Mercurial > dropbear

comparison packet.c @ 752:24172f555f9c

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix MAC bug which would prevent asymmetric hashes
author Matt Johnston <matt@ucc.asn.au>
date Wed, 03 Apr 2013 23:54:58 +0800
parents 9a5438271556
children d63ef1e211ea
comparison
equal deleted inserted replaced
751:685d05f1cc5c 752:24172f555f9c
72 writebuf = (buffer*)l->item; 72 writebuf = (buffer*)l->item;
73 packet_type = writebuf->data[writebuf->len-1]; 73 packet_type = writebuf->data[writebuf->len-1];
74 len = writebuf->len - 1 - writebuf->pos; 74 len = writebuf->len - 1 - writebuf->pos;
75 dropbear_assert(len > 0); 75 dropbear_assert(len > 0);
76 all_ignore &= (packet_type == SSH_MSG_IGNORE); 76 all_ignore &= (packet_type == SSH_MSG_IGNORE);
77 TRACE2(("write_packet writev #%d type %d len %d/%d", i, packet_type,
78 len, writebuf->len-1))
77 iov[i].iov_base = buf_getptr(writebuf, len); 79 iov[i].iov_base = buf_getptr(writebuf, len);
78 iov[i].iov_len = len; 80 iov[i].iov_len = len;
79 } 81 }
80 written = writev(ses.sock_out, iov, ses.writequeue.count); 82 written = writev(ses.sock_out, iov, ses.writequeue.count);
81 if (written < 0) { 83 if (written < 0) {
364 static int checkmac() { 366 static int checkmac() {
365 367
366 unsigned char mac_bytes[MAX_MAC_LEN]; 368 unsigned char mac_bytes[MAX_MAC_LEN];
367 unsigned int mac_size, contents_len; 369 unsigned int mac_size, contents_len;
368 370
369 mac_size = ses.keys->trans.algo_mac->hashsize; 371 mac_size = ses.keys->recv.algo_mac->hashsize;
370 contents_len = ses.readbuf->len - mac_size; 372 contents_len = ses.readbuf->len - mac_size;
371 373
372 buf_setpos(ses.readbuf, 0); 374 buf_setpos(ses.readbuf, 0);
373 make_mac(ses.recvseq, &ses.keys->recv, ses.readbuf, contents_len, mac_bytes); 375 make_mac(ses.recvseq, &ses.keys->recv, ses.readbuf, contents_len, mac_bytes);
374 376
453 ses.reply_queue_tail->next = new_item; 455 ses.reply_queue_tail->next = new_item;
454 } else { 456 } else {
455 ses.reply_queue_head = new_item; 457 ses.reply_queue_head = new_item;
456 } 458 }
457 ses.reply_queue_tail = new_item; 459 ses.reply_queue_tail = new_item;
458 TRACE2(("leave enqueue_reply_packet"))
459 } 460 }
460 461
461 void maybe_flush_reply_queue() { 462 void maybe_flush_reply_queue() {
462 struct packetlist *tmp_item = NULL, *curr_item = NULL; 463 struct packetlist *tmp_item = NULL, *curr_item = NULL;
463 if (!ses.dataallowed) 464 if (!ses.dataallowed)
498 packet_type = buf_getbyte(ses.writepayload); 499 packet_type = buf_getbyte(ses.writepayload);
499 buf_setpos(ses.writepayload, 0); 500 buf_setpos(ses.writepayload, 0);
500 501
501 TRACE2(("encrypt_packet type is %d", packet_type)) 502 TRACE2(("encrypt_packet type is %d", packet_type))
502 503
503 if ((!ses.dataallowed && !packet_is_okay_kex(packet_type)) 504 if ((!ses.dataallowed && !packet_is_okay_kex(packet_type))) {
504 || ses.kexstate.sentnewkeys) {
505 /* During key exchange only particular packets are allowed. 505 /* During key exchange only particular packets are allowed.
506 Since this packet_type isn't OK we just enqueue it to send 506 Since this packet_type isn't OK we just enqueue it to send
507 after the KEX, see maybe_flush_reply_queue */ 507 after the KEX, see maybe_flush_reply_queue */
508 508 TRACE2(("Delay sending reply packet. dataallowed %d, type %d, sentnewkeys %d",
509 /* We also enqueue packets here when we have sent a MSG_NEWKEYS 509 ses.dataallowed, packet_type, ses.kexstate.sentnewkeys))
510 * packet but are yet to received one. For simplicity we just switch
511 * over all the keys at once. This is the 'ses.kexstate.sentnewkeys'
512 * case. */
513 enqueue_reply_packet(); 510 enqueue_reply_packet();
514 return; 511 return;
515 } 512 }
516 513
517 blocksize = ses.keys->trans.algo_crypt->blocksize; 514 blocksize = ses.keys->trans.algo_crypt->blocksize;