| ︙ | | |
179
180
181
182
183
184
185
186
187
188
189
190
191
192
|
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
|
+
|
*/
#define BUG_CHOKES_ON_SSH1_IGNORE 1
#define BUG_SSH2_HMAC 2
#define BUG_NEEDS_SSH1_PLAIN_PASSWORD 4
#define BUG_CHOKES_ON_RSA 8
#define BUG_SSH2_RSA_PADDING 16
#define BUG_SSH2_DERIVEKEY 32
#define BUG_SSH2_DH_GEX 64
static int ssh_pkt_ctx = 0;
#define translate(x) if (type == x) return #x
#define translatec(x,ctx) if (type == x && (ssh_pkt_ctx & ctx)) return #x
char *ssh1_pkt_type(int type)
{
|
| ︙ | | |
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
|
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
|
+
+
+
+
+
+
+
+
|
(!strncmp(imp, "OpenSSH_3.", 10) && imp[10]>='0' && imp[10]<='2')))){
/*
* These versions have the SSH2 RSA padding bug.
*/
ssh_remote_bugs |= BUG_SSH2_RSA_PADDING;
logevent("We believe remote version has SSH2 RSA padding bug");
}
if (cfg.sshbug_dhgex2 == BUG_ON) {
/*
* These versions have the SSH2 DH GEX bug.
*/
ssh_remote_bugs |= BUG_SSH2_DH_GEX;
logevent("We believe remote version has SSH2 DH group exchange bug");
}
}
static int do_ssh_init(unsigned char c)
{
static int vslen;
static char version[10];
static char *vstring;
|
| ︙ | | |
3644
3645
3646
3647
3648
3649
3650
3651
3652
3653
3654
3655
3656
3657
|
3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
|
+
+
+
|
*/
ssh2_pkt_init(SSH2_MSG_KEXINIT);
for (i = 0; i < 16; i++)
ssh2_pkt_addbyte((unsigned char) random_byte());
/* List key exchange algorithms. */
ssh2_pkt_addstring_start();
for (i = 0; i < lenof(kex_algs); i++) {
if (kex_algs[i] == &ssh_diffiehellman_gex &&
(ssh_remote_bugs & BUG_SSH2_DH_GEX))
continue;
ssh2_pkt_addstring_str(kex_algs[i]->name);
if (i < lenof(kex_algs) - 1)
ssh2_pkt_addstring_str(",");
}
/* List server host key algorithms. */
ssh2_pkt_addstring_start();
for (i = 0; i < lenof(hostkey_algs); i++) {
|
| ︙ | | |
3750
3751
3752
3753
3754
3755
3756
3757
3758
3759
3760
3761
3762
3763
|
3762
3763
3764
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
|
+
+
+
|
csmac_tobe = NULL;
scmac_tobe = NULL;
cscomp_tobe = NULL;
sccomp_tobe = NULL;
pktin.savedpos += 16; /* skip garbage cookie */
ssh2_pkt_getstring(&str, &len); /* key exchange algorithms */
for (i = 0; i < lenof(kex_algs); i++) {
if (kex_algs[i] == &ssh_diffiehellman_gex &&
(ssh_remote_bugs & BUG_SSH2_DH_GEX))
continue;
if (in_commasep_string(kex_algs[i]->name, str, len)) {
kex = kex_algs[i];
break;
}
}
ssh2_pkt_getstring(&str, &len); /* host key algorithms */
for (i = 0; i < lenof(hostkey_algs); i++) {
|
| ︙ | | |