->name,
5517 ssh_dialog_callback, ssh);
5518 if (s->dlgret < 0) {
5522 bombout(("Unexpected data from server while"
5523 " waiting for user response"));
5526 } while (pktin || inlen > 0);
5527 s->dlgret = ssh->user_response;
5529 ssh_set_frozen(ssh, 0);
5530 if (s->dlgret == 0) {
5531 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5537 if (s->warn_sccipher) {
5538 ssh_set_frozen(ssh, 1);
5539 s->dlgret = askalg(ssh->frontend,
5540 "server-to-client cipher",
5541 s->sccipher_tobe->name,
5542 ssh_dialog_callback, ssh);
5543 if (s->dlgret < 0) {
5547 bombout(("Unexpected data from server while"
5548 " waiting for user response"));
5551 } while (pktin || inlen > 0);
5552 s->dlgret = ssh->user_response;
5554 ssh_set_frozen(ssh, 0);
5555 if (s->dlgret == 0) {
5556 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5562 ssh->exhash = ssh->kex->hash->init();
5563 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_c, strlen(ssh->v_c));
5564 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_s, strlen(ssh->v_s));
5565 hash_string(ssh->kex->hash, ssh->exhash,
5566 s->our_kexinit, s->our_kexinitlen);
5567 sfree(s->our_kexinit);
5568 if (pktin->length > 5)
5569 hash_string(ssh->kex->hash, ssh->exhash,
5570 pktin->data + 5, pktin->length - 5);
5572 if (s->ignorepkt) /* first_kex_packet_follows */
5573 crWaitUntil(pktin); /* Ignore packet */
5576 if (ssh->kex->main_type == KEXTYPE_DH) {
5578 * Work out the number of bits of key we will need from the
5579 * key exchange. We start with the maximum key length of
5585 csbits = s->cscipher_tobe->keylen;
5586 scbits = s->sccipher_tobe->keylen;
5587 s->nbits = (csbits > scbits ? csbits : scbits);
5589 /* The keys only have hlen-bit entropy, since they're based on
5590 * a hash. So cap the key size at hlen bits. */
5591 if (s->nbits > ssh->kex->hash->hlen * 8)
5592 s->nbits = ssh->kex->hash->hlen * 8;
5595 * If we're doing Diffie-Hellman group exchange, start by
5596 * requesting a group.
5598 if (!ssh->kex->pdata) {
5599 logevent("Doing Diffie-Hellman group exchange");
5600 ssh->pkt_ctx |= SSH2_PKTCTX_DHGEX;
5602 * Work out how big a DH group we will need to allow that
5605 s->pbits = 512 << ((s->nbits - 1) / 64);
5606 s->pktout = ssh2_pkt_init(SSH2_MSG_KEX_DH_GEX_REQUEST);
5607 ssh2_pkt_adduint32(s->pktout, s->pbits);
5608 ssh2_pkt_send_noqueue(ssh, s->pktout);
5611 if (pktin->type != SSH2_MSG_KEX_DH_GEX_GROUP) {
5612 bombout(("expected key exchange group packet from server"));
5615 s->p = ssh2_pkt_getmp(pktin);
5616 s->g = ssh2_pkt_getmp(pktin);
5617 if (!s->p || !s->g) {
5618 bombout(("unable to read mp-ints from incoming group packet"));
5621 ssh->kex_ctx = dh_setup_gex(s->p, s->g);
5622 s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT;
5623 s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY;
5625 ssh->pkt_ctx |= SSH2_PKTCTX_DHGROUP;
5626 ssh->kex_ctx = dh_setup_group(ssh->kex);
5627 s->kex_init_value = SSH2_MSG_KEXDH_INIT;
5628 s->kex_reply_value = SSH2_MSG_KEXDH_REPLY;
5629 logeventf(ssh, "Using Diffie-Hellman with standard group \"%s\"",
5630 ssh->kex->groupname);
5633 logeventf(ssh, "Doing Diffie-Hellman key exchange with hash %s",
5634 ssh->kex->hash->text_name);
5636 * Now generate and send e for Diffie-Hellman.
5638 set_busy_status(ssh->frontend, BUSY_CPU); /* this can take a while */
5639 s->e = dh_create_e(ssh->kex_ctx, s->nbits * 2);
5640 s->pktout = ssh2_pkt_init(s->kex_init_value);
5641 ssh2_pkt_addmp(s->pktout, s->e);
5642 ssh2_pkt_send_noqueue(ssh, s->pktout);
5644 set_busy_status(ssh->frontend, BUSY_WAITING); /* wait for server */
5646 if (pktin->type != s->kex_reply_value) {
5647 bombout(("expected key exchange reply packet from server"));
5650 set_busy_status(ssh->frontend, BUSY_CPU); /* cogitate */
5651 ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
5652 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
5653 s->f = ssh2_pkt_getmp(pktin);
5655 bombout(("unable to parse key exchange reply packet"));
5658 ssh_pkt_getstring(pktin, &s->sigdata, &s->siglen);
5660 s->K = dh_find_K(ssh->kex_ctx, s->f);
5662 /* We assume everything from now on will be quick, and it might
5663 * involve user interaction. */
5664 set_busy_status(ssh->frontend, BUSY_NOT);
5666 hash_string(ssh->kex->hash, ssh->exhash, s->hostkeydata, s->hostkeylen);
5667 if (!ssh->kex->pdata) {
5668 hash_uint32(ssh->kex->hash, ssh->exhash, s->pbits);
5669 hash_mpint(ssh->kex->hash, ssh->exhash, s->p);
5670 hash_mpint(ssh->kex->hash, ssh->exhash, s->g);
5672 hash_mpint(ssh->kex->hash, ssh->exhash, s->e);
5673 hash_mpint(ssh->kex->hash, ssh->exhash, s->f);
5675 dh_cleanup(ssh->kex_ctx);
5677 if (!ssh->kex->pdata) {
5682 logeventf(ssh, "Doing RSA key exchange with hash %s",
5683 ssh->kex->hash->text_name);
5684 ssh->pkt_ctx |= SSH2_PKTCTX_RSAKEX;
5686 * RSA key exchange. First expect a KEXRSA_PUBKEY packet
5690 if (pktin->type != SSH2_MSG_KEXRSA_PUBKEY) {
5691 bombout(("expected RSA public key packet from server"));
5695 ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
5696 hash_string(ssh->kex->hash, ssh->exhash,
5697 s->hostkeydata, s->hostkeylen);
5698 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
5702 ssh_pkt_getstring(pktin, &keydata, &s->rsakeylen);
5703 s->rsakeydata = snewn(s->rsakeylen, char);
5704 memcpy(s->rsakeydata, keydata, s->rsakeylen);
5707 s->rsakey = ssh_rsakex_newkey(s->rsakeydata, s->rsakeylen);
5709 sfree(s->rsakeydata);
5710 bombout(("unable to parse RSA public key from server"));
5714 hash_string(ssh->kex->hash, ssh->exhash, s->rsakeydata, s->rsakeylen);
5717 * Next, set up a shared secret K, of precisely KLEN -
5718 * 2*HLEN - 49 bits, where KLEN is the bit length of the
5719 * RSA key modulus and HLEN is the bit length of the hash
5723 int klen = ssh_rsakex_klen(s->rsakey);
5724 int nbits = klen - (2*ssh->kex->hash->hlen*8 + 49);
5726 unsigned char *kstr1, *kstr2, *outstr;
5727 int kstr1len, kstr2len, outstrlen;
5729 s->K = bn_power_2(nbits - 1);
5731 for (i = 0; i < nbits; i++) {
5733 byte = random_byte();
5735 bignum_set_bit(s->K, i, (byte >> (i & 7)) & 1);
5739 * Encode this as an mpint.
5741 kstr1 = ssh2_mpint_fmt(s->K, &kstr1len);
5742 kstr2 = snewn(kstr2len = 4 + kstr1len, unsigned char);
5743 PUT_32BIT(kstr2, kstr1len);
5744 memcpy(kstr2 + 4, kstr1, kstr1len);
5747 * Encrypt it with the given RSA key.
5749 outstrlen = (klen + 7) / 8;
5750 outstr = snewn(outstrlen, unsigned char);
5751 ssh_rsakex_encrypt(ssh->kex->hash, kstr2, kstr2len,
5752 outstr, outstrlen, s->rsakey);
5755 * And send it off in a return packet.
5757 s->pktout = ssh2_pkt_init(SSH2_MSG_KEXRSA_SECRET);
5758 ssh2_pkt_addstring_start(s->pktout);
5759 ssh2_pkt_addstring_data(s->pktout, (char *)outstr, outstrlen);
5760 ssh2_pkt_send_noqueue(ssh, s->pktout);
5762 hash_string(ssh->kex->hash, ssh->exhash, outstr, outstrlen);
5769 ssh_rsakex_freekey(s->rsakey);
5772 if (pktin->type != SSH2_MSG_KEXRSA_DONE) {
5773 sfree(s->rsakeydata);
5774 bombout(("expected signature packet from server"));
5778 ssh_pkt_getstring(pktin, &s->sigdata, &s->siglen);
5780 sfree(s->rsakeydata);
5783 hash_mpint(ssh->kex->hash, ssh->exhash, s->K);
5784 assert(ssh->kex->hash->hlen <= sizeof(s->exchange_hash));
5785 ssh->kex->hash->final(ssh->exhash, s->exchange_hash);
5787 ssh->kex_ctx = NULL;
5790 debug(("Exchange hash is:\n"));
5791 dmemdump(s->exchange_hash, ssh->kex->hash->hlen);
5795 !ssh->hostkey->verifysig(s->hkey, s->sigdata, s->siglen,
5796 (char *)s->exchange_hash,
5797 ssh->kex->hash->hlen)) {
5798 bombout(("Server's host key did not match the signature supplied"));
5803 * Authenticate remote host: verify host key. (We've already
5804 * checked the signature of the exchange hash.)
5806 s->keystr = ssh->hostkey->fmtkey(s->hkey);
5807 s->fingerprint = ssh->hostkey->fingerprint(s->hkey);
5808 ssh_set_frozen(ssh, 1);
5809 s->dlgret = verify_ssh_host_key(ssh->frontend,
5810 ssh->savedhost, ssh->savedport,
5811 ssh->hostkey->keytype, s->keystr,
5813 ssh_dialog_callback, ssh);
5814 if (s->dlgret < 0) {
5818 bombout(("Unexpected data from server while waiting"
5819 " for user host key response"));
5822 } while (pktin || inlen > 0);
5823 s->dlgret = ssh->user_response;
5825 ssh_set_frozen(ssh, 0);
5826 if (s->dlgret == 0) {
5827 ssh_disconnect(ssh, "User aborted at host key verification", NULL,
5831 if (!s->got_session_id) { /* don't bother logging this in rekeys */
5832 logevent("Host key fingerprint is:");
5833 logevent(s->fingerprint);
5835 sfree(s->fingerprint);
5837 ssh->hostkey->freekey(s->hkey);
5840 * The exchange hash from the very first key exchange is also
5841 * the session id, used in session key construction and
5844 if (!s->got_session_id) {
5845 assert(sizeof(s->exchange_hash) <= sizeof(ssh->v2_session_id));
5846 memcpy(ssh->v2_session_id, s->exchange_hash,
5847 sizeof(s->exchange_hash));
5848 ssh->v2_session_id_len = ssh->kex->hash->hlen;
5849 assert(ssh->v2_session_id_len <= sizeof(ssh->v2_session_id));
5850 s->got_session_id = TRUE;
5854 * Send SSH2_MSG_NEWKEYS.
5856 s->pktout = ssh2_pkt_init(SSH2_MSG_NEWKEYS);
5857 ssh2_pkt_send_noqueue(ssh, s->pktout);
5858 ssh->outgoing_data_size = 0; /* start counting from here */
5861 * We've sent client NEWKEYS, so create and initialise
5862 * client-to-server session keys.
5864 if (ssh->cs_cipher_ctx)
5865 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
5866 ssh->cscipher = s->cscipher_tobe;
5867 ssh->cs_cipher_ctx = ssh->cscipher->make_context();
5869 if (ssh->cs_mac_ctx)
5870 ssh->csmac->free_context(ssh->cs_mac_ctx);
5871 ssh->csmac = s->csmac_tobe;
5872 ssh->cs_mac_ctx = ssh->csmac->make_context();
5874 if (ssh->cs_comp_ctx)
5875 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
5876 ssh->cscomp = s->cscomp_tobe;
5877 ssh->cs_comp_ctx = ssh->cscomp->compress_init();
5880 * Set IVs on client-to-server keys. Here we use the exchange
5881 * hash from the _first_ key exchange.
5884 unsigned char keyspace[SSH2_KEX_MAX_HASH_LEN * SSH2_MKKEY_ITERS];
5885 assert(sizeof(keyspace) >= ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5886 ssh2_mkkey(ssh,s->K,s->exchange_hash,'C',keyspace);
5887 assert((ssh->cscipher->keylen+7) / 8 <=
5888 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5889 ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace);
5890 ssh2_mkkey(ssh,s->K,s->exchange_hash,'A',keyspace);
5891 assert(ssh->cscipher->blksize <=
5892 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5893 ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace);
5894 ssh2_mkkey(ssh,s->K,s->exchange_hash,'E',keyspace);
5895 assert(ssh->csmac->len <=
5896 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5897 ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace);
5898 memset(keyspace, 0, sizeof(keyspace));
5901 logeventf(ssh, "Initialised %.200s client->server encryption",
5902 ssh->cscipher->text_name);
5903 logeventf(ssh, "Initialised %.200s client->server MAC algorithm",
5904 ssh->csmac->text_name);
5905 if (ssh->cscomp->text_name)
5906 logeventf(ssh, "Initialised %s compression",
5907 ssh->cscomp->text_name);
5910 * Now our end of the key exchange is complete, we can send all
5911 * our queued higher-layer packets.
5913 ssh->queueing = FALSE;
5914 ssh2_pkt_queuesend(ssh);
5917 * Expect SSH2_MSG_NEWKEYS from server.
5920 if (pktin->type != SSH2_MSG_NEWKEYS) {
5921 bombout(("expected new-keys packet from server"));
5924 ssh->incoming_data_size = 0; /* start counting from here */
5927 * We've seen server NEWKEYS, so create and initialise
5928 * server-to-client session keys.
5930 if (ssh->sc_cipher_ctx)
5931 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
5932 ssh->sccipher = s->sccipher_tobe;
5933 ssh->sc_cipher_ctx = ssh->sccipher->make_context();
5935 if (ssh->sc_mac_ctx)
5936 ssh->scmac->free_context(ssh->sc_mac_ctx);
5937 ssh->scmac = s->scmac_tobe;
5938 ssh->sc_mac_ctx = ssh->scmac->make_context();
5940 if (ssh->sc_comp_ctx)
5941 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
5942 ssh->sccomp = s->sccomp_tobe;
5943 ssh->sc_comp_ctx = ssh->sccomp->decompress_init();
5946 * Set IVs on server-to-client keys. Here we use the exchange
5947 * hash from the _first_ key exchange.
5950 unsigned char keyspace[SSH2_KEX_MAX_HASH_LEN * SSH2_MKKEY_ITERS];
5951 assert(sizeof(keyspace) >= ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5952 ssh2_mkkey(ssh,s->K,s->exchange_hash,'D',keyspace);
5953 assert((ssh->sccipher->keylen+7) / 8 <=
5954 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5955 ssh->sccipher->setkey(ssh->sc_cipher_ctx, keyspace);
5956 ssh2_mkkey(ssh,s->K,s->exchange_hash,'B',keyspace);
5957 assert(ssh->sccipher->blksize <=
5958 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5959 ssh->sccipher->setiv(ssh->sc_cipher_ctx, keyspace);
5960 ssh2_mkkey(ssh,s->K,s->exchange_hash,'F',keyspace);
5961 assert(ssh->scmac->len <=
5962 ssh->kex->hash->hlen * SSH2_MKKEY_ITERS);
5963 ssh->scmac->setkey(ssh->sc_mac_ctx, keyspace);
5964 memset(keyspace, 0, sizeof(keyspace));
5966 logeventf(ssh, "Initialised %.200s server->client encryption",
5967 ssh->sccipher->text_name);
5968 logeventf(ssh, "Initialised %.200s server->client MAC algorithm",
5969 ssh->scmac->text_name);
5970 if (ssh->sccomp->text_name)
5971 logeventf(ssh, "Initialised %s decompression",
5972 ssh->sccomp->text_name);
5975 * Free shared secret.
5980 * Key exchange is over. Loop straight back round if we have a
5981 * deferred rekey reason.
5983 if (ssh->deferred_rekey_reason) {
5984 logevent(ssh->deferred_rekey_reason);
5986 ssh->deferred_rekey_reason = NULL;
5987 goto begin_key_exchange;
5991 * Otherwise, schedule a timer for our next rekey.
5993 ssh->kex_in_progress = FALSE;
5994 ssh->last_rekey = GETTICKCOUNT();
5995 if (ssh->cfg.ssh_rekey_time != 0)
5996 ssh->next_rekey = schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
6000 * If this is the first key exchange phase, we must pass the
6001 * SSH2_MSG_NEWKEYS packet to the next layer, not because it
6002 * wants to see it but because it will need time to initialise
6003 * itself before it sees an actual packet. In subsequent key
6004 * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because
6005 * it would only confuse the layer above.
6007 if (s->activated_authconn) {
6010 s->activated_authconn = TRUE;
6013 * Now we're encrypting. Begin returning 1 to the protocol main
6014 * function so that other things can run on top of the
6015 * transport. If we ever see a KEXINIT, we must go back to the
6018 * We _also_ go back to the start if we see pktin==NULL and
6019 * inlen==-1, because this is a special signal meaning
6020 * `initiate client-driven rekey', and `in' contains a message
6021 * giving the reason for the rekey.
6023 while (!((pktin && pktin->type == SSH2_MSG_KEXINIT) ||
6024 (!pktin && inlen == -1))) {
6029 logevent("Server initiated key re-exchange");
6032 * Special case: if the server bug is set that doesn't
6033 * allow rekeying, we give a different log message and
6034 * continue waiting. (If such a server _initiates_ a rekey,
6035 * we process it anyway!)
6037 if ((ssh->remote_bugs & BUG_SSH2_REKEY)) {
6038 logeventf(ssh, "Server bug prevents key re-exchange (%s)",
6040 /* Reset the counters, so that at least this message doesn't
6041 * hit the event log _too_ often. */
6042 ssh->outgoing_data_size = 0;
6043 ssh->incoming_data_size = 0;
6044 if (ssh->cfg.ssh_rekey_time != 0) {
6046 schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
6049 goto wait_for_rekey; /* this is utterly horrid */
6051 logeventf(ssh, "Initiating key re-exchange (%s)", (char *)in);
6054 goto begin_key_exchange;
6060 * Add data to an SSH-2 channel output buffer.
6062 static void ssh2_add_channel_data(struct ssh_channel *c, char *buf,
6065 bufchain_add(&c->v.v2.outbuffer, buf, len);
6069 * Attempt to send data on an SSH-2 channel.
6071 static int ssh2_try_send(struct ssh_channel *c)
6074 struct Packet *pktout;
6076 while (c->v.v2.remwindow > 0 && bufchain_size(&c->v.v2.outbuffer) > 0) {
6079 bufchain_prefix(&c->v.v2.outbuffer, &data, &len);
6080 if ((unsigned)len > c->v.v2.remwindow)
6081 len = c->v.v2.remwindow;
6082 if ((unsigned)len > c->v.v2.remmaxpkt)
6083 len = c->v.v2.remmaxpkt;
6084 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_DATA);
6085 ssh2_pkt_adduint32(pktout, c->remoteid);
6086 dont_log_data(ssh, pktout, PKTLOG_OMIT);
6087 ssh2_pkt_addstring_start(pktout);
6088 ssh2_pkt_addstring_data(pktout, data, len);
6089 end_log_omission(ssh, pktout);
6090 ssh2_pkt_send(ssh, pktout);
6091 bufchain_consume(&c->v.v2.outbuffer, len);
6092 c->v.v2.remwindow -= len;
6096 * After having sent as much data as we can, return the amount
6099 return bufchain_size(&c->v.v2.outbuffer);
6102 static void ssh2_try_send_and_unthrottle(struct ssh_channel *c)
6106 return; /* don't send on closing channels */
6107 bufsize = ssh2_try_send(c);
6110 case CHAN_MAINSESSION:
6111 /* stdin need not receive an unthrottle
6112 * notification since it will be polled */
6115 x11_unthrottle(c->u.x11.s);
6118 /* agent sockets are request/response and need no
6119 * buffer management */
6122 pfd_unthrottle(c->u.pfd.s);
6129 * Potentially enlarge the window on an SSH-2 channel.
6131 static void ssh2_set_window(struct ssh_channel *c, unsigned newwin)
6136 * Never send WINDOW_ADJUST for a channel that the remote side
6137 * already thinks it's closed; there's no point, since it won't
6138 * be sending any more data anyway.
6144 * Only send a WINDOW_ADJUST if there's significantly more window
6145 * available than the other end thinks there is. This saves us
6146 * sending a WINDOW_ADJUST for every character in a shell session.
6148 * "Significant" is arbitrarily defined as half the window size.
6150 if (newwin > c->v.v2.locwindow * 2) {
6151 struct Packet *pktout;
6153 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
6154 ssh2_pkt_adduint32(pktout, c->remoteid);
6155 ssh2_pkt_adduint32(pktout, newwin - c->v.v2.locwindow);
6156 ssh2_pkt_send(ssh, pktout);
6157 c->v.v2.locwindow = newwin;
6161 static void ssh2_msg_channel_window_adjust(Ssh ssh, struct Packet *pktin)
6163 unsigned i = ssh_pkt_getuint32(pktin);
6164 struct ssh_channel *c;
6165 c = find234(ssh->channels, &i, ssh_channelfind);
6166 if (c && !c->closes) {
6167 c->v.v2.remwindow += ssh_pkt_getuint32(pktin);
6168 ssh2_try_send_and_unthrottle(c);
6172 static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin)
6176 unsigned i = ssh_pkt_getuint32(pktin);
6177 struct ssh_channel *c;
6178 c = find234(ssh->channels, &i, ssh_channelfind);
6180 return; /* nonexistent channel */
6181 if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA &&
6182 ssh_pkt_getuint32(pktin) != SSH2_EXTENDED_DATA_STDERR)
6183 return; /* extended but not stderr */
6184 ssh_pkt_getstring(pktin, &data, &length);
6187 c->v.v2.locwindow -= length;
6189 case CHAN_MAINSESSION:
6191 from_backend(ssh->frontend, pktin->type ==
6192 SSH2_MSG_CHANNEL_EXTENDED_DATA,
6196 bufsize = x11_send(c->u.x11.s, data, length);
6199 bufsize = pfd_send(c->u.pfd.s, data, length);
6202 while (length > 0) {
6203 if (c->u.a.lensofar < 4) {
6204 unsigned int l = min(4 - c->u.a.lensofar,
6206 memcpy(c->u.a.msglen + c->u.a.lensofar,
6210 c->u.a.lensofar += l;
6212 if (c->u.a.lensofar == 4) {
6214 4 + GET_32BIT(c->u.a.msglen);
6215 c->u.a.message = snewn(c->u.a.totallen,
6217 memcpy(c->u.a.message, c->u.a.msglen, 4);
6219 if (c->u.a.lensofar >= 4 && length > 0) {
6221 min(c->u.a.totallen - c->u.a.lensofar,
6223 memcpy(c->u.a.message + c->u.a.lensofar,
6227 c->u.a.lensofar += l;
6229 if (c->u.a.lensofar == c->u.a.totallen) {
6232 if (agent_query(c->u.a.message,
6235 ssh_agentf_callback, c))
6236 ssh_agentf_callback(c, reply, replylen);
6237 sfree(c->u.a.message);
6238 c->u.a.lensofar = 0;
6245 * If we are not buffering too much data,
6246 * enlarge the window again at the remote side.
6248 if (bufsize < OUR_V2_WINSIZE)
6249 ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
6253 static void ssh2_msg_channel_eof(Ssh ssh, struct Packet *pktin)
6255 unsigned i = ssh_pkt_getuint32(pktin);
6256 struct ssh_channel *c;
6258 c = find234(ssh->channels, &i, ssh_channelfind);
6260 return; /* nonexistent channel */
6262 if (c->type == CHAN_X11) {
6264 * Remote EOF on an X11 channel means we should
6265 * wrap up and close the channel ourselves.
6267 x11_close(c->u.x11.s);
6269 } else if (c->type == CHAN_AGENT) {
6271 } else if (c->type == CHAN_SOCKDATA) {
6272 pfd_close(c->u.pfd.s);
6277 static void ssh2_msg_channel_close(Ssh ssh, struct Packet *pktin)
6279 unsigned i = ssh_pkt_getuint32(pktin);
6280 struct ssh_channel *c;
6281 struct Packet *pktout;
6283 c = find234(ssh->channels, &i, ssh_channelfind);
6284 if (!c || c->halfopen) {
6285 bombout(("Received CHANNEL_CLOSE for %s channel %d\n",
6286 c ? "half-open" : "nonexistent", i));
6289 /* Do pre-close processing on the channel. */
6291 case CHAN_MAINSESSION:
6292 ssh->mainchan = NULL;
6293 update_specials_menu(ssh->frontend);
6296 if (c->u.x11.s != NULL)
6297 x11_close(c->u.x11.s);
6304 if (c->u.pfd.s != NULL)
6305 pfd_close(c->u.pfd.s);
6309 if (c->closes == 0) {
6310 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6311 ssh2_pkt_adduint32(pktout, c->remoteid);
6312 ssh2_pkt_send(ssh, pktout);
6314 del234(ssh->channels, c);
6315 bufchain_clear(&c->v.v2.outbuffer);
6319 * See if that was the last channel left open.
6320 * (This is only our termination condition if we're
6321 * not running in -N mode.)
6323 if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) {
6325 * We used to send SSH_MSG_DISCONNECT here,
6326 * because I'd believed that _every_ conforming
6327 * SSH-2 connection had to end with a disconnect
6328 * being sent by at least one side; apparently
6329 * I was wrong and it's perfectly OK to
6330 * unceremoniously slam the connection shut
6331 * when you're done, and indeed OpenSSH feels
6332 * this is more polite than sending a
6333 * DISCONNECT. So now we don't.
6335 ssh_disconnect(ssh, "All channels closed", NULL, 0, TRUE);
6339 static void ssh2_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
6341 unsigned i = ssh_pkt_getuint32(pktin);
6342 struct ssh_channel *c;
6343 struct Packet *pktout;
6345 c = find234(ssh->channels, &i, ssh_channelfind);
6347 return; /* nonexistent channel */
6348 if (c->type != CHAN_SOCKDATA_DORMANT)
6349 return; /* dunno why they're confirming this */
6350 c->remoteid = ssh_pkt_getuint32(pktin);
6351 c->halfopen = FALSE;
6352 c->type = CHAN_SOCKDATA;
6353 c->v.v2.remwindow = ssh_pkt_getuint32(pktin);
6354 c->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
6356 pfd_confirm(c->u.pfd.s);
6359 * We have a pending close on this channel,
6360 * which we decided on before the server acked
6361 * the channel open. So now we know the
6362 * remoteid, we can close it again.
6364 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6365 ssh2_pkt_adduint32(pktout, c->remoteid);
6366 ssh2_pkt_send(ssh, pktout);
6370 static void ssh2_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
6372 static const char *const reasons[] = {
6373 "<unknown reason code>",
6374 "Administratively prohibited",
6376 "Unknown channel type",
6377 "Resource shortage",
6379 unsigned i = ssh_pkt_getuint32(pktin);
6380 unsigned reason_code;
6381 char *reason_string;
6383 struct ssh_channel *c;
6384 c = find234(ssh->channels, &i, ssh_channelfind);
6386 return; /* nonexistent channel */
6387 if (c->type != CHAN_SOCKDATA_DORMANT)
6388 return; /* dunno why they're failing this */
6390 reason_code = ssh_pkt_getuint32(pktin);
6391 if (reason_code >= lenof(reasons))
6392 reason_code = 0; /* ensure reasons[reason_code] in range */
6393 ssh_pkt_getstring(pktin, &reason_string, &reason_length);
6394 logeventf(ssh, "Forwarded connection refused by server: %s [%.*s]",
6395 reasons[reason_code], reason_length, reason_string);
6397 pfd_close(c->u.pfd.s);
6399 del234(ssh->channels, c);
6403 static void ssh2_msg_channel_request(Ssh ssh, struct Packet *pktin)
6407 int typelen, want_reply;
6408 int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */
6409 struct ssh_channel *c;
6410 struct Packet *pktout;
6412 localid = ssh_pkt_getuint32(pktin);
6413 ssh_pkt_getstring(pktin, &type, &typelen);
6414 want_reply = ssh2_pkt_getbool(pktin);
6417 * First, check that the channel exists. Otherwise,
6418 * we can instantly disconnect with a rude message.
6420 c = find234(ssh->channels, &localid, ssh_channelfind);
6422 char *buf = dupprintf("Received channel request for nonexistent"
6423 " channel %d", localid);
6424 ssh_disconnect(ssh, NULL, buf, SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6430 * Having got the channel number, we now look at
6431 * the request type string to see if it's something
6434 if (c == ssh->mainchan) {
6436 * We recognise "exit-status" and "exit-signal" on
6437 * the primary channel.
6439 if (typelen == 11 &&
6440 !memcmp(type, "exit-status", 11)) {
6442 ssh->exitcode = ssh_pkt_getuint32(pktin);
6443 logeventf(ssh, "Server sent command exit status %d",
6445 reply = SSH2_MSG_CHANNEL_SUCCESS;
6447 } else if (typelen == 11 &&
6448 !memcmp(type, "exit-signal", 11)) {
6450 int is_plausible = TRUE, is_int = FALSE;
6451 char *fmt_sig = "", *fmt_msg = "";
6453 int msglen = 0, core = FALSE;
6454 /* ICK: older versions of OpenSSH (e.g. 3.4p1)
6455 * provide an `int' for the signal, despite its
6456 * having been a `string' in the drafts since at
6457 * least 2001. (Fixed in session.c 1.147.) Try to
6458 * infer which we can safely parse it as. */
6460 unsigned char *p = pktin->body +
6462 long len = pktin->length - pktin->savedpos;
6463 unsigned long num = GET_32BIT(p); /* what is it? */
6464 /* If it's 0, it hardly matters; assume string */
6468 int maybe_int = FALSE, maybe_str = FALSE;
6469 #define CHECK_HYPOTHESIS(offset, result) \
6472 if (q >= 0 && q+4 <= len) { \
6473 q = q + 4 + GET_32BIT(p+q); \
6474 if (q >= 0 && q+4 <= len && \
6475 ((q = q + 4 + GET_32BIT(p+q))!= 0) && q == len) \
6479 CHECK_HYPOTHESIS(4+1, maybe_int);
6480 CHECK_HYPOTHESIS(4+num+1, maybe_str);
6481 #undef CHECK_HYPOTHESIS
6482 if (maybe_int && !maybe_str)
6484 else if (!maybe_int && maybe_str)
6487 /* Crikey. Either or neither. Panic. */
6488 is_plausible = FALSE;
6491 ssh->exitcode = 128; /* means `unknown signal' */
6494 /* Old non-standard OpenSSH. */
6495 int signum = ssh_pkt_getuint32(pktin);
6496 fmt_sig = dupprintf(" %d", signum);
6497 ssh->exitcode = 128 + signum;
6499 /* As per the drafts. */
6502 ssh_pkt_getstring(pktin, &sig, &siglen);
6503 /* Signal name isn't supposed to be blank, but
6504 * let's cope gracefully if it is. */
6506 fmt_sig = dupprintf(" \"%.*s\"",
6511 * Really hideous method of translating the
6512 * signal description back into a locally
6513 * meaningful number.
6518 #define TRANSLATE_SIGNAL(s) \
6519 else if (siglen == lenof(#s)-1 && !memcmp(sig, #s, siglen)) \
6520 ssh->exitcode = 128 + SIG ## s
6522 TRANSLATE_SIGNAL(ABRT);
6525 TRANSLATE_SIGNAL(ALRM);
6528 TRANSLATE_SIGNAL(FPE);
6531 TRANSLATE_SIGNAL(HUP);
6534 TRANSLATE_SIGNAL(ILL);
6537 TRANSLATE_SIGNAL(INT);
6540 TRANSLATE_SIGNAL(KILL);
6543 TRANSLATE_SIGNAL(PIPE);
6546 TRANSLATE_SIGNAL(QUIT);
6549 TRANSLATE_SIGNAL(SEGV);
6552 TRANSLATE_SIGNAL(TERM);
6555 TRANSLATE_SIGNAL(USR1);
6558 TRANSLATE_SIGNAL(USR2);
6560 #undef TRANSLATE_SIGNAL
6562 ssh->exitcode = 128;
6564 core = ssh2_pkt_getbool(pktin);
6565 ssh_pkt_getstring(pktin, &msg, &msglen);
6567 fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg);
6569 /* ignore lang tag */
6570 } /* else don't attempt to parse */
6571 logeventf(ssh, "Server exited on signal%s%s%s",
6572 fmt_sig, core ? " (core dumped)" : "",
6574 if (*fmt_sig) sfree(fmt_sig);
6575 if (*fmt_msg) sfree(fmt_msg);
6576 reply = SSH2_MSG_CHANNEL_SUCCESS;
6581 * This is a channel request we don't know
6582 * about, so we now either ignore the request
6583 * or respond with CHANNEL_FAILURE, depending
6586 reply = SSH2_MSG_CHANNEL_FAILURE;
6589 pktout = ssh2_pkt_init(reply);
6590 ssh2_pkt_adduint32(pktout, c->remoteid);
6591 ssh2_pkt_send(ssh, pktout);
6595 static void ssh2_msg_global_request(Ssh ssh, struct Packet *pktin)
6598 int typelen, want_reply;
6599 struct Packet *pktout;
6601 ssh_pkt_getstring(pktin, &type, &typelen);
6602 want_reply = ssh2_pkt_getbool(pktin);
6605 * We currently don't support any global requests
6606 * at all, so we either ignore the request or
6607 * respond with REQUEST_FAILURE, depending on
6611 pktout = ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE);
6612 ssh2_pkt_send(ssh, pktout);
6616 static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin)
6624 struct ssh_channel *c;
6625 unsigned remid, winsize, pktsize;
6626 struct Packet *pktout;
6628 ssh_pkt_getstring(pktin, &type, &typelen);
6629 c = snew(struct ssh_channel);
6632 remid = ssh_pkt_getuint32(pktin);
6633 winsize = ssh_pkt_getuint32(pktin);
6634 pktsize = ssh_pkt_getuint32(pktin);
6636 if (typelen == 3 && !memcmp(type, "x11", 3)) {
6639 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
6640 addrstr = snewn(peeraddrlen+1, char);
6641 memcpy(addrstr, peeraddr, peeraddrlen);
6642 addrstr[peeraddrlen] = '\0';
6643 peerport = ssh_pkt_getuint32(pktin);
6645 logeventf(ssh, "Received X11 connect request from %s:%d",
6648 if (!ssh->X11_fwd_enabled)
6649 error = "X11 forwarding is not enabled";
6650 else if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c,
6651 ssh->x11auth, addrstr, peerport,
6652 &ssh->cfg) != NULL) {
6653 error = "Unable to open an X11 connection";
6655 logevent("Opening X11 forward connection succeeded");
6660 } else if (typelen == 15 &&
6661 !memcmp(type, "forwarded-tcpip", 15)) {
6662 struct ssh_rportfwd pf, *realpf;
6665 ssh_pkt_getstring(pktin, &dummy, &dummylen);/* skip address */
6666 pf.sport = ssh_pkt_getuint32(pktin);
6667 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
6668 peerport = ssh_pkt_getuint32(pktin);
6669 realpf = find234(ssh->rportfwds, &pf, NULL);
6670 logeventf(ssh, "Received remote port %d open request "
6671 "from %s:%d", pf.sport, peeraddr, peerport);
6672 if (realpf == NULL) {
6673 error = "Remote port is not recognised";
6675 const char *e = pfd_newconnect(&c->u.pfd.s,
6679 realpf->pfrec->addressfamily);
6680 logeventf(ssh, "Attempting to forward remote port to "
6681 "%s:%d", realpf->dhost, realpf->dport);
6683 logeventf(ssh, "Port open failed: %s", e);
6684 error = "Port open failed";
6686 logevent("Forwarded port opened successfully");
6687 c->type = CHAN_SOCKDATA;
6690 } else if (typelen == 22 &&
6691 !memcmp(type, "auth-agent@openssh.com", 22)) {
6692 if (!ssh->agentfwd_enabled)
6693 error = "Agent forwarding is not enabled";
6695 c->type = CHAN_AGENT; /* identify channel type */
6696 c->u.a.lensofar = 0;
6699 error = "Unsupported channel type requested";
6702 c->remoteid = remid;
6703 c->halfopen = FALSE;
6705 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE);
6706 ssh2_pkt_adduint32(pktout, c->remoteid);
6707 ssh2_pkt_adduint32(pktout, SSH2_OPEN_CONNECT_FAILED);
6708 ssh2_pkt_addstring(pktout, error);
6709 ssh2_pkt_addstring(pktout, "en"); /* language tag */
6710 ssh2_pkt_send(ssh, pktout);
6711 logeventf(ssh, "Rejected channel open: %s", error);
6714 c->localid = alloc_channel_id(ssh);
6716 c->v.v2.locwindow = OUR_V2_WINSIZE;
6717 c->v.v2.remwindow = winsize;
6718 c->v.v2.remmaxpkt = pktsize;
6719 bufchain_init(&c->v.v2.outbuffer);
6720 add234(ssh->channels, c);
6721 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
6722 ssh2_pkt_adduint32(pktout, c->remoteid);
6723 ssh2_pkt_adduint32(pktout, c->localid);
6724 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);
6725 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
6726 ssh2_pkt_send(ssh, pktout);
6731 * Buffer banner messages for later display at some convenient point.
6733 static void ssh2_msg_userauth_banner(Ssh ssh, struct Packet *pktin)
6735 /* Arbitrary limit to prevent unbounded inflation of buffer */
6736 if (bufchain_size(&ssh->banner) <= 131072) {
6737 char *banner = NULL;
6739 ssh_pkt_getstring(pktin, &banner, &size);
6741 bufchain_add(&ssh->banner, banner, size);
6745 /* Helper function to deal with sending tty modes for "pty-req" */
6746 static void ssh2_send_ttymode(void *data, char *mode, char *val)
6748 struct Packet *pktout = (struct Packet *)data;
6750 unsigned int arg = 0;
6751 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
6752 if (i == lenof(ssh_ttymodes)) return;
6753 switch (ssh_ttymodes[i].type) {
6755 arg = ssh_tty_parse_specchar(val);
6758 arg = ssh_tty_parse_boolean(val);
6761 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
6762 ssh2_pkt_adduint32(pktout, arg);
6766 * Handle the SSH-2 userauth and connection layers.
6768 static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
6769 struct Packet *pktin)
6771 struct do_ssh2_authconn_state {
6774 AUTH_TYPE_PUBLICKEY,
6775 AUTH_TYPE_PUBLICKEY_OFFER_LOUD,
6776 AUTH_TYPE_PUBLICKEY_OFFER_QUIET,
6778 AUTH_TYPE_KEYBOARD_INTERACTIVE,
6779 AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
6781 int done_service_req;
6782 int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter;
6783 int tried_pubkey_config, done_agent;
6784 int kbd_inter_refused;
6786 prompts_t *cur_prompt;
6791 void *publickey_blob;
6792 int publickey_bloblen;
6793 int publickey_encrypted;
6794 char *publickey_algorithm;
6795 char *publickey_comment;
6796 unsigned char agent_request[5], *agent_response, *agentp;
6797 int agent_responselen;
6798 unsigned char *pkblob_in_agent;
6800 char *pkblob, *alg, *commentp;
6801 int pklen, alglen, commentlen;
6802 int siglen, retlen, len;
6803 char *q, *agentreq, *ret;
6805 int num_env, env_left, env_ok;
6806 struct Packet *pktout;
6808 crState(do_ssh2_authconn_state);
6810 crBegin(ssh->do_ssh2_authconn_crstate);
6812 s->done_service_req = FALSE;
6813 s->we_are_in = FALSE;
6814 if (!ssh->cfg.ssh_no_userauth) {
6816 * Request userauth protocol, and await a response to it.
6818 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
6819 ssh2_pkt_addstring(s->pktout, "ssh-userauth");
6820 ssh2_pkt_send(ssh, s->pktout);
6821 crWaitUntilV(pktin);
6822 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT)
6823 s->done_service_req = TRUE;
6825 if (!s->done_service_req) {
6827 * Request connection protocol directly, without authentication.
6829 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
6830 ssh2_pkt_addstring(s->pktout, "ssh-connection");
6831 ssh2_pkt_send(ssh, s->pktout);
6832 crWaitUntilV(pktin);
6833 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT) {
6834 s->we_are_in = TRUE; /* no auth required */
6836 bombout(("Server refused service request"));
6841 /* Arrange to be able to deal with any BANNERs that come in.
6842 * (We do this now as packets may come in during the next bit.) */
6843 bufchain_init(&ssh->banner);
6844 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] =
6845 ssh2_msg_userauth_banner;
6848 * Misc one-time setup for authentication.
6850 s->publickey_blob = NULL;
6851 if (!s->we_are_in) {
6854 * Load the public half of any configured public key file
6857 if (!filename_is_null(ssh->cfg.keyfile)) {
6859 logeventf(ssh, "Reading private key file \"%.150s\"",
6860 filename_to_str(&ssh->cfg.keyfile));
6861 keytype = key_type(&ssh->cfg.keyfile);
6862 if (keytype == SSH_KEYTYPE_SSH2) {
6865 ssh2_userkey_loadpub(&ssh->cfg.keyfile,
6866 &s->publickey_algorithm,
6867 &s->publickey_bloblen,
6868 &s->publickey_comment, &error);
6869 if (s->publickey_blob) {
6870 s->publickey_encrypted =
6871 ssh2_userkey_encrypted(&ssh->cfg.keyfile, NULL);
6874 logeventf(ssh, "Unable to load private key (%s)",
6876 msgbuf = dupprintf("Unable to load private key file "
6877 "\"%.150s\" (%s)\r\n",
6878 filename_to_str(&ssh->cfg.keyfile),
6880 c_write_str(ssh, msgbuf);
6885 logeventf(ssh, "Unable to use this key file (%s)",
6886 key_type_to_str(keytype));
6887 msgbuf = dupprintf("Unable to use key file \"%.150s\""
6889 filename_to_str(&ssh->cfg.keyfile),
6890 key_type_to_str(keytype));
6891 c_write_str(ssh, msgbuf);
6893 s->publickey_blob = NULL;
6898 * Find out about any keys Pageant has (but if there's a
6899 * public key configured, filter out all others).
6902 s->agent_response = NULL;
6903 s->pkblob_in_agent = NULL;
6904 if (ssh->cfg.tryagent && agent_exists()) {
6908 logevent("Pageant is running. Requesting keys.");
6910 /* Request the keys held by the agent. */
6911 PUT_32BIT(s->agent_request, 1);
6912 s->agent_request[4] = SSH2_AGENTC_REQUEST_IDENTITIES;
6913 if (!agent_query(s->agent_request, 5, &r, &s->agent_responselen,
6914 ssh_agent_callback, ssh)) {
6918 bombout(("Unexpected data from server while"
6919 " waiting for agent response"));
6922 } while (pktin || inlen > 0);
6923 r = ssh->agent_response;
6924 s->agent_responselen = ssh->agent_response_len;
6926 s->agent_response = (unsigned char *) r;
6927 if (s->agent_response && s->agent_responselen >= 5 &&
6928 s->agent_response[4] == SSH2_AGENT_IDENTITIES_ANSWER) {
6931 p = s->agent_response + 5;
6932 s->nkeys = GET_32BIT(p);
6934 logeventf(ssh, "Pageant has %d SSH-2 keys", s->nkeys);
6935 if (s->publickey_blob) {
6936 /* See if configured key is in agent. */
6937 for (keyi = 0; keyi < s->nkeys; keyi++) {
6938 s->pklen = GET_32BIT(p);
6939 if (s->pklen == s->publickey_bloblen &&
6940 !memcmp(p+4, s->publickey_blob,
6941 s->publickey_bloblen)) {
6942 logeventf(ssh, "Pageant key #%d matches "
6943 "configured key file", keyi);
6945 s->pkblob_in_agent = p;
6949 p += GET_32BIT(p) + 4; /* comment */
6951 if (!s->pkblob_in_agent) {
6952 logevent("Configured key file not in Pageant");
6962 * We repeat this whole loop, including the username prompt,
6963 * until we manage a successful authentication. If the user
6964 * types the wrong _password_, they can be sent back to the
6965 * beginning to try another username, if this is configured on.
6966 * (If they specify a username in the config, they are never
6967 * asked, even if they do give a wrong password.)
6969 * I think this best serves the needs of
6971 * - the people who have no configuration, no keys, and just
6972 * want to try repeated (username,password) pairs until they
6973 * type both correctly
6975 * - people who have keys and configuration but occasionally
6976 * need to fall back to passwords
6978 * - people with a key held in Pageant, who might not have
6979 * logged in to a particular machine before; so they want to
6980 * type a username, and then _either_ their key will be
6981 * accepted, _or_ they will type a password. If they mistype
6982 * the username they will want to be able to get back and
6985 s->username[0] = '\0';
6986 s->got_username = FALSE;
6987 while (!s->we_are_in) {
6991 if (s->got_username && !ssh->cfg.change_username) {
6993 * We got a username last time round this loop, and
6994 * with change_username turned off we don't try to get
6997 } else if (!*ssh->cfg.username) {
6998 int ret; /* need not be kept over crReturn */
6999 s->cur_prompt = new_prompts(ssh->frontend);
7000 s->cur_prompt->to_server = TRUE;
7001 s->cur_prompt->name = dupstr("SSH login name");
7002 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
7003 lenof(s->username));
7004 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7007 crWaitUntilV(!pktin);
7008 ret = get_userpass_input(s->cur_prompt, in, inlen);
7013 * get_userpass_input() failed to get a username.
7016 free_prompts(s->cur_prompt);
7017 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
7020 memcpy(s->username, s->cur_prompt->prompts[0]->result,
7021 lenof(s->username));
7022 free_prompts(s->cur_prompt);
7025 strncpy(s->username, ssh->cfg.username, sizeof(s->username));
7026 s->username[sizeof(s->username)-1] = '\0';
7027 if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
7028 stuff = dupprintf("Using username \"%s\".\r\n", s->username);
7029 c_write_str(ssh, stuff);
7033 s->got_username = TRUE;
7036 * Send an authentication request using method "none": (a)
7037 * just in case it succeeds, and (b) so that we know what
7038 * authentication methods we can usefully try next.
7040 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7042 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7043 ssh2_pkt_addstring(s->pktout, s->username);
7044 ssh2_pkt_addstring(s->pktout, "ssh-connection");/* service requested */
7045 ssh2_pkt_addstring(s->pktout, "none"); /* method */
7046 ssh2_pkt_send(ssh, s->pktout);
7047 s->type = AUTH_TYPE_NONE;
7049 s->we_are_in = FALSE;
7051 s->tried_pubkey_config = FALSE;
7052 s->kbd_inter_refused = FALSE;
7054 /* Reset agent request state. */
7055 s->done_agent = FALSE;
7056 if (s->agent_response) {
7057 if (s->pkblob_in_agent) {
7058 s->agentp = s->pkblob_in_agent;
7060 s->agentp = s->agent_response + 5 + 4;
7067 * Wait for the result of the last authentication request.
7070 crWaitUntilV(pktin);
7072 * Now is a convenient point to spew any banner material
7073 * that we've accumulated. (This should ensure that when
7074 * we exit the auth loop, we haven't any left to deal
7078 int size = bufchain_size(&ssh->banner);
7080 * Don't show the banner if we're operating in
7081 * non-verbose non-interactive mode. (It's probably
7082 * a script, which means nobody will read the
7083 * banner _anyway_, and moreover the printing of
7084 * the banner will screw up processing on the
7085 * output of (say) plink.)
7087 if (size && (flags & (FLAG_VERBOSE | FLAG_INTERACTIVE))) {
7088 char *banner = snewn(size, char);
7089 bufchain_fetch(&ssh->banner, banner, size);
7090 c_write_untrusted(ssh, banner, size);
7093 bufchain_clear(&ssh->banner);
7095 if (pktin->type == SSH2_MSG_USERAUTH_SUCCESS) {
7096 logevent("Access granted");
7097 s->we_are_in = TRUE;
7101 if (pktin->type != SSH2_MSG_USERAUTH_FAILURE) {
7102 bombout(("Strange packet received during authentication: "
7103 "type %d", pktin->type));
7110 * OK, we're now sitting on a USERAUTH_FAILURE message, so
7111 * we can look at the string in it and know what we can
7112 * helpfully try next.
7114 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE) {
7117 ssh_pkt_getstring(pktin, &methods, &methlen);
7118 if (!ssh2_pkt_getbool(pktin)) {
7120 * We have received an unequivocal Access
7121 * Denied. This can translate to a variety of
7124 * - if we'd just tried "none" authentication,
7125 * it's not worth printing anything at all
7127 * - if we'd just tried a public key _offer_,
7128 * the message should be "Server refused our
7129 * key" (or no message at all if the key
7130 * came from Pageant)
7132 * - if we'd just tried anything else, the
7133 * message really should be "Access denied".
7135 * Additionally, if we'd just tried password
7136 * authentication, we should break out of this
7137 * whole loop so as to go back to the username
7138 * prompt (iff we're configured to allow
7139 * username change attempts).
7141 if (s->type == AUTH_TYPE_NONE) {
7143 } else if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD ||
7144 s->type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) {
7145 if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD)
7146 c_write_str(ssh, "Server refused our key\r\n");
7147 logevent("Server refused public key");
7148 } else if (s->type==AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) {
7149 /* server declined keyboard-interactive; ignore */
7151 c_write_str(ssh, "Access denied\r\n");
7152 logevent("Access denied");
7153 if (s->type == AUTH_TYPE_PASSWORD &&
7154 ssh->cfg.change_username) {
7155 /* XXX perhaps we should allow
7156 * keyboard-interactive to do this too? */
7157 s->we_are_in = FALSE;
7162 c_write_str(ssh, "Further authentication required\r\n");
7163 logevent("Further authentication required");
7167 in_commasep_string("publickey", methods, methlen);
7169 in_commasep_string("password", methods, methlen);
7170 s->can_keyb_inter = ssh->cfg.try_ki_auth &&
7171 in_commasep_string("keyboard-interactive", methods, methlen);
7174 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7176 if (s->can_pubkey && !s->done_agent && s->nkeys) {
7179 * Attempt public-key authentication using a key from Pageant.
7182 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7183 ssh->pkt_ctx |= SSH2_PKTCTX_PUBLICKEY;
7185 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
7187 /* Unpack key from agent response */
7188 s->pklen = GET_32BIT(s->agentp);
7190 s->pkblob = (char *)s->agentp;
7191 s->agentp += s->pklen;
7192 s->alglen = GET_32BIT(s->pkblob);
7193 s->alg = s->pkblob + 4;
7194 s->commentlen = GET_32BIT(s->agentp);
7196 s->commentp = (char *)s->agentp;
7197 s->agentp += s->commentlen;
7198 /* s->agentp now points at next key, if any */
7200 /* See if server will accept it */
7201 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7202 ssh2_pkt_addstring(s->pktout, s->username);
7203 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7204 /* service requested */
7205 ssh2_pkt_addstring(s->pktout, "publickey");
7207 ssh2_pkt_addbool(s->pktout, FALSE); /* no signature included */
7208 ssh2_pkt_addstring_start(s->pktout);
7209 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
7210 ssh2_pkt_addstring_start(s->pktout);
7211 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
7212 ssh2_pkt_send(ssh, s->pktout);
7213 s->type = AUTH_TYPE_PUBLICKEY_OFFER_QUIET;
7215 crWaitUntilV(pktin);
7216 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
7218 /* Offer of key refused. */
7225 if (flags & FLAG_VERBOSE) {
7226 c_write_str(ssh, "Authenticating with "
7228 c_write(ssh, s->commentp, s->commentlen);
7229 c_write_str(ssh, "\" from agent\r\n");
7233 * Server is willing to accept the key.
7234 * Construct a SIGN_REQUEST.
7236 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7237 ssh2_pkt_addstring(s->pktout, s->username);
7238 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7239 /* service requested */
7240 ssh2_pkt_addstring(s->pktout, "publickey");
7242 ssh2_pkt_addbool(s->pktout, TRUE); /* signature included */
7243 ssh2_pkt_addstring_start(s->pktout);
7244 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
7245 ssh2_pkt_addstring_start(s->pktout);
7246 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
7248 /* Ask agent for signature. */
7249 s->siglen = s->pktout->length - 5 + 4 +
7250 ssh->v2_session_id_len;
7251 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
7253 s->len = 1; /* message type */
7254 s->len += 4 + s->pklen; /* key blob */
7255 s->len += 4 + s->siglen; /* data to sign */
7256 s->len += 4; /* flags */
7257 s->agentreq = snewn(4 + s->len, char);
7258 PUT_32BIT(s->agentreq, s->len);
7259 s->q = s->agentreq + 4;
7260 *s->q++ = SSH2_AGENTC_SIGN_REQUEST;
7261 PUT_32BIT(s->q, s->pklen);
7263 memcpy(s->q, s->pkblob, s->pklen);
7265 PUT_32BIT(s->q, s->siglen);
7267 /* Now the data to be signed... */
7268 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
7269 PUT_32BIT(s->q, ssh->v2_session_id_len);
7272 memcpy(s->q, ssh->v2_session_id,
7273 ssh->v2_session_id_len);
7274 s->q += ssh->v2_session_id_len;
7275 memcpy(s->q, s->pktout->data + 5,
7276 s->pktout->length - 5);
7277 s->q += s->pktout->length - 5;
7278 /* And finally the (zero) flags word. */
7280 if (!agent_query(s->agentreq, s->len + 4,
7282 ssh_agent_callback, ssh)) {
7286 bombout(("Unexpected data from server"
7287 " while waiting for agent"
7291 } while (pktin || inlen > 0);
7292 vret = ssh->agent_response;
7293 s->retlen = ssh->agent_response_len;
7298 if (s->ret[4] == SSH2_AGENT_SIGN_RESPONSE) {
7299 logevent("Sending Pageant's response");
7300 ssh2_add_sigblob(ssh, s->pktout,
7301 s->pkblob, s->pklen,
7303 GET_32BIT(s->ret + 5));
7304 ssh2_pkt_send(ssh, s->pktout);
7305 s->type = AUTH_TYPE_PUBLICKEY;
7307 /* FIXME: less drastic response */
7308 bombout(("Pageant failed to answer challenge"));
7314 /* Do we have any keys left to try? */
7315 if (s->pkblob_in_agent) {
7316 s->done_agent = TRUE;
7317 s->tried_pubkey_config = TRUE;
7320 if (s->keyi >= s->nkeys)
7321 s->done_agent = TRUE;
7324 } else if (s->can_pubkey && s->publickey_blob &&
7325 !s->tried_pubkey_config) {
7327 struct ssh2_userkey *key; /* not live over crReturn */
7328 char *passphrase; /* not live over crReturn */
7330 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7331 ssh->pkt_ctx |= SSH2_PKTCTX_PUBLICKEY;
7333 s->tried_pubkey_config = TRUE;
7336 * Try the public key supplied in the configuration.
7338 * First, offer the public blob to see if the server is
7339 * willing to accept it.
7341 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7342 ssh2_pkt_addstring(s->pktout, s->username);
7343 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7344 /* service requested */
7345 ssh2_pkt_addstring(s->pktout, "publickey"); /* method */
7346 ssh2_pkt_addbool(s->pktout, FALSE);
7347 /* no signature included */
7348 ssh2_pkt_addstring(s->pktout, s->publickey_algorithm);
7349 ssh2_pkt_addstring_start(s->pktout);
7350 ssh2_pkt_addstring_data(s->pktout,
7351 (char *)s->publickey_blob,
7352 s->publickey_bloblen);
7353 ssh2_pkt_send(ssh, s->pktout);
7354 logevent("Offered public key");
7356 crWaitUntilV(pktin);
7357 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
7358 /* Key refused. Give up. */
7359 s->gotit = TRUE; /* reconsider message next loop */
7360 s->type = AUTH_TYPE_PUBLICKEY_OFFER_LOUD;
7361 continue; /* process this new message */
7363 logevent("Offer of public key accepted");
7366 * Actually attempt a serious authentication using
7369 if (flags & FLAG_VERBOSE) {
7370 c_write_str(ssh, "Authenticating with public key \"");
7371 c_write_str(ssh, s->publickey_comment);
7372 c_write_str(ssh, "\"\r\n");
7376 const char *error; /* not live over crReturn */
7377 if (s->publickey_encrypted) {
7379 * Get a passphrase from the user.
7381 int ret; /* need not be kept over crReturn */
7382 s->cur_prompt = new_prompts(ssh->frontend);
7383 s->cur_prompt->to_server = FALSE;
7384 s->cur_prompt->name = dupstr("SSH key passphrase");
7385 add_prompt(s->cur_prompt,
7386 dupprintf("Passphrase for key \"%.100s\": ",
7387 s->publickey_comment),
7388 FALSE, SSH_MAX_PASSWORD_LEN);
7389 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7392 crWaitUntilV(!pktin);
7393 ret = get_userpass_input(s->cur_prompt,
7398 /* Failed to get a passphrase. Terminate. */
7399 free_prompts(s->cur_prompt);
7400 ssh_disconnect(ssh, NULL,
7401 "Unable to authenticate",
7402 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7407 dupstr(s->cur_prompt->prompts[0]->result);
7408 free_prompts(s->cur_prompt);
7410 passphrase = NULL; /* no passphrase needed */
7414 * Try decrypting the key.
7416 key = ssh2_load_userkey(&ssh->cfg.keyfile, passphrase,
7419 /* burn the evidence */
7420 memset(passphrase, 0, strlen(passphrase));
7423 if (key == SSH2_WRONG_PASSPHRASE || key == NULL) {
7425 (key == SSH2_WRONG_PASSPHRASE)) {
7426 c_write_str(ssh, "Wrong passphrase\r\n");
7428 /* and loop again */
7430 c_write_str(ssh, "Unable to load private key (");
7431 c_write_str(ssh, error);
7432 c_write_str(ssh, ")\r\n");
7434 break; /* try something else */
7440 unsigned char *pkblob, *sigblob, *sigdata;
7441 int pkblob_len, sigblob_len, sigdata_len;
7445 * We have loaded the private key and the server
7446 * has announced that it's willing to accept it.
7447 * Hallelujah. Generate a signature and send it.
7449 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7450 ssh2_pkt_addstring(s->pktout, s->username);
7451 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7452 /* service requested */
7453 ssh2_pkt_addstring(s->pktout, "publickey");
7455 ssh2_pkt_addbool(s->pktout, TRUE);
7456 /* signature follows */
7457 ssh2_pkt_addstring(s->pktout, key->alg->name);
7458 pkblob = key->alg->public_blob(key->data,
7460 ssh2_pkt_addstring_start(s->pktout);
7461 ssh2_pkt_addstring_data(s->pktout, (char *)pkblob,
7465 * The data to be signed is:
7469 * followed by everything so far placed in the
7472 sigdata_len = s->pktout->length - 5 + 4 +
7473 ssh->v2_session_id_len;
7474 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
7476 sigdata = snewn(sigdata_len, unsigned char);
7478 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
7479 PUT_32BIT(sigdata+p, ssh->v2_session_id_len);
7482 memcpy(sigdata+p, ssh->v2_session_id,
7483 ssh->v2_session_id_len);
7484 p += ssh->v2_session_id_len;
7485 memcpy(sigdata+p, s->pktout->data + 5,
7486 s->pktout->length - 5);
7487 p += s->pktout->length - 5;
7488 assert(p == sigdata_len);
7489 sigblob = key->alg->sign(key->data, (char *)sigdata,
7490 sigdata_len, &sigblob_len);
7491 ssh2_add_sigblob(ssh, s->pktout, pkblob, pkblob_len,
7492 sigblob, sigblob_len);
7497 ssh2_pkt_send(ssh, s->pktout);
7498 s->type = AUTH_TYPE_PUBLICKEY;
7499 key->alg->freekey(key->data);
7502 } else if (s->can_keyb_inter && !s->kbd_inter_refused) {
7505 * Keyboard-interactive authentication.
7508 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
7510 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7511 ssh->pkt_ctx |= SSH2_PKTCTX_KBDINTER;
7513 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7514 ssh2_pkt_addstring(s->pktout, s->username);
7515 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7516 /* service requested */
7517 ssh2_pkt_addstring(s->pktout, "keyboard-interactive");
7519 ssh2_pkt_addstring(s->pktout, ""); /* lang */
7520 ssh2_pkt_addstring(s->pktout, ""); /* submethods */
7521 ssh2_pkt_send(ssh, s->pktout);
7523 crWaitUntilV(pktin);
7524 if (pktin->type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
7525 /* Server is not willing to do keyboard-interactive
7526 * at all (or, bizarrely but legally, accepts the
7527 * user without actually issuing any prompts).
7528 * Give up on it entirely. */
7530 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE)
7531 logevent("Keyboard-interactive authentication refused");
7532 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET;
7533 s->kbd_inter_refused = TRUE; /* don't try it again */
7538 * Loop while the server continues to send INFO_REQUESTs.
7540 while (pktin->type == SSH2_MSG_USERAUTH_INFO_REQUEST) {
7542 char *name, *inst, *lang;
7543 int name_len, inst_len, lang_len;
7547 * We've got a fresh USERAUTH_INFO_REQUEST.
7548 * Get the preamble and start building a prompt.
7550 ssh_pkt_getstring(pktin, &name, &name_len);
7551 ssh_pkt_getstring(pktin, &inst, &inst_len);
7552 ssh_pkt_getstring(pktin, &lang, &lang_len);
7553 s->cur_prompt = new_prompts(ssh->frontend);
7554 s->cur_prompt->to_server = TRUE;
7556 /* FIXME: better prefix to distinguish from
7558 s->cur_prompt->name =
7559 dupprintf("SSH server: %.*s", name_len, name);
7560 s->cur_prompt->name_reqd = TRUE;
7562 s->cur_prompt->name =
7563 dupstr("SSH server authentication");
7564 s->cur_prompt->name_reqd = FALSE;
7566 /* FIXME: ugly to print "Using..." in prompt _every_
7567 * time round. Can this be done more subtly? */
7568 s->cur_prompt->instruction =
7569 dupprintf("Using keyboard-interactive authentication.%s%.*s",
7570 inst_len ? "\n" : "", inst_len, inst);
7571 s->cur_prompt->instr_reqd = TRUE;
7574 * Get the prompts from the packet.
7576 s->num_prompts = ssh_pkt_getuint32(pktin);
7577 for (i = 0; i < s->num_prompts; i++) {
7581 static char noprompt[] =
7582 "<server failed to send prompt>: ";
7584 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
7585 echo = ssh2_pkt_getbool(pktin);
7588 prompt_len = lenof(noprompt)-1;
7590 add_prompt(s->cur_prompt,
7591 dupprintf("%.*s", prompt_len, prompt),
7592 echo, SSH_MAX_PASSWORD_LEN);
7596 * Get the user's responses.
7598 if (s->num_prompts) {
7599 int ret; /* not live over crReturn */
7600 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7603 crWaitUntilV(!pktin);
7604 ret = get_userpass_input(s->cur_prompt, in, inlen);
7609 * Failed to get responses. Terminate.
7611 free_prompts(s->cur_prompt);
7612 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7613 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7620 * Send the responses to the server.
7622 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_INFO_RESPONSE);
7623 ssh2_pkt_adduint32(s->pktout, s->num_prompts);
7624 for (i=0; i < s->num_prompts; i++) {
7625 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7626 ssh2_pkt_addstring(s->pktout,
7627 s->cur_prompt->prompts[i]->result);
7628 end_log_omission(ssh, s->pktout);
7630 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
7633 * Get the next packet in case it's another
7636 crWaitUntilV(pktin);
7641 * We should have SUCCESS or FAILURE now.
7645 } else if (s->can_passwd) {
7648 * Plain old password authentication.
7650 int ret; /* not live over crReturn */
7651 int changereq_first_time; /* not live over crReturn */
7653 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7654 ssh->pkt_ctx |= SSH2_PKTCTX_PASSWORD;
7656 s->cur_prompt = new_prompts(ssh->frontend);
7657 s->cur_prompt->to_server = TRUE;
7658 s->cur_prompt->name = dupstr("SSH password");
7659 add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
7662 FALSE, SSH_MAX_PASSWORD_LEN);
7664 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7667 crWaitUntilV(!pktin);
7668 ret = get_userpass_input(s->cur_prompt, in, inlen);
7673 * Failed to get responses. Terminate.
7675 free_prompts(s->cur_prompt);
7676 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7677 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7682 * Squirrel away the password. (We may need it later if
7683 * asked to change it.)
7685 s->password = dupstr(s->cur_prompt->prompts[0]->result);
7686 free_prompts(s->cur_prompt);
7689 * Send the password packet.
7691 * We pad out the password packet to 256 bytes to make
7692 * it harder for an attacker to find the length of the
7695 * Anyone using a password longer than 256 bytes
7696 * probably doesn't have much to worry about from
7697 * people who find out how long their password is!
7699 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7700 ssh2_pkt_addstring(s->pktout, s->username);
7701 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7702 /* service requested */
7703 ssh2_pkt_addstring(s->pktout, "password");
7704 ssh2_pkt_addbool(s->pktout, FALSE);
7705 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7706 ssh2_pkt_addstring(s->pktout, s->password);
7707 end_log_omission(ssh, s->pktout);
7708 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
7709 logevent("Sent password");
7710 s->type = AUTH_TYPE_PASSWORD;
7713 * Wait for next packet, in case it's a password change
7716 crWaitUntilV(pktin);
7717 changereq_first_time = TRUE;
7719 while (pktin->type == SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ) {
7722 * We're being asked for a new password
7723 * (perhaps not for the first time).
7724 * Loop until the server accepts it.
7727 int got_new = FALSE; /* not live over crReturn */
7728 char *prompt; /* not live over crReturn */
7729 int prompt_len; /* not live over crReturn */
7733 if (changereq_first_time)
7734 msg = "Server requested password change";
7736 msg = "Server rejected new password";
7738 c_write_str(ssh, msg);
7739 c_write_str(ssh, "\r\n");
7742 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
7744 s->cur_prompt = new_prompts(ssh->frontend);
7745 s->cur_prompt->to_server = TRUE;
7746 s->cur_prompt->name = dupstr("New SSH password");
7747 s->cur_prompt->instruction =
7748 dupprintf("%.*s", prompt_len, prompt);
7749 s->cur_prompt->instr_reqd = TRUE;
7751 * There's no explicit requirement in the protocol
7752 * for the "old" passwords in the original and
7753 * password-change messages to be the same, and
7754 * apparently some Cisco kit supports password change
7755 * by the user entering a blank password originally
7756 * and the real password subsequently, so,
7757 * reluctantly, we prompt for the old password again.
7759 * (On the other hand, some servers don't even bother
7760 * to check this field.)
7762 add_prompt(s->cur_prompt,
7763 dupstr("Current password (blank for previously entered password): "),
7764 FALSE, SSH_MAX_PASSWORD_LEN);
7765 add_prompt(s->cur_prompt, dupstr("Enter new password: "),
7766 FALSE, SSH_MAX_PASSWORD_LEN);
7767 add_prompt(s->cur_prompt, dupstr("Confirm new password: "),
7768 FALSE, SSH_MAX_PASSWORD_LEN);
7771 * Loop until the user manages to enter the same
7776 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7779 crWaitUntilV(!pktin);
7780 ret = get_userpass_input(s->cur_prompt, in, inlen);
7785 * Failed to get responses. Terminate.
7787 /* burn the evidence */
7788 free_prompts(s->cur_prompt);
7789 memset(s->password, 0, strlen(s->password));
7791 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7792 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7798 * If the user specified a new original password
7799 * (IYSWIM), overwrite any previously specified
7801 * (A side effect is that the user doesn't have to
7802 * re-enter it if they louse up the new password.)
7804 if (s->cur_prompt->prompts[0]->result[0]) {
7805 memset(s->password, 0, strlen(s->password));
7806 /* burn the evidence */
7809 dupstr(s->cur_prompt->prompts[0]->result);
7813 * Check the two new passwords match.
7815 got_new = (strcmp(s->cur_prompt->prompts[1]->result,
7816 s->cur_prompt->prompts[2]->result)
7819 /* They don't. Silly user. */
7820 c_write_str(ssh, "Passwords do not match\r\n");
7825 * Send the new password (along with the old one).
7826 * (see above for padding rationale)
7828 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7829 ssh2_pkt_addstring(s->pktout, s->username);
7830 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7831 /* service requested */
7832 ssh2_pkt_addstring(s->pktout, "password");
7833 ssh2_pkt_addbool(s->pktout, TRUE);
7834 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7835 ssh2_pkt_addstring(s->pktout, s->password);
7836 ssh2_pkt_addstring(s->pktout,
7837 s->cur_prompt->prompts[1]->result);
7838 free_prompts(s->cur_prompt);
7839 end_log_omission(ssh, s->pktout);
7840 ssh2_pkt_send_with_padding(ssh, s->pktout, 256);
7841 logevent("Sent new password");
7844 * Now see what the server has to say about it.
7845 * (If it's CHANGEREQ again, it's not happy with the
7848 crWaitUntilV(pktin);
7849 changereq_first_time = FALSE;
7854 * We need to reexamine the current pktin at the top
7855 * of the loop. Either:
7856 * - we weren't asked to change password at all, in
7857 * which case it's a SUCCESS or FAILURE with the
7859 * - we sent a new password, and the server was
7860 * either OK with it (SUCCESS or FAILURE w/partial
7861 * success) or unhappy with the _old_ password
7862 * (FAILURE w/o partial success)
7863 * In any of these cases, we go back to the top of
7864 * the loop and start again.
7869 * We don't need the old password any more, in any
7870 * case. Burn the evidence.
7872 memset(s->password, 0, strlen(s->password));
7877 ssh_disconnect(ssh, NULL,
7878 "No supported authentication methods available",
7879 SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
7887 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
7889 /* Clear up various bits and pieces from authentication. */
7890 if (s->publickey_blob) {
7891 sfree(s->publickey_blob);
7892 sfree(s->publickey_comment);
7894 if (s->agent_response)
7895 sfree(s->agent_response);
7898 * Now the connection protocol has started, one way or another.
7901 ssh->channels = newtree234(ssh_channelcmp);
7904 * Set up handlers for some connection protocol messages, so we
7905 * don't have to handle them repeatedly in this coroutine.
7907 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] =
7908 ssh2_msg_channel_window_adjust;
7909 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] =
7910 ssh2_msg_global_request;
7913 * Create the main session channel.
7915 if (ssh->cfg.ssh_no_shell) {
7916 ssh->mainchan = NULL;
7917 } else if (*ssh->cfg.ssh_nc_host) {
7919 * Just start a direct-tcpip channel and use it as the main
7922 ssh->mainchan = snew(struct ssh_channel);
7923 ssh->mainchan->ssh = ssh;
7924 ssh->mainchan->localid = alloc_channel_id(ssh);
7926 "Opening direct-tcpip channel to %s:%d in place of session",
7927 ssh->cfg.ssh_nc_host, ssh->cfg.ssh_nc_port);
7928 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
7929 ssh2_pkt_addstring(s->pktout, "direct-tcpip");
7930 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
7931 ssh->mainchan->v.v2.locwindow = OUR_V2_WINSIZE;
7932 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
7933 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
7934 ssh2_pkt_addstring(s->pktout, ssh->cfg.ssh_nc_host);
7935 ssh2_pkt_adduint32(s->pktout, ssh->cfg.ssh_nc_port);
7937 * There's nothing meaningful to put in the originator
7938 * fields, but some servers insist on syntactically correct
7941 ssh2_pkt_addstring(s->pktout, "0.0.0.0");
7942 ssh2_pkt_adduint32(s->pktout, 0);
7943 ssh2_pkt_send(ssh, s->pktout);
7945 crWaitUntilV(pktin);
7946 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
7947 bombout(("Server refused to open a direct-tcpip channel"));
7949 /* FIXME: error data comes back in FAILURE packet */
7951 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
7952 bombout(("Server's channel confirmation cited wrong channel"));
7955 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
7956 ssh->mainchan->halfopen = FALSE;
7957 ssh->mainchan->type = CHAN_MAINSESSION;
7958 ssh->mainchan->closes = 0;
7959 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
7960 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
7961 bufchain_init(&ssh->mainchan->v.v2.outbuffer);
7962 add234(ssh->channels, ssh->mainchan);
7963 update_specials_menu(ssh->frontend);
7964 logevent("Opened direct-tcpip channel");
7967 ssh->mainchan = snew(struct ssh_channel);
7968 ssh->mainchan->ssh = ssh;
7969 ssh->mainchan->localid = alloc_channel_id(ssh);
7970 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
7971 ssh2_pkt_addstring(s->pktout, "session");
7972 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
7973 ssh->mainchan->v.v2.locwindow = OUR_V2_WINSIZE;
7974 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
7975 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
7976 ssh2_pkt_send(ssh, s->pktout);
7977 crWaitUntilV(pktin);
7978 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
7979 bombout(("Server refused to open a session"));
7981 /* FIXME: error data comes back in FAILURE packet */
7983 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
7984 bombout(("Server's channel confirmation cited wrong channel"));
7987 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
7988 ssh->mainchan->halfopen = FALSE;
7989 ssh->mainchan->type = CHAN_MAINSESSION;
7990 ssh->mainchan->closes = 0;
7991 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
7992 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
7993 bufchain_init(&ssh->mainchan->v.v2.outbuffer);
7994 add234(ssh->channels, ssh->mainchan);
7995 update_specials_menu(ssh->frontend);
7996 logevent("Opened channel for session");
7997 ssh->ncmode = FALSE;
8001 * Now we have a channel, make dispatch table entries for
8002 * general channel-based messages.
8004 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] =
8005 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] =
8006 ssh2_msg_channel_data;
8007 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_channel_eof;
8008 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_channel_close;
8009 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] =
8010 ssh2_msg_channel_open_confirmation;
8011 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] =
8012 ssh2_msg_channel_open_failure;
8013 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] =
8014 ssh2_msg_channel_request;
8015 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] =
8016 ssh2_msg_channel_open;
8019 * Potentially enable X11 forwarding.
8021 if (ssh->mainchan && !ssh->ncmode && ssh->cfg.x11_forward) {
8022 char proto[20], data[64];
8023 logevent("Requesting X11 forwarding");
8024 ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
8025 data, sizeof(data), ssh->cfg.x11_auth);
8026 x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display);
8027 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8028 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8029 ssh2_pkt_addstring(s->pktout, "x11-req");
8030 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8031 ssh2_pkt_addbool(s->pktout, 0); /* many connections */
8032 ssh2_pkt_addstring(s->pktout, proto);
8034 * Note that while we blank the X authentication data here, we don't
8035 * take any special action to blank the start of an X11 channel,
8036 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
8037 * without having session blanking enabled is likely to leak your
8038 * cookie into the log.
8040 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
8041 ssh2_pkt_addstring(s->pktout, data);
8042 end_log_omission(ssh, s->pktout);
8043 ssh2_pkt_adduint32(s->pktout, x11_get_screen_number(ssh->cfg.x11_display));
8044 ssh2_pkt_send(ssh, s->pktout);
8046 crWaitUntilV(pktin);
8048 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8049 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8050 bombout(("Unexpected response to X11 forwarding request:"
8051 " packet type %d", pktin->type));
8054 logevent("X11 forwarding refused");
8056 logevent("X11 forwarding enabled");
8057 ssh->X11_fwd_enabled = TRUE;
8062 * Enable port forwardings.
8064 ssh_setup_portfwd(ssh, &ssh->cfg);
8067 * Potentially enable agent forwarding.
8069 if (ssh->mainchan && !ssh->ncmode && ssh->cfg.agentfwd && agent_exists()) {
8070 logevent("Requesting OpenSSH-style agent forwarding");
8071 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8072 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8073 ssh2_pkt_addstring(s->pktout, "auth-agent-req@openssh.com");
8074 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8075 ssh2_pkt_send(ssh, s->pktout);
8077 crWaitUntilV(pktin);
8079 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8080 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8081 bombout(("Unexpected response to agent forwarding request:"
8082 " packet type %d", pktin->type));
8085 logevent("Agent forwarding refused");
8087 logevent("Agent forwarding enabled");
8088 ssh->agentfwd_enabled = TRUE;
8093 * Now allocate a pty for the session.
8095 if (ssh->mainchan && !ssh->ncmode && !ssh->cfg.nopty) {
8096 /* Unpick the terminal-speed string. */
8097 /* XXX perhaps we should allow no speeds to be sent. */
8098 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
8099 sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
8100 /* Build the pty request. */
8101 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8102 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
8103 ssh2_pkt_addstring(s->pktout, "pty-req");
8104 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8105 ssh2_pkt_addstring(s->pktout, ssh->cfg.termtype);
8106 ssh2_pkt_adduint32(s->pktout, ssh->term_width);
8107 ssh2_pkt_adduint32(s->pktout, ssh->term_height);
8108 ssh2_pkt_adduint32(s->pktout, 0); /* pixel width */
8109 ssh2_pkt_adduint32(s->pktout, 0); /* pixel height */
8110 ssh2_pkt_addstring_start(s->pktout);
8111 parse_ttymodes(ssh, ssh->cfg.ttymodes,
8112 ssh2_send_ttymode, (void *)s->pktout);
8113 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_ISPEED);
8114 ssh2_pkt_adduint32(s->pktout, ssh->ispeed);
8115 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_OSPEED);
8116 ssh2_pkt_adduint32(s->pktout, ssh->ospeed);
8117 ssh2_pkt_addstring_data(s->pktout, "\0", 1); /* TTY_OP_END */
8118 ssh2_pkt_send(ssh, s->pktout);
8119 ssh->state = SSH_STATE_INTERMED;
8121 crWaitUntilV(pktin);
8123 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8124 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8125 bombout(("Unexpected response to pty request:"
8126 " packet type %d", pktin->type));
8129 c_write_str(ssh, "Server refused to allocate pty\r\n");
8130 ssh->editing = ssh->echoing = 1;
8132 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
8133 ssh->ospeed, ssh->ispeed);
8136 ssh->editing = ssh->echoing = 1;
8140 * Send environment variables.
8142 * Simplest thing here is to send all the requests at once, and
8143 * then wait for a whole bunch of successes or failures.
8145 if (ssh->mainchan && !ssh->ncmode && *ssh->cfg.environmt) {
8146 char *e = ssh->cfg.environmt;
8147 char *var, *varend, *val;
8153 while (*e && *e != '\t') e++;
8155 if (*e == '\t') e++;
8160 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8161 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
8162 ssh2_pkt_addstring(s->pktout, "env");
8163 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8164 ssh2_pkt_addstring_start(s->pktout);
8165 ssh2_pkt_addstring_data(s->pktout, var, varend-var);
8166 ssh2_pkt_addstring(s->pktout, val);
8167 ssh2_pkt_send(ssh, s->pktout);
8172 logeventf(ssh, "Sent %d environment variables", s->num_env);
8175 s->env_left = s->num_env;
8177 while (s->env_left > 0) {
8178 crWaitUntilV(pktin);
8180 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8181 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8182 bombout(("Unexpected response to environment request:"
8183 " packet type %d", pktin->type));
8193 if (s->env_ok == s->num_env) {
8194 logevent("All environment variables successfully set");
8195 } else if (s->env_ok == 0) {
8196 logevent("All environment variables refused");
8197 c_write_str(ssh, "Server refused to set environment variables\r\n");
8199 logeventf(ssh, "%d environment variables refused",
8200 s->num_env - s->env_ok);
8201 c_write_str(ssh, "Server refused to set all environment variables\r\n");
8206 * Start a shell or a remote command. We may have to attempt
8207 * this twice if the config data has provided a second choice
8210 if (ssh->mainchan && !ssh->ncmode) while (1) {
8214 if (ssh->fallback_cmd) {
8215 subsys = ssh->cfg.ssh_subsys2;
8216 cmd = ssh->cfg.remote_cmd_ptr2;
8218 subsys = ssh->cfg.ssh_subsys;
8219 cmd = ssh->cfg.remote_cmd_ptr;
8220 if (!cmd) cmd = ssh->cfg.remote_cmd;
8223 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8224 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
8226 ssh2_pkt_addstring(s->pktout, "subsystem");
8227 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8228 ssh2_pkt_addstring(s->pktout, cmd);
8230 ssh2_pkt_addstring(s->pktout, "exec");
8231 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8232 ssh2_pkt_addstring(s->pktout, cmd);
8234 ssh2_pkt_addstring(s->pktout, "shell");
8235 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
8237 ssh2_pkt_send(ssh, s->pktout);
8239 crWaitUntilV(pktin);
8241 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
8242 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
8243 bombout(("Unexpected response to shell/command request:"
8244 " packet type %d", pktin->type));
8248 * We failed to start the command. If this is the
8249 * fallback command, we really are finished; if it's
8250 * not, and if the fallback command exists, try falling
8251 * back to it before complaining.
8253 if (!ssh->fallback_cmd && ssh->cfg.remote_cmd_ptr2 != NULL) {
8254 logevent("Primary command failed; attempting fallback");
8255 ssh->fallback_cmd = TRUE;
8258 bombout(("Server refused to start a shell/command"));
8261 logevent("Started a shell/command");
8266 ssh->state = SSH_STATE_SESSION;
8267 if (ssh->size_needed)
8268 ssh_size(ssh, ssh->term_width, ssh->term_height);
8269 if (ssh->eof_needed)
8270 ssh_special(ssh, TS_EOF);
8276 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
8281 s->try_send = FALSE;
8285 * _All_ the connection-layer packets we expect to
8286 * receive are now handled by the dispatch table.
8287 * Anything that reaches here must be bogus.
8290 bombout(("Strange packet received: type %d", pktin->type));
8292 } else if (ssh->mainchan) {
8294 * We have spare data. Add it to the channel buffer.
8296 ssh2_add_channel_data(ssh->mainchan, (char *)in, inlen);
8301 struct ssh_channel *c;
8303 * Try to send data on all channels if we can.
8305 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++)
8306 ssh2_try_send_and_unthrottle(c);
8314 * Handlers for SSH-2 messages that might arrive at any moment.
8316 static void ssh2_msg_disconnect(Ssh ssh, struct Packet *pktin)
8318 /* log reason code in disconnect message */
8320 int nowlen, reason, msglen;
8322 reason = ssh_pkt_getuint32(pktin);
8323 ssh_pkt_getstring(pktin, &msg, &msglen);
8325 if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
8326 buf = dupprintf("Received disconnect message (%s)",
8327 ssh2_disconnect_reasons[reason]);
8329 buf = dupprintf("Received disconnect message (unknown"
8330 " type %d)", reason);
8334 buf = dupprintf("Disconnection message text: %n%.*s",
8335 &nowlen, msglen, msg);
8337 bombout(("Server sent disconnect message\ntype %d (%s):\n\"%s\"",
8339 (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ?
8340 ssh2_disconnect_reasons[reason] : "unknown",
8345 static void ssh2_msg_debug(Ssh ssh, struct Packet *pktin)
8347 /* log the debug message */
8352 /* XXX maybe we should actually take notice of this */
8353 always_display = ssh2_pkt_getbool(pktin);
8354 ssh_pkt_getstring(pktin, &msg, &msglen);
8356 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
8359 static void ssh2_msg_something_unimplemented(Ssh ssh, struct Packet *pktin)
8361 struct Packet *pktout;
8362 pktout = ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED);
8363 ssh2_pkt_adduint32(pktout, pktin->sequence);
8365 * UNIMPLEMENTED messages MUST appear in the same order as the
8366 * messages they respond to. Hence, never queue them.
8368 ssh2_pkt_send_noqueue(ssh, pktout);
8372 * Handle the top-level SSH-2 protocol.
8374 static void ssh2_protocol_setup(Ssh ssh)
8379 * Most messages cause SSH2_MSG_UNIMPLEMENTED.
8381 for (i = 0; i < 256; i++)
8382 ssh->packet_dispatch[i] = ssh2_msg_something_unimplemented;
8385 * Any message we actually understand, we set to NULL so that
8386 * the coroutines will get it.
8388 ssh->packet_dispatch[SSH2_MSG_UNIMPLEMENTED] = NULL;
8389 ssh->packet_dispatch[SSH2_MSG_SERVICE_REQUEST] = NULL;
8390 ssh->packet_dispatch[SSH2_MSG_SERVICE_ACCEPT] = NULL;
8391 ssh->packet_dispatch[SSH2_MSG_KEXINIT] = NULL;
8392 ssh->packet_dispatch[SSH2_MSG_NEWKEYS] = NULL;
8393 ssh->packet_dispatch[SSH2_MSG_KEXDH_INIT] = NULL;
8394 ssh->packet_dispatch[SSH2_MSG_KEXDH_REPLY] = NULL;
8395 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REQUEST] = NULL; duplicate case value */
8396 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_GROUP] = NULL; duplicate case value */
8397 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_INIT] = NULL;
8398 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REPLY] = NULL;
8399 ssh->packet_dispatch[SSH2_MSG_USERAUTH_REQUEST] = NULL;
8400 ssh->packet_dispatch[SSH2_MSG_USERAUTH_FAILURE] = NULL;
8401 ssh->packet_dispatch[SSH2_MSG_USERAUTH_SUCCESS] = NULL;
8402 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
8403 ssh->packet_dispatch[SSH2_MSG_USERAUTH_PK_OK] = NULL;
8404 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ] = NULL; duplicate case value */
8405 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_REQUEST] = NULL; duplicate case value */
8406 ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_RESPONSE] = NULL;
8407 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = NULL;
8408 ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = NULL;
8409 ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = NULL;
8410 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = NULL;
8411 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = NULL;
8412 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = NULL;
8413 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = NULL;
8414 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = NULL;
8415 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = NULL;
8416 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = NULL;
8417 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = NULL;
8418 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = NULL;
8419 ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = NULL;
8420 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = NULL;
8423 * These special message types we install handlers for.
8425 ssh->packet_dispatch[SSH2_MSG_DISCONNECT] = ssh2_msg_disconnect;
8426 ssh->packet_dispatch[SSH2_MSG_IGNORE] = ssh_msg_ignore; /* shared with SSH-1 */
8427 ssh->packet_dispatch[SSH2_MSG_DEBUG] = ssh2_msg_debug;
8430 static void ssh2_timer(void *ctx, long now)
8434 if (ssh->state == SSH_STATE_CLOSED)
8437 if (!ssh->kex_in_progress && ssh->cfg.ssh_rekey_time != 0 &&
8438 now - ssh->next_rekey >= 0) {
8439 do_ssh2_transport(ssh, "timeout", -1, NULL);
8443 static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
8444 struct Packet *pktin)
8446 unsigned char *in = (unsigned char *)vin;
8447 if (ssh->state == SSH_STATE_CLOSED)
8451 ssh->incoming_data_size += pktin->encrypted_len;
8452 if (!ssh->kex_in_progress &&
8453 ssh->max_data_size != 0 &&
8454 ssh->incoming_data_size > ssh->max_data_size)
8455 do_ssh2_transport(ssh, "too much data received", -1, NULL);
8458 if (pktin && ssh->packet_dispatch[pktin->type]) {
8459 ssh->packet_dispatch[pktin->type](ssh, pktin);
8463 if (!ssh->protocol_initial_phase_done ||
8464 (pktin && pktin->type >= 20 && pktin->type < 50)) {
8465 if (do_ssh2_transport(ssh, in, inlen, pktin) &&
8466 !ssh->protocol_initial_phase_done) {
8467 ssh->protocol_initial_phase_done = TRUE;
8469 * Allow authconn to initialise itself.
8471 do_ssh2_authconn(ssh, NULL, 0, NULL);
8474 do_ssh2_authconn(ssh, in, inlen, pktin);
8479 * Called to set up the connection.
8481 * Returns an error message, or NULL on success.
8483 static const char *ssh_init(void *frontend_handle, void **backend_handle,
8485 char *host, int port, char **realhost, int nodelay,
8491 ssh = snew(struct ssh_tag);
8492 ssh->cfg = *cfg; /* STRUCTURE COPY */
8493 ssh->version = 0; /* when not ready yet */
8496 ssh->v1_cipher_ctx = NULL;
8497 ssh->crcda_ctx = NULL;
8498 ssh->cscipher = NULL;
8499 ssh->cs_cipher_ctx = NULL;
8500 ssh->sccipher = NULL;
8501 ssh->sc_cipher_ctx = NULL;
8503 ssh->cs_mac_ctx = NULL;
8505 ssh->sc_mac_ctx = NULL;
8507 ssh->cs_comp_ctx = NULL;
8509 ssh->sc_comp_ctx = NULL;
8511 ssh->kex_ctx = NULL;
8512 ssh->hostkey = NULL;
8514 ssh->close_expected = FALSE;
8515 ssh->clean_exit = FALSE;
8516 ssh->state = SSH_STATE_PREPACKET;
8517 ssh->size_needed = FALSE;
8518 ssh->eof_needed = FALSE;
8521 ssh->deferred_send_data = NULL;
8522 ssh->deferred_len = 0;
8523 ssh->deferred_size = 0;
8524 ssh->fallback_cmd = 0;
8526 ssh->x11auth = NULL;
8527 ssh->v1_compressing = FALSE;
8528 ssh->v2_outgoing_sequence = 0;
8529 ssh->ssh1_rdpkt_crstate = 0;
8530 ssh->ssh2_rdpkt_crstate = 0;
8531 ssh->do_ssh_init_crstate = 0;
8532 ssh->ssh_gotdata_crstate = 0;
8533 ssh->do_ssh1_connection_crstate = 0;
8534 ssh->do_ssh1_login_crstate = 0;
8535 ssh->do_ssh2_transport_crstate = 0;
8536 ssh->do_ssh2_authconn_crstate = 0;
8537 ssh->do_ssh_init_state = NULL;
8538 ssh->do_ssh1_login_state = NULL;
8539 ssh->do_ssh2_transport_state = NULL;
8540 ssh->do_ssh2_authconn_state = NULL;
8543 ssh->mainchan = NULL;
8544 ssh->throttled_all = 0;
8545 ssh->v1_stdout_throttling = 0;
8547 ssh->queuelen = ssh->queuesize = 0;
8548 ssh->queueing = FALSE;
8549 ssh->qhead = ssh->qtail = NULL;
8550 ssh->deferred_rekey_reason = NULL;
8551 bufchain_init(&ssh->queued_incoming_data);
8552 ssh->frozen = FALSE;
8554 *backend_handle = ssh;
8557 if (crypto_startup() == 0)
8558 return "Microsoft high encryption pack not installed!";
8561 ssh->frontend = frontend_handle;
8562 ssh->term_width = ssh->cfg.width;
8563 ssh->term_height = ssh->cfg.height;
8565 ssh->channels = NULL;
8566 ssh->rportfwds = NULL;
8567 ssh->portfwds = NULL;
8572 ssh->v1_throttle_count = 0;
8573 ssh->overall_bufsize = 0;
8574 ssh->fallback_cmd = 0;
8576 ssh->protocol = NULL;
8578 ssh->protocol_initial_phase_done = FALSE;
8582 ssh->incoming_data_size = ssh->outgoing_data_size =
8583 ssh->deferred_data_size = 0L;
8584 ssh->max_data_size = parse_blocksize(ssh->cfg.ssh_rekey_data);
8585 ssh->kex_in_progress = FALSE;
8587 p = connect_to_host(ssh, host, port, realhost, nodelay, keepalive);
8596 static void ssh_free(void *handle)
8598 Ssh ssh = (Ssh) handle;
8599 struct ssh_channel *c;
8600 struct ssh_rportfwd *pf;
8602 if (ssh->v1_cipher_ctx)
8603 ssh->cipher->free_context(ssh->v1_cipher_ctx);
8604 if (ssh->cs_cipher_ctx)
8605 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
8606 if (ssh->sc_cipher_ctx)
8607 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
8608 if (ssh->cs_mac_ctx)
8609 ssh->csmac->free_context(ssh->cs_mac_ctx);
8610 if (ssh->sc_mac_ctx)
8611 ssh->scmac->free_context(ssh->sc_mac_ctx);
8612 if (ssh->cs_comp_ctx) {
8614 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
8616 zlib_compress_cleanup(ssh->cs_comp_ctx);
8618 if (ssh->sc_comp_ctx) {
8620 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
8622 zlib_decompress_cleanup(ssh->sc_comp_ctx);
8625 dh_cleanup(ssh->kex_ctx);
8626 sfree(ssh->savedhost);
8628 while (ssh->queuelen-- > 0)
8629 ssh_free_packet(ssh->queue[ssh->queuelen]);
8632 while (ssh->qhead) {
8633 struct queued_handler *qh = ssh->qhead;
8634 ssh->qhead = qh->next;
8637 ssh->qhead = ssh->qtail = NULL;
8639 if (ssh->channels) {
8640 while ((c = delpos234(ssh->channels, 0)) != NULL) {
8643 if (c->u.x11.s != NULL)
8644 x11_close(c->u.x11.s);
8647 if (c->u.pfd.s != NULL)
8648 pfd_close(c->u.pfd.s);
8653 freetree234(ssh->channels);
8654 ssh->channels = NULL;
8657 if (ssh->rportfwds) {
8658 while ((pf = delpos234(ssh->rportfwds, 0)) != NULL)
8660 freetree234(ssh->rportfwds);
8661 ssh->rportfwds = NULL;
8663 sfree(ssh->deferred_send_data);
8665 x11_free_auth(ssh->x11auth);
8666 sfree(ssh->do_ssh_init_state);
8667 sfree(ssh->do_ssh1_login_state);
8668 sfree(ssh->do_ssh2_transport_state);
8669 sfree(ssh->do_ssh2_authconn_state);
8672 if (ssh->crcda_ctx) {
8673 crcda_free_context(ssh->crcda_ctx);
8674 ssh->crcda_ctx = NULL;
8677 ssh_do_close(ssh, TRUE);
8678 expire_timer_context(ssh);
8680 pinger_free(ssh->pinger);
8681 bufchain_clear(&ssh->queued_incoming_data);
8688 * Reconfigure the SSH backend.
8690 static void ssh_reconfig(void *handle, Config *cfg)
8692 Ssh ssh = (Ssh) handle;
8693 char *rekeying = NULL, rekey_mandatory = FALSE;
8694 unsigned long old_max_data_size;
8696 pinger_reconfig(ssh->pinger, &ssh->cfg, cfg);
8698 ssh_setup_portfwd(ssh, cfg);
8700 if (ssh->cfg.ssh_rekey_time != cfg->ssh_rekey_time &&
8701 cfg->ssh_rekey_time != 0) {
8702 long new_next = ssh->last_rekey + cfg->ssh_rekey_time*60*TICKSPERSEC;
8703 long now = GETTICKCOUNT();
8705 if (new_next - now < 0) {
8706 rekeying = "timeout shortened";
8708 ssh->next_rekey = schedule_timer(new_next - now, ssh2_timer, ssh);
8712 old_max_data_size = ssh->max_data_size;
8713 ssh->max_data_size = parse_blocksize(cfg->ssh_rekey_data);
8714 if (old_max_data_size != ssh->max_data_size &&
8715 ssh->max_data_size != 0) {
8716 if (ssh->outgoing_data_size > ssh->max_data_size ||
8717 ssh->incoming_data_size > ssh->max_data_size)
8718 rekeying = "data limit lowered";
8721 if (ssh->cfg.compression != cfg->compression) {
8722 rekeying = "compression setting changed";
8723 rekey_mandatory = TRUE;
8726 if (ssh->cfg.ssh2_des_cbc != cfg->ssh2_des_cbc ||
8727 memcmp(ssh->cfg.ssh_cipherlist, cfg->ssh_cipherlist,
8728 sizeof(ssh->cfg.ssh_cipherlist))) {
8729 rekeying = "cipher settings changed";
8730 rekey_mandatory = TRUE;
8733 ssh->cfg = *cfg; /* STRUCTURE COPY */
8736 if (!ssh->kex_in_progress) {
8737 do_ssh2_transport(ssh, rekeying, -1, NULL);
8738 } else if (rekey_mandatory) {
8739 ssh->deferred_rekey_reason = rekeying;
8745 * Called to send data down the SSH connection.
8747 static int ssh_send(void *handle, char *buf, int len)
8749 Ssh ssh = (Ssh) handle;
8751 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
8754 ssh->protocol(ssh, (unsigned char *)buf, len, 0);
8756 return ssh_sendbuffer(ssh);
8760 * Called to query the current amount of buffered stdin data.
8762 static int ssh_sendbuffer(void *handle)
8764 Ssh ssh = (Ssh) handle;
8767 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
8771 * If the SSH socket itself has backed up, add the total backup
8772 * size on that to any individual buffer on the stdin channel.
8775 if (ssh->throttled_all)
8776 override_value = ssh->overall_bufsize;
8778 if (ssh->version == 1) {
8779 return override_value;
8780 } else if (ssh->version == 2) {
8781 if (!ssh->mainchan || ssh->mainchan->closes > 0)
8782 return override_value;
8784 return (override_value +
8785 bufchain_size(&ssh->mainchan->v.v2.outbuffer));
8792 * Called to set the size of the window from SSH's POV.
8794 static void ssh_size(void *handle, int width, int height)
8796 Ssh ssh = (Ssh) handle;
8797 struct Packet *pktout;
8799 ssh->term_width = width;
8800 ssh->term_height = height;
8802 switch (ssh->state) {
8803 case SSH_STATE_BEFORE_SIZE:
8804 case SSH_STATE_PREPACKET:
8805 case SSH_STATE_CLOSED:
8806 break; /* do nothing */
8807 case SSH_STATE_INTERMED:
8808 ssh->size_needed = TRUE; /* buffer for later */
8810 case SSH_STATE_SESSION:
8811 if (!ssh->cfg.nopty) {
8812 if (ssh->version == 1) {
8813 send_packet(ssh, SSH1_CMSG_WINDOW_SIZE,
8814 PKT_INT, ssh->term_height,
8815 PKT_INT, ssh->term_width,
8816 PKT_INT, 0, PKT_INT, 0, PKT_END);
8817 } else if (ssh->mainchan) {
8818 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8819 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8820 ssh2_pkt_addstring(pktout, "window-change");
8821 ssh2_pkt_addbool(pktout, 0);
8822 ssh2_pkt_adduint32(pktout, ssh->term_width);
8823 ssh2_pkt_adduint32(pktout, ssh->term_height);
8824 ssh2_pkt_adduint32(pktout, 0);
8825 ssh2_pkt_adduint32(pktout, 0);
8826 ssh2_pkt_send(ssh, pktout);
8834 * Return a list of the special codes that make sense in this
8837 static const struct telnet_special *ssh_get_specials(void *handle)
8839 static const struct telnet_special ssh1_ignore_special[] = {
8840 {"IGNORE message", TS_NOP}
8842 static const struct telnet_special ssh2_transport_specials[] = {
8843 {"IGNORE message", TS_NOP},
8844 {"Repeat key exchange", TS_REKEY},
8846 static const struct telnet_special ssh2_session_specials[] = {
8849 /* These are the signal names defined by draft-ietf-secsh-connect-23.
8850 * They include all the ISO C signals, but are a subset of the POSIX
8851 * required signals. */
8852 {"SIGINT (Interrupt)", TS_SIGINT},
8853 {"SIGTERM (Terminate)", TS_SIGTERM},
8854 {"SIGKILL (Kill)", TS_SIGKILL},
8855 {"SIGQUIT (Quit)", TS_SIGQUIT},
8856 {"SIGHUP (Hangup)", TS_SIGHUP},
8857 {"More signals", TS_SUBMENU},
8858 {"SIGABRT", TS_SIGABRT}, {"SIGALRM", TS_SIGALRM},
8859 {"SIGFPE", TS_SIGFPE}, {"SIGILL", TS_SIGILL},
8860 {"SIGPIPE", TS_SIGPIPE}, {"SIGSEGV", TS_SIGSEGV},
8861 {"SIGUSR1", TS_SIGUSR1}, {"SIGUSR2", TS_SIGUSR2},
8864 static const struct telnet_special specials_end[] = {
8867 /* XXX review this length for any changes: */
8868 static struct telnet_special ssh_specials[lenof(ssh2_transport_specials) +
8869 lenof(ssh2_session_specials) +
8870 lenof(specials_end)];
8871 Ssh ssh = (Ssh) handle;
8873 #define ADD_SPECIALS(name) \
8875 assert((i + lenof(name)) <= lenof(ssh_specials)); \
8876 memcpy(&ssh_specials[i], name, sizeof name); \
8880 if (ssh->version == 1) {
8881 /* Don't bother offering IGNORE if we've decided the remote
8882 * won't cope with it, since we wouldn't bother sending it if
8884 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
8885 ADD_SPECIALS(ssh1_ignore_special);
8886 } else if (ssh->version == 2) {
8887 ADD_SPECIALS(ssh2_transport_specials);
8889 ADD_SPECIALS(ssh2_session_specials);
8890 } /* else we're not ready yet */
8893 ADD_SPECIALS(specials_end);
8894 return ssh_specials;
8902 * Send special codes. TS_EOF is useful for `plink', so you
8903 * can send an EOF and collect resulting output (e.g. `plink
8906 static void ssh_special(void *handle, Telnet_Special code)
8908 Ssh ssh = (Ssh) handle;
8909 struct Packet *pktout;
8911 if (code == TS_EOF) {
8912 if (ssh->state != SSH_STATE_SESSION) {
8914 * Buffer the EOF in case we are pre-SESSION, so we can
8915 * send it as soon as we reach SESSION.
8918 ssh->eof_needed = TRUE;
8921 if (ssh->version == 1) {
8922 send_packet(ssh, SSH1_CMSG_EOF, PKT_END);
8923 } else if (ssh->mainchan) {
8924 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_EOF);
8925 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8926 ssh2_pkt_send(ssh, pktout);
8927 ssh->send_ok = 0; /* now stop trying to read from stdin */
8929 logevent("Sent EOF message");
8930 } else if (code == TS_PING || code == TS_NOP) {
8931 if (ssh->state == SSH_STATE_CLOSED
8932 || ssh->state == SSH_STATE_PREPACKET) return;
8933 if (ssh->version == 1) {
8934 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
8935 send_packet(ssh, SSH1_MSG_IGNORE, PKT_STR, "", PKT_END);
8937 pktout = ssh2_pkt_init(SSH2_MSG_IGNORE);
8938 ssh2_pkt_addstring_start(pktout);
8939 ssh2_pkt_send_noqueue(ssh, pktout);
8941 } else if (code == TS_REKEY) {
8942 if (!ssh->kex_in_progress && ssh->version == 2) {
8943 do_ssh2_transport(ssh, "at user request", -1, NULL);
8945 } else if (code == TS_BRK) {
8946 if (ssh->state == SSH_STATE_CLOSED
8947 || ssh->state == SSH_STATE_PREPACKET) return;
8948 if (ssh->version == 1) {
8949 logevent("Unable to send BREAK signal in SSH-1");
8950 } else if (ssh->mainchan) {
8951 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8952 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8953 ssh2_pkt_addstring(pktout, "break");
8954 ssh2_pkt_addbool(pktout, 0);
8955 ssh2_pkt_adduint32(pktout, 0); /* default break length */
8956 ssh2_pkt_send(ssh, pktout);
8959 /* Is is a POSIX signal? */
8960 char *signame = NULL;
8961 if (code == TS_SIGABRT) signame = "ABRT";
8962 if (code == TS_SIGALRM) signame = "ALRM";
8963 if (code == TS_SIGFPE) signame = "FPE";
8964 if (code == TS_SIGHUP) signame = "HUP";
8965 if (code == TS_SIGILL) signame = "ILL";
8966 if (code == TS_SIGINT) signame = "INT";
8967 if (code == TS_SIGKILL) signame = "KILL";
8968 if (code == TS_SIGPIPE) signame = "PIPE";
8969 if (code == TS_SIGQUIT) signame = "QUIT";
8970 if (code == TS_SIGSEGV) signame = "SEGV";
8971 if (code == TS_SIGTERM) signame = "TERM";
8972 if (code == TS_SIGUSR1) signame = "USR1";
8973 if (code == TS_SIGUSR2) signame = "USR2";
8974 /* The SSH-2 protocol does in principle support arbitrary named
8975 * signals, including signame@domain, but we don't support those. */
8977 /* It's a signal. */
8978 if (ssh->version == 2 && ssh->mainchan) {
8979 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8980 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8981 ssh2_pkt_addstring(pktout, "signal");
8982 ssh2_pkt_addbool(pktout, 0);
8983 ssh2_pkt_addstring(pktout, signame);
8984 ssh2_pkt_send(ssh, pktout);
8985 logeventf(ssh, "Sent signal SIG%s", signame);
8988 /* Never heard of it. Do nothing */
8993 void *new_sock_channel(void *handle, Socket s)
8995 Ssh ssh = (Ssh) handle;
8996 struct ssh_channel *c;
8997 c = snew(struct ssh_channel);
9002 c->localid = alloc_channel_id(ssh);
9004 c->type = CHAN_SOCKDATA_DORMANT;/* identify channel type */
9006 bufchain_init(&c->v.v2.outbuffer);
9007 add234(ssh->channels, c);
9013 * This is called when stdout/stderr (the entity to which
9014 * from_backend sends data) manages to clear some backlog.
9016 static void ssh_unthrottle(void *handle, int bufsize)
9018 Ssh ssh = (Ssh) handle;
9019 if (ssh->version == 1) {
9020 if (ssh->v1_stdout_throttling && bufsize < SSH1_BUFFER_LIMIT) {
9021 ssh->v1_stdout_throttling = 0;
9022 ssh1_throttle(ssh, -1);
9025 ssh2_set_window(ssh->mainchan, OUR_V2_WINSIZE - bufsize);
9029 void ssh_send_port_open(void *channel, char *hostname, int port, char *org)
9031 struct ssh_channel *c = (struct ssh_channel *)channel;
9033 struct Packet *pktout;
9035 logeventf(ssh, "Opening forwarded connection to %s:%d", hostname, port);
9037 if (ssh->version == 1) {
9038 send_packet(ssh, SSH1_MSG_PORT_OPEN,
9039 PKT_INT, c->localid,
9042 /* PKT_STR, <org:orgport>, */
9045 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
9046 ssh2_pkt_addstring(pktout, "direct-tcpip");
9047 ssh2_pkt_adduint32(pktout, c->localid);
9048 c->v.v2.locwindow = OUR_V2_WINSIZE;
9049 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);/* our window size */
9050 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
9051 ssh2_pkt_addstring(pktout, hostname);
9052 ssh2_pkt_adduint32(pktout, port);
9054 * We make up values for the originator data; partly it's
9055 * too much hassle to keep track, and partly I'm not
9056 * convinced the server should be told details like that
9057 * about my local network configuration.
9058 * The "originator IP address" is syntactically a numeric
9059 * IP address, and some servers (e.g., Tectia) get upset
9060 * if it doesn't match this syntax.
9062 ssh2_pkt_addstring(pktout, "0.0.0.0");
9063 ssh2_pkt_adduint32(pktout, 0);
9064 ssh2_pkt_send(ssh, pktout);
9068 static int ssh_connected(void *handle)
9070 Ssh ssh = (Ssh) handle;
9071 return ssh->s != NULL;
9074 static int ssh_sendok(void *handle)
9076 Ssh ssh = (Ssh) handle;
9077 return ssh->send_ok;
9080 static int ssh_ldisc(void *handle, int option)
9082 Ssh ssh = (Ssh) handle;
9083 if (option == LD_ECHO)
9084 return ssh->echoing;
9085 if (option == LD_EDIT)
9086 return ssh->editing;
9090 static void ssh_provide_ldisc(void *handle, void *ldisc)
9092 Ssh ssh = (Ssh) handle;
9096 static void ssh_provide_logctx(void *handle, void *logctx)
9098 Ssh ssh = (Ssh) handle;
9099 ssh->logctx = logctx;
9102 static int ssh_return_exitcode(void *handle)
9104 Ssh ssh = (Ssh) handle;
9108 return (ssh->exitcode >= 0 ? ssh->exitcode : INT_MAX);
9112 * cfg_info for SSH is the currently running version of the
9113 * protocol. (1 for 1; 2 for 2; 0 for not-decided-yet.)
9115 static int ssh_cfg_info(void *handle)
9117 Ssh ssh = (Ssh) handle;
9118 return ssh->version;
9122 * Gross hack: pscp will try to start SFTP but fall back to scp1 if
9123 * that fails. This variable is the means by which scp.c can reach
9124 * into the SSH code and find out which one it got.
9126 extern int ssh_fallback_cmd(void *handle)
9128 Ssh ssh = (Ssh) handle;
9129 return ssh->fallback_cmd;
9132 Backend ssh_backend = {
9142 ssh_return_exitcode,