Annotation of src/usr.bin/ssh/packet.c, Revision 1.62
1.1 deraadt 1: /*
1.15 deraadt 2: * Author: Tatu Ylonen <ylo@cs.hut.fi>
3: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: * All rights reserved
1.35 deraadt 5: * This file contains code implementing the packet protocol and communication
6: * with the other side. This same code is used both on client and server side.
1.29 markus 7: *
1.35 deraadt 8: * As far as I am concerned, the code I have written for this software
9: * can be used freely for any purpose. Any derived versions of this
10: * software must be clearly marked as such, and if the derived work is
11: * incompatible with the protocol description in the RFC file, it must be
12: * called by a name other than "ssh" or "Secure Shell".
1.29 markus 13: *
1.25 markus 14: *
15: * SSH2 packet format added by Markus Friedl.
1.35 deraadt 16: * Copyright (c) 2000 Markus Friedl. All rights reserved.
1.25 markus 17: *
1.35 deraadt 18: * Redistribution and use in source and binary forms, with or without
19: * modification, are permitted provided that the following conditions
20: * are met:
21: * 1. Redistributions of source code must retain the above copyright
22: * notice, this list of conditions and the following disclaimer.
23: * 2. Redistributions in binary form must reproduce the above copyright
24: * notice, this list of conditions and the following disclaimer in the
25: * documentation and/or other materials provided with the distribution.
26: *
27: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
28: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
29: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
30: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
31: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
32: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
33: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
34: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
35: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
36: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.15 deraadt 37: */
1.1 deraadt 38:
39: #include "includes.h"
1.62 ! markus 40: RCSID("$OpenBSD: packet.c,v 1.61 2001/04/05 10:42:51 markus Exp $");
1.1 deraadt 41:
42: #include "xmalloc.h"
43: #include "buffer.h"
44: #include "packet.h"
45: #include "bufaux.h"
46: #include "crc32.h"
47: #include "getput.h"
48:
49: #include "compress.h"
1.9 dugsong 50: #include "deattack.h"
1.23 markus 51: #include "channels.h"
1.1 deraadt 52:
1.25 markus 53: #include "compat.h"
1.45 markus 54: #include "ssh1.h"
1.25 markus 55: #include "ssh2.h"
56:
1.37 markus 57: #include "cipher.h"
1.25 markus 58: #include "kex.h"
1.50 markus 59: #include "mac.h"
1.46 markus 60: #include "log.h"
61: #include "canohost.h"
1.25 markus 62:
63: #ifdef PACKET_DEBUG
64: #define DBG(x) x
65: #else
66: #define DBG(x)
67: #endif
68:
1.16 markus 69: /*
70: * This variable contains the file descriptors used for communicating with
71: * the other side. connection_in is used for reading; connection_out for
72: * writing. These can be the same descriptor, in which case it is assumed to
73: * be a socket.
74: */
1.1 deraadt 75: static int connection_in = -1;
76: static int connection_out = -1;
77:
78: /* Protocol flags for the remote side. */
1.40 markus 79: static u_int remote_protocol_flags = 0;
1.1 deraadt 80:
81: /* Encryption context for receiving data. This is only used for decryption. */
82: static CipherContext receive_context;
1.14 markus 83:
84: /* Encryption context for sending data. This is only used for encryption. */
1.1 deraadt 85: static CipherContext send_context;
86:
87: /* Buffer for raw input data from the socket. */
88: static Buffer input;
89:
90: /* Buffer for raw output data going to the socket. */
91: static Buffer output;
92:
93: /* Buffer for the partial outgoing packet being constructed. */
94: static Buffer outgoing_packet;
95:
96: /* Buffer for the incoming packet currently being processed. */
97: static Buffer incoming_packet;
98:
99: /* Scratch buffer for packet compression/decompression. */
100: static Buffer compression_buffer;
1.60 markus 101: static int compression_buffer_ready = 0;
1.1 deraadt 102:
103: /* Flag indicating whether packet compression/decompression is enabled. */
104: static int packet_compression = 0;
105:
1.12 markus 106: /* default maximum packet size */
107: int max_packet_size = 32768;
108:
1.1 deraadt 109: /* Flag indicating whether this module has been initialized. */
110: static int initialized = 0;
111:
112: /* Set to true if the connection is interactive. */
113: static int interactive_mode = 0;
114:
1.25 markus 115: /* Session key information for Encryption and MAC */
1.57 markus 116: Newkeys *newkeys[MODE_MAX];
1.25 markus 117:
1.16 markus 118: /*
119: * Sets the descriptors used for communication. Disables encryption until
120: * packet_set_encryption_key is called.
121: */
1.2 provos 122: void
123: packet_set_connection(int fd_in, int fd_out)
1.1 deraadt 124: {
1.37 markus 125: Cipher *none = cipher_by_name("none");
126: if (none == NULL)
127: fatal("packet_set_connection: cannot load cipher 'none'");
1.14 markus 128: connection_in = fd_in;
129: connection_out = fd_out;
1.40 markus 130: cipher_init(&send_context, none, (u_char *) "", 0, NULL, 0);
131: cipher_init(&receive_context, none, (u_char *) "", 0, NULL, 0);
1.62 ! markus 132: newkeys[MODE_IN] = newkeys[MODE_OUT] = NULL;
1.14 markus 133: if (!initialized) {
134: initialized = 1;
135: buffer_init(&input);
136: buffer_init(&output);
137: buffer_init(&outgoing_packet);
138: buffer_init(&incoming_packet);
139: }
140: /* Kludge: arrange the close function to be called from fatal(). */
141: fatal_add_cleanup((void (*) (void *)) packet_close, NULL);
1.1 deraadt 142: }
143:
1.19 markus 144: /* Returns 1 if remote host is connected via socket, 0 if not. */
145:
146: int
147: packet_connection_is_on_socket()
148: {
149: struct sockaddr_storage from, to;
150: socklen_t fromlen, tolen;
151:
152: /* filedescriptors in and out are the same, so it's a socket */
153: if (connection_in == connection_out)
154: return 1;
155: fromlen = sizeof(from);
156: memset(&from, 0, sizeof(from));
1.20 markus 157: if (getpeername(connection_in, (struct sockaddr *)&from, &fromlen) < 0)
1.19 markus 158: return 0;
159: tolen = sizeof(to);
160: memset(&to, 0, sizeof(to));
1.20 markus 161: if (getpeername(connection_out, (struct sockaddr *)&to, &tolen) < 0)
1.19 markus 162: return 0;
163: if (fromlen != tolen || memcmp(&from, &to, fromlen) != 0)
164: return 0;
165: if (from.ss_family != AF_INET && from.ss_family != AF_INET6)
166: return 0;
167: return 1;
168: }
169:
170: /* returns 1 if connection is via ipv4 */
171:
172: int
173: packet_connection_is_ipv4()
174: {
175: struct sockaddr_storage to;
1.21 deraadt 176: socklen_t tolen = sizeof(to);
1.19 markus 177:
178: memset(&to, 0, sizeof(to));
179: if (getsockname(connection_out, (struct sockaddr *)&to, &tolen) < 0)
180: return 0;
181: if (to.ss_family != AF_INET)
182: return 0;
183: return 1;
184: }
185:
1.1 deraadt 186: /* Sets the connection into non-blocking mode. */
187:
1.2 provos 188: void
189: packet_set_nonblocking()
1.1 deraadt 190: {
1.14 markus 191: /* Set the socket into non-blocking mode. */
192: if (fcntl(connection_in, F_SETFL, O_NONBLOCK) < 0)
193: error("fcntl O_NONBLOCK: %.100s", strerror(errno));
194:
195: if (connection_out != connection_in) {
196: if (fcntl(connection_out, F_SETFL, O_NONBLOCK) < 0)
197: error("fcntl O_NONBLOCK: %.100s", strerror(errno));
198: }
1.1 deraadt 199: }
200:
201: /* Returns the socket used for reading. */
202:
1.2 provos 203: int
204: packet_get_connection_in()
1.1 deraadt 205: {
1.14 markus 206: return connection_in;
1.1 deraadt 207: }
208:
209: /* Returns the descriptor used for writing. */
210:
1.2 provos 211: int
212: packet_get_connection_out()
1.1 deraadt 213: {
1.14 markus 214: return connection_out;
1.1 deraadt 215: }
216:
217: /* Closes the connection and clears and frees internal data structures. */
218:
1.2 provos 219: void
220: packet_close()
1.1 deraadt 221: {
1.14 markus 222: if (!initialized)
223: return;
224: initialized = 0;
225: if (connection_in == connection_out) {
226: shutdown(connection_out, SHUT_RDWR);
227: close(connection_out);
228: } else {
229: close(connection_in);
230: close(connection_out);
231: }
232: buffer_free(&input);
233: buffer_free(&output);
234: buffer_free(&outgoing_packet);
235: buffer_free(&incoming_packet);
1.60 markus 236: if (compression_buffer_ready) {
1.14 markus 237: buffer_free(&compression_buffer);
238: buffer_compress_uninit();
239: }
1.1 deraadt 240: }
241:
242: /* Sets remote side protocol flags. */
243:
1.2 provos 244: void
1.40 markus 245: packet_set_protocol_flags(u_int protocol_flags)
1.1 deraadt 246: {
1.14 markus 247: remote_protocol_flags = protocol_flags;
248: channel_set_options((protocol_flags & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) != 0);
1.1 deraadt 249: }
250:
251: /* Returns the remote protocol flags set earlier by the above function. */
252:
1.40 markus 253: u_int
1.2 provos 254: packet_get_protocol_flags()
1.1 deraadt 255: {
1.14 markus 256: return remote_protocol_flags;
1.1 deraadt 257: }
258:
1.16 markus 259: /*
260: * Starts packet compression from the next packet on in both directions.
261: * Level is compression level 1 (fastest) - 9 (slow, best) as in gzip.
262: */
1.1 deraadt 263:
1.60 markus 264: void
265: packet_init_compression()
266: {
267: if (compression_buffer_ready == 1)
268: return;
269: compression_buffer_ready = 1;
270: buffer_init(&compression_buffer);
271: }
272:
1.2 provos 273: void
274: packet_start_compression(int level)
1.1 deraadt 275: {
1.62 ! markus 276: if (packet_compression && !compat20)
1.14 markus 277: fatal("Compression already enabled.");
278: packet_compression = 1;
1.60 markus 279: packet_init_compression();
280: buffer_compress_init_send(level);
281: buffer_compress_init_recv();
1.1 deraadt 282: }
283:
1.16 markus 284: /*
285: * Causes any further packets to be encrypted using the given key. The same
286: * key is used for both sending and reception. However, both directions are
287: * encrypted independently of each other.
288: */
1.2 provos 289: void
1.40 markus 290: packet_set_encryption_key(const u_char *key, u_int keylen,
1.37 markus 291: int number)
1.1 deraadt 292: {
1.37 markus 293: Cipher *cipher = cipher_by_number(number);
294: if (cipher == NULL)
295: fatal("packet_set_encryption_key: unknown cipher number %d", number);
1.25 markus 296: if (keylen < 20)
1.37 markus 297: fatal("packet_set_encryption_key: keylen too small: %d", keylen);
298: cipher_init(&receive_context, cipher, key, keylen, NULL, 0);
299: cipher_init(&send_context, cipher, key, keylen, NULL, 0);
1.1 deraadt 300: }
301:
1.62 ! markus 302: /* Start constructing a packet to send. */
1.2 provos 303: void
1.62 ! markus 304: packet_start(u_char type)
1.1 deraadt 305: {
1.62 ! markus 306: u_char buf[9];
! 307: int len;
1.1 deraadt 308:
1.62 ! markus 309: DBG(debug("packet_start[%d]", type));
! 310: len = compat20 ? 6 : 9;
! 311: memset(buf, 0, len - 1);
! 312: buf[len - 1] = type;
1.14 markus 313: buffer_clear(&outgoing_packet);
1.62 ! markus 314: buffer_append(&outgoing_packet, buf, len);
1.25 markus 315: }
316:
1.62 ! markus 317: /* Append payload. */
1.2 provos 318: void
319: packet_put_char(int value)
1.1 deraadt 320: {
1.14 markus 321: char ch = value;
322: buffer_append(&outgoing_packet, &ch, 1);
1.1 deraadt 323: }
1.2 provos 324: void
1.40 markus 325: packet_put_int(u_int value)
1.1 deraadt 326: {
1.14 markus 327: buffer_put_int(&outgoing_packet, value);
1.1 deraadt 328: }
1.2 provos 329: void
1.40 markus 330: packet_put_string(const char *buf, u_int len)
1.1 deraadt 331: {
1.14 markus 332: buffer_put_string(&outgoing_packet, buf, len);
1.1 deraadt 333: }
1.24 markus 334: void
335: packet_put_cstring(const char *str)
336: {
337: buffer_put_string(&outgoing_packet, str, strlen(str));
338: }
339: void
1.40 markus 340: packet_put_raw(const char *buf, u_int len)
1.24 markus 341: {
342: buffer_append(&outgoing_packet, buf, len);
343: }
1.2 provos 344: void
1.14 markus 345: packet_put_bignum(BIGNUM * value)
1.1 deraadt 346: {
1.14 markus 347: buffer_put_bignum(&outgoing_packet, value);
1.1 deraadt 348: }
1.24 markus 349: void
350: packet_put_bignum2(BIGNUM * value)
351: {
352: buffer_put_bignum2(&outgoing_packet, value);
353: }
1.1 deraadt 354:
1.16 markus 355: /*
356: * Finalizes and sends the packet. If the encryption key has been set,
357: * encrypts the packet before sending.
358: */
1.14 markus 359:
1.2 provos 360: void
1.49 itojun 361: packet_send1(void)
1.1 deraadt 362: {
1.14 markus 363: char buf[8], *cp;
364: int i, padding, len;
1.40 markus 365: u_int checksum;
1.14 markus 366: u_int32_t rand = 0;
367:
1.16 markus 368: /*
369: * If using packet compression, compress the payload of the outgoing
370: * packet.
371: */
1.14 markus 372: if (packet_compression) {
373: buffer_clear(&compression_buffer);
374: /* Skip padding. */
375: buffer_consume(&outgoing_packet, 8);
376: /* padding */
377: buffer_append(&compression_buffer, "\0\0\0\0\0\0\0\0", 8);
378: buffer_compress(&outgoing_packet, &compression_buffer);
379: buffer_clear(&outgoing_packet);
380: buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
381: buffer_len(&compression_buffer));
382: }
383: /* Compute packet length without padding (add checksum, remove padding). */
384: len = buffer_len(&outgoing_packet) + 4 - 8;
385:
1.32 markus 386: /* Insert padding. Initialized to zero in packet_start1() */
1.14 markus 387: padding = 8 - len % 8;
1.62 ! markus 388: if (send_context.cipher->number != SSH_CIPHER_NONE) {
1.14 markus 389: cp = buffer_ptr(&outgoing_packet);
390: for (i = 0; i < padding; i++) {
391: if (i % 4 == 0)
392: rand = arc4random();
393: cp[7 - i] = rand & 0xff;
394: rand >>= 8;
395: }
396: }
397: buffer_consume(&outgoing_packet, 8 - padding);
398:
399: /* Add check bytes. */
1.40 markus 400: checksum = ssh_crc32((u_char *) buffer_ptr(&outgoing_packet),
1.34 deraadt 401: buffer_len(&outgoing_packet));
1.14 markus 402: PUT_32BIT(buf, checksum);
403: buffer_append(&outgoing_packet, buf, 4);
1.1 deraadt 404:
405: #ifdef PACKET_DEBUG
1.14 markus 406: fprintf(stderr, "packet_send plain: ");
407: buffer_dump(&outgoing_packet);
1.1 deraadt 408: #endif
409:
1.14 markus 410: /* Append to output. */
411: PUT_32BIT(buf, len);
412: buffer_append(&output, buf, 4);
413: buffer_append_space(&output, &cp, buffer_len(&outgoing_packet));
1.62 ! markus 414: cipher_encrypt(&send_context, cp, buffer_ptr(&outgoing_packet),
1.14 markus 415: buffer_len(&outgoing_packet));
416:
1.1 deraadt 417: #ifdef PACKET_DEBUG
1.14 markus 418: fprintf(stderr, "encrypted: ");
419: buffer_dump(&output);
1.1 deraadt 420: #endif
421:
1.14 markus 422: buffer_clear(&outgoing_packet);
1.1 deraadt 423:
1.16 markus 424: /*
425: * Note that the packet is now only buffered in output. It won\'t be
426: * actually sent until packet_write_wait or packet_write_poll is
427: * called.
428: */
1.1 deraadt 429: }
430:
1.57 markus 431: void
432: set_newkeys(int mode)
433: {
434: Enc *enc;
435: Mac *mac;
436: Comp *comp;
437: CipherContext *cc;
438:
439: debug("newkeys: mode %d", mode);
440:
441: cc = (mode == MODE_OUT) ? &send_context : &receive_context;
442: if (newkeys[mode] != NULL) {
443: debug("newkeys: rekeying");
1.59 markus 444: /* todo: free old keys, reset compression/cipher-ctxt; */
1.57 markus 445: memset(cc, 0, sizeof(*cc));
1.59 markus 446: enc = &newkeys[mode]->enc;
447: mac = &newkeys[mode]->mac;
448: comp = &newkeys[mode]->comp;
1.61 markus 449: memset(mac->key, 0, mac->key_len);
1.59 markus 450: xfree(enc->name);
451: xfree(enc->iv);
452: xfree(enc->key);
453: xfree(mac->name);
454: xfree(mac->key);
455: xfree(comp->name);
1.58 markus 456: xfree(newkeys[mode]);
1.57 markus 457: }
458: newkeys[mode] = kex_get_newkeys(mode);
459: if (newkeys[mode] == NULL)
460: fatal("newkeys: no keys for mode %d", mode);
461: enc = &newkeys[mode]->enc;
462: mac = &newkeys[mode]->mac;
463: comp = &newkeys[mode]->comp;
464: if (mac->md != NULL)
465: mac->enabled = 1;
466: DBG(debug("cipher_init_context: %d", mode));
467: cipher_init(cc, enc->cipher, enc->key, enc->cipher->key_len,
468: enc->iv, enc->cipher->block_size);
1.59 markus 469: memset(enc->iv, 0, enc->cipher->block_size);
470: memset(enc->key, 0, enc->cipher->key_len);
1.57 markus 471: if (comp->type != 0 && comp->enabled == 0) {
1.60 markus 472: packet_init_compression();
473: if (mode == MODE_OUT)
474: buffer_compress_init_send(6);
475: else
476: buffer_compress_init_recv();
1.57 markus 477: comp->enabled = 1;
478: }
479: }
480:
1.16 markus 481: /*
1.25 markus 482: * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
483: */
484: void
1.49 itojun 485: packet_send2(void)
1.25 markus 486: {
1.50 markus 487: static u_int32_t seqnr = 0;
1.62 ! markus 488: u_char type, *ucp, *macbuf = NULL;
1.25 markus 489: char *cp;
1.40 markus 490: u_int packet_length = 0;
491: u_int i, padlen, len;
1.25 markus 492: u_int32_t rand = 0;
493: Enc *enc = NULL;
494: Mac *mac = NULL;
495: Comp *comp = NULL;
496: int block_size;
497:
1.57 markus 498: if (newkeys[MODE_OUT] != NULL) {
499: enc = &newkeys[MODE_OUT]->enc;
500: mac = &newkeys[MODE_OUT]->mac;
501: comp = &newkeys[MODE_OUT]->comp;
1.25 markus 502: }
1.37 markus 503: block_size = enc ? enc->cipher->block_size : 8;
1.25 markus 504:
1.62 ! markus 505: ucp = (u_char *) buffer_ptr(&outgoing_packet);
! 506: type = ucp[5];
1.25 markus 507:
508: #ifdef PACKET_DEBUG
509: fprintf(stderr, "plain: ");
510: buffer_dump(&outgoing_packet);
511: #endif
512:
513: if (comp && comp->enabled) {
514: len = buffer_len(&outgoing_packet);
515: /* skip header, compress only payload */
516: buffer_consume(&outgoing_packet, 5);
517: buffer_clear(&compression_buffer);
518: buffer_compress(&outgoing_packet, &compression_buffer);
519: buffer_clear(&outgoing_packet);
520: buffer_append(&outgoing_packet, "\0\0\0\0\0", 5);
521: buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
522: buffer_len(&compression_buffer));
523: DBG(debug("compression: raw %d compressed %d", len,
524: buffer_len(&outgoing_packet)));
525: }
526:
527: /* sizeof (packet_len + pad_len + payload) */
528: len = buffer_len(&outgoing_packet);
529:
530: /*
531: * calc size of padding, alloc space, get random data,
532: * minimum padding is 4 bytes
533: */
534: padlen = block_size - (len % block_size);
535: if (padlen < 4)
536: padlen += block_size;
537: buffer_append_space(&outgoing_packet, &cp, padlen);
1.38 markus 538: if (enc && enc->cipher->number != SSH_CIPHER_NONE) {
1.32 markus 539: /* random padding */
1.25 markus 540: for (i = 0; i < padlen; i++) {
541: if (i % 4 == 0)
542: rand = arc4random();
543: cp[i] = rand & 0xff;
1.52 markus 544: rand >>= 8;
1.25 markus 545: }
1.32 markus 546: } else {
547: /* clear padding */
548: memset(cp, 0, padlen);
1.25 markus 549: }
550: /* packet_length includes payload, padding and padding length field */
551: packet_length = buffer_len(&outgoing_packet) - 4;
1.62 ! markus 552: ucp = (u_char *)buffer_ptr(&outgoing_packet);
! 553: PUT_32BIT(ucp, packet_length);
! 554: ucp[4] = padlen;
1.25 markus 555: DBG(debug("send: len %d (includes padlen %d)", packet_length+4, padlen));
556:
557: /* compute MAC over seqnr and packet(length fields, payload, padding) */
558: if (mac && mac->enabled) {
1.50 markus 559: macbuf = mac_compute(mac, seqnr,
1.40 markus 560: (u_char *) buffer_ptr(&outgoing_packet),
1.50 markus 561: buffer_len(&outgoing_packet));
1.36 markus 562: DBG(debug("done calc MAC out #%d", seqnr));
1.25 markus 563: }
564: /* encrypt packet and append to output buffer. */
565: buffer_append_space(&output, &cp, buffer_len(&outgoing_packet));
1.62 ! markus 566: cipher_encrypt(&send_context, cp, buffer_ptr(&outgoing_packet),
1.25 markus 567: buffer_len(&outgoing_packet));
568: /* append unencrypted MAC */
569: if (mac && mac->enabled)
570: buffer_append(&output, (char *)macbuf, mac->mac_len);
571: #ifdef PACKET_DEBUG
572: fprintf(stderr, "encrypted: ");
573: buffer_dump(&output);
574: #endif
1.29 markus 575: /* increment sequence number for outgoing packets */
576: if (++seqnr == 0)
577: log("outgoing seqnr wraps around");
1.25 markus 578: buffer_clear(&outgoing_packet);
579:
1.57 markus 580: if (type == SSH2_MSG_NEWKEYS)
581: set_newkeys(MODE_OUT);
1.25 markus 582: }
583:
584: void
585: packet_send()
586: {
1.62 ! markus 587: if (compat20)
1.25 markus 588: packet_send2();
589: else
590: packet_send1();
591: DBG(debug("packet_send done"));
592: }
593:
594: /*
1.16 markus 595: * Waits until a packet has been received, and returns its type. Note that
596: * no other data is processed until this returns, so this function should not
597: * be used during the interactive session.
598: */
1.1 deraadt 599:
1.2 provos 600: int
601: packet_read(int *payload_len_ptr)
1.1 deraadt 602: {
1.14 markus 603: int type, len;
1.56 millert 604: fd_set *setp;
1.14 markus 605: char buf[8192];
1.25 markus 606: DBG(debug("packet_read()"));
1.14 markus 607:
1.56 millert 608: setp = (fd_set *)xmalloc(howmany(connection_in+1, NFDBITS) *
609: sizeof(fd_mask));
610:
1.14 markus 611: /* Since we are blocking, ensure that all written packets have been sent. */
612: packet_write_wait();
613:
614: /* Stay in the loop until we have received a complete packet. */
615: for (;;) {
616: /* Try to read a packet from the buffer. */
617: type = packet_read_poll(payload_len_ptr);
1.62 ! markus 618: if (!compat20 && (
1.32 markus 619: type == SSH_SMSG_SUCCESS
1.14 markus 620: || type == SSH_SMSG_FAILURE
621: || type == SSH_CMSG_EOF
1.32 markus 622: || type == SSH_CMSG_EXIT_CONFIRMATION))
1.14 markus 623: packet_integrity_check(*payload_len_ptr, 0, type);
624: /* If we got a packet, return it. */
1.56 millert 625: if (type != SSH_MSG_NONE) {
626: xfree(setp);
1.14 markus 627: return type;
1.56 millert 628: }
1.16 markus 629: /*
630: * Otherwise, wait for some data to arrive, add it to the
631: * buffer, and try again.
632: */
1.56 millert 633: memset(setp, 0, howmany(connection_in + 1, NFDBITS) *
634: sizeof(fd_mask));
635: FD_SET(connection_in, setp);
1.16 markus 636:
1.14 markus 637: /* Wait for some data to arrive. */
1.56 millert 638: while (select(connection_in + 1, setp, NULL, NULL, NULL) == -1 &&
1.51 deraadt 639: (errno == EAGAIN || errno == EINTR))
640: ;
1.16 markus 641:
1.14 markus 642: /* Read data from the socket. */
643: len = read(connection_in, buf, sizeof(buf));
1.18 markus 644: if (len == 0) {
645: log("Connection closed by %.200s", get_remote_ipaddr());
646: fatal_cleanup();
647: }
1.14 markus 648: if (len < 0)
649: fatal("Read from socket failed: %.100s", strerror(errno));
650: /* Append it to the buffer. */
651: packet_process_incoming(buf, len);
652: }
653: /* NOTREACHED */
1.1 deraadt 654: }
655:
1.16 markus 656: /*
657: * Waits until a packet has been received, verifies that its type matches
658: * that given, and gives a fatal error and exits if there is a mismatch.
659: */
1.1 deraadt 660:
1.2 provos 661: void
662: packet_read_expect(int *payload_len_ptr, int expected_type)
1.1 deraadt 663: {
1.14 markus 664: int type;
1.1 deraadt 665:
1.14 markus 666: type = packet_read(payload_len_ptr);
667: if (type != expected_type)
668: packet_disconnect("Protocol error: expected packet type %d, got %d",
1.25 markus 669: expected_type, type);
1.1 deraadt 670: }
671:
672: /* Checks if a full packet is available in the data received so far via
1.14 markus 673: * packet_process_incoming. If so, reads the packet; otherwise returns
674: * SSH_MSG_NONE. This does not wait for data from the connection.
675: *
676: * SSH_MSG_DISCONNECT is handled specially here. Also,
677: * SSH_MSG_IGNORE messages are skipped by this function and are never returned
678: * to higher levels.
679: *
680: * The returned payload_len does include space consumed by:
681: * Packet length
682: * Padding
683: * Packet type
684: * Check bytes
685: */
1.1 deraadt 686:
1.2 provos 687: int
1.25 markus 688: packet_read_poll1(int *payload_len_ptr)
1.1 deraadt 689: {
1.40 markus 690: u_int len, padded_len;
1.62 ! markus 691: u_char *ucp, type;
! 692: char *cp;
1.40 markus 693: u_int checksum, stored_checksum;
1.14 markus 694:
695: /* Check if input size is less than minimum packet size. */
696: if (buffer_len(&input) < 4 + 8)
697: return SSH_MSG_NONE;
698: /* Get length of incoming packet. */
1.40 markus 699: ucp = (u_char *) buffer_ptr(&input);
1.14 markus 700: len = GET_32BIT(ucp);
701: if (len < 1 + 2 + 2 || len > 256 * 1024)
702: packet_disconnect("Bad packet length %d.", len);
703: padded_len = (len + 8) & ~7;
704:
705: /* Check if the packet has been entirely received. */
706: if (buffer_len(&input) < 4 + padded_len)
707: return SSH_MSG_NONE;
708:
709: /* The entire packet is in buffer. */
710:
711: /* Consume packet length. */
712: buffer_consume(&input, 4);
713:
1.62 ! markus 714: /*
! 715: * Cryptographic attack detector for ssh
! 716: * (C)1998 CORE-SDI, Buenos Aires Argentina
! 717: * Ariel Futoransky(futo@core-sdi.com)
! 718: */
! 719: if (receive_context.cipher->number != SSH_CIPHER_NONE &&
! 720: detect_attack(buffer_ptr(&input), padded_len, NULL) == DEATTACK_DETECTED)
! 721: packet_disconnect("crc32 compensation attack: network attack detected");
! 722:
! 723: /* Decrypt data to incoming_packet. */
1.14 markus 724: buffer_clear(&incoming_packet);
725: buffer_append_space(&incoming_packet, &cp, padded_len);
1.62 ! markus 726: cipher_decrypt(&receive_context, cp, buffer_ptr(&input), padded_len);
! 727:
1.14 markus 728: buffer_consume(&input, padded_len);
1.1 deraadt 729:
730: #ifdef PACKET_DEBUG
1.14 markus 731: fprintf(stderr, "read_poll plain: ");
732: buffer_dump(&incoming_packet);
1.1 deraadt 733: #endif
734:
1.14 markus 735: /* Compute packet checksum. */
1.40 markus 736: checksum = ssh_crc32((u_char *) buffer_ptr(&incoming_packet),
1.25 markus 737: buffer_len(&incoming_packet) - 4);
1.14 markus 738:
739: /* Skip padding. */
740: buffer_consume(&incoming_packet, 8 - len % 8);
741:
742: /* Test check bytes. */
743: if (len != buffer_len(&incoming_packet))
744: packet_disconnect("packet_read_poll: len %d != buffer_len %d.",
1.25 markus 745: len, buffer_len(&incoming_packet));
1.14 markus 746:
1.40 markus 747: ucp = (u_char *) buffer_ptr(&incoming_packet) + len - 4;
1.14 markus 748: stored_checksum = GET_32BIT(ucp);
749: if (checksum != stored_checksum)
750: packet_disconnect("Corrupted check bytes on input.");
751: buffer_consume_end(&incoming_packet, 4);
752:
753: if (packet_compression) {
754: buffer_clear(&compression_buffer);
755: buffer_uncompress(&incoming_packet, &compression_buffer);
756: buffer_clear(&incoming_packet);
757: buffer_append(&incoming_packet, buffer_ptr(&compression_buffer),
1.25 markus 758: buffer_len(&compression_buffer));
1.14 markus 759: }
1.62 ! markus 760: type = buffer_get_char(&incoming_packet);
1.14 markus 761: *payload_len_ptr = buffer_len(&incoming_packet);
1.62 ! markus 762: return type;
1.1 deraadt 763: }
1.14 markus 764:
1.25 markus 765: int
766: packet_read_poll2(int *payload_len_ptr)
767: {
1.50 markus 768: static u_int32_t seqnr = 0;
769: static u_int packet_length = 0;
1.40 markus 770: u_int padlen, need;
1.62 ! markus 771: u_char *macbuf, *ucp, type;
1.25 markus 772: char *cp;
773: int maclen, block_size;
774: Enc *enc = NULL;
775: Mac *mac = NULL;
776: Comp *comp = NULL;
777:
1.57 markus 778: if (newkeys[MODE_IN] != NULL) {
779: enc = &newkeys[MODE_IN]->enc;
780: mac = &newkeys[MODE_IN]->mac;
781: comp = &newkeys[MODE_IN]->comp;
1.25 markus 782: }
783: maclen = mac && mac->enabled ? mac->mac_len : 0;
1.37 markus 784: block_size = enc ? enc->cipher->block_size : 8;
1.25 markus 785:
786: if (packet_length == 0) {
787: /*
788: * check if input size is less than the cipher block size,
789: * decrypt first block and extract length of incoming packet
790: */
791: if (buffer_len(&input) < block_size)
792: return SSH_MSG_NONE;
793: buffer_clear(&incoming_packet);
794: buffer_append_space(&incoming_packet, &cp, block_size);
1.62 ! markus 795: cipher_decrypt(&receive_context, cp, buffer_ptr(&input),
1.25 markus 796: block_size);
1.40 markus 797: ucp = (u_char *) buffer_ptr(&incoming_packet);
1.25 markus 798: packet_length = GET_32BIT(ucp);
799: if (packet_length < 1 + 4 || packet_length > 256 * 1024) {
800: buffer_dump(&incoming_packet);
801: packet_disconnect("Bad packet length %d.", packet_length);
802: }
803: DBG(debug("input: packet len %d", packet_length+4));
804: buffer_consume(&input, block_size);
805: }
806: /* we have a partial packet of block_size bytes */
807: need = 4 + packet_length - block_size;
808: DBG(debug("partial packet %d, need %d, maclen %d", block_size,
809: need, maclen));
810: if (need % block_size != 0)
811: fatal("padding error: need %d block %d mod %d",
812: need, block_size, need % block_size);
813: /*
814: * check if the entire packet has been received and
815: * decrypt into incoming_packet
816: */
817: if (buffer_len(&input) < need + maclen)
818: return SSH_MSG_NONE;
819: #ifdef PACKET_DEBUG
820: fprintf(stderr, "read_poll enc/full: ");
821: buffer_dump(&input);
822: #endif
823: buffer_append_space(&incoming_packet, &cp, need);
1.62 ! markus 824: cipher_decrypt(&receive_context, cp, buffer_ptr(&input), need);
1.25 markus 825: buffer_consume(&input, need);
826: /*
827: * compute MAC over seqnr and packet,
828: * increment sequence number for incoming packet
829: */
1.29 markus 830: if (mac && mac->enabled) {
1.50 markus 831: macbuf = mac_compute(mac, seqnr,
1.40 markus 832: (u_char *) buffer_ptr(&incoming_packet),
1.50 markus 833: buffer_len(&incoming_packet));
1.25 markus 834: if (memcmp(macbuf, buffer_ptr(&input), mac->mac_len) != 0)
1.36 markus 835: packet_disconnect("Corrupted MAC on input.");
836: DBG(debug("MAC #%d ok", seqnr));
1.25 markus 837: buffer_consume(&input, mac->mac_len);
838: }
1.29 markus 839: if (++seqnr == 0)
840: log("incoming seqnr wraps around");
1.25 markus 841:
842: /* get padlen */
843: cp = buffer_ptr(&incoming_packet) + 4;
1.62 ! markus 844: padlen = (u_char) *cp;
1.25 markus 845: DBG(debug("input: padlen %d", padlen));
846: if (padlen < 4)
847: packet_disconnect("Corrupted padlen %d on input.", padlen);
848:
849: /* skip packet size + padlen, discard padding */
850: buffer_consume(&incoming_packet, 4 + 1);
851: buffer_consume_end(&incoming_packet, padlen);
852:
853: DBG(debug("input: len before de-compress %d", buffer_len(&incoming_packet)));
854: if (comp && comp->enabled) {
855: buffer_clear(&compression_buffer);
856: buffer_uncompress(&incoming_packet, &compression_buffer);
857: buffer_clear(&incoming_packet);
858: buffer_append(&incoming_packet, buffer_ptr(&compression_buffer),
859: buffer_len(&compression_buffer));
860: DBG(debug("input: len after de-compress %d", buffer_len(&incoming_packet)));
861: }
862: /*
863: * get packet type, implies consume.
864: * return length of payload (without type field)
865: */
1.62 ! markus 866: type = buffer_get_char(&incoming_packet);
1.57 markus 867: if (type == SSH2_MSG_NEWKEYS)
868: set_newkeys(MODE_IN);
1.62 ! markus 869: *payload_len_ptr = buffer_len(&incoming_packet);
1.25 markus 870: #ifdef PACKET_DEBUG
1.55 deraadt 871: fprintf(stderr, "read/plain[%d]:\r\n", type);
1.25 markus 872: buffer_dump(&incoming_packet);
873: #endif
1.62 ! markus 874: /* reset for next packet */
! 875: packet_length = 0;
! 876: return type;
1.25 markus 877: }
878:
879: int
880: packet_read_poll(int *payload_len_ptr)
881: {
1.62 ! markus 882: int reason;
! 883: u_char type;
1.25 markus 884: char *msg;
1.62 ! markus 885:
1.25 markus 886: for (;;) {
1.62 ! markus 887: if (compat20) {
! 888: type = packet_read_poll2(payload_len_ptr);
! 889: if (type)
1.25 markus 890: DBG(debug("received packet type %d", type));
891: switch(type) {
892: case SSH2_MSG_IGNORE:
893: break;
894: case SSH2_MSG_DEBUG:
895: packet_get_char();
896: msg = packet_get_string(NULL);
897: debug("Remote: %.900s", msg);
898: xfree(msg);
899: msg = packet_get_string(NULL);
900: xfree(msg);
901: break;
902: case SSH2_MSG_DISCONNECT:
903: reason = packet_get_int();
904: msg = packet_get_string(NULL);
1.41 markus 905: log("Received disconnect from %s: %d: %.400s", get_remote_ipaddr(),
906: reason, msg);
1.25 markus 907: xfree(msg);
908: fatal_cleanup();
909: break;
910: default:
911: return type;
912: break;
1.48 stevesk 913: }
1.25 markus 914: } else {
1.62 ! markus 915: type = packet_read_poll1(payload_len_ptr);
1.25 markus 916: switch(type) {
917: case SSH_MSG_IGNORE:
918: break;
919: case SSH_MSG_DEBUG:
920: msg = packet_get_string(NULL);
921: debug("Remote: %.900s", msg);
922: xfree(msg);
923: break;
924: case SSH_MSG_DISCONNECT:
925: msg = packet_get_string(NULL);
1.41 markus 926: log("Received disconnect from %s: %.400s", get_remote_ipaddr(),
927: msg);
1.25 markus 928: fatal_cleanup();
929: xfree(msg);
930: break;
931: default:
1.62 ! markus 932: if (type)
1.25 markus 933: DBG(debug("received packet type %d", type));
934: return type;
935: break;
1.48 stevesk 936: }
1.25 markus 937: }
938: }
939: }
940:
1.16 markus 941: /*
942: * Buffers the given amount of input characters. This is intended to be used
943: * together with packet_read_poll.
944: */
1.1 deraadt 945:
1.2 provos 946: void
1.40 markus 947: packet_process_incoming(const char *buf, u_int len)
1.1 deraadt 948: {
1.14 markus 949: buffer_append(&input, buf, len);
1.1 deraadt 950: }
951:
952: /* Returns a character from the packet. */
953:
1.40 markus 954: u_int
1.2 provos 955: packet_get_char()
1.1 deraadt 956: {
1.14 markus 957: char ch;
958: buffer_get(&incoming_packet, &ch, 1);
1.40 markus 959: return (u_char) ch;
1.1 deraadt 960: }
961:
962: /* Returns an integer from the packet data. */
963:
1.40 markus 964: u_int
1.2 provos 965: packet_get_int()
1.1 deraadt 966: {
1.14 markus 967: return buffer_get_int(&incoming_packet);
1.1 deraadt 968: }
969:
1.16 markus 970: /*
971: * Returns an arbitrary precision integer from the packet data. The integer
972: * must have been initialized before this call.
973: */
1.1 deraadt 974:
1.2 provos 975: void
1.14 markus 976: packet_get_bignum(BIGNUM * value, int *length_ptr)
1.1 deraadt 977: {
1.14 markus 978: *length_ptr = buffer_get_bignum(&incoming_packet, value);
1.24 markus 979: }
980:
981: void
982: packet_get_bignum2(BIGNUM * value, int *length_ptr)
983: {
984: *length_ptr = buffer_get_bignum2(&incoming_packet, value);
985: }
986:
987: char *
988: packet_get_raw(int *length_ptr)
989: {
990: int bytes = buffer_len(&incoming_packet);
991: if (length_ptr != NULL)
992: *length_ptr = bytes;
993: return buffer_ptr(&incoming_packet);
1.28 markus 994: }
995:
996: int
997: packet_remaining(void)
998: {
999: return buffer_len(&incoming_packet);
1.1 deraadt 1000: }
1001:
1.16 markus 1002: /*
1003: * Returns a string from the packet data. The string is allocated using
1004: * xmalloc; it is the responsibility of the calling program to free it when
1005: * no longer needed. The length_ptr argument may be NULL, or point to an
1006: * integer into which the length of the string is stored.
1007: */
1.1 deraadt 1008:
1.16 markus 1009: char *
1.40 markus 1010: packet_get_string(u_int *length_ptr)
1.1 deraadt 1011: {
1.14 markus 1012: return buffer_get_string(&incoming_packet, length_ptr);
1.1 deraadt 1013: }
1014:
1.16 markus 1015: /*
1016: * Sends a diagnostic message from the server to the client. This message
1017: * can be sent at any time (but not while constructing another message). The
1018: * message is printed immediately, but only if the client is being executed
1019: * in verbose mode. These messages are primarily intended to ease debugging
1020: * authentication problems. The length of the formatted message must not
1021: * exceed 1024 bytes. This will automatically call packet_write_wait.
1022: */
1.1 deraadt 1023:
1.2 provos 1024: void
1.14 markus 1025: packet_send_debug(const char *fmt,...)
1.1 deraadt 1026: {
1.14 markus 1027: char buf[1024];
1028: va_list args;
1.39 markus 1029:
1030: if (compat20 && (datafellows & SSH_BUG_DEBUG))
1031: return;
1.14 markus 1032:
1033: va_start(args, fmt);
1034: vsnprintf(buf, sizeof(buf), fmt, args);
1035: va_end(args);
1036:
1.30 markus 1037: if (compat20) {
1038: packet_start(SSH2_MSG_DEBUG);
1039: packet_put_char(0); /* bool: always display */
1040: packet_put_cstring(buf);
1041: packet_put_cstring("");
1042: } else {
1043: packet_start(SSH_MSG_DEBUG);
1044: packet_put_cstring(buf);
1045: }
1.14 markus 1046: packet_send();
1047: packet_write_wait();
1.1 deraadt 1048: }
1049:
1.16 markus 1050: /*
1051: * Logs the error plus constructs and sends a disconnect packet, closes the
1052: * connection, and exits. This function never returns. The error message
1053: * should not contain a newline. The length of the formatted message must
1054: * not exceed 1024 bytes.
1055: */
1.1 deraadt 1056:
1.2 provos 1057: void
1.14 markus 1058: packet_disconnect(const char *fmt,...)
1.1 deraadt 1059: {
1.14 markus 1060: char buf[1024];
1061: va_list args;
1062: static int disconnecting = 0;
1063: if (disconnecting) /* Guard against recursive invocations. */
1064: fatal("packet_disconnect called recursively.");
1065: disconnecting = 1;
1066:
1.16 markus 1067: /*
1068: * Format the message. Note that the caller must make sure the
1069: * message is of limited size.
1070: */
1.14 markus 1071: va_start(args, fmt);
1072: vsnprintf(buf, sizeof(buf), fmt, args);
1073: va_end(args);
1074:
1075: /* Send the disconnect message to the other side, and wait for it to get sent. */
1.25 markus 1076: if (compat20) {
1077: packet_start(SSH2_MSG_DISCONNECT);
1078: packet_put_int(SSH2_DISCONNECT_PROTOCOL_ERROR);
1079: packet_put_cstring(buf);
1080: packet_put_cstring("");
1081: } else {
1082: packet_start(SSH_MSG_DISCONNECT);
1083: packet_put_string(buf, strlen(buf));
1084: }
1.14 markus 1085: packet_send();
1086: packet_write_wait();
1087:
1088: /* Stop listening for connections. */
1089: channel_stop_listening();
1090:
1091: /* Close the connection. */
1092: packet_close();
1.1 deraadt 1093:
1.14 markus 1094: /* Display the error locally and exit. */
1.17 markus 1095: log("Disconnecting: %.100s", buf);
1096: fatal_cleanup();
1.1 deraadt 1097: }
1098:
1.16 markus 1099: /* Checks if there is any buffered output, and tries to write some of the output. */
1.1 deraadt 1100:
1.2 provos 1101: void
1102: packet_write_poll()
1.1 deraadt 1103: {
1.14 markus 1104: int len = buffer_len(&output);
1105: if (len > 0) {
1106: len = write(connection_out, buffer_ptr(&output), len);
1107: if (len <= 0) {
1108: if (errno == EAGAIN)
1109: return;
1110: else
1111: fatal("Write failed: %.100s", strerror(errno));
1112: }
1113: buffer_consume(&output, len);
1114: }
1.1 deraadt 1115: }
1116:
1.16 markus 1117: /*
1118: * Calls packet_write_poll repeatedly until all pending output data has been
1119: * written.
1120: */
1.1 deraadt 1121:
1.2 provos 1122: void
1123: packet_write_wait()
1.1 deraadt 1124: {
1.56 millert 1125: fd_set *setp;
1126:
1127: setp = (fd_set *)xmalloc(howmany(connection_out + 1, NFDBITS) *
1128: sizeof(fd_mask));
1.14 markus 1129: packet_write_poll();
1130: while (packet_have_data_to_write()) {
1.56 millert 1131: memset(setp, 0, howmany(connection_out + 1, NFDBITS) *
1132: sizeof(fd_mask));
1133: FD_SET(connection_out, setp);
1134: while (select(connection_out + 1, NULL, setp, NULL, NULL) == -1 &&
1.51 deraadt 1135: (errno == EAGAIN || errno == EINTR))
1136: ;
1.14 markus 1137: packet_write_poll();
1138: }
1.56 millert 1139: xfree(setp);
1.1 deraadt 1140: }
1141:
1142: /* Returns true if there is buffered data to write to the connection. */
1143:
1.2 provos 1144: int
1145: packet_have_data_to_write()
1.1 deraadt 1146: {
1.14 markus 1147: return buffer_len(&output) != 0;
1.1 deraadt 1148: }
1149:
1150: /* Returns true if there is not too much data to write to the connection. */
1151:
1.2 provos 1152: int
1153: packet_not_very_much_data_to_write()
1.1 deraadt 1154: {
1.14 markus 1155: if (interactive_mode)
1156: return buffer_len(&output) < 16384;
1157: else
1158: return buffer_len(&output) < 128 * 1024;
1.1 deraadt 1159: }
1160:
1161: /* Informs that the current session is interactive. Sets IP flags for that. */
1162:
1.2 provos 1163: void
1.43 markus 1164: packet_set_interactive(int interactive)
1.1 deraadt 1165: {
1.43 markus 1166: static int called = 0;
1.44 markus 1167: int lowdelay = IPTOS_LOWDELAY;
1168: int throughput = IPTOS_THROUGHPUT;
1169: int on = 1;
1170:
1.43 markus 1171: if (called)
1172: return;
1173: called = 1;
1.1 deraadt 1174:
1.14 markus 1175: /* Record that we are in interactive mode. */
1176: interactive_mode = interactive;
1.1 deraadt 1177:
1.19 markus 1178: /* Only set socket options if using a socket. */
1179: if (!packet_connection_is_on_socket())
1.14 markus 1180: return;
1.19 markus 1181: /*
1.42 markus 1182: * IPTOS_LOWDELAY and IPTOS_THROUGHPUT are IPv4 only
1.19 markus 1183: */
1.14 markus 1184: if (interactive) {
1.16 markus 1185: /*
1186: * Set IP options for an interactive connection. Use
1187: * IPTOS_LOWDELAY and TCP_NODELAY.
1188: */
1.42 markus 1189: if (packet_connection_is_ipv4()) {
1190: if (setsockopt(connection_in, IPPROTO_IP, IP_TOS,
1191: (void *) &lowdelay, sizeof(lowdelay)) < 0)
1192: error("setsockopt IPTOS_LOWDELAY: %.100s",
1193: strerror(errno));
1194: }
1.14 markus 1195: if (setsockopt(connection_in, IPPROTO_TCP, TCP_NODELAY, (void *) &on,
1.19 markus 1196: sizeof(on)) < 0)
1.14 markus 1197: error("setsockopt TCP_NODELAY: %.100s", strerror(errno));
1.42 markus 1198: } else if (packet_connection_is_ipv4()) {
1.16 markus 1199: /*
1200: * Set IP options for a non-interactive connection. Use
1201: * IPTOS_THROUGHPUT.
1202: */
1.14 markus 1203: if (setsockopt(connection_in, IPPROTO_IP, IP_TOS, (void *) &throughput,
1.19 markus 1204: sizeof(throughput)) < 0)
1.14 markus 1205: error("setsockopt IPTOS_THROUGHPUT: %.100s", strerror(errno));
1206: }
1.1 deraadt 1207: }
1208:
1209: /* Returns true if the current connection is interactive. */
1210:
1.2 provos 1211: int
1212: packet_is_interactive()
1.1 deraadt 1213: {
1.14 markus 1214: return interactive_mode;
1.12 markus 1215: }
1216:
1217: int
1218: packet_set_maxsize(int s)
1219: {
1.14 markus 1220: static int called = 0;
1221: if (called) {
1.25 markus 1222: log("packet_set_maxsize: called twice: old %d new %d",
1223: max_packet_size, s);
1.14 markus 1224: return -1;
1225: }
1226: if (s < 4 * 1024 || s > 1024 * 1024) {
1227: log("packet_set_maxsize: bad size %d", s);
1228: return -1;
1229: }
1230: log("packet_set_maxsize: setting to %d", s);
1231: max_packet_size = s;
1232: return s;
1.53 markus 1233: }
1234:
1235: /*
1236: * 9.2. Ignored Data Message
1.61 markus 1237: *
1.53 markus 1238: * byte SSH_MSG_IGNORE
1239: * string data
1.61 markus 1240: *
1.53 markus 1241: * All implementations MUST understand (and ignore) this message at any
1242: * time (after receiving the protocol version). No implementation is
1243: * required to send them. This message can be used as an additional
1244: * protection measure against advanced traffic analysis techniques.
1245: */
1246: /* size of current + ignore message should be n*sumlen bytes (w/o mac) */
1247: void
1248: packet_inject_ignore(int sumlen)
1249: {
1.54 markus 1250: int blocksize, padlen, have, need, nb, mini, nbytes;
1.53 markus 1251: Enc *enc = NULL;
1252:
1.62 ! markus 1253: if (compat20 == 0)
1.53 markus 1254: return;
1255:
1256: have = buffer_len(&outgoing_packet);
1257: debug2("packet_inject_ignore: current %d", have);
1.57 markus 1258: if (newkeys[MODE_OUT] != NULL)
1259: enc = &newkeys[MODE_OUT]->enc;
1.53 markus 1260: blocksize = enc ? enc->cipher->block_size : 8;
1261: padlen = blocksize - (have % blocksize);
1262: if (padlen < 4)
1263: padlen += blocksize;
1264: have += padlen;
1265: have /= blocksize; /* # of blocks for current message */
1266:
1267: nb = roundup(sumlen, blocksize) / blocksize; /* blocks for both */
1268: mini = roundup(5+1+4+4, blocksize) / blocksize; /* minsize ignore msg */
1269: need = nb - (have % nb); /* blocks for ignore */
1270: if (need <= mini)
1271: need += nb;
1272: nbytes = (need - mini) * blocksize; /* size of ignore payload */
1273: debug2("packet_inject_ignore: block %d have %d nb %d mini %d need %d",
1274: blocksize, have, nb, mini, need);
1275:
1276: /* enqueue current message and append a ignore message */
1277: packet_send();
1.54 markus 1278: packet_send_ignore(nbytes);
1279: }
1280:
1281: void
1282: packet_send_ignore(int nbytes)
1283: {
1284: u_int32_t rand = 0;
1285: int i;
1286:
1287: packet_start(compat20 ? SSH2_MSG_IGNORE : SSH_MSG_IGNORE);
1.53 markus 1288: packet_put_int(nbytes);
1289: for(i = 0; i < nbytes; i++) {
1290: if (i % 4 == 0)
1291: rand = arc4random();
1292: packet_put_char(rand & 0xff);
1293: rand >>= 8;
1294: }
1.1 deraadt 1295: }
![[BACK]](/icons/back.gif){kind=icon}
Return to packet.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh