# HG changeset patch # User Matt Johnston # Date 1087974856 0 # Node ID c1e5d919540205be3eb9183f8d914d696c22ad26 # Parent 5ae28f6101c19954ea4f3cfd0537c5046814caea# Parent d7cc5b484a2e6f2273c9874c351edd1f8e0c5d2b merge of abac2150ee4f4031a98016241fbd136d24fed127 and ffa047425729e478a5b49b1ab0f8ec71c08a1421 diff -r d7cc5b484a2e -r c1e5d9195402 common-kex.c --- a/common-kex.c Tue Jun 22 10:47:16 2004 +0000 +++ b/common-kex.c Wed Jun 23 07:14:16 2004 +0000 @@ -450,8 +450,8 @@ /* the rest of ses.kexhashbuf will be done after DH exchange */ ses.kexstate.recvkexinit = 1; -// ses.expecting = SSH_MSG_KEXDH_INIT; - ses.expecting = 0; + ses.requirenext = SSH_MSG_KEXDH_INIT; +// ses.expecting = 0; // client matt TRACE(("leave recv_msg_kexinit")); } diff -r d7cc5b484a2e -r c1e5d9195402 common-packet.c --- a/common-packet.c Tue Jun 22 10:47:16 2004 +0000 +++ b/common-packet.c Wed Jun 23 07:14:16 2004 +0000 @@ -402,21 +402,6 @@ -/* This must be called directly after receiving the unimplemented packet. - * Isn't the most clean implementation, it relies on packet processing - * occurring directly after decryption. This is reasonably valid, since - * there is only a single decryption buffer */ -void recv_unimplemented() { - - CHECKCLEARTOWRITE(); - - buf_putbyte(ses.writepayload, SSH_MSG_UNIMPLEMENTED); - /* the decryption routine increments the sequence number, we must - * decrement */ - buf_putint(ses.writepayload, ses.recvseq - 1); - - encrypt_packet(); -} /* encrypt the writepayload, putting into writebuf, ready for write_packet() * to put on the wire */ diff -r d7cc5b484a2e -r c1e5d9195402 common-session.c --- a/common-session.c Tue Jun 22 10:47:16 2004 +0000 +++ b/common-session.c Wed Jun 23 07:14:16 2004 +0000 @@ -76,7 +76,7 @@ ses.payload = NULL; ses.recvseq = 0; - ses.expecting = SSH_MSG_KEXINIT; + ses.requirenext = SSH_MSG_KEXINIT; ses.dataallowed = 0; /* don't send data yet, we'll wait until after kex */ ses.ignorenext = 0; @@ -106,6 +106,8 @@ ses.dh_K = NULL; ses.remoteident = NULL; + ses.authdone = 0; + ses.chantypes = NULL; ses.allowprivport = 0; diff -r d7cc5b484a2e -r c1e5d9195402 debug.h --- a/debug.h Tue Jun 22 10:47:16 2004 +0000 +++ b/debug.h Wed Jun 23 07:14:16 2004 +0000 @@ -36,7 +36,7 @@ /* Define this to print trace statements - very verbose */ /* Caution: Don't use this in an unfriendly environment (ie unfirewalled), * since the printing does not sanitise strings etc */ -/*#define DEBUG_TRACE*/ +#define DEBUG_TRACE /* All functions writing to the cleartext payload buffer call * CHECKCLEARTOWRITE() before writing. This is only really useful if you're diff -r d7cc5b484a2e -r c1e5d9195402 packet.h --- a/packet.h Tue Jun 22 10:47:16 2004 +0000 +++ b/packet.h Wed Jun 23 07:14:16 2004 +0000 @@ -32,9 +32,13 @@ void read_packet(); void decrypt_packet(); void encrypt_packet(); -void recv_unimplemented(); + +void process_packet(); -void svr_process_packet(); +typedef struct PacketType { + unsigned char type; /* SSH_MSG_FOO */ + void (*handler)(); +} packettype; #define PACKET_PADDING_OFF 4 #define PACKET_PAYLOAD_OFF 5 diff -r d7cc5b484a2e -r c1e5d9195402 process-packet.c --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/process-packet.c Wed Jun 23 07:14:16 2004 +0000 @@ -0,0 +1,161 @@ +/* + * Dropbear - a SSH2 server + * + * Copyright (c) 2002-2004 Matt Johnston + * All rights reserved. + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in + * all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. */ + +#include "includes.h" +#include "packet.h" +#include "session.h" +#include "dbutil.h" +#include "ssh.h" +#include "algo.h" +#include "buffer.h" +#include "kex.h" +#include "random.h" +#include "service.h" +#include "auth.h" +#include "channel.h" + +#define MAX_UNAUTH_PACKET_TYPE SSH_MSG_USERAUTH_PK_OK + +static void recv_unimplemented(); + +/* process a decrypted packet, call the appropriate handler */ +void process_packet() { + + unsigned char type; + unsigned int i; + + TRACE(("enter process_packet")); + + type = buf_getbyte(ses.payload); + TRACE(("process_packet: packet type = %d", type)); + + /* These packets we can receive at any time */ + switch(type) { + + case SSH_MSG_IGNORE: + case SSH_MSG_DEBUG: + TRACE(("received SSH_MSG_IGNORE or SSH_MSG_DEBUG")); + goto out; + + case SSH_MSG_UNIMPLEMENTED: + /* debugging XXX */ + TRACE(("SSH_MSG_UNIMPLEMENTED")); + dropbear_exit("received SSH_MSG_UNIMPLEMENTED"); + + case SSH_MSG_DISCONNECT: + /* TODO cleanup? */ + dropbear_close("Disconnect received"); + } + + + /* This applies for KEX, where the spec says the next packet MUST be + * NEWKEYS */ + if (ses.requirenext != 0) { + if (ses.requirenext != type) { + /* TODO send disconnect? */ + dropbear_exit("unexpected packet type %d, expected %d", type, + ses.requirenext); + } else { + /* Got what we expected */ + ses.requirenext = 0; + } + } + + /* Check if we should ignore this packet. Used currently only for + * KEX code, with first_kex_packet_follows */ + if (ses.ignorenext) { + TRACE(("Ignoring packet, type = %d", type)); + ses.ignorenext = 0; + goto out; + } + + /* XXX This code somewhere else perhaps? */ +#ifdef DROPBEAR_CLIENT + if (IS_DROPBEAR_CLIENT) { + + /* XXX - needs changing */ + /* In client mode, we REUSE ses.expecting to proceed to the + * next phase when a packet was received. + * If the "expecting" flag is set to a non-null value, it will + * be reset when a packet of that type is received. + * This is different from the server-mode behaviour, when + * a packet type mismatch would have caused sudden death. + */ + + /* check that we aren't expecting a particular packet */ + if (cli_ses.expecting && cli_ses.expecting == type) { + cli_ses.expecting = 0; + } + } +#endif + + /* Kindly the protocol authors gave all the preauth packets type values + * less-than-or-equal-to 60 ( == MAX_UNAUTH_PACKET_TYPE ). + * NOTE: if the protocol changes and new types are added, revisit this + * assumption */ + if ( !ses.authdone && type > MAX_UNAUTH_PACKET_TYPE ) { + dropbear_exit("received message %d before userauth", type); + } + + for (i = 0; ; i++) { + if (ses.packettypes[i].type == 0) { + /* end of list */ + break; + } + + if (ses.packettypes[i].type == type) { + ses.packettypes[i].handler(); + goto out; + } + } + + + /* TODO do something more here? */ + TRACE(("preauth unknown packet")); + recv_unimplemented(); + +out: + buf_free(ses.payload); + ses.payload = NULL; + + TRACE(("leave process_packet")); +} + + + +/* This must be called directly after receiving the unimplemented packet. + * Isn't the most clean implementation, it relies on packet processing + * occurring directly after decryption (direct use of ses.recvseq). + * This is reasonably valid, since there is only a single decryption buffer */ +static void recv_unimplemented() { + + CHECKCLEARTOWRITE(); + + buf_putbyte(ses.writepayload, SSH_MSG_UNIMPLEMENTED); + /* the decryption routine increments the sequence number, we must + * decrement */ + buf_putint(ses.writepayload, ses.recvseq - 1); + + encrypt_packet(); +} diff -r d7cc5b484a2e -r c1e5d9195402 session.h --- a/session.h Tue Jun 22 10:47:16 2004 +0000 +++ b/session.h Wed Jun 23 07:14:16 2004 +0000 @@ -34,6 +34,7 @@ #include "queue.h" #include "runopts.h" #include "listener.h" +#include "packet.h" extern int sessinitdone; /* Is set to 0 somewhere */ extern int exitflag; @@ -106,10 +107,13 @@ unsigned int transseq, recvseq; /* Sequence IDs */ /* Packet-handling flags */ + const packettype * packettypes; /* Packet handler mappings for this + session, see process-packet.c */ + unsigned dataallowed : 1; /* whether we can send data packets or we are in the middle of a KEX or something */ - unsigned char expecting; /* byte indicating what packet we expect next, + unsigned char requirenext; /* byte indicating what packet we require next, or 0x00 for any */ unsigned char ignorenext; /* whether to ignore the next packet, @@ -130,6 +134,12 @@ can add it to the hash when generating keys */ + unsigned char authdone; /* Indicates when authentication has been + completed. This applies to both client and + server - in the server it gets set to 1 when + authentication is successful, in the client it + is set when the server has told us that auth + succeeded */ /* Channel related */ struct Channel ** channels; /* these pointers may be null */ diff -r d7cc5b484a2e -r c1e5d9195402 ssh.h --- a/ssh.h Tue Jun 22 10:47:16 2004 +0000 +++ b/ssh.h Wed Jun 23 07:14:16 2004 +0000 @@ -44,6 +44,9 @@ #define SSH_MSG_USERAUTH_BANNER 53 #define SSH_MSG_USERAUTH_PK_OK 60 +/* If adding numbers here, check MAX_UNAUTH_PACKET_TYPE in process-packet.c + * is still valid */ + /* connect message numbers */ #define SSH_MSG_GLOBAL_REQUEST 80 #define SSH_MSG_REQUEST_SUCCESS 81 diff -r d7cc5b484a2e -r c1e5d9195402 svr-auth.c --- a/svr-auth.c Tue Jun 22 10:47:16 2004 +0000 +++ b/svr-auth.c Wed Jun 23 07:14:16 2004 +0000 @@ -52,7 +52,7 @@ * on initialisation */ static void authclear() { - svr_ses.authstate.authdone = 0; + ses.authdone = 0; svr_ses.authstate.pw = NULL; svr_ses.authstate.username = NULL; svr_ses.authstate.printableuser = NULL; @@ -102,7 +102,7 @@ TRACE(("enter recv_msg_userauth_request")); /* ignore packets if auth is already done */ - if (svr_ses.authstate.authdone == 1) { + if (ses.authdone == 1) { return; } @@ -339,7 +339,7 @@ buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_SUCCESS); encrypt_packet(); - svr_ses.authstate.authdone = 1; + ses.authdone = 1; if (svr_ses.authstate.pw->pw_uid == 0) { ses.allowprivport = 1; diff -r d7cc5b484a2e -r c1e5d9195402 svr-kex.c --- a/svr-kex.c Tue Jun 22 10:47:16 2004 +0000 +++ b/svr-kex.c Wed Jun 23 07:14:16 2004 +0000 @@ -57,7 +57,7 @@ mp_clear(&dh_e); send_msg_newkeys(); - ses.expecting = SSH_MSG_NEWKEYS; + ses.requirenext = SSH_MSG_NEWKEYS; TRACE(("leave recv_msg_kexdh_init")); } diff -r d7cc5b484a2e -r c1e5d9195402 svr-packet.c --- a/svr-packet.c Tue Jun 22 10:47:16 2004 +0000 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,196 +0,0 @@ -/* - * Dropbear - a SSH2 server - * - * Copyright (c) 2002,2003 Matt Johnston - * All rights reserved. - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. */ - -#include "includes.h" -#include "packet.h" -#include "session.h" -#include "dbutil.h" -#include "ssh.h" -#include "algo.h" -#include "buffer.h" -#include "kex.h" -#include "random.h" -#include "service.h" -#include "auth.h" -#include "channel.h" - -static void svr_process_postauth_packet(unsigned int type); - -/* process a decrypted packet, call the appropriate handler */ -void svr_process_packet() { - - unsigned char type; - - TRACE(("enter process_packet")); - - type = buf_getbyte(ses.payload); - TRACE(("process_packet: packet type = %d", type)); - - /* these packets we can receive at any time, regardless of expecting - * other packets: */ - switch(type) { - - case SSH_MSG_IGNORE: - case SSH_MSG_DEBUG: - TRACE(("received SSH_MSG_IGNORE or SSH_MSG_DEBUG")); - goto out; - - case SSH_MSG_UNIMPLEMENTED: - /* debugging XXX */ - TRACE(("SSH_MSG_UNIMPLEMENTED")); - dropbear_exit("received SSH_MSG_UNIMPLEMENTED"); - - case SSH_MSG_DISCONNECT: - /* TODO cleanup? */ - dropbear_close("Disconnect received"); - } - - /* Check if we should ignore this packet. Used currently only for - * KEX code, with first_kex_packet_follows */ - if (ses.ignorenext) { - TRACE(("Ignoring packet, type = %d", type)); - ses.ignorenext = 0; - goto out; - } - - /* check that we aren't expecting a particular packet */ - if (ses.expecting && ses.expecting != type) { - /* TODO send disconnect? */ - dropbear_exit("unexpected packet type %d, expected %d", type, - ses.expecting); - } - - /* handle the packet depending on type */ - ses.expecting = 0; - - switch (type) { - - case SSH_MSG_SERVICE_REQUEST: - recv_msg_service_request(); - break; - - case SSH_MSG_USERAUTH_REQUEST: - recv_msg_userauth_request(); - break; - - case SSH_MSG_KEXINIT: - recv_msg_kexinit(); - break; - - case SSH_MSG_KEXDH_INIT: - recv_msg_kexdh_init(); - break; - - case SSH_MSG_NEWKEYS: - recv_msg_newkeys(); - break; - - /* this is ugly, need to make a cleaner way to do it */ - case SSH_MSG_CHANNEL_DATA: - case SSH_MSG_CHANNEL_WINDOW_ADJUST: - case SSH_MSG_CHANNEL_REQUEST: - case SSH_MSG_CHANNEL_OPEN: - case SSH_MSG_CHANNEL_EOF: - case SSH_MSG_CHANNEL_CLOSE: - case SSH_MSG_CHANNEL_OPEN_CONFIRMATION: - case SSH_MSG_CHANNEL_OPEN_FAILURE: - case SSH_MSG_GLOBAL_REQUEST: - /* these should be checked for authdone below */ - svr_process_postauth_packet(type); - break; - - default: - /* TODO this possibly should be handled */ - TRACE(("preauth unknown packet")); - recv_unimplemented(); - break; - } - -out: - buf_free(ses.payload); - ses.payload = NULL; - - TRACE(("leave process_packet")); -} - -/* process a packet, and also check that auth has been done */ -static void svr_process_postauth_packet(unsigned int type) { - - /* messages following here require userauth before use */ - - /* IF YOU ADD MORE PACKET TYPES, MAKE SURE THEY'RE ALSO ADDED TO THE LIST - * IN process_packet() XXX XXX XXX */ - if (!svr_ses.authstate.authdone) { - dropbear_exit("received message %d before userauth", type); - } - - switch (type) { - - case SSH_MSG_CHANNEL_DATA: - recv_msg_channel_data(); - break; - - case SSH_MSG_CHANNEL_WINDOW_ADJUST: - recv_msg_channel_window_adjust(); - break; - -#ifndef DISABLE_REMOTETCPFWD - case SSH_MSG_GLOBAL_REQUEST: - /* currently only used for remote tcp, so we cheat a little */ - recv_msg_global_request_remotetcp(); - break; -#endif - - case SSH_MSG_CHANNEL_REQUEST: - recv_msg_channel_request(); - break; - - case SSH_MSG_CHANNEL_OPEN: - recv_msg_channel_open(); - break; - - case SSH_MSG_CHANNEL_EOF: - recv_msg_channel_eof(); - break; - - case SSH_MSG_CHANNEL_CLOSE: - recv_msg_channel_close(); - break; - -#ifdef USING_LISTENERS /* for x11, tcp fwd etc */ - case SSH_MSG_CHANNEL_OPEN_CONFIRMATION: - recv_msg_channel_open_confirmation(); - break; - - case SSH_MSG_CHANNEL_OPEN_FAILURE: - recv_msg_channel_open_failure(); - break; -#endif - - default: - TRACE(("unknown packet()")); - recv_unimplemented(); - break; - } -} diff -r d7cc5b484a2e -r c1e5d9195402 svr-service.c --- a/svr-service.c Tue Jun 22 10:47:16 2004 +0000 +++ b/svr-service.c Wed Jun 23 07:14:16 2004 +0000 @@ -56,7 +56,7 @@ /* ssh-connection */ if (len == SSH_SERVICE_CONNECTION_LEN && (strncmp(SSH_SERVICE_CONNECTION, name, len) == 0)) { - if (svr_ses.authstate.authdone != 1) { + if (ses.authdone != 1) { dropbear_exit("request for connection before auth"); } diff -r d7cc5b484a2e -r c1e5d9195402 svr-session.c --- a/svr-session.c Tue Jun 22 10:47:16 2004 +0000 +++ b/svr-session.c Wed Jun 23 07:14:16 2004 +0000 @@ -36,18 +36,39 @@ #include "chansession.h" #include "atomicio.h" #include "tcpfwd-direct.h" +#include "service.h" +#include "auth.h" +#include "tcpfwd-remote.h" static void svr_remoteclosed(); struct serversession svr_ses; -const struct ChanType *chantypes[] = { +static const packettype svr_packettypes[] = { + /* TYPE, AUTHREQUIRED, FUNCTION */ + {SSH_MSG_SERVICE_REQUEST, recv_msg_service_request}, // server + {SSH_MSG_USERAUTH_REQUEST, recv_msg_userauth_request}, //server + {SSH_MSG_KEXINIT, recv_msg_kexinit}, + {SSH_MSG_KEXDH_INIT, recv_msg_kexdh_init}, + {SSH_MSG_NEWKEYS, recv_msg_newkeys}, + {SSH_MSG_CHANNEL_DATA, recv_msg_channel_data}, + {SSH_MSG_CHANNEL_WINDOW_ADJUST, recv_msg_channel_window_adjust}, + {SSH_MSG_GLOBAL_REQUEST, recv_msg_global_request_remotetcp}, + {SSH_MSG_CHANNEL_REQUEST, recv_msg_channel_request}, + {SSH_MSG_CHANNEL_OPEN, recv_msg_channel_open}, + {SSH_MSG_CHANNEL_EOF, recv_msg_channel_eof}, + {SSH_MSG_CHANNEL_CLOSE, recv_msg_channel_close}, + {SSH_MSG_CHANNEL_OPEN_CONFIRMATION, recv_msg_channel_open_confirmation}, + {SSH_MSG_CHANNEL_OPEN_FAILURE, recv_msg_channel_open_failure}, + {0, 0} /* End */ +}; + +static const struct ChanType *svr_chantypes[] = { &svrchansess, &chan_tcpdirect, NULL /* Null termination is mandatory. */ }; - void svr_session(int sock, runopts *opts, int childpipe, struct sockaddr* remoteaddr) { @@ -64,7 +85,7 @@ /* Initialise server specific parts of the session */ svr_ses.childpipe = childpipe; authinitialise(); - chaninitialise(chantypes); + chaninitialise(svr_chantypes); svr_chansessinitialise(); if (gettimeofday(&timeout, 0) < 0) { @@ -76,6 +97,9 @@ /* set up messages etc */ session_remoteclosed = svr_remoteclosed; + /* packet handlers */ + ses.packettypes = svr_packettypes; + /* We're ready to go now */ sessinitdone = 1; @@ -145,7 +169,7 @@ /* Process the decrypted packet. After this, the read buffer * will be ready for a new packet */ if (ses.payload != NULL) { - svr_process_packet(); + process_packet(); } }