Diff

Differences From Artifact [c9374d6544]:

To Artifact [f59941e947]:


179
180
181
182
183
184
185

186
187
188
189
190
191
192
 */
#define BUG_CHOKES_ON_SSH1_IGNORE                 1
#define BUG_SSH2_HMAC                             2
#define BUG_NEEDS_SSH1_PLAIN_PASSWORD        	  4
#define BUG_CHOKES_ON_RSA	        	  8
#define BUG_SSH2_RSA_PADDING	        	 16
#define BUG_SSH2_DERIVEKEY                       32


static int ssh_pkt_ctx = 0;

#define translate(x) if (type == x) return #x
#define translatec(x,ctx) if (type == x && (ssh_pkt_ctx & ctx)) return #x
char *ssh1_pkt_type(int type)
{







>







179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
 */
#define BUG_CHOKES_ON_SSH1_IGNORE                 1
#define BUG_SSH2_HMAC                             2
#define BUG_NEEDS_SSH1_PLAIN_PASSWORD        	  4
#define BUG_CHOKES_ON_RSA	        	  8
#define BUG_SSH2_RSA_PADDING	        	 16
#define BUG_SSH2_DERIVEKEY                       32
#define BUG_SSH2_DH_GEX                          64

static int ssh_pkt_ctx = 0;

#define translate(x) if (type == x) return #x
#define translatec(x,ctx) if (type == x && (ssh_pkt_ctx & ctx)) return #x
char *ssh1_pkt_type(int type)
{
1738
1739
1740
1741
1742
1743
1744








1745
1746
1747
1748
1749
1750
1751
	  (!strncmp(imp, "OpenSSH_3.", 10) && imp[10]>='0' && imp[10]<='2')))){
	/*
	 * These versions have the SSH2 RSA padding bug.
	 */
	ssh_remote_bugs |= BUG_SSH2_RSA_PADDING;
	logevent("We believe remote version has SSH2 RSA padding bug");
    }








}

static int do_ssh_init(unsigned char c)
{
    static int vslen;
    static char version[10];
    static char *vstring;







>
>
>
>
>
>
>
>







1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
	  (!strncmp(imp, "OpenSSH_3.", 10) && imp[10]>='0' && imp[10]<='2')))){
	/*
	 * These versions have the SSH2 RSA padding bug.
	 */
	ssh_remote_bugs |= BUG_SSH2_RSA_PADDING;
	logevent("We believe remote version has SSH2 RSA padding bug");
    }

    if (cfg.sshbug_dhgex2 == BUG_ON) {
	/*
	 * These versions have the SSH2 DH GEX bug.
	 */
	ssh_remote_bugs |= BUG_SSH2_DH_GEX;
	logevent("We believe remote version has SSH2 DH group exchange bug");
    }
}

static int do_ssh_init(unsigned char c)
{
    static int vslen;
    static char version[10];
    static char *vstring;
3644
3645
3646
3647
3648
3649
3650



3651
3652
3653
3654
3655
3656
3657
     */
    ssh2_pkt_init(SSH2_MSG_KEXINIT);
    for (i = 0; i < 16; i++)
	ssh2_pkt_addbyte((unsigned char) random_byte());
    /* List key exchange algorithms. */
    ssh2_pkt_addstring_start();
    for (i = 0; i < lenof(kex_algs); i++) {



	ssh2_pkt_addstring_str(kex_algs[i]->name);
	if (i < lenof(kex_algs) - 1)
	    ssh2_pkt_addstring_str(",");
    }
    /* List server host key algorithms. */
    ssh2_pkt_addstring_start();
    for (i = 0; i < lenof(hostkey_algs); i++) {







>
>
>







3653
3654
3655
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
     */
    ssh2_pkt_init(SSH2_MSG_KEXINIT);
    for (i = 0; i < 16; i++)
	ssh2_pkt_addbyte((unsigned char) random_byte());
    /* List key exchange algorithms. */
    ssh2_pkt_addstring_start();
    for (i = 0; i < lenof(kex_algs); i++) {
	if (kex_algs[i] == &ssh_diffiehellman_gex &&
	    (ssh_remote_bugs & BUG_SSH2_DH_GEX))
	    continue;
	ssh2_pkt_addstring_str(kex_algs[i]->name);
	if (i < lenof(kex_algs) - 1)
	    ssh2_pkt_addstring_str(",");
    }
    /* List server host key algorithms. */
    ssh2_pkt_addstring_start();
    for (i = 0; i < lenof(hostkey_algs); i++) {
3750
3751
3752
3753
3754
3755
3756



3757
3758
3759
3760
3761
3762
3763
    csmac_tobe = NULL;
    scmac_tobe = NULL;
    cscomp_tobe = NULL;
    sccomp_tobe = NULL;
    pktin.savedpos += 16;	       /* skip garbage cookie */
    ssh2_pkt_getstring(&str, &len);    /* key exchange algorithms */
    for (i = 0; i < lenof(kex_algs); i++) {



	if (in_commasep_string(kex_algs[i]->name, str, len)) {
	    kex = kex_algs[i];
	    break;
	}
    }
    ssh2_pkt_getstring(&str, &len);    /* host key algorithms */
    for (i = 0; i < lenof(hostkey_algs); i++) {







>
>
>







3762
3763
3764
3765
3766
3767
3768
3769
3770
3771
3772
3773
3774
3775
3776
3777
3778
    csmac_tobe = NULL;
    scmac_tobe = NULL;
    cscomp_tobe = NULL;
    sccomp_tobe = NULL;
    pktin.savedpos += 16;	       /* skip garbage cookie */
    ssh2_pkt_getstring(&str, &len);    /* key exchange algorithms */
    for (i = 0; i < lenof(kex_algs); i++) {
	if (kex_algs[i] == &ssh_diffiehellman_gex &&
	    (ssh_remote_bugs & BUG_SSH2_DH_GEX))
	    continue;
	if (in_commasep_string(kex_algs[i]->name, str, len)) {
	    kex = kex_algs[i];
	    break;
	}
    }
    ssh2_pkt_getstring(&str, &len);    /* host key algorithms */
    for (i = 0; i < lenof(hostkey_algs); i++) {