===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/packet.c,v
retrieving revision 1.158
retrieving revision 1.159
diff -u -r1.158 -r1.159
--- src/usr.bin/ssh/packet.c	2008/11/21 15:47:38	1.158
+++ src/usr.bin/ssh/packet.c	2009/01/26 09:58:15	1.159
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.158 2008/11/21 15:47:38 markus Exp $ */
+/* $OpenBSD: packet.c,v 1.159 2009/01/26 09:58:15 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -80,6 +80,8 @@
 #define DBG(x)
 #endif
 
+#define PACKET_MAX_SIZE (256 * 1024)
+
 /*
  * This variable contains the file descriptors used for communicating with
  * the other side.  connection_in is used for reading; connection_out for
@@ -156,6 +158,10 @@
 /* roundup current message to extra_pad bytes */
 static u_char extra_pad = 0;
 
+/* XXX discard incoming data after MAC error */
+static u_int packet_discard = 0;
+static Mac *packet_discard_mac = NULL;
+
 struct packet {
 	TAILQ_ENTRY(packet) next;
 	u_char type;
@@ -205,6 +211,36 @@
 		packet_timeout_ms = timeout * count * 1000;
 }
 
+static void
+packet_stop_discard(void)
+{
+	if (packet_discard_mac) {
+		char buf[1024];
+		
+		memset(buf, 'a', sizeof(buf));
+		while (buffer_len(&incoming_packet) < PACKET_MAX_SIZE)
+			buffer_append(&incoming_packet, buf, sizeof(buf));
+		(void) mac_compute(packet_discard_mac,
+		    p_read.seqnr,
+		    buffer_ptr(&incoming_packet),
+		    PACKET_MAX_SIZE);
+	}
+	logit("Finished discarding for %.200s", get_remote_ipaddr());
+	cleanup_exit(255);
+}
+
+static void
+packet_start_discard(Enc *enc, Mac *mac, u_int packet_length, u_int discard)
+{
+	if (!cipher_is_cbc(enc->cipher))
+		packet_disconnect("Packet corrupt");
+	if (packet_length != PACKET_MAX_SIZE && mac && mac->enabled)
+		packet_discard_mac = mac;
+	if (buffer_len(&input) >= discard)
+		packet_stop_discard();
+	packet_discard = discard - buffer_len(&input);
+}
+
 /* Returns 1 if remote host is connected via socket, 0 if not. */
 
 int
@@ -1117,6 +1153,9 @@
 	Mac *mac   = NULL;
 	Comp *comp = NULL;
 
+	if (packet_discard)
+		return SSH_MSG_NONE;
+
 	if (newkeys[MODE_IN] != NULL) {
 		enc  = &newkeys[MODE_IN]->enc;
 		mac  = &newkeys[MODE_IN]->mac;
@@ -1138,12 +1177,14 @@
 		    block_size);
 		cp = buffer_ptr(&incoming_packet);
 		packet_length = get_u32(cp);
-		if (packet_length < 1 + 4 || packet_length > 256 * 1024) {
+		if (packet_length < 1 + 4 || packet_length > PACKET_MAX_SIZE) {
 #ifdef PACKET_DEBUG
 			buffer_dump(&incoming_packet);
 #endif
-			packet_disconnect("Bad packet length %-10u",
-			    packet_length);
+			logit("Bad packet length %u.", packet_length);
+			packet_start_discard(enc, mac, packet_length,
+			    PACKET_MAX_SIZE);
+			return SSH_MSG_NONE;
 		}
 		DBG(debug("input: packet len %u", packet_length+4));
 		buffer_consume(&input, block_size);
@@ -1155,7 +1196,9 @@
 	if (need % block_size != 0) {
 		logit("padding error: need %d block %d mod %d",
 		    need, block_size, need % block_size);
-		packet_disconnect("Bad packet length %-10u", packet_length);
+		packet_start_discard(enc, mac, packet_length,
+		    PACKET_MAX_SIZE - block_size);
+		return SSH_MSG_NONE;
 	}
 	/*
 	 * check if the entire packet has been received and
@@ -1178,11 +1221,19 @@
 		macbuf = mac_compute(mac, p_read.seqnr,
 		    buffer_ptr(&incoming_packet),
 		    buffer_len(&incoming_packet));
-		if (memcmp(macbuf, buffer_ptr(&input), mac->mac_len) != 0)
-			packet_disconnect("Corrupted MAC on input.");
+		if (memcmp(macbuf, buffer_ptr(&input), mac->mac_len) != 0) {
+			logit("Corrupted MAC on input.");
+			if (need > PACKET_MAX_SIZE)
+				fatal("internal error need %d", need);
+			packet_start_discard(enc, mac, packet_length,
+			    PACKET_MAX_SIZE - need);
+			return SSH_MSG_NONE;
+		}
+				
 		DBG(debug("MAC #%d ok", p_read.seqnr));
 		buffer_consume(&input, mac->mac_len);
 	}
+	/* XXX now it's safe to use fatal/packet_disconnect */
 	if (seqnr_p != NULL)
 		*seqnr_p = p_read.seqnr;
 	if (++p_read.seqnr == 0)
@@ -1315,6 +1366,13 @@
 void
 packet_process_incoming(const char *buf, u_int len)
 {
+	if (packet_discard) {
+		keep_alive_timeouts = 0; /* ?? */
+		if (len >= packet_discard)
+			packet_stop_discard();
+		packet_discard -= len;
+		return;
+	}
 	buffer_append(&input, buf, len);
 }