| ︙ | | |
861
862
863
864
865
866
867
868
869
870
871
872
873
874
|
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
|
+
|
st->gotcrc = GET_32BIT(ssh->pktin.data + st->biglen - 4);
if (st->gotcrc != st->realcrc) {
bombout(("Incorrect CRC received on packet"));
crStop(0);
}
ssh->pktin.body = ssh->pktin.data + st->pad + 1;
ssh->pktin.savedpos = 0;
if (ssh->v1_compressing) {
unsigned char *decompblk;
int decomplen;
if (!zlib_decompress_block(ssh->sc_comp_ctx,
ssh->pktin.body - 1, ssh->pktin.length + 1,
&decompblk, &decomplen)) {
|
| ︙ | | |
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
|
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
|
+
|
ssh->pktin.length = 5 + newlen;
memcpy(ssh->pktin.data + 5, newpayload, newlen);
sfree(newpayload);
}
}
ssh->pktin.savedpos = 6;
ssh->pktin.body = ssh->pktin.data;
ssh->pktin.type = ssh->pktin.data[5];
if (ssh->logctx)
log_packet(ssh->logctx, PKT_INCOMING, ssh->pktin.type,
ssh2_pkt_type(ssh->pkt_ctx, ssh->pktin.type),
ssh->pktin.data+6, ssh->pktin.length-6);
|
| ︙ | | |
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
|
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
|
-
+
-
+
-
+
-
+
-
+
-
+
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+
|
int len;
p = ssh2_mpint_fmt(b, &len);
sha_string(s, p, len);
sfree(p);
}
/*
* SSH2 packet decode functions.
* Packet decode functions for both SSH1 and SSH2.
*/
static unsigned long ssh2_pkt_getuint32(Ssh ssh)
static unsigned long ssh_pkt_getuint32(Ssh ssh)
{
unsigned long value;
if (ssh->pktin.length - ssh->pktin.savedpos < 4)
return 0; /* arrgh, no way to decline (FIXME?) */
value = GET_32BIT(ssh->pktin.data + ssh->pktin.savedpos);
value = GET_32BIT(ssh->pktin.body + ssh->pktin.savedpos);
ssh->pktin.savedpos += 4;
return value;
}
static int ssh2_pkt_getbool(Ssh ssh)
{
unsigned long value;
if (ssh->pktin.length - ssh->pktin.savedpos < 1)
return 0; /* arrgh, no way to decline (FIXME?) */
value = ssh->pktin.data[ssh->pktin.savedpos] != 0;
value = ssh->pktin.body[ssh->pktin.savedpos] != 0;
ssh->pktin.savedpos++;
return value;
}
static void ssh2_pkt_getstring(Ssh ssh, char **p, int *length)
static void ssh_pkt_getstring(Ssh ssh, char **p, int *length)
{
int len;
*p = NULL;
*length = 0;
if (ssh->pktin.length - ssh->pktin.savedpos < 4)
return;
len = GET_32BIT(ssh->pktin.data + ssh->pktin.savedpos);
len = GET_32BIT(ssh->pktin.body + ssh->pktin.savedpos);
if (len < 0)
return;
*length = len;
ssh->pktin.savedpos += 4;
if (ssh->pktin.length - ssh->pktin.savedpos < *length)
return;
*p = (char *)(ssh->pktin.data + ssh->pktin.savedpos);
*p = (char *)(ssh->pktin.body + ssh->pktin.savedpos);
ssh->pktin.savedpos += *length;
}
static void *ssh_pkt_getdata(Ssh ssh, int length)
{
if (ssh->pktin.length - ssh->pktin.savedpos < length)
return NULL;
ssh->pktin.savedpos += length;
return ssh->pktin.body + (ssh->pktin.savedpos - length);
}
static int ssh1_pkt_getrsakey(Ssh ssh, struct RSAKey *key,
unsigned char **keystr)
{
int j;
j = makekey(ssh->pktin.body + ssh->pktin.savedpos,
ssh->pktin.length - ssh->pktin.savedpos,
key, keystr, 0);
if (j < 0)
return FALSE;
ssh->pktin.savedpos += j;
assert(ssh->pktin.savedpos < ssh->pktin.length);
return TRUE;
}
static Bignum ssh1_pkt_getmp(Ssh ssh)
{
int j;
Bignum b;
j = ssh1_read_bignum(ssh->pktin.body + ssh->pktin.savedpos,
ssh->pktin.length - ssh->pktin.savedpos, &b);
if (j < 0)
return NULL;
ssh->pktin.savedpos += j;
return b;
}
static Bignum ssh2_pkt_getmp(Ssh ssh)
{
char *p;
int length;
Bignum b;
ssh2_pkt_getstring(ssh, &p, &length);
ssh_pkt_getstring(ssh, &p, &length);
if (!p)
return NULL;
if (p[0] & 0x80) {
bombout(("internal error: Can't handle negative mpints"));
return NULL;
}
b = bignum_from_bytes((unsigned char *)p, length);
|
| ︙ | | |
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
|
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
|
-
-
+
+
|
}
/*
* Handle the key exchange and user authentication phases.
*/
static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt)
{
int i, j;
unsigned char cookie[8];
int i, j, ret;
unsigned char cookie[8], *ptr;
struct RSAKey servkey, hostkey;
struct MD5Context md5c;
struct do_ssh1_login_state {
int len;
unsigned char *rsabuf, *keystr1, *keystr2;
unsigned long supported_ciphers_mask, supported_auths_mask;
int tried_publickey, tried_agent;
|
| ︙ | | |
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
|
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
|
+
+
+
+
+
-
+
-
-
+
+
+
+
+
-
-
-
+
+
+
-
+
+
+
+
+
+
+
+
+
+
|
if (ssh->pktin.type != SSH1_SMSG_PUBLIC_KEY) {
bombout(("Public key packet not received"));
crStop(0);
}
logevent("Received public keys");
ptr = ssh_pkt_getdata(ssh, 8);
if (!ptr) {
bombout(("SSH1 public key packet stopped before random cookie"));
crStop(0);
}
memcpy(cookie, ssh->pktin.body, 8);
memcpy(cookie, ptr, 8);
i = makekey(ssh->pktin.body + 8, &servkey, &s->keystr1, 0);
j = makekey(ssh->pktin.body + 8 + i, &hostkey, &s->keystr2, 0);
if (!ssh1_pkt_getrsakey(ssh, &servkey, &s->keystr1) ||
!ssh1_pkt_getrsakey(ssh, &hostkey, &s->keystr2)) {
bombout(("SSH1 public key packet stopped before public keys"));
crStop(0);
}
/*
* Log the host key fingerprint.
*/
{
char logmsg[80];
logevent("Host key fingerprint is:");
strcpy(logmsg, " ");
hostkey.comment = NULL;
rsa_fingerprint(logmsg + strlen(logmsg),
sizeof(logmsg) - strlen(logmsg), &hostkey);
logevent(logmsg);
}
ssh->v1_remote_protoflags = GET_32BIT(ssh->pktin.body + 8 + i + j);
s->supported_ciphers_mask = GET_32BIT(ssh->pktin.body + 12 + i + j);
s->supported_auths_mask = GET_32BIT(ssh->pktin.body + 16 + i + j);
ssh->v1_remote_protoflags = ssh_pkt_getuint32(ssh);
s->supported_ciphers_mask = ssh_pkt_getuint32(ssh);
s->supported_auths_mask = ssh_pkt_getuint32(ssh);
ssh->v1_local_protoflags =
ssh->v1_remote_protoflags & SSH1_PROTOFLAGS_SUPPORTED;
ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
MD5Init(&md5c);
MD5Update(&md5c, s->keystr2, hostkey.bytes);
MD5Update(&md5c, s->keystr1, servkey.bytes);
MD5Update(&md5c, ssh->pktin.body, 8);
MD5Update(&md5c, cookie, 8);
MD5Final(s->session_id, &md5c);
for (i = 0; i < 32; i++)
ssh->session_key[i] = random_byte();
/*
* Verify that the `bits' and `bytes' parameters match.
*/
if (hostkey.bits > hostkey.bytes * 8 ||
servkey.bits > servkey.bytes * 8) {
bombout(("SSH1 public keys were badly formatted"));
crStop(0);
}
s->len = (hostkey.bytes > servkey.bytes ? hostkey.bytes : servkey.bytes);
s->rsabuf = snewn(s->len, unsigned char);
if (!s->rsabuf)
fatalbox("Out of memory");
|
| ︙ | | |
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
|
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
|
-
-
+
+
+
-
-
+
+
+
+
+
+
+
|
for (i = 0; i < 32; i++) {
s->rsabuf[i] = ssh->session_key[i];
if (i < 16)
s->rsabuf[i] ^= s->session_id[i];
}
if (hostkey.bytes > servkey.bytes) {
rsaencrypt(s->rsabuf, 32, &servkey);
rsaencrypt(s->rsabuf, servkey.bytes, &hostkey);
ret = rsaencrypt(s->rsabuf, 32, &servkey);
if (ret)
ret = rsaencrypt(s->rsabuf, servkey.bytes, &hostkey);
} else {
rsaencrypt(s->rsabuf, 32, &hostkey);
rsaencrypt(s->rsabuf, hostkey.bytes, &servkey);
ret = rsaencrypt(s->rsabuf, 32, &hostkey);
if (ret)
ret = rsaencrypt(s->rsabuf, hostkey.bytes, &servkey);
}
if (!ret) {
bombout(("SSH1 public key encryptions failed due to bad formatting"));
crStop(0);
}
logevent("Encrypted session key");
{
int cipher_chosen = 0, warn = 0;
char *cipher_string = NULL;
|
| ︙ | | |
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
|
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
|
+
+
+
+
+
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+
|
if (s->publickey_blob &&
!memcmp(s->p, s->publickey_blob,
s->publickey_bloblen)) {
logevent("This key matches configured key file");
s->tried_publickey = 1;
}
s->p += 4;
{
int n, ok = FALSE;
do { /* do while (0) to make breaking easy */
n = ssh1_read_bignum
(s->p, s->responselen-(s->p-s->response),
s->p += ssh1_read_bignum(s->p, &s->key.exponent);
s->p += ssh1_read_bignum(s->p, &s->key.modulus);
s->commentlen = GET_32BIT(s->p);
s->p += 4;
s->commentp = (char *)s->p;
s->p += s->commentlen;
&s->key.exponent);
if (n < 0)
break;
s->p += n;
n = ssh1_read_bignum
(s->p, s->responselen-(s->p-s->response),
&s->key.modulus);
if (n < 0)
break;
s->p += n;
if (s->responselen - (s->p-s->response) < 4)
break;
s->commentlen = GET_32BIT(s->p);
s->p += 4;
if (s->responselen - (s->p-s->response) <
s->commentlen)
break;
s->commentp = (char *)s->p;
s->p += s->commentlen;
ok = TRUE;
} while (0);
if (!ok) {
logevent("Pageant key list packet was truncated");
break;
}
}
send_packet(ssh, SSH1_CMSG_AUTH_RSA,
PKT_BIGNUM, s->key.modulus, PKT_END);
crWaitUntil(ispkt);
if (ssh->pktin.type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
logevent("Key refused");
continue;
}
logevent("Received RSA challenge");
if ((s->challenge = ssh1_pkt_getmp(ssh)) == NULL) {
bombout(("Server's RSA challenge was badly formatted"));
crStop(0);
}
ssh1_read_bignum(ssh->pktin.body, &s->challenge);
|
| ︙ | | |
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
|
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
|
+
-
+
+
+
+
+
+
+
-
+
|
if (ssh->pktin.type != SSH1_SMSG_AUTH_TIS_CHALLENGE) {
logevent("TIS authentication declined");
if (flags & FLAG_INTERACTIVE)
c_write_str(ssh, "TIS authentication refused.\r\n");
s->tis_auth_refused = 1;
continue;
} else {
char *challenge;
int challengelen = GET_32BIT(ssh->pktin.body);
int challengelen;
ssh_pkt_getstring(ssh, &challenge, &challengelen);
if (!challenge) {
bombout(("TIS challenge packet was badly formed"));
crStop(0);
}
logevent("Received TIS challenge");
if (challengelen > sizeof(s->prompt) - 1)
challengelen = sizeof(s->prompt) - 1;/* prevent overrun */
memcpy(s->prompt, ssh->pktin.body + 4, challengelen);
memcpy(s->prompt, challenge, challengelen);
/* Prompt heuristic comes from OpenSSH */
strncpy(s->prompt + challengelen,
memchr(s->prompt, '\n', challengelen) ?
"": "\r\nResponse: ",
(sizeof s->prompt) - challengelen);
s->prompt[(sizeof s->prompt) - 1] = '\0';
}
|
| ︙ | | |
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
|
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
|
+
-
+
+
+
+
+
+
+
-
+
|
crWaitUntil(ispkt);
if (ssh->pktin.type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
logevent("CryptoCard authentication declined");
c_write_str(ssh, "CryptoCard authentication refused.\r\n");
s->ccard_auth_refused = 1;
continue;
} else {
char *challenge;
int challengelen = GET_32BIT(ssh->pktin.body);
int challengelen;
ssh_pkt_getstring(ssh, &challenge, &challengelen);
if (!challenge) {
bombout(("CryptoCard challenge packet was badly formed"));
crStop(0);
}
logevent("Received CryptoCard challenge");
if (challengelen > sizeof(s->prompt) - 1)
challengelen = sizeof(s->prompt) - 1;/* prevent overrun */
memcpy(s->prompt, ssh->pktin.body + 4, challengelen);
memcpy(s->prompt, challenge, challengelen);
strncpy(s->prompt + challengelen,
memchr(s->prompt, '\n', challengelen) ?
"" : "\r\nResponse: ",
sizeof(s->prompt) - challengelen);
s->prompt[sizeof(s->prompt) - 1] = '\0';
}
}
|
| ︙ | | |
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
|
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
|
-
+
+
+
+
|
}
{
int i;
unsigned char buffer[32];
Bignum challenge, response;
ssh1_read_bignum(ssh->pktin.body, &challenge);
if ((challenge = ssh1_pkt_getmp(ssh)) == NULL) {
bombout(("Server's RSA challenge was badly formatted"));
crStop(0);
}
response = rsadecrypt(challenge, &s->key);
freebn(s->key.private_exponent);/* burn the evidence */
for (i = 0; i < 32; i++) {
buffer[i] = bignum_byte(response, 31 - i);
}
|
| ︙ | | |
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505
3506
3507
3508
3509
3510
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523
3524
3525
3526
3527
3528
3529
3530
3531
3532
3533
3534
3535
3536
3537
3538
3539
3540
3541
3542
3543
3544
3545
3546
3547
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560
3561
3562
3563
3564
3565
3566
3567
3568
3569
3570
3571
3572
3573
3574
3575
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586
3587
3588
3589
3590
3591
3592
3593
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
|
3594
3595
3596
3597
3598
3599
3600
3601
3602
3603
3604
3605
3606
3607
3608
3609
3610
3611
3612
3613
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625
3626
3627
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675
3676
3677
3678
3679
3680
3681
3682
3683
3684
3685
3686
3687
3688
3689
3690
3691
3692
3693
3694
3695
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
3723
3724
3725
3726
3727
3728
3729
3730
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741
3742
3743
3744
3745
3746
3747
|
+
+
-
-
+
+
+
+
+
+
+
+
-
+
+
-
+
-
+
-
-
+
-
-
+
+
+
-
+
-
+
+
-
+
-
-
+
-
-
+
-
-
+
-
-
-
+
+
-
-
-
+
+
+
-
+
-
+
-
+
-
+
+
-
-
+
-
+
-
-
+
+
|
ssh->send_ok = 1;
ssh->channels = newtree234(ssh_channelcmp);
while (1) {
crReturnV;
if (ispkt) {
if (ssh->pktin.type == SSH1_SMSG_STDOUT_DATA ||
ssh->pktin.type == SSH1_SMSG_STDERR_DATA) {
char *string;
int stringlen, bufsize;
long len = GET_32BIT(ssh->pktin.body);
int bufsize =
(char *)(ssh->pktin.body) + 4, len);
string, stringlen);
if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
ssh->v1_stdout_throttling = 1;
ssh1_throttle(ssh, +1);
}
} else if (ssh->pktin.type == SSH1_MSG_DISCONNECT) {
ssh_closing((Plug)ssh, NULL, 0, 0);
logevent("Received disconnect request");
crStopV;
} else if (ssh->pktin.type == SSH1_SMSG_X11_OPEN) {
/* Remote side is trying to open a channel to talk to our
* X-Server. Give them back a local channel number. */
struct ssh_channel *c;
int remoteid = ssh_pkt_getuint32(ssh);
logevent("Received X11 connect request");
/* Refuse if X11 forwarding is disabled. */
if (!ssh->X11_fwd_enabled) {
send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
PKT_INT, GET_32BIT(ssh->pktin.body), PKT_END);
PKT_INT, remoteid, PKT_END);
logevent("Rejected X11 connect request");
} else {
c = snew(struct ssh_channel);
c->ssh = ssh;
if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c,
ssh->x11auth, NULL, -1, &ssh->cfg) != NULL) {
logevent("opening X11 forward connection failed");
logevent("Opening X11 forward connection failed");
sfree(c);
send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
PKT_INT, GET_32BIT(ssh->pktin.body),
PKT_END);
("opening X11 forward connection succeeded");
c->remoteid = GET_32BIT(ssh->pktin.body);
("Opening X11 forward connection succeeded");
c->remoteid = remoteid;
c->localid = alloc_channel_id(ssh);
c->closes = 0;
c->v.v1.throttling = 0;
c->type = CHAN_X11; /* identify channel type */
add234(ssh->channels, c);
send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
PKT_INT, c->remoteid, PKT_INT,
c->localid, PKT_END);
logevent("Opened X11 forward channel");
}
}
} else if (ssh->pktin.type == SSH1_SMSG_AGENT_OPEN) {
/* Remote side is trying to open a channel to talk to our
* agent. Give them back a local channel number. */
struct ssh_channel *c;
int remoteid = ssh_pkt_getuint32(ssh);
/* Refuse if agent forwarding is disabled. */
if (!ssh->agentfwd_enabled) {
send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
PKT_INT, GET_32BIT(ssh->pktin.body), PKT_END);
PKT_INT, remoteid, PKT_END);
} else {
c = snew(struct ssh_channel);
c->ssh = ssh;
c->remoteid = GET_32BIT(ssh->pktin.body);
c->remoteid = remoteid;
c->localid = alloc_channel_id(ssh);
c->closes = 0;
c->v.v1.throttling = 0;
c->type = CHAN_AGENT; /* identify channel type */
c->u.a.lensofar = 0;
add234(ssh->channels, c);
send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
PKT_INT, c->remoteid, PKT_INT, c->localid,
PKT_END);
}
} else if (ssh->pktin.type == SSH1_MSG_PORT_OPEN) {
/* Remote side is trying to open a channel to talk to a
* forwarded port. Give them back a local channel number. */
struct ssh_channel *c;
struct ssh_rportfwd pf;
int remoteid;
int hostsize, port;
char host[256], buf[1024];
char *host, buf[1024];
char *p, *h;
hostsize = GET_32BIT(ssh->pktin.body+4);
remoteid = ssh_pkt_getuint32(ssh);
for (h = host, p = (char *)(ssh->pktin.body+8);
hostsize != 0; hostsize--) {
if (h+1 < host+sizeof(host))
*h++ = *p;
p++;
}
*h = 0;
port = GET_32BIT(p);
strcpy(pf.dhost, host);
host, port);
pf.dhost, port);
logevent(buf);
send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
PKT_INT, GET_32BIT(ssh->pktin.body), PKT_END);
PKT_INT, remoteid, PKT_END);
} else {
sprintf(buf, "Received remote port open request for %s:%d",
host, port);
pf.dhost, port);
logevent(buf);
e = pfd_newconnect(&c->u.pfd.s, host, port, c, &ssh->cfg);
e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port,
c, &ssh->cfg);
if (e != NULL) {
char buf[256];
sprintf(buf, "Port open failed: %s", e);
logevent(buf);
sfree(c);
send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
PKT_INT, GET_32BIT(ssh->pktin.body),
PKT_END);
c->remoteid = GET_32BIT(ssh->pktin.body);
c->remoteid = remoteid;
c->localid = alloc_channel_id(ssh);
c->closes = 0;
c->v.v1.throttling = 0;
c->type = CHAN_SOCKDATA; /* identify channel type */
add234(ssh->channels, c);
send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
PKT_INT, c->remoteid, PKT_INT,
c->localid, PKT_END);
logevent("Forwarded port opened successfully");
}
}
} else if (ssh->pktin.type == SSH1_MSG_CHANNEL_OPEN_CONFIRMATION) {
unsigned int remoteid = GET_32BIT(ssh->pktin.body);
unsigned int localid = GET_32BIT(ssh->pktin.body+4);
unsigned int remoteid = ssh_pkt_getuint32(ssh);
unsigned int localid = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &remoteid, ssh_channelfind);
if (c && c->type == CHAN_SOCKDATA_DORMANT) {
c->remoteid = localid;
c->type = CHAN_SOCKDATA;
c->v.v1.throttling = 0;
|
| ︙ | | |
3641
3642
3643
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
|
3756
3757
3758
3759
3760
3761
3762
3763
3764
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
3779
3780
3781
3782
3783
3784
|
-
+
-
+
|
* remoteid, we can close it again.
*/
send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE,
PKT_INT, c->remoteid, PKT_END);
}
} else if (ssh->pktin.type == SSH1_MSG_CHANNEL_OPEN_FAILURE) {
unsigned int remoteid = GET_32BIT(ssh->pktin.body);
unsigned int remoteid = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &remoteid, ssh_channelfind);
if (c && c->type == CHAN_SOCKDATA_DORMANT) {
logevent("Forwarded connection refused by server");
pfd_close(c->u.pfd.s);
del234(ssh->channels, c);
sfree(c);
}
} else if (ssh->pktin.type == SSH1_MSG_CHANNEL_CLOSE ||
ssh->pktin.type == SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION) {
/* Remote side closes a channel. */
unsigned i = GET_32BIT(ssh->pktin.body);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (c && ((int)c->remoteid) != -1) {
int closetype;
closetype =
(ssh->pktin.type == SSH1_MSG_CHANNEL_CLOSE ? 1 : 2);
|
| ︙ | | |
3696
3697
3698
3699
3700
3701
3702
3703
3704
3705
3706
3707
3708
3709
3710
3711
3712
3713
3714
3715
3716
3717
3718
3719
3720
3721
3722
|
3811
3812
3813
3814
3815
3816
3817
3818
3819
3820
3821
3822
3823
3824
3825
3826
3827
3828
3829
3830
3831
3832
3833
3834
3835
3836
3837
3838
3839
3840
|
-
-
+
+
+
-
+
+
+
-
+
-
+
|
ssh->pktin.type == SSH1_MSG_CHANNEL_CLOSE ? "" :
"_CONFIRMATION", c ? "half-open" : "nonexistent",
i));
crStopV;
}
} else if (ssh->pktin.type == SSH1_MSG_CHANNEL_DATA) {
/* Data sent down one of our channels. */
int i = GET_32BIT(ssh->pktin.body);
int len = GET_32BIT(ssh->pktin.body + 4);
int i = ssh_pkt_getuint32(ssh);
char *p;
int len;
unsigned char *p = ssh->pktin.body + 8;
bufsize = x11_send(c->u.x11.s, (char *)p, len);
bufsize = x11_send(c->u.x11.s, p, len);
break;
case CHAN_SOCKDATA:
bufsize = pfd_send(c->u.pfd.s, (char *)p, len);
bufsize = pfd_send(c->u.pfd.s, p, len);
break;
case CHAN_AGENT:
/* Data for an agent message. Buffer it. */
while (len > 0) {
if (c->u.a.lensofar < 4) {
int l = min(4 - c->u.a.lensofar, len);
memcpy(c->u.a.msglen + c->u.a.lensofar, p,
|
| ︙ | | |
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
3779
|
3883
3884
3885
3886
3887
3888
3889
3890
3891
3892
3893
3894
3895
3896
3897
|
-
+
|
} else if (ssh->pktin.type == SSH1_SMSG_SUCCESS) {
/* may be from EXEC_SHELL on some servers */
} else if (ssh->pktin.type == SSH1_SMSG_FAILURE) {
/* may be from EXEC_SHELL on some servers
* if no pty is available or in other odd cases. Ignore */
} else if (ssh->pktin.type == SSH1_SMSG_EXIT_STATUS) {
char buf[100];
ssh->exitcode = GET_32BIT(ssh->pktin.body);
ssh->exitcode = ssh_pkt_getuint32(ssh);
sprintf(buf, "Server sent command exit status %d",
ssh->exitcode);
logevent(buf);
send_packet(ssh, SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
/*
* In case `helpful' firewalls or proxies tack
* extra human-readable text on the end of the
|
| ︙ | | |
4065
4066
4067
4068
4069
4070
4071
4072
4073
4074
4075
4076
4077
4078
4079
4080
4081
4082
4083
4084
4085
4086
4087
4088
4089
4090
4091
4092
4093
4094
4095
4096
|
4183
4184
4185
4186
4187
4188
4189
4190
4191
4192
4193
4194
4195
4196
4197
4198
4199
4200
4201
4202
4203
4204
4205
4206
4207
4208
4209
4210
4211
4212
4213
4214
|
-
+
-
+
-
+
|
s->cscipher_tobe = NULL;
s->sccipher_tobe = NULL;
s->csmac_tobe = NULL;
s->scmac_tobe = NULL;
s->cscomp_tobe = NULL;
s->sccomp_tobe = NULL;
ssh->pktin.savedpos += 16; /* skip garbage cookie */
ssh2_pkt_getstring(ssh, &str, &len); /* key exchange algorithms */
ssh_pkt_getstring(ssh, &str, &len); /* key exchange algorithms */
for (i = 0; i < lenof(kex_algs); i++) {
if (kex_algs[i] == &ssh_diffiehellman_gex &&
(ssh->remote_bugs & BUG_SSH2_DH_GEX))
continue;
if (in_commasep_string(kex_algs[i]->name, str, len)) {
ssh->kex = kex_algs[i];
break;
}
}
ssh2_pkt_getstring(ssh, &str, &len); /* host key algorithms */
ssh_pkt_getstring(ssh, &str, &len); /* host key algorithms */
for (i = 0; i < lenof(hostkey_algs); i++) {
if (in_commasep_string(hostkey_algs[i]->name, str, len)) {
ssh->hostkey = hostkey_algs[i];
break;
}
}
ssh2_pkt_getstring(ssh, &str, &len); /* client->server cipher */
ssh_pkt_getstring(ssh, &str, &len); /* client->server cipher */
s->warn = 0;
for (i = 0; i < s->n_preferred_ciphers; i++) {
const struct ssh2_ciphers *c = s->preferred_ciphers[i];
if (!c) {
s->warn = 1;
} else {
for (j = 0; j < c->nciphers; j++) {
|
| ︙ | | |
4108
4109
4110
4111
4112
4113
4114
4115
4116
4117
4118
4119
4120
4121
4122
|
4226
4227
4228
4229
4230
4231
4232
4233
4234
4235
4236
4237
4238
4239
4240
|
-
+
|
}
if (!s->cscipher_tobe) {
bombout(("Couldn't agree a client-to-server cipher (available: %s)",
str ? str : "(null)"));
crStop(0);
}
ssh2_pkt_getstring(ssh, &str, &len); /* server->client cipher */
ssh_pkt_getstring(ssh, &str, &len); /* server->client cipher */
s->warn = 0;
for (i = 0; i < s->n_preferred_ciphers; i++) {
const struct ssh2_ciphers *c = s->preferred_ciphers[i];
if (!c) {
s->warn = 1;
} else {
for (j = 0; j < c->nciphers; j++) {
|
| ︙ | | |
4134
4135
4136
4137
4138
4139
4140
4141
4142
4143
4144
4145
4146
4147
4148
4149
4150
4151
4152
4153
4154
4155
4156
4157
4158
4159
4160
4161
4162
4163
4164
4165
4166
4167
4168
4169
4170
4171
|
4252
4253
4254
4255
4256
4257
4258
4259
4260
4261
4262
4263
4264
4265
4266
4267
4268
4269
4270
4271
4272
4273
4274
4275
4276
4277
4278
4279
4280
4281
4282
4283
4284
4285
4286
4287
4288
4289
|
-
+
-
+
-
+
-
+
|
}
if (!s->sccipher_tobe) {
bombout(("Couldn't agree a server-to-client cipher (available: %s)",
str ? str : "(null)"));
crStop(0);
}
ssh2_pkt_getstring(ssh, &str, &len); /* client->server mac */
ssh_pkt_getstring(ssh, &str, &len); /* client->server mac */
for (i = 0; i < s->nmacs; i++) {
if (in_commasep_string(s->maclist[i]->name, str, len)) {
s->csmac_tobe = s->maclist[i];
break;
}
}
ssh2_pkt_getstring(ssh, &str, &len); /* server->client mac */
ssh_pkt_getstring(ssh, &str, &len); /* server->client mac */
for (i = 0; i < s->nmacs; i++) {
if (in_commasep_string(s->maclist[i]->name, str, len)) {
s->scmac_tobe = s->maclist[i];
break;
}
}
ssh2_pkt_getstring(ssh, &str, &len); /* client->server compression */
ssh_pkt_getstring(ssh, &str, &len); /* client->server compression */
for (i = 0; i < lenof(compressions) + 1; i++) {
const struct ssh_compress *c =
i == 0 ? s->preferred_comp : compressions[i - 1];
if (in_commasep_string(c->name, str, len)) {
s->cscomp_tobe = c;
break;
}
}
ssh2_pkt_getstring(ssh, &str, &len); /* server->client compression */
ssh_pkt_getstring(ssh, &str, &len); /* server->client compression */
for (i = 0; i < lenof(compressions) + 1; i++) {
const struct ssh_compress *c =
i == 0 ? s->preferred_comp : compressions[i - 1];
if (in_commasep_string(c->name, str, len)) {
s->sccomp_tobe = c;
break;
}
|
| ︙ | | |
4232
4233
4234
4235
4236
4237
4238
4239
4240
4241
4242
4243
4244
4245
4246
4247
4248
|
4350
4351
4352
4353
4354
4355
4356
4357
4358
4359
4360
4361
4362
4363
4364
4365
4366
|
-
+
-
+
|
ssh2_pkt_send(ssh);
crWaitUntil(ispkt);
if (ssh->pktin.type != s->kex_reply_value) {
bombout(("expected key exchange reply packet from server"));
crStop(0);
}
ssh2_pkt_getstring(ssh, &s->hostkeydata, &s->hostkeylen);
ssh_pkt_getstring(ssh, &s->hostkeydata, &s->hostkeylen);
s->f = ssh2_pkt_getmp(ssh);
ssh2_pkt_getstring(ssh, &s->sigdata, &s->siglen);
ssh_pkt_getstring(ssh, &s->sigdata, &s->siglen);
s->K = dh_find_K(ssh->kex_ctx, s->f);
sha_string(&ssh->exhash, s->hostkeydata, s->hostkeylen);
if (ssh->kex == &ssh_diffiehellman_gex) {
sha_uint32(&ssh->exhash, s->pbits);
sha_mpint(&ssh->exhash, s->p);
|
| ︙ | | |
4655
4656
4657
4658
4659
4660
4661
4662
4663
4664
4665
4666
4667
4668
4669
|
4773
4774
4775
4776
4777
4778
4779
4780
4781
4782
4783
4784
4785
4786
4787
|
-
+
|
* non-verbose non-interactive mode. (It's probably
* a script, which means nobody will read the
* banner _anyway_, and moreover the printing of
* the banner will screw up processing on the
* output of (say) plink.)
*/
if (flags & (FLAG_VERBOSE | FLAG_INTERACTIVE)) {
ssh2_pkt_getstring(ssh, &banner, &size);
ssh_pkt_getstring(ssh, &banner, &size);
if (banner)
c_write_untrusted(ssh, banner, size);
}
crWaitUntilV(ispkt);
}
if (ssh->pktin.type == SSH2_MSG_USERAUTH_SUCCESS) {
logevent("Access granted");
|
| ︙ | | |
4694
4695
4696
4697
4698
4699
4700
4701
4702
4703
4704
4705
4706
4707
4708
|
4812
4813
4814
4815
4816
4817
4818
4819
4820
4821
4822
4823
4824
4825
4826
|
-
+
|
* OK, we're now sitting on a USERAUTH_FAILURE message, so
* we can look at the string in it and know what we can
* helpfully try next.
*/
if (ssh->pktin.type == SSH2_MSG_USERAUTH_FAILURE) {
char *methods;
int methlen;
ssh2_pkt_getstring(ssh, &methods, &methlen);
ssh_pkt_getstring(ssh, &methods, &methlen);
s->kbd_inter_running = FALSE;
if (!ssh2_pkt_getbool(ssh)) {
/*
* We have received an unequivocal Access
* Denied. This can translate to a variety of
* messages:
*
|
| ︙ | | |
5043
5044
5045
5046
5047
5048
5049
5050
5051
5052
5053
5054
5055
5056
5057
5058
5059
5060
5061
5062
5063
5064
5065
5066
5067
5068
5069
5070
5071
5072
5073
5074
5075
5076
5077
5078
5079
|
5161
5162
5163
5164
5165
5166
5167
5168
5169
5170
5171
5172
5173
5174
5175
5176
5177
5178
5179
5180
5181
5182
5183
5184
5185
5186
5187
5188
5189
5190
5191
5192
5193
5194
5195
5196
5197
|
-
-
-
+
+
+
-
+
-
+
|
* We've got a fresh USERAUTH_INFO_REQUEST.
* Display header data, and start going through
* the prompts.
*/
char *name, *inst, *lang;
int name_len, inst_len, lang_len;
ssh2_pkt_getstring(ssh, &name, &name_len);
ssh2_pkt_getstring(ssh, &inst, &inst_len);
ssh2_pkt_getstring(ssh, &lang, &lang_len);
ssh_pkt_getstring(ssh, &name, &name_len);
ssh_pkt_getstring(ssh, &inst, &inst_len);
ssh_pkt_getstring(ssh, &lang, &lang_len);
if (name_len > 0) {
c_write_untrusted(ssh, name, name_len);
c_write_str(ssh, "\r\n");
}
if (inst_len > 0) {
c_write_untrusted(ssh, inst, inst_len);
c_write_str(ssh, "\r\n");
}
s->num_prompts = ssh2_pkt_getuint32(ssh);
s->num_prompts = ssh_pkt_getuint32(ssh);
}
/*
* If there are prompts remaining in the packet,
* display one and get a response.
*/
if (s->curr_prompt < s->num_prompts) {
char *prompt;
int prompt_len;
ssh2_pkt_getstring(ssh, &prompt, &prompt_len);
ssh_pkt_getstring(ssh, &prompt, &prompt_len);
if (prompt_len > 0) {
strncpy(s->pwprompt, prompt, sizeof(s->pwprompt));
s->pwprompt[prompt_len < sizeof(s->pwprompt) ?
prompt_len : sizeof(s->pwprompt)-1] = '\0';
} else {
strcpy(s->pwprompt,
"<server failed to send prompt>: ");
|
| ︙ | | |
5334
5335
5336
5337
5338
5339
5340
5341
5342
5343
5344
5345
5346
5347
5348
5349
5350
5351
5352
5353
5354
5355
5356
|
5452
5453
5454
5455
5456
5457
5458
5459
5460
5461
5462
5463
5464
5465
5466
5467
5468
5469
5470
5471
5472
5473
5474
|
-
+
-
+
-
-
+
+
|
ssh2_pkt_send(ssh);
crWaitUntilV(ispkt);
if (ssh->pktin.type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
bombout(("Server refused to open a session"));
crStopV;
/* FIXME: error data comes back in FAILURE packet */
}
if (ssh2_pkt_getuint32(ssh) != ssh->mainchan->localid) {
if (ssh_pkt_getuint32(ssh) != ssh->mainchan->localid) {
bombout(("Server's channel confirmation cited wrong channel"));
crStopV;
}
ssh->mainchan->remoteid = ssh2_pkt_getuint32(ssh);
ssh->mainchan->remoteid = ssh_pkt_getuint32(ssh);
ssh->mainchan->type = CHAN_MAINSESSION;
ssh->mainchan->closes = 0;
ssh->mainchan->v.v2.remwindow = ssh2_pkt_getuint32(ssh);
ssh->mainchan->v.v2.remmaxpkt = ssh2_pkt_getuint32(ssh);
ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(ssh);
ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(ssh);
bufchain_init(&ssh->mainchan->v.v2.outbuffer);
add234(ssh->channels, ssh->mainchan);
logevent("Opened channel for session");
/*
* Potentially enable X11 forwarding.
*/
|
| ︙ | | |
5369
5370
5371
5372
5373
5374
5375
5376
5377
5378
5379
5380
5381
5382
5383
5384
5385
5386
5387
5388
|
5487
5488
5489
5490
5491
5492
5493
5494
5495
5496
5497
5498
5499
5500
5501
5502
5503
5504
5505
5506
|
-
+
-
+
|
ssh2_pkt_addstring(ssh, data);
ssh2_pkt_adduint32(ssh, x11_get_screen_number(ssh->cfg.x11_display));
ssh2_pkt_send(ssh);
do {
crWaitUntilV(ispkt);
if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c)
continue; /* nonexistent channel */
c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
c->v.v2.remwindow += ssh_pkt_getuint32(ssh);
}
} while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
bombout(("Unexpected response to X11 forwarding request:"
" packet type %d", ssh->pktin.type));
|
| ︙ | | |
5525
5526
5527
5528
5529
5530
5531
5532
5533
5534
5535
5536
5537
5538
5539
5540
5541
5542
5543
5544
|
5643
5644
5645
5646
5647
5648
5649
5650
5651
5652
5653
5654
5655
5656
5657
5658
5659
5660
5661
5662
|
-
+
-
+
|
ssh2_pkt_addstring(ssh, "127.0.0.1");
ssh2_pkt_adduint32(ssh, sport);
ssh2_pkt_send(ssh);
do {
crWaitUntilV(ispkt);
if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c)
continue;/* nonexistent channel */
c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
c->v.v2.remwindow += ssh_pkt_getuint32(ssh);
}
} while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
if (ssh->pktin.type != SSH2_MSG_REQUEST_SUCCESS) {
if (ssh->pktin.type != SSH2_MSG_REQUEST_FAILURE) {
bombout(("Unexpected response to port "
"forwarding request: packet type %d",
|
| ︙ | | |
5565
5566
5567
5568
5569
5570
5571
5572
5573
5574
5575
5576
5577
5578
5579
5580
5581
5582
5583
5584
|
5683
5684
5685
5686
5687
5688
5689
5690
5691
5692
5693
5694
5695
5696
5697
5698
5699
5700
5701
5702
|
-
+
-
+
|
ssh2_pkt_addstring(ssh, "auth-agent-req@openssh.com");
ssh2_pkt_addbool(ssh, 1); /* want reply */
ssh2_pkt_send(ssh);
do {
crWaitUntilV(ispkt);
if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c)
continue; /* nonexistent channel */
c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
c->v.v2.remwindow += ssh_pkt_getuint32(ssh);
}
} while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
bombout(("Unexpected response to agent forwarding request:"
" packet type %d", ssh->pktin.type));
|
| ︙ | | |
5617
5618
5619
5620
5621
5622
5623
5624
5625
5626
5627
5628
5629
5630
5631
5632
5633
5634
5635
5636
|
5735
5736
5737
5738
5739
5740
5741
5742
5743
5744
5745
5746
5747
5748
5749
5750
5751
5752
5753
5754
|
-
+
-
+
|
ssh2_pkt_addstring_data(ssh, "\0", 1); /* TTY_OP_END */
ssh2_pkt_send(ssh);
ssh->state = SSH_STATE_INTERMED;
do {
crWaitUntilV(ispkt);
if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c)
continue; /* nonexistent channel */
c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
c->v.v2.remwindow += ssh_pkt_getuint32(ssh);
}
} while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
bombout(("Unexpected response to pty request:"
" packet type %d", ssh->pktin.type));
|
| ︙ | | |
5677
5678
5679
5680
5681
5682
5683
5684
5685
5686
5687
5688
5689
5690
5691
5692
5693
5694
5695
5696
|
5795
5796
5797
5798
5799
5800
5801
5802
5803
5804
5805
5806
5807
5808
5809
5810
5811
5812
5813
5814
|
-
+
-
+
|
ssh2_pkt_addstring(ssh, "shell");
ssh2_pkt_addbool(ssh, 1); /* want reply */
}
ssh2_pkt_send(ssh);
do {
crWaitUntilV(ispkt);
if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c)
continue; /* nonexistent channel */
c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
c->v.v2.remwindow += ssh_pkt_getuint32(ssh);
}
} while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
bombout(("Unexpected response to shell/command request:"
" packet type %d", ssh->pktin.type));
crStopV;
|
| ︙ | | |
5730
5731
5732
5733
5734
5735
5736
5737
5738
5739
5740
5741
5742
5743
5744
5745
5746
5747
5748
5749
5750
5751
5752
|
5848
5849
5850
5851
5852
5853
5854
5855
5856
5857
5858
5859
5860
5861
5862
5863
5864
5865
5866
5867
5868
5869
5870
|
-
+
-
+
-
+
|
crReturnV;
s->try_send = FALSE;
if (ispkt) {
if (ssh->pktin.type == SSH2_MSG_CHANNEL_DATA ||
ssh->pktin.type == SSH2_MSG_CHANNEL_EXTENDED_DATA) {
char *data;
int length;
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c)
continue; /* nonexistent channel */
if (ssh->pktin.type == SSH2_MSG_CHANNEL_EXTENDED_DATA &&
ssh2_pkt_getuint32(ssh) != SSH2_EXTENDED_DATA_STDERR)
ssh_pkt_getuint32(ssh) != SSH2_EXTENDED_DATA_STDERR)
continue; /* extended but not stderr */
ssh2_pkt_getstring(ssh, &data, &length);
ssh_pkt_getstring(ssh, &data, &length);
if (data) {
int bufsize = 0;
c->v.v2.locwindow -= length;
switch (c->type) {
case CHAN_MAINSESSION:
bufsize =
from_backend(ssh->frontend, ssh->pktin.type ==
|
| ︙ | | |
5805
5806
5807
5808
5809
5810
5811
5812
5813
5814
5815
5816
5817
5818
5819
5820
5821
5822
5823
5824
5825
5826
5827
5828
5829
5830
5831
5832
5833
5834
5835
5836
5837
5838
5839
5840
|
5923
5924
5925
5926
5927
5928
5929
5930
5931
5932
5933
5934
5935
5936
5937
5938
5939
5940
5941
5942
5943
5944
5945
5946
5947
5948
5949
5950
5951
5952
5953
5954
5955
5956
5957
5958
|
-
+
-
+
|
* If we are not buffering too much data,
* enlarge the window again at the remote side.
*/
if (bufsize < OUR_V2_WINSIZE)
ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
}
} else if (ssh->pktin.type == SSH2_MSG_CHANNEL_EOF) {
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c)
continue; /* nonexistent channel */
if (c->type == CHAN_X11) {
/*
* Remote EOF on an X11 channel means we should
* wrap up and close the channel ourselves.
*/
x11_close(c->u.x11.s);
sshfwd_close(c);
} else if (c->type == CHAN_AGENT) {
sshfwd_close(c);
} else if (c->type == CHAN_SOCKDATA) {
pfd_close(c->u.pfd.s);
sshfwd_close(c);
}
} else if (ssh->pktin.type == SSH2_MSG_CHANNEL_CLOSE) {
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c || ((int)c->remoteid) == -1) {
bombout(("Received CHANNEL_CLOSE for %s channel %d\n",
c ? "half-open" : "nonexistent", i));
crStopV;
|
| ︙ | | |
5890
5891
5892
5893
5894
5895
5896
5897
5898
5899
5900
5901
5902
5903
5904
5905
5906
5907
5908
5909
5910
5911
5912
5913
5914
5915
5916
5917
5918
5919
5920
5921
5922
5923
5924
5925
5926
5927
5928
5929
5930
5931
5932
5933
5934
5935
5936
5937
5938
5939
5940
5941
5942
5943
5944
5945
5946
5947
5948
5949
5950
5951
5952
5953
5954
5955
5956
5957
5958
|
6008
6009
6010
6011
6012
6013
6014
6015
6016
6017
6018
6019
6020
6021
6022
6023
6024
6025
6026
6027
6028
6029
6030
6031
6032
6033
6034
6035
6036
6037
6038
6039
6040
6041
6042
6043
6044
6045
6046
6047
6048
6049
6050
6051
6052
6053
6054
6055
6056
6057
6058
6059
6060
6061
6062
6063
6064
6065
6066
6067
6068
6069
6070
6071
6072
6073
6074
6075
6076
|
-
+
-
+
-
+
-
+
-
-
+
+
-
+
-
-
+
+
|
ssh2_pkt_send(ssh);
#endif
ssh_closing((Plug)ssh, NULL, 0, 0);
crStopV;
}
continue; /* remote sends close; ignore (FIXME) */
} else if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c || c->closes)
continue; /* nonexistent or closing channel */
c->v.v2.remwindow += ssh2_pkt_getuint32(ssh);
c->v.v2.remwindow += ssh_pkt_getuint32(ssh);
s->try_send = TRUE;
} else if (ssh->pktin.type == SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c)
continue; /* nonexistent channel */
if (c->type != CHAN_SOCKDATA_DORMANT)
continue; /* dunno why they're confirming this */
c->remoteid = ssh2_pkt_getuint32(ssh);
c->remoteid = ssh_pkt_getuint32(ssh);
c->type = CHAN_SOCKDATA;
c->v.v2.remwindow = ssh2_pkt_getuint32(ssh);
c->v.v2.remmaxpkt = ssh2_pkt_getuint32(ssh);
c->v.v2.remwindow = ssh_pkt_getuint32(ssh);
c->v.v2.remmaxpkt = ssh_pkt_getuint32(ssh);
if (c->u.pfd.s)
pfd_confirm(c->u.pfd.s);
if (c->closes) {
/*
* We have a pending close on this channel,
* which we decided on before the server acked
* the channel open. So now we know the
* remoteid, we can close it again.
*/
ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_CLOSE);
ssh2_pkt_adduint32(ssh, c->remoteid);
ssh2_pkt_send(ssh);
}
} else if (ssh->pktin.type == SSH2_MSG_CHANNEL_OPEN_FAILURE) {
unsigned i = ssh2_pkt_getuint32(ssh);
unsigned i = ssh_pkt_getuint32(ssh);
struct ssh_channel *c;
c = find234(ssh->channels, &i, ssh_channelfind);
if (!c)
continue; /* nonexistent channel */
if (c->type != CHAN_SOCKDATA_DORMANT)
continue; /* dunno why they're failing this */
logevent("Forwarded connection refused by server");
pfd_close(c->u.pfd.s);
del234(ssh->channels, c);
sfree(c);
} else if (ssh->pktin.type == SSH2_MSG_CHANNEL_REQUEST) {
unsigned localid;
char *type;
int typelen, want_reply;
struct ssh_channel *c;
localid = ssh2_pkt_getuint32(ssh);
ssh2_pkt_getstring(ssh, &type, &typelen);
localid = ssh_pkt_getuint32(ssh);
ssh_pkt_getstring(ssh, &type, &typelen);
want_reply = ssh2_pkt_getbool(ssh);
/*
* First, check that the channel exists. Otherwise,
* we can instantly disconnect with a rude message.
*/
c = find234(ssh->channels, &localid, ssh_channelfind);
|
| ︙ | | |
5976
5977
5978
5979
5980
5981
5982
5983
5984
5985
5986
5987
5988
5989
5990
|
6094
6095
6096
6097
6098
6099
6100
6101
6102
6103
6104
6105
6106
6107
6108
|
-
+
|
* the request type string to see if it's something
* we recognise.
*/
if (typelen == 11 && !memcmp(type, "exit-status", 11) &&
c == ssh->mainchan) {
/* We recognise "exit-status" on the primary channel. */
char buf[100];
ssh->exitcode = ssh2_pkt_getuint32(ssh);
ssh->exitcode = ssh_pkt_getuint32(ssh);
sprintf(buf, "Server sent command exit status %d",
ssh->exitcode);
logevent(buf);
if (want_reply) {
ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_SUCCESS);
ssh2_pkt_adduint32(ssh, c->remoteid);
ssh2_pkt_send(ssh);
|
| ︙ | | |
6002
6003
6004
6005
6006
6007
6008
6009
6010
6011
6012
6013
6014
6015
6016
|
6120
6121
6122
6123
6124
6125
6126
6127
6128
6129
6130
6131
6132
6133
6134
|
-
+
|
ssh2_pkt_send(ssh);
}
}
} else if (ssh->pktin.type == SSH2_MSG_GLOBAL_REQUEST) {
char *type;
int typelen, want_reply;
ssh2_pkt_getstring(ssh, &type, &typelen);
ssh_pkt_getstring(ssh, &type, &typelen);
want_reply = ssh2_pkt_getbool(ssh);
/*
* We currently don't support any global requests
* at all, so we either ignore the request or
* respond with REQUEST_FAILURE, depending on
* want_reply.
|
| ︙ | | |
6024
6025
6026
6027
6028
6029
6030
6031
6032
6033
6034
6035
6036
6037
6038
6039
6040
6041
6042
6043
6044
6045
6046
6047
6048
6049
6050
6051
6052
6053
6054
6055
6056
6057
6058
6059
6060
6061
6062
6063
6064
6065
6066
6067
6068
6069
6070
6071
6072
6073
6074
|
6142
6143
6144
6145
6146
6147
6148
6149
6150
6151
6152
6153
6154
6155
6156
6157
6158
6159
6160
6161
6162
6163
6164
6165
6166
6167
6168
6169
6170
6171
6172
6173
6174
6175
6176
6177
6178
6179
6180
6181
6182
6183
6184
6185
6186
6187
6188
6189
6190
6191
6192
|
-
+
-
-
-
+
+
+
-
+
-
+
-
-
-
-
+
+
+
+
|
int typelen;
char *peeraddr;
int peeraddrlen;
int peerport;
char *error = NULL;
struct ssh_channel *c;
unsigned remid, winsize, pktsize;
ssh2_pkt_getstring(ssh, &type, &typelen);
ssh_pkt_getstring(ssh, &type, &typelen);
c = snew(struct ssh_channel);
c->ssh = ssh;
remid = ssh2_pkt_getuint32(ssh);
winsize = ssh2_pkt_getuint32(ssh);
pktsize = ssh2_pkt_getuint32(ssh);
remid = ssh_pkt_getuint32(ssh);
winsize = ssh_pkt_getuint32(ssh);
pktsize = ssh_pkt_getuint32(ssh);
if (typelen == 3 && !memcmp(type, "x11", 3)) {
char *addrstr;
ssh2_pkt_getstring(ssh, &peeraddr, &peeraddrlen);
ssh_pkt_getstring(ssh, &peeraddr, &peeraddrlen);
addrstr = snewn(peeraddrlen+1, char);
memcpy(addrstr, peeraddr, peeraddrlen);
peeraddr[peeraddrlen] = '\0';
peerport = ssh2_pkt_getuint32(ssh);
peerport = ssh_pkt_getuint32(ssh);
if (!ssh->X11_fwd_enabled)
error = "X11 forwarding is not enabled";
else if (x11_init(&c->u.x11.s, ssh->cfg.x11_display, c,
ssh->x11auth, addrstr, peerport,
&ssh->cfg) != NULL) {
error = "Unable to open an X11 connection";
} else {
c->type = CHAN_X11;
}
sfree(addrstr);
} else if (typelen == 15 &&
!memcmp(type, "forwarded-tcpip", 15)) {
struct ssh_rportfwd pf, *realpf;
char *dummy;
int dummylen;
ssh2_pkt_getstring(ssh, &dummy, &dummylen);/* skip address */
pf.sport = ssh2_pkt_getuint32(ssh);
ssh2_pkt_getstring(ssh, &peeraddr, &peeraddrlen);
peerport = ssh2_pkt_getuint32(ssh);
ssh_pkt_getstring(ssh, &dummy, &dummylen);/* skip address */
pf.sport = ssh_pkt_getuint32(ssh);
ssh_pkt_getstring(ssh, &peeraddr, &peeraddrlen);
peerport = ssh_pkt_getuint32(ssh);
realpf = find234(ssh->rportfwds, &pf, NULL);
if (realpf == NULL) {
error = "Remote port is not recognised";
} else {
const char *e = pfd_newconnect(&c->u.pfd.s,
realpf->dhost,
realpf->dport, c,
|
| ︙ | | |