1 /* $OpenBSD: packet.c,v 1.315 2024/05/31 08:49:35 djm Exp $ */
2 /*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
6 * This file contains code implementing the packet protocol and communication
7 * with the other side. This same code is used both on client and server side.
8 *
9 * As far as I am concerned, the code I have written for this software
10 * can be used freely for any purpose. Any derived versions of this
11 * software must be clearly marked as such, and if the derived work is
12 * incompatible with the protocol description in the RFC file, it must be
13 * called by a name other than "ssh" or "Secure Shell".
14 *
15 *
16 * SSH2 packet format added by Markus Friedl.
17 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
18 *
19 * Redistribution and use in source and binary forms, with or without
20 * modification, are permitted provided that the following conditions
21 * are met:
22 * 1. Redistributions of source code must retain the above copyright
23 * notice, this list of conditions and the following disclaimer.
24 * 2. Redistributions in binary form must reproduce the above copyright
25 * notice, this list of conditions and the following disclaimer in the
26 * documentation and/or other materials provided with the distribution.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
29 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
30 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
31 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
32 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
33 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
34 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
35 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
36 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
37 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38 */
39
40 #include <sys/types.h>
41 #include <sys/queue.h>
42 #include <sys/socket.h>
43 #include <sys/time.h>
44 #include <netinet/in.h>
45 #include <netinet/ip.h>
46
47 #include <errno.h>
48 #include <netdb.h>
49 #include <stdarg.h>
50 #include <stdio.h>
51 #include <stdlib.h>
52 #include <string.h>
53 #include <unistd.h>
54 #include <limits.h>
55 #include <poll.h>
56 #include <signal.h>
57 #include <time.h>
58
59 #ifdef WITH_ZLIB
60 #include <zlib.h>
61 #endif
62
63 #include "xmalloc.h"
64 #include "compat.h"
65 #include "ssh2.h"
66 #include "cipher.h"
67 #include "sshkey.h"
68 #include "kex.h"
69 #include "digest.h"
70 #include "mac.h"
71 #include "log.h"
72 #include "canohost.h"
73 #include "misc.h"
74 #include "channels.h"
75 #include "ssh.h"
76 #include "packet.h"
77 #include "ssherr.h"
78 #include "sshbuf.h"
79
80 #ifdef PACKET_DEBUG
81 #define DBG(x) x
82 #else
83 #define DBG(x)
84 #endif
85
86 #define PACKET_MAX_SIZE (256 * 1024)
87
88 struct packet_state {
89 u_int32_t seqnr;
90 u_int32_t packets;
91 u_int64_t blocks;
92 u_int64_t bytes;
93 };
94
95 struct packet {
96 TAILQ_ENTRY(packet) next;
97 u_char type;
98 struct sshbuf *payload;
99 };
100
101 struct session_state {
102 /*
103 * This variable contains the file descriptors used for
104 * communicating with the other side. connection_in is used for
105 * reading; connection_out for writing. These can be the same
106 * descriptor, in which case it is assumed to be a socket.
107 */
108 int connection_in;
109 int connection_out;
110
111 /* Protocol flags for the remote side. */
112 u_int remote_protocol_flags;
113
114 /* Encryption context for receiving data. Only used for decryption. */
115 struct sshcipher_ctx *receive_context;
116
117 /* Encryption context for sending data. Only used for encryption. */
118 struct sshcipher_ctx *send_context;
119
120 /* Buffer for raw input data from the socket. */
121 struct sshbuf *input;
122
123 /* Buffer for raw output data going to the socket. */
124 struct sshbuf *output;
125
126 /* Buffer for the partial outgoing packet being constructed. */
127 struct sshbuf *outgoing_packet;
128
129 /* Buffer for the incoming packet currently being processed. */
130 struct sshbuf *incoming_packet;
131
132 /* Scratch buffer for packet compression/decompression. */
133 struct sshbuf *compression_buffer;
134
135 #ifdef WITH_ZLIB
136 /* Incoming/outgoing compression dictionaries */
137 z_stream compression_in_stream;
138 z_stream compression_out_stream;
139 #endif
140 int compression_in_started;
141 int compression_out_started;
142 int compression_in_failures;
143 int compression_out_failures;
144
145 /* default maximum packet size */
146 u_int max_packet_size;
147
148 /* Flag indicating whether this module has been initialized. */
149 int initialized;
150
151 /* Set to true if the connection is interactive. */
152 int interactive_mode;
153
154 /* Set to true if we are the server side. */
155 int server_side;
156
157 /* Set to true if we are authenticated. */
158 int after_authentication;
159
160 int keep_alive_timeouts;
161
162 /* The maximum time that we will wait to send or receive a packet */
163 int packet_timeout_ms;
164
165 /* Session key information for Encryption and MAC */
166 struct newkeys *newkeys[MODE_MAX];
167 struct packet_state p_read, p_send;
168
169 /* Volume-based rekeying */
170 u_int64_t max_blocks_in, max_blocks_out, rekey_limit;
171
172 /* Time-based rekeying */
173 u_int32_t rekey_interval; /* how often in seconds */
174 time_t rekey_time; /* time of last rekeying */
175
176 /* roundup current message to extra_pad bytes */
177 u_char extra_pad;
178
179 /* XXX discard incoming data after MAC error */
180 u_int packet_discard;
181 size_t packet_discard_mac_already;
182 struct sshmac *packet_discard_mac;
183
184 /* Used in packet_read_poll2() */
185 u_int packlen;
186
187 /* Used in packet_send2 */
188 int rekeying;
189
190 /* Used in ssh_packet_send_mux() */
191 int mux;
192
193 /* Used in packet_set_interactive */
194 int set_interactive_called;
195
196 /* Used in packet_set_maxsize */
197 int set_maxsize_called;
198
199 /* One-off warning about weak ciphers */
200 int cipher_warning_done;
201
202 /* Hook for fuzzing inbound packets */
203 ssh_packet_hook_fn *hook_in;
204 void *hook_in_ctx;
205
206 TAILQ_HEAD(, packet) outgoing;
207 };
208
209 struct ssh *
ssh_alloc_session_state(void)210 ssh_alloc_session_state(void)
211 {
212 struct ssh *ssh = NULL;
213 struct session_state *state = NULL;
214
215 if ((ssh = calloc(1, sizeof(*ssh))) == NULL ||
216 (state = calloc(1, sizeof(*state))) == NULL ||
217 (ssh->kex = kex_new()) == NULL ||
218 (state->input = sshbuf_new()) == NULL ||
219 (state->output = sshbuf_new()) == NULL ||
220 (state->outgoing_packet = sshbuf_new()) == NULL ||
221 (state->incoming_packet = sshbuf_new()) == NULL)
222 goto fail;
223 TAILQ_INIT(&state->outgoing);
224 TAILQ_INIT(&ssh->private_keys);
225 TAILQ_INIT(&ssh->public_keys);
226 state->connection_in = -1;
227 state->connection_out = -1;
228 state->max_packet_size = 32768;
229 state->packet_timeout_ms = -1;
230 state->p_send.packets = state->p_read.packets = 0;
231 state->initialized = 1;
232 /*
233 * ssh_packet_send2() needs to queue packets until
234 * we've done the initial key exchange.
235 */
236 state->rekeying = 1;
237 ssh->state = state;
238 return ssh;
239 fail:
240 if (ssh) {
241 kex_free(ssh->kex);
242 free(ssh);
243 }
244 if (state) {
245 sshbuf_free(state->input);
246 sshbuf_free(state->output);
247 sshbuf_free(state->incoming_packet);
248 sshbuf_free(state->outgoing_packet);
249 free(state);
250 }
251 return NULL;
252 }
253
254 void
ssh_packet_set_input_hook(struct ssh * ssh,ssh_packet_hook_fn * hook,void * ctx)255 ssh_packet_set_input_hook(struct ssh *ssh, ssh_packet_hook_fn *hook, void *ctx)
256 {
257 ssh->state->hook_in = hook;
258 ssh->state->hook_in_ctx = ctx;
259 }
260
261 /* Returns nonzero if rekeying is in progress */
262 int
ssh_packet_is_rekeying(struct ssh * ssh)263 ssh_packet_is_rekeying(struct ssh *ssh)
264 {
265 return ssh->state->rekeying ||
266 (ssh->kex != NULL && ssh->kex->done == 0);
267 }
268
269 /*
270 * Sets the descriptors used for communication.
271 */
272 struct ssh *
ssh_packet_set_connection(struct ssh * ssh,int fd_in,int fd_out)273 ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out)
274 {
275 struct session_state *state;
276 const struct sshcipher *none = cipher_by_name("none");
277 int r;
278
279 if (none == NULL) {
280 error_f("cannot load cipher 'none'");
281 return NULL;
282 }
283 if (ssh == NULL)
284 ssh = ssh_alloc_session_state();
285 if (ssh == NULL) {
286 error_f("could not allocate state");
287 return NULL;
288 }
289 state = ssh->state;
290 state->connection_in = fd_in;
291 state->connection_out = fd_out;
292 if ((r = cipher_init(&state->send_context, none,
293 (const u_char *)"", 0, NULL, 0, CIPHER_ENCRYPT)) != 0 ||
294 (r = cipher_init(&state->receive_context, none,
295 (const u_char *)"", 0, NULL, 0, CIPHER_DECRYPT)) != 0) {
296 error_fr(r, "cipher_init failed");
297 free(ssh); /* XXX need ssh_free_session_state? */
298 return NULL;
299 }
300 state->newkeys[MODE_IN] = state->newkeys[MODE_OUT] = NULL;
301 /*
302 * Cache the IP address of the remote connection for use in error
303 * messages that might be generated after the connection has closed.
304 */
305 (void)ssh_remote_ipaddr(ssh);
306 return ssh;
307 }
308
309 void
ssh_packet_set_timeout(struct ssh * ssh,int timeout,int count)310 ssh_packet_set_timeout(struct ssh *ssh, int timeout, int count)
311 {
312 struct session_state *state = ssh->state;
313
314 if (timeout <= 0 || count <= 0) {
315 state->packet_timeout_ms = -1;
316 return;
317 }
318 if ((INT_MAX / 1000) / count < timeout)
319 state->packet_timeout_ms = INT_MAX;
320 else
321 state->packet_timeout_ms = timeout * count * 1000;
322 }
323
324 void
ssh_packet_set_mux(struct ssh * ssh)325 ssh_packet_set_mux(struct ssh *ssh)
326 {
327 ssh->state->mux = 1;
328 ssh->state->rekeying = 0;
329 kex_free(ssh->kex);
330 ssh->kex = NULL;
331 }
332
333 int
ssh_packet_get_mux(struct ssh * ssh)334 ssh_packet_get_mux(struct ssh *ssh)
335 {
336 return ssh->state->mux;
337 }
338
339 int
ssh_packet_set_log_preamble(struct ssh * ssh,const char * fmt,...)340 ssh_packet_set_log_preamble(struct ssh *ssh, const char *fmt, ...)
341 {
342 va_list args;
343 int r;
344
345 free(ssh->log_preamble);
346 if (fmt == NULL)
347 ssh->log_preamble = NULL;
348 else {
349 va_start(args, fmt);
350 r = vasprintf(&ssh->log_preamble, fmt, args);
351 va_end(args);
352 if (r < 0 || ssh->log_preamble == NULL)
353 return SSH_ERR_ALLOC_FAIL;
354 }
355 return 0;
356 }
357
358 int
ssh_packet_stop_discard(struct ssh * ssh)359 ssh_packet_stop_discard(struct ssh *ssh)
360 {
361 struct session_state *state = ssh->state;
362 int r;
363
364 if (state->packet_discard_mac) {
365 char buf[1024];
366 size_t dlen = PACKET_MAX_SIZE;
367
368 if (dlen > state->packet_discard_mac_already)
369 dlen -= state->packet_discard_mac_already;
370 memset(buf, 'a', sizeof(buf));
371 while (sshbuf_len(state->incoming_packet) < dlen)
372 if ((r = sshbuf_put(state->incoming_packet, buf,
373 sizeof(buf))) != 0)
374 return r;
375 (void) mac_compute(state->packet_discard_mac,
376 state->p_read.seqnr,
377 sshbuf_ptr(state->incoming_packet), dlen,
378 NULL, 0);
379 }
380 logit("Finished discarding for %.200s port %d",
381 ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
382 return SSH_ERR_MAC_INVALID;
383 }
384
385 static int
ssh_packet_start_discard(struct ssh * ssh,struct sshenc * enc,struct sshmac * mac,size_t mac_already,u_int discard)386 ssh_packet_start_discard(struct ssh *ssh, struct sshenc *enc,
387 struct sshmac *mac, size_t mac_already, u_int discard)
388 {
389 struct session_state *state = ssh->state;
390 int r;
391
392 if (enc == NULL || !cipher_is_cbc(enc->cipher) || (mac && mac->etm)) {
393 if ((r = sshpkt_disconnect(ssh, "Packet corrupt")) != 0)
394 return r;
395 return SSH_ERR_MAC_INVALID;
396 }
397 /*
398 * Record number of bytes over which the mac has already
399 * been computed in order to minimize timing attacks.
400 */
401 if (mac && mac->enabled) {
402 state->packet_discard_mac = mac;
403 state->packet_discard_mac_already = mac_already;
404 }
405 if (sshbuf_len(state->input) >= discard)
406 return ssh_packet_stop_discard(ssh);
407 state->packet_discard = discard - sshbuf_len(state->input);
408 return 0;
409 }
410
411 /* Returns 1 if remote host is connected via socket, 0 if not. */
412
413 int
ssh_packet_connection_is_on_socket(struct ssh * ssh)414 ssh_packet_connection_is_on_socket(struct ssh *ssh)
415 {
416 struct session_state *state;
417 struct sockaddr_storage from, to;
418 socklen_t fromlen, tolen;
419
420 if (ssh == NULL || ssh->state == NULL)
421 return 0;
422
423 state = ssh->state;
424 if (state->connection_in == -1 || state->connection_out == -1)
425 return 0;
426 /* filedescriptors in and out are the same, so it's a socket */
427 if (state->connection_in == state->connection_out)
428 return 1;
429 fromlen = sizeof(from);
430 memset(&from, 0, sizeof(from));
431 if (getpeername(state->connection_in, (struct sockaddr *)&from,
432 &fromlen) == -1)
433 return 0;
434 tolen = sizeof(to);
435 memset(&to, 0, sizeof(to));
436 if (getpeername(state->connection_out, (struct sockaddr *)&to,
437 &tolen) == -1)
438 return 0;
439 if (fromlen != tolen || memcmp(&from, &to, fromlen) != 0)
440 return 0;
441 if (from.ss_family != AF_INET && from.ss_family != AF_INET6)
442 return 0;
443 return 1;
444 }
445
446 void
ssh_packet_get_bytes(struct ssh * ssh,u_int64_t * ibytes,u_int64_t * obytes)447 ssh_packet_get_bytes(struct ssh *ssh, u_int64_t *ibytes, u_int64_t *obytes)
448 {
449 if (ibytes)
450 *ibytes = ssh->state->p_read.bytes;
451 if (obytes)
452 *obytes = ssh->state->p_send.bytes;
453 }
454
455 int
ssh_packet_connection_af(struct ssh * ssh)456 ssh_packet_connection_af(struct ssh *ssh)
457 {
458 return get_sock_af(ssh->state->connection_out);
459 }
460
461 /* Sets the connection into non-blocking mode. */
462
463 void
ssh_packet_set_nonblocking(struct ssh * ssh)464 ssh_packet_set_nonblocking(struct ssh *ssh)
465 {
466 /* Set the socket into non-blocking mode. */
467 set_nonblock(ssh->state->connection_in);
468
469 if (ssh->state->connection_out != ssh->state->connection_in)
470 set_nonblock(ssh->state->connection_out);
471 }
472
473 /* Returns the socket used for reading. */
474
475 int
ssh_packet_get_connection_in(struct ssh * ssh)476 ssh_packet_get_connection_in(struct ssh *ssh)
477 {
478 return ssh->state->connection_in;
479 }
480
481 /* Returns the descriptor used for writing. */
482
483 int
ssh_packet_get_connection_out(struct ssh * ssh)484 ssh_packet_get_connection_out(struct ssh *ssh)
485 {
486 return ssh->state->connection_out;
487 }
488
489 /*
490 * Returns the IP-address of the remote host as a string. The returned
491 * string must not be freed.
492 */
493
494 const char *
ssh_remote_ipaddr(struct ssh * ssh)495 ssh_remote_ipaddr(struct ssh *ssh)
496 {
497 int sock;
498
499 /* Check whether we have cached the ipaddr. */
500 if (ssh->remote_ipaddr == NULL) {
501 if (ssh_packet_connection_is_on_socket(ssh)) {
502 sock = ssh->state->connection_in;
503 ssh->remote_ipaddr = get_peer_ipaddr(sock);
504 ssh->remote_port = get_peer_port(sock);
505 ssh->local_ipaddr = get_local_ipaddr(sock);
506 ssh->local_port = get_local_port(sock);
507 } else {
508 ssh->remote_ipaddr = xstrdup("UNKNOWN");
509 ssh->remote_port = 65535;
510 ssh->local_ipaddr = xstrdup("UNKNOWN");
511 ssh->local_port = 65535;
512 }
513 }
514 return ssh->remote_ipaddr;
515 }
516
517 /*
518 * Returns the remote DNS hostname as a string. The returned string must not
519 * be freed. NB. this will usually trigger a DNS query. Return value is on
520 * heap and no caching is performed.
521 * This function does additional checks on the hostname to mitigate some
522 * attacks based on conflation of hostnames and addresses and will
523 * fall back to returning an address on error.
524 */
525
526 char *
ssh_remote_hostname(struct ssh * ssh)527 ssh_remote_hostname(struct ssh *ssh)
528 {
529 struct sockaddr_storage from;
530 socklen_t fromlen;
531 struct addrinfo hints, *ai, *aitop;
532 char name[NI_MAXHOST], ntop2[NI_MAXHOST];
533 const char *ntop = ssh_remote_ipaddr(ssh);
534
535 /* Get IP address of client. */
536 fromlen = sizeof(from);
537 memset(&from, 0, sizeof(from));
538 if (getpeername(ssh_packet_get_connection_in(ssh),
539 (struct sockaddr *)&from, &fromlen) == -1) {
540 debug_f("getpeername failed: %.100s", strerror(errno));
541 return xstrdup(ntop);
542 }
543
544 debug3_f("trying to reverse map address %.100s.", ntop);
545 /* Map the IP address to a host name. */
546 if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
547 NULL, 0, NI_NAMEREQD) != 0) {
548 /* Host name not found. Use ip address. */
549 return xstrdup(ntop);
550 }
551
552 /*
553 * if reverse lookup result looks like a numeric hostname,
554 * someone is trying to trick us by PTR record like following:
555 * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
556 */
557 memset(&hints, 0, sizeof(hints));
558 hints.ai_socktype = SOCK_DGRAM; /*dummy*/
559 hints.ai_flags = AI_NUMERICHOST;
560 if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
561 logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
562 name, ntop);
563 freeaddrinfo(ai);
564 return xstrdup(ntop);
565 }
566
567 /* Names are stored in lowercase. */
568 lowercase(name);
569
570 /*
571 * Map it back to an IP address and check that the given
572 * address actually is an address of this host. This is
573 * necessary because anyone with access to a name server can
574 * define arbitrary names for an IP address. Mapping from
575 * name to IP address can be trusted better (but can still be
576 * fooled if the intruder has access to the name server of
577 * the domain).
578 */
579 memset(&hints, 0, sizeof(hints));
580 hints.ai_family = from.ss_family;
581 hints.ai_socktype = SOCK_STREAM;
582 if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
583 logit("reverse mapping checking getaddrinfo for %.700s "
584 "[%s] failed.", name, ntop);
585 return xstrdup(ntop);
586 }
587 /* Look for the address from the list of addresses. */
588 for (ai = aitop; ai; ai = ai->ai_next) {
589 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
590 sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
591 (strcmp(ntop, ntop2) == 0))
592 break;
593 }
594 freeaddrinfo(aitop);
595 /* If we reached the end of the list, the address was not there. */
596 if (ai == NULL) {
597 /* Address not found for the host name. */
598 logit("Address %.100s maps to %.600s, but this does not "
599 "map back to the address.", ntop, name);
600 return xstrdup(ntop);
601 }
602 return xstrdup(name);
603 }
604
605 /* Returns the port number of the remote host. */
606
607 int
ssh_remote_port(struct ssh * ssh)608 ssh_remote_port(struct ssh *ssh)
609 {
610 (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */
611 return ssh->remote_port;
612 }
613
614 /*
615 * Returns the IP-address of the local host as a string. The returned
616 * string must not be freed.
617 */
618
619 const char *
ssh_local_ipaddr(struct ssh * ssh)620 ssh_local_ipaddr(struct ssh *ssh)
621 {
622 (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */
623 return ssh->local_ipaddr;
624 }
625
626 /* Returns the port number of the local host. */
627
628 int
ssh_local_port(struct ssh * ssh)629 ssh_local_port(struct ssh *ssh)
630 {
631 (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */
632 return ssh->local_port;
633 }
634
635 /* Returns the routing domain of the input socket, or NULL if unavailable */
636 const char *
ssh_packet_rdomain_in(struct ssh * ssh)637 ssh_packet_rdomain_in(struct ssh *ssh)
638 {
639 if (ssh->rdomain_in != NULL)
640 return ssh->rdomain_in;
641 if (!ssh_packet_connection_is_on_socket(ssh))
642 return NULL;
643 ssh->rdomain_in = get_rdomain(ssh->state->connection_in);
644 return ssh->rdomain_in;
645 }
646
647 /* Closes the connection and clears and frees internal data structures. */
648
649 static void
ssh_packet_close_internal(struct ssh * ssh,int do_close)650 ssh_packet_close_internal(struct ssh *ssh, int do_close)
651 {
652 struct session_state *state = ssh->state;
653 u_int mode;
654
655 if (!state->initialized)
656 return;
657 state->initialized = 0;
658 if (do_close) {
659 if (state->connection_in == state->connection_out) {
660 close(state->connection_out);
661 } else {
662 close(state->connection_in);
663 close(state->connection_out);
664 }
665 }
666 sshbuf_free(state->input);
667 sshbuf_free(state->output);
668 sshbuf_free(state->outgoing_packet);
669 sshbuf_free(state->incoming_packet);
670 for (mode = 0; mode < MODE_MAX; mode++) {
671 kex_free_newkeys(state->newkeys[mode]); /* current keys */
672 state->newkeys[mode] = NULL;
673 ssh_clear_newkeys(ssh, mode); /* next keys */
674 }
675 #ifdef WITH_ZLIB
676 /* compression state is in shared mem, so we can only release it once */
677 if (do_close && state->compression_buffer) {
678 sshbuf_free(state->compression_buffer);
679 if (state->compression_out_started) {
680 z_streamp stream = &state->compression_out_stream;
681 debug("compress outgoing: "
682 "raw data %llu, compressed %llu, factor %.2f",
683 (unsigned long long)stream->total_in,
684 (unsigned long long)stream->total_out,
685 stream->total_in == 0 ? 0.0 :
686 (double) stream->total_out / stream->total_in);
687 if (state->compression_out_failures == 0)
688 deflateEnd(stream);
689 }
690 if (state->compression_in_started) {
691 z_streamp stream = &state->compression_in_stream;
692 debug("compress incoming: "
693 "raw data %llu, compressed %llu, factor %.2f",
694 (unsigned long long)stream->total_out,
695 (unsigned long long)stream->total_in,
696 stream->total_out == 0 ? 0.0 :
697 (double) stream->total_in / stream->total_out);
698 if (state->compression_in_failures == 0)
699 inflateEnd(stream);
700 }
701 }
702 #endif /* WITH_ZLIB */
703 cipher_free(state->send_context);
704 cipher_free(state->receive_context);
705 state->send_context = state->receive_context = NULL;
706 if (do_close) {
707 free(ssh->local_ipaddr);
708 ssh->local_ipaddr = NULL;
709 free(ssh->remote_ipaddr);
710 ssh->remote_ipaddr = NULL;
711 free(ssh->state);
712 ssh->state = NULL;
713 kex_free(ssh->kex);
714 ssh->kex = NULL;
715 }
716 }
717
718 void
ssh_packet_close(struct ssh * ssh)719 ssh_packet_close(struct ssh *ssh)
720 {
721 ssh_packet_close_internal(ssh, 1);
722 }
723
724 void
ssh_packet_clear_keys(struct ssh * ssh)725 ssh_packet_clear_keys(struct ssh *ssh)
726 {
727 ssh_packet_close_internal(ssh, 0);
728 }
729
730 /* Sets remote side protocol flags. */
731
732 void
ssh_packet_set_protocol_flags(struct ssh * ssh,u_int protocol_flags)733 ssh_packet_set_protocol_flags(struct ssh *ssh, u_int protocol_flags)
734 {
735 ssh->state->remote_protocol_flags = protocol_flags;
736 }
737
738 /* Returns the remote protocol flags set earlier by the above function. */
739
740 u_int
ssh_packet_get_protocol_flags(struct ssh * ssh)741 ssh_packet_get_protocol_flags(struct ssh *ssh)
742 {
743 return ssh->state->remote_protocol_flags;
744 }
745
746 /*
747 * Starts packet compression from the next packet on in both directions.
748 * Level is compression level 1 (fastest) - 9 (slow, best) as in gzip.
749 */
750
751 static int
ssh_packet_init_compression(struct ssh * ssh)752 ssh_packet_init_compression(struct ssh *ssh)
753 {
754 if (!ssh->state->compression_buffer &&
755 ((ssh->state->compression_buffer = sshbuf_new()) == NULL))
756 return SSH_ERR_ALLOC_FAIL;
757 return 0;
758 }
759
760 #ifdef WITH_ZLIB
761 static int
start_compression_out(struct ssh * ssh,int level)762 start_compression_out(struct ssh *ssh, int level)
763 {
764 if (level < 1 || level > 9)
765 return SSH_ERR_INVALID_ARGUMENT;
766 debug("Enabling compression at level %d.", level);
767 if (ssh->state->compression_out_started == 1)
768 deflateEnd(&ssh->state->compression_out_stream);
769 switch (deflateInit(&ssh->state->compression_out_stream, level)) {
770 case Z_OK:
771 ssh->state->compression_out_started = 1;
772 break;
773 case Z_MEM_ERROR:
774 return SSH_ERR_ALLOC_FAIL;
775 default:
776 return SSH_ERR_INTERNAL_ERROR;
777 }
778 return 0;
779 }
780
781 static int
start_compression_in(struct ssh * ssh)782 start_compression_in(struct ssh *ssh)
783 {
784 if (ssh->state->compression_in_started == 1)
785 inflateEnd(&ssh->state->compression_in_stream);
786 switch (inflateInit(&ssh->state->compression_in_stream)) {
787 case Z_OK:
788 ssh->state->compression_in_started = 1;
789 break;
790 case Z_MEM_ERROR:
791 return SSH_ERR_ALLOC_FAIL;
792 default:
793 return SSH_ERR_INTERNAL_ERROR;
794 }
795 return 0;
796 }
797
798 /* XXX remove need for separate compression buffer */
799 static int
compress_buffer(struct ssh * ssh,struct sshbuf * in,struct sshbuf * out)800 compress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
801 {
802 u_char buf[4096];
803 int r, status;
804
805 if (ssh->state->compression_out_started != 1)
806 return SSH_ERR_INTERNAL_ERROR;
807
808 /* This case is not handled below. */
809 if (sshbuf_len(in) == 0)
810 return 0;
811
812 /* Input is the contents of the input buffer. */
813 if ((ssh->state->compression_out_stream.next_in =
814 sshbuf_mutable_ptr(in)) == NULL)
815 return SSH_ERR_INTERNAL_ERROR;
816 ssh->state->compression_out_stream.avail_in = sshbuf_len(in);
817
818 /* Loop compressing until deflate() returns with avail_out != 0. */
819 do {
820 /* Set up fixed-size output buffer. */
821 ssh->state->compression_out_stream.next_out = buf;
822 ssh->state->compression_out_stream.avail_out = sizeof(buf);
823
824 /* Compress as much data into the buffer as possible. */
825 status = deflate(&ssh->state->compression_out_stream,
826 Z_PARTIAL_FLUSH);
827 switch (status) {
828 case Z_MEM_ERROR:
829 return SSH_ERR_ALLOC_FAIL;
830 case Z_OK:
831 /* Append compressed data to output_buffer. */
832 if ((r = sshbuf_put(out, buf, sizeof(buf) -
833 ssh->state->compression_out_stream.avail_out)) != 0)
834 return r;
835 break;
836 case Z_STREAM_ERROR:
837 default:
838 ssh->state->compression_out_failures++;
839 return SSH_ERR_INVALID_FORMAT;
840 }
841 } while (ssh->state->compression_out_stream.avail_out == 0);
842 return 0;
843 }
844
845 static int
uncompress_buffer(struct ssh * ssh,struct sshbuf * in,struct sshbuf * out)846 uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
847 {
848 u_char buf[4096];
849 int r, status;
850
851 if (ssh->state->compression_in_started != 1)
852 return SSH_ERR_INTERNAL_ERROR;
853
854 if ((ssh->state->compression_in_stream.next_in =
855 sshbuf_mutable_ptr(in)) == NULL)
856 return SSH_ERR_INTERNAL_ERROR;
857 ssh->state->compression_in_stream.avail_in = sshbuf_len(in);
858
859 for (;;) {
860 /* Set up fixed-size output buffer. */
861 ssh->state->compression_in_stream.next_out = buf;
862 ssh->state->compression_in_stream.avail_out = sizeof(buf);
863
864 status = inflate(&ssh->state->compression_in_stream,
865 Z_SYNC_FLUSH);
866 switch (status) {
867 case Z_OK:
868 if ((r = sshbuf_put(out, buf, sizeof(buf) -
869 ssh->state->compression_in_stream.avail_out)) != 0)
870 return r;
871 break;
872 case Z_BUF_ERROR:
873 /*
874 * Comments in zlib.h say that we should keep calling
875 * inflate() until we get an error. This appears to
876 * be the error that we get.
877 */
878 return 0;
879 case Z_DATA_ERROR:
880 return SSH_ERR_INVALID_FORMAT;
881 case Z_MEM_ERROR:
882 return SSH_ERR_ALLOC_FAIL;
883 case Z_STREAM_ERROR:
884 default:
885 ssh->state->compression_in_failures++;
886 return SSH_ERR_INTERNAL_ERROR;
887 }
888 }
889 /* NOTREACHED */
890 }
891
892 #else /* WITH_ZLIB */
893
894 static int
start_compression_out(struct ssh * ssh,int level)895 start_compression_out(struct ssh *ssh, int level)
896 {
897 return SSH_ERR_INTERNAL_ERROR;
898 }
899
900 static int
start_compression_in(struct ssh * ssh)901 start_compression_in(struct ssh *ssh)
902 {
903 return SSH_ERR_INTERNAL_ERROR;
904 }
905
906 static int
compress_buffer(struct ssh * ssh,struct sshbuf * in,struct sshbuf * out)907 compress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
908 {
909 return SSH_ERR_INTERNAL_ERROR;
910 }
911
912 static int
uncompress_buffer(struct ssh * ssh,struct sshbuf * in,struct sshbuf * out)913 uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
914 {
915 return SSH_ERR_INTERNAL_ERROR;
916 }
917 #endif /* WITH_ZLIB */
918
919 void
ssh_clear_newkeys(struct ssh * ssh,int mode)920 ssh_clear_newkeys(struct ssh *ssh, int mode)
921 {
922 if (ssh->kex && ssh->kex->newkeys[mode]) {
923 kex_free_newkeys(ssh->kex->newkeys[mode]);
924 ssh->kex->newkeys[mode] = NULL;
925 }
926 }
927
928 int
ssh_set_newkeys(struct ssh * ssh,int mode)929 ssh_set_newkeys(struct ssh *ssh, int mode)
930 {
931 struct session_state *state = ssh->state;
932 struct sshenc *enc;
933 struct sshmac *mac;
934 struct sshcomp *comp;
935 struct sshcipher_ctx **ccp;
936 struct packet_state *ps;
937 u_int64_t *max_blocks;
938 const char *wmsg;
939 int r, crypt_type;
940 const char *dir = mode == MODE_OUT ? "out" : "in";
941
942 debug2_f("mode %d", mode);
943
944 if (mode == MODE_OUT) {
945 ccp = &state->send_context;
946 crypt_type = CIPHER_ENCRYPT;
947 ps = &state->p_send;
948 max_blocks = &state->max_blocks_out;
949 } else {
950 ccp = &state->receive_context;
951 crypt_type = CIPHER_DECRYPT;
952 ps = &state->p_read;
953 max_blocks = &state->max_blocks_in;
954 }
955 if (state->newkeys[mode] != NULL) {
956 debug_f("rekeying %s, input %llu bytes %llu blocks, "
957 "output %llu bytes %llu blocks", dir,
958 (unsigned long long)state->p_read.bytes,
959 (unsigned long long)state->p_read.blocks,
960 (unsigned long long)state->p_send.bytes,
961 (unsigned long long)state->p_send.blocks);
962 kex_free_newkeys(state->newkeys[mode]);
963 state->newkeys[mode] = NULL;
964 }
965 /* note that both bytes and the seqnr are not reset */
966 ps->packets = ps->blocks = 0;
967 /* move newkeys from kex to state */
968 if ((state->newkeys[mode] = ssh->kex->newkeys[mode]) == NULL)
969 return SSH_ERR_INTERNAL_ERROR;
970 ssh->kex->newkeys[mode] = NULL;
971 enc = &state->newkeys[mode]->enc;
972 mac = &state->newkeys[mode]->mac;
973 comp = &state->newkeys[mode]->comp;
974 if (cipher_authlen(enc->cipher) == 0) {
975 if ((r = mac_init(mac)) != 0)
976 return r;
977 }
978 mac->enabled = 1;
979 DBG(debug_f("cipher_init: %s", dir));
980 cipher_free(*ccp);
981 *ccp = NULL;
982 if ((r = cipher_init(ccp, enc->cipher, enc->key, enc->key_len,
983 enc->iv, enc->iv_len, crypt_type)) != 0)
984 return r;
985 if (!state->cipher_warning_done &&
986 (wmsg = cipher_warning_message(*ccp)) != NULL) {
987 error("Warning: %s", wmsg);
988 state->cipher_warning_done = 1;
989 }
990 /* Deleting the keys does not gain extra security */
991 /* explicit_bzero(enc->iv, enc->block_size);
992 explicit_bzero(enc->key, enc->key_len);
993 explicit_bzero(mac->key, mac->key_len); */
994 if ((comp->type == COMP_ZLIB ||
995 (comp->type == COMP_DELAYED &&
996 state->after_authentication)) && comp->enabled == 0) {
997 if ((r = ssh_packet_init_compression(ssh)) < 0)
998 return r;
999 if (mode == MODE_OUT) {
1000 if ((r = start_compression_out(ssh, 6)) != 0)
1001 return r;
1002 } else {
1003 if ((r = start_compression_in(ssh)) != 0)
1004 return r;
1005 }
1006 comp->enabled = 1;
1007 }
1008 /*
1009 * The 2^(blocksize*2) limit is too expensive for 3DES,
1010 * so enforce a 1GB limit for small blocksizes.
1011 * See RFC4344 section 3.2.
1012 */
1013 if (enc->block_size >= 16)
1014 *max_blocks = (u_int64_t)1 << (enc->block_size*2);
1015 else
1016 *max_blocks = ((u_int64_t)1 << 30) / enc->block_size;
1017 if (state->rekey_limit)
1018 *max_blocks = MINIMUM(*max_blocks,
1019 state->rekey_limit / enc->block_size);
1020 debug("rekey %s after %llu blocks", dir,
1021 (unsigned long long)*max_blocks);
1022 return 0;
1023 }
1024
1025 #define MAX_PACKETS (1U<<31)
1026 static int
ssh_packet_need_rekeying(struct ssh * ssh,u_int outbound_packet_len)1027 ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
1028 {
1029 struct session_state *state = ssh->state;
1030 u_int32_t out_blocks;
1031
1032 /* XXX client can't cope with rekeying pre-auth */
1033 if (!state->after_authentication)
1034 return 0;
1035
1036 /* Haven't keyed yet or KEX in progress. */
1037 if (ssh_packet_is_rekeying(ssh))
1038 return 0;
1039
1040 /* Peer can't rekey */
1041 if (ssh->compat & SSH_BUG_NOREKEY)
1042 return 0;
1043
1044 /*
1045 * Permit one packet in or out per rekey - this allows us to
1046 * make progress when rekey limits are very small.
1047 */
1048 if (state->p_send.packets == 0 && state->p_read.packets == 0)
1049 return 0;
1050
1051 /* Time-based rekeying */
1052 if (state->rekey_interval != 0 &&
1053 (int64_t)state->rekey_time + state->rekey_interval <= monotime())
1054 return 1;
1055
1056 /*
1057 * Always rekey when MAX_PACKETS sent in either direction
1058 * As per RFC4344 section 3.1 we do this after 2^31 packets.
1059 */
1060 if (state->p_send.packets > MAX_PACKETS ||
1061 state->p_read.packets > MAX_PACKETS)
1062 return 1;
1063
1064 /* Rekey after (cipher-specific) maximum blocks */
1065 out_blocks = ROUNDUP(outbound_packet_len,
1066 state->newkeys[MODE_OUT]->enc.block_size);
1067 return (state->max_blocks_out &&
1068 (state->p_send.blocks + out_blocks > state->max_blocks_out)) ||
1069 (state->max_blocks_in &&
1070 (state->p_read.blocks > state->max_blocks_in));
1071 }
1072
1073 int
ssh_packet_check_rekey(struct ssh * ssh)1074 ssh_packet_check_rekey(struct ssh *ssh)
1075 {
1076 if (!ssh_packet_need_rekeying(ssh, 0))
1077 return 0;
1078 debug3_f("rekex triggered");
1079 return kex_start_rekex(ssh);
1080 }
1081
1082 /*
1083 * Delayed compression for SSH2 is enabled after authentication:
1084 * This happens on the server side after a SSH2_MSG_USERAUTH_SUCCESS is sent,
1085 * and on the client side after a SSH2_MSG_USERAUTH_SUCCESS is received.
1086 */
1087 static int
ssh_packet_enable_delayed_compress(struct ssh * ssh)1088 ssh_packet_enable_delayed_compress(struct ssh *ssh)
1089 {
1090 struct session_state *state = ssh->state;
1091 struct sshcomp *comp = NULL;
1092 int r, mode;
1093
1094 /*
1095 * Remember that we are past the authentication step, so rekeying
1096 * with COMP_DELAYED will turn on compression immediately.
1097 */
1098 state->after_authentication = 1;
1099 for (mode = 0; mode < MODE_MAX; mode++) {
1100 /* protocol error: USERAUTH_SUCCESS received before NEWKEYS */
1101 if (state->newkeys[mode] == NULL)
1102 continue;
1103 comp = &state->newkeys[mode]->comp;
1104 if (comp && !comp->enabled && comp->type == COMP_DELAYED) {
1105 if ((r = ssh_packet_init_compression(ssh)) != 0)
1106 return r;
1107 if (mode == MODE_OUT) {
1108 if ((r = start_compression_out(ssh, 6)) != 0)
1109 return r;
1110 } else {
1111 if ((r = start_compression_in(ssh)) != 0)
1112 return r;
1113 }
1114 comp->enabled = 1;
1115 }
1116 }
1117 return 0;
1118 }
1119
1120 /* Used to mute debug logging for noisy packet types */
1121 int
ssh_packet_log_type(u_char type)1122 ssh_packet_log_type(u_char type)
1123 {
1124 switch (type) {
1125 case SSH2_MSG_PING:
1126 case SSH2_MSG_PONG:
1127 case SSH2_MSG_CHANNEL_DATA:
1128 case SSH2_MSG_CHANNEL_EXTENDED_DATA:
1129 case SSH2_MSG_CHANNEL_WINDOW_ADJUST:
1130 return 0;
1131 default:
1132 return 1;
1133 }
1134 }
1135
1136 /*
1137 * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
1138 */
1139 int
ssh_packet_send2_wrapped(struct ssh * ssh)1140 ssh_packet_send2_wrapped(struct ssh *ssh)
1141 {
1142 struct session_state *state = ssh->state;
1143 u_char type, *cp, macbuf[SSH_DIGEST_MAX_LENGTH];
1144 u_char tmp, padlen, pad = 0;
1145 u_int authlen = 0, aadlen = 0;
1146 u_int len;
1147 struct sshenc *enc = NULL;
1148 struct sshmac *mac = NULL;
1149 struct sshcomp *comp = NULL;
1150 int r, block_size;
1151
1152 if (state->newkeys[MODE_OUT] != NULL) {
1153 enc = &state->newkeys[MODE_OUT]->enc;
1154 mac = &state->newkeys[MODE_OUT]->mac;
1155 comp = &state->newkeys[MODE_OUT]->comp;
1156 /* disable mac for authenticated encryption */
1157 if ((authlen = cipher_authlen(enc->cipher)) != 0)
1158 mac = NULL;
1159 }
1160 block_size = enc ? enc->block_size : 8;
1161 aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
1162
1163 type = (sshbuf_ptr(state->outgoing_packet))[5];
1164 if (ssh_packet_log_type(type))
1165 debug3("send packet: type %u", type);
1166 #ifdef PACKET_DEBUG
1167 fprintf(stderr, "plain: ");
1168 sshbuf_dump(state->outgoing_packet, stderr);
1169 #endif
1170
1171 if (comp && comp->enabled) {
1172 len = sshbuf_len(state->outgoing_packet);
1173 /* skip header, compress only payload */
1174 if ((r = sshbuf_consume(state->outgoing_packet, 5)) != 0)
1175 goto out;
1176 sshbuf_reset(state->compression_buffer);
1177 if ((r = compress_buffer(ssh, state->outgoing_packet,
1178 state->compression_buffer)) != 0)
1179 goto out;
1180 sshbuf_reset(state->outgoing_packet);
1181 if ((r = sshbuf_put(state->outgoing_packet,
1182 "\0\0\0\0\0", 5)) != 0 ||
1183 (r = sshbuf_putb(state->outgoing_packet,
1184 state->compression_buffer)) != 0)
1185 goto out;
1186 DBG(debug("compression: raw %d compressed %zd", len,
1187 sshbuf_len(state->outgoing_packet)));
1188 }
1189
1190 /* sizeof (packet_len + pad_len + payload) */
1191 len = sshbuf_len(state->outgoing_packet);
1192
1193 /*
1194 * calc size of padding, alloc space, get random data,
1195 * minimum padding is 4 bytes
1196 */
1197 len -= aadlen; /* packet length is not encrypted for EtM modes */
1198 padlen = block_size - (len % block_size);
1199 if (padlen < 4)
1200 padlen += block_size;
1201 if (state->extra_pad) {
1202 tmp = state->extra_pad;
1203 state->extra_pad =
1204 ROUNDUP(state->extra_pad, block_size);
1205 /* check if roundup overflowed */
1206 if (state->extra_pad < tmp)
1207 return SSH_ERR_INVALID_ARGUMENT;
1208 tmp = (len + padlen) % state->extra_pad;
1209 /* Check whether pad calculation below will underflow */
1210 if (tmp > state->extra_pad)
1211 return SSH_ERR_INVALID_ARGUMENT;
1212 pad = state->extra_pad - tmp;
1213 DBG(debug3_f("adding %d (len %d padlen %d extra_pad %d)",
1214 pad, len, padlen, state->extra_pad));
1215 tmp = padlen;
1216 padlen += pad;
1217 /* Check whether padlen calculation overflowed */
1218 if (padlen < tmp)
1219 return SSH_ERR_INVALID_ARGUMENT; /* overflow */
1220 state->extra_pad = 0;
1221 }
1222 if ((r = sshbuf_reserve(state->outgoing_packet, padlen, &cp)) != 0)
1223 goto out;
1224 if (enc && !cipher_ctx_is_plaintext(state->send_context)) {
1225 /* random padding */
1226 arc4random_buf(cp, padlen);
1227 } else {
1228 /* clear padding */
1229 explicit_bzero(cp, padlen);
1230 }
1231 /* sizeof (packet_len + pad_len + payload + padding) */
1232 len = sshbuf_len(state->outgoing_packet);
1233 cp = sshbuf_mutable_ptr(state->outgoing_packet);
1234 if (cp == NULL) {
1235 r = SSH_ERR_INTERNAL_ERROR;
1236 goto out;
1237 }
1238 /* packet_length includes payload, padding and padding length field */
1239 POKE_U32(cp, len - 4);
1240 cp[4] = padlen;
1241 DBG(debug("send: len %d (includes padlen %d, aadlen %d)",
1242 len, padlen, aadlen));
1243
1244 /* compute MAC over seqnr and packet(length fields, payload, padding) */
1245 if (mac && mac->enabled && !mac->etm) {
1246 if ((r = mac_compute(mac, state->p_send.seqnr,
1247 sshbuf_ptr(state->outgoing_packet), len,
1248 macbuf, sizeof(macbuf))) != 0)
1249 goto out;
1250 DBG(debug("done calc MAC out #%d", state->p_send.seqnr));
1251 }
1252 /* encrypt packet and append to output buffer. */
1253 if ((r = sshbuf_reserve(state->output,
1254 sshbuf_len(state->outgoing_packet) + authlen, &cp)) != 0)
1255 goto out;
1256 if ((r = cipher_crypt(state->send_context, state->p_send.seqnr, cp,
1257 sshbuf_ptr(state->outgoing_packet),
1258 len - aadlen, aadlen, authlen)) != 0)
1259 goto out;
1260 /* append unencrypted MAC */
1261 if (mac && mac->enabled) {
1262 if (mac->etm) {
1263 /* EtM: compute mac over aadlen + cipher text */
1264 if ((r = mac_compute(mac, state->p_send.seqnr,
1265 cp, len, macbuf, sizeof(macbuf))) != 0)
1266 goto out;
1267 DBG(debug("done calc MAC(EtM) out #%d",
1268 state->p_send.seqnr));
1269 }
1270 if ((r = sshbuf_put(state->output, macbuf, mac->mac_len)) != 0)
1271 goto out;
1272 }
1273 #ifdef PACKET_DEBUG
1274 fprintf(stderr, "encrypted: ");
1275 sshbuf_dump(state->output, stderr);
1276 #endif
1277 /* increment sequence number for outgoing packets */
1278 if (++state->p_send.seqnr == 0) {
1279 if ((ssh->kex->flags & KEX_INITIAL) != 0) {
1280 ssh_packet_disconnect(ssh, "outgoing sequence number "
1281 "wrapped during initial key exchange");
1282 }
1283 logit("outgoing seqnr wraps around");
1284 }
1285 if (++state->p_send.packets == 0)
1286 if (!(ssh->compat & SSH_BUG_NOREKEY))
1287 return SSH_ERR_NEED_REKEY;
1288 state->p_send.blocks += len / block_size;
1289 state->p_send.bytes += len;
1290 sshbuf_reset(state->outgoing_packet);
1291
1292 if (type == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) {
1293 debug_f("resetting send seqnr %u", state->p_send.seqnr);
1294 state->p_send.seqnr = 0;
1295 }
1296
1297 if (type == SSH2_MSG_NEWKEYS)
1298 r = ssh_set_newkeys(ssh, MODE_OUT);
1299 else if (type == SSH2_MSG_USERAUTH_SUCCESS && state->server_side)
1300 r = ssh_packet_enable_delayed_compress(ssh);
1301 else
1302 r = 0;
1303 out:
1304 return r;
1305 }
1306
1307 /* returns non-zero if the specified packet type is usec by KEX */
1308 static int
ssh_packet_type_is_kex(u_char type)1309 ssh_packet_type_is_kex(u_char type)
1310 {
1311 return
1312 type >= SSH2_MSG_TRANSPORT_MIN &&
1313 type <= SSH2_MSG_TRANSPORT_MAX &&
1314 type != SSH2_MSG_SERVICE_REQUEST &&
1315 type != SSH2_MSG_SERVICE_ACCEPT &&
1316 type != SSH2_MSG_EXT_INFO;
1317 }
1318
1319 int
ssh_packet_send2(struct ssh * ssh)1320 ssh_packet_send2(struct ssh *ssh)
1321 {
1322 struct session_state *state = ssh->state;
1323 struct packet *p;
1324 u_char type;
1325 int r, need_rekey;
1326
1327 if (sshbuf_len(state->outgoing_packet) < 6)
1328 return SSH_ERR_INTERNAL_ERROR;
1329 type = sshbuf_ptr(state->outgoing_packet)[5];
1330 need_rekey = !ssh_packet_type_is_kex(type) &&
1331 ssh_packet_need_rekeying(ssh, sshbuf_len(state->outgoing_packet));
1332
1333 /*
1334 * During rekeying we can only send key exchange messages.
1335 * Queue everything else.
1336 */
1337 if ((need_rekey || state->rekeying) && !ssh_packet_type_is_kex(type)) {
1338 if (need_rekey)
1339 debug3_f("rekex triggered");
1340 debug("enqueue packet: %u", type);
1341 p = calloc(1, sizeof(*p));
1342 if (p == NULL)
1343 return SSH_ERR_ALLOC_FAIL;
1344 p->type = type;
1345 p->payload = state->outgoing_packet;
1346 TAILQ_INSERT_TAIL(&state->outgoing, p, next);
1347 state->outgoing_packet = sshbuf_new();
1348 if (state->outgoing_packet == NULL)
1349 return SSH_ERR_ALLOC_FAIL;
1350 if (need_rekey) {
1351 /*
1352 * This packet triggered a rekey, so send the
1353 * KEXINIT now.
1354 * NB. reenters this function via kex_start_rekex().
1355 */
1356 return kex_start_rekex(ssh);
1357 }
1358 return 0;
1359 }
1360
1361 /* rekeying starts with sending KEXINIT */
1362 if (type == SSH2_MSG_KEXINIT)
1363 state->rekeying = 1;
1364
1365 if ((r = ssh_packet_send2_wrapped(ssh)) != 0)
1366 return r;
1367
1368 /* after a NEWKEYS message we can send the complete queue */
1369 if (type == SSH2_MSG_NEWKEYS) {
1370 state->rekeying = 0;
1371 state->rekey_time = monotime();
1372 while ((p = TAILQ_FIRST(&state->outgoing))) {
1373 type = p->type;
1374 /*
1375 * If this packet triggers a rekex, then skip the
1376 * remaining packets in the queue for now.
1377 * NB. re-enters this function via kex_start_rekex.
1378 */
1379 if (ssh_packet_need_rekeying(ssh,
1380 sshbuf_len(p->payload))) {
1381 debug3_f("queued packet triggered rekex");
1382 return kex_start_rekex(ssh);
1383 }
1384 debug("dequeue packet: %u", type);
1385 sshbuf_free(state->outgoing_packet);
1386 state->outgoing_packet = p->payload;
1387 TAILQ_REMOVE(&state->outgoing, p, next);
1388 memset(p, 0, sizeof(*p));
1389 free(p);
1390 if ((r = ssh_packet_send2_wrapped(ssh)) != 0)
1391 return r;
1392 }
1393 }
1394 return 0;
1395 }
1396
1397 /*
1398 * Waits until a packet has been received, and returns its type. Note that
1399 * no other data is processed until this returns, so this function should not
1400 * be used during the interactive session.
1401 */
1402
1403 int
ssh_packet_read_seqnr(struct ssh * ssh,u_char * typep,u_int32_t * seqnr_p)1404 ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
1405 {
1406 struct session_state *state = ssh->state;
1407 int len, r, ms_remain = 0;
1408 struct pollfd pfd;
1409 char buf[8192];
1410 struct timeval start;
1411 struct timespec timespec, *timespecp = NULL;
1412
1413 DBG(debug("packet_read()"));
1414
1415 /*
1416 * Since we are blocking, ensure that all written packets have
1417 * been sent.
1418 */
1419 if ((r = ssh_packet_write_wait(ssh)) != 0)
1420 goto out;
1421
1422 /* Stay in the loop until we have received a complete packet. */
1423 for (;;) {
1424 /* Try to read a packet from the buffer. */
1425 if ((r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p)) != 0)
1426 break;
1427 /* If we got a packet, return it. */
1428 if (*typep != SSH_MSG_NONE)
1429 break;
1430 /*
1431 * Otherwise, wait for some data to arrive, add it to the
1432 * buffer, and try again.
1433 */
1434 pfd.fd = state->connection_in;
1435 pfd.events = POLLIN;
1436
1437 if (state->packet_timeout_ms > 0) {
1438 ms_remain = state->packet_timeout_ms;
1439 timespecp = ×pec;
1440 }
1441 /* Wait for some data to arrive. */
1442 for (;;) {
1443 if (state->packet_timeout_ms > 0) {
1444 ms_to_timespec(×pec, ms_remain);
1445 monotime_tv(&start);
1446 }
1447 if ((r = ppoll(&pfd, 1, timespecp, NULL)) >= 0)
1448 break;
1449 if (errno != EAGAIN && errno != EINTR) {
1450 r = SSH_ERR_SYSTEM_ERROR;
1451 goto out;
1452 }
1453 if (state->packet_timeout_ms <= 0)
1454 continue;
1455 ms_subtract_diff(&start, &ms_remain);
1456 if (ms_remain <= 0) {
1457 r = 0;
1458 break;
1459 }
1460 }
1461 if (r == 0) {
1462 r = SSH_ERR_CONN_TIMEOUT;
1463 goto out;
1464 }
1465 /* Read data from the socket. */
1466 len = read(state->connection_in, buf, sizeof(buf));
1467 if (len == 0) {
1468 r = SSH_ERR_CONN_CLOSED;
1469 goto out;
1470 }
1471 if (len == -1) {
1472 r = SSH_ERR_SYSTEM_ERROR;
1473 goto out;
1474 }
1475
1476 /* Append it to the buffer. */
1477 if ((r = ssh_packet_process_incoming(ssh, buf, len)) != 0)
1478 goto out;
1479 }
1480 out:
1481 return r;
1482 }
1483
1484 int
ssh_packet_read(struct ssh * ssh)1485 ssh_packet_read(struct ssh *ssh)
1486 {
1487 u_char type;
1488 int r;
1489
1490 if ((r = ssh_packet_read_seqnr(ssh, &type, NULL)) != 0)
1491 fatal_fr(r, "read");
1492 return type;
1493 }
1494
1495 static int
ssh_packet_read_poll2_mux(struct ssh * ssh,u_char * typep,u_int32_t * seqnr_p)1496 ssh_packet_read_poll2_mux(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
1497 {
1498 struct session_state *state = ssh->state;
1499 const u_char *cp;
1500 size_t need;
1501 int r;
1502
1503 if (ssh->kex)
1504 return SSH_ERR_INTERNAL_ERROR;
1505 *typep = SSH_MSG_NONE;
1506 cp = sshbuf_ptr(state->input);
1507 if (state->packlen == 0) {
1508 if (sshbuf_len(state->input) < 4 + 1)
1509 return 0; /* packet is incomplete */
1510 state->packlen = PEEK_U32(cp);
1511 if (state->packlen < 4 + 1 ||
1512 state->packlen > PACKET_MAX_SIZE)
1513 return SSH_ERR_MESSAGE_INCOMPLETE;
1514 }
1515 need = state->packlen + 4;
1516 if (sshbuf_len(state->input) < need)
1517 return 0; /* packet is incomplete */
1518 sshbuf_reset(state->incoming_packet);
1519 if ((r = sshbuf_put(state->incoming_packet, cp + 4,
1520 state->packlen)) != 0 ||
1521 (r = sshbuf_consume(state->input, need)) != 0 ||
1522 (r = sshbuf_get_u8(state->incoming_packet, NULL)) != 0 ||
1523 (r = sshbuf_get_u8(state->incoming_packet, typep)) != 0)
1524 return r;
1525 if (ssh_packet_log_type(*typep))
1526 debug3_f("type %u", *typep);
1527 /* sshbuf_dump(state->incoming_packet, stderr); */
1528 /* reset for next packet */
1529 state->packlen = 0;
1530 return r;
1531 }
1532
1533 int
ssh_packet_read_poll2(struct ssh * ssh,u_char * typep,u_int32_t * seqnr_p)1534 ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
1535 {
1536 struct session_state *state = ssh->state;
1537 u_int padlen, need;
1538 u_char *cp;
1539 u_int maclen, aadlen = 0, authlen = 0, block_size;
1540 struct sshenc *enc = NULL;
1541 struct sshmac *mac = NULL;
1542 struct sshcomp *comp = NULL;
1543 int r;
1544
1545 if (state->mux)
1546 return ssh_packet_read_poll2_mux(ssh, typep, seqnr_p);
1547
1548 *typep = SSH_MSG_NONE;
1549
1550 if (state->packet_discard)
1551 return 0;
1552
1553 if (state->newkeys[MODE_IN] != NULL) {
1554 enc = &state->newkeys[MODE_IN]->enc;
1555 mac = &state->newkeys[MODE_IN]->mac;
1556 comp = &state->newkeys[MODE_IN]->comp;
1557 /* disable mac for authenticated encryption */
1558 if ((authlen = cipher_authlen(enc->cipher)) != 0)
1559 mac = NULL;
1560 }
1561 maclen = mac && mac->enabled ? mac->mac_len : 0;
1562 block_size = enc ? enc->block_size : 8;
1563 aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
1564
1565 if (aadlen && state->packlen == 0) {
1566 if (cipher_get_length(state->receive_context,
1567 &state->packlen, state->p_read.seqnr,
1568 sshbuf_ptr(state->input), sshbuf_len(state->input)) != 0)
1569 return 0;
1570 if (state->packlen < 1 + 4 ||
1571 state->packlen > PACKET_MAX_SIZE) {
1572 #ifdef PACKET_DEBUG
1573 sshbuf_dump(state->input, stderr);
1574 #endif
1575 logit("Bad packet length %u.", state->packlen);
1576 if ((r = sshpkt_disconnect(ssh, "Packet corrupt")) != 0)
1577 return r;
1578 return SSH_ERR_CONN_CORRUPT;
1579 }
1580 sshbuf_reset(state->incoming_packet);
1581 } else if (state->packlen == 0) {
1582 /*
1583 * check if input size is less than the cipher block size,
1584 * decrypt first block and extract length of incoming packet
1585 */
1586 if (sshbuf_len(state->input) < block_size)
1587 return 0;
1588 sshbuf_reset(state->incoming_packet);
1589 if ((r = sshbuf_reserve(state->incoming_packet, block_size,
1590 &cp)) != 0)
1591 goto out;
1592 if ((r = cipher_crypt(state->receive_context,
1593 state->p_send.seqnr, cp, sshbuf_ptr(state->input),
1594 block_size, 0, 0)) != 0)
1595 goto out;
1596 state->packlen = PEEK_U32(sshbuf_ptr(state->incoming_packet));
1597 if (state->packlen < 1 + 4 ||
1598 state->packlen > PACKET_MAX_SIZE) {
1599 #ifdef PACKET_DEBUG
1600 fprintf(stderr, "input: \n");
1601 sshbuf_dump(state->input, stderr);
1602 fprintf(stderr, "incoming_packet: \n");
1603 sshbuf_dump(state->incoming_packet, stderr);
1604 #endif
1605 logit("Bad packet length %u.", state->packlen);
1606 return ssh_packet_start_discard(ssh, enc, mac, 0,
1607 PACKET_MAX_SIZE);
1608 }
1609 if ((r = sshbuf_consume(state->input, block_size)) != 0)
1610 goto out;
1611 }
1612 DBG(debug("input: packet len %u", state->packlen+4));
1613
1614 if (aadlen) {
1615 /* only the payload is encrypted */
1616 need = state->packlen;
1617 } else {
1618 /*
1619 * the payload size and the payload are encrypted, but we
1620 * have a partial packet of block_size bytes
1621 */
1622 need = 4 + state->packlen - block_size;
1623 }
1624 DBG(debug("partial packet: block %d, need %d, maclen %d, authlen %d,"
1625 " aadlen %d", block_size, need, maclen, authlen, aadlen));
1626 if (need % block_size != 0) {
1627 logit("padding error: need %d block %d mod %d",
1628 need, block_size, need % block_size);
1629 return ssh_packet_start_discard(ssh, enc, mac, 0,
1630 PACKET_MAX_SIZE - block_size);
1631 }
1632 /*
1633 * check if the entire packet has been received and
1634 * decrypt into incoming_packet:
1635 * 'aadlen' bytes are unencrypted, but authenticated.
1636 * 'need' bytes are encrypted, followed by either
1637 * 'authlen' bytes of authentication tag or
1638 * 'maclen' bytes of message authentication code.
1639 */
1640 if (sshbuf_len(state->input) < aadlen + need + authlen + maclen)
1641 return 0; /* packet is incomplete */
1642 #ifdef PACKET_DEBUG
1643 fprintf(stderr, "read_poll enc/full: ");
1644 sshbuf_dump(state->input, stderr);
1645 #endif
1646 /* EtM: check mac over encrypted input */
1647 if (mac && mac->enabled && mac->etm) {
1648 if ((r = mac_check(mac, state->p_read.seqnr,
1649 sshbuf_ptr(state->input), aadlen + need,
1650 sshbuf_ptr(state->input) + aadlen + need + authlen,
1651 maclen)) != 0) {
1652 if (r == SSH_ERR_MAC_INVALID)
1653 logit("Corrupted MAC on input.");
1654 goto out;
1655 }
1656 }
1657 if ((r = sshbuf_reserve(state->incoming_packet, aadlen + need,
1658 &cp)) != 0)
1659 goto out;
1660 if ((r = cipher_crypt(state->receive_context, state->p_read.seqnr, cp,
1661 sshbuf_ptr(state->input), need, aadlen, authlen)) != 0)
1662 goto out;
1663 if ((r = sshbuf_consume(state->input, aadlen + need + authlen)) != 0)
1664 goto out;
1665 if (mac && mac->enabled) {
1666 /* Not EtM: check MAC over cleartext */
1667 if (!mac->etm && (r = mac_check(mac, state->p_read.seqnr,
1668 sshbuf_ptr(state->incoming_packet),
1669 sshbuf_len(state->incoming_packet),
1670 sshbuf_ptr(state->input), maclen)) != 0) {
1671 if (r != SSH_ERR_MAC_INVALID)
1672 goto out;
1673 logit("Corrupted MAC on input.");
1674 if (need + block_size > PACKET_MAX_SIZE)
1675 return SSH_ERR_INTERNAL_ERROR;
1676 return ssh_packet_start_discard(ssh, enc, mac,
1677 sshbuf_len(state->incoming_packet),
1678 PACKET_MAX_SIZE - need - block_size);
1679 }
1680 /* Remove MAC from input buffer */
1681 DBG(debug("MAC #%d ok", state->p_read.seqnr));
1682 if ((r = sshbuf_consume(state->input, mac->mac_len)) != 0)
1683 goto out;
1684 }
1685
1686 if (seqnr_p != NULL)
1687 *seqnr_p = state->p_read.seqnr;
1688 if (++state->p_read.seqnr == 0) {
1689 if ((ssh->kex->flags & KEX_INITIAL) != 0) {
1690 ssh_packet_disconnect(ssh, "incoming sequence number "
1691 "wrapped during initial key exchange");
1692 }
1693 logit("incoming seqnr wraps around");
1694 }
1695 if (++state->p_read.packets == 0)
1696 if (!(ssh->compat & SSH_BUG_NOREKEY))
1697 return SSH_ERR_NEED_REKEY;
1698 state->p_read.blocks += (state->packlen + 4) / block_size;
1699 state->p_read.bytes += state->packlen + 4;
1700
1701 /* get padlen */
1702 padlen = sshbuf_ptr(state->incoming_packet)[4];
1703 DBG(debug("input: padlen %d", padlen));
1704 if (padlen < 4) {
1705 if ((r = sshpkt_disconnect(ssh,
1706 "Corrupted padlen %d on input.", padlen)) != 0 ||
1707 (r = ssh_packet_write_wait(ssh)) != 0)
1708 return r;
1709 return SSH_ERR_CONN_CORRUPT;
1710 }
1711
1712 /* skip packet size + padlen, discard padding */
1713 if ((r = sshbuf_consume(state->incoming_packet, 4 + 1)) != 0 ||
1714 ((r = sshbuf_consume_end(state->incoming_packet, padlen)) != 0))
1715 goto out;
1716
1717 DBG(debug("input: len before de-compress %zd",
1718 sshbuf_len(state->incoming_packet)));
1719 if (comp && comp->enabled) {
1720 sshbuf_reset(state->compression_buffer);
1721 if ((r = uncompress_buffer(ssh, state->incoming_packet,
1722 state->compression_buffer)) != 0)
1723 goto out;
1724 sshbuf_reset(state->incoming_packet);
1725 if ((r = sshbuf_putb(state->incoming_packet,
1726 state->compression_buffer)) != 0)
1727 goto out;
1728 DBG(debug("input: len after de-compress %zd",
1729 sshbuf_len(state->incoming_packet)));
1730 }
1731 /*
1732 * get packet type, implies consume.
1733 * return length of payload (without type field)
1734 */
1735 if ((r = sshbuf_get_u8(state->incoming_packet, typep)) != 0)
1736 goto out;
1737 if (ssh_packet_log_type(*typep))
1738 debug3("receive packet: type %u", *typep);
1739 if (*typep < SSH2_MSG_MIN) {
1740 if ((r = sshpkt_disconnect(ssh,
1741 "Invalid ssh2 packet type: %d", *typep)) != 0 ||
1742 (r = ssh_packet_write_wait(ssh)) != 0)
1743 return r;
1744 return SSH_ERR_PROTOCOL_ERROR;
1745 }
1746 if (state->hook_in != NULL &&
1747 (r = state->hook_in(ssh, state->incoming_packet, typep,
1748 state->hook_in_ctx)) != 0)
1749 return r;
1750 if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
1751 r = ssh_packet_enable_delayed_compress(ssh);
1752 else
1753 r = 0;
1754 #ifdef PACKET_DEBUG
1755 fprintf(stderr, "read/plain[%d]:\r\n", *typep);
1756 sshbuf_dump(state->incoming_packet, stderr);
1757 #endif
1758 /* reset for next packet */
1759 state->packlen = 0;
1760 if (*typep == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) {
1761 debug_f("resetting read seqnr %u", state->p_read.seqnr);
1762 state->p_read.seqnr = 0;
1763 }
1764
1765 if ((r = ssh_packet_check_rekey(ssh)) != 0)
1766 return r;
1767 out:
1768 return r;
1769 }
1770
1771 int
ssh_packet_read_poll_seqnr(struct ssh * ssh,u_char * typep,u_int32_t * seqnr_p)1772 ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
1773 {
1774 struct session_state *state = ssh->state;
1775 u_int reason, seqnr;
1776 int r;
1777 u_char *msg;
1778 const u_char *d;
1779 size_t len;
1780
1781 for (;;) {
1782 msg = NULL;
1783 r = ssh_packet_read_poll2(ssh, typep, seqnr_p);
1784 if (r != 0)
1785 return r;
1786 if (*typep == 0) {
1787 /* no message ready */
1788 return 0;
1789 }
1790 state->keep_alive_timeouts = 0;
1791 DBG(debug("received packet type %d", *typep));
1792
1793 /* Always process disconnect messages */
1794 if (*typep == SSH2_MSG_DISCONNECT) {
1795 if ((r = sshpkt_get_u32(ssh, &reason)) != 0 ||
1796 (r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
1797 return r;
1798 /* Ignore normal client exit notifications */
1799 do_log2(ssh->state->server_side &&
1800 reason == SSH2_DISCONNECT_BY_APPLICATION ?
1801 SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
1802 "Received disconnect from %s port %d:"
1803 "%u: %.400s", ssh_remote_ipaddr(ssh),
1804 ssh_remote_port(ssh), reason, msg);
1805 free(msg);
1806 return SSH_ERR_DISCONNECTED;
1807 }
1808
1809 /*
1810 * Do not implicitly handle any messages here during initial
1811 * KEX when in strict mode. They will be need to be allowed
1812 * explicitly by the KEX dispatch table or they will generate
1813 * protocol errors.
1814 */
1815 if (ssh->kex != NULL &&
1816 (ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict)
1817 return 0;
1818 /* Implicitly handle transport-level messages */
1819 switch (*typep) {
1820 case SSH2_MSG_IGNORE:
1821 debug3("Received SSH2_MSG_IGNORE");
1822 break;
1823 case SSH2_MSG_DEBUG:
1824 if ((r = sshpkt_get_u8(ssh, NULL)) != 0 ||
1825 (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 ||
1826 (r = sshpkt_get_string(ssh, NULL, NULL)) != 0) {
1827 free(msg);
1828 return r;
1829 }
1830 debug("Remote: %.900s", msg);
1831 free(msg);
1832 break;
1833 case SSH2_MSG_UNIMPLEMENTED:
1834 if ((r = sshpkt_get_u32(ssh, &seqnr)) != 0)
1835 return r;
1836 debug("Received SSH2_MSG_UNIMPLEMENTED for %u",
1837 seqnr);
1838 break;
1839 case SSH2_MSG_PING:
1840 if ((r = sshpkt_get_string_direct(ssh, &d, &len)) != 0)
1841 return r;
1842 DBG(debug("Received SSH2_MSG_PING len %zu", len));
1843 if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 ||
1844 (r = sshpkt_put_string(ssh, d, len)) != 0 ||
1845 (r = sshpkt_send(ssh)) != 0)
1846 return r;
1847 break;
1848 case SSH2_MSG_PONG:
1849 if ((r = sshpkt_get_string_direct(ssh,
1850 NULL, &len)) != 0)
1851 return r;
1852 DBG(debug("Received SSH2_MSG_PONG len %zu", len));
1853 break;
1854 default:
1855 return 0;
1856 }
1857 }
1858 }
1859
1860 /*
1861 * Buffers the supplied input data. This is intended to be used together
1862 * with packet_read_poll().
1863 */
1864 int
ssh_packet_process_incoming(struct ssh * ssh,const char * buf,u_int len)1865 ssh_packet_process_incoming(struct ssh *ssh, const char *buf, u_int len)
1866 {
1867 struct session_state *state = ssh->state;
1868 int r;
1869
1870 if (state->packet_discard) {
1871 state->keep_alive_timeouts = 0; /* ?? */
1872 if (len >= state->packet_discard) {
1873 if ((r = ssh_packet_stop_discard(ssh)) != 0)
1874 return r;
1875 }
1876 state->packet_discard -= len;
1877 return 0;
1878 }
1879 if ((r = sshbuf_put(state->input, buf, len)) != 0)
1880 return r;
1881
1882 return 0;
1883 }
1884
1885 /* Reads and buffers data from the specified fd */
1886 int
ssh_packet_process_read(struct ssh * ssh,int fd)1887 ssh_packet_process_read(struct ssh *ssh, int fd)
1888 {
1889 struct session_state *state = ssh->state;
1890 int r;
1891 size_t rlen;
1892
1893 if ((r = sshbuf_read(fd, state->input, PACKET_MAX_SIZE, &rlen)) != 0)
1894 return r;
1895
1896 if (state->packet_discard) {
1897 if ((r = sshbuf_consume_end(state->input, rlen)) != 0)
1898 return r;
1899 state->keep_alive_timeouts = 0; /* ?? */
1900 if (rlen >= state->packet_discard) {
1901 if ((r = ssh_packet_stop_discard(ssh)) != 0)
1902 return r;
1903 }
1904 state->packet_discard -= rlen;
1905 return 0;
1906 }
1907 return 0;
1908 }
1909
1910 int
ssh_packet_remaining(struct ssh * ssh)1911 ssh_packet_remaining(struct ssh *ssh)
1912 {
1913 return sshbuf_len(ssh->state->incoming_packet);
1914 }
1915
1916 /*
1917 * Sends a diagnostic message from the server to the client. This message
1918 * can be sent at any time (but not while constructing another message). The
1919 * message is printed immediately, but only if the client is being executed
1920 * in verbose mode. These messages are primarily intended to ease debugging
1921 * authentication problems. The length of the formatted message must not
1922 * exceed 1024 bytes. This will automatically call ssh_packet_write_wait.
1923 */
1924 void
ssh_packet_send_debug(struct ssh * ssh,const char * fmt,...)1925 ssh_packet_send_debug(struct ssh *ssh, const char *fmt,...)
1926 {
1927 char buf[1024];
1928 va_list args;
1929 int r;
1930
1931 if ((ssh->compat & SSH_BUG_DEBUG))
1932 return;
1933
1934 va_start(args, fmt);
1935 vsnprintf(buf, sizeof(buf), fmt, args);
1936 va_end(args);
1937
1938 debug3("sending debug message: %s", buf);
1939
1940 if ((r = sshpkt_start(ssh, SSH2_MSG_DEBUG)) != 0 ||
1941 (r = sshpkt_put_u8(ssh, 0)) != 0 || /* always display */
1942 (r = sshpkt_put_cstring(ssh, buf)) != 0 ||
1943 (r = sshpkt_put_cstring(ssh, "")) != 0 ||
1944 (r = sshpkt_send(ssh)) != 0 ||
1945 (r = ssh_packet_write_wait(ssh)) != 0)
1946 fatal_fr(r, "send DEBUG");
1947 }
1948
1949 void
sshpkt_fmt_connection_id(struct ssh * ssh,char * s,size_t l)1950 sshpkt_fmt_connection_id(struct ssh *ssh, char *s, size_t l)
1951 {
1952 snprintf(s, l, "%.200s%s%s port %d",
1953 ssh->log_preamble ? ssh->log_preamble : "",
1954 ssh->log_preamble ? " " : "",
1955 ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
1956 }
1957
1958 /*
1959 * Pretty-print connection-terminating errors and exit.
1960 */
1961 static void
sshpkt_vfatal(struct ssh * ssh,int r,const char * fmt,va_list ap)1962 sshpkt_vfatal(struct ssh *ssh, int r, const char *fmt, va_list ap)
1963 {
1964 char *tag = NULL, remote_id[512];
1965 int oerrno = errno;
1966
1967 sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
1968
1969 switch (r) {
1970 case SSH_ERR_CONN_CLOSED:
1971 ssh_packet_clear_keys(ssh);
1972 logdie("Connection closed by %s", remote_id);
1973 case SSH_ERR_CONN_TIMEOUT:
1974 ssh_packet_clear_keys(ssh);
1975 logdie("Connection %s %s timed out",
1976 ssh->state->server_side ? "from" : "to", remote_id);
1977 case SSH_ERR_DISCONNECTED:
1978 ssh_packet_clear_keys(ssh);
1979 logdie("Disconnected from %s", remote_id);
1980 case SSH_ERR_SYSTEM_ERROR:
1981 if (errno == ECONNRESET) {
1982 ssh_packet_clear_keys(ssh);
1983 logdie("Connection reset by %s", remote_id);
1984 }
1985 /* FALLTHROUGH */
1986 case SSH_ERR_NO_CIPHER_ALG_MATCH:
1987 case SSH_ERR_NO_MAC_ALG_MATCH:
1988 case SSH_ERR_NO_COMPRESS_ALG_MATCH:
1989 case SSH_ERR_NO_KEX_ALG_MATCH:
1990 case SSH_ERR_NO_HOSTKEY_ALG_MATCH:
1991 if (ssh->kex && ssh->kex->failed_choice) {
1992 ssh_packet_clear_keys(ssh);
1993 errno = oerrno;
1994 logdie("Unable to negotiate with %s: %s. "
1995 "Their offer: %s", remote_id, ssh_err(r),
1996 ssh->kex->failed_choice);
1997 }
1998 /* FALLTHROUGH */
1999 default:
2000 if (vasprintf(&tag, fmt, ap) == -1) {
2001 ssh_packet_clear_keys(ssh);
2002 logdie_f("could not allocate failure message");
2003 }
2004 ssh_packet_clear_keys(ssh);
2005 errno = oerrno;
2006 logdie_r(r, "%s%sConnection %s %s",
2007 tag != NULL ? tag : "", tag != NULL ? ": " : "",
2008 ssh->state->server_side ? "from" : "to", remote_id);
2009 }
2010 }
2011
2012 void
sshpkt_fatal(struct ssh * ssh,int r,const char * fmt,...)2013 sshpkt_fatal(struct ssh *ssh, int r, const char *fmt, ...)
2014 {
2015 va_list ap;
2016
2017 va_start(ap, fmt);
2018 sshpkt_vfatal(ssh, r, fmt, ap);
2019 /* NOTREACHED */
2020 va_end(ap);
2021 logdie_f("should have exited");
2022 }
2023
2024 /*
2025 * Logs the error plus constructs and sends a disconnect packet, closes the
2026 * connection, and exits. This function never returns. The error message
2027 * should not contain a newline. The length of the formatted message must
2028 * not exceed 1024 bytes.
2029 */
2030 void
ssh_packet_disconnect(struct ssh * ssh,const char * fmt,...)2031 ssh_packet_disconnect(struct ssh *ssh, const char *fmt,...)
2032 {
2033 char buf[1024], remote_id[512];
2034 va_list args;
2035 static int disconnecting = 0;
2036 int r;
2037
2038 if (disconnecting) /* Guard against recursive invocations. */
2039 fatal("packet_disconnect called recursively.");
2040 disconnecting = 1;
2041
2042 /*
2043 * Format the message. Note that the caller must make sure the
2044 * message is of limited size.
2045 */
2046 sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
2047 va_start(args, fmt);
2048 vsnprintf(buf, sizeof(buf), fmt, args);
2049 va_end(args);
2050
2051 /* Display the error locally */
2052 logit("Disconnecting %s: %.100s", remote_id, buf);
2053
2054 /*
2055 * Send the disconnect message to the other side, and wait
2056 * for it to get sent.
2057 */
2058 if ((r = sshpkt_disconnect(ssh, "%s", buf)) != 0)
2059 sshpkt_fatal(ssh, r, "%s", __func__);
2060
2061 if ((r = ssh_packet_write_wait(ssh)) != 0)
2062 sshpkt_fatal(ssh, r, "%s", __func__);
2063
2064 /* Close the connection. */
2065 ssh_packet_close(ssh);
2066 cleanup_exit(255);
2067 }
2068
2069 /*
2070 * Checks if there is any buffered output, and tries to write some of
2071 * the output.
2072 */
2073 int
ssh_packet_write_poll(struct ssh * ssh)2074 ssh_packet_write_poll(struct ssh *ssh)
2075 {
2076 struct session_state *state = ssh->state;
2077 int len = sshbuf_len(state->output);
2078 int r;
2079
2080 if (len > 0) {
2081 len = write(state->connection_out,
2082 sshbuf_ptr(state->output), len);
2083 if (len == -1) {
2084 if (errno == EINTR || errno == EAGAIN)
2085 return 0;
2086 return SSH_ERR_SYSTEM_ERROR;
2087 }
2088 if (len == 0)
2089 return SSH_ERR_CONN_CLOSED;
2090 if ((r = sshbuf_consume(state->output, len)) != 0)
2091 return r;
2092 }
2093 return 0;
2094 }
2095
2096 /*
2097 * Calls packet_write_poll repeatedly until all pending output data has been
2098 * written.
2099 */
2100 int
ssh_packet_write_wait(struct ssh * ssh)2101 ssh_packet_write_wait(struct ssh *ssh)
2102 {
2103 int ret, r, ms_remain = 0;
2104 struct timeval start;
2105 struct timespec timespec, *timespecp = NULL;
2106 struct session_state *state = ssh->state;
2107 struct pollfd pfd;
2108
2109 if ((r = ssh_packet_write_poll(ssh)) != 0)
2110 return r;
2111 while (ssh_packet_have_data_to_write(ssh)) {
2112 pfd.fd = state->connection_out;
2113 pfd.events = POLLOUT;
2114
2115 if (state->packet_timeout_ms > 0) {
2116 ms_remain = state->packet_timeout_ms;
2117 timespecp = ×pec;
2118 }
2119 for (;;) {
2120 if (state->packet_timeout_ms > 0) {
2121 ms_to_timespec(×pec, ms_remain);
2122 monotime_tv(&start);
2123 }
2124 if ((ret = ppoll(&pfd, 1, timespecp, NULL)) >= 0)
2125 break;
2126 if (errno != EAGAIN && errno != EINTR)
2127 break;
2128 if (state->packet_timeout_ms <= 0)
2129 continue;
2130 ms_subtract_diff(&start, &ms_remain);
2131 if (ms_remain <= 0) {
2132 ret = 0;
2133 break;
2134 }
2135 }
2136 if (ret == 0)
2137 return SSH_ERR_CONN_TIMEOUT;
2138 if ((r = ssh_packet_write_poll(ssh)) != 0)
2139 return r;
2140 }
2141 return 0;
2142 }
2143
2144 /* Returns true if there is buffered data to write to the connection. */
2145
2146 int
ssh_packet_have_data_to_write(struct ssh * ssh)2147 ssh_packet_have_data_to_write(struct ssh *ssh)
2148 {
2149 return sshbuf_len(ssh->state->output) != 0;
2150 }
2151
2152 /* Returns true if there is not too much data to write to the connection. */
2153
2154 int
ssh_packet_not_very_much_data_to_write(struct ssh * ssh)2155 ssh_packet_not_very_much_data_to_write(struct ssh *ssh)
2156 {
2157 if (ssh->state->interactive_mode)
2158 return sshbuf_len(ssh->state->output) < 16384;
2159 else
2160 return sshbuf_len(ssh->state->output) < 128 * 1024;
2161 }
2162
2163 /*
2164 * returns true when there are at most a few keystrokes of data to write
2165 * and the connection is in interactive mode.
2166 */
2167
2168 int
ssh_packet_interactive_data_to_write(struct ssh * ssh)2169 ssh_packet_interactive_data_to_write(struct ssh *ssh)
2170 {
2171 return ssh->state->interactive_mode &&
2172 sshbuf_len(ssh->state->output) < 256;
2173 }
2174
2175 void
ssh_packet_set_tos(struct ssh * ssh,int tos)2176 ssh_packet_set_tos(struct ssh *ssh, int tos)
2177 {
2178 if (!ssh_packet_connection_is_on_socket(ssh) || tos == INT_MAX)
2179 return;
2180 set_sock_tos(ssh->state->connection_in, tos);
2181 }
2182
2183 /* Informs that the current session is interactive. Sets IP flags for that. */
2184
2185 void
ssh_packet_set_interactive(struct ssh * ssh,int interactive,int qos_interactive,int qos_bulk)2186 ssh_packet_set_interactive(struct ssh *ssh, int interactive, int qos_interactive, int qos_bulk)
2187 {
2188 struct session_state *state = ssh->state;
2189
2190 if (state->set_interactive_called)
2191 return;
2192 state->set_interactive_called = 1;
2193
2194 /* Record that we are in interactive mode. */
2195 state->interactive_mode = interactive;
2196
2197 /* Only set socket options if using a socket. */
2198 if (!ssh_packet_connection_is_on_socket(ssh))
2199 return;
2200 set_nodelay(state->connection_in);
2201 ssh_packet_set_tos(ssh, interactive ? qos_interactive : qos_bulk);
2202 }
2203
2204 /* Returns true if the current connection is interactive. */
2205
2206 int
ssh_packet_is_interactive(struct ssh * ssh)2207 ssh_packet_is_interactive(struct ssh *ssh)
2208 {
2209 return ssh->state->interactive_mode;
2210 }
2211
2212 int
ssh_packet_set_maxsize(struct ssh * ssh,u_int s)2213 ssh_packet_set_maxsize(struct ssh *ssh, u_int s)
2214 {
2215 struct session_state *state = ssh->state;
2216
2217 if (state->set_maxsize_called) {
2218 logit_f("called twice: old %d new %d",
2219 state->max_packet_size, s);
2220 return -1;
2221 }
2222 if (s < 4 * 1024 || s > 1024 * 1024) {
2223 logit_f("bad size %d", s);
2224 return -1;
2225 }
2226 state->set_maxsize_called = 1;
2227 debug_f("setting to %d", s);
2228 state->max_packet_size = s;
2229 return s;
2230 }
2231
2232 int
ssh_packet_inc_alive_timeouts(struct ssh * ssh)2233 ssh_packet_inc_alive_timeouts(struct ssh *ssh)
2234 {
2235 return ++ssh->state->keep_alive_timeouts;
2236 }
2237
2238 void
ssh_packet_set_alive_timeouts(struct ssh * ssh,int ka)2239 ssh_packet_set_alive_timeouts(struct ssh *ssh, int ka)
2240 {
2241 ssh->state->keep_alive_timeouts = ka;
2242 }
2243
2244 u_int
ssh_packet_get_maxsize(struct ssh * ssh)2245 ssh_packet_get_maxsize(struct ssh *ssh)
2246 {
2247 return ssh->state->max_packet_size;
2248 }
2249
2250 void
ssh_packet_set_rekey_limits(struct ssh * ssh,u_int64_t bytes,u_int32_t seconds)2251 ssh_packet_set_rekey_limits(struct ssh *ssh, u_int64_t bytes, u_int32_t seconds)
2252 {
2253 debug3("rekey after %llu bytes, %u seconds", (unsigned long long)bytes,
2254 (unsigned int)seconds);
2255 ssh->state->rekey_limit = bytes;
2256 ssh->state->rekey_interval = seconds;
2257 }
2258
2259 time_t
ssh_packet_get_rekey_timeout(struct ssh * ssh)2260 ssh_packet_get_rekey_timeout(struct ssh *ssh)
2261 {
2262 time_t seconds;
2263
2264 seconds = ssh->state->rekey_time + ssh->state->rekey_interval -
2265 monotime();
2266 return (seconds <= 0 ? 1 : seconds);
2267 }
2268
2269 void
ssh_packet_set_server(struct ssh * ssh)2270 ssh_packet_set_server(struct ssh *ssh)
2271 {
2272 ssh->state->server_side = 1;
2273 ssh->kex->server = 1; /* XXX unify? */
2274 }
2275
2276 void
ssh_packet_set_authenticated(struct ssh * ssh)2277 ssh_packet_set_authenticated(struct ssh *ssh)
2278 {
2279 ssh->state->after_authentication = 1;
2280 }
2281
2282 void *
ssh_packet_get_input(struct ssh * ssh)2283 ssh_packet_get_input(struct ssh *ssh)
2284 {
2285 return (void *)ssh->state->input;
2286 }
2287
2288 void *
ssh_packet_get_output(struct ssh * ssh)2289 ssh_packet_get_output(struct ssh *ssh)
2290 {
2291 return (void *)ssh->state->output;
2292 }
2293
2294 /* Reset after_authentication and reset compression in post-auth privsep */
2295 static int
ssh_packet_set_postauth(struct ssh * ssh)2296 ssh_packet_set_postauth(struct ssh *ssh)
2297 {
2298 int r;
2299
2300 debug_f("called");
2301 /* This was set in net child, but is not visible in user child */
2302 ssh->state->after_authentication = 1;
2303 ssh->state->rekeying = 0;
2304 if ((r = ssh_packet_enable_delayed_compress(ssh)) != 0)
2305 return r;
2306 return 0;
2307 }
2308
2309 /* Packet state (de-)serialization for privsep */
2310
2311 /* turn kex into a blob for packet state serialization */
2312 static int
kex_to_blob(struct sshbuf * m,struct kex * kex)2313 kex_to_blob(struct sshbuf *m, struct kex *kex)
2314 {
2315 int r;
2316
2317 if ((r = sshbuf_put_u32(m, kex->we_need)) != 0 ||
2318 (r = sshbuf_put_cstring(m, kex->hostkey_alg)) != 0 ||
2319 (r = sshbuf_put_u32(m, kex->hostkey_type)) != 0 ||
2320 (r = sshbuf_put_u32(m, kex->hostkey_nid)) != 0 ||
2321 (r = sshbuf_put_u32(m, kex->kex_type)) != 0 ||
2322 (r = sshbuf_put_u32(m, kex->kex_strict)) != 0 ||
2323 (r = sshbuf_put_stringb(m, kex->my)) != 0 ||
2324 (r = sshbuf_put_stringb(m, kex->peer)) != 0 ||
2325 (r = sshbuf_put_stringb(m, kex->client_version)) != 0 ||
2326 (r = sshbuf_put_stringb(m, kex->server_version)) != 0 ||
2327 (r = sshbuf_put_stringb(m, kex->session_id)) != 0 ||
2328 (r = sshbuf_put_u32(m, kex->flags)) != 0)
2329 return r;
2330 return 0;
2331 }
2332
2333 /* turn key exchange results into a blob for packet state serialization */
2334 static int
newkeys_to_blob(struct sshbuf * m,struct ssh * ssh,int mode)2335 newkeys_to_blob(struct sshbuf *m, struct ssh *ssh, int mode)
2336 {
2337 struct sshbuf *b;
2338 struct sshcipher_ctx *cc;
2339 struct sshcomp *comp;
2340 struct sshenc *enc;
2341 struct sshmac *mac;
2342 struct newkeys *newkey;
2343 int r;
2344
2345 if ((newkey = ssh->state->newkeys[mode]) == NULL)
2346 return SSH_ERR_INTERNAL_ERROR;
2347 enc = &newkey->enc;
2348 mac = &newkey->mac;
2349 comp = &newkey->comp;
2350 cc = (mode == MODE_OUT) ? ssh->state->send_context :
2351 ssh->state->receive_context;
2352 if ((r = cipher_get_keyiv(cc, enc->iv, enc->iv_len)) != 0)
2353 return r;
2354 if ((b = sshbuf_new()) == NULL)
2355 return SSH_ERR_ALLOC_FAIL;
2356 if ((r = sshbuf_put_cstring(b, enc->name)) != 0 ||
2357 (r = sshbuf_put_u32(b, enc->enabled)) != 0 ||
2358 (r = sshbuf_put_u32(b, enc->block_size)) != 0 ||
2359 (r = sshbuf_put_string(b, enc->key, enc->key_len)) != 0 ||
2360 (r = sshbuf_put_string(b, enc->iv, enc->iv_len)) != 0)
2361 goto out;
2362 if (cipher_authlen(enc->cipher) == 0) {
2363 if ((r = sshbuf_put_cstring(b, mac->name)) != 0 ||
2364 (r = sshbuf_put_u32(b, mac->enabled)) != 0 ||
2365 (r = sshbuf_put_string(b, mac->key, mac->key_len)) != 0)
2366 goto out;
2367 }
2368 if ((r = sshbuf_put_u32(b, comp->type)) != 0 ||
2369 (r = sshbuf_put_cstring(b, comp->name)) != 0)
2370 goto out;
2371 r = sshbuf_put_stringb(m, b);
2372 out:
2373 sshbuf_free(b);
2374 return r;
2375 }
2376
2377 /* serialize packet state into a blob */
2378 int
ssh_packet_get_state(struct ssh * ssh,struct sshbuf * m)2379 ssh_packet_get_state(struct ssh *ssh, struct sshbuf *m)
2380 {
2381 struct session_state *state = ssh->state;
2382 int r;
2383
2384 if ((r = kex_to_blob(m, ssh->kex)) != 0 ||
2385 (r = newkeys_to_blob(m, ssh, MODE_OUT)) != 0 ||
2386 (r = newkeys_to_blob(m, ssh, MODE_IN)) != 0 ||
2387 (r = sshbuf_put_u64(m, state->rekey_limit)) != 0 ||
2388 (r = sshbuf_put_u32(m, state->rekey_interval)) != 0 ||
2389 (r = sshbuf_put_u32(m, state->p_send.seqnr)) != 0 ||
2390 (r = sshbuf_put_u64(m, state->p_send.blocks)) != 0 ||
2391 (r = sshbuf_put_u32(m, state->p_send.packets)) != 0 ||
2392 (r = sshbuf_put_u64(m, state->p_send.bytes)) != 0 ||
2393 (r = sshbuf_put_u32(m, state->p_read.seqnr)) != 0 ||
2394 (r = sshbuf_put_u64(m, state->p_read.blocks)) != 0 ||
2395 (r = sshbuf_put_u32(m, state->p_read.packets)) != 0 ||
2396 (r = sshbuf_put_u64(m, state->p_read.bytes)) != 0 ||
2397 (r = sshbuf_put_stringb(m, state->input)) != 0 ||
2398 (r = sshbuf_put_stringb(m, state->output)) != 0)
2399 return r;
2400
2401 return 0;
2402 }
2403
2404 /* restore key exchange results from blob for packet state de-serialization */
2405 static int
newkeys_from_blob(struct sshbuf * m,struct ssh * ssh,int mode)2406 newkeys_from_blob(struct sshbuf *m, struct ssh *ssh, int mode)
2407 {
2408 struct sshbuf *b = NULL;
2409 struct sshcomp *comp;
2410 struct sshenc *enc;
2411 struct sshmac *mac;
2412 struct newkeys *newkey = NULL;
2413 size_t keylen, ivlen, maclen;
2414 int r;
2415
2416 if ((newkey = calloc(1, sizeof(*newkey))) == NULL) {
2417 r = SSH_ERR_ALLOC_FAIL;
2418 goto out;
2419 }
2420 if ((r = sshbuf_froms(m, &b)) != 0)
2421 goto out;
2422 #ifdef DEBUG_PK
2423 sshbuf_dump(b, stderr);
2424 #endif
2425 enc = &newkey->enc;
2426 mac = &newkey->mac;
2427 comp = &newkey->comp;
2428
2429 if ((r = sshbuf_get_cstring(b, &enc->name, NULL)) != 0 ||
2430 (r = sshbuf_get_u32(b, (u_int *)&enc->enabled)) != 0 ||
2431 (r = sshbuf_get_u32(b, &enc->block_size)) != 0 ||
2432 (r = sshbuf_get_string(b, &enc->key, &keylen)) != 0 ||
2433 (r = sshbuf_get_string(b, &enc->iv, &ivlen)) != 0)
2434 goto out;
2435 if ((enc->cipher = cipher_by_name(enc->name)) == NULL) {
2436 r = SSH_ERR_INVALID_FORMAT;
2437 goto out;
2438 }
2439 if (cipher_authlen(enc->cipher) == 0) {
2440 if ((r = sshbuf_get_cstring(b, &mac->name, NULL)) != 0)
2441 goto out;
2442 if ((r = mac_setup(mac, mac->name)) != 0)
2443 goto out;
2444 if ((r = sshbuf_get_u32(b, (u_int *)&mac->enabled)) != 0 ||
2445 (r = sshbuf_get_string(b, &mac->key, &maclen)) != 0)
2446 goto out;
2447 if (maclen > mac->key_len) {
2448 r = SSH_ERR_INVALID_FORMAT;
2449 goto out;
2450 }
2451 mac->key_len = maclen;
2452 }
2453 if ((r = sshbuf_get_u32(b, &comp->type)) != 0 ||
2454 (r = sshbuf_get_cstring(b, &comp->name, NULL)) != 0)
2455 goto out;
2456 if (sshbuf_len(b) != 0) {
2457 r = SSH_ERR_INVALID_FORMAT;
2458 goto out;
2459 }
2460 enc->key_len = keylen;
2461 enc->iv_len = ivlen;
2462 ssh->kex->newkeys[mode] = newkey;
2463 newkey = NULL;
2464 r = 0;
2465 out:
2466 free(newkey);
2467 sshbuf_free(b);
2468 return r;
2469 }
2470
2471 /* restore kex from blob for packet state de-serialization */
2472 static int
kex_from_blob(struct sshbuf * m,struct kex ** kexp)2473 kex_from_blob(struct sshbuf *m, struct kex **kexp)
2474 {
2475 struct kex *kex;
2476 int r;
2477
2478 if ((kex = kex_new()) == NULL)
2479 return SSH_ERR_ALLOC_FAIL;
2480 if ((r = sshbuf_get_u32(m, &kex->we_need)) != 0 ||
2481 (r = sshbuf_get_cstring(m, &kex->hostkey_alg, NULL)) != 0 ||
2482 (r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_type)) != 0 ||
2483 (r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_nid)) != 0 ||
2484 (r = sshbuf_get_u32(m, &kex->kex_type)) != 0 ||
2485 (r = sshbuf_get_u32(m, &kex->kex_strict)) != 0 ||
2486 (r = sshbuf_get_stringb(m, kex->my)) != 0 ||
2487 (r = sshbuf_get_stringb(m, kex->peer)) != 0 ||
2488 (r = sshbuf_get_stringb(m, kex->client_version)) != 0 ||
2489 (r = sshbuf_get_stringb(m, kex->server_version)) != 0 ||
2490 (r = sshbuf_get_stringb(m, kex->session_id)) != 0 ||
2491 (r = sshbuf_get_u32(m, &kex->flags)) != 0)
2492 goto out;
2493 kex->server = 1;
2494 kex->done = 1;
2495 r = 0;
2496 out:
2497 if (r != 0 || kexp == NULL) {
2498 kex_free(kex);
2499 if (kexp != NULL)
2500 *kexp = NULL;
2501 } else {
2502 kex_free(*kexp);
2503 *kexp = kex;
2504 }
2505 return r;
2506 }
2507
2508 /*
2509 * Restore packet state from content of blob 'm' (de-serialization).
2510 * Note that 'm' will be partially consumed on parsing or any other errors.
2511 */
2512 int
ssh_packet_set_state(struct ssh * ssh,struct sshbuf * m)2513 ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m)
2514 {
2515 struct session_state *state = ssh->state;
2516 const u_char *input, *output;
2517 size_t ilen, olen;
2518 int r;
2519
2520 if ((r = kex_from_blob(m, &ssh->kex)) != 0 ||
2521 (r = newkeys_from_blob(m, ssh, MODE_OUT)) != 0 ||
2522 (r = newkeys_from_blob(m, ssh, MODE_IN)) != 0 ||
2523 (r = sshbuf_get_u64(m, &state->rekey_limit)) != 0 ||
2524 (r = sshbuf_get_u32(m, &state->rekey_interval)) != 0 ||
2525 (r = sshbuf_get_u32(m, &state->p_send.seqnr)) != 0 ||
2526 (r = sshbuf_get_u64(m, &state->p_send.blocks)) != 0 ||
2527 (r = sshbuf_get_u32(m, &state->p_send.packets)) != 0 ||
2528 (r = sshbuf_get_u64(m, &state->p_send.bytes)) != 0 ||
2529 (r = sshbuf_get_u32(m, &state->p_read.seqnr)) != 0 ||
2530 (r = sshbuf_get_u64(m, &state->p_read.blocks)) != 0 ||
2531 (r = sshbuf_get_u32(m, &state->p_read.packets)) != 0 ||
2532 (r = sshbuf_get_u64(m, &state->p_read.bytes)) != 0)
2533 return r;
2534 /*
2535 * We set the time here so that in post-auth privsep child we
2536 * count from the completion of the authentication.
2537 */
2538 state->rekey_time = monotime();
2539 /* XXX ssh_set_newkeys overrides p_read.packets? XXX */
2540 if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0 ||
2541 (r = ssh_set_newkeys(ssh, MODE_OUT)) != 0)
2542 return r;
2543
2544 if ((r = ssh_packet_set_postauth(ssh)) != 0)
2545 return r;
2546
2547 sshbuf_reset(state->input);
2548 sshbuf_reset(state->output);
2549 if ((r = sshbuf_get_string_direct(m, &input, &ilen)) != 0 ||
2550 (r = sshbuf_get_string_direct(m, &output, &olen)) != 0 ||
2551 (r = sshbuf_put(state->input, input, ilen)) != 0 ||
2552 (r = sshbuf_put(state->output, output, olen)) != 0)
2553 return r;
2554
2555 if (sshbuf_len(m))
2556 return SSH_ERR_INVALID_FORMAT;
2557 debug3_f("done");
2558 return 0;
2559 }
2560
2561 /* NEW API */
2562
2563 /* put data to the outgoing packet */
2564
2565 int
sshpkt_put(struct ssh * ssh,const void * v,size_t len)2566 sshpkt_put(struct ssh *ssh, const void *v, size_t len)
2567 {
2568 return sshbuf_put(ssh->state->outgoing_packet, v, len);
2569 }
2570
2571 int
sshpkt_putb(struct ssh * ssh,const struct sshbuf * b)2572 sshpkt_putb(struct ssh *ssh, const struct sshbuf *b)
2573 {
2574 return sshbuf_putb(ssh->state->outgoing_packet, b);
2575 }
2576
2577 int
sshpkt_put_u8(struct ssh * ssh,u_char val)2578 sshpkt_put_u8(struct ssh *ssh, u_char val)
2579 {
2580 return sshbuf_put_u8(ssh->state->outgoing_packet, val);
2581 }
2582
2583 int
sshpkt_put_u32(struct ssh * ssh,u_int32_t val)2584 sshpkt_put_u32(struct ssh *ssh, u_int32_t val)
2585 {
2586 return sshbuf_put_u32(ssh->state->outgoing_packet, val);
2587 }
2588
2589 int
sshpkt_put_u64(struct ssh * ssh,u_int64_t val)2590 sshpkt_put_u64(struct ssh *ssh, u_int64_t val)
2591 {
2592 return sshbuf_put_u64(ssh->state->outgoing_packet, val);
2593 }
2594
2595 int
sshpkt_put_string(struct ssh * ssh,const void * v,size_t len)2596 sshpkt_put_string(struct ssh *ssh, const void *v, size_t len)
2597 {
2598 return sshbuf_put_string(ssh->state->outgoing_packet, v, len);
2599 }
2600
2601 int
sshpkt_put_cstring(struct ssh * ssh,const void * v)2602 sshpkt_put_cstring(struct ssh *ssh, const void *v)
2603 {
2604 return sshbuf_put_cstring(ssh->state->outgoing_packet, v);
2605 }
2606
2607 int
sshpkt_put_stringb(struct ssh * ssh,const struct sshbuf * v)2608 sshpkt_put_stringb(struct ssh *ssh, const struct sshbuf *v)
2609 {
2610 return sshbuf_put_stringb(ssh->state->outgoing_packet, v);
2611 }
2612
2613 #ifdef WITH_OPENSSL
2614 int
sshpkt_put_ec(struct ssh * ssh,const EC_POINT * v,const EC_GROUP * g)2615 sshpkt_put_ec(struct ssh *ssh, const EC_POINT *v, const EC_GROUP *g)
2616 {
2617 return sshbuf_put_ec(ssh->state->outgoing_packet, v, g);
2618 }
2619
2620
2621 int
sshpkt_put_bignum2(struct ssh * ssh,const BIGNUM * v)2622 sshpkt_put_bignum2(struct ssh *ssh, const BIGNUM *v)
2623 {
2624 return sshbuf_put_bignum2(ssh->state->outgoing_packet, v);
2625 }
2626 #endif /* WITH_OPENSSL */
2627
2628 /* fetch data from the incoming packet */
2629
2630 int
sshpkt_get(struct ssh * ssh,void * valp,size_t len)2631 sshpkt_get(struct ssh *ssh, void *valp, size_t len)
2632 {
2633 return sshbuf_get(ssh->state->incoming_packet, valp, len);
2634 }
2635
2636 int
sshpkt_get_u8(struct ssh * ssh,u_char * valp)2637 sshpkt_get_u8(struct ssh *ssh, u_char *valp)
2638 {
2639 return sshbuf_get_u8(ssh->state->incoming_packet, valp);
2640 }
2641
2642 int
sshpkt_get_u32(struct ssh * ssh,u_int32_t * valp)2643 sshpkt_get_u32(struct ssh *ssh, u_int32_t *valp)
2644 {
2645 return sshbuf_get_u32(ssh->state->incoming_packet, valp);
2646 }
2647
2648 int
sshpkt_get_u64(struct ssh * ssh,u_int64_t * valp)2649 sshpkt_get_u64(struct ssh *ssh, u_int64_t *valp)
2650 {
2651 return sshbuf_get_u64(ssh->state->incoming_packet, valp);
2652 }
2653
2654 int
sshpkt_get_string(struct ssh * ssh,u_char ** valp,size_t * lenp)2655 sshpkt_get_string(struct ssh *ssh, u_char **valp, size_t *lenp)
2656 {
2657 return sshbuf_get_string(ssh->state->incoming_packet, valp, lenp);
2658 }
2659
2660 int
sshpkt_get_string_direct(struct ssh * ssh,const u_char ** valp,size_t * lenp)2661 sshpkt_get_string_direct(struct ssh *ssh, const u_char **valp, size_t *lenp)
2662 {
2663 return sshbuf_get_string_direct(ssh->state->incoming_packet, valp, lenp);
2664 }
2665
2666 int
sshpkt_peek_string_direct(struct ssh * ssh,const u_char ** valp,size_t * lenp)2667 sshpkt_peek_string_direct(struct ssh *ssh, const u_char **valp, size_t *lenp)
2668 {
2669 return sshbuf_peek_string_direct(ssh->state->incoming_packet, valp, lenp);
2670 }
2671
2672 int
sshpkt_get_cstring(struct ssh * ssh,char ** valp,size_t * lenp)2673 sshpkt_get_cstring(struct ssh *ssh, char **valp, size_t *lenp)
2674 {
2675 return sshbuf_get_cstring(ssh->state->incoming_packet, valp, lenp);
2676 }
2677
2678 int
sshpkt_getb_froms(struct ssh * ssh,struct sshbuf ** valp)2679 sshpkt_getb_froms(struct ssh *ssh, struct sshbuf **valp)
2680 {
2681 return sshbuf_froms(ssh->state->incoming_packet, valp);
2682 }
2683
2684 #ifdef WITH_OPENSSL
2685 int
sshpkt_get_ec(struct ssh * ssh,EC_POINT * v,const EC_GROUP * g)2686 sshpkt_get_ec(struct ssh *ssh, EC_POINT *v, const EC_GROUP *g)
2687 {
2688 return sshbuf_get_ec(ssh->state->incoming_packet, v, g);
2689 }
2690
2691 int
sshpkt_get_bignum2(struct ssh * ssh,BIGNUM ** valp)2692 sshpkt_get_bignum2(struct ssh *ssh, BIGNUM **valp)
2693 {
2694 return sshbuf_get_bignum2(ssh->state->incoming_packet, valp);
2695 }
2696 #endif /* WITH_OPENSSL */
2697
2698 int
sshpkt_get_end(struct ssh * ssh)2699 sshpkt_get_end(struct ssh *ssh)
2700 {
2701 if (sshbuf_len(ssh->state->incoming_packet) > 0)
2702 return SSH_ERR_UNEXPECTED_TRAILING_DATA;
2703 return 0;
2704 }
2705
2706 const u_char *
sshpkt_ptr(struct ssh * ssh,size_t * lenp)2707 sshpkt_ptr(struct ssh *ssh, size_t *lenp)
2708 {
2709 if (lenp != NULL)
2710 *lenp = sshbuf_len(ssh->state->incoming_packet);
2711 return sshbuf_ptr(ssh->state->incoming_packet);
2712 }
2713
2714 /* start a new packet */
2715
2716 int
sshpkt_start(struct ssh * ssh,u_char type)2717 sshpkt_start(struct ssh *ssh, u_char type)
2718 {
2719 u_char buf[6]; /* u32 packet length, u8 pad len, u8 type */
2720
2721 DBG(debug("packet_start[%d]", type));
2722 memset(buf, 0, sizeof(buf));
2723 buf[sizeof(buf) - 1] = type;
2724 sshbuf_reset(ssh->state->outgoing_packet);
2725 return sshbuf_put(ssh->state->outgoing_packet, buf, sizeof(buf));
2726 }
2727
2728 static int
ssh_packet_send_mux(struct ssh * ssh)2729 ssh_packet_send_mux(struct ssh *ssh)
2730 {
2731 struct session_state *state = ssh->state;
2732 u_char type, *cp;
2733 size_t len;
2734 int r;
2735
2736 if (ssh->kex)
2737 return SSH_ERR_INTERNAL_ERROR;
2738 len = sshbuf_len(state->outgoing_packet);
2739 if (len < 6)
2740 return SSH_ERR_INTERNAL_ERROR;
2741 cp = sshbuf_mutable_ptr(state->outgoing_packet);
2742 type = cp[5];
2743 if (ssh_packet_log_type(type))
2744 debug3_f("type %u", type);
2745 /* drop everything, but the connection protocol */
2746 if (type >= SSH2_MSG_CONNECTION_MIN &&
2747 type <= SSH2_MSG_CONNECTION_MAX) {
2748 POKE_U32(cp, len - 4);
2749 if ((r = sshbuf_putb(state->output,
2750 state->outgoing_packet)) != 0)
2751 return r;
2752 /* sshbuf_dump(state->output, stderr); */
2753 }
2754 sshbuf_reset(state->outgoing_packet);
2755 return 0;
2756 }
2757
2758 /*
2759 * 9.2. Ignored Data Message
2760 *
2761 * byte SSH_MSG_IGNORE
2762 * string data
2763 *
2764 * All implementations MUST understand (and ignore) this message at any
2765 * time (after receiving the protocol version). No implementation is
2766 * required to send them. This message can be used as an additional
2767 * protection measure against advanced traffic analysis techniques.
2768 */
2769 int
sshpkt_msg_ignore(struct ssh * ssh,u_int nbytes)2770 sshpkt_msg_ignore(struct ssh *ssh, u_int nbytes)
2771 {
2772 u_int32_t rnd = 0;
2773 int r;
2774 u_int i;
2775
2776 if ((r = sshpkt_start(ssh, SSH2_MSG_IGNORE)) != 0 ||
2777 (r = sshpkt_put_u32(ssh, nbytes)) != 0)
2778 return r;
2779 for (i = 0; i < nbytes; i++) {
2780 if (i % 4 == 0)
2781 rnd = arc4random();
2782 if ((r = sshpkt_put_u8(ssh, (u_char)rnd & 0xff)) != 0)
2783 return r;
2784 rnd >>= 8;
2785 }
2786 return 0;
2787 }
2788
2789 /* send it */
2790
2791 int
sshpkt_send(struct ssh * ssh)2792 sshpkt_send(struct ssh *ssh)
2793 {
2794 if (ssh->state && ssh->state->mux)
2795 return ssh_packet_send_mux(ssh);
2796 return ssh_packet_send2(ssh);
2797 }
2798
2799 int
sshpkt_disconnect(struct ssh * ssh,const char * fmt,...)2800 sshpkt_disconnect(struct ssh *ssh, const char *fmt,...)
2801 {
2802 char buf[1024];
2803 va_list args;
2804 int r;
2805
2806 va_start(args, fmt);
2807 vsnprintf(buf, sizeof(buf), fmt, args);
2808 va_end(args);
2809
2810 debug2_f("sending SSH2_MSG_DISCONNECT: %s", buf);
2811 if ((r = sshpkt_start(ssh, SSH2_MSG_DISCONNECT)) != 0 ||
2812 (r = sshpkt_put_u32(ssh, SSH2_DISCONNECT_PROTOCOL_ERROR)) != 0 ||
2813 (r = sshpkt_put_cstring(ssh, buf)) != 0 ||
2814 (r = sshpkt_put_cstring(ssh, "")) != 0 ||
2815 (r = sshpkt_send(ssh)) != 0)
2816 return r;
2817 return 0;
2818 }
2819
2820 /* roundup current message to pad bytes */
2821 int
sshpkt_add_padding(struct ssh * ssh,u_char pad)2822 sshpkt_add_padding(struct ssh *ssh, u_char pad)
2823 {
2824 ssh->state->extra_pad = pad;
2825 return 0;
2826 }
2827