1 /* $OpenBSD: packet.c,v 1.168 2010/07/13 23:13:16 djm Exp $ */ 2 /* 3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * This file contains code implementing the packet protocol and communication 7 * with the other side. This same code is used both on client and server side. 8 * 9 * As far as I am concerned, the code I have written for this software 10 * can be used freely for any purpose. Any derived versions of this 11 * software must be clearly marked as such, and if the derived work is 12 * incompatible with the protocol description in the RFC file, it must be 13 * called by a name other than "ssh" or "Secure Shell". 14 * 15 * 16 * SSH2 packet format added by Markus Friedl. 17 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 18 * 19 * Redistribution and use in source and binary forms, with or without 20 * modification, are permitted provided that the following conditions 21 * are met: 22 * 1. Redistributions of source code must retain the above copyright 23 * notice, this list of conditions and the following disclaimer. 24 * 2. Redistributions in binary form must reproduce the above copyright 25 * notice, this list of conditions and the following disclaimer in the 26 * documentation and/or other materials provided with the distribution. 27 * 28 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 29 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 30 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 31 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 32 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 33 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 34 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 35 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 36 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 37 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40 #include "includes.h" 41 42 #include <sys/types.h> 43 #include "openbsd-compat/sys-queue.h" 44 #include <sys/param.h> 45 #include <sys/socket.h> 46 #ifdef HAVE_SYS_TIME_H 47 # include <sys/time.h> 48 #endif 49 50 #include <netinet/in.h> 51 #include <netinet/ip.h> 52 #include <arpa/inet.h> 53 54 #include <errno.h> 55 #include <stdarg.h> 56 #include <stdio.h> 57 #include <stdlib.h> 58 #include <string.h> 59 #include <unistd.h> 60 #include <signal.h> 61 62 #include "xmalloc.h" 63 #include "buffer.h" 64 #include "packet.h" 65 #include "crc32.h" 66 #include "compress.h" 67 #include "deattack.h" 68 #include "channels.h" 69 #include "compat.h" 70 #include "ssh1.h" 71 #include "ssh2.h" 72 #include "cipher.h" 73 #include "key.h" 74 #include "kex.h" 75 #include "mac.h" 76 #include "log.h" 77 #include "canohost.h" 78 #include "misc.h" 79 #include "ssh.h" 80 #include "roaming.h" 81 82 #ifdef PACKET_DEBUG 83 #define DBG(x) x 84 #else 85 #define DBG(x) 86 #endif 87 88 #define PACKET_MAX_SIZE (256 * 1024) 89 90 struct packet_state { 91 u_int32_t seqnr; 92 u_int32_t packets; 93 u_int64_t blocks; 94 u_int64_t bytes; 95 }; 96 97 struct packet { 98 TAILQ_ENTRY(packet) next; 99 u_char type; 100 Buffer payload; 101 }; 102 103 struct session_state { 104 /* 105 * This variable contains the file descriptors used for 106 * communicating with the other side. connection_in is used for 107 * reading; connection_out for writing. These can be the same 108 * descriptor, in which case it is assumed to be a socket. 109 */ 110 int connection_in; 111 int connection_out; 112 113 /* Protocol flags for the remote side. */ 114 u_int remote_protocol_flags; 115 116 /* Encryption context for receiving data. Only used for decryption. */ 117 CipherContext receive_context; 118 119 /* Encryption context for sending data. Only used for encryption. */ 120 CipherContext send_context; 121 122 /* Buffer for raw input data from the socket. */ 123 Buffer input; 124 125 /* Buffer for raw output data going to the socket. */ 126 Buffer output; 127 128 /* Buffer for the partial outgoing packet being constructed. */ 129 Buffer outgoing_packet; 130 131 /* Buffer for the incoming packet currently being processed. */ 132 Buffer incoming_packet; 133 134 /* Scratch buffer for packet compression/decompression. */ 135 Buffer compression_buffer; 136 int compression_buffer_ready; 137 138 /* 139 * Flag indicating whether packet compression/decompression is 140 * enabled. 141 */ 142 int packet_compression; 143 144 /* default maximum packet size */ 145 u_int max_packet_size; 146 147 /* Flag indicating whether this module has been initialized. */ 148 int initialized; 149 150 /* Set to true if the connection is interactive. */ 151 int interactive_mode; 152 153 /* Set to true if we are the server side. */ 154 int server_side; 155 156 /* Set to true if we are authenticated. */ 157 int after_authentication; 158 159 int keep_alive_timeouts; 160 161 /* The maximum time that we will wait to send or receive a packet */ 162 int packet_timeout_ms; 163 164 /* Session key information for Encryption and MAC */ 165 Newkeys *newkeys[MODE_MAX]; 166 struct packet_state p_read, p_send; 167 168 u_int64_t max_blocks_in, max_blocks_out; 169 u_int32_t rekey_limit; 170 171 /* Session key for protocol v1 */ 172 u_char ssh1_key[SSH_SESSION_KEY_LENGTH]; 173 u_int ssh1_keylen; 174 175 /* roundup current message to extra_pad bytes */ 176 u_char extra_pad; 177 178 /* XXX discard incoming data after MAC error */ 179 u_int packet_discard; 180 Mac *packet_discard_mac; 181 182 /* Used in packet_read_poll2() */ 183 u_int packlen; 184 185 /* Used in packet_send2 */ 186 int rekeying; 187 188 /* Used in packet_set_interactive */ 189 int set_interactive_called; 190 191 /* Used in packet_set_maxsize */ 192 int set_maxsize_called; 193 194 TAILQ_HEAD(, packet) outgoing; 195 }; 196 197 static struct session_state *active_state, *backup_state; 198 199 static struct session_state * 200 alloc_session_state(void) 201 { 202 struct session_state *s = xcalloc(1, sizeof(*s)); 203 204 s->connection_in = -1; 205 s->connection_out = -1; 206 s->max_packet_size = 32768; 207 s->packet_timeout_ms = -1; 208 return s; 209 } 210 211 /* 212 * Sets the descriptors used for communication. Disables encryption until 213 * packet_set_encryption_key is called. 214 */ 215 void 216 packet_set_connection(int fd_in, int fd_out) 217 { 218 Cipher *none = cipher_by_name("none"); 219 220 if (none == NULL) 221 fatal("packet_set_connection: cannot load cipher 'none'"); 222 if (active_state == NULL) 223 active_state = alloc_session_state(); 224 active_state->connection_in = fd_in; 225 active_state->connection_out = fd_out; 226 cipher_init(&active_state->send_context, none, (const u_char *)"", 227 0, NULL, 0, CIPHER_ENCRYPT); 228 cipher_init(&active_state->receive_context, none, (const u_char *)"", 229 0, NULL, 0, CIPHER_DECRYPT); 230 active_state->newkeys[MODE_IN] = active_state->newkeys[MODE_OUT] = NULL; 231 if (!active_state->initialized) { 232 active_state->initialized = 1; 233 buffer_init(&active_state->input); 234 buffer_init(&active_state->output); 235 buffer_init(&active_state->outgoing_packet); 236 buffer_init(&active_state->incoming_packet); 237 TAILQ_INIT(&active_state->outgoing); 238 active_state->p_send.packets = active_state->p_read.packets = 0; 239 } 240 } 241 242 void 243 packet_set_timeout(int timeout, int count) 244 { 245 if (timeout == 0 || count == 0) { 246 active_state->packet_timeout_ms = -1; 247 return; 248 } 249 if ((INT_MAX / 1000) / count < timeout) 250 active_state->packet_timeout_ms = INT_MAX; 251 else 252 active_state->packet_timeout_ms = timeout * count * 1000; 253 } 254 255 static void 256 packet_stop_discard(void) 257 { 258 if (active_state->packet_discard_mac) { 259 char buf[1024]; 260 261 memset(buf, 'a', sizeof(buf)); 262 while (buffer_len(&active_state->incoming_packet) < 263 PACKET_MAX_SIZE) 264 buffer_append(&active_state->incoming_packet, buf, 265 sizeof(buf)); 266 (void) mac_compute(active_state->packet_discard_mac, 267 active_state->p_read.seqnr, 268 buffer_ptr(&active_state->incoming_packet), 269 PACKET_MAX_SIZE); 270 } 271 logit("Finished discarding for %.200s", get_remote_ipaddr()); 272 cleanup_exit(255); 273 } 274 275 static void 276 packet_start_discard(Enc *enc, Mac *mac, u_int packet_length, u_int discard) 277 { 278 if (enc == NULL || !cipher_is_cbc(enc->cipher)) 279 packet_disconnect("Packet corrupt"); 280 if (packet_length != PACKET_MAX_SIZE && mac && mac->enabled) 281 active_state->packet_discard_mac = mac; 282 if (buffer_len(&active_state->input) >= discard) 283 packet_stop_discard(); 284 active_state->packet_discard = discard - 285 buffer_len(&active_state->input); 286 } 287 288 /* Returns 1 if remote host is connected via socket, 0 if not. */ 289 290 int 291 packet_connection_is_on_socket(void) 292 { 293 struct sockaddr_storage from, to; 294 socklen_t fromlen, tolen; 295 296 /* filedescriptors in and out are the same, so it's a socket */ 297 if (active_state->connection_in == active_state->connection_out) 298 return 1; 299 fromlen = sizeof(from); 300 memset(&from, 0, sizeof(from)); 301 if (getpeername(active_state->connection_in, (struct sockaddr *)&from, 302 &fromlen) < 0) 303 return 0; 304 tolen = sizeof(to); 305 memset(&to, 0, sizeof(to)); 306 if (getpeername(active_state->connection_out, (struct sockaddr *)&to, 307 &tolen) < 0) 308 return 0; 309 if (fromlen != tolen || memcmp(&from, &to, fromlen) != 0) 310 return 0; 311 if (from.ss_family != AF_INET && from.ss_family != AF_INET6) 312 return 0; 313 return 1; 314 } 315 316 /* 317 * Exports an IV from the CipherContext required to export the key 318 * state back from the unprivileged child to the privileged parent 319 * process. 320 */ 321 322 void 323 packet_get_keyiv(int mode, u_char *iv, u_int len) 324 { 325 CipherContext *cc; 326 327 if (mode == MODE_OUT) 328 cc = &active_state->send_context; 329 else 330 cc = &active_state->receive_context; 331 332 cipher_get_keyiv(cc, iv, len); 333 } 334 335 int 336 packet_get_keycontext(int mode, u_char *dat) 337 { 338 CipherContext *cc; 339 340 if (mode == MODE_OUT) 341 cc = &active_state->send_context; 342 else 343 cc = &active_state->receive_context; 344 345 return (cipher_get_keycontext(cc, dat)); 346 } 347 348 void 349 packet_set_keycontext(int mode, u_char *dat) 350 { 351 CipherContext *cc; 352 353 if (mode == MODE_OUT) 354 cc = &active_state->send_context; 355 else 356 cc = &active_state->receive_context; 357 358 cipher_set_keycontext(cc, dat); 359 } 360 361 int 362 packet_get_keyiv_len(int mode) 363 { 364 CipherContext *cc; 365 366 if (mode == MODE_OUT) 367 cc = &active_state->send_context; 368 else 369 cc = &active_state->receive_context; 370 371 return (cipher_get_keyiv_len(cc)); 372 } 373 374 void 375 packet_set_iv(int mode, u_char *dat) 376 { 377 CipherContext *cc; 378 379 if (mode == MODE_OUT) 380 cc = &active_state->send_context; 381 else 382 cc = &active_state->receive_context; 383 384 cipher_set_keyiv(cc, dat); 385 } 386 387 int 388 packet_get_ssh1_cipher(void) 389 { 390 return (cipher_get_number(active_state->receive_context.cipher)); 391 } 392 393 void 394 packet_get_state(int mode, u_int32_t *seqnr, u_int64_t *blocks, u_int32_t *packets, 395 u_int64_t *bytes) 396 { 397 struct packet_state *state; 398 399 state = (mode == MODE_IN) ? 400 &active_state->p_read : &active_state->p_send; 401 if (seqnr) 402 *seqnr = state->seqnr; 403 if (blocks) 404 *blocks = state->blocks; 405 if (packets) 406 *packets = state->packets; 407 if (bytes) 408 *bytes = state->bytes; 409 } 410 411 void 412 packet_set_state(int mode, u_int32_t seqnr, u_int64_t blocks, u_int32_t packets, 413 u_int64_t bytes) 414 { 415 struct packet_state *state; 416 417 state = (mode == MODE_IN) ? 418 &active_state->p_read : &active_state->p_send; 419 state->seqnr = seqnr; 420 state->blocks = blocks; 421 state->packets = packets; 422 state->bytes = bytes; 423 } 424 425 /* returns 1 if connection is via ipv4 */ 426 427 int 428 packet_connection_is_ipv4(void) 429 { 430 struct sockaddr_storage to; 431 socklen_t tolen = sizeof(to); 432 433 memset(&to, 0, sizeof(to)); 434 if (getsockname(active_state->connection_out, (struct sockaddr *)&to, 435 &tolen) < 0) 436 return 0; 437 if (to.ss_family == AF_INET) 438 return 1; 439 #ifdef IPV4_IN_IPV6 440 if (to.ss_family == AF_INET6 && 441 IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&to)->sin6_addr)) 442 return 1; 443 #endif 444 return 0; 445 } 446 447 /* Sets the connection into non-blocking mode. */ 448 449 void 450 packet_set_nonblocking(void) 451 { 452 /* Set the socket into non-blocking mode. */ 453 set_nonblock(active_state->connection_in); 454 455 if (active_state->connection_out != active_state->connection_in) 456 set_nonblock(active_state->connection_out); 457 } 458 459 /* Returns the socket used for reading. */ 460 461 int 462 packet_get_connection_in(void) 463 { 464 return active_state->connection_in; 465 } 466 467 /* Returns the descriptor used for writing. */ 468 469 int 470 packet_get_connection_out(void) 471 { 472 return active_state->connection_out; 473 } 474 475 /* Closes the connection and clears and frees internal data structures. */ 476 477 void 478 packet_close(void) 479 { 480 if (!active_state->initialized) 481 return; 482 active_state->initialized = 0; 483 if (active_state->connection_in == active_state->connection_out) { 484 shutdown(active_state->connection_out, SHUT_RDWR); 485 close(active_state->connection_out); 486 } else { 487 close(active_state->connection_in); 488 close(active_state->connection_out); 489 } 490 buffer_free(&active_state->input); 491 buffer_free(&active_state->output); 492 buffer_free(&active_state->outgoing_packet); 493 buffer_free(&active_state->incoming_packet); 494 if (active_state->compression_buffer_ready) { 495 buffer_free(&active_state->compression_buffer); 496 buffer_compress_uninit(); 497 } 498 cipher_cleanup(&active_state->send_context); 499 cipher_cleanup(&active_state->receive_context); 500 } 501 502 /* Sets remote side protocol flags. */ 503 504 void 505 packet_set_protocol_flags(u_int protocol_flags) 506 { 507 active_state->remote_protocol_flags = protocol_flags; 508 } 509 510 /* Returns the remote protocol flags set earlier by the above function. */ 511 512 u_int 513 packet_get_protocol_flags(void) 514 { 515 return active_state->remote_protocol_flags; 516 } 517 518 /* 519 * Starts packet compression from the next packet on in both directions. 520 * Level is compression level 1 (fastest) - 9 (slow, best) as in gzip. 521 */ 522 523 static void 524 packet_init_compression(void) 525 { 526 if (active_state->compression_buffer_ready == 1) 527 return; 528 active_state->compression_buffer_ready = 1; 529 buffer_init(&active_state->compression_buffer); 530 } 531 532 void 533 packet_start_compression(int level) 534 { 535 if (active_state->packet_compression && !compat20) 536 fatal("Compression already enabled."); 537 active_state->packet_compression = 1; 538 packet_init_compression(); 539 buffer_compress_init_send(level); 540 buffer_compress_init_recv(); 541 } 542 543 /* 544 * Causes any further packets to be encrypted using the given key. The same 545 * key is used for both sending and reception. However, both directions are 546 * encrypted independently of each other. 547 */ 548 549 void 550 packet_set_encryption_key(const u_char *key, u_int keylen, 551 int number) 552 { 553 Cipher *cipher = cipher_by_number(number); 554 555 if (cipher == NULL) 556 fatal("packet_set_encryption_key: unknown cipher number %d", number); 557 if (keylen < 20) 558 fatal("packet_set_encryption_key: keylen too small: %d", keylen); 559 if (keylen > SSH_SESSION_KEY_LENGTH) 560 fatal("packet_set_encryption_key: keylen too big: %d", keylen); 561 memcpy(active_state->ssh1_key, key, keylen); 562 active_state->ssh1_keylen = keylen; 563 cipher_init(&active_state->send_context, cipher, key, keylen, NULL, 564 0, CIPHER_ENCRYPT); 565 cipher_init(&active_state->receive_context, cipher, key, keylen, NULL, 566 0, CIPHER_DECRYPT); 567 } 568 569 u_int 570 packet_get_encryption_key(u_char *key) 571 { 572 if (key == NULL) 573 return (active_state->ssh1_keylen); 574 memcpy(key, active_state->ssh1_key, active_state->ssh1_keylen); 575 return (active_state->ssh1_keylen); 576 } 577 578 /* Start constructing a packet to send. */ 579 void 580 packet_start(u_char type) 581 { 582 u_char buf[9]; 583 int len; 584 585 DBG(debug("packet_start[%d]", type)); 586 len = compat20 ? 6 : 9; 587 memset(buf, 0, len - 1); 588 buf[len - 1] = type; 589 buffer_clear(&active_state->outgoing_packet); 590 buffer_append(&active_state->outgoing_packet, buf, len); 591 } 592 593 /* Append payload. */ 594 void 595 packet_put_char(int value) 596 { 597 char ch = value; 598 599 buffer_append(&active_state->outgoing_packet, &ch, 1); 600 } 601 602 void 603 packet_put_int(u_int value) 604 { 605 buffer_put_int(&active_state->outgoing_packet, value); 606 } 607 608 void 609 packet_put_int64(u_int64_t value) 610 { 611 buffer_put_int64(&active_state->outgoing_packet, value); 612 } 613 614 void 615 packet_put_string(const void *buf, u_int len) 616 { 617 buffer_put_string(&active_state->outgoing_packet, buf, len); 618 } 619 620 void 621 packet_put_cstring(const char *str) 622 { 623 buffer_put_cstring(&active_state->outgoing_packet, str); 624 } 625 626 void 627 packet_put_raw(const void *buf, u_int len) 628 { 629 buffer_append(&active_state->outgoing_packet, buf, len); 630 } 631 632 void 633 packet_put_bignum(BIGNUM * value) 634 { 635 buffer_put_bignum(&active_state->outgoing_packet, value); 636 } 637 638 void 639 packet_put_bignum2(BIGNUM * value) 640 { 641 buffer_put_bignum2(&active_state->outgoing_packet, value); 642 } 643 644 /* 645 * Finalizes and sends the packet. If the encryption key has been set, 646 * encrypts the packet before sending. 647 */ 648 649 static void 650 packet_send1(void) 651 { 652 u_char buf[8], *cp; 653 int i, padding, len; 654 u_int checksum; 655 u_int32_t rnd = 0; 656 657 /* 658 * If using packet compression, compress the payload of the outgoing 659 * packet. 660 */ 661 if (active_state->packet_compression) { 662 buffer_clear(&active_state->compression_buffer); 663 /* Skip padding. */ 664 buffer_consume(&active_state->outgoing_packet, 8); 665 /* padding */ 666 buffer_append(&active_state->compression_buffer, 667 "\0\0\0\0\0\0\0\0", 8); 668 buffer_compress(&active_state->outgoing_packet, 669 &active_state->compression_buffer); 670 buffer_clear(&active_state->outgoing_packet); 671 buffer_append(&active_state->outgoing_packet, 672 buffer_ptr(&active_state->compression_buffer), 673 buffer_len(&active_state->compression_buffer)); 674 } 675 /* Compute packet length without padding (add checksum, remove padding). */ 676 len = buffer_len(&active_state->outgoing_packet) + 4 - 8; 677 678 /* Insert padding. Initialized to zero in packet_start1() */ 679 padding = 8 - len % 8; 680 if (!active_state->send_context.plaintext) { 681 cp = buffer_ptr(&active_state->outgoing_packet); 682 for (i = 0; i < padding; i++) { 683 if (i % 4 == 0) 684 rnd = arc4random(); 685 cp[7 - i] = rnd & 0xff; 686 rnd >>= 8; 687 } 688 } 689 buffer_consume(&active_state->outgoing_packet, 8 - padding); 690 691 /* Add check bytes. */ 692 checksum = ssh_crc32(buffer_ptr(&active_state->outgoing_packet), 693 buffer_len(&active_state->outgoing_packet)); 694 put_u32(buf, checksum); 695 buffer_append(&active_state->outgoing_packet, buf, 4); 696 697 #ifdef PACKET_DEBUG 698 fprintf(stderr, "packet_send plain: "); 699 buffer_dump(&active_state->outgoing_packet); 700 #endif 701 702 /* Append to output. */ 703 put_u32(buf, len); 704 buffer_append(&active_state->output, buf, 4); 705 cp = buffer_append_space(&active_state->output, 706 buffer_len(&active_state->outgoing_packet)); 707 cipher_crypt(&active_state->send_context, cp, 708 buffer_ptr(&active_state->outgoing_packet), 709 buffer_len(&active_state->outgoing_packet)); 710 711 #ifdef PACKET_DEBUG 712 fprintf(stderr, "encrypted: "); 713 buffer_dump(&active_state->output); 714 #endif 715 active_state->p_send.packets++; 716 active_state->p_send.bytes += len + 717 buffer_len(&active_state->outgoing_packet); 718 buffer_clear(&active_state->outgoing_packet); 719 720 /* 721 * Note that the packet is now only buffered in output. It won't be 722 * actually sent until packet_write_wait or packet_write_poll is 723 * called. 724 */ 725 } 726 727 void 728 set_newkeys(int mode) 729 { 730 Enc *enc; 731 Mac *mac; 732 Comp *comp; 733 CipherContext *cc; 734 u_int64_t *max_blocks; 735 int crypt_type; 736 737 debug2("set_newkeys: mode %d", mode); 738 739 if (mode == MODE_OUT) { 740 cc = &active_state->send_context; 741 crypt_type = CIPHER_ENCRYPT; 742 active_state->p_send.packets = active_state->p_send.blocks = 0; 743 max_blocks = &active_state->max_blocks_out; 744 } else { 745 cc = &active_state->receive_context; 746 crypt_type = CIPHER_DECRYPT; 747 active_state->p_read.packets = active_state->p_read.blocks = 0; 748 max_blocks = &active_state->max_blocks_in; 749 } 750 if (active_state->newkeys[mode] != NULL) { 751 debug("set_newkeys: rekeying"); 752 cipher_cleanup(cc); 753 enc = &active_state->newkeys[mode]->enc; 754 mac = &active_state->newkeys[mode]->mac; 755 comp = &active_state->newkeys[mode]->comp; 756 mac_clear(mac); 757 xfree(enc->name); 758 xfree(enc->iv); 759 xfree(enc->key); 760 xfree(mac->name); 761 xfree(mac->key); 762 xfree(comp->name); 763 xfree(active_state->newkeys[mode]); 764 } 765 active_state->newkeys[mode] = kex_get_newkeys(mode); 766 if (active_state->newkeys[mode] == NULL) 767 fatal("newkeys: no keys for mode %d", mode); 768 enc = &active_state->newkeys[mode]->enc; 769 mac = &active_state->newkeys[mode]->mac; 770 comp = &active_state->newkeys[mode]->comp; 771 if (mac_init(mac) == 0) 772 mac->enabled = 1; 773 DBG(debug("cipher_init_context: %d", mode)); 774 cipher_init(cc, enc->cipher, enc->key, enc->key_len, 775 enc->iv, enc->block_size, crypt_type); 776 /* Deleting the keys does not gain extra security */ 777 /* memset(enc->iv, 0, enc->block_size); 778 memset(enc->key, 0, enc->key_len); 779 memset(mac->key, 0, mac->key_len); */ 780 if ((comp->type == COMP_ZLIB || 781 (comp->type == COMP_DELAYED && 782 active_state->after_authentication)) && comp->enabled == 0) { 783 packet_init_compression(); 784 if (mode == MODE_OUT) 785 buffer_compress_init_send(6); 786 else 787 buffer_compress_init_recv(); 788 comp->enabled = 1; 789 } 790 /* 791 * The 2^(blocksize*2) limit is too expensive for 3DES, 792 * blowfish, etc, so enforce a 1GB limit for small blocksizes. 793 */ 794 if (enc->block_size >= 16) 795 *max_blocks = (u_int64_t)1 << (enc->block_size*2); 796 else 797 *max_blocks = ((u_int64_t)1 << 30) / enc->block_size; 798 if (active_state->rekey_limit) 799 *max_blocks = MIN(*max_blocks, 800 active_state->rekey_limit / enc->block_size); 801 } 802 803 /* 804 * Delayed compression for SSH2 is enabled after authentication: 805 * This happens on the server side after a SSH2_MSG_USERAUTH_SUCCESS is sent, 806 * and on the client side after a SSH2_MSG_USERAUTH_SUCCESS is received. 807 */ 808 static void 809 packet_enable_delayed_compress(void) 810 { 811 Comp *comp = NULL; 812 int mode; 813 814 /* 815 * Remember that we are past the authentication step, so rekeying 816 * with COMP_DELAYED will turn on compression immediately. 817 */ 818 active_state->after_authentication = 1; 819 for (mode = 0; mode < MODE_MAX; mode++) { 820 /* protocol error: USERAUTH_SUCCESS received before NEWKEYS */ 821 if (active_state->newkeys[mode] == NULL) 822 continue; 823 comp = &active_state->newkeys[mode]->comp; 824 if (comp && !comp->enabled && comp->type == COMP_DELAYED) { 825 packet_init_compression(); 826 if (mode == MODE_OUT) 827 buffer_compress_init_send(6); 828 else 829 buffer_compress_init_recv(); 830 comp->enabled = 1; 831 } 832 } 833 } 834 835 /* 836 * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue) 837 */ 838 static int 839 packet_send2_wrapped(void) 840 { 841 u_char type, *cp, *macbuf = NULL; 842 u_char padlen, pad; 843 u_int packet_length = 0; 844 u_int i, len; 845 u_int32_t rnd = 0; 846 Enc *enc = NULL; 847 Mac *mac = NULL; 848 Comp *comp = NULL; 849 int block_size; 850 851 if (active_state->newkeys[MODE_OUT] != NULL) { 852 enc = &active_state->newkeys[MODE_OUT]->enc; 853 mac = &active_state->newkeys[MODE_OUT]->mac; 854 comp = &active_state->newkeys[MODE_OUT]->comp; 855 } 856 block_size = enc ? enc->block_size : 8; 857 858 cp = buffer_ptr(&active_state->outgoing_packet); 859 type = cp[5]; 860 861 #ifdef PACKET_DEBUG 862 fprintf(stderr, "plain: "); 863 buffer_dump(&active_state->outgoing_packet); 864 #endif 865 866 if (comp && comp->enabled) { 867 len = buffer_len(&active_state->outgoing_packet); 868 /* skip header, compress only payload */ 869 buffer_consume(&active_state->outgoing_packet, 5); 870 buffer_clear(&active_state->compression_buffer); 871 buffer_compress(&active_state->outgoing_packet, 872 &active_state->compression_buffer); 873 buffer_clear(&active_state->outgoing_packet); 874 buffer_append(&active_state->outgoing_packet, "\0\0\0\0\0", 5); 875 buffer_append(&active_state->outgoing_packet, 876 buffer_ptr(&active_state->compression_buffer), 877 buffer_len(&active_state->compression_buffer)); 878 DBG(debug("compression: raw %d compressed %d", len, 879 buffer_len(&active_state->outgoing_packet))); 880 } 881 882 /* sizeof (packet_len + pad_len + payload) */ 883 len = buffer_len(&active_state->outgoing_packet); 884 885 /* 886 * calc size of padding, alloc space, get random data, 887 * minimum padding is 4 bytes 888 */ 889 padlen = block_size - (len % block_size); 890 if (padlen < 4) 891 padlen += block_size; 892 if (active_state->extra_pad) { 893 /* will wrap if extra_pad+padlen > 255 */ 894 active_state->extra_pad = 895 roundup(active_state->extra_pad, block_size); 896 pad = active_state->extra_pad - 897 ((len + padlen) % active_state->extra_pad); 898 debug3("packet_send2: adding %d (len %d padlen %d extra_pad %d)", 899 pad, len, padlen, active_state->extra_pad); 900 padlen += pad; 901 active_state->extra_pad = 0; 902 } 903 cp = buffer_append_space(&active_state->outgoing_packet, padlen); 904 if (enc && !active_state->send_context.plaintext) { 905 /* random padding */ 906 for (i = 0; i < padlen; i++) { 907 if (i % 4 == 0) 908 rnd = arc4random(); 909 cp[i] = rnd & 0xff; 910 rnd >>= 8; 911 } 912 } else { 913 /* clear padding */ 914 memset(cp, 0, padlen); 915 } 916 /* packet_length includes payload, padding and padding length field */ 917 packet_length = buffer_len(&active_state->outgoing_packet) - 4; 918 cp = buffer_ptr(&active_state->outgoing_packet); 919 put_u32(cp, packet_length); 920 cp[4] = padlen; 921 DBG(debug("send: len %d (includes padlen %d)", packet_length+4, padlen)); 922 923 /* compute MAC over seqnr and packet(length fields, payload, padding) */ 924 if (mac && mac->enabled) { 925 macbuf = mac_compute(mac, active_state->p_send.seqnr, 926 buffer_ptr(&active_state->outgoing_packet), 927 buffer_len(&active_state->outgoing_packet)); 928 DBG(debug("done calc MAC out #%d", active_state->p_send.seqnr)); 929 } 930 /* encrypt packet and append to output buffer. */ 931 cp = buffer_append_space(&active_state->output, 932 buffer_len(&active_state->outgoing_packet)); 933 cipher_crypt(&active_state->send_context, cp, 934 buffer_ptr(&active_state->outgoing_packet), 935 buffer_len(&active_state->outgoing_packet)); 936 /* append unencrypted MAC */ 937 if (mac && mac->enabled) 938 buffer_append(&active_state->output, macbuf, mac->mac_len); 939 #ifdef PACKET_DEBUG 940 fprintf(stderr, "encrypted: "); 941 buffer_dump(&active_state->output); 942 #endif 943 /* increment sequence number for outgoing packets */ 944 if (++active_state->p_send.seqnr == 0) 945 logit("outgoing seqnr wraps around"); 946 if (++active_state->p_send.packets == 0) 947 if (!(datafellows & SSH_BUG_NOREKEY)) 948 fatal("XXX too many packets with same key"); 949 active_state->p_send.blocks += (packet_length + 4) / block_size; 950 active_state->p_send.bytes += packet_length + 4; 951 buffer_clear(&active_state->outgoing_packet); 952 953 if (type == SSH2_MSG_NEWKEYS) 954 set_newkeys(MODE_OUT); 955 else if (type == SSH2_MSG_USERAUTH_SUCCESS && active_state->server_side) 956 packet_enable_delayed_compress(); 957 return(packet_length); 958 } 959 960 static int 961 packet_send2(void) 962 { 963 static int packet_length = 0; 964 struct packet *p; 965 u_char type, *cp; 966 967 cp = buffer_ptr(&active_state->outgoing_packet); 968 type = cp[5]; 969 970 /* during rekeying we can only send key exchange messages */ 971 if (active_state->rekeying) { 972 if (!((type >= SSH2_MSG_TRANSPORT_MIN) && 973 (type <= SSH2_MSG_TRANSPORT_MAX))) { 974 debug("enqueue packet: %u", type); 975 p = xmalloc(sizeof(*p)); 976 p->type = type; 977 memcpy(&p->payload, &active_state->outgoing_packet, 978 sizeof(Buffer)); 979 buffer_init(&active_state->outgoing_packet); 980 TAILQ_INSERT_TAIL(&active_state->outgoing, p, next); 981 return(sizeof(Buffer)); 982 } 983 } 984 985 /* rekeying starts with sending KEXINIT */ 986 if (type == SSH2_MSG_KEXINIT) 987 active_state->rekeying = 1; 988 989 packet_length = packet_send2_wrapped(); 990 991 /* after a NEWKEYS message we can send the complete queue */ 992 if (type == SSH2_MSG_NEWKEYS) { 993 active_state->rekeying = 0; 994 while ((p = TAILQ_FIRST(&active_state->outgoing))) { 995 type = p->type; 996 debug("dequeue packet: %u", type); 997 buffer_free(&active_state->outgoing_packet); 998 memcpy(&active_state->outgoing_packet, &p->payload, 999 sizeof(Buffer)); 1000 TAILQ_REMOVE(&active_state->outgoing, p, next); 1001 xfree(p); 1002 packet_length += packet_send2_wrapped(); 1003 } 1004 } 1005 return(packet_length); 1006 } 1007 1008 int 1009 packet_send(void) 1010 { 1011 int packet_len = 0; 1012 if (compat20) 1013 packet_len = packet_send2(); 1014 else 1015 packet_send1(); 1016 DBG(debug("packet_send done")); 1017 return(packet_len); 1018 } 1019 1020 /* 1021 * Waits until a packet has been received, and returns its type. Note that 1022 * no other data is processed until this returns, so this function should not 1023 * be used during the interactive session. 1024 */ 1025 1026 int 1027 packet_read_seqnr(u_int32_t *seqnr_p) 1028 { 1029 int type, len, ret, ms_remain, cont; 1030 fd_set *setp; 1031 char buf[8192]; 1032 struct timeval timeout, start, *timeoutp = NULL; 1033 1034 DBG(debug("packet_read()")); 1035 1036 setp = (fd_set *)xcalloc(howmany(active_state->connection_in + 1, 1037 NFDBITS), sizeof(fd_mask)); 1038 1039 /* Since we are blocking, ensure that all written packets have been sent. */ 1040 packet_write_wait(); 1041 1042 /* Stay in the loop until we have received a complete packet. */ 1043 for (;;) { 1044 /* Try to read a packet from the buffer. */ 1045 type = packet_read_poll_seqnr(seqnr_p); 1046 if (!compat20 && ( 1047 type == SSH_SMSG_SUCCESS 1048 || type == SSH_SMSG_FAILURE 1049 || type == SSH_CMSG_EOF 1050 || type == SSH_CMSG_EXIT_CONFIRMATION)) 1051 packet_check_eom(); 1052 /* If we got a packet, return it. */ 1053 if (type != SSH_MSG_NONE) { 1054 xfree(setp); 1055 return type; 1056 } 1057 /* 1058 * Otherwise, wait for some data to arrive, add it to the 1059 * buffer, and try again. 1060 */ 1061 memset(setp, 0, howmany(active_state->connection_in + 1, 1062 NFDBITS) * sizeof(fd_mask)); 1063 FD_SET(active_state->connection_in, setp); 1064 1065 if (active_state->packet_timeout_ms > 0) { 1066 ms_remain = active_state->packet_timeout_ms; 1067 timeoutp = &timeout; 1068 } 1069 /* Wait for some data to arrive. */ 1070 for (;;) { 1071 if (active_state->packet_timeout_ms != -1) { 1072 ms_to_timeval(&timeout, ms_remain); 1073 gettimeofday(&start, NULL); 1074 } 1075 if ((ret = select(active_state->connection_in + 1, setp, 1076 NULL, NULL, timeoutp)) >= 0) 1077 break; 1078 if (errno != EAGAIN && errno != EINTR && 1079 errno != EWOULDBLOCK) 1080 break; 1081 if (active_state->packet_timeout_ms == -1) 1082 continue; 1083 ms_subtract_diff(&start, &ms_remain); 1084 if (ms_remain <= 0) { 1085 ret = 0; 1086 break; 1087 } 1088 } 1089 if (ret == 0) { 1090 logit("Connection to %.200s timed out while " 1091 "waiting to read", get_remote_ipaddr()); 1092 cleanup_exit(255); 1093 } 1094 /* Read data from the socket. */ 1095 do { 1096 cont = 0; 1097 len = roaming_read(active_state->connection_in, buf, 1098 sizeof(buf), &cont); 1099 } while (len == 0 && cont); 1100 if (len == 0) { 1101 logit("Connection closed by %.200s", get_remote_ipaddr()); 1102 cleanup_exit(255); 1103 } 1104 if (len < 0) 1105 fatal("Read from socket failed: %.100s", strerror(errno)); 1106 /* Append it to the buffer. */ 1107 packet_process_incoming(buf, len); 1108 } 1109 /* NOTREACHED */ 1110 } 1111 1112 int 1113 packet_read(void) 1114 { 1115 return packet_read_seqnr(NULL); 1116 } 1117 1118 /* 1119 * Waits until a packet has been received, verifies that its type matches 1120 * that given, and gives a fatal error and exits if there is a mismatch. 1121 */ 1122 1123 void 1124 packet_read_expect(int expected_type) 1125 { 1126 int type; 1127 1128 type = packet_read(); 1129 if (type != expected_type) 1130 packet_disconnect("Protocol error: expected packet type %d, got %d", 1131 expected_type, type); 1132 } 1133 1134 /* Checks if a full packet is available in the data received so far via 1135 * packet_process_incoming. If so, reads the packet; otherwise returns 1136 * SSH_MSG_NONE. This does not wait for data from the connection. 1137 * 1138 * SSH_MSG_DISCONNECT is handled specially here. Also, 1139 * SSH_MSG_IGNORE messages are skipped by this function and are never returned 1140 * to higher levels. 1141 */ 1142 1143 static int 1144 packet_read_poll1(void) 1145 { 1146 u_int len, padded_len; 1147 u_char *cp, type; 1148 u_int checksum, stored_checksum; 1149 1150 /* Check if input size is less than minimum packet size. */ 1151 if (buffer_len(&active_state->input) < 4 + 8) 1152 return SSH_MSG_NONE; 1153 /* Get length of incoming packet. */ 1154 cp = buffer_ptr(&active_state->input); 1155 len = get_u32(cp); 1156 if (len < 1 + 2 + 2 || len > 256 * 1024) 1157 packet_disconnect("Bad packet length %u.", len); 1158 padded_len = (len + 8) & ~7; 1159 1160 /* Check if the packet has been entirely received. */ 1161 if (buffer_len(&active_state->input) < 4 + padded_len) 1162 return SSH_MSG_NONE; 1163 1164 /* The entire packet is in buffer. */ 1165 1166 /* Consume packet length. */ 1167 buffer_consume(&active_state->input, 4); 1168 1169 /* 1170 * Cryptographic attack detector for ssh 1171 * (C)1998 CORE-SDI, Buenos Aires Argentina 1172 * Ariel Futoransky(futo@core-sdi.com) 1173 */ 1174 if (!active_state->receive_context.plaintext) { 1175 switch (detect_attack(buffer_ptr(&active_state->input), 1176 padded_len)) { 1177 case DEATTACK_DETECTED: 1178 packet_disconnect("crc32 compensation attack: " 1179 "network attack detected"); 1180 case DEATTACK_DOS_DETECTED: 1181 packet_disconnect("deattack denial of " 1182 "service detected"); 1183 } 1184 } 1185 1186 /* Decrypt data to incoming_packet. */ 1187 buffer_clear(&active_state->incoming_packet); 1188 cp = buffer_append_space(&active_state->incoming_packet, padded_len); 1189 cipher_crypt(&active_state->receive_context, cp, 1190 buffer_ptr(&active_state->input), padded_len); 1191 1192 buffer_consume(&active_state->input, padded_len); 1193 1194 #ifdef PACKET_DEBUG 1195 fprintf(stderr, "read_poll plain: "); 1196 buffer_dump(&active_state->incoming_packet); 1197 #endif 1198 1199 /* Compute packet checksum. */ 1200 checksum = ssh_crc32(buffer_ptr(&active_state->incoming_packet), 1201 buffer_len(&active_state->incoming_packet) - 4); 1202 1203 /* Skip padding. */ 1204 buffer_consume(&active_state->incoming_packet, 8 - len % 8); 1205 1206 /* Test check bytes. */ 1207 if (len != buffer_len(&active_state->incoming_packet)) 1208 packet_disconnect("packet_read_poll1: len %d != buffer_len %d.", 1209 len, buffer_len(&active_state->incoming_packet)); 1210 1211 cp = (u_char *)buffer_ptr(&active_state->incoming_packet) + len - 4; 1212 stored_checksum = get_u32(cp); 1213 if (checksum != stored_checksum) 1214 packet_disconnect("Corrupted check bytes on input."); 1215 buffer_consume_end(&active_state->incoming_packet, 4); 1216 1217 if (active_state->packet_compression) { 1218 buffer_clear(&active_state->compression_buffer); 1219 buffer_uncompress(&active_state->incoming_packet, 1220 &active_state->compression_buffer); 1221 buffer_clear(&active_state->incoming_packet); 1222 buffer_append(&active_state->incoming_packet, 1223 buffer_ptr(&active_state->compression_buffer), 1224 buffer_len(&active_state->compression_buffer)); 1225 } 1226 active_state->p_read.packets++; 1227 active_state->p_read.bytes += padded_len + 4; 1228 type = buffer_get_char(&active_state->incoming_packet); 1229 if (type < SSH_MSG_MIN || type > SSH_MSG_MAX) 1230 packet_disconnect("Invalid ssh1 packet type: %d", type); 1231 return type; 1232 } 1233 1234 static int 1235 packet_read_poll2(u_int32_t *seqnr_p) 1236 { 1237 u_int padlen, need; 1238 u_char *macbuf, *cp, type; 1239 u_int maclen, block_size; 1240 Enc *enc = NULL; 1241 Mac *mac = NULL; 1242 Comp *comp = NULL; 1243 1244 if (active_state->packet_discard) 1245 return SSH_MSG_NONE; 1246 1247 if (active_state->newkeys[MODE_IN] != NULL) { 1248 enc = &active_state->newkeys[MODE_IN]->enc; 1249 mac = &active_state->newkeys[MODE_IN]->mac; 1250 comp = &active_state->newkeys[MODE_IN]->comp; 1251 } 1252 maclen = mac && mac->enabled ? mac->mac_len : 0; 1253 block_size = enc ? enc->block_size : 8; 1254 1255 if (active_state->packlen == 0) { 1256 /* 1257 * check if input size is less than the cipher block size, 1258 * decrypt first block and extract length of incoming packet 1259 */ 1260 if (buffer_len(&active_state->input) < block_size) 1261 return SSH_MSG_NONE; 1262 buffer_clear(&active_state->incoming_packet); 1263 cp = buffer_append_space(&active_state->incoming_packet, 1264 block_size); 1265 cipher_crypt(&active_state->receive_context, cp, 1266 buffer_ptr(&active_state->input), block_size); 1267 cp = buffer_ptr(&active_state->incoming_packet); 1268 active_state->packlen = get_u32(cp); 1269 if (active_state->packlen < 1 + 4 || 1270 active_state->packlen > PACKET_MAX_SIZE) { 1271 #ifdef PACKET_DEBUG 1272 buffer_dump(&active_state->incoming_packet); 1273 #endif 1274 logit("Bad packet length %u.", active_state->packlen); 1275 packet_start_discard(enc, mac, active_state->packlen, 1276 PACKET_MAX_SIZE); 1277 return SSH_MSG_NONE; 1278 } 1279 DBG(debug("input: packet len %u", active_state->packlen+4)); 1280 buffer_consume(&active_state->input, block_size); 1281 } 1282 /* we have a partial packet of block_size bytes */ 1283 need = 4 + active_state->packlen - block_size; 1284 DBG(debug("partial packet %d, need %d, maclen %d", block_size, 1285 need, maclen)); 1286 if (need % block_size != 0) { 1287 logit("padding error: need %d block %d mod %d", 1288 need, block_size, need % block_size); 1289 packet_start_discard(enc, mac, active_state->packlen, 1290 PACKET_MAX_SIZE - block_size); 1291 return SSH_MSG_NONE; 1292 } 1293 /* 1294 * check if the entire packet has been received and 1295 * decrypt into incoming_packet 1296 */ 1297 if (buffer_len(&active_state->input) < need + maclen) 1298 return SSH_MSG_NONE; 1299 #ifdef PACKET_DEBUG 1300 fprintf(stderr, "read_poll enc/full: "); 1301 buffer_dump(&active_state->input); 1302 #endif 1303 cp = buffer_append_space(&active_state->incoming_packet, need); 1304 cipher_crypt(&active_state->receive_context, cp, 1305 buffer_ptr(&active_state->input), need); 1306 buffer_consume(&active_state->input, need); 1307 /* 1308 * compute MAC over seqnr and packet, 1309 * increment sequence number for incoming packet 1310 */ 1311 if (mac && mac->enabled) { 1312 macbuf = mac_compute(mac, active_state->p_read.seqnr, 1313 buffer_ptr(&active_state->incoming_packet), 1314 buffer_len(&active_state->incoming_packet)); 1315 if (timingsafe_bcmp(macbuf, buffer_ptr(&active_state->input), 1316 mac->mac_len) != 0) { 1317 logit("Corrupted MAC on input."); 1318 if (need > PACKET_MAX_SIZE) 1319 fatal("internal error need %d", need); 1320 packet_start_discard(enc, mac, active_state->packlen, 1321 PACKET_MAX_SIZE - need); 1322 return SSH_MSG_NONE; 1323 } 1324 1325 DBG(debug("MAC #%d ok", active_state->p_read.seqnr)); 1326 buffer_consume(&active_state->input, mac->mac_len); 1327 } 1328 /* XXX now it's safe to use fatal/packet_disconnect */ 1329 if (seqnr_p != NULL) 1330 *seqnr_p = active_state->p_read.seqnr; 1331 if (++active_state->p_read.seqnr == 0) 1332 logit("incoming seqnr wraps around"); 1333 if (++active_state->p_read.packets == 0) 1334 if (!(datafellows & SSH_BUG_NOREKEY)) 1335 fatal("XXX too many packets with same key"); 1336 active_state->p_read.blocks += (active_state->packlen + 4) / block_size; 1337 active_state->p_read.bytes += active_state->packlen + 4; 1338 1339 /* get padlen */ 1340 cp = buffer_ptr(&active_state->incoming_packet); 1341 padlen = cp[4]; 1342 DBG(debug("input: padlen %d", padlen)); 1343 if (padlen < 4) 1344 packet_disconnect("Corrupted padlen %d on input.", padlen); 1345 1346 /* skip packet size + padlen, discard padding */ 1347 buffer_consume(&active_state->incoming_packet, 4 + 1); 1348 buffer_consume_end(&active_state->incoming_packet, padlen); 1349 1350 DBG(debug("input: len before de-compress %d", 1351 buffer_len(&active_state->incoming_packet))); 1352 if (comp && comp->enabled) { 1353 buffer_clear(&active_state->compression_buffer); 1354 buffer_uncompress(&active_state->incoming_packet, 1355 &active_state->compression_buffer); 1356 buffer_clear(&active_state->incoming_packet); 1357 buffer_append(&active_state->incoming_packet, 1358 buffer_ptr(&active_state->compression_buffer), 1359 buffer_len(&active_state->compression_buffer)); 1360 DBG(debug("input: len after de-compress %d", 1361 buffer_len(&active_state->incoming_packet))); 1362 } 1363 /* 1364 * get packet type, implies consume. 1365 * return length of payload (without type field) 1366 */ 1367 type = buffer_get_char(&active_state->incoming_packet); 1368 if (type < SSH2_MSG_MIN || type >= SSH2_MSG_LOCAL_MIN) 1369 packet_disconnect("Invalid ssh2 packet type: %d", type); 1370 if (type == SSH2_MSG_NEWKEYS) 1371 set_newkeys(MODE_IN); 1372 else if (type == SSH2_MSG_USERAUTH_SUCCESS && 1373 !active_state->server_side) 1374 packet_enable_delayed_compress(); 1375 #ifdef PACKET_DEBUG 1376 fprintf(stderr, "read/plain[%d]:\r\n", type); 1377 buffer_dump(&active_state->incoming_packet); 1378 #endif 1379 /* reset for next packet */ 1380 active_state->packlen = 0; 1381 return type; 1382 } 1383 1384 int 1385 packet_read_poll_seqnr(u_int32_t *seqnr_p) 1386 { 1387 u_int reason, seqnr; 1388 u_char type; 1389 char *msg; 1390 1391 for (;;) { 1392 if (compat20) { 1393 type = packet_read_poll2(seqnr_p); 1394 if (type) { 1395 active_state->keep_alive_timeouts = 0; 1396 DBG(debug("received packet type %d", type)); 1397 } 1398 switch (type) { 1399 case SSH2_MSG_IGNORE: 1400 debug3("Received SSH2_MSG_IGNORE"); 1401 break; 1402 case SSH2_MSG_DEBUG: 1403 packet_get_char(); 1404 msg = packet_get_string(NULL); 1405 debug("Remote: %.900s", msg); 1406 xfree(msg); 1407 msg = packet_get_string(NULL); 1408 xfree(msg); 1409 break; 1410 case SSH2_MSG_DISCONNECT: 1411 reason = packet_get_int(); 1412 msg = packet_get_string(NULL); 1413 logit("Received disconnect from %s: %u: %.400s", 1414 get_remote_ipaddr(), reason, msg); 1415 xfree(msg); 1416 cleanup_exit(255); 1417 break; 1418 case SSH2_MSG_UNIMPLEMENTED: 1419 seqnr = packet_get_int(); 1420 debug("Received SSH2_MSG_UNIMPLEMENTED for %u", 1421 seqnr); 1422 break; 1423 default: 1424 return type; 1425 } 1426 } else { 1427 type = packet_read_poll1(); 1428 switch (type) { 1429 case SSH_MSG_IGNORE: 1430 break; 1431 case SSH_MSG_DEBUG: 1432 msg = packet_get_string(NULL); 1433 debug("Remote: %.900s", msg); 1434 xfree(msg); 1435 break; 1436 case SSH_MSG_DISCONNECT: 1437 msg = packet_get_string(NULL); 1438 logit("Received disconnect from %s: %.400s", 1439 get_remote_ipaddr(), msg); 1440 cleanup_exit(255); 1441 break; 1442 default: 1443 if (type) 1444 DBG(debug("received packet type %d", type)); 1445 return type; 1446 } 1447 } 1448 } 1449 } 1450 1451 int 1452 packet_read_poll(void) 1453 { 1454 return packet_read_poll_seqnr(NULL); 1455 } 1456 1457 /* 1458 * Buffers the given amount of input characters. This is intended to be used 1459 * together with packet_read_poll. 1460 */ 1461 1462 void 1463 packet_process_incoming(const char *buf, u_int len) 1464 { 1465 if (active_state->packet_discard) { 1466 active_state->keep_alive_timeouts = 0; /* ?? */ 1467 if (len >= active_state->packet_discard) 1468 packet_stop_discard(); 1469 active_state->packet_discard -= len; 1470 return; 1471 } 1472 buffer_append(&active_state->input, buf, len); 1473 } 1474 1475 /* Returns a character from the packet. */ 1476 1477 u_int 1478 packet_get_char(void) 1479 { 1480 char ch; 1481 1482 buffer_get(&active_state->incoming_packet, &ch, 1); 1483 return (u_char) ch; 1484 } 1485 1486 /* Returns an integer from the packet data. */ 1487 1488 u_int 1489 packet_get_int(void) 1490 { 1491 return buffer_get_int(&active_state->incoming_packet); 1492 } 1493 1494 /* Returns an 64 bit integer from the packet data. */ 1495 1496 u_int64_t 1497 packet_get_int64(void) 1498 { 1499 return buffer_get_int64(&active_state->incoming_packet); 1500 } 1501 1502 /* 1503 * Returns an arbitrary precision integer from the packet data. The integer 1504 * must have been initialized before this call. 1505 */ 1506 1507 void 1508 packet_get_bignum(BIGNUM * value) 1509 { 1510 buffer_get_bignum(&active_state->incoming_packet, value); 1511 } 1512 1513 void 1514 packet_get_bignum2(BIGNUM * value) 1515 { 1516 buffer_get_bignum2(&active_state->incoming_packet, value); 1517 } 1518 1519 void * 1520 packet_get_raw(u_int *length_ptr) 1521 { 1522 u_int bytes = buffer_len(&active_state->incoming_packet); 1523 1524 if (length_ptr != NULL) 1525 *length_ptr = bytes; 1526 return buffer_ptr(&active_state->incoming_packet); 1527 } 1528 1529 int 1530 packet_remaining(void) 1531 { 1532 return buffer_len(&active_state->incoming_packet); 1533 } 1534 1535 /* 1536 * Returns a string from the packet data. The string is allocated using 1537 * xmalloc; it is the responsibility of the calling program to free it when 1538 * no longer needed. The length_ptr argument may be NULL, or point to an 1539 * integer into which the length of the string is stored. 1540 */ 1541 1542 void * 1543 packet_get_string(u_int *length_ptr) 1544 { 1545 return buffer_get_string(&active_state->incoming_packet, length_ptr); 1546 } 1547 1548 void * 1549 packet_get_string_ptr(u_int *length_ptr) 1550 { 1551 return buffer_get_string_ptr(&active_state->incoming_packet, length_ptr); 1552 } 1553 1554 /* 1555 * Sends a diagnostic message from the server to the client. This message 1556 * can be sent at any time (but not while constructing another message). The 1557 * message is printed immediately, but only if the client is being executed 1558 * in verbose mode. These messages are primarily intended to ease debugging 1559 * authentication problems. The length of the formatted message must not 1560 * exceed 1024 bytes. This will automatically call packet_write_wait. 1561 */ 1562 1563 void 1564 packet_send_debug(const char *fmt,...) 1565 { 1566 char buf[1024]; 1567 va_list args; 1568 1569 if (compat20 && (datafellows & SSH_BUG_DEBUG)) 1570 return; 1571 1572 va_start(args, fmt); 1573 vsnprintf(buf, sizeof(buf), fmt, args); 1574 va_end(args); 1575 1576 if (compat20) { 1577 packet_start(SSH2_MSG_DEBUG); 1578 packet_put_char(0); /* bool: always display */ 1579 packet_put_cstring(buf); 1580 packet_put_cstring(""); 1581 } else { 1582 packet_start(SSH_MSG_DEBUG); 1583 packet_put_cstring(buf); 1584 } 1585 packet_send(); 1586 packet_write_wait(); 1587 } 1588 1589 /* 1590 * Logs the error plus constructs and sends a disconnect packet, closes the 1591 * connection, and exits. This function never returns. The error message 1592 * should not contain a newline. The length of the formatted message must 1593 * not exceed 1024 bytes. 1594 */ 1595 1596 void 1597 packet_disconnect(const char *fmt,...) 1598 { 1599 char buf[1024]; 1600 va_list args; 1601 static int disconnecting = 0; 1602 1603 if (disconnecting) /* Guard against recursive invocations. */ 1604 fatal("packet_disconnect called recursively."); 1605 disconnecting = 1; 1606 1607 /* 1608 * Format the message. Note that the caller must make sure the 1609 * message is of limited size. 1610 */ 1611 va_start(args, fmt); 1612 vsnprintf(buf, sizeof(buf), fmt, args); 1613 va_end(args); 1614 1615 /* Display the error locally */ 1616 logit("Disconnecting: %.100s", buf); 1617 1618 /* Send the disconnect message to the other side, and wait for it to get sent. */ 1619 if (compat20) { 1620 packet_start(SSH2_MSG_DISCONNECT); 1621 packet_put_int(SSH2_DISCONNECT_PROTOCOL_ERROR); 1622 packet_put_cstring(buf); 1623 packet_put_cstring(""); 1624 } else { 1625 packet_start(SSH_MSG_DISCONNECT); 1626 packet_put_cstring(buf); 1627 } 1628 packet_send(); 1629 packet_write_wait(); 1630 1631 /* Stop listening for connections. */ 1632 channel_close_all(); 1633 1634 /* Close the connection. */ 1635 packet_close(); 1636 cleanup_exit(255); 1637 } 1638 1639 /* Checks if there is any buffered output, and tries to write some of the output. */ 1640 1641 int 1642 packet_write_poll(void) 1643 { 1644 int len = buffer_len(&active_state->output); 1645 int cont; 1646 1647 if (len > 0) { 1648 cont = 0; 1649 len = roaming_write(active_state->connection_out, 1650 buffer_ptr(&active_state->output), len, &cont); 1651 if (len == -1) { 1652 if (errno == EINTR || errno == EAGAIN || 1653 errno == EWOULDBLOCK) 1654 return(0); 1655 fatal("Write failed: %.100s", strerror(errno)); 1656 } 1657 if (len == 0 && !cont) 1658 fatal("Write connection closed"); 1659 buffer_consume(&active_state->output, len); 1660 } 1661 return(len); 1662 } 1663 1664 /* 1665 * Calls packet_write_poll repeatedly until all pending output data has been 1666 * written. 1667 */ 1668 1669 void 1670 packet_write_wait(void) 1671 { 1672 fd_set *setp; 1673 int ret, ms_remain; 1674 struct timeval start, timeout, *timeoutp = NULL; 1675 1676 setp = (fd_set *)xcalloc(howmany(active_state->connection_out + 1, 1677 NFDBITS), sizeof(fd_mask)); 1678 packet_write_poll(); 1679 while (packet_have_data_to_write()) { 1680 memset(setp, 0, howmany(active_state->connection_out + 1, 1681 NFDBITS) * sizeof(fd_mask)); 1682 FD_SET(active_state->connection_out, setp); 1683 1684 if (active_state->packet_timeout_ms > 0) { 1685 ms_remain = active_state->packet_timeout_ms; 1686 timeoutp = &timeout; 1687 } 1688 for (;;) { 1689 if (active_state->packet_timeout_ms != -1) { 1690 ms_to_timeval(&timeout, ms_remain); 1691 gettimeofday(&start, NULL); 1692 } 1693 if ((ret = select(active_state->connection_out + 1, 1694 NULL, setp, NULL, timeoutp)) >= 0) 1695 break; 1696 if (errno != EAGAIN && errno != EINTR && 1697 errno != EWOULDBLOCK) 1698 break; 1699 if (active_state->packet_timeout_ms == -1) 1700 continue; 1701 ms_subtract_diff(&start, &ms_remain); 1702 if (ms_remain <= 0) { 1703 ret = 0; 1704 break; 1705 } 1706 } 1707 if (ret == 0) { 1708 logit("Connection to %.200s timed out while " 1709 "waiting to write", get_remote_ipaddr()); 1710 cleanup_exit(255); 1711 } 1712 packet_write_poll(); 1713 } 1714 xfree(setp); 1715 } 1716 1717 /* Returns true if there is buffered data to write to the connection. */ 1718 1719 int 1720 packet_have_data_to_write(void) 1721 { 1722 return buffer_len(&active_state->output) != 0; 1723 } 1724 1725 /* Returns true if there is not too much data to write to the connection. */ 1726 1727 int 1728 packet_not_very_much_data_to_write(void) 1729 { 1730 if (active_state->interactive_mode) 1731 return buffer_len(&active_state->output) < 16384; 1732 else 1733 return buffer_len(&active_state->output) < 128 * 1024; 1734 } 1735 1736 static void 1737 packet_set_tos(int interactive) 1738 { 1739 #if defined(IP_TOS) && !defined(IP_TOS_IS_BROKEN) 1740 int tos = interactive ? IPTOS_LOWDELAY : IPTOS_THROUGHPUT; 1741 1742 if (!packet_connection_is_on_socket() || 1743 !packet_connection_is_ipv4()) 1744 return; 1745 if (setsockopt(active_state->connection_in, IPPROTO_IP, IP_TOS, &tos, 1746 sizeof(tos)) < 0) 1747 error("setsockopt IP_TOS %d: %.100s:", 1748 tos, strerror(errno)); 1749 #endif 1750 } 1751 1752 /* Informs that the current session is interactive. Sets IP flags for that. */ 1753 1754 void 1755 packet_set_interactive(int interactive) 1756 { 1757 if (active_state->set_interactive_called) 1758 return; 1759 active_state->set_interactive_called = 1; 1760 1761 /* Record that we are in interactive mode. */ 1762 active_state->interactive_mode = interactive; 1763 1764 /* Only set socket options if using a socket. */ 1765 if (!packet_connection_is_on_socket()) 1766 return; 1767 set_nodelay(active_state->connection_in); 1768 packet_set_tos(interactive); 1769 } 1770 1771 /* Returns true if the current connection is interactive. */ 1772 1773 int 1774 packet_is_interactive(void) 1775 { 1776 return active_state->interactive_mode; 1777 } 1778 1779 int 1780 packet_set_maxsize(u_int s) 1781 { 1782 if (active_state->set_maxsize_called) { 1783 logit("packet_set_maxsize: called twice: old %d new %d", 1784 active_state->max_packet_size, s); 1785 return -1; 1786 } 1787 if (s < 4 * 1024 || s > 1024 * 1024) { 1788 logit("packet_set_maxsize: bad size %d", s); 1789 return -1; 1790 } 1791 active_state->set_maxsize_called = 1; 1792 debug("packet_set_maxsize: setting to %d", s); 1793 active_state->max_packet_size = s; 1794 return s; 1795 } 1796 1797 int 1798 packet_inc_alive_timeouts(void) 1799 { 1800 return ++active_state->keep_alive_timeouts; 1801 } 1802 1803 void 1804 packet_set_alive_timeouts(int ka) 1805 { 1806 active_state->keep_alive_timeouts = ka; 1807 } 1808 1809 u_int 1810 packet_get_maxsize(void) 1811 { 1812 return active_state->max_packet_size; 1813 } 1814 1815 /* roundup current message to pad bytes */ 1816 void 1817 packet_add_padding(u_char pad) 1818 { 1819 active_state->extra_pad = pad; 1820 } 1821 1822 /* 1823 * 9.2. Ignored Data Message 1824 * 1825 * byte SSH_MSG_IGNORE 1826 * string data 1827 * 1828 * All implementations MUST understand (and ignore) this message at any 1829 * time (after receiving the protocol version). No implementation is 1830 * required to send them. This message can be used as an additional 1831 * protection measure against advanced traffic analysis techniques. 1832 */ 1833 void 1834 packet_send_ignore(int nbytes) 1835 { 1836 u_int32_t rnd = 0; 1837 int i; 1838 1839 packet_start(compat20 ? SSH2_MSG_IGNORE : SSH_MSG_IGNORE); 1840 packet_put_int(nbytes); 1841 for (i = 0; i < nbytes; i++) { 1842 if (i % 4 == 0) 1843 rnd = arc4random(); 1844 packet_put_char((u_char)rnd & 0xff); 1845 rnd >>= 8; 1846 } 1847 } 1848 1849 int rekey_requested = 0; 1850 void 1851 packet_request_rekeying(void) 1852 { 1853 rekey_requested = 1; 1854 } 1855 1856 #define MAX_PACKETS (1U<<31) 1857 int 1858 packet_need_rekeying(void) 1859 { 1860 if (datafellows & SSH_BUG_NOREKEY) 1861 return 0; 1862 if (rekey_requested == 1) 1863 { 1864 rekey_requested = 0; 1865 return 1; 1866 } 1867 return 1868 (active_state->p_send.packets > MAX_PACKETS) || 1869 (active_state->p_read.packets > MAX_PACKETS) || 1870 (active_state->max_blocks_out && 1871 (active_state->p_send.blocks > active_state->max_blocks_out)) || 1872 (active_state->max_blocks_in && 1873 (active_state->p_read.blocks > active_state->max_blocks_in)); 1874 } 1875 1876 void 1877 packet_set_rekey_limit(u_int32_t bytes) 1878 { 1879 active_state->rekey_limit = bytes; 1880 } 1881 1882 void 1883 packet_set_server(void) 1884 { 1885 active_state->server_side = 1; 1886 } 1887 1888 void 1889 packet_set_authenticated(void) 1890 { 1891 active_state->after_authentication = 1; 1892 } 1893 1894 void * 1895 packet_get_input(void) 1896 { 1897 return (void *)&active_state->input; 1898 } 1899 1900 void * 1901 packet_get_output(void) 1902 { 1903 return (void *)&active_state->output; 1904 } 1905 1906 void * 1907 packet_get_newkeys(int mode) 1908 { 1909 return (void *)active_state->newkeys[mode]; 1910 } 1911 1912 /* 1913 * Save the state for the real connection, and use a separate state when 1914 * resuming a suspended connection. 1915 */ 1916 void 1917 packet_backup_state(void) 1918 { 1919 struct session_state *tmp; 1920 1921 close(active_state->connection_in); 1922 active_state->connection_in = -1; 1923 close(active_state->connection_out); 1924 active_state->connection_out = -1; 1925 if (backup_state) 1926 tmp = backup_state; 1927 else 1928 tmp = alloc_session_state(); 1929 backup_state = active_state; 1930 active_state = tmp; 1931 } 1932 1933 /* 1934 * Swap in the old state when resuming a connecion. 1935 */ 1936 void 1937 packet_restore_state(void) 1938 { 1939 struct session_state *tmp; 1940 void *buf; 1941 u_int len; 1942 1943 tmp = backup_state; 1944 backup_state = active_state; 1945 active_state = tmp; 1946 active_state->connection_in = backup_state->connection_in; 1947 backup_state->connection_in = -1; 1948 active_state->connection_out = backup_state->connection_out; 1949 backup_state->connection_out = -1; 1950 len = buffer_len(&backup_state->input); 1951 if (len > 0) { 1952 buf = buffer_ptr(&backup_state->input); 1953 buffer_append(&active_state->input, buf, len); 1954 buffer_clear(&backup_state->input); 1955 add_recv_bytes(len); 1956 } 1957 } 1958 1959 int 1960 packet_authentication_state(void) 1961 { 1962 return(active_state->after_authentication); 1963 } 1964