17 #define SSH1_MSG_DISCONNECT 1 /* 0x1 */
18 #define SSH1_SMSG_PUBLIC_KEY 2 /* 0x2 */
19 #define SSH1_CMSG_SESSION_KEY 3 /* 0x3 */
20 #define SSH1_CMSG_USER 4 /* 0x4 */
21 #define SSH1_CMSG_AUTH_RSA 6 /* 0x6 */
22 #define SSH1_SMSG_AUTH_RSA_CHALLENGE 7 /* 0x7 */
23 #define SSH1_CMSG_AUTH_RSA_RESPONSE 8 /* 0x8 */
24 #define SSH1_CMSG_AUTH_PASSWORD 9 /* 0x9 */
25 #define SSH1_CMSG_REQUEST_PTY 10 /* 0xa */
26 #define SSH1_CMSG_WINDOW_SIZE 11 /* 0xb */
27 #define SSH1_CMSG_EXEC_SHELL 12 /* 0xc */
28 #define SSH1_CMSG_EXEC_CMD 13 /* 0xd */
29 #define SSH1_SMSG_SUCCESS 14 /* 0xe */
30 #define SSH1_SMSG_FAILURE 15 /* 0xf */
31 #define SSH1_CMSG_STDIN_DATA 16 /* 0x10 */
32 #define SSH1_SMSG_STDOUT_DATA 17 /* 0x11 */
33 #define SSH1_SMSG_STDERR_DATA 18 /* 0x12 */
34 #define SSH1_CMSG_EOF 19 /* 0x13 */
35 #define SSH1_SMSG_EXIT_STATUS 20 /* 0x14 */
36 #define SSH1_MSG_CHANNEL_OPEN_CONFIRMATION 21 /* 0x15 */
37 #define SSH1_MSG_CHANNEL_OPEN_FAILURE 22 /* 0x16 */
38 #define SSH1_MSG_CHANNEL_DATA 23 /* 0x17 */
39 #define SSH1_MSG_CHANNEL_CLOSE 24 /* 0x18 */
40 #define SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION 25 /* 0x19 */
41 #define SSH1_SMSG_X11_OPEN 27 /* 0x1b */
42 #define SSH1_CMSG_PORT_FORWARD_REQUEST 28 /* 0x1c */
43 #define SSH1_MSG_PORT_OPEN 29 /* 0x1d */
44 #define SSH1_CMSG_AGENT_REQUEST_FORWARDING 30 /* 0x1e */
45 #define SSH1_SMSG_AGENT_OPEN 31 /* 0x1f */
46 #define SSH1_MSG_IGNORE 32 /* 0x20 */
47 #define SSH1_CMSG_EXIT_CONFIRMATION 33 /* 0x21 */
48 #define SSH1_CMSG_X11_REQUEST_FORWARDING 34 /* 0x22 */
49 #define SSH1_CMSG_AUTH_RHOSTS_RSA 35 /* 0x23 */
50 #define SSH1_MSG_DEBUG 36 /* 0x24 */
51 #define SSH1_CMSG_REQUEST_COMPRESSION 37 /* 0x25 */
52 #define SSH1_CMSG_AUTH_TIS 39 /* 0x27 */
53 #define SSH1_SMSG_AUTH_TIS_CHALLENGE 40 /* 0x28 */
54 #define SSH1_CMSG_AUTH_TIS_RESPONSE 41 /* 0x29 */
55 #define SSH1_CMSG_AUTH_CCARD 70 /* 0x46 */
56 #define SSH1_SMSG_AUTH_CCARD_CHALLENGE 71 /* 0x47 */
57 #define SSH1_CMSG_AUTH_CCARD_RESPONSE 72 /* 0x48 */
59 #define SSH1_AUTH_TIS 5 /* 0x5 */
60 #define SSH1_AUTH_CCARD 16 /* 0x10 */
62 #define SSH1_PROTOFLAG_SCREEN_NUMBER 1 /* 0x1 */
63 /* Mask for protoflags we will echo back to server if seen */
64 #define SSH1_PROTOFLAGS_SUPPORTED 0 /* 0x1 */
66 #define SSH2_MSG_DISCONNECT 1 /* 0x1 */
67 #define SSH2_MSG_IGNORE 2 /* 0x2 */
68 #define SSH2_MSG_UNIMPLEMENTED 3 /* 0x3 */
69 #define SSH2_MSG_DEBUG 4 /* 0x4 */
70 #define SSH2_MSG_SERVICE_REQUEST 5 /* 0x5 */
71 #define SSH2_MSG_SERVICE_ACCEPT 6 /* 0x6 */
72 #define SSH2_MSG_KEXINIT 20 /* 0x14 */
73 #define SSH2_MSG_NEWKEYS 21 /* 0x15 */
74 #define SSH2_MSG_KEXDH_INIT 30 /* 0x1e */
75 #define SSH2_MSG_KEXDH_REPLY 31 /* 0x1f */
76 #define SSH2_MSG_KEX_DH_GEX_REQUEST 30 /* 0x1e */
77 #define SSH2_MSG_KEX_DH_GEX_GROUP 31 /* 0x1f */
78 #define SSH2_MSG_KEX_DH_GEX_INIT 32 /* 0x20 */
79 #define SSH2_MSG_KEX_DH_GEX_REPLY 33 /* 0x21 */
80 #define SSH2_MSG_USERAUTH_REQUEST 50 /* 0x32 */
81 #define SSH2_MSG_USERAUTH_FAILURE 51 /* 0x33 */
82 #define SSH2_MSG_USERAUTH_SUCCESS 52 /* 0x34 */
83 #define SSH2_MSG_USERAUTH_BANNER 53 /* 0x35 */
84 #define SSH2_MSG_USERAUTH_PK_OK 60 /* 0x3c */
85 #define SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ 60 /* 0x3c */
86 #define SSH2_MSG_USERAUTH_INFO_REQUEST 60 /* 0x3c */
87 #define SSH2_MSG_USERAUTH_INFO_RESPONSE 61 /* 0x3d */
88 #define SSH2_MSG_GLOBAL_REQUEST 80 /* 0x50 */
89 #define SSH2_MSG_REQUEST_SUCCESS 81 /* 0x51 */
90 #define SSH2_MSG_REQUEST_FAILURE 82 /* 0x52 */
91 #define SSH2_MSG_CHANNEL_OPEN 90 /* 0x5a */
92 #define SSH2_MSG_CHANNEL_OPEN_CONFIRMATION 91 /* 0x5b */
93 #define SSH2_MSG_CHANNEL_OPEN_FAILURE 92 /* 0x5c */
94 #define SSH2_MSG_CHANNEL_WINDOW_ADJUST 93 /* 0x5d */
95 #define SSH2_MSG_CHANNEL_DATA 94 /* 0x5e */
96 #define SSH2_MSG_CHANNEL_EXTENDED_DATA 95 /* 0x5f */
97 #define SSH2_MSG_CHANNEL_EOF 96 /* 0x60 */
98 #define SSH2_MSG_CHANNEL_CLOSE 97 /* 0x61 */
99 #define SSH2_MSG_CHANNEL_REQUEST 98 /* 0x62 */
100 #define SSH2_MSG_CHANNEL_SUCCESS 99 /* 0x63 */
101 #define SSH2_MSG_CHANNEL_FAILURE 100 /* 0x64 */
104 * Packet type contexts, so that ssh2_pkt_type can correctly decode
105 * the ambiguous type numbers back into the correct type strings.
107 #define SSH2_PKTCTX_DHGROUP 0x0001
108 #define SSH2_PKTCTX_DHGEX 0x0002
109 #define SSH2_PKTCTX_KEX_MASK 0x000F
110 #define SSH2_PKTCTX_PUBLICKEY 0x0010
111 #define SSH2_PKTCTX_PASSWORD 0x0020
112 #define SSH2_PKTCTX_KBDINTER 0x0040
113 #define SSH2_PKTCTX_AUTH_MASK 0x00F0
115 #define SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1 /* 0x1 */
116 #define SSH2_DISCONNECT_PROTOCOL_ERROR 2 /* 0x2 */
117 #define SSH2_DISCONNECT_KEY_EXCHANGE_FAILED 3 /* 0x3 */
118 #define SSH2_DISCONNECT_HOST_AUTHENTICATION_FAILED 4 /* 0x4 */
119 #define SSH2_DISCONNECT_MAC_ERROR 5 /* 0x5 */
120 #define SSH2_DISCONNECT_COMPRESSION_ERROR 6 /* 0x6 */
121 #define SSH2_DISCONNECT_SERVICE_NOT_AVAILABLE 7 /* 0x7 */
122 #define SSH2_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED 8 /* 0x8 */
123 #define SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9 /* 0x9 */
124 #define SSH2_DISCONNECT_CONNECTION_LOST 10 /* 0xa */
125 #define SSH2_DISCONNECT_BY_APPLICATION 11 /* 0xb */
126 #define SSH2_DISCONNECT_TOO_MANY_CONNECTIONS 12 /* 0xc */
127 #define SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER 13 /* 0xd */
128 #define SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14 /* 0xe */
129 #define SSH2_DISCONNECT_ILLEGAL_USER_NAME 15 /* 0xf */
131 static const char *const ssh2_disconnect_reasons[] = {
133 "host not allowed to connect",
135 "key exchange failed",
136 "host authentication failed",
139 "service not available",
140 "protocol version not supported",
141 "host key not verifiable",
144 "too many connections",
145 "auth cancelled by user",
146 "no more auth methods available",
150 #define SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED 1 /* 0x1 */
151 #define SSH2_OPEN_CONNECT_FAILED 2 /* 0x2 */
152 #define SSH2_OPEN_UNKNOWN_CHANNEL_TYPE 3 /* 0x3 */
153 #define SSH2_OPEN_RESOURCE_SHORTAGE 4 /* 0x4 */
155 #define SSH2_EXTENDED_DATA_STDERR 1 /* 0x1 */
158 * Various remote-bug flags.
160 #define BUG_CHOKES_ON_SSH1_IGNORE 1
161 #define BUG_SSH2_HMAC 2
162 #define BUG_NEEDS_SSH1_PLAIN_PASSWORD 4
163 #define BUG_CHOKES_ON_RSA 8
164 #define BUG_SSH2_RSA_PADDING 16
165 #define BUG_SSH2_DERIVEKEY 32
166 #define BUG_SSH2_REKEY 64
167 #define BUG_SSH2_PK_SESSIONID 128
170 * Codes for terminal modes.
171 * Most of these are the same in SSH-1 and SSH-2.
172 * This list is derived from draft-ietf-secsh-connect-25 and
175 static const struct {
176 const char* const mode;
178 enum { TTY_OP_CHAR, TTY_OP_BOOL } type;
180 /* "V" prefix discarded for special characters relative to SSH specs */
181 { "INTR", 1, TTY_OP_CHAR },
182 { "QUIT", 2, TTY_OP_CHAR },
183 { "ERASE", 3, TTY_OP_CHAR },
184 { "KILL", 4, TTY_OP_CHAR },
185 { "EOF", 5, TTY_OP_CHAR },
186 { "EOL", 6, TTY_OP_CHAR },
187 { "EOL2", 7, TTY_OP_CHAR },
188 { "START", 8, TTY_OP_CHAR },
189 { "STOP", 9, TTY_OP_CHAR },
190 { "SUSP", 10, TTY_OP_CHAR },
191 { "DSUSP", 11, TTY_OP_CHAR },
192 { "REPRINT", 12, TTY_OP_CHAR },
193 { "WERASE", 13, TTY_OP_CHAR },
194 { "LNEXT", 14, TTY_OP_CHAR },
195 { "FLUSH", 15, TTY_OP_CHAR },
196 { "SWTCH", 16, TTY_OP_CHAR },
197 { "STATUS", 17, TTY_OP_CHAR },
198 { "DISCARD", 18, TTY_OP_CHAR },
199 { "IGNPAR", 30, TTY_OP_BOOL },
200 { "PARMRK", 31, TTY_OP_BOOL },
201 { "INPCK", 32, TTY_OP_BOOL },
202 { "ISTRIP", 33, TTY_OP_BOOL },
203 { "INLCR", 34, TTY_OP_BOOL },
204 { "IGNCR", 35, TTY_OP_BOOL },
205 { "ICRNL", 36, TTY_OP_BOOL },
206 { "IUCLC", 37, TTY_OP_BOOL },
207 { "IXON", 38, TTY_OP_BOOL },
208 { "IXANY", 39, TTY_OP_BOOL },
209 { "IXOFF", 40, TTY_OP_BOOL },
210 { "IMAXBEL", 41, TTY_OP_BOOL },
211 { "ISIG", 50, TTY_OP_BOOL },
212 { "ICANON", 51, TTY_OP_BOOL },
213 { "XCASE", 52, TTY_OP_BOOL },
214 { "ECHO", 53, TTY_OP_BOOL },
215 { "ECHOE", 54, TTY_OP_BOOL },
216 { "ECHOK", 55, TTY_OP_BOOL },
217 { "ECHONL", 56, TTY_OP_BOOL },
218 { "NOFLSH", 57, TTY_OP_BOOL },
219 { "TOSTOP", 58, TTY_OP_BOOL },
220 { "IEXTEN", 59, TTY_OP_BOOL },
221 { "ECHOCTL", 60, TTY_OP_BOOL },
222 { "ECHOKE", 61, TTY_OP_BOOL },
223 { "PENDIN", 62, TTY_OP_BOOL }, /* XXX is this a real mode? */
224 { "OPOST", 70, TTY_OP_BOOL },
225 { "OLCUC", 71, TTY_OP_BOOL },
226 { "ONLCR", 72, TTY_OP_BOOL },
227 { "OCRNL", 73, TTY_OP_BOOL },
228 { "ONOCR", 74, TTY_OP_BOOL },
229 { "ONLRET", 75, TTY_OP_BOOL },
230 { "CS7", 90, TTY_OP_BOOL },
231 { "CS8", 91, TTY_OP_BOOL },
232 { "PARENB", 92, TTY_OP_BOOL },
233 { "PARODD", 93, TTY_OP_BOOL }
236 /* Miscellaneous other tty-related constants. */
237 #define SSH_TTY_OP_END 0
238 /* The opcodes for ISPEED/OSPEED differ between SSH-1 and SSH-2. */
239 #define SSH1_TTY_OP_ISPEED 192
240 #define SSH1_TTY_OP_OSPEED 193
241 #define SSH2_TTY_OP_ISPEED 128
242 #define SSH2_TTY_OP_OSPEED 129
244 /* Helper functions for parsing tty-related config. */
245 static unsigned int ssh_tty_parse_specchar(char *s)
250 ret = ctrlparse(s, &next);
251 if (!next) ret = s[0];
253 ret = 255; /* special value meaning "don't set" */
257 static unsigned int ssh_tty_parse_boolean(char *s)
259 if (stricmp(s, "yes") == 0 ||
260 stricmp(s, "on") == 0 ||
261 stricmp(s, "true") == 0 ||
262 stricmp(s, "+") == 0)
264 else if (stricmp(s, "no") == 0 ||
265 stricmp(s, "off") == 0 ||
266 stricmp(s, "false") == 0 ||
267 stricmp(s, "-") == 0)
268 return 0; /* false */
270 return (atoi(s) != 0);
273 #define translate(x) if (type == x) return #x
274 #define translatec(x,ctx) if (type == x && (pkt_ctx & ctx)) return #x
275 static char *ssh1_pkt_type(int type)
277 translate(SSH1_MSG_DISCONNECT);
278 translate(SSH1_SMSG_PUBLIC_KEY);
279 translate(SSH1_CMSG_SESSION_KEY);
280 translate(SSH1_CMSG_USER);
281 translate(SSH1_CMSG_AUTH_RSA);
282 translate(SSH1_SMSG_AUTH_RSA_CHALLENGE);
283 translate(SSH1_CMSG_AUTH_RSA_RESPONSE);
284 translate(SSH1_CMSG_AUTH_PASSWORD);
285 translate(SSH1_CMSG_REQUEST_PTY);
286 translate(SSH1_CMSG_WINDOW_SIZE);
287 translate(SSH1_CMSG_EXEC_SHELL);
288 translate(SSH1_CMSG_EXEC_CMD);
289 translate(SSH1_SMSG_SUCCESS);
290 translate(SSH1_SMSG_FAILURE);
291 translate(SSH1_CMSG_STDIN_DATA);
292 translate(SSH1_SMSG_STDOUT_DATA);
293 translate(SSH1_SMSG_STDERR_DATA);
294 translate(SSH1_CMSG_EOF);
295 translate(SSH1_SMSG_EXIT_STATUS);
296 translate(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
297 translate(SSH1_MSG_CHANNEL_OPEN_FAILURE);
298 translate(SSH1_MSG_CHANNEL_DATA);
299 translate(SSH1_MSG_CHANNEL_CLOSE);
300 translate(SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION);
301 translate(SSH1_SMSG_X11_OPEN);
302 translate(SSH1_CMSG_PORT_FORWARD_REQUEST);
303 translate(SSH1_MSG_PORT_OPEN);
304 translate(SSH1_CMSG_AGENT_REQUEST_FORWARDING);
305 translate(SSH1_SMSG_AGENT_OPEN);
306 translate(SSH1_MSG_IGNORE);
307 translate(SSH1_CMSG_EXIT_CONFIRMATION);
308 translate(SSH1_CMSG_X11_REQUEST_FORWARDING);
309 translate(SSH1_CMSG_AUTH_RHOSTS_RSA);
310 translate(SSH1_MSG_DEBUG);
311 translate(SSH1_CMSG_REQUEST_COMPRESSION);
312 translate(SSH1_CMSG_AUTH_TIS);
313 translate(SSH1_SMSG_AUTH_TIS_CHALLENGE);
314 translate(SSH1_CMSG_AUTH_TIS_RESPONSE);
315 translate(SSH1_CMSG_AUTH_CCARD);
316 translate(SSH1_SMSG_AUTH_CCARD_CHALLENGE);
317 translate(SSH1_CMSG_AUTH_CCARD_RESPONSE);
320 static char *ssh2_pkt_type(int pkt_ctx, int type)
322 translate(SSH2_MSG_DISCONNECT);
323 translate(SSH2_MSG_IGNORE);
324 translate(SSH2_MSG_UNIMPLEMENTED);
325 translate(SSH2_MSG_DEBUG);
326 translate(SSH2_MSG_SERVICE_REQUEST);
327 translate(SSH2_MSG_SERVICE_ACCEPT);
328 translate(SSH2_MSG_KEXINIT);
329 translate(SSH2_MSG_NEWKEYS);
330 translatec(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP);
331 translatec(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP);
332 translatec(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX);
333 translatec(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX);
334 translatec(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX);
335 translatec(SSH2_MSG_KEX_DH_GEX_REPLY, SSH2_PKTCTX_DHGEX);
336 translate(SSH2_MSG_USERAUTH_REQUEST);
337 translate(SSH2_MSG_USERAUTH_FAILURE);
338 translate(SSH2_MSG_USERAUTH_SUCCESS);
339 translate(SSH2_MSG_USERAUTH_BANNER);
340 translatec(SSH2_MSG_USERAUTH_PK_OK, SSH2_PKTCTX_PUBLICKEY);
341 translatec(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, SSH2_PKTCTX_PASSWORD);
342 translatec(SSH2_MSG_USERAUTH_INFO_REQUEST, SSH2_PKTCTX_KBDINTER);
343 translatec(SSH2_MSG_USERAUTH_INFO_RESPONSE, SSH2_PKTCTX_KBDINTER);
344 translate(SSH2_MSG_GLOBAL_REQUEST);
345 translate(SSH2_MSG_REQUEST_SUCCESS);
346 translate(SSH2_MSG_REQUEST_FAILURE);
347 translate(SSH2_MSG_CHANNEL_OPEN);
348 translate(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
349 translate(SSH2_MSG_CHANNEL_OPEN_FAILURE);
350 translate(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
351 translate(SSH2_MSG_CHANNEL_DATA);
352 translate(SSH2_MSG_CHANNEL_EXTENDED_DATA);
353 translate(SSH2_MSG_CHANNEL_EOF);
354 translate(SSH2_MSG_CHANNEL_CLOSE);
355 translate(SSH2_MSG_CHANNEL_REQUEST);
356 translate(SSH2_MSG_CHANNEL_SUCCESS);
357 translate(SSH2_MSG_CHANNEL_FAILURE);
363 /* Enumeration values for fields in SSH-1 packets */
365 PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM,
366 /* These values are for communicating relevant semantics of
367 * fields to the packet logging code. */
368 PKTT_OTHER, PKTT_PASSWORD, PKTT_DATA
372 * Coroutine mechanics for the sillier bits of the code. If these
373 * macros look impenetrable to you, you might find it helpful to
376 * http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html
378 * which explains the theory behind these macros.
380 * In particular, if you are getting `case expression not constant'
381 * errors when building with MS Visual Studio, this is because MS's
382 * Edit and Continue debugging feature causes their compiler to
383 * violate ANSI C. To disable Edit and Continue debugging:
385 * - right-click ssh.c in the FileView
387 * - select the C/C++ tab and the General category
388 * - under `Debug info:', select anything _other_ than `Program
389 * Database for Edit and Continue'.
391 #define crBegin(v) { int *crLine = &v; switch(v) { case 0:;
394 if (!ssh->t) ssh->t = snew(struct t); \
396 #define crFinish(z) } *crLine = 0; return (z); }
397 #define crFinishV } *crLine = 0; return; }
398 #define crReturn(z) \
400 *crLine =__LINE__; return (z); case __LINE__:;\
404 *crLine=__LINE__; return; case __LINE__:;\
406 #define crStop(z) do{ *crLine = 0; return (z); }while(0)
407 #define crStopV do{ *crLine = 0; return; }while(0)
408 #define crWaitUntil(c) do { crReturn(0); } while (!(c))
409 #define crWaitUntilV(c) do { crReturnV; } while (!(c))
411 typedef struct ssh_tag *Ssh;
414 static struct Packet *ssh1_pkt_init(int pkt_type);
415 static struct Packet *ssh2_pkt_init(int pkt_type);
416 static void ssh_pkt_ensure(struct Packet *, int length);
417 static void ssh_pkt_adddata(struct Packet *, void *data, int len);
418 static void ssh_pkt_addbyte(struct Packet *, unsigned char value);
419 static void ssh2_pkt_addbool(struct Packet *, unsigned char value);
420 static void ssh_pkt_adduint32(struct Packet *, unsigned long value);
421 static void ssh_pkt_addstring_start(struct Packet *);
422 static void ssh_pkt_addstring_str(struct Packet *, char *data);
423 static void ssh_pkt_addstring_data(struct Packet *, char *data, int len);
424 static void ssh_pkt_addstring(struct Packet *, char *data);
425 static unsigned char *ssh2_mpint_fmt(Bignum b, int *len);
426 static void ssh1_pkt_addmp(struct Packet *, Bignum b);
427 static void ssh2_pkt_addmp(struct Packet *, Bignum b);
428 static int ssh2_pkt_construct(Ssh, struct Packet *);
429 static void ssh2_pkt_send(Ssh, struct Packet *);
430 static void ssh2_pkt_send_noqueue(Ssh, struct Packet *);
431 static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
432 struct Packet *pktin);
433 static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
434 struct Packet *pktin);
437 * Buffer management constants. There are several of these for
438 * various different purposes:
440 * - SSH1_BUFFER_LIMIT is the amount of backlog that must build up
441 * on a local data stream before we throttle the whole SSH
442 * connection (in SSH-1 only). Throttling the whole connection is
443 * pretty drastic so we set this high in the hope it won't
446 * - SSH_MAX_BACKLOG is the amount of backlog that must build up
447 * on the SSH connection itself before we defensively throttle
448 * _all_ local data streams. This is pretty drastic too (though
449 * thankfully unlikely in SSH-2 since the window mechanism should
450 * ensure that the server never has any need to throttle its end
451 * of the connection), so we set this high as well.
453 * - OUR_V2_WINSIZE is the maximum window size we present on SSH-2
457 #define SSH1_BUFFER_LIMIT 32768
458 #define SSH_MAX_BACKLOG 32768
459 #define OUR_V2_WINSIZE 16384
460 #define OUR_V2_MAXPKT 0x4000UL
462 /* Maximum length of passwords/passphrases (arbitrary) */
463 #define SSH_MAX_PASSWORD_LEN 100
465 const static struct ssh_signkey *hostkey_algs[] = { &ssh_rsa, &ssh_dss };
467 const static struct ssh_mac *macs[] = {
468 &ssh_hmac_sha1, &ssh_hmac_sha1_96, &ssh_hmac_md5
470 const static struct ssh_mac *buggymacs[] = {
471 &ssh_hmac_sha1_buggy, &ssh_hmac_sha1_96_buggy, &ssh_hmac_md5
474 static void *ssh_comp_none_init(void)
478 static void ssh_comp_none_cleanup(void *handle)
481 static int ssh_comp_none_block(void *handle, unsigned char *block, int len,
482 unsigned char **outblock, int *outlen)
486 static int ssh_comp_none_disable(void *handle)
490 const static struct ssh_compress ssh_comp_none = {
492 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
493 ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
494 ssh_comp_none_disable, NULL
496 extern const struct ssh_compress ssh_zlib;
497 const static struct ssh_compress *compressions[] = {
498 &ssh_zlib, &ssh_comp_none
501 enum { /* channel types */
506 CHAN_SOCKDATA_DORMANT /* one the remote hasn't confirmed */
510 * 2-3-4 tree storing channels.
513 Ssh ssh; /* pointer back to main context */
514 unsigned remoteid, localid;
516 /* True if we opened this channel but server hasn't confirmed. */
519 * In SSH-1, this value contains four bits:
521 * 1 We have sent SSH1_MSG_CHANNEL_CLOSE.
522 * 2 We have sent SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
523 * 4 We have received SSH1_MSG_CHANNEL_CLOSE.
524 * 8 We have received SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
526 * A channel is completely finished with when all four bits are set.
530 struct ssh1_data_channel {
533 struct ssh2_data_channel {
535 unsigned remwindow, remmaxpkt;
540 struct ssh_agent_channel {
541 unsigned char *message;
542 unsigned char msglen[4];
543 unsigned lensofar, totallen;
545 struct ssh_x11_channel {
548 struct ssh_pfd_channel {
555 * 2-3-4 tree storing remote->local port forwardings. SSH-1 and SSH-2
556 * use this structure in different ways, reflecting SSH-2's
557 * altogether saner approach to port forwarding.
559 * In SSH-1, you arrange a remote forwarding by sending the server
560 * the remote port number, and the local destination host:port.
561 * When a connection comes in, the server sends you back that
562 * host:port pair, and you connect to it. This is a ready-made
563 * security hole if you're not on the ball: a malicious server
564 * could send you back _any_ host:port pair, so if you trustingly
565 * connect to the address it gives you then you've just opened the
566 * entire inside of your corporate network just by connecting
567 * through it to a dodgy SSH server. Hence, we must store a list of
568 * host:port pairs we _are_ trying to forward to, and reject a
569 * connection request from the server if it's not in the list.
571 * In SSH-2, each side of the connection minds its own business and
572 * doesn't send unnecessary information to the other. You arrange a
573 * remote forwarding by sending the server just the remote port
574 * number. When a connection comes in, the server tells you which
575 * of its ports was connected to; and _you_ have to remember what
576 * local host:port pair went with that port number.
578 * Hence, in SSH-1 this structure is indexed by destination
579 * host:port pair, whereas in SSH-2 it is indexed by source port.
581 struct ssh_portfwd; /* forward declaration */
583 struct ssh_rportfwd {
584 unsigned sport, dport;
587 struct ssh_portfwd *pfrec;
589 #define free_rportfwd(pf) ( \
590 ((pf) ? (sfree((pf)->sportdesc)) : (void)0 ), sfree(pf) )
593 * Separately to the rportfwd tree (which is for looking up port
594 * open requests from the server), a tree of _these_ structures is
595 * used to keep track of all the currently open port forwardings,
596 * so that we can reconfigure in mid-session if the user requests
600 enum { DESTROY, KEEP, CREATE } status;
602 unsigned sport, dport;
605 struct ssh_rportfwd *remote;
609 #define free_portfwd(pf) ( \
610 ((pf) ? (sfree((pf)->saddr), sfree((pf)->daddr), \
611 sfree((pf)->sserv), sfree((pf)->dserv)) : (void)0 ), sfree(pf) )
614 long length; /* length of `data' actually used */
615 long forcepad; /* SSH-2: force padding to at least this length */
616 int type; /* only used for incoming packets */
617 unsigned long sequence; /* SSH-2 incoming sequence number */
618 unsigned char *data; /* allocated storage */
619 unsigned char *body; /* offset of payload within `data' */
620 long savedpos; /* temporary index into `data' (for strings) */
621 long maxlen; /* amount of storage allocated for `data' */
622 long encrypted_len; /* for SSH-2 total-size counting */
625 * State associated with packet logging
629 struct logblank_t *blanks;
632 static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
633 struct Packet *pktin);
634 static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
635 struct Packet *pktin);
636 static void ssh1_protocol_setup(Ssh ssh);
637 static void ssh2_protocol_setup(Ssh ssh);
638 static void ssh_size(void *handle, int width, int height);
639 static void ssh_special(void *handle, Telnet_Special);
640 static int ssh2_try_send(struct ssh_channel *c);
641 static void ssh2_add_channel_data(struct ssh_channel *c, char *buf, int len);
642 static void ssh_throttle_all(Ssh ssh, int enable, int bufsize);
643 static void ssh2_set_window(struct ssh_channel *c, unsigned newwin);
644 static int ssh_sendbuffer(void *handle);
645 static int ssh_do_close(Ssh ssh, int notify_exit);
646 static unsigned long ssh_pkt_getuint32(struct Packet *pkt);
647 static int ssh2_pkt_getbool(struct Packet *pkt);
648 static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length);
649 static void ssh2_timer(void *ctx, long now);
650 static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
651 struct Packet *pktin);
653 struct rdpkt1_state_tag {
654 long len, pad, biglen, to_read;
655 unsigned long realcrc, gotcrc;
659 struct Packet *pktin;
662 struct rdpkt2_state_tag {
663 long len, pad, payload, packetlen, maclen;
666 unsigned long incoming_sequence;
667 struct Packet *pktin;
670 typedef void (*handler_fn_t)(Ssh ssh, struct Packet *pktin);
671 typedef void (*chandler_fn_t)(Ssh ssh, struct Packet *pktin, void *ctx);
673 struct queued_handler;
674 struct queued_handler {
676 chandler_fn_t handler;
678 struct queued_handler *next;
682 const struct plug_function_table *fn;
683 /* the above field _must_ be first in the structure */
693 unsigned char session_key[32];
695 int v1_remote_protoflags;
696 int v1_local_protoflags;
697 int agentfwd_enabled;
700 const struct ssh_cipher *cipher;
703 const struct ssh2_cipher *cscipher, *sccipher;
704 void *cs_cipher_ctx, *sc_cipher_ctx;
705 const struct ssh_mac *csmac, *scmac;
706 void *cs_mac_ctx, *sc_mac_ctx;
707 const struct ssh_compress *cscomp, *sccomp;
708 void *cs_comp_ctx, *sc_comp_ctx;
709 const struct ssh_kex *kex;
710 const struct ssh_signkey *hostkey;
711 unsigned char v2_session_id[32];
712 int v2_session_id_len;
718 int echoing, editing;
722 int ospeed, ispeed; /* temporaries */
723 int term_width, term_height;
725 tree234 *channels; /* indexed by local id */
726 struct ssh_channel *mainchan; /* primary session channel */
731 tree234 *rportfwds, *portfwds;
735 SSH_STATE_BEFORE_SIZE,
741 int size_needed, eof_needed;
743 struct Packet **queue;
744 int queuelen, queuesize;
746 unsigned char *deferred_send_data;
747 int deferred_len, deferred_size;
750 * Gross hack: pscp will try to start SFTP but fall back to
751 * scp1 if that fails. This variable is the means by which
752 * scp.c can reach into the SSH code and find out which one it
757 bufchain banner; /* accumulates banners during do_ssh2_authconn */
764 int v1_throttle_count;
767 int v1_stdout_throttling;
768 unsigned long v2_outgoing_sequence;
770 int ssh1_rdpkt_crstate;
771 int ssh2_rdpkt_crstate;
772 int do_ssh_init_crstate;
773 int ssh_gotdata_crstate;
774 int do_ssh1_login_crstate;
775 int do_ssh1_connection_crstate;
776 int do_ssh2_transport_crstate;
777 int do_ssh2_authconn_crstate;
779 void *do_ssh_init_state;
780 void *do_ssh1_login_state;
781 void *do_ssh2_transport_state;
782 void *do_ssh2_authconn_state;
784 struct rdpkt1_state_tag rdpkt1_state;
785 struct rdpkt2_state_tag rdpkt2_state;
787 /* SSH-1 and SSH-2 use this for different things, but both use it */
788 int protocol_initial_phase_done;
790 void (*protocol) (Ssh ssh, void *vin, int inlen,
792 struct Packet *(*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen);
795 * We maintain a full _copy_ of a Config structure here, not
796 * merely a pointer to it. That way, when we're passed a new
797 * one for reconfiguration, we can check the differences and
798 * potentially reconfigure port forwardings etc in mid-session.
803 * Used to transfer data back from async callbacks.
805 void *agent_response;
806 int agent_response_len;
810 * The SSH connection can be set as `frozen', meaning we are
811 * not currently accepting incoming data from the network. This
812 * is slightly more serious than setting the _socket_ as
813 * frozen, because we may already have had data passed to us
814 * from the network which we need to delay processing until
815 * after the freeze is lifted, so we also need a bufchain to
819 bufchain queued_incoming_data;
822 * Dispatch table for packet types that we may have to deal
825 handler_fn_t packet_dispatch[256];
828 * Queues of one-off handler functions for success/failure
829 * indications from a request.
831 struct queued_handler *qhead, *qtail;
834 * This module deals with sending keepalives.
839 * Track incoming and outgoing data sizes and time, for
842 unsigned long incoming_data_size, outgoing_data_size, deferred_data_size;
843 unsigned long max_data_size;
845 long next_rekey, last_rekey;
846 char *deferred_rekey_reason; /* points to STATIC string; don't free */
849 #define logevent(s) logevent(ssh->frontend, s)
851 /* logevent, only printf-formatted. */
852 static void logeventf(Ssh ssh, const char *fmt, ...)
858 buf = dupvprintf(fmt, ap);
864 #define bombout(msg) \
866 char *text = dupprintf msg; \
867 ssh_do_close(ssh, FALSE); \
869 connection_fatal(ssh->frontend, "%s", text); \
873 /* Functions to leave bits out of the SSH packet log file. */
875 static void dont_log_password(Ssh ssh, struct Packet *pkt, int blanktype)
877 if (ssh->cfg.logomitpass)
878 pkt->logmode = blanktype;
881 static void dont_log_data(Ssh ssh, struct Packet *pkt, int blanktype)
883 if (ssh->cfg.logomitdata)
884 pkt->logmode = blanktype;
887 static void end_log_omission(Ssh ssh, struct Packet *pkt)
889 pkt->logmode = PKTLOG_EMIT;
892 /* Helper function for common bits of parsing cfg.ttymodes. */
893 static void parse_ttymodes(Ssh ssh, char *modes,
894 void (*do_mode)(void *data, char *mode, char *val),
898 char *t = strchr(modes, '\t');
899 char *m = snewn(t-modes+1, char);
901 strncpy(m, modes, t-modes);
904 val = get_ttymode(ssh->frontend, m);
908 do_mode(data, m, val);
911 modes += strlen(modes) + 1;
915 static int ssh_channelcmp(void *av, void *bv)
917 struct ssh_channel *a = (struct ssh_channel *) av;
918 struct ssh_channel *b = (struct ssh_channel *) bv;
919 if (a->localid < b->localid)
921 if (a->localid > b->localid)
925 static int ssh_channelfind(void *av, void *bv)
927 unsigned *a = (unsigned *) av;
928 struct ssh_channel *b = (struct ssh_channel *) bv;
936 static int ssh_rportcmp_ssh1(void *av, void *bv)
938 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
939 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
941 if ( (i = strcmp(a->dhost, b->dhost)) != 0)
942 return i < 0 ? -1 : +1;
943 if (a->dport > b->dport)
945 if (a->dport < b->dport)
950 static int ssh_rportcmp_ssh2(void *av, void *bv)
952 struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
953 struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
955 if (a->sport > b->sport)
957 if (a->sport < b->sport)
963 * Special form of strcmp which can cope with NULL inputs. NULL is
964 * defined to sort before even the empty string.
966 static int nullstrcmp(const char *a, const char *b)
968 if (a == NULL && b == NULL)
977 static int ssh_portcmp(void *av, void *bv)
979 struct ssh_portfwd *a = (struct ssh_portfwd *) av;
980 struct ssh_portfwd *b = (struct ssh_portfwd *) bv;
982 if (a->type > b->type)
984 if (a->type < b->type)
986 if (a->addressfamily > b->addressfamily)
988 if (a->addressfamily < b->addressfamily)
990 if ( (i = nullstrcmp(a->saddr, b->saddr)) != 0)
991 return i < 0 ? -1 : +1;
992 if (a->sport > b->sport)
994 if (a->sport < b->sport)
996 if (a->type != 'D') {
997 if ( (i = nullstrcmp(a->daddr, b->daddr)) != 0)
998 return i < 0 ? -1 : +1;
999 if (a->dport > b->dport)
1001 if (a->dport < b->dport)
1007 static int alloc_channel_id(Ssh ssh)
1009 const unsigned CHANNEL_NUMBER_OFFSET = 256;
1010 unsigned low, high, mid;
1012 struct ssh_channel *c;
1015 * First-fit allocation of channel numbers: always pick the
1016 * lowest unused one. To do this, binary-search using the
1017 * counted B-tree to find the largest channel ID which is in a
1018 * contiguous sequence from the beginning. (Precisely
1019 * everything in that sequence must have ID equal to its tree
1020 * index plus CHANNEL_NUMBER_OFFSET.)
1022 tsize = count234(ssh->channels);
1026 while (high - low > 1) {
1027 mid = (high + low) / 2;
1028 c = index234(ssh->channels, mid);
1029 if (c->localid == mid + CHANNEL_NUMBER_OFFSET)
1030 low = mid; /* this one is fine */
1032 high = mid; /* this one is past it */
1035 * Now low points to either -1, or the tree index of the
1036 * largest ID in the initial sequence.
1039 unsigned i = low + 1 + CHANNEL_NUMBER_OFFSET;
1040 assert(NULL == find234(ssh->channels, &i, ssh_channelfind));
1042 return low + 1 + CHANNEL_NUMBER_OFFSET;
1045 static void c_write_stderr(int trusted, const char *buf, int len)
1048 for (i = 0; i < len; i++)
1049 if (buf[i] != '\r' && (trusted || buf[i] & 0x60))
1050 fputc(buf[i], stderr);
1053 static void c_write(Ssh ssh, const char *buf, int len)
1055 if (flags & FLAG_STDERR)
1056 c_write_stderr(1, buf, len);
1058 from_backend(ssh->frontend, 1, buf, len);
1061 static void c_write_untrusted(Ssh ssh, const char *buf, int len)
1063 if (flags & FLAG_STDERR)
1064 c_write_stderr(0, buf, len);
1066 from_backend_untrusted(ssh->frontend, buf, len);
1069 static void c_write_str(Ssh ssh, const char *buf)
1071 c_write(ssh, buf, strlen(buf));
1074 static void ssh_free_packet(struct Packet *pkt)
1079 static struct Packet *ssh_new_packet(void)
1081 struct Packet *pkt = snew(struct Packet);
1083 pkt->body = pkt->data = NULL;
1085 pkt->logmode = PKTLOG_EMIT;
1093 * Collect incoming data in the incoming packet buffer.
1094 * Decipher and verify the packet when it is completely read.
1095 * Drop SSH1_MSG_DEBUG and SSH1_MSG_IGNORE packets.
1096 * Update the *data and *datalen variables.
1097 * Return a Packet structure when a packet is completed.
1099 static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
1101 struct rdpkt1_state_tag *st = &ssh->rdpkt1_state;
1103 crBegin(ssh->ssh1_rdpkt_crstate);
1105 st->pktin = ssh_new_packet();
1107 st->pktin->type = 0;
1108 st->pktin->length = 0;
1110 for (st->i = st->len = 0; st->i < 4; st->i++) {
1111 while ((*datalen) == 0)
1113 st->len = (st->len << 8) + **data;
1114 (*data)++, (*datalen)--;
1117 st->pad = 8 - (st->len % 8);
1118 st->biglen = st->len + st->pad;
1119 st->pktin->length = st->len - 5;
1121 if (st->biglen < 0) {
1122 bombout(("Extremely large packet length from server suggests"
1123 " data stream corruption"));
1124 ssh_free_packet(st->pktin);
1128 st->pktin->maxlen = st->biglen;
1129 st->pktin->data = snewn(st->biglen + APIEXTRA, unsigned char);
1131 st->to_read = st->biglen;
1132 st->p = st->pktin->data;
1133 while (st->to_read > 0) {
1134 st->chunk = st->to_read;
1135 while ((*datalen) == 0)
1137 if (st->chunk > (*datalen))
1138 st->chunk = (*datalen);
1139 memcpy(st->p, *data, st->chunk);
1141 *datalen -= st->chunk;
1143 st->to_read -= st->chunk;
1146 if (ssh->cipher && detect_attack(ssh->crcda_ctx, st->pktin->data,
1147 st->biglen, NULL)) {
1148 bombout(("Network attack (CRC compensation) detected!"));
1149 ssh_free_packet(st->pktin);
1154 ssh->cipher->decrypt(ssh->v1_cipher_ctx, st->pktin->data, st->biglen);
1156 st->realcrc = crc32_compute(st->pktin->data, st->biglen - 4);
1157 st->gotcrc = GET_32BIT(st->pktin->data + st->biglen - 4);
1158 if (st->gotcrc != st->realcrc) {
1159 bombout(("Incorrect CRC received on packet"));
1160 ssh_free_packet(st->pktin);
1164 st->pktin->body = st->pktin->data + st->pad + 1;
1165 st->pktin->savedpos = 0;
1167 if (ssh->v1_compressing) {
1168 unsigned char *decompblk;
1170 if (!zlib_decompress_block(ssh->sc_comp_ctx,
1171 st->pktin->body - 1, st->pktin->length + 1,
1172 &decompblk, &decomplen)) {
1173 bombout(("Zlib decompression encountered invalid data"));
1174 ssh_free_packet(st->pktin);
1178 if (st->pktin->maxlen < st->pad + decomplen) {
1179 st->pktin->maxlen = st->pad + decomplen;
1180 st->pktin->data = sresize(st->pktin->data,
1181 st->pktin->maxlen + APIEXTRA,
1183 st->pktin->body = st->pktin->data + st->pad + 1;
1186 memcpy(st->pktin->body - 1, decompblk, decomplen);
1188 st->pktin->length = decomplen - 1;
1191 st->pktin->type = st->pktin->body[-1];
1194 * Log incoming packet, possibly omitting sensitive fields.
1198 struct logblank_t blank;
1199 if (ssh->cfg.logomitdata) {
1200 int do_blank = FALSE, blank_prefix = 0;
1201 /* "Session data" packets - omit the data field */
1202 if ((st->pktin->type == SSH1_SMSG_STDOUT_DATA) ||
1203 (st->pktin->type == SSH1_SMSG_STDERR_DATA)) {
1204 do_blank = TRUE; blank_prefix = 0;
1205 } else if (st->pktin->type == SSH1_MSG_CHANNEL_DATA) {
1206 do_blank = TRUE; blank_prefix = 4;
1209 blank.offset = blank_prefix;
1210 blank.len = st->pktin->length;
1211 blank.type = PKTLOG_OMIT;
1215 log_packet(ssh->logctx,
1216 PKT_INCOMING, st->pktin->type,
1217 ssh1_pkt_type(st->pktin->type),
1218 st->pktin->body, st->pktin->length,
1222 crFinish(st->pktin);
1225 static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
1227 struct rdpkt2_state_tag *st = &ssh->rdpkt2_state;
1229 crBegin(ssh->ssh2_rdpkt_crstate);
1231 st->pktin = ssh_new_packet();
1233 st->pktin->type = 0;
1234 st->pktin->length = 0;
1236 st->cipherblk = ssh->sccipher->blksize;
1239 if (st->cipherblk < 8)
1242 st->pktin->data = snewn(st->cipherblk + APIEXTRA, unsigned char);
1245 * Acquire and decrypt the first block of the packet. This will
1246 * contain the length and padding details.
1248 for (st->i = st->len = 0; st->i < st->cipherblk; st->i++) {
1249 while ((*datalen) == 0)
1251 st->pktin->data[st->i] = *(*data)++;
1256 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1257 st->pktin->data, st->cipherblk);
1260 * Now get the length and padding figures.
1262 st->len = GET_32BIT(st->pktin->data);
1263 st->pad = st->pktin->data[4];
1266 * _Completely_ silly lengths should be stomped on before they
1267 * do us any more damage.
1269 if (st->len < 0 || st->len > 35000 || st->pad < 4 ||
1270 st->len - st->pad < 1 || (st->len + 4) % st->cipherblk != 0) {
1271 bombout(("Incoming packet was garbled on decryption"));
1272 ssh_free_packet(st->pktin);
1277 * This enables us to deduce the payload length.
1279 st->payload = st->len - st->pad - 1;
1281 st->pktin->length = st->payload + 5;
1284 * So now we can work out the total packet length.
1286 st->packetlen = st->len + 4;
1287 st->maclen = ssh->scmac ? ssh->scmac->len : 0;
1290 * Allocate memory for the rest of the packet.
1292 st->pktin->maxlen = st->packetlen + st->maclen;
1293 st->pktin->data = sresize(st->pktin->data,
1294 st->pktin->maxlen + APIEXTRA,
1298 * Read and decrypt the remainder of the packet.
1300 for (st->i = st->cipherblk; st->i < st->packetlen + st->maclen;
1302 while ((*datalen) == 0)
1304 st->pktin->data[st->i] = *(*data)++;
1307 /* Decrypt everything _except_ the MAC. */
1309 ssh->sccipher->decrypt(ssh->sc_cipher_ctx,
1310 st->pktin->data + st->cipherblk,
1311 st->packetlen - st->cipherblk);
1313 st->pktin->encrypted_len = st->packetlen;
1319 && !ssh->scmac->verify(ssh->sc_mac_ctx, st->pktin->data, st->len + 4,
1320 st->incoming_sequence)) {
1321 bombout(("Incorrect MAC received on packet"));
1322 ssh_free_packet(st->pktin);
1326 st->pktin->sequence = st->incoming_sequence++;
1329 * Decompress packet payload.
1332 unsigned char *newpayload;
1335 ssh->sccomp->decompress(ssh->sc_comp_ctx,
1336 st->pktin->data + 5, st->pktin->length - 5,
1337 &newpayload, &newlen)) {
1338 if (st->pktin->maxlen < newlen + 5) {
1339 st->pktin->maxlen = newlen + 5;
1340 st->pktin->data = sresize(st->pktin->data,
1341 st->pktin->maxlen + APIEXTRA,
1344 st->pktin->length = 5 + newlen;
1345 memcpy(st->pktin->data + 5, newpayload, newlen);
1350 st->pktin->savedpos = 6;
1351 st->pktin->body = st->pktin->data;
1352 st->pktin->type = st->pktin->data[5];
1355 * Log incoming packet, possibly omitting sensitive fields.
1359 struct logblank_t blank;
1360 if (ssh->cfg.logomitdata) {
1361 int do_blank = FALSE, blank_prefix = 0;
1362 /* "Session data" packets - omit the data field */
1363 if (st->pktin->type == SSH2_MSG_CHANNEL_DATA) {
1364 do_blank = TRUE; blank_prefix = 4;
1365 } else if (st->pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA) {
1366 do_blank = TRUE; blank_prefix = 8;
1369 blank.offset = blank_prefix;
1370 blank.len = (st->pktin->length-6) - blank_prefix;
1371 blank.type = PKTLOG_OMIT;
1375 log_packet(ssh->logctx, PKT_INCOMING, st->pktin->type,
1376 ssh2_pkt_type(ssh->pkt_ctx, st->pktin->type),
1377 st->pktin->data+6, st->pktin->length-6,
1381 crFinish(st->pktin);
1384 static int s_wrpkt_prepare(Ssh ssh, struct Packet *pkt, int *offset_p)
1386 int pad, biglen, i, pktoffs;
1390 * XXX various versions of SC (including 8.8.4) screw up the
1391 * register allocation in this function and use the same register
1392 * (D6) for len and as a temporary, with predictable results. The
1393 * following sledgehammer prevents this.
1400 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[12],
1401 ssh1_pkt_type(pkt->data[12]),
1402 pkt->body, pkt->length - (pkt->body - pkt->data),
1403 pkt->nblanks, pkt->blanks);
1404 sfree(pkt->blanks); pkt->blanks = NULL;
1407 if (ssh->v1_compressing) {
1408 unsigned char *compblk;
1410 zlib_compress_block(ssh->cs_comp_ctx,
1411 pkt->data + 12, pkt->length - 12,
1412 &compblk, &complen);
1413 memcpy(pkt->data + 12, compblk, complen);
1415 pkt->length = complen + 12;
1418 ssh_pkt_ensure(pkt, pkt->length + 4); /* space for CRC */
1420 len = pkt->length - 4 - 8; /* len(type+data+CRC) */
1421 pad = 8 - (len % 8);
1423 biglen = len + pad; /* len(padding+type+data+CRC) */
1425 for (i = pktoffs; i < 4+8; i++)
1426 pkt->data[i] = random_byte();
1427 crc = crc32_compute(pkt->data + pktoffs + 4, biglen - 4); /* all ex len */
1428 PUT_32BIT(pkt->data + pktoffs + 4 + biglen - 4, crc);
1429 PUT_32BIT(pkt->data + pktoffs, len);
1432 ssh->cipher->encrypt(ssh->v1_cipher_ctx,
1433 pkt->data + pktoffs + 4, biglen);
1435 if (offset_p) *offset_p = pktoffs;
1436 return biglen + 4; /* len(length+padding+type+data+CRC) */
1439 static void s_wrpkt(Ssh ssh, struct Packet *pkt)
1441 int len, backlog, offset;
1442 len = s_wrpkt_prepare(ssh, pkt, &offset);
1443 backlog = sk_write(ssh->s, (char *)pkt->data + offset, len);
1444 if (backlog > SSH_MAX_BACKLOG)
1445 ssh_throttle_all(ssh, 1, backlog);
1446 ssh_free_packet(pkt);
1449 static void s_wrpkt_defer(Ssh ssh, struct Packet *pkt)
1452 len = s_wrpkt_prepare(ssh, pkt, &offset);
1453 if (ssh->deferred_len + len > ssh->deferred_size) {
1454 ssh->deferred_size = ssh->deferred_len + len + 128;
1455 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
1459 memcpy(ssh->deferred_send_data + ssh->deferred_len,
1460 pkt->data + offset, len);
1461 ssh->deferred_len += len;
1462 ssh_free_packet(pkt);
1466 * Construct a SSH-1 packet with the specified contents.
1467 * (This all-at-once interface used to be the only one, but now SSH-1
1468 * packets can also be constructed incrementally.)
1470 static struct Packet *construct_packet(Ssh ssh, int pkttype, va_list ap)
1476 pkt = ssh1_pkt_init(pkttype);
1478 while ((argtype = va_arg(ap, int)) != PKT_END) {
1479 unsigned char *argp, argchar;
1480 unsigned long argint;
1483 /* Actual fields in the packet */
1485 argint = va_arg(ap, int);
1486 ssh_pkt_adduint32(pkt, argint);
1489 argchar = (unsigned char) va_arg(ap, int);
1490 ssh_pkt_addbyte(pkt, argchar);
1493 argp = va_arg(ap, unsigned char *);
1494 arglen = va_arg(ap, int);
1495 ssh_pkt_adddata(pkt, argp, arglen);
1498 argp = va_arg(ap, unsigned char *);
1499 ssh_pkt_addstring(pkt, argp);
1502 bn = va_arg(ap, Bignum);
1503 ssh1_pkt_addmp(pkt, bn);
1505 /* Tokens for modifications to packet logging */
1507 dont_log_password(ssh, pkt, PKTLOG_BLANK);
1510 dont_log_data(ssh, pkt, PKTLOG_OMIT);
1513 end_log_omission(ssh, pkt);
1521 static void send_packet(Ssh ssh, int pkttype, ...)
1525 va_start(ap, pkttype);
1526 pkt = construct_packet(ssh, pkttype, ap);
1531 static void defer_packet(Ssh ssh, int pkttype, ...)
1535 va_start(ap, pkttype);
1536 pkt = construct_packet(ssh, pkttype, ap);
1538 s_wrpkt_defer(ssh, pkt);
1541 static int ssh_versioncmp(char *a, char *b)
1544 unsigned long av, bv;
1546 av = strtoul(a, &ae, 10);
1547 bv = strtoul(b, &be, 10);
1549 return (av < bv ? -1 : +1);
1554 av = strtoul(ae, &ae, 10);
1555 bv = strtoul(be, &be, 10);
1557 return (av < bv ? -1 : +1);
1562 * Utility routines for putting an SSH-protocol `string' and
1563 * `uint32' into a hash state.
1565 static void hash_string(const struct ssh_hash *h, void *s, void *str, int len)
1567 unsigned char lenblk[4];
1568 PUT_32BIT(lenblk, len);
1569 h->bytes(s, lenblk, 4);
1570 h->bytes(s, str, len);
1573 static void hash_uint32(const struct ssh_hash *h, void *s, unsigned i)
1575 unsigned char intblk[4];
1576 PUT_32BIT(intblk, i);
1577 h->bytes(s, intblk, 4);
1581 * Packet construction functions. Mostly shared between SSH-1 and SSH-2.
1583 static void ssh_pkt_ensure(struct Packet *pkt, int length)
1585 if (pkt->maxlen < length) {
1586 unsigned char *body = pkt->body;
1587 int offset = body ? body - pkt->data : 0;
1588 pkt->maxlen = length + 256;
1589 pkt->data = sresize(pkt->data, pkt->maxlen + APIEXTRA, unsigned char);
1590 if (body) pkt->body = pkt->data + offset;
1593 static void ssh_pkt_adddata(struct Packet *pkt, void *data, int len)
1595 if (pkt->logmode != PKTLOG_EMIT) {
1597 pkt->blanks = sresize(pkt->blanks, pkt->nblanks, struct logblank_t);
1599 pkt->blanks[pkt->nblanks-1].offset = pkt->length -
1600 (pkt->body - pkt->data);
1601 pkt->blanks[pkt->nblanks-1].len = len;
1602 pkt->blanks[pkt->nblanks-1].type = pkt->logmode;
1605 ssh_pkt_ensure(pkt, pkt->length);
1606 memcpy(pkt->data + pkt->length - len, data, len);
1608 static void ssh_pkt_addbyte(struct Packet *pkt, unsigned char byte)
1610 ssh_pkt_adddata(pkt, &byte, 1);
1612 static void ssh2_pkt_addbool(struct Packet *pkt, unsigned char value)
1614 ssh_pkt_adddata(pkt, &value, 1);
1616 static void ssh_pkt_adduint32(struct Packet *pkt, unsigned long value)
1619 PUT_32BIT(x, value);
1620 ssh_pkt_adddata(pkt, x, 4);
1622 static void ssh_pkt_addstring_start(struct Packet *pkt)
1624 ssh_pkt_adduint32(pkt, 0);
1625 pkt->savedpos = pkt->length;
1627 static void ssh_pkt_addstring_str(struct Packet *pkt, char *data)
1629 ssh_pkt_adddata(pkt, data, strlen(data));
1630 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
1632 static void ssh_pkt_addstring_data(struct Packet *pkt, char *data, int len)
1634 ssh_pkt_adddata(pkt, data, len);
1635 PUT_32BIT(pkt->data + pkt->savedpos - 4, pkt->length - pkt->savedpos);
1637 static void ssh_pkt_addstring(struct Packet *pkt, char *data)
1639 ssh_pkt_addstring_start(pkt);
1640 ssh_pkt_addstring_str(pkt, data);
1642 static void ssh1_pkt_addmp(struct Packet *pkt, Bignum b)
1644 int len = ssh1_bignum_length(b);
1645 unsigned char *data = snewn(len, char);
1646 (void) ssh1_write_bignum(data, b);
1647 ssh_pkt_adddata(pkt, data, len);
1650 static unsigned char *ssh2_mpint_fmt(Bignum b, int *len)
1653 int i, n = (bignum_bitcount(b) + 7) / 8;
1654 p = snewn(n + 1, unsigned char);
1656 for (i = 1; i <= n; i++)
1657 p[i] = bignum_byte(b, n - i);
1659 while (i <= n && p[i] == 0 && (p[i + 1] & 0x80) == 0)
1661 memmove(p, p + i, n + 1 - i);
1665 static void ssh2_pkt_addmp(struct Packet *pkt, Bignum b)
1669 p = ssh2_mpint_fmt(b, &len);
1670 ssh_pkt_addstring_start(pkt);
1671 ssh_pkt_addstring_data(pkt, (char *)p, len);
1675 static struct Packet *ssh1_pkt_init(int pkt_type)
1677 struct Packet *pkt = ssh_new_packet();
1678 pkt->length = 4 + 8; /* space for length + max padding */
1679 ssh_pkt_addbyte(pkt, pkt_type);
1680 pkt->body = pkt->data + pkt->length;
1684 /* For legacy code (SSH-1 and -2 packet construction used to be separate) */
1685 #define ssh2_pkt_ensure(pkt, length) ssh_pkt_ensure(pkt, length)
1686 #define ssh2_pkt_adddata(pkt, data, len) ssh_pkt_adddata(pkt, data, len)
1687 #define ssh2_pkt_addbyte(pkt, byte) ssh_pkt_addbyte(pkt, byte)
1688 #define ssh2_pkt_adduint32(pkt, value) ssh_pkt_adduint32(pkt, value)
1689 #define ssh2_pkt_addstring_start(pkt) ssh_pkt_addstring_start(pkt)
1690 #define ssh2_pkt_addstring_str(pkt, data) ssh_pkt_addstring_str(pkt, data)
1691 #define ssh2_pkt_addstring_data(pkt, data, len) ssh_pkt_addstring_data(pkt, data, len)
1692 #define ssh2_pkt_addstring(pkt, data) ssh_pkt_addstring(pkt, data)
1694 static struct Packet *ssh2_pkt_init(int pkt_type)
1696 struct Packet *pkt = ssh_new_packet();
1697 pkt->length = 5; /* space for packet length + padding length */
1699 ssh_pkt_addbyte(pkt, (unsigned char) pkt_type);
1700 pkt->body = pkt->data + pkt->length; /* after packet type */
1705 * Construct an SSH-2 final-form packet: compress it, encrypt it,
1706 * put the MAC on it. Final packet, ready to be sent, is stored in
1707 * pkt->data. Total length is returned.
1709 static int ssh2_pkt_construct(Ssh ssh, struct Packet *pkt)
1711 int cipherblk, maclen, padding, i;
1714 log_packet(ssh->logctx, PKT_OUTGOING, pkt->data[5],
1715 ssh2_pkt_type(ssh->pkt_ctx, pkt->data[5]),
1716 pkt->body, pkt->length - (pkt->body - pkt->data),
1717 pkt->nblanks, pkt->blanks);
1718 sfree(pkt->blanks); pkt->blanks = NULL;
1722 * Compress packet payload.
1725 unsigned char *newpayload;
1728 ssh->cscomp->compress(ssh->cs_comp_ctx, pkt->data + 5,
1730 &newpayload, &newlen)) {
1732 ssh2_pkt_adddata(pkt, newpayload, newlen);
1738 * Add padding. At least four bytes, and must also bring total
1739 * length (minus MAC) up to a multiple of the block size.
1740 * If pkt->forcepad is set, make sure the packet is at least that size
1743 cipherblk = ssh->cscipher ? ssh->cscipher->blksize : 8; /* block size */
1744 cipherblk = cipherblk < 8 ? 8 : cipherblk; /* or 8 if blksize < 8 */
1746 if (pkt->length + padding < pkt->forcepad)
1747 padding = pkt->forcepad - pkt->length;
1749 (cipherblk - (pkt->length + padding) % cipherblk) % cipherblk;
1750 assert(padding <= 255);
1751 maclen = ssh->csmac ? ssh->csmac->len : 0;
1752 ssh2_pkt_ensure(pkt, pkt->length + padding + maclen);
1753 pkt->data[4] = padding;
1754 for (i = 0; i < padding; i++)
1755 pkt->data[pkt->length + i] = random_byte();
1756 PUT_32BIT(pkt->data, pkt->length + padding - 4);
1758 ssh->csmac->generate(ssh->cs_mac_ctx, pkt->data,
1759 pkt->length + padding,
1760 ssh->v2_outgoing_sequence);
1761 ssh->v2_outgoing_sequence++; /* whether or not we MACed */
1764 ssh->cscipher->encrypt(ssh->cs_cipher_ctx,
1765 pkt->data, pkt->length + padding);
1767 pkt->encrypted_len = pkt->length + padding;
1769 /* Ready-to-send packet starts at pkt->data. We return length. */
1770 return pkt->length + padding + maclen;
1774 * Routines called from the main SSH code to send packets. There
1775 * are quite a few of these, because we have two separate
1776 * mechanisms for delaying the sending of packets:
1778 * - In order to send an IGNORE message and a password message in
1779 * a single fixed-length blob, we require the ability to
1780 * concatenate the encrypted forms of those two packets _into_ a
1781 * single blob and then pass it to our <network.h> transport
1782 * layer in one go. Hence, there's a deferment mechanism which
1783 * works after packet encryption.
1785 * - In order to avoid sending any connection-layer messages
1786 * during repeat key exchange, we have to queue up any such
1787 * outgoing messages _before_ they are encrypted (and in
1788 * particular before they're allocated sequence numbers), and
1789 * then send them once we've finished.
1791 * I call these mechanisms `defer' and `queue' respectively, so as
1792 * to distinguish them reasonably easily.
1794 * The functions send_noqueue() and defer_noqueue() free the packet
1795 * structure they are passed. Every outgoing packet goes through
1796 * precisely one of these functions in its life; packets passed to
1797 * ssh2_pkt_send() or ssh2_pkt_defer() either go straight to one of
1798 * these or get queued, and then when the queue is later emptied
1799 * the packets are all passed to defer_noqueue().
1801 * When using a CBC-mode cipher, it's necessary to ensure that an
1802 * attacker can't provide data to be encrypted using an IV that they
1803 * know. We ensure this by prefixing each packet that might contain
1804 * user data with an SSH_MSG_IGNORE. This is done using the deferral
1805 * mechanism, so in this case send_noqueue() ends up redirecting to
1806 * defer_noqueue(). If you don't like this inefficiency, don't use
1810 static void ssh2_pkt_defer_noqueue(Ssh, struct Packet *, int);
1811 static void ssh_pkt_defersend(Ssh);
1814 * Send an SSH-2 packet immediately, without queuing or deferring.
1816 static void ssh2_pkt_send_noqueue(Ssh ssh, struct Packet *pkt)
1820 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC)) {
1821 /* We need to send two packets, so use the deferral mechanism. */
1822 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
1823 ssh_pkt_defersend(ssh);
1826 len = ssh2_pkt_construct(ssh, pkt);
1827 backlog = sk_write(ssh->s, (char *)pkt->data, len);
1828 if (backlog > SSH_MAX_BACKLOG)
1829 ssh_throttle_all(ssh, 1, backlog);
1831 ssh->outgoing_data_size += pkt->encrypted_len;
1832 if (!ssh->kex_in_progress &&
1833 ssh->max_data_size != 0 &&
1834 ssh->outgoing_data_size > ssh->max_data_size)
1835 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
1837 ssh_free_packet(pkt);
1841 * Defer an SSH-2 packet.
1843 static void ssh2_pkt_defer_noqueue(Ssh ssh, struct Packet *pkt, int noignore)
1846 if (ssh->cscipher != NULL && (ssh->cscipher->flags & SSH_CIPHER_IS_CBC) &&
1847 ssh->deferred_len == 0 && !noignore) {
1849 * Interpose an SSH_MSG_IGNORE to ensure that user data don't
1850 * get encrypted with a known IV.
1852 struct Packet *ipkt = ssh2_pkt_init(SSH2_MSG_IGNORE);
1853 ssh2_pkt_defer_noqueue(ssh, ipkt, TRUE);
1855 len = ssh2_pkt_construct(ssh, pkt);
1856 if (ssh->deferred_len + len > ssh->deferred_size) {
1857 ssh->deferred_size = ssh->deferred_len + len + 128;
1858 ssh->deferred_send_data = sresize(ssh->deferred_send_data,
1862 memcpy(ssh->deferred_send_data + ssh->deferred_len, pkt->data, len);
1863 ssh->deferred_len += len;
1864 ssh->deferred_data_size += pkt->encrypted_len;
1865 ssh_free_packet(pkt);
1869 * Queue an SSH-2 packet.
1871 static void ssh2_pkt_queue(Ssh ssh, struct Packet *pkt)
1873 assert(ssh->queueing);
1875 if (ssh->queuelen >= ssh->queuesize) {
1876 ssh->queuesize = ssh->queuelen + 32;
1877 ssh->queue = sresize(ssh->queue, ssh->queuesize, struct Packet *);
1880 ssh->queue[ssh->queuelen++] = pkt;
1884 * Either queue or send a packet, depending on whether queueing is
1887 static void ssh2_pkt_send(Ssh ssh, struct Packet *pkt)
1890 ssh2_pkt_queue(ssh, pkt);
1892 ssh2_pkt_send_noqueue(ssh, pkt);
1897 * Either queue or defer a packet, depending on whether queueing is
1900 static void ssh2_pkt_defer(Ssh ssh, struct Packet *pkt)
1903 ssh2_pkt_queue(ssh, pkt);
1905 ssh2_pkt_defer_noqueue(ssh, pkt, FALSE);
1910 * Send the whole deferred data block constructed by
1911 * ssh2_pkt_defer() or SSH-1's defer_packet().
1913 * The expected use of the defer mechanism is that you call
1914 * ssh2_pkt_defer() a few times, then call ssh_pkt_defersend(). If
1915 * not currently queueing, this simply sets up deferred_send_data
1916 * and then sends it. If we _are_ currently queueing, the calls to
1917 * ssh2_pkt_defer() put the deferred packets on to the queue
1918 * instead, and therefore ssh_pkt_defersend() has no deferred data
1919 * to send. Hence, there's no need to make it conditional on
1922 static void ssh_pkt_defersend(Ssh ssh)
1925 backlog = sk_write(ssh->s, (char *)ssh->deferred_send_data,
1927 ssh->deferred_len = ssh->deferred_size = 0;
1928 sfree(ssh->deferred_send_data);
1929 ssh->deferred_send_data = NULL;
1930 if (backlog > SSH_MAX_BACKLOG)
1931 ssh_throttle_all(ssh, 1, backlog);
1933 ssh->outgoing_data_size += ssh->deferred_data_size;
1934 if (!ssh->kex_in_progress &&
1935 ssh->max_data_size != 0 &&
1936 ssh->outgoing_data_size > ssh->max_data_size)
1937 do_ssh2_transport(ssh, "too much data sent", -1, NULL);
1938 ssh->deferred_data_size = 0;
1942 * Send all queued SSH-2 packets. We send them by means of
1943 * ssh2_pkt_defer_noqueue(), in case they included a pair of
1944 * packets that needed to be lumped together.
1946 static void ssh2_pkt_queuesend(Ssh ssh)
1950 assert(!ssh->queueing);
1952 for (i = 0; i < ssh->queuelen; i++)
1953 ssh2_pkt_defer_noqueue(ssh, ssh->queue[i], FALSE);
1956 ssh_pkt_defersend(ssh);
1960 void bndebug(char *string, Bignum b)
1964 p = ssh2_mpint_fmt(b, &len);
1965 debug(("%s", string));
1966 for (i = 0; i < len; i++)
1967 debug((" %02x", p[i]));
1973 static void hash_mpint(const struct ssh_hash *h, void *s, Bignum b)
1977 p = ssh2_mpint_fmt(b, &len);
1978 hash_string(h, s, p, len);
1983 * Packet decode functions for both SSH-1 and SSH-2.
1985 static unsigned long ssh_pkt_getuint32(struct Packet *pkt)
1987 unsigned long value;
1988 if (pkt->length - pkt->savedpos < 4)
1989 return 0; /* arrgh, no way to decline (FIXME?) */
1990 value = GET_32BIT(pkt->body + pkt->savedpos);
1994 static int ssh2_pkt_getbool(struct Packet *pkt)
1996 unsigned long value;
1997 if (pkt->length - pkt->savedpos < 1)
1998 return 0; /* arrgh, no way to decline (FIXME?) */
1999 value = pkt->body[pkt->savedpos] != 0;
2003 static void ssh_pkt_getstring(struct Packet *pkt, char **p, int *length)
2008 if (pkt->length - pkt->savedpos < 4)
2010 len = GET_32BIT(pkt->body + pkt->savedpos);
2015 if (pkt->length - pkt->savedpos < *length)
2017 *p = (char *)(pkt->body + pkt->savedpos);
2018 pkt->savedpos += *length;
2020 static void *ssh_pkt_getdata(struct Packet *pkt, int length)
2022 if (pkt->length - pkt->savedpos < length)
2024 pkt->savedpos += length;
2025 return pkt->body + (pkt->savedpos - length);
2027 static int ssh1_pkt_getrsakey(struct Packet *pkt, struct RSAKey *key,
2028 unsigned char **keystr)
2032 j = makekey(pkt->body + pkt->savedpos,
2033 pkt->length - pkt->savedpos,
2040 assert(pkt->savedpos < pkt->length);
2044 static Bignum ssh1_pkt_getmp(struct Packet *pkt)
2049 j = ssh1_read_bignum(pkt->body + pkt->savedpos,
2050 pkt->length - pkt->savedpos, &b);
2058 static Bignum ssh2_pkt_getmp(struct Packet *pkt)
2064 ssh_pkt_getstring(pkt, &p, &length);
2069 b = bignum_from_bytes((unsigned char *)p, length);
2074 * Helper function to add an SSH-2 signature blob to a packet.
2075 * Expects to be shown the public key blob as well as the signature
2076 * blob. Normally works just like ssh2_pkt_addstring, but will
2077 * fiddle with the signature packet if necessary for
2078 * BUG_SSH2_RSA_PADDING.
2080 static void ssh2_add_sigblob(Ssh ssh, struct Packet *pkt,
2081 void *pkblob_v, int pkblob_len,
2082 void *sigblob_v, int sigblob_len)
2084 unsigned char *pkblob = (unsigned char *)pkblob_v;
2085 unsigned char *sigblob = (unsigned char *)sigblob_v;
2087 /* dmemdump(pkblob, pkblob_len); */
2088 /* dmemdump(sigblob, sigblob_len); */
2091 * See if this is in fact an ssh-rsa signature and a buggy
2092 * server; otherwise we can just do this the easy way.
2094 if ((ssh->remote_bugs & BUG_SSH2_RSA_PADDING) &&
2095 (GET_32BIT(pkblob) == 7 && !memcmp(pkblob+4, "ssh-rsa", 7))) {
2096 int pos, len, siglen;
2099 * Find the byte length of the modulus.
2102 pos = 4+7; /* skip over "ssh-rsa" */
2103 pos += 4 + GET_32BIT(pkblob+pos); /* skip over exponent */
2104 len = GET_32BIT(pkblob+pos); /* find length of modulus */
2105 pos += 4; /* find modulus itself */
2106 while (len > 0 && pkblob[pos] == 0)
2108 /* debug(("modulus length is %d\n", len)); */
2111 * Now find the signature integer.
2113 pos = 4+7; /* skip over "ssh-rsa" */
2114 siglen = GET_32BIT(sigblob+pos);
2115 /* debug(("signature length is %d\n", siglen)); */
2117 if (len != siglen) {
2118 unsigned char newlen[4];
2119 ssh2_pkt_addstring_start(pkt);
2120 ssh2_pkt_addstring_data(pkt, (char *)sigblob, pos);
2121 /* dmemdump(sigblob, pos); */
2122 pos += 4; /* point to start of actual sig */
2123 PUT_32BIT(newlen, len);
2124 ssh2_pkt_addstring_data(pkt, (char *)newlen, 4);
2125 /* dmemdump(newlen, 4); */
2127 while (len-- > siglen) {
2128 ssh2_pkt_addstring_data(pkt, (char *)newlen, 1);
2129 /* dmemdump(newlen, 1); */
2131 ssh2_pkt_addstring_data(pkt, (char *)(sigblob+pos), siglen);
2132 /* dmemdump(sigblob+pos, siglen); */
2136 /* Otherwise fall through and do it the easy way. */
2139 ssh2_pkt_addstring_start(pkt);
2140 ssh2_pkt_addstring_data(pkt, (char *)sigblob, sigblob_len);
2144 * Examine the remote side's version string and compare it against
2145 * a list of known buggy implementations.
2147 static void ssh_detect_bugs(Ssh ssh, char *vstring)
2149 char *imp; /* pointer to implementation part */
2151 imp += strcspn(imp, "-");
2153 imp += strcspn(imp, "-");
2156 ssh->remote_bugs = 0;
2158 if (ssh->cfg.sshbug_ignore1 == FORCE_ON ||
2159 (ssh->cfg.sshbug_ignore1 == AUTO &&
2160 (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
2161 !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
2162 !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25") ||
2163 !strcmp(imp, "OSU_1.4alpha3") || !strcmp(imp, "OSU_1.5alpha4")))) {
2165 * These versions don't support SSH1_MSG_IGNORE, so we have
2166 * to use a different defence against password length
2169 ssh->remote_bugs |= BUG_CHOKES_ON_SSH1_IGNORE;
2170 logevent("We believe remote version has SSH-1 ignore bug");
2173 if (ssh->cfg.sshbug_plainpw1 == FORCE_ON ||
2174 (ssh->cfg.sshbug_plainpw1 == AUTO &&
2175 (!strcmp(imp, "Cisco-1.25") || !strcmp(imp, "OSU_1.4alpha3")))) {
2177 * These versions need a plain password sent; they can't
2178 * handle having a null and a random length of data after
2181 ssh->remote_bugs |= BUG_NEEDS_SSH1_PLAIN_PASSWORD;
2182 logevent("We believe remote version needs a plain SSH-1 password");
2185 if (ssh->cfg.sshbug_rsa1 == FORCE_ON ||
2186 (ssh->cfg.sshbug_rsa1 == AUTO &&
2187 (!strcmp(imp, "Cisco-1.25")))) {
2189 * These versions apparently have no clue whatever about
2190 * RSA authentication and will panic and die if they see
2191 * an AUTH_RSA message.
2193 ssh->remote_bugs |= BUG_CHOKES_ON_RSA;
2194 logevent("We believe remote version can't handle SSH-1 RSA authentication");
2197 if (ssh->cfg.sshbug_hmac2 == FORCE_ON ||
2198 (ssh->cfg.sshbug_hmac2 == AUTO &&
2199 !wc_match("* VShell", imp) &&
2200 (wc_match("2.1.0*", imp) || wc_match("2.0.*", imp) ||
2201 wc_match("2.2.0*", imp) || wc_match("2.3.0*", imp) ||
2202 wc_match("2.1 *", imp)))) {
2204 * These versions have the HMAC bug.
2206 ssh->remote_bugs |= BUG_SSH2_HMAC;
2207 logevent("We believe remote version has SSH-2 HMAC bug");
2210 if (ssh->cfg.sshbug_derivekey2 == FORCE_ON ||
2211 (ssh->cfg.sshbug_derivekey2 == AUTO &&
2212 !wc_match("* VShell", imp) &&
2213 (wc_match("2.0.0*", imp) || wc_match("2.0.10*", imp) ))) {
2215 * These versions have the key-derivation bug (failing to
2216 * include the literal shared secret in the hashes that
2217 * generate the keys).
2219 ssh->remote_bugs |= BUG_SSH2_DERIVEKEY;
2220 logevent("We believe remote version has SSH-2 key-derivation bug");
2223 if (ssh->cfg.sshbug_rsapad2 == FORCE_ON ||
2224 (ssh->cfg.sshbug_rsapad2 == AUTO &&
2225 (wc_match("OpenSSH_2.[5-9]*", imp) ||
2226 wc_match("OpenSSH_3.[0-2]*", imp)))) {
2228 * These versions have the SSH-2 RSA padding bug.
2230 ssh->remote_bugs |= BUG_SSH2_RSA_PADDING;
2231 logevent("We believe remote version has SSH-2 RSA padding bug");
2234 if (ssh->cfg.sshbug_pksessid2 == FORCE_ON ||
2235 (ssh->cfg.sshbug_pksessid2 == AUTO &&
2236 wc_match("OpenSSH_2.[0-2]*", imp))) {
2238 * These versions have the SSH-2 session-ID bug in
2239 * public-key authentication.
2241 ssh->remote_bugs |= BUG_SSH2_PK_SESSIONID;
2242 logevent("We believe remote version has SSH-2 public-key-session-ID bug");
2245 if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
2246 (ssh->cfg.sshbug_rekey2 == AUTO &&
2247 (wc_match("DigiSSH_2.0", imp) ||
2248 wc_match("OpenSSH_2.[0-4]*", imp) ||
2249 wc_match("OpenSSH_2.5.[0-3]*", imp) ||
2250 wc_match("Sun_SSH_1.0", imp) ||
2251 wc_match("Sun_SSH_1.0.1", imp) ||
2252 /* All versions <= 1.2.6 (they changed their format in 1.2.7) */
2253 wc_match("WeOnlyDo-*", imp)))) {
2255 * These versions have the SSH-2 rekey bug.
2257 ssh->remote_bugs |= BUG_SSH2_REKEY;
2258 logevent("We believe remote version has SSH-2 rekey bug");
2263 * The `software version' part of an SSH version string is required
2264 * to contain no spaces or minus signs.
2266 static void ssh_fix_verstring(char *str)
2268 /* Eat "SSH-<protoversion>-". */
2269 assert(*str == 'S'); str++;
2270 assert(*str == 'S'); str++;
2271 assert(*str == 'H'); str++;
2272 assert(*str == '-'); str++;
2273 while (*str && *str != '-') str++;
2274 assert(*str == '-'); str++;
2276 /* Convert minus signs and spaces in the remaining string into
2279 if (*str == '-' || *str == ' ')
2285 static int do_ssh_init(Ssh ssh, unsigned char c)
2287 struct do_ssh_init_state {
2295 crState(do_ssh_init_state);
2297 crBegin(ssh->do_ssh_init_crstate);
2299 /* Search for a line beginning with the string "SSH-" in the input. */
2301 if (c != 'S') goto no;
2303 if (c != 'S') goto no;
2305 if (c != 'H') goto no;
2307 if (c != '-') goto no;
2316 s->vstring = snewn(s->vstrsize, char);
2317 strcpy(s->vstring, "SSH-");
2321 crReturn(1); /* get another char */
2322 if (s->vslen >= s->vstrsize - 1) {
2324 s->vstring = sresize(s->vstring, s->vstrsize, char);
2326 s->vstring[s->vslen++] = c;
2329 s->version[s->i] = '\0';
2331 } else if (s->i < sizeof(s->version) - 1)
2332 s->version[s->i++] = c;
2333 } else if (c == '\012')
2337 ssh->agentfwd_enabled = FALSE;
2338 ssh->rdpkt2_state.incoming_sequence = 0;
2340 s->vstring[s->vslen] = 0;
2341 s->vstring[strcspn(s->vstring, "\015\012")] = '\0';/* remove EOL chars */
2342 logeventf(ssh, "Server version: %s", s->vstring);
2343 ssh_detect_bugs(ssh, s->vstring);
2346 * Decide which SSH protocol version to support.
2349 /* Anything strictly below "2.0" means protocol 1 is supported. */
2350 s->proto1 = ssh_versioncmp(s->version, "2.0") < 0;
2351 /* Anything greater or equal to "1.99" means protocol 2 is supported. */
2352 s->proto2 = ssh_versioncmp(s->version, "1.99") >= 0;
2354 if (ssh->cfg.sshprot == 0 && !s->proto1) {
2355 bombout(("SSH protocol version 1 required by user but not provided by server"));
2358 if (ssh->cfg.sshprot == 3 && !s->proto2) {
2359 bombout(("SSH protocol version 2 required by user but not provided by server"));
2366 if (s->proto2 && (ssh->cfg.sshprot >= 2 || !s->proto1)) {
2368 * Construct a v2 version string.
2370 verstring = dupprintf("SSH-2.0-%s\015\012", sshver);
2374 * Construct a v1 version string.
2376 verstring = dupprintf("SSH-%s-%s\012",
2377 (ssh_versioncmp(s->version, "1.5") <= 0 ?
2378 s->version : "1.5"),
2383 ssh_fix_verstring(verstring);
2385 if (ssh->version == 2) {
2388 * Hash our version string and their version string.
2390 len = strcspn(verstring, "\015\012");
2391 ssh->v_c = snewn(len + 1, char);
2392 memcpy(ssh->v_c, verstring, len);
2394 len = strcspn(s->vstring, "\015\012");
2395 ssh->v_s = snewn(len + 1, char);
2396 memcpy(ssh->v_s, s->vstring, len);
2400 * Initialise SSH-2 protocol.
2402 ssh->protocol = ssh2_protocol;
2403 ssh2_protocol_setup(ssh);
2404 ssh->s_rdpkt = ssh2_rdpkt;
2407 * Initialise SSH-1 protocol.
2409 ssh->protocol = ssh1_protocol;
2410 ssh1_protocol_setup(ssh);
2411 ssh->s_rdpkt = ssh1_rdpkt;
2413 logeventf(ssh, "We claim version: %.*s",
2414 strcspn(verstring, "\015\012"), verstring);
2415 sk_write(ssh->s, verstring, strlen(verstring));
2417 if (ssh->version == 2)
2418 do_ssh2_transport(ssh, NULL, -1, NULL);
2421 logeventf(ssh, "Using SSH protocol version %d", ssh->version);
2423 update_specials_menu(ssh->frontend);
2424 ssh->state = SSH_STATE_BEFORE_SIZE;
2425 ssh->pinger = pinger_new(&ssh->cfg, &ssh_backend, ssh);
2432 static void ssh_process_incoming_data(Ssh ssh,
2433 unsigned char **data, int *datalen)
2435 struct Packet *pktin = ssh->s_rdpkt(ssh, data, datalen);
2437 ssh->protocol(ssh, NULL, 0, pktin);
2438 ssh_free_packet(pktin);
2442 static void ssh_queue_incoming_data(Ssh ssh,
2443 unsigned char **data, int *datalen)
2445 bufchain_add(&ssh->queued_incoming_data, *data, *datalen);
2450 static void ssh_process_queued_incoming_data(Ssh ssh)
2453 unsigned char *data;
2456 while (!ssh->frozen && bufchain_size(&ssh->queued_incoming_data)) {
2457 bufchain_prefix(&ssh->queued_incoming_data, &vdata, &len);
2461 while (!ssh->frozen && len > 0)
2462 ssh_process_incoming_data(ssh, &data, &len);
2465 bufchain_consume(&ssh->queued_incoming_data, origlen - len);
2469 static void ssh_set_frozen(Ssh ssh, int frozen)
2472 sk_set_frozen(ssh->s, frozen);
2473 ssh->frozen = frozen;
2476 static void ssh_gotdata(Ssh ssh, unsigned char *data, int datalen)
2478 crBegin(ssh->ssh_gotdata_crstate);
2481 * To begin with, feed the characters one by one to the
2482 * protocol initialisation / selection function do_ssh_init().
2483 * When that returns 0, we're done with the initial greeting
2484 * exchange and can move on to packet discipline.
2487 int ret; /* need not be kept across crReturn */
2489 crReturnV; /* more data please */
2490 ret = do_ssh_init(ssh, *data);
2498 * We emerge from that loop when the initial negotiation is
2499 * over and we have selected an s_rdpkt function. Now pass
2500 * everything to s_rdpkt, and then pass the resulting packets
2501 * to the proper protocol handler.
2505 while (bufchain_size(&ssh->queued_incoming_data) > 0 || datalen > 0) {
2507 ssh_queue_incoming_data(ssh, &data, &datalen);
2508 /* This uses up all data and cannot cause anything interesting
2509 * to happen; indeed, for anything to happen at all, we must
2510 * return, so break out. */
2512 } else if (bufchain_size(&ssh->queued_incoming_data) > 0) {
2513 /* This uses up some or all data, and may freeze the
2515 ssh_process_queued_incoming_data(ssh);
2517 /* This uses up some or all data, and may freeze the
2519 ssh_process_incoming_data(ssh, &data, &datalen);
2521 /* FIXME this is probably EBW. */
2522 if (ssh->state == SSH_STATE_CLOSED)
2525 /* We're out of data. Go and get some more. */
2531 static int ssh_do_close(Ssh ssh, int notify_exit)
2534 struct ssh_channel *c;
2536 ssh->state = SSH_STATE_CLOSED;
2537 expire_timer_context(ssh);
2542 notify_remote_exit(ssh->frontend);
2547 * Now we must shut down any port- and X-forwarded channels going
2548 * through this connection.
2550 if (ssh->channels) {
2551 while (NULL != (c = index234(ssh->channels, 0))) {
2554 x11_close(c->u.x11.s);
2557 pfd_close(c->u.pfd.s);
2560 del234(ssh->channels, c); /* moving next one to index 0 */
2561 if (ssh->version == 2)
2562 bufchain_clear(&c->v.v2.outbuffer);
2567 * Go through port-forwardings, and close any associated
2568 * listening sockets.
2570 if (ssh->portfwds) {
2571 struct ssh_portfwd *pf;
2572 while (NULL != (pf = index234(ssh->portfwds, 0))) {
2573 /* Dispose of any listening socket. */
2575 pfd_terminate(pf->local);
2576 del234(ssh->portfwds, pf); /* moving next one to index 0 */
2584 static void ssh_log(Plug plug, int type, SockAddr addr, int port,
2585 const char *error_msg, int error_code)
2587 Ssh ssh = (Ssh) plug;
2588 char addrbuf[256], *msg;
2590 sk_getaddr(addr, addrbuf, lenof(addrbuf));
2593 msg = dupprintf("Connecting to %s port %d", addrbuf, port);
2595 msg = dupprintf("Failed to connect to %s: %s", addrbuf, error_msg);
2601 static int ssh_closing(Plug plug, const char *error_msg, int error_code,
2604 Ssh ssh = (Ssh) plug;
2605 int need_notify = ssh_do_close(ssh, FALSE);
2608 if (!ssh->close_expected)
2609 error_msg = "Server unexpectedly closed network connection";
2611 error_msg = "Server closed network connection";
2615 notify_remote_exit(ssh->frontend);
2618 logevent(error_msg);
2619 if (!ssh->close_expected || !ssh->clean_exit)
2620 connection_fatal(ssh->frontend, "%s", error_msg);
2624 static int ssh_receive(Plug plug, int urgent, char *data, int len)
2626 Ssh ssh = (Ssh) plug;
2627 ssh_gotdata(ssh, (unsigned char *)data, len);
2628 if (ssh->state == SSH_STATE_CLOSED) {
2629 ssh_do_close(ssh, TRUE);
2635 static void ssh_sent(Plug plug, int bufsize)
2637 Ssh ssh = (Ssh) plug;
2639 * If the send backlog on the SSH socket itself clears, we
2640 * should unthrottle the whole world if it was throttled.
2642 if (bufsize < SSH_MAX_BACKLOG)
2643 ssh_throttle_all(ssh, 0, bufsize);
2647 * Connect to specified host and port.
2648 * Returns an error message, or NULL on success.
2649 * Also places the canonical host name into `realhost'. It must be
2650 * freed by the caller.
2652 static const char *connect_to_host(Ssh ssh, char *host, int port,
2653 char **realhost, int nodelay, int keepalive)
2655 static const struct plug_function_table fn_table = {
2666 ssh->savedhost = snewn(1 + strlen(host), char);
2667 strcpy(ssh->savedhost, host);
2670 port = 22; /* default ssh port */
2671 ssh->savedport = port;
2676 logeventf(ssh, "Looking up host \"%s\"%s", host,
2677 (ssh->cfg.addressfamily == ADDRTYPE_IPV4 ? " (IPv4)" :
2678 (ssh->cfg.addressfamily == ADDRTYPE_IPV6 ? " (IPv6)" : "")));
2679 addr = name_lookup(host, port, realhost, &ssh->cfg,
2680 ssh->cfg.addressfamily);
2681 if ((err = sk_addr_error(addr)) != NULL) {
2689 ssh->fn = &fn_table;
2690 ssh->s = new_connection(addr, *realhost, port,
2691 0, 1, nodelay, keepalive, (Plug) ssh, &ssh->cfg);
2692 if ((err = sk_socket_error(ssh->s)) != NULL) {
2694 notify_remote_exit(ssh->frontend);
2702 * Throttle or unthrottle the SSH connection.
2704 static void ssh1_throttle(Ssh ssh, int adjust)
2706 int old_count = ssh->v1_throttle_count;
2707 ssh->v1_throttle_count += adjust;
2708 assert(ssh->v1_throttle_count >= 0);
2709 if (ssh->v1_throttle_count && !old_count) {
2710 ssh_set_frozen(ssh, 1);
2711 } else if (!ssh->v1_throttle_count && old_count) {
2712 ssh_set_frozen(ssh, 0);
2717 * Throttle or unthrottle _all_ local data streams (for when sends
2718 * on the SSH connection itself back up).
2720 static void ssh_throttle_all(Ssh ssh, int enable, int bufsize)
2723 struct ssh_channel *c;
2725 if (enable == ssh->throttled_all)
2727 ssh->throttled_all = enable;
2728 ssh->overall_bufsize = bufsize;
2731 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++) {
2733 case CHAN_MAINSESSION:
2735 * This is treated separately, outside the switch.
2739 x11_override_throttle(c->u.x11.s, enable);
2742 /* Agent channels require no buffer management. */
2745 pfd_override_throttle(c->u.pfd.s, enable);
2751 static void ssh_agent_callback(void *sshv, void *reply, int replylen)
2753 Ssh ssh = (Ssh) sshv;
2755 ssh->agent_response = reply;
2756 ssh->agent_response_len = replylen;
2758 if (ssh->version == 1)
2759 do_ssh1_login(ssh, NULL, -1, NULL);
2761 do_ssh2_authconn(ssh, NULL, -1, NULL);
2764 static void ssh_dialog_callback(void *sshv, int ret)
2766 Ssh ssh = (Ssh) sshv;
2768 ssh->user_response = ret;
2770 if (ssh->version == 1)
2771 do_ssh1_login(ssh, NULL, -1, NULL);
2773 do_ssh2_transport(ssh, NULL, -1, NULL);
2776 * This may have unfrozen the SSH connection, so do a
2779 ssh_process_queued_incoming_data(ssh);
2782 static void ssh_agentf_callback(void *cv, void *reply, int replylen)
2784 struct ssh_channel *c = (struct ssh_channel *)cv;
2786 void *sentreply = reply;
2789 /* Fake SSH_AGENT_FAILURE. */
2790 sentreply = "\0\0\0\1\5";
2793 if (ssh->version == 2) {
2794 ssh2_add_channel_data(c, sentreply, replylen);
2797 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
2798 PKT_INT, c->remoteid,
2801 PKT_DATA, sentreply, replylen,
2810 * Client-initiated disconnection. Send a DISCONNECT if `wire_reason'
2811 * non-NULL, otherwise just close the connection. `client_reason' == NULL
2812 * => log `wire_reason'.
2814 static void ssh_disconnect(Ssh ssh, char *client_reason, char *wire_reason,
2815 int code, int clean_exit)
2819 client_reason = wire_reason;
2821 error = dupprintf("Disconnected: %s", client_reason);
2823 error = dupstr("Disconnected");
2825 if (ssh->version == 1) {
2826 send_packet(ssh, SSH1_MSG_DISCONNECT, PKT_STR, wire_reason,
2828 } else if (ssh->version == 2) {
2829 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_DISCONNECT);
2830 ssh2_pkt_adduint32(pktout, code);
2831 ssh2_pkt_addstring(pktout, wire_reason);
2832 ssh2_pkt_addstring(pktout, "en"); /* language tag */
2833 ssh2_pkt_send_noqueue(ssh, pktout);
2836 ssh->close_expected = TRUE;
2837 ssh->clean_exit = clean_exit;
2838 ssh_closing((Plug)ssh, error, 0, 0);
2843 * Handle the key exchange and user authentication phases.
2845 static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
2846 struct Packet *pktin)
2849 unsigned char cookie[8], *ptr;
2850 struct RSAKey servkey, hostkey;
2851 struct MD5Context md5c;
2852 struct do_ssh1_login_state {
2854 unsigned char *rsabuf, *keystr1, *keystr2;
2855 unsigned long supported_ciphers_mask, supported_auths_mask;
2856 int tried_publickey, tried_agent;
2857 int tis_auth_refused, ccard_auth_refused;
2858 unsigned char session_id[16];
2861 void *publickey_blob;
2862 int publickey_bloblen;
2863 char *publickey_comment;
2864 int publickey_encrypted;
2865 prompts_t *cur_prompt;
2868 unsigned char request[5], *response, *p;
2878 crState(do_ssh1_login_state);
2880 crBegin(ssh->do_ssh1_login_crstate);
2885 if (pktin->type != SSH1_SMSG_PUBLIC_KEY) {
2886 bombout(("Public key packet not received"));
2890 logevent("Received public keys");
2892 ptr = ssh_pkt_getdata(pktin, 8);
2894 bombout(("SSH-1 public key packet stopped before random cookie"));
2897 memcpy(cookie, ptr, 8);
2899 if (!ssh1_pkt_getrsakey(pktin, &servkey, &s->keystr1) ||
2900 !ssh1_pkt_getrsakey(pktin, &hostkey, &s->keystr2)) {
2901 bombout(("Failed to read SSH-1 public keys from public key packet"));
2906 * Log the host key fingerprint.
2910 logevent("Host key fingerprint is:");
2911 strcpy(logmsg, " ");
2912 hostkey.comment = NULL;
2913 rsa_fingerprint(logmsg + strlen(logmsg),
2914 sizeof(logmsg) - strlen(logmsg), &hostkey);
2918 ssh->v1_remote_protoflags = ssh_pkt_getuint32(pktin);
2919 s->supported_ciphers_mask = ssh_pkt_getuint32(pktin);
2920 s->supported_auths_mask = ssh_pkt_getuint32(pktin);
2922 ssh->v1_local_protoflags =
2923 ssh->v1_remote_protoflags & SSH1_PROTOFLAGS_SUPPORTED;
2924 ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
2927 MD5Update(&md5c, s->keystr2, hostkey.bytes);
2928 MD5Update(&md5c, s->keystr1, servkey.bytes);
2929 MD5Update(&md5c, cookie, 8);
2930 MD5Final(s->session_id, &md5c);
2932 for (i = 0; i < 32; i++)
2933 ssh->session_key[i] = random_byte();
2936 * Verify that the `bits' and `bytes' parameters match.
2938 if (hostkey.bits > hostkey.bytes * 8 ||
2939 servkey.bits > servkey.bytes * 8) {
2940 bombout(("SSH-1 public keys were badly formatted"));
2944 s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
2946 s->rsabuf = snewn(s->len, unsigned char);
2949 * Verify the host key.
2953 * First format the key into a string.
2955 int len = rsastr_len(&hostkey);
2956 char fingerprint[100];
2957 char *keystr = snewn(len, char);
2958 rsastr_fmt(keystr, &hostkey);
2959 rsa_fingerprint(fingerprint, sizeof(fingerprint), &hostkey);
2961 ssh_set_frozen(ssh, 1);
2962 s->dlgret = verify_ssh_host_key(ssh->frontend,
2963 ssh->savedhost, ssh->savedport,
2964 "rsa", keystr, fingerprint,
2965 ssh_dialog_callback, ssh);
2967 if (s->dlgret < 0) {
2971 bombout(("Unexpected data from server while waiting"
2972 " for user host key response"));
2975 } while (pktin || inlen > 0);
2976 s->dlgret = ssh->user_response;
2978 ssh_set_frozen(ssh, 0);
2980 if (s->dlgret == 0) {
2981 ssh_disconnect(ssh, "User aborted at host key verification",
2987 for (i = 0; i < 32; i++) {
2988 s->rsabuf[i] = ssh->session_key[i];
2990 s->rsabuf[i] ^= s->session_id[i];
2993 if (hostkey.bytes > servkey.bytes) {
2994 ret = rsaencrypt(s->rsabuf, 32, &servkey);
2996 ret = rsaencrypt(s->rsabuf, servkey.bytes, &hostkey);
2998 ret = rsaencrypt(s->rsabuf, 32, &hostkey);
3000 ret = rsaencrypt(s->rsabuf, hostkey.bytes, &servkey);
3003 bombout(("SSH-1 public key encryptions failed due to bad formatting"));
3007 logevent("Encrypted session key");
3010 int cipher_chosen = 0, warn = 0;
3011 char *cipher_string = NULL;
3013 for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) {
3014 int next_cipher = ssh->cfg.ssh_cipherlist[i];
3015 if (next_cipher == CIPHER_WARN) {
3016 /* If/when we choose a cipher, warn about it */
3018 } else if (next_cipher == CIPHER_AES) {
3019 /* XXX Probably don't need to mention this. */
3020 logevent("AES not supported in SSH-1, skipping");
3022 switch (next_cipher) {
3023 case CIPHER_3DES: s->cipher_type = SSH_CIPHER_3DES;
3024 cipher_string = "3DES"; break;
3025 case CIPHER_BLOWFISH: s->cipher_type = SSH_CIPHER_BLOWFISH;
3026 cipher_string = "Blowfish"; break;
3027 case CIPHER_DES: s->cipher_type = SSH_CIPHER_DES;
3028 cipher_string = "single-DES"; break;
3030 if (s->supported_ciphers_mask & (1 << s->cipher_type))
3034 if (!cipher_chosen) {
3035 if ((s->supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0)
3036 bombout(("Server violates SSH-1 protocol by not "
3037 "supporting 3DES encryption"));
3039 /* shouldn't happen */
3040 bombout(("No supported ciphers found"));
3044 /* Warn about chosen cipher if necessary. */
3046 ssh_set_frozen(ssh, 1);
3047 s->dlgret = askalg(ssh->frontend, "cipher", cipher_string,
3048 ssh_dialog_callback, ssh);
3049 if (s->dlgret < 0) {
3053 bombout(("Unexpected data from server while waiting"
3054 " for user response"));
3057 } while (pktin || inlen > 0);
3058 s->dlgret = ssh->user_response;
3060 ssh_set_frozen(ssh, 0);
3061 if (s->dlgret == 0) {
3062 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
3069 switch (s->cipher_type) {
3070 case SSH_CIPHER_3DES:
3071 logevent("Using 3DES encryption");
3073 case SSH_CIPHER_DES:
3074 logevent("Using single-DES encryption");
3076 case SSH_CIPHER_BLOWFISH:
3077 logevent("Using Blowfish encryption");
3081 send_packet(ssh, SSH1_CMSG_SESSION_KEY,
3082 PKT_CHAR, s->cipher_type,
3083 PKT_DATA, cookie, 8,
3084 PKT_CHAR, (s->len * 8) >> 8, PKT_CHAR, (s->len * 8) & 0xFF,
3085 PKT_DATA, s->rsabuf, s->len,
3086 PKT_INT, ssh->v1_local_protoflags, PKT_END);
3088 logevent("Trying to enable encryption...");
3092 ssh->cipher = (s->cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish_ssh1 :
3093 s->cipher_type == SSH_CIPHER_DES ? &ssh_des :
3095 ssh->v1_cipher_ctx = ssh->cipher->make_context();
3096 ssh->cipher->sesskey(ssh->v1_cipher_ctx, ssh->session_key);
3097 logeventf(ssh, "Initialised %s encryption", ssh->cipher->text_name);
3099 ssh->crcda_ctx = crcda_make_context();
3100 logevent("Installing CRC compensation attack detector");
3102 if (servkey.modulus) {
3103 sfree(servkey.modulus);
3104 servkey.modulus = NULL;
3106 if (servkey.exponent) {
3107 sfree(servkey.exponent);
3108 servkey.exponent = NULL;
3110 if (hostkey.modulus) {
3111 sfree(hostkey.modulus);
3112 hostkey.modulus = NULL;
3114 if (hostkey.exponent) {
3115 sfree(hostkey.exponent);
3116 hostkey.exponent = NULL;
3120 if (pktin->type != SSH1_SMSG_SUCCESS) {
3121 bombout(("Encryption not successfully enabled"));
3125 logevent("Successfully started encryption");
3127 fflush(stdout); /* FIXME eh? */
3129 if (!*ssh->cfg.username) {
3130 int ret; /* need not be kept over crReturn */
3131 s->cur_prompt = new_prompts(ssh->frontend);
3132 s->cur_prompt->to_server = TRUE;
3133 s->cur_prompt->name = dupstr("SSH login name");
3134 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
3135 lenof(s->username));
3136 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3139 crWaitUntil(!pktin);
3140 ret = get_userpass_input(s->cur_prompt, in, inlen);
3145 * Failed to get a username. Terminate.
3147 free_prompts(s->cur_prompt);
3148 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
3151 memcpy(s->username, s->cur_prompt->prompts[0]->result,
3152 lenof(s->username));
3153 free_prompts(s->cur_prompt);
3155 strncpy(s->username, ssh->cfg.username, sizeof(s->username));
3156 s->username[sizeof(s->username)-1] = '\0';
3159 send_packet(ssh, SSH1_CMSG_USER, PKT_STR, s->username, PKT_END);
3161 char *userlog = dupprintf("Sent username \"%s\"", s->username);
3163 if (flags & FLAG_INTERACTIVE &&
3164 (!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) {
3165 c_write_str(ssh, userlog);
3166 c_write_str(ssh, "\r\n");
3174 if ((ssh->remote_bugs & BUG_CHOKES_ON_RSA)) {
3175 /* We must not attempt PK auth. Pretend we've already tried it. */
3176 s->tried_publickey = s->tried_agent = 1;
3178 s->tried_publickey = s->tried_agent = 0;
3180 s->tis_auth_refused = s->ccard_auth_refused = 0;
3182 * Load the public half of any configured keyfile for later use.
3184 if (!filename_is_null(ssh->cfg.keyfile)) {
3186 logeventf(ssh, "Reading private key file \"%.150s\"",
3187 filename_to_str(&ssh->cfg.keyfile));
3188 keytype = key_type(&ssh->cfg.keyfile);
3189 if (keytype == SSH_KEYTYPE_SSH1) {
3191 if (rsakey_pubblob(&ssh->cfg.keyfile,
3192 &s->publickey_blob, &s->publickey_bloblen,
3193 &s->publickey_comment, &error)) {
3194 s->publickey_encrypted = rsakey_encrypted(&ssh->cfg.keyfile,
3198 logeventf(ssh, "Unable to load private key (%s)", error);
3199 msgbuf = dupprintf("Unable to load private key file "
3200 "\"%.150s\" (%s)\r\n",
3201 filename_to_str(&ssh->cfg.keyfile),
3203 c_write_str(ssh, msgbuf);
3205 s->publickey_blob = NULL;
3209 logeventf(ssh, "Unable to use this key file (%s)",
3210 key_type_to_str(keytype));
3211 msgbuf = dupprintf("Unable to use key file \"%.150s\""
3213 filename_to_str(&ssh->cfg.keyfile),
3214 key_type_to_str(keytype));
3215 c_write_str(ssh, msgbuf);
3217 s->publickey_blob = NULL;
3220 s->publickey_blob = NULL;
3222 while (pktin->type == SSH1_SMSG_FAILURE) {
3223 s->pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
3225 if (agent_exists() && !s->tried_agent) {
3227 * Attempt RSA authentication using Pageant.
3233 logevent("Pageant is running. Requesting keys.");
3235 /* Request the keys held by the agent. */
3236 PUT_32BIT(s->request, 1);
3237 s->request[4] = SSH1_AGENTC_REQUEST_RSA_IDENTITIES;
3238 if (!agent_query(s->request, 5, &r, &s->responselen,
3239 ssh_agent_callback, ssh)) {
3243 bombout(("Unexpected data from server while waiting"
3244 " for agent response"));
3247 } while (pktin || inlen > 0);
3248 r = ssh->agent_response;
3249 s->responselen = ssh->agent_response_len;
3251 s->response = (unsigned char *) r;
3252 if (s->response && s->responselen >= 5 &&
3253 s->response[4] == SSH1_AGENT_RSA_IDENTITIES_ANSWER) {
3254 s->p = s->response + 5;
3255 s->nkeys = GET_32BIT(s->p);
3257 logeventf(ssh, "Pageant has %d SSH-1 keys", s->nkeys);
3258 for (s->keyi = 0; s->keyi < s->nkeys; s->keyi++) {
3259 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
3260 if (s->publickey_blob &&
3261 !memcmp(s->p, s->publickey_blob,
3262 s->publickey_bloblen)) {
3263 logevent("This key matches configured key file");
3264 s->tried_publickey = 1;
3269 do { /* do while (0) to make breaking easy */
3270 n = ssh1_read_bignum
3271 (s->p, s->responselen-(s->p-s->response),
3276 n = ssh1_read_bignum
3277 (s->p, s->responselen-(s->p-s->response),
3282 if (s->responselen - (s->p-s->response) < 4)
3284 s->commentlen = GET_32BIT(s->p);
3286 if (s->responselen - (s->p-s->response) <
3289 s->commentp = (char *)s->p;
3290 s->p += s->commentlen;
3294 logevent("Pageant key list packet was truncated");
3298 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3299 PKT_BIGNUM, s->key.modulus, PKT_END);
3301 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
3302 logevent("Key refused");
3305 logevent("Received RSA challenge");
3306 if ((s->challenge = ssh1_pkt_getmp(pktin)) == NULL) {
3307 bombout(("Server's RSA challenge was badly formatted"));
3312 char *agentreq, *q, *ret;
3315 len = 1 + 4; /* message type, bit count */
3316 len += ssh1_bignum_length(s->key.exponent);
3317 len += ssh1_bignum_length(s->key.modulus);
3318 len += ssh1_bignum_length(s->challenge);
3319 len += 16; /* session id */
3320 len += 4; /* response format */
3321 agentreq = snewn(4 + len, char);
3322 PUT_32BIT(agentreq, len);
3324 *q++ = SSH1_AGENTC_RSA_CHALLENGE;
3325 PUT_32BIT(q, bignum_bitcount(s->key.modulus));
3327 q += ssh1_write_bignum(q, s->key.exponent);
3328 q += ssh1_write_bignum(q, s->key.modulus);
3329 q += ssh1_write_bignum(q, s->challenge);
3330 memcpy(q, s->session_id, 16);
3332 PUT_32BIT(q, 1); /* response format */
3333 if (!agent_query(agentreq, len + 4, &vret, &retlen,
3334 ssh_agent_callback, ssh)) {
3339 bombout(("Unexpected data from server"
3340 " while waiting for agent"
3344 } while (pktin || inlen > 0);
3345 vret = ssh->agent_response;
3346 retlen = ssh->agent_response_len;
3351 if (ret[4] == SSH1_AGENT_RSA_RESPONSE) {
3352 logevent("Sending Pageant's response");
3353 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
3354 PKT_DATA, ret + 5, 16,
3358 if (pktin->type == SSH1_SMSG_SUCCESS) {
3360 ("Pageant's response accepted");
3361 if (flags & FLAG_VERBOSE) {
3362 c_write_str(ssh, "Authenticated using"
3364 c_write(ssh, s->commentp,
3366 c_write_str(ssh, "\" from agent\r\n");
3371 ("Pageant's response not accepted");
3374 ("Pageant failed to answer challenge");
3378 logevent("No reply received from Pageant");
3381 freebn(s->key.exponent);
3382 freebn(s->key.modulus);
3383 freebn(s->challenge);
3392 if (s->publickey_blob && !s->tried_publickey) {
3394 * Try public key authentication with the specified
3397 int got_passphrase; /* need not be kept over crReturn */
3398 if (flags & FLAG_VERBOSE)
3399 c_write_str(ssh, "Trying public key authentication.\r\n");
3400 logeventf(ssh, "Trying public key \"%s\"",
3401 filename_to_str(&ssh->cfg.keyfile));
3402 s->tried_publickey = 1;
3403 got_passphrase = FALSE;
3404 while (!got_passphrase) {
3406 * Get a passphrase, if necessary.
3408 char *passphrase = NULL; /* only written after crReturn */
3410 if (!s->publickey_encrypted) {
3411 if (flags & FLAG_VERBOSE)
3412 c_write_str(ssh, "No passphrase required.\r\n");
3415 int ret; /* need not be kept over crReturn */
3416 s->cur_prompt = new_prompts(ssh->frontend);
3417 s->cur_prompt->to_server = FALSE;
3418 s->cur_prompt->name = dupstr("SSH key passphrase");
3419 add_prompt(s->cur_prompt,
3420 dupprintf("Passphrase for key \"%.100s\": ",
3421 s->publickey_comment),
3422 FALSE, SSH_MAX_PASSWORD_LEN);
3423 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3426 crWaitUntil(!pktin);
3427 ret = get_userpass_input(s->cur_prompt, in, inlen);
3431 /* Failed to get a passphrase. Terminate. */
3432 free_prompts(s->cur_prompt);
3433 ssh_disconnect(ssh, NULL, "Unable to authenticate",
3437 passphrase = dupstr(s->cur_prompt->prompts[0]->result);
3438 free_prompts(s->cur_prompt);
3441 * Try decrypting key with passphrase.
3443 ret = loadrsakey(&ssh->cfg.keyfile, &s->key, passphrase,
3446 memset(passphrase, 0, strlen(passphrase));
3450 /* Correct passphrase. */
3451 got_passphrase = TRUE;
3452 } else if (ret == 0) {
3453 c_write_str(ssh, "Couldn't load private key from ");
3454 c_write_str(ssh, filename_to_str(&ssh->cfg.keyfile));
3455 c_write_str(ssh, " (");
3456 c_write_str(ssh, error);
3457 c_write_str(ssh, ").\r\n");
3458 got_passphrase = FALSE;
3459 break; /* go and try something else */
3460 } else if (ret == -1) {
3461 c_write_str(ssh, "Wrong passphrase.\r\n"); /* FIXME */
3462 got_passphrase = FALSE;
3465 assert(0 && "unexpected return from loadrsakey()");
3469 if (got_passphrase) {
3472 * Send a public key attempt.
3474 send_packet(ssh, SSH1_CMSG_AUTH_RSA,
3475 PKT_BIGNUM, s->key.modulus, PKT_END);
3478 if (pktin->type == SSH1_SMSG_FAILURE) {
3479 c_write_str(ssh, "Server refused our public key.\r\n");
3480 continue; /* go and try something else */
3482 if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
3483 bombout(("Bizarre response to offer of public key"));
3489 unsigned char buffer[32];
3490 Bignum challenge, response;
3492 if ((challenge = ssh1_pkt_getmp(pktin)) == NULL) {
3493 bombout(("Server's RSA challenge was badly formatted"));
3496 response = rsadecrypt(challenge, &s->key);
3497 freebn(s->key.private_exponent);/* burn the evidence */
3499 for (i = 0; i < 32; i++) {
3500 buffer[i] = bignum_byte(response, 31 - i);
3504 MD5Update(&md5c, buffer, 32);
3505 MD5Update(&md5c, s->session_id, 16);
3506 MD5Final(buffer, &md5c);
3508 send_packet(ssh, SSH1_CMSG_AUTH_RSA_RESPONSE,
3509 PKT_DATA, buffer, 16, PKT_END);
3516 if (pktin->type == SSH1_SMSG_FAILURE) {
3517 if (flags & FLAG_VERBOSE)
3518 c_write_str(ssh, "Failed to authenticate with"
3519 " our public key.\r\n");
3520 continue; /* go and try something else */
3521 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
3522 bombout(("Bizarre response to RSA authentication response"));
3526 break; /* we're through! */
3532 * Otherwise, try various forms of password-like authentication.
3534 s->cur_prompt = new_prompts(ssh->frontend);
3536 if (ssh->cfg.try_tis_auth &&
3537 (s->supported_auths_mask & (1 << SSH1_AUTH_TIS)) &&
3538 !s->tis_auth_refused) {
3539 s->pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
3540 logevent("Requested TIS authentication");
3541 send_packet(ssh, SSH1_CMSG_AUTH_TIS, PKT_END);
3543 if (pktin->type != SSH1_SMSG_AUTH_TIS_CHALLENGE) {
3544 logevent("TIS authentication declined");
3545 if (flags & FLAG_INTERACTIVE)
3546 c_write_str(ssh, "TIS authentication refused.\r\n");
3547 s->tis_auth_refused = 1;
3552 char *instr_suf, *prompt;
3554 ssh_pkt_getstring(pktin, &challenge, &challengelen);
3556 bombout(("TIS challenge packet was badly formed"));
3559 logevent("Received TIS challenge");
3560 s->cur_prompt->to_server = TRUE;
3561 s->cur_prompt->name = dupstr("SSH TIS authentication");
3562 /* Prompt heuristic comes from OpenSSH */
3563 if (memchr(challenge, '\n', challengelen)) {
3564 instr_suf = dupstr("");
3565 prompt = dupprintf("%.*s", challengelen, challenge);
3567 instr_suf = dupprintf("%.*s", challengelen, challenge);
3568 prompt = dupstr("Response: ");
3570 s->cur_prompt->instruction =
3571 dupprintf("Using TIS authentication.%s%s",
3572 (*instr_suf) ? "\n" : "",
3574 s->cur_prompt->instr_reqd = TRUE;
3575 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3579 if (ssh->cfg.try_tis_auth &&
3580 (s->supported_auths_mask & (1 << SSH1_AUTH_CCARD)) &&
3581 !s->ccard_auth_refused) {
3582 s->pwpkt_type = SSH1_CMSG_AUTH_CCARD_RESPONSE;
3583 logevent("Requested CryptoCard authentication");
3584 send_packet(ssh, SSH1_CMSG_AUTH_CCARD, PKT_END);
3586 if (pktin->type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
3587 logevent("CryptoCard authentication declined");
3588 c_write_str(ssh, "CryptoCard authentication refused.\r\n");
3589 s->ccard_auth_refused = 1;
3594 char *instr_suf, *prompt;
3596 ssh_pkt_getstring(pktin, &challenge, &challengelen);
3598 bombout(("CryptoCard challenge packet was badly formed"));
3601 logevent("Received CryptoCard challenge");
3602 s->cur_prompt->to_server = TRUE;
3603 s->cur_prompt->name = dupstr("SSH CryptoCard authentication");
3604 s->cur_prompt->name_reqd = FALSE;
3605 /* Prompt heuristic comes from OpenSSH */
3606 if (memchr(challenge, '\n', challengelen)) {
3607 instr_suf = dupstr("");
3608 prompt = dupprintf("%.*s", challengelen, challenge);
3610 instr_suf = dupprintf("%.*s", challengelen, challenge);
3611 prompt = dupstr("Response: ");
3613 s->cur_prompt->instruction =
3614 dupprintf("Using CryptoCard authentication.%s%s",
3615 (*instr_suf) ? "\n" : "",
3617 s->cur_prompt->instr_reqd = TRUE;
3618 add_prompt(s->cur_prompt, prompt, FALSE, SSH_MAX_PASSWORD_LEN);
3622 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
3623 s->cur_prompt->to_server = TRUE;
3624 s->cur_prompt->name = dupstr("SSH password");
3625 add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
3626 s->username, ssh->savedhost),
3627 FALSE, SSH_MAX_PASSWORD_LEN);
3631 * Show password prompt, having first obtained it via a TIS
3632 * or CryptoCard exchange if we're doing TIS or CryptoCard
3636 int ret; /* need not be kept over crReturn */
3637 ret = get_userpass_input(s->cur_prompt, NULL, 0);
3640 crWaitUntil(!pktin);
3641 ret = get_userpass_input(s->cur_prompt, in, inlen);
3646 * Failed to get a password (for example
3647 * because one was supplied on the command line
3648 * which has already failed to work). Terminate.
3650 free_prompts(s->cur_prompt);
3651 ssh_disconnect(ssh, NULL, "Unable to authenticate", 0, TRUE);
3656 if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
3658 * Defence against traffic analysis: we send a
3659 * whole bunch of packets containing strings of
3660 * different lengths. One of these strings is the
3661 * password, in a SSH1_CMSG_AUTH_PASSWORD packet.
3662 * The others are all random data in
3663 * SSH1_MSG_IGNORE packets. This way a passive
3664 * listener can't tell which is the password, and
3665 * hence can't deduce the password length.
3667 * Anybody with a password length greater than 16
3668 * bytes is going to have enough entropy in their
3669 * password that a listener won't find it _that_
3670 * much help to know how long it is. So what we'll
3673 * - if password length < 16, we send 15 packets
3674 * containing string lengths 1 through 15
3676 * - otherwise, we let N be the nearest multiple
3677 * of 8 below the password length, and send 8
3678 * packets containing string lengths N through
3679 * N+7. This won't obscure the order of
3680 * magnitude of the password length, but it will
3681 * introduce a bit of extra uncertainty.
3683 * A few servers (the old 1.2.18 through 1.2.22)
3684 * can't deal with SSH1_MSG_IGNORE. For these
3685 * servers, we need an alternative defence. We make
3686 * use of the fact that the password is interpreted
3687 * as a C string: so we can append a NUL, then some
3690 * One server (a Cisco one) can deal with neither
3691 * SSH1_MSG_IGNORE _nor_ a padded password string.
3692 * For this server we are left with no defences
3693 * against password length sniffing.
3695 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE)) {
3697 * The server can deal with SSH1_MSG_IGNORE, so
3698 * we can use the primary defence.
3700 int bottom, top, pwlen, i;
3703 pwlen = strlen(s->cur_prompt->prompts[0]->result);
3705 bottom = 0; /* zero length passwords are OK! :-) */
3708 bottom = pwlen & ~7;
3712 assert(pwlen >= bottom && pwlen <= top);
3714 randomstr = snewn(top + 1, char);
3716 for (i = bottom; i <= top; i++) {
3718 defer_packet(ssh, s->pwpkt_type,
3719 PKTT_PASSWORD, PKT_STR,
3720 s->cur_prompt->prompts[0]->result,
3721 PKTT_OTHER, PKT_END);
3723 for (j = 0; j < i; j++) {
3725 randomstr[j] = random_byte();
3726 } while (randomstr[j] == '\0');
3728 randomstr[i] = '\0';
3729 defer_packet(ssh, SSH1_MSG_IGNORE,
3730 PKT_STR, randomstr, PKT_END);
3733 logevent("Sending password with camouflage packets");
3734 ssh_pkt_defersend(ssh);
3737 else if (!(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
3739 * The server can't deal with SSH1_MSG_IGNORE
3740 * but can deal with padded passwords, so we
3741 * can use the secondary defence.
3747 len = strlen(s->cur_prompt->prompts[0]->result);
3748 if (len < sizeof(string)) {
3750 strcpy(string, s->cur_prompt->prompts[0]->result);
3751 len++; /* cover the zero byte */
3752 while (len < sizeof(string)) {
3753 string[len++] = (char) random_byte();
3756 ss = s->cur_prompt->prompts[0]->result;
3758 logevent("Sending length-padded password");
3759 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
3760 PKT_INT, len, PKT_DATA, ss, len,
3761 PKTT_OTHER, PKT_END);
3764 * The server has _both_
3765 * BUG_CHOKES_ON_SSH1_IGNORE and
3766 * BUG_NEEDS_SSH1_PLAIN_PASSWORD. There is
3767 * therefore nothing we can do.
3770 len = strlen(s->cur_prompt->prompts[0]->result);
3771 logevent("Sending unpadded password");
3772 send_packet(ssh, s->pwpkt_type,
3773 PKTT_PASSWORD, PKT_INT, len,
3774 PKT_DATA, s->cur_prompt->prompts[0]->result, len,
3775 PKTT_OTHER, PKT_END);
3778 send_packet(ssh, s->pwpkt_type, PKTT_PASSWORD,
3779 PKT_STR, s->cur_prompt->prompts[0]->result,
3780 PKTT_OTHER, PKT_END);
3782 logevent("Sent password");
3783 free_prompts(s->cur_prompt);
3785 if (pktin->type == SSH1_SMSG_FAILURE) {
3786 if (flags & FLAG_VERBOSE)
3787 c_write_str(ssh, "Access denied\r\n");
3788 logevent("Authentication refused");
3789 } else if (pktin->type != SSH1_SMSG_SUCCESS) {
3790 bombout(("Strange packet received, type %d", pktin->type));
3796 if (s->publickey_blob) {
3797 sfree(s->publickey_blob);
3798 sfree(s->publickey_comment);
3801 logevent("Authentication successful");
3806 void sshfwd_close(struct ssh_channel *c)
3810 if (ssh->state == SSH_STATE_CLOSED)
3813 if (c && !c->closes) {
3815 * If halfopen is true, we have sent
3816 * CHANNEL_OPEN for this channel, but it hasn't even been
3817 * acknowledged by the server. So we must set a close flag
3818 * on it now, and then when the server acks the channel
3819 * open, we can close it then.
3822 if (ssh->version == 1) {
3823 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
3826 struct Packet *pktout;
3827 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
3828 ssh2_pkt_adduint32(pktout, c->remoteid);
3829 ssh2_pkt_send(ssh, pktout);
3832 c->closes = 1; /* sent MSG_CLOSE */
3833 if (c->type == CHAN_X11) {
3835 logevent("Forwarded X11 connection terminated");
3836 } else if (c->type == CHAN_SOCKDATA ||
3837 c->type == CHAN_SOCKDATA_DORMANT) {
3839 logevent("Forwarded port closed");
3844 int sshfwd_write(struct ssh_channel *c, char *buf, int len)
3848 if (ssh->state == SSH_STATE_CLOSED)
3851 if (ssh->version == 1) {
3852 send_packet(ssh, SSH1_MSG_CHANNEL_DATA,
3853 PKT_INT, c->remoteid,
3855 PKT_INT, len, PKT_DATA, buf, len,
3856 PKTT_OTHER, PKT_END);
3858 * In SSH-1 we can return 0 here - implying that forwarded
3859 * connections are never individually throttled - because
3860 * the only circumstance that can cause throttling will be
3861 * the whole SSH connection backing up, in which case
3862 * _everything_ will be throttled as a whole.
3866 ssh2_add_channel_data(c, buf, len);
3867 return ssh2_try_send(c);
3871 void sshfwd_unthrottle(struct ssh_channel *c, int bufsize)
3875 if (ssh->state == SSH_STATE_CLOSED)
3878 if (ssh->version == 1) {
3879 if (c->v.v1.throttling && bufsize < SSH1_BUFFER_LIMIT) {
3880 c->v.v1.throttling = 0;
3881 ssh1_throttle(ssh, -1);
3884 ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
3888 static void ssh_queueing_handler(Ssh ssh, struct Packet *pktin)
3890 struct queued_handler *qh = ssh->qhead;
3894 assert(pktin->type == qh->msg1 || pktin->type == qh->msg2);
3897 assert(ssh->packet_dispatch[qh->msg1] == ssh_queueing_handler);
3898 ssh->packet_dispatch[qh->msg1] = NULL;
3901 assert(ssh->packet_dispatch[qh->msg2] == ssh_queueing_handler);
3902 ssh->packet_dispatch[qh->msg2] = NULL;
3906 ssh->qhead = qh->next;
3908 if (ssh->qhead->msg1 > 0) {
3909 assert(ssh->packet_dispatch[ssh->qhead->msg1] == NULL);
3910 ssh->packet_dispatch[ssh->qhead->msg1] = ssh_queueing_handler;
3912 if (ssh->qhead->msg2 > 0) {
3913 assert(ssh->packet_dispatch[ssh->qhead->msg2] == NULL);
3914 ssh->packet_dispatch[ssh->qhead->msg2] = ssh_queueing_handler;
3917 ssh->qhead = ssh->qtail = NULL;
3918 ssh->packet_dispatch[pktin->type] = NULL;
3921 qh->handler(ssh, pktin, qh->ctx);
3926 static void ssh_queue_handler(Ssh ssh, int msg1, int msg2,
3927 chandler_fn_t handler, void *ctx)
3929 struct queued_handler *qh;
3931 qh = snew(struct queued_handler);
3934 qh->handler = handler;
3938 if (ssh->qtail == NULL) {
3942 assert(ssh->packet_dispatch[qh->msg1] == NULL);
3943 ssh->packet_dispatch[qh->msg1] = ssh_queueing_handler;
3946 assert(ssh->packet_dispatch[qh->msg2] == NULL);
3947 ssh->packet_dispatch[qh->msg2] = ssh_queueing_handler;
3950 ssh->qtail->next = qh;
3955 static void ssh_rportfwd_succfail(Ssh ssh, struct Packet *pktin, void *ctx)
3957 struct ssh_rportfwd *rpf, *pf = (struct ssh_rportfwd *)ctx;
3959 if (pktin->type == (ssh->version == 1 ? SSH1_SMSG_SUCCESS :
3960 SSH2_MSG_REQUEST_SUCCESS)) {
3961 logeventf(ssh, "Remote port forwarding from %s enabled",
3964 logeventf(ssh, "Remote port forwarding from %s refused",
3967 rpf = del234(ssh->rportfwds, pf);
3973 static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
3975 const char *portfwd_strptr = cfg->portfwd;
3976 struct ssh_portfwd *epf;
3979 if (!ssh->portfwds) {
3980 ssh->portfwds = newtree234(ssh_portcmp);
3983 * Go through the existing port forwardings and tag them
3984 * with status==DESTROY. Any that we want to keep will be
3985 * re-enabled (status==KEEP) as we go through the
3986 * configuration and find out which bits are the same as
3989 struct ssh_portfwd *epf;
3991 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
3992 epf->status = DESTROY;
3995 while (*portfwd_strptr) {
3996 char address_family, type;
3997 int sport,dport,sserv,dserv;
3998 char sports[256], dports[256], saddr[256], host[256];
4001 address_family = 'A';
4003 if (*portfwd_strptr == 'A' ||
4004 *portfwd_strptr == '4' ||
4005 *portfwd_strptr == '6')
4006 address_family = *portfwd_strptr++;
4007 if (*portfwd_strptr == 'L' ||
4008 *portfwd_strptr == 'R' ||
4009 *portfwd_strptr == 'D')
4010 type = *portfwd_strptr++;
4015 while (*portfwd_strptr && *portfwd_strptr != '\t') {
4016 if (*portfwd_strptr == ':') {
4018 * We've seen a colon in the middle of the
4019 * source port number. This means that
4020 * everything we've seen until now is the
4021 * source _address_, so we'll move it into
4022 * saddr and start sports from the beginning
4027 if (ssh->version == 1 && type == 'R') {
4028 logeventf(ssh, "SSH-1 cannot handle remote source address "
4029 "spec \"%s\"; ignoring", sports);
4031 strcpy(saddr, sports);
4034 if (n < lenof(sports)-1) sports[n++] = *portfwd_strptr++;
4038 if (*portfwd_strptr == '\t')
4041 while (*portfwd_strptr && *portfwd_strptr != ':') {
4042 if (n < lenof(host)-1) host[n++] = *portfwd_strptr++;
4045 if (*portfwd_strptr == ':')
4048 while (*portfwd_strptr) {
4049 if (n < lenof(dports)-1) dports[n++] = *portfwd_strptr++;
4053 dport = atoi(dports);
4057 dport = net_service_lookup(dports);
4059 logeventf(ssh, "Service lookup failed for destination"
4060 " port \"%s\"", dports);
4064 while (*portfwd_strptr) portfwd_strptr++;
4068 portfwd_strptr++; /* eat the NUL and move to next one */
4070 sport = atoi(sports);
4074 sport = net_service_lookup(sports);
4076 logeventf(ssh, "Service lookup failed for source"
4077 " port \"%s\"", sports);
4080 if (sport && dport) {
4081 /* Set up a description of the source port. */
4082 struct ssh_portfwd *pfrec, *epfrec;
4084 pfrec = snew(struct ssh_portfwd);
4086 pfrec->saddr = *saddr ? dupstr(saddr) : NULL;
4087 pfrec->sserv = sserv ? dupstr(sports) : NULL;
4088 pfrec->sport = sport;
4089 pfrec->daddr = *host ? dupstr(host) : NULL;
4090 pfrec->dserv = dserv ? dupstr(dports) : NULL;
4091 pfrec->dport = dport;
4092 pfrec->local = NULL;
4093 pfrec->remote = NULL;
4094 pfrec->addressfamily = (address_family == '4' ? ADDRTYPE_IPV4 :
4095 address_family == '6' ? ADDRTYPE_IPV6 :
4098 epfrec = add234(ssh->portfwds, pfrec);
4099 if (epfrec != pfrec) {
4101 * We already have a port forwarding with precisely
4102 * these parameters. Hence, no need to do anything;
4103 * simply tag the existing one as KEEP.
4105 epfrec->status = KEEP;
4106 free_portfwd(pfrec);
4108 pfrec->status = CREATE;
4114 * Now go through and destroy any port forwardings which were
4117 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4118 if (epf->status == DESTROY) {
4121 message = dupprintf("%s port forwarding from %s%s%d",
4122 epf->type == 'L' ? "local" :
4123 epf->type == 'R' ? "remote" : "dynamic",
4124 epf->saddr ? epf->saddr : "",
4125 epf->saddr ? ":" : "",
4128 if (epf->type != 'D') {
4129 char *msg2 = dupprintf("%s to %s:%d", message,
4130 epf->daddr, epf->dport);
4135 logeventf(ssh, "Cancelling %s", message);
4139 struct ssh_rportfwd *rpf = epf->remote;
4140 struct Packet *pktout;
4143 * Cancel the port forwarding at the server
4146 if (ssh->version == 1) {
4148 * We cannot cancel listening ports on the
4149 * server side in SSH-1! There's no message
4150 * to support it. Instead, we simply remove
4151 * the rportfwd record from the local end
4152 * so that any connections the server tries
4153 * to make on it are rejected.
4156 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4157 ssh2_pkt_addstring(pktout, "cancel-tcpip-forward");
4158 ssh2_pkt_addbool(pktout, 0);/* _don't_ want reply */
4160 ssh2_pkt_addstring(pktout, epf->saddr);
4161 } else if (ssh->cfg.rport_acceptall) {
4162 /* XXX: ssh->cfg.rport_acceptall may not represent
4163 * what was used to open the original connection,
4164 * since it's reconfigurable. */
4165 ssh2_pkt_addstring(pktout, "0.0.0.0");
4167 ssh2_pkt_addstring(pktout, "127.0.0.1");
4169 ssh2_pkt_adduint32(pktout, epf->sport);
4170 ssh2_pkt_send(ssh, pktout);
4173 del234(ssh->rportfwds, rpf);
4175 } else if (epf->local) {
4176 pfd_terminate(epf->local);
4179 delpos234(ssh->portfwds, i);
4181 i--; /* so we don't skip one in the list */
4185 * And finally, set up any new port forwardings (status==CREATE).
4187 for (i = 0; (epf = index234(ssh->portfwds, i)) != NULL; i++)
4188 if (epf->status == CREATE) {
4189 char *sportdesc, *dportdesc;
4190 sportdesc = dupprintf("%s%s%s%s%d%s",
4191 epf->saddr ? epf->saddr : "",
4192 epf->saddr ? ":" : "",
4193 epf->sserv ? epf->sserv : "",
4194 epf->sserv ? "(" : "",
4196 epf->sserv ? ")" : "");
4197 if (epf->type == 'D') {
4200 dportdesc = dupprintf("%s:%s%s%d%s",
4202 epf->dserv ? epf->dserv : "",
4203 epf->dserv ? "(" : "",
4205 epf->dserv ? ")" : "");
4208 if (epf->type == 'L') {
4209 const char *err = pfd_addforward(epf->daddr, epf->dport,
4210 epf->saddr, epf->sport,
4213 epf->addressfamily);
4215 logeventf(ssh, "Local %sport %s forwarding to %s%s%s",
4216 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4217 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4218 sportdesc, dportdesc,
4219 err ? " failed: " : "", err ? err : "");
4220 } else if (epf->type == 'D') {
4221 const char *err = pfd_addforward(NULL, -1,
4222 epf->saddr, epf->sport,
4225 epf->addressfamily);
4227 logeventf(ssh, "Local %sport %s SOCKS dynamic forwarding%s%s",
4228 epf->addressfamily == ADDRTYPE_IPV4 ? "IPv4 " :
4229 epf->addressfamily == ADDRTYPE_IPV6 ? "IPv6 " : "",
4231 err ? " failed: " : "", err ? err : "");
4233 struct ssh_rportfwd *pf;
4236 * Ensure the remote port forwardings tree exists.
4238 if (!ssh->rportfwds) {
4239 if (ssh->version == 1)
4240 ssh->rportfwds = newtree234(ssh_rportcmp_ssh1);
4242 ssh->rportfwds = newtree234(ssh_rportcmp_ssh2);
4245 pf = snew(struct ssh_rportfwd);
4246 strncpy(pf->dhost, epf->daddr, lenof(pf->dhost)-1);
4247 pf->dhost[lenof(pf->dhost)-1] = '\0';
4248 pf->dport = epf->dport;
4249 pf->sport = epf->sport;
4250 if (add234(ssh->rportfwds, pf) != pf) {
4251 logeventf(ssh, "Duplicate remote port forwarding to %s:%d",
4252 epf->daddr, epf->dport);
4255 logeventf(ssh, "Requesting remote port %s"
4256 " forward to %s", sportdesc, dportdesc);
4258 pf->sportdesc = sportdesc;
4263 if (ssh->version == 1) {
4264 send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST,
4265 PKT_INT, epf->sport,
4266 PKT_STR, epf->daddr,
4267 PKT_INT, epf->dport,
4269 ssh_queue_handler(ssh, SSH1_SMSG_SUCCESS,
4271 ssh_rportfwd_succfail, pf);
4273 struct Packet *pktout;
4274 pktout = ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
4275 ssh2_pkt_addstring(pktout, "tcpip-forward");
4276 ssh2_pkt_addbool(pktout, 1);/* want reply */
4278 ssh2_pkt_addstring(pktout, epf->saddr);
4279 } else if (cfg->rport_acceptall) {
4280 ssh2_pkt_addstring(pktout, "0.0.0.0");
4282 ssh2_pkt_addstring(pktout, "127.0.0.1");
4284 ssh2_pkt_adduint32(pktout, epf->sport);
4285 ssh2_pkt_send(ssh, pktout);
4287 ssh_queue_handler(ssh, SSH2_MSG_REQUEST_SUCCESS,
4288 SSH2_MSG_REQUEST_FAILURE,
4289 ssh_rportfwd_succfail, pf);
4298 static void ssh1_smsg_stdout_stderr_data(Ssh ssh, struct Packet *pktin)
4301 int stringlen, bufsize;
4303 ssh_pkt_getstring(pktin, &string, &stringlen);
4304 if (string == NULL) {
4305 bombout(("Incoming terminal data packet was badly formed"));
4309 bufsize = from_backend(ssh->frontend, pktin->type == SSH1_SMSG_STDERR_DATA,
4311 if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
4312 ssh->v1_stdout_throttling = 1;
4313 ssh1_throttle(ssh, +1);
4317 static void ssh1_smsg_x11_open(Ssh ssh, struct Packet *pktin)
4319 /* Remote side is trying to open a channel to talk to our
4320 * X-Server. Give them back a local channel number. */
4321 struct ssh_channel *c;
4322 int remoteid = ssh_pkt_getuint32(pktin);
4324 logevent("Received X11 connect request");
4325 /* Refuse if X11 forwarding is disabled. */
4326 if (!ssh->X11_fwd_enabled) {
4327 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4328 PKT_INT, remoteid, PKT_END);
4329 logevent("Rejected X11 connect request");
4331 c = snew(struct ssh_channel);
4334 if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c,
4335 ssh->x11auth, NULL, -1, &ssh->cfg) != NULL) {
4336 logevent("Opening X11 forward connection failed");
4338 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4339 PKT_INT, remoteid, PKT_END);
4342 ("Opening X11 forward connection succeeded");
4343 c->remoteid = remoteid;
4344 c->halfopen = FALSE;
4345 c->localid = alloc_channel_id(ssh);
4347 c->v.v1.throttling = 0;
4348 c->type = CHAN_X11; /* identify channel type */
4349 add234(ssh->channels, c);
4350 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4351 PKT_INT, c->remoteid, PKT_INT,
4352 c->localid, PKT_END);
4353 logevent("Opened X11 forward channel");
4358 static void ssh1_smsg_agent_open(Ssh ssh, struct Packet *pktin)
4360 /* Remote side is trying to open a channel to talk to our
4361 * agent. Give them back a local channel number. */
4362 struct ssh_channel *c;
4363 int remoteid = ssh_pkt_getuint32(pktin);
4365 /* Refuse if agent forwarding is disabled. */
4366 if (!ssh->agentfwd_enabled) {
4367 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4368 PKT_INT, remoteid, PKT_END);
4370 c = snew(struct ssh_channel);
4372 c->remoteid = remoteid;
4373 c->halfopen = FALSE;
4374 c->localid = alloc_channel_id(ssh);
4376 c->v.v1.throttling = 0;
4377 c->type = CHAN_AGENT; /* identify channel type */
4378 c->u.a.lensofar = 0;
4379 add234(ssh->channels, c);
4380 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4381 PKT_INT, c->remoteid, PKT_INT, c->localid,
4386 static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin)
4388 /* Remote side is trying to open a channel to talk to a
4389 * forwarded port. Give them back a local channel number. */
4390 struct ssh_channel *c;
4391 struct ssh_rportfwd pf, *pfp;
4396 c = snew(struct ssh_channel);
4399 remoteid = ssh_pkt_getuint32(pktin);
4400 ssh_pkt_getstring(pktin, &host, &hostsize);
4401 port = ssh_pkt_getuint32(pktin);
4403 if (hostsize >= lenof(pf.dhost))
4404 hostsize = lenof(pf.dhost)-1;
4405 memcpy(pf.dhost, host, hostsize);
4406 pf.dhost[hostsize] = '\0';
4408 pfp = find234(ssh->rportfwds, &pf, NULL);
4411 logeventf(ssh, "Rejected remote port open request for %s:%d",
4413 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4414 PKT_INT, remoteid, PKT_END);
4416 logeventf(ssh, "Received remote port open request for %s:%d",
4418 e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port,
4419 c, &ssh->cfg, pfp->pfrec->addressfamily);
4421 logeventf(ssh, "Port open failed: %s", e);
4423 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
4424 PKT_INT, remoteid, PKT_END);
4426 c->remoteid = remoteid;
4427 c->halfopen = FALSE;
4428 c->localid = alloc_channel_id(ssh);
4430 c->v.v1.throttling = 0;
4431 c->type = CHAN_SOCKDATA; /* identify channel type */
4432 add234(ssh->channels, c);
4433 send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
4434 PKT_INT, c->remoteid, PKT_INT,
4435 c->localid, PKT_END);
4436 logevent("Forwarded port opened successfully");
4441 static void ssh1_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
4443 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4444 unsigned int localid = ssh_pkt_getuint32(pktin);
4445 struct ssh_channel *c;
4447 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4448 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4449 c->remoteid = localid;
4450 c->halfopen = FALSE;
4451 c->type = CHAN_SOCKDATA;
4452 c->v.v1.throttling = 0;
4453 pfd_confirm(c->u.pfd.s);
4456 if (c && c->closes) {
4458 * We have a pending close on this channel,
4459 * which we decided on before the server acked
4460 * the channel open. So now we know the
4461 * remoteid, we can close it again.
4463 send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE,
4464 PKT_INT, c->remoteid, PKT_END);
4468 static void ssh1_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
4470 unsigned int remoteid = ssh_pkt_getuint32(pktin);
4471 struct ssh_channel *c;
4473 c = find234(ssh->channels, &remoteid, ssh_channelfind);
4474 if (c && c->type == CHAN_SOCKDATA_DORMANT) {
4475 logevent("Forwarded connection refused by server");
4476 pfd_close(c->u.pfd.s);
4477 del234(ssh->channels, c);
4482 static void ssh1_msg_channel_close(Ssh ssh, struct Packet *pktin)
4484 /* Remote side closes a channel. */
4485 unsigned i = ssh_pkt_getuint32(pktin);
4486 struct ssh_channel *c;
4487 c = find234(ssh->channels, &i, ssh_channelfind);
4488 if (c && !c->halfopen) {
4491 (pktin->type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2);
4493 if ((c->closes == 0) && (c->type == CHAN_X11)) {
4494 logevent("Forwarded X11 connection terminated");
4495 assert(c->u.x11.s != NULL);
4496 x11_close(c->u.x11.s);
4499 if ((c->closes == 0) && (c->type == CHAN_SOCKDATA)) {
4500 logevent("Forwarded port closed");
4501 assert(c->u.pfd.s != NULL);
4502 pfd_close(c->u.pfd.s);
4506 c->closes |= (closetype << 2); /* seen this message */
4507 if (!(c->closes & closetype)) {
4508 send_packet(ssh, pktin->type, PKT_INT, c->remoteid,
4510 c->closes |= closetype; /* sent it too */
4513 if (c->closes == 15) {
4514 del234(ssh->channels, c);
4518 bombout(("Received CHANNEL_CLOSE%s for %s channel %d\n",
4519 pktin->type == SSH1_MSG_CHANNEL_CLOSE ? "" :
4520 "_CONFIRMATION", c ? "half-open" : "nonexistent",
4525 static void ssh1_msg_channel_data(Ssh ssh, struct Packet *pktin)
4527 /* Data sent down one of our channels. */
4528 int i = ssh_pkt_getuint32(pktin);
4531 struct ssh_channel *c;
4533 ssh_pkt_getstring(pktin, &p, &len);
4535 c = find234(ssh->channels, &i, ssh_channelfind);
4540 bufsize = x11_send(c->u.x11.s, p, len);
4543 bufsize = pfd_send(c->u.pfd.s, p, len);
4546 /* Data for an agent message. Buffer it. */
4548 if (c->u.a.lensofar < 4) {
4549 unsigned int l = min(4 - c->u.a.lensofar, len);
4550 memcpy(c->u.a.msglen + c->u.a.lensofar, p,
4554 c->u.a.lensofar += l;
4556 if (c->u.a.lensofar == 4) {
4558 4 + GET_32BIT(c->u.a.msglen);
4559 c->u.a.message = snewn(c->u.a.totallen,
4561 memcpy(c->u.a.message, c->u.a.msglen, 4);
4563 if (c->u.a.lensofar >= 4 && len > 0) {
4565 min(c->u.a.totallen - c->u.a.lensofar,
4567 memcpy(c->u.a.message + c->u.a.lensofar, p,
4571 c->u.a.lensofar += l;
4573 if (c->u.a.lensofar == c->u.a.totallen) {
4576 if (agent_query(c->u.a.message,
4579 ssh_agentf_callback, c))
4580 ssh_agentf_callback(c, reply, replylen);
4581 sfree(c->u.a.message);
4582 c->u.a.lensofar = 0;
4585 bufsize = 0; /* agent channels never back up */
4588 if (!c->v.v1.throttling && bufsize > SSH1_BUFFER_LIMIT) {
4589 c->v.v1.throttling = 1;
4590 ssh1_throttle(ssh, +1);
4595 static void ssh1_smsg_exit_status(Ssh ssh, struct Packet *pktin)
4597 ssh->exitcode = ssh_pkt_getuint32(pktin);
4598 logeventf(ssh, "Server sent command exit status %d", ssh->exitcode);
4599 send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
4601 * In case `helpful' firewalls or proxies tack
4602 * extra human-readable text on the end of the
4603 * session which we might mistake for another
4604 * encrypted packet, we close the session once
4605 * we've sent EXIT_CONFIRMATION.
4607 ssh_disconnect(ssh, NULL, NULL, 0, TRUE);
4610 /* Helper function to deal with sending tty modes for REQUEST_PTY */
4611 static void ssh1_send_ttymode(void *data, char *mode, char *val)
4613 struct Packet *pktout = (struct Packet *)data;
4615 unsigned int arg = 0;
4616 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
4617 if (i == lenof(ssh_ttymodes)) return;
4618 switch (ssh_ttymodes[i].type) {
4620 arg = ssh_tty_parse_specchar(val);
4623 arg = ssh_tty_parse_boolean(val);
4626 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
4627 ssh2_pkt_addbyte(pktout, arg);
4631 static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
4632 struct Packet *pktin)
4634 crBegin(ssh->do_ssh1_connection_crstate);
4636 ssh->packet_dispatch[SSH1_SMSG_STDOUT_DATA] =
4637 ssh->packet_dispatch[SSH1_SMSG_STDERR_DATA] =
4638 ssh1_smsg_stdout_stderr_data;
4640 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_CONFIRMATION] =
4641 ssh1_msg_channel_open_confirmation;
4642 ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_FAILURE] =
4643 ssh1_msg_channel_open_failure;
4644 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE] =
4645 ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION] =
4646 ssh1_msg_channel_close;
4647 ssh->packet_dispatch[SSH1_MSG_CHANNEL_DATA] = ssh1_msg_channel_data;
4648 ssh->packet_dispatch[SSH1_SMSG_EXIT_STATUS] = ssh1_smsg_exit_status;
4650 if (ssh->cfg.agentfwd && agent_exists()) {
4651 logevent("Requesting agent forwarding");
4652 send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END);
4656 if (pktin->type != SSH1_SMSG_SUCCESS
4657 && pktin->type != SSH1_SMSG_FAILURE) {
4658 bombout(("Protocol confusion"));
4660 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4661 logevent("Agent forwarding refused");
4663 logevent("Agent forwarding enabled");
4664 ssh->agentfwd_enabled = TRUE;
4665 ssh->packet_dispatch[SSH1_SMSG_AGENT_OPEN] = ssh1_smsg_agent_open;
4669 if (ssh->cfg.x11_forward) {
4670 char proto[20], data[64];
4671 logevent("Requesting X11 forwarding");
4672 ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
4673 data, sizeof(data), ssh->cfg.x11_auth);
4674 x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display);
4676 * Note that while we blank the X authentication data here, we don't
4677 * take any special action to blank the start of an X11 channel,
4678 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
4679 * without having session blanking enabled is likely to leak your
4680 * cookie into the log.
4682 if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) {
4683 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
4685 PKTT_PASSWORD, PKT_STR, data, PKTT_OTHER,
4686 PKT_INT, x11_get_screen_number(ssh->cfg.x11_display),
4689 send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING,
4691 PKTT_PASSWORD, PKT_STR, data, PKTT_OTHER, PKT_END);
4696 if (pktin->type != SSH1_SMSG_SUCCESS
4697 && pktin->type != SSH1_SMSG_FAILURE) {
4698 bombout(("Protocol confusion"));
4700 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4701 logevent("X11 forwarding refused");
4703 logevent("X11 forwarding enabled");
4704 ssh->X11_fwd_enabled = TRUE;
4705 ssh->packet_dispatch[SSH1_SMSG_X11_OPEN] = ssh1_smsg_x11_open;
4709 ssh_setup_portfwd(ssh, &ssh->cfg);
4710 ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = ssh1_msg_port_open;
4712 if (!ssh->cfg.nopty) {
4714 /* Unpick the terminal-speed string. */
4715 /* XXX perhaps we should allow no speeds to be sent. */
4716 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
4717 sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
4718 /* Send the pty request. */
4719 pkt = ssh1_pkt_init(SSH1_CMSG_REQUEST_PTY);
4720 ssh_pkt_addstring(pkt, ssh->cfg.termtype);
4721 ssh_pkt_adduint32(pkt, ssh->term_height);
4722 ssh_pkt_adduint32(pkt, ssh->term_width);
4723 ssh_pkt_adduint32(pkt, 0); /* width in pixels */
4724 ssh_pkt_adduint32(pkt, 0); /* height in pixels */
4725 parse_ttymodes(ssh, ssh->cfg.ttymodes,
4726 ssh1_send_ttymode, (void *)pkt);
4727 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_ISPEED);
4728 ssh_pkt_adduint32(pkt, ssh->ispeed);
4729 ssh_pkt_addbyte(pkt, SSH1_TTY_OP_OSPEED);
4730 ssh_pkt_adduint32(pkt, ssh->ospeed);
4731 ssh_pkt_addbyte(pkt, SSH_TTY_OP_END);
4733 ssh->state = SSH_STATE_INTERMED;
4737 if (pktin->type != SSH1_SMSG_SUCCESS
4738 && pktin->type != SSH1_SMSG_FAILURE) {
4739 bombout(("Protocol confusion"));
4741 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4742 c_write_str(ssh, "Server refused to allocate pty\r\n");
4743 ssh->editing = ssh->echoing = 1;
4745 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
4746 ssh->ospeed, ssh->ispeed);
4748 ssh->editing = ssh->echoing = 1;
4751 if (ssh->cfg.compression) {
4752 send_packet(ssh, SSH1_CMSG_REQUEST_COMPRESSION, PKT_INT, 6, PKT_END);
4756 if (pktin->type != SSH1_SMSG_SUCCESS
4757 && pktin->type != SSH1_SMSG_FAILURE) {
4758 bombout(("Protocol confusion"));
4760 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4761 c_write_str(ssh, "Server refused to compress\r\n");
4763 logevent("Started compression");
4764 ssh->v1_compressing = TRUE;
4765 ssh->cs_comp_ctx = zlib_compress_init();
4766 logevent("Initialised zlib (RFC1950) compression");
4767 ssh->sc_comp_ctx = zlib_decompress_init();
4768 logevent("Initialised zlib (RFC1950) decompression");
4772 * Start the shell or command.
4774 * Special case: if the first-choice command is an SSH-2
4775 * subsystem (hence not usable here) and the second choice
4776 * exists, we fall straight back to that.
4779 char *cmd = ssh->cfg.remote_cmd_ptr;
4781 if (!cmd) cmd = ssh->cfg.remote_cmd;
4783 if (ssh->cfg.ssh_subsys && ssh->cfg.remote_cmd_ptr2) {
4784 cmd = ssh->cfg.remote_cmd_ptr2;
4785 ssh->fallback_cmd = TRUE;
4788 send_packet(ssh, SSH1_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END);
4790 send_packet(ssh, SSH1_CMSG_EXEC_SHELL, PKT_END);
4791 logevent("Started session");
4794 ssh->state = SSH_STATE_SESSION;
4795 if (ssh->size_needed)
4796 ssh_size(ssh, ssh->term_width, ssh->term_height);
4797 if (ssh->eof_needed)
4798 ssh_special(ssh, TS_EOF);
4801 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
4803 ssh->channels = newtree234(ssh_channelcmp);
4807 * By this point, most incoming packets are already being
4808 * handled by the dispatch table, and we need only pay
4809 * attention to the unusual ones.
4814 if (pktin->type == SSH1_SMSG_SUCCESS) {
4815 /* may be from EXEC_SHELL on some servers */
4816 } else if (pktin->type == SSH1_SMSG_FAILURE) {
4817 /* may be from EXEC_SHELL on some servers
4818 * if no pty is available or in other odd cases. Ignore */
4820 bombout(("Strange packet received: type %d", pktin->type));
4825 int len = min(inlen, 512);
4826 send_packet(ssh, SSH1_CMSG_STDIN_DATA, PKTT_DATA,
4827 PKT_INT, len, PKT_DATA, in, len,
4828 PKTT_OTHER, PKT_END);
4839 * Handle the top-level SSH-2 protocol.
4841 static void ssh1_msg_debug(Ssh ssh, struct Packet *pktin)
4846 ssh_pkt_getstring(pktin, &msg, &msglen);
4847 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
4850 static void ssh1_msg_disconnect(Ssh ssh, struct Packet *pktin)
4852 /* log reason code in disconnect message */
4856 ssh_pkt_getstring(pktin, &msg, &msglen);
4857 bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg));
4860 static void ssh_msg_ignore(Ssh ssh, struct Packet *pktin)
4862 /* Do nothing, because we're ignoring it! Duhh. */
4865 static void ssh1_protocol_setup(Ssh ssh)
4870 * Most messages are handled by the coroutines.
4872 for (i = 0; i < 256; i++)
4873 ssh->packet_dispatch[i] = NULL;
4876 * These special message types we install handlers for.
4878 ssh->packet_dispatch[SSH1_MSG_DISCONNECT] = ssh1_msg_disconnect;
4879 ssh->packet_dispatch[SSH1_MSG_IGNORE] = ssh_msg_ignore;
4880 ssh->packet_dispatch[SSH1_MSG_DEBUG] = ssh1_msg_debug;
4883 static void ssh1_protocol(Ssh ssh, void *vin, int inlen,
4884 struct Packet *pktin)
4886 unsigned char *in=(unsigned char*)vin;
4887 if (ssh->state == SSH_STATE_CLOSED)
4890 if (pktin && ssh->packet_dispatch[pktin->type]) {
4891 ssh->packet_dispatch[pktin->type](ssh, pktin);
4895 if (!ssh->protocol_initial_phase_done) {
4896 if (do_ssh1_login(ssh, in, inlen, pktin))
4897 ssh->protocol_initial_phase_done = TRUE;
4902 do_ssh1_connection(ssh, in, inlen, pktin);
4906 * Utility routine for decoding comma-separated strings in KEXINIT.
4908 static int in_commasep_string(char *needle, char *haystack, int haylen)
4911 if (!needle || !haystack) /* protect against null pointers */
4913 needlen = strlen(needle);
4916 * Is it at the start of the string?
4918 if (haylen >= needlen && /* haystack is long enough */
4919 !memcmp(needle, haystack, needlen) && /* initial match */
4920 (haylen == needlen || haystack[needlen] == ',')
4921 /* either , or EOS follows */
4925 * If not, search for the next comma and resume after that.
4926 * If no comma found, terminate.
4928 while (haylen > 0 && *haystack != ',')
4929 haylen--, haystack++;
4932 haylen--, haystack++; /* skip over comma itself */
4937 * Similar routine for checking whether we have the first string in a list.
4939 static int first_in_commasep_string(char *needle, char *haystack, int haylen)
4942 if (!needle || !haystack) /* protect against null pointers */
4944 needlen = strlen(needle);
4946 * Is it at the start of the string?
4948 if (haylen >= needlen && /* haystack is long enough */
4949 !memcmp(needle, haystack, needlen) && /* initial match */
4950 (haylen == needlen || haystack[needlen] == ',')
4951 /* either , or EOS follows */
4959 * SSH-2 key creation method.
4961 static void ssh2_mkkey(Ssh ssh, Bignum K, unsigned char *H, char chr,
4962 unsigned char *keyspace)
4964 const struct ssh_hash *h = ssh->kex->hash;
4966 /* First hlen bytes. */
4968 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
4969 hash_mpint(h, s, K);
4970 h->bytes(s, H, h->hlen);
4971 h->bytes(s, &chr, 1);
4972 h->bytes(s, ssh->v2_session_id, ssh->v2_session_id_len);
4973 h->final(s, keyspace);
4974 /* Next hlen bytes. */
4976 if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
4977 hash_mpint(h, s, K);
4978 h->bytes(s, H, h->hlen);
4979 h->bytes(s, keyspace, h->hlen);
4980 h->final(s, keyspace + h->hlen);
4984 * Handle the SSH-2 transport layer.
4986 static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
4987 struct Packet *pktin)
4989 unsigned char *in = (unsigned char *)vin;
4990 struct do_ssh2_transport_state {
4991 int nbits, pbits, warn_kex, warn_cscipher, warn_sccipher;
4992 Bignum p, g, e, f, K;
4995 int kex_init_value, kex_reply_value;
4996 const struct ssh_mac **maclist;
4998 const struct ssh2_cipher *cscipher_tobe;
4999 const struct ssh2_cipher *sccipher_tobe;
5000 const struct ssh_mac *csmac_tobe;
5001 const struct ssh_mac *scmac_tobe;
5002 const struct ssh_compress *cscomp_tobe;
5003 const struct ssh_compress *sccomp_tobe;
5004 char *hostkeydata, *sigdata, *keystr, *fingerprint;
5005 int hostkeylen, siglen;
5006 void *hkey; /* actual host key */
5007 unsigned char exchange_hash[32];
5008 int n_preferred_kex;
5009 const struct ssh_kexes *preferred_kex[KEX_MAX];
5010 int n_preferred_ciphers;
5011 const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX];
5012 const struct ssh_compress *preferred_comp;
5013 int got_session_id, activated_authconn;
5014 struct Packet *pktout;
5019 crState(do_ssh2_transport_state);
5021 crBegin(ssh->do_ssh2_transport_crstate);
5023 s->cscipher_tobe = s->sccipher_tobe = NULL;
5024 s->csmac_tobe = s->scmac_tobe = NULL;
5025 s->cscomp_tobe = s->sccomp_tobe = NULL;
5027 s->got_session_id = s->activated_authconn = FALSE;
5030 * Be prepared to work around the buggy MAC problem.
5032 if (ssh->remote_bugs & BUG_SSH2_HMAC)
5033 s->maclist = buggymacs, s->nmacs = lenof(buggymacs);
5035 s->maclist = macs, s->nmacs = lenof(macs);
5038 ssh->pkt_ctx &= ~SSH2_PKTCTX_KEX_MASK;
5040 int i, j, commalist_started;
5043 * Set up the preferred key exchange. (NULL => warn below here)
5045 s->n_preferred_kex = 0;
5046 for (i = 0; i < KEX_MAX; i++) {
5047 switch (ssh->cfg.ssh_kexlist[i]) {
5049 s->preferred_kex[s->n_preferred_kex++] =
5050 &ssh_diffiehellman_gex;
5053 s->preferred_kex[s->n_preferred_kex++] =
5054 &ssh_diffiehellman_group14;
5057 s->preferred_kex[s->n_preferred_kex++] =
5058 &ssh_diffiehellman_group1;
5061 /* Flag for later. Don't bother if it's the last in
5063 if (i < KEX_MAX - 1) {
5064 s->preferred_kex[s->n_preferred_kex++] = NULL;
5071 * Set up the preferred ciphers. (NULL => warn below here)
5073 s->n_preferred_ciphers = 0;
5074 for (i = 0; i < CIPHER_MAX; i++) {
5075 switch (ssh->cfg.ssh_cipherlist[i]) {
5076 case CIPHER_BLOWFISH:
5077 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_blowfish;
5080 if (ssh->cfg.ssh2_des_cbc) {
5081 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_des;
5085 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_3des;
5088 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_aes;
5090 case CIPHER_ARCFOUR:
5091 s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_arcfour;
5094 /* Flag for later. Don't bother if it's the last in
5096 if (i < CIPHER_MAX - 1) {
5097 s->preferred_ciphers[s->n_preferred_ciphers++] = NULL;
5104 * Set up preferred compression.
5106 if (ssh->cfg.compression)
5107 s->preferred_comp = &ssh_zlib;
5109 s->preferred_comp = &ssh_comp_none;
5112 * Enable queueing of outgoing auth- or connection-layer
5113 * packets while we are in the middle of a key exchange.
5115 ssh->queueing = TRUE;
5118 * Flag that KEX is in progress.
5120 ssh->kex_in_progress = TRUE;
5123 * Construct and send our key exchange packet.
5125 s->pktout = ssh2_pkt_init(SSH2_MSG_KEXINIT);
5126 for (i = 0; i < 16; i++)
5127 ssh2_pkt_addbyte(s->pktout, (unsigned char) random_byte());
5128 /* List key exchange algorithms. */
5129 ssh2_pkt_addstring_start(s->pktout);
5130 commalist_started = 0;
5131 for (i = 0; i < s->n_preferred_kex; i++) {
5132 const struct ssh_kexes *k = s->preferred_kex[i];
5133 if (!k) continue; /* warning flag */
5134 for (j = 0; j < k->nkexes; j++) {
5135 if (commalist_started)
5136 ssh2_pkt_addstring_str(s->pktout, ",");
5137 ssh2_pkt_addstring_str(s->pktout, k->list[j]->name);
5138 commalist_started = 1;
5141 /* List server host key algorithms. */
5142 ssh2_pkt_addstring_start(s->pktout);
5143 for (i = 0; i < lenof(hostkey_algs); i++) {
5144 ssh2_pkt_addstring_str(s->pktout, hostkey_algs[i]->name);
5145 if (i < lenof(hostkey_algs) - 1)
5146 ssh2_pkt_addstring_str(s->pktout, ",");
5148 /* List client->server encryption algorithms. */
5149 ssh2_pkt_addstring_start(s->pktout);
5150 commalist_started = 0;
5151 for (i = 0; i < s->n_preferred_ciphers; i++) {
5152 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5153 if (!c) continue; /* warning flag */
5154 for (j = 0; j < c->nciphers; j++) {
5155 if (commalist_started)
5156 ssh2_pkt_addstring_str(s->pktout, ",");
5157 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
5158 commalist_started = 1;
5161 /* List server->client encryption algorithms. */
5162 ssh2_pkt_addstring_start(s->pktout);
5163 commalist_started = 0;
5164 for (i = 0; i < s->n_preferred_ciphers; i++) {
5165 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5166 if (!c) continue; /* warning flag */
5167 for (j = 0; j < c->nciphers; j++) {
5168 if (commalist_started)
5169 ssh2_pkt_addstring_str(s->pktout, ",");
5170 ssh2_pkt_addstring_str(s->pktout, c->list[j]->name);
5171 commalist_started = 1;
5174 /* List client->server MAC algorithms. */
5175 ssh2_pkt_addstring_start(s->pktout);
5176 for (i = 0; i < s->nmacs; i++) {
5177 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
5178 if (i < s->nmacs - 1)
5179 ssh2_pkt_addstring_str(s->pktout, ",");
5181 /* List server->client MAC algorithms. */
5182 ssh2_pkt_addstring_start(s->pktout);
5183 for (i = 0; i < s->nmacs; i++) {
5184 ssh2_pkt_addstring_str(s->pktout, s->maclist[i]->name);
5185 if (i < s->nmacs - 1)
5186 ssh2_pkt_addstring_str(s->pktout, ",");
5188 /* List client->server compression algorithms. */
5189 ssh2_pkt_addstring_start(s->pktout);
5190 assert(lenof(compressions) > 1);
5191 ssh2_pkt_addstring_str(s->pktout, s->preferred_comp->name);
5192 for (i = 0; i < lenof(compressions); i++) {
5193 const struct ssh_compress *c = compressions[i];
5194 if (c != s->preferred_comp) {
5195 ssh2_pkt_addstring_str(s->pktout, ",");
5196 ssh2_pkt_addstring_str(s->pktout, c->name);
5199 /* List server->client compression algorithms. */
5200 ssh2_pkt_addstring_start(s->pktout);
5201 assert(lenof(compressions) > 1);
5202 ssh2_pkt_addstring_str(s->pktout, s->preferred_comp->name);
5203 for (i = 0; i < lenof(compressions); i++) {
5204 const struct ssh_compress *c = compressions[i];
5205 if (c != s->preferred_comp) {
5206 ssh2_pkt_addstring_str(s->pktout, ",");
5207 ssh2_pkt_addstring_str(s->pktout, c->name);
5210 /* List client->server languages. Empty list. */
5211 ssh2_pkt_addstring_start(s->pktout);
5212 /* List server->client languages. Empty list. */
5213 ssh2_pkt_addstring_start(s->pktout);
5214 /* First KEX packet does _not_ follow, because we're not that brave. */
5215 ssh2_pkt_addbool(s->pktout, FALSE);
5217 ssh2_pkt_adduint32(s->pktout, 0);
5220 s->our_kexinitlen = s->pktout->length - 5;
5221 s->our_kexinit = snewn(s->our_kexinitlen, unsigned char);
5222 memcpy(s->our_kexinit, s->pktout->data + 5, s->our_kexinitlen);
5224 ssh2_pkt_send_noqueue(ssh, s->pktout);
5230 * Now examine the other side's KEXINIT to see what we're up
5234 char *str, *preferred;
5237 if (pktin->type != SSH2_MSG_KEXINIT) {
5238 bombout(("expected key exchange packet from server"));
5242 ssh->hostkey = NULL;
5243 s->cscipher_tobe = NULL;
5244 s->sccipher_tobe = NULL;
5245 s->csmac_tobe = NULL;
5246 s->scmac_tobe = NULL;
5247 s->cscomp_tobe = NULL;
5248 s->sccomp_tobe = NULL;
5249 s->warn_kex = s->warn_cscipher = s->warn_sccipher = FALSE;
5251 pktin->savedpos += 16; /* skip garbage cookie */
5252 ssh_pkt_getstring(pktin, &str, &len); /* key exchange algorithms */
5255 for (i = 0; i < s->n_preferred_kex; i++) {
5256 const struct ssh_kexes *k = s->preferred_kex[i];
5260 for (j = 0; j < k->nkexes; j++) {
5261 if (!preferred) preferred = k->list[j]->name;
5262 if (in_commasep_string(k->list[j]->name, str, len)) {
5263 ssh->kex = k->list[j];
5272 bombout(("Couldn't agree a key exchange algorithm (available: %s)",
5273 str ? str : "(null)"));
5277 * Note that the server's guess is considered wrong if it doesn't match
5278 * the first algorithm in our list, even if it's still the algorithm
5281 s->guessok = first_in_commasep_string(preferred, str, len);
5282 ssh_pkt_getstring(pktin, &str, &len); /* host key algorithms */
5283 for (i = 0; i < lenof(hostkey_algs); i++) {
5284 if (in_commasep_string(hostkey_algs[i]->name, str, len)) {
5285 ssh->hostkey = hostkey_algs[i];
5289 s->guessok = s->guessok &&
5290 first_in_commasep_string(hostkey_algs[0]->name, str, len);
5291 ssh_pkt_getstring(pktin, &str, &len); /* client->server cipher */
5292 for (i = 0; i < s->n_preferred_ciphers; i++) {
5293 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5295 s->warn_cscipher = TRUE;
5297 for (j = 0; j < c->nciphers; j++) {
5298 if (in_commasep_string(c->list[j]->name, str, len)) {
5299 s->cscipher_tobe = c->list[j];
5304 if (s->cscipher_tobe)
5307 if (!s->cscipher_tobe) {
5308 bombout(("Couldn't agree a client-to-server cipher (available: %s)",
5309 str ? str : "(null)"));
5313 ssh_pkt_getstring(pktin, &str, &len); /* server->client cipher */
5314 for (i = 0; i < s->n_preferred_ciphers; i++) {
5315 const struct ssh2_ciphers *c = s->preferred_ciphers[i];
5317 s->warn_sccipher = TRUE;
5319 for (j = 0; j < c->nciphers; j++) {
5320 if (in_commasep_string(c->list[j]->name, str, len)) {
5321 s->sccipher_tobe = c->list[j];
5326 if (s->sccipher_tobe)
5329 if (!s->sccipher_tobe) {
5330 bombout(("Couldn't agree a server-to-client cipher (available: %s)",
5331 str ? str : "(null)"));
5335 ssh_pkt_getstring(pktin, &str, &len); /* client->server mac */
5336 for (i = 0; i < s->nmacs; i++) {
5337 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5338 s->csmac_tobe = s->maclist[i];
5342 ssh_pkt_getstring(pktin, &str, &len); /* server->client mac */
5343 for (i = 0; i < s->nmacs; i++) {
5344 if (in_commasep_string(s->maclist[i]->name, str, len)) {
5345 s->scmac_tobe = s->maclist[i];
5349 ssh_pkt_getstring(pktin, &str, &len); /* client->server compression */
5350 for (i = 0; i < lenof(compressions) + 1; i++) {
5351 const struct ssh_compress *c =
5352 i == 0 ? s->preferred_comp : compressions[i - 1];
5353 if (in_commasep_string(c->name, str, len)) {
5358 ssh_pkt_getstring(pktin, &str, &len); /* server->client compression */
5359 for (i = 0; i < lenof(compressions) + 1; i++) {
5360 const struct ssh_compress *c =
5361 i == 0 ? s->preferred_comp : compressions[i - 1];
5362 if (in_commasep_string(c->name, str, len)) {
5367 ssh_pkt_getstring(pktin, &str, &len); /* client->server language */
5368 ssh_pkt_getstring(pktin, &str, &len); /* server->client language */
5369 s->ignorepkt = ssh2_pkt_getbool(pktin) && !s->guessok;
5372 ssh_set_frozen(ssh, 1);
5373 s->dlgret = askalg(ssh->frontend, "key-exchange algorithm",
5375 ssh_dialog_callback, ssh);
5376 if (s->dlgret < 0) {
5380 bombout(("Unexpected data from server while"
5381 " waiting for user response"));
5384 } while (pktin || inlen > 0);
5385 s->dlgret = ssh->user_response;
5387 ssh_set_frozen(ssh, 0);
5388 if (s->dlgret == 0) {
5389 ssh_disconnect(ssh, "User aborted at kex warning", NULL,
5395 if (s->warn_cscipher) {
5396 ssh_set_frozen(ssh, 1);
5397 s->dlgret = askalg(ssh->frontend,
5398 "client-to-server cipher",
5399 s->cscipher_tobe->name,
5400 ssh_dialog_callback, ssh);
5401 if (s->dlgret < 0) {
5405 bombout(("Unexpected data from server while"
5406 " waiting for user response"));
5409 } while (pktin || inlen > 0);
5410 s->dlgret = ssh->user_response;
5412 ssh_set_frozen(ssh, 0);
5413 if (s->dlgret == 0) {
5414 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5420 if (s->warn_sccipher) {
5421 ssh_set_frozen(ssh, 1);
5422 s->dlgret = askalg(ssh->frontend,
5423 "server-to-client cipher",
5424 s->sccipher_tobe->name,
5425 ssh_dialog_callback, ssh);
5426 if (s->dlgret < 0) {
5430 bombout(("Unexpected data from server while"
5431 " waiting for user response"));
5434 } while (pktin || inlen > 0);
5435 s->dlgret = ssh->user_response;
5437 ssh_set_frozen(ssh, 0);
5438 if (s->dlgret == 0) {
5439 ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
5445 ssh->exhash = ssh->kex->hash->init();
5446 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_c, strlen(ssh->v_c));
5447 hash_string(ssh->kex->hash, ssh->exhash, ssh->v_s, strlen(ssh->v_s));
5448 hash_string(ssh->kex->hash, ssh->exhash,
5449 s->our_kexinit, s->our_kexinitlen);
5450 sfree(s->our_kexinit);
5451 if (pktin->length > 5)
5452 hash_string(ssh->kex->hash, ssh->exhash,
5453 pktin->data + 5, pktin->length - 5);
5455 if (s->ignorepkt) /* first_kex_packet_follows */
5456 crWaitUntil(pktin); /* Ignore packet */
5460 * Work out the number of bits of key we will need from the key
5461 * exchange. We start with the maximum key length of either
5467 csbits = s->cscipher_tobe->keylen;
5468 scbits = s->sccipher_tobe->keylen;
5469 s->nbits = (csbits > scbits ? csbits : scbits);
5471 /* The keys only have hlen-bit entropy, since they're based on
5472 * a hash. So cap the key size at hlen bits. */
5473 if (s->nbits > ssh->kex->hash->hlen * 8)
5474 s->nbits = ssh->kex->hash->hlen * 8;
5477 * If we're doing Diffie-Hellman group exchange, start by
5478 * requesting a group.
5480 if (!ssh->kex->pdata) {
5481 logevent("Doing Diffie-Hellman group exchange");
5482 ssh->pkt_ctx |= SSH2_PKTCTX_DHGEX;
5484 * Work out how big a DH group we will need to allow that
5487 s->pbits = 512 << ((s->nbits - 1) / 64);
5488 s->pktout = ssh2_pkt_init(SSH2_MSG_KEX_DH_GEX_REQUEST);
5489 ssh2_pkt_adduint32(s->pktout, s->pbits);
5490 ssh2_pkt_send_noqueue(ssh, s->pktout);
5493 if (pktin->type != SSH2_MSG_KEX_DH_GEX_GROUP) {
5494 bombout(("expected key exchange group packet from server"));
5497 s->p = ssh2_pkt_getmp(pktin);
5498 s->g = ssh2_pkt_getmp(pktin);
5499 if (!s->p || !s->g) {
5500 bombout(("unable to read mp-ints from incoming group packet"));
5503 ssh->kex_ctx = dh_setup_gex(s->p, s->g);
5504 s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT;
5505 s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY;
5507 ssh->pkt_ctx |= SSH2_PKTCTX_DHGROUP;
5508 ssh->kex_ctx = dh_setup_group(ssh->kex);
5509 s->kex_init_value = SSH2_MSG_KEXDH_INIT;
5510 s->kex_reply_value = SSH2_MSG_KEXDH_REPLY;
5511 logeventf(ssh, "Using Diffie-Hellman with standard group \"%s\"",
5512 ssh->kex->groupname);
5515 logevent("Doing Diffie-Hellman key exchange");
5517 * Now generate and send e for Diffie-Hellman.
5519 set_busy_status(ssh->frontend, BUSY_CPU); /* this can take a while */
5520 s->e = dh_create_e(ssh->kex_ctx, s->nbits * 2);
5521 s->pktout = ssh2_pkt_init(s->kex_init_value);
5522 ssh2_pkt_addmp(s->pktout, s->e);
5523 ssh2_pkt_send_noqueue(ssh, s->pktout);
5525 set_busy_status(ssh->frontend, BUSY_WAITING); /* wait for server */
5527 if (pktin->type != s->kex_reply_value) {
5528 bombout(("expected key exchange reply packet from server"));
5531 set_busy_status(ssh->frontend, BUSY_CPU); /* cogitate */
5532 ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
5533 s->f = ssh2_pkt_getmp(pktin);
5535 bombout(("unable to parse key exchange reply packet"));
5538 ssh_pkt_getstring(pktin, &s->sigdata, &s->siglen);
5540 s->K = dh_find_K(ssh->kex_ctx, s->f);
5542 /* We assume everything from now on will be quick, and it might
5543 * involve user interaction. */
5544 set_busy_status(ssh->frontend, BUSY_NOT);
5546 hash_string(ssh->kex->hash, ssh->exhash, s->hostkeydata, s->hostkeylen);
5547 if (!ssh->kex->pdata) {
5548 hash_uint32(ssh->kex->hash, ssh->exhash, s->pbits);
5549 hash_mpint(ssh->kex->hash, ssh->exhash, s->p);
5550 hash_mpint(ssh->kex->hash, ssh->exhash, s->g);
5552 hash_mpint(ssh->kex->hash, ssh->exhash, s->e);
5553 hash_mpint(ssh->kex->hash, ssh->exhash, s->f);
5554 hash_mpint(ssh->kex->hash, ssh->exhash, s->K);
5555 assert(ssh->kex->hash->hlen <= sizeof(s->exchange_hash));
5556 ssh->kex->hash->final(ssh->exhash, s->exchange_hash);
5558 dh_cleanup(ssh->kex_ctx);
5559 ssh->kex_ctx = NULL;
5562 debug(("Exchange hash is:\n"));
5563 dmemdump(s->exchange_hash, ssh->kex->hash->hlen);
5566 s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
5568 !ssh->hostkey->verifysig(s->hkey, s->sigdata, s->siglen,
5569 (char *)s->exchange_hash,
5570 ssh->kex->hash->hlen)) {
5571 bombout(("Server's host key did not match the signature supplied"));
5576 * Authenticate remote host: verify host key. (We've already
5577 * checked the signature of the exchange hash.)
5579 s->keystr = ssh->hostkey->fmtkey(s->hkey);
5580 s->fingerprint = ssh->hostkey->fingerprint(s->hkey);
5581 ssh_set_frozen(ssh, 1);
5582 s->dlgret = verify_ssh_host_key(ssh->frontend,
5583 ssh->savedhost, ssh->savedport,
5584 ssh->hostkey->keytype, s->keystr,
5586 ssh_dialog_callback, ssh);
5587 if (s->dlgret < 0) {
5591 bombout(("Unexpected data from server while waiting"
5592 " for user host key response"));
5595 } while (pktin || inlen > 0);
5596 s->dlgret = ssh->user_response;
5598 ssh_set_frozen(ssh, 0);
5599 if (s->dlgret == 0) {
5600 ssh_disconnect(ssh, "User aborted at host key verification", NULL,
5604 if (!s->got_session_id) { /* don't bother logging this in rekeys */
5605 logevent("Host key fingerprint is:");
5606 logevent(s->fingerprint);
5608 sfree(s->fingerprint);
5610 ssh->hostkey->freekey(s->hkey);
5613 * The exchange hash from the very first key exchange is also
5614 * the session id, used in session key construction and
5617 if (!s->got_session_id) {
5618 assert(sizeof(s->exchange_hash) <= sizeof(ssh->v2_session_id));
5619 memcpy(ssh->v2_session_id, s->exchange_hash,
5620 sizeof(s->exchange_hash));
5621 ssh->v2_session_id_len = ssh->kex->hash->hlen;
5622 assert(ssh->v2_session_id_len <= sizeof(ssh->v2_session_id));
5623 s->got_session_id = TRUE;
5627 * Send SSH2_MSG_NEWKEYS.
5629 s->pktout = ssh2_pkt_init(SSH2_MSG_NEWKEYS);
5630 ssh2_pkt_send_noqueue(ssh, s->pktout);
5631 ssh->outgoing_data_size = 0; /* start counting from here */
5634 * We've sent client NEWKEYS, so create and initialise
5635 * client-to-server session keys.
5637 if (ssh->cs_cipher_ctx)
5638 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
5639 ssh->cscipher = s->cscipher_tobe;
5640 ssh->cs_cipher_ctx = ssh->cscipher->make_context();
5642 if (ssh->cs_mac_ctx)
5643 ssh->csmac->free_context(ssh->cs_mac_ctx);
5644 ssh->csmac = s->csmac_tobe;
5645 ssh->cs_mac_ctx = ssh->csmac->make_context();
5647 if (ssh->cs_comp_ctx)
5648 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
5649 ssh->cscomp = s->cscomp_tobe;
5650 ssh->cs_comp_ctx = ssh->cscomp->compress_init();
5653 * Set IVs on client-to-server keys. Here we use the exchange
5654 * hash from the _first_ key exchange.
5657 unsigned char keyspace[40];
5658 ssh2_mkkey(ssh,s->K,s->exchange_hash,'C',keyspace);
5659 ssh->cscipher->setkey(ssh->cs_cipher_ctx, keyspace);
5660 ssh2_mkkey(ssh,s->K,s->exchange_hash,'A',keyspace);
5661 ssh->cscipher->setiv(ssh->cs_cipher_ctx, keyspace);
5662 ssh2_mkkey(ssh,s->K,s->exchange_hash,'E',keyspace);
5663 ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace);
5666 logeventf(ssh, "Initialised %.200s client->server encryption",
5667 ssh->cscipher->text_name);
5668 logeventf(ssh, "Initialised %.200s client->server MAC algorithm",
5669 ssh->csmac->text_name);
5670 if (ssh->cscomp->text_name)
5671 logeventf(ssh, "Initialised %s compression",
5672 ssh->cscomp->text_name);
5675 * Now our end of the key exchange is complete, we can send all
5676 * our queued higher-layer packets.
5678 ssh->queueing = FALSE;
5679 ssh2_pkt_queuesend(ssh);
5682 * Expect SSH2_MSG_NEWKEYS from server.
5685 if (pktin->type != SSH2_MSG_NEWKEYS) {
5686 bombout(("expected new-keys packet from server"));
5689 ssh->incoming_data_size = 0; /* start counting from here */
5692 * We've seen server NEWKEYS, so create and initialise
5693 * server-to-client session keys.
5695 if (ssh->sc_cipher_ctx)
5696 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
5697 ssh->sccipher = s->sccipher_tobe;
5698 ssh->sc_cipher_ctx = ssh->sccipher->make_context();
5700 if (ssh->sc_mac_ctx)
5701 ssh->scmac->free_context(ssh->sc_mac_ctx);
5702 ssh->scmac = s->scmac_tobe;
5703 ssh->sc_mac_ctx = ssh->scmac->make_context();
5705 if (ssh->sc_comp_ctx)
5706 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
5707 ssh->sccomp = s->sccomp_tobe;
5708 ssh->sc_comp_ctx = ssh->sccomp->decompress_init();
5711 * Set IVs on server-to-client keys. Here we use the exchange
5712 * hash from the _first_ key exchange.
5715 unsigned char keyspace[40];
5716 ssh2_mkkey(ssh,s->K,s->exchange_hash,'D',keyspace);
5717 ssh->sccipher->setkey(ssh->sc_cipher_ctx, keyspace);
5718 ssh2_mkkey(ssh,s->K,s->exchange_hash,'B',keyspace);
5719 ssh->sccipher->setiv(ssh->sc_cipher_ctx, keyspace);
5720 ssh2_mkkey(ssh,s->K,s->exchange_hash,'F',keyspace);
5721 ssh->scmac->setkey(ssh->sc_mac_ctx, keyspace);
5723 logeventf(ssh, "Initialised %.200s server->client encryption",
5724 ssh->sccipher->text_name);
5725 logeventf(ssh, "Initialised %.200s server->client MAC algorithm",
5726 ssh->scmac->text_name);
5727 if (ssh->sccomp->text_name)
5728 logeventf(ssh, "Initialised %s decompression",
5729 ssh->sccomp->text_name);
5732 * Free key exchange data.
5736 if (!ssh->kex->pdata) {
5742 * Key exchange is over. Loop straight back round if we have a
5743 * deferred rekey reason.
5745 if (ssh->deferred_rekey_reason) {
5746 logevent(ssh->deferred_rekey_reason);
5748 ssh->deferred_rekey_reason = NULL;
5749 goto begin_key_exchange;
5753 * Otherwise, schedule a timer for our next rekey.
5755 ssh->kex_in_progress = FALSE;
5756 ssh->last_rekey = GETTICKCOUNT();
5757 if (ssh->cfg.ssh_rekey_time != 0)
5758 ssh->next_rekey = schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
5762 * If this is the first key exchange phase, we must pass the
5763 * SSH2_MSG_NEWKEYS packet to the next layer, not because it
5764 * wants to see it but because it will need time to initialise
5765 * itself before it sees an actual packet. In subsequent key
5766 * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because
5767 * it would only confuse the layer above.
5769 if (s->activated_authconn) {
5772 s->activated_authconn = TRUE;
5775 * Now we're encrypting. Begin returning 1 to the protocol main
5776 * function so that other things can run on top of the
5777 * transport. If we ever see a KEXINIT, we must go back to the
5780 * We _also_ go back to the start if we see pktin==NULL and
5781 * inlen==-1, because this is a special signal meaning
5782 * `initiate client-driven rekey', and `in' contains a message
5783 * giving the reason for the rekey.
5785 while (!((pktin && pktin->type == SSH2_MSG_KEXINIT) ||
5786 (!pktin && inlen == -1))) {
5791 logevent("Server initiated key re-exchange");
5794 * Special case: if the server bug is set that doesn't
5795 * allow rekeying, we give a different log message and
5796 * continue waiting. (If such a server _initiates_ a rekey,
5797 * we process it anyway!)
5799 if ((ssh->remote_bugs & BUG_SSH2_REKEY)) {
5800 logeventf(ssh, "Server bug prevents key re-exchange (%s)",
5802 /* Reset the counters, so that at least this message doesn't
5803 * hit the event log _too_ often. */
5804 ssh->outgoing_data_size = 0;
5805 ssh->incoming_data_size = 0;
5806 if (ssh->cfg.ssh_rekey_time != 0) {
5808 schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
5811 goto wait_for_rekey; /* this is utterly horrid */
5813 logeventf(ssh, "Initiating key re-exchange (%s)", (char *)in);
5816 goto begin_key_exchange;
5822 * Add data to an SSH-2 channel output buffer.
5824 static void ssh2_add_channel_data(struct ssh_channel *c, char *buf,
5827 bufchain_add(&c->v.v2.outbuffer, buf, len);
5831 * Attempt to send data on an SSH-2 channel.
5833 static int ssh2_try_send(struct ssh_channel *c)
5836 struct Packet *pktout;
5838 while (c->v.v2.remwindow > 0 && bufchain_size(&c->v.v2.outbuffer) > 0) {
5841 bufchain_prefix(&c->v.v2.outbuffer, &data, &len);
5842 if ((unsigned)len > c->v.v2.remwindow)
5843 len = c->v.v2.remwindow;
5844 if ((unsigned)len > c->v.v2.remmaxpkt)
5845 len = c->v.v2.remmaxpkt;
5846 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_DATA);
5847 ssh2_pkt_adduint32(pktout, c->remoteid);
5848 dont_log_data(ssh, pktout, PKTLOG_OMIT);
5849 ssh2_pkt_addstring_start(pktout);
5850 ssh2_pkt_addstring_data(pktout, data, len);
5851 end_log_omission(ssh, pktout);
5852 ssh2_pkt_send(ssh, pktout);
5853 bufchain_consume(&c->v.v2.outbuffer, len);
5854 c->v.v2.remwindow -= len;
5858 * After having sent as much data as we can, return the amount
5861 return bufchain_size(&c->v.v2.outbuffer);
5864 static void ssh2_try_send_and_unthrottle(struct ssh_channel *c)
5868 return; /* don't send on closing channels */
5869 bufsize = ssh2_try_send(c);
5872 case CHAN_MAINSESSION:
5873 /* stdin need not receive an unthrottle
5874 * notification since it will be polled */
5877 x11_unthrottle(c->u.x11.s);
5880 /* agent sockets are request/response and need no
5881 * buffer management */
5884 pfd_unthrottle(c->u.pfd.s);
5891 * Potentially enlarge the window on an SSH-2 channel.
5893 static void ssh2_set_window(struct ssh_channel *c, unsigned newwin)
5898 * Never send WINDOW_ADJUST for a channel that the remote side
5899 * already thinks it's closed; there's no point, since it won't
5900 * be sending any more data anyway.
5906 * Only send a WINDOW_ADJUST if there's significantly more window
5907 * available than the other end thinks there is. This saves us
5908 * sending a WINDOW_ADJUST for every character in a shell session.
5910 * "Significant" is arbitrarily defined as half the window size.
5912 if (newwin > c->v.v2.locwindow * 2) {
5913 struct Packet *pktout;
5915 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
5916 ssh2_pkt_adduint32(pktout, c->remoteid);
5917 ssh2_pkt_adduint32(pktout, newwin - c->v.v2.locwindow);
5918 ssh2_pkt_send(ssh, pktout);
5919 c->v.v2.locwindow = newwin;
5923 static void ssh2_msg_channel_window_adjust(Ssh ssh, struct Packet *pktin)
5925 unsigned i = ssh_pkt_getuint32(pktin);
5926 struct ssh_channel *c;
5927 c = find234(ssh->channels, &i, ssh_channelfind);
5928 if (c && !c->closes) {
5929 c->v.v2.remwindow += ssh_pkt_getuint32(pktin);
5930 ssh2_try_send_and_unthrottle(c);
5934 static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin)
5938 unsigned i = ssh_pkt_getuint32(pktin);
5939 struct ssh_channel *c;
5940 c = find234(ssh->channels, &i, ssh_channelfind);
5942 return; /* nonexistent channel */
5943 if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA &&
5944 ssh_pkt_getuint32(pktin) != SSH2_EXTENDED_DATA_STDERR)
5945 return; /* extended but not stderr */
5946 ssh_pkt_getstring(pktin, &data, &length);
5949 c->v.v2.locwindow -= length;
5951 case CHAN_MAINSESSION:
5953 from_backend(ssh->frontend, pktin->type ==
5954 SSH2_MSG_CHANNEL_EXTENDED_DATA,
5958 bufsize = x11_send(c->u.x11.s, data, length);
5961 bufsize = pfd_send(c->u.pfd.s, data, length);
5964 while (length > 0) {
5965 if (c->u.a.lensofar < 4) {
5966 unsigned int l = min(4 - c->u.a.lensofar, length);
5967 memcpy(c->u.a.msglen + c->u.a.lensofar,
5971 c->u.a.lensofar += l;
5973 if (c->u.a.lensofar == 4) {
5975 4 + GET_32BIT(c->u.a.msglen);
5976 c->u.a.message = snewn(c->u.a.totallen,
5978 memcpy(c->u.a.message, c->u.a.msglen, 4);
5980 if (c->u.a.lensofar >= 4 && length > 0) {
5982 min(c->u.a.totallen - c->u.a.lensofar,
5984 memcpy(c->u.a.message + c->u.a.lensofar,
5988 c->u.a.lensofar += l;
5990 if (c->u.a.lensofar == c->u.a.totallen) {
5993 if (agent_query(c->u.a.message,
5996 ssh_agentf_callback, c))
5997 ssh_agentf_callback(c, reply, replylen);
5998 sfree(c->u.a.message);
5999 c->u.a.lensofar = 0;
6006 * If we are not buffering too much data,
6007 * enlarge the window again at the remote side.
6009 if (bufsize < OUR_V2_WINSIZE)
6010 ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
6014 static void ssh2_msg_channel_eof(Ssh ssh, struct Packet *pktin)
6016 unsigned i = ssh_pkt_getuint32(pktin);
6017 struct ssh_channel *c;
6019 c = find234(ssh->channels, &i, ssh_channelfind);
6021 return; /* nonexistent channel */
6023 if (c->type == CHAN_X11) {
6025 * Remote EOF on an X11 channel means we should
6026 * wrap up and close the channel ourselves.
6028 x11_close(c->u.x11.s);
6030 } else if (c->type == CHAN_AGENT) {
6032 } else if (c->type == CHAN_SOCKDATA) {
6033 pfd_close(c->u.pfd.s);
6038 static void ssh2_msg_channel_close(Ssh ssh, struct Packet *pktin)
6040 unsigned i = ssh_pkt_getuint32(pktin);
6041 struct ssh_channel *c;
6042 struct Packet *pktout;
6044 c = find234(ssh->channels, &i, ssh_channelfind);
6045 if (!c || c->halfopen) {
6046 bombout(("Received CHANNEL_CLOSE for %s channel %d\n",
6047 c ? "half-open" : "nonexistent", i));
6050 /* Do pre-close processing on the channel. */
6052 case CHAN_MAINSESSION:
6053 ssh->mainchan = NULL;
6054 update_specials_menu(ssh->frontend);
6057 if (c->u.x11.s != NULL)
6058 x11_close(c->u.x11.s);
6065 if (c->u.pfd.s != NULL)
6066 pfd_close(c->u.pfd.s);
6070 if (c->closes == 0) {
6071 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6072 ssh2_pkt_adduint32(pktout, c->remoteid);
6073 ssh2_pkt_send(ssh, pktout);
6075 del234(ssh->channels, c);
6076 bufchain_clear(&c->v.v2.outbuffer);
6080 * See if that was the last channel left open.
6081 * (This is only our termination condition if we're
6082 * not running in -N mode.)
6084 if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) {
6086 * We used to send SSH_MSG_DISCONNECT here,
6087 * because I'd believed that _every_ conforming
6088 * SSH-2 connection had to end with a disconnect
6089 * being sent by at least one side; apparently
6090 * I was wrong and it's perfectly OK to
6091 * unceremoniously slam the connection shut
6092 * when you're done, and indeed OpenSSH feels
6093 * this is more polite than sending a
6094 * DISCONNECT. So now we don't.
6096 ssh_disconnect(ssh, "All channels closed", NULL, 0, TRUE);
6100 static void ssh2_msg_channel_open_confirmation(Ssh ssh, struct Packet *pktin)
6102 unsigned i = ssh_pkt_getuint32(pktin);
6103 struct ssh_channel *c;
6104 struct Packet *pktout;
6106 c = find234(ssh->channels, &i, ssh_channelfind);
6108 return; /* nonexistent channel */
6109 if (c->type != CHAN_SOCKDATA_DORMANT)
6110 return; /* dunno why they're confirming this */
6111 c->remoteid = ssh_pkt_getuint32(pktin);
6112 c->halfopen = FALSE;
6113 c->type = CHAN_SOCKDATA;
6114 c->v.v2.remwindow = ssh_pkt_getuint32(pktin);
6115 c->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
6117 pfd_confirm(c->u.pfd.s);
6120 * We have a pending close on this channel,
6121 * which we decided on before the server acked
6122 * the channel open. So now we know the
6123 * remoteid, we can close it again.
6125 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
6126 ssh2_pkt_adduint32(pktout, c->remoteid);
6127 ssh2_pkt_send(ssh, pktout);
6131 static void ssh2_msg_channel_open_failure(Ssh ssh, struct Packet *pktin)
6133 static const char *const reasons[] = {
6134 "<unknown reason code>",
6135 "Administratively prohibited",
6137 "Unknown channel type",
6138 "Resource shortage",
6140 unsigned i = ssh_pkt_getuint32(pktin);
6141 unsigned reason_code;
6142 char *reason_string;
6144 struct ssh_channel *c;
6145 c = find234(ssh->channels, &i, ssh_channelfind);
6147 return; /* nonexistent channel */
6148 if (c->type != CHAN_SOCKDATA_DORMANT)
6149 return; /* dunno why they're failing this */
6151 reason_code = ssh_pkt_getuint32(pktin);
6152 if (reason_code >= lenof(reasons))
6153 reason_code = 0; /* ensure reasons[reason_code] in range */
6154 ssh_pkt_getstring(pktin, &reason_string, &reason_length);
6155 logeventf(ssh, "Forwarded connection refused by server: %s [%.*s]",
6156 reasons[reason_code], reason_length, reason_string);
6158 pfd_close(c->u.pfd.s);
6160 del234(ssh->channels, c);
6164 static void ssh2_msg_channel_request(Ssh ssh, struct Packet *pktin)
6168 int typelen, want_reply;
6169 int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */
6170 struct ssh_channel *c;
6171 struct Packet *pktout;
6173 localid = ssh_pkt_getuint32(pktin);
6174 ssh_pkt_getstring(pktin, &type, &typelen);
6175 want_reply = ssh2_pkt_getbool(pktin);
6178 * First, check that the channel exists. Otherwise,
6179 * we can instantly disconnect with a rude message.
6181 c = find234(ssh->channels, &localid, ssh_channelfind);
6183 char *buf = dupprintf("Received channel request for nonexistent"
6184 " channel %d", localid);
6185 ssh_disconnect(ssh, NULL, buf, SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
6191 * Having got the channel number, we now look at
6192 * the request type string to see if it's something
6195 if (c == ssh->mainchan) {
6197 * We recognise "exit-status" and "exit-signal" on
6198 * the primary channel.
6200 if (typelen == 11 &&
6201 !memcmp(type, "exit-status", 11)) {
6203 ssh->exitcode = ssh_pkt_getuint32(pktin);
6204 logeventf(ssh, "Server sent command exit status %d",
6206 reply = SSH2_MSG_CHANNEL_SUCCESS;
6208 } else if (typelen == 11 &&
6209 !memcmp(type, "exit-signal", 11)) {
6211 int is_plausible = TRUE, is_int = FALSE;
6212 char *fmt_sig = "", *fmt_msg = "";
6214 int msglen = 0, core = FALSE;
6215 /* ICK: older versions of OpenSSH (e.g. 3.4p1)
6216 * provide an `int' for the signal, despite its
6217 * having been a `string' in the drafts since at
6218 * least 2001. (Fixed in session.c 1.147.) Try to
6219 * infer which we can safely parse it as. */
6221 unsigned char *p = pktin->body +
6223 long len = pktin->length - pktin->savedpos;
6224 unsigned long num = GET_32BIT(p); /* what is it? */
6225 /* If it's 0, it hardly matters; assume string */
6229 int maybe_int = FALSE, maybe_str = FALSE;
6230 #define CHECK_HYPOTHESIS(offset, result) \
6233 if (q >= 0 && q+4 <= len) { \
6234 q = q + 4 + GET_32BIT(p+q); \
6235 if (q >= 0 && q+4 <= len && \
6236 ((q = q + 4 + GET_32BIT(p+q))!= 0) && q == len) \
6240 CHECK_HYPOTHESIS(4+1, maybe_int);
6241 CHECK_HYPOTHESIS(4+num+1, maybe_str);
6242 #undef CHECK_HYPOTHESIS
6243 if (maybe_int && !maybe_str)
6245 else if (!maybe_int && maybe_str)
6248 /* Crikey. Either or neither. Panic. */
6249 is_plausible = FALSE;
6254 /* Old non-standard OpenSSH. */
6255 int signum = ssh_pkt_getuint32(pktin);
6256 fmt_sig = dupprintf(" %d", signum);
6258 /* As per the drafts. */
6261 ssh_pkt_getstring(pktin, &sig, &siglen);
6262 /* Signal name isn't supposed to be blank, but
6263 * let's cope gracefully if it is. */
6265 fmt_sig = dupprintf(" \"%.*s\"",
6269 core = ssh2_pkt_getbool(pktin);
6270 ssh_pkt_getstring(pktin, &msg, &msglen);
6272 fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg);
6274 /* ignore lang tag */
6275 } /* else don't attempt to parse */
6276 logeventf(ssh, "Server exited on signal%s%s%s",
6277 fmt_sig, core ? " (core dumped)" : "",
6279 if (*fmt_sig) sfree(fmt_sig);
6280 if (*fmt_msg) sfree(fmt_msg);
6281 reply = SSH2_MSG_CHANNEL_SUCCESS;
6286 * This is a channel request we don't know
6287 * about, so we now either ignore the request
6288 * or respond with CHANNEL_FAILURE, depending
6291 reply = SSH2_MSG_CHANNEL_FAILURE;
6294 pktout = ssh2_pkt_init(reply);
6295 ssh2_pkt_adduint32(pktout, c->remoteid);
6296 ssh2_pkt_send(ssh, pktout);
6300 static void ssh2_msg_global_request(Ssh ssh, struct Packet *pktin)
6303 int typelen, want_reply;
6304 struct Packet *pktout;
6306 ssh_pkt_getstring(pktin, &type, &typelen);
6307 want_reply = ssh2_pkt_getbool(pktin);
6310 * We currently don't support any global requests
6311 * at all, so we either ignore the request or
6312 * respond with REQUEST_FAILURE, depending on
6316 pktout = ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE);
6317 ssh2_pkt_send(ssh, pktout);
6321 static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin)
6329 struct ssh_channel *c;
6330 unsigned remid, winsize, pktsize;
6331 struct Packet *pktout;
6333 ssh_pkt_getstring(pktin, &type, &typelen);
6334 c = snew(struct ssh_channel);
6337 remid = ssh_pkt_getuint32(pktin);
6338 winsize = ssh_pkt_getuint32(pktin);
6339 pktsize = ssh_pkt_getuint32(pktin);
6341 if (typelen == 3 && !memcmp(type, "x11", 3)) {
6344 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
6345 addrstr = snewn(peeraddrlen+1, char);
6346 memcpy(addrstr, peeraddr, peeraddrlen);
6347 addrstr[peeraddrlen] = '\0';
6348 peerport = ssh_pkt_getuint32(pktin);
6350 logeventf(ssh, "Received X11 connect request from %s:%d",
6353 if (!ssh->X11_fwd_enabled)
6354 error = "X11 forwarding is not enabled";
6355 else if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c,
6356 ssh->x11auth, addrstr, peerport,
6357 &ssh->cfg) != NULL) {
6358 error = "Unable to open an X11 connection";
6360 logevent("Opening X11 forward connection succeeded");
6365 } else if (typelen == 15 &&
6366 !memcmp(type, "forwarded-tcpip", 15)) {
6367 struct ssh_rportfwd pf, *realpf;
6370 ssh_pkt_getstring(pktin, &dummy, &dummylen);/* skip address */
6371 pf.sport = ssh_pkt_getuint32(pktin);
6372 ssh_pkt_getstring(pktin, &peeraddr, &peeraddrlen);
6373 peerport = ssh_pkt_getuint32(pktin);
6374 realpf = find234(ssh->rportfwds, &pf, NULL);
6375 logeventf(ssh, "Received remote port %d open request "
6376 "from %s:%d", pf.sport, peeraddr, peerport);
6377 if (realpf == NULL) {
6378 error = "Remote port is not recognised";
6380 const char *e = pfd_newconnect(&c->u.pfd.s,
6384 realpf->pfrec->addressfamily);
6385 logeventf(ssh, "Attempting to forward remote port to "
6386 "%s:%d", realpf->dhost, realpf->dport);
6388 logeventf(ssh, "Port open failed: %s", e);
6389 error = "Port open failed";
6391 logevent("Forwarded port opened successfully");
6392 c->type = CHAN_SOCKDATA;
6395 } else if (typelen == 22 &&
6396 !memcmp(type, "auth-agent@openssh.com", 22)) {
6397 if (!ssh->agentfwd_enabled)
6398 error = "Agent forwarding is not enabled";
6400 c->type = CHAN_AGENT; /* identify channel type */
6401 c->u.a.lensofar = 0;
6404 error = "Unsupported channel type requested";
6407 c->remoteid = remid;
6408 c->halfopen = FALSE;
6410 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE);
6411 ssh2_pkt_adduint32(pktout, c->remoteid);
6412 ssh2_pkt_adduint32(pktout, SSH2_OPEN_CONNECT_FAILED);
6413 ssh2_pkt_addstring(pktout, error);
6414 ssh2_pkt_addstring(pktout, "en"); /* language tag */
6415 ssh2_pkt_send(ssh, pktout);
6416 logeventf(ssh, "Rejected channel open: %s", error);
6419 c->localid = alloc_channel_id(ssh);
6421 c->v.v2.locwindow = OUR_V2_WINSIZE;
6422 c->v.v2.remwindow = winsize;
6423 c->v.v2.remmaxpkt = pktsize;
6424 bufchain_init(&c->v.v2.outbuffer);
6425 add234(ssh->channels, c);
6426 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
6427 ssh2_pkt_adduint32(pktout, c->remoteid);
6428 ssh2_pkt_adduint32(pktout, c->localid);
6429 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);
6430 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
6431 ssh2_pkt_send(ssh, pktout);
6436 * Buffer banner messages for later display at some convenient point.
6438 static void ssh2_msg_userauth_banner(Ssh ssh, struct Packet *pktin)
6440 /* Arbitrary limit to prevent unbounded inflation of buffer */
6441 if (bufchain_size(&ssh->banner) <= 131072) {
6442 char *banner = NULL;
6444 ssh_pkt_getstring(pktin, &banner, &size);
6446 bufchain_add(&ssh->banner, banner, size);
6450 /* Helper function to deal with sending tty modes for "pty-req" */
6451 static void ssh2_send_ttymode(void *data, char *mode, char *val)
6453 struct Packet *pktout = (struct Packet *)data;
6455 unsigned int arg = 0;
6456 while (strcmp(mode, ssh_ttymodes[i].mode) != 0) i++;
6457 if (i == lenof(ssh_ttymodes)) return;
6458 switch (ssh_ttymodes[i].type) {
6460 arg = ssh_tty_parse_specchar(val);
6463 arg = ssh_tty_parse_boolean(val);
6466 ssh2_pkt_addbyte(pktout, ssh_ttymodes[i].opcode);
6467 ssh2_pkt_adduint32(pktout, arg);
6471 * Handle the SSH-2 userauth and connection layers.
6473 static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
6474 struct Packet *pktin)
6476 struct do_ssh2_authconn_state {
6479 AUTH_TYPE_PUBLICKEY,
6480 AUTH_TYPE_PUBLICKEY_OFFER_LOUD,
6481 AUTH_TYPE_PUBLICKEY_OFFER_QUIET,
6483 AUTH_TYPE_KEYBOARD_INTERACTIVE,
6484 AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
6486 int done_service_req;
6487 int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter;
6488 int tried_pubkey_config, tried_agent;
6489 int kbd_inter_refused;
6491 prompts_t *cur_prompt;
6496 void *publickey_blob;
6497 int publickey_bloblen;
6498 int publickey_encrypted;
6499 char *publickey_algorithm;
6500 char *publickey_comment;
6501 unsigned char request[5], *response, *p;
6505 char *pkblob, *alg, *commentp;
6506 int pklen, alglen, commentlen;
6507 int siglen, retlen, len;
6508 char *q, *agentreq, *ret;
6510 int num_env, env_left, env_ok;
6511 struct Packet *pktout;
6513 crState(do_ssh2_authconn_state);
6515 crBegin(ssh->do_ssh2_authconn_crstate);
6517 s->done_service_req = FALSE;
6518 s->we_are_in = FALSE;
6519 if (!ssh->cfg.ssh_no_userauth) {
6521 * Request userauth protocol, and await a response to it.
6523 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
6524 ssh2_pkt_addstring(s->pktout, "ssh-userauth");
6525 ssh2_pkt_send(ssh, s->pktout);
6526 crWaitUntilV(pktin);
6527 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT)
6528 s->done_service_req = TRUE;
6530 if (!s->done_service_req) {
6532 * Request connection protocol directly, without authentication.
6534 s->pktout = ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
6535 ssh2_pkt_addstring(s->pktout, "ssh-connection");
6536 ssh2_pkt_send(ssh, s->pktout);
6537 crWaitUntilV(pktin);
6538 if (pktin->type == SSH2_MSG_SERVICE_ACCEPT) {
6539 s->we_are_in = TRUE; /* no auth required */
6541 bombout(("Server refused service request"));
6547 * Misc one-time setup for authentication.
6549 s->publickey_blob = NULL;
6550 if (!s->we_are_in) {
6553 * Load the public half of any configured public key file
6556 if (!filename_is_null(ssh->cfg.keyfile)) {
6558 logeventf(ssh, "Reading private key file \"%.150s\"",
6559 filename_to_str(&ssh->cfg.keyfile));
6560 keytype = key_type(&ssh->cfg.keyfile);
6561 if (keytype == SSH_KEYTYPE_SSH2) {
6564 ssh2_userkey_loadpub(&ssh->cfg.keyfile,
6565 &s->publickey_algorithm,
6566 &s->publickey_bloblen,
6567 &s->publickey_comment, &error);
6568 if (s->publickey_blob) {
6569 s->publickey_encrypted =
6570 ssh2_userkey_encrypted(&ssh->cfg.keyfile, NULL);
6573 logeventf(ssh, "Unable to load private key (%s)",
6575 msgbuf = dupprintf("Unable to load private key file "
6576 "\"%.150s\" (%s)\r\n",
6577 filename_to_str(&ssh->cfg.keyfile),
6579 c_write_str(ssh, msgbuf);
6584 logeventf(ssh, "Unable to use this key file (%s)",
6585 key_type_to_str(keytype));
6586 msgbuf = dupprintf("Unable to use key file \"%.150s\""
6588 filename_to_str(&ssh->cfg.keyfile),
6589 key_type_to_str(keytype));
6590 c_write_str(ssh, msgbuf);
6592 s->publickey_blob = NULL;
6599 * We repeat this whole loop, including the username prompt,
6600 * until we manage a successful authentication. If the user
6601 * types the wrong _password_, they can be sent back to the
6602 * beginning to try another username, if this is configured on.
6603 * (If they specify a username in the config, they are never
6604 * asked, even if they do give a wrong password.)
6606 * I think this best serves the needs of
6608 * - the people who have no configuration, no keys, and just
6609 * want to try repeated (username,password) pairs until they
6610 * type both correctly
6612 * - people who have keys and configuration but occasionally
6613 * need to fall back to passwords
6615 * - people with a key held in Pageant, who might not have
6616 * logged in to a particular machine before; so they want to
6617 * type a username, and then _either_ their key will be
6618 * accepted, _or_ they will type a password. If they mistype
6619 * the username they will want to be able to get back and
6622 s->username[0] = '\0';
6623 s->got_username = FALSE;
6624 bufchain_init(&ssh->banner);
6625 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] =
6626 ssh2_msg_userauth_banner;
6627 while (!s->we_are_in) {
6631 if (s->got_username && !ssh->cfg.change_username) {
6633 * We got a username last time round this loop, and
6634 * with change_username turned off we don't try to get
6637 } else if (!*ssh->cfg.username) {
6638 int ret; /* need not be kept over crReturn */
6639 s->cur_prompt = new_prompts(ssh->frontend);
6640 s->cur_prompt->to_server = TRUE;
6641 s->cur_prompt->name = dupstr("SSH login name");
6642 add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
6643 lenof(s->username));
6644 ret = get_userpass_input(s->cur_prompt, NULL, 0);
6647 crWaitUntilV(!pktin);
6648 ret = get_userpass_input(s->cur_prompt, in, inlen);
6653 * get_userpass_input() failed to get a username.
6656 free_prompts(s->cur_prompt);
6657 ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
6660 memcpy(s->username, s->cur_prompt->prompts[0]->result,
6661 lenof(s->username));
6662 free_prompts(s->cur_prompt);
6665 strncpy(s->username, ssh->cfg.username, sizeof(s->username));
6666 s->username[sizeof(s->username)-1] = '\0';
6667 if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
6668 stuff = dupprintf("Using username \"%s\".\r\n", s->username);
6669 c_write_str(ssh, stuff);
6673 s->got_username = TRUE;
6676 * Send an authentication request using method "none": (a)
6677 * just in case it succeeds, and (b) so that we know what
6678 * authentication methods we can usefully try next.
6680 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
6682 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
6683 ssh2_pkt_addstring(s->pktout, s->username);
6684 ssh2_pkt_addstring(s->pktout, "ssh-connection");/* service requested */
6685 ssh2_pkt_addstring(s->pktout, "none"); /* method */
6686 ssh2_pkt_send(ssh, s->pktout);
6687 s->type = AUTH_TYPE_NONE;
6689 s->we_are_in = FALSE;
6691 s->tried_pubkey_config = FALSE;
6692 s->tried_agent = FALSE;
6693 s->kbd_inter_refused = FALSE;
6697 * Wait for the result of the last authentication request.
6700 crWaitUntilV(pktin);
6702 * Now is a convenient point to spew any banner material
6703 * that we've accumulated. (This should ensure that when
6704 * we exit the auth loop, we haven't any left to deal
6708 int size = bufchain_size(&ssh->banner);
6710 * Don't show the banner if we're operating in
6711 * non-verbose non-interactive mode. (It's probably
6712 * a script, which means nobody will read the
6713 * banner _anyway_, and moreover the printing of
6714 * the banner will screw up processing on the
6715 * output of (say) plink.)
6717 if (size && (flags & (FLAG_VERBOSE | FLAG_INTERACTIVE))) {
6718 char *banner = snewn(size, char);
6719 bufchain_fetch(&ssh->banner, banner, size);
6720 c_write_untrusted(ssh, banner, size);
6723 bufchain_clear(&ssh->banner);
6725 if (pktin->type == SSH2_MSG_USERAUTH_SUCCESS) {
6726 logevent("Access granted");
6727 s->we_are_in = TRUE;
6731 if (pktin->type != SSH2_MSG_USERAUTH_FAILURE) {
6732 bombout(("Strange packet received during authentication: "
6733 "type %d", pktin->type));
6740 * OK, we're now sitting on a USERAUTH_FAILURE message, so
6741 * we can look at the string in it and know what we can
6742 * helpfully try next.
6744 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE) {
6747 ssh_pkt_getstring(pktin, &methods, &methlen);
6748 if (!ssh2_pkt_getbool(pktin)) {
6750 * We have received an unequivocal Access
6751 * Denied. This can translate to a variety of
6754 * - if we'd just tried "none" authentication,
6755 * it's not worth printing anything at all
6757 * - if we'd just tried a public key _offer_,
6758 * the message should be "Server refused our
6759 * key" (or no message at all if the key
6760 * came from Pageant)
6762 * - if we'd just tried anything else, the
6763 * message really should be "Access denied".
6765 * Additionally, if we'd just tried password
6766 * authentication, we should break out of this
6767 * whole loop so as to go back to the username
6768 * prompt (iff we're configured to allow
6769 * username change attempts).
6771 if (s->type == AUTH_TYPE_NONE) {
6773 } else if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD ||
6774 s->type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) {
6775 if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD)
6776 c_write_str(ssh, "Server refused our key\r\n");
6777 logevent("Server refused public key");
6778 } else if (s->type==AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) {
6779 /* server declined keyboard-interactive; ignore */
6781 c_write_str(ssh, "Access denied\r\n");
6782 logevent("Access denied");
6783 if (s->type == AUTH_TYPE_PASSWORD &&
6784 ssh->cfg.change_username) {
6785 /* XXX perhaps we should allow
6786 * keyboard-interactive to do this too? */
6787 s->we_are_in = FALSE;
6792 c_write_str(ssh, "Further authentication required\r\n");
6793 logevent("Further authentication required");
6797 in_commasep_string("publickey", methods, methlen);
6799 in_commasep_string("password", methods, methlen);
6800 s->can_keyb_inter = ssh->cfg.try_ki_auth &&
6801 in_commasep_string("keyboard-interactive", methods, methlen);
6804 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
6806 if (s->can_pubkey && agent_exists() && !s->tried_agent) {
6809 * Attempt public-key authentication using Pageant.
6814 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
6815 ssh->pkt_ctx |= SSH2_PKTCTX_PUBLICKEY;
6817 s->tried_agent = TRUE;
6819 logevent("Pageant is running. Requesting keys.");
6821 /* Request the keys held by the agent. */
6822 PUT_32BIT(s->request, 1);
6823 s->request[4] = SSH2_AGENTC_REQUEST_IDENTITIES;
6824 if (!agent_query(s->request, 5, &r, &s->responselen,
6825 ssh_agent_callback, ssh)) {
6829 bombout(("Unexpected data from server while"
6830 " waiting for agent response"));
6833 } while (pktin || inlen > 0);
6834 r = ssh->agent_response;
6835 s->responselen = ssh->agent_response_len;
6837 s->response = (unsigned char *) r;
6838 if (s->response && s->responselen >= 5 &&
6839 s->response[4] == SSH2_AGENT_IDENTITIES_ANSWER) {
6840 s->p = s->response + 5;
6841 s->nkeys = GET_32BIT(s->p);
6843 logeventf(ssh, "Pageant has %d SSH-2 keys", s->nkeys);
6844 for (s->keyi = 0; s->keyi < s->nkeys; s->keyi++) {
6847 logeventf(ssh, "Trying Pageant key #%d", s->keyi);
6848 s->pklen = GET_32BIT(s->p);
6850 if (s->publickey_blob &&
6851 s->pklen == s->publickey_bloblen &&
6852 !memcmp(s->p, s->publickey_blob,
6853 s->publickey_bloblen)) {
6854 logevent("This key matches configured key file");
6855 s->tried_pubkey_config = 1;
6857 s->pkblob = (char *)s->p;
6859 s->alglen = GET_32BIT(s->pkblob);
6860 s->alg = s->pkblob + 4;
6861 s->commentlen = GET_32BIT(s->p);
6863 s->commentp = (char *)s->p;
6864 s->p += s->commentlen;
6865 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
6866 ssh2_pkt_addstring(s->pktout, s->username);
6867 ssh2_pkt_addstring(s->pktout, "ssh-connection"); /* service requested */
6868 ssh2_pkt_addstring(s->pktout, "publickey"); /* method */
6869 ssh2_pkt_addbool(s->pktout, FALSE); /* no signature included */
6870 ssh2_pkt_addstring_start(s->pktout);
6871 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
6872 ssh2_pkt_addstring_start(s->pktout);
6873 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
6874 ssh2_pkt_send(ssh, s->pktout);
6876 crWaitUntilV(pktin);
6877 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
6878 logevent("Key refused");
6882 if (flags & FLAG_VERBOSE) {
6883 c_write_str(ssh, "Authenticating with "
6885 c_write(ssh, s->commentp, s->commentlen);
6886 c_write_str(ssh, "\" from agent\r\n");
6890 * Server is willing to accept the key.
6891 * Construct a SIGN_REQUEST.
6893 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
6894 ssh2_pkt_addstring(s->pktout, s->username);
6895 ssh2_pkt_addstring(s->pktout, "ssh-connection"); /* service requested */
6896 ssh2_pkt_addstring(s->pktout, "publickey"); /* method */
6897 ssh2_pkt_addbool(s->pktout, TRUE);
6898 ssh2_pkt_addstring_start(s->pktout);
6899 ssh2_pkt_addstring_data(s->pktout, s->alg, s->alglen);
6900 ssh2_pkt_addstring_start(s->pktout);
6901 ssh2_pkt_addstring_data(s->pktout, s->pkblob, s->pklen);
6903 s->siglen = s->pktout->length - 5 + 4 +
6904 ssh->v2_session_id_len;
6905 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
6907 s->len = 1; /* message type */
6908 s->len += 4 + s->pklen; /* key blob */
6909 s->len += 4 + s->siglen; /* data to sign */
6910 s->len += 4; /* flags */
6911 s->agentreq = snewn(4 + s->len, char);
6912 PUT_32BIT(s->agentreq, s->len);
6913 s->q = s->agentreq + 4;
6914 *s->q++ = SSH2_AGENTC_SIGN_REQUEST;
6915 PUT_32BIT(s->q, s->pklen);
6917 memcpy(s->q, s->pkblob, s->pklen);
6919 PUT_32BIT(s->q, s->siglen);
6921 /* Now the data to be signed... */
6922 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
6923 PUT_32BIT(s->q, ssh->v2_session_id_len);
6926 memcpy(s->q, ssh->v2_session_id,
6927 ssh->v2_session_id_len);
6928 s->q += ssh->v2_session_id_len;
6929 memcpy(s->q, s->pktout->data + 5,
6930 s->pktout->length - 5);
6931 s->q += s->pktout->length - 5;
6932 /* And finally the (zero) flags word. */
6934 if (!agent_query(s->agentreq, s->len + 4,
6936 ssh_agent_callback, ssh)) {
6940 bombout(("Unexpected data from server"
6941 " while waiting for agent"
6945 } while (pktin || inlen > 0);
6946 vret = ssh->agent_response;
6947 s->retlen = ssh->agent_response_len;
6952 if (s->ret[4] == SSH2_AGENT_SIGN_RESPONSE) {
6953 logevent("Sending Pageant's response");
6954 ssh2_add_sigblob(ssh, s->pktout,
6955 s->pkblob, s->pklen,
6957 GET_32BIT(s->ret + 5));
6958 ssh2_pkt_send(ssh, s->pktout);
6963 ("Pageant failed to answer challenge");
6973 } else if (s->can_pubkey && s->publickey_blob &&
6974 !s->tried_pubkey_config) {
6976 struct ssh2_userkey *key; /* not live over crReturn */
6977 char *passphrase; /* not live over crReturn */
6979 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
6980 ssh->pkt_ctx |= SSH2_PKTCTX_PUBLICKEY;
6982 s->tried_pubkey_config = TRUE;
6985 * Try the public key supplied in the configuration.
6987 * First, offer the public blob to see if the server is
6988 * willing to accept it.
6990 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
6991 ssh2_pkt_addstring(s->pktout, s->username);
6992 ssh2_pkt_addstring(s->pktout, "ssh-connection");
6993 /* service requested */
6994 ssh2_pkt_addstring(s->pktout, "publickey"); /* method */
6995 ssh2_pkt_addbool(s->pktout, FALSE);
6996 /* no signature included */
6997 ssh2_pkt_addstring(s->pktout, s->publickey_algorithm);
6998 ssh2_pkt_addstring_start(s->pktout);
6999 ssh2_pkt_addstring_data(s->pktout,
7000 (char *)s->publickey_blob,
7001 s->publickey_bloblen);
7002 ssh2_pkt_send(ssh, s->pktout);
7003 logevent("Offered public key");
7005 crWaitUntilV(pktin);
7006 if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
7007 /* Key refused. Give up. */
7008 s->gotit = TRUE; /* reconsider message next loop */
7009 s->type = AUTH_TYPE_PUBLICKEY_OFFER_LOUD;
7010 continue; /* process this new message */
7012 logevent("Offer of public key accepted");
7015 * Actually attempt a serious authentication using
7018 if (flags & FLAG_VERBOSE) {
7019 c_write_str(ssh, "Authenticating with public key \"");
7020 c_write_str(ssh, s->publickey_comment);
7021 c_write_str(ssh, "\"\r\n");
7025 const char *error; /* not live over crReturn */
7026 if (s->publickey_encrypted) {
7028 * Get a passphrase from the user.
7030 int ret; /* need not be kept over crReturn */
7031 s->cur_prompt = new_prompts(ssh->frontend);
7032 s->cur_prompt->to_server = FALSE;
7033 s->cur_prompt->name = dupstr("SSH key passphrase");
7034 add_prompt(s->cur_prompt,
7035 dupprintf("Passphrase for key \"%.100s\": ",
7036 s->publickey_comment),
7037 FALSE, SSH_MAX_PASSWORD_LEN);
7038 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7041 crWaitUntilV(!pktin);
7042 ret = get_userpass_input(s->cur_prompt,
7047 /* Failed to get a passphrase. Terminate. */
7048 free_prompts(s->cur_prompt);
7049 ssh_disconnect(ssh, NULL,
7050 "Unable to authenticate",
7051 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7056 dupstr(s->cur_prompt->prompts[0]->result);
7057 free_prompts(s->cur_prompt);
7059 passphrase = NULL; /* no passphrase needed */
7063 * Try decrypting the key.
7065 key = ssh2_load_userkey(&ssh->cfg.keyfile, passphrase,
7068 /* burn the evidence */
7069 memset(passphrase, 0, strlen(passphrase));
7072 if (key == SSH2_WRONG_PASSPHRASE || key == NULL) {
7074 (key == SSH2_WRONG_PASSPHRASE)) {
7075 c_write_str(ssh, "Wrong passphrase\r\n");
7077 /* and loop again */
7079 c_write_str(ssh, "Unable to load private key (");
7080 c_write_str(ssh, error);
7081 c_write_str(ssh, ")\r\n");
7083 break; /* try something else */
7089 unsigned char *pkblob, *sigblob, *sigdata;
7090 int pkblob_len, sigblob_len, sigdata_len;
7094 * We have loaded the private key and the server
7095 * has announced that it's willing to accept it.
7096 * Hallelujah. Generate a signature and send it.
7098 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7099 ssh2_pkt_addstring(s->pktout, s->username);
7100 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7101 /* service requested */
7102 ssh2_pkt_addstring(s->pktout, "publickey");
7104 ssh2_pkt_addbool(s->pktout, TRUE);
7105 /* signature follows */
7106 ssh2_pkt_addstring(s->pktout, key->alg->name);
7107 pkblob = key->alg->public_blob(key->data,
7109 ssh2_pkt_addstring_start(s->pktout);
7110 ssh2_pkt_addstring_data(s->pktout, (char *)pkblob,
7114 * The data to be signed is:
7118 * followed by everything so far placed in the
7121 sigdata_len = s->pktout->length - 5 + 4 +
7122 ssh->v2_session_id_len;
7123 if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)
7125 sigdata = snewn(sigdata_len, unsigned char);
7127 if (!(ssh->remote_bugs & BUG_SSH2_PK_SESSIONID)) {
7128 PUT_32BIT(sigdata+p, ssh->v2_session_id_len);
7131 memcpy(sigdata+p, ssh->v2_session_id,
7132 ssh->v2_session_id_len);
7133 p += ssh->v2_session_id_len;
7134 memcpy(sigdata+p, s->pktout->data + 5,
7135 s->pktout->length - 5);
7136 p += s->pktout->length - 5;
7137 assert(p == sigdata_len);
7138 sigblob = key->alg->sign(key->data, (char *)sigdata,
7139 sigdata_len, &sigblob_len);
7140 ssh2_add_sigblob(ssh, s->pktout, pkblob, pkblob_len,
7141 sigblob, sigblob_len);
7146 ssh2_pkt_send(ssh, s->pktout);
7147 s->type = AUTH_TYPE_PUBLICKEY;
7148 key->alg->freekey(key->data);
7151 } else if (s->can_keyb_inter && !s->kbd_inter_refused) {
7154 * Keyboard-interactive authentication.
7156 char *name, *inst, *lang;
7157 int name_len, inst_len, lang_len;
7160 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
7162 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7163 ssh->pkt_ctx |= SSH2_PKTCTX_KBDINTER;
7165 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7166 ssh2_pkt_addstring(s->pktout, s->username);
7167 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7168 /* service requested */
7169 ssh2_pkt_addstring(s->pktout, "keyboard-interactive");
7171 ssh2_pkt_addstring(s->pktout, ""); /* lang */
7172 ssh2_pkt_addstring(s->pktout, ""); /* submethods */
7173 ssh2_pkt_send(ssh, s->pktout);
7175 crWaitUntilV(pktin);
7176 if (pktin->type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
7177 /* Server is not willing to do keyboard-interactive
7178 * at all. Give up on it entirely. */
7180 if (pktin->type == SSH2_MSG_USERAUTH_FAILURE)
7181 logevent("Keyboard-interactive authentication refused");
7182 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET;
7183 s->kbd_inter_refused = TRUE; /* don't try it again */
7188 * We've got a fresh USERAUTH_INFO_REQUEST.
7189 * Get the preamble and start building a prompt.
7191 ssh_pkt_getstring(pktin, &name, &name_len);
7192 ssh_pkt_getstring(pktin, &inst, &inst_len);
7193 ssh_pkt_getstring(pktin, &lang, &lang_len);
7194 s->cur_prompt = new_prompts(ssh->frontend);
7195 s->cur_prompt->to_server = TRUE;
7197 /* FIXME: better prefix to distinguish from
7199 s->cur_prompt->name = dupprintf("SSH server: %.*s",
7201 s->cur_prompt->name_reqd = TRUE;
7203 s->cur_prompt->name = dupstr("SSH server authentication");
7204 s->cur_prompt->name_reqd = FALSE;
7206 s->cur_prompt->instruction =
7207 dupprintf("Using keyboard-interactive authentication.%s%.*s",
7208 inst_len ? "\n" : "", inst_len, inst);
7209 s->cur_prompt->instr_reqd = TRUE;
7212 * Get the prompts from the packet.
7214 s->num_prompts = ssh_pkt_getuint32(pktin);
7215 for (i = 0; i < s->num_prompts; i++) {
7219 static char noprompt[] =
7220 "<server failed to send prompt>: ";
7222 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
7223 echo = ssh2_pkt_getbool(pktin);
7226 prompt_len = lenof(noprompt)-1;
7228 add_prompt(s->cur_prompt,
7229 dupprintf("%.*s", prompt_len, prompt),
7230 echo, SSH_MAX_PASSWORD_LEN);
7234 * Get the user's responses.
7236 if (s->num_prompts) {
7237 int ret; /* not live over crReturn */
7238 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7241 crWaitUntilV(!pktin);
7242 ret = get_userpass_input(s->cur_prompt, in, inlen);
7247 * Failed to get responses. Terminate.
7249 free_prompts(s->cur_prompt);
7250 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7251 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7258 * Send the responses to the server.
7260 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_INFO_RESPONSE);
7261 s->pktout->forcepad = 256;
7262 ssh2_pkt_adduint32(s->pktout, s->num_prompts);
7263 for (i=0; i < s->num_prompts; i++) {
7264 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7265 ssh2_pkt_addstring(s->pktout,
7266 s->cur_prompt->prompts[i]->result);
7267 end_log_omission(ssh, s->pktout);
7269 ssh2_pkt_send(ssh, s->pktout);
7270 s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
7272 } else if (s->can_passwd) {
7275 * Plain old password authentication.
7277 int ret; /* not live over crReturn */
7278 int changereq_first_time; /* not live over crReturn */
7280 ssh->pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
7281 ssh->pkt_ctx |= SSH2_PKTCTX_PASSWORD;
7283 s->cur_prompt = new_prompts(ssh->frontend);
7284 s->cur_prompt->to_server = TRUE;
7285 s->cur_prompt->name = dupstr("SSH password");
7286 add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
7289 FALSE, SSH_MAX_PASSWORD_LEN);
7291 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7294 crWaitUntilV(!pktin);
7295 ret = get_userpass_input(s->cur_prompt, in, inlen);
7300 * Failed to get responses. Terminate.
7302 free_prompts(s->cur_prompt);
7303 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7304 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7309 * Squirrel away the password. (We may need it later if
7310 * asked to change it.)
7312 s->password = dupstr(s->cur_prompt->prompts[0]->result);
7313 free_prompts(s->cur_prompt);
7316 * Send the password packet.
7318 * We pad out the password packet to 256 bytes to make
7319 * it harder for an attacker to find the length of the
7322 * Anyone using a password longer than 256 bytes
7323 * probably doesn't have much to worry about from
7324 * people who find out how long their password is!
7326 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7327 s->pktout->forcepad = 256;
7328 ssh2_pkt_addstring(s->pktout, s->username);
7329 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7330 /* service requested */
7331 ssh2_pkt_addstring(s->pktout, "password");
7332 ssh2_pkt_addbool(s->pktout, FALSE);
7333 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7334 ssh2_pkt_addstring(s->pktout, s->password);
7335 end_log_omission(ssh, s->pktout);
7336 ssh2_pkt_send(ssh, s->pktout);
7337 logevent("Sent password");
7338 s->type = AUTH_TYPE_PASSWORD;
7341 * Wait for next packet, in case it's a password change
7344 crWaitUntilV(pktin);
7345 changereq_first_time = TRUE;
7347 while (pktin->type == SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ) {
7350 * We're being asked for a new password
7351 * (perhaps not for the first time).
7352 * Loop until the server accepts it.
7355 int got_new = FALSE; /* not live over crReturn */
7356 char *prompt; /* not live over crReturn */
7357 int prompt_len; /* not live over crReturn */
7361 if (changereq_first_time)
7362 msg = "Server requested password change";
7364 msg = "Server rejected new password";
7366 c_write_str(ssh, msg);
7367 c_write_str(ssh, "\r\n");
7370 ssh_pkt_getstring(pktin, &prompt, &prompt_len);
7372 s->cur_prompt = new_prompts(ssh->frontend);
7373 s->cur_prompt->to_server = TRUE;
7374 s->cur_prompt->name = dupstr("New SSH password");
7375 s->cur_prompt->instruction =
7376 dupprintf("%.*s", prompt_len, prompt);
7377 s->cur_prompt->instr_reqd = TRUE;
7378 add_prompt(s->cur_prompt, dupstr("Enter new password: "),
7379 FALSE, SSH_MAX_PASSWORD_LEN);
7380 add_prompt(s->cur_prompt, dupstr("Confirm new password: "),
7381 FALSE, SSH_MAX_PASSWORD_LEN);
7384 * Loop until the user manages to enter the same
7389 ret = get_userpass_input(s->cur_prompt, NULL, 0);
7392 crWaitUntilV(!pktin);
7393 ret = get_userpass_input(s->cur_prompt, in, inlen);
7398 * Failed to get responses. Terminate.
7400 /* burn the evidence */
7401 free_prompts(s->cur_prompt);
7402 memset(s->password, 0, strlen(s->password));
7404 ssh_disconnect(ssh, NULL, "Unable to authenticate",
7405 SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
7411 * Check the two passwords match.
7413 got_new = (strcmp(s->cur_prompt->prompts[0]->result,
7414 s->cur_prompt->prompts[1]->result)
7417 /* They don't. Silly user. */
7418 c_write_str(ssh, "Passwords do not match\r\n");
7423 * Send the new password (along with the old one).
7424 * (see above for padding rationale)
7426 s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
7427 s->pktout->forcepad = 256;
7428 ssh2_pkt_addstring(s->pktout, s->username);
7429 ssh2_pkt_addstring(s->pktout, "ssh-connection");
7430 /* service requested */
7431 ssh2_pkt_addstring(s->pktout, "password");
7432 ssh2_pkt_addbool(s->pktout, TRUE);
7433 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7434 ssh2_pkt_addstring(s->pktout, s->password);
7435 ssh2_pkt_addstring(s->pktout,
7436 s->cur_prompt->prompts[0]->result);
7437 free_prompts(s->cur_prompt);
7438 end_log_omission(ssh, s->pktout);
7439 ssh2_pkt_send(ssh, s->pktout);
7440 logevent("Sent new password");
7443 * Now see what the server has to say about it.
7444 * (If it's CHANGEREQ again, it's not happy with the
7447 crWaitUntilV(pktin);
7448 changereq_first_time = FALSE;
7453 * We need to reexamine the current pktin at the top
7454 * of the loop. Either:
7455 * - we weren't asked to change password at all, in
7456 * which case it's a SUCCESS or FAILURE with the
7458 * - we sent a new password, and the server was
7459 * either OK with it (SUCCESS or FAILURE w/partial
7460 * success) or unhappy with the _old_ password
7461 * (FAILURE w/o partial success)
7462 * In any of these cases, we go back to the top of
7463 * the loop and start again.
7468 * We don't need the old password any more, in any
7469 * case. Burn the evidence.
7471 memset(s->password, 0, strlen(s->password));
7476 ssh_disconnect(ssh, NULL,
7477 "No supported authentication methods available",
7478 SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
7486 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
7488 /* Clear up various bits and pieces from authentication. */
7489 if (s->publickey_blob) {
7490 sfree(s->publickey_blob);
7491 sfree(s->publickey_comment);
7495 * Now the connection protocol has started, one way or another.
7498 ssh->channels = newtree234(ssh_channelcmp);
7501 * Set up handlers for some connection protocol messages, so we
7502 * don't have to handle them repeatedly in this coroutine.
7504 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] =
7505 ssh2_msg_channel_window_adjust;
7506 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] =
7507 ssh2_msg_global_request;
7510 * Create the main session channel.
7512 if (!ssh->cfg.ssh_no_shell) {
7513 ssh->mainchan = snew(struct ssh_channel);
7514 ssh->mainchan->ssh = ssh;
7515 ssh->mainchan->localid = alloc_channel_id(ssh);
7516 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
7517 ssh2_pkt_addstring(s->pktout, "session");
7518 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
7519 ssh->mainchan->v.v2.locwindow = OUR_V2_WINSIZE;
7520 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
7521 ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT); /* our max pkt size */
7522 ssh2_pkt_send(ssh, s->pktout);
7523 crWaitUntilV(pktin);
7524 if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
7525 bombout(("Server refused to open a session"));
7527 /* FIXME: error data comes back in FAILURE packet */
7529 if (ssh_pkt_getuint32(pktin) != ssh->mainchan->localid) {
7530 bombout(("Server's channel confirmation cited wrong channel"));
7533 ssh->mainchan->remoteid = ssh_pkt_getuint32(pktin);
7534 ssh->mainchan->halfopen = FALSE;
7535 ssh->mainchan->type = CHAN_MAINSESSION;
7536 ssh->mainchan->closes = 0;
7537 ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(pktin);
7538 ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(pktin);
7539 bufchain_init(&ssh->mainchan->v.v2.outbuffer);
7540 add234(ssh->channels, ssh->mainchan);
7541 update_specials_menu(ssh->frontend);
7542 logevent("Opened channel for session");
7544 ssh->mainchan = NULL;
7547 * Now we have a channel, make dispatch table entries for
7548 * general channel-based messages.
7550 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] =
7551 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] =
7552 ssh2_msg_channel_data;
7553 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_channel_eof;
7554 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_channel_close;
7555 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] =
7556 ssh2_msg_channel_open_confirmation;
7557 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] =
7558 ssh2_msg_channel_open_failure;
7559 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] =
7560 ssh2_msg_channel_request;
7561 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] =
7562 ssh2_msg_channel_open;
7565 * Potentially enable X11 forwarding.
7567 if (ssh->mainchan && ssh->cfg.x11_forward) {
7568 char proto[20], data[64];
7569 logevent("Requesting X11 forwarding");
7570 ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
7571 data, sizeof(data), ssh->cfg.x11_auth);
7572 x11_get_real_auth(ssh->x11auth, ssh->cfg.x11_display);
7573 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
7574 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
7575 ssh2_pkt_addstring(s->pktout, "x11-req");
7576 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
7577 ssh2_pkt_addbool(s->pktout, 0); /* many connections */
7578 ssh2_pkt_addstring(s->pktout, proto);
7580 * Note that while we blank the X authentication data here, we don't
7581 * take any special action to blank the start of an X11 channel,
7582 * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
7583 * without having session blanking enabled is likely to leak your
7584 * cookie into the log.
7586 dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
7587 ssh2_pkt_addstring(s->pktout, data);
7588 end_log_omission(ssh, s->pktout);
7589 ssh2_pkt_adduint32(s->pktout, x11_get_screen_number(ssh->cfg.x11_display));
7590 ssh2_pkt_send(ssh, s->pktout);
7592 crWaitUntilV(pktin);
7594 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
7595 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
7596 bombout(("Unexpected response to X11 forwarding request:"
7597 " packet type %d", pktin->type));
7600 logevent("X11 forwarding refused");
7602 logevent("X11 forwarding enabled");
7603 ssh->X11_fwd_enabled = TRUE;
7608 * Enable port forwardings.
7610 ssh_setup_portfwd(ssh, &ssh->cfg);
7613 * Potentially enable agent forwarding.
7615 if (ssh->mainchan && ssh->cfg.agentfwd && agent_exists()) {
7616 logevent("Requesting OpenSSH-style agent forwarding");
7617 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
7618 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
7619 ssh2_pkt_addstring(s->pktout, "auth-agent-req@openssh.com");
7620 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
7621 ssh2_pkt_send(ssh, s->pktout);
7623 crWaitUntilV(pktin);
7625 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
7626 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
7627 bombout(("Unexpected response to agent forwarding request:"
7628 " packet type %d", pktin->type));
7631 logevent("Agent forwarding refused");
7633 logevent("Agent forwarding enabled");
7634 ssh->agentfwd_enabled = TRUE;
7639 * Now allocate a pty for the session.
7641 if (ssh->mainchan && !ssh->cfg.nopty) {
7642 /* Unpick the terminal-speed string. */
7643 /* XXX perhaps we should allow no speeds to be sent. */
7644 ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
7645 sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
7646 /* Build the pty request. */
7647 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
7648 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
7649 ssh2_pkt_addstring(s->pktout, "pty-req");
7650 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
7651 ssh2_pkt_addstring(s->pktout, ssh->cfg.termtype);
7652 ssh2_pkt_adduint32(s->pktout, ssh->term_width);
7653 ssh2_pkt_adduint32(s->pktout, ssh->term_height);
7654 ssh2_pkt_adduint32(s->pktout, 0); /* pixel width */
7655 ssh2_pkt_adduint32(s->pktout, 0); /* pixel height */
7656 ssh2_pkt_addstring_start(s->pktout);
7657 parse_ttymodes(ssh, ssh->cfg.ttymodes,
7658 ssh2_send_ttymode, (void *)s->pktout);
7659 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_ISPEED);
7660 ssh2_pkt_adduint32(s->pktout, ssh->ispeed);
7661 ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_OSPEED);
7662 ssh2_pkt_adduint32(s->pktout, ssh->ospeed);
7663 ssh2_pkt_addstring_data(s->pktout, "\0", 1); /* TTY_OP_END */
7664 ssh2_pkt_send(ssh, s->pktout);
7665 ssh->state = SSH_STATE_INTERMED;
7667 crWaitUntilV(pktin);
7669 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
7670 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
7671 bombout(("Unexpected response to pty request:"
7672 " packet type %d", pktin->type));
7675 c_write_str(ssh, "Server refused to allocate pty\r\n");
7676 ssh->editing = ssh->echoing = 1;
7678 logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
7679 ssh->ospeed, ssh->ispeed);
7682 ssh->editing = ssh->echoing = 1;
7686 * Send environment variables.
7688 * Simplest thing here is to send all the requests at once, and
7689 * then wait for a whole bunch of successes or failures.
7691 if (ssh->mainchan && *ssh->cfg.environmt) {
7692 char *e = ssh->cfg.environmt;
7693 char *var, *varend, *val;
7699 while (*e && *e != '\t') e++;
7701 if (*e == '\t') e++;
7706 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
7707 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
7708 ssh2_pkt_addstring(s->pktout, "env");
7709 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
7710 ssh2_pkt_addstring_start(s->pktout);
7711 ssh2_pkt_addstring_data(s->pktout, var, varend-var);
7712 ssh2_pkt_addstring(s->pktout, val);
7713 ssh2_pkt_send(ssh, s->pktout);
7718 logeventf(ssh, "Sent %d environment variables", s->num_env);
7721 s->env_left = s->num_env;
7723 while (s->env_left > 0) {
7724 crWaitUntilV(pktin);
7726 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
7727 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
7728 bombout(("Unexpected response to environment request:"
7729 " packet type %d", pktin->type));
7739 if (s->env_ok == s->num_env) {
7740 logevent("All environment variables successfully set");
7741 } else if (s->env_ok == 0) {
7742 logevent("All environment variables refused");
7743 c_write_str(ssh, "Server refused to set environment variables\r\n");
7745 logeventf(ssh, "%d environment variables refused",
7746 s->num_env - s->env_ok);
7747 c_write_str(ssh, "Server refused to set all environment variables\r\n");
7752 * Start a shell or a remote command. We may have to attempt
7753 * this twice if the config data has provided a second choice
7756 if (ssh->mainchan) while (1) {
7760 if (ssh->fallback_cmd) {
7761 subsys = ssh->cfg.ssh_subsys2;
7762 cmd = ssh->cfg.remote_cmd_ptr2;
7764 subsys = ssh->cfg.ssh_subsys;
7765 cmd = ssh->cfg.remote_cmd_ptr;
7766 if (!cmd) cmd = ssh->cfg.remote_cmd;
7769 s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
7770 ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
7772 ssh2_pkt_addstring(s->pktout, "subsystem");
7773 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
7774 ssh2_pkt_addstring(s->pktout, cmd);
7776 ssh2_pkt_addstring(s->pktout, "exec");
7777 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
7778 ssh2_pkt_addstring(s->pktout, cmd);
7780 ssh2_pkt_addstring(s->pktout, "shell");
7781 ssh2_pkt_addbool(s->pktout, 1); /* want reply */
7783 ssh2_pkt_send(ssh, s->pktout);
7785 crWaitUntilV(pktin);
7787 if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
7788 if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
7789 bombout(("Unexpected response to shell/command request:"
7790 " packet type %d", pktin->type));
7794 * We failed to start the command. If this is the
7795 * fallback command, we really are finished; if it's
7796 * not, and if the fallback command exists, try falling
7797 * back to it before complaining.
7799 if (!ssh->fallback_cmd && ssh->cfg.remote_cmd_ptr2 != NULL) {
7800 logevent("Primary command failed; attempting fallback");
7801 ssh->fallback_cmd = TRUE;
7804 bombout(("Server refused to start a shell/command"));
7807 logevent("Started a shell/command");
7812 ssh->state = SSH_STATE_SESSION;
7813 if (ssh->size_needed)
7814 ssh_size(ssh, ssh->term_width, ssh->term_height);
7815 if (ssh->eof_needed)
7816 ssh_special(ssh, TS_EOF);
7822 ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
7827 s->try_send = FALSE;
7831 * _All_ the connection-layer packets we expect to
7832 * receive are now handled by the dispatch table.
7833 * Anything that reaches here must be bogus.
7836 bombout(("Strange packet received: type %d", pktin->type));
7838 } else if (ssh->mainchan) {
7840 * We have spare data. Add it to the channel buffer.
7842 ssh2_add_channel_data(ssh->mainchan, (char *)in, inlen);
7847 struct ssh_channel *c;
7849 * Try to send data on all channels if we can.
7851 for (i = 0; NULL != (c = index234(ssh->channels, i)); i++)
7852 ssh2_try_send_and_unthrottle(c);
7860 * Handlers for SSH-2 messages that might arrive at any moment.
7862 static void ssh2_msg_disconnect(Ssh ssh, struct Packet *pktin)
7864 /* log reason code in disconnect message */
7866 int nowlen, reason, msglen;
7868 reason = ssh_pkt_getuint32(pktin);
7869 ssh_pkt_getstring(pktin, &msg, &msglen);
7871 if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
7872 buf = dupprintf("Received disconnect message (%s)",
7873 ssh2_disconnect_reasons[reason]);
7875 buf = dupprintf("Received disconnect message (unknown"
7876 " type %d)", reason);
7880 buf = dupprintf("Disconnection message text: %n%.*s",
7881 &nowlen, msglen, msg);
7883 bombout(("Server sent disconnect message\ntype %d (%s):\n\"%s\"",
7885 (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ?
7886 ssh2_disconnect_reasons[reason] : "unknown",
7891 static void ssh2_msg_debug(Ssh ssh, struct Packet *pktin)
7893 /* log the debug message */
7898 /* XXX maybe we should actually take notice of this */
7899 always_display = ssh2_pkt_getbool(pktin);
7900 ssh_pkt_getstring(pktin, &msg, &msglen);
7902 logeventf(ssh, "Remote debug message: %.*s", msglen, msg);
7905 static void ssh2_msg_something_unimplemented(Ssh ssh, struct Packet *pktin)
7907 struct Packet *pktout;
7908 pktout = ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED);
7909 ssh2_pkt_adduint32(pktout, pktin->sequence);
7911 * UNIMPLEMENTED messages MUST appear in the same order as the
7912 * messages they respond to. Hence, never queue them.
7914 ssh2_pkt_send_noqueue(ssh, pktout);
7918 * Handle the top-level SSH-2 protocol.
7920 static void ssh2_protocol_setup(Ssh ssh)
7925 * Most messages cause SSH2_MSG_UNIMPLEMENTED.
7927 for (i = 0; i < 256; i++)
7928 ssh->packet_dispatch[i] = ssh2_msg_something_unimplemented;
7931 * Any message we actually understand, we set to NULL so that
7932 * the coroutines will get it.
7934 ssh->packet_dispatch[SSH2_MSG_UNIMPLEMENTED] = NULL;
7935 ssh->packet_dispatch[SSH2_MSG_SERVICE_REQUEST] = NULL;
7936 ssh->packet_dispatch[SSH2_MSG_SERVICE_ACCEPT] = NULL;
7937 ssh->packet_dispatch[SSH2_MSG_KEXINIT] = NULL;
7938 ssh->packet_dispatch[SSH2_MSG_NEWKEYS] = NULL;
7939 ssh->packet_dispatch[SSH2_MSG_KEXDH_INIT] = NULL;
7940 ssh->packet_dispatch[SSH2_MSG_KEXDH_REPLY] = NULL;
7941 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REQUEST] = NULL; duplicate case value */
7942 /* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_GROUP] = NULL; duplicate case value */
7943 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_INIT] = NULL;
7944 ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REPLY] = NULL;
7945 ssh->packet_dispatch[SSH2_MSG_USERAUTH_REQUEST] = NULL;
7946 ssh->packet_dispatch[SSH2_MSG_USERAUTH_FAILURE] = NULL;
7947 ssh->packet_dispatch[SSH2_MSG_USERAUTH_SUCCESS] = NULL;
7948 ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
7949 ssh->packet_dispatch[SSH2_MSG_USERAUTH_PK_OK] = NULL;
7950 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ] = NULL; duplicate case value */
7951 /* ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_REQUEST] = NULL; duplicate case value */
7952 ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_RESPONSE] = NULL;
7953 ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = NULL;
7954 ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = NULL;
7955 ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = NULL;
7956 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = NULL;
7957 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = NULL;
7958 ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = NULL;
7959 ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = NULL;
7960 ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = NULL;
7961 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = NULL;
7962 ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = NULL;
7963 ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = NULL;
7964 ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = NULL;
7965 ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = NULL;
7966 ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = NULL;
7969 * These special message types we install handlers for.
7971 ssh->packet_dispatch[SSH2_MSG_DISCONNECT] = ssh2_msg_disconnect;
7972 ssh->packet_dispatch[SSH2_MSG_IGNORE] = ssh_msg_ignore; /* shared with SSH-1 */
7973 ssh->packet_dispatch[SSH2_MSG_DEBUG] = ssh2_msg_debug;
7976 static void ssh2_timer(void *ctx, long now)
7980 if (ssh->state == SSH_STATE_CLOSED)
7983 if (!ssh->kex_in_progress && ssh->cfg.ssh_rekey_time != 0 &&
7984 now - ssh->next_rekey >= 0) {
7985 do_ssh2_transport(ssh, "timeout", -1, NULL);
7989 static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
7990 struct Packet *pktin)
7992 unsigned char *in = (unsigned char *)vin;
7993 if (ssh->state == SSH_STATE_CLOSED)
7997 ssh->incoming_data_size += pktin->encrypted_len;
7998 if (!ssh->kex_in_progress &&
7999 ssh->max_data_size != 0 &&
8000 ssh->incoming_data_size > ssh->max_data_size)
8001 do_ssh2_transport(ssh, "too much data received", -1, NULL);
8004 if (pktin && ssh->packet_dispatch[pktin->type]) {
8005 ssh->packet_dispatch[pktin->type](ssh, pktin);
8009 if (!ssh->protocol_initial_phase_done ||
8010 (pktin && pktin->type >= 20 && pktin->type < 50)) {
8011 if (do_ssh2_transport(ssh, in, inlen, pktin) &&
8012 !ssh->protocol_initial_phase_done) {
8013 ssh->protocol_initial_phase_done = TRUE;
8015 * Allow authconn to initialise itself.
8017 do_ssh2_authconn(ssh, NULL, 0, NULL);
8020 do_ssh2_authconn(ssh, in, inlen, pktin);
8025 * Called to set up the connection.
8027 * Returns an error message, or NULL on success.
8029 static const char *ssh_init(void *frontend_handle, void **backend_handle,
8031 char *host, int port, char **realhost, int nodelay,
8037 ssh = snew(struct ssh_tag);
8038 ssh->cfg = *cfg; /* STRUCTURE COPY */
8039 ssh->version = 0; /* when not ready yet */
8042 ssh->v1_cipher_ctx = NULL;
8043 ssh->crcda_ctx = NULL;
8044 ssh->cscipher = NULL;
8045 ssh->cs_cipher_ctx = NULL;
8046 ssh->sccipher = NULL;
8047 ssh->sc_cipher_ctx = NULL;
8049 ssh->cs_mac_ctx = NULL;
8051 ssh->sc_mac_ctx = NULL;
8053 ssh->cs_comp_ctx = NULL;
8055 ssh->sc_comp_ctx = NULL;
8057 ssh->kex_ctx = NULL;
8058 ssh->hostkey = NULL;
8060 ssh->close_expected = FALSE;
8061 ssh->clean_exit = FALSE;
8062 ssh->state = SSH_STATE_PREPACKET;
8063 ssh->size_needed = FALSE;
8064 ssh->eof_needed = FALSE;
8067 ssh->deferred_send_data = NULL;
8068 ssh->deferred_len = 0;
8069 ssh->deferred_size = 0;
8070 ssh->fallback_cmd = 0;
8072 ssh->x11auth = NULL;
8073 ssh->v1_compressing = FALSE;
8074 ssh->v2_outgoing_sequence = 0;
8075 ssh->ssh1_rdpkt_crstate = 0;
8076 ssh->ssh2_rdpkt_crstate = 0;
8077 ssh->do_ssh_init_crstate = 0;
8078 ssh->ssh_gotdata_crstate = 0;
8079 ssh->do_ssh1_connection_crstate = 0;
8080 ssh->do_ssh1_login_crstate = 0;
8081 ssh->do_ssh2_transport_crstate = 0;
8082 ssh->do_ssh2_authconn_crstate = 0;
8083 ssh->do_ssh_init_state = NULL;
8084 ssh->do_ssh1_login_state = NULL;
8085 ssh->do_ssh2_transport_state = NULL;
8086 ssh->do_ssh2_authconn_state = NULL;
8089 ssh->mainchan = NULL;
8090 ssh->throttled_all = 0;
8091 ssh->v1_stdout_throttling = 0;
8093 ssh->queuelen = ssh->queuesize = 0;
8094 ssh->queueing = FALSE;
8095 ssh->qhead = ssh->qtail = NULL;
8096 ssh->deferred_rekey_reason = NULL;
8097 bufchain_init(&ssh->queued_incoming_data);
8098 ssh->frozen = FALSE;
8100 *backend_handle = ssh;
8103 if (crypto_startup() == 0)
8104 return "Microsoft high encryption pack not installed!";
8107 ssh->frontend = frontend_handle;
8108 ssh->term_width = ssh->cfg.width;
8109 ssh->term_height = ssh->cfg.height;
8111 ssh->channels = NULL;
8112 ssh->rportfwds = NULL;
8113 ssh->portfwds = NULL;
8118 ssh->v1_throttle_count = 0;
8119 ssh->overall_bufsize = 0;
8120 ssh->fallback_cmd = 0;
8122 ssh->protocol = NULL;
8124 ssh->protocol_initial_phase_done = FALSE;
8128 ssh->incoming_data_size = ssh->outgoing_data_size =
8129 ssh->deferred_data_size = 0L;
8130 ssh->max_data_size = parse_blocksize(ssh->cfg.ssh_rekey_data);
8131 ssh->kex_in_progress = FALSE;
8133 p = connect_to_host(ssh, host, port, realhost, nodelay, keepalive);
8142 static void ssh_free(void *handle)
8144 Ssh ssh = (Ssh) handle;
8145 struct ssh_channel *c;
8146 struct ssh_rportfwd *pf;
8148 if (ssh->v1_cipher_ctx)
8149 ssh->cipher->free_context(ssh->v1_cipher_ctx);
8150 if (ssh->cs_cipher_ctx)
8151 ssh->cscipher->free_context(ssh->cs_cipher_ctx);
8152 if (ssh->sc_cipher_ctx)
8153 ssh->sccipher->free_context(ssh->sc_cipher_ctx);
8154 if (ssh->cs_mac_ctx)
8155 ssh->csmac->free_context(ssh->cs_mac_ctx);
8156 if (ssh->sc_mac_ctx)
8157 ssh->scmac->free_context(ssh->sc_mac_ctx);
8158 if (ssh->cs_comp_ctx) {
8160 ssh->cscomp->compress_cleanup(ssh->cs_comp_ctx);
8162 zlib_compress_cleanup(ssh->cs_comp_ctx);
8164 if (ssh->sc_comp_ctx) {
8166 ssh->sccomp->decompress_cleanup(ssh->sc_comp_ctx);
8168 zlib_decompress_cleanup(ssh->sc_comp_ctx);
8171 dh_cleanup(ssh->kex_ctx);
8172 sfree(ssh->savedhost);
8174 while (ssh->queuelen-- > 0)
8175 ssh_free_packet(ssh->queue[ssh->queuelen]);
8178 while (ssh->qhead) {
8179 struct queued_handler *qh = ssh->qhead;
8180 ssh->qhead = qh->next;
8183 ssh->qhead = ssh->qtail = NULL;
8185 if (ssh->channels) {
8186 while ((c = delpos234(ssh->channels, 0)) != NULL) {
8189 if (c->u.x11.s != NULL)
8190 x11_close(c->u.x11.s);
8193 if (c->u.pfd.s != NULL)
8194 pfd_close(c->u.pfd.s);
8199 freetree234(ssh->channels);
8200 ssh->channels = NULL;
8203 if (ssh->rportfwds) {
8204 while ((pf = delpos234(ssh->rportfwds, 0)) != NULL)
8206 freetree234(ssh->rportfwds);
8207 ssh->rportfwds = NULL;
8209 sfree(ssh->deferred_send_data);
8211 x11_free_auth(ssh->x11auth);
8212 sfree(ssh->do_ssh_init_state);
8213 sfree(ssh->do_ssh1_login_state);
8214 sfree(ssh->do_ssh2_transport_state);
8215 sfree(ssh->do_ssh2_authconn_state);
8218 if (ssh->crcda_ctx) {
8219 crcda_free_context(ssh->crcda_ctx);
8220 ssh->crcda_ctx = NULL;
8223 ssh_do_close(ssh, TRUE);
8224 expire_timer_context(ssh);
8226 pinger_free(ssh->pinger);
8227 bufchain_clear(&ssh->queued_incoming_data);
8234 * Reconfigure the SSH backend.
8236 static void ssh_reconfig(void *handle, Config *cfg)
8238 Ssh ssh = (Ssh) handle;
8239 char *rekeying = NULL, rekey_mandatory = FALSE;
8240 unsigned long old_max_data_size;
8242 pinger_reconfig(ssh->pinger, &ssh->cfg, cfg);
8244 ssh_setup_portfwd(ssh, cfg);
8246 if (ssh->cfg.ssh_rekey_time != cfg->ssh_rekey_time &&
8247 cfg->ssh_rekey_time != 0) {
8248 long new_next = ssh->last_rekey + cfg->ssh_rekey_time*60*TICKSPERSEC;
8249 long now = GETTICKCOUNT();
8251 if (new_next - now < 0) {
8252 rekeying = "timeout shortened";
8254 ssh->next_rekey = schedule_timer(new_next - now, ssh2_timer, ssh);
8258 old_max_data_size = ssh->max_data_size;
8259 ssh->max_data_size = parse_blocksize(cfg->ssh_rekey_data);
8260 if (old_max_data_size != ssh->max_data_size &&
8261 ssh->max_data_size != 0) {
8262 if (ssh->outgoing_data_size > ssh->max_data_size ||
8263 ssh->incoming_data_size > ssh->max_data_size)
8264 rekeying = "data limit lowered";
8267 if (ssh->cfg.compression != cfg->compression) {
8268 rekeying = "compression setting changed";
8269 rekey_mandatory = TRUE;
8272 if (ssh->cfg.ssh2_des_cbc != cfg->ssh2_des_cbc ||
8273 memcmp(ssh->cfg.ssh_cipherlist, cfg->ssh_cipherlist,
8274 sizeof(ssh->cfg.ssh_cipherlist))) {
8275 rekeying = "cipher settings changed";
8276 rekey_mandatory = TRUE;
8279 ssh->cfg = *cfg; /* STRUCTURE COPY */
8282 if (!ssh->kex_in_progress) {
8283 do_ssh2_transport(ssh, rekeying, -1, NULL);
8284 } else if (rekey_mandatory) {
8285 ssh->deferred_rekey_reason = rekeying;
8291 * Called to send data down the SSH connection.
8293 static int ssh_send(void *handle, char *buf, int len)
8295 Ssh ssh = (Ssh) handle;
8297 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
8300 ssh->protocol(ssh, (unsigned char *)buf, len, 0);
8302 return ssh_sendbuffer(ssh);
8306 * Called to query the current amount of buffered stdin data.
8308 static int ssh_sendbuffer(void *handle)
8310 Ssh ssh = (Ssh) handle;
8313 if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL)
8317 * If the SSH socket itself has backed up, add the total backup
8318 * size on that to any individual buffer on the stdin channel.
8321 if (ssh->throttled_all)
8322 override_value = ssh->overall_bufsize;
8324 if (ssh->version == 1) {
8325 return override_value;
8326 } else if (ssh->version == 2) {
8327 if (!ssh->mainchan || ssh->mainchan->closes > 0)
8328 return override_value;
8330 return (override_value +
8331 bufchain_size(&ssh->mainchan->v.v2.outbuffer));
8338 * Called to set the size of the window from SSH's POV.
8340 static void ssh_size(void *handle, int width, int height)
8342 Ssh ssh = (Ssh) handle;
8343 struct Packet *pktout;
8345 ssh->term_width = width;
8346 ssh->term_height = height;
8348 switch (ssh->state) {
8349 case SSH_STATE_BEFORE_SIZE:
8350 case SSH_STATE_PREPACKET:
8351 case SSH_STATE_CLOSED:
8352 break; /* do nothing */
8353 case SSH_STATE_INTERMED:
8354 ssh->size_needed = TRUE; /* buffer for later */
8356 case SSH_STATE_SESSION:
8357 if (!ssh->cfg.nopty) {
8358 if (ssh->version == 1) {
8359 send_packet(ssh, SSH1_CMSG_WINDOW_SIZE,
8360 PKT_INT, ssh->term_height,
8361 PKT_INT, ssh->term_width,
8362 PKT_INT, 0, PKT_INT, 0, PKT_END);
8363 } else if (ssh->mainchan) {
8364 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8365 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8366 ssh2_pkt_addstring(pktout, "window-change");
8367 ssh2_pkt_addbool(pktout, 0);
8368 ssh2_pkt_adduint32(pktout, ssh->term_width);
8369 ssh2_pkt_adduint32(pktout, ssh->term_height);
8370 ssh2_pkt_adduint32(pktout, 0);
8371 ssh2_pkt_adduint32(pktout, 0);
8372 ssh2_pkt_send(ssh, pktout);
8380 * Return a list of the special codes that make sense in this
8383 static const struct telnet_special *ssh_get_specials(void *handle)
8385 static const struct telnet_special ssh1_ignore_special[] = {
8386 {"IGNORE message", TS_NOP}
8388 static const struct telnet_special ssh2_transport_specials[] = {
8389 {"IGNORE message", TS_NOP},
8390 {"Repeat key exchange", TS_REKEY},
8392 static const struct telnet_special ssh2_session_specials[] = {
8395 /* These are the signal names defined by draft-ietf-secsh-connect-23.
8396 * They include all the ISO C signals, but are a subset of the POSIX
8397 * required signals. */
8398 {"SIGINT (Interrupt)", TS_SIGINT},
8399 {"SIGTERM (Terminate)", TS_SIGTERM},
8400 {"SIGKILL (Kill)", TS_SIGKILL},
8401 {"SIGQUIT (Quit)", TS_SIGQUIT},
8402 {"SIGHUP (Hangup)", TS_SIGHUP},
8403 {"More signals", TS_SUBMENU},
8404 {"SIGABRT", TS_SIGABRT}, {"SIGALRM", TS_SIGALRM},
8405 {"SIGFPE", TS_SIGFPE}, {"SIGILL", TS_SIGILL},
8406 {"SIGPIPE", TS_SIGPIPE}, {"SIGSEGV", TS_SIGSEGV},
8407 {"SIGUSR1", TS_SIGUSR1}, {"SIGUSR2", TS_SIGUSR2},
8410 static const struct telnet_special specials_end[] = {
8413 /* XXX review this length for any changes: */
8414 static struct telnet_special ssh_specials[lenof(ssh2_transport_specials) +
8415 lenof(ssh2_session_specials) +
8416 lenof(specials_end)];
8417 Ssh ssh = (Ssh) handle;
8419 #define ADD_SPECIALS(name) \
8421 assert((i + lenof(name)) <= lenof(ssh_specials)); \
8422 memcpy(&ssh_specials[i], name, sizeof name); \
8426 if (ssh->version == 1) {
8427 /* Don't bother offering IGNORE if we've decided the remote
8428 * won't cope with it, since we wouldn't bother sending it if
8430 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
8431 ADD_SPECIALS(ssh1_ignore_special);
8432 } else if (ssh->version == 2) {
8433 ADD_SPECIALS(ssh2_transport_specials);
8435 ADD_SPECIALS(ssh2_session_specials);
8436 } /* else we're not ready yet */
8439 ADD_SPECIALS(specials_end);
8440 return ssh_specials;
8448 * Send special codes. TS_EOF is useful for `plink', so you
8449 * can send an EOF and collect resulting output (e.g. `plink
8452 static void ssh_special(void *handle, Telnet_Special code)
8454 Ssh ssh = (Ssh) handle;
8455 struct Packet *pktout;
8457 if (code == TS_EOF) {
8458 if (ssh->state != SSH_STATE_SESSION) {
8460 * Buffer the EOF in case we are pre-SESSION, so we can
8461 * send it as soon as we reach SESSION.
8464 ssh->eof_needed = TRUE;
8467 if (ssh->version == 1) {
8468 send_packet(ssh, SSH1_CMSG_EOF, PKT_END);
8469 } else if (ssh->mainchan) {
8470 struct Packet *pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_EOF);
8471 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8472 ssh2_pkt_send(ssh, pktout);
8473 ssh->send_ok = 0; /* now stop trying to read from stdin */
8475 logevent("Sent EOF message");
8476 } else if (code == TS_PING || code == TS_NOP) {
8477 if (ssh->state == SSH_STATE_CLOSED
8478 || ssh->state == SSH_STATE_PREPACKET) return;
8479 if (ssh->version == 1) {
8480 if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
8481 send_packet(ssh, SSH1_MSG_IGNORE, PKT_STR, "", PKT_END);
8483 pktout = ssh2_pkt_init(SSH2_MSG_IGNORE);
8484 ssh2_pkt_addstring_start(pktout);
8485 ssh2_pkt_send_noqueue(ssh, pktout);
8487 } else if (code == TS_REKEY) {
8488 if (!ssh->kex_in_progress && ssh->version == 2) {
8489 do_ssh2_transport(ssh, "at user request", -1, NULL);
8491 } else if (code == TS_BRK) {
8492 if (ssh->state == SSH_STATE_CLOSED
8493 || ssh->state == SSH_STATE_PREPACKET) return;
8494 if (ssh->version == 1) {
8495 logevent("Unable to send BREAK signal in SSH-1");
8496 } else if (ssh->mainchan) {
8497 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8498 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8499 ssh2_pkt_addstring(pktout, "break");
8500 ssh2_pkt_addbool(pktout, 0);
8501 ssh2_pkt_adduint32(pktout, 0); /* default break length */
8502 ssh2_pkt_send(ssh, pktout);
8505 /* Is is a POSIX signal? */
8506 char *signame = NULL;
8507 if (code == TS_SIGABRT) signame = "ABRT";
8508 if (code == TS_SIGALRM) signame = "ALRM";
8509 if (code == TS_SIGFPE) signame = "FPE";
8510 if (code == TS_SIGHUP) signame = "HUP";
8511 if (code == TS_SIGILL) signame = "ILL";
8512 if (code == TS_SIGINT) signame = "INT";
8513 if (code == TS_SIGKILL) signame = "KILL";
8514 if (code == TS_SIGPIPE) signame = "PIPE";
8515 if (code == TS_SIGQUIT) signame = "QUIT";
8516 if (code == TS_SIGSEGV) signame = "SEGV";
8517 if (code == TS_SIGTERM) signame = "TERM";
8518 if (code == TS_SIGUSR1) signame = "USR1";
8519 if (code == TS_SIGUSR2) signame = "USR2";
8520 /* The SSH-2 protocol does in principle support arbitrary named
8521 * signals, including signame@domain, but we don't support those. */
8523 /* It's a signal. */
8524 if (ssh->version == 2 && ssh->mainchan) {
8525 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
8526 ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
8527 ssh2_pkt_addstring(pktout, "signal");
8528 ssh2_pkt_addbool(pktout, 0);
8529 ssh2_pkt_addstring(pktout, signame);
8530 ssh2_pkt_send(ssh, pktout);
8531 logeventf(ssh, "Sent signal SIG%s", signame);
8534 /* Never heard of it. Do nothing */
8539 void *new_sock_channel(void *handle, Socket s)
8541 Ssh ssh = (Ssh) handle;
8542 struct ssh_channel *c;
8543 c = snew(struct ssh_channel);
8548 c->localid = alloc_channel_id(ssh);
8550 c->type = CHAN_SOCKDATA_DORMANT;/* identify channel type */
8552 bufchain_init(&c->v.v2.outbuffer);
8553 add234(ssh->channels, c);
8559 * This is called when stdout/stderr (the entity to which
8560 * from_backend sends data) manages to clear some backlog.
8562 static void ssh_unthrottle(void *handle, int bufsize)
8564 Ssh ssh = (Ssh) handle;
8565 if (ssh->version == 1) {
8566 if (ssh->v1_stdout_throttling && bufsize < SSH1_BUFFER_LIMIT) {
8567 ssh->v1_stdout_throttling = 0;
8568 ssh1_throttle(ssh, -1);
8571 if (ssh->mainchan && ssh->mainchan->closes == 0)
8572 ssh2_set_window(ssh->mainchan, OUR_V2_WINSIZE - bufsize);
8576 void ssh_send_port_open(void *channel, char *hostname, int port, char *org)
8578 struct ssh_channel *c = (struct ssh_channel *)channel;
8580 struct Packet *pktout;
8582 logeventf(ssh, "Opening forwarded connection to %s:%d", hostname, port);
8584 if (ssh->version == 1) {
8585 send_packet(ssh, SSH1_MSG_PORT_OPEN,
8586 PKT_INT, c->localid,
8589 /* PKT_STR, <org:orgport>, */
8592 pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
8593 ssh2_pkt_addstring(pktout, "direct-tcpip");
8594 ssh2_pkt_adduint32(pktout, c->localid);
8595 c->v.v2.locwindow = OUR_V2_WINSIZE;
8596 ssh2_pkt_adduint32(pktout, c->v.v2.locwindow);/* our window size */
8597 ssh2_pkt_adduint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
8598 ssh2_pkt_addstring(pktout, hostname);
8599 ssh2_pkt_adduint32(pktout, port);
8601 * We make up values for the originator data; partly it's
8602 * too much hassle to keep track, and partly I'm not
8603 * convinced the server should be told details like that
8604 * about my local network configuration.
8606 ssh2_pkt_addstring(pktout, "client-side-connection");
8607 ssh2_pkt_adduint32(pktout, 0);
8608 ssh2_pkt_send(ssh, pktout);
8612 static Socket ssh_socket(void *handle)
8614 Ssh ssh = (Ssh) handle;
8618 static int ssh_sendok(void *handle)
8620 Ssh ssh = (Ssh) handle;
8621 return ssh->send_ok;
8624 static int ssh_ldisc(void *handle, int option)
8626 Ssh ssh = (Ssh) handle;
8627 if (option == LD_ECHO)
8628 return ssh->echoing;
8629 if (option == LD_EDIT)
8630 return ssh->editing;
8634 static void ssh_provide_ldisc(void *handle, void *ldisc)
8636 Ssh ssh = (Ssh) handle;
8640 static void ssh_provide_logctx(void *handle, void *logctx)
8642 Ssh ssh = (Ssh) handle;
8643 ssh->logctx = logctx;
8646 static int ssh_return_exitcode(void *handle)
8648 Ssh ssh = (Ssh) handle;
8652 return (ssh->exitcode >= 0 ? ssh->exitcode : 0);
8656 * cfg_info for SSH is the currently running version of the
8657 * protocol. (1 for 1; 2 for 2; 0 for not-decided-yet.)
8659 static int ssh_cfg_info(void *handle)
8661 Ssh ssh = (Ssh) handle;
8662 return ssh->version;
8666 * Gross hack: pscp will try to start SFTP but fall back to scp1 if
8667 * that fails. This variable is the means by which scp.c can reach
8668 * into the SSH code and find out which one it got.
8670 extern int ssh_fallback_cmd(void *handle)
8672 Ssh ssh = (Ssh) handle;
8673 return ssh->fallback_cmd;
8676 Backend ssh_backend = {
8686 ssh_return_exitcode,