1 /* $OpenBSD: packet.c,v 1.315 2024/05/31 08:49:35 djm Exp $ */
2 /*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
6 * This file contains code implementing the packet protocol and communication
7 * with the other side. This same code is used both on client and server side.
8 *
9 * As far as I am concerned, the code I have written for this software
10 * can be used freely for any purpose. Any derived versions of this
11 * software must be clearly marked as such, and if the derived work is
12 * incompatible with the protocol description in the RFC file, it must be
13 * called by a name other than "ssh" or "Secure Shell".
14 *
15 *
16 * SSH2 packet format added by Markus Friedl.
17 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
18 *
19 * Redistribution and use in source and binary forms, with or without
20 * modification, are permitted provided that the following conditions
21 * are met:
22 * 1. Redistributions of source code must retain the above copyright
23 * notice, this list of conditions and the following disclaimer.
24 * 2. Redistributions in binary form must reproduce the above copyright
25 * notice, this list of conditions and the following disclaimer in the
26 * documentation and/or other materials provided with the distribution.
27 *
28 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
29 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
30 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
31 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
32 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
33 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
34 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
35 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
36 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
37 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38 */
39
40 #include "includes.h"
41
42 #include <sys/types.h>
43 #include "openbsd-compat/sys-queue.h"
44 #include <sys/socket.h>
45 #ifdef HAVE_SYS_TIME_H
46 # include <sys/time.h>
47 #endif
48
49 #include <netinet/in.h>
50 #include <netinet/ip.h>
51 #include <arpa/inet.h>
52
53 #include <errno.h>
54 #include <netdb.h>
55 #include <stdarg.h>
56 #include <stdio.h>
57 #include <stdlib.h>
58 #include <string.h>
59 #include <unistd.h>
60 #include <limits.h>
61 #ifdef HAVE_POLL_H
62 #include <poll.h>
63 #endif
64 #include <signal.h>
65 #include <time.h>
66
67 /*
68 * Explicitly include OpenSSL before zlib as some versions of OpenSSL have
69 * "free_func" in their headers, which zlib typedefs.
70 */
71 #ifdef WITH_OPENSSL
72 # include <openssl/bn.h>
73 # include <openssl/evp.h>
74 # ifdef OPENSSL_HAS_ECC
75 # include <openssl/ec.h>
76 # endif
77 #endif
78
79 #ifdef WITH_ZLIB
80 #include <zlib.h>
81 #endif
82
83 #include "xmalloc.h"
84 #include "compat.h"
85 #include "ssh2.h"
86 #include "cipher.h"
87 #include "sshkey.h"
88 #include "kex.h"
89 #include "digest.h"
90 #include "mac.h"
91 #include "log.h"
92 #include "canohost.h"
93 #include "misc.h"
94 #include "channels.h"
95 #include "ssh.h"
96 #include "packet.h"
97 #include "ssherr.h"
98 #include "sshbuf.h"
99
100 #ifdef PACKET_DEBUG
101 #define DBG(x) x
102 #else
103 #define DBG(x)
104 #endif
105
106 #define PACKET_MAX_SIZE (256 * 1024)
107
108 struct packet_state {
109 u_int32_t seqnr;
110 u_int32_t packets;
111 u_int64_t blocks;
112 u_int64_t bytes;
113 };
114
115 struct packet {
116 TAILQ_ENTRY(packet) next;
117 u_char type;
118 struct sshbuf *payload;
119 };
120
121 struct session_state {
122 /*
123 * This variable contains the file descriptors used for
124 * communicating with the other side. connection_in is used for
125 * reading; connection_out for writing. These can be the same
126 * descriptor, in which case it is assumed to be a socket.
127 */
128 int connection_in;
129 int connection_out;
130
131 /* Protocol flags for the remote side. */
132 u_int remote_protocol_flags;
133
134 /* Encryption context for receiving data. Only used for decryption. */
135 struct sshcipher_ctx *receive_context;
136
137 /* Encryption context for sending data. Only used for encryption. */
138 struct sshcipher_ctx *send_context;
139
140 /* Buffer for raw input data from the socket. */
141 struct sshbuf *input;
142
143 /* Buffer for raw output data going to the socket. */
144 struct sshbuf *output;
145
146 /* Buffer for the partial outgoing packet being constructed. */
147 struct sshbuf *outgoing_packet;
148
149 /* Buffer for the incoming packet currently being processed. */
150 struct sshbuf *incoming_packet;
151
152 /* Scratch buffer for packet compression/decompression. */
153 struct sshbuf *compression_buffer;
154
155 #ifdef WITH_ZLIB
156 /* Incoming/outgoing compression dictionaries */
157 z_stream compression_in_stream;
158 z_stream compression_out_stream;
159 #endif
160 int compression_in_started;
161 int compression_out_started;
162 int compression_in_failures;
163 int compression_out_failures;
164
165 /* default maximum packet size */
166 u_int max_packet_size;
167
168 /* Flag indicating whether this module has been initialized. */
169 int initialized;
170
171 /* Set to true if the connection is interactive. */
172 int interactive_mode;
173
174 /* Set to true if we are the server side. */
175 int server_side;
176
177 /* Set to true if we are authenticated. */
178 int after_authentication;
179
180 int keep_alive_timeouts;
181
182 /* The maximum time that we will wait to send or receive a packet */
183 int packet_timeout_ms;
184
185 /* Session key information for Encryption and MAC */
186 struct newkeys *newkeys[MODE_MAX];
187 struct packet_state p_read, p_send;
188
189 /* Volume-based rekeying */
190 u_int64_t max_blocks_in, max_blocks_out, rekey_limit;
191
192 /* Time-based rekeying */
193 u_int32_t rekey_interval; /* how often in seconds */
194 time_t rekey_time; /* time of last rekeying */
195
196 /* roundup current message to extra_pad bytes */
197 u_char extra_pad;
198
199 /* XXX discard incoming data after MAC error */
200 u_int packet_discard;
201 size_t packet_discard_mac_already;
202 struct sshmac *packet_discard_mac;
203
204 /* Used in packet_read_poll2() */
205 u_int packlen;
206
207 /* Used in packet_send2 */
208 int rekeying;
209
210 /* Used in ssh_packet_send_mux() */
211 int mux;
212
213 /* Used in packet_set_interactive */
214 int set_interactive_called;
215
216 /* Used in packet_set_maxsize */
217 int set_maxsize_called;
218
219 /* One-off warning about weak ciphers */
220 int cipher_warning_done;
221
222 /* Hook for fuzzing inbound packets */
223 ssh_packet_hook_fn *hook_in;
224 void *hook_in_ctx;
225
226 TAILQ_HEAD(, packet) outgoing;
227 };
228
229 struct ssh *
ssh_alloc_session_state(void)230 ssh_alloc_session_state(void)
231 {
232 struct ssh *ssh = NULL;
233 struct session_state *state = NULL;
234
235 if ((ssh = calloc(1, sizeof(*ssh))) == NULL ||
236 (state = calloc(1, sizeof(*state))) == NULL ||
237 (ssh->kex = kex_new()) == NULL ||
238 (state->input = sshbuf_new()) == NULL ||
239 (state->output = sshbuf_new()) == NULL ||
240 (state->outgoing_packet = sshbuf_new()) == NULL ||
241 (state->incoming_packet = sshbuf_new()) == NULL)
242 goto fail;
243 TAILQ_INIT(&state->outgoing);
244 TAILQ_INIT(&ssh->private_keys);
245 TAILQ_INIT(&ssh->public_keys);
246 state->connection_in = -1;
247 state->connection_out = -1;
248 state->max_packet_size = 32768;
249 state->packet_timeout_ms = -1;
250 state->p_send.packets = state->p_read.packets = 0;
251 state->initialized = 1;
252 /*
253 * ssh_packet_send2() needs to queue packets until
254 * we've done the initial key exchange.
255 */
256 state->rekeying = 1;
257 ssh->state = state;
258 return ssh;
259 fail:
260 if (ssh) {
261 kex_free(ssh->kex);
262 free(ssh);
263 }
264 if (state) {
265 sshbuf_free(state->input);
266 sshbuf_free(state->output);
267 sshbuf_free(state->incoming_packet);
268 sshbuf_free(state->outgoing_packet);
269 free(state);
270 }
271 return NULL;
272 }
273
274 void
ssh_packet_set_input_hook(struct ssh * ssh,ssh_packet_hook_fn * hook,void * ctx)275 ssh_packet_set_input_hook(struct ssh *ssh, ssh_packet_hook_fn *hook, void *ctx)
276 {
277 ssh->state->hook_in = hook;
278 ssh->state->hook_in_ctx = ctx;
279 }
280
281 /* Returns nonzero if rekeying is in progress */
282 int
ssh_packet_is_rekeying(struct ssh * ssh)283 ssh_packet_is_rekeying(struct ssh *ssh)
284 {
285 return ssh->state->rekeying ||
286 (ssh->kex != NULL && ssh->kex->done == 0);
287 }
288
289 /*
290 * Sets the descriptors used for communication.
291 */
292 struct ssh *
ssh_packet_set_connection(struct ssh * ssh,int fd_in,int fd_out)293 ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out)
294 {
295 struct session_state *state;
296 const struct sshcipher *none = cipher_by_name("none");
297 int r;
298
299 if (none == NULL) {
300 error_f("cannot load cipher 'none'");
301 return NULL;
302 }
303 if (ssh == NULL)
304 ssh = ssh_alloc_session_state();
305 if (ssh == NULL) {
306 error_f("could not allocate state");
307 return NULL;
308 }
309 state = ssh->state;
310 state->connection_in = fd_in;
311 state->connection_out = fd_out;
312 if ((r = cipher_init(&state->send_context, none,
313 (const u_char *)"", 0, NULL, 0, CIPHER_ENCRYPT)) != 0 ||
314 (r = cipher_init(&state->receive_context, none,
315 (const u_char *)"", 0, NULL, 0, CIPHER_DECRYPT)) != 0) {
316 error_fr(r, "cipher_init failed");
317 free(ssh); /* XXX need ssh_free_session_state? */
318 return NULL;
319 }
320 state->newkeys[MODE_IN] = state->newkeys[MODE_OUT] = NULL;
321 /*
322 * Cache the IP address of the remote connection for use in error
323 * messages that might be generated after the connection has closed.
324 */
325 (void)ssh_remote_ipaddr(ssh);
326 return ssh;
327 }
328
329 void
ssh_packet_set_timeout(struct ssh * ssh,int timeout,int count)330 ssh_packet_set_timeout(struct ssh *ssh, int timeout, int count)
331 {
332 struct session_state *state = ssh->state;
333
334 if (timeout <= 0 || count <= 0) {
335 state->packet_timeout_ms = -1;
336 return;
337 }
338 if ((INT_MAX / 1000) / count < timeout)
339 state->packet_timeout_ms = INT_MAX;
340 else
341 state->packet_timeout_ms = timeout * count * 1000;
342 }
343
344 void
ssh_packet_set_mux(struct ssh * ssh)345 ssh_packet_set_mux(struct ssh *ssh)
346 {
347 ssh->state->mux = 1;
348 ssh->state->rekeying = 0;
349 kex_free(ssh->kex);
350 ssh->kex = NULL;
351 }
352
353 int
ssh_packet_get_mux(struct ssh * ssh)354 ssh_packet_get_mux(struct ssh *ssh)
355 {
356 return ssh->state->mux;
357 }
358
359 int
ssh_packet_set_log_preamble(struct ssh * ssh,const char * fmt,...)360 ssh_packet_set_log_preamble(struct ssh *ssh, const char *fmt, ...)
361 {
362 va_list args;
363 int r;
364
365 free(ssh->log_preamble);
366 if (fmt == NULL)
367 ssh->log_preamble = NULL;
368 else {
369 va_start(args, fmt);
370 r = vasprintf(&ssh->log_preamble, fmt, args);
371 va_end(args);
372 if (r < 0 || ssh->log_preamble == NULL)
373 return SSH_ERR_ALLOC_FAIL;
374 }
375 return 0;
376 }
377
378 int
ssh_packet_stop_discard(struct ssh * ssh)379 ssh_packet_stop_discard(struct ssh *ssh)
380 {
381 struct session_state *state = ssh->state;
382 int r;
383
384 if (state->packet_discard_mac) {
385 char buf[1024];
386 size_t dlen = PACKET_MAX_SIZE;
387
388 if (dlen > state->packet_discard_mac_already)
389 dlen -= state->packet_discard_mac_already;
390 memset(buf, 'a', sizeof(buf));
391 while (sshbuf_len(state->incoming_packet) < dlen)
392 if ((r = sshbuf_put(state->incoming_packet, buf,
393 sizeof(buf))) != 0)
394 return r;
395 (void) mac_compute(state->packet_discard_mac,
396 state->p_read.seqnr,
397 sshbuf_ptr(state->incoming_packet), dlen,
398 NULL, 0);
399 }
400 logit("Finished discarding for %.200s port %d",
401 ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
402 return SSH_ERR_MAC_INVALID;
403 }
404
405 static int
ssh_packet_start_discard(struct ssh * ssh,struct sshenc * enc,struct sshmac * mac,size_t mac_already,u_int discard)406 ssh_packet_start_discard(struct ssh *ssh, struct sshenc *enc,
407 struct sshmac *mac, size_t mac_already, u_int discard)
408 {
409 struct session_state *state = ssh->state;
410 int r;
411
412 if (enc == NULL || !cipher_is_cbc(enc->cipher) || (mac && mac->etm)) {
413 if ((r = sshpkt_disconnect(ssh, "Packet corrupt")) != 0)
414 return r;
415 return SSH_ERR_MAC_INVALID;
416 }
417 /*
418 * Record number of bytes over which the mac has already
419 * been computed in order to minimize timing attacks.
420 */
421 if (mac && mac->enabled) {
422 state->packet_discard_mac = mac;
423 state->packet_discard_mac_already = mac_already;
424 }
425 if (sshbuf_len(state->input) >= discard)
426 return ssh_packet_stop_discard(ssh);
427 state->packet_discard = discard - sshbuf_len(state->input);
428 return 0;
429 }
430
431 /* Returns 1 if remote host is connected via socket, 0 if not. */
432
433 int
ssh_packet_connection_is_on_socket(struct ssh * ssh)434 ssh_packet_connection_is_on_socket(struct ssh *ssh)
435 {
436 struct session_state *state;
437 struct sockaddr_storage from, to;
438 socklen_t fromlen, tolen;
439
440 if (ssh == NULL || ssh->state == NULL)
441 return 0;
442
443 state = ssh->state;
444 if (state->connection_in == -1 || state->connection_out == -1)
445 return 0;
446 /* filedescriptors in and out are the same, so it's a socket */
447 if (state->connection_in == state->connection_out)
448 return 1;
449 fromlen = sizeof(from);
450 memset(&from, 0, sizeof(from));
451 if (getpeername(state->connection_in, (struct sockaddr *)&from,
452 &fromlen) == -1)
453 return 0;
454 tolen = sizeof(to);
455 memset(&to, 0, sizeof(to));
456 if (getpeername(state->connection_out, (struct sockaddr *)&to,
457 &tolen) == -1)
458 return 0;
459 if (fromlen != tolen || memcmp(&from, &to, fromlen) != 0)
460 return 0;
461 if (from.ss_family != AF_INET && from.ss_family != AF_INET6)
462 return 0;
463 return 1;
464 }
465
466 void
ssh_packet_get_bytes(struct ssh * ssh,u_int64_t * ibytes,u_int64_t * obytes)467 ssh_packet_get_bytes(struct ssh *ssh, u_int64_t *ibytes, u_int64_t *obytes)
468 {
469 if (ibytes)
470 *ibytes = ssh->state->p_read.bytes;
471 if (obytes)
472 *obytes = ssh->state->p_send.bytes;
473 }
474
475 int
ssh_packet_connection_af(struct ssh * ssh)476 ssh_packet_connection_af(struct ssh *ssh)
477 {
478 return get_sock_af(ssh->state->connection_out);
479 }
480
481 /* Sets the connection into non-blocking mode. */
482
483 void
ssh_packet_set_nonblocking(struct ssh * ssh)484 ssh_packet_set_nonblocking(struct ssh *ssh)
485 {
486 /* Set the socket into non-blocking mode. */
487 set_nonblock(ssh->state->connection_in);
488
489 if (ssh->state->connection_out != ssh->state->connection_in)
490 set_nonblock(ssh->state->connection_out);
491 }
492
493 /* Returns the socket used for reading. */
494
495 int
ssh_packet_get_connection_in(struct ssh * ssh)496 ssh_packet_get_connection_in(struct ssh *ssh)
497 {
498 return ssh->state->connection_in;
499 }
500
501 /* Returns the descriptor used for writing. */
502
503 int
ssh_packet_get_connection_out(struct ssh * ssh)504 ssh_packet_get_connection_out(struct ssh *ssh)
505 {
506 return ssh->state->connection_out;
507 }
508
509 /*
510 * Returns the IP-address of the remote host as a string. The returned
511 * string must not be freed.
512 */
513
514 const char *
ssh_remote_ipaddr(struct ssh * ssh)515 ssh_remote_ipaddr(struct ssh *ssh)
516 {
517 int sock;
518
519 /* Check whether we have cached the ipaddr. */
520 if (ssh->remote_ipaddr == NULL) {
521 if (ssh_packet_connection_is_on_socket(ssh)) {
522 sock = ssh->state->connection_in;
523 ssh->remote_ipaddr = get_peer_ipaddr(sock);
524 ssh->remote_port = get_peer_port(sock);
525 ssh->local_ipaddr = get_local_ipaddr(sock);
526 ssh->local_port = get_local_port(sock);
527 } else {
528 ssh->remote_ipaddr = xstrdup("UNKNOWN");
529 ssh->remote_port = 65535;
530 ssh->local_ipaddr = xstrdup("UNKNOWN");
531 ssh->local_port = 65535;
532 }
533 }
534 return ssh->remote_ipaddr;
535 }
536
537 /*
538 * Returns the remote DNS hostname as a string. The returned string must not
539 * be freed. NB. this will usually trigger a DNS query. Return value is on
540 * heap and no caching is performed.
541 * This function does additional checks on the hostname to mitigate some
542 * attacks based on conflation of hostnames and addresses and will
543 * fall back to returning an address on error.
544 */
545
546 char *
ssh_remote_hostname(struct ssh * ssh)547 ssh_remote_hostname(struct ssh *ssh)
548 {
549 struct sockaddr_storage from;
550 socklen_t fromlen;
551 struct addrinfo hints, *ai, *aitop;
552 char name[NI_MAXHOST], ntop2[NI_MAXHOST];
553 const char *ntop = ssh_remote_ipaddr(ssh);
554
555 /* Get IP address of client. */
556 fromlen = sizeof(from);
557 memset(&from, 0, sizeof(from));
558 if (getpeername(ssh_packet_get_connection_in(ssh),
559 (struct sockaddr *)&from, &fromlen) == -1) {
560 debug_f("getpeername failed: %.100s", strerror(errno));
561 return xstrdup(ntop);
562 }
563
564 ipv64_normalise_mapped(&from, &fromlen);
565 if (from.ss_family == AF_INET6)
566 fromlen = sizeof(struct sockaddr_in6);
567
568 debug3("trying to reverse map address %.100s.", ntop);
569 /* Map the IP address to a host name. */
570 if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name),
571 NULL, 0, NI_NAMEREQD) != 0) {
572 /* Host name not found. Use ip address. */
573 return xstrdup(ntop);
574 }
575
576 /*
577 * if reverse lookup result looks like a numeric hostname,
578 * someone is trying to trick us by PTR record like following:
579 * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
580 */
581 memset(&hints, 0, sizeof(hints));
582 hints.ai_socktype = SOCK_DGRAM; /*dummy*/
583 hints.ai_flags = AI_NUMERICHOST;
584 if (getaddrinfo(name, NULL, &hints, &ai) == 0) {
585 logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
586 name, ntop);
587 freeaddrinfo(ai);
588 return xstrdup(ntop);
589 }
590
591 /* Names are stored in lowercase. */
592 lowercase(name);
593
594 /*
595 * Map it back to an IP address and check that the given
596 * address actually is an address of this host. This is
597 * necessary because anyone with access to a name server can
598 * define arbitrary names for an IP address. Mapping from
599 * name to IP address can be trusted better (but can still be
600 * fooled if the intruder has access to the name server of
601 * the domain).
602 */
603 memset(&hints, 0, sizeof(hints));
604 hints.ai_family = from.ss_family;
605 hints.ai_socktype = SOCK_STREAM;
606 if (getaddrinfo(name, NULL, &hints, &aitop) != 0) {
607 logit("reverse mapping checking getaddrinfo for %.700s "
608 "[%s] failed.", name, ntop);
609 return xstrdup(ntop);
610 }
611 /* Look for the address from the list of addresses. */
612 for (ai = aitop; ai; ai = ai->ai_next) {
613 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2,
614 sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 &&
615 (strcmp(ntop, ntop2) == 0))
616 break;
617 }
618 freeaddrinfo(aitop);
619 /* If we reached the end of the list, the address was not there. */
620 if (ai == NULL) {
621 /* Address not found for the host name. */
622 logit("Address %.100s maps to %.600s, but this does not "
623 "map back to the address.", ntop, name);
624 return xstrdup(ntop);
625 }
626 return xstrdup(name);
627 }
628
629 /* Returns the port number of the remote host. */
630
631 int
ssh_remote_port(struct ssh * ssh)632 ssh_remote_port(struct ssh *ssh)
633 {
634 (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */
635 return ssh->remote_port;
636 }
637
638 /*
639 * Returns the IP-address of the local host as a string. The returned
640 * string must not be freed.
641 */
642
643 const char *
ssh_local_ipaddr(struct ssh * ssh)644 ssh_local_ipaddr(struct ssh *ssh)
645 {
646 (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */
647 return ssh->local_ipaddr;
648 }
649
650 /* Returns the port number of the local host. */
651
652 int
ssh_local_port(struct ssh * ssh)653 ssh_local_port(struct ssh *ssh)
654 {
655 (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */
656 return ssh->local_port;
657 }
658
659 /* Returns the routing domain of the input socket, or NULL if unavailable */
660 const char *
ssh_packet_rdomain_in(struct ssh * ssh)661 ssh_packet_rdomain_in(struct ssh *ssh)
662 {
663 if (ssh->rdomain_in != NULL)
664 return ssh->rdomain_in;
665 if (!ssh_packet_connection_is_on_socket(ssh))
666 return NULL;
667 ssh->rdomain_in = get_rdomain(ssh->state->connection_in);
668 return ssh->rdomain_in;
669 }
670
671 /* Closes the connection and clears and frees internal data structures. */
672
673 static void
ssh_packet_close_internal(struct ssh * ssh,int do_close)674 ssh_packet_close_internal(struct ssh *ssh, int do_close)
675 {
676 struct session_state *state = ssh->state;
677 u_int mode;
678
679 if (!state->initialized)
680 return;
681 state->initialized = 0;
682 if (do_close) {
683 if (state->connection_in == state->connection_out) {
684 close(state->connection_out);
685 } else {
686 close(state->connection_in);
687 close(state->connection_out);
688 }
689 }
690 sshbuf_free(state->input);
691 sshbuf_free(state->output);
692 sshbuf_free(state->outgoing_packet);
693 sshbuf_free(state->incoming_packet);
694 for (mode = 0; mode < MODE_MAX; mode++) {
695 kex_free_newkeys(state->newkeys[mode]); /* current keys */
696 state->newkeys[mode] = NULL;
697 ssh_clear_newkeys(ssh, mode); /* next keys */
698 }
699 #ifdef WITH_ZLIB
700 /* compression state is in shared mem, so we can only release it once */
701 if (do_close && state->compression_buffer) {
702 sshbuf_free(state->compression_buffer);
703 if (state->compression_out_started) {
704 z_streamp stream = &state->compression_out_stream;
705 debug("compress outgoing: "
706 "raw data %llu, compressed %llu, factor %.2f",
707 (unsigned long long)stream->total_in,
708 (unsigned long long)stream->total_out,
709 stream->total_in == 0 ? 0.0 :
710 (double) stream->total_out / stream->total_in);
711 if (state->compression_out_failures == 0)
712 deflateEnd(stream);
713 }
714 if (state->compression_in_started) {
715 z_streamp stream = &state->compression_in_stream;
716 debug("compress incoming: "
717 "raw data %llu, compressed %llu, factor %.2f",
718 (unsigned long long)stream->total_out,
719 (unsigned long long)stream->total_in,
720 stream->total_out == 0 ? 0.0 :
721 (double) stream->total_in / stream->total_out);
722 if (state->compression_in_failures == 0)
723 inflateEnd(stream);
724 }
725 }
726 #endif /* WITH_ZLIB */
727 cipher_free(state->send_context);
728 cipher_free(state->receive_context);
729 state->send_context = state->receive_context = NULL;
730 if (do_close) {
731 free(ssh->local_ipaddr);
732 ssh->local_ipaddr = NULL;
733 free(ssh->remote_ipaddr);
734 ssh->remote_ipaddr = NULL;
735 free(ssh->state);
736 ssh->state = NULL;
737 kex_free(ssh->kex);
738 ssh->kex = NULL;
739 }
740 }
741
742 void
ssh_packet_close(struct ssh * ssh)743 ssh_packet_close(struct ssh *ssh)
744 {
745 ssh_packet_close_internal(ssh, 1);
746 }
747
748 void
ssh_packet_clear_keys(struct ssh * ssh)749 ssh_packet_clear_keys(struct ssh *ssh)
750 {
751 ssh_packet_close_internal(ssh, 0);
752 }
753
754 /* Sets remote side protocol flags. */
755
756 void
ssh_packet_set_protocol_flags(struct ssh * ssh,u_int protocol_flags)757 ssh_packet_set_protocol_flags(struct ssh *ssh, u_int protocol_flags)
758 {
759 ssh->state->remote_protocol_flags = protocol_flags;
760 }
761
762 /* Returns the remote protocol flags set earlier by the above function. */
763
764 u_int
ssh_packet_get_protocol_flags(struct ssh * ssh)765 ssh_packet_get_protocol_flags(struct ssh *ssh)
766 {
767 return ssh->state->remote_protocol_flags;
768 }
769
770 /*
771 * Starts packet compression from the next packet on in both directions.
772 * Level is compression level 1 (fastest) - 9 (slow, best) as in gzip.
773 */
774
775 static int
ssh_packet_init_compression(struct ssh * ssh)776 ssh_packet_init_compression(struct ssh *ssh)
777 {
778 if (!ssh->state->compression_buffer &&
779 ((ssh->state->compression_buffer = sshbuf_new()) == NULL))
780 return SSH_ERR_ALLOC_FAIL;
781 return 0;
782 }
783
784 #ifdef WITH_ZLIB
785 static int
start_compression_out(struct ssh * ssh,int level)786 start_compression_out(struct ssh *ssh, int level)
787 {
788 if (level < 1 || level > 9)
789 return SSH_ERR_INVALID_ARGUMENT;
790 debug("Enabling compression at level %d.", level);
791 if (ssh->state->compression_out_started == 1)
792 deflateEnd(&ssh->state->compression_out_stream);
793 switch (deflateInit(&ssh->state->compression_out_stream, level)) {
794 case Z_OK:
795 ssh->state->compression_out_started = 1;
796 break;
797 case Z_MEM_ERROR:
798 return SSH_ERR_ALLOC_FAIL;
799 default:
800 return SSH_ERR_INTERNAL_ERROR;
801 }
802 return 0;
803 }
804
805 static int
start_compression_in(struct ssh * ssh)806 start_compression_in(struct ssh *ssh)
807 {
808 if (ssh->state->compression_in_started == 1)
809 inflateEnd(&ssh->state->compression_in_stream);
810 switch (inflateInit(&ssh->state->compression_in_stream)) {
811 case Z_OK:
812 ssh->state->compression_in_started = 1;
813 break;
814 case Z_MEM_ERROR:
815 return SSH_ERR_ALLOC_FAIL;
816 default:
817 return SSH_ERR_INTERNAL_ERROR;
818 }
819 return 0;
820 }
821
822 /* XXX remove need for separate compression buffer */
823 static int
compress_buffer(struct ssh * ssh,struct sshbuf * in,struct sshbuf * out)824 compress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
825 {
826 u_char buf[4096];
827 int r, status;
828
829 if (ssh->state->compression_out_started != 1)
830 return SSH_ERR_INTERNAL_ERROR;
831
832 /* This case is not handled below. */
833 if (sshbuf_len(in) == 0)
834 return 0;
835
836 /* Input is the contents of the input buffer. */
837 if ((ssh->state->compression_out_stream.next_in =
838 sshbuf_mutable_ptr(in)) == NULL)
839 return SSH_ERR_INTERNAL_ERROR;
840 ssh->state->compression_out_stream.avail_in = sshbuf_len(in);
841
842 /* Loop compressing until deflate() returns with avail_out != 0. */
843 do {
844 /* Set up fixed-size output buffer. */
845 ssh->state->compression_out_stream.next_out = buf;
846 ssh->state->compression_out_stream.avail_out = sizeof(buf);
847
848 /* Compress as much data into the buffer as possible. */
849 status = deflate(&ssh->state->compression_out_stream,
850 Z_PARTIAL_FLUSH);
851 switch (status) {
852 case Z_MEM_ERROR:
853 return SSH_ERR_ALLOC_FAIL;
854 case Z_OK:
855 /* Append compressed data to output_buffer. */
856 if ((r = sshbuf_put(out, buf, sizeof(buf) -
857 ssh->state->compression_out_stream.avail_out)) != 0)
858 return r;
859 break;
860 case Z_STREAM_ERROR:
861 default:
862 ssh->state->compression_out_failures++;
863 return SSH_ERR_INVALID_FORMAT;
864 }
865 } while (ssh->state->compression_out_stream.avail_out == 0);
866 return 0;
867 }
868
869 static int
uncompress_buffer(struct ssh * ssh,struct sshbuf * in,struct sshbuf * out)870 uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
871 {
872 u_char buf[4096];
873 int r, status;
874
875 if (ssh->state->compression_in_started != 1)
876 return SSH_ERR_INTERNAL_ERROR;
877
878 if ((ssh->state->compression_in_stream.next_in =
879 sshbuf_mutable_ptr(in)) == NULL)
880 return SSH_ERR_INTERNAL_ERROR;
881 ssh->state->compression_in_stream.avail_in = sshbuf_len(in);
882
883 for (;;) {
884 /* Set up fixed-size output buffer. */
885 ssh->state->compression_in_stream.next_out = buf;
886 ssh->state->compression_in_stream.avail_out = sizeof(buf);
887
888 status = inflate(&ssh->state->compression_in_stream,
889 Z_SYNC_FLUSH);
890 switch (status) {
891 case Z_OK:
892 if ((r = sshbuf_put(out, buf, sizeof(buf) -
893 ssh->state->compression_in_stream.avail_out)) != 0)
894 return r;
895 break;
896 case Z_BUF_ERROR:
897 /*
898 * Comments in zlib.h say that we should keep calling
899 * inflate() until we get an error. This appears to
900 * be the error that we get.
901 */
902 return 0;
903 case Z_DATA_ERROR:
904 return SSH_ERR_INVALID_FORMAT;
905 case Z_MEM_ERROR:
906 return SSH_ERR_ALLOC_FAIL;
907 case Z_STREAM_ERROR:
908 default:
909 ssh->state->compression_in_failures++;
910 return SSH_ERR_INTERNAL_ERROR;
911 }
912 }
913 /* NOTREACHED */
914 }
915
916 #else /* WITH_ZLIB */
917
918 static int
start_compression_out(struct ssh * ssh,int level)919 start_compression_out(struct ssh *ssh, int level)
920 {
921 return SSH_ERR_INTERNAL_ERROR;
922 }
923
924 static int
start_compression_in(struct ssh * ssh)925 start_compression_in(struct ssh *ssh)
926 {
927 return SSH_ERR_INTERNAL_ERROR;
928 }
929
930 static int
compress_buffer(struct ssh * ssh,struct sshbuf * in,struct sshbuf * out)931 compress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
932 {
933 return SSH_ERR_INTERNAL_ERROR;
934 }
935
936 static int
uncompress_buffer(struct ssh * ssh,struct sshbuf * in,struct sshbuf * out)937 uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out)
938 {
939 return SSH_ERR_INTERNAL_ERROR;
940 }
941 #endif /* WITH_ZLIB */
942
943 void
ssh_clear_newkeys(struct ssh * ssh,int mode)944 ssh_clear_newkeys(struct ssh *ssh, int mode)
945 {
946 if (ssh->kex && ssh->kex->newkeys[mode]) {
947 kex_free_newkeys(ssh->kex->newkeys[mode]);
948 ssh->kex->newkeys[mode] = NULL;
949 }
950 }
951
952 int
ssh_set_newkeys(struct ssh * ssh,int mode)953 ssh_set_newkeys(struct ssh *ssh, int mode)
954 {
955 struct session_state *state = ssh->state;
956 struct sshenc *enc;
957 struct sshmac *mac;
958 struct sshcomp *comp;
959 struct sshcipher_ctx **ccp;
960 struct packet_state *ps;
961 u_int64_t *max_blocks;
962 const char *wmsg;
963 int r, crypt_type;
964 const char *dir = mode == MODE_OUT ? "out" : "in";
965
966 debug2_f("mode %d", mode);
967
968 if (mode == MODE_OUT) {
969 ccp = &state->send_context;
970 crypt_type = CIPHER_ENCRYPT;
971 ps = &state->p_send;
972 max_blocks = &state->max_blocks_out;
973 } else {
974 ccp = &state->receive_context;
975 crypt_type = CIPHER_DECRYPT;
976 ps = &state->p_read;
977 max_blocks = &state->max_blocks_in;
978 }
979 if (state->newkeys[mode] != NULL) {
980 debug_f("rekeying %s, input %llu bytes %llu blocks, "
981 "output %llu bytes %llu blocks", dir,
982 (unsigned long long)state->p_read.bytes,
983 (unsigned long long)state->p_read.blocks,
984 (unsigned long long)state->p_send.bytes,
985 (unsigned long long)state->p_send.blocks);
986 kex_free_newkeys(state->newkeys[mode]);
987 state->newkeys[mode] = NULL;
988 }
989 /* note that both bytes and the seqnr are not reset */
990 ps->packets = ps->blocks = 0;
991 /* move newkeys from kex to state */
992 if ((state->newkeys[mode] = ssh->kex->newkeys[mode]) == NULL)
993 return SSH_ERR_INTERNAL_ERROR;
994 ssh->kex->newkeys[mode] = NULL;
995 enc = &state->newkeys[mode]->enc;
996 mac = &state->newkeys[mode]->mac;
997 comp = &state->newkeys[mode]->comp;
998 if (cipher_authlen(enc->cipher) == 0) {
999 if ((r = mac_init(mac)) != 0)
1000 return r;
1001 }
1002 mac->enabled = 1;
1003 DBG(debug_f("cipher_init: %s", dir));
1004 cipher_free(*ccp);
1005 *ccp = NULL;
1006 if ((r = cipher_init(ccp, enc->cipher, enc->key, enc->key_len,
1007 enc->iv, enc->iv_len, crypt_type)) != 0)
1008 return r;
1009 if (!state->cipher_warning_done &&
1010 (wmsg = cipher_warning_message(*ccp)) != NULL) {
1011 error("Warning: %s", wmsg);
1012 state->cipher_warning_done = 1;
1013 }
1014 /* Deleting the keys does not gain extra security */
1015 /* explicit_bzero(enc->iv, enc->block_size);
1016 explicit_bzero(enc->key, enc->key_len);
1017 explicit_bzero(mac->key, mac->key_len); */
1018 if ((comp->type == COMP_ZLIB ||
1019 (comp->type == COMP_DELAYED &&
1020 state->after_authentication)) && comp->enabled == 0) {
1021 if ((r = ssh_packet_init_compression(ssh)) < 0)
1022 return r;
1023 if (mode == MODE_OUT) {
1024 if ((r = start_compression_out(ssh, 6)) != 0)
1025 return r;
1026 } else {
1027 if ((r = start_compression_in(ssh)) != 0)
1028 return r;
1029 }
1030 comp->enabled = 1;
1031 }
1032 /*
1033 * The 2^(blocksize*2) limit is too expensive for 3DES,
1034 * so enforce a 1GB limit for small blocksizes.
1035 * See RFC4344 section 3.2.
1036 */
1037 if (enc->block_size >= 16)
1038 *max_blocks = (u_int64_t)1 << (enc->block_size*2);
1039 else
1040 *max_blocks = ((u_int64_t)1 << 30) / enc->block_size;
1041 if (state->rekey_limit)
1042 *max_blocks = MINIMUM(*max_blocks,
1043 state->rekey_limit / enc->block_size);
1044 debug("rekey %s after %llu blocks", dir,
1045 (unsigned long long)*max_blocks);
1046 return 0;
1047 }
1048
1049 #define MAX_PACKETS (1U<<31)
1050 static int
ssh_packet_need_rekeying(struct ssh * ssh,u_int outbound_packet_len)1051 ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
1052 {
1053 struct session_state *state = ssh->state;
1054 u_int32_t out_blocks;
1055
1056 /* XXX client can't cope with rekeying pre-auth */
1057 if (!state->after_authentication)
1058 return 0;
1059
1060 /* Haven't keyed yet or KEX in progress. */
1061 if (ssh_packet_is_rekeying(ssh))
1062 return 0;
1063
1064 /* Peer can't rekey */
1065 if (ssh->compat & SSH_BUG_NOREKEY)
1066 return 0;
1067
1068 /*
1069 * Permit one packet in or out per rekey - this allows us to
1070 * make progress when rekey limits are very small.
1071 */
1072 if (state->p_send.packets == 0 && state->p_read.packets == 0)
1073 return 0;
1074
1075 /* Time-based rekeying */
1076 if (state->rekey_interval != 0 &&
1077 (int64_t)state->rekey_time + state->rekey_interval <= monotime())
1078 return 1;
1079
1080 /*
1081 * Always rekey when MAX_PACKETS sent in either direction
1082 * As per RFC4344 section 3.1 we do this after 2^31 packets.
1083 */
1084 if (state->p_send.packets > MAX_PACKETS ||
1085 state->p_read.packets > MAX_PACKETS)
1086 return 1;
1087
1088 /* Rekey after (cipher-specific) maximum blocks */
1089 out_blocks = ROUNDUP(outbound_packet_len,
1090 state->newkeys[MODE_OUT]->enc.block_size);
1091 return (state->max_blocks_out &&
1092 (state->p_send.blocks + out_blocks > state->max_blocks_out)) ||
1093 (state->max_blocks_in &&
1094 (state->p_read.blocks > state->max_blocks_in));
1095 }
1096
1097 int
ssh_packet_check_rekey(struct ssh * ssh)1098 ssh_packet_check_rekey(struct ssh *ssh)
1099 {
1100 if (!ssh_packet_need_rekeying(ssh, 0))
1101 return 0;
1102 debug3_f("rekex triggered");
1103 return kex_start_rekex(ssh);
1104 }
1105
1106 /*
1107 * Delayed compression for SSH2 is enabled after authentication:
1108 * This happens on the server side after a SSH2_MSG_USERAUTH_SUCCESS is sent,
1109 * and on the client side after a SSH2_MSG_USERAUTH_SUCCESS is received.
1110 */
1111 static int
ssh_packet_enable_delayed_compress(struct ssh * ssh)1112 ssh_packet_enable_delayed_compress(struct ssh *ssh)
1113 {
1114 struct session_state *state = ssh->state;
1115 struct sshcomp *comp = NULL;
1116 int r, mode;
1117
1118 /*
1119 * Remember that we are past the authentication step, so rekeying
1120 * with COMP_DELAYED will turn on compression immediately.
1121 */
1122 state->after_authentication = 1;
1123 for (mode = 0; mode < MODE_MAX; mode++) {
1124 /* protocol error: USERAUTH_SUCCESS received before NEWKEYS */
1125 if (state->newkeys[mode] == NULL)
1126 continue;
1127 comp = &state->newkeys[mode]->comp;
1128 if (comp && !comp->enabled && comp->type == COMP_DELAYED) {
1129 if ((r = ssh_packet_init_compression(ssh)) != 0)
1130 return r;
1131 if (mode == MODE_OUT) {
1132 if ((r = start_compression_out(ssh, 6)) != 0)
1133 return r;
1134 } else {
1135 if ((r = start_compression_in(ssh)) != 0)
1136 return r;
1137 }
1138 comp->enabled = 1;
1139 }
1140 }
1141 return 0;
1142 }
1143
1144 /* Used to mute debug logging for noisy packet types */
1145 int
ssh_packet_log_type(u_char type)1146 ssh_packet_log_type(u_char type)
1147 {
1148 switch (type) {
1149 case SSH2_MSG_PING:
1150 case SSH2_MSG_PONG:
1151 case SSH2_MSG_CHANNEL_DATA:
1152 case SSH2_MSG_CHANNEL_EXTENDED_DATA:
1153 case SSH2_MSG_CHANNEL_WINDOW_ADJUST:
1154 return 0;
1155 default:
1156 return 1;
1157 }
1158 }
1159
1160 /*
1161 * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
1162 */
1163 int
ssh_packet_send2_wrapped(struct ssh * ssh)1164 ssh_packet_send2_wrapped(struct ssh *ssh)
1165 {
1166 struct session_state *state = ssh->state;
1167 u_char type, *cp, macbuf[SSH_DIGEST_MAX_LENGTH];
1168 u_char tmp, padlen, pad = 0;
1169 u_int authlen = 0, aadlen = 0;
1170 u_int len;
1171 struct sshenc *enc = NULL;
1172 struct sshmac *mac = NULL;
1173 struct sshcomp *comp = NULL;
1174 int r, block_size;
1175
1176 if (state->newkeys[MODE_OUT] != NULL) {
1177 enc = &state->newkeys[MODE_OUT]->enc;
1178 mac = &state->newkeys[MODE_OUT]->mac;
1179 comp = &state->newkeys[MODE_OUT]->comp;
1180 /* disable mac for authenticated encryption */
1181 if ((authlen = cipher_authlen(enc->cipher)) != 0)
1182 mac = NULL;
1183 }
1184 block_size = enc ? enc->block_size : 8;
1185 aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
1186
1187 type = (sshbuf_ptr(state->outgoing_packet))[5];
1188 if (ssh_packet_log_type(type))
1189 debug3("send packet: type %u", type);
1190 #ifdef PACKET_DEBUG
1191 fprintf(stderr, "plain: ");
1192 sshbuf_dump(state->outgoing_packet, stderr);
1193 #endif
1194
1195 if (comp && comp->enabled) {
1196 len = sshbuf_len(state->outgoing_packet);
1197 /* skip header, compress only payload */
1198 if ((r = sshbuf_consume(state->outgoing_packet, 5)) != 0)
1199 goto out;
1200 sshbuf_reset(state->compression_buffer);
1201 if ((r = compress_buffer(ssh, state->outgoing_packet,
1202 state->compression_buffer)) != 0)
1203 goto out;
1204 sshbuf_reset(state->outgoing_packet);
1205 if ((r = sshbuf_put(state->outgoing_packet,
1206 "\0\0\0\0\0", 5)) != 0 ||
1207 (r = sshbuf_putb(state->outgoing_packet,
1208 state->compression_buffer)) != 0)
1209 goto out;
1210 DBG(debug("compression: raw %d compressed %zd", len,
1211 sshbuf_len(state->outgoing_packet)));
1212 }
1213
1214 /* sizeof (packet_len + pad_len + payload) */
1215 len = sshbuf_len(state->outgoing_packet);
1216
1217 /*
1218 * calc size of padding, alloc space, get random data,
1219 * minimum padding is 4 bytes
1220 */
1221 len -= aadlen; /* packet length is not encrypted for EtM modes */
1222 padlen = block_size - (len % block_size);
1223 if (padlen < 4)
1224 padlen += block_size;
1225 if (state->extra_pad) {
1226 tmp = state->extra_pad;
1227 state->extra_pad =
1228 ROUNDUP(state->extra_pad, block_size);
1229 /* check if roundup overflowed */
1230 if (state->extra_pad < tmp)
1231 return SSH_ERR_INVALID_ARGUMENT;
1232 tmp = (len + padlen) % state->extra_pad;
1233 /* Check whether pad calculation below will underflow */
1234 if (tmp > state->extra_pad)
1235 return SSH_ERR_INVALID_ARGUMENT;
1236 pad = state->extra_pad - tmp;
1237 DBG(debug3_f("adding %d (len %d padlen %d extra_pad %d)",
1238 pad, len, padlen, state->extra_pad));
1239 tmp = padlen;
1240 padlen += pad;
1241 /* Check whether padlen calculation overflowed */
1242 if (padlen < tmp)
1243 return SSH_ERR_INVALID_ARGUMENT; /* overflow */
1244 state->extra_pad = 0;
1245 }
1246 if ((r = sshbuf_reserve(state->outgoing_packet, padlen, &cp)) != 0)
1247 goto out;
1248 if (enc && !cipher_ctx_is_plaintext(state->send_context)) {
1249 /* random padding */
1250 arc4random_buf(cp, padlen);
1251 } else {
1252 /* clear padding */
1253 explicit_bzero(cp, padlen);
1254 }
1255 /* sizeof (packet_len + pad_len + payload + padding) */
1256 len = sshbuf_len(state->outgoing_packet);
1257 cp = sshbuf_mutable_ptr(state->outgoing_packet);
1258 if (cp == NULL) {
1259 r = SSH_ERR_INTERNAL_ERROR;
1260 goto out;
1261 }
1262 /* packet_length includes payload, padding and padding length field */
1263 POKE_U32(cp, len - 4);
1264 cp[4] = padlen;
1265 DBG(debug("send: len %d (includes padlen %d, aadlen %d)",
1266 len, padlen, aadlen));
1267
1268 /* compute MAC over seqnr and packet(length fields, payload, padding) */
1269 if (mac && mac->enabled && !mac->etm) {
1270 if ((r = mac_compute(mac, state->p_send.seqnr,
1271 sshbuf_ptr(state->outgoing_packet), len,
1272 macbuf, sizeof(macbuf))) != 0)
1273 goto out;
1274 DBG(debug("done calc MAC out #%d", state->p_send.seqnr));
1275 }
1276 /* encrypt packet and append to output buffer. */
1277 if ((r = sshbuf_reserve(state->output,
1278 sshbuf_len(state->outgoing_packet) + authlen, &cp)) != 0)
1279 goto out;
1280 if ((r = cipher_crypt(state->send_context, state->p_send.seqnr, cp,
1281 sshbuf_ptr(state->outgoing_packet),
1282 len - aadlen, aadlen, authlen)) != 0)
1283 goto out;
1284 /* append unencrypted MAC */
1285 if (mac && mac->enabled) {
1286 if (mac->etm) {
1287 /* EtM: compute mac over aadlen + cipher text */
1288 if ((r = mac_compute(mac, state->p_send.seqnr,
1289 cp, len, macbuf, sizeof(macbuf))) != 0)
1290 goto out;
1291 DBG(debug("done calc MAC(EtM) out #%d",
1292 state->p_send.seqnr));
1293 }
1294 if ((r = sshbuf_put(state->output, macbuf, mac->mac_len)) != 0)
1295 goto out;
1296 }
1297 #ifdef PACKET_DEBUG
1298 fprintf(stderr, "encrypted: ");
1299 sshbuf_dump(state->output, stderr);
1300 #endif
1301 /* increment sequence number for outgoing packets */
1302 if (++state->p_send.seqnr == 0) {
1303 if ((ssh->kex->flags & KEX_INITIAL) != 0) {
1304 ssh_packet_disconnect(ssh, "outgoing sequence number "
1305 "wrapped during initial key exchange");
1306 }
1307 logit("outgoing seqnr wraps around");
1308 }
1309 if (++state->p_send.packets == 0)
1310 if (!(ssh->compat & SSH_BUG_NOREKEY))
1311 return SSH_ERR_NEED_REKEY;
1312 state->p_send.blocks += len / block_size;
1313 state->p_send.bytes += len;
1314 sshbuf_reset(state->outgoing_packet);
1315
1316 if (type == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) {
1317 debug_f("resetting send seqnr %u", state->p_send.seqnr);
1318 state->p_send.seqnr = 0;
1319 }
1320
1321 if (type == SSH2_MSG_NEWKEYS)
1322 r = ssh_set_newkeys(ssh, MODE_OUT);
1323 else if (type == SSH2_MSG_USERAUTH_SUCCESS && state->server_side)
1324 r = ssh_packet_enable_delayed_compress(ssh);
1325 else
1326 r = 0;
1327 out:
1328 return r;
1329 }
1330
1331 /* returns non-zero if the specified packet type is usec by KEX */
1332 static int
ssh_packet_type_is_kex(u_char type)1333 ssh_packet_type_is_kex(u_char type)
1334 {
1335 return
1336 type >= SSH2_MSG_TRANSPORT_MIN &&
1337 type <= SSH2_MSG_TRANSPORT_MAX &&
1338 type != SSH2_MSG_SERVICE_REQUEST &&
1339 type != SSH2_MSG_SERVICE_ACCEPT &&
1340 type != SSH2_MSG_EXT_INFO;
1341 }
1342
1343 int
ssh_packet_send2(struct ssh * ssh)1344 ssh_packet_send2(struct ssh *ssh)
1345 {
1346 struct session_state *state = ssh->state;
1347 struct packet *p;
1348 u_char type;
1349 int r, need_rekey;
1350
1351 if (sshbuf_len(state->outgoing_packet) < 6)
1352 return SSH_ERR_INTERNAL_ERROR;
1353 type = sshbuf_ptr(state->outgoing_packet)[5];
1354 need_rekey = !ssh_packet_type_is_kex(type) &&
1355 ssh_packet_need_rekeying(ssh, sshbuf_len(state->outgoing_packet));
1356
1357 /*
1358 * During rekeying we can only send key exchange messages.
1359 * Queue everything else.
1360 */
1361 if ((need_rekey || state->rekeying) && !ssh_packet_type_is_kex(type)) {
1362 if (need_rekey)
1363 debug3_f("rekex triggered");
1364 debug("enqueue packet: %u", type);
1365 p = calloc(1, sizeof(*p));
1366 if (p == NULL)
1367 return SSH_ERR_ALLOC_FAIL;
1368 p->type = type;
1369 p->payload = state->outgoing_packet;
1370 TAILQ_INSERT_TAIL(&state->outgoing, p, next);
1371 state->outgoing_packet = sshbuf_new();
1372 if (state->outgoing_packet == NULL)
1373 return SSH_ERR_ALLOC_FAIL;
1374 if (need_rekey) {
1375 /*
1376 * This packet triggered a rekey, so send the
1377 * KEXINIT now.
1378 * NB. reenters this function via kex_start_rekex().
1379 */
1380 return kex_start_rekex(ssh);
1381 }
1382 return 0;
1383 }
1384
1385 /* rekeying starts with sending KEXINIT */
1386 if (type == SSH2_MSG_KEXINIT)
1387 state->rekeying = 1;
1388
1389 if ((r = ssh_packet_send2_wrapped(ssh)) != 0)
1390 return r;
1391
1392 /* after a NEWKEYS message we can send the complete queue */
1393 if (type == SSH2_MSG_NEWKEYS) {
1394 state->rekeying = 0;
1395 state->rekey_time = monotime();
1396 while ((p = TAILQ_FIRST(&state->outgoing))) {
1397 type = p->type;
1398 /*
1399 * If this packet triggers a rekex, then skip the
1400 * remaining packets in the queue for now.
1401 * NB. re-enters this function via kex_start_rekex.
1402 */
1403 if (ssh_packet_need_rekeying(ssh,
1404 sshbuf_len(p->payload))) {
1405 debug3_f("queued packet triggered rekex");
1406 return kex_start_rekex(ssh);
1407 }
1408 debug("dequeue packet: %u", type);
1409 sshbuf_free(state->outgoing_packet);
1410 state->outgoing_packet = p->payload;
1411 TAILQ_REMOVE(&state->outgoing, p, next);
1412 memset(p, 0, sizeof(*p));
1413 free(p);
1414 if ((r = ssh_packet_send2_wrapped(ssh)) != 0)
1415 return r;
1416 }
1417 }
1418 return 0;
1419 }
1420
1421 /*
1422 * Waits until a packet has been received, and returns its type. Note that
1423 * no other data is processed until this returns, so this function should not
1424 * be used during the interactive session.
1425 */
1426
1427 int
ssh_packet_read_seqnr(struct ssh * ssh,u_char * typep,u_int32_t * seqnr_p)1428 ssh_packet_read_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
1429 {
1430 struct session_state *state = ssh->state;
1431 int len, r, ms_remain = 0;
1432 struct pollfd pfd;
1433 char buf[8192];
1434 struct timeval start;
1435 struct timespec timespec, *timespecp = NULL;
1436
1437 DBG(debug("packet_read()"));
1438
1439 /*
1440 * Since we are blocking, ensure that all written packets have
1441 * been sent.
1442 */
1443 if ((r = ssh_packet_write_wait(ssh)) != 0)
1444 goto out;
1445
1446 /* Stay in the loop until we have received a complete packet. */
1447 for (;;) {
1448 /* Try to read a packet from the buffer. */
1449 if ((r = ssh_packet_read_poll_seqnr(ssh, typep, seqnr_p)) != 0)
1450 break;
1451 /* If we got a packet, return it. */
1452 if (*typep != SSH_MSG_NONE)
1453 break;
1454 /*
1455 * Otherwise, wait for some data to arrive, add it to the
1456 * buffer, and try again.
1457 */
1458 pfd.fd = state->connection_in;
1459 pfd.events = POLLIN;
1460
1461 if (state->packet_timeout_ms > 0) {
1462 ms_remain = state->packet_timeout_ms;
1463 timespecp = ×pec;
1464 }
1465 /* Wait for some data to arrive. */
1466 for (;;) {
1467 if (state->packet_timeout_ms > 0) {
1468 ms_to_timespec(×pec, ms_remain);
1469 monotime_tv(&start);
1470 }
1471 if ((r = ppoll(&pfd, 1, timespecp, NULL)) >= 0)
1472 break;
1473 if (errno != EAGAIN && errno != EINTR &&
1474 errno != EWOULDBLOCK) {
1475 r = SSH_ERR_SYSTEM_ERROR;
1476 goto out;
1477 }
1478 if (state->packet_timeout_ms <= 0)
1479 continue;
1480 ms_subtract_diff(&start, &ms_remain);
1481 if (ms_remain <= 0) {
1482 r = 0;
1483 break;
1484 }
1485 }
1486 if (r == 0) {
1487 r = SSH_ERR_CONN_TIMEOUT;
1488 goto out;
1489 }
1490 /* Read data from the socket. */
1491 len = read(state->connection_in, buf, sizeof(buf));
1492 if (len == 0) {
1493 r = SSH_ERR_CONN_CLOSED;
1494 goto out;
1495 }
1496 if (len == -1) {
1497 r = SSH_ERR_SYSTEM_ERROR;
1498 goto out;
1499 }
1500
1501 /* Append it to the buffer. */
1502 if ((r = ssh_packet_process_incoming(ssh, buf, len)) != 0)
1503 goto out;
1504 }
1505 out:
1506 return r;
1507 }
1508
1509 int
ssh_packet_read(struct ssh * ssh)1510 ssh_packet_read(struct ssh *ssh)
1511 {
1512 u_char type;
1513 int r;
1514
1515 if ((r = ssh_packet_read_seqnr(ssh, &type, NULL)) != 0)
1516 fatal_fr(r, "read");
1517 return type;
1518 }
1519
1520 static int
ssh_packet_read_poll2_mux(struct ssh * ssh,u_char * typep,u_int32_t * seqnr_p)1521 ssh_packet_read_poll2_mux(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
1522 {
1523 struct session_state *state = ssh->state;
1524 const u_char *cp;
1525 size_t need;
1526 int r;
1527
1528 if (ssh->kex)
1529 return SSH_ERR_INTERNAL_ERROR;
1530 *typep = SSH_MSG_NONE;
1531 cp = sshbuf_ptr(state->input);
1532 if (state->packlen == 0) {
1533 if (sshbuf_len(state->input) < 4 + 1)
1534 return 0; /* packet is incomplete */
1535 state->packlen = PEEK_U32(cp);
1536 if (state->packlen < 4 + 1 ||
1537 state->packlen > PACKET_MAX_SIZE)
1538 return SSH_ERR_MESSAGE_INCOMPLETE;
1539 }
1540 need = state->packlen + 4;
1541 if (sshbuf_len(state->input) < need)
1542 return 0; /* packet is incomplete */
1543 sshbuf_reset(state->incoming_packet);
1544 if ((r = sshbuf_put(state->incoming_packet, cp + 4,
1545 state->packlen)) != 0 ||
1546 (r = sshbuf_consume(state->input, need)) != 0 ||
1547 (r = sshbuf_get_u8(state->incoming_packet, NULL)) != 0 ||
1548 (r = sshbuf_get_u8(state->incoming_packet, typep)) != 0)
1549 return r;
1550 if (ssh_packet_log_type(*typep))
1551 debug3_f("type %u", *typep);
1552 /* sshbuf_dump(state->incoming_packet, stderr); */
1553 /* reset for next packet */
1554 state->packlen = 0;
1555 return r;
1556 }
1557
1558 int
ssh_packet_read_poll2(struct ssh * ssh,u_char * typep,u_int32_t * seqnr_p)1559 ssh_packet_read_poll2(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
1560 {
1561 struct session_state *state = ssh->state;
1562 u_int padlen, need;
1563 u_char *cp;
1564 u_int maclen, aadlen = 0, authlen = 0, block_size;
1565 struct sshenc *enc = NULL;
1566 struct sshmac *mac = NULL;
1567 struct sshcomp *comp = NULL;
1568 int r;
1569
1570 if (state->mux)
1571 return ssh_packet_read_poll2_mux(ssh, typep, seqnr_p);
1572
1573 *typep = SSH_MSG_NONE;
1574
1575 if (state->packet_discard)
1576 return 0;
1577
1578 if (state->newkeys[MODE_IN] != NULL) {
1579 enc = &state->newkeys[MODE_IN]->enc;
1580 mac = &state->newkeys[MODE_IN]->mac;
1581 comp = &state->newkeys[MODE_IN]->comp;
1582 /* disable mac for authenticated encryption */
1583 if ((authlen = cipher_authlen(enc->cipher)) != 0)
1584 mac = NULL;
1585 }
1586 maclen = mac && mac->enabled ? mac->mac_len : 0;
1587 block_size = enc ? enc->block_size : 8;
1588 aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
1589
1590 if (aadlen && state->packlen == 0) {
1591 if (cipher_get_length(state->receive_context,
1592 &state->packlen, state->p_read.seqnr,
1593 sshbuf_ptr(state->input), sshbuf_len(state->input)) != 0)
1594 return 0;
1595 if (state->packlen < 1 + 4 ||
1596 state->packlen > PACKET_MAX_SIZE) {
1597 #ifdef PACKET_DEBUG
1598 sshbuf_dump(state->input, stderr);
1599 #endif
1600 logit("Bad packet length %u.", state->packlen);
1601 if ((r = sshpkt_disconnect(ssh, "Packet corrupt")) != 0)
1602 return r;
1603 return SSH_ERR_CONN_CORRUPT;
1604 }
1605 sshbuf_reset(state->incoming_packet);
1606 } else if (state->packlen == 0) {
1607 /*
1608 * check if input size is less than the cipher block size,
1609 * decrypt first block and extract length of incoming packet
1610 */
1611 if (sshbuf_len(state->input) < block_size)
1612 return 0;
1613 sshbuf_reset(state->incoming_packet);
1614 if ((r = sshbuf_reserve(state->incoming_packet, block_size,
1615 &cp)) != 0)
1616 goto out;
1617 if ((r = cipher_crypt(state->receive_context,
1618 state->p_send.seqnr, cp, sshbuf_ptr(state->input),
1619 block_size, 0, 0)) != 0)
1620 goto out;
1621 state->packlen = PEEK_U32(sshbuf_ptr(state->incoming_packet));
1622 if (state->packlen < 1 + 4 ||
1623 state->packlen > PACKET_MAX_SIZE) {
1624 #ifdef PACKET_DEBUG
1625 fprintf(stderr, "input: \n");
1626 sshbuf_dump(state->input, stderr);
1627 fprintf(stderr, "incoming_packet: \n");
1628 sshbuf_dump(state->incoming_packet, stderr);
1629 #endif
1630 logit("Bad packet length %u.", state->packlen);
1631 return ssh_packet_start_discard(ssh, enc, mac, 0,
1632 PACKET_MAX_SIZE);
1633 }
1634 if ((r = sshbuf_consume(state->input, block_size)) != 0)
1635 goto out;
1636 }
1637 DBG(debug("input: packet len %u", state->packlen+4));
1638
1639 if (aadlen) {
1640 /* only the payload is encrypted */
1641 need = state->packlen;
1642 } else {
1643 /*
1644 * the payload size and the payload are encrypted, but we
1645 * have a partial packet of block_size bytes
1646 */
1647 need = 4 + state->packlen - block_size;
1648 }
1649 DBG(debug("partial packet: block %d, need %d, maclen %d, authlen %d,"
1650 " aadlen %d", block_size, need, maclen, authlen, aadlen));
1651 if (need % block_size != 0) {
1652 logit("padding error: need %d block %d mod %d",
1653 need, block_size, need % block_size);
1654 return ssh_packet_start_discard(ssh, enc, mac, 0,
1655 PACKET_MAX_SIZE - block_size);
1656 }
1657 /*
1658 * check if the entire packet has been received and
1659 * decrypt into incoming_packet:
1660 * 'aadlen' bytes are unencrypted, but authenticated.
1661 * 'need' bytes are encrypted, followed by either
1662 * 'authlen' bytes of authentication tag or
1663 * 'maclen' bytes of message authentication code.
1664 */
1665 if (sshbuf_len(state->input) < aadlen + need + authlen + maclen)
1666 return 0; /* packet is incomplete */
1667 #ifdef PACKET_DEBUG
1668 fprintf(stderr, "read_poll enc/full: ");
1669 sshbuf_dump(state->input, stderr);
1670 #endif
1671 /* EtM: check mac over encrypted input */
1672 if (mac && mac->enabled && mac->etm) {
1673 if ((r = mac_check(mac, state->p_read.seqnr,
1674 sshbuf_ptr(state->input), aadlen + need,
1675 sshbuf_ptr(state->input) + aadlen + need + authlen,
1676 maclen)) != 0) {
1677 if (r == SSH_ERR_MAC_INVALID)
1678 logit("Corrupted MAC on input.");
1679 goto out;
1680 }
1681 }
1682 if ((r = sshbuf_reserve(state->incoming_packet, aadlen + need,
1683 &cp)) != 0)
1684 goto out;
1685 if ((r = cipher_crypt(state->receive_context, state->p_read.seqnr, cp,
1686 sshbuf_ptr(state->input), need, aadlen, authlen)) != 0)
1687 goto out;
1688 if ((r = sshbuf_consume(state->input, aadlen + need + authlen)) != 0)
1689 goto out;
1690 if (mac && mac->enabled) {
1691 /* Not EtM: check MAC over cleartext */
1692 if (!mac->etm && (r = mac_check(mac, state->p_read.seqnr,
1693 sshbuf_ptr(state->incoming_packet),
1694 sshbuf_len(state->incoming_packet),
1695 sshbuf_ptr(state->input), maclen)) != 0) {
1696 if (r != SSH_ERR_MAC_INVALID)
1697 goto out;
1698 logit("Corrupted MAC on input.");
1699 if (need + block_size > PACKET_MAX_SIZE)
1700 return SSH_ERR_INTERNAL_ERROR;
1701 return ssh_packet_start_discard(ssh, enc, mac,
1702 sshbuf_len(state->incoming_packet),
1703 PACKET_MAX_SIZE - need - block_size);
1704 }
1705 /* Remove MAC from input buffer */
1706 DBG(debug("MAC #%d ok", state->p_read.seqnr));
1707 if ((r = sshbuf_consume(state->input, mac->mac_len)) != 0)
1708 goto out;
1709 }
1710
1711 if (seqnr_p != NULL)
1712 *seqnr_p = state->p_read.seqnr;
1713 if (++state->p_read.seqnr == 0) {
1714 if ((ssh->kex->flags & KEX_INITIAL) != 0) {
1715 ssh_packet_disconnect(ssh, "incoming sequence number "
1716 "wrapped during initial key exchange");
1717 }
1718 logit("incoming seqnr wraps around");
1719 }
1720 if (++state->p_read.packets == 0)
1721 if (!(ssh->compat & SSH_BUG_NOREKEY))
1722 return SSH_ERR_NEED_REKEY;
1723 state->p_read.blocks += (state->packlen + 4) / block_size;
1724 state->p_read.bytes += state->packlen + 4;
1725
1726 /* get padlen */
1727 padlen = sshbuf_ptr(state->incoming_packet)[4];
1728 DBG(debug("input: padlen %d", padlen));
1729 if (padlen < 4) {
1730 if ((r = sshpkt_disconnect(ssh,
1731 "Corrupted padlen %d on input.", padlen)) != 0 ||
1732 (r = ssh_packet_write_wait(ssh)) != 0)
1733 return r;
1734 return SSH_ERR_CONN_CORRUPT;
1735 }
1736
1737 /* skip packet size + padlen, discard padding */
1738 if ((r = sshbuf_consume(state->incoming_packet, 4 + 1)) != 0 ||
1739 ((r = sshbuf_consume_end(state->incoming_packet, padlen)) != 0))
1740 goto out;
1741
1742 DBG(debug("input: len before de-compress %zd",
1743 sshbuf_len(state->incoming_packet)));
1744 if (comp && comp->enabled) {
1745 sshbuf_reset(state->compression_buffer);
1746 if ((r = uncompress_buffer(ssh, state->incoming_packet,
1747 state->compression_buffer)) != 0)
1748 goto out;
1749 sshbuf_reset(state->incoming_packet);
1750 if ((r = sshbuf_putb(state->incoming_packet,
1751 state->compression_buffer)) != 0)
1752 goto out;
1753 DBG(debug("input: len after de-compress %zd",
1754 sshbuf_len(state->incoming_packet)));
1755 }
1756 /*
1757 * get packet type, implies consume.
1758 * return length of payload (without type field)
1759 */
1760 if ((r = sshbuf_get_u8(state->incoming_packet, typep)) != 0)
1761 goto out;
1762 if (ssh_packet_log_type(*typep))
1763 debug3("receive packet: type %u", *typep);
1764 if (*typep < SSH2_MSG_MIN) {
1765 if ((r = sshpkt_disconnect(ssh,
1766 "Invalid ssh2 packet type: %d", *typep)) != 0 ||
1767 (r = ssh_packet_write_wait(ssh)) != 0)
1768 return r;
1769 return SSH_ERR_PROTOCOL_ERROR;
1770 }
1771 if (state->hook_in != NULL &&
1772 (r = state->hook_in(ssh, state->incoming_packet, typep,
1773 state->hook_in_ctx)) != 0)
1774 return r;
1775 if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side)
1776 r = ssh_packet_enable_delayed_compress(ssh);
1777 else
1778 r = 0;
1779 #ifdef PACKET_DEBUG
1780 fprintf(stderr, "read/plain[%d]:\r\n", *typep);
1781 sshbuf_dump(state->incoming_packet, stderr);
1782 #endif
1783 /* reset for next packet */
1784 state->packlen = 0;
1785 if (*typep == SSH2_MSG_NEWKEYS && ssh->kex->kex_strict) {
1786 debug_f("resetting read seqnr %u", state->p_read.seqnr);
1787 state->p_read.seqnr = 0;
1788 }
1789
1790 if ((r = ssh_packet_check_rekey(ssh)) != 0)
1791 return r;
1792 out:
1793 return r;
1794 }
1795
1796 int
ssh_packet_read_poll_seqnr(struct ssh * ssh,u_char * typep,u_int32_t * seqnr_p)1797 ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
1798 {
1799 struct session_state *state = ssh->state;
1800 u_int reason, seqnr;
1801 int r;
1802 u_char *msg;
1803 const u_char *d;
1804 size_t len;
1805
1806 for (;;) {
1807 msg = NULL;
1808 r = ssh_packet_read_poll2(ssh, typep, seqnr_p);
1809 if (r != 0)
1810 return r;
1811 if (*typep == 0) {
1812 /* no message ready */
1813 return 0;
1814 }
1815 state->keep_alive_timeouts = 0;
1816 DBG(debug("received packet type %d", *typep));
1817
1818 /* Always process disconnect messages */
1819 if (*typep == SSH2_MSG_DISCONNECT) {
1820 if ((r = sshpkt_get_u32(ssh, &reason)) != 0 ||
1821 (r = sshpkt_get_string(ssh, &msg, NULL)) != 0)
1822 return r;
1823 /* Ignore normal client exit notifications */
1824 do_log2(ssh->state->server_side &&
1825 reason == SSH2_DISCONNECT_BY_APPLICATION ?
1826 SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
1827 "Received disconnect from %s port %d:"
1828 "%u: %.400s", ssh_remote_ipaddr(ssh),
1829 ssh_remote_port(ssh), reason, msg);
1830 free(msg);
1831 return SSH_ERR_DISCONNECTED;
1832 }
1833
1834 /*
1835 * Do not implicitly handle any messages here during initial
1836 * KEX when in strict mode. They will be need to be allowed
1837 * explicitly by the KEX dispatch table or they will generate
1838 * protocol errors.
1839 */
1840 if (ssh->kex != NULL &&
1841 (ssh->kex->flags & KEX_INITIAL) && ssh->kex->kex_strict)
1842 return 0;
1843 /* Implicitly handle transport-level messages */
1844 switch (*typep) {
1845 case SSH2_MSG_IGNORE:
1846 debug3("Received SSH2_MSG_IGNORE");
1847 break;
1848 case SSH2_MSG_DEBUG:
1849 if ((r = sshpkt_get_u8(ssh, NULL)) != 0 ||
1850 (r = sshpkt_get_string(ssh, &msg, NULL)) != 0 ||
1851 (r = sshpkt_get_string(ssh, NULL, NULL)) != 0) {
1852 free(msg);
1853 return r;
1854 }
1855 debug("Remote: %.900s", msg);
1856 free(msg);
1857 break;
1858 case SSH2_MSG_UNIMPLEMENTED:
1859 if ((r = sshpkt_get_u32(ssh, &seqnr)) != 0)
1860 return r;
1861 debug("Received SSH2_MSG_UNIMPLEMENTED for %u",
1862 seqnr);
1863 break;
1864 case SSH2_MSG_PING:
1865 if ((r = sshpkt_get_string_direct(ssh, &d, &len)) != 0)
1866 return r;
1867 DBG(debug("Received SSH2_MSG_PING len %zu", len));
1868 if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 ||
1869 (r = sshpkt_put_string(ssh, d, len)) != 0 ||
1870 (r = sshpkt_send(ssh)) != 0)
1871 return r;
1872 break;
1873 case SSH2_MSG_PONG:
1874 if ((r = sshpkt_get_string_direct(ssh,
1875 NULL, &len)) != 0)
1876 return r;
1877 DBG(debug("Received SSH2_MSG_PONG len %zu", len));
1878 break;
1879 default:
1880 return 0;
1881 }
1882 }
1883 }
1884
1885 /*
1886 * Buffers the supplied input data. This is intended to be used together
1887 * with packet_read_poll().
1888 */
1889 int
ssh_packet_process_incoming(struct ssh * ssh,const char * buf,u_int len)1890 ssh_packet_process_incoming(struct ssh *ssh, const char *buf, u_int len)
1891 {
1892 struct session_state *state = ssh->state;
1893 int r;
1894
1895 if (state->packet_discard) {
1896 state->keep_alive_timeouts = 0; /* ?? */
1897 if (len >= state->packet_discard) {
1898 if ((r = ssh_packet_stop_discard(ssh)) != 0)
1899 return r;
1900 }
1901 state->packet_discard -= len;
1902 return 0;
1903 }
1904 if ((r = sshbuf_put(state->input, buf, len)) != 0)
1905 return r;
1906
1907 return 0;
1908 }
1909
1910 /* Reads and buffers data from the specified fd */
1911 int
ssh_packet_process_read(struct ssh * ssh,int fd)1912 ssh_packet_process_read(struct ssh *ssh, int fd)
1913 {
1914 struct session_state *state = ssh->state;
1915 int r;
1916 size_t rlen;
1917
1918 if ((r = sshbuf_read(fd, state->input, PACKET_MAX_SIZE, &rlen)) != 0)
1919 return r;
1920
1921 if (state->packet_discard) {
1922 if ((r = sshbuf_consume_end(state->input, rlen)) != 0)
1923 return r;
1924 state->keep_alive_timeouts = 0; /* ?? */
1925 if (rlen >= state->packet_discard) {
1926 if ((r = ssh_packet_stop_discard(ssh)) != 0)
1927 return r;
1928 }
1929 state->packet_discard -= rlen;
1930 return 0;
1931 }
1932 return 0;
1933 }
1934
1935 int
ssh_packet_remaining(struct ssh * ssh)1936 ssh_packet_remaining(struct ssh *ssh)
1937 {
1938 return sshbuf_len(ssh->state->incoming_packet);
1939 }
1940
1941 /*
1942 * Sends a diagnostic message from the server to the client. This message
1943 * can be sent at any time (but not while constructing another message). The
1944 * message is printed immediately, but only if the client is being executed
1945 * in verbose mode. These messages are primarily intended to ease debugging
1946 * authentication problems. The length of the formatted message must not
1947 * exceed 1024 bytes. This will automatically call ssh_packet_write_wait.
1948 */
1949 void
ssh_packet_send_debug(struct ssh * ssh,const char * fmt,...)1950 ssh_packet_send_debug(struct ssh *ssh, const char *fmt,...)
1951 {
1952 char buf[1024];
1953 va_list args;
1954 int r;
1955
1956 if ((ssh->compat & SSH_BUG_DEBUG))
1957 return;
1958
1959 va_start(args, fmt);
1960 vsnprintf(buf, sizeof(buf), fmt, args);
1961 va_end(args);
1962
1963 debug3("sending debug message: %s", buf);
1964
1965 if ((r = sshpkt_start(ssh, SSH2_MSG_DEBUG)) != 0 ||
1966 (r = sshpkt_put_u8(ssh, 0)) != 0 || /* always display */
1967 (r = sshpkt_put_cstring(ssh, buf)) != 0 ||
1968 (r = sshpkt_put_cstring(ssh, "")) != 0 ||
1969 (r = sshpkt_send(ssh)) != 0 ||
1970 (r = ssh_packet_write_wait(ssh)) != 0)
1971 fatal_fr(r, "send DEBUG");
1972 }
1973
1974 void
sshpkt_fmt_connection_id(struct ssh * ssh,char * s,size_t l)1975 sshpkt_fmt_connection_id(struct ssh *ssh, char *s, size_t l)
1976 {
1977 snprintf(s, l, "%.200s%s%s port %d",
1978 ssh->log_preamble ? ssh->log_preamble : "",
1979 ssh->log_preamble ? " " : "",
1980 ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
1981 }
1982
1983 /*
1984 * Pretty-print connection-terminating errors and exit.
1985 */
1986 static void
sshpkt_vfatal(struct ssh * ssh,int r,const char * fmt,va_list ap)1987 sshpkt_vfatal(struct ssh *ssh, int r, const char *fmt, va_list ap)
1988 {
1989 char *tag = NULL, remote_id[512];
1990 int oerrno = errno;
1991
1992 sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
1993
1994 switch (r) {
1995 case SSH_ERR_CONN_CLOSED:
1996 ssh_packet_clear_keys(ssh);
1997 logdie("Connection closed by %s", remote_id);
1998 case SSH_ERR_CONN_TIMEOUT:
1999 ssh_packet_clear_keys(ssh);
2000 logdie("Connection %s %s timed out",
2001 ssh->state->server_side ? "from" : "to", remote_id);
2002 case SSH_ERR_DISCONNECTED:
2003 ssh_packet_clear_keys(ssh);
2004 logdie("Disconnected from %s", remote_id);
2005 case SSH_ERR_SYSTEM_ERROR:
2006 if (errno == ECONNRESET) {
2007 ssh_packet_clear_keys(ssh);
2008 logdie("Connection reset by %s", remote_id);
2009 }
2010 /* FALLTHROUGH */
2011 case SSH_ERR_NO_CIPHER_ALG_MATCH:
2012 case SSH_ERR_NO_MAC_ALG_MATCH:
2013 case SSH_ERR_NO_COMPRESS_ALG_MATCH:
2014 case SSH_ERR_NO_KEX_ALG_MATCH:
2015 case SSH_ERR_NO_HOSTKEY_ALG_MATCH:
2016 if (ssh->kex && ssh->kex->failed_choice) {
2017 ssh_packet_clear_keys(ssh);
2018 errno = oerrno;
2019 logdie("Unable to negotiate with %s: %s. "
2020 "Their offer: %s", remote_id, ssh_err(r),
2021 ssh->kex->failed_choice);
2022 }
2023 /* FALLTHROUGH */
2024 default:
2025 if (vasprintf(&tag, fmt, ap) == -1) {
2026 ssh_packet_clear_keys(ssh);
2027 logdie_f("could not allocate failure message");
2028 }
2029 ssh_packet_clear_keys(ssh);
2030 errno = oerrno;
2031 logdie_r(r, "%s%sConnection %s %s",
2032 tag != NULL ? tag : "", tag != NULL ? ": " : "",
2033 ssh->state->server_side ? "from" : "to", remote_id);
2034 }
2035 }
2036
2037 void
sshpkt_fatal(struct ssh * ssh,int r,const char * fmt,...)2038 sshpkt_fatal(struct ssh *ssh, int r, const char *fmt, ...)
2039 {
2040 va_list ap;
2041
2042 va_start(ap, fmt);
2043 sshpkt_vfatal(ssh, r, fmt, ap);
2044 /* NOTREACHED */
2045 va_end(ap);
2046 logdie_f("should have exited");
2047 }
2048
2049 /*
2050 * Logs the error plus constructs and sends a disconnect packet, closes the
2051 * connection, and exits. This function never returns. The error message
2052 * should not contain a newline. The length of the formatted message must
2053 * not exceed 1024 bytes.
2054 */
2055 void
ssh_packet_disconnect(struct ssh * ssh,const char * fmt,...)2056 ssh_packet_disconnect(struct ssh *ssh, const char *fmt,...)
2057 {
2058 char buf[1024], remote_id[512];
2059 va_list args;
2060 static int disconnecting = 0;
2061 int r;
2062
2063 if (disconnecting) /* Guard against recursive invocations. */
2064 fatal("packet_disconnect called recursively.");
2065 disconnecting = 1;
2066
2067 /*
2068 * Format the message. Note that the caller must make sure the
2069 * message is of limited size.
2070 */
2071 sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
2072 va_start(args, fmt);
2073 vsnprintf(buf, sizeof(buf), fmt, args);
2074 va_end(args);
2075
2076 /* Display the error locally */
2077 logit("Disconnecting %s: %.100s", remote_id, buf);
2078
2079 /*
2080 * Send the disconnect message to the other side, and wait
2081 * for it to get sent.
2082 */
2083 if ((r = sshpkt_disconnect(ssh, "%s", buf)) != 0)
2084 sshpkt_fatal(ssh, r, "%s", __func__);
2085
2086 if ((r = ssh_packet_write_wait(ssh)) != 0)
2087 sshpkt_fatal(ssh, r, "%s", __func__);
2088
2089 /* Close the connection. */
2090 ssh_packet_close(ssh);
2091 cleanup_exit(255);
2092 }
2093
2094 /*
2095 * Checks if there is any buffered output, and tries to write some of
2096 * the output.
2097 */
2098 int
ssh_packet_write_poll(struct ssh * ssh)2099 ssh_packet_write_poll(struct ssh *ssh)
2100 {
2101 struct session_state *state = ssh->state;
2102 int len = sshbuf_len(state->output);
2103 int r;
2104
2105 if (len > 0) {
2106 len = write(state->connection_out,
2107 sshbuf_ptr(state->output), len);
2108 if (len == -1) {
2109 if (errno == EINTR || errno == EAGAIN ||
2110 errno == EWOULDBLOCK)
2111 return 0;
2112 return SSH_ERR_SYSTEM_ERROR;
2113 }
2114 if (len == 0)
2115 return SSH_ERR_CONN_CLOSED;
2116 if ((r = sshbuf_consume(state->output, len)) != 0)
2117 return r;
2118 }
2119 return 0;
2120 }
2121
2122 /*
2123 * Calls packet_write_poll repeatedly until all pending output data has been
2124 * written.
2125 */
2126 int
ssh_packet_write_wait(struct ssh * ssh)2127 ssh_packet_write_wait(struct ssh *ssh)
2128 {
2129 int ret, r, ms_remain = 0;
2130 struct timeval start;
2131 struct timespec timespec, *timespecp = NULL;
2132 struct session_state *state = ssh->state;
2133 struct pollfd pfd;
2134
2135 if ((r = ssh_packet_write_poll(ssh)) != 0)
2136 return r;
2137 while (ssh_packet_have_data_to_write(ssh)) {
2138 pfd.fd = state->connection_out;
2139 pfd.events = POLLOUT;
2140
2141 if (state->packet_timeout_ms > 0) {
2142 ms_remain = state->packet_timeout_ms;
2143 timespecp = ×pec;
2144 }
2145 for (;;) {
2146 if (state->packet_timeout_ms > 0) {
2147 ms_to_timespec(×pec, ms_remain);
2148 monotime_tv(&start);
2149 }
2150 if ((ret = ppoll(&pfd, 1, timespecp, NULL)) >= 0)
2151 break;
2152 if (errno != EAGAIN && errno != EINTR &&
2153 errno != EWOULDBLOCK)
2154 break;
2155 if (state->packet_timeout_ms <= 0)
2156 continue;
2157 ms_subtract_diff(&start, &ms_remain);
2158 if (ms_remain <= 0) {
2159 ret = 0;
2160 break;
2161 }
2162 }
2163 if (ret == 0)
2164 return SSH_ERR_CONN_TIMEOUT;
2165 if ((r = ssh_packet_write_poll(ssh)) != 0)
2166 return r;
2167 }
2168 return 0;
2169 }
2170
2171 /* Returns true if there is buffered data to write to the connection. */
2172
2173 int
ssh_packet_have_data_to_write(struct ssh * ssh)2174 ssh_packet_have_data_to_write(struct ssh *ssh)
2175 {
2176 return sshbuf_len(ssh->state->output) != 0;
2177 }
2178
2179 /* Returns true if there is not too much data to write to the connection. */
2180
2181 int
ssh_packet_not_very_much_data_to_write(struct ssh * ssh)2182 ssh_packet_not_very_much_data_to_write(struct ssh *ssh)
2183 {
2184 if (ssh->state->interactive_mode)
2185 return sshbuf_len(ssh->state->output) < 16384;
2186 else
2187 return sshbuf_len(ssh->state->output) < 128 * 1024;
2188 }
2189
2190 /*
2191 * returns true when there are at most a few keystrokes of data to write
2192 * and the connection is in interactive mode.
2193 */
2194
2195 int
ssh_packet_interactive_data_to_write(struct ssh * ssh)2196 ssh_packet_interactive_data_to_write(struct ssh *ssh)
2197 {
2198 return ssh->state->interactive_mode &&
2199 sshbuf_len(ssh->state->output) < 256;
2200 }
2201
2202 void
ssh_packet_set_tos(struct ssh * ssh,int tos)2203 ssh_packet_set_tos(struct ssh *ssh, int tos)
2204 {
2205 if (!ssh_packet_connection_is_on_socket(ssh) || tos == INT_MAX)
2206 return;
2207 set_sock_tos(ssh->state->connection_in, tos);
2208 }
2209
2210 /* Informs that the current session is interactive. Sets IP flags for that. */
2211
2212 void
ssh_packet_set_interactive(struct ssh * ssh,int interactive,int qos_interactive,int qos_bulk)2213 ssh_packet_set_interactive(struct ssh *ssh, int interactive, int qos_interactive, int qos_bulk)
2214 {
2215 struct session_state *state = ssh->state;
2216
2217 if (state->set_interactive_called)
2218 return;
2219 state->set_interactive_called = 1;
2220
2221 /* Record that we are in interactive mode. */
2222 state->interactive_mode = interactive;
2223
2224 /* Only set socket options if using a socket. */
2225 if (!ssh_packet_connection_is_on_socket(ssh))
2226 return;
2227 set_nodelay(state->connection_in);
2228 ssh_packet_set_tos(ssh, interactive ? qos_interactive : qos_bulk);
2229 }
2230
2231 /* Returns true if the current connection is interactive. */
2232
2233 int
ssh_packet_is_interactive(struct ssh * ssh)2234 ssh_packet_is_interactive(struct ssh *ssh)
2235 {
2236 return ssh->state->interactive_mode;
2237 }
2238
2239 int
ssh_packet_set_maxsize(struct ssh * ssh,u_int s)2240 ssh_packet_set_maxsize(struct ssh *ssh, u_int s)
2241 {
2242 struct session_state *state = ssh->state;
2243
2244 if (state->set_maxsize_called) {
2245 logit_f("called twice: old %d new %d",
2246 state->max_packet_size, s);
2247 return -1;
2248 }
2249 if (s < 4 * 1024 || s > 1024 * 1024) {
2250 logit_f("bad size %d", s);
2251 return -1;
2252 }
2253 state->set_maxsize_called = 1;
2254 debug_f("setting to %d", s);
2255 state->max_packet_size = s;
2256 return s;
2257 }
2258
2259 int
ssh_packet_inc_alive_timeouts(struct ssh * ssh)2260 ssh_packet_inc_alive_timeouts(struct ssh *ssh)
2261 {
2262 return ++ssh->state->keep_alive_timeouts;
2263 }
2264
2265 void
ssh_packet_set_alive_timeouts(struct ssh * ssh,int ka)2266 ssh_packet_set_alive_timeouts(struct ssh *ssh, int ka)
2267 {
2268 ssh->state->keep_alive_timeouts = ka;
2269 }
2270
2271 u_int
ssh_packet_get_maxsize(struct ssh * ssh)2272 ssh_packet_get_maxsize(struct ssh *ssh)
2273 {
2274 return ssh->state->max_packet_size;
2275 }
2276
2277 void
ssh_packet_set_rekey_limits(struct ssh * ssh,u_int64_t bytes,u_int32_t seconds)2278 ssh_packet_set_rekey_limits(struct ssh *ssh, u_int64_t bytes, u_int32_t seconds)
2279 {
2280 debug3("rekey after %llu bytes, %u seconds", (unsigned long long)bytes,
2281 (unsigned int)seconds);
2282 ssh->state->rekey_limit = bytes;
2283 ssh->state->rekey_interval = seconds;
2284 }
2285
2286 time_t
ssh_packet_get_rekey_timeout(struct ssh * ssh)2287 ssh_packet_get_rekey_timeout(struct ssh *ssh)
2288 {
2289 time_t seconds;
2290
2291 seconds = ssh->state->rekey_time + ssh->state->rekey_interval -
2292 monotime();
2293 return (seconds <= 0 ? 1 : seconds);
2294 }
2295
2296 void
ssh_packet_set_server(struct ssh * ssh)2297 ssh_packet_set_server(struct ssh *ssh)
2298 {
2299 ssh->state->server_side = 1;
2300 ssh->kex->server = 1; /* XXX unify? */
2301 }
2302
2303 void
ssh_packet_set_authenticated(struct ssh * ssh)2304 ssh_packet_set_authenticated(struct ssh *ssh)
2305 {
2306 ssh->state->after_authentication = 1;
2307 }
2308
2309 void *
ssh_packet_get_input(struct ssh * ssh)2310 ssh_packet_get_input(struct ssh *ssh)
2311 {
2312 return (void *)ssh->state->input;
2313 }
2314
2315 void *
ssh_packet_get_output(struct ssh * ssh)2316 ssh_packet_get_output(struct ssh *ssh)
2317 {
2318 return (void *)ssh->state->output;
2319 }
2320
2321 /* Reset after_authentication and reset compression in post-auth privsep */
2322 static int
ssh_packet_set_postauth(struct ssh * ssh)2323 ssh_packet_set_postauth(struct ssh *ssh)
2324 {
2325 int r;
2326
2327 debug_f("called");
2328 /* This was set in net child, but is not visible in user child */
2329 ssh->state->after_authentication = 1;
2330 ssh->state->rekeying = 0;
2331 if ((r = ssh_packet_enable_delayed_compress(ssh)) != 0)
2332 return r;
2333 return 0;
2334 }
2335
2336 /* Packet state (de-)serialization for privsep */
2337
2338 /* turn kex into a blob for packet state serialization */
2339 static int
kex_to_blob(struct sshbuf * m,struct kex * kex)2340 kex_to_blob(struct sshbuf *m, struct kex *kex)
2341 {
2342 int r;
2343
2344 if ((r = sshbuf_put_u32(m, kex->we_need)) != 0 ||
2345 (r = sshbuf_put_cstring(m, kex->hostkey_alg)) != 0 ||
2346 (r = sshbuf_put_u32(m, kex->hostkey_type)) != 0 ||
2347 (r = sshbuf_put_u32(m, kex->hostkey_nid)) != 0 ||
2348 (r = sshbuf_put_u32(m, kex->kex_type)) != 0 ||
2349 (r = sshbuf_put_u32(m, kex->kex_strict)) != 0 ||
2350 (r = sshbuf_put_stringb(m, kex->my)) != 0 ||
2351 (r = sshbuf_put_stringb(m, kex->peer)) != 0 ||
2352 (r = sshbuf_put_stringb(m, kex->client_version)) != 0 ||
2353 (r = sshbuf_put_stringb(m, kex->server_version)) != 0 ||
2354 (r = sshbuf_put_stringb(m, kex->session_id)) != 0 ||
2355 (r = sshbuf_put_u32(m, kex->flags)) != 0)
2356 return r;
2357 return 0;
2358 }
2359
2360 /* turn key exchange results into a blob for packet state serialization */
2361 static int
newkeys_to_blob(struct sshbuf * m,struct ssh * ssh,int mode)2362 newkeys_to_blob(struct sshbuf *m, struct ssh *ssh, int mode)
2363 {
2364 struct sshbuf *b;
2365 struct sshcipher_ctx *cc;
2366 struct sshcomp *comp;
2367 struct sshenc *enc;
2368 struct sshmac *mac;
2369 struct newkeys *newkey;
2370 int r;
2371
2372 if ((newkey = ssh->state->newkeys[mode]) == NULL)
2373 return SSH_ERR_INTERNAL_ERROR;
2374 enc = &newkey->enc;
2375 mac = &newkey->mac;
2376 comp = &newkey->comp;
2377 cc = (mode == MODE_OUT) ? ssh->state->send_context :
2378 ssh->state->receive_context;
2379 if ((r = cipher_get_keyiv(cc, enc->iv, enc->iv_len)) != 0)
2380 return r;
2381 if ((b = sshbuf_new()) == NULL)
2382 return SSH_ERR_ALLOC_FAIL;
2383 if ((r = sshbuf_put_cstring(b, enc->name)) != 0 ||
2384 (r = sshbuf_put_u32(b, enc->enabled)) != 0 ||
2385 (r = sshbuf_put_u32(b, enc->block_size)) != 0 ||
2386 (r = sshbuf_put_string(b, enc->key, enc->key_len)) != 0 ||
2387 (r = sshbuf_put_string(b, enc->iv, enc->iv_len)) != 0)
2388 goto out;
2389 if (cipher_authlen(enc->cipher) == 0) {
2390 if ((r = sshbuf_put_cstring(b, mac->name)) != 0 ||
2391 (r = sshbuf_put_u32(b, mac->enabled)) != 0 ||
2392 (r = sshbuf_put_string(b, mac->key, mac->key_len)) != 0)
2393 goto out;
2394 }
2395 if ((r = sshbuf_put_u32(b, comp->type)) != 0 ||
2396 (r = sshbuf_put_cstring(b, comp->name)) != 0)
2397 goto out;
2398 r = sshbuf_put_stringb(m, b);
2399 out:
2400 sshbuf_free(b);
2401 return r;
2402 }
2403
2404 /* serialize packet state into a blob */
2405 int
ssh_packet_get_state(struct ssh * ssh,struct sshbuf * m)2406 ssh_packet_get_state(struct ssh *ssh, struct sshbuf *m)
2407 {
2408 struct session_state *state = ssh->state;
2409 int r;
2410
2411 if ((r = kex_to_blob(m, ssh->kex)) != 0 ||
2412 (r = newkeys_to_blob(m, ssh, MODE_OUT)) != 0 ||
2413 (r = newkeys_to_blob(m, ssh, MODE_IN)) != 0 ||
2414 (r = sshbuf_put_u64(m, state->rekey_limit)) != 0 ||
2415 (r = sshbuf_put_u32(m, state->rekey_interval)) != 0 ||
2416 (r = sshbuf_put_u32(m, state->p_send.seqnr)) != 0 ||
2417 (r = sshbuf_put_u64(m, state->p_send.blocks)) != 0 ||
2418 (r = sshbuf_put_u32(m, state->p_send.packets)) != 0 ||
2419 (r = sshbuf_put_u64(m, state->p_send.bytes)) != 0 ||
2420 (r = sshbuf_put_u32(m, state->p_read.seqnr)) != 0 ||
2421 (r = sshbuf_put_u64(m, state->p_read.blocks)) != 0 ||
2422 (r = sshbuf_put_u32(m, state->p_read.packets)) != 0 ||
2423 (r = sshbuf_put_u64(m, state->p_read.bytes)) != 0 ||
2424 (r = sshbuf_put_stringb(m, state->input)) != 0 ||
2425 (r = sshbuf_put_stringb(m, state->output)) != 0)
2426 return r;
2427
2428 return 0;
2429 }
2430
2431 /* restore key exchange results from blob for packet state de-serialization */
2432 static int
newkeys_from_blob(struct sshbuf * m,struct ssh * ssh,int mode)2433 newkeys_from_blob(struct sshbuf *m, struct ssh *ssh, int mode)
2434 {
2435 struct sshbuf *b = NULL;
2436 struct sshcomp *comp;
2437 struct sshenc *enc;
2438 struct sshmac *mac;
2439 struct newkeys *newkey = NULL;
2440 size_t keylen, ivlen, maclen;
2441 int r;
2442
2443 if ((newkey = calloc(1, sizeof(*newkey))) == NULL) {
2444 r = SSH_ERR_ALLOC_FAIL;
2445 goto out;
2446 }
2447 if ((r = sshbuf_froms(m, &b)) != 0)
2448 goto out;
2449 #ifdef DEBUG_PK
2450 sshbuf_dump(b, stderr);
2451 #endif
2452 enc = &newkey->enc;
2453 mac = &newkey->mac;
2454 comp = &newkey->comp;
2455
2456 if ((r = sshbuf_get_cstring(b, &enc->name, NULL)) != 0 ||
2457 (r = sshbuf_get_u32(b, (u_int *)&enc->enabled)) != 0 ||
2458 (r = sshbuf_get_u32(b, &enc->block_size)) != 0 ||
2459 (r = sshbuf_get_string(b, &enc->key, &keylen)) != 0 ||
2460 (r = sshbuf_get_string(b, &enc->iv, &ivlen)) != 0)
2461 goto out;
2462 if ((enc->cipher = cipher_by_name(enc->name)) == NULL) {
2463 r = SSH_ERR_INVALID_FORMAT;
2464 goto out;
2465 }
2466 if (cipher_authlen(enc->cipher) == 0) {
2467 if ((r = sshbuf_get_cstring(b, &mac->name, NULL)) != 0)
2468 goto out;
2469 if ((r = mac_setup(mac, mac->name)) != 0)
2470 goto out;
2471 if ((r = sshbuf_get_u32(b, (u_int *)&mac->enabled)) != 0 ||
2472 (r = sshbuf_get_string(b, &mac->key, &maclen)) != 0)
2473 goto out;
2474 if (maclen > mac->key_len) {
2475 r = SSH_ERR_INVALID_FORMAT;
2476 goto out;
2477 }
2478 mac->key_len = maclen;
2479 }
2480 if ((r = sshbuf_get_u32(b, &comp->type)) != 0 ||
2481 (r = sshbuf_get_cstring(b, &comp->name, NULL)) != 0)
2482 goto out;
2483 if (sshbuf_len(b) != 0) {
2484 r = SSH_ERR_INVALID_FORMAT;
2485 goto out;
2486 }
2487 enc->key_len = keylen;
2488 enc->iv_len = ivlen;
2489 ssh->kex->newkeys[mode] = newkey;
2490 newkey = NULL;
2491 r = 0;
2492 out:
2493 free(newkey);
2494 sshbuf_free(b);
2495 return r;
2496 }
2497
2498 /* restore kex from blob for packet state de-serialization */
2499 static int
kex_from_blob(struct sshbuf * m,struct kex ** kexp)2500 kex_from_blob(struct sshbuf *m, struct kex **kexp)
2501 {
2502 struct kex *kex;
2503 int r;
2504
2505 if ((kex = kex_new()) == NULL)
2506 return SSH_ERR_ALLOC_FAIL;
2507 if ((r = sshbuf_get_u32(m, &kex->we_need)) != 0 ||
2508 (r = sshbuf_get_cstring(m, &kex->hostkey_alg, NULL)) != 0 ||
2509 (r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_type)) != 0 ||
2510 (r = sshbuf_get_u32(m, (u_int *)&kex->hostkey_nid)) != 0 ||
2511 (r = sshbuf_get_u32(m, &kex->kex_type)) != 0 ||
2512 (r = sshbuf_get_u32(m, &kex->kex_strict)) != 0 ||
2513 (r = sshbuf_get_stringb(m, kex->my)) != 0 ||
2514 (r = sshbuf_get_stringb(m, kex->peer)) != 0 ||
2515 (r = sshbuf_get_stringb(m, kex->client_version)) != 0 ||
2516 (r = sshbuf_get_stringb(m, kex->server_version)) != 0 ||
2517 (r = sshbuf_get_stringb(m, kex->session_id)) != 0 ||
2518 (r = sshbuf_get_u32(m, &kex->flags)) != 0)
2519 goto out;
2520 kex->server = 1;
2521 kex->done = 1;
2522 r = 0;
2523 out:
2524 if (r != 0 || kexp == NULL) {
2525 kex_free(kex);
2526 if (kexp != NULL)
2527 *kexp = NULL;
2528 } else {
2529 kex_free(*kexp);
2530 *kexp = kex;
2531 }
2532 return r;
2533 }
2534
2535 /*
2536 * Restore packet state from content of blob 'm' (de-serialization).
2537 * Note that 'm' will be partially consumed on parsing or any other errors.
2538 */
2539 int
ssh_packet_set_state(struct ssh * ssh,struct sshbuf * m)2540 ssh_packet_set_state(struct ssh *ssh, struct sshbuf *m)
2541 {
2542 struct session_state *state = ssh->state;
2543 const u_char *input, *output;
2544 size_t ilen, olen;
2545 int r;
2546
2547 if ((r = kex_from_blob(m, &ssh->kex)) != 0 ||
2548 (r = newkeys_from_blob(m, ssh, MODE_OUT)) != 0 ||
2549 (r = newkeys_from_blob(m, ssh, MODE_IN)) != 0 ||
2550 (r = sshbuf_get_u64(m, &state->rekey_limit)) != 0 ||
2551 (r = sshbuf_get_u32(m, &state->rekey_interval)) != 0 ||
2552 (r = sshbuf_get_u32(m, &state->p_send.seqnr)) != 0 ||
2553 (r = sshbuf_get_u64(m, &state->p_send.blocks)) != 0 ||
2554 (r = sshbuf_get_u32(m, &state->p_send.packets)) != 0 ||
2555 (r = sshbuf_get_u64(m, &state->p_send.bytes)) != 0 ||
2556 (r = sshbuf_get_u32(m, &state->p_read.seqnr)) != 0 ||
2557 (r = sshbuf_get_u64(m, &state->p_read.blocks)) != 0 ||
2558 (r = sshbuf_get_u32(m, &state->p_read.packets)) != 0 ||
2559 (r = sshbuf_get_u64(m, &state->p_read.bytes)) != 0)
2560 return r;
2561 /*
2562 * We set the time here so that in post-auth privsep child we
2563 * count from the completion of the authentication.
2564 */
2565 state->rekey_time = monotime();
2566 /* XXX ssh_set_newkeys overrides p_read.packets? XXX */
2567 if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0 ||
2568 (r = ssh_set_newkeys(ssh, MODE_OUT)) != 0)
2569 return r;
2570
2571 if ((r = ssh_packet_set_postauth(ssh)) != 0)
2572 return r;
2573
2574 sshbuf_reset(state->input);
2575 sshbuf_reset(state->output);
2576 if ((r = sshbuf_get_string_direct(m, &input, &ilen)) != 0 ||
2577 (r = sshbuf_get_string_direct(m, &output, &olen)) != 0 ||
2578 (r = sshbuf_put(state->input, input, ilen)) != 0 ||
2579 (r = sshbuf_put(state->output, output, olen)) != 0)
2580 return r;
2581
2582 if (sshbuf_len(m))
2583 return SSH_ERR_INVALID_FORMAT;
2584 debug3_f("done");
2585 return 0;
2586 }
2587
2588 /* NEW API */
2589
2590 /* put data to the outgoing packet */
2591
2592 int
sshpkt_put(struct ssh * ssh,const void * v,size_t len)2593 sshpkt_put(struct ssh *ssh, const void *v, size_t len)
2594 {
2595 return sshbuf_put(ssh->state->outgoing_packet, v, len);
2596 }
2597
2598 int
sshpkt_putb(struct ssh * ssh,const struct sshbuf * b)2599 sshpkt_putb(struct ssh *ssh, const struct sshbuf *b)
2600 {
2601 return sshbuf_putb(ssh->state->outgoing_packet, b);
2602 }
2603
2604 int
sshpkt_put_u8(struct ssh * ssh,u_char val)2605 sshpkt_put_u8(struct ssh *ssh, u_char val)
2606 {
2607 return sshbuf_put_u8(ssh->state->outgoing_packet, val);
2608 }
2609
2610 int
sshpkt_put_u32(struct ssh * ssh,u_int32_t val)2611 sshpkt_put_u32(struct ssh *ssh, u_int32_t val)
2612 {
2613 return sshbuf_put_u32(ssh->state->outgoing_packet, val);
2614 }
2615
2616 int
sshpkt_put_u64(struct ssh * ssh,u_int64_t val)2617 sshpkt_put_u64(struct ssh *ssh, u_int64_t val)
2618 {
2619 return sshbuf_put_u64(ssh->state->outgoing_packet, val);
2620 }
2621
2622 int
sshpkt_put_string(struct ssh * ssh,const void * v,size_t len)2623 sshpkt_put_string(struct ssh *ssh, const void *v, size_t len)
2624 {
2625 return sshbuf_put_string(ssh->state->outgoing_packet, v, len);
2626 }
2627
2628 int
sshpkt_put_cstring(struct ssh * ssh,const void * v)2629 sshpkt_put_cstring(struct ssh *ssh, const void *v)
2630 {
2631 return sshbuf_put_cstring(ssh->state->outgoing_packet, v);
2632 }
2633
2634 int
sshpkt_put_stringb(struct ssh * ssh,const struct sshbuf * v)2635 sshpkt_put_stringb(struct ssh *ssh, const struct sshbuf *v)
2636 {
2637 return sshbuf_put_stringb(ssh->state->outgoing_packet, v);
2638 }
2639
2640 int
sshpkt_getb_froms(struct ssh * ssh,struct sshbuf ** valp)2641 sshpkt_getb_froms(struct ssh *ssh, struct sshbuf **valp)
2642 {
2643 return sshbuf_froms(ssh->state->incoming_packet, valp);
2644 }
2645
2646 #ifdef WITH_OPENSSL
2647 #ifdef OPENSSL_HAS_ECC
2648 int
sshpkt_put_ec(struct ssh * ssh,const EC_POINT * v,const EC_GROUP * g)2649 sshpkt_put_ec(struct ssh *ssh, const EC_POINT *v, const EC_GROUP *g)
2650 {
2651 return sshbuf_put_ec(ssh->state->outgoing_packet, v, g);
2652 }
2653 #endif /* OPENSSL_HAS_ECC */
2654
2655
2656 int
sshpkt_put_bignum2(struct ssh * ssh,const BIGNUM * v)2657 sshpkt_put_bignum2(struct ssh *ssh, const BIGNUM *v)
2658 {
2659 return sshbuf_put_bignum2(ssh->state->outgoing_packet, v);
2660 }
2661 #endif /* WITH_OPENSSL */
2662
2663 /* fetch data from the incoming packet */
2664
2665 int
sshpkt_get(struct ssh * ssh,void * valp,size_t len)2666 sshpkt_get(struct ssh *ssh, void *valp, size_t len)
2667 {
2668 return sshbuf_get(ssh->state->incoming_packet, valp, len);
2669 }
2670
2671 int
sshpkt_get_u8(struct ssh * ssh,u_char * valp)2672 sshpkt_get_u8(struct ssh *ssh, u_char *valp)
2673 {
2674 return sshbuf_get_u8(ssh->state->incoming_packet, valp);
2675 }
2676
2677 int
sshpkt_get_u32(struct ssh * ssh,u_int32_t * valp)2678 sshpkt_get_u32(struct ssh *ssh, u_int32_t *valp)
2679 {
2680 return sshbuf_get_u32(ssh->state->incoming_packet, valp);
2681 }
2682
2683 int
sshpkt_get_u64(struct ssh * ssh,u_int64_t * valp)2684 sshpkt_get_u64(struct ssh *ssh, u_int64_t *valp)
2685 {
2686 return sshbuf_get_u64(ssh->state->incoming_packet, valp);
2687 }
2688
2689 int
sshpkt_get_string(struct ssh * ssh,u_char ** valp,size_t * lenp)2690 sshpkt_get_string(struct ssh *ssh, u_char **valp, size_t *lenp)
2691 {
2692 return sshbuf_get_string(ssh->state->incoming_packet, valp, lenp);
2693 }
2694
2695 int
sshpkt_get_string_direct(struct ssh * ssh,const u_char ** valp,size_t * lenp)2696 sshpkt_get_string_direct(struct ssh *ssh, const u_char **valp, size_t *lenp)
2697 {
2698 return sshbuf_get_string_direct(ssh->state->incoming_packet, valp, lenp);
2699 }
2700
2701 int
sshpkt_peek_string_direct(struct ssh * ssh,const u_char ** valp,size_t * lenp)2702 sshpkt_peek_string_direct(struct ssh *ssh, const u_char **valp, size_t *lenp)
2703 {
2704 return sshbuf_peek_string_direct(ssh->state->incoming_packet, valp, lenp);
2705 }
2706
2707 int
sshpkt_get_cstring(struct ssh * ssh,char ** valp,size_t * lenp)2708 sshpkt_get_cstring(struct ssh *ssh, char **valp, size_t *lenp)
2709 {
2710 return sshbuf_get_cstring(ssh->state->incoming_packet, valp, lenp);
2711 }
2712
2713 #ifdef WITH_OPENSSL
2714 #ifdef OPENSSL_HAS_ECC
2715 int
sshpkt_get_ec(struct ssh * ssh,EC_POINT * v,const EC_GROUP * g)2716 sshpkt_get_ec(struct ssh *ssh, EC_POINT *v, const EC_GROUP *g)
2717 {
2718 return sshbuf_get_ec(ssh->state->incoming_packet, v, g);
2719 }
2720 #endif /* OPENSSL_HAS_ECC */
2721
2722 int
sshpkt_get_bignum2(struct ssh * ssh,BIGNUM ** valp)2723 sshpkt_get_bignum2(struct ssh *ssh, BIGNUM **valp)
2724 {
2725 return sshbuf_get_bignum2(ssh->state->incoming_packet, valp);
2726 }
2727 #endif /* WITH_OPENSSL */
2728
2729 int
sshpkt_get_end(struct ssh * ssh)2730 sshpkt_get_end(struct ssh *ssh)
2731 {
2732 if (sshbuf_len(ssh->state->incoming_packet) > 0)
2733 return SSH_ERR_UNEXPECTED_TRAILING_DATA;
2734 return 0;
2735 }
2736
2737 const u_char *
sshpkt_ptr(struct ssh * ssh,size_t * lenp)2738 sshpkt_ptr(struct ssh *ssh, size_t *lenp)
2739 {
2740 if (lenp != NULL)
2741 *lenp = sshbuf_len(ssh->state->incoming_packet);
2742 return sshbuf_ptr(ssh->state->incoming_packet);
2743 }
2744
2745 /* start a new packet */
2746
2747 int
sshpkt_start(struct ssh * ssh,u_char type)2748 sshpkt_start(struct ssh *ssh, u_char type)
2749 {
2750 u_char buf[6]; /* u32 packet length, u8 pad len, u8 type */
2751
2752 DBG(debug("packet_start[%d]", type));
2753 memset(buf, 0, sizeof(buf));
2754 buf[sizeof(buf) - 1] = type;
2755 sshbuf_reset(ssh->state->outgoing_packet);
2756 return sshbuf_put(ssh->state->outgoing_packet, buf, sizeof(buf));
2757 }
2758
2759 static int
ssh_packet_send_mux(struct ssh * ssh)2760 ssh_packet_send_mux(struct ssh *ssh)
2761 {
2762 struct session_state *state = ssh->state;
2763 u_char type, *cp;
2764 size_t len;
2765 int r;
2766
2767 if (ssh->kex)
2768 return SSH_ERR_INTERNAL_ERROR;
2769 len = sshbuf_len(state->outgoing_packet);
2770 if (len < 6)
2771 return SSH_ERR_INTERNAL_ERROR;
2772 cp = sshbuf_mutable_ptr(state->outgoing_packet);
2773 type = cp[5];
2774 if (ssh_packet_log_type(type))
2775 debug3_f("type %u", type);
2776 /* drop everything, but the connection protocol */
2777 if (type >= SSH2_MSG_CONNECTION_MIN &&
2778 type <= SSH2_MSG_CONNECTION_MAX) {
2779 POKE_U32(cp, len - 4);
2780 if ((r = sshbuf_putb(state->output,
2781 state->outgoing_packet)) != 0)
2782 return r;
2783 /* sshbuf_dump(state->output, stderr); */
2784 }
2785 sshbuf_reset(state->outgoing_packet);
2786 return 0;
2787 }
2788
2789 /*
2790 * 9.2. Ignored Data Message
2791 *
2792 * byte SSH_MSG_IGNORE
2793 * string data
2794 *
2795 * All implementations MUST understand (and ignore) this message at any
2796 * time (after receiving the protocol version). No implementation is
2797 * required to send them. This message can be used as an additional
2798 * protection measure against advanced traffic analysis techniques.
2799 */
2800 int
sshpkt_msg_ignore(struct ssh * ssh,u_int nbytes)2801 sshpkt_msg_ignore(struct ssh *ssh, u_int nbytes)
2802 {
2803 u_int32_t rnd = 0;
2804 int r;
2805 u_int i;
2806
2807 if ((r = sshpkt_start(ssh, SSH2_MSG_IGNORE)) != 0 ||
2808 (r = sshpkt_put_u32(ssh, nbytes)) != 0)
2809 return r;
2810 for (i = 0; i < nbytes; i++) {
2811 if (i % 4 == 0)
2812 rnd = arc4random();
2813 if ((r = sshpkt_put_u8(ssh, (u_char)rnd & 0xff)) != 0)
2814 return r;
2815 rnd >>= 8;
2816 }
2817 return 0;
2818 }
2819
2820 /* send it */
2821
2822 int
sshpkt_send(struct ssh * ssh)2823 sshpkt_send(struct ssh *ssh)
2824 {
2825 if (ssh->state && ssh->state->mux)
2826 return ssh_packet_send_mux(ssh);
2827 return ssh_packet_send2(ssh);
2828 }
2829
2830 int
sshpkt_disconnect(struct ssh * ssh,const char * fmt,...)2831 sshpkt_disconnect(struct ssh *ssh, const char *fmt,...)
2832 {
2833 char buf[1024];
2834 va_list args;
2835 int r;
2836
2837 va_start(args, fmt);
2838 vsnprintf(buf, sizeof(buf), fmt, args);
2839 va_end(args);
2840
2841 debug2_f("sending SSH2_MSG_DISCONNECT: %s", buf);
2842 if ((r = sshpkt_start(ssh, SSH2_MSG_DISCONNECT)) != 0 ||
2843 (r = sshpkt_put_u32(ssh, SSH2_DISCONNECT_PROTOCOL_ERROR)) != 0 ||
2844 (r = sshpkt_put_cstring(ssh, buf)) != 0 ||
2845 (r = sshpkt_put_cstring(ssh, "")) != 0 ||
2846 (r = sshpkt_send(ssh)) != 0)
2847 return r;
2848 return 0;
2849 }
2850
2851 /* roundup current message to pad bytes */
2852 int
sshpkt_add_padding(struct ssh * ssh,u_char pad)2853 sshpkt_add_padding(struct ssh *ssh, u_char pad)
2854 {
2855 ssh->state->extra_pad = pad;
2856 return 0;
2857 }
2858