nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-01-10 01:48:00 +00:00
Code Issues Projects Releases Wiki Activity
12abb95394
putty-source/ssh.c

10107 lines
326 KiB
C
Raw Normal View History

Sprinkle some header comments in various files in an attempt to explain what they're for. [originally from svn r6639]
2006-04-23 18:26:03 +00:00
/*
* SSH backend.
*/
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
#include <stdio.h>
#include <stdlib.h>
Joris van Rantwijk's unified SSH code suitable for PuTTY and PSCP [originally from svn r504] [this commit reordered to come after creation of 0.49 tag]
2000-06-22 12:18:34 +00:00
#include <stdarg.h>
#include <assert.h>
Return a non-zero exit code in the event of a fatal-error SSH session termination. `Close window only on clean exit' was not working properly on Unix in the absence of this: notify_remote_exit() was being called and ssh_return_exitcode was returning zero, causing gtk_main_quit() to be called, _before_ connection_fatal() happened. [originally from svn r6801]
2006-08-26 09:21:52 +00:00
#include <limits.h>
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#include <signal.h>
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
#include "putty.h"
Refuse to forward agent messages > AGENT_MAX_MSGLEN. Mostly so that we don't have to malloc contiguous space for them inside PuTTY; since we've already got a handy constant saying how big is too big, we might as well use it to sanity-check the contents of our agent forwarding channels.
2017-01-30 19:42:25 +00:00
#include "pageant.h" /* for AGENT_MAX_MSGLEN */
Pageant now accepts an initial key list on the command line [originally from svn r592]
2000-09-15 10:48:42 +00:00
#include "tree234.h"
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
#include "storage.h"
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
#include "marshal.h"
Joris van Rantwijk's unified SSH code suitable for PuTTY and PSCP [originally from svn r504] [this commit reordered to come after creation of 0.49 tag]
2000-06-22 12:18:34 +00:00
#include "ssh.h"
Move some ssh.c declarations into header files. ssh.c has been an unmanageably huge monolith of a source file for too long, and it's finally time I started breaking it up into smaller pieces. The first step is to move some declarations - basic types like packets and packet queues, standard constants, enums, and the coroutine system - into headers where other files can see them.
2018-06-09 08:07:18 +00:00
#include "sshcr.h"
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
#include "sshbpp.h"
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
#include "sshchan.h"
At some point recently, Unix PuTTY started suffering build errors using -DNO_GSSAPI. Move some ifdefs around so it stops. [originally from svn r8370]
2008-12-02 18:18:32 +00:00
#ifndef NO_GSSAPI
Patch from Alejandro Sedeno, somewhat modified by me, which reorganises the GSSAPI support so that it handles alternative implementations of the GSS-API. In particular, this means PuTTY can now talk to MIT Kerberos for Windows instead of being limited to SSPI. I don't know for sure whether further tweaking will be needed (to the UI, most likely, or to automatic selection of credentials), but testing reports suggest it's now at least worth committing to trunk to get it more widely tested. [originally from svn r8952]
2010-05-19 18:22:17 +00:00
#include "sshgssc.h"
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
#include "sshgss.h"
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#define MIN_CTXT_LIFETIME 5 /* Avoid rekey with short lifetime (seconds) */
#define GSS_KEX_CAPABLE (1<<0) /* Can do GSS KEX */
#define GSS_CRED_UPDATED (1<<1) /* Cred updated since previous delegation */
#define GSS_CTXT_EXPIRES (1<<2) /* Context expires before next timer */
#define GSS_CTXT_MAYFAIL (1<<3) /* Context may expire during handshake */
At some point recently, Unix PuTTY started suffering build errors using -DNO_GSSAPI. Move some ifdefs around so it stops. [originally from svn r8370]
2008-12-02 18:18:32 +00:00
#endif
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Log the text message in SSH_MSG_DISCONNECT (both protocols) so that when people submit Event Logs for diagnosis it's a little easier to work out what's up. [originally from svn r1043]
2001-04-16 09:10:34 +00:00
static const char *const ssh2_disconnect_reasons[] = {
NULL,
Make SSH_MSG_DISCONNECT reasons less scary (without removing useful content). [originally from svn r6392]
2005-10-13 21:51:38 +00:00
"host not allowed to connect",
"protocol error",
"key exchange failed",
"host authentication failed",
Tweak to r6392: spell "MAC" thus. [originally from svn r6399] [r6392 == 8fb9bd0216f49ef0ae94371a3325402301ad2d47]
2005-10-13 22:51:44 +00:00
"MAC error",
Make SSH_MSG_DISCONNECT reasons less scary (without removing useful content). [originally from svn r6392]
2005-10-13 21:51:38 +00:00
"compression error",
"service not available",
"protocol version not supported",
"host key not verifiable",
"connection lost",
"by application",
"too many connections",
"auth cancelled by user",
"no more auth methods available",
"illegal user name",
Log the text message in SSH_MSG_DISCONNECT (both protocols) so that when people submit Event Logs for diagnosis it's a little easier to work out what's up. [originally from svn r1043]
2001-04-16 09:10:34 +00:00
};
Format SSH2_MSG_DISCONNECT correctly (with reason code, reason string, and language tag). [originally from svn r770]
2000-10-26 13:10:47 +00:00
Support RFC 4419. PuTTY now uses the updated version of Diffie-Hellman group exchange, except for a few old OpenSSH versions which Darren Tucker reports only support the old version. FIXME: this needs further work because the Bugs config panel has now overflowed.
2015-04-25 09:46:53 +00:00
#define DH_MIN_SIZE 1024
#define DH_MAX_SIZE 8192
Update to password length traffic analysis: one Cisco router can apparently not deal with SSH1_MSG_IGNORE _or_ padded passwords, so we must fall back to sending an undefended password. [originally from svn r1332]
2001-10-27 10:39:54 +00:00
Factor out ssh2_timer_update. This is a preliminary refactoring for an upcoming change which will need to affect every use of schedule_timer to wait for the next rekey: those calls to schedule_timer are now centralised into a function that does an organised piece of thinking about when the next timer should be. A side effect of this change is that the translation from CONF_ssh_rekey_time to an actual tick count is now better proofed against integer overflow (just in case the user entered a completely silly value).
2018-04-14 13:48:02 +00:00
/* Safely convert rekey_time to unsigned long minutes */
static unsigned long rekey_mins(int rekey_time, unsigned long def)
{
if (rekey_time < 0 || rekey_time > MAX_TICK_MINS)
rekey_time = def;
return (unsigned long)rekey_time;
}
Retired the #ifdef DUMP_PACKETS stuff in ssh.c because I'm utterly sick of recompiling to enable packet dumps. SSH packet dumping is now provided as a logging option, and dumps to putty.log like all the other logging options. While I'm at it I cleaned up the format so that packet types are translated into strings for easy browsing. POSSIBLE SIDE EFFECT: in the course of this work I had to re-enable the SSH1 packet length checks which it turns out hadn't actually been active for some time, so it's possible things might break as a result. If need be I can always disable those checks for the 0.52 release and think about it more carefully later. [originally from svn r1493]
2001-12-14 14:57:50 +00:00
#define translate(x) if (type == x) return #x
Split pkt_ctx into a separate enumeration for each of kex and userauth instead of a bitfield for both. This doesn't gain much here, but it should make it easier to make things other than logging use the context. [originally from svn r7647]
2007-07-21 21:39:36 +00:00
#define translatek(x,ctx) if (type == x && (pkt_kctx == ctx)) return #x
#define translatea(x,ctx) if (type == x && (pkt_actx == ctx)) return #x
Move some ssh.c declarations into header files. ssh.c has been an unmanageably huge monolith of a source file for too long, and it's finally time I started breaking it up into smaller pieces. The first step is to move some declarations - basic types like packets and packet queues, standard constants, enums, and the coroutine system - into headers where other files can see them.
2018-06-09 08:07:18 +00:00
const char *ssh1_pkt_type(int type)
Retired the #ifdef DUMP_PACKETS stuff in ssh.c because I'm utterly sick of recompiling to enable packet dumps. SSH packet dumping is now provided as a logging option, and dumps to putty.log like all the other logging options. While I'm at it I cleaned up the format so that packet types are translated into strings for easy browsing. POSSIBLE SIDE EFFECT: in the course of this work I had to re-enable the SSH1 packet length checks which it turns out hadn't actually been active for some time, so it's possible things might break as a result. If need be I can always disable those checks for the 0.52 release and think about it more carefully later. [originally from svn r1493]
2001-12-14 14:57:50 +00:00
{
translate(SSH1_MSG_DISCONNECT);
translate(SSH1_SMSG_PUBLIC_KEY);
translate(SSH1_CMSG_SESSION_KEY);
translate(SSH1_CMSG_USER);
translate(SSH1_CMSG_AUTH_RSA);
translate(SSH1_SMSG_AUTH_RSA_CHALLENGE);
translate(SSH1_CMSG_AUTH_RSA_RESPONSE);
translate(SSH1_CMSG_AUTH_PASSWORD);
translate(SSH1_CMSG_REQUEST_PTY);
translate(SSH1_CMSG_WINDOW_SIZE);
translate(SSH1_CMSG_EXEC_SHELL);
translate(SSH1_CMSG_EXEC_CMD);
translate(SSH1_SMSG_SUCCESS);
translate(SSH1_SMSG_FAILURE);
translate(SSH1_CMSG_STDIN_DATA);
translate(SSH1_SMSG_STDOUT_DATA);
translate(SSH1_SMSG_STDERR_DATA);
translate(SSH1_CMSG_EOF);
translate(SSH1_SMSG_EXIT_STATUS);
translate(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
translate(SSH1_MSG_CHANNEL_OPEN_FAILURE);
translate(SSH1_MSG_CHANNEL_DATA);
translate(SSH1_MSG_CHANNEL_CLOSE);
translate(SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION);
translate(SSH1_SMSG_X11_OPEN);
translate(SSH1_CMSG_PORT_FORWARD_REQUEST);
translate(SSH1_MSG_PORT_OPEN);
translate(SSH1_CMSG_AGENT_REQUEST_FORWARDING);
translate(SSH1_SMSG_AGENT_OPEN);
translate(SSH1_MSG_IGNORE);
translate(SSH1_CMSG_EXIT_CONFIRMATION);
translate(SSH1_CMSG_X11_REQUEST_FORWARDING);
translate(SSH1_CMSG_AUTH_RHOSTS_RSA);
translate(SSH1_MSG_DEBUG);
translate(SSH1_CMSG_REQUEST_COMPRESSION);
translate(SSH1_CMSG_AUTH_TIS);
translate(SSH1_SMSG_AUTH_TIS_CHALLENGE);
translate(SSH1_CMSG_AUTH_TIS_RESPONSE);
translate(SSH1_CMSG_AUTH_CCARD);
translate(SSH1_SMSG_AUTH_CCARD_CHALLENGE);
translate(SSH1_CMSG_AUTH_CCARD_RESPONSE);
return "unknown";
}
Move some ssh.c declarations into header files. ssh.c has been an unmanageably huge monolith of a source file for too long, and it's finally time I started breaking it up into smaller pieces. The first step is to move some declarations - basic types like packets and packet queues, standard constants, enums, and the coroutine system - into headers where other files can see them.
2018-06-09 08:07:18 +00:00
const char *ssh2_pkt_type(Pkt_KCtx pkt_kctx, Pkt_ACtx pkt_actx, int type)
Retired the #ifdef DUMP_PACKETS stuff in ssh.c because I'm utterly sick of recompiling to enable packet dumps. SSH packet dumping is now provided as a logging option, and dumps to putty.log like all the other logging options. While I'm at it I cleaned up the format so that packet types are translated into strings for easy browsing. POSSIBLE SIDE EFFECT: in the course of this work I had to re-enable the SSH1 packet length checks which it turns out hadn't actually been active for some time, so it's possible things might break as a result. If need be I can always disable those checks for the 0.52 release and think about it more carefully later. [originally from svn r1493]
2001-12-14 14:57:50 +00:00
{
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
translatea(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE,SSH2_PKTCTX_GSSAPI);
translatea(SSH2_MSG_USERAUTH_GSSAPI_TOKEN,SSH2_PKTCTX_GSSAPI);
translatea(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,SSH2_PKTCTX_GSSAPI);
translatea(SSH2_MSG_USERAUTH_GSSAPI_ERROR,SSH2_PKTCTX_GSSAPI);
translatea(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK,SSH2_PKTCTX_GSSAPI);
translatea(SSH2_MSG_USERAUTH_GSSAPI_MIC, SSH2_PKTCTX_GSSAPI);
Retired the #ifdef DUMP_PACKETS stuff in ssh.c because I'm utterly sick of recompiling to enable packet dumps. SSH packet dumping is now provided as a logging option, and dumps to putty.log like all the other logging options. While I'm at it I cleaned up the format so that packet types are translated into strings for easy browsing. POSSIBLE SIDE EFFECT: in the course of this work I had to re-enable the SSH1 packet length checks which it turns out hadn't actually been active for some time, so it's possible things might break as a result. If need be I can always disable those checks for the 0.52 release and think about it more carefully later. [originally from svn r1493]
2001-12-14 14:57:50 +00:00
translate(SSH2_MSG_DISCONNECT);
translate(SSH2_MSG_IGNORE);
translate(SSH2_MSG_UNIMPLEMENTED);
translate(SSH2_MSG_DEBUG);
translate(SSH2_MSG_SERVICE_REQUEST);
translate(SSH2_MSG_SERVICE_ACCEPT);
translate(SSH2_MSG_KEXINIT);
translate(SSH2_MSG_NEWKEYS);
Split pkt_ctx into a separate enumeration for each of kex and userauth instead of a bitfield for both. This doesn't gain much here, but it should make it easier to make things other than logging use the context. [originally from svn r7647]
2007-07-21 21:39:36 +00:00
translatek(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP);
translatek(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP);
Support RFC 4419. PuTTY now uses the updated version of Diffie-Hellman group exchange, except for a few old OpenSSH versions which Darren Tucker reports only support the old version. FIXME: this needs further work because the Bugs config panel has now overflowed.
2015-04-25 09:46:53 +00:00
translatek(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD, SSH2_PKTCTX_DHGEX);
Split pkt_ctx into a separate enumeration for each of kex and userauth instead of a bitfield for both. This doesn't gain much here, but it should make it easier to make things other than logging use the context. [originally from svn r7647]
2007-07-21 21:39:36 +00:00
translatek(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX);
translatek(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX);
translatek(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX);
translatek(SSH2_MSG_KEX_DH_GEX_REPLY, SSH2_PKTCTX_DHGEX);
translatek(SSH2_MSG_KEXRSA_PUBKEY, SSH2_PKTCTX_RSAKEX);
translatek(SSH2_MSG_KEXRSA_SECRET, SSH2_PKTCTX_RSAKEX);
translatek(SSH2_MSG_KEXRSA_DONE, SSH2_PKTCTX_RSAKEX);
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
translatek(SSH2_MSG_KEX_ECDH_INIT, SSH2_PKTCTX_ECDHKEX);
translatek(SSH2_MSG_KEX_ECDH_REPLY, SSH2_PKTCTX_ECDHKEX);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
translatek(SSH2_MSG_KEXGSS_INIT, SSH2_PKTCTX_GSSKEX);
translatek(SSH2_MSG_KEXGSS_CONTINUE, SSH2_PKTCTX_GSSKEX);
translatek(SSH2_MSG_KEXGSS_COMPLETE, SSH2_PKTCTX_GSSKEX);
translatek(SSH2_MSG_KEXGSS_HOSTKEY, SSH2_PKTCTX_GSSKEX);
translatek(SSH2_MSG_KEXGSS_ERROR, SSH2_PKTCTX_GSSKEX);
translatek(SSH2_MSG_KEXGSS_GROUPREQ, SSH2_PKTCTX_GSSKEX);
translatek(SSH2_MSG_KEXGSS_GROUP, SSH2_PKTCTX_GSSKEX);
Retired the #ifdef DUMP_PACKETS stuff in ssh.c because I'm utterly sick of recompiling to enable packet dumps. SSH packet dumping is now provided as a logging option, and dumps to putty.log like all the other logging options. While I'm at it I cleaned up the format so that packet types are translated into strings for easy browsing. POSSIBLE SIDE EFFECT: in the course of this work I had to re-enable the SSH1 packet length checks which it turns out hadn't actually been active for some time, so it's possible things might break as a result. If need be I can always disable those checks for the 0.52 release and think about it more carefully later. [originally from svn r1493]
2001-12-14 14:57:50 +00:00
translate(SSH2_MSG_USERAUTH_REQUEST);
translate(SSH2_MSG_USERAUTH_FAILURE);
translate(SSH2_MSG_USERAUTH_SUCCESS);
translate(SSH2_MSG_USERAUTH_BANNER);
Split pkt_ctx into a separate enumeration for each of kex and userauth instead of a bitfield for both. This doesn't gain much here, but it should make it easier to make things other than logging use the context. [originally from svn r7647]
2007-07-21 21:39:36 +00:00
translatea(SSH2_MSG_USERAUTH_PK_OK, SSH2_PKTCTX_PUBLICKEY);
translatea(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, SSH2_PKTCTX_PASSWORD);
translatea(SSH2_MSG_USERAUTH_INFO_REQUEST, SSH2_PKTCTX_KBDINTER);
translatea(SSH2_MSG_USERAUTH_INFO_RESPONSE, SSH2_PKTCTX_KBDINTER);
Retired the #ifdef DUMP_PACKETS stuff in ssh.c because I'm utterly sick of recompiling to enable packet dumps. SSH packet dumping is now provided as a logging option, and dumps to putty.log like all the other logging options. While I'm at it I cleaned up the format so that packet types are translated into strings for easy browsing. POSSIBLE SIDE EFFECT: in the course of this work I had to re-enable the SSH1 packet length checks which it turns out hadn't actually been active for some time, so it's possible things might break as a result. If need be I can always disable those checks for the 0.52 release and think about it more carefully later. [originally from svn r1493]
2001-12-14 14:57:50 +00:00
translate(SSH2_MSG_GLOBAL_REQUEST);
translate(SSH2_MSG_REQUEST_SUCCESS);
translate(SSH2_MSG_REQUEST_FAILURE);
translate(SSH2_MSG_CHANNEL_OPEN);
translate(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
translate(SSH2_MSG_CHANNEL_OPEN_FAILURE);
translate(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
translate(SSH2_MSG_CHANNEL_DATA);
translate(SSH2_MSG_CHANNEL_EXTENDED_DATA);
translate(SSH2_MSG_CHANNEL_EOF);
translate(SSH2_MSG_CHANNEL_CLOSE);
translate(SSH2_MSG_CHANNEL_REQUEST);
translate(SSH2_MSG_CHANNEL_SUCCESS);
translate(SSH2_MSG_CHANNEL_FAILURE);
return "unknown";
}
#undef translate
#undef translatec
Introduce the ability to distinguish remote SSH implementations by their version strings and enable bug compatibility modes. [originally from svn r985]
2001-03-06 10:32:28 +00:00
`ssh-log-pw-blank': known password fields are now omitted from SSH packet logs by default (although they can be included). There's also an option to remove session data, which is good both for privacy and for reducing the size of logfiles. [originally from svn r4593]
2004-10-02 00:33:27 +00:00
/* Enumeration values for fields in SSH-1 packets */
enum {
PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM,
};
Switch to using SSH_MSG macros [originally from svn r282]
1999-11-08 17:36:08 +00:00
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_pkt_send(Ssh, struct PktOut *);
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
static void do_ssh1_login(void *vctx);
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
static void do_ssh2_userauth(void *vctx);
Install ssh-connection packet handlers synchronously. I had a one-off 'Strange packet received' error yesterday for an SSH_MSG_GLOBAL_REQUEST at connection startup. I wasn't able to reproduce, but examining the packet logs from the successful retry suggested that the global request in question was an OpenSSH 'here are my hostkeys' message. My belief is that in the failing connection that request packet must have arrived exceptionally promptly, and been added to pq_full before the preceding SSH_MSG_USERAUTH_SUCCESS had been processed. So the code that loops along pq_full feeding everything to the dispatch table would have moved the USERAUTH_SUCCESS on to pq_ssh2_userauth and scheduled a callback to handle it, and then moved on to the GLOBAL_REQUEST which would have gone straight to the dispatch table handler for 'help, we weren't expecting this message'. The userauth callback would later on have installed a more sensible dispatch table handler for global requests, but by then, it was too late. Solution: make a special case during pq_full processing, so that when we see USERAUTH_SUCCESS we _immediately_ - before continuing to traverse pq_full - install the initial dispatch table entries for the ssh-connection protocol. That way, even if connection messages are already in the queue, we won't get confused by them.
2018-05-31 17:42:47 +00:00
static void ssh2_connection_setup(Ssh ssh);
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
static void do_ssh2_connection(void *vctx);
Convert ssh2_channel_init() into ssh_channel_init(). By adding support for initialising SSH-1 channels as well. Now all newly-created channels go through this function.
2016-05-21 21:29:57 +00:00
static void ssh_channel_init(struct ssh_channel *c);
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static struct ssh_channel *ssh_channel_msg(Ssh ssh, PktIn *pktin);
Use ssh2_channel_got_eof() in ssh1_msg_channel_close(). Of course, that means renaming it to ssh_channel_got_eof(). It also involves adding the assertions from ssh1_msg_channel_close(), just in case.
2016-05-25 22:16:09 +00:00
static void ssh_channel_got_eof(struct ssh_channel *c);
Nearly forgot noting this down in the 'half-closed' bug entry: don't send CHANNEL_CLOSE until we have acks for all our winadj requests. Should work around https://bugzilla.mindrot.org/show_bug.cgi?id=1818 . [originally from svn r9280]
2011-09-13 11:56:25 +00:00
static void ssh2_channel_check_close(struct ssh_channel *c);
Factor out code to close the local socket associated with a channel. The only visible effect should be that abrupt closure of an SSH connection now leads to a slew of messages about closing forwarded ports.
2016-05-28 13:50:02 +00:00
static void ssh_channel_close_local(struct ssh_channel *c, char const *reason);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
static void ssh_channel_destroy(struct ssh_channel *c);
Factor out common parts of ssh_unthrottle and sshfwd_unthrottle. The SSH-2 code is essentially all shared, but SSH-1 still has some code specific to the stdout/stderr case.
2016-05-17 13:57:51 +00:00
static void ssh_channel_unthrottle(struct ssh_channel *c, int bufsize);
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_something_unimplemented(Ssh ssh, PktIn *pktin);
static void ssh2_general_packet_processing(Ssh ssh, PktIn *pktin);
Put all user input into a bufchain. This change introduces a new bufchain ssh->user_input, into which we put every byte received via back->send() (i.e. keyboard input from the GUI PuTTY window, data read by Plink from standard input, or outgoing SCP/SFTP protocol data made up by the file transfer utilities). Just like ssh->incoming_data, there's also a function pointer ssh->current_user_input_fn which says who currently has responsibility for pulling data back off that bufchain and processing it. So that can be changed over when the connection moves into a different major phase. At the moment, nothing very interesting is being done with this bufchain: each phase of the connection has its own little function that pulls chunks back out of it with bufchain_prefix and passes them to the unchanged main protocol coroutines. But this is groundwork for being able to switch over each of those coroutines in turn to read directly from ssh->user_input, with the aim of eliminating a collection of annoying bugs in which typed-ahead data is accidentally discarded at an SSH phase transition.
2018-05-18 06:22:58 +00:00
static void ssh1_login_input(Ssh ssh);
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
static void ssh2_userauth_input(Ssh ssh);
static void ssh2_connection_input(Ssh ssh);
Add support for sending SSH2_MSG_UNIMPLEMENTED for unrecognised messages; also do something with the debugging messages sent as SSH2_MSG_DEBUG. [originally from svn r1544]
2002-01-10 19:50:53 +00:00
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
struct ssh_signkey_with_user_pref_id {
Invent a struct type for polymorphic SSH key data. During last week's work, I made a mistake in which I got the arguments backwards in one of the key-blob-generating functions - mistakenly swapped the 'void *' key instance with the 'BinarySink *' output destination - and I didn't spot the mistake until run time, because in C you can implicitly convert both to and from void * and so there was no compile-time failure of type checking. Now that I've introduced the FROMFIELD macro that downcasts a pointer to one field of a structure to retrieve a pointer to the whole structure, I think I might start using that more widely to indicate this kind of polymorphic subtyping. So now all the public-key functions in the struct ssh_signkey vtable handle their data instance in the form of a pointer to a subfield of a new zero-sized structure type 'ssh_key', which outside the key implementations indicates 'this is some kind of key instance but it could be of any type'; they downcast that pointer internally using FROMFIELD in place of the previous ordinary C cast, and return one by returning &foo->sshk for whatever foo they've just made up. The sshk member is not at the beginning of the structure, which means all those FROMFIELDs and &key->sshk are actually adding and subtracting an offset. Of course I could have put the member at the start anyway, but I had the idea that it's actually a feature _not_ to have the two types start at the same address, because it means you should notice earlier rather than later if you absentmindedly cast from one to the other directly rather than by the approved method (in particular, if you accidentally assign one through a void * and back without even _noticing_ you perpetrated a cast). In particular, this enforces that you can't sfree() the thing even once without realising you should instead of called the right freekey function. (I found several bugs by this method during initial testing, so I think it's already proved its worth!) While I'm here, I've also renamed the vtable structure ssh_signkey to ssh_keyalg, because it was a confusing name anyway - it describes the _algorithm_ for handling all keys of that type, not a specific key. So ssh_keyalg is the collection of code, and ssh_key is one instance of the data it handles.
2018-05-27 07:32:21 +00:00
const ssh_keyalg *alg;
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
int id;
};
const static struct ssh_signkey_with_user_pref_id hostkey_algs[] = {
{ &ssh_ecdsa_ed25519, HK_ED25519 },
{ &ssh_ecdsa_nistp256, HK_ECDSA },
{ &ssh_ecdsa_nistp384, HK_ECDSA },
{ &ssh_ecdsa_nistp521, HK_ECDSA },
{ &ssh_dss, HK_DSA },
{ &ssh_rsa, HK_RSA },
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
};
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
Turn SSH-2 MACs into a classoid. This piece of tidying-up has come out particularly well in terms of saving tedious repetition and boilerplate. I've managed to remove three pointless methods from every MAC implementation by means of writing them once centrally in terms of the implementation-specific methods; another method (hmacmd5_sink) vanished because I was able to make the interface type 'ssh2_mac' be directly usable as a BinarySink by way of a new delegation system; and because all the method implementations can now find their own vtable, I was even able to merge a lot of keying and output functions that had previously differed only in length parameters by having them look up the lengths in whatever vtable they were passed.
2018-09-13 15:15:17 +00:00
const static struct ssh2_macalg *const macs[] = {
Add support for HMAC-SHA-256 as an SSH-2 MAC algorithm ("hmac-sha2-256") as specified in RFC 6668. This is not so much because I think it's necessary, but because scrypt uses HMAC-SHA-256 and once we've got it we may as well use it. Code very closely derived from the HMAC-SHA-1 code. Tested against OpenSSH 5.9p1 Debian-5ubuntu1. [originally from svn r9759]
2013-02-20 23:30:55 +00:00
&ssh_hmac_sha256, &ssh_hmac_sha1, &ssh_hmac_sha1_96, &ssh_hmac_md5
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
};
Turn SSH-2 MACs into a classoid. This piece of tidying-up has come out particularly well in terms of saving tedious repetition and boilerplate. I've managed to remove three pointless methods from every MAC implementation by means of writing them once centrally in terms of the implementation-specific methods; another method (hmacmd5_sink) vanished because I was able to make the interface type 'ssh2_mac' be directly usable as a BinarySink by way of a new delegation system; and because all the method implementations can now find their own vtable, I was even able to merge a lot of keying and output functions that had previously differed only in length parameters by having them look up the lengths in whatever vtable they were passed.
2018-09-13 15:15:17 +00:00
const static struct ssh2_macalg *const buggymacs[] = {
Implement hmac-sha1-96. It's RECOMMENDED in the current transport draft, and we don't have any strong reason not to implement it, for all that it's rather pointless. [originally from svn r6284]
2005-09-10 16:19:53 +00:00
&ssh_hmac_sha1_buggy, &ssh_hmac_sha1_96_buggy, &ssh_hmac_md5
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
};
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
static ssh_compressor *ssh_comp_none_init(void)
The Zlib module now uses dynamically allocated contexts. I think that completes the static-removal in the crypto library. Ooh. [originally from svn r2136]
2002-10-25 13:26:33 +00:00
{
return NULL;
}
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
static void ssh_comp_none_cleanup(ssh_compressor *handle)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
}
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
static ssh_decompressor *ssh_decomp_none_init(void)
{
return NULL;
}
static void ssh_decomp_none_cleanup(ssh_decompressor *handle)
{
}
static void ssh_comp_none_block(ssh_compressor *handle,
unsigned char *block, int len,
Move password-packet padding into the BPP module. Now when we construct a packet containing sensitive data, we just set a field saying '... and make it take up at least this much space, to disguise its true size', and nothing in the rest of the system worries about that flag until ssh2bpp.c acts on it. Also, I've changed the strategy for doing the padding. Previously, we were following the real packet with an SSH_MSG_IGNORE to make up the size. But that was only a partial defence: it works OK against passive traffic analysis, but an attacker proxying the TCP stream and dribbling it out one byte at a time could still have found out the size of the real packet by noting when the dribbled data provoked a response. Now I put the SSH_MSG_IGNORE _first_, which should defeat that attack. But that in turn doesn't work when we're doing compression, because we can't predict the compressed sizes accurately enough to make that strategy sensible. Fortunately, compression provides an alternative strategy anyway: if we've got zlib turned on when we send one of these sensitive packets, then we can pad out the compressed zlib data as much as we like by adding empty RFC1951 blocks (effectively chaining ZLIB_PARTIAL_FLUSHes). So both strategies should now be dribble-proof.
2018-07-09 19:30:11 +00:00
unsigned char **outblock, int *outlen,
int minlen)
Make compression functions return void. The return value wasn't used to indicate failure; it only indicated whether any compression was being done at all or whether the compression method was ssh_comp_none, and we can tell the latter just as well by the fact that its init function returns a null context pointer.
2018-07-10 20:27:43 +00:00
{
}
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
static int ssh_decomp_none_block(ssh_decompressor *handle,
unsigned char *block, int len,
Make compression functions return void. The return value wasn't used to indicate failure; it only indicated whether any compression was being done at all or whether the compression method was ssh_comp_none, and we can tell the latter just as well by the fact that its init function returns a null context pointer.
2018-07-10 20:27:43 +00:00
unsigned char **outblock, int *outlen)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
return 0;
}
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
const static struct ssh_compression_alg ssh_comp_none = {
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
"none", NULL,
The Zlib module now uses dynamically allocated contexts. I think that completes the static-removal in the crypto library. Ooh. [originally from svn r2136]
2002-10-25 13:26:33 +00:00
ssh_comp_none_init, ssh_comp_none_cleanup, ssh_comp_none_block,
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
ssh_decomp_none_init, ssh_decomp_none_cleanup, ssh_decomp_none_block,
Move password-packet padding into the BPP module. Now when we construct a packet containing sensitive data, we just set a field saying '... and make it take up at least this much space, to disguise its true size', and nothing in the rest of the system worries about that flag until ssh2bpp.c acts on it. Also, I've changed the strategy for doing the padding. Previously, we were following the real packet with an SSH_MSG_IGNORE to make up the size. But that was only a partial defence: it works OK against passive traffic analysis, but an attacker proxying the TCP stream and dribbling it out one byte at a time could still have found out the size of the real packet by noting when the dribbled data provoked a response. Now I put the SSH_MSG_IGNORE _first_, which should defeat that attack. But that in turn doesn't work when we're doing compression, because we can't predict the compressed sizes accurately enough to make that strategy sensible. Fortunately, compression provides an alternative strategy anyway: if we've got zlib turned on when we send one of these sensitive packets, then we can pad out the compressed zlib data as much as we like by adding empty RFC1951 blocks (effectively chaining ZLIB_PARTIAL_FLUSHes). So both strategies should now be dribble-proof.
2018-07-09 19:30:11 +00:00
NULL
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
};
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
const static struct ssh_compression_alg *const compressions[] = {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
&ssh_zlib, &ssh_comp_none
};
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
typedef void (*handler_fn_t)(Ssh ssh, PktIn *pktin);
typedef void (*chandler_fn_t)(Ssh ssh, PktIn *pktin, void *ctx);
typedef void (*cchandler_fn_t)(struct ssh_channel *, PktIn *, void *);
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
/*
* Each channel has a queue of outstanding CHANNEL_REQUESTS and their
* handlers.
*/
struct outstanding_channel_request {
cchandler_fn_t handler;
void *ctx;
struct outstanding_channel_request *next;
};
Pageant now accepts an initial key list on the command line [originally from svn r592]
2000-09-15 10:48:42 +00:00
/*
* 2-3-4 tree storing channels.
*/
struct ssh_channel {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Ssh ssh; /* pointer back to main context */
SSH2 is now more plausible - window sizes listened to, basic non-crashing [originally from svn r604]
2000-09-20 14:29:52 +00:00
unsigned remoteid, localid;
Pageant now accepts an initial key list on the command line [originally from svn r592]
2000-09-15 10:48:42 +00:00
int type;
Don't abuse a remote channel number of (unsigned)(-1) to indicate a channel for which we don't yet have a remote number, and instead add a flag to indicate this fact. Fixes bug ssh-remoteid-minusone. [originally from svn r5171]
2005-01-22 16:06:21 +00:00
/* True if we opened this channel but server hasn't confirmed. */
int halfopen;
Improvements to SSH1 channel close handling: track sending and receiving of CLOSE and CLOSE_CONFIRMATION separately rather than taking short cuts. I believe ssh-1.2.33 sending CLOSE_CONFIRMATION before CLOSE was causing the remaining incidences of bug `nonexistent-channel'. (ssh-1.2.33 appears to have unilaterally decreed that CLOSE and CLOSE_CONFIRMATION are respectively renamed INPUT_EOF and OUTPUT_CLOSING, hence there is no longer an ordering constraint on them. Bah.) [originally from svn r1961]
2002-09-15 13:24:00 +00:00
/*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* In SSH-1, this value contains four bits:
Improvements to SSH1 channel close handling: track sending and receiving of CLOSE and CLOSE_CONFIRMATION separately rather than taking short cuts. I believe ssh-1.2.33 sending CLOSE_CONFIRMATION before CLOSE was causing the remaining incidences of bug `nonexistent-channel'. (ssh-1.2.33 appears to have unilaterally decreed that CLOSE and CLOSE_CONFIRMATION are respectively renamed INPUT_EOF and OUTPUT_CLOSING, hence there is no longer an ordering constraint on them. Bah.) [originally from svn r1961]
2002-09-15 13:24:00 +00:00
*
* 1 We have sent SSH1_MSG_CHANNEL_CLOSE.
* 2 We have sent SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
* 4 We have received SSH1_MSG_CHANNEL_CLOSE.
* 8 We have received SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION.
*
* A channel is completely finished with when all four bits are set.
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
*
* In SSH-2, the four bits mean:
*
* 1 We have sent SSH2_MSG_CHANNEL_EOF.
* 2 We have sent SSH2_MSG_CHANNEL_CLOSE.
* 4 We have received SSH2_MSG_CHANNEL_EOF.
* 8 We have received SSH2_MSG_CHANNEL_CLOSE.
*
* A channel is completely finished with when we have both sent
* and received CLOSE.
*
* The symbolic constants below use the SSH-2 terminology, which
* is a bit confusing in SSH-1, but we have to use _something_.
Improvements to SSH1 channel close handling: track sending and receiving of CLOSE and CLOSE_CONFIRMATION separately rather than taking short cuts. I believe ssh-1.2.33 sending CLOSE_CONFIRMATION before CLOSE was causing the remaining incidences of bug `nonexistent-channel'. (ssh-1.2.33 appears to have unilaterally decreed that CLOSE and CLOSE_CONFIRMATION are respectively renamed INPUT_EOF and OUTPUT_CLOSING, hence there is no longer an ordering constraint on them. Bah.) [originally from svn r1961]
2002-09-15 13:24:00 +00:00
*/
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
#define CLOSES_SENT_EOF 1
#define CLOSES_SENT_CLOSE 2
#define CLOSES_RCVD_EOF 4
#define CLOSES_RCVD_CLOSE 8
Pageant now accepts an initial key list on the command line [originally from svn r592]
2000-09-15 10:48:42 +00:00
int closes;
Patch from Alan Ning (somewhat polished by me): introduce a flag called 'pending_close'. This deals with the situation in which we're forwarding a port, have received and locally buffered some data from the local endpoint but not yet been able to pass it down the SSH connection due to window limitations, and then the local endpoint closes its socket. In this situation what we've been doing until now is to immediately send SSH2_MSG_CHANNEL_CLOSE, causing the data still in our local buffer to be lost; now we instead set the new flag, which will remind us to send SSH2_MSG_CHANNEL_CLOSE _after_ we empty our bufchain. Should fix at least one manifestation of 'portfwd-close', though I don't know if it's the cause of all the reports we've ever seen. [originally from svn r8971]
2010-07-04 22:53:53 +00:00
/*
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
* This flag indicates that an EOF is pending on the outgoing side
* of the channel: that is, wherever we're getting the data for
* this channel has sent us some data followed by EOF. We can't
* actually send the EOF until we've finished sending the data, so
* we set this flag instead to remind us to do so once our buffer
* is clear.
Patch from Alan Ning (somewhat polished by me): introduce a flag called 'pending_close'. This deals with the situation in which we're forwarding a port, have received and locally buffered some data from the local endpoint but not yet been able to pass it down the SSH connection due to window limitations, and then the local endpoint closes its socket. In this situation what we've been doing until now is to immediately send SSH2_MSG_CHANNEL_CLOSE, causing the data still in our local buffer to be lost; now we instead set the new flag, which will remind us to send SSH2_MSG_CHANNEL_CLOSE _after_ we empty our bufchain. Should fix at least one manifestation of 'portfwd-close', though I don't know if it's the cause of all the reports we've ever seen. [originally from svn r8971]
2010-07-04 22:53:53 +00:00
*/
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
int pending_eof;
Patch from Alan Ning (somewhat polished by me): introduce a flag called 'pending_close'. This deals with the situation in which we're forwarding a port, have received and locally buffered some data from the local endpoint but not yet been able to pass it down the SSH connection due to window limitations, and then the local endpoint closes its socket. In this situation what we've been doing until now is to immediately send SSH2_MSG_CHANNEL_CLOSE, causing the data still in our local buffer to be lost; now we instead set the new flag, which will remind us to send SSH2_MSG_CHANNEL_CLOSE _after_ we empty our bufchain. Should fix at least one manifestation of 'portfwd-close', though I don't know if it's the cause of all the reports we've ever seen. [originally from svn r8971]
2010-07-04 22:53:53 +00:00
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
/*
* True if this channel is causing the underlying connection to be
* throttled.
*/
int throttling_conn;
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
/*
* True if we currently have backed-up data on the direction of
* this channel pointing out of the SSH connection, and therefore
* would prefer the 'Channel' implementation not to read further
* local input if possible.
*/
int throttled_by_backlog;
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
union {
struct ssh2_data_channel {
bufchain outbuffer;
unsigned remwindow, remmaxpkt;
Tweak to window handling: Keep the local window in a signed integer, and arrange to handle usefully the case where the server sends us more data than it's allowed to. There's no danger of overflow, since the maximum is OUR_V2_WINSIZE and the minimum is -OUR_V2_MAXPKT (at least if the server is nice). [originally from svn r7661]
2007-08-04 14:32:06 +00:00
/* locwindow is signed so we can cope with excess data. */
In the file-transfer applications, which only ever use the main channel, arrange to set the SSH-2 window size to something very large. This prevents the connection stalling when the window fills up, and means that PSCP receives data _much_ faster. [originally from svn r7672]
2007-08-04 22:14:19 +00:00
int locwindow, locmaxwin;
Add support for automatically tuning the SSH-2 window size for decent performance. The theory behind this is fairly simple, though the implementation turns out to be a little trickier than it looks. The basic idea is that when the connection isn't being limited by our ability to process data, we want to ensure that the window size _as seen by the server_ never drops to zero. Measuring the server's view of the window size is done by arranging for it to acknowledge every SSH_MSG_CHANNEL_WINDOW_ADJUST, or rather an SSH_MSG_CHANNEL_REQUEST sent just before it. That way we can tell when it its outgoing data stream it received the window adjustment, and thus how small the server's view of the window got. At present, we only ever increase the window size. In theory, we could arrange to reduce it again if the server's view of it seemed to be persistently too large, but my experiments suggest that getting this right will be tricky. [originally from svn r7735]
2007-09-24 15:18:11 +00:00
/*
* remlocwin is the amount of local window that we think
* the remote end had available to it after it sent the
* last data packet or window adjust ack.
*/
int remlocwin;
/*
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
* These store the list of channel requests that haven't
Add support for automatically tuning the SSH-2 window size for decent performance. The theory behind this is fairly simple, though the implementation turns out to be a little trickier than it looks. The basic idea is that when the connection isn't being limited by our ability to process data, we want to ensure that the window size _as seen by the server_ never drops to zero. Measuring the server's view of the window size is done by arranging for it to acknowledge every SSH_MSG_CHANNEL_WINDOW_ADJUST, or rather an SSH_MSG_CHANNEL_REQUEST sent just before it. That way we can tell when it its outgoing data stream it received the window adjustment, and thus how small the server's view of the window got. At present, we only ever increase the window size. In theory, we could arrange to reduce it again if the server's view of it seemed to be persistently too large, but my experiments suggest that getting this right will be tricky. [originally from svn r7735]
2007-09-24 15:18:11 +00:00
* been acked.
*/
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
struct outstanding_channel_request *chanreq_head, *chanreq_tail;
Add support for automatically tuning the SSH-2 window size for decent performance. The theory behind this is fairly simple, though the implementation turns out to be a little trickier than it looks. The basic idea is that when the connection isn't being limited by our ability to process data, we want to ensure that the window size _as seen by the server_ never drops to zero. Measuring the server's view of the window size is done by arranging for it to acknowledge every SSH_MSG_CHANNEL_WINDOW_ADJUST, or rather an SSH_MSG_CHANNEL_REQUEST sent just before it. That way we can tell when it its outgoing data stream it received the window adjustment, and thus how small the server's view of the window got. At present, we only ever increase the window size. In theory, we could arrange to reduce it again if the server's view of it seemed to be persistently too large, but my experiments suggest that getting this right will be tricky. [originally from svn r7735]
2007-09-24 15:18:11 +00:00
enum { THROTTLED, UNTHROTTLING, UNTHROTTLED } throttle_state;
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
} v2;
} v;
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
Expose structure tags for the connection-sharing data types. This was a particularly confusing piece of type-danger, because three different types were passed outside sshshare.c as 'void *' and only human vigilance prevented one coming back as the wrong one. Now they all keep their opaque structure tags when they move through other parts of the code.
2018-09-13 08:09:10 +00:00
ssh_sharing_connstate *sharectx; /* sharing context, if this is a
* downstream channel */
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
Channel *chan; /* handle the client side of this channel, if not */
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
SshChannel sc; /* entry point for chan to talk back to */
};
static int sshchannel_write(SshChannel *c, const void *buf, int len);
static void sshchannel_write_eof(SshChannel *c);
static void sshchannel_unclean_close(SshChannel *c, const char *err);
static void sshchannel_unthrottle(SshChannel *c, int bufsize);
static Conf *sshchannel_get_conf(SshChannel *c);
static void sshchannel_window_override_removed(SshChannel *c);
static void sshchannel_x11_sharing_handover(
SshChannel *c, ssh_sharing_connstate *share_cs, share_channel *share_chan,
const char *peer_addr, int peer_port, int endian,
int protomajor, int protominor, const void *initial_data, int initial_len);
const struct SshChannelVtable sshchannel_vtable = {
sshchannel_write,
sshchannel_write_eof,
sshchannel_unclean_close,
sshchannel_unthrottle,
sshchannel_get_conf,
sshchannel_window_override_removed,
sshchannel_x11_sharing_handover,
Pageant now accepts an initial key list on the command line [originally from svn r592]
2000-09-15 10:48:42 +00:00
};
Minor restructuring to ssh.c in preparation for portability drive [originally from svn r649]
2000-09-29 08:43:47 +00:00
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
/*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* 2-3-4 tree storing remote->local port forwardings. SSH-1 and SSH-2
* use this structure in different ways, reflecting SSH-2's
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
* altogether saner approach to port forwarding.
*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* In SSH-1, you arrange a remote forwarding by sending the server
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
* the remote port number, and the local destination host:port.
* When a connection comes in, the server sends you back that
* host:port pair, and you connect to it. This is a ready-made
* security hole if you're not on the ball: a malicious server
* could send you back _any_ host:port pair, so if you trustingly
* connect to the address it gives you then you've just opened the
* entire inside of your corporate network just by connecting
* through it to a dodgy SSH server. Hence, we must store a list of
* host:port pairs we _are_ trying to forward to, and reject a
* connection request from the server if it's not in the list.
*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* In SSH-2, each side of the connection minds its own business and
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
* doesn't send unnecessary information to the other. You arrange a
* remote forwarding by sending the server just the remote port
* number. When a connection comes in, the server tells you which
* of its ports was connected to; and _you_ have to remember what
* local host:port pair went with that port number.
*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* Hence, in SSH-1 this structure is indexed by destination
* host:port pair, whereas in SSH-2 it is indexed by source port.
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
*/
SSH port forwarding is now configurable in mid-session. After doing Change Settings, the port forwarding setup function is run again, and tags all existing port forwardings as `do not keep'. Then it iterates through the config in the normal way; when it encounters a port forwarding which is already in the tree, it tags it `keep' rather than setting it up from scratch. Finally, it goes through the tree and removes any that haven't been labelled `keep'. Hence, editing the list of forwardings in Change Settings has the effect of cancelling any forwardings you remove, and adding any new ones. The SSH panel now appears in the reconfig box, and is empty apart from a message explaining that it has to be there for subpanels of it to exist. Better wording for this message would be welcome. [originally from svn r5030]
2004-12-28 14:07:05 +00:00
struct ssh_portfwd; /* forward declaration */
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
struct ssh_rportfwd {
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
unsigned sport, dport;
Clean up the semantics of the ssh_rportfwd structure. It's now indexed by source hostname as well as source port (so that separate requests for the server to listen on addr1:1234 and addr2:1234 can be disambiguated), and also its destination host name is dynamically allocated rather than a fixed-size buffer. [originally from svn r10062]
2013-11-17 14:03:21 +00:00
char *shost, *dhost;
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
int addressfamily;
char *log_description; /* name of remote listening port, for logging */
Expose structure tags for the connection-sharing data types. This was a particularly confusing piece of type-danger, because three different types were passed outside sshshare.c as 'void *' and only human vigilance prevented one coming back as the wrong one. Now they all keep their opaque structure tags when they move through other parts of the code.
2018-09-13 08:09:10 +00:00
ssh_sharing_connstate *share_ctx;
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
PortFwdRecord *pfr;
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
};
Clean up the semantics of the ssh_rportfwd structure. It's now indexed by source hostname as well as source port (so that separate requests for the server to listen on addr1:1234 and addr2:1234 can be disambiguated), and also its destination host name is dynamically allocated rather than a fixed-size buffer. [originally from svn r10062]
2013-11-17 14:03:21 +00:00
static void free_rportfwd(struct ssh_rportfwd *pf)
{
if (pf) {
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
sfree(pf->log_description);
Clean up the semantics of the ssh_rportfwd structure. It's now indexed by source hostname as well as source port (so that separate requests for the server to listen on addr1:1234 and addr2:1234 can be disambiguated), and also its destination host name is dynamically allocated rather than a fixed-size buffer. [originally from svn r10062]
2013-11-17 14:03:21 +00:00
sfree(pf->shost);
sfree(pf->dhost);
sfree(pf);
}
}
SSH port forwarding is now configurable in mid-session. After doing Change Settings, the port forwarding setup function is run again, and tags all existing port forwardings as `do not keep'. Then it iterates through the config in the normal way; when it encounters a port forwarding which is already in the tree, it tags it `keep' rather than setting it up from scratch. Finally, it goes through the tree and removes any that haven't been labelled `keep'. Hence, editing the list of forwardings in Change Settings has the effect of cancelling any forwardings you remove, and adding any new ones. The SSH panel now appears in the reconfig box, and is empty apart from a message explaining that it has to be there for subpanels of it to exist. Better wording for this message would be welcome. [originally from svn r5030]
2004-12-28 14:07:05 +00:00
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
static void ssh1_protocol_setup(Ssh ssh);
static void ssh2_protocol_setup(Ssh ssh);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
static void ssh2_bare_connection_protocol_setup(Ssh ssh);
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static void ssh_size(Backend *be, int width, int height);
static void ssh_special(Backend *be, Telnet_Special);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
static int ssh2_try_send(struct ssh_channel *c);
Shared ssh_send_channel_data for both SSH-1 and SSH-2. Saves duplication between agent and port forwarding code. Conflicts: ssh.c
2016-04-23 14:51:45 +00:00
static int ssh_send_channel_data(struct ssh_channel *c,
const char *buf, int len);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
static void ssh_throttle_all(Ssh ssh, int enable, int bufsize);
Use "int" rather than "unsigned" as the argument to ssh2_set_window, not because it can ever be negative, but because we'll be comparing it with another int. This way, C's promotion rules don't bite us and we should stand slightly more chance of coping with broken servers that overrun our window. [originally from svn r7683]
2007-08-06 20:56:52 +00:00
static void ssh2_set_window(struct ssh_channel *c, int newwin);
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static int ssh_sendbuffer(Backend *be);
Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. [originally from svn r5098] [this svn revision also touched putty-wishlist]
2005-01-11 19:33:41 +00:00
static int ssh_do_close(Ssh ssh, int notify_exit);
Two related changes to timing code: First, make absolute times unsigned. This means that it's safe to depend on their overflow behaviour (which is undefined for signed integers). This requires a little extra care in handling comparisons, but I think I've correctly adjusted them all. Second, functions registered with schedule_timer() are guaranteed to be called with precisely the time that was returned by schedule_timer(). Thus, it's only necessary to check these values for equality rather than doing risky range checks, so do that. The timing code still does lots that's undefined, unnecessary, or just wrong, but this is a good start. [originally from svn r9667]
2012-09-18 21:42:48 +00:00
static void ssh2_timer(void *ctx, unsigned long now);
Factor out ssh2_timer_update. This is a preliminary refactoring for an upcoming change which will need to affect every use of schedule_timer to wait for the next rekey: those calls to schedule_timer are now centralised into a function that does an organised piece of thinking about when the next timer should be. A side effect of this change is that the translation from CONF_ssh_rekey_time to an actual tick count is now better proofed against integer overflow (just in case the user entered a completely silly value).
2018-04-14 13:48:02 +00:00
static int ssh2_timer_update(Ssh ssh, unsigned long rekey_time);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
Reduce verbosity of 'GSS init sec context failed' message. Now we don't generate that message as a side effect of the periodic check for new GSS credentials; we only generate it as part of the much larger slew of messages that happen during a rekey.
2018-05-01 17:54:04 +00:00
static void ssh2_gss_update(Ssh ssh, int definitely_rekeying);
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static PktOut *ssh2_gss_authpacket(Ssh ssh, Ssh_gss_ctx gss_ctx,
const char *authtype);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#endif
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_unexpected(Ssh ssh, PktIn *pktin);
ssh.c: new data type 'struct PacketQueue'. This is just a linked list of 'struct Packet' with a convenience API on the front. As yet it's unused, so ssh.c will currently not compile with gcc -Werror unless you also add -Wno-unused-function. But all the functions I've added here will be used in later commits in the current patch series, so that's only a temporary condition.
2018-05-18 06:22:56 +00:00
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
struct queued_handler;
struct queued_handler {
int msg1, msg2;
chandler_fn_t handler;
void *ctx;
struct queued_handler *next;
};
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
/*
* Enumeration of high-level classes of reason why we might need to do
* a repeat key exchange. The full detailed reason in human-readable
* form for the Event Log is kept in ssh->rekey_reason, but
* ssh->rekey_class is a variable with this enum type which is used to
* discriminate between classes of reason that the code needs to treat
* differently.
*
Fix constant rekeying. Another piece of fallout from this morning's patch series, which I didn't notice until I left a session running for more than an hour: once do_ssh2_transport is told to begin a rekey, it has no way of knowing _not_ to immediately do another one, and another, and so on. Added a value RK_NONE to the rekey class enumeration, and set rekey_class to that immediately after a key exchange completes. Then a new one won't start until some code actually sets rekey_class to a nonzero value again.
2018-05-18 12:46:36 +00:00
* RK_NONE == 0 is the value indicating that no rekey is currently
* needed at all. RK_INITIAL indicates that we haven't even done the
* _first_ key exchange yet. RK_NORMAL is the usual case.
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
* RK_GSS_UPDATE indicates that we're rekeying because we've just got
* new GSSAPI credentials (hence there's no point in doing a
* preliminary check for new GSS creds, because we already know the
* answer); RK_POST_USERAUTH indicates that _if_ we're going to need a
* post-userauth immediate rekey for any reason, this is the moment to
* do it.
*
* So RK_POST_USERAUTH only tells the transport layer to _consider_
* rekeying, not to definitely do it. Also, that one enum value is
* special in that do_ssh2_transport fills in the reason text after it
* decides whether it needs a rekey at all. In the other cases,
* rekey_reason is set up at the same time as rekey_class.
*/
Fix constant rekeying. Another piece of fallout from this morning's patch series, which I didn't notice until I left a session running for more than an hour: once do_ssh2_transport is told to begin a rekey, it has no way of knowing _not_ to immediately do another one, and another, and so on. Added a value RK_NONE to the rekey class enumeration, and set rekey_class to that immediately after a key exchange completes. Then a new one won't start until some code actually sets rekey_class to a nonzero value again.
2018-05-18 12:46:36 +00:00
enum RekeyClass {
RK_NONE = 0,
RK_INITIAL,
RK_NORMAL,
RK_POST_USERAUTH,
RK_GSS_UPDATE
};
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
struct ssh_tag {
Beginnings of support for multiple exchange hashes in SSH-2: rather than storing a SHA-1 hash of the client and server version strings, store the strings themselves so we can feed them through the appropriate hash when we know what it is. [originally from svn r6241]
2005-08-30 20:38:57 +00:00
char *v_c, *v_s;
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
struct ssh_version_receiver version_receiver;
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
ssh_hash *exhash;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Socket s;
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
const Plug_vtable *plugvt;
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Backend backend;
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
Expose the Ldisc structure tag throughout the code. That's one fewer anonymous 'void *' which might be accidentally confused with some other pointer type if I misremember the order of function arguments. While I'm here, I've made its pointer-nature explicit - that is, 'Ldisc' is now a typedef for the structure type itself rather than a pointer to it. A stylistic change only, but it feels more natural to me these days for a thing you're going to eventually pass to a 'free' function.
2018-09-11 14:02:59 +00:00
Ldisc *ldisc;
Make 'LogContext' a typedef visible throughout the code. Same principle again - the more of these structures have globally visible tags (even if the structure contents are still opaque in most places), the fewer of them I can mistake for each other.
2018-09-11 14:17:16 +00:00
LogContext *logctx;
Line discipline module now uses dynamically allocated data. Also fixed one or two other minor problems. [originally from svn r2141]
2002-10-26 10:16:19 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
unsigned char session_key[32];
int v1_remote_protoflags;
int v1_local_protoflags;
int agentfwd_enabled;
int X11_fwd_enabled;
int remote_bugs;
const struct ssh_kex *kex;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
const ssh_keyalg *hostkey_alg;
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
char *hostkey_str; /* string representation, for easy checking in rekeys */
Dimitry Andric spotted that DH gex with SHA-256 was overflowing a buffer. Fixed, and added paranoia so that this shouldn't happen again. [originally from svn r6606] [this svn revision also touched putty-wishlist]
2006-03-12 19:24:05 +00:00
unsigned char v2_session_id[SSH2_KEX_MAX_HASH_LEN];
Add infrastructure for supporting multiple hashes in key exchange. Nothing very surprising here. [originally from svn r6251]
2005-08-31 20:43:06 +00:00
int v2_session_id_len;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
int v2_cbc_ignore_workaround;
int v2_out_cipherblksize;
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
struct dh_ctx *dh_ctx;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
int bare_connection;
int attempting_connshare;
Expose structure tags for the connection-sharing data types. This was a particularly confusing piece of type-danger, because three different types were passed outside sshshare.c as 'void *' and only human vigilance prevented one coming back as the wrong one. Now they all keep their opaque structure tags when they move through other parts of the code.
2018-09-13 08:09:10 +00:00
ssh_sharing_state *connshare;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
char *savedhost;
int savedport;
int send_ok;
int echoing, editing;
Option to log proxy setup diagnostics to the terminal. It has three settings: on, off, and 'only until session starts'. The idea of the last one is that if you use something like 'ssh -v' as your proxy command, you probably wanted to see the initial SSH connection-setup messages while you were waiting to see if the connection would be set up successfully at all, but probably _didn't_ want a slew of diagnostics from rekeys disrupting your terminal in mid-emacs once the session had got properly under way. Default is off, to avoid startling people used to the old behaviour. I wonder if I should have set it more aggressively, though.
2015-11-22 14:33:28 +00:00
int session_started;
Introduce a typedef for frontend handles. This is another major source of unexplained 'void *' parameters throughout the code. In particular, the currently unused testback.c actually gave the wrong pointer type to its internal store of the frontend handle - it cast the input void * to a Terminal *, from which it got implicitly cast back again when calling from_backend, and nobody noticed. Now it uses the right type internally as well as externally.
2018-09-12 08:10:51 +00:00
Frontend *frontend;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Spotted by Dimitry Andric: `ssh-termspeed' implementation was not taking account of coroutines and used local variables over a crFoo. I believe the impact was cosmetic, affecting the speeds reported in the Event Log only. I've put the variables `ispeed' and `ospeed' in the main ssh_tag structure, even though they're only live for a short duration; I did this rather than create a new state struct for ssh1_protocol() (since ssh_tag already has short-duration junk like portfwd_strptr). [originally from svn r4272]
2004-06-03 10:36:27 +00:00
int ospeed, ispeed; /* temporaries */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int term_width, term_height;
tree234 *channels; /* indexed by local id */
struct ssh_channel *mainchan; /* primary session channel */
New command-line option in Plink (and PuTTY, though it's less useful there): `plink host -nc host2:port' causes the SSH connection's main channel to be replaced with a direct-tcpip connection to the specified destination. This feature is mainly designed for use as a local proxy: setting your local proxy command to `plink %proxyhost -nc %host:%port' lets you tunnel SSH over SSH with a minimum of fuss. Works on all platforms. [originally from svn r6823]
2006-08-28 15:12:37 +00:00
int ncmode; /* is primary channel direct-tcpip? */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int exitcode;
Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. [originally from svn r5098] [this svn revision also touched putty-wishlist]
2005-01-11 19:33:41 +00:00
int close_expected;
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
int clean_exit;
Try harder not to call connection_fatal twice. If the server sends an SSH_MSG_DISCONNECT, then we call connection_fatal(). But if the server closes the network connection, then we call connection_fatal(). In situations where the former happens, the latter happens too. Currently, calling connection_fatal twice is especially bad on GTK because all dialogs are now non-modal and an assertion fails in the GTK front end when two fatal message boxes try to exist at the same time (the register_dialog system finds that slot is already occupied). But regardless of that, we'd rather not even _try_ to print two fatal boxes, because even if the front end doesn't fail an assertion, there's no guarantee that the _more useful_ one of the messages will end up being displayed. So a better fix is to have ssh.c make a sensible decision about which message is the helpful one - in this case, the actual error message out of the SSH_MSG_DISCONNECT, rather than the predictable fact of the connection having been slammed shut immediately afterwards - and only pass that one to the front end in the first place.
2018-06-03 05:46:28 +00:00
int disconnect_message_seen;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
tree234 *rportfwds;
PortFwdManager *portfwdmgr;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
ConnectionLayer cl;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
enum {
SSH_STATE_PREPACKET,
SSH_STATE_BEFORE_SIZE,
SSH_STATE_INTERMED,
SSH_STATE_SESSION,
SSH_STATE_CLOSED
} state;
int size_needed, eof_needed;
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
int sent_console_eof;
Changed my mind about the EOF policy in SSH mode: I think the SSH backend should unilaterally assume outgoing EOF when it sees incoming EOF, if and only if the main session channel is talking to a pty. (Because ptys don't have a strong concept of EOF in the first place, that seems like a sensible place to draw the line.) This fixes a bug introduced by today's revamp in which if you used Unix Plink to run a console session it would hang after you hit ^D - because the server had sent EOF, but it was waiting for a client-side EOF too. [originally from svn r9282]
2011-09-13 15:38:12 +00:00
int got_pty; /* affects EOF behaviour on main channel */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
PktOutQueue outq;
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
int queueing;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
/*
* Gross hack: pscp will try to start SFTP but fall back to
* scp1 if that fails. This variable is the means by which
* scp.c can reach into the SSH code and find out which one it
* got.
*/
int fallback_cmd;
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
bufchain banner; /* accumulates banners during do_ssh2_userauth */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Revamp of the local X11 connection code. We now parse X display strings more rigorously, and then we look up the local X authority data in .Xauthority _ourself_ rather than delegating to an external xauth program. This is (negligibly) more efficient on Unix, assuming I haven't got it wrong in some subtle way, but its major benefit is that we can now support X authority lookups on Windows as well provided the user points us at an appropriate X authority file in the standard format. A new Windows-specific config option has been added for this purpose. [originally from svn r8305]
2008-11-17 18:38:09 +00:00
struct X11Display *x11disp;
Prepare to have multiple X11 auth cookies valid at once. Rather than the top-level component of X forwarding being an X11Display structure which owns some auth data, it's now a collection of X11FakeAuth structures, each of which owns a display. The idea is that when we receive an X connection, we wait to see which of our available auth cookies it matches, and then connect to whatever X display that auth cookie identifies. At present the tree will only have one thing in it; this is all groundwork for later changes. [originally from svn r10079]
2013-11-17 14:05:10 +00:00
struct X11FakeAuth *x11auth;
tree234 *x11authtree;
X forwarding authentication is now invented on a per-SSH-connection basis, so the statics are gone from x11fwd.c. [originally from svn r2145]
2002-10-26 11:23:15 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int version;
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
int conn_throttle_count;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int overall_bufsize;
int throttled_all;
int v1_stdout_throttling;
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
int do_ssh1_connection_crstate;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
void *do_ssh_init_state;
void *do_ssh1_login_state;
void *do_ssh2_transport_state;
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
void *do_ssh2_userauth_state;
void *do_ssh2_connection_state;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
void *do_ssh_connection_init_state;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
bufchain incoming_data;
struct IdempotentCallback incoming_data_consumer;
int incoming_data_seen_eof;
char *incoming_data_eof_message;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
PktInQueue pq_full;
Make the rdpkt functions output to a PacketQueue. Each of the coroutines that parses the incoming wire data into a stream of 'struct Packet' now delivers those packets to a PacketQueue called ssh->pq_full (containing the full, unfiltered stream of all packets received on the SSH connection), replacing the old API in which each coroutine would directly return a 'struct Packet *' to its caller, or NULL if it didn't have one ready yet. This simplifies the function-call API of the rdpkt coroutines (they now return void). It increases the complexity at the other end, because we've now got a function ssh_process_pq_full (scheduled as an idempotent callback whenever rdpkt appends anything to the queue) which pulls things out of the queue and passes them to ssh->protocol. But that's only a temporary complexity increase; by the time I finish the upcoming stream of refactorings, there won't be two chained functions there any more. One small workaround I had to add in this commit is a flag called 'pending_newkeys', which ssh2_rdpkt sets when it's just returned an SSH_MSG_NEWKEYS packet, and then waits for the transport layer to process the NEWKEYS and set up the new encryption context before processing any more wire data. This wasn't necessary before, because the old architecture was naturally synchronous - ssh2_rdpkt would return a NEWKEYS, which would be immediately passed to do_ssh2_transport, which would finish processing it immediately, and by the time ssh2_rdpkt was next called, the keys would already be in place. This change adds a big while loop around the whole of each rdpkt function, so it's easiest to read it as a whitespace-ignored diff.
2018-05-18 06:22:57 +00:00
struct IdempotentCallback pq_full_consumer;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
PktInQueue pq_ssh1_login;
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
struct IdempotentCallback ssh1_login_icb;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
PktInQueue pq_ssh1_connection;
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
struct IdempotentCallback ssh1_connection_icb;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
PktInQueue pq_ssh2_transport;
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
struct IdempotentCallback ssh2_transport_icb;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
PktInQueue pq_ssh2_userauth;
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
struct IdempotentCallback ssh2_userauth_icb;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
PktInQueue pq_ssh2_connection;
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
struct IdempotentCallback ssh2_connection_icb;
do_ssh2_authconn: get packets from a PacketQueue. Just like do_ssh1_login, do_ssh2_authconn is now no longer receiving its packets via function arguments; instead, it's pulling them off a dedicated PacketQueue populated by particular dispatch table entries, with the same reference-counting system to stop them being freed when the pq_full processing function regains control. This eliminates further ugly bombout()s from the code while waiting for authentication responses from the user or the SSH agent. As I mentioned in the previous commit, I've had to keep ssh2_authconn_input separate from do_ssh2_authconn, and this time the reason why is thoroughly annoying: it's because do_ssh2_authconn has changed its prototype to take the Ssh structure as a void * so that it can be called from the idempotent callback system, whereas ssh2_authconn_input has to have the type of ssh->current_user_input_fn which takes the more sensible pointer type 'Ssh'.
2018-05-18 06:22:58 +00:00
Put all user input into a bufchain. This change introduces a new bufchain ssh->user_input, into which we put every byte received via back->send() (i.e. keyboard input from the GUI PuTTY window, data read by Plink from standard input, or outgoing SCP/SFTP protocol data made up by the file transfer utilities). Just like ssh->incoming_data, there's also a function pointer ssh->current_user_input_fn which says who currently has responsibility for pulling data back off that bufchain and processing it. So that can be changed over when the connection moves into a different major phase. At the moment, nothing very interesting is being done with this bufchain: each phase of the connection has its own little function that pulls chunks back out of it with bufchain_prefix and passes them to the unchanged main protocol coroutines. But this is groundwork for being able to switch over each of those coroutines in turn to read directly from ssh->user_input, with the aim of eliminating a collection of annoying bugs in which typed-ahead data is accidentally discarded at an SSH phase transition.
2018-05-18 06:22:58 +00:00
bufchain user_input;
struct IdempotentCallback user_input_consumer;
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
bufchain outgoing_data;
struct IdempotentCallback outgoing_data_sender;
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
const char *rekey_reason;
enum RekeyClass rekey_class;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
PacketLogSettings pls;
BinaryPacketProtocol *bpp;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
void (*general_packet_processing)(Ssh ssh, PktIn *pkt);
Put all user input into a bufchain. This change introduces a new bufchain ssh->user_input, into which we put every byte received via back->send() (i.e. keyboard input from the GUI PuTTY window, data read by Plink from standard input, or outgoing SCP/SFTP protocol data made up by the file transfer utilities). Just like ssh->incoming_data, there's also a function pointer ssh->current_user_input_fn which says who currently has responsibility for pulling data back off that bufchain and processing it. So that can be changed over when the connection moves into a different major phase. At the moment, nothing very interesting is being done with this bufchain: each phase of the connection has its own little function that pulls chunks back out of it with bufchain_prefix and passes them to the unchanged main protocol coroutines. But this is groundwork for being able to switch over each of those coroutines in turn to read directly from ssh->user_input, with the aim of eliminating a collection of annoying bugs in which typed-ahead data is accidentally discarded at an SSH phase transition.
2018-05-18 06:22:58 +00:00
void (*current_user_input_fn) (Ssh ssh);
The back ends now contain their own copies of the Config structure, and have a function to pass in a new one. (Well, actually several back ends don't actually bother to do this because they need nothing out of Config after the initial setup phase, but they could if they wanted to.) [originally from svn r2561]
2003-01-12 14:48:29 +00:00
/*
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
* We maintain our own copy of a Conf structure here. That way,
* when we're passed a new one for reconfiguration, we can check
* the differences and potentially reconfigure port forwardings
* etc in mid-session.
The back ends now contain their own copies of the Config structure, and have a function to pass in a new one. (Well, actually several back ends don't actually bother to do this because they need nothing out of Config after the initial setup phase, but they could if they wanted to.) [originally from svn r2561]
2003-01-12 14:48:29 +00:00
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
Conf *conf;
/*
* Dynamically allocated username string created during SSH
* login. Stored in here rather than in the coroutine state so
* that it'll be reliably freed if we shut down the SSH session
* at some unexpected moment.
*/
char *username;
First half of `pageant-async' work. agent_query() is now passed a callback function; it may return 0 to indicate that it doesn't have an answer _yet_, in which case it will call the callback later on when it does, or it may return 1 to indicate that it's got an answer right now. The Windows agent_query() implementation is functionally unchanged and still synchronous, but the Unix one is async (since that one was really easy to do via uxsel). ssh.c copes cheerfully with either return value, so other ports are at liberty to be sync or async as they choose. [originally from svn r3153]
2003-04-28 11:41:39 +00:00
/*
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
* Used to transfer data back from async callbacks.
First half of `pageant-async' work. agent_query() is now passed a callback function; it may return 0 to indicate that it doesn't have an answer _yet_, in which case it will call the callback later on when it does, or it may return 1 to indicate that it's got an answer right now. The Windows agent_query() implementation is functionally unchanged and still synchronous, but the Unix one is async (since that one was really easy to do via uxsel). ssh.c copes cheerfully with either return value, so other ports are at liberty to be sync or async as they choose. [originally from svn r3153]
2003-04-28 11:41:39 +00:00
*/
void *agent_response;
int agent_response_len;
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
int user_response;
/*
* The SSH connection can be set as `frozen', meaning we are
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
* not currently accepting incoming data from the network.
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
*/
int frozen;
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
/*
* Dispatch table for packet types that we may have to deal
* with at any time.
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
handler_fn_t packet_dispatch[SSH_MAX_MSG];
New timing infrastructure. There's a new function schedule_timer() which pretty much any module can call to request a call-back in the future. So terminal.c can do its own handling of blinking, visual bells and deferred screen updates, without having to rely on term_update() being called 50 times a second (fixes: pterm-timer); and ssh.c and telnet.c both invoke a new module pinger.c which takes care of sending keepalives, so they get sent uniformly in all front ends (fixes: plink-keepalives, unix-keepalives). [originally from svn r4906] [this svn revision also touched putty-wishlist]
2004-11-27 13:20:21 +00:00
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
/*
* Queues of one-off handler functions for success/failure
* indications from a request.
*/
struct queued_handler *qhead, *qtail;
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
handler_fn_t q_saved_handler1, q_saved_handler2;
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
New timing infrastructure. There's a new function schedule_timer() which pretty much any module can call to request a call-back in the future. So terminal.c can do its own handling of blinking, visual bells and deferred screen updates, without having to rely on term_update() being called 50 times a second (fixes: pterm-timer); and ssh.c and telnet.c both invoke a new module pinger.c which takes care of sending keepalives, so they get sent uniformly in all front ends (fixes: plink-keepalives, unix-keepalives). [originally from svn r4906] [this svn revision also touched putty-wishlist]
2004-11-27 13:20:21 +00:00
/*
* This module deals with sending keepalives.
*/
Pinger pinger;
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
/*
* Track incoming and outgoing data sizes and time, for
* size-based rekeys.
*/
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
unsigned long incoming_data_size, outgoing_data_size;
Basic configurability for client-initiated rekeys. [originally from svn r5027]
2004-12-24 13:39:32 +00:00
unsigned long max_data_size;
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
int kex_in_progress;
Two related changes to timing code: First, make absolute times unsigned. This means that it's safe to depend on their overflow behaviour (which is undefined for signed integers). This requires a little extra care in handling comparisons, but I think I've correctly adjusted them all. Second, functions registered with schedule_timer() are guaranteed to be called with precisely the time that was returned by schedule_timer(). Thus, it's only necessary to check these values for equality rather than doing risky range checks, so do that. The timing code still does lots that's undefined, unnecessary, or just wrong, but this is a good start. [originally from svn r9667]
2012-09-18 21:42:48 +00:00
unsigned long next_rekey, last_rekey;
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
const char *deferred_rekey_reason;
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
/*
* Fully qualified host name, which we need if doing GSSAPI.
*/
char *fullhostname;
Cleanups of the GSSAPI support. On Windows, standard GSS libraries are now loaded from standard locations (system32 for SSPI, the registry-stored MIT KfW install location for KfW) rather than using the risky default DLL search path; I've therefore also added an option to manually specify a GSS DLL we haven't heard of (which should in principle Just Work provided it supports proper GSS-API as specified in the RFC). The same option exists on Unix too, because it seemed like too useful an idea to reserve to Windows. In addition, GSSAPI is now documented, and also (unfortunately) its GUI configuration has been moved out into a sub-subpanel on the grounds that it was too big to fit in Auth. [originally from svn r9003]
2010-09-25 07:16:56 +00:00
#ifndef NO_GSSAPI
/*
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
* GSSAPI libraries for this session. We need them at key exchange
* and userauth time.
*
* And the gss_ctx we setup at initial key exchange will be used
* during gssapi-keyex userauth time as well.
Cleanups of the GSSAPI support. On Windows, standard GSS libraries are now loaded from standard locations (system32 for SSPI, the registry-stored MIT KfW install location for KfW) rather than using the risky default DLL search path; I've therefore also added an option to manually specify a GSS DLL we haven't heard of (which should in principle Just Work provided it supports proper GSS-API as specified in the RFC). The same option exists on Unix too, because it seemed like too useful an idea to reserve to Windows. In addition, GSSAPI is now documented, and also (unfortunately) its GUI configuration has been moved out into a sub-subpanel on the grounds that it was too big to fit in Auth. [originally from svn r9003]
2010-09-25 07:16:56 +00:00
*/
struct ssh_gss_liblist *gsslibs;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
struct ssh_gss_library *gsslib;
int gss_status;
time_t gss_cred_expiry; /* Re-delegate if newer */
unsigned long gss_ctxt_lifetime; /* Re-delegate when short */
Ssh_gss_name gss_srv_name; /* Cached for KEXGSS */
Ssh_gss_ctx gss_ctx; /* Saved for gssapi-keyex */
tree234 *transient_hostkey_cache;
Cleanups of the GSSAPI support. On Windows, standard GSS libraries are now loaded from standard locations (system32 for SSPI, the registry-stored MIT KfW install location for KfW) rather than using the risky default DLL search path; I've therefore also added an option to manually specify a GSS DLL we haven't heard of (which should in principle Just Work provided it supports proper GSS-API as specified in the RFC). The same option exists on Unix too, because it seemed like too useful an idea to reserve to Windows. In addition, GSSAPI is now documented, and also (unfortunately) its GUI configuration has been moved out into a sub-subpanel on the grounds that it was too big to fit in Auth. [originally from svn r9003]
2010-09-25 07:16:56 +00:00
#endif
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
int gss_kex_used; /* outside ifdef; always FALSE if NO_GSSAPI */
Allocate the SSH specials list dynamically. The last list we returned is now stored in the main Ssh structure rather than being a static array in ssh_get_specials. The main point of this is that I want to start adding more dynamic things to it, for which I can't predict the array's max length in advance. But also this fixes a conceptual wrongness, in that if a process had more than one Ssh instance in it then their specials arrays would have taken turns occupying the old static array, and although the current single-threaded client code in the GUI front ends wouldn't have minded (it would have read out the contents just once immediately after get_specials returned), it still feels as if it was a bug waiting to happen.
2016-03-21 06:50:50 +00:00
/*
* The last list returned from get_specials.
*/
struct telnet_special *specials;
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
/*
* List of host key algorithms for which we _don't_ have a stored
* host key. These are indices into the main hostkey_algs[] array
*/
int uncert_hostkeys[lenof(hostkey_algs)];
int n_uncert_hostkeys;
/*
* Flag indicating that the current rekey is intended to finish
* with a newly cross-certified host key.
*/
int cross_certifying;
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
/*
* Any asynchronous query to our SSH agent that we might have in
* flight from the main authentication loop. (Queries from
* agent-forwarding channels live in their channel structure.)
*/
agent_pending_query *auth_agent_query;
Avoid duplicate random_unref on freeing an Ssh. If ssh_init encounters a synchronous error, it will call random_unref before returning. But the Ssh structure it created will still exist, and if the caller (sensibly) responds by freeing it, then that will cause a second random_unref, leading to the RNG's refcount going below zero and failing an assertion. We never noticed this before because with only one PuTTY connection per process it was easier to just exit(1) without bothering to clean things up. Now, with all the multi-sessions-per-process fixes I'm doing, this has shown up as a problem. But other front ends may legitimately still just exit - I don't think I can sensibly enforce _not_ doing so at this late stage - so I've had to arrange to set a flag in the Ssh saying whether a random_unref is still pending or not.
2017-11-27 19:29:47 +00:00
int need_random_unref;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
};
Further restructuring [originally from svn r657]
2000-09-29 15:56:33 +00:00
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
static const char *ssh_pkt_type(Ssh ssh, int type)
{
if (ssh->version == 1)
return ssh1_pkt_type(type);
else
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
return ssh2_pkt_type(ssh->pls.kctx, ssh->pls.actx, type);
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
}
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
Frontend *ssh_get_frontend(Ssh ssh)
{
return ssh->frontend;
}
Move the stderr output of event log messages in verbose mode to the general logging module rather than localising it in ssh.c. This means it should work in other protocols as well (notably Telnet, where it might actually be useful for debugging negotiations). [originally from svn r2360]
2002-12-19 14:24:28 +00:00
#define logevent(s) logevent(ssh->frontend, s)
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
/* logevent, only printf-formatted. */
Colin's const-fixing Patch Of Death. Seems to build fine on Windows as well as Unix, so it can go in. [originally from svn r3162]
2003-05-04 14:18:18 +00:00
static void logeventf(Ssh ssh, const char *fmt, ...)
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
{
va_list ap;
Robustness fixes for KEXINIT handling and others. In particular, I've created a self-mallocing variant of sprintf, to obviate any future need for paranoid %.100s type stuff in format strings. [originally from svn r2199]
2002-11-07 19:49:03 +00:00
char *buf;
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
va_start(ap, fmt);
Robustness fixes for KEXINIT handling and others. In particular, I've created a self-mallocing variant of sprintf, to obviate any future need for paranoid %.100s type stuff in format strings. [originally from svn r2199]
2002-11-07 19:49:03 +00:00
buf = dupvprintf(fmt, ap);
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
va_end(ap);
Robustness fixes for KEXINIT handling and others. In particular, I've created a self-mallocing variant of sprintf, to obviate any future need for paranoid %.100s type stuff in format strings. [originally from svn r2199]
2002-11-07 19:49:03 +00:00
logevent(buf);
sfree(buf);
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
}
Make bombout() less of a macro and more of a function. This gives GCC slightly fewer opportunities to gratuitously inflate its output. [originally from svn r9634]
2012-08-27 21:55:45 +00:00
static void bomb_out(Ssh ssh, char *text)
{
ssh_do_close(ssh, FALSE);
logevent(text);
connection_fatal(ssh->frontend, "%s", text);
sfree(text);
}
#define bombout(msg) bomb_out(ssh, dupprintf msg)
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
static int ssh_channelcmp(void *av, void *bv)
{
struct ssh_channel *a = (struct ssh_channel *) av;
struct ssh_channel *b = (struct ssh_channel *) bv;
if (a->localid < b->localid)
return -1;
if (a->localid > b->localid)
return +1;
Pageant now accepts an initial key list on the command line [originally from svn r592]
2000-09-15 10:48:42 +00:00
return 0;
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
static int ssh_channelfind(void *av, void *bv)
{
unsigned *a = (unsigned *) av;
struct ssh_channel *b = (struct ssh_channel *) bv;
if (*a < b->localid)
return -1;
if (*a > b->localid)
return +1;
Pageant now accepts an initial key list on the command line [originally from svn r592]
2000-09-15 10:48:42 +00:00
return 0;
}
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
static int ssh_rportcmp_ssh1(void *av, void *bv)
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
{
struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
int i;
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
if ( (i = strcmp(a->dhost, b->dhost)) != 0)
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
return i < 0 ? -1 : +1;
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
if (a->dport > b->dport)
return +1;
if (a->dport < b->dport)
return -1;
return 0;
}
static int ssh_rportcmp_ssh2(void *av, void *bv)
{
struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
Clean up the semantics of the ssh_rportfwd structure. It's now indexed by source hostname as well as source port (so that separate requests for the server to listen on addr1:1234 and addr2:1234 can be disambiguated), and also its destination host name is dynamically allocated rather than a fixed-size buffer. [originally from svn r10062]
2013-11-17 14:03:21 +00:00
int i;
if ( (i = strcmp(a->shost, b->shost)) != 0)
return i < 0 ? -1 : +1;
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
if (a->sport > b->sport)
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
return +1;
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
if (a->sport < b->sport)
return -1;
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
return 0;
}
Reimplement alloc_channel_id using search234. This replaces the previous log(n)^2 algorithm for channel-number allocation, which binary-searched the space of tree indices using a log-time call to index234() at each step, with a single log-time pass down the tree which only has to check the returned channel number against the returned tree index at each step. I'm under no illusions that this was a critical performance issue, but it's been offending my sense of algorithmic elegance for a while.
2018-09-19 12:20:03 +00:00
static unsigned alloc_channel_id(Ssh ssh)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Having now compiled the last few days' changes with MSVC, it's turned up a bunch of warnings, mostly unused variables. All fixed. [originally from svn r1058]
2001-04-17 08:24:29 +00:00
const unsigned CHANNEL_NUMBER_OFFSET = 256;
Reimplement alloc_channel_id using search234. This replaces the previous log(n)^2 algorithm for channel-number allocation, which binary-searched the space of tree indices using a log-time call to index234() at each step, with a single log-time pass down the tree which only has to check the returned channel number against the returned tree index at each step. I'm under no illusions that this was a critical performance issue, but it's been offending my sense of algorithmic elegance for a while.
2018-09-19 12:20:03 +00:00
search234_state ss;
Replace PuTTY's 2-3-4 tree implementation with the shiny new counted one, in preparation for using it to speed up scrollback. [originally from svn r1053]
2001-04-16 17:18:24 +00:00
/*
Reimplement alloc_channel_id using search234. This replaces the previous log(n)^2 algorithm for channel-number allocation, which binary-searched the space of tree indices using a log-time call to index234() at each step, with a single log-time pass down the tree which only has to check the returned channel number against the returned tree index at each step. I'm under no illusions that this was a critical performance issue, but it's been offending my sense of algorithmic elegance for a while.
2018-09-19 12:20:03 +00:00
* First-fit allocation of channel numbers: we always pick the
* lowest unused one.
*
* Every channel before that, and no channel after it, has an ID
* exactly equal to its tree index plus CHANNEL_NUMBER_OFFSET. So
* we can use the search234 system to identify the length of that
* initial sequence, in a single log-time pass down the channels
* tree.
Replace PuTTY's 2-3-4 tree implementation with the shiny new counted one, in preparation for using it to speed up scrollback. [originally from svn r1053]
2001-04-16 17:18:24 +00:00
*/
Reimplement alloc_channel_id using search234. This replaces the previous log(n)^2 algorithm for channel-number allocation, which binary-searched the space of tree indices using a log-time call to index234() at each step, with a single log-time pass down the tree which only has to check the returned channel number against the returned tree index at each step. I'm under no illusions that this was a critical performance issue, but it's been offending my sense of algorithmic elegance for a while.
2018-09-19 12:20:03 +00:00
search234_start(&ss, ssh->channels);
while (ss.element) {
struct ssh_channel *c = (struct ssh_channel *)ss.element;
if (c->localid == ss.index + CHANNEL_NUMBER_OFFSET)
search234_step(&ss, +1);
else
search234_step(&ss, -1);
Replace PuTTY's 2-3-4 tree implementation with the shiny new counted one, in preparation for using it to speed up scrollback. [originally from svn r1053]
2001-04-16 17:18:24 +00:00
}
Reimplement alloc_channel_id using search234. This replaces the previous log(n)^2 algorithm for channel-number allocation, which binary-searched the space of tree indices using a log-time call to index234() at each step, with a single log-time pass down the tree which only has to check the returned channel number against the returned tree index at each step. I'm under no illusions that this was a critical performance issue, but it's been offending my sense of algorithmic elegance for a while.
2018-09-19 12:20:03 +00:00
Replace PuTTY's 2-3-4 tree implementation with the shiny new counted one, in preparation for using it to speed up scrollback. [originally from svn r1053]
2001-04-16 17:18:24 +00:00
/*
Reimplement alloc_channel_id using search234. This replaces the previous log(n)^2 algorithm for channel-number allocation, which binary-searched the space of tree indices using a log-time call to index234() at each step, with a single log-time pass down the tree which only has to check the returned channel number against the returned tree index at each step. I'm under no illusions that this was a critical performance issue, but it's been offending my sense of algorithmic elegance for a while.
2018-09-19 12:20:03 +00:00
* Now ss.index gives exactly the number of channels in that
* initial sequence. So adding CHANNEL_NUMBER_OFFSET to it must
* give precisely the lowest unused channel number.
Replace PuTTY's 2-3-4 tree implementation with the shiny new counted one, in preparation for using it to speed up scrollback. [originally from svn r1053]
2001-04-16 17:18:24 +00:00
*/
Reimplement alloc_channel_id using search234. This replaces the previous log(n)^2 algorithm for channel-number allocation, which binary-searched the space of tree indices using a log-time call to index234() at each step, with a single log-time pass down the tree which only has to check the returned channel number against the returned tree index at each step. I'm under no illusions that this was a critical performance issue, but it's been offending my sense of algorithmic elegance for a while.
2018-09-19 12:20:03 +00:00
return ss.index + CHANNEL_NUMBER_OFFSET;
Replace PuTTY's 2-3-4 tree implementation with the shiny new counted one, in preparation for using it to speed up scrollback. [originally from svn r1053]
2001-04-16 17:18:24 +00:00
}
Make lots of generic data parameters into 'void *'. This is a cleanup I started to notice a need for during the BinarySink work. It removes a lot of faffing about casting things to char * or unsigned char * so that some API will accept them, even though lots of such APIs really take a plain 'block of raw binary data' argument and don't care what C thinks the signedness of that data might be - they may well reinterpret it back and forth internally. So I've tried to arrange for all the function call APIs that ought to have a void * (or const void *) to have one, and those that need to do pointer arithmetic on the parameter internally can cast it back at the top of the function. That saves endless ad-hoc casts at the call sites.
2018-05-26 07:31:34 +00:00
static void c_write_stderr(int trusted, const void *vbuf, int len)
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
{
Make lots of generic data parameters into 'void *'. This is a cleanup I started to notice a need for during the BinarySink work. It removes a lot of faffing about casting things to char * or unsigned char * so that some API will accept them, even though lots of such APIs really take a plain 'block of raw binary data' argument and don't care what C thinks the signedness of that data might be - they may well reinterpret it back and forth internally. So I've tried to arrange for all the function call APIs that ought to have a void * (or const void *) to have one, and those that need to do pointer arithmetic on the parameter internally can cast it back at the top of the function. That saves endless ad-hoc casts at the call sites.
2018-05-26 07:31:34 +00:00
const char *buf = (const char *)vbuf;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
int i;
for (i = 0; i < len; i++)
I seem to have slightly funted Plink's display of banners etc in r6437, oops. Fixed. [originally from svn r6846] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2006-09-05 21:41:38 +00:00
if (buf[i] != '\r' && (trusted || buf[i] == '\n' || (buf[i] & 0x60)))
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
fputc(buf[i], stderr);
}
Make lots of generic data parameters into 'void *'. This is a cleanup I started to notice a need for during the BinarySink work. It removes a lot of faffing about casting things to char * or unsigned char * so that some API will accept them, even though lots of such APIs really take a plain 'block of raw binary data' argument and don't care what C thinks the signedness of that data might be - they may well reinterpret it back and forth internally. So I've tried to arrange for all the function call APIs that ought to have a void * (or const void *) to have one, and those that need to do pointer arithmetic on the parameter internally can cast it back at the top of the function. That saves endless ad-hoc casts at the call sites.
2018-05-26 07:31:34 +00:00
static void c_write(Ssh ssh, const void *buf, int len)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (flags & FLAG_STDERR)
c_write_stderr(1, buf, len);
else
from_backend(ssh->frontend, 1, buf, len);
Remove the special hooks in ssh.c for pscp. pscp now uses the standard interface to the outside of the ssh module. This means pscp now works without change in SSH2. [originally from svn r638]
2000-09-27 09:36:39 +00:00
}
Oops, Ben is quite right about the rather appalling design of filename_from_str. Here's a better fix, with some const repercussions too. [originally from svn r2768]
2003-02-01 17:24:27 +00:00
static void c_write_str(Ssh ssh, const char *buf)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write(ssh, buf, strlen(buf));
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
}
Replace PktOut body pointer with a prefix length. The body pointer was used after encryption to mark the start of the fully wire-ready packet by ssh2_pkt_construct, and before encryption by the log_outgoing_packet functions. Now the former returns a nice modern ptrlen (it never really needed to store the pointer _in_ the packet structure anyway), and the latter uses an integer 'prefix' field, which isn't very different in concept but saves effort on reallocs.
2018-06-06 06:17:32 +00:00
static int s_write(Ssh ssh, const void *data, int len)
New logging mode, which records the exact bytes sent over the wire in an SSH connection _in addition_ to the decrypted packets. This will hopefully come in useful for debugging wire data corruption issues: you can strace the server, enable this mode in the client, and compare the sent and received data. I'd _like_ to have this mode also log Diffie-Hellman private exponents, session IDs, encryption and MAC keys, so that the resulting log file could be used to independently verify the correctness of all cryptographic operations performed by PuTTY. However, I haven't been able to convince myself that the security implications are acceptable. (It doesn't matter that this information would permit an attacker to decrypt the session, because the _already_ decrypted session is stored alongside it in the log file. And I'm not planning, under any circumstances, to log users' private keys. But gaining access to the log file while the session was still running would permit an attacker to _hijack_ the session, and that's the iffy bit.) [originally from svn r6835]
2006-08-29 19:07:11 +00:00
{
Avoid logging zero-length strings of outgoing raw data. In the 'SSH packets + raw data' logging mode, one of these occurs immediately after the initial key exchange, at the point where the transport routine releases any queued higher-layer packets that had been waiting for KEX to complete. Of course, in the initial KEX there are never any of those, so we do a zero-length s_write(), which is harmless but has the side effect of a zero-length raw-data log entry.
2018-02-07 19:56:28 +00:00
if (len && ssh->logctx)
In SSH packet logging mode, log SSH-2 packet sequence numbers, in both directions. We had a bug report yesterday about a Cisco router sending SSH2_MSG_UNIMPLEMENTED and it wasn't clear for which packet; logging the sequence numbers should make such problems much easier to diagnose. (In fact this logging fix wouldn't have helped in yesterday's case, because the router also didn't bother to fill in the sequence number field in the SSH2_MSG_UNIMPLEMENTED packet! This is a precautionary measure against the next one of these problems.) [originally from svn r8295]
2008-11-11 07:47:27 +00:00
log_packet(ssh->logctx, PKT_OUTGOING, -1, NULL, data, len,
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
0, NULL, NULL, 0, NULL);
Add a missing null pointer check in s_write. I don't know that this can ever be triggered in the current state of the code, but when I start mucking around with SSH session closing in the near future, it may be handy to have it. [originally from svn r10076]
2013-11-17 14:04:56 +00:00
if (!ssh->s)
return 0;
Make lots of generic data parameters into 'void *'. This is a cleanup I started to notice a need for during the BinarySink work. It removes a lot of faffing about casting things to char * or unsigned char * so that some API will accept them, even though lots of such APIs really take a plain 'block of raw binary data' argument and don't care what C thinks the signedness of that data might be - they may well reinterpret it back and forth internally. So I've tried to arrange for all the function call APIs that ought to have a void * (or const void *) to have one, and those that need to do pointer arithmetic on the parameter internally can cast it back at the top of the function. That saves endless ad-hoc casts at the call sites.
2018-05-26 07:31:34 +00:00
return sk_write(ssh->s, data, len);
New logging mode, which records the exact bytes sent over the wire in an SSH connection _in addition_ to the decrypted packets. This will hopefully come in useful for debugging wire data corruption issues: you can strace the server, enable this mode in the client, and compare the sent and received data. I'd _like_ to have this mode also log Diffie-Hellman private exponents, session IDs, encryption and MAC keys, so that the resulting log file could be used to independently verify the correctness of all cryptographic operations performed by PuTTY. However, I haven't been able to convince myself that the security implications are acceptable. (It doesn't matter that this information would permit an attacker to decrypt the session, because the _already_ decrypted session is stored alongside it in the log file. And I'm not planning, under any circumstances, to log users' private keys. But gaining access to the log file while the session was still running would permit an attacker to _hijack_ the session, and that's the iffy bit.) [originally from svn r6835]
2006-08-29 19:07:11 +00:00
}
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
static void ssh_pkt_write(Ssh ssh, PktOut *pkt)
{
if (ssh->version == 2 && ssh->v2_cbc_ignore_workaround &&
bufchain_size(&ssh->outgoing_data) != 0) {
/*
* When using a CBC-mode cipher in SSH-2, it's necessary to
* ensure that an attacker can't provide data to be encrypted
* using an IV that they know. We ensure this by prefixing
* each packet that might contain user data with an
* SSH_MSG_IGNORE.
*/
PktOut *ipkt = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_IGNORE);
put_stringz(ipkt, "");
Fix duplicate packets in CBC mode. Yesterday's reinstatement of ssh_free_pktout revealed - via valgrind spotting the use-after-free - that the code that prefixed sensible packets with IV-muddling SSH_MSG_IGNOREs was actually sending a second copy of the sensible packet in place of the IGNORE, due to a typo.
2018-07-10 20:04:32 +00:00
ssh_bpp_format_packet(ssh->bpp, ipkt);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
}
ssh_bpp_format_packet(ssh->bpp, pkt);
queue_idempotent_callback(&ssh->outgoing_data_sender);
}
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
/*
* Either queue or send a packet, depending on whether queueing is
* set.
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_pkt_send(Ssh ssh, PktOut *pkt)
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
{
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
if (ssh->queueing) {
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
pq_push(&ssh->outq, pkt);
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
} else {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, pkt);
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
}
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
}
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
static void ssh_send_outgoing_data(void *ctx)
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
{
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
Ssh ssh = (Ssh)ctx;
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
while (bufchain_size(&ssh->outgoing_data) > 0) {
void *data;
int len, backlog;
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
bufchain_prefix(&ssh->outgoing_data, &data, &len);
backlog = s_write(ssh, data, len);
bufchain_consume(&ssh->outgoing_data, len);
ssh->outgoing_data_size += len;
if (ssh->version == 2 && !ssh->kex_in_progress &&
!ssh->bare_connection && ssh->max_data_size != 0 &&
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->outgoing_data_size > ssh->max_data_size) {
ssh->rekey_reason = "too much data sent";
ssh->rekey_class = RK_NORMAL;
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
queue_idempotent_callback(&ssh->ssh2_transport_icb);
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
}
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
if (backlog > SSH_MAX_BACKLOG) {
ssh_throttle_all(ssh, 1, backlog);
return;
}
ssh_pkt_defersend: don't call do_ssh2_transport when using SSH-1. Also add an assertion to do_ssh2_transport to catch this. This bug would be highly unlikely to manifest accidentally, but I think you could trigger it by setting the data-based rekey threshold very low.
2016-05-01 17:16:22 +00:00
}
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
}
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
/*
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
* Send all queued SSH-2 packets.
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
*/
static void ssh2_pkt_queuesend(Ssh ssh)
{
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
PktOut *pkt;
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
assert(!ssh->queueing);
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
while ((pkt = pq_pop(&ssh->outq)) != NULL)
ssh_pkt_write(ssh, pkt);
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
}
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
#if 0
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
void bndebug(char *string, Bignum b)
{
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
unsigned char *p;
int i, len;
p = ssh2_mpint_fmt(b, &len);
debug(("%s", string));
for (i = 0; i < len; i++)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
debug((" %02x", p[i]));
Debugging improvements. Started using Dave Hinton's dmemdump function (woohoo!), improved that function so it provides an ASCII dump as well as hex (whee!), removed all remaining spurious \r in debug statements (ooh!), and made enabling of packet debugging in SSH a matter of one ifdef rather than lots (phew!). [originally from svn r1091]
2001-04-28 17:35:18 +00:00
debug(("\n"));
Make memory management uniform: _everything_ now goes through the smalloc() macros and thence to the safemalloc() functions in misc.c. This should allow me to plug in a debugging allocator and track memory leaks and segfaults and things. [originally from svn r818]
2000-12-12 10:33:13 +00:00
sfree(p);
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
}
#endif
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
/*
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
* Helper function to add an SSH-2 signature blob to a packet. Expects
* to be shown the public key blob as well as the signature blob.
* Normally just appends the sig blob unmodified as a string, except
* that it optionally breaks it open and fiddle with it to work around
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
* BUG_SSH2_RSA_PADDING.
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_add_sigblob(Ssh ssh, PktOut *pkt,
Rewrite ssh2_add_sigblob using BinarySource. This is the function that breaks apart a signature blob (generated locally or received from an SSH agent) and adds leading zero bytes in front of the signature integer, if we think we're talking to a server that will incorrectly insist on that. The breaking-apart process is just another instance of SSH-style data unmarshalling, so it should be done by the new centralised routines.
2018-05-29 19:45:42 +00:00
const void *pkblob, int pkblob_len,
const void *sigblob, int sigblob_len)
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
{
Rewrite ssh2_add_sigblob using BinarySource. This is the function that breaks apart a signature blob (generated locally or received from an SSH agent) and adds leading zero bytes in front of the signature integer, if we think we're talking to a server that will incorrectly insist on that. The breaking-apart process is just another instance of SSH-style data unmarshalling, so it should be done by the new centralised routines.
2018-05-29 19:45:42 +00:00
BinarySource pk[1], sig[1];
BinarySource_BARE_INIT(pk, pkblob, pkblob_len);
BinarySource_BARE_INIT(sig, sigblob, sigblob_len);
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
/* dmemdump(pkblob, pkblob_len); */
/* dmemdump(sigblob, sigblob_len); */
/*
* See if this is in fact an ssh-rsa signature and a buggy
* server; otherwise we can just do this the easy way.
*/
Rewrite ssh2_add_sigblob using BinarySource. This is the function that breaks apart a signature blob (generated locally or received from an SSH agent) and adds leading zero bytes in front of the signature integer, if we think we're talking to a server that will incorrectly insist on that. The breaking-apart process is just another instance of SSH-style data unmarshalling, so it should be done by the new centralised routines.
2018-05-29 19:45:42 +00:00
if ((ssh->remote_bugs & BUG_SSH2_RSA_PADDING) &&
ptrlen_eq_string(get_string(pk), "ssh-rsa") &&
ptrlen_eq_string(get_string(sig), "ssh-rsa")) {
ptrlen mod_mp, sig_mp;
size_t sig_prefix_len;
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
/*
Rewrite ssh2_add_sigblob using BinarySource. This is the function that breaks apart a signature blob (generated locally or received from an SSH agent) and adds leading zero bytes in front of the signature integer, if we think we're talking to a server that will incorrectly insist on that. The breaking-apart process is just another instance of SSH-style data unmarshalling, so it should be done by the new centralised routines.
2018-05-29 19:45:42 +00:00
* Find the modulus and signature integers.
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
*/
Rewrite ssh2_add_sigblob using BinarySource. This is the function that breaks apart a signature blob (generated locally or received from an SSH agent) and adds leading zero bytes in front of the signature integer, if we think we're talking to a server that will incorrectly insist on that. The breaking-apart process is just another instance of SSH-style data unmarshalling, so it should be done by the new centralised routines.
2018-05-29 19:45:42 +00:00
get_string(pk); /* skip over exponent */
mod_mp = get_string(pk); /* remember modulus */
sig_prefix_len = sig->pos;
sig_mp = get_string(sig);
if (get_err(pk) || get_err(sig))
Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918]
2013-07-14 10:45:54 +00:00
goto give_up;
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
Rewrite ssh2_add_sigblob using BinarySource. This is the function that breaks apart a signature blob (generated locally or received from an SSH agent) and adds leading zero bytes in front of the signature integer, if we think we're talking to a server that will incorrectly insist on that. The breaking-apart process is just another instance of SSH-style data unmarshalling, so it should be done by the new centralised routines.
2018-05-29 19:45:42 +00:00
/*
* Find the byte length of the modulus, not counting leading
* zeroes.
*/
while (mod_mp.len > 0 && *(const char *)mod_mp.ptr == 0) {
mod_mp.len--;
mod_mp.ptr = (const char *)mod_mp.ptr + 1;
}
/* debug(("modulus length is %d\n", len)); */
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
/* debug(("signature length is %d\n", siglen)); */
Rewrite ssh2_add_sigblob using BinarySource. This is the function that breaks apart a signature blob (generated locally or received from an SSH agent) and adds leading zero bytes in front of the signature integer, if we think we're talking to a server that will incorrectly insist on that. The breaking-apart process is just another instance of SSH-style data unmarshalling, so it should be done by the new centralised routines.
2018-05-29 19:45:42 +00:00
if (mod_mp.len != sig_mp.len) {
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
strbuf *substr = strbuf_new();
Rewrite ssh2_add_sigblob using BinarySource. This is the function that breaks apart a signature blob (generated locally or received from an SSH agent) and adds leading zero bytes in front of the signature integer, if we think we're talking to a server that will incorrectly insist on that. The breaking-apart process is just another instance of SSH-style data unmarshalling, so it should be done by the new centralised routines.
2018-05-29 19:45:42 +00:00
put_data(substr, sigblob, sig_prefix_len);
put_uint32(substr, mod_mp.len);
New BinarySink function 'put_padding'. It is to put_data what memset is to memcpy. Several places in the code wanted it already, but not _quite_ enough for me to have written it with the rest of the BinarySink infrastructure originally.
2018-06-09 08:01:07 +00:00
put_padding(substr, mod_mp.len - sig_mp.len, 0);
Rewrite ssh2_add_sigblob using BinarySource. This is the function that breaks apart a signature blob (generated locally or received from an SSH agent) and adds leading zero bytes in front of the signature integer, if we think we're talking to a server that will incorrectly insist on that. The breaking-apart process is just another instance of SSH-style data unmarshalling, so it should be done by the new centralised routines.
2018-05-29 19:45:42 +00:00
put_data(substr, sig_mp.ptr, sig_mp.len);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringsb(pkt, substr);
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
return;
}
Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918]
2013-07-14 10:45:54 +00:00
/* Otherwise fall through and do it the easy way. We also come
* here as a fallback if we discover above that the key blob
* is misformatted in some way. */
give_up:;
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
}
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_string(pkt, sigblob, sigblob_len);
Workaround for the SSH2 RSA padding bug in OpenSSH 2.5 - 3.2 inclusive. Padding is accomplished by rewriting the signature blob rather than at the point of generation, in order to avoid having to move part of the workaround into Pageant (and having to corrupt the agent wire protocol to allow PuTTY to specify whether it wants its signatures padded!). [originally from svn r1708]
2002-05-31 17:39:16 +00:00
}
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
static void ssh_feed_to_bpp(Ssh ssh)
{
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
PacketQueueNode *prev_tail = ssh->pq_full.pqb.end.prev;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
assert(ssh->bpp);
ssh_bpp_handle_input(ssh->bpp);
if (ssh->bpp->error) {
bomb_out(ssh, ssh->bpp->error); /* also frees the error string */
return;
}
if (ssh->bpp->seen_disconnect) {
/*
* If we've seen a DISCONNECT message, we should unset the
* close_expected flag, because now we _do_ expect the server
* to close the network connection afterwards. That way, the
* more informative connection_fatal message for the
* disconnect itself won't fight with 'Server unexpectedly
* closed network connection'.
*/
ssh->clean_exit = FALSE;
ssh->close_expected = TRUE;
ssh->disconnect_message_seen = TRUE;
}
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
if (ssh->pq_full.pqb.end.prev != prev_tail)
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
queue_idempotent_callback(&ssh->pq_full_consumer);
}
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
static void ssh_got_ssh_version(struct ssh_version_receiver *rcv,
int major_version)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
Ssh ssh = FROMFIELD(rcv, struct ssh_tag, version_receiver);
BinaryPacketProtocol *old_bpp;
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
/*
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
* Queue an outgoing-data run: if the version string has been sent
* late rather than early, it'll still be sitting on our output
* raw data queue.
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
*/
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
queue_idempotent_callback(&ssh->outgoing_data_sender);
Option to log proxy setup diagnostics to the terminal. It has three settings: on, off, and 'only until session starts'. The idea of the last one is that if you use something like 'ssh -v' as your proxy command, you probably wanted to see the initial SSH connection-setup messages while you were waiting to see if the connection would be set up successfully at all, but probably _didn't_ want a slew of diagnostics from rekeys disrupting your terminal in mid-emacs once the session had got properly under way. Default is off, to avoid startling people used to the old behaviour. I wonder if I should have set it more aggressively, though.
2015-11-22 14:33:28 +00:00
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
/*
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
* We don't support choosing a major protocol version dynamically,
* so this should always be the same value we set up in
* connect_to_host().
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
*/
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
assert(ssh->version == major_version);
old_bpp = ssh->bpp;
ssh->remote_bugs = ssh_verstring_get_bugs(old_bpp);
if (!ssh->bare_connection) {
if (ssh->version == 2) {
/*
* Retrieve both version strings from the old BPP before
* we free it.
*/
ssh->v_s = dupstr(ssh_verstring_get_remote(old_bpp));
ssh->v_c = dupstr(ssh_verstring_get_local(old_bpp));
/*
* Initialise SSH-2 protocol.
*/
ssh2_protocol_setup(ssh);
ssh->general_packet_processing = ssh2_general_packet_processing;
ssh->current_user_input_fn = NULL;
} else {
/*
* Initialise SSH-1 protocol.
*/
ssh1_protocol_setup(ssh);
ssh->current_user_input_fn = ssh1_login_input;
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
}
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
if (ssh->version == 2)
queue_idempotent_callback(&ssh->ssh2_transport_icb);
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
Stop supporting fallback between SSH versions. The UI now only has "1" and "2" options for SSH protocol version, which behave like the old "1 only" and "2 only" options; old SSH-N-with-fallback settings are interpreted as SSH-N-only. This prevents any attempt at a protocol downgrade attack. Most users should see no difference; those poor souls who still have to work with SSH-1 equipment now have to explicitly opt in.
2016-03-28 19:23:57 +00:00
} else {
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
assert(ssh->version == 2); /* can't do SSH-1 bare connection! */
logeventf(ssh, "Using bare ssh-connection protocol");
Kimmo Parviainen points out that SSH software version strings have restrictions on the use of hyphens and spaces. [originally from svn r4939]
2004-12-01 13:37:31 +00:00
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
ssh2_bare_connection_protocol_setup(ssh);
ssh->current_user_input_fn = ssh2_connection_input;
Separate out the code for creating and sending SSH version strings so that in the SSH-2-only case, we can send it as soon as we connect rather than waiting for the server's one. Unfortunately, actually doing so will take a little more effort -- there are subtleties to do with having a working log context at the right moment that need to be sorted out. [originally from svn r7645]
2007-07-19 23:53:02 +00:00
}
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->bpp->out_raw = &ssh->outgoing_data;
ssh->bpp->in_raw = &ssh->incoming_data;
ssh->bpp->in_pq = &ssh->pq_full;
ssh->bpp->pls = &ssh->pls;
ssh->bpp->logctx = ssh->logctx;
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
queue_idempotent_callback(&ssh->incoming_data_consumer);
Call every new user input consumer when it's set up. This fixes further embarrassing hangs in the wake of the big restructuring, in which we'd assign a new function pointer into ssh->current_user_input_fn but not immediately call it to let it process whatever might already be waiting for it in the user input queue.
2018-05-18 10:40:21 +00:00
queue_idempotent_callback(&ssh->user_input_consumer);
Separate out the code for creating and sending SSH version strings so that in the SSH-2-only case, we can send it as soon as we connect rather than waiting for the server's one. Unfortunately, actually doing so will take a little more effort -- there are subtleties to do with having a working log context at the right moment that need to be sorted out. [originally from svn r7645]
2007-07-19 23:53:02 +00:00
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
update_specials_menu(ssh->frontend);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->state = SSH_STATE_BEFORE_SIZE;
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
ssh->pinger = pinger_new(ssh->conf, &ssh->backend);
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
if (ssh->bare_connection) {
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
/*
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
* Get connection protocol under way.
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
*/
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
do_ssh2_connection(ssh);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
}
}
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
static void ssh_process_incoming_data(void *ctx)
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
{
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
Ssh ssh = (Ssh)ctx;
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
if (ssh->state == SSH_STATE_CLOSED)
return;
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
if (!ssh->frozen)
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
ssh_feed_to_bpp(ssh);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
if (ssh->state == SSH_STATE_CLOSED) /* yes, check _again_ */
return;
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
if (ssh->incoming_data_seen_eof) {
int need_notify = ssh_do_close(ssh, FALSE);
const char *error_msg = ssh->incoming_data_eof_message;
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
if (!error_msg) {
if (!ssh->close_expected)
error_msg = "Server unexpectedly closed network connection";
else
error_msg = "Server closed network connection";
}
if (ssh->close_expected && ssh->clean_exit && ssh->exitcode < 0)
ssh->exitcode = 0;
if (need_notify)
notify_remote_exit(ssh->frontend);
if (error_msg)
logevent(error_msg);
Try harder not to call connection_fatal twice. If the server sends an SSH_MSG_DISCONNECT, then we call connection_fatal(). But if the server closes the network connection, then we call connection_fatal(). In situations where the former happens, the latter happens too. Currently, calling connection_fatal twice is especially bad on GTK because all dialogs are now non-modal and an assertion fails in the GTK front end when two fatal message boxes try to exist at the same time (the register_dialog system finds that slot is already occupied). But regardless of that, we'd rather not even _try_ to print two fatal boxes, because even if the front end doesn't fail an assertion, there's no guarantee that the _more useful_ one of the messages will end up being displayed. So a better fix is to have ssh.c make a sensible decision about which message is the helpful one - in this case, the actual error message out of the SSH_MSG_DISCONNECT, rather than the predictable fact of the connection having been slammed shut immediately afterwards - and only pass that one to the front end in the first place.
2018-06-03 05:46:28 +00:00
if ((!ssh->close_expected || !ssh->clean_exit) &&
!ssh->disconnect_message_seen)
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
connection_fatal(ssh->frontend, "%s", error_msg);
}
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
}
Make the rdpkt functions output to a PacketQueue. Each of the coroutines that parses the incoming wire data into a stream of 'struct Packet' now delivers those packets to a PacketQueue called ssh->pq_full (containing the full, unfiltered stream of all packets received on the SSH connection), replacing the old API in which each coroutine would directly return a 'struct Packet *' to its caller, or NULL if it didn't have one ready yet. This simplifies the function-call API of the rdpkt coroutines (they now return void). It increases the complexity at the other end, because we've now got a function ssh_process_pq_full (scheduled as an idempotent callback whenever rdpkt appends anything to the queue) which pulls things out of the queue and passes them to ssh->protocol. But that's only a temporary complexity increase; by the time I finish the upcoming stream of refactorings, there won't be two chained functions there any more. One small workaround I had to add in this commit is a flag called 'pending_newkeys', which ssh2_rdpkt sets when it's just returned an SSH_MSG_NEWKEYS packet, and then waits for the transport layer to process the NEWKEYS and set up the new encryption context before processing any more wire data. This wasn't necessary before, because the old architecture was naturally synchronous - ssh2_rdpkt would return a NEWKEYS, which would be immediately passed to do_ssh2_transport, which would finish processing it immediately, and by the time ssh2_rdpkt was next called, the keys would already be in place. This change adds a big while loop around the whole of each rdpkt function, so it's easiest to read it as a whitespace-ignored diff.
2018-05-18 06:22:57 +00:00
static void ssh_process_pq_full(void *ctx)
{
Ssh ssh = (Ssh)ctx;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktIn *pktin;
Make the rdpkt functions output to a PacketQueue. Each of the coroutines that parses the incoming wire data into a stream of 'struct Packet' now delivers those packets to a PacketQueue called ssh->pq_full (containing the full, unfiltered stream of all packets received on the SSH connection), replacing the old API in which each coroutine would directly return a 'struct Packet *' to its caller, or NULL if it didn't have one ready yet. This simplifies the function-call API of the rdpkt coroutines (they now return void). It increases the complexity at the other end, because we've now got a function ssh_process_pq_full (scheduled as an idempotent callback whenever rdpkt appends anything to the queue) which pulls things out of the queue and passes them to ssh->protocol. But that's only a temporary complexity increase; by the time I finish the upcoming stream of refactorings, there won't be two chained functions there any more. One small workaround I had to add in this commit is a flag called 'pending_newkeys', which ssh2_rdpkt sets when it's just returned an SSH_MSG_NEWKEYS packet, and then waits for the transport layer to process the NEWKEYS and set up the new encryption context before processing any more wire data. This wasn't necessary before, because the old architecture was naturally synchronous - ssh2_rdpkt would return a NEWKEYS, which would be immediately passed to do_ssh2_transport, which would finish processing it immediately, and by the time ssh2_rdpkt was next called, the keys would already be in place. This change adds a big while loop around the whole of each rdpkt function, so it's easiest to read it as a whitespace-ignored diff.
2018-05-18 06:22:57 +00:00
while ((pktin = pq_pop(&ssh->pq_full)) != NULL) {
Stop passing incoming packets through ssh->protocol. After the previous two refactorings, there's no longer any need to pass packets to ssh1_protocol or ssh2_protocol so that each one can do its own thing with them, because now the handling is the same in both cases: first call the general type-independent packet processing code (if any), and then call the dispatch table entry for the packet type (which now always exists).
2018-05-18 06:22:57 +00:00
if (ssh->general_packet_processing)
ssh->general_packet_processing(ssh, pktin);
ssh->packet_dispatch[pktin->type](ssh, pktin);
Make the rdpkt functions output to a PacketQueue. Each of the coroutines that parses the incoming wire data into a stream of 'struct Packet' now delivers those packets to a PacketQueue called ssh->pq_full (containing the full, unfiltered stream of all packets received on the SSH connection), replacing the old API in which each coroutine would directly return a 'struct Packet *' to its caller, or NULL if it didn't have one ready yet. This simplifies the function-call API of the rdpkt coroutines (they now return void). It increases the complexity at the other end, because we've now got a function ssh_process_pq_full (scheduled as an idempotent callback whenever rdpkt appends anything to the queue) which pulls things out of the queue and passes them to ssh->protocol. But that's only a temporary complexity increase; by the time I finish the upcoming stream of refactorings, there won't be two chained functions there any more. One small workaround I had to add in this commit is a flag called 'pending_newkeys', which ssh2_rdpkt sets when it's just returned an SSH_MSG_NEWKEYS packet, and then waits for the transport layer to process the NEWKEYS and set up the new encryption context before processing any more wire data. This wasn't necessary before, because the old architecture was naturally synchronous - ssh2_rdpkt would return a NEWKEYS, which would be immediately passed to do_ssh2_transport, which would finish processing it immediately, and by the time ssh2_rdpkt was next called, the keys would already be in place. This change adds a big while loop around the whole of each rdpkt function, so it's easiest to read it as a whitespace-ignored diff.
2018-05-18 06:22:57 +00:00
ssh_unref_packet(pktin);
}
}
Put all user input into a bufchain. This change introduces a new bufchain ssh->user_input, into which we put every byte received via back->send() (i.e. keyboard input from the GUI PuTTY window, data read by Plink from standard input, or outgoing SCP/SFTP protocol data made up by the file transfer utilities). Just like ssh->incoming_data, there's also a function pointer ssh->current_user_input_fn which says who currently has responsibility for pulling data back off that bufchain and processing it. So that can be changed over when the connection moves into a different major phase. At the moment, nothing very interesting is being done with this bufchain: each phase of the connection has its own little function that pulls chunks back out of it with bufchain_prefix and passes them to the unchanged main protocol coroutines. But this is groundwork for being able to switch over each of those coroutines in turn to read directly from ssh->user_input, with the aim of eliminating a collection of annoying bugs in which typed-ahead data is accidentally discarded at an SSH phase transition.
2018-05-18 06:22:58 +00:00
static void ssh_process_user_input(void *ctx)
{
Ssh ssh = (Ssh)ctx;
if (ssh->current_user_input_fn)
ssh->current_user_input_fn(ssh);
}
Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. [originally from svn r5098] [this svn revision also touched putty-wishlist]
2005-01-11 19:33:41 +00:00
static int ssh_do_close(Ssh ssh, int notify_exit)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
ssh_do_close() was only closing about half the channels. Fixed. [originally from svn r5324]
2005-02-17 01:47:01 +00:00
int ret = 0;
Robustness in the face of sudden connection closures: we now make a credible effort to shut down open forwardings cleanly when the owning SSH connection terminates abruptly (for whatever reason). [originally from svn r3137]
2003-04-25 11:48:24 +00:00
struct ssh_channel *c;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->state = SSH_STATE_CLOSED;
<1112163342.018492.101240@f14g2000cwb.googlegroups.com> on comp.security.ssh contains a Dr Watson log which looks to me as if `unclean-close-crash' occurred due to a rekey timer going off after the session had closed. Hence, ssh2_timer() now avoids doing anything if the session is already closed, and also ssh_do_close() proactively calls expire_timer_context(). Between those I think they ought to solve the problem. [originally from svn r5564]
2005-03-30 08:27:54 +00:00
expire_timer_context(ssh);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->s) {
sk_close(ssh->s);
ssh->s = NULL;
Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. [originally from svn r5098] [this svn revision also touched putty-wishlist]
2005-01-11 19:33:41 +00:00
if (notify_exit)
notify_remote_exit(ssh->frontend);
else
ret = 1;
Yet another possible segfault path in the backends fixed. I don't _believe_ I'm still finding these. I have no idea what I was thinking when I wrote this stuff. [originally from svn r1162]
2001-07-31 14:23:21 +00:00
}
Robustness in the face of sudden connection closures: we now make a credible effort to shut down open forwardings cleanly when the owning SSH connection terminates abruptly (for whatever reason). [originally from svn r3137]
2003-04-25 11:48:24 +00:00
/*
ssh_do_close() was only closing about half the channels. Fixed. [originally from svn r5324]
2005-02-17 01:47:01 +00:00
* Now we must shut down any port- and X-forwarded channels going
Robustness in the face of sudden connection closures: we now make a credible effort to shut down open forwardings cleanly when the owning SSH connection terminates abruptly (for whatever reason). [originally from svn r3137]
2003-04-25 11:48:24 +00:00
* through this connection.
*/
The new ssh_do_close() function itself causes a segfault if the connection goes foom before ssh->channels is set up. Oops. Fixed. [originally from svn r3141]
2003-04-25 17:44:09 +00:00
if (ssh->channels) {
ssh_do_close() was only closing about half the channels. Fixed. [originally from svn r5324]
2005-02-17 01:47:01 +00:00
while (NULL != (c = index234(ssh->channels, 0))) {
Factor out code to close the local socket associated with a channel. The only visible effect should be that abrupt closure of an SSH connection now leads to a slew of messages about closing forwarded ports.
2016-05-28 13:50:02 +00:00
ssh_channel_close_local(c, NULL);
ssh_do_close() was only closing about half the channels. Fixed. [originally from svn r5324]
2005-02-17 01:47:01 +00:00
del234(ssh->channels, c); /* moving next one to index 0 */
The new ssh_do_close() function itself causes a segfault if the connection goes foom before ssh->channels is set up. Oops. Fixed. [originally from svn r3141]
2003-04-25 17:44:09 +00:00
if (ssh->version == 2)
bufchain_clear(&c->v.v2.outbuffer);
sfree(c);
Robustness in the face of sudden connection closures: we now make a credible effort to shut down open forwardings cleanly when the owning SSH connection terminates abruptly (for whatever reason). [originally from svn r3137]
2003-04-25 11:48:24 +00:00
}
}
ssh_do_close() should close any listening sockets associated with port-forwardings. [originally from svn r5325]
2005-02-17 02:00:01 +00:00
/*
* Go through port-forwardings, and close any associated
* listening sockets.
*/
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
portfwdmgr_close_all(ssh->portfwdmgr);
Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. [originally from svn r5098] [this svn revision also touched putty-wishlist]
2005-01-11 19:33:41 +00:00
Shut down connshare upstream along with the SSH connection. This ought to happen in ssh_do_close alongside the code that shuts down other local listening things like port forwardings, for the same obvious reason. In particular, we should get through this _before_ we put up a modal dialog box telling the user what just went wrong with the SSH connection, so that further sessions started while that box is active don't try futilely to connect to the not-really-listening zombie upstream.
2014-11-10 18:29:00 +00:00
/*
* Also stop attempting to connection-share.
*/
if (ssh->connshare) {
sharestate_free(ssh->connshare);
ssh->connshare = NULL;
}
Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. [originally from svn r5098] [this svn revision also touched putty-wishlist]
2005-01-11 19:33:41 +00:00
return ret;
Robustness in the face of sudden connection closures: we now make a credible effort to shut down open forwardings cleanly when the owning SSH connection terminates abruptly (for whatever reason). [originally from svn r3137]
2003-04-25 11:48:24 +00:00
}
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
static void ssh_socket_log(Plug plug, int type, SockAddr addr, int port,
const char *error_msg, int error_code)
Support for falling back through the list of addresses returned from a DNS lookup, whether they're IPv4, v6 or a mixture of both. [originally from svn r5119] [this svn revision also touched putty-wishlist]
2005-01-16 14:29:34 +00:00
{
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
Ssh ssh = FROMFIELD(plug, struct ssh_tag, plugvt);
Support for falling back through the list of addresses returned from a DNS lookup, whether they're IPv4, v6 or a mixture of both. [originally from svn r5119] [this svn revision also touched putty-wishlist]
2005-01-16 14:29:34 +00:00
Factor out the back ends' plug log functions. I'm about to want to make a change to all those functions at once, and since they're almost identical, it seemed easiest to pull them out into a common helper. The new source file be_misc.c is intended to contain helper code common to all network back ends (crypto and non-crypto, in particular), and initially it contains a backend_socket_log() function which is the common part of ssh_log(), telnet_log(), rlogin_log() etc.
2015-11-22 11:49:14 +00:00
/*
* While we're attempting connection sharing, don't loudly log
* everything that happens. Real TCP connections need to be logged
* when we _start_ trying to connect, because it might be ages
* before they respond if something goes wrong; but connection
* sharing is local and quick to respond, and it's sufficient to
* simply wait and see whether it worked afterwards.
*/
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
Factor out the back ends' plug log functions. I'm about to want to make a change to all those functions at once, and since they're almost identical, it seemed easiest to pull them out into a common helper. The new source file be_misc.c is intended to contain helper code common to all network back ends (crypto and non-crypto, in particular), and initially it contains a backend_socket_log() function which is the common part of ssh_log(), telnet_log(), rlogin_log() etc.
2015-11-22 11:49:14 +00:00
if (!ssh->attempting_connshare)
backend_socket_log(ssh->frontend, type, addr, port,
Option to log proxy setup diagnostics to the terminal. It has three settings: on, off, and 'only until session starts'. The idea of the last one is that if you use something like 'ssh -v' as your proxy command, you probably wanted to see the initial SSH connection-setup messages while you were waiting to see if the connection would be set up successfully at all, but probably _didn't_ want a slew of diagnostics from rekeys disrupting your terminal in mid-emacs once the session had got properly under way. Default is off, to avoid startling people used to the old behaviour. I wonder if I should have set it more aggressively, though.
2015-11-22 14:33:28 +00:00
error_msg, error_code, ssh->conf,
ssh->session_started);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
}
Support for falling back through the list of addresses returned from a DNS lookup, whether they're IPv4, v6 or a mixture of both. [originally from svn r5119] [this svn revision also touched putty-wishlist]
2005-01-16 14:29:34 +00:00
Make plug receive and closing functions return void instead of int. Nothing was paying attention to their return values any more anyway.
2016-06-02 22:03:24 +00:00
static void ssh_closing(Plug plug, const char *error_msg, int error_code,
int calling_back)
Robustness in the face of sudden connection closures: we now make a credible effort to shut down open forwardings cleanly when the owning SSH connection terminates abruptly (for whatever reason). [originally from svn r3137]
2003-04-25 11:48:24 +00:00
{
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
Ssh ssh = FROMFIELD(plug, struct ssh_tag, plugvt);
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
ssh->incoming_data_seen_eof = TRUE;
ssh->incoming_data_eof_message = dupstr(error_msg);
queue_idempotent_callback(&ssh->incoming_data_consumer);
Dave Hinton's modifications to the network layer interface, which should make it possible to add SSL support later. [originally from svn r996]
2001-03-13 10:22:45 +00:00
}
Make plug receive and closing functions return void instead of int. Nothing was paying attention to their return values any more anyway.
2016-06-02 22:03:24 +00:00
static void ssh_receive(Plug plug, int urgent, char *data, int len)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
Ssh ssh = FROMFIELD(plug, struct ssh_tag, plugvt);
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
/* Log raw data, if we're in that mode. */
if (ssh->logctx)
log_packet(ssh->logctx, PKT_INCOMING, -1, NULL, data, len,
0, NULL, NULL, 0, NULL);
bufchain_add(&ssh->incoming_data, data, len);
queue_idempotent_callback(&ssh->incoming_data_consumer);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->state == SSH_STATE_CLOSED) {
Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. [originally from svn r5098] [this svn revision also touched putty-wishlist]
2005-01-11 19:33:41 +00:00
ssh_do_close(ssh, TRUE);
SSH2 connections weren't closing cleanly after socket revamp. Fixed. [originally from svn r754]
2000-10-24 09:55:45 +00:00
}
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
static void ssh_sent(Plug plug, int bufsize)
{
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
Ssh ssh = FROMFIELD(plug, struct ssh_tag, plugvt);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
/*
Add a missing check of outgoing_data. When the whole SSH connection is throttled and then unthrottled, we need to requeue the callback that transfers data to the Socket from the new outgoing_data queue introduced in commit 9e3522a97. The user-visible effect of this missing call was that outgoing SFTP transactions would lock up, because in SFTP mode we enable the "simple@putty.projects.tartarus.org" mode and essentially turn off the per-channel window management, so throttling of the whole connection becomes the main source of back-pressure.
2018-06-13 18:44:44 +00:00
* If the send backlog on the SSH socket itself clears, we should
* unthrottle the whole world if it was throttled, and also resume
* sending our bufchain of queued wire data.
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
*/
Add a missing check of outgoing_data. When the whole SSH connection is throttled and then unthrottled, we need to requeue the callback that transfers data to the Socket from the new outgoing_data queue introduced in commit 9e3522a97. The user-visible effect of this missing call was that outgoing SFTP transactions would lock up, because in SFTP mode we enable the "simple@putty.projects.tartarus.org" mode and essentially turn off the per-channel window management, so throttling of the whole connection becomes the main source of back-pressure.
2018-06-13 18:44:44 +00:00
if (bufsize < SSH_MAX_BACKLOG) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh_throttle_all(ssh, 0, bufsize);
Add a missing check of outgoing_data. When the whole SSH connection is throttled and then unthrottled, we need to requeue the callback that transfers data to the Socket from the new outgoing_data queue introduced in commit 9e3522a97. The user-visible effect of this missing call was that outgoing SFTP transactions would lock up, because in SFTP mode we enable the "simple@putty.projects.tartarus.org" mode and essentially turn off the per-channel window management, so throttling of the whole connection becomes the main source of back-pressure.
2018-06-13 18:44:44 +00:00
queue_idempotent_callback(&ssh->outgoing_data_sender);
}
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
Factor out ssh_hostport_setup(). This is the part of ssh.c's connect_to_host() which figures out the host name and port number that logically identify the connection - i.e. not necessarily where we physically connected to, but what we'll use to look up the saved session cache, put in the window title bar, and give to the connection sharing code to identify other connections to share with. I'm about to want to use it for another purpose, so it needs to be moved out into a separate function.
2015-09-25 09:58:29 +00:00
static void ssh_hostport_setup(const char *host, int port, Conf *conf,
char **savedhost, int *savedport,
char **loghost_ret)
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
{
Factor out ssh_hostport_setup(). This is the part of ssh.c's connect_to_host() which figures out the host name and port number that logically identify the connection - i.e. not necessarily where we physically connected to, but what we'll use to look up the saved session cache, put in the window title bar, and give to the connection sharing code to identify other connections to share with. I'm about to want to use it for another purpose, so it needs to be moved out into a separate function.
2015-09-25 09:58:29 +00:00
char *loghost = conf_get_str(conf, CONF_loghost);
if (loghost_ret)
*loghost_ret = loghost;
Dave Hinton's modifications to the network layer interface, which should make it possible to add SSL support later. [originally from svn r996]
2001-03-13 10:22:45 +00:00
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (*loghost) {
Use the new host_str* functions to improve IPv6 literal support. I've gone through everywhere we handle host names / addresses (on command lines, in PuTTY config, in port forwarding, in X display names, in host key storage...) and tried to make them handle IPv6 literals sensibly, by using the host_str* functions I introduced in my previous commit. Generally it's now OK to use a bracketed IPv6 literal anywhere a hostname might have been valid; in a few cases where no ambiguity exists (e.g. no :port suffix is permitted anyway) unbracketed IPv6 literals are also acceptable. [originally from svn r10120]
2014-01-25 15:58:54 +00:00
char *tmphost;
char *colon;
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
Use the new host_str* functions to improve IPv6 literal support. I've gone through everywhere we handle host names / addresses (on command lines, in PuTTY config, in port forwarding, in X display names, in host key storage...) and tried to make them handle IPv6 literals sensibly, by using the host_str* functions I introduced in my previous commit. Generally it's now OK to use a bracketed IPv6 literal anywhere a hostname might have been valid; in a few cases where no ambiguity exists (e.g. no :port suffix is permitted anyway) unbracketed IPv6 literals are also acceptable. [originally from svn r10120]
2014-01-25 15:58:54 +00:00
tmphost = dupstr(loghost);
Factor out ssh_hostport_setup(). This is the part of ssh.c's connect_to_host() which figures out the host name and port number that logically identify the connection - i.e. not necessarily where we physically connected to, but what we'll use to look up the saved session cache, put in the window title bar, and give to the connection sharing code to identify other connections to share with. I'm about to want to use it for another purpose, so it needs to be moved out into a separate function.
2015-09-25 09:58:29 +00:00
*savedport = 22; /* default ssh port */
Been meaning to do this for years: introduce a configuration option to manually tweak the host name and port number under which the SSH host key is read and written. I've put it in the cross-platform Connection panel. Partly under the flimsy pretext that other backends _can_ use it if they so wish (and in fact it overrides the host name for title-bar purposes in all network backends, though it has no other effect in anything but SSH); but mostly because the SSH panel was too full already :-) [originally from svn r8033]
2008-06-01 11:16:32 +00:00
/*
Use the new host_str* functions to improve IPv6 literal support. I've gone through everywhere we handle host names / addresses (on command lines, in PuTTY config, in port forwarding, in X display names, in host key storage...) and tried to make them handle IPv6 literals sensibly, by using the host_str* functions I introduced in my previous commit. Generally it's now OK to use a bracketed IPv6 literal anywhere a hostname might have been valid; in a few cases where no ambiguity exists (e.g. no :port suffix is permitted anyway) unbracketed IPv6 literals are also acceptable. [originally from svn r10120]
2014-01-25 15:58:54 +00:00
* A colon suffix on the hostname string also lets us affect
Avoid misidentifying unbracketed IPv6 literals as host:port. Both GUI PuTTY front ends have a piece of logic whereby a string is interpreted as host:port if there's _one_ colon in it, but if there's more than one colon then it's assumed to be an IPv6 literal with no trailing port number. This permits the PuTTY command line to take strings such as 'host', 'host:22' or '[::1]:22', but also cope with a bare v6 literal such as '::1'. This logic is also required in the two Plink front ends and in the processing of CONF_loghost for host key indexing in ssh.c, but was missing in all those places. Add it. [originally from svn r10121]
2014-01-25 15:58:57 +00:00
* savedport. (Unless there are multiple colons, in which case
* we assume this is an unbracketed IPv6 literal.)
Been meaning to do this for years: introduce a configuration option to manually tweak the host name and port number under which the SSH host key is read and written. I've put it in the cross-platform Connection panel. Partly under the flimsy pretext that other backends _can_ use it if they so wish (and in fact it overrides the host name for title-bar purposes in all network backends, though it has no other effect in anything but SSH); but mostly because the SSH panel was too full already :-) [originally from svn r8033]
2008-06-01 11:16:32 +00:00
*/
Use the new host_str* functions to improve IPv6 literal support. I've gone through everywhere we handle host names / addresses (on command lines, in PuTTY config, in port forwarding, in X display names, in host key storage...) and tried to make them handle IPv6 literals sensibly, by using the host_str* functions I introduced in my previous commit. Generally it's now OK to use a bracketed IPv6 literal anywhere a hostname might have been valid; in a few cases where no ambiguity exists (e.g. no :port suffix is permitted anyway) unbracketed IPv6 literals are also acceptable. [originally from svn r10120]
2014-01-25 15:58:54 +00:00
colon = host_strrchr(tmphost, ':');
Avoid misidentifying unbracketed IPv6 literals as host:port. Both GUI PuTTY front ends have a piece of logic whereby a string is interpreted as host:port if there's _one_ colon in it, but if there's more than one colon then it's assumed to be an IPv6 literal with no trailing port number. This permits the PuTTY command line to take strings such as 'host', 'host:22' or '[::1]:22', but also cope with a bare v6 literal such as '::1'. This logic is also required in the two Plink front ends and in the processing of CONF_loghost for host key indexing in ssh.c, but was missing in all those places. Add it. [originally from svn r10121]
2014-01-25 15:58:57 +00:00
if (colon && colon == host_strchr(tmphost, ':')) {
Been meaning to do this for years: introduce a configuration option to manually tweak the host name and port number under which the SSH host key is read and written. I've put it in the cross-platform Connection panel. Partly under the flimsy pretext that other backends _can_ use it if they so wish (and in fact it overrides the host name for title-bar purposes in all network backends, though it has no other effect in anything but SSH); but mostly because the SSH panel was too full already :-) [originally from svn r8033]
2008-06-01 11:16:32 +00:00
*colon++ = '\0';
if (*colon)
Factor out ssh_hostport_setup(). This is the part of ssh.c's connect_to_host() which figures out the host name and port number that logically identify the connection - i.e. not necessarily where we physically connected to, but what we'll use to look up the saved session cache, put in the window title bar, and give to the connection sharing code to identify other connections to share with. I'm about to want to use it for another purpose, so it needs to be moved out into a separate function.
2015-09-25 09:58:29 +00:00
*savedport = atoi(colon);
Been meaning to do this for years: introduce a configuration option to manually tweak the host name and port number under which the SSH host key is read and written. I've put it in the cross-platform Connection panel. Partly under the flimsy pretext that other backends _can_ use it if they so wish (and in fact it overrides the host name for title-bar purposes in all network backends, though it has no other effect in anything but SSH); but mostly because the SSH panel was too full already :-) [originally from svn r8033]
2008-06-01 11:16:32 +00:00
}
Use the new host_str* functions to improve IPv6 literal support. I've gone through everywhere we handle host names / addresses (on command lines, in PuTTY config, in port forwarding, in X display names, in host key storage...) and tried to make them handle IPv6 literals sensibly, by using the host_str* functions I introduced in my previous commit. Generally it's now OK to use a bracketed IPv6 literal anywhere a hostname might have been valid; in a few cases where no ambiguity exists (e.g. no :port suffix is permitted anyway) unbracketed IPv6 literals are also acceptable. [originally from svn r10120]
2014-01-25 15:58:54 +00:00
Factor out ssh_hostport_setup(). This is the part of ssh.c's connect_to_host() which figures out the host name and port number that logically identify the connection - i.e. not necessarily where we physically connected to, but what we'll use to look up the saved session cache, put in the window title bar, and give to the connection sharing code to identify other connections to share with. I'm about to want to use it for another purpose, so it needs to be moved out into a separate function.
2015-09-25 09:58:29 +00:00
*savedhost = host_strduptrim(tmphost);
Use the new host_str* functions to improve IPv6 literal support. I've gone through everywhere we handle host names / addresses (on command lines, in PuTTY config, in port forwarding, in X display names, in host key storage...) and tried to make them handle IPv6 literals sensibly, by using the host_str* functions I introduced in my previous commit. Generally it's now OK to use a bracketed IPv6 literal anywhere a hostname might have been valid; in a few cases where no ambiguity exists (e.g. no :port suffix is permitted anyway) unbracketed IPv6 literals are also acceptable. [originally from svn r10120]
2014-01-25 15:58:54 +00:00
sfree(tmphost);
Been meaning to do this for years: introduce a configuration option to manually tweak the host name and port number under which the SSH host key is read and written. I've put it in the cross-platform Connection panel. Partly under the flimsy pretext that other backends _can_ use it if they so wish (and in fact it overrides the host name for title-bar purposes in all network backends, though it has no other effect in anything but SSH); but mostly because the SSH panel was too full already :-) [originally from svn r8033]
2008-06-01 11:16:32 +00:00
} else {
Factor out ssh_hostport_setup(). This is the part of ssh.c's connect_to_host() which figures out the host name and port number that logically identify the connection - i.e. not necessarily where we physically connected to, but what we'll use to look up the saved session cache, put in the window title bar, and give to the connection sharing code to identify other connections to share with. I'm about to want to use it for another purpose, so it needs to be moved out into a separate function.
2015-09-25 09:58:29 +00:00
*savedhost = host_strduptrim(host);
Been meaning to do this for years: introduce a configuration option to manually tweak the host name and port number under which the SSH host key is read and written. I've put it in the cross-platform Connection panel. Partly under the flimsy pretext that other backends _can_ use it if they so wish (and in fact it overrides the host name for title-bar purposes in all network backends, though it has no other effect in anything but SSH); but mostly because the SSH panel was too full already :-) [originally from svn r8033]
2008-06-01 11:16:32 +00:00
if (port < 0)
port = 22; /* default ssh port */
Factor out ssh_hostport_setup(). This is the part of ssh.c's connect_to_host() which figures out the host name and port number that logically identify the connection - i.e. not necessarily where we physically connected to, but what we'll use to look up the saved session cache, put in the window title bar, and give to the connection sharing code to identify other connections to share with. I'm about to want to use it for another purpose, so it needs to be moved out into a separate function.
2015-09-25 09:58:29 +00:00
*savedport = port;
Been meaning to do this for years: introduce a configuration option to manually tweak the host name and port number under which the SSH host key is read and written. I've put it in the cross-platform Connection panel. Partly under the flimsy pretext that other backends _can_ use it if they so wish (and in fact it overrides the host name for title-bar purposes in all network backends, though it has no other effect in anything but SSH); but mostly because the SSH panel was too full already :-) [originally from svn r8033]
2008-06-01 11:16:32 +00:00
}
Factor out ssh_hostport_setup(). This is the part of ssh.c's connect_to_host() which figures out the host name and port number that logically identify the connection - i.e. not necessarily where we physically connected to, but what we'll use to look up the saved session cache, put in the window title bar, and give to the connection sharing code to identify other connections to share with. I'm about to want to use it for another purpose, so it needs to be moved out into a separate function.
2015-09-25 09:58:29 +00:00
}
New Plink operating mode: 'plink -shareexists'. A Plink invocation of the form 'plink -shareexists <session>' tests for a currently live connection-sharing upstream for the session in question. <session> can be any syntax you'd use with Plink to make the actual connection (a host/port number, a bare saved session name, -load, whatever). I envisage this being useful for things like adaptive proxying - e.g. if you want to connect to host A which you can't route to directly, and you might already have a connection to either of hosts B or C which are viable proxies, then you could write a proxy shell script which checks whether you already have an upstream for B or C and goes via whichever one is currently active. Testing for the upstream's existence has to be done by actually connecting to its socket, because on Unix the mere existence of a Unix-domain socket file doesn't guarantee that there's a process listening to it. So we make a test connection, and then immediately disconnect; hence, that shows up in the upstream's event log.
2015-09-25 10:46:28 +00:00
static int ssh_test_for_upstream(const char *host, int port, Conf *conf)
{
char *savedhost;
int savedport;
int ret;
Initialise the random state in ssh_test_for_upstream(). This protects the Unix platform sharing code in the case where no salt file exists yet in the connection-sharing directory, in which case make_dirname() will want to create one by using some random bytes, and prior to this commit, would fail an assertion because the random number generator wasn't set up. It would be neater to just return FALSE from ssh_test_for_upstream in that situation - if there's no salt file, then no sharing socket can be valid anyway - but that would involve doing more violence to the code structure than I'm currently prepared to do for a minor elegance gain.
2015-10-24 15:44:37 +00:00
random_ref(); /* platform may need this to determine share socket name */
New Plink operating mode: 'plink -shareexists'. A Plink invocation of the form 'plink -shareexists <session>' tests for a currently live connection-sharing upstream for the session in question. <session> can be any syntax you'd use with Plink to make the actual connection (a host/port number, a bare saved session name, -load, whatever). I envisage this being useful for things like adaptive proxying - e.g. if you want to connect to host A which you can't route to directly, and you might already have a connection to either of hosts B or C which are viable proxies, then you could write a proxy shell script which checks whether you already have an upstream for B or C and goes via whichever one is currently active. Testing for the upstream's existence has to be done by actually connecting to its socket, because on Unix the mere existence of a Unix-domain socket file doesn't guarantee that there's a process listening to it. So we make a test connection, and then immediately disconnect; hence, that shows up in the upstream's event log.
2015-09-25 10:46:28 +00:00
ssh_hostport_setup(host, port, conf, &savedhost, &savedport, NULL);
ret = ssh_share_test_for_upstream(savedhost, savedport, conf);
sfree(savedhost);
Initialise the random state in ssh_test_for_upstream(). This protects the Unix platform sharing code in the case where no salt file exists yet in the connection-sharing directory, in which case make_dirname() will want to create one by using some random bytes, and prior to this commit, would fail an assertion because the random number generator wasn't set up. It would be neater to just return FALSE from ssh_test_for_upstream in that situation - if there's no salt file, then no sharing socket can be valid anyway - but that would involve doing more violence to the code structure than I'm currently prepared to do for a minor elegance gain.
2015-10-24 15:44:37 +00:00
random_unref();
New Plink operating mode: 'plink -shareexists'. A Plink invocation of the form 'plink -shareexists <session>' tests for a currently live connection-sharing upstream for the session in question. <session> can be any syntax you'd use with Plink to make the actual connection (a host/port number, a bare saved session name, -load, whatever). I envisage this being useful for things like adaptive proxying - e.g. if you want to connect to host A which you can't route to directly, and you might already have a connection to either of hosts B or C which are viable proxies, then you could write a proxy shell script which checks whether you already have an upstream for B or C and goes via whichever one is currently active. Testing for the upstream's existence has to be done by actually connecting to its socket, because on Unix the mere existence of a Unix-domain socket file doesn't guarantee that there's a process listening to it. So we make a test connection, and then immediately disconnect; hence, that shows up in the upstream's event log.
2015-09-25 10:46:28 +00:00
return ret;
}
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
static const Plug_vtable Ssh_plugvt = {
ssh_socket_log,
ssh_closing,
ssh_receive,
ssh_sent,
NULL
};
Factor out ssh_hostport_setup(). This is the part of ssh.c's connect_to_host() which figures out the host name and port number that logically identify the connection - i.e. not necessarily where we physically connected to, but what we'll use to look up the saved session cache, put in the window title bar, and give to the connection sharing code to identify other connections to share with. I'm about to want to use it for another purpose, so it needs to be moved out into a separate function.
2015-09-25 09:58:29 +00:00
/*
* Connect to specified host and port.
* Returns an error message, or NULL on success.
* Also places the canonical host name into `realhost'. It must be
* freed by the caller.
*/
static const char *connect_to_host(Ssh ssh, const char *host, int port,
char **realhost, int nodelay, int keepalive)
{
SockAddr addr;
const char *err;
char *loghost;
int addressfamily, sshprot;
ssh_hostport_setup(host, port, ssh->conf,
&ssh->savedhost, &ssh->savedport, &loghost);
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
ssh->plugvt = &Ssh_plugvt;
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
/*
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
* Try connection-sharing, in case that means we don't open a
* socket after all. ssh_connection_sharing_init will connect to a
* previously established upstream if it can, and failing that,
* establish a listening socket for _us_ to be the upstream. In
* the latter case it will return NULL just as if it had done
* nothing, because here we only need to care if we're a
* downstream and need to do our connection setup differently.
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
*/
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
ssh->connshare = NULL;
ssh->attempting_connshare = TRUE; /* affects socket logging behaviour */
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
ssh->s = ssh_connection_sharing_init(
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
ssh->savedhost, ssh->savedport, ssh->conf, &ssh->cl, &ssh->plugvt,
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
&ssh->connshare);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
ssh->attempting_connshare = FALSE;
if (ssh->s != NULL) {
/*
* We are a downstream.
*/
ssh->bare_connection = TRUE;
ssh->fullhostname = NULL;
*realhost = dupstr(host); /* best we can do */
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
/* In an interactive session, or in verbose mode, announce
* in the console window that we're a sharing downstream,
* to avoid confusing users as to why this session doesn't
* behave in quite the usual way. */
c_write_str(ssh,"Reusing a shared connection to this server.\r\n");
}
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
} else {
/*
* We're not a downstream, so open a normal socket.
*/
/*
* Try to find host.
*/
addressfamily = conf_get_int(ssh->conf, CONF_addressfamily);
Tell the truth about DNS lookups in the Event Log. We've always had the back-end code unconditionally print 'Looking up host' before calling name_lookup. But name_lookup doesn't always do an actual lookup - in cases where the connection will be proxied and we're configured to let the proxy do the DNS for us, it just calls sk_nonamelookup to return a dummy SockAddr with the unresolved name still in it. It's better to print a message that varies depending on whether we're _really_ doing DNS or not, e.g. so that people can tell the difference between DNS failure and proxy misconfiguration. Hence, those log messages are now generated inside name_lookup(), which takes a couple of extra parameters for the purpose - a frontend pointer to pass to logevent(), and a reason string so that it can say what the hostname it's (optionally) looking up is going to be used for. (The latter is intended for possible use in logging subsidiary lookups for port forwarding, though the moment I haven't changed the current setup where those connection setups aren't logged in detail - we just pass NULL in that situation.)
2015-11-22 09:58:14 +00:00
addr = name_lookup(host, port, realhost, ssh->conf, addressfamily,
ssh->frontend, "SSH connection");
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
if ((err = sk_addr_error(addr)) != NULL) {
sk_addr_free(addr);
return err;
}
ssh->fullhostname = dupstr(*realhost); /* save in case of GSSAPI */
ssh->s = new_connection(addr, *realhost, port,
0, 1, nodelay, keepalive,
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
&ssh->plugvt, ssh->conf);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
if ((err = sk_socket_error(ssh->s)) != NULL) {
ssh->s = NULL;
notify_remote_exit(ssh->frontend);
return err;
}
Set SSH socket variable to NULL if connect() fails. Failure to do this was causing PSCP to hang indefinitely after reporting Connection Refused. [originally from svn r1569]
2002-02-27 22:45:52 +00:00
}
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
Arrange that log_packet() isn't called for raw data logging if logctx is null. This allows us to send data in ssh_init(), albeit at the expense of its not being properly logged, so arrange to send the version string then if that's sensible, which should reduce the number of round-trips required to bring up an SSH-2 connection. [originally from svn r7646]
2007-07-21 13:43:57 +00:00
/*
Stop supporting fallback between SSH versions. The UI now only has "1" and "2" options for SSH protocol version, which behave like the old "1 only" and "2 only" options; old SSH-N-with-fallback settings are interpreted as SSH-N-only. This prevents any attempt at a protocol downgrade attack. Most users should see no difference; those poor souls who still have to work with SSH-1 equipment now have to explicitly opt in.
2016-03-28 19:23:57 +00:00
* The SSH version number is always fixed (since we no longer support
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
* fallback between versions), so set it now.
Arrange that log_packet() isn't called for raw data logging if logctx is null. This allows us to send data in ssh_init(), albeit at the expense of its not being properly logged, so arrange to send the version string then if that's sensible, which should reduce the number of round-trips required to bring up an SSH-2 connection. [originally from svn r7646]
2007-07-21 13:43:57 +00:00
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
sshprot = conf_get_int(ssh->conf, CONF_sshprot);
Stop supporting fallback between SSH versions. The UI now only has "1" and "2" options for SSH protocol version, which behave like the old "1 only" and "2 only" options; old SSH-N-with-fallback settings are interpreted as SSH-N-only. This prevents any attempt at a protocol downgrade attack. Most users should see no difference; those poor souls who still have to work with SSH-1 equipment now have to explicitly opt in.
2016-03-28 19:23:57 +00:00
assert(sshprot == 0 || sshprot == 3);
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (sshprot == 0)
Stop supporting fallback between SSH versions. The UI now only has "1" and "2" options for SSH protocol version, which behave like the old "1 only" and "2 only" options; old SSH-N-with-fallback settings are interpreted as SSH-N-only. This prevents any attempt at a protocol downgrade attack. Most users should see no difference; those poor souls who still have to work with SSH-1 equipment now have to explicitly opt in.
2016-03-28 19:23:57 +00:00
/* SSH-1 only */
Arrange that log_packet() isn't called for raw data logging if logctx is null. This allows us to send data in ssh_init(), albeit at the expense of its not being properly logged, so arrange to send the version string then if that's sensible, which should reduce the number of round-trips required to bring up an SSH-2 connection. [originally from svn r7646]
2007-07-21 13:43:57 +00:00
ssh->version = 1;
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
if (sshprot == 3 || ssh->bare_connection) {
Stop supporting fallback between SSH versions. The UI now only has "1" and "2" options for SSH protocol version, which behave like the old "1 only" and "2 only" options; old SSH-N-with-fallback settings are interpreted as SSH-N-only. This prevents any attempt at a protocol downgrade attack. Most users should see no difference; those poor souls who still have to work with SSH-1 equipment now have to explicitly opt in.
2016-03-28 19:23:57 +00:00
/* SSH-2 only */
Arrange that log_packet() isn't called for raw data logging if logctx is null. This allows us to send data in ssh_init(), albeit at the expense of its not being properly logged, so arrange to send the version string then if that's sensible, which should reduce the number of round-trips required to bring up an SSH-2 connection. [originally from svn r7646]
2007-07-21 13:43:57 +00:00
ssh->version = 2;
}
Move version string exchange out into a BPP. Getting it out of the overgrown ssh.c is worthwhile in itself! But there are other benefits of this reorganisation too. One is that I get to remove ssh->current_incoming_data_fn, because now _all_ incoming network data is handled by whatever the current BPP is. So now we only indirect through the BPP, not through some other preliminary function pointer _and_ the BPP. Another is that all _outgoing_ network data is now handled centrally, including our outgoing version string - which means that a hex dump of that string now shows up in the raw-data log file, from which it was previously conspicuous by its absence.
2018-09-19 16:37:00 +00:00
/*
* Set up the initial BPP that will do the version string
* exchange.
*/
ssh->version_receiver.got_ssh_version = ssh_got_ssh_version;
ssh->bpp = ssh_verstring_new(
ssh->conf, ssh->frontend, ssh->bare_connection,
ssh->version == 1 ? "1.5" : "2.0", &ssh->version_receiver);
ssh->bpp->out_raw = &ssh->outgoing_data;
ssh->bpp->in_raw = &ssh->incoming_data;
/*
* And call its handle_input method right now, in case it wants to
* send the outgoing version string immediately.
*/
ssh_bpp_handle_input(ssh->bpp);
queue_idempotent_callback(&ssh->outgoing_data_sender);
Been meaning to do this for years: introduce a configuration option to manually tweak the host name and port number under which the SSH host key is read and written. I've put it in the cross-platform Connection panel. Partly under the flimsy pretext that other backends _can_ use it if they so wish (and in fact it overrides the host name for title-bar purposes in all network backends, though it has no other effect in anything but SSH); but mostly because the SSH panel was too full already :-) [originally from svn r8033]
2008-06-01 11:16:32 +00:00
/*
* loghost, if configured, overrides realhost.
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (*loghost) {
Been meaning to do this for years: introduce a configuration option to manually tweak the host name and port number under which the SSH host key is read and written. I've put it in the cross-platform Connection panel. Partly under the flimsy pretext that other backends _can_ use it if they so wish (and in fact it overrides the host name for title-bar purposes in all network backends, though it has no other effect in anything but SSH); but mostly because the SSH panel was too full already :-) [originally from svn r8033]
2008-06-01 11:16:32 +00:00
sfree(*realhost);
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
*realhost = dupstr(loghost);
Been meaning to do this for years: introduce a configuration option to manually tweak the host name and port number under which the SSH host key is read and written. I've put it in the cross-platform Connection panel. Partly under the flimsy pretext that other backends _can_ use it if they so wish (and in fact it overrides the host name for title-bar purposes in all network backends, though it has no other effect in anything but SSH); but mostly because the SSH panel was too full already :-) [originally from svn r8033]
2008-06-01 11:16:32 +00:00
}
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
return NULL;
}
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
/*
* Throttle or unthrottle the SSH connection.
*/
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
static void ssh_throttle_conn(Ssh ssh, int adjust)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
{
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
int old_count = ssh->conn_throttle_count;
Get rid of ssh_set_frozen. We used it to suppress reading from the network at every point during protocol setup where PuTTY was waiting for a user response to a dialog box (e.g. a host key warning). The purpose of this was to avoid dropping an important packet while the coroutine was listening to one of its other input parameters (as it were). But now everything is queue-based, packets will stay queued until we're ready to look at them anyway; so it's better _not_ to freeze the connection, so that messages we _can_ handle in between (e.g. SSH_MSG_DEBUG or SSH_MSG_IGNORE) can still be processed. That dispenses with all uses of ssh_set_frozen except for its use by ssh_throttle_conn to exert back-pressure on the server in SSH1 which doesn't have per-channel windows. So I've moved that last use _into_ ssh_throttle_conn, and now the function is completely gone.
2018-09-19 19:52:12 +00:00
int frozen;
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
ssh->conn_throttle_count += adjust;
assert(ssh->conn_throttle_count >= 0);
Get rid of ssh_set_frozen. We used it to suppress reading from the network at every point during protocol setup where PuTTY was waiting for a user response to a dialog box (e.g. a host key warning). The purpose of this was to avoid dropping an important packet while the coroutine was listening to one of its other input parameters (as it were). But now everything is queue-based, packets will stay queued until we're ready to look at them anyway; so it's better _not_ to freeze the connection, so that messages we _can_ handle in between (e.g. SSH_MSG_DEBUG or SSH_MSG_IGNORE) can still be processed. That dispenses with all uses of ssh_set_frozen except for its use by ssh_throttle_conn to exert back-pressure on the server in SSH1 which doesn't have per-channel windows. So I've moved that last use _into_ ssh_throttle_conn, and now the function is completely gone.
2018-09-19 19:52:12 +00:00
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
if (ssh->conn_throttle_count && !old_count) {
Get rid of ssh_set_frozen. We used it to suppress reading from the network at every point during protocol setup where PuTTY was waiting for a user response to a dialog box (e.g. a host key warning). The purpose of this was to avoid dropping an important packet while the coroutine was listening to one of its other input parameters (as it were). But now everything is queue-based, packets will stay queued until we're ready to look at them anyway; so it's better _not_ to freeze the connection, so that messages we _can_ handle in between (e.g. SSH_MSG_DEBUG or SSH_MSG_IGNORE) can still be processed. That dispenses with all uses of ssh_set_frozen except for its use by ssh_throttle_conn to exert back-pressure on the server in SSH1 which doesn't have per-channel windows. So I've moved that last use _into_ ssh_throttle_conn, and now the function is completely gone.
2018-09-19 19:52:12 +00:00
frozen = TRUE;
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
} else if (!ssh->conn_throttle_count && old_count) {
Get rid of ssh_set_frozen. We used it to suppress reading from the network at every point during protocol setup where PuTTY was waiting for a user response to a dialog box (e.g. a host key warning). The purpose of this was to avoid dropping an important packet while the coroutine was listening to one of its other input parameters (as it were). But now everything is queue-based, packets will stay queued until we're ready to look at them anyway; so it's better _not_ to freeze the connection, so that messages we _can_ handle in between (e.g. SSH_MSG_DEBUG or SSH_MSG_IGNORE) can still be processed. That dispenses with all uses of ssh_set_frozen except for its use by ssh_throttle_conn to exert back-pressure on the server in SSH1 which doesn't have per-channel windows. So I've moved that last use _into_ ssh_throttle_conn, and now the function is completely gone.
2018-09-19 19:52:12 +00:00
frozen = FALSE;
} else {
return; /* don't change current frozen state */
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
Get rid of ssh_set_frozen. We used it to suppress reading from the network at every point during protocol setup where PuTTY was waiting for a user response to a dialog box (e.g. a host key warning). The purpose of this was to avoid dropping an important packet while the coroutine was listening to one of its other input parameters (as it were). But now everything is queue-based, packets will stay queued until we're ready to look at them anyway; so it's better _not_ to freeze the connection, so that messages we _can_ handle in between (e.g. SSH_MSG_DEBUG or SSH_MSG_IGNORE) can still be processed. That dispenses with all uses of ssh_set_frozen except for its use by ssh_throttle_conn to exert back-pressure on the server in SSH1 which doesn't have per-channel windows. So I've moved that last use _into_ ssh_throttle_conn, and now the function is completely gone.
2018-09-19 19:52:12 +00:00
ssh->frozen = frozen;
if (ssh->s)
sk_set_frozen(ssh->s, frozen);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
static void ssh_channel_check_throttle(struct ssh_channel *c)
{
/*
* We don't want this channel to read further input if this
* particular channel has a backed-up SSH window, or if the
* outgoing side of the whole SSH connection is currently
* throttled, or if this channel already has an outgoing EOF
* either sent or pending.
*/
chan_set_input_wanted(c->chan,
!c->throttled_by_backlog &&
!c->ssh->throttled_all &&
!c->pending_eof &&
!(c->closes & CLOSES_SENT_EOF));
}
Rewrite agent forwarding to serialise requests. The previous agent-forwarding system worked by passing each complete query received from the input to agent_query() as soon as it was ready. So if the remote client were to pipeline multiple requests, then Unix PuTTY (in which agent_query() works asynchronously) would parallelise them into many _simultaneous_ connections to the real agent - and would not track which query went out first, so that if the real agent happened to send its replies (to what _it_ thought were independent clients) in the wrong order, then PuTTY would serialise the replies on to the forwarding channel in whatever order it got them, which wouldn't be the order the remote client was expecting. To solve this, I've done a considerable rewrite, which keeps the request stream in a bufchain, and only removes data from the bufchain when it has a complete request. Then, if agent_query decides to be asynchronous, the forwarding system waits for _that_ agent response before even trying to extract the next request's worth of data from the bufchain. As an added bonus (in principle), this gives agent-forwarding channels some actual flow control for the first time ever! If a client spams us with an endless stream of rapid requests, and never reads its responses, then the output side of the channel will run out of window, which causes us to stop processing requests until we have space to send responses again, which in turn causes us to stop granting extra window on the input side, which serves the client right.
2017-01-29 19:40:38 +00:00
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
/*
* Throttle or unthrottle _all_ local data streams (for when sends
* on the SSH connection itself back up).
*/
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
static void ssh_throttle_all(Ssh ssh, int enable, int bufsize)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
{
int i;
struct ssh_channel *c;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (enable == ssh->throttled_all)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
return;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->throttled_all = enable;
ssh->overall_bufsize = bufsize;
if (!ssh->channels)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
return;
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
for (i = 0; NULL != (c = index234(ssh->channels, i)); i++)
ssh_channel_check_throttle(c);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
Make ssh_agent_callback() and ssh_agentf_callback() static. [originally from svn r3182]
2003-05-10 12:54:29 +00:00
static void ssh_agent_callback(void *sshv, void *reply, int replylen)
First half of `pageant-async' work. agent_query() is now passed a callback function; it may return 0 to indicate that it doesn't have an answer _yet_, in which case it will call the callback later on when it does, or it may return 1 to indicate that it's got an answer right now. The Windows agent_query() implementation is functionally unchanged and still synchronous, but the Unix one is async (since that one was really easy to do via uxsel). ssh.c copes cheerfully with either return value, so other ports are at liberty to be sync or async as they choose. [originally from svn r3153]
2003-04-28 11:41:39 +00:00
{
Ssh ssh = (Ssh) sshv;
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
ssh->auth_agent_query = NULL;
First half of `pageant-async' work. agent_query() is now passed a callback function; it may return 0 to indicate that it doesn't have an answer _yet_, in which case it will call the callback later on when it does, or it may return 1 to indicate that it's got an answer right now. The Windows agent_query() implementation is functionally unchanged and still synchronous, but the Unix one is async (since that one was really easy to do via uxsel). ssh.c copes cheerfully with either return value, so other ports are at liberty to be sync or async as they choose. [originally from svn r3153]
2003-04-28 11:41:39 +00:00
ssh->agent_response = reply;
ssh->agent_response_len = replylen;
if (ssh->version == 1)
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
do_ssh1_login(ssh);
First half of `pageant-async' work. agent_query() is now passed a callback function; it may return 0 to indicate that it doesn't have an answer _yet_, in which case it will call the callback later on when it does, or it may return 1 to indicate that it's got an answer right now. The Windows agent_query() implementation is functionally unchanged and still synchronous, but the Unix one is async (since that one was really easy to do via uxsel). ssh.c copes cheerfully with either return value, so other ports are at liberty to be sync or async as they choose. [originally from svn r3153]
2003-04-28 11:41:39 +00:00
else
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
do_ssh2_userauth(ssh);
First half of `pageant-async' work. agent_query() is now passed a callback function; it may return 0 to indicate that it doesn't have an answer _yet_, in which case it will call the callback later on when it does, or it may return 1 to indicate that it's got an answer right now. The Windows agent_query() implementation is functionally unchanged and still synchronous, but the Unix one is async (since that one was really easy to do via uxsel). ssh.c copes cheerfully with either return value, so other ports are at liberty to be sync or async as they choose. [originally from svn r3153]
2003-04-28 11:41:39 +00:00
}
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
static void ssh_dialog_callback(void *sshv, int ret)
{
Ssh ssh = (Ssh) sshv;
ssh->user_response = ret;
if (ssh->version == 1)
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
do_ssh1_login(ssh);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
else
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
queue_idempotent_callback(&ssh->ssh2_transport_icb);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
/*
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
* This may have unfrozen the SSH connection.
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
*/
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
if (!ssh->frozen)
queue_idempotent_callback(&ssh->incoming_data_consumer);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
}
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
/*
* Client-initiated disconnection. Send a DISCONNECT if `wire_reason'
* non-NULL, otherwise just close the connection. `client_reason' == NULL
* => log `wire_reason'.
*/
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
static void ssh_disconnect(Ssh ssh, const char *client_reason,
const char *wire_reason,
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
int code, int clean_exit)
{
char *error;
if (!client_reason)
client_reason = wire_reason;
if (client_reason)
error = dupprintf("Disconnected: %s", client_reason);
else
error = dupstr("Disconnected");
if (wire_reason) {
if (ssh->version == 1) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
PktOut *pktout = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_DISCONNECT);
put_stringz(pktout, wire_reason);
ssh_pkt_write(ssh, pktout);
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
} else if (ssh->version == 2) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
PktOut *pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_DISCONNECT);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, code);
put_stringz(pktout, wire_reason);
put_stringz(pktout, "en"); /* language tag */
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, pktout);
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
}
}
ssh->close_expected = TRUE;
ssh->clean_exit = clean_exit;
Modernise the Socket/Plug vtable system. Now I've got FROMFIELD, I can rework it so that structures providing an implementation of the Socket or Plug trait no longer have to have the vtable pointer as the very first thing in the structure. In particular, this means that the ProxySocket structure can now directly implement _both_ the Socket and Plug traits, which is always _logically_ how it's worked, but previously it had to be implemented via two separate structs linked to each other.
2018-05-27 08:29:33 +00:00
ssh_closing(&ssh->plugvt, error, 0, 0);
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
sfree(error);
}
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
int verify_ssh_manual_host_key(Ssh ssh, const char *fingerprint, ssh_key *key)
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
{
if (!conf_get_str_nthstrkey(ssh->conf, CONF_ssh_manual_hostkeys, 0)) {
return -1; /* no manual keys configured */
}
if (fingerprint) {
/*
* The fingerprint string we've been given will have things
* like 'ssh-rsa 2048' at the front of it. Strip those off and
* narrow down to just the colon-separated hex block at the
* end of the string.
*/
const char *p = strrchr(fingerprint, ' ');
fingerprint = p ? p+1 : fingerprint;
/* Quick sanity checks, including making sure it's in lowercase */
assert(strlen(fingerprint) == 16*3 - 1);
assert(fingerprint[2] == ':');
assert(fingerprint[strspn(fingerprint, "0123456789abcdef:")] == 0);
if (conf_get_str_str_opt(ssh->conf, CONF_ssh_manual_hostkeys,
fingerprint))
return 1; /* success */
}
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
if (key) {
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
/*
* Construct the base64-encoded public key blob and see if
* that's listed.
*/
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf *binblob;
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
char *base64blob;
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
int atoms, i;
binblob = strbuf_new();
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_key_public_blob(key, BinarySink_UPCAST(binblob));
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
atoms = (binblob->len + 2) / 3;
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
base64blob = snewn(atoms * 4 + 1, char);
for (i = 0; i < atoms; i++)
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
base64_encode_atom(binblob->u + 3*i,
binblob->len - 3*i, base64blob + 4*i);
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
base64blob[atoms * 4] = '\0';
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf_free(binblob);
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
if (conf_get_str_str_opt(ssh->conf, CONF_ssh_manual_hostkeys,
base64blob)) {
sfree(base64blob);
return 1; /* success */
}
sfree(base64blob);
}
return 0;
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_coro_wrapper_initial(Ssh ssh, PktIn *pktin);
static void ssh1_coro_wrapper_session(Ssh ssh, PktIn *pktin);
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
static void ssh1_connection_input(Ssh ssh);
Joris van Rantwijk's unified SSH code suitable for PuTTY and PSCP [originally from svn r504] [this commit reordered to come after creation of 0.49 tag]
2000-06-22 12:18:34 +00:00
/*
* Handle the key exchange and user authentication phases.
*/
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
static void do_ssh1_login(void *vctx)
Joris van Rantwijk's unified SSH code suitable for PuTTY and PSCP [originally from svn r504] [this commit reordered to come after creation of 0.49 tag]
2000-06-22 12:18:34 +00:00
{
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
Ssh ssh = (Ssh)vctx;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktIn *pktin;
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
PktOut *pkt;
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
int i, j, ret;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen pl;
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
struct MD5Context md5c;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
struct do_ssh1_login_state {
Tweak to SSH coroutine code: put line number in the coroutine state structure, which is consistent with Simon's canonical version of the macros. [originally from svn r9607]
2012-08-18 09:30:01 +00:00
int crLine;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int len;
Const-correctness in public-key functions. Several of the functions in ssh2_signkey, and one or two SSH-1 key functions too, were still taking assorted non-const buffer parameters that had never been properly constified. Sort them all out.
2015-05-05 19:16:17 +00:00
unsigned char *rsabuf;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
unsigned long supported_ciphers_mask, supported_auths_mask;
int tried_publickey, tried_agent;
int tis_auth_refused, ccard_auth_refused;
do_ssh1_login: make 'cookie' a coroutine variable. Previously it was local, which _mostly_ worked, except that if the SSH host key needed verifying via a non-modal dialog box, there could be a crReturn in between writing it and reading it. It's pretty tempting to suggest that because nobody has noticed this before, SSH-1 can't be needed any more! But actually I suspect the intervening crReturn has only appeared since the last release, probably around November when I was messing about with GTK dialog box modality. (I observed the problem just now on the GTK build, while trying to check that a completely different set of changes hadn't broken SSH-1.)
2018-05-17 18:41:25 +00:00
unsigned char cookie[8];
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
unsigned char session_id[16];
int cipher_type;
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf *publickey_blob;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
char *publickey_comment;
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
int privatekey_available, privatekey_encrypted;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
prompts_t *cur_prompt;
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
int userpass_ret;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
char c;
int pwpkt_type;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
unsigned char *agent_response;
BinarySource asrc[1]; /* response from SSH agent */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int keyi, nkeys;
int authed;
struct RSAKey key;
Bignum challenge;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
ptrlen comment;
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
int dlgret;
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
Filename *keyfile;
Move the SSH-1 servkey and hostkey variables into the coroutine state, since there is a theoretical code path (via the crReturn loop after asking an interactive question about a host key or crypto algorithm) on which we can leave and return to do_ssh1_login between allocating and freeing those keys. (In practice it shouldn't come up anyway with any of the current implementations of the interactive question functions, not to mention the unlikelihood of anyone non-specialist still using SSH-1, but better safe than sorry.) [originally from svn r9895]
2013-07-07 14:34:37 +00:00
struct RSAKey servkey, hostkey;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
};
crState(do_ssh1_login_state);
Tweak to SSH coroutine code: put line number in the coroutine state structure, which is consistent with Simon's canonical version of the macros. [originally from svn r9607]
2012-08-18 09:30:01 +00:00
crBeginState;
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_login)) != NULL);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type != SSH1_SMSG_PUBLIC_KEY) {
Ahem; fix `bombout' so it passes the correct frontend handle to connection_fatal(). [originally from svn r3030]
2003-03-31 11:22:30 +00:00
bombout(("Public key packet not received"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Prevent network errors from summarily closing the window when CoE is off [originally from svn r613]
2000-09-22 11:04:57 +00:00
}
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
logevent("Received public keys");
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
pl = get_data(pktin, 8);
memcpy(s->cookie, pl.ptr, pl.len);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Remove 'keystr' parameter in get_rsa_ssh1_pub. This parameter returned a substring of the input, which was used for two purposes. Firstly, it was used to hash the host and server keys during the initial SSH-1 key setup phase; secondly, it was used to check the keys in Pageant against the public key blob of a key specified on the command line. Unfortunately, those two purposes didn't agree! The first one needs just the bare key modulus bytes (without even the SSH-1 mpint length header); the second needs the entire key blob. So, actually, it seems to have never worked in SSH-1 to say 'putty -i keyfile' and have PuTTY find that key in Pageant and not have to ask for the passphrase to decrypt the version on disk. Fixed by removing that parameter completely, which simplifies all the _other_ call sites, and replacing it by custom code in those two places that each does the actually right thing.
2018-06-03 07:23:07 +00:00
get_rsa_ssh1_pub(pktin, &s->servkey, RSA_SSH1_EXPONENT_FIRST);
get_rsa_ssh1_pub(pktin, &s->hostkey, RSA_SSH1_EXPONENT_FIRST);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Fix a valgrind error. rsa_ssh1_fingerprint will look at the input key's comment field, which I forgot to initialise to anything, even the NULL it should be.
2018-06-06 19:05:13 +00:00
s->hostkey.comment = NULL; /* avoid confusing rsa_ssh1_fingerprint */
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
/*
Implement OpenSSH-compatible RSA key fingerprints and use them throughout [originally from svn r637]
2000-09-26 14:26:21 +00:00
* Log the host key fingerprint.
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
*/
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
if (!get_err(pktin)) {
Give rsa_fingerprint() a new name and API. It's an SSH-1 specific function, so it should have a name reflecting that, and it didn't. Also it had one of those outdated APIs involving passing it a client-allocated buffer and size. Now it has a sensible name, and internally it constructs the output string using a strbuf and returns it dynamically allocated.
2018-06-03 07:08:53 +00:00
char *fingerprint = rsa_ssh1_fingerprint(&s->hostkey);
Implement OpenSSH-compatible RSA key fingerprints and use them throughout [originally from svn r637]
2000-09-26 14:26:21 +00:00
logevent("Host key fingerprint is:");
Give rsa_fingerprint() a new name and API. It's an SSH-1 specific function, so it should have a name reflecting that, and it didn't. Also it had one of those outdated APIs involving passing it a client-allocated buffer and size. Now it has a sensible name, and internally it constructs the output string using a strbuf and returns it dynamically allocated.
2018-06-03 07:08:53 +00:00
logeventf(ssh, " %s", fingerprint);
sfree(fingerprint);
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ssh->v1_remote_protoflags = get_uint32(pktin);
s->supported_ciphers_mask = get_uint32(pktin);
s->supported_auths_mask = get_uint32(pktin);
if (get_err(pktin)) {
bombout(("Bad SSH-1 public key packet"));
crStopV;
}
Don't try SSH-1 RSA authentication unless the server has advertised support for it. It's possible that this obsoletes BUG_CHOKES_ON_RSA. Certainly the one SSH-1.5-Cisco-1.25 server I found was correctly not advertising RSA auth. For now, leave it in, because I'm not feeling entirely confident. [originally from svn r7726]
2007-09-20 21:33:21 +00:00
if ((ssh->remote_bugs & BUG_CHOKES_ON_RSA))
s->supported_auths_mask &= ~(1 << SSH1_AUTH_RSA);
Add encryption selection, and Blowfish as second option [originally from svn r175]
1999-07-06 19:42:57 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->v1_local_protoflags =
ssh->v1_remote_protoflags & SSH1_PROTOFLAGS_SUPPORTED;
ssh->v1_local_protoflags |= SSH1_PROTOFLAG_SCREEN_NUMBER;
Correct handling of SSH1 protocol flags, in particular PROTOFLAG_SCREEN_NUMBER, without which OpenSSH 2.5.1 was objecting to my gratuitous inclusion of a screen number in the SSH1 X forwarding request. Ahem. [originally from svn r1006]
2001-03-16 11:58:54 +00:00
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
MD5Init(&md5c);
Remove 'keystr' parameter in get_rsa_ssh1_pub. This parameter returned a substring of the input, which was used for two purposes. Firstly, it was used to hash the host and server keys during the initial SSH-1 key setup phase; secondly, it was used to check the keys in Pageant against the public key blob of a key specified on the command line. Unfortunately, those two purposes didn't agree! The first one needs just the bare key modulus bytes (without even the SSH-1 mpint length header); the second needs the entire key blob. So, actually, it seems to have never worked in SSH-1 to say 'putty -i keyfile' and have PuTTY find that key in Pageant and not have to ask for the passphrase to decrypt the version on disk. Fixed by removing that parameter completely, which simplifies all the _other_ call sites, and replacing it by custom code in those two places that each does the actually right thing.
2018-06-03 07:23:07 +00:00
{
int i;
for (i = (bignum_bitcount(s->hostkey.modulus) + 7) / 8; i-- ;)
put_byte(&md5c, bignum_byte(s->hostkey.modulus, i));
for (i = (bignum_bitcount(s->servkey.modulus) + 7) / 8; i-- ;)
put_byte(&md5c, bignum_byte(s->servkey.modulus, i));
}
Replace all uses of SHA*_Bytes / MD5Update. In fact, those functions don't even exist any more. The only way to get data into a primitive hash state is via the new put_* system. Of course, that means put_data() is a viable replacement for every previous call to one of the per-hash update functions - but just mechanically doing that would have missed the opportunity to simplify a lot of the call sites.
2018-05-24 09:03:36 +00:00
put_data(&md5c, s->cookie, 8);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
MD5Final(s->session_id, &md5c);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
for (i = 0; i < 32; i++)
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->session_key[i] = random_byte();
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
/*
* Verify that the `bits' and `bytes' parameters match.
*/
Move the SSH-1 servkey and hostkey variables into the coroutine state, since there is a theoretical code path (via the crReturn loop after asking an interactive question about a host key or crypto algorithm) on which we can leave and return to do_ssh1_login between allocating and freeing those keys. (In practice it shouldn't come up anyway with any of the current implementations of the interactive question functions, not to mention the unlikelihood of anyone non-specialist still using SSH-1, but better safe than sorry.) [originally from svn r9895]
2013-07-07 14:34:37 +00:00
if (s->hostkey.bits > s->hostkey.bytes * 8 ||
s->servkey.bits > s->servkey.bytes * 8) {
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
bombout(("SSH-1 public keys were badly formatted"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
}
Move the SSH-1 servkey and hostkey variables into the coroutine state, since there is a theoretical code path (via the crReturn loop after asking an interactive question about a host key or crypto algorithm) on which we can leave and return to do_ssh1_login between allocating and freeing those keys. (In practice it shouldn't come up anyway with any of the current implementations of the interactive question functions, not to mention the unlikelihood of anyone non-specialist still using SSH-1, but better safe than sorry.) [originally from svn r9895]
2013-07-07 14:34:37 +00:00
s->len = (s->hostkey.bytes > s->servkey.bytes ?
s->hostkey.bytes : s->servkey.bytes);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Introduced wrapper macros snew(), snewn() and sresize() for the malloc functions, which automatically cast to the same type they're allocating the size of. Should prevent any future errors involving mallocing the size of the wrong structure type, and will also make life easier if we ever need to turn the PuTTY core code from real C into C++-friendly C. I haven't touched the Mac frontend in this checkin because I couldn't compile or test it. [originally from svn r3014]
2003-03-29 16:14:26 +00:00
s->rsabuf = snewn(s->len, unsigned char);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
First stab at the ability to compile puttytel.exe, an SSH-free variant which is patent-safe in the US and legal in France and Russia. This is a horrible hack in some ways: it's shown up serious deficiencies in the module boundaries. Needs further work, probably once the SSH implementations are recombined. [originally from svn r410]
2000-03-15 15:08:48 +00:00
/*
* Verify the host key.
*/
{
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
/*
* First format the key into a string.
*/
Move the SSH-1 servkey and hostkey variables into the coroutine state, since there is a theoretical code path (via the crReturn loop after asking an interactive question about a host key or crypto algorithm) on which we can leave and return to do_ssh1_login between allocating and freeing those keys. (In practice it shouldn't come up anyway with any of the current implementations of the interactive question functions, not to mention the unlikelihood of anyone non-specialist still using SSH-1, but better safe than sorry.) [originally from svn r9895]
2013-07-07 14:34:37 +00:00
int len = rsastr_len(&s->hostkey);
Give rsa_fingerprint() a new name and API. It's an SSH-1 specific function, so it should have a name reflecting that, and it didn't. Also it had one of those outdated APIs involving passing it a client-allocated buffer and size. Now it has a sensible name, and internally it constructs the output string using a strbuf and returns it dynamically allocated.
2018-06-03 07:08:53 +00:00
char *fingerprint;
Introduced wrapper macros snew(), snewn() and sresize() for the malloc functions, which automatically cast to the same type they're allocating the size of. Should prevent any future errors involving mallocing the size of the wrong structure type, and will also make life easier if we ever need to turn the PuTTY core code from real C into C++-friendly C. I haven't touched the Mac frontend in this checkin because I couldn't compile or test it. [originally from svn r3014]
2003-03-29 16:14:26 +00:00
char *keystr = snewn(len, char);
Move the SSH-1 servkey and hostkey variables into the coroutine state, since there is a theoretical code path (via the crReturn loop after asking an interactive question about a host key or crypto algorithm) on which we can leave and return to do_ssh1_login between allocating and freeing those keys. (In practice it shouldn't come up anyway with any of the current implementations of the interactive question functions, not to mention the unlikelihood of anyone non-specialist still using SSH-1, but better safe than sorry.) [originally from svn r9895]
2013-07-07 14:34:37 +00:00
rsastr_fmt(keystr, &s->hostkey);
Give rsa_fingerprint() a new name and API. It's an SSH-1 specific function, so it should have a name reflecting that, and it didn't. Also it had one of those outdated APIs involving passing it a client-allocated buffer and size. Now it has a sensible name, and internally it constructs the output string using a strbuf and returns it dynamically allocated.
2018-06-03 07:08:53 +00:00
fingerprint = rsa_ssh1_fingerprint(&s->hostkey);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
/* First check against manually configured host keys. */
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->dlgret = verify_ssh_manual_host_key(ssh, fingerprint, NULL);
Give rsa_fingerprint() a new name and API. It's an SSH-1 specific function, so it should have a name reflecting that, and it didn't. Also it had one of those outdated APIs involving passing it a client-allocated buffer and size. Now it has a sensible name, and internally it constructs the output string using a strbuf and returns it dynamically allocated.
2018-06-03 07:08:53 +00:00
sfree(fingerprint);
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
if (s->dlgret == 0) { /* did not match */
bombout(("Host key did not appear in manually configured list"));
Fix assorted memory leaks. All spotted by Coverity.
2014-11-22 09:58:15 +00:00
sfree(keystr);
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
} else if (s->dlgret < 0) { /* none configured; use standard handling */
s->dlgret = verify_ssh_host_key(ssh->frontend,
ssh->savedhost, ssh->savedport,
"rsa", keystr, fingerprint,
ssh_dialog_callback, ssh);
sfree(keystr);
Add FUZZING support to ssh.c. This adds the "none" cipher and MAC, and also disables kex signure verification and host-key checking. Since a client like this is completely insecure, it also rewrites the client version string to start "ISH", which should make it fail to interoperate with a real SSH server. The server version string is still expected to begin "SSH" so the real packet captures can be used against it.
2015-10-18 12:04:58 +00:00
#ifdef FUZZING
s->dlgret = 1;
#endif
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
if (s->dlgret < 0) {
do_ssh1_login: remove user input parameters. This is the first refactoring of a major coroutine enabled by adding the ssh->user_input queue. Now, instead of receiving a fixed block of parameter data, do_ssh1_login reads directly from the user input bufchain. In particular, I can get rid of all the temporary bufchains I constructed to pass to get_userpass_input (or rather, the ones in this particular function), because now we can let get_userpass_input read directly from the main user_input bufchain, and it will read only as much data as it has an interest in, and leave the rest as type-ahead for future prompts or the main session.
2018-05-18 06:22:58 +00:00
ssh->user_response = -1;
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crWaitUntilV(ssh->user_response >= 0);
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
s->dlgret = ssh->user_response;
}
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
if (s->dlgret == 0) {
ssh_disconnect(ssh, "User aborted at host key verification",
NULL, 0, TRUE);
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
}
Fix assorted memory leaks. All spotted by Coverity.
2014-11-22 09:58:15 +00:00
} else {
sfree(keystr);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
for (i = 0; i < 32; i++) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->rsabuf[i] = ssh->session_key[i];
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
if (i < 16)
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->rsabuf[i] ^= s->session_id[i];
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
Move the SSH-1 servkey and hostkey variables into the coroutine state, since there is a theoretical code path (via the crReturn loop after asking an interactive question about a host key or crypto algorithm) on which we can leave and return to do_ssh1_login between allocating and freeing those keys. (In practice it shouldn't come up anyway with any of the current implementations of the interactive question functions, not to mention the unlikelihood of anyone non-specialist still using SSH-1, but better safe than sorry.) [originally from svn r9895]
2013-07-07 14:34:37 +00:00
if (s->hostkey.bytes > s->servkey.bytes) {
Clean up the crufty old SSH-1 RSA API. Lots of functions had really generic names (like 'makekey'), or names that missed out an important concept (like 'rsakey_pubblob', which loads a public blob from a _file_ and doesn't generate it from an in-memory representation at all). Also, the opaque 'int order' that distinguishes the two formats of public key blob is now a mnemonic enumeration, and while I'm at it, rsa_ssh1_public_blob takes one of those as an extra argument.
2018-05-24 07:22:44 +00:00
ret = rsa_ssh1_encrypt(s->rsabuf, 32, &s->servkey);
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
if (ret)
Clean up the crufty old SSH-1 RSA API. Lots of functions had really generic names (like 'makekey'), or names that missed out an important concept (like 'rsakey_pubblob', which loads a public blob from a _file_ and doesn't generate it from an in-memory representation at all). Also, the opaque 'int order' that distinguishes the two formats of public key blob is now a mnemonic enumeration, and while I'm at it, rsa_ssh1_public_blob takes one of those as an extra argument.
2018-05-24 07:22:44 +00:00
ret = rsa_ssh1_encrypt(s->rsabuf, s->servkey.bytes, &s->hostkey);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
} else {
Clean up the crufty old SSH-1 RSA API. Lots of functions had really generic names (like 'makekey'), or names that missed out an important concept (like 'rsakey_pubblob', which loads a public blob from a _file_ and doesn't generate it from an in-memory representation at all). Also, the opaque 'int order' that distinguishes the two formats of public key blob is now a mnemonic enumeration, and while I'm at it, rsa_ssh1_public_blob takes one of those as an extra argument.
2018-05-24 07:22:44 +00:00
ret = rsa_ssh1_encrypt(s->rsabuf, 32, &s->hostkey);
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
if (ret)
Clean up the crufty old SSH-1 RSA API. Lots of functions had really generic names (like 'makekey'), or names that missed out an important concept (like 'rsakey_pubblob', which loads a public blob from a _file_ and doesn't generate it from an in-memory representation at all). Also, the opaque 'int order' that distinguishes the two formats of public key blob is now a mnemonic enumeration, and while I'm at it, rsa_ssh1_public_blob takes one of those as an extra argument.
2018-05-24 07:22:44 +00:00
ret = rsa_ssh1_encrypt(s->rsabuf, s->hostkey.bytes, &s->servkey);
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
}
if (!ret) {
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
bombout(("SSH-1 public key encryptions failed due to bad formatting"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
logevent("Encrypted session key");
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
{
int cipher_chosen = 0, warn = 0;
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
const char *cipher_string = NULL;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int i;
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) {
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
int next_cipher = conf_get_int_int(ssh->conf,
CONF_ssh_cipherlist, i);
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
if (next_cipher == CIPHER_WARN) {
/* If/when we choose a cipher, warn about it */
warn = 1;
} else if (next_cipher == CIPHER_AES) {
/* XXX Probably don't need to mention this. */
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
logevent("AES not supported in SSH-1, skipping");
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
} else {
switch (next_cipher) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
case CIPHER_3DES: s->cipher_type = SSH_CIPHER_3DES;
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
cipher_string = "3DES"; break;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
case CIPHER_BLOWFISH: s->cipher_type = SSH_CIPHER_BLOWFISH;
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
cipher_string = "Blowfish"; break;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
case CIPHER_DES: s->cipher_type = SSH_CIPHER_DES;
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
cipher_string = "single-DES"; break;
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (s->supported_ciphers_mask & (1 << s->cipher_type))
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
cipher_chosen = 1;
}
}
if (!cipher_chosen) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if ((s->supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0)
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
bombout(("Server violates SSH-1 protocol by not "
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
"supporting 3DES encryption"));
else
/* shouldn't happen */
Ahem; fix `bombout' so it passes the correct frontend handle to connection_fatal(). [originally from svn r3030]
2003-03-31 11:22:30 +00:00
bombout(("No supported ciphers found"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
After we fall back to 3DES, double-check the server really does support it, and bomb out with a complaint if not. [originally from svn r1042]
2001-04-16 07:49:11 +00:00
}
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
/* Warn about chosen cipher if necessary. */
Use sk_set_frozen() to ensure that no data will be accepted from an SSH connection when we're in the middle of asking the user a dialog-box-type question. Fixes `unix-kex-packet', which has just bitten me when connecting to one of the work Suns. [originally from svn r5071] [this svn revision also touched putty-wishlist]
2005-01-07 09:24:24 +00:00
if (warn) {
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
s->dlgret = askalg(ssh->frontend, "cipher", cipher_string,
ssh_dialog_callback, ssh);
if (s->dlgret < 0) {
do_ssh1_login: remove user input parameters. This is the first refactoring of a major coroutine enabled by adding the ssh->user_input queue. Now, instead of receiving a fixed block of parameter data, do_ssh1_login reads directly from the user input bufchain. In particular, I can get rid of all the temporary bufchains I constructed to pass to get_userpass_input (or rather, the ones in this particular function), because now we can let get_userpass_input read directly from the main user_input bufchain, and it will read only as much data as it has an interest in, and leave the rest as type-ahead for future prompts or the main session.
2018-05-18 06:22:58 +00:00
ssh->user_response = -1;
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crWaitUntilV(ssh->user_response >= 0);
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
s->dlgret = ssh->user_response;
}
if (s->dlgret == 0) {
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
0, TRUE);
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
}
Use sk_set_frozen() to ensure that no data will be accepted from an SSH connection when we're in the middle of asking the user a dialog-box-type question. Fixes `unix-kex-packet', which has just bitten me when connecting to one of the work Suns. [originally from svn r5071] [this svn revision also touched putty-wishlist]
2005-01-07 09:24:24 +00:00
}
Add encryption selection, and Blowfish as second option [originally from svn r175]
1999-07-06 19:42:57 +00:00
}
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
switch (s->cipher_type) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
case SSH_CIPHER_3DES:
logevent("Using 3DES encryption");
break;
case SSH_CIPHER_DES:
logevent("Using single-DES encryption");
break;
case SSH_CIPHER_BLOWFISH:
logevent("Using Blowfish encryption");
break;
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
}
Add encryption selection, and Blowfish as second option [originally from svn r175]
1999-07-06 19:42:57 +00:00
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_SESSION_KEY);
put_byte(pkt, s->cipher_type);
put_data(pkt, s->cookie, 8);
put_uint16(pkt, s->len * 8);
put_data(pkt, s->rsabuf, s->len);
put_uint32(pkt, ssh->v1_local_protoflags);
ssh_pkt_write(ssh, pkt);
Joris van Rantwijk's unified SSH code suitable for PuTTY and PSCP [originally from svn r504] [this commit reordered to come after creation of 0.49 tag]
2000-06-22 12:18:34 +00:00
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
logevent("Trying to enable encryption...");
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
sfree(s->rsabuf);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
{
Turn SSH-1 ciphers into a classoid. The interchangeable system of SSH-1 ciphers previously followed the same pattern as the backends and the public-key algorithms, in that all the clients would maintain two separate pointers, one to the vtable and the other to the individual instance / context. Now I've merged them, just as I did with those other two, so that you only cart around a single pointer, which has a vtable pointer inside it and a type distinguishing it from an instance of any of the other interchangeable sets of algorithms.
2018-09-13 12:29:32 +00:00
const struct ssh1_cipheralg *cipher =
(s->cipher_type == SSH_CIPHER_BLOWFISH ? &ssh1_blowfish :
s->cipher_type == SSH_CIPHER_DES ? &ssh1_des : &ssh1_3des);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh1_bpp_new_cipher(ssh->bpp, cipher, ssh->session_key);
logeventf(ssh, "Initialised %s encryption", cipher->text_name);
}
SSH CRC attack detector now uses a dynamically allocated context. [originally from svn r2132]
2002-10-25 12:58:21 +00:00
Move the SSH-1 servkey and hostkey variables into the coroutine state, since there is a theoretical code path (via the crReturn loop after asking an interactive question about a host key or crypto algorithm) on which we can leave and return to do_ssh1_login between allocating and freeing those keys. (In practice it shouldn't come up anyway with any of the current implementations of the interactive question functions, not to mention the unlikelihood of anyone non-specialist still using SSH-1, but better safe than sorry.) [originally from svn r9895]
2013-07-07 14:34:37 +00:00
if (s->servkey.modulus) {
sfree(s->servkey.modulus);
s->servkey.modulus = NULL;
Joe Yates's memory leak patches. [originally from svn r3650]
2003-12-19 12:44:46 +00:00
}
Move the SSH-1 servkey and hostkey variables into the coroutine state, since there is a theoretical code path (via the crReturn loop after asking an interactive question about a host key or crypto algorithm) on which we can leave and return to do_ssh1_login between allocating and freeing those keys. (In practice it shouldn't come up anyway with any of the current implementations of the interactive question functions, not to mention the unlikelihood of anyone non-specialist still using SSH-1, but better safe than sorry.) [originally from svn r9895]
2013-07-07 14:34:37 +00:00
if (s->servkey.exponent) {
sfree(s->servkey.exponent);
s->servkey.exponent = NULL;
Joe Yates's memory leak patches. [originally from svn r3650]
2003-12-19 12:44:46 +00:00
}
Move the SSH-1 servkey and hostkey variables into the coroutine state, since there is a theoretical code path (via the crReturn loop after asking an interactive question about a host key or crypto algorithm) on which we can leave and return to do_ssh1_login between allocating and freeing those keys. (In practice it shouldn't come up anyway with any of the current implementations of the interactive question functions, not to mention the unlikelihood of anyone non-specialist still using SSH-1, but better safe than sorry.) [originally from svn r9895]
2013-07-07 14:34:37 +00:00
if (s->hostkey.modulus) {
sfree(s->hostkey.modulus);
s->hostkey.modulus = NULL;
Joe Yates's memory leak patches. [originally from svn r3650]
2003-12-19 12:44:46 +00:00
}
Move the SSH-1 servkey and hostkey variables into the coroutine state, since there is a theoretical code path (via the crReturn loop after asking an interactive question about a host key or crypto algorithm) on which we can leave and return to do_ssh1_login between allocating and freeing those keys. (In practice it shouldn't come up anyway with any of the current implementations of the interactive question functions, not to mention the unlikelihood of anyone non-specialist still using SSH-1, but better safe than sorry.) [originally from svn r9895]
2013-07-07 14:34:37 +00:00
if (s->hostkey.exponent) {
sfree(s->hostkey.exponent);
s->hostkey.exponent = NULL;
Joe Yates's memory leak patches. [originally from svn r3650]
2003-12-19 12:44:46 +00:00
}
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_login)) != NULL);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type != SSH1_SMSG_SUCCESS) {
Ahem; fix `bombout' so it passes the correct frontend handle to connection_fatal(). [originally from svn r3030]
2003-03-31 11:22:30 +00:00
bombout(("Encryption not successfully enabled"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Prevent network errors from summarily closing the window when CoE is off [originally from svn r613]
2000-09-22 11:04:57 +00:00
}
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
logevent("Successfully started encryption");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
fflush(stdout); /* FIXME eh? */
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
if ((ssh->username = get_remote_username(ssh->conf)) == NULL) {
s->cur_prompt = new_prompts(ssh->frontend);
s->cur_prompt->to_server = TRUE;
s->cur_prompt->name = dupstr("SSH login name");
add_prompt(s->cur_prompt, dupstr("login as: "), TRUE);
s->userpass_ret = get_userpass_input(s->cur_prompt, NULL);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
while (1) {
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
while (s->userpass_ret < 0 &&
bufchain_size(&ssh->user_input) > 0)
s->userpass_ret = get_userpass_input(
s->cur_prompt, &ssh->user_input);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
if (s->userpass_ret >= 0)
break;
ssh->send_ok = 1;
crReturnV;
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
ssh->send_ok = 0;
}
if (!s->userpass_ret) {
/*
* Failed to get a username. Terminate.
*/
free_prompts(s->cur_prompt);
ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
crStopV;
}
ssh->username = dupstr(s->cur_prompt->prompts[0]->result);
free_prompts(s->cur_prompt);
}
Joris van Rantwijk's unified SSH code suitable for PuTTY and PSCP [originally from svn r504] [this commit reordered to come after creation of 0.49 tag]
2000-06-22 12:18:34 +00:00
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_USER);
put_stringz(pkt, ssh->username);
ssh_pkt_write(ssh, pkt);
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
{
char *userlog = dupprintf("Sent username \"%s\"", ssh->username);
logevent(userlog);
if (flags & FLAG_INTERACTIVE &&
(!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) {
c_write_str(ssh, userlog);
c_write_str(ssh, "\r\n");
}
sfree(userlog);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_login)) != NULL);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Don't try SSH-1 RSA authentication unless the server has advertised support for it. It's possible that this obsoletes BUG_CHOKES_ON_RSA. Certainly the one SSH-1.5-Cisco-1.25 server I found was correctly not advertising RSA auth. For now, leave it in, because I'm not feeling entirely confident. [originally from svn r7726]
2007-09-20 21:33:21 +00:00
if ((s->supported_auths_mask & (1 << SSH1_AUTH_RSA)) == 0) {
Cisco routers apparently have yet another bug: they can't handle RSA auth attempts at all without panicking and bombing out. Workaround added. [originally from svn r1568]
2002-02-27 22:41:31 +00:00
/* We must not attempt PK auth. Pretend we've already tried it. */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->tried_publickey = s->tried_agent = 1;
Cisco routers apparently have yet another bug: they can't handle RSA auth attempts at all without panicking and bombing out. Workaround added. [originally from svn r1568]
2002-02-27 22:41:31 +00:00
} else {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->tried_publickey = s->tried_agent = 0;
Cisco routers apparently have yet another bug: they can't handle RSA auth attempts at all without panicking and bombing out. Workaround added. [originally from svn r1568]
2002-02-27 22:41:31 +00:00
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->tis_auth_refused = s->ccard_auth_refused = 0;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/*
* Load the public half of any configured keyfile for later use.
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
Turn 'Filename' into a dynamically allocated type with no arbitrary length limit, just as I did to FontSpec yesterday. [originally from svn r9316]
2011-10-02 11:01:57 +00:00
if (!filename_is_null(s->keyfile)) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
int keytype;
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
logeventf(ssh, "Reading key file \"%.150s\"",
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
filename_to_str(s->keyfile));
keytype = key_type(s->keyfile);
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
if (keytype == SSH_KEYTYPE_SSH1 ||
keytype == SSH_KEYTYPE_SSH1_PUBLIC) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
const char *error;
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
s->publickey_blob = strbuf_new();
Clean up the crufty old SSH-1 RSA API. Lots of functions had really generic names (like 'makekey'), or names that missed out an important concept (like 'rsakey_pubblob', which loads a public blob from a _file_ and doesn't generate it from an in-memory representation at all). Also, the opaque 'int order' that distinguishes the two formats of public key blob is now a mnemonic enumeration, and while I'm at it, rsa_ssh1_public_blob takes one of those as an extra argument.
2018-05-24 07:22:44 +00:00
if (rsa_ssh1_loadpub(s->keyfile,
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
BinarySink_UPCAST(s->publickey_blob),
Clean up the crufty old SSH-1 RSA API. Lots of functions had really generic names (like 'makekey'), or names that missed out an important concept (like 'rsakey_pubblob', which loads a public blob from a _file_ and doesn't generate it from an in-memory representation at all). Also, the opaque 'int order' that distinguishes the two formats of public key blob is now a mnemonic enumeration, and while I'm at it, rsa_ssh1_public_blob takes one of those as an extra argument.
2018-05-24 07:22:44 +00:00
&s->publickey_comment, &error)) {
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
s->privatekey_available = (keytype == SSH_KEYTYPE_SSH1);
if (!s->privatekey_available)
logeventf(ssh, "Key file contains public key only");
Clean up the crufty old SSH-1 RSA API. Lots of functions had really generic names (like 'makekey'), or names that missed out an important concept (like 'rsakey_pubblob', which loads a public blob from a _file_ and doesn't generate it from an in-memory representation at all). Also, the opaque 'int order' that distinguishes the two formats of public key blob is now a mnemonic enumeration, and while I'm at it, rsa_ssh1_public_blob takes one of those as an extra argument.
2018-05-24 07:22:44 +00:00
s->privatekey_encrypted = rsa_ssh1_encrypted(s->keyfile, NULL);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else {
char *msgbuf;
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
logeventf(ssh, "Unable to load key (%s)", error);
msgbuf = dupprintf("Unable to load key file "
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
"\"%.150s\" (%s)\r\n",
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
filename_to_str(s->keyfile),
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
error);
c_write_str(ssh, msgbuf);
sfree(msgbuf);
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf_free(s->publickey_blob);
s->publickey_blob = NULL;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
} else {
char *msgbuf;
logeventf(ssh, "Unable to use this key file (%s)",
key_type_to_str(keytype));
msgbuf = dupprintf("Unable to use key file \"%.150s\""
" (%s)\r\n",
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
filename_to_str(s->keyfile),
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
key_type_to_str(keytype));
c_write_str(ssh, msgbuf);
sfree(msgbuf);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->publickey_blob = NULL;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
PuTTY can now detect when one of the Pageant keys it tries matches the private key file given in the config; if it spots this then it avoids trying it again (and in particular avoids needing to ask for the passphrase when it knows perfectly well it won't work). [originally from svn r1523]
2001-12-30 16:20:31 +00:00
} else
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->publickey_blob = NULL;
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
while (pktin->type == SSH1_SMSG_FAILURE) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
Jacob's TIS / CCard authentication tweaks. [originally from svn r1253]
2001-09-08 12:50:15 +00:00
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_tryagent) && agent_exists() && !s->tried_agent) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
/*
* Attempt RSA authentication using Pageant.
*/
void *r;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
int rlen;
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
strbuf *request;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->authed = FALSE;
s->tried_agent = 1;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent("Pageant is running. Requesting keys.");
/* Request the keys held by the agent. */
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
request = strbuf_new_for_agent_query();
put_byte(request, SSH1_AGENTC_REQUEST_RSA_IDENTITIES);
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
ssh->auth_agent_query = agent_query(
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
request, &r, &rlen, ssh_agent_callback, ssh);
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
strbuf_free(request);
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
if (ssh->auth_agent_query) {
do_ssh1_login: remove user input parameters. This is the first refactoring of a major coroutine enabled by adding the ssh->user_input queue. Now, instead of receiving a fixed block of parameter data, do_ssh1_login reads directly from the user input bufchain. In particular, I can get rid of all the temporary bufchains I constructed to pass to get_userpass_input (or rather, the ones in this particular function), because now we can let get_userpass_input read directly from the main user_input bufchain, and it will read only as much data as it has an interest in, and leave the rest as type-ahead for future prompts or the main session.
2018-05-18 06:22:58 +00:00
ssh->agent_response = NULL;
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crWaitUntilV(ssh->agent_response);
First half of `pageant-async' work. agent_query() is now passed a callback function; it may return 0 to indicate that it doesn't have an answer _yet_, in which case it will call the callback later on when it does, or it may return 1 to indicate that it's got an answer right now. The Windows agent_query() implementation is functionally unchanged and still synchronous, but the Unix one is async (since that one was really easy to do via uxsel). ssh.c copes cheerfully with either return value, so other ports are at liberty to be sync or async as they choose. [originally from svn r3153]
2003-04-28 11:41:39 +00:00
r = ssh->agent_response;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
rlen = ssh->agent_response_len;
First half of `pageant-async' work. agent_query() is now passed a callback function; it may return 0 to indicate that it doesn't have an answer _yet_, in which case it will call the callback later on when it does, or it may return 1 to indicate that it's got an answer right now. The Windows agent_query() implementation is functionally unchanged and still synchronous, but the Unix one is async (since that one was really easy to do via uxsel). ssh.c copes cheerfully with either return value, so other ports are at liberty to be sync or async as they choose. [originally from svn r3153]
2003-04-28 11:41:39 +00:00
}
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
s->agent_response = r;
BinarySource_BARE_INIT(s->asrc, r, rlen);
get_uint32(s->asrc); /* skip length field */
if (get_byte(s->asrc) == SSH1_AGENT_RSA_IDENTITIES_ANSWER) {
s->nkeys = toint(get_uint32(s->asrc));
Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918]
2013-07-14 10:45:54 +00:00
if (s->nkeys < 0) {
logeventf(ssh, "Pageant reported negative key count %d",
s->nkeys);
s->nkeys = 0;
}
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
logeventf(ssh, "Pageant has %d SSH-1 keys", s->nkeys);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
for (s->keyi = 0; s->keyi < s->nkeys; s->keyi++) {
Remove 'keystr' parameter in get_rsa_ssh1_pub. This parameter returned a substring of the input, which was used for two purposes. Firstly, it was used to hash the host and server keys during the initial SSH-1 key setup phase; secondly, it was used to check the keys in Pageant against the public key blob of a key specified on the command line. Unfortunately, those two purposes didn't agree! The first one needs just the bare key modulus bytes (without even the SSH-1 mpint length header); the second needs the entire key blob. So, actually, it seems to have never worked in SSH-1 to say 'putty -i keyfile' and have PuTTY find that key in Pageant and not have to ask for the passphrase to decrypt the version on disk. Fixed by removing that parameter completely, which simplifies all the _other_ call sites, and replacing it by custom code in those two places that each does the actually right thing.
2018-06-03 07:23:07 +00:00
size_t start, end;
start = s->asrc->pos;
get_rsa_ssh1_pub(s->asrc, &s->key,
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
RSA_SSH1_EXPONENT_FIRST);
Remove 'keystr' parameter in get_rsa_ssh1_pub. This parameter returned a substring of the input, which was used for two purposes. Firstly, it was used to hash the host and server keys during the initial SSH-1 key setup phase; secondly, it was used to check the keys in Pageant against the public key blob of a key specified on the command line. Unfortunately, those two purposes didn't agree! The first one needs just the bare key modulus bytes (without even the SSH-1 mpint length header); the second needs the entire key blob. So, actually, it seems to have never worked in SSH-1 to say 'putty -i keyfile' and have PuTTY find that key in Pageant and not have to ask for the passphrase to decrypt the version on disk. Fixed by removing that parameter completely, which simplifies all the _other_ call sites, and replacing it by custom code in those two places that each does the actually right thing.
2018-06-03 07:23:07 +00:00
end = s->asrc->pos;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
s->comment = get_string(s->asrc);
if (get_err(s->asrc)) {
logevent("Pageant key list packet was truncated");
break;
}
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
if (s->publickey_blob) {
Remove 'keystr' parameter in get_rsa_ssh1_pub. This parameter returned a substring of the input, which was used for two purposes. Firstly, it was used to hash the host and server keys during the initial SSH-1 key setup phase; secondly, it was used to check the keys in Pageant against the public key blob of a key specified on the command line. Unfortunately, those two purposes didn't agree! The first one needs just the bare key modulus bytes (without even the SSH-1 mpint length header); the second needs the entire key blob. So, actually, it seems to have never worked in SSH-1 to say 'putty -i keyfile' and have PuTTY find that key in Pageant and not have to ask for the passphrase to decrypt the version on disk. Fixed by removing that parameter completely, which simplifies all the _other_ call sites, and replacing it by custom code in those two places that each does the actually right thing.
2018-06-03 07:23:07 +00:00
ptrlen keystr = make_ptrlen(
(const char *)s->asrc->data + start, end - start);
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
if (keystr.len == s->publickey_blob->len &&
!memcmp(keystr.ptr, s->publickey_blob->s,
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
s->publickey_blob->len)) {
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
logeventf(ssh, "Pageant key #%d matches "
"configured key file", s->keyi);
s->tried_publickey = 1;
} else
/* Skip non-configured key */
continue;
}
logeventf(ssh, "Trying Pageant key #%d", s->keyi);
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_AUTH_RSA);
put_mp_ssh1(pkt, s->key.modulus);
ssh_pkt_write(ssh, pkt);
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_login))
!= NULL);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent("Key refused");
continue;
}
logevent("Received RSA challenge");
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->challenge = get_mp_ssh1(pktin);
if (get_err(pktin)) {
freebn(s->challenge);
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
bombout(("Server's RSA challenge was badly formatted"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
strbuf *agentreq;
char *ret;
Placate gcc's `-Wall' warnings. [originally from svn r1121]
2001-05-13 14:02:28 +00:00
void *vret;
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
int retlen;
agentreq = strbuf_new_for_agent_query();
put_byte(agentreq, SSH1_AGENTC_RSA_CHALLENGE);
put_uint32(agentreq, bignum_bitcount(s->key.modulus));
put_mp_ssh1(agentreq, s->key.exponent);
put_mp_ssh1(agentreq, s->key.modulus);
put_mp_ssh1(agentreq, s->challenge);
put_data(agentreq, s->session_id, 16);
put_uint32(agentreq, 1); /* response format */
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
ssh->auth_agent_query = agent_query(
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
agentreq, &vret, &retlen,
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
ssh_agent_callback, ssh);
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
strbuf_free(agentreq);
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
if (ssh->auth_agent_query) {
do_ssh1_login: remove user input parameters. This is the first refactoring of a major coroutine enabled by adding the ssh->user_input queue. Now, instead of receiving a fixed block of parameter data, do_ssh1_login reads directly from the user input bufchain. In particular, I can get rid of all the temporary bufchains I constructed to pass to get_userpass_input (or rather, the ones in this particular function), because now we can let get_userpass_input read directly from the main user_input bufchain, and it will read only as much data as it has an interest in, and leave the rest as type-ahead for future prompts or the main session.
2018-05-18 06:22:58 +00:00
ssh->agent_response = NULL;
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crWaitUntilV(ssh->agent_response);
First half of `pageant-async' work. agent_query() is now passed a callback function; it may return 0 to indicate that it doesn't have an answer _yet_, in which case it will call the callback later on when it does, or it may return 1 to indicate that it's got an answer right now. The Windows agent_query() implementation is functionally unchanged and still synchronous, but the Unix one is async (since that one was really easy to do via uxsel). ssh.c copes cheerfully with either return value, so other ports are at liberty to be sync or async as they choose. [originally from svn r3153]
2003-04-28 11:41:39 +00:00
vret = ssh->agent_response;
retlen = ssh->agent_response_len;
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
}
Placate gcc's `-Wall' warnings. [originally from svn r1121]
2001-05-13 14:02:28 +00:00
ret = vret;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
if (ret) {
if (ret[4] == SSH1_AGENT_RSA_RESPONSE) {
logevent("Sending Pageant's response");
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp,
SSH1_CMSG_AUTH_RSA_RESPONSE);
put_data(pkt, ret + 5, 16);
ssh_pkt_write(ssh, pkt);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
sfree(ret);
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV(
(pktin = pq_pop(&ssh->pq_ssh1_login))
!= NULL);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type == SSH1_SMSG_SUCCESS) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent
("Pageant's response accepted");
if (flags & FLAG_VERBOSE) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write_str(ssh, "Authenticated using"
" RSA key \"");
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
c_write(ssh, s->comment.ptr,
s->comment.len);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write_str(ssh, "\" from agent\r\n");
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->authed = TRUE;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
} else
logevent
("Pageant's response not accepted");
} else {
logevent
("Pageant failed to answer challenge");
sfree(ret);
}
} else {
logevent("No reply received from Pageant");
}
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
freebn(s->key.exponent);
freebn(s->key.modulus);
freebn(s->challenge);
if (s->authed)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
break;
}
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
sfree(s->agent_response);
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
if (s->publickey_blob && !s->tried_publickey)
logevent("Configured key file not in Pageant");
When we fail to get a response from Pageant, we should log the fact. Currently, if the IPC exchange goes wrong, the Event Log just prints "Pageant is running. Requesting keys." and then goes on to the next step without ever saying what happened. [originally from svn r9177]
2011-06-08 20:39:06 +00:00
} else {
logevent("Failed to get reply from Pageant");
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (s->authed)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
break;
}
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
if (s->publickey_blob && s->privatekey_available &&
!s->tried_publickey) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/*
* Try public key authentication with the specified
* key file.
*/
int got_passphrase; /* need not be kept over crReturn */
if (flags & FLAG_VERBOSE)
c_write_str(ssh, "Trying public key authentication.\r\n");
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
logeventf(ssh, "Trying public key \"%s\"",
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
filename_to_str(s->keyfile));
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
s->tried_publickey = 1;
got_passphrase = FALSE;
while (!got_passphrase) {
/*
* Get a passphrase, if necessary.
*/
char *passphrase = NULL; /* only written after crReturn */
const char *error;
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
if (!s->privatekey_encrypted) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (flags & FLAG_VERBOSE)
c_write_str(ssh, "No passphrase required.\r\n");
passphrase = NULL;
} else {
s->cur_prompt = new_prompts(ssh->frontend);
s->cur_prompt->to_server = FALSE;
s->cur_prompt->name = dupstr("SSH key passphrase");
add_prompt(s->cur_prompt,
dupprintf("Passphrase for key \"%.100s\": ",
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
s->publickey_comment), FALSE);
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(s->cur_prompt, NULL);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
while (1) {
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
while (s->userpass_ret < 0 &&
bufchain_size(&ssh->user_input) > 0)
s->userpass_ret = get_userpass_input(
s->cur_prompt, &ssh->user_input);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
if (s->userpass_ret >= 0)
break;
ssh->send_ok = 1;
crReturnV;
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
ssh->send_ok = 0;
}
if (!s->userpass_ret) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/* Failed to get a passphrase. Terminate. */
free_prompts(s->cur_prompt);
ssh_disconnect(ssh, NULL, "Unable to authenticate",
0, TRUE);
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
passphrase = dupstr(s->cur_prompt->prompts[0]->result);
free_prompts(s->cur_prompt);
}
/*
* Try decrypting key with passphrase.
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
Clean up the crufty old SSH-1 RSA API. Lots of functions had really generic names (like 'makekey'), or names that missed out an important concept (like 'rsakey_pubblob', which loads a public blob from a _file_ and doesn't generate it from an in-memory representation at all). Also, the opaque 'int order' that distinguishes the two formats of public key blob is now a mnemonic enumeration, and while I'm at it, rsa_ssh1_public_blob takes one of those as an extra argument.
2018-05-24 07:22:44 +00:00
ret = rsa_ssh1_loadkey(
s->keyfile, &s->key, passphrase, &error);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (passphrase) {
Introduce a new utility function smemclr(), which memsets things to zero but does it in such a way that over-clever compilers hopefully won't helpfully optimise the call away if you do it just before freeing something or letting it go out of scope. Use this for (hopefully) every memset whose job is to destroy sensitive data that might otherwise be left lying around in the process's memory. [originally from svn r9586]
2012-07-22 19:51:50 +00:00
smemclr(passphrase, strlen(passphrase));
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
sfree(passphrase);
}
if (ret == 1) {
/* Correct passphrase. */
got_passphrase = TRUE;
} else if (ret == 0) {
c_write_str(ssh, "Couldn't load private key from ");
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
c_write_str(ssh, filename_to_str(s->keyfile));
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
c_write_str(ssh, " (");
c_write_str(ssh, error);
c_write_str(ssh, ").\r\n");
got_passphrase = FALSE;
break; /* go and try something else */
} else if (ret == -1) {
c_write_str(ssh, "Wrong passphrase.\r\n"); /* FIXME */
got_passphrase = FALSE;
/* and try again */
Placate a compiler warning introduced in r6437. (I forgot we usually compile with -Werror on Unix, oops.) [originally from svn r6446] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-04 23:21:42 +00:00
} else {
Clean up the crufty old SSH-1 RSA API. Lots of functions had really generic names (like 'makekey'), or names that missed out an important concept (like 'rsakey_pubblob', which loads a public blob from a _file_ and doesn't generate it from an in-memory representation at all). Also, the opaque 'int order' that distinguishes the two formats of public key blob is now a mnemonic enumeration, and while I'm at it, rsa_ssh1_public_blob takes one of those as an extra argument.
2018-05-24 07:22:44 +00:00
assert(0 && "unexpected return from rsa_ssh1_loadkey()");
Fix compiles on GCC 3.3, which doesn't know about assert(0); [originally from svn r7130]
2007-01-20 20:05:46 +00:00
got_passphrase = FALSE; /* placate optimisers */
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
}
if (got_passphrase) {
/*
* Send a public key attempt.
*/
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_AUTH_RSA);
put_mp_ssh1(pkt, s->key.modulus);
ssh_pkt_write(ssh, pkt);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_login))
!= NULL);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (pktin->type == SSH1_SMSG_FAILURE) {
c_write_str(ssh, "Server refused our public key.\r\n");
Fix minor hiccup in SSH-1 p-k auth. [originally from svn r6447]
2005-11-04 23:31:11 +00:00
continue; /* go and try something else */
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
if (pktin->type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
bombout(("Bizarre response to offer of public key"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
{
int i;
unsigned char buffer[32];
Bignum challenge, response;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
challenge = get_mp_ssh1(pktin);
if (get_err(pktin)) {
freebn(challenge);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
bombout(("Server's RSA challenge was badly formatted"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
Clean up the crufty old SSH-1 RSA API. Lots of functions had really generic names (like 'makekey'), or names that missed out an important concept (like 'rsakey_pubblob', which loads a public blob from a _file_ and doesn't generate it from an in-memory representation at all). Also, the opaque 'int order' that distinguishes the two formats of public key blob is now a mnemonic enumeration, and while I'm at it, rsa_ssh1_public_blob takes one of those as an extra argument.
2018-05-24 07:22:44 +00:00
response = rsa_ssh1_decrypt(challenge, &s->key);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
freebn(s->key.private_exponent);/* burn the evidence */
for (i = 0; i < 32; i++) {
buffer[i] = bignum_byte(response, 31 - i);
}
MD5Init(&md5c);
Replace all uses of SHA*_Bytes / MD5Update. In fact, those functions don't even exist any more. The only way to get data into a primitive hash state is via the new put_* system. Of course, that means put_data() is a viable replacement for every previous call to one of the per-hash update functions - but just mechanically doing that would have missed the opportunity to simplify a lot of the call sites.
2018-05-24 09:03:36 +00:00
put_data(&md5c, buffer, 32);
put_data(&md5c, s->session_id, 16);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
MD5Final(buffer, &md5c);
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(
ssh->bpp, SSH1_CMSG_AUTH_RSA_RESPONSE);
put_data(pkt, buffer, 16);
ssh_pkt_write(ssh, pkt);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
freebn(challenge);
freebn(response);
}
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_login))
!= NULL);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (pktin->type == SSH1_SMSG_FAILURE) {
if (flags & FLAG_VERBOSE)
c_write_str(ssh, "Failed to authenticate with"
" our public key.\r\n");
Fix minor hiccup in SSH-1 p-k auth. [originally from svn r6447]
2005-11-04 23:31:11 +00:00
continue; /* go and try something else */
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else if (pktin->type != SSH1_SMSG_SUCCESS) {
bombout(("Bizarre response to RSA authentication response"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
break; /* we're through! */
}
}
/*
* Otherwise, try various forms of password-like authentication.
*/
s->cur_prompt = new_prompts(ssh->frontend);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_try_tis_auth) &&
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
(s->supported_auths_mask & (1 << SSH1_AUTH_TIS)) &&
!s->tis_auth_refused) {
s->pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent("Requested TIS authentication");
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_AUTH_TIS);
ssh_pkt_write(ssh, pkt);
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_login)) != NULL);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type != SSH1_SMSG_AUTH_TIS_CHALLENGE) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent("TIS authentication declined");
if (flags & FLAG_INTERACTIVE)
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write_str(ssh, "TIS authentication refused.\r\n");
s->tis_auth_refused = 1;
Jacob's TIS / CCard authentication tweaks. [originally from svn r1253]
2001-09-08 12:50:15 +00:00
continue;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
} else {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen challenge;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
char *instr_suf, *prompt;
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
challenge = get_string(pktin);
if (get_err(pktin)) {
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
bombout(("TIS challenge packet was badly formed"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent("Received TIS challenge");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
s->cur_prompt->to_server = TRUE;
s->cur_prompt->name = dupstr("SSH TIS authentication");
Jacob's TIS / CCard authentication tweaks. [originally from svn r1253]
2001-09-08 12:50:15 +00:00
/* Prompt heuristic comes from OpenSSH */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
if (memchr(challenge.ptr, '\n', challenge.len)) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
instr_suf = dupstr("");
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
prompt = mkstr(challenge);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
instr_suf = mkstr(challenge);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
prompt = dupstr("Response: ");
}
s->cur_prompt->instruction =
dupprintf("Using TIS authentication.%s%s",
(*instr_suf) ? "\n" : "",
instr_suf);
s->cur_prompt->instr_reqd = TRUE;
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
add_prompt(s->cur_prompt, prompt, FALSE);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
sfree(instr_suf);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
}
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_try_tis_auth) &&
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
(s->supported_auths_mask & (1 << SSH1_AUTH_CCARD)) &&
!s->ccard_auth_refused) {
s->pwpkt_type = SSH1_CMSG_AUTH_CCARD_RESPONSE;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent("Requested CryptoCard authentication");
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_AUTH_CCARD);
ssh_pkt_write(ssh, pkt);
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_login)) != NULL);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent("CryptoCard authentication declined");
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write_str(ssh, "CryptoCard authentication refused.\r\n");
s->ccard_auth_refused = 1;
Jacob's TIS / CCard authentication tweaks. [originally from svn r1253]
2001-09-08 12:50:15 +00:00
continue;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
} else {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen challenge;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
char *instr_suf, *prompt;
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
challenge = get_string(pktin);
if (get_err(pktin)) {
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
bombout(("CryptoCard challenge packet was badly formed"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Merged SSH1 robustness changes from 0.55 release branch on to trunk. [originally from svn r4379]
2004-08-01 12:07:11 +00:00
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent("Received CryptoCard challenge");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
s->cur_prompt->to_server = TRUE;
s->cur_prompt->name = dupstr("SSH CryptoCard authentication");
s->cur_prompt->name_reqd = FALSE;
/* Prompt heuristic comes from OpenSSH */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
if (memchr(challenge.ptr, '\n', challenge.len)) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
instr_suf = dupstr("");
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
prompt = mkstr(challenge);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
instr_suf = mkstr(challenge);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
prompt = dupstr("Response: ");
}
s->cur_prompt->instruction =
dupprintf("Using CryptoCard authentication.%s%s",
(*instr_suf) ? "\n" : "",
instr_suf);
s->cur_prompt->instr_reqd = TRUE;
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
add_prompt(s->cur_prompt, prompt, FALSE);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
sfree(instr_suf);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
In SSH-1, don't attempt password authentication unless the server has announced support for it. Instead exit with a fatal error (since password auth is our last resort). [originally from svn r7724]
2007-09-20 21:07:24 +00:00
if ((s->supported_auths_mask & (1 << SSH1_AUTH_PASSWORD)) == 0) {
bombout(("No supported authentication methods available"));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
In SSH-1, don't attempt password authentication unless the server has announced support for it. Instead exit with a fatal error (since password auth is our last resort). [originally from svn r7724]
2007-09-20 21:07:24 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
s->cur_prompt->to_server = TRUE;
s->cur_prompt->name = dupstr("SSH password");
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
add_prompt(s->cur_prompt, dupprintf("%s@%s's password: ",
ssh->username, ssh->savedhost),
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
FALSE);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Rationalise ordering of authentication operations. Still some work to do, but at least pscp no longer hangs when prompting for a passphrase [originally from svn r621]
2000-09-25 10:14:53 +00:00
Jacob's TIS / CCard authentication tweaks. [originally from svn r1253]
2001-09-08 12:50:15 +00:00
/*
* Show password prompt, having first obtained it via a TIS
* or CryptoCard exchange if we're doing TIS or CryptoCard
* authentication.
*/
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(s->cur_prompt, NULL);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
while (1) {
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
while (s->userpass_ret < 0 &&
bufchain_size(&ssh->user_input) > 0)
s->userpass_ret = get_userpass_input(
s->cur_prompt, &ssh->user_input);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
if (s->userpass_ret >= 0)
break;
ssh->send_ok = 1;
crReturnV;
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
ssh->send_ok = 0;
}
if (!s->userpass_ret) {
/*
* Failed to get a password (for example
* because one was supplied on the command line
* which has already failed to work). Terminate.
*/
free_prompts(s->cur_prompt);
ssh_disconnect(ssh, NULL, "Unable to authenticate", 0, TRUE);
crStopV;
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (s->pwpkt_type == SSH1_CMSG_AUTH_PASSWORD) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
/*
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
* Defence against traffic analysis: we send a
* whole bunch of packets containing strings of
* different lengths. One of these strings is the
* password, in a SSH1_CMSG_AUTH_PASSWORD packet.
* The others are all random data in
* SSH1_MSG_IGNORE packets. This way a passive
* listener can't tell which is the password, and
* hence can't deduce the password length.
*
* Anybody with a password length greater than 16
* bytes is going to have enough entropy in their
* password that a listener won't find it _that_
* much help to know how long it is. So what we'll
* do is:
*
* - if password length < 16, we send 15 packets
* containing string lengths 1 through 15
*
* - otherwise, we let N be the nearest multiple
* of 8 below the password length, and send 8
* packets containing string lengths N through
* N+7. This won't obscure the order of
* magnitude of the password length, but it will
* introduce a bit of extra uncertainty.
*
Minor semantic tweak to bug-compatibility modes: make BUG_NEEDS_SSH1_PLAIN_PASSWORD do exactly what it says on the tin, independent of whether BUG_CHOKES_ON_SSH1_IGNORE is set. This is invisible in the default configuration, as all servers marked as having the second bug have the first one too, but it would allow one to manually configure PuTTY to cope with a SSH-1 server that got upset by ignore messages during authentication, but was fine with their use as keepalives. [originally from svn r6876]
2006-10-22 19:51:28 +00:00
* A few servers can't deal with SSH1_MSG_IGNORE, at
* least in this context. For these servers, we need
* an alternative defence. We make use of the fact
* that the password is interpreted as a C string:
* so we can append a NUL, then some random data.
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
*
Minor semantic tweak to bug-compatibility modes: make BUG_NEEDS_SSH1_PLAIN_PASSWORD do exactly what it says on the tin, independent of whether BUG_CHOKES_ON_SSH1_IGNORE is set. This is invisible in the default configuration, as all servers marked as having the second bug have the first one too, but it would allow one to manually configure PuTTY to cope with a SSH-1 server that got upset by ignore messages during authentication, but was fine with their use as keepalives. [originally from svn r6876]
2006-10-22 19:51:28 +00:00
* A few servers can deal with neither SSH1_MSG_IGNORE
* here _nor_ a padded password string.
* For these servers we are left with no defences
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
* against password length sniffing.
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
*/
Minor semantic tweak to bug-compatibility modes: make BUG_NEEDS_SSH1_PLAIN_PASSWORD do exactly what it says on the tin, independent of whether BUG_CHOKES_ON_SSH1_IGNORE is set. This is invisible in the default configuration, as all servers marked as having the second bug have the first one too, but it would allow one to manually configure PuTTY to cope with a SSH-1 server that got upset by ignore messages during authentication, but was fine with their use as keepalives. [originally from svn r6876]
2006-10-22 19:51:28 +00:00
if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE) &&
!(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
/*
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
* The server can deal with SSH1_MSG_IGNORE, so
* we can use the primary defence.
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
*/
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
int bottom, top, pwlen, i;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
pwlen = strlen(s->cur_prompt->prompts[0]->result);
if (pwlen < 16) {
bottom = 0; /* zero length passwords are OK! :-) */
top = 15;
} else {
bottom = pwlen & ~7;
top = bottom + 7;
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
assert(pwlen >= bottom && pwlen <= top);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
for (i = bottom; i <= top; i++) {
if (i == pwlen) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, s->pwpkt_type);
put_stringz(pkt, s->cur_prompt->prompts[0]->result);
ssh_pkt_write(ssh, pkt);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
strbuf *random_data = strbuf_new();
for (j = 0; j < i; j++)
put_byte(random_data, random_byte());
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_IGNORE);
put_stringsb(pkt, random_data);
ssh_pkt_write(ssh, pkt);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
logevent("Sending password with camouflage packets");
}
else if (!(ssh->remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
/*
* The server can't deal with SSH1_MSG_IGNORE
* but can deal with padded passwords, so we
* can use the secondary defence.
*/
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
strbuf *padded_pw = strbuf_new();
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
logevent("Sending length-padded password");
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, s->pwpkt_type);
put_asciz(padded_pw, s->cur_prompt->prompts[0]->result);
do {
put_byte(padded_pw, random_byte());
} while (padded_pw->len % 64 != 0);
put_stringsb(pkt, padded_pw);
ssh_pkt_write(ssh, pkt);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else {
/*
Minor semantic tweak to bug-compatibility modes: make BUG_NEEDS_SSH1_PLAIN_PASSWORD do exactly what it says on the tin, independent of whether BUG_CHOKES_ON_SSH1_IGNORE is set. This is invisible in the default configuration, as all servers marked as having the second bug have the first one too, but it would allow one to manually configure PuTTY to cope with a SSH-1 server that got upset by ignore messages during authentication, but was fine with their use as keepalives. [originally from svn r6876]
2006-10-22 19:51:28 +00:00
* The server is believed unable to cope with
* any of our password camouflage methods.
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
*/
logevent("Sending unpadded password");
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, s->pwpkt_type);
put_stringz(pkt, s->cur_prompt->prompts[0]->result);
ssh_pkt_write(ssh, pkt);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, s->pwpkt_type);
put_stringz(pkt, s->cur_prompt->prompts[0]->result);
ssh_pkt_write(ssh, pkt);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
logevent("Sent password");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
free_prompts(s->cur_prompt);
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_login)) != NULL);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type == SSH1_SMSG_FAILURE) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
if (flags & FLAG_VERBOSE)
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write_str(ssh, "Access denied\r\n");
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
logevent("Authentication refused");
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
} else if (pktin->type != SSH1_SMSG_SUCCESS) {
bombout(("Strange packet received, type %d", pktin->type));
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
crStopV;
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/* Clear up */
if (s->publickey_blob) {
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf_free(s->publickey_blob);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
sfree(s->publickey_comment);
}
Changes from executor: - NetHack keypad mode (Shift only works with NumLock off) - Alt-Space handling (best I could manage; not too bad considering) - Event Log rather than Telnet Negotiation Log [originally from svn r284]
1999-11-09 11:10:04 +00:00
logevent("Authentication successful");
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
/* Set up for the next phase */
{
int i;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
for (i = 0; i < SSH_MAX_MSG; i++)
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
if (ssh->packet_dispatch[i] == ssh1_coro_wrapper_initial)
ssh->packet_dispatch[i] = ssh1_coro_wrapper_session;
ssh->current_user_input_fn = ssh1_connection_input;
Call every new user input consumer when it's set up. This fixes further embarrassing hangs in the wake of the big restructuring, in which we'd assign a new function pointer into ssh->current_user_input_fn but not immediately call it to let it process whatever might already be waiting for it in the user input queue.
2018-05-18 10:40:21 +00:00
queue_idempotent_callback(&ssh->user_input_consumer);
do_ssh1_login: change return type to void. Now it does its post-completion work itself instead of telling the callee to do the same. So its caller, ssh1_coro_wrapper_initial, is now a _completely_ trivial wrapper - but I'm not taking the opportunity to fold the two functions together completely, because the wrapper is going to acquire a new purpose in the next commit :-)
2018-05-18 06:22:58 +00:00
}
crFinishV;
Joris van Rantwijk's unified SSH code suitable for PuTTY and PSCP [originally from svn r504] [this commit reordered to come after creation of 0.49 tag]
2000-06-22 12:18:34 +00:00
}
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
static void ssh_channel_try_eof(struct ssh_channel *c)
{
Ssh ssh = c->ssh;
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
PktOut *pktout;
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
assert(c->pending_eof); /* precondition for calling us */
if (c->halfopen)
return; /* can't close: not even opened yet */
if (ssh->version == 2 && bufchain_size(&c->v.v2.outbuffer) > 0)
return; /* can't send EOF: pending outgoing data */
Better handling of outstanding CHANNEL_REQUESTS on channel destruction. Part the first: make sure that all structures describing channel requests are freed when the SSH connection is freed. This involves adding a means to ask a response handler to free any memory it holds. Part the second: in ssh_channel_try_eof(), call ssh2_channel_check_close() rather than emitting an SSH_MSG_CHANNEL_EOF directly. This avoids the possibility of closing the channel while a CHANNEL_REQUEST is outstanding. Also add some assertions that helped with tracking down the latter problem. [originally from svn r9623]
2012-08-25 21:06:48 +00:00
c->pending_eof = FALSE; /* we're about to send it */
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
if (ssh->version == 1) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_CHANNEL_CLOSE);
put_uint32(pktout, c->remoteid);
ssh_pkt_write(ssh, pktout);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
c->closes |= CLOSES_SENT_EOF;
} else {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_CHANNEL_EOF);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, c->remoteid);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
ssh2_pkt_send(ssh, pktout);
c->closes |= CLOSES_SENT_EOF;
Better handling of outstanding CHANNEL_REQUESTS on channel destruction. Part the first: make sure that all structures describing channel requests are freed when the SSH connection is freed. This involves adding a means to ask a response handler to free any memory it holds. Part the second: in ssh_channel_try_eof(), call ssh2_channel_check_close() rather than emitting an SSH_MSG_CHANNEL_EOF directly. This avoids the possibility of closing the channel while a CHANNEL_REQUEST is outstanding. Also add some assertions that helped with tracking down the latter problem. [originally from svn r9623]
2012-08-25 21:06:48 +00:00
ssh2_channel_check_close(c);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
}
}
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
static Conf *sshchannel_get_conf(SshChannel *sc)
Decouple X socket opening from x11_init(). Now we wait to open the socket to the X server until we've seen the authorisation data. This prepares us to do something else with the channel if we see different auth data, which will come up in connection sharing. [originally from svn r10078]
2013-11-17 14:05:04 +00:00
{
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
struct ssh_channel *c = FROMFIELD(sc, struct ssh_channel, sc);
Decouple X socket opening from x11_init(). Now we wait to open the socket to the X server until we've seen the authorisation data. This prepares us to do something else with the channel if we see different auth data, which will come up in connection sharing. [originally from svn r10078]
2013-11-17 14:05:04 +00:00
Ssh ssh = c->ssh;
return ssh->conf;
}
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
static void sshchannel_write_eof(SshChannel *sc)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
struct ssh_channel *c = FROMFIELD(sc, struct ssh_channel, sc);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Ssh ssh = c->ssh;
Over-enthusiastic assertions in the port forwarding code removed. Port forwardings are set up before initialising the last few details of the main shell session, so ssh->state can reasonably hold values other than SSH_STATE_SESSION and SSH_STATE_CLOSED during calls to sshfwd_*. [originally from svn r5446]
2005-03-05 18:14:57 +00:00
if (ssh->state == SSH_STATE_CLOSED)
Robustness in the face of sudden connection closures: we now make a credible effort to shut down open forwardings cleanly when the owning SSH connection terminates abruptly (for whatever reason). [originally from svn r3137]
2003-04-25 11:48:24 +00:00
return;
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
if (c->closes & CLOSES_SENT_EOF)
return;
Patch from Alan Ning (somewhat polished by me): introduce a flag called 'pending_close'. This deals with the situation in which we're forwarding a port, have received and locally buffered some data from the local endpoint but not yet been able to pass it down the SSH connection due to window limitations, and then the local endpoint closes its socket. In this situation what we've been doing until now is to immediately send SSH2_MSG_CHANNEL_CLOSE, causing the data still in our local buffer to be lost; now we instead set the new flag, which will remind us to send SSH2_MSG_CHANNEL_CLOSE _after_ we empty our bufchain. Should fix at least one manifestation of 'portfwd-close', though I don't know if it's the cause of all the reports we've ever seen. [originally from svn r8971]
2010-07-04 22:53:53 +00:00
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
c->pending_eof = TRUE;
ssh_channel_try_eof(c);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
static void sshchannel_unclean_close(SshChannel *sc, const char *err)
Introduce a function sshfwd_unclean_close(), supplied by ssh.c to subsidiary network modules like portfwd.c. To be called when the subsidiary module experiences a socket error: it sends an emergency CHANNEL_CLOSE (not just outgoing CHANNEL_EOF), and immediately deletes the local side of the channel. (I've invented a new channel type in ssh.c called CHAN_ZOMBIE, for channels whose original local side has already been thrown away and they're just hanging around waiting to receive the acknowledging CHANNEL_CLOSE.) As a result of this and the last few commits, I can now run a port forwarding session in which a local socket error occurs on a forwarded port, and PuTTY now handles it apparently correctly, closing both the SSH channel and the local socket and then actually recognising that it's OK to terminate when all _other_ channels have been closed. Previously the channel corresponding to the duff connection would linger around (because of net_pending_errors never being called), and keep being selected on (hence chewing CPU), and inhibit program termination at the end of the session (because not all channels were closed). [originally from svn r9364]
2011-12-08 19:15:58 +00:00
{
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
struct ssh_channel *c = FROMFIELD(sc, struct ssh_channel, sc);
Introduce a function sshfwd_unclean_close(), supplied by ssh.c to subsidiary network modules like portfwd.c. To be called when the subsidiary module experiences a socket error: it sends an emergency CHANNEL_CLOSE (not just outgoing CHANNEL_EOF), and immediately deletes the local side of the channel. (I've invented a new channel type in ssh.c called CHAN_ZOMBIE, for channels whose original local side has already been thrown away and they're just hanging around waiting to receive the acknowledging CHANNEL_CLOSE.) As a result of this and the last few commits, I can now run a port forwarding session in which a local socket error occurs on a forwarded port, and PuTTY now handles it apparently correctly, closing both the SSH channel and the local socket and then actually recognising that it's OK to terminate when all _other_ channels have been closed. Previously the channel corresponding to the duff connection would linger around (because of net_pending_errors never being called), and keep being selected on (hence chewing CPU), and inhibit program termination at the end of the session (because not all channels were closed). [originally from svn r9364]
2011-12-08 19:15:58 +00:00
Ssh ssh = c->ssh;
Factor out code to close the local socket associated with a channel. The only visible effect should be that abrupt closure of an SSH connection now leads to a slew of messages about closing forwarded ports.
2016-05-28 13:50:02 +00:00
char *reason;
Introduce a function sshfwd_unclean_close(), supplied by ssh.c to subsidiary network modules like portfwd.c. To be called when the subsidiary module experiences a socket error: it sends an emergency CHANNEL_CLOSE (not just outgoing CHANNEL_EOF), and immediately deletes the local side of the channel. (I've invented a new channel type in ssh.c called CHAN_ZOMBIE, for channels whose original local side has already been thrown away and they're just hanging around waiting to receive the acknowledging CHANNEL_CLOSE.) As a result of this and the last few commits, I can now run a port forwarding session in which a local socket error occurs on a forwarded port, and PuTTY now handles it apparently correctly, closing both the SSH channel and the local socket and then actually recognising that it's OK to terminate when all _other_ channels have been closed. Previously the channel corresponding to the duff connection would linger around (because of net_pending_errors never being called), and keep being selected on (hence chewing CPU), and inhibit program termination at the end of the session (because not all channels were closed). [originally from svn r9364]
2011-12-08 19:15:58 +00:00
if (ssh->state == SSH_STATE_CLOSED)
return;
Factor out code to close the local socket associated with a channel. The only visible effect should be that abrupt closure of an SSH connection now leads to a slew of messages about closing forwarded ports.
2016-05-28 13:50:02 +00:00
reason = dupprintf("due to local error: %s", err);
ssh_channel_close_local(c, reason);
sfree(reason);
Handle socket errors on half-open channels. Anthony Ho reports that this can occur naturally in some situation involving Windows 8 + IE 11 and dynamic port forwarding: apparently we get through the SOCKS negotiation, send our CHANNEL_OPEN, and then *immediately* suffer a local WSAECONNABORTED error before the server has sent back its OPEN_CONFIRMATION or OPEN_FAILURE. In this situation ssh2_channel_check_close was failing to notice that the channel didn't yet have a valid server id, and sending out a CHANNEL_CLOSE anyway containing 32 bits of uninitialised nonsense. We now handle this by turning our half-open CHAN_SOCKDATA_DORMANT into a half-open CHAN_ZOMBIE, which means in turn that our handler functions for OPEN_CONFIRMATION and OPEN_FAILURE have to recognise and handle that case, the former by immediately initiating channel closure once we _do_ have the channel's server id to do it with. [originally from svn r10039]
2013-09-08 13:20:49 +00:00
c->pending_eof = FALSE; /* this will confuse a zombie channel */
If we're called on to uncleanly close an SSH channel for which we've already sent SSH2_MSG_CHANNEL_CLOSE, we should not skip the _whole_ of sshfwd_unclean_close(), only the part about sending SSH2_MSG_CHANNEL_CLOSE. It's still important to retag the SSH channel as CHAN_ZOMBIE and clean up its previous data provider. [originally from svn r9389]
2012-01-26 18:22:28 +00:00
Introduce a function sshfwd_unclean_close(), supplied by ssh.c to subsidiary network modules like portfwd.c. To be called when the subsidiary module experiences a socket error: it sends an emergency CHANNEL_CLOSE (not just outgoing CHANNEL_EOF), and immediately deletes the local side of the channel. (I've invented a new channel type in ssh.c called CHAN_ZOMBIE, for channels whose original local side has already been thrown away and they're just hanging around waiting to receive the acknowledging CHANNEL_CLOSE.) As a result of this and the last few commits, I can now run a port forwarding session in which a local socket error occurs on a forwarded port, and PuTTY now handles it apparently correctly, closing both the SSH channel and the local socket and then actually recognising that it's OK to terminate when all _other_ channels have been closed. Previously the channel corresponding to the duff connection would linger around (because of net_pending_errors never being called), and keep being selected on (hence chewing CPU), and inhibit program termination at the end of the session (because not all channels were closed). [originally from svn r9364]
2011-12-08 19:15:58 +00:00
ssh2_channel_check_close(c);
}
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
static int sshchannel_write(SshChannel *sc, const void *buf, int len)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
struct ssh_channel *c = FROMFIELD(sc, struct ssh_channel, sc);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Ssh ssh = c->ssh;
Over-enthusiastic assertions in the port forwarding code removed. Port forwardings are set up before initialising the last few details of the main shell session, so ssh->state can reasonably hold values other than SSH_STATE_SESSION and SSH_STATE_CLOSED during calls to sshfwd_*. [originally from svn r5446]
2005-03-05 18:14:57 +00:00
if (ssh->state == SSH_STATE_CLOSED)
Robustness in the face of sudden connection closures: we now make a credible effort to shut down open forwardings cleanly when the owning SSH connection terminates abruptly (for whatever reason). [originally from svn r3137]
2003-04-25 11:48:24 +00:00
return 0;
Shared ssh_send_channel_data for both SSH-1 and SSH-2. Saves duplication between agent and port forwarding code. Conflicts: ssh.c
2016-04-23 14:51:45 +00:00
return ssh_send_channel_data(c, buf, len);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
static void sshchannel_unthrottle(SshChannel *sc, int bufsize)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
{
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
struct ssh_channel *c = FROMFIELD(sc, struct ssh_channel, sc);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Ssh ssh = c->ssh;
Over-enthusiastic assertions in the port forwarding code removed. Port forwardings are set up before initialising the last few details of the main shell session, so ssh->state can reasonably hold values other than SSH_STATE_SESSION and SSH_STATE_CLOSED during calls to sshfwd_*. [originally from svn r5446]
2005-03-05 18:14:57 +00:00
if (ssh->state == SSH_STATE_CLOSED)
Robustness in the face of sudden connection closures: we now make a credible effort to shut down open forwardings cleanly when the owning SSH connection terminates abruptly (for whatever reason). [originally from svn r3137]
2003-04-25 11:48:24 +00:00
return;
Factor out common parts of ssh_unthrottle and sshfwd_unthrottle. The SSH-2 code is essentially all shared, but SSH-1 still has some code specific to the stdout/stderr case.
2016-05-17 13:57:51 +00:00
ssh_channel_unthrottle(c, bufsize);
Add X11 forwarding, mainly thanks to Andreas Schultz [originally from svn r878]
2001-01-22 11:34:52 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh_queueing_handler(Ssh ssh, PktIn *pktin)
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
{
struct queued_handler *qh = ssh->qhead;
assert(qh != NULL);
assert(pktin->type == qh->msg1 || pktin->type == qh->msg2);
if (qh->msg1 > 0) {
assert(ssh->packet_dispatch[qh->msg1] == ssh_queueing_handler);
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
ssh->packet_dispatch[qh->msg1] = ssh->q_saved_handler1;
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
}
if (qh->msg2 > 0) {
assert(ssh->packet_dispatch[qh->msg2] == ssh_queueing_handler);
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
ssh->packet_dispatch[qh->msg2] = ssh->q_saved_handler2;
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
}
if (qh->next) {
ssh->qhead = qh->next;
if (ssh->qhead->msg1 > 0) {
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
ssh->q_saved_handler1 = ssh->packet_dispatch[ssh->qhead->msg1];
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
ssh->packet_dispatch[ssh->qhead->msg1] = ssh_queueing_handler;
}
if (ssh->qhead->msg2 > 0) {
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
ssh->q_saved_handler2 = ssh->packet_dispatch[ssh->qhead->msg2];
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
ssh->packet_dispatch[ssh->qhead->msg2] = ssh_queueing_handler;
}
} else {
ssh->qhead = ssh->qtail = NULL;
}
qh->handler(ssh, pktin, qh->ctx);
sfree(qh);
}
static void ssh_queue_handler(Ssh ssh, int msg1, int msg2,
chandler_fn_t handler, void *ctx)
{
struct queued_handler *qh;
qh = snew(struct queued_handler);
qh->msg1 = msg1;
qh->msg2 = msg2;
qh->handler = handler;
qh->ctx = ctx;
qh->next = NULL;
if (ssh->qtail == NULL) {
ssh->qhead = qh;
if (qh->msg1 > 0) {
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
ssh->q_saved_handler1 = ssh->packet_dispatch[ssh->qhead->msg1];
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
ssh->packet_dispatch[qh->msg1] = ssh_queueing_handler;
}
if (qh->msg2 > 0) {
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
ssh->q_saved_handler2 = ssh->packet_dispatch[ssh->qhead->msg2];
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
ssh->packet_dispatch[qh->msg2] = ssh_queueing_handler;
}
} else {
ssh->qtail->next = qh;
}
ssh->qtail = qh;
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh_rportfwd_succfail(Ssh ssh, PktIn *pktin, void *ctx)
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
{
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
struct ssh_rportfwd *rpf = (struct ssh_rportfwd *)ctx;
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
if (pktin->type == (ssh->version == 1 ? SSH1_SMSG_SUCCESS :
SSH2_MSG_REQUEST_SUCCESS)) {
logeventf(ssh, "Remote port forwarding from %s enabled",
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
rpf->log_description);
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
} else {
logeventf(ssh, "Remote port forwarding from %s refused",
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
rpf->log_description);
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
struct ssh_rportfwd *realpf = del234(ssh->rportfwds, rpf);
assert(realpf == rpf);
portfwdmgr_close(ssh->portfwdmgr, rpf->pfr);
free_rportfwd(rpf);
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
}
}
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
/* Many of these vtable methods have the same names as wrapper macros
* in ssh.h, so parenthesise the names to inhibit macro expansion */
static struct ssh_rportfwd *(ssh_rportfwd_alloc)(
ConnectionLayer *cl,
const char *shost, int sport, const char *dhost, int dport,
int addressfamily, const char *log_description, PortFwdRecord *pfr,
ssh_sharing_connstate *share_ctx);
static void (ssh_rportfwd_remove)(
ConnectionLayer *cl, struct ssh_rportfwd *rpf);
static SshChannel *(ssh_lportfwd_open)(
ConnectionLayer *cl, const char *hostname, int port,
const char *org, Channel *chan);
static struct X11FakeAuth *(ssh_add_sharing_x11_display)(
ConnectionLayer *cl, int authtype, ssh_sharing_connstate *share_cs,
share_channel *share_chan);
static void (ssh_remove_sharing_x11_display)(ConnectionLayer *cl,
struct X11FakeAuth *auth);
static void (ssh_send_packet_from_downstream)(
ConnectionLayer *cl, unsigned id, int type,
const void *pkt, int pktlen, const char *additional_log_text);
static unsigned (ssh_alloc_sharing_channel)(
ConnectionLayer *cl, ssh_sharing_connstate *connstate);
static void (ssh_delete_sharing_channel)(
ConnectionLayer *cl, unsigned localid);
static void (ssh_sharing_queue_global_request)(
ConnectionLayer *cl, ssh_sharing_connstate *share_ctx);
static int (ssh_agent_forwarding_permitted)(ConnectionLayer *cl);
const struct ConnectionLayerVtable ssh_connlayer_vtable = {
ssh_rportfwd_alloc,
ssh_rportfwd_remove,
ssh_lportfwd_open,
ssh_add_sharing_x11_display,
ssh_remove_sharing_x11_display,
ssh_send_packet_from_downstream,
ssh_alloc_sharing_channel,
ssh_delete_sharing_channel,
ssh_sharing_queue_global_request,
ssh_agent_forwarding_permitted,
};
static struct ssh_rportfwd *(ssh_rportfwd_alloc)(
ConnectionLayer *cl,
const char *shost, int sport, const char *dhost, int dport,
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
int addressfamily, const char *log_description, PortFwdRecord *pfr,
ssh_sharing_connstate *share_ctx)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
{
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
Ssh ssh = FROMFIELD(cl, struct ssh_tag, cl);
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
/*
* Ensure the remote port forwardings tree exists.
*/
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
if (!ssh->rportfwds) {
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
if (ssh->version == 1)
ssh->rportfwds = newtree234(ssh_rportcmp_ssh1);
else
ssh->rportfwds = newtree234(ssh_rportcmp_ssh2);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
}
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
struct ssh_rportfwd *rpf = snew(struct ssh_rportfwd);
rpf->shost = dupstr(shost);
rpf->sport = sport;
rpf->dhost = dupstr(dhost);
rpf->dport = dport;
rpf->addressfamily = addressfamily;
rpf->log_description = dupstr(log_description);
rpf->pfr = pfr;
rpf->share_ctx = share_ctx;
if (add234(ssh->rportfwds, rpf) != rpf) {
free_rportfwd(rpf);
return NULL;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
}
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
if (!rpf->share_ctx) {
PktOut *pktout;
if (ssh->version == 1) {
pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH1_CMSG_PORT_FORWARD_REQUEST);
put_uint32(pktout, rpf->sport);
put_stringz(pktout, rpf->dhost);
put_uint32(pktout, rpf->dport);
ssh_pkt_write(ssh, pktout);
ssh_queue_handler(ssh, SSH1_SMSG_SUCCESS,
SSH1_SMSG_FAILURE,
ssh_rportfwd_succfail, rpf);
} else {
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_GLOBAL_REQUEST);
put_stringz(pktout, "tcpip-forward");
put_bool(pktout, 1); /* want reply */
put_stringz(pktout, rpf->shost);
put_uint32(pktout, rpf->sport);
ssh2_pkt_send(ssh, pktout);
ssh_queue_handler(ssh, SSH2_MSG_REQUEST_SUCCESS,
SSH2_MSG_REQUEST_FAILURE,
ssh_rportfwd_succfail, rpf);
}
}
return rpf;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
}
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
static void (ssh_rportfwd_remove)(
ConnectionLayer *cl, struct ssh_rportfwd *rpf)
Remove downstream remote port forwardings in ssh.c too. Another piece of half-finished machinery that I can't have tested properly when I set up connection sharing: I had the function ssh_alloc_sharing_rportfwd which is how sshshare.c asks ssh.c to start sending it channel-open requests for a given remote forwarded port, but I had no companion function that removes one of those requests again when a downstream remote port forwarding goes away (either by mid-session cancel-tcpip-forward or by the whole downstream disconnecting). As a result, the _second_ attempt to set up the same remote port forwarding, after a sharing downstream had done so once and then stopped, would quietly fail.
2018-06-03 06:54:00 +00:00
{
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
Ssh ssh = FROMFIELD(cl, struct ssh_tag, cl);
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
if (ssh->version == 1) {
/*
* We cannot cancel listening ports on the server side in
* SSH-1! There's no message to support it.
*/
} else if (rpf->share_ctx) {
/*
* We don't manufacture a cancel-tcpip-forward message for
* remote port forwardings being removed on behalf of a
* downstream; we just pass through the one the downstream
* sent to us.
*/
} else {
PktOut *pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_GLOBAL_REQUEST);
put_stringz(pktout, "cancel-tcpip-forward");
put_bool(pktout, 0); /* _don't_ want reply */
put_stringz(pktout, rpf->shost);
put_uint32(pktout, rpf->sport);
ssh2_pkt_send(ssh, pktout);
}
Remove downstream remote port forwardings in ssh.c too. Another piece of half-finished machinery that I can't have tested properly when I set up connection sharing: I had the function ssh_alloc_sharing_rportfwd which is how sshshare.c asks ssh.c to start sending it channel-open requests for a given remote forwarded port, but I had no companion function that removes one of those requests again when a downstream remote port forwarding goes away (either by mid-session cancel-tcpip-forward or by the whole downstream disconnecting). As a result, the _second_ attempt to set up the same remote port forwarding, after a sharing downstream had done so once and then stopped, would quietly fail.
2018-06-03 06:54:00 +00:00
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
struct ssh_rportfwd *realpf = del234(ssh->rportfwds, rpf);
assert(realpf == rpf);
free_rportfwd(rpf);
Remove downstream remote port forwardings in ssh.c too. Another piece of half-finished machinery that I can't have tested properly when I set up connection sharing: I had the function ssh_alloc_sharing_rportfwd which is how sshshare.c asks ssh.c to start sending it channel-open requests for a given remote forwarded port, but I had no companion function that removes one of those requests again when a downstream remote port forwarding goes away (either by mid-session cancel-tcpip-forward or by the whole downstream disconnecting). As a result, the _second_ attempt to set up the same remote port forwarding, after a sharing downstream had done so once and then stopped, would quietly fail.
2018-06-03 06:54:00 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh_sharing_global_request_response(Ssh ssh, PktIn *pktin,
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
void *ctx)
{
share_got_pkt_from_server(ctx, pktin->type,
Remove body and length fields from PktIn. They were duplicating values stored in the BinarySource substructure. Mostly they're not referred to directly any more (instead, we call get_foo to access the BinarySource); and when they are, we can switch to reading the same values back out of the BinarySource anyway.
2018-06-06 06:17:09 +00:00
BinarySource_UPCAST(pktin)->data,
BinarySource_UPCAST(pktin)->len);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
}
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
static void (ssh_sharing_queue_global_request)(
ConnectionLayer *cl, ssh_sharing_connstate *share_ctx)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
{
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
Ssh ssh = FROMFIELD(cl, struct ssh_tag, cl);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
ssh_queue_handler(ssh, SSH2_MSG_REQUEST_SUCCESS, SSH2_MSG_REQUEST_FAILURE,
ssh_sharing_global_request_response, share_ctx);
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_smsg_stdout_stderr_data(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen string;
int bufsize;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
string = get_string(pktin);
if (get_err(pktin)) {
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
bombout(("Incoming terminal data packet was badly formed"));
return;
}
bufsize = from_backend(ssh->frontend, pktin->type == SSH1_SMSG_STDERR_DATA,
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
string.ptr, string.len);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
ssh->v1_stdout_throttling = 1;
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
ssh_throttle_conn(ssh, +1);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_smsg_x11_open(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
/* Remote side is trying to open a channel to talk to our
* X-Server. Give them back a local channel number. */
struct ssh_channel *c;
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
PktOut *pkt;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
int remoteid = get_uint32(pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
logevent("Received X11 connect request");
/* Refuse if X11 forwarding is disabled. */
if (!ssh->X11_fwd_enabled) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_CHANNEL_OPEN_FAILURE);
put_uint32(pkt, remoteid);
ssh_pkt_write(ssh, pkt);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
logevent("Rejected X11 connect request");
} else {
c = snew(struct ssh_channel);
c->ssh = ssh;
Convert ssh2_channel_init() into ssh_channel_init(). By adding support for initialising SSH-1 channels as well. Now all newly-created channels go through this function.
2016-05-21 21:29:57 +00:00
ssh_channel_init(c);
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
c->chan = x11_new_channel(ssh->x11authtree, &c->sc, NULL, -1, FALSE);
Get rid of the error-return mechanism from x11_init. Now that it doesn't actually make a network connection because that's deferred until after the X authorisation exchange, there's no point in having it return an error message and write the real output through a pointer argument. Instead, we can just have it return xconn directly and simplify the call sites. [originally from svn r10081]
2013-11-17 14:05:23 +00:00
c->remoteid = remoteid;
c->halfopen = FALSE;
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
put_uint32(pkt, c->remoteid);
put_uint32(pkt, c->localid);
ssh_pkt_write(ssh, pkt);
Get rid of the error-return mechanism from x11_init. Now that it doesn't actually make a network connection because that's deferred until after the X authorisation exchange, there's no point in having it return an error message and write the real output through a pointer argument. Instead, we can just have it return xconn directly and simplify the call sites. [originally from svn r10081]
2013-11-17 14:05:23 +00:00
logevent("Opened X11 forward channel");
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_smsg_agent_open(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
/* Remote side is trying to open a channel to talk to our
* agent. Give them back a local channel number. */
struct ssh_channel *c;
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
PktOut *pkt;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
int remoteid = toint(get_uint32(pktin));
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
/* Refuse if agent forwarding is disabled. */
if (!ssh->agentfwd_enabled) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_CHANNEL_OPEN_FAILURE);
put_uint32(pkt, remoteid);
ssh_pkt_write(ssh, pkt);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
} else {
c = snew(struct ssh_channel);
c->ssh = ssh;
Convert ssh2_channel_init() into ssh_channel_init(). By adding support for initialising SSH-1 channels as well. Now all newly-created channels go through this function.
2016-05-21 21:29:57 +00:00
ssh_channel_init(c);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
c->remoteid = remoteid;
Don't abuse a remote channel number of (unsigned)(-1) to indicate a channel for which we don't yet have a remote number, and instead add a flag to indicate this fact. Fixes bug ssh-remoteid-minusone. [originally from svn r5171]
2005-01-22 16:06:21 +00:00
c->halfopen = FALSE;
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
c->chan = agentf_new(&c->sc);
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
put_uint32(pkt, c->remoteid);
put_uint32(pkt, c->localid);
ssh_pkt_write(ssh, pkt);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_msg_port_open(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
/* Remote side is trying to open a channel to talk to a
* forwarded port. Give them back a local channel number. */
Integrate unfix.org's IPv6 patches up to level 10, with rather a lot of polishing to bring them to what I think should in principle be release quality. Unlike the unfix.org patches themselves, this checkin enables IPv6 by default; if you want to leave it out, you have to build with COMPAT=-DNO_IPV6. I have tested that this compiles on Visual C 7 (so the nightlies _should_ acquire IPv6 support without missing a beat), but since I don't have IPv6 set up myself I haven't actually tested that it _works_. It still seems to make correct IPv4 connections, but that's all I've been able to verify for myself. Further testing is needed. [originally from svn r5047] [this svn revision also touched putty-wishlist]
2004-12-30 16:45:11 +00:00
struct ssh_rportfwd pf, *pfp;
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
PktOut *pkt;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
int remoteid;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
int port;
ptrlen host;
Refactor ssh.c's APIs to x11fwd.c and portfwd.c. The most important change is that, where previously ssh.c held the Socket pointer for each X11 and port forwarding, and the support modules would find their internal state structure by calling sk_get_private_ptr on that Socket, it's now the other way round. ssh.c now directly holds the internal state structure pointer for each forwarding, and when the support module needs the Socket it looks it up in a field of that. This will come in handy when I decouple socket creation from logical forwarding setup, so that X forwardings can delay actually opening a connection to an X server until they look at the authentication data and see which server it has to be. However, while I'm here, I've also taken the opportunity to clean up a few other points, notably error message handling, and also the fact that the same kind of state structure was used for both connection-type and listening-type port forwardings. Now there are separate PortForwarding and PortListener structure types, which seems far more sensible. [originally from svn r10074]
2013-11-17 14:04:41 +00:00
char *err;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
remoteid = toint(get_uint32(pktin));
host = get_string(pktin);
port = toint(get_uint32(pktin));
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
pf.dhost = mkstr(host);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
pf.dport = port;
Integrate unfix.org's IPv6 patches up to level 10, with rather a lot of polishing to bring them to what I think should in principle be release quality. Unlike the unfix.org patches themselves, this checkin enables IPv6 by default; if you want to leave it out, you have to build with COMPAT=-DNO_IPV6. I have tested that this compiles on Visual C 7 (so the nightlies _should_ acquire IPv6 support without missing a beat), but since I don't have IPv6 set up myself I haven't actually tested that it _works_. It still seems to make correct IPv4 connections, but that's all I've been able to verify for myself. Further testing is needed. [originally from svn r5047] [this svn revision also touched putty-wishlist]
2004-12-30 16:45:11 +00:00
pfp = find234(ssh->rportfwds, &pf, NULL);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Integrate unfix.org's IPv6 patches up to level 10, with rather a lot of polishing to bring them to what I think should in principle be release quality. Unlike the unfix.org patches themselves, this checkin enables IPv6 by default; if you want to leave it out, you have to build with COMPAT=-DNO_IPV6. I have tested that this compiles on Visual C 7 (so the nightlies _should_ acquire IPv6 support without missing a beat), but since I don't have IPv6 set up myself I haven't actually tested that it _works_. It still seems to make correct IPv4 connections, but that's all I've been able to verify for myself. Further testing is needed. [originally from svn r5047] [this svn revision also touched putty-wishlist]
2004-12-30 16:45:11 +00:00
if (pfp == NULL) {
Slightly gratuitous logeventf() crusade and purge of fixed-length buffers. Also a bonus sfree(). [originally from svn r5281]
2005-02-10 00:16:59 +00:00
logeventf(ssh, "Rejected remote port open request for %s:%d",
pf.dhost, port);
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_CHANNEL_OPEN_FAILURE);
put_uint32(pkt, remoteid);
ssh_pkt_write(ssh, pkt);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
} else {
Fix another giant batch of resource leaks. (Mostly memory, but there's one missing fclose too.) [originally from svn r9919]
2013-07-14 10:46:07 +00:00
struct ssh_channel *c = snew(struct ssh_channel);
c->ssh = ssh;
Slightly gratuitous logeventf() crusade and purge of fixed-length buffers. Also a bonus sfree(). [originally from svn r5281]
2005-02-10 00:16:59 +00:00
logeventf(ssh, "Received remote port open request for %s:%d",
pf.dhost, port);
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
err = portfwdmgr_connect(ssh->portfwdmgr, &c->chan, pf.dhost, port,
&c->sc, pfp->addressfamily);
Refactor ssh.c's APIs to x11fwd.c and portfwd.c. The most important change is that, where previously ssh.c held the Socket pointer for each X11 and port forwarding, and the support modules would find their internal state structure by calling sk_get_private_ptr on that Socket, it's now the other way round. ssh.c now directly holds the internal state structure pointer for each forwarding, and when the support module needs the Socket it looks it up in a field of that. This will come in handy when I decouple socket creation from logical forwarding setup, so that X forwardings can delay actually opening a connection to an X server until they look at the authentication data and see which server it has to be. However, while I'm here, I've also taken the opportunity to clean up a few other points, notably error message handling, and also the fact that the same kind of state structure was used for both connection-type and listening-type port forwardings. Now there are separate PortForwarding and PortListener structure types, which seems far more sensible. [originally from svn r10074]
2013-11-17 14:04:41 +00:00
if (err != NULL) {
logeventf(ssh, "Port open failed: %s", err);
sfree(err);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
sfree(c);
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_CHANNEL_OPEN_FAILURE);
put_uint32(pkt, remoteid);
ssh_pkt_write(ssh, pkt);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
} else {
Convert ssh2_channel_init() into ssh_channel_init(). By adding support for initialising SSH-1 channels as well. Now all newly-created channels go through this function.
2016-05-21 21:29:57 +00:00
ssh_channel_init(c);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
c->remoteid = remoteid;
Don't abuse a remote channel number of (unsigned)(-1) to indicate a channel for which we don't yet have a remote number, and instead add a flag to indicate this fact. Fixes bug ssh-remoteid-minusone. [originally from svn r5171]
2005-01-22 16:06:21 +00:00
c->halfopen = FALSE;
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(
ssh->bpp, SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
put_uint32(pkt, c->remoteid);
put_uint32(pkt, c->localid);
ssh_pkt_write(ssh, pkt);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
logevent("Forwarded port opened successfully");
}
}
Clean up the semantics of the ssh_rportfwd structure. It's now indexed by source hostname as well as source port (so that separate requests for the server to listen on addr1:1234 and addr2:1234 can be disambiguated), and also its destination host name is dynamically allocated rather than a fixed-size buffer. [originally from svn r10062]
2013-11-17 14:03:21 +00:00
sfree(pf.dhost);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_msg_channel_open_confirmation(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
struct ssh_channel *c;
Switch SSH-1 channel message handlers to use ssh_channel_msg(). This gives consistent (and stricter) handling of channel messages directed at non-existent and half-open channels.
2016-05-22 21:21:20 +00:00
c = ssh_channel_msg(ssh, pktin);
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
chan_open_confirmation(c->chan);
c->remoteid = get_uint32(pktin);
c->halfopen = FALSE;
c->throttling_conn = 0;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
if (c && c->pending_eof) {
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
/*
* We have a pending close on this channel,
* which we decided on before the server acked
* the channel open. So now we know the
* remoteid, we can close it again.
*/
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
ssh_channel_try_eof(c);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_msg_channel_open_failure(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
struct ssh_channel *c;
Switch SSH-1 channel message handlers to use ssh_channel_msg(). This gives consistent (and stricter) handling of channel messages directed at non-existent and half-open channels.
2016-05-22 21:21:20 +00:00
c = ssh_channel_msg(ssh, pktin);
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
chan_open_failed(c->chan, NULL);
chan_free(c->chan);
del234(ssh->channels, c);
sfree(c);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_msg_channel_close(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
/* Remote side closes a channel. */
struct ssh_channel *c;
Switch SSH-1 channel message handlers to use ssh_channel_msg(). This gives consistent (and stricter) handling of channel messages directed at non-existent and half-open channels.
2016-05-22 21:21:20 +00:00
c = ssh_channel_msg(ssh, pktin);
if (c) {
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Use ssh2_channel_got_eof() in ssh1_msg_channel_close(). Of course, that means renaming it to ssh_channel_got_eof(). It also involves adding the assertions from ssh1_msg_channel_close(), just in case.
2016-05-25 22:16:09 +00:00
if (pktin->type == SSH1_MSG_CHANNEL_CLOSE) {
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
/*
* Received CHANNEL_CLOSE, which we translate into
* outgoing EOF.
*/
Use ssh2_channel_got_eof() in ssh1_msg_channel_close(). Of course, that means renaming it to ssh_channel_got_eof(). It also involves adding the assertions from ssh1_msg_channel_close(), just in case.
2016-05-25 22:16:09 +00:00
ssh_channel_got_eof(c);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
}
if (pktin->type == SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION &&
!(c->closes & CLOSES_RCVD_CLOSE)) {
if (!(c->closes & CLOSES_SENT_EOF)) {
Switch SSH-1 channel message handlers to use ssh_channel_msg(). This gives consistent (and stricter) handling of channel messages directed at non-existent and half-open channels.
2016-05-22 21:21:20 +00:00
bombout(("Received CHANNEL_CLOSE_CONFIRMATION for channel %u"
" for which we never sent CHANNEL_CLOSE\n",
c->localid));
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
}
c->closes |= CLOSES_RCVD_CLOSE;
}
if (!((CLOSES_SENT_EOF | CLOSES_RCVD_EOF) & ~c->closes) &&
!(c->closes & CLOSES_SENT_CLOSE)) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
PktOut *pkt = ssh_bpp_new_pktout(
ssh->bpp, SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION);
put_uint32(pkt, c->remoteid);
ssh_pkt_write(ssh, pkt);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
c->closes |= CLOSES_SENT_CLOSE;
}
if (!((CLOSES_SENT_CLOSE | CLOSES_RCVD_CLOSE) & ~c->closes))
ssh_channel_destroy(c);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
}
Unify despatch of incoming channel data between SSH-1 and SSH-2.
2016-05-21 12:13:00 +00:00
static int ssh_channel_data(struct ssh_channel *c, int is_stderr,
Fix some missing void * and const in existing APIs. Several changes here that should have been in commit 7babe66a8 but I missed them.
2018-06-02 06:52:26 +00:00
const void *data, int length)
Unify despatch of incoming channel data between SSH-1 and SSH-2.
2016-05-21 12:13:00 +00:00
{
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
if (c->chan)
chan_send(c->chan, is_stderr, data, length);
Unify despatch of incoming channel data between SSH-1 and SSH-2.
2016-05-21 12:13:00 +00:00
return 0;
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_msg_channel_data(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
/* Data sent down one of our channels. */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen data;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
struct ssh_channel *c;
Switch SSH-1 channel message handlers to use ssh_channel_msg(). This gives consistent (and stricter) handling of channel messages directed at non-existent and half-open channels.
2016-05-22 21:21:20 +00:00
c = ssh_channel_msg(ssh, pktin);
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
data = get_string(pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
if (c) {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
int bufsize = ssh_channel_data(c, FALSE, data.ptr, data.len);
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
if (!c->throttling_conn && bufsize > SSH1_BUFFER_LIMIT) {
c->throttling_conn = 1;
ssh_throttle_conn(ssh, +1);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
}
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_smsg_exit_status(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
PktOut *pkt;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ssh->exitcode = get_uint32(pktin);
Slightly gratuitous logeventf() crusade and purge of fixed-length buffers. Also a bonus sfree(). [originally from svn r5281]
2005-02-10 00:16:59 +00:00
logeventf(ssh, "Server sent command exit status %d", ssh->exitcode);
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_EXIT_CONFIRMATION);
ssh_pkt_write(ssh, pkt);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
/*
* In case `helpful' firewalls or proxies tack
* extra human-readable text on the end of the
* session which we might mistake for another
* encrypted packet, we close the session once
* we've sent EXIT_CONFIRMATION.
*/
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
ssh_disconnect(ssh, NULL, NULL, 0, TRUE);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
static int (ssh_agent_forwarding_permitted)(ConnectionLayer *cl)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
{
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
Ssh ssh = FROMFIELD(cl, struct ssh_tag, cl);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
return conf_get_int(ssh->conf, CONF_agentfwd) && agent_exists();
}
First crack at `terminal-modes' in SSH. PuTTY now sends ERASE by default, Unix Plink sends everything sensible it can find, and it's fully configurable from the GUI. I'm not entirely sure about the precise set of modes that Unix Plink should look at; informed tweaks are welcome. Also the Mac bits are guesses (but trivial). [originally from svn r5653] [this svn revision also touched putty-wishlist]
2005-04-21 13:57:08 +00:00
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
static void do_ssh1_connection(void *vctx)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
Ssh ssh = (Ssh)vctx;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktIn *pktin;
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
PktOut *pkt;
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
crBegin(ssh->do_ssh1_connection_crstate);
Joris van Rantwijk's unified SSH code suitable for PuTTY and PSCP [originally from svn r504] [this commit reordered to come after creation of 0.49 tag]
2000-06-22 12:18:34 +00:00
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
ssh->packet_dispatch[SSH1_SMSG_STDOUT_DATA] =
ssh->packet_dispatch[SSH1_SMSG_STDERR_DATA] =
ssh1_smsg_stdout_stderr_data;
ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_CONFIRMATION] =
ssh1_msg_channel_open_confirmation;
ssh->packet_dispatch[SSH1_MSG_CHANNEL_OPEN_FAILURE] =
ssh1_msg_channel_open_failure;
ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE] =
ssh->packet_dispatch[SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION] =
ssh1_msg_channel_close;
ssh->packet_dispatch[SSH1_MSG_CHANNEL_DATA] = ssh1_msg_channel_data;
ssh->packet_dispatch[SSH1_SMSG_EXIT_STATUS] = ssh1_smsg_exit_status;
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
if (ssh_agent_forwarding_permitted(&ssh->cl)) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent("Requesting agent forwarding");
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_AGENT_REQUEST_FORWARDING);
ssh_pkt_write(ssh, pkt);
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_connection)) != NULL);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type != SSH1_SMSG_SUCCESS
&& pktin->type != SSH1_SMSG_FAILURE) {
Ahem; fix `bombout' so it passes the correct frontend handle to connection_fatal(). [originally from svn r3030]
2003-03-31 11:22:30 +00:00
bombout(("Protocol confusion"));
Unix makefile now uses -O2, which massively cuts down key exchange time. This gives rise to a whole bunch of spare warnings, one or two of which might have been actual bugs; now all resolved. [originally from svn r3134]
2003-04-23 13:48:09 +00:00
crStopV;
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
} else if (pktin->type == SSH1_SMSG_FAILURE) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
logevent("Agent forwarding refused");
} else {
logevent("Agent forwarding enabled");
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->agentfwd_enabled = TRUE;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
ssh->packet_dispatch[SSH1_SMSG_AGENT_OPEN] = ssh1_smsg_agent_open;
Fix bugtraq 1949: server could open an agent forwarding channel even if agent forwarding had not been negotiated on, and more particularly even if it had been deliberately disabled by the user. [originally from svn r814]
2000-12-02 11:43:25 +00:00
}
Pageant now accepts an initial key list on the command line [originally from svn r592]
2000-09-15 10:48:42 +00:00
}
Prepare to have multiple X11 auth cookies valid at once. Rather than the top-level component of X forwarding being an X11Display structure which owns some auth data, it's now a collection of X11FakeAuth structures, each of which owns a display. The idea is that when we receive an X connection, we wait to see which of our available auth cookies it matches, and then connect to whatever X display that auth cookie identifies. At present the tree will only have one thing in it; this is all groundwork for later changes. [originally from svn r10079]
2013-11-17 14:05:10 +00:00
if (conf_get_int(ssh->conf, CONF_x11_forward)) {
ssh->x11disp =
x11_setup_display(conf_get_str(ssh->conf, CONF_x11_display),
ssh->conf);
if (!ssh->x11disp) {
/* FIXME: return an error message from x11_setup_display */
logevent("X11 forwarding not enabled: unable to"
" initialise X display");
} else {
ssh->x11auth = x11_invent_fake_auth
(ssh->x11authtree, conf_get_int(ssh->conf, CONF_x11_auth));
ssh->x11auth->disp = ssh->x11disp;
logevent("Requesting X11 forwarding");
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(
ssh->bpp, SSH1_CMSG_X11_REQUEST_FORWARDING);
put_stringz(pkt, ssh->x11auth->protoname);
put_stringz(pkt, ssh->x11auth->datastring);
if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER)
put_uint32(pkt, ssh->x11disp->screennum);
ssh_pkt_write(ssh, pkt);
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_connection))
!= NULL);
Prepare to have multiple X11 auth cookies valid at once. Rather than the top-level component of X forwarding being an X11Display structure which owns some auth data, it's now a collection of X11FakeAuth structures, each of which owns a display. The idea is that when we receive an X connection, we wait to see which of our available auth cookies it matches, and then connect to whatever X display that auth cookie identifies. At present the tree will only have one thing in it; this is all groundwork for later changes. [originally from svn r10079]
2013-11-17 14:05:10 +00:00
if (pktin->type != SSH1_SMSG_SUCCESS
&& pktin->type != SSH1_SMSG_FAILURE) {
bombout(("Protocol confusion"));
crStopV;
} else if (pktin->type == SSH1_SMSG_FAILURE) {
logevent("X11 forwarding refused");
} else {
logevent("X11 forwarding enabled");
ssh->X11_fwd_enabled = TRUE;
ssh->packet_dispatch[SSH1_SMSG_X11_OPEN] = ssh1_smsg_x11_open;
}
}
Add X11 forwarding, mainly thanks to Andreas Schultz [originally from svn r878]
2001-01-22 11:34:52 +00:00
}
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
portfwdmgr_config(ssh->portfwdmgr, ssh->conf);
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = ssh1_msg_port_open;
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (!conf_get_int(ssh->conf, CONF_nopty)) {
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pkt;
In SSH, we now send terminal speeds to the server when requesting a pty (we didn't before) - `ssh-termspeed'. In the process, I've removed the individual controls on the Telnet and Rlogin panels and replaced them with one on the Connection panel (since they were backed by the same storage anyway). The terminal speeds sent in SSH are logged in the Event Log. [originally from svn r4133]
2004-04-24 20:05:03 +00:00
/* Unpick the terminal-speed string. */
/* XXX perhaps we should allow no speeds to be sent. */
Spotted by Dimitry Andric: `ssh-termspeed' implementation was not taking account of coroutines and used local variables over a crFoo. I believe the impact was cosmetic, affecting the speeds reported in the Event Log only. I've put the variables `ispeed' and `ospeed' in the main ssh_tag structure, even though they're only live for a short duration; I did this rather than create a new state struct for ssh1_protocol() (since ssh_tag already has short-duration junk like portfwd_strptr). [originally from svn r4272]
2004-06-03 10:36:27 +00:00
ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
sscanf(conf_get_str(ssh->conf, CONF_termspeed), "%d,%d", &ssh->ospeed, &ssh->ispeed);
In SSH, we now send terminal speeds to the server when requesting a pty (we didn't before) - `ssh-termspeed'. In the process, I've removed the individual controls on the Telnet and Rlogin panels and replaced them with one on the Connection panel (since they were backed by the same storage anyway). The terminal speeds sent in SSH are logged in the Event Log. [originally from svn r4133]
2004-04-24 20:05:03 +00:00
/* Send the pty request. */
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_REQUEST_PTY);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(pkt, conf_get_str(ssh->conf, CONF_termtype));
put_uint32(pkt, ssh->term_height);
put_uint32(pkt, ssh->term_width);
put_uint32(pkt, 0); /* width in pixels */
put_uint32(pkt, 0); /* height in pixels */
Move the ttymode formatter into sshcommon.c. While I'm at it, I've brought it all into a single function: the parsing of data from Conf, the list of modes, and even the old callback system for writing to the destination buffer is now a simple if statement that formats mode parameters as byte or uint32 depending on SSH version. Also, the terminal speeds and the end byte are part of the same setup, so it's all together in one place instead of scattered all over ssh.c.
2018-09-19 19:36:40 +00:00
write_ttymodes_to_packet_from_conf(
BinarySink_UPCAST(pkt), ssh->frontend, ssh->conf,
1, ssh->ospeed, ssh->ispeed);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, pkt);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->state = SSH_STATE_INTERMED;
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_connection)) != NULL);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type != SSH1_SMSG_SUCCESS
&& pktin->type != SSH1_SMSG_FAILURE) {
Ahem; fix `bombout' so it passes the correct frontend handle to connection_fatal(). [originally from svn r3030]
2003-03-31 11:22:30 +00:00
bombout(("Protocol confusion"));
Unix makefile now uses -O2, which massively cuts down key exchange time. This gives rise to a whole bunch of spare warnings, one or two of which might have been actual bugs; now all resolved. [originally from svn r3134]
2003-04-23 13:48:09 +00:00
crStopV;
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
} else if (pktin->type == SSH1_SMSG_FAILURE) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write_str(ssh, "Server refused to allocate pty\r\n");
ssh->editing = ssh->echoing = 1;
Changed my mind about the EOF policy in SSH mode: I think the SSH backend should unilaterally assume outgoing EOF when it sees incoming EOF, if and only if the main session channel is talking to a pty. (Because ptys don't have a strong concept of EOF in the first place, that seems like a sensible place to draw the line.) This fixes a bug introduced by today's revamp in which if you used Unix Plink to run a console session it would hang after you hit ^D - because the server had sent EOF, but it was waiting for a client-side EOF too. [originally from svn r9282]
2011-09-13 15:38:12 +00:00
} else {
logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
ssh->ospeed, ssh->ispeed);
ssh->got_pty = TRUE;
}
Rethink the whole line discipline architecture. Instead of having multiple switchable line disciplines, we now have a single unified one which changes its behaviour based on option settings. Each option setting can be suggested by the back end and/or the terminal handler, and can be forcibly overridden by the configuration. Local echo and local line editing are separate, independently switchable, options. [originally from svn r895]
2001-01-24 14:08:20 +00:00
} else {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->editing = ssh->echoing = 1;
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_compression)) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_REQUEST_COMPRESSION);
put_uint32(pkt, 6); /* gzip compression level */
ssh_pkt_write(ssh, pkt);
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh1_connection)) != NULL);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type != SSH1_SMSG_SUCCESS
&& pktin->type != SSH1_SMSG_FAILURE) {
Ahem; fix `bombout' so it passes the correct frontend handle to connection_fatal(). [originally from svn r3030]
2003-03-31 11:22:30 +00:00
bombout(("Protocol confusion"));
Unix makefile now uses -O2, which massively cuts down key exchange time. This gives rise to a whole bunch of spare warnings, one or two of which might have been actual bugs; now all resolved. [originally from svn r3134]
2003-04-23 13:48:09 +00:00
crStopV;
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
} else if (pktin->type == SSH1_SMSG_FAILURE) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write_str(ssh, "Server refused to compress\r\n");
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
logevent("Started zlib (RFC1950) compression");
ssh1_bpp_start_compression(ssh->bpp);
Implement Zlib compression, in both SSH1 and SSH2. [originally from svn r792]
2000-11-01 21:34:21 +00:00
}
PSCP now uses the modern SFTP protocol if it can, and falls back to scp1 if it can't. Currently not very tested - I checked it in as soon as it completed a successful recursive copy in both directions. Also, one known bug: you can't specify a remote wildcard, because by the nature of SFTP we'll need to implement the wildcard engine on the client side. I do intend to do this (and use the same wildcard engine in PSFTP as well) but I haven't got round to it yet. [originally from svn r1208]
2001-08-26 18:32:28 +00:00
/*
* Start the shell or command.
*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* Special case: if the first-choice command is an SSH-2
PSCP now uses the modern SFTP protocol if it can, and falls back to scp1 if it can't. Currently not very tested - I checked it in as soon as it completed a successful recursive copy in both directions. Also, one known bug: you can't specify a remote wildcard, because by the nature of SFTP we'll need to implement the wildcard engine on the client side. I do intend to do this (and use the same wildcard engine in PSFTP as well) but I haven't got round to it yet. [originally from svn r1208]
2001-08-26 18:32:28 +00:00
* subsystem (hence not usable here) and the second choice
* exists, we fall straight back to that.
*/
{
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
char *cmd = conf_get_str(ssh->conf, CONF_remote_cmd);
PSCP now uses the modern SFTP protocol if it can, and falls back to scp1 if it can't. Currently not very tested - I checked it in as soon as it completed a successful recursive copy in both directions. Also, one known bug: you can't specify a remote wildcard, because by the nature of SFTP we'll need to implement the wildcard engine on the client side. I do intend to do this (and use the same wildcard engine in PSFTP as well) but I haven't got round to it yet. [originally from svn r1208]
2001-08-26 18:32:28 +00:00
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_ssh_subsys) &&
conf_get_str(ssh->conf, CONF_remote_cmd2)) {
cmd = conf_get_str(ssh->conf, CONF_remote_cmd2);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->fallback_cmd = TRUE;
PSCP now uses the modern SFTP protocol if it can, and falls back to scp1 if it can't. Currently not very tested - I checked it in as soon as it completed a successful recursive copy in both directions. Also, one known bug: you can't specify a remote wildcard, because by the nature of SFTP we'll need to implement the wildcard engine on the client side. I do intend to do this (and use the same wildcard engine in PSFTP as well) but I haven't got round to it yet. [originally from svn r1208]
2001-08-26 18:32:28 +00:00
}
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
if (*cmd) {
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_EXEC_CMD);
put_stringz(pkt, cmd);
ssh_pkt_write(ssh, pkt);
} else {
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_EXEC_SHELL);
ssh_pkt_write(ssh, pkt);
}
PSCP now uses the modern SFTP protocol if it can, and falls back to scp1 if it can't. Currently not very tested - I checked it in as soon as it completed a successful recursive copy in both directions. Also, one known bug: you can't specify a remote wildcard, because by the nature of SFTP we'll need to implement the wildcard engine on the client side. I do intend to do this (and use the same wildcard engine in PSFTP as well) but I haven't got round to it yet. [originally from svn r1208]
2001-08-26 18:32:28 +00:00
logevent("Started session");
}
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->state = SSH_STATE_SESSION;
if (ssh->size_needed)
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
backend_size(&ssh->backend, ssh->term_width, ssh->term_height);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->eof_needed)
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
backend_special(&ssh->backend, TS_EOF);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Line discipline module now uses dynamically allocated data. Also fixed one or two other minor problems. [originally from svn r2141]
2002-10-26 10:16:19 +00:00
if (ssh->ldisc)
Move echo/edit state change functionality out of ldisc_send. I'm not actually sure why we've always had back ends notify ldisc of changes to echo/edit settings by giving ldisc_send(ldisc,NULL,0,0) a special meaning, instead of by having a separate dedicated notify function with its own prototype and parameter set. Coverity's recent observation that the two kinds of call don't even have the same requirements on the ldisc (particularly, whether ldisc->term can be NULL) makes me realise that it's really high time I separated the two conceptually different operations into actually different functions. While I'm here, I've renamed the confusing ldisc_update() function which that special operation ends up feeding to, because it's not actually a function applying to an ldisc - it applies to a front end. So ldisc_send(ldisc,NULL,0,0) is now ldisc_echoedit_update(ldisc), and that in turn figures out the current echo/edit settings before passing them on to frontend_echoedit_update(). I think that should be clearer.
2014-11-22 16:12:47 +00:00
ldisc_echoedit_update(ssh->ldisc); /* cause ldisc to notice changes */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->send_ok = 1;
ssh->channels = newtree234(ssh_channelcmp);
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
while (1) {
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
/*
* By this point, most incoming packets are already being
* handled by the dispatch table, and we need only pay
* attention to the unusual ones.
*/
Improvements to SSH1 channel close handling: track sending and receiving of CLOSE and CLOSE_CONFIRMATION separately rather than taking short cuts. I believe ssh-1.2.33 sending CLOSE_CONFIRMATION before CLOSE was causing the remaining incidences of bug `nonexistent-channel'. (ssh-1.2.33 appears to have unilaterally decreed that CLOSE and CLOSE_CONFIRMATION are respectively renamed INPUT_EOF and OUTPUT_CLOSING, hence there is no longer an ordering constraint on them. Bah.) [originally from svn r1961]
2002-09-15 13:24:00 +00:00
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
while ((pktin = pq_pop(&ssh->pq_ssh1_connection)) != NULL) {
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
if (pktin->type == SSH1_SMSG_SUCCESS) {
Switch to using SSH_MSG macros [originally from svn r282]
1999-11-08 17:36:08 +00:00
/* may be from EXEC_SHELL on some servers */
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
} else if (pktin->type == SSH1_SMSG_FAILURE) {
Switch to using SSH_MSG macros [originally from svn r282]
1999-11-08 17:36:08 +00:00
/* may be from EXEC_SHELL on some servers
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
* if no pty is available or in other odd cases. Ignore */
} else {
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
bombout(("Strange packet received: type %d", pktin->type));
Unix makefile now uses -O2, which massively cuts down key exchange time. This gives rise to a whole bunch of spare warnings, one or two of which might have been actual bugs; now all resolved. [originally from svn r3134]
2003-04-23 13:48:09 +00:00
crStopV;
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
}
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
while (bufchain_size(&ssh->user_input) > 0) {
void *data;
int len;
bufchain_prefix(&ssh->user_input, &data, &len);
if (len > 512)
len = 512;
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_STDIN_DATA);
put_string(pkt, data, len);
ssh_pkt_write(ssh, pkt);
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
bufchain_consume(&ssh->user_input, len);
}
crReturnV;
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
crFinishV;
}
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
/*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* Handle the top-level SSH-2 protocol.
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_msg_debug(Ssh ssh, PktIn *pktin)
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
{
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen msg = get_string(pktin);
logeventf(ssh, "Remote debug message: %.*s", PTRLEN_PRINTF(msg));
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_msg_disconnect(Ssh ssh, PktIn *pktin)
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
{
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen msg = get_string(pktin);
bombout(("Server sent disconnect message:\n\"%.*s\"", PTRLEN_PRINTF(msg)));
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh_msg_ignore(Ssh ssh, PktIn *pktin)
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
{
/* Do nothing, because we're ignoring it! Duhh. */
}
Put all user input into a bufchain. This change introduces a new bufchain ssh->user_input, into which we put every byte received via back->send() (i.e. keyboard input from the GUI PuTTY window, data read by Plink from standard input, or outgoing SCP/SFTP protocol data made up by the file transfer utilities). Just like ssh->incoming_data, there's also a function pointer ssh->current_user_input_fn which says who currently has responsibility for pulling data back off that bufchain and processing it. So that can be changed over when the connection moves into a different major phase. At the moment, nothing very interesting is being done with this bufchain: each phase of the connection has its own little function that pulls chunks back out of it with bufchain_prefix and passes them to the unchanged main protocol coroutines. But this is groundwork for being able to switch over each of those coroutines in turn to read directly from ssh->user_input, with the aim of eliminating a collection of annoying bugs in which typed-ahead data is accidentally discarded at an SSH phase transition.
2018-05-18 06:22:58 +00:00
static void ssh1_login_input(Ssh ssh)
{
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
do_ssh1_login(ssh);
Put all user input into a bufchain. This change introduces a new bufchain ssh->user_input, into which we put every byte received via back->send() (i.e. keyboard input from the GUI PuTTY window, data read by Plink from standard input, or outgoing SCP/SFTP protocol data made up by the file transfer utilities). Just like ssh->incoming_data, there's also a function pointer ssh->current_user_input_fn which says who currently has responsibility for pulling data back off that bufchain and processing it. So that can be changed over when the connection moves into a different major phase. At the moment, nothing very interesting is being done with this bufchain: each phase of the connection has its own little function that pulls chunks back out of it with bufchain_prefix and passes them to the unchanged main protocol coroutines. But this is groundwork for being able to switch over each of those coroutines in turn to read directly from ssh->user_input, with the aim of eliminating a collection of annoying bugs in which typed-ahead data is accidentally discarded at an SSH phase transition.
2018-05-18 06:22:58 +00:00
}
static void ssh1_connection_input(Ssh ssh)
{
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
do_ssh1_connection(ssh);
Put all user input into a bufchain. This change introduces a new bufchain ssh->user_input, into which we put every byte received via back->send() (i.e. keyboard input from the GUI PuTTY window, data read by Plink from standard input, or outgoing SCP/SFTP protocol data made up by the file transfer utilities). Just like ssh->incoming_data, there's also a function pointer ssh->current_user_input_fn which says who currently has responsibility for pulling data back off that bufchain and processing it. So that can be changed over when the connection moves into a different major phase. At the moment, nothing very interesting is being done with this bufchain: each phase of the connection has its own little function that pulls chunks back out of it with bufchain_prefix and passes them to the unchanged main protocol coroutines. But this is groundwork for being able to switch over each of those coroutines in turn to read directly from ssh->user_input, with the aim of eliminating a collection of annoying bugs in which typed-ahead data is accidentally discarded at an SSH phase transition.
2018-05-18 06:22:58 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_coro_wrapper_initial(Ssh ssh, PktIn *pktin)
Unconditionally fill the SSH-1 dispatch table. In SSH-2, every possible packet type code has a non-NULL entry in the dispatch table, even if most of them are just ssh2_msg_unimplemented. In SSH-1, some dispatch table entries are NULL, which means that the code processing the dispatch table has to have some SSH-1 specific fallback logic. Now I've put the fallback logic in a separate function, and replaced the NULL table entries with pointers to that function, so that another pointless difference between the SSH-1 and SSH-2 code is removed.
2018-05-18 06:22:57 +00:00
{
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
pktin->refcount++; /* avoid packet being freed when we return */
pq_push(&ssh->pq_ssh1_login, pktin);
queue_idempotent_callback(&ssh->ssh1_login_icb);
Unconditionally fill the SSH-1 dispatch table. In SSH-2, every possible packet type code has a non-NULL entry in the dispatch table, even if most of them are just ssh2_msg_unimplemented. In SSH-1, some dispatch table entries are NULL, which means that the code processing the dispatch table has to have some SSH-1 specific fallback logic. Now I've put the fallback logic in a separate function, and replaced the NULL table entries with pointers to that function, so that another pointless difference between the SSH-1 and SSH-2 code is removed.
2018-05-18 06:22:57 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh1_coro_wrapper_session(Ssh ssh, PktIn *pktin)
Stop using ssh->protocol_initial_phase_done in SSH-1. This flag was used to indicate that ssh1_protocol (or, as of the previous commit, ssh1_coro_wrapper) should stop passing packets to do_ssh1_login and start passing them to do_ssh1_connection. Now, instead of using a flag, we simply have two separate versions of ssh1_coro_wrapper for the two phases, and indicate the change by rewriting all the entries in the dispatch table. So now we _just_ have a function-pointer dereference per packet, rather than one of those and then a flag check.
2018-05-18 06:22:57 +00:00
{
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
pktin->refcount++; /* avoid packet being freed when we return */
pq_push(&ssh->pq_ssh1_connection, pktin);
queue_idempotent_callback(&ssh->ssh1_connection_icb);
Stop using ssh->protocol_initial_phase_done in SSH-1. This flag was used to indicate that ssh1_protocol (or, as of the previous commit, ssh1_coro_wrapper) should stop passing packets to do_ssh1_login and start passing them to do_ssh1_connection. Now, instead of using a flag, we simply have two separate versions of ssh1_coro_wrapper for the two phases, and indicate the change by rewriting all the entries in the dispatch table. So now we _just_ have a function-pointer dereference per packet, rather than one of those and then a flag check.
2018-05-18 06:22:57 +00:00
}
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
static void ssh1_protocol_setup(Ssh ssh)
{
int i;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->bpp = ssh1_bpp_new();
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
/*
Unconditionally fill the SSH-1 dispatch table. In SSH-2, every possible packet type code has a non-NULL entry in the dispatch table, even if most of them are just ssh2_msg_unimplemented. In SSH-1, some dispatch table entries are NULL, which means that the code processing the dispatch table has to have some SSH-1 specific fallback logic. Now I've put the fallback logic in a separate function, and replaced the NULL table entries with pointers to that function, so that another pointless difference between the SSH-1 and SSH-2 code is removed.
2018-05-18 06:22:57 +00:00
* Most messages are handled by the main protocol routine.
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
for (i = 0; i < SSH_MAX_MSG; i++)
Stop using ssh->protocol_initial_phase_done in SSH-1. This flag was used to indicate that ssh1_protocol (or, as of the previous commit, ssh1_coro_wrapper) should stop passing packets to do_ssh1_login and start passing them to do_ssh1_connection. Now, instead of using a flag, we simply have two separate versions of ssh1_coro_wrapper for the two phases, and indicate the change by rewriting all the entries in the dispatch table. So now we _just_ have a function-pointer dereference per packet, rather than one of those and then a flag check.
2018-05-18 06:22:57 +00:00
ssh->packet_dispatch[i] = ssh1_coro_wrapper_initial;
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
/*
* These special message types we install handlers for.
*/
ssh->packet_dispatch[SSH1_MSG_DISCONNECT] = ssh1_msg_disconnect;
ssh->packet_dispatch[SSH1_MSG_IGNORE] = ssh_msg_ignore;
ssh->packet_dispatch[SSH1_MSG_DEBUG] = ssh1_msg_debug;
}
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
/*
Gratuitous simplification of commasep_string functions. in_commasep_string() is now implemented in terms of first_in_commasep_string(), memchr(), and tail recursion.
2015-05-17 22:14:57 +00:00
* Utility routines for decoding comma-separated strings in KEXINIT.
Probable support for first_kex_packet_follows in KEXINIT. Not significantly tested since none of the common key-exchange protocols starts with a packet from the server, so I don't have a server that implements this. [originally from svn r5162]
2005-01-22 13:32:41 +00:00
*/
Factor out code for constructing lists of algorithms for SSH-2 KEXINIT.
2014-11-03 00:55:21 +00:00
static int first_in_commasep_string(char const *needle, char const *haystack,
int haylen)
Probable support for first_kex_packet_follows in KEXINIT. Not significantly tested since none of the common key-exchange protocols starts with a packet from the server, so I don't have a server that implements this. [originally from svn r5162]
2005-01-22 13:32:41 +00:00
{
int needlen;
if (!needle || !haystack) /* protect against null pointers */
return 0;
needlen = strlen(needle);
Gratuitous simplification of commasep_string functions. in_commasep_string() is now implemented in terms of first_in_commasep_string(), memchr(), and tail recursion.
2015-05-17 22:14:57 +00:00
Probable support for first_kex_packet_follows in KEXINIT. Not significantly tested since none of the common key-exchange protocols starts with a packet from the server, so I don't have a server that implements this. [originally from svn r5162]
2005-01-22 13:32:41 +00:00
if (haylen >= needlen && /* haystack is long enough */
!memcmp(needle, haystack, needlen) && /* initial match */
(haylen == needlen || haystack[needlen] == ',')
/* either , or EOS follows */
)
return 1;
return 0;
}
Gratuitous simplification of commasep_string functions. in_commasep_string() is now implemented in terms of first_in_commasep_string(), memchr(), and tail recursion.
2015-05-17 22:14:57 +00:00
static int in_commasep_string(char const *needle, char const *haystack,
int haylen)
{
char *p;
if (!needle || !haystack) /* protect against null pointers */
return 0;
/*
* Is it at the start of the string?
*/
if (first_in_commasep_string(needle, haystack, haylen))
return 1;
/*
* If not, search for the next comma and resume after that.
* If no comma found, terminate.
*/
p = memchr(haystack, ',', haylen);
if (!p) return 0;
/* + 1 to skip over comma */
return in_commasep_string(needle, p + 1, haylen - (p + 1 - haystack));
}
Factor out code for constructing lists of algorithms for SSH-2 KEXINIT.
2014-11-03 00:55:21 +00:00
/*
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
* Add a value to a strbuf containing a comma-separated list.
Factor out code for constructing lists of algorithms for SSH-2 KEXINIT.
2014-11-03 00:55:21 +00:00
*/
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
static void add_to_commasep(strbuf *buf, const char *data)
Factor out code for constructing lists of algorithms for SSH-2 KEXINIT.
2014-11-03 00:55:21 +00:00
{
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
if (buf->len > 0)
put_byte(buf, ',');
put_data(buf, data, strlen(data));
Factor out code for constructing lists of algorithms for SSH-2 KEXINIT.
2014-11-03 00:55:21 +00:00
}
Probable support for first_kex_packet_follows in KEXINIT. Not significantly tested since none of the common key-exchange protocols starts with a packet from the server, so I don't have a server that implements this. [originally from svn r5162]
2005-01-22 13:32:41 +00:00
Second attempt. Can successfully decrypt the _first block_ of a packet. [originally from svn r570]
2000-09-05 16:23:36 +00:00
/*
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
* SSH-2 key derivation (RFC 4253 section 7.2).
Second attempt. Can successfully decrypt the _first block_ of a packet. [originally from svn r570]
2000-09-05 16:23:36 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
static void ssh2_mkkey(Ssh ssh, strbuf *out, Bignum K, unsigned char *H,
char chr, int keylen)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
const struct ssh_hashalg *h = ssh->kex->hash;
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
int keylen_padded;
unsigned char *key;
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
ssh_hash *s, *s2;
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
if (keylen == 0)
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
return;
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
/*
* Round the requested amount of key material up to a multiple of
* the length of the hash we're using to make it. This makes life
* simpler because then we can just write each hash output block
* straight into the output buffer without fiddling about
* truncating the last one. Since it's going into a strbuf, and
* strbufs are always smemclr()ed on free, there's no need to
* worry about leaving extra potentially-sensitive data in memory
* that the caller didn't ask for.
*/
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
keylen_padded = ((keylen + h->hlen - 1) / h->hlen) * h->hlen;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
out->len = 0;
key = strbuf_append(out, keylen_padded);
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
Add infrastructure for supporting multiple hashes in key exchange. Nothing very surprising here. [originally from svn r6251]
2005-08-31 20:43:06 +00:00
/* First hlen bytes. */
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
s = ssh_hash_new(h);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_mp_ssh2(s, K);
put_data(s, H, h->hlen);
put_byte(s, chr);
put_data(s, ssh->v2_session_id, ssh->v2_session_id_len);
ssh_hash_final(s, key);
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
/* Subsequent blocks of hlen bytes. */
if (keylen_padded > h->hlen) {
int offset;
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
s = ssh_hash_new(h);
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
if (!(ssh->remote_bugs & BUG_SSH2_DERIVEKEY))
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_mp_ssh2(s, K);
put_data(s, H, h->hlen);
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
for (offset = h->hlen; offset < keylen_padded; offset += h->hlen) {
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_data(s, key + offset - h->hlen, h->hlen);
s2 = ssh_hash_copy(s);
ssh_hash_final(s2, key + offset);
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
}
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
ssh_hash_free(s);
Remove arbitrary limit SSH2_MKKEY_ITERS. Tim Kosse points out that we now support some combinations of crypto primitives which break the hardwired assumption that two blocks of hash output from the session-key derivation algorithm are sufficient to key every cipher and MAC in the system. So now ssh2_mkkey is given the desired key length, and performs as many iterations as necessary.
2015-08-21 22:40:16 +00:00
}
Second attempt. Can successfully decrypt the _first block_ of a packet. [originally from svn r570]
2000-09-05 16:23:36 +00:00
}
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
/*
* Structure for constructing KEXINIT algorithm lists.
*/
#define MAXKEXLIST 16
struct kexinit_algorithm {
const char *name;
union {
struct {
const struct ssh_kex *kex;
int warn;
} kex;
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
struct {
Invent a struct type for polymorphic SSH key data. During last week's work, I made a mistake in which I got the arguments backwards in one of the key-blob-generating functions - mistakenly swapped the 'void *' key instance with the 'BinarySink *' output destination - and I didn't spot the mistake until run time, because in C you can implicitly convert both to and from void * and so there was no compile-time failure of type checking. Now that I've introduced the FROMFIELD macro that downcasts a pointer to one field of a structure to retrieve a pointer to the whole structure, I think I might start using that more widely to indicate this kind of polymorphic subtyping. So now all the public-key functions in the struct ssh_signkey vtable handle their data instance in the form of a pointer to a subfield of a new zero-sized structure type 'ssh_key', which outside the key implementations indicates 'this is some kind of key instance but it could be of any type'; they downcast that pointer internally using FROMFIELD in place of the previous ordinary C cast, and return one by returning &foo->sshk for whatever foo they've just made up. The sshk member is not at the beginning of the structure, which means all those FROMFIELDs and &key->sshk are actually adding and subtracting an offset. Of course I could have put the member at the start anyway, but I had the idea that it's actually a feature _not_ to have the two types start at the same address, because it means you should notice earlier rather than later if you absentmindedly cast from one to the other directly rather than by the approved method (in particular, if you accidentally assign one through a void * and back without even _noticing_ you perpetrated a cast). In particular, this enforces that you can't sfree() the thing even once without realising you should instead of called the right freekey function. (I found several bugs by this method during initial testing, so I think it's already proved its worth!) While I'm here, I've also renamed the vtable structure ssh_signkey to ssh_keyalg, because it was a confusing name anyway - it describes the _algorithm_ for handling all keys of that type, not a specific key. So ssh_keyalg is the collection of code, and ssh_key is one instance of the data it handles.
2018-05-27 07:32:21 +00:00
const ssh_keyalg *hostkey;
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
int warn;
} hk;
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
struct {
Turn SSH-2 ciphers into a classoid. This is more or less the same job as the SSH-1 case, only more extensive, because we have a wider range of ciphers. I'm a bit disappointed about the AES case, in particular, because I feel as if it ought to have been possible to arrange to combine this layer of vtable dispatch with the subsidiary one that selects between hardware and software implementations of the underlying cipher. I may come back later and have another try at that, in fact.
2018-09-13 13:43:04 +00:00
const struct ssh2_cipheralg *cipher;
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
int warn;
} cipher;
struct {
Turn SSH-2 MACs into a classoid. This piece of tidying-up has come out particularly well in terms of saving tedious repetition and boilerplate. I've managed to remove three pointless methods from every MAC implementation by means of writing them once centrally in terms of the implementation-specific methods; another method (hmacmd5_sink) vanished because I was able to make the interface type 'ssh2_mac' be directly usable as a BinarySink by way of a new delegation system; and because all the method implementations can now find their own vtable, I was even able to merge a lot of keying and output functions that had previously differed only in length parameters by having them look up the lengths in whatever vtable they were passed.
2018-09-13 15:15:17 +00:00
const struct ssh2_macalg *mac;
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
int etm;
} mac;
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
const struct ssh_compression_alg *comp;
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
} u;
};
/*
* Find a slot in a KEXINIT algorithm list to use for a new algorithm.
* If the algorithm is already in the list, return a pointer to its
* entry, otherwise return an entry from the end of the list.
* This assumes that every time a particular name is passed in, it
* comes from the same string constant. If this isn't true, this
* function may need to be rewritten to use strcmp() instead.
*/
static struct kexinit_algorithm *ssh2_kexinit_addalg(struct kexinit_algorithm
*list, const char *name)
{
int i;
for (i = 0; i < MAXKEXLIST; i++)
if (list[i].name == NULL || list[i].name == name) {
list[i].name = name;
return &list[i];
}
assert(!"No space in KEXINIT list");
Fix warning about missing return in ssh2_kexinit_addalg
2015-08-11 07:39:05 +00:00
return NULL;
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
}
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
/*
* Data structure managing host keys in sessions based on GSSAPI KEX.
*
* In a session we started with a GSSAPI key exchange, the concept of
* 'host key' has completely different lifetime and security semantics
* from the usual ones. Per RFC 4462 section 2.1, we assume that any
* host key delivered to us in the course of a GSSAPI key exchange is
* _solely_ there to use as a transient fallback within the same
* session, if at the time of a subsequent rekey the GSS credentials
* are temporarily invalid and so a non-GSS KEX method has to be used.
*
* In particular, in a GSS-based SSH deployment, host keys may not
* even _be_ persistent identities for the server; it would be
* legitimate for a server to generate a fresh one routinely if it
* wanted to, like SSH-1 server keys.
*
* So, in this mode, we never touch the persistent host key cache at
* all, either to check keys against it _or_ to store keys in it.
* Instead, we maintain an in-memory cache of host keys that have been
* mentioned in GSS key exchanges within this particular session, and
* we permit precisely those host keys in non-GSS rekeys.
*/
struct ssh_transient_hostkey_cache_entry {
Invent a struct type for polymorphic SSH key data. During last week's work, I made a mistake in which I got the arguments backwards in one of the key-blob-generating functions - mistakenly swapped the 'void *' key instance with the 'BinarySink *' output destination - and I didn't spot the mistake until run time, because in C you can implicitly convert both to and from void * and so there was no compile-time failure of type checking. Now that I've introduced the FROMFIELD macro that downcasts a pointer to one field of a structure to retrieve a pointer to the whole structure, I think I might start using that more widely to indicate this kind of polymorphic subtyping. So now all the public-key functions in the struct ssh_signkey vtable handle their data instance in the form of a pointer to a subfield of a new zero-sized structure type 'ssh_key', which outside the key implementations indicates 'this is some kind of key instance but it could be of any type'; they downcast that pointer internally using FROMFIELD in place of the previous ordinary C cast, and return one by returning &foo->sshk for whatever foo they've just made up. The sshk member is not at the beginning of the structure, which means all those FROMFIELDs and &key->sshk are actually adding and subtracting an offset. Of course I could have put the member at the start anyway, but I had the idea that it's actually a feature _not_ to have the two types start at the same address, because it means you should notice earlier rather than later if you absentmindedly cast from one to the other directly rather than by the approved method (in particular, if you accidentally assign one through a void * and back without even _noticing_ you perpetrated a cast). In particular, this enforces that you can't sfree() the thing even once without realising you should instead of called the right freekey function. (I found several bugs by this method during initial testing, so I think it's already proved its worth!) While I'm here, I've also renamed the vtable structure ssh_signkey to ssh_keyalg, because it was a confusing name anyway - it describes the _algorithm_ for handling all keys of that type, not a specific key. So ssh_keyalg is the collection of code, and ssh_key is one instance of the data it handles.
2018-05-27 07:32:21 +00:00
const ssh_keyalg *alg;
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf *pub_blob;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
};
static int ssh_transient_hostkey_cache_cmp(void *av, void *bv)
{
const struct ssh_transient_hostkey_cache_entry
*a = (const struct ssh_transient_hostkey_cache_entry *)av,
*b = (const struct ssh_transient_hostkey_cache_entry *)bv;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
return strcmp(a->alg->ssh_id, b->alg->ssh_id);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
}
static int ssh_transient_hostkey_cache_find(void *av, void *bv)
{
Invent a struct type for polymorphic SSH key data. During last week's work, I made a mistake in which I got the arguments backwards in one of the key-blob-generating functions - mistakenly swapped the 'void *' key instance with the 'BinarySink *' output destination - and I didn't spot the mistake until run time, because in C you can implicitly convert both to and from void * and so there was no compile-time failure of type checking. Now that I've introduced the FROMFIELD macro that downcasts a pointer to one field of a structure to retrieve a pointer to the whole structure, I think I might start using that more widely to indicate this kind of polymorphic subtyping. So now all the public-key functions in the struct ssh_signkey vtable handle their data instance in the form of a pointer to a subfield of a new zero-sized structure type 'ssh_key', which outside the key implementations indicates 'this is some kind of key instance but it could be of any type'; they downcast that pointer internally using FROMFIELD in place of the previous ordinary C cast, and return one by returning &foo->sshk for whatever foo they've just made up. The sshk member is not at the beginning of the structure, which means all those FROMFIELDs and &key->sshk are actually adding and subtracting an offset. Of course I could have put the member at the start anyway, but I had the idea that it's actually a feature _not_ to have the two types start at the same address, because it means you should notice earlier rather than later if you absentmindedly cast from one to the other directly rather than by the approved method (in particular, if you accidentally assign one through a void * and back without even _noticing_ you perpetrated a cast). In particular, this enforces that you can't sfree() the thing even once without realising you should instead of called the right freekey function. (I found several bugs by this method during initial testing, so I think it's already proved its worth!) While I'm here, I've also renamed the vtable structure ssh_signkey to ssh_keyalg, because it was a confusing name anyway - it describes the _algorithm_ for handling all keys of that type, not a specific key. So ssh_keyalg is the collection of code, and ssh_key is one instance of the data it handles.
2018-05-27 07:32:21 +00:00
const ssh_keyalg *aalg = (const ssh_keyalg *)av;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
const struct ssh_transient_hostkey_cache_entry
*b = (const struct ssh_transient_hostkey_cache_entry *)bv;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
return strcmp(aalg->ssh_id, b->alg->ssh_id);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
}
static void ssh_init_transient_hostkey_store(Ssh ssh)
{
ssh->transient_hostkey_cache =
newtree234(ssh_transient_hostkey_cache_cmp);
}
static void ssh_cleanup_transient_hostkey_store(Ssh ssh)
{
struct ssh_transient_hostkey_cache_entry *ent;
while ((ent = delpos234(ssh->transient_hostkey_cache, 0)) != NULL) {
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf_free(ent->pub_blob);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
sfree(ent);
}
freetree234(ssh->transient_hostkey_cache);
}
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
static void ssh_store_transient_hostkey(Ssh ssh, ssh_key *key)
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
{
struct ssh_transient_hostkey_cache_entry *ent, *retd;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
if ((ent = find234(ssh->transient_hostkey_cache, (void *)ssh_key_alg(key),
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh_transient_hostkey_cache_find)) != NULL) {
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf_free(ent->pub_blob);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
sfree(ent);
}
ent = snew(struct ssh_transient_hostkey_cache_entry);
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ent->alg = ssh_key_alg(key);
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
ent->pub_blob = strbuf_new();
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_key_public_blob(key, BinarySink_UPCAST(ent->pub_blob));
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
retd = add234(ssh->transient_hostkey_cache, ent);
assert(retd == ent);
}
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
static int ssh_verify_transient_hostkey(Ssh ssh, ssh_key *key)
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
{
struct ssh_transient_hostkey_cache_entry *ent;
int toret = FALSE;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
if ((ent = find234(ssh->transient_hostkey_cache, (void *)ssh_key_alg(key),
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh_transient_hostkey_cache_find)) != NULL) {
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf *this_blob = strbuf_new();
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_key_public_blob(key, BinarySink_UPCAST(this_blob));
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
if (this_blob->len == ent->pub_blob->len &&
!memcmp(this_blob->s, ent->pub_blob->s,
this_blob->len))
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
toret = TRUE;
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf_free(this_blob);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
}
return toret;
}
Invent a struct type for polymorphic SSH key data. During last week's work, I made a mistake in which I got the arguments backwards in one of the key-blob-generating functions - mistakenly swapped the 'void *' key instance with the 'BinarySink *' output destination - and I didn't spot the mistake until run time, because in C you can implicitly convert both to and from void * and so there was no compile-time failure of type checking. Now that I've introduced the FROMFIELD macro that downcasts a pointer to one field of a structure to retrieve a pointer to the whole structure, I think I might start using that more widely to indicate this kind of polymorphic subtyping. So now all the public-key functions in the struct ssh_signkey vtable handle their data instance in the form of a pointer to a subfield of a new zero-sized structure type 'ssh_key', which outside the key implementations indicates 'this is some kind of key instance but it could be of any type'; they downcast that pointer internally using FROMFIELD in place of the previous ordinary C cast, and return one by returning &foo->sshk for whatever foo they've just made up. The sshk member is not at the beginning of the structure, which means all those FROMFIELDs and &key->sshk are actually adding and subtracting an offset. Of course I could have put the member at the start anyway, but I had the idea that it's actually a feature _not_ to have the two types start at the same address, because it means you should notice earlier rather than later if you absentmindedly cast from one to the other directly rather than by the approved method (in particular, if you accidentally assign one through a void * and back without even _noticing_ you perpetrated a cast). In particular, this enforces that you can't sfree() the thing even once without realising you should instead of called the right freekey function. (I found several bugs by this method during initial testing, so I think it's already proved its worth!) While I'm here, I've also renamed the vtable structure ssh_signkey to ssh_keyalg, because it was a confusing name anyway - it describes the _algorithm_ for handling all keys of that type, not a specific key. So ssh_keyalg is the collection of code, and ssh_key is one instance of the data it handles.
2018-05-27 07:32:21 +00:00
static int ssh_have_transient_hostkey(Ssh ssh, const ssh_keyalg *alg)
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
{
struct ssh_transient_hostkey_cache_entry *ent =
find234(ssh->transient_hostkey_cache, (void *)alg,
ssh_transient_hostkey_cache_find);
return ent != NULL;
}
static int ssh_have_any_transient_hostkey(Ssh ssh)
{
return count234(ssh->transient_hostkey_cache) > 0;
}
#endif /* NO_GSSAPI */
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
/*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* Handle the SSH-2 transport layer.
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
*/
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
static void do_ssh2_transport(void *vctx)
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
{
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
Ssh ssh = (Ssh)vctx;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktIn *pktin;
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
enum kexlist {
KEXLIST_KEX, KEXLIST_HOSTKEY, KEXLIST_CSCIPHER, KEXLIST_SCCIPHER,
KEXLIST_CSMAC, KEXLIST_SCMAC, KEXLIST_CSCOMP, KEXLIST_SCCOMP,
NKEXLIST
};
const char * kexlist_descr[NKEXLIST] = {
"key exchange algorithm", "host key algorithm",
"client-to-server cipher", "server-to-client cipher",
"client-to-server MAC", "server-to-client MAC",
"client-to-server compression method",
"server-to-client compression method" };
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
struct do_ssh2_transport_state {
Tweak to SSH coroutine code: put line number in the coroutine state structure, which is consistent with Simon's canonical version of the macros. [originally from svn r9607]
2012-08-18 09:30:01 +00:00
int crLine;
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
int nbits, pbits, warn_kex, warn_hk, warn_cscipher, warn_sccipher;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Bignum p, g, e, f, K;
Further progress in the direction of variable exchange hashes -- stash the outgoing KEXINIT, and only start generating the exchange hash once we know which KEX method we're using. [originally from svn r6242]
2005-08-30 22:39:35 +00:00
void *our_kexinit;
int our_kexinitlen;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int kex_init_value, kex_reply_value;
Turn SSH-2 MACs into a classoid. This piece of tidying-up has come out particularly well in terms of saving tedious repetition and boilerplate. I've managed to remove three pointless methods from every MAC implementation by means of writing them once centrally in terms of the implementation-specific methods; another method (hmacmd5_sink) vanished because I was able to make the interface type 'ssh2_mac' be directly usable as a BinarySink by way of a new delegation system; and because all the method implementations can now find their own vtable, I was even able to merge a lot of keying and output functions that had previously differed only in length parameters by having them look up the lengths in whatever vtable they were passed.
2018-09-13 15:15:17 +00:00
const struct ssh2_macalg *const *maclist;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int nmacs;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
struct {
Turn SSH-2 ciphers into a classoid. This is more or less the same job as the SSH-1 case, only more extensive, because we have a wider range of ciphers. I'm a bit disappointed about the AES case, in particular, because I feel as if it ought to have been possible to arrange to combine this layer of vtable dispatch with the subsidiary one that selects between hardware and software implementations of the underlying cipher. I may come back later and have another try at that, in fact.
2018-09-13 13:43:04 +00:00
const struct ssh2_cipheralg *cipher;
Turn SSH-2 MACs into a classoid. This piece of tidying-up has come out particularly well in terms of saving tedious repetition and boilerplate. I've managed to remove three pointless methods from every MAC implementation by means of writing them once centrally in terms of the implementation-specific methods; another method (hmacmd5_sink) vanished because I was able to make the interface type 'ssh2_mac' be directly usable as a BinarySink by way of a new delegation system; and because all the method implementations can now find their own vtable, I was even able to merge a lot of keying and output functions that had previously differed only in length parameters by having them look up the lengths in whatever vtable they were passed.
2018-09-13 15:15:17 +00:00
const struct ssh2_macalg *mac;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
int etm_mode;
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
const struct ssh_compression_alg *comp;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
} in, out;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen hostkeydata, sigdata;
char *keystr, *fingerprint;
Invent a struct type for polymorphic SSH key data. During last week's work, I made a mistake in which I got the arguments backwards in one of the key-blob-generating functions - mistakenly swapped the 'void *' key instance with the 'BinarySink *' output destination - and I didn't spot the mistake until run time, because in C you can implicitly convert both to and from void * and so there was no compile-time failure of type checking. Now that I've introduced the FROMFIELD macro that downcasts a pointer to one field of a structure to retrieve a pointer to the whole structure, I think I might start using that more widely to indicate this kind of polymorphic subtyping. So now all the public-key functions in the struct ssh_signkey vtable handle their data instance in the form of a pointer to a subfield of a new zero-sized structure type 'ssh_key', which outside the key implementations indicates 'this is some kind of key instance but it could be of any type'; they downcast that pointer internally using FROMFIELD in place of the previous ordinary C cast, and return one by returning &foo->sshk for whatever foo they've just made up. The sshk member is not at the beginning of the structure, which means all those FROMFIELDs and &key->sshk are actually adding and subtracting an offset. Of course I could have put the member at the start anyway, but I had the idea that it's actually a feature _not_ to have the two types start at the same address, because it means you should notice earlier rather than later if you absentmindedly cast from one to the other directly rather than by the approved method (in particular, if you accidentally assign one through a void * and back without even _noticing_ you perpetrated a cast). In particular, this enforces that you can't sfree() the thing even once without realising you should instead of called the right freekey function. (I found several bugs by this method during initial testing, so I think it's already proved its worth!) While I'm here, I've also renamed the vtable structure ssh_signkey to ssh_keyalg, because it was a confusing name anyway - it describes the _algorithm_ for handling all keys of that type, not a specific key. So ssh_keyalg is the collection of code, and ssh_key is one instance of the data it handles.
2018-05-27 07:32:21 +00:00
ssh_key *hkey; /* actual host key */
struct RSAKey *rsakey; /* for RSA kex */
struct ec_key *eckey; /* for ECDH kex */
Dimitry Andric spotted that DH gex with SHA-256 was overflowing a buffer. Fixed, and added paranoia so that this shouldn't happen again. [originally from svn r6606] [this svn revision also touched putty-wishlist]
2006-03-12 19:24:05 +00:00
unsigned char exchange_hash[SSH2_KEX_MAX_HASH_LEN];
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
int n_preferred_kex;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
int can_gssapi_keyex;
int need_gss_transient_hostkey;
int warned_about_no_gss_transient_hostkey;
Revert KEX_MAX_CONF system from the GSS kex patch. Commit d515e4f1a went through a lot of very different shapes before it was finally pushed. In some of them, GSS kex had its own value in the kex enumeration, but it was used in ssh.c but not in config.c (because, as in the final version, it wasn't configured by the same drag-list system as the rest of them). So we had to distinguish the set of key exchange ids known to the program as a whole from the set controllable in the configuration. In the final version, GSS kex ended up even more separated from the kex enumeration than that: the enum value KEX_GSS_SHA1_K5 isn't used at all. Instead, GSS key exchange appears in the list at the point of translation from the list of enum values into the list of pointers to data structures full of kex methods. But after all the changes, everyone involved forgot to revert the part of the patch which split KEX_MAX in two and introduced the pointless value KEX_GSS_SHA1_K5! Better late than never: I'm reverting it now, to avoid confusion, and because I don't have any reason to think the distinction will be useful for any other purpose.
2018-05-01 06:41:01 +00:00
const struct ssh_kexes *preferred_kex[KEX_MAX + 1]; /* +1 for GSSAPI */
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
int n_preferred_hk;
int preferred_hk[HK_MAX];
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int n_preferred_ciphers;
const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX];
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
const struct ssh_compression_alg *preferred_comp;
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
int userauth_succeeded; /* for delayed compression */
int pending_compression;
Remove do_ssh2_transport variable 'activated_authconn'. It hasn't been used since 2012, when commit 8e0ab8be5 introduced a new method of getting the do_ssh2_authconn coroutine started, and didn't notice that the variable we were previously using was now completely unused.
2018-05-17 14:19:54 +00:00
int got_session_id;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
int dlgret;
int guessok;
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
int ignorepkt;
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
struct kexinit_algorithm kexlists[NKEXLIST][MAXKEXLIST];
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
Ssh_gss_buf gss_buf;
Ssh_gss_buf gss_rcvtok, gss_sndtok;
Ssh_gss_stat gss_stat;
Ssh_gss_ctx gss_ctx;
Ssh_gss_buf mic;
int init_token_sent;
int complete_rcvd;
int gss_delegate;
time_t gss_cred_expiry;
#endif
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
};
crState(do_ssh2_transport_state);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
assert(!ssh->bare_connection);
ssh_pkt_defersend: don't call do_ssh2_transport when using SSH-1. Also add an assertion to do_ssh2_transport to catch this. This bug would be highly unlikely to manifest accidentally, but I think you could trigger it by setting the data-based rekey threshold very low.
2016-05-01 17:16:22 +00:00
assert(ssh->version == 2);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
Tweak to SSH coroutine code: put line number in the coroutine state structure, which is consistent with Simon's canonical version of the macros. [originally from svn r9607]
2012-08-18 09:30:01 +00:00
crBeginState;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->in.cipher = s->out.cipher = NULL;
s->in.mac = s->out.mac = NULL;
s->in.comp = s->out.comp = NULL;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Remove do_ssh2_transport variable 'activated_authconn'. It hasn't been used since 2012, when commit 8e0ab8be5 introduced a new method of getting the do_ssh2_authconn coroutine started, and didn't notice that the variable we were previously using was now completely unused.
2018-05-17 14:19:54 +00:00
s->got_session_id = FALSE;
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
s->userauth_succeeded = FALSE;
s->pending_compression = FALSE;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->need_gss_transient_hostkey = FALSE;
s->warned_about_no_gss_transient_hostkey = FALSE;
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
/*
* Be prepared to work around the buggy MAC problem.
*/
if (ssh->remote_bugs & BUG_SSH2_HMAC)
s->maclist = buggymacs, s->nmacs = lenof(buggymacs);
else
s->maclist = macs, s->nmacs = lenof(macs);
begin_key_exchange:
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
if (s->need_gss_transient_hostkey) {
/*
* This flag indicates a special case in which we must not do
* GSS key exchange even if we could. (See comments below,
* where the flag was set on the previous key exchange.)
*/
s->can_gssapi_keyex = FALSE;
Make GSS kex and GSS userauth separately configurable. The former has advantages in terms of keeping Kerberos credentials up to date, but it also does something sufficiently weird to the usual SSH host key system that I think it's worth making sure users have a means of turning it off separately from the less intrusive GSS userauth.
2018-04-26 18:15:15 +00:00
} else if (conf_get_int(ssh->conf, CONF_try_gssapi_kex)) {
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/*
* We always check if we have GSS creds before we come up with
* the kex algorithm list, otherwise future rekeys will fail
* when creds expire. To make this so, this code section must
* follow the begin_key_exchange label above, otherwise this
* section would execute just once per-connection.
*
* Update GSS state unless the reason we're here is that a
* timer just checked the GSS state and decided that we should
* rekey to update delegated credentials. In that case, the
* state is "fresh".
*/
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
if (ssh->rekey_class != RK_GSS_UPDATE)
Reduce verbosity of 'GSS init sec context failed' message. Now we don't generate that message as a side effect of the periodic check for new GSS credentials; we only generate it as part of the much larger slew of messages that happen during a rekey.
2018-05-01 17:54:04 +00:00
ssh2_gss_update(ssh, TRUE);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/* Do GSSAPI KEX when capable */
s->can_gssapi_keyex = ssh->gss_status & GSS_KEX_CAPABLE;
/*
* But not when failure is likely. [ GSS implementations may
* attempt (and fail) to use a ticket that is almost expired
* when retrieved from the ccache that actually expires by the
* time the server receives it. ]
*
* Note: The first time always try KEXGSS if we can, failures
* will be very rare, and disabling the initial GSS KEX is
* worse. Some day GSS libraries will ignore cached tickets
* whose lifetime is critically short, and will instead use
* fresh ones.
*/
if (!s->got_session_id && (ssh->gss_status & GSS_CTXT_MAYFAIL) != 0)
s->can_gssapi_keyex = 0;
s->gss_delegate = conf_get_int(ssh->conf, CONF_gssapifwd);
Make GSS kex and GSS userauth separately configurable. The former has advantages in terms of keeping Kerberos credentials up to date, but it also does something sufficiently weird to the usual SSH host key system that I think it's worth making sure users have a means of turning it off separately from the less intrusive GSS userauth.
2018-04-26 18:15:15 +00:00
} else {
s->can_gssapi_keyex = FALSE;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
}
#endif
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.kctx = SSH2_PKTCTX_NOKEX;
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
{
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
int i, j, k, warn;
struct kexinit_algorithm *alg;
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
/*
* Set up the preferred key exchange. (NULL => warn below here)
*/
s->n_preferred_kex = 0;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (s->can_gssapi_keyex)
s->preferred_kex[s->n_preferred_kex++] = &ssh_gssk5_sha1_kex;
Revert KEX_MAX_CONF system from the GSS kex patch. Commit d515e4f1a went through a lot of very different shapes before it was finally pushed. In some of them, GSS kex had its own value in the kex enumeration, but it was used in ssh.c but not in config.c (because, as in the final version, it wasn't configured by the same drag-list system as the rest of them). So we had to distinguish the set of key exchange ids known to the program as a whole from the set controllable in the configuration. In the final version, GSS kex ended up even more separated from the kex enumeration than that: the enum value KEX_GSS_SHA1_K5 isn't used at all. Instead, GSS key exchange appears in the list at the point of translation from the list of enum values into the list of pointers to data structures full of kex methods. But after all the changes, everyone involved forgot to revert the part of the patch which split KEX_MAX in two and introduced the pointless value KEX_GSS_SHA1_K5! Better late than never: I'm reverting it now, to avoid confusion, and because I don't have any reason to think the distinction will be useful for any other purpose.
2018-05-01 06:41:01 +00:00
for (i = 0; i < KEX_MAX; i++) {
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
switch (conf_get_int_int(ssh->conf, CONF_ssh_kexlist, i)) {
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
case KEX_DHGEX:
s->preferred_kex[s->n_preferred_kex++] =
&ssh_diffiehellman_gex;
break;
case KEX_DHGROUP14:
s->preferred_kex[s->n_preferred_kex++] =
&ssh_diffiehellman_group14;
break;
case KEX_DHGROUP1:
s->preferred_kex[s->n_preferred_kex++] =
&ssh_diffiehellman_group1;
break;
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
case KEX_RSA:
s->preferred_kex[s->n_preferred_kex++] =
&ssh_rsa_kex;
break;
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
case KEX_ECDH:
s->preferred_kex[s->n_preferred_kex++] =
&ssh_ecdh_kex;
break;
Dimitry Andric spotted that DH gex with SHA-256 was overflowing a buffer. Fixed, and added paranoia so that this shouldn't happen again. [originally from svn r6606] [this svn revision also touched putty-wishlist]
2006-03-12 19:24:05 +00:00
case KEX_WARN:
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
/* Flag for later. Don't bother if it's the last in
* the list. */
if (i < KEX_MAX - 1) {
s->preferred_kex[s->n_preferred_kex++] = NULL;
}
break;
}
}
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
/*
* Set up the preferred host key types. These are just the ids
* in the enum in putty.h, so 'warn below here' is indicated
* by HK_WARN.
*/
s->n_preferred_hk = 0;
for (i = 0; i < HK_MAX; i++) {
int id = conf_get_int_int(ssh->conf, CONF_ssh_hklist, i);
/* As above, don't bother with HK_WARN if it's last in the
* list */
if (id != HK_WARN || i < HK_MAX - 1)
s->preferred_hk[s->n_preferred_hk++] = id;
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
/*
* Set up the preferred ciphers. (NULL => warn below here)
*/
s->n_preferred_ciphers = 0;
for (i = 0; i < CIPHER_MAX; i++) {
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
switch (conf_get_int_int(ssh->conf, CONF_ssh_cipherlist, i)) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
case CIPHER_BLOWFISH:
s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_blowfish;
break;
case CIPHER_DES:
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_ssh2_des_cbc)) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_des;
}
break;
case CIPHER_3DES:
s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_3des;
break;
case CIPHER_AES:
s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_aes;
break;
Implement my experimental arcfour modes. The 256-bit version is disabled until I can test it against someone else's implementation. [originally from svn r5633]
2005-04-14 22:58:29 +00:00
case CIPHER_ARCFOUR:
s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_arcfour;
break;
Add the ChaCha20-Poly1305 cipher+MAC, as implemented by OpenSSH.
2015-06-07 11:51:51 +00:00
case CIPHER_CHACHA20:
s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_ccp;
break;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
case CIPHER_WARN:
/* Flag for later. Don't bother if it's the last in
* the list. */
if (i < CIPHER_MAX - 1) {
s->preferred_ciphers[s->n_preferred_ciphers++] = NULL;
}
break;
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
}
}
Add a config option to emulate the HMAC bug in commercial SSH v2.3.x and earlier (namely, it uses only 16 bytes of key rather than 20). [originally from svn r706]
2000-10-12 12:39:44 +00:00
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
/*
* Set up preferred compression.
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_compression))
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
s->preferred_comp = &ssh_zlib;
else
s->preferred_comp = &ssh_comp_none;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
/*
* Enable queueing of outgoing auth- or connection-layer
* packets while we are in the middle of a key exchange.
*/
ssh->queueing = TRUE;
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
/*
* Flag that KEX is in progress.
*/
ssh->kex_in_progress = TRUE;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
for (i = 0; i < NKEXLIST; i++)
for (j = 0; j < MAXKEXLIST; j++)
s->kexlists[i][j].name = NULL;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
/* List key exchange algorithms. */
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
warn = FALSE;
Add a preference list for SSH-2 key exchange algorithms, on a new "Kex" panel (which will gain more content anon). Retire BUG_SSH2_DH_GEX and add a backwards-compatibility wart, since we never did find a way of automatically detecting this alleged server bug, and in any case there was only ever one report (<3D91F3B5.7030309@inwind.it>, FWIW). Also generalise askcipher() to a new askalg() (thus touching all the front-ends). I've made some attempt to document what SSH key exchange is and why you care, but it could use some review for clarity (and outright lies). [originally from svn r5022]
2004-12-23 02:24:07 +00:00
for (i = 0; i < s->n_preferred_kex; i++) {
Restructure things so that a single entry in the KEX preference list can correspond to multiple SSH-2 KEX algorithms. We already do the equivalent for cipher algorithms. [originally from svn r6262]
2005-09-03 13:41:43 +00:00
const struct ssh_kexes *k = s->preferred_kex[i];
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
if (!k) warn = TRUE;
else for (j = 0; j < k->nkexes; j++) {
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
alg = ssh2_kexinit_addalg(s->kexlists[KEXLIST_KEX],
k->list[j]->name);
alg->u.kex.kex = k->list[j];
alg->u.kex.warn = warn;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
/* List server host key algorithms. */
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
if (!s->got_session_id) {
/*
* In the first key exchange, we list all the algorithms
Add have_ssh_host_key() and use it to influence algorithm selection. The general plan is that if PuTTY knows a host key for a server, it should preferentially ask for the same type of key so that there's some chance of actually getting the same key again. This should mean that when a server (or PuTTY) adds a new host key type, PuTTY doesn't gratuitously switch to that key type and then warn the user about an unrecognised key.
2015-05-29 21:40:50 +00:00
* we're prepared to cope with, but prefer those algorithms
* for which we have a host key for this host.
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
*
* If the host key algorithm is below the warning
* threshold, we warn even if we did already have a key
* for it, on the basis that if the user has just
* reconfigured that host key type to be warned about,
* they surely _do_ want to be alerted that a server
* they're actually connecting to is using it.
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
*/
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
warn = FALSE;
for (i = 0; i < s->n_preferred_hk; i++) {
if (s->preferred_hk[i] == HK_WARN)
warn = TRUE;
for (j = 0; j < lenof(hostkey_algs); j++) {
if (hostkey_algs[j].id != s->preferred_hk[i])
continue;
if (have_ssh_host_key(ssh->savedhost, ssh->savedport,
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
hostkey_algs[j].alg->cache_id)) {
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
alg = ssh2_kexinit_addalg(s->kexlists[KEXLIST_HOSTKEY],
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
hostkey_algs[j].alg->ssh_id);
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
alg->u.hk.hostkey = hostkey_algs[j].alg;
alg->u.hk.warn = warn;
}
}
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
}
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
warn = FALSE;
for (i = 0; i < s->n_preferred_hk; i++) {
if (s->preferred_hk[i] == HK_WARN)
warn = TRUE;
for (j = 0; j < lenof(hostkey_algs); j++) {
if (hostkey_algs[j].id != s->preferred_hk[i])
continue;
alg = ssh2_kexinit_addalg(s->kexlists[KEXLIST_HOSTKEY],
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
hostkey_algs[j].alg->ssh_id);
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
alg->u.hk.hostkey = hostkey_algs[j].alg;
alg->u.hk.warn = warn;
}
}
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
} else if (ssh->gss_kex_used && !s->need_gss_transient_hostkey) {
/*
* If we've previously done a GSSAPI KEX, then we list
* precisely the algorithms for which a previous GSS key
* exchange has delivered us a host key, because we expect
* one of exactly those keys to be used in any subsequent
* non-GSS-based rekey.
*
* An exception is if this is the key exchange we
* triggered for the purposes of populating that cache -
* in which case the cache will currently be empty, which
* isn't helpful!
*/
warn = FALSE;
for (i = 0; i < s->n_preferred_hk; i++) {
if (s->preferred_hk[i] == HK_WARN)
warn = TRUE;
for (j = 0; j < lenof(hostkey_algs); j++) {
if (hostkey_algs[j].id != s->preferred_hk[i])
continue;
if (ssh_have_transient_hostkey(ssh, hostkey_algs[j].alg)) {
alg = ssh2_kexinit_addalg(s->kexlists[KEXLIST_HOSTKEY],
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
hostkey_algs[j].alg->ssh_id);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
alg->u.hk.hostkey = hostkey_algs[j].alg;
alg->u.hk.warn = warn;
}
}
}
#endif
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
} else {
/*
* In subsequent key exchanges, we list only the kex
* algorithm that was selected in the first key exchange,
* so that we keep getting the same host key and hence
* don't have to interrupt the user's session to ask for
* reverification.
*/
assert(ssh->kex);
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
alg = ssh2_kexinit_addalg(s->kexlists[KEXLIST_HOSTKEY],
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh->hostkey_alg->ssh_id);
alg->u.hk.hostkey = ssh->hostkey_alg;
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
alg->u.hk.warn = FALSE;
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
}
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (s->can_gssapi_keyex) {
alg = ssh2_kexinit_addalg(s->kexlists[KEXLIST_HOSTKEY], "null");
alg->u.hk.hostkey = NULL;
}
De-duplicate code in KEXINIT generation. There's no need to have identical code generating server-to-client and client-to-server versions of the cipher and MAC lists; a couple of twice-around loops will do fine. [originally from svn r9610]
2012-08-21 22:33:31 +00:00
/* List encryption algorithms (client->server then server->client). */
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
for (k = KEXLIST_CSCIPHER; k <= KEXLIST_SCCIPHER; k++) {
warn = FALSE;
Add FUZZING support to ssh.c. This adds the "none" cipher and MAC, and also disables kex signure verification and host-key checking. Since a client like this is completely insecure, it also rewrites the client version string to start "ISH", which should make it fail to interoperate with a real SSH server. The server version string is still expected to begin "SSH" so the real packet captures can be used against it.
2015-10-18 12:04:58 +00:00
#ifdef FUZZING
alg = ssh2_kexinit_addalg(s->kexlists[k], "none");
alg->u.cipher.cipher = NULL;
alg->u.cipher.warn = warn;
#endif /* FUZZING */
De-duplicate code in KEXINIT generation. There's no need to have identical code generating server-to-client and client-to-server versions of the cipher and MAC lists; a couple of twice-around loops will do fine. [originally from svn r9610]
2012-08-21 22:33:31 +00:00
for (i = 0; i < s->n_preferred_ciphers; i++) {
const struct ssh2_ciphers *c = s->preferred_ciphers[i];
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
if (!c) warn = TRUE;
else for (j = 0; j < c->nciphers; j++) {
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
alg = ssh2_kexinit_addalg(s->kexlists[k],
c->list[j]->name);
alg->u.cipher.cipher = c->list[j];
alg->u.cipher.warn = warn;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
}
}
De-duplicate code in KEXINIT generation. There's no need to have identical code generating server-to-client and client-to-server versions of the cipher and MAC lists; a couple of twice-around loops will do fine. [originally from svn r9610]
2012-08-21 22:33:31 +00:00
/* List MAC algorithms (client->server then server->client). */
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
for (j = KEXLIST_CSMAC; j <= KEXLIST_SCMAC; j++) {
Add FUZZING support to ssh.c. This adds the "none" cipher and MAC, and also disables kex signure verification and host-key checking. Since a client like this is completely insecure, it also rewrites the client version string to start "ISH", which should make it fail to interoperate with a real SSH server. The server version string is still expected to begin "SSH" so the real packet captures can be used against it.
2015-10-18 12:04:58 +00:00
#ifdef FUZZING
alg = ssh2_kexinit_addalg(s->kexlists[j], "none");
alg->u.mac.mac = NULL;
alg->u.mac.etm = FALSE;
#endif /* FUZZING */
Support OpenSSH encrypt-then-MAC protocol extension. This causes the initial length field of the SSH-2 binary packet to be unencrypted (with the knock-on effect that now the packet length not including MAC must be congruent to 4 rather than 0 mod the cipher block size), and then the MAC is applied over the unencrypted length field and encrypted ciphertext (prefixed by the sequence number as usual). At the cost of exposing some information about the packet lengths to an attacker (but rarely anything they couldn't have inferred from the TCP headers anyway), this closes down any possibility of a MITM using the client as a decryption oracle, unless they can _first_ fake a correct MAC. ETM mode is enabled by means of selecting a different MAC identifier, all the current ones of which are constructed by appending "-etm@openssh.com" to the name of a MAC that already existed. We currently prefer the original SSH-2 binary packet protocol (i.e. we list all the ETM-mode MACs last in our KEXINIT), on the grounds that it's better tested and more analysed, so at the moment the new mode is only activated if a server refuses to speak anything else.
2015-04-26 22:30:32 +00:00
for (i = 0; i < s->nmacs; i++) {
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
alg = ssh2_kexinit_addalg(s->kexlists[j], s->maclist[i]->name);
alg->u.mac.mac = s->maclist[i];
alg->u.mac.etm = FALSE;
Support OpenSSH encrypt-then-MAC protocol extension. This causes the initial length field of the SSH-2 binary packet to be unencrypted (with the knock-on effect that now the packet length not including MAC must be congruent to 4 rather than 0 mod the cipher block size), and then the MAC is applied over the unencrypted length field and encrypted ciphertext (prefixed by the sequence number as usual). At the cost of exposing some information about the packet lengths to an attacker (but rarely anything they couldn't have inferred from the TCP headers anyway), this closes down any possibility of a MITM using the client as a decryption oracle, unless they can _first_ fake a correct MAC. ETM mode is enabled by means of selecting a different MAC identifier, all the current ones of which are constructed by appending "-etm@openssh.com" to the name of a MAC that already existed. We currently prefer the original SSH-2 binary packet protocol (i.e. we list all the ETM-mode MACs last in our KEXINIT), on the grounds that it's better tested and more analysed, so at the moment the new mode is only activated if a server refuses to speak anything else.
2015-04-26 22:30:32 +00:00
}
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
for (i = 0; i < s->nmacs; i++)
Support OpenSSH encrypt-then-MAC protocol extension. This causes the initial length field of the SSH-2 binary packet to be unencrypted (with the knock-on effect that now the packet length not including MAC must be congruent to 4 rather than 0 mod the cipher block size), and then the MAC is applied over the unencrypted length field and encrypted ciphertext (prefixed by the sequence number as usual). At the cost of exposing some information about the packet lengths to an attacker (but rarely anything they couldn't have inferred from the TCP headers anyway), this closes down any possibility of a MITM using the client as a decryption oracle, unless they can _first_ fake a correct MAC. ETM mode is enabled by means of selecting a different MAC identifier, all the current ones of which are constructed by appending "-etm@openssh.com" to the name of a MAC that already existed. We currently prefer the original SSH-2 binary packet protocol (i.e. we list all the ETM-mode MACs last in our KEXINIT), on the grounds that it's better tested and more analysed, so at the moment the new mode is only activated if a server refuses to speak anything else.
2015-04-26 22:30:32 +00:00
/* For each MAC, there may also be an ETM version,
* which we list second. */
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
if (s->maclist[i]->etm_name) {
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
alg = ssh2_kexinit_addalg(s->kexlists[j],
s->maclist[i]->etm_name);
alg->u.mac.mac = s->maclist[i];
alg->u.mac.etm = TRUE;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
}
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
/* List client->server compression algorithms,
* then server->client compression algorithms. (We use the
* same set twice.) */
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
for (j = KEXLIST_CSCOMP; j <= KEXLIST_SCCOMP; j++) {
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
assert(lenof(compressions) > 1);
/* Prefer non-delayed versions */
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
alg = ssh2_kexinit_addalg(s->kexlists[j], s->preferred_comp->name);
alg->u.comp = s->preferred_comp;
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
/* We don't even list delayed versions of algorithms until
* they're allowed to be used, to avoid a race. See the end of
* this function. */
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
if (s->userauth_succeeded && s->preferred_comp->delayed_name) {
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
alg = ssh2_kexinit_addalg(s->kexlists[j],
s->preferred_comp->delayed_name);
alg->u.comp = s->preferred_comp;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
}
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
for (i = 0; i < lenof(compressions); i++) {
Make ssh_compress into a pair of linked classoids. This was mildly fiddly because there's a single vtable structure that implements two distinct interface types, one for compression and one for decompression - and I have actually confused them before now (commit d4304f1b7), so I think it's important to make them actually be separate types!
2018-09-14 08:16:41 +00:00
const struct ssh_compression_alg *c = compressions[i];
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
alg = ssh2_kexinit_addalg(s->kexlists[j], c->name);
alg->u.comp = c;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
if (s->userauth_succeeded && c->delayed_name) {
Add a common function to add an algorithm to KEXINIT. This allows for sharing a bit of code, and it also means that deduplication of KEXINIT algorithms can be done while working out the list of algorithms rather than when constructing the KEXINIT packet itself.
2015-05-30 08:10:48 +00:00
alg = ssh2_kexinit_addalg(s->kexlists[j], c->delayed_name);
alg->u.comp = c;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
}
}
}
/*
* Construct and send our key exchange packet.
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_KEXINIT);
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
for (i = 0; i < 16; i++)
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_byte(s->pktout, (unsigned char) random_byte());
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
for (i = 0; i < NKEXLIST; i++) {
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
strbuf *list = strbuf_new();
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
for (j = 0; j < MAXKEXLIST; j++) {
if (s->kexlists[i][j].name == NULL) break;
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
add_to_commasep(list, s->kexlists[i][j].name);
In SSH-2, list each compression algorithm only once. (No particular reason for this change, just tidiness.) [originally from svn r4528]
2004-09-03 12:28:19 +00:00
}
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringsb(s->pktout, list);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
}
/* List client->server languages. Empty list. */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "");
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
/* List server->client languages. Empty list. */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "");
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
/* First KEX packet does _not_ follow, because we're not that brave. */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_bool(s->pktout, FALSE);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
/* Reserved. */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(s->pktout, 0);
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
}
Attempt to get repeated key exchange working in SSH2. Still under test - might not be 100%. I think it _ought_ to work though. [originally from svn r826]
2000-12-18 09:20:08 +00:00
Further progress in the direction of variable exchange hashes -- stash the outgoing KEXINIT, and only start generating the exchange hash once we know which KEX method we're using. [originally from svn r6242]
2005-08-30 22:39:35 +00:00
s->our_kexinitlen = s->pktout->length - 5;
s->our_kexinit = snewn(s->our_kexinitlen, unsigned char);
memcpy(s->our_kexinit, s->pktout->data + 5, s->our_kexinitlen);
Attempt to get repeated key exchange working in SSH2. Still under test - might not be 100%. I think it _ought_ to work though. [originally from svn r826]
2000-12-18 09:20:08 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, s->pktout);
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL);
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
/*
* Now examine the other side's KEXINIT to see what we're up
* to.
*/
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
{
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen str;
int i, j;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type != SSH2_MSG_KEXINIT) {
Ahem; fix `bombout' so it passes the correct frontend handle to connection_fatal(). [originally from svn r3030]
2003-03-31 11:22:30 +00:00
bombout(("expected key exchange packet from server"));
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->kex = NULL;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh->hostkey_alg = NULL;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->in.cipher = s->out.cipher = NULL;
s->in.mac = s->out.mac = NULL;
s->in.comp = s->out.comp = NULL;
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
s->warn_kex = s->warn_hk = FALSE;
s->warn_cscipher = s->warn_sccipher = FALSE;
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
get_data(pktin, 16); /* skip garbage cookie */
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
s->guessok = FALSE;
for (i = 0; i < NKEXLIST; i++) {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
str = get_string(pktin);
if (get_err(pktin)) {
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
bombout(("KEXINIT packet was incomplete"));
crStopV;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
}
Don't try to agree a MAC we'll never use. If we've chosen the ChaCha20-Poly1305 option for a cipher, then that forces the use of its associated MAC. In that situation, we should avoid even _trying_ to figure out a MAC by examining the MAC string from the server's KEXINIT, because we won't use the MAC selected by that method anyway, so there's no point imposing the requirement on servers to present a MAC we believe in just so we know it's there. This was breaking interoperation with tinysshd, and is in violation of OpenSSH's spec for the "chacha20-poly1305@openssh.com" cipher.
2015-09-24 10:41:43 +00:00
/* If we've already selected a cipher which requires a
* particular MAC, then just select that, and don't even
* bother looking through the server's KEXINIT string for
* MACs. */
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
if (i == KEXLIST_CSMAC && s->out.cipher &&
s->out.cipher->required_mac) {
s->out.mac = s->out.cipher->required_mac;
s->out.etm_mode = !!(s->out.mac->etm_name);
Don't try to agree a MAC we'll never use. If we've chosen the ChaCha20-Poly1305 option for a cipher, then that forces the use of its associated MAC. In that situation, we should avoid even _trying_ to figure out a MAC by examining the MAC string from the server's KEXINIT, because we won't use the MAC selected by that method anyway, so there's no point imposing the requirement on servers to present a MAC we believe in just so we know it's there. This was breaking interoperation with tinysshd, and is in violation of OpenSSH's spec for the "chacha20-poly1305@openssh.com" cipher.
2015-09-24 10:41:43 +00:00
goto matched;
}
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
if (i == KEXLIST_SCMAC && s->in.cipher &&
s->in.cipher->required_mac) {
s->in.mac = s->in.cipher->required_mac;
s->in.etm_mode = !!(s->in.mac->etm_name);
Don't try to agree a MAC we'll never use. If we've chosen the ChaCha20-Poly1305 option for a cipher, then that forces the use of its associated MAC. In that situation, we should avoid even _trying_ to figure out a MAC by examining the MAC string from the server's KEXINIT, because we won't use the MAC selected by that method anyway, so there's no point imposing the requirement on servers to present a MAC we believe in just so we know it's there. This was breaking interoperation with tinysshd, and is in violation of OpenSSH's spec for the "chacha20-poly1305@openssh.com" cipher.
2015-09-24 10:41:43 +00:00
goto matched;
}
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
for (j = 0; j < MAXKEXLIST; j++) {
struct kexinit_algorithm *alg = &s->kexlists[i][j];
if (alg->name == NULL) break;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
if (in_commasep_string(alg->name, str.ptr, str.len)) {
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
/* We've found a matching algorithm. */
if (i == KEXLIST_KEX || i == KEXLIST_HOSTKEY) {
/* Check if we might need to ignore first kex pkt */
if (j != 0 ||
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
!first_in_commasep_string(alg->name,
str.ptr, str.len))
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
s->guessok = FALSE;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
}
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
if (i == KEXLIST_KEX) {
ssh->kex = alg->u.kex.kex;
s->warn_kex = alg->u.kex.warn;
} else if (i == KEXLIST_HOSTKEY) {
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/*
* Ignore an unexpected/inappropriate offer of "null",
* we offer "null" when we're willing to use GSS KEX,
* but it is only acceptable when GSSKEX is actually
* selected.
*/
if (alg->u.hk.hostkey == NULL &&
ssh->kex->main_type != KEXTYPE_GSS)
continue;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh->hostkey_alg = alg->u.hk.hostkey;
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
s->warn_hk = alg->u.hk.warn;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
} else if (i == KEXLIST_CSCIPHER) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->out.cipher = alg->u.cipher.cipher;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
s->warn_cscipher = alg->u.cipher.warn;
} else if (i == KEXLIST_SCCIPHER) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->in.cipher = alg->u.cipher.cipher;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
s->warn_sccipher = alg->u.cipher.warn;
} else if (i == KEXLIST_CSMAC) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->out.mac = alg->u.mac.mac;
s->out.etm_mode = alg->u.mac.etm;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
} else if (i == KEXLIST_SCMAC) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->in.mac = alg->u.mac.mac;
s->in.etm_mode = alg->u.mac.etm;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
} else if (i == KEXLIST_CSCOMP) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->out.comp = alg->u.comp;
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
} else if (i == KEXLIST_SCCOMP) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->in.comp = alg->u.comp;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
}
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
goto matched;
Jacob's patch for a drag-list to select SSH ciphers. Heavily hacked by me to make the drag list behaviour slightly more intuitive. WARNING: DO NOT LOOK AT pl_itemfrompt() IF YOU ARE SQUEAMISH. [originally from svn r1199]
2001-08-25 19:33:33 +00:00
}
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
if ((i == KEXLIST_CSCOMP || i == KEXLIST_SCCOMP) &&
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
in_commasep_string(alg->u.comp->delayed_name,
Stop saying we'll try compression later, if it is later. On the post-userauth rekey, when we're specifically rekeying in order to turn on delayed compression, we shouldn't write the Event Log "Server supports delayed compression; will try this later" message that we did in the original key exchange. At this point, it _is_ later, and we're about to turn on compression right now!
2018-06-16 13:44:10 +00:00
str.ptr, str.len) &&
!s->userauth_succeeded)
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
s->pending_compression = TRUE; /* try this later */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
}
Log when we avoid using an unknown host key. Intended as a hint that users may want to use the "Cache new host key type" special command.
2016-03-25 15:37:16 +00:00
bombout(("Couldn't agree a %s (available: %.*s)",
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
kexlist_descr[i], PTRLEN_PRINTF(str)));
Restructure KEXINIT generation and parsing. The new code remembers the contents and meaning of the outgoing KEXINIT and uses this to drive the algorithm negotiation, rather than trying to reconstruct what the outgoing KEXINIT probably said. This removes the need to maintain the KEXINIT generation and parsing code precisely in parallel. It also fixes a bug whereby PuTTY would have selected the wrong host key type in cases where the server gained a host key type between rekeys.
2015-05-17 09:53:27 +00:00
crStopV;
matched:;
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (i == KEXLIST_HOSTKEY &&
!ssh->gss_kex_used &&
ssh->kex->main_type != KEXTYPE_GSS) {
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
int j;
/*
* In addition to deciding which host key we're
* actually going to use, we should make a list of the
* host keys offered by the server which we _don't_
* have cached. These will be offered as cross-
* certification options by ssh_get_specials.
Update the specials menu as keys are cross-certified. If you've just certified a key, you want it to vanish from the menu immediately, of course.
2016-03-21 19:05:32 +00:00
*
* We also count the key we're currently using for KEX
* as one we've already got, because by the time this
* menu becomes visible, it will be.
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
*/
ssh->n_uncert_hostkeys = 0;
for (j = 0; j < lenof(hostkey_algs); j++) {
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
if (hostkey_algs[j].alg != ssh->hostkey_alg &&
in_commasep_string(hostkey_algs[j].alg->ssh_id,
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
str.ptr, str.len) &&
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
!have_ssh_host_key(ssh->savedhost, ssh->savedport,
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
hostkey_algs[j].alg->cache_id)) {
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
ssh->uncert_hostkeys[ssh->n_uncert_hostkeys++] = j;
}
}
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Allow a cipher to override the SSH KEX's choice of MAC. No cipher uses this facility yet, but one shortly will.
2015-06-07 12:40:11 +00:00
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
if (s->pending_compression) {
logevent("Server supports delayed compression; "
"will try this later");
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
get_string(pktin); /* client->server language */
get_string(pktin); /* server->client language */
s->ignorepkt = get_bool(pktin) && !s->guessok;
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
ssh->exhash = ssh_hash_new(ssh->kex->hash);
put_stringz(ssh->exhash, ssh->v_c);
put_stringz(ssh->exhash, ssh->v_s);
put_string(ssh->exhash, s->our_kexinit, s->our_kexinitlen);
Move the calculation of the exchange hash to above the various warnings about insecure crypto components. The latter may crReturn (though not in any current implementation, I believe), which invalidates pktin, which is used by the former. [originally from svn r9921]
2013-07-14 10:46:27 +00:00
sfree(s->our_kexinit);
Clean up the 'data' vs 'body' pointers in struct Packet. There's always been some confusion over exactly what it all means. I haven't cleaned it up to the point of complete sensibleness, but I've got it to a point where I can at least understand and document the remaining non-sensibleness. [originally from svn r10070]
2013-11-17 14:04:18 +00:00
/* Include the type byte in the hash of server's KEXINIT */
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_string(ssh->exhash,
Remove body and length fields from PktIn. They were duplicating values stored in the BinarySource substructure. Mostly they're not referred to directly any more (instead, we call get_foo to access the BinarySource); and when they are, we can switch to reading the same values back out of the BinarySource anyway.
2018-06-06 06:17:09 +00:00
(const char *)BinarySource_UPCAST(pktin)->data - 1,
BinarySource_UPCAST(pktin)->len + 1);
Move the calculation of the exchange hash to above the various warnings about insecure crypto components. The latter may crReturn (though not in any current implementation, I believe), which invalidates pktin, which is used by the former. [originally from svn r9921]
2013-07-14 10:46:27 +00:00
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
if (s->warn_kex) {
s->dlgret = askalg(ssh->frontend, "key-exchange algorithm",
ssh->kex->name,
ssh_dialog_callback, ssh);
if (s->dlgret < 0) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->user_response = -1;
crWaitUntilV(ssh->user_response >= 0);
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
s->dlgret = ssh->user_response;
}
if (s->dlgret == 0) {
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
ssh_disconnect(ssh, "User aborted at kex warning", NULL,
0, TRUE);
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
}
}
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
if (s->warn_hk) {
Special host key warning when a better key exists. If you're connecting to a new server and it _only_ provides host key types you've configured to be below the warning threshold, it's OK to give the standard askalg() message. But if you've newly demoted a host key type and now reconnect to some server for which that type was the best key you had cached, the askalg() wording isn't really appropriate (it's not that the key we've settled on is the first type _supported by the server_, it's that it's the first type _cached by us_), and also it's potentially helpful to list the better algorithms so that the user can pick one to cross-certify.
2016-03-27 17:08:49 +00:00
int j, k;
char *betteralgs;
/*
* Change warning box wording depending on why we chose a
* warning-level host key algorithm. If it's because
* that's all we have *cached*, use the askhk mechanism,
* and list the host keys we could usefully cross-certify.
* Otherwise, use askalg for the standard wording.
*/
betteralgs = NULL;
for (j = 0; j < ssh->n_uncert_hostkeys; j++) {
const struct ssh_signkey_with_user_pref_id *hktype =
&hostkey_algs[ssh->uncert_hostkeys[j]];
int better = FALSE;
for (k = 0; k < HK_MAX; k++) {
int id = conf_get_int_int(ssh->conf, CONF_ssh_hklist, k);
if (id == HK_WARN) {
break;
} else if (id == hktype->id) {
better = TRUE;
break;
}
}
if (better) {
if (betteralgs) {
char *old_ba = betteralgs;
betteralgs = dupcat(betteralgs, ",",
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
hktype->alg->ssh_id,
Special host key warning when a better key exists. If you're connecting to a new server and it _only_ provides host key types you've configured to be below the warning threshold, it's OK to give the standard askalg() message. But if you've newly demoted a host key type and now reconnect to some server for which that type was the best key you had cached, the askalg() wording isn't really appropriate (it's not that the key we've settled on is the first type _supported by the server_, it's that it's the first type _cached by us_), and also it's potentially helpful to list the better algorithms so that the user can pick one to cross-certify.
2016-03-27 17:08:49 +00:00
(const char *)NULL);
sfree(old_ba);
} else {
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
betteralgs = dupstr(hktype->alg->ssh_id);
Special host key warning when a better key exists. If you're connecting to a new server and it _only_ provides host key types you've configured to be below the warning threshold, it's OK to give the standard askalg() message. But if you've newly demoted a host key type and now reconnect to some server for which that type was the best key you had cached, the askalg() wording isn't really appropriate (it's not that the key we've settled on is the first type _supported by the server_, it's that it's the first type _cached by us_), and also it's potentially helpful to list the better algorithms so that the user can pick one to cross-certify.
2016-03-27 17:08:49 +00:00
}
}
}
if (betteralgs) {
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->dlgret = askhk(ssh->frontend, ssh->hostkey_alg->ssh_id,
Special host key warning when a better key exists. If you're connecting to a new server and it _only_ provides host key types you've configured to be below the warning threshold, it's OK to give the standard askalg() message. But if you've newly demoted a host key type and now reconnect to some server for which that type was the best key you had cached, the askalg() wording isn't really appropriate (it's not that the key we've settled on is the first type _supported by the server_, it's that it's the first type _cached by us_), and also it's potentially helpful to list the better algorithms so that the user can pick one to cross-certify.
2016-03-27 17:08:49 +00:00
betteralgs, ssh_dialog_callback, ssh);
sfree(betteralgs);
} else {
s->dlgret = askalg(ssh->frontend, "host key type",
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh->hostkey_alg->ssh_id,
Special host key warning when a better key exists. If you're connecting to a new server and it _only_ provides host key types you've configured to be below the warning threshold, it's OK to give the standard askalg() message. But if you've newly demoted a host key type and now reconnect to some server for which that type was the best key you had cached, the askalg() wording isn't really appropriate (it's not that the key we've settled on is the first type _supported by the server_, it's that it's the first type _cached by us_), and also it's potentially helpful to list the better algorithms so that the user can pick one to cross-certify.
2016-03-27 17:08:49 +00:00
ssh_dialog_callback, ssh);
}
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
if (s->dlgret < 0) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->user_response = -1;
crWaitUntilV(ssh->user_response >= 0);
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
s->dlgret = ssh->user_response;
}
if (s->dlgret == 0) {
ssh_disconnect(ssh, "User aborted at host key warning", NULL,
0, TRUE);
crStopV;
}
}
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
if (s->warn_cscipher) {
s->dlgret = askalg(ssh->frontend,
"client-to-server cipher",
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->out.cipher->name,
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
ssh_dialog_callback, ssh);
if (s->dlgret < 0) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->user_response = -1;
crWaitUntilV(ssh->user_response >= 0);
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
s->dlgret = ssh->user_response;
}
if (s->dlgret == 0) {
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
0, TRUE);
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
}
}
if (s->warn_sccipher) {
s->dlgret = askalg(ssh->frontend,
"server-to-client cipher",
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->in.cipher->name,
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
ssh_dialog_callback, ssh);
if (s->dlgret < 0) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->user_response = -1;
crWaitUntilV(ssh->user_response >= 0);
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
s->dlgret = ssh->user_response;
}
if (s->dlgret == 0) {
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
ssh_disconnect(ssh, "User aborted at cipher warning", NULL,
0, TRUE);
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Ahem. Actually _checking_ that asynchronous askalg() worked would have been helpful. Since async verify_ssh_host_key() worked, I didn't think anything else could go wrong. How wrong I was. [originally from svn r5331]
2005-02-17 18:56:37 +00:00
}
}
if (s->ignorepkt) /* first_kex_packet_follows */
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL);
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
}
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
if (ssh->kex->main_type == KEXTYPE_DH) {
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
/*
* Work out the number of bits of key we will need from the
* key exchange. We start with the maximum key length of
* either cipher...
*/
{
int csbits, scbits;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
csbits = s->out.cipher ? s->out.cipher->real_keybits : 0;
scbits = s->in.cipher ? s->in.cipher->real_keybits : 0;
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
s->nbits = (csbits > scbits ? csbits : scbits);
}
/* The keys only have hlen-bit entropy, since they're based on
* a hash. So cap the key size at hlen bits. */
if (s->nbits > ssh->kex->hash->hlen * 8)
s->nbits = ssh->kex->hash->hlen * 8;
/*
* If we're doing Diffie-Hellman group exchange, start by
* requesting a group.
*/
Provide an 'extra' pointer in ssh_signkey and ssh_kex. This gives families of public key and kex functions (by which I mean those sharing a set of methods) a place to store parameters that allow the methods to vary depending on which exact algorithm is in use. The ssh_kex structure already had a set of parameters specific to Diffie-Hellman key exchange; I've moved those into sshdh.c and made them part of the 'extra' structure for that family only, so that unrelated kex methods don't have to faff about saying NULL,NULL,0,0. (This required me to write an extra accessor function for ssh.c to ask whether a DH method was group-exchange style or fixed-group style, but that doesn't seem too silly.)
2015-05-15 09:12:08 +00:00
if (dh_is_gex(ssh->kex)) {
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
logevent("Doing Diffie-Hellman group exchange");
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.kctx = SSH2_PKTCTX_DHGEX;
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
/*
* Work out how big a DH group we will need to allow that
* much data.
*/
s->pbits = 512 << ((s->nbits - 1) / 64);
Support RFC 4419. PuTTY now uses the updated version of Diffie-Hellman group exchange, except for a few old OpenSSH versions which Darren Tucker reports only support the old version. FIXME: this needs further work because the Bugs config panel has now overflowed.
2015-04-25 09:46:53 +00:00
if (s->pbits < DH_MIN_SIZE)
s->pbits = DH_MIN_SIZE;
if (s->pbits > DH_MAX_SIZE)
s->pbits = DH_MAX_SIZE;
if ((ssh->remote_bugs & BUG_SSH2_OLDGEX)) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_KEX_DH_GEX_REQUEST_OLD);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(s->pktout, s->pbits);
Support RFC 4419. PuTTY now uses the updated version of Diffie-Hellman group exchange, except for a few old OpenSSH versions which Darren Tucker reports only support the old version. FIXME: this needs further work because the Bugs config panel has now overflowed.
2015-04-25 09:46:53 +00:00
} else {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_KEX_DH_GEX_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(s->pktout, DH_MIN_SIZE);
put_uint32(s->pktout, s->pbits);
put_uint32(s->pktout, DH_MAX_SIZE);
Support RFC 4419. PuTTY now uses the updated version of Diffie-Hellman group exchange, except for a few old OpenSSH versions which Darren Tucker reports only support the old version. FIXME: this needs further work because the Bugs config panel has now overflowed.
2015-04-25 09:46:53 +00:00
}
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, s->pktout);
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL);
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
if (pktin->type != SSH2_MSG_KEX_DH_GEX_GROUP) {
bombout(("expected key exchange group packet from server"));
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->p = get_mp_ssh2(pktin);
s->g = get_mp_ssh2(pktin);
if (get_err(pktin)) {
freebn(s->p);
freebn(s->g);
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
bombout(("unable to read mp-ints from incoming group packet"));
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
}
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
ssh->dh_ctx = dh_setup_gex(s->p, s->g);
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT;
s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY;
} else {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.kctx = SSH2_PKTCTX_DHGROUP;
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
ssh->dh_ctx = dh_setup_group(ssh->kex);
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
s->kex_init_value = SSH2_MSG_KEXDH_INIT;
s->kex_reply_value = SSH2_MSG_KEXDH_REPLY;
logeventf(ssh, "Using Diffie-Hellman with standard group \"%s\"",
ssh->kex->groupname);
}
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
logeventf(ssh, "Doing Diffie-Hellman key exchange with hash %s",
ssh->kex->hash->text_name);
/*
* Now generate and send e for Diffie-Hellman.
*/
set_busy_status(ssh->frontend, BUSY_CPU); /* this can take a while */
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
s->e = dh_create_e(ssh->dh_ctx, s->nbits * 2);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(ssh->bpp, s->kex_init_value);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_mp_ssh2(s->pktout, s->e);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, s->pktout);
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
set_busy_status(ssh->frontend, BUSY_WAITING); /* wait for server */
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL);
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
if (pktin->type != s->kex_reply_value) {
bombout(("expected key exchange reply packet from server"));
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
}
set_busy_status(ssh->frontend, BUSY_CPU); /* cogitate */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->hostkeydata = get_string(pktin);
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->hkey = ssh_key_new_pub(ssh->hostkey_alg, s->hostkeydata);
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->f = get_mp_ssh2(pktin);
s->sigdata = get_string(pktin);
if (get_err(pktin)) {
Add missing null-pointer checks in key exchange. Assorted calls to ssh_pkt_getstring in handling the later parts of key exchange (post-KEXINIT) were not checked for NULL afterwards, so that a variety of badly formatted key exchange packets would cause a crash rather than a sensible error message. None of these is an exploitable vulnerability - the server can only force a clean null-deref crash, not an access to actually interesting memory. Thanks to '3unnym00n' for pointing out one of these, causing me to find all the rest of them too.
2015-06-13 14:22:03 +00:00
bombout(("unable to parse key exchange reply packet"));
crStopV;
}
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
Enforce acceptable range for Diffie-Hellman server value. Florent Daigniere of Matta points out that RFC 4253 actually _requires_ us to refuse to accept out-of-range values, though it isn't completely clear to me why this should be a MUST on the receiving end. Matta considers this to be a security vulnerability, on the grounds that if a server should accidentally send an obviously useless value such as 1 then we will fail to reject it and agree a key that an eavesdropper could also figure out. Their id for this vulnerability is MATTA-2015-002.
2015-02-05 19:39:17 +00:00
{
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
const char *err = dh_validate_f(ssh->dh_ctx, s->f);
Enforce acceptable range for Diffie-Hellman server value. Florent Daigniere of Matta points out that RFC 4253 actually _requires_ us to refuse to accept out-of-range values, though it isn't completely clear to me why this should be a MUST on the receiving end. Matta considers this to be a security vulnerability, on the grounds that if a server should accidentally send an obviously useless value such as 1 then we will fail to reject it and agree a key that an eavesdropper could also figure out. Their id for this vulnerability is MATTA-2015-002.
2015-02-05 19:39:17 +00:00
if (err) {
bombout(("key exchange reply failed validation: %s", err));
crStopV;
}
}
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
s->K = dh_find_K(ssh->dh_ctx, s->f);
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
/* We assume everything from now on will be quick, and it might
* involve user interaction. */
set_busy_status(ssh->frontend, BUSY_NOT);
The terminal window can now indicate that PuTTY is busy in various ways, by changing its mouse pointer. Currently this is only used in the (slightly- arbitrarily-defined) "heavy" bits of SSH-2 key exchange. We override pointer hiding while PuTTY is busy, but preserve pointer-hiding state. Not yet implemented on the Mac. Also switch to frobbing window-class cursor in Windows rather than relying on SetCursor(). [originally from svn r5303]
2005-02-15 17:05:58 +00:00
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_stringpl(ssh->exhash, s->hostkeydata);
Provide an 'extra' pointer in ssh_signkey and ssh_kex. This gives families of public key and kex functions (by which I mean those sharing a set of methods) a place to store parameters that allow the methods to vary depending on which exact algorithm is in use. The ssh_kex structure already had a set of parameters specific to Diffie-Hellman key exchange; I've moved those into sshdh.c and made them part of the 'extra' structure for that family only, so that unrelated kex methods don't have to faff about saying NULL,NULL,0,0. (This required me to write an extra accessor function for ssh.c to ask whether a DH method was group-exchange style or fixed-group style, but that doesn't seem too silly.)
2015-05-15 09:12:08 +00:00
if (dh_is_gex(ssh->kex)) {
Support RFC 4419. PuTTY now uses the updated version of Diffie-Hellman group exchange, except for a few old OpenSSH versions which Darren Tucker reports only support the old version. FIXME: this needs further work because the Bugs config panel has now overflowed.
2015-04-25 09:46:53 +00:00
if (!(ssh->remote_bugs & BUG_SSH2_OLDGEX))
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_uint32(ssh->exhash, DH_MIN_SIZE);
put_uint32(ssh->exhash, s->pbits);
Support RFC 4419. PuTTY now uses the updated version of Diffie-Hellman group exchange, except for a few old OpenSSH versions which Darren Tucker reports only support the old version. FIXME: this needs further work because the Bugs config panel has now overflowed.
2015-04-25 09:46:53 +00:00
if (!(ssh->remote_bugs & BUG_SSH2_OLDGEX))
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_uint32(ssh->exhash, DH_MAX_SIZE);
put_mp_ssh2(ssh->exhash, s->p);
put_mp_ssh2(ssh->exhash, s->g);
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
}
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_mp_ssh2(ssh->exhash, s->e);
put_mp_ssh2(ssh->exhash, s->f);
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
dh_cleanup(ssh->dh_ctx);
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
freebn(s->f);
Provide an 'extra' pointer in ssh_signkey and ssh_kex. This gives families of public key and kex functions (by which I mean those sharing a set of methods) a place to store parameters that allow the methods to vary depending on which exact algorithm is in use. The ssh_kex structure already had a set of parameters specific to Diffie-Hellman key exchange; I've moved those into sshdh.c and made them part of the 'extra' structure for that family only, so that unrelated kex methods don't have to faff about saying NULL,NULL,0,0. (This required me to write an extra accessor function for ssh.c to ask whether a DH method was group-exchange style or fixed-group style, but that doesn't seem too silly.)
2015-05-15 09:12:08 +00:00
if (dh_is_gex(ssh->kex)) {
Reindent the section that was marked `XXX The lines below should be reindented before this is committed'. Unfortunately not before it was committed, but you can't have everything :-) [originally from svn r7499]
2007-05-01 12:26:44 +00:00
freebn(s->g);
freebn(s->p);
}
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
} else if (ssh->kex->main_type == KEXTYPE_ECDH) {
Log which elliptic curve we're using for ECDH kex. It seems like quite an important thing to mention in the event log! Suppose there's a bug affecting only one curve, for example? Fixed- group Diffie-Hellman has always logged the group, but the ECDH log message just told you the hash and not also the curve. To implement this, I've added a 'textname' field to all elliptic curves, whether they're used for kex or signing or both, suitable for use in this log message and any others we might find a need for in future.
2015-05-19 07:42:23 +00:00
logeventf(ssh, "Doing ECDH key exchange with curve %s and hash %s",
ssh_ecdhkex_curve_textname(ssh->kex),
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
ssh->kex->hash->text_name);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.kctx = SSH2_PKTCTX_ECDHKEX;
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
Clean up elliptic curve selection and naming. The ec_name_to_curve and ec_curve_to_name functions shouldn't really have had to exist at all: whenever any part of the PuTTY codebase starts using sshecc.c, it's starting from an ssh_signkey or ssh_kex pointer already found by some other means. So if we make sure not to lose that pointer, we should never need to do any string-based lookups to find the curve we want, and conversely, when we need to know the name of our curve or our algorithm, we should be able to look it up as a straightforward const char * starting from the algorithm pointer. This commit cleans things up so that that is indeed what happens. The ssh_signkey and ssh_kex structures defined in sshecc.c now have 'extra' fields containing pointers to all the necessary stuff; ec_name_to_curve and ec_curve_to_name have been completely removed; struct ec_curve has a string field giving the curve's name (but only for those curves which _have_ a name exposed in the wire protocol, i.e. the three NIST ones); struct ec_key keeps a pointer to the ssh_signkey it started from, and uses that to remember the algorithm name rather than reconstructing it from the curve. And I think I've got rid of all the ad-hockery scattered around the code that switches on curve->fieldBits or manually constructs curve names using stuff like sprintf("nistp%d"); the only remaining switch on fieldBits (necessary because that's the UI for choosing a curve in PuTTYgen) is at least centralised into one place in sshecc.c. One user-visible result is that the format of ed25519 host keys in the registry has changed: there's now no curve name prefix on them, because I think it's not really right to make up a name to use. So any early adopters who've been using snapshot PuTTY in the last week will be inconvenienced; sorry about that.
2015-05-15 09:13:05 +00:00
s->eckey = ssh_ecdhkex_newkey(ssh->kex);
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
if (!s->eckey) {
bombout(("Unable to generate key for ECDH"));
crStopV;
}
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_KEX_ECDH_INIT);
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
{
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf *pubpoint = strbuf_new();
ssh_ecdhkex_getpublic(s->eckey, BinarySink_UPCAST(pubpoint));
put_stringsb(s->pktout, pubpoint);
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
}
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, s->pktout);
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL);
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
if (pktin->type != SSH2_MSG_KEX_ECDH_REPLY) {
ssh_ecdhkex_freekey(s->eckey);
bombout(("expected ECDH reply packet from server"));
crStopV;
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->hostkeydata = get_string(pktin);
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_stringpl(ssh->exhash, s->hostkeydata);
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->hkey = ssh_key_new_pub(ssh->hostkey_alg, s->hostkeydata);
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
{
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf *pubpoint = strbuf_new();
ssh_ecdhkex_getpublic(s->eckey, BinarySink_UPCAST(pubpoint));
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_string(ssh->exhash, pubpoint->u, pubpoint->len);
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf_free(pubpoint);
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
}
{
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen keydata = get_string(pktin);
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_stringpl(ssh->exhash, keydata);
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->K = ssh_ecdhkex_getkey(s->eckey, keydata.ptr, keydata.len);
if (!get_err(pktin) && !s->K) {
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
ssh_ecdhkex_freekey(s->eckey);
bombout(("point received in ECDH was not valid"));
crStopV;
}
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->sigdata = get_string(pktin);
if (get_err(pktin)) {
Add missing null-pointer checks in key exchange. Assorted calls to ssh_pkt_getstring in handling the later parts of key exchange (post-KEXINIT) were not checked for NULL afterwards, so that a variety of badly formatted key exchange packets would cause a crash rather than a sensible error message. None of these is an exploitable vulnerability - the server can only force a clean null-deref crash, not an access to actually interesting memory. Thanks to '3unnym00n' for pointing out one of these, causing me to find all the rest of them too.
2015-06-13 14:22:03 +00:00
bombout(("unable to parse key exchange reply packet"));
crStopV;
}
Elliptic-curve cryptography support. This provides support for ECDSA public keys, for both hosts and users, and also ECDH key exchange. Supported curves are currently just the three NIST curves required by RFC 5656.
2014-11-01 09:45:20 +00:00
ssh_ecdhkex_freekey(s->eckey);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
} else if (ssh->kex->main_type == KEXTYPE_GSS) {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen data;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.kctx = SSH2_PKTCTX_GSSKEX;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->init_token_sent = 0;
s->complete_rcvd = 0;
s->hkey = NULL;
s->fingerprint = NULL;
s->keystr = NULL;
/*
* Work out the number of bits of key we will need from the
* key exchange. We start with the maximum key length of
* either cipher...
*
* This is rote from the KEXTYPE_DH section above.
*/
{
int csbits, scbits;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
csbits = s->out.cipher->real_keybits;
scbits = s->in.cipher->real_keybits;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->nbits = (csbits > scbits ? csbits : scbits);
}
/* The keys only have hlen-bit entropy, since they're based on
* a hash. So cap the key size at hlen bits. */
if (s->nbits > ssh->kex->hash->hlen * 8)
s->nbits = ssh->kex->hash->hlen * 8;
if (dh_is_gex(ssh->kex)) {
/*
* Work out how big a DH group we will need to allow that
* much data.
*/
s->pbits = 512 << ((s->nbits - 1) / 64);
logeventf(ssh, "Doing GSSAPI (with Kerberos V5) Diffie-Hellman "
"group exchange, with minimum %d bits", s->pbits);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_KEXGSS_GROUPREQ);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(s->pktout, s->pbits); /* min */
put_uint32(s->pktout, s->pbits); /* preferred */
put_uint32(s->pktout, s->pbits * 2); /* max */
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, s->pktout);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV(
(pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (pktin->type != SSH2_MSG_KEXGSS_GROUP) {
bombout(("expected key exchange group packet from server"));
crStopV;
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->p = get_mp_ssh2(pktin);
s->g = get_mp_ssh2(pktin);
if (get_err(pktin)) {
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
bombout(("unable to read mp-ints from incoming group packet"));
crStopV;
}
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
ssh->dh_ctx = dh_setup_gex(s->p, s->g);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
} else {
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
ssh->dh_ctx = dh_setup_group(ssh->kex);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
logeventf(ssh, "Using GSSAPI (with Kerberos V5) Diffie-Hellman with standard group \"%s\"",
ssh->kex->groupname);
}
logeventf(ssh, "Doing GSSAPI (with Kerberos V5) Diffie-Hellman key exchange with hash %s",
ssh->kex->hash->text_name);
/* Now generate e for Diffie-Hellman. */
set_busy_status(ssh->frontend, BUSY_CPU); /* this can take a while */
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
s->e = dh_create_e(ssh->dh_ctx, s->nbits * 2);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (ssh->gsslib->gsslogmsg)
logevent(ssh->gsslib->gsslogmsg);
/* initial tokens are empty */
SSH_GSS_CLEAR_BUF(&s->gss_rcvtok);
SSH_GSS_CLEAR_BUF(&s->gss_sndtok);
SSH_GSS_CLEAR_BUF(&s->mic);
s->gss_stat = ssh->gsslib->acquire_cred(ssh->gsslib, &s->gss_ctx,
&s->gss_cred_expiry);
if (s->gss_stat != SSH_GSS_OK) {
bombout(("GSSAPI key exchange failed to initialize"));
crStopV;
}
/* now enter the loop */
assert(ssh->gss_srv_name);
do {
/*
* When acquire_cred yields no useful expiration, go with the
* service ticket expiration.
*/
s->gss_stat = ssh->gsslib->init_sec_context
(ssh->gsslib,
&s->gss_ctx,
ssh->gss_srv_name,
s->gss_delegate,
&s->gss_rcvtok,
&s->gss_sndtok,
(s->gss_cred_expiry == GSS_NO_EXPIRATION ?
&s->gss_cred_expiry : NULL),
NULL);
SSH_GSS_CLEAR_BUF(&s->gss_rcvtok);
if (s->gss_stat == SSH_GSS_S_COMPLETE && s->complete_rcvd)
break; /* MIC is verified after the loop */
if (s->gss_stat != SSH_GSS_S_COMPLETE &&
s->gss_stat != SSH_GSS_S_CONTINUE_NEEDED) {
if (ssh->gsslib->display_status(ssh->gsslib, s->gss_ctx,
&s->gss_buf) == SSH_GSS_OK) {
bombout(("GSSAPI key exchange failed to initialize"
" context: %s", (char *)s->gss_buf.value));
sfree(s->gss_buf.value);
crStopV;
} else {
bombout(("GSSAPI key exchange failed to initialize"
" context"));
crStopV;
}
}
assert(s->gss_stat == SSH_GSS_S_COMPLETE ||
s->gss_stat == SSH_GSS_S_CONTINUE_NEEDED);
if (!s->init_token_sent) {
s->init_token_sent = 1;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_KEXGSS_INIT);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (s->gss_sndtok.length == 0) {
bombout(("GSSAPI key exchange failed:"
" no initial context token"));
crStopV;
}
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_string(s->pktout,
s->gss_sndtok.value, s->gss_sndtok.length);
put_mp_ssh2(s->pktout, s->e);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, s->pktout);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->gsslib->free_tok(ssh->gsslib, &s->gss_sndtok);
logevent("GSSAPI key exchange initialised");
} else if (s->gss_sndtok.length != 0) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_KEXGSS_CONTINUE);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_string(s->pktout,
s->gss_sndtok.value, s->gss_sndtok.length);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, s->pktout);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->gsslib->free_tok(ssh->gsslib, &s->gss_sndtok);
}
if (s->gss_stat == SSH_GSS_S_COMPLETE && s->complete_rcvd)
break;
wait_for_gss_token:
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV(
(pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
switch (pktin->type) {
case SSH2_MSG_KEXGSS_CONTINUE:
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
data = get_string(pktin);
s->gss_rcvtok.value = (char *)data.ptr;
s->gss_rcvtok.length = data.len;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
continue;
case SSH2_MSG_KEXGSS_COMPLETE:
s->complete_rcvd = 1;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->f = get_mp_ssh2(pktin);
data = get_string(pktin);
s->mic.value = (char *)data.ptr;
s->mic.length = data.len;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/* Save expiration time of cred when delegating */
if (s->gss_delegate && s->gss_cred_expiry != GSS_NO_EXPIRATION)
ssh->gss_cred_expiry = s->gss_cred_expiry;
/* If there's a final token we loop to consume it */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
if (get_bool(pktin)) {
data = get_string(pktin);
s->gss_rcvtok.value = (char *)data.ptr;
s->gss_rcvtok.length = data.len;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
continue;
}
break;
case SSH2_MSG_KEXGSS_HOSTKEY:
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->hostkeydata = get_string(pktin);
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
if (ssh->hostkey_alg) {
s->hkey = ssh_key_new_pub(ssh->hostkey_alg,
s->hostkeydata);
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_string(ssh->exhash,
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->hostkeydata.ptr, s->hostkeydata.len);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
}
/*
* Can't loop as we have no token to pass to
* init_sec_context.
*/
goto wait_for_gss_token;
case SSH2_MSG_KEXGSS_ERROR:
/*
* We have no use for the server's major and minor
* status. The minor status is really only
* meaningful to the server, and with luck the major
* status means something to us (but not really all
* that much). The string is more meaningful, and
* hopefully the server sends any error tokens, as
* that will produce the most useful information for
* us.
*/
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
get_uint32(pktin); /* server's major status */
get_uint32(pktin); /* server's minor status */
data = get_string(pktin);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
logeventf(ssh, "GSSAPI key exchange failed; "
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
"server's message: %.*s", PTRLEN_PRINTF(data));
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/* Language tag, but we have no use for it */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
get_string(pktin);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/*
* Wait for an error token, if there is one, or the
* server's disconnect. The error token, if there
* is one, must follow the SSH2_MSG_KEXGSS_ERROR
* message, per the RFC.
*/
goto wait_for_gss_token;
default:
bombout(("unexpected message type during gss kex"));
crStopV;
break;
}
} while (s->gss_rcvtok.length ||
s->gss_stat == SSH_GSS_S_CONTINUE_NEEDED ||
!s->complete_rcvd);
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
s->K = dh_find_K(ssh->dh_ctx, s->f);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/* We assume everything from now on will be quick, and it might
* involve user interaction. */
set_busy_status(ssh->frontend, BUSY_NOT);
if (!s->hkey)
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_stringz(ssh->exhash, "");
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (dh_is_gex(ssh->kex)) {
/* min, preferred, max */
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_uint32(ssh->exhash, s->pbits);
put_uint32(ssh->exhash, s->pbits);
put_uint32(ssh->exhash, s->pbits * 2);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_mp_ssh2(ssh->exhash, s->p);
put_mp_ssh2(ssh->exhash, s->g);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
}
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_mp_ssh2(ssh->exhash, s->e);
put_mp_ssh2(ssh->exhash, s->f);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/*
* MIC verification is done below, after we compute the hash
* used as the MIC input.
*/
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
dh_cleanup(ssh->dh_ctx);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
freebn(s->f);
if (dh_is_gex(ssh->kex)) {
freebn(s->g);
freebn(s->p);
}
#endif
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
} else {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen rsakeydata;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
assert(ssh->kex->main_type == KEXTYPE_RSA);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
logeventf(ssh, "Doing RSA key exchange with hash %s",
ssh->kex->hash->text_name);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.kctx = SSH2_PKTCTX_RSAKEX;
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
/*
* RSA key exchange. First expect a KEXRSA_PUBKEY packet
* from the server.
*/
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
if (pktin->type != SSH2_MSG_KEXRSA_PUBKEY) {
bombout(("expected RSA public key packet from server"));
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->hostkeydata = get_string(pktin);
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_stringpl(ssh->exhash, s->hostkeydata);
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->hkey = ssh_key_new_pub(ssh->hostkey_alg, s->hostkeydata);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
rsakeydata = get_string(pktin);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->rsakey = ssh_rsakex_newkey(rsakeydata.ptr, rsakeydata.len);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
if (!s->rsakey) {
bombout(("unable to parse RSA public key from server"));
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
}
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_stringpl(ssh->exhash, rsakeydata);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
/*
* Next, set up a shared secret K, of precisely KLEN -
* 2*HLEN - 49 bits, where KLEN is the bit length of the
* RSA key modulus and HLEN is the bit length of the hash
* we're using.
*/
{
int klen = ssh_rsakex_klen(s->rsakey);
int nbits = klen - (2*ssh->kex->hash->hlen*8 + 49);
int i, byte = 0;
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
strbuf *buf;
unsigned char *outstr;
int outstrlen;
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
s->K = bn_power_2(nbits - 1);
for (i = 0; i < nbits; i++) {
if ((i & 7) == 0) {
byte = random_byte();
}
bignum_set_bit(s->K, i, (byte >> (i & 7)) & 1);
}
/*
* Encode this as an mpint.
*/
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
buf = strbuf_new();
put_mp_ssh2(buf, s->K);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
/*
* Encrypt it with the given RSA key.
*/
outstrlen = (klen + 7) / 8;
outstr = snewn(outstrlen, unsigned char);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
ssh_rsakex_encrypt(ssh->kex->hash, buf->u, buf->len,
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
outstr, outstrlen, s->rsakey);
/*
* And send it off in a return packet.
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_KEXRSA_SECRET);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_string(s->pktout, outstr, outstrlen);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, s->pktout);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_string(ssh->exhash, outstr, outstrlen);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
strbuf_free(buf);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
sfree(outstr);
}
ssh_rsakex_freekey(s->rsakey);
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL);
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
if (pktin->type != SSH2_MSG_KEXRSA_DONE) {
bombout(("expected signature packet from server"));
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->sigdata = get_string(pktin);
if (get_err(pktin)) {
Add missing null-pointer checks in key exchange. Assorted calls to ssh_pkt_getstring in handling the later parts of key exchange (post-KEXINIT) were not checked for NULL afterwards, so that a variety of badly formatted key exchange packets would cause a crash rather than a sensible error message. None of these is an exploitable vulnerability - the server can only force a clean null-deref crash, not an access to actually interesting memory. Thanks to '3unnym00n' for pointing out one of these, causing me to find all the rest of them too.
2015-06-13 14:22:03 +00:00
bombout(("unable to parse signature packet"));
crStopV;
}
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
}
Turn SSH hashes into a classoid. The new version of ssh_hash has the same nice property as ssh2_mac, that I can make the generic interface object type function directly as a BinarySink so that clients don't have to call h->sink() and worry about the separate sink object they get back from that.
2018-09-13 15:41:46 +00:00
put_mp_ssh2(ssh->exhash, s->K);
assert(ssh_hash_alg(ssh->exhash)->hlen <= sizeof(s->exchange_hash));
ssh_hash_final(ssh->exhash, s->exchange_hash);
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
if (ssh->kex->main_type == KEXTYPE_GSS) {
Ssh_gss_buf gss_buf;
SSH_GSS_CLEAR_BUF(&s->gss_buf);
gss_buf.value = s->exchange_hash;
gss_buf.length = ssh->kex->hash->hlen;
s->gss_stat = ssh->gsslib->verify_mic(ssh->gsslib, s->gss_ctx, &gss_buf, &s->mic);
if (s->gss_stat != SSH_GSS_OK) {
if (ssh->gsslib->display_status(ssh->gsslib, s->gss_ctx,
&s->gss_buf) == SSH_GSS_OK) {
bombout(("GSSAPI Key Exchange MIC was not valid: %s",
(char *)s->gss_buf.value));
sfree(s->gss_buf.value);
} else {
bombout(("GSSAPI Key Exchange MIC was not valid"));
}
crStopV;
}
ssh->gss_kex_used = TRUE;
/*-
* If this the first KEX, save the GSS context for "gssapi-keyex"
* authentication.
*
* http://tools.ietf.org/html/rfc4462#section-4
*
* This method may be used only if the initial key exchange was
* performed using a GSS-API-based key exchange method defined in
* accordance with Section 2. The GSS-API context used with this
* method is always that established during an initial GSS-API-based
* key exchange. Any context established during key exchange for the
* purpose of rekeying MUST NOT be used with this method.
*/
if (!s->got_session_id) {
ssh->gss_ctx = s->gss_ctx;
} else {
ssh->gsslib->release_cred(ssh->gsslib, &s->gss_ctx);
}
logeventf(ssh, "GSSAPI Key Exchange complete!");
}
#endif
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
ssh->dh_ctx = NULL;
Remove the last lingering knowledge, outside sshbn.c, of the internal structure of the Bignum type. Bignum is now a fully opaque type unless you're inside sshbn.c. [originally from svn r960]
2001-03-01 17:41:26 +00:00
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
#if 0
Debugging improvements. Started using Dave Hinton's dmemdump function (woohoo!), improved that function so it provides an ASCII dump as well as hex (whee!), removed all remaining spurious \r in debug statements (ooh!), and made enabling of packet debugging in SSH a matter of one ifdef rather than lots (phew!). [originally from svn r1091]
2001-04-28 17:35:18 +00:00
debug(("Exchange hash is:\n"));
Add infrastructure for supporting multiple hashes in key exchange. Nothing very surprising here. [originally from svn r6251]
2005-08-31 20:43:06 +00:00
dmemdump(s->exchange_hash, ssh->kex->hash->hlen);
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
#endif
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/* In GSS keyex there's no hostkey signature to verify */
if (ssh->kex->main_type != KEXTYPE_GSS) {
if (!s->hkey) {
bombout(("Server's host key is invalid"));
crStopV;
}
Emit a distinct error message when the SSH server's host key is invalid. This also means that FUZZING can just ignore host-key verification failure while preserving invalid-host-key errors.
2015-10-18 19:16:39 +00:00
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
if (!ssh_key_verify(
Clean up ssh_keyalg APIs and implementations. Quite a few of the function pointers in the ssh_keyalg vtable now take ptrlen arguments in place of separate pointer and length pairs. Meanwhile, the various key types' implementations of those functions now work by initialising a BinarySource with the input ptrlen and using the new decode functions to walk along it. One exception is the openssh_createkey method which reads a private key in the wire format used by OpenSSH's SSH-2 agent protocol, which has to consume a prefix of a larger data stream, and tell the caller how much of that data was the private key. That function now takes an actual BinarySource, and passes that directly to the decode functions, so that on return the caller finds that the BinarySource's read pointer has been advanced exactly past the private key. This let me throw away _several_ reimplementations of mpint-reading functions, one in each of sshrsa, sshdss.c and sshecc.c. Worse still, they didn't all have exactly the SSH-2 semantics, because the thing in sshrsa.c whose name suggested it was an mpint-reading function actually tolerated the wrong number of leading zero bytes, which it had to be able to do to cope with the "ssh-rsa" signature format which contains a thing that isn't quite an SSH-2 mpint. Now that deviation is clearly commented!
2018-05-31 17:40:51 +00:00
s->hkey, s->sigdata,
make_ptrlen(s->exchange_hash, ssh->kex->hash->hlen))) {
Add FUZZING support to ssh.c. This adds the "none" cipher and MAC, and also disables kex signure verification and host-key checking. Since a client like this is completely insecure, it also rewrites the client version string to start "ISH", which should make it fail to interoperate with a real SSH server. The server version string is still expected to begin "SSH" so the real packet captures can be used against it.
2015-10-18 12:04:58 +00:00
#ifndef FUZZING
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
bombout(("Server's host key did not match the signature "
"supplied"));
crStopV;
Add FUZZING support to ssh.c. This adds the "none" cipher and MAC, and also disables kex signure verification and host-key checking. Since a client like this is completely insecure, it also rewrites the client version string to start "ISH", which should make it fail to interoperate with a real SSH server. The server version string is still expected to begin "SSH" so the real packet captures can be used against it.
2015-10-18 12:04:58 +00:00
#endif
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
}
Prevent network errors from summarily closing the window when CoE is off [originally from svn r613]
2000-09-22 11:04:57 +00:00
}
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->keystr = (s->hkey ? ssh_key_cache_str(s->hkey) : NULL);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
if (ssh->gss_kex_used) {
/*
* In a GSS-based session, check the host key (if any) against
* the transient host key cache. See comment above, at the
* definition of ssh_transient_hostkey_cache_entry.
*/
if (ssh->kex->main_type == KEXTYPE_GSS) {
/*
* We've just done a GSS key exchange. If it gave us a
* host key, store it.
*/
if (s->hkey) {
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->fingerprint = ssh2_fingerprint(s->hkey);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
logevent("GSS kex provided fallback host key:");
logevent(s->fingerprint);
sfree(s->fingerprint);
s->fingerprint = NULL;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_store_transient_hostkey(ssh, s->hkey);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
} else if (!ssh_have_any_transient_hostkey(ssh)) {
/*
* But if it didn't, then we currently have no
* fallback host key to use in subsequent non-GSS
* rekeys. So we should immediately trigger a non-GSS
* rekey of our own, to set one up, before the session
* keys have been used for anything else.
*
* This is similar to the cross-certification done at
* user request in the permanent host key cache, but
* here we do it automatically, once, at session
* startup, and only add the key to the transient
* cache.
*/
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
if (ssh->hostkey_alg) {
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->need_gss_transient_hostkey = TRUE;
} else {
/*
* If we negotiated the "null" host key algorithm
* in the key exchange, that's an indication that
* no host key at all is available from the server
* (both because we listed "null" last, and
* because RFC 4462 section 5 says that a server
* MUST NOT offer "null" as a host key algorithm
* unless that is the only algorithm it provides
* at all).
*
* In that case we actually _can't_ perform a
* non-GSSAPI key exchange, so it's pointless to
* attempt one proactively. This is also likely to
* cause trouble later if a rekey is required at a
* moment whne GSS credentials are not available,
* but someone setting up a server in this
* configuration presumably accepts that as a
* consequence.
*/
if (!s->warned_about_no_gss_transient_hostkey) {
logevent("No fallback host key available");
s->warned_about_no_gss_transient_hostkey = TRUE;
}
}
}
} else {
/*
* We've just done a fallback key exchange, so make
* sure the host key it used is in the cache of keys
* we previously received in GSS kexes.
*
* An exception is if this was the non-GSS key exchange we
* triggered on purpose to populate the transient cache.
*/
assert(s->hkey); /* only KEXTYPE_GSS lets this be null */
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->fingerprint = ssh2_fingerprint(s->hkey);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (s->need_gss_transient_hostkey) {
logevent("Post-GSS rekey provided fallback host key:");
logevent(s->fingerprint);
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_store_transient_hostkey(ssh, s->hkey);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->need_gss_transient_hostkey = FALSE;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
} else if (!ssh_verify_transient_hostkey(ssh, s->hkey)) {
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
logevent("Non-GSS rekey after initial GSS kex "
"used host key:");
logevent(s->fingerprint);
bombout(("Host key was not previously sent via GSS kex"));
}
sfree(s->fingerprint);
s->fingerprint = NULL;
}
} else
#endif /* NO_GSSAPI */
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
if (!s->got_session_id) {
Log when we avoid using an unknown host key. Intended as a hint that users may want to use the "Cache new host key type" special command.
2016-03-25 15:37:16 +00:00
/*
Fix log message about alternate host keys. Since we got a dynamic preference order, it's been bailing out at a random point, and listing keys we wouldn't use. (It would still be nice to only mention keys that we'd actually use, but that's now quite fiddly.)
2016-03-26 18:40:16 +00:00
* Make a note of any other host key formats that are available.
Log when we avoid using an unknown host key. Intended as a hint that users may want to use the "Cache new host key type" special command.
2016-03-25 15:37:16 +00:00
*/
{
Fix plurality in unknown host keys log message.
2016-04-10 14:57:00 +00:00
int i, j, nkeys = 0;
Log when we avoid using an unknown host key. Intended as a hint that users may want to use the "Cache new host key type" special command.
2016-03-25 15:37:16 +00:00
char *list = NULL;
for (i = 0; i < lenof(hostkey_algs); i++) {
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
if (hostkey_algs[i].alg == ssh->hostkey_alg)
Fix log message about alternate host keys. Since we got a dynamic preference order, it's been bailing out at a random point, and listing keys we wouldn't use. (It would still be nice to only mention keys that we'd actually use, but that's now quite fiddly.)
2016-03-26 18:40:16 +00:00
continue;
Fix assertion failure in host keys log message. When Jacob introduced this message in d0d3c47a0, he was right to assume that hostkey_algs[] and ssh->uncert_hostkeys[] were sorted in the same order. Unfortunately, he became wrong less than an hour later when I committed d06098622. Now we avoid making any such assumption.
2016-03-27 13:59:18 +00:00
for (j = 0; j < ssh->n_uncert_hostkeys; j++)
if (ssh->uncert_hostkeys[j] == i)
break;
if (j < ssh->n_uncert_hostkeys) {
Log when we avoid using an unknown host key. Intended as a hint that users may want to use the "Cache new host key type" special command.
2016-03-25 15:37:16 +00:00
char *newlist;
if (list)
newlist = dupprintf("%s/%s", list,
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
hostkey_algs[i].alg->ssh_id);
Log when we avoid using an unknown host key. Intended as a hint that users may want to use the "Cache new host key type" special command.
2016-03-25 15:37:16 +00:00
else
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
newlist = dupprintf("%s", hostkey_algs[i].alg->ssh_id);
Log when we avoid using an unknown host key. Intended as a hint that users may want to use the "Cache new host key type" special command.
2016-03-25 15:37:16 +00:00
sfree(list);
list = newlist;
Fix plurality in unknown host keys log message.
2016-04-10 14:57:00 +00:00
nkeys++;
Log when we avoid using an unknown host key. Intended as a hint that users may want to use the "Cache new host key type" special command.
2016-03-25 15:37:16 +00:00
}
}
if (list) {
logeventf(ssh,
Fix log message about alternate host keys. Since we got a dynamic preference order, it's been bailing out at a random point, and listing keys we wouldn't use. (It would still be nice to only mention keys that we'd actually use, but that's now quite fiddly.)
2016-03-26 18:40:16 +00:00
"Server also has %s host key%s, but we "
"don't know %s", list,
Fix plurality in unknown host keys log message.
2016-04-10 14:57:00 +00:00
nkeys > 1 ? "s" : "",
nkeys > 1 ? "any of them" : "it");
Log when we avoid using an unknown host key. Intended as a hint that users may want to use the "Cache new host key type" special command.
2016-03-25 15:37:16 +00:00
sfree(list);
}
}
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
/*
* Authenticate remote host: verify host key. (We've already
* checked the signature of the exchange hash.)
*/
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->fingerprint = ssh2_fingerprint(s->hkey);
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
logevent("Host key fingerprint is:");
logevent(s->fingerprint);
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
/* First check against manually configured host keys. */
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->dlgret = verify_ssh_manual_host_key(ssh, s->fingerprint, s->hkey);
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
if (s->dlgret == 0) { /* did not match */
bombout(("Host key did not appear in manually configured list"));
crStopV;
} else if (s->dlgret < 0) { /* none configured; use standard handling */
s->dlgret = verify_ssh_host_key(ssh->frontend,
ssh->savedhost, ssh->savedport,
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_key_cache_id(s->hkey),
s->keystr, s->fingerprint,
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
ssh_dialog_callback, ssh);
Add FUZZING support to ssh.c. This adds the "none" cipher and MAC, and also disables kex signure verification and host-key checking. Since a client like this is completely insecure, it also rewrites the client version string to start "ISH", which should make it fail to interoperate with a real SSH server. The server version string is still expected to begin "SSH" so the real packet captures can be used against it.
2015-10-18 12:04:58 +00:00
#ifdef FUZZING
s->dlgret = 1;
#endif
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
if (s->dlgret < 0) {
ssh->user_response = -1;
crWaitUntilV(ssh->user_response >= 0);
s->dlgret = ssh->user_response;
}
New option to manually configure the expected host key(s). This option is available from the command line as '-hostkey', and is also configurable through the GUI. When enabled, it completely replaces all of the automated host key management: the server's host key will be checked against the manually configured list, and the connection will be allowed or disconnected on that basis, and the host key store in the registry will not be either consulted or updated. The main aim is to provide a means of automatically running Plink, PSCP or PSFTP deep inside Windows services where HKEY_CURRENT_USER isn't available to have stored the right host key in. But it also permits you to specify a list of multiple host keys, which means a second use case for the same mechanism will probably be round-robin DNS names that select one of several servers with different host keys. Host keys can be specified as the standard MD5 fingerprint or as an SSH-2 base64 blob, and are canonicalised on input. (The base64 blob is more unwieldy, especially with Windows command-line length limits, but provides a means of specifying the _whole_ public key in case you don't trust MD5. I haven't bothered to provide an analogous mechanism for SSH-1, on the basis that anyone worrying about MD5 should have stopped using SSH-1 already!) [originally from svn r10220]
2014-09-09 11:46:24 +00:00
if (s->dlgret == 0) {
ssh_disconnect(ssh, "Aborted at host key verification", NULL,
0, TRUE);
crStopV;
}
}
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
sfree(s->fingerprint);
/*
* Save this host key, to check against the one presented in
* subsequent rekeys.
*/
ssh->hostkey_str = s->keystr;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->keystr = NULL;
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
} else if (ssh->cross_certifying) {
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
s->fingerprint = ssh2_fingerprint(s->hkey);
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
logevent("Storing additional host key for this host:");
logevent(s->fingerprint);
Fix memory leak: Free hostkey fingerprint when cross-certifying.
2017-01-06 10:44:47 +00:00
sfree(s->fingerprint);
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
store_host_key(ssh->savedhost, ssh->savedport,
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_key_cache_id(s->hkey), s->keystr);
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
ssh->cross_certifying = FALSE;
/*
* Don't forget to store the new key as the one we'll be
* re-checking in future normal rekeys.
*/
ssh->hostkey_str = s->keystr;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->keystr = NULL;
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
} else {
/*
* In a rekey, we never present an interactive host key
* verification request to the user. Instead, we simply
* enforce that the key we're seeing this time is identical to
* the one we saw before.
*/
if (strcmp(ssh->hostkey_str, s->keystr)) {
Add FUZZING support to ssh.c. This adds the "none" cipher and MAC, and also disables kex signure verification and host-key checking. Since a client like this is completely insecure, it also rewrites the client version string to start "ISH", which should make it fail to interoperate with a real SSH server. The server version string is still expected to begin "SSH" so the real packet captures can be used against it.
2015-10-18 12:04:58 +00:00
#ifndef FUZZING
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
bombout(("Host key was different in repeat key exchange"));
crStopV;
Add FUZZING support to ssh.c. This adds the "none" cipher and MAC, and also disables kex signure verification and host-key checking. Since a client like this is completely insecure, it also rewrites the client version string to start "ISH", which should make it fail to interoperate with a real SSH server. The server version string is still expected to begin "SSH" so the real packet captures can be used against it.
2015-10-18 12:04:58 +00:00
#endif
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
}
Fix the SSH2 key re-exchange bug. Session id != exchange hash, because the session id is the exchange hash from the _first_ key exchange, so in subsequent key exchanges they're different. [originally from svn r901]
2001-01-26 18:50:13 +00:00
}
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
sfree(s->keystr);
if (s->hkey) {
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_key_free(s->hkey);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->hkey = NULL;
}
Second attempt. Can successfully decrypt the _first block_ of a packet. [originally from svn r570]
2000-09-05 16:23:36 +00:00
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
/*
* The exchange hash from the very first key exchange is also
* the session id, used in session key construction and
* authentication.
*/
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
if (!s->got_session_id) {
Add infrastructure for supporting multiple hashes in key exchange. Nothing very surprising here. [originally from svn r6251]
2005-08-31 20:43:06 +00:00
assert(sizeof(s->exchange_hash) <= sizeof(ssh->v2_session_id));
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
memcpy(ssh->v2_session_id, s->exchange_hash,
sizeof(s->exchange_hash));
Add infrastructure for supporting multiple hashes in key exchange. Nothing very surprising here. [originally from svn r6251]
2005-08-31 20:43:06 +00:00
ssh->v2_session_id_len = ssh->kex->hash->hlen;
Check ssh->v2_session_id_len _after_ assigning to it. [originally from svn r6260]
2005-09-02 10:51:09 +00:00
assert(ssh->v2_session_id_len <= sizeof(ssh->v2_session_id));
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
s->got_session_id = TRUE;
}
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
Second attempt. Can successfully decrypt the _first block_ of a packet. [originally from svn r570]
2000-09-05 16:23:36 +00:00
/*
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
* Send SSH2_MSG_NEWKEYS.
Second attempt. Can successfully decrypt the _first block_ of a packet. [originally from svn r570]
2000-09-05 16:23:36 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_NEWKEYS);
ssh_pkt_write(ssh, s->pktout);
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
ssh->outgoing_data_size = 0; /* start counting from here */
/*
* We've sent client NEWKEYS, so create and initialise
typo in comment [originally from svn r4923]
2004-11-29 09:27:13 +00:00
* client-to-server session keys.
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
{
strbuf *cipher_key = strbuf_new();
strbuf *cipher_iv = strbuf_new();
strbuf *mac_key = strbuf_new();
if (s->out.cipher) {
ssh2_mkkey(ssh, cipher_iv, s->K, s->exchange_hash, 'A',
s->out.cipher->blksize);
ssh2_mkkey(ssh, cipher_key, s->K, s->exchange_hash, 'C',
s->out.cipher->padded_keybytes);
}
if (s->out.mac) {
ssh2_mkkey(ssh, mac_key, s->K, s->exchange_hash, 'E',
s->out.mac->keylen);
}
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh2_bpp_new_outgoing_crypto(
ssh->bpp,
s->out.cipher, cipher_key->u, cipher_iv->u,
s->out.mac, s->out.etm_mode, mac_key->u,
s->out.comp);
/*
* Remember some details we'll need later for making other
* policy decisions based on the crypto we've just
* initialised.
*/
ssh->v2_cbc_ignore_workaround = (
s->out.cipher &&
(s->out.cipher->flags & SSH_CIPHER_IS_CBC) &&
!(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE));
ssh->v2_out_cipherblksize = s->out.cipher->blksize;
strbuf_free(cipher_key);
strbuf_free(cipher_iv);
strbuf_free(mac_key);
}
if (s->out.cipher)
logeventf(ssh, "Initialised %.200s client->server encryption",
s->out.cipher->text_name);
if (s->out.mac)
logeventf(ssh, "Initialised %.200s client->server"
" MAC algorithm%s%s",
s->out.mac->text_name,
s->out.etm_mode ? " (in ETM mode)" : "",
(s->out.cipher->required_mac ?
" (required by cipher)" : ""));
if (s->out.comp->text_name)
logeventf(ssh, "Initialised %s compression",
s->out.comp->text_name);
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
/*
* Now our end of the key exchange is complete, we can send all
* our queued higher-layer packets.
*/
ssh->queueing = FALSE;
ssh2_pkt_queuesend(ssh);
Second attempt. Can successfully decrypt the _first block_ of a packet. [originally from svn r570]
2000-09-05 16:23:36 +00:00
Send SSH2_MSG_NEWKEYS _before_ expecting to receive it, rather than after. Shouldn't make a difference for any server that previously worked, but we should now interoperate sensibly with servers that wait to receive our NEWKEYS before sending their own. Apparently Unisphere produce one such. [originally from svn r1390]
2001-11-21 22:06:53 +00:00
/*
* Expect SSH2_MSG_NEWKEYS from server.
*/
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type != SSH2_MSG_NEWKEYS) {
Ahem; fix `bombout' so it passes the correct frontend handle to connection_fatal(). [originally from svn r3030]
2003-03-31 11:22:30 +00:00
bombout(("expected new-keys packet from server"));
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crStopV;
Send SSH2_MSG_NEWKEYS _before_ expecting to receive it, rather than after. Shouldn't make a difference for any server that previously worked, but we should now interoperate sensibly with servers that wait to receive our NEWKEYS before sending their own. Apparently Unisphere produce one such. [originally from svn r1390]
2001-11-21 22:06:53 +00:00
}
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
ssh->incoming_data_size = 0; /* start counting from here */
Send SSH2_MSG_NEWKEYS _before_ expecting to receive it, rather than after. Shouldn't make a difference for any server that previously worked, but we should now interoperate sensibly with servers that wait to receive our NEWKEYS before sending their own. Apparently Unisphere produce one such. [originally from svn r1390]
2001-11-21 22:06:53 +00:00
Second attempt. Can successfully decrypt the _first block_ of a packet. [originally from svn r570]
2000-09-05 16:23:36 +00:00
/*
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
* We've seen server NEWKEYS, so create and initialise
* server-to-client session keys.
Second attempt. Can successfully decrypt the _first block_ of a packet. [originally from svn r570]
2000-09-05 16:23:36 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
{
strbuf *cipher_key = strbuf_new();
strbuf *cipher_iv = strbuf_new();
strbuf *mac_key = strbuf_new();
if (s->in.cipher) {
ssh2_mkkey(ssh, cipher_iv, s->K, s->exchange_hash, 'B',
s->in.cipher->blksize);
ssh2_mkkey(ssh, cipher_key, s->K, s->exchange_hash, 'D',
s->in.cipher->padded_keybytes);
}
if (s->in.mac) {
ssh2_mkkey(ssh, mac_key, s->K, s->exchange_hash, 'F',
s->in.mac->keylen);
}
SSH2 MACs now use dynamically allocated contexts. [originally from svn r2131]
2002-10-25 12:51:28 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh2_bpp_new_incoming_crypto(
ssh->bpp,
s->in.cipher, cipher_key->u, cipher_iv->u,
s->in.mac, s->in.etm_mode, mac_key->u,
s->in.comp);
SSH2 MACs now use dynamically allocated contexts. [originally from svn r2131]
2002-10-25 12:51:28 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
strbuf_free(cipher_key);
strbuf_free(cipher_iv);
strbuf_free(mac_key);
}
The Zlib module now uses dynamically allocated contexts. I think that completes the static-removal in the crypto library. Ooh. [originally from svn r2136]
2002-10-25 13:26:33 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
if (s->in.cipher)
logeventf(ssh, "Initialised %.200s server->client encryption",
s->in.cipher->text_name);
if (s->in.mac)
logeventf(ssh, "Initialised %.200s server->client"
" MAC algorithm%s%s",
s->in.mac->text_name,
s->in.etm_mode ? " (in ETM mode)" : "",
(s->in.cipher->required_mac ?
" (required by cipher)" : ""));
if (s->in.comp->text_name)
logeventf(ssh, "Initialised %s decompression",
s->in.comp->text_name);
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
/*
Add support for RFC 4432 RSA key exchange, the patch for which has been lying around in my home directory for _years_. [originally from svn r7496]
2007-04-30 22:09:26 +00:00
* Free shared secret.
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
*/
Joe Yates's memory leak patches. [originally from svn r3650]
2003-12-19 12:44:46 +00:00
freebn(s->K);
Second attempt. Can successfully decrypt the _first block_ of a packet. [originally from svn r570]
2000-09-05 16:23:36 +00:00
Update the specials menu as keys are cross-certified. If you've just certified a key, you want it to vanish from the menu immediately, of course.
2016-03-21 19:05:32 +00:00
/*
* Update the specials menu to list the remaining uncertified host
* keys.
*/
update_specials_menu(ssh->frontend);
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
/*
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
* Key exchange is over. Loop straight back round if we have a
* deferred rekey reason.
*/
if (ssh->deferred_rekey_reason) {
logevent(ssh->deferred_rekey_reason);
pktin = NULL;
ssh->deferred_rekey_reason = NULL;
goto begin_key_exchange;
}
/*
* Otherwise, schedule a timer for our next rekey.
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
*/
ssh->kex_in_progress = FALSE;
Support reconfiguration of key exchange in mid-session. The fiddly bit is working out when to reschedule the next rekey for when the timeout or data limit changes; sometimes it will be _right now_ because we're already over the new limit. Still to do: the Kex panel should not appear in mid-session if we are using SSHv1. [originally from svn r5031]
2004-12-28 14:10:32 +00:00
ssh->last_rekey = GETTICKCOUNT();
Factor out ssh2_timer_update. This is a preliminary refactoring for an upcoming change which will need to affect every use of schedule_timer to wait for the next rekey: those calls to schedule_timer are now centralised into a function that does an organised piece of thinking about when the next timer should be. A side effect of this change is that the translation from CONF_ssh_rekey_time to an actual tick count is now better proofed against integer overflow (just in case the user entered a completely silly value).
2018-04-14 13:48:02 +00:00
(void) ssh2_timer_update(ssh, 0);
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
SSH2 transport layer now enables encryption and MAC successfully for 3DES [originally from svn r571]
2000-09-06 09:55:32 +00:00
/*
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
* Now we're encrypting. Get the next-layer protocol started if it
* hasn't already, and then sit here waiting for reasons to go
* back to the start and do a repeat key exchange. One of those
* reasons is that we receive KEXINIT from the other end; the
* other is if we find ssh->rekey_reason is non-NULL, i.e. we've
* decided to initiate a rekey ourselves for some reason.
SSH2 transport layer now enables encryption and MAC successfully for 3DES [originally from svn r571]
2000-09-06 09:55:32 +00:00
*/
Fix constant rekeying. Another piece of fallout from this morning's patch series, which I didn't notice until I left a session running for more than an hour: once do_ssh2_transport is told to begin a rekey, it has no way of knowing _not_ to immediately do another one, and another, and so on. Added a value RK_NONE to the rekey class enumeration, and set rekey_class to that immediately after a key exchange completes. Then a new one won't start until some code actually sets rekey_class to a nonzero value again.
2018-05-18 12:46:36 +00:00
ssh->rekey_class = RK_NONE;
while (!pq_peek(&ssh->pq_ssh2_transport) && !ssh->rekey_class) {
Servers announcing themselves as `Sun_SSH_1.0' apparently cannot deal with rekeys at all: they totally ignore mid-session KEXINIT sent by the client. Hence, a new bug entry so we don't try it. [originally from svn r5092]
2005-01-11 10:37:55 +00:00
wait_for_rekey:
Remove the ssh*_protocol() functions completely. After the last few commits, neither incoming SSH packets nor incoming user input goes through those functions any more - each of those directions of data goes into a queue and from there to a callback specifically processing that queue. So the centralised top-level protocol switching functions have nothing left to switch, and can go.
2018-05-18 06:22:58 +00:00
if (!ssh->current_user_input_fn) {
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
/*
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
* Allow userauth to initialise itself.
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
*/
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
do_ssh2_userauth(ssh);
ssh->current_user_input_fn = ssh2_userauth_input;
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
}
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crReturnV;
Attempt to fix the remaining key re-exchange bug [originally from svn r934]
2001-02-20 13:55:59 +00:00
}
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
if ((pktin = pq_pop(&ssh->pq_ssh2_transport)) != NULL) {
if (pktin->type != SSH2_MSG_KEXINIT) {
bombout(("unexpected key exchange packet, type %d", pktin->type));
crStopV;
}
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
logevent("Server initiated key re-exchange");
} else {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
if (ssh->rekey_class == RK_POST_USERAUTH) {
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
/*
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
* userauth has seen a USERAUTH_SUCCEEDED. For a couple of
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
* reasons, this may be the moment to do an immediate
* rekey with different parameters.
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
*
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
* One is to turn on delayed compression. We do this by a
* rekey to work around a protocol design bug:
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
* draft-miller-secsh-compression-delayed-00 says that you
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
* negotiate delayed compression in the first key
* exchange, and both sides start compressing when the
* server has sent USERAUTH_SUCCESS. This has a race
* condition -- the server can't know when the client has
* seen it, and thus which incoming packets it should
* treat as compressed.
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
*
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
* Instead, we do the initial key exchange without
* offering the delayed methods, but note if the server
* offers them; when we get here, if a delayed method was
* available that was higher on our list than what we got,
* we initiate a rekey in which we _do_ list the delayed
* methods (and hopefully get it as a result). Subsequent
* rekeys will do the same.
*
* Another reason for a rekey at this point is if we've
* done a GSS key exchange and don't have anything in our
* transient hostkey cache, in which case we should make
* an attempt to populate the cache now.
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
*/
assert(!s->userauth_succeeded); /* should only happen once */
s->userauth_succeeded = TRUE;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (s->pending_compression) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->rekey_reason = "enabling delayed compression";
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
} else if (s->need_gss_transient_hostkey) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->rekey_reason = "populating transient host key cache";
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
} else {
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
/* Can't see any point rekeying. */
goto wait_for_rekey; /* this is utterly horrid */
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
}
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
/* else fall through to rekey... */
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
s->pending_compression = FALSE;
}
Servers announcing themselves as `Sun_SSH_1.0' apparently cannot deal with rekeys at all: they totally ignore mid-session KEXINIT sent by the client. Hence, a new bug entry so we don't try it. [originally from svn r5092]
2005-01-11 10:37:55 +00:00
/*
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
* Now we've decided to rekey.
*
Servers announcing themselves as `Sun_SSH_1.0' apparently cannot deal with rekeys at all: they totally ignore mid-session KEXINIT sent by the client. Hence, a new bug entry so we don't try it. [originally from svn r5092]
2005-01-11 10:37:55 +00:00
* Special case: if the server bug is set that doesn't
* allow rekeying, we give a different log message and
* continue waiting. (If such a server _initiates_ a rekey,
* we process it anyway!)
*/
if ((ssh->remote_bugs & BUG_SSH2_REKEY)) {
logeventf(ssh, "Server bug prevents key re-exchange (%s)",
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->rekey_reason);
Servers announcing themselves as `Sun_SSH_1.0' apparently cannot deal with rekeys at all: they totally ignore mid-session KEXINIT sent by the client. Hence, a new bug entry so we don't try it. [originally from svn r5092]
2005-01-11 10:37:55 +00:00
/* Reset the counters, so that at least this message doesn't
* hit the event log _too_ often. */
ssh->outgoing_data_size = 0;
ssh->incoming_data_size = 0;
Factor out ssh2_timer_update. This is a preliminary refactoring for an upcoming change which will need to affect every use of schedule_timer to wait for the next rekey: those calls to schedule_timer are now centralised into a function that does an organised piece of thinking about when the next timer should be. A side effect of this change is that the translation from CONF_ssh_rekey_time to an actual tick count is now better proofed against integer overflow (just in case the user entered a completely silly value).
2018-04-14 13:48:02 +00:00
(void) ssh2_timer_update(ssh, 0);
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
goto wait_for_rekey; /* this is still utterly horrid */
Servers announcing themselves as `Sun_SSH_1.0' apparently cannot deal with rekeys at all: they totally ignore mid-session KEXINIT sent by the client. Hence, a new bug entry so we don't try it. [originally from svn r5092]
2005-01-11 10:37:55 +00:00
} else {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
logeventf(ssh, "Initiating key re-exchange (%s)",
ssh->rekey_reason);
Servers announcing themselves as `Sun_SSH_1.0' apparently cannot deal with rekeys at all: they totally ignore mid-session KEXINIT sent by the client. Hence, a new bug entry so we don't try it. [originally from svn r5092]
2005-01-11 10:37:55 +00:00
}
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
}
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
goto begin_key_exchange;
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
Change return type of do_ssh2_transport() to void. Nothing pays attention to it any more, anyway. [originally from svn r9635]
2012-08-27 22:02:17 +00:00
crFinishV;
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
}
Bring the SSH2 channel architecture up to scratch, enabling X forwarding to work under SSH2. Also - surprise! - implement X forwarding under SSH2. [originally from svn r882]
2001-01-22 15:36:07 +00:00
/*
Shared ssh_send_channel_data for both SSH-1 and SSH-2. Saves duplication between agent and port forwarding code. Conflicts: ssh.c
2016-04-23 14:51:45 +00:00
* Send data on an SSH channel. In SSH-2, this involves buffering it
* first.
Bring the SSH2 channel architecture up to scratch, enabling X forwarding to work under SSH2. Also - surprise! - implement X forwarding under SSH2. [originally from svn r882]
2001-01-22 15:36:07 +00:00
*/
Shared ssh_send_channel_data for both SSH-1 and SSH-2. Saves duplication between agent and port forwarding code. Conflicts: ssh.c
2016-04-23 14:51:45 +00:00
static int ssh_send_channel_data(struct ssh_channel *c, const char *buf,
Call ssh2_try_send() from ssh2_add_channel_data() and rename latter All calls to ssh2_add_channel_data() were followed by a call to ssh2_try_send(), so it seems sensible to replace ssh2_add_channel_data() with ssh2_send_channel_data(), which does both.
2016-04-23 12:17:33 +00:00
int len)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
assert(!(c->closes & CLOSES_SENT_EOF));
Shared ssh_send_channel_data for both SSH-1 and SSH-2. Saves duplication between agent and port forwarding code. Conflicts: ssh.c
2016-04-23 14:51:45 +00:00
if (c->ssh->version == 2) {
bufchain_add(&c->v.v2.outbuffer, buf, len);
return ssh2_try_send(c);
} else {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
PktOut *pkt = ssh_bpp_new_pktout(c->ssh->bpp, SSH1_MSG_CHANNEL_DATA);
put_uint32(pkt, c->remoteid);
put_string(pkt, buf, len);
ssh_pkt_write(c->ssh, pkt);
Shared ssh_send_channel_data for both SSH-1 and SSH-2. Saves duplication between agent and port forwarding code. Conflicts: ssh.c
2016-04-23 14:51:45 +00:00
/*
* In SSH-1 we can return 0 here - implying that channels are
* never individually throttled - because the only
* circumstance that can cause throttling will be the whole
* SSH connection backing up, in which case _everything_ will
* be throttled as a whole.
*/
return 0;
}
Bring the SSH2 channel architecture up to scratch, enabling X forwarding to work under SSH2. Also - surprise! - implement X forwarding under SSH2. [originally from svn r882]
2001-01-22 15:36:07 +00:00
}
/*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* Attempt to send data on an SSH-2 channel.
Bring the SSH2 channel architecture up to scratch, enabling X forwarding to work under SSH2. Also - surprise! - implement X forwarding under SSH2. [originally from svn r882]
2001-01-22 15:36:07 +00:00
*/
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
static int ssh2_try_send(struct ssh_channel *c)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Ssh ssh = c->ssh;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
int ret;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
while (c->v.v2.remwindow > 0 && bufchain_size(&c->v.v2.outbuffer) > 0) {
int len;
void *data;
bufchain_prefix(&c->v.v2.outbuffer, &data, &len);
if ((unsigned)len > c->v.v2.remwindow)
len = c->v.v2.remwindow;
if ((unsigned)len > c->v.v2.remmaxpkt)
len = c->v.v2.remmaxpkt;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_CHANNEL_DATA);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, c->remoteid);
put_string(pktout, data, len);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
ssh2_pkt_send(ssh, pktout);
Fix stale-pointer bugs in connection-fatal network errors. I think these began to appear as a consequencce of replacing fatalbox() calls with more sensible error reports: the more specific a direction I send a report in, the greater the annoying possibility of re-entrance when the resulting error handler starts closing stuff.
2017-11-26 19:59:27 +00:00
if (!ssh->s) /* a network error might have closed the socket */
break;
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
bufchain_consume(&c->v.v2.outbuffer, len);
c->v.v2.remwindow -= len;
}
/*
* After having sent as much data as we can, return the amount
* still buffered.
*/
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
ret = bufchain_size(&c->v.v2.outbuffer);
/*
* And if there's no data pending but we need to send an EOF, send
* it.
*/
if (!ret && c->pending_eof)
ssh_channel_try_eof(c);
return ret;
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
Patch from Alan Ning (somewhat polished by me): introduce a flag called 'pending_close'. This deals with the situation in which we're forwarding a port, have received and locally buffered some data from the local endpoint but not yet been able to pass it down the SSH connection due to window limitations, and then the local endpoint closes its socket. In this situation what we've been doing until now is to immediately send SSH2_MSG_CHANNEL_CLOSE, causing the data still in our local buffer to be lost; now we instead set the new flag, which will remind us to send SSH2_MSG_CHANNEL_CLOSE _after_ we empty our bufchain. Should fix at least one manifestation of 'portfwd-close', though I don't know if it's the cause of all the reports we've ever seen. [originally from svn r8971]
2010-07-04 22:53:53 +00:00
static void ssh2_try_send_and_unthrottle(Ssh ssh, struct ssh_channel *c)
The structural reorganisation of ssh.c (r4909) caused ssh2_try_send() to no longer be run after receiving WINDOW_ADJUSTs. I believe this is likely to have been the cause of recent PSCP hanging issues. [originally from svn r5517] [r4909 == 02b0474f578ec550552989bd6461fd7151609006]
2005-03-17 19:49:51 +00:00
{
int bufsize;
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
if (c->closes & CLOSES_SENT_EOF)
return; /* don't send on channels we've EOFed */
The structural reorganisation of ssh.c (r4909) caused ssh2_try_send() to no longer be run after receiving WINDOW_ADJUSTs. I believe this is likely to have been the cause of recent PSCP hanging issues. [originally from svn r5517] [r4909 == 02b0474f578ec550552989bd6461fd7151609006]
2005-03-17 19:49:51 +00:00
bufsize = ssh2_try_send(c);
if (bufsize == 0) {
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
c->throttled_by_backlog = FALSE;
ssh_channel_check_throttle(c);
The structural reorganisation of ssh.c (r4909) caused ssh2_try_send() to no longer be run after receiving WINDOW_ADJUSTs. I believe this is likely to have been the cause of recent PSCP hanging issues. [originally from svn r5517] [r4909 == 02b0474f578ec550552989bd6461fd7151609006]
2005-03-17 19:49:51 +00:00
}
}
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
static int ssh_is_simple(Ssh ssh)
{
/*
* We use the 'simple' variant of the SSH protocol if we're asked
* to, except not if we're also doing connection-sharing (either
* tunnelling our packets over an upstream or expecting to be
* tunnelled over ourselves), since then the assumption that we
* have only one channel to worry about is not true after all.
*/
return (conf_get_int(ssh->conf, CONF_ssh_simple) &&
!ssh->bare_connection && !ssh->connshare);
}
Factor out the increasingly complicated SSH-2 channel structure initialisation into its own function. Maintaining four copies was getting boring. [originally from svn r7757]
2007-10-03 21:04:26 +00:00
/*
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
* Set up most of a new ssh_channel. Nulls out sharectx, but leaves
* chan untouched (since it will sometimes have been filled in before
* calling this).
Factor out the increasingly complicated SSH-2 channel structure initialisation into its own function. Maintaining four copies was getting boring. [originally from svn r7757]
2007-10-03 21:04:26 +00:00
*/
Convert ssh2_channel_init() into ssh_channel_init(). By adding support for initialising SSH-1 channels as well. Now all newly-created channels go through this function.
2016-05-21 21:29:57 +00:00
static void ssh_channel_init(struct ssh_channel *c)
Factor out the increasingly complicated SSH-2 channel structure initialisation into its own function. Maintaining four copies was getting boring. [originally from svn r7757]
2007-10-03 21:04:26 +00:00
{
Ssh ssh = c->ssh;
c->localid = alloc_channel_id(ssh);
c->closes = 0;
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
c->pending_eof = FALSE;
Factor out the increasingly complicated SSH-2 channel structure initialisation into its own function. Maintaining four copies was getting boring. [originally from svn r7757]
2007-10-03 21:04:26 +00:00
c->throttling_conn = FALSE;
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
c->sharectx = NULL;
Convert ssh2_channel_init() into ssh_channel_init(). By adding support for initialising SSH-1 channels as well. Now all newly-created channels go through this function.
2016-05-21 21:29:57 +00:00
if (ssh->version == 2) {
c->v.v2.locwindow = c->v.v2.locmaxwin = c->v.v2.remlocwin =
ssh_is_simple(ssh) ? OUR_V2_BIGWIN : OUR_V2_WINSIZE;
c->v.v2.chanreq_head = NULL;
c->v.v2.throttle_state = UNTHROTTLED;
bufchain_init(&c->v.v2.outbuffer);
}
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
c->sc.vt = &sshchannel_vtable;
In ssh_channel_init(), insert the new channel into the channel tree234. All but one caller was doing this unconditionally. The one conditional call was when initialising the main channel, and in consequence PuTTY leaked a channel structure when the server refused to open the main channel. Now it doesn't.
2016-05-21 21:58:57 +00:00
add234(ssh->channels, c);
Factor out the increasingly complicated SSH-2 channel structure initialisation into its own function. Maintaining four copies was getting boring. [originally from svn r7757]
2007-10-03 21:04:26 +00:00
}
Factor out some common code for constructing SSH2_CHANNEL_OPEN. [originally from svn r9649]
2012-09-01 12:28:38 +00:00
/*
* Construct the common parts of a CHANNEL_OPEN.
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static PktOut *ssh2_chanopen_init(struct ssh_channel *c,
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
const char *type)
Factor out some common code for constructing SSH2_CHANNEL_OPEN. [originally from svn r9649]
2012-09-01 12:28:38 +00:00
{
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Factor out some common code for constructing SSH2_CHANNEL_OPEN. [originally from svn r9649]
2012-09-01 12:28:38 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(c->ssh->bpp, SSH2_MSG_CHANNEL_OPEN);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(pktout, type);
put_uint32(pktout, c->localid);
put_uint32(pktout, c->v.v2.locwindow);/* our window size */
put_uint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
Factor out some common code for constructing SSH2_CHANNEL_OPEN. [originally from svn r9649]
2012-09-01 12:28:38 +00:00
return pktout;
}
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
/*
* CHANNEL_FAILURE doesn't come with any indication of what message
* caused it, so we have to keep track of the outstanding
* CHANNEL_REQUESTs ourselves.
*/
static void ssh2_queue_chanreq_handler(struct ssh_channel *c,
cchandler_fn_t handler, void *ctx)
{
struct outstanding_channel_request *ocr =
snew(struct outstanding_channel_request);
Better handling of outstanding CHANNEL_REQUESTS on channel destruction. Part the first: make sure that all structures describing channel requests are freed when the SSH connection is freed. This involves adding a means to ask a response handler to free any memory it holds. Part the second: in ssh_channel_try_eof(), call ssh2_channel_check_close() rather than emitting an SSH_MSG_CHANNEL_EOF directly. This avoids the possibility of closing the channel while a CHANNEL_REQUEST is outstanding. Also add some assertions that helped with tracking down the latter problem. [originally from svn r9623]
2012-08-25 21:06:48 +00:00
assert(!(c->closes & (CLOSES_SENT_CLOSE | CLOSES_RCVD_CLOSE)));
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
ocr->handler = handler;
ocr->ctx = ctx;
ocr->next = NULL;
if (!c->v.v2.chanreq_head)
c->v.v2.chanreq_head = ocr;
else
c->v.v2.chanreq_tail->next = ocr;
c->v.v2.chanreq_tail = ocr;
}
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
/*
* Construct the common parts of a CHANNEL_REQUEST. If handler is not
* NULL then a reply will be requested and the handler will be called
* when it arrives. The returned packet is ready to have any
* request-specific data added and be sent. Note that if a handler is
* provided, it's essential that the request actually be sent.
Better handling of outstanding CHANNEL_REQUESTS on channel destruction. Part the first: make sure that all structures describing channel requests are freed when the SSH connection is freed. This involves adding a means to ask a response handler to free any memory it holds. Part the second: in ssh_channel_try_eof(), call ssh2_channel_check_close() rather than emitting an SSH_MSG_CHANNEL_EOF directly. This avoids the possibility of closing the channel while a CHANNEL_REQUEST is outstanding. Also add some assertions that helped with tracking down the latter problem. [originally from svn r9623]
2012-08-25 21:06:48 +00:00
*
Implement this year's consensus on CHANNEL_FAILURE vs CHANNEL_CLOSE. We now expect that after the server has sent us CHANNEL_CLOSE, we should not expect to see any replies to our outstanding channel requests, and conversely after we have sent CHANNEL_CLOSE we avoid sending any reply to channel requests from the server. This was the consensus among implementors discussing the problem on ietf-ssh in April 2014. To cope with current OpenSSH's (and perhaps other servers we don't know about yet) willingness to send request replies after CHANNEL_CLOSE, I introduce a bug-compatibility flag which is detected for every OpenSSH version up to and including the current 6.6 - but not beyond, since https://bugzilla.mindrot.org/show_bug.cgi?id=1818 promises that 6.7 will also implement the new consensus behaviour. [originally from svn r10200]
2014-07-06 14:05:39 +00:00
* The handler will usually be passed the response packet in pktin. If
* pktin is NULL, this means that no reply will ever be forthcoming
* (e.g. because the entire connection is being destroyed, or because
* the server initiated channel closure before we saw the response)
* and the handler should free any storage it's holding.
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static PktOut *ssh2_chanreq_init(struct ssh_channel *c,
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
const char *type,
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
cchandler_fn_t handler, void *ctx)
{
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
Better handling of outstanding CHANNEL_REQUESTS on channel destruction. Part the first: make sure that all structures describing channel requests are freed when the SSH connection is freed. This involves adding a means to ask a response handler to free any memory it holds. Part the second: in ssh_channel_try_eof(), call ssh2_channel_check_close() rather than emitting an SSH_MSG_CHANNEL_EOF directly. This avoids the possibility of closing the channel while a CHANNEL_REQUEST is outstanding. Also add some assertions that helped with tracking down the latter problem. [originally from svn r9623]
2012-08-25 21:06:48 +00:00
assert(!(c->closes & (CLOSES_SENT_CLOSE | CLOSES_RCVD_CLOSE)));
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(c->ssh->bpp, SSH2_MSG_CHANNEL_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, c->remoteid);
put_stringz(pktout, type);
put_bool(pktout, handler != NULL);
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
if (handler != NULL)
ssh2_queue_chanreq_handler(c, handler, ctx);
return pktout;
}
Factor out common parts of ssh_unthrottle and sshfwd_unthrottle. The SSH-2 code is essentially all shared, but SSH-1 still has some code specific to the stdout/stderr case.
2016-05-17 13:57:51 +00:00
static void ssh_channel_unthrottle(struct ssh_channel *c, int bufsize)
{
Ssh ssh = c->ssh;
int buflimit;
if (ssh->version == 1) {
buflimit = SSH1_BUFFER_LIMIT;
} else {
if (ssh_is_simple(ssh))
buflimit = 0;
else
buflimit = c->v.v2.locmaxwin;
Don't send SSH_MSG_CHANNEL_WINDOW_ADJUST with a zero adjustment.
2016-05-17 14:28:56 +00:00
if (bufsize < buflimit)
ssh2_set_window(c, buflimit - bufsize);
Factor out common parts of ssh_unthrottle and sshfwd_unthrottle. The SSH-2 code is essentially all shared, but SSH-1 still has some code specific to the stdout/stderr case.
2016-05-17 13:57:51 +00:00
}
if (c->throttling_conn && bufsize <= buflimit) {
c->throttling_conn = 0;
ssh_throttle_conn(ssh, -1);
}
}
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
/*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* Potentially enlarge the window on an SSH-2 channel.
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_handle_winadj_response(struct ssh_channel *, PktIn *,
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
void *);
Use "int" rather than "unsigned" as the argument to ssh2_set_window, not because it can ever be negative, but because we'll be comparing it with another int. This way, C's promotion rules don't bite us and we should stand slightly more chance of coping with broken servers that overrun our window. [originally from svn r7683]
2007-08-06 20:56:52 +00:00
static void ssh2_set_window(struct ssh_channel *c, int newwin)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
{
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Ssh ssh = c->ssh;
Extra safety feature to avoid sending SSH2_MSG_WINDOW_ADJUST on a nonexistent channel. I don't quite know why this was happening, but whatever it was this ought to fix it. [originally from svn r1540]
2002-01-10 13:29:43 +00:00
/*
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
* Never send WINDOW_ADJUST for a channel that the remote side has
* already sent EOF on; there's no point, since it won't be
Make sure we never send window adjustments (or winadjes) on channels for which we've already sent CHANNEL_CLOSE. It would be embarrassing if the remote end had also sent CHANNEL_CLOSE in response and then received our communication once it had forgotten about the channel. [originally from svn r9360]
2011-12-08 19:15:53 +00:00
* sending any more data anyway. Ditto if _we've_ already sent
* CLOSE.
Extra safety feature to avoid sending SSH2_MSG_WINDOW_ADJUST on a nonexistent channel. I don't quite know why this was happening, but whatever it was this ought to fix it. [originally from svn r1540]
2002-01-10 13:29:43 +00:00
*/
Make sure we never send window adjustments (or winadjes) on channels for which we've already sent CHANNEL_CLOSE. It would be embarrassing if the remote end had also sent CHANNEL_CLOSE in response and then received our communication once it had forgotten about the channel. [originally from svn r9360]
2011-12-08 19:15:53 +00:00
if (c->closes & (CLOSES_RCVD_EOF | CLOSES_SENT_CLOSE))
Extra safety feature to avoid sending SSH2_MSG_WINDOW_ADJUST on a nonexistent channel. I don't quite know why this was happening, but whatever it was this ought to fix it. [originally from svn r1540]
2002-01-10 13:29:43 +00:00
return;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
/*
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
* If the client-side Channel is in an initial setup phase with a
* fixed window size, e.g. for an X11 channel when we're still
* waiting to see its initial auth and may yet hand it off to a
* downstream, don't send any WINDOW_ADJUST either.
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
*/
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
if (c->chan->initial_fixed_window_size)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
return;
Be a little less enthusiastic about sending SSH_MSG_CHANNEL_WINDOW_ADJUST: only send it when it will significantly increase the server's idea of our window. This avoids the slew of one-byte WINDOW_ADJUSTs that an interactive shell typically generates. [originally from svn r5121]
2005-01-16 14:43:12 +00:00
/*
Add a new bug-compatibility mode that limits the window size we'll advertise so that the server can't exceed our maximum packet size. Enable it for "1.36_sshlib GlobalSCAPE" which apparently sends oversize packets otherwise. [originally from svn r7804]
2007-12-05 00:02:06 +00:00
* If the remote end has a habit of ignoring maxpkt, limit the
* window so that it has no choice (assuming it doesn't ignore the
* window as well).
*/
if ((ssh->remote_bugs & BUG_SSH2_MAXPKT) && newwin > OUR_V2_MAXPKT)
newwin = OUR_V2_MAXPKT;
/*
Be a little less enthusiastic about sending SSH_MSG_CHANNEL_WINDOW_ADJUST: only send it when it will significantly increase the server's idea of our window. This avoids the slew of one-byte WINDOW_ADJUSTs that an interactive shell typically generates. [originally from svn r5121]
2005-01-16 14:43:12 +00:00
* Only send a WINDOW_ADJUST if there's significantly more window
* available than the other end thinks there is. This saves us
* sending a WINDOW_ADJUST for every character in a shell session.
*
* "Significant" is arbitrarily defined as half the window size.
*/
Small window-handling tweaks. Set the default big window to 0x7fffffff bytes, and tweak ssh2_set_window() so it can cope with that. Also arrange to send a private channel message in simple mode to tell the server that it can safely use a large window too. [originally from svn r7679]
2007-08-05 14:18:43 +00:00
if (newwin / 2 >= c->v.v2.locwindow) {
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
unsigned *up;
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
Add support for automatically tuning the SSH-2 window size for decent performance. The theory behind this is fairly simple, though the implementation turns out to be a little trickier than it looks. The basic idea is that when the connection isn't being limited by our ability to process data, we want to ensure that the window size _as seen by the server_ never drops to zero. Measuring the server's view of the window size is done by arranging for it to acknowledge every SSH_MSG_CHANNEL_WINDOW_ADJUST, or rather an SSH_MSG_CHANNEL_REQUEST sent just before it. That way we can tell when it its outgoing data stream it received the window adjustment, and thus how small the server's view of the window got. At present, we only ever increase the window size. In theory, we could arrange to reduce it again if the server's view of it seemed to be persistently too large, but my experiments suggest that getting this right will be tricky. [originally from svn r7735]
2007-09-24 15:18:11 +00:00
/*
* In order to keep track of how much window the client
* actually has available, we'd like it to acknowledge each
* WINDOW_ADJUST. We can't do that directly, so we accompany
* it with a CHANNEL_REQUEST that has to be acknowledged.
*
* This is only necessary if we're opening the window wide.
* If we're not, then throughput is being constrained by
* something other than the maximum window size anyway.
*/
if (newwin == c->v.v2.locmaxwin &&
Add a bug-compatibility flag to disable the winadj@putty.projects.tartarus.org request. Not currently enabled automatically, but should be usable as a manual workaround. [originally from svn r9592]
2012-07-28 19:30:12 +00:00
!(ssh->remote_bugs & BUG_CHOKES_ON_WINADJ)) {
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
up = snew(unsigned);
*up = newwin - c->v.v2.locwindow;
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
pktout = ssh2_chanreq_init(c, "winadj@putty.projects.tartarus.org",
ssh2_handle_winadj_response, up);
ssh2_pkt_send(ssh, pktout);
Add support for automatically tuning the SSH-2 window size for decent performance. The theory behind this is fairly simple, though the implementation turns out to be a little trickier than it looks. The basic idea is that when the connection isn't being limited by our ability to process data, we want to ensure that the window size _as seen by the server_ never drops to zero. Measuring the server's view of the window size is done by arranging for it to acknowledge every SSH_MSG_CHANNEL_WINDOW_ADJUST, or rather an SSH_MSG_CHANNEL_REQUEST sent just before it. That way we can tell when it its outgoing data stream it received the window adjustment, and thus how small the server's view of the window got. At present, we only ever increase the window size. In theory, we could arrange to reduce it again if the server's view of it seemed to be persistently too large, but my experiments suggest that getting this right will be tricky. [originally from svn r7735]
2007-09-24 15:18:11 +00:00
if (c->v.v2.throttle_state != UNTHROTTLED)
c->v.v2.throttle_state = UNTHROTTLING;
} else {
/* Pretend the WINDOW_ADJUST was acked immediately. */
c->v.v2.remlocwin = newwin;
c->v.v2.throttle_state = THROTTLED;
}
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_CHANNEL_WINDOW_ADJUST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, c->remoteid);
put_uint32(pktout, newwin - c->v.v2.locwindow);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
ssh2_pkt_send(ssh, pktout);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
c->v.v2.locwindow = newwin;
Bring the SSH2 channel architecture up to scratch, enabling X forwarding to work under SSH2. Also - surprise! - implement X forwarding under SSH2. [originally from svn r882]
2001-01-22 15:36:07 +00:00
}
}
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
/*
* Find the channel associated with a message. If there's no channel,
* or it's not properly open, make a noise about it and return NULL.
Forward channel messages for shared channels in ssh_channel_msg(). This saves doing it separately in every function that processes such messages.
2016-05-22 22:59:48 +00:00
* If the channel is shared, pass the message on to downstream and
* also return NULL (meaning the caller should ignore this message).
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static struct ssh_channel *ssh_channel_msg(Ssh ssh, PktIn *pktin)
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
{
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
unsigned localid = get_uint32(pktin);
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
struct ssh_channel *c;
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
int halfopen_ok;
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
/* Is this message OK on a half-open connection? */
if (ssh->version == 1)
halfopen_ok = (pktin->type == SSH1_MSG_CHANNEL_OPEN_CONFIRMATION ||
pktin->type == SSH1_MSG_CHANNEL_OPEN_FAILURE);
else
halfopen_ok = (pktin->type == SSH2_MSG_CHANNEL_OPEN_CONFIRMATION ||
pktin->type == SSH2_MSG_CHANNEL_OPEN_FAILURE);
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
c = find234(ssh->channels, &localid, ssh_channelfind);
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
if (c && c->sharectx) {
share_got_pkt_from_server(c->sharectx, pktin->type,
BinarySource_UPCAST(pktin)->data,
BinarySource_UPCAST(pktin)->len);
return NULL;
}
if (!c || c->halfopen != halfopen_ok) {
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
char *buf = dupprintf("Received %s for %s channel %u",
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
ssh_pkt_type(ssh, pktin->type),
More strictness in ssh_channel_msg(). Now it disconnects if the server sends SSH_MSG_CHANNEL_OPEN_CONFIRMATION or SSH_MSG_CHANNEL_OPEN_FAILURE for a channel that isn't half-open. Assertions in the SSH-2 handlers for these messages rely on this behaviour even though it's never been enforced before.
2016-05-22 21:57:25 +00:00
!c ? "nonexistent" :
c->halfopen ? "half-open" : "open",
localid);
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
ssh_disconnect(ssh, NULL, buf, SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
sfree(buf);
return NULL;
}
return c;
}
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
static void ssh2_handle_winadj_response(struct ssh_channel *c,
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktIn *pktin, void *ctx)
Fix 'winadj-success': since at least one server (boks_sshd) blithely responds to "winadj@putty.projects.tartarus.org" with SSH_MSG_CHANNEL_SUCCESS despite probably having no idea what it means, treat this just the same as SSH_MSG_CHANNEL_FAILURE instead of killing the connection. Tested only as far as making sure that winadj/FAILURE with a normal server isn't _completely_ broken. [originally from svn r9185] [this svn revision also touched putty-wishlist]
2011-07-01 21:53:41 +00:00
{
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
unsigned *sizep = ctx;
/*
* Winadj responses should always be failures. However, at least
* one server ("boks_sshd") is known to return SUCCESS for channel
* requests it's never heard of, such as "winadj@putty". Raised
* with foxt.com as bug 090916-090424, but for the sake of a quiet
* life, we don't worry about what kind of response we got.
*/
c->v.v2.remlocwin += *sizep;
sfree(sizep);
Fix 'winadj-success': since at least one server (boks_sshd) blithely responds to "winadj@putty.projects.tartarus.org" with SSH_MSG_CHANNEL_SUCCESS despite probably having no idea what it means, treat this just the same as SSH_MSG_CHANNEL_FAILURE instead of killing the connection. Tested only as far as making sure that winadj/FAILURE with a normal server isn't _completely_ broken. [originally from svn r9185] [this svn revision also touched putty-wishlist]
2011-07-01 21:53:41 +00:00
/*
* winadj messages are only sent when the window is fully open, so
* if we get an ack of one, we know any pending unthrottle is
* complete.
*/
if (c->v.v2.throttle_state == UNTHROTTLING)
c->v.v2.throttle_state = UNTHROTTLED;
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_channel_response(Ssh ssh, PktIn *pktin)
Rather than rejecting spurious SSH_MSG_CHANNEL_SUCCESSes, and ignoring spurious SSH_MSG_CHANNEL_FAILUREs, treat them as the protocol errors they are and forcibly disconnect. Inspired by recent traffic on comp.security.ssh. [originally from svn r7752]
2007-10-01 21:11:11 +00:00
{
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
struct ssh_channel *c = ssh_channel_msg(ssh, pktin);
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
struct outstanding_channel_request *ocr;
Rather than rejecting spurious SSH_MSG_CHANNEL_SUCCESSes, and ignoring spurious SSH_MSG_CHANNEL_FAILUREs, treat them as the protocol errors they are and forcibly disconnect. Inspired by recent traffic on comp.security.ssh. [originally from svn r7752]
2007-10-01 21:11:11 +00:00
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
if (!c) return;
ocr = c->v.v2.chanreq_head;
if (!ocr) {
ssh2_msg_unexpected(ssh, pktin);
Rather than rejecting spurious SSH_MSG_CHANNEL_SUCCESSes, and ignoring spurious SSH_MSG_CHANNEL_FAILUREs, treat them as the protocol errors they are and forcibly disconnect. Inspired by recent traffic on comp.security.ssh. [originally from svn r7752]
2007-10-01 21:11:11 +00:00
return;
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
}
ocr->handler(c, pktin, ocr->ctx);
Stop ssh2_msg_channel_response using a stale ssh_channel. When it calls through ocr->handler() to process the response to a channel request, sometimes that call ends up back in the main SSH-2 authconn coroutine, and sometimes _that_ will call bomb_out(), which closes the whole SSH connection and frees all the channels - so that when control returns back up the call stack to ssh2_msg_channel_response itself which continues working with the channel it was passed, it's using freed memory and things go badly. This is the sort of thing I'd _like_ to fix using some kind of large-scale refactoring along the lines of moving all the actual free() calls out into top-level callbacks, so that _any_ function which is holding a pointer to something can rely on that pointer still being valid after it calls a subroutine. But I haven't worked out all the details of how that system should work, and doubtless it will turn out to have problems of its own once I do, so here's a point fix which simply checks if the whole SSH session has been closed (which is easy - much easier than checking if that _channel_ structure still exists) and fixes the immediate bug. (I think this is the real fix for the problem reported by the user I mention in commit f0126dd19, because I actually got the details wrong in the log message for that previous commit: the user's SSH server wasn't rejecting the _opening_ of the main session channel, it was rejecting the "shell" channel request, so this code path was the one being exercised. Still, the other bug was real too, so no harm done!)
2017-07-19 06:22:03 +00:00
if (ssh->state == SSH_STATE_CLOSED)
return; /* in case the handler called bomb_out(), which some can */
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
c->v.v2.chanreq_head = ocr->next;
sfree(ocr);
Add support for automatically tuning the SSH-2 window size for decent performance. The theory behind this is fairly simple, though the implementation turns out to be a little trickier than it looks. The basic idea is that when the connection isn't being limited by our ability to process data, we want to ensure that the window size _as seen by the server_ never drops to zero. Measuring the server's view of the window size is done by arranging for it to acknowledge every SSH_MSG_CHANNEL_WINDOW_ADJUST, or rather an SSH_MSG_CHANNEL_REQUEST sent just before it. That way we can tell when it its outgoing data stream it received the window adjustment, and thus how small the server's view of the window got. At present, we only ever increase the window size. In theory, we could arrange to reduce it again if the server's view of it seemed to be persistently too large, but my experiments suggest that getting this right will be tricky. [originally from svn r7735]
2007-09-24 15:18:11 +00:00
/*
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
* We may now initiate channel-closing procedures, if that
* CHANNEL_REQUEST was the last thing outstanding before we send
* CHANNEL_CLOSE.
Add support for automatically tuning the SSH-2 window size for decent performance. The theory behind this is fairly simple, though the implementation turns out to be a little trickier than it looks. The basic idea is that when the connection isn't being limited by our ability to process data, we want to ensure that the window size _as seen by the server_ never drops to zero. Measuring the server's view of the window size is done by arranging for it to acknowledge every SSH_MSG_CHANNEL_WINDOW_ADJUST, or rather an SSH_MSG_CHANNEL_REQUEST sent just before it. That way we can tell when it its outgoing data stream it received the window adjustment, and thus how small the server's view of the window got. At present, we only ever increase the window size. In theory, we could arrange to reduce it again if the server's view of it seemed to be persistently too large, but my experiments suggest that getting this right will be tricky. [originally from svn r7735]
2007-09-24 15:18:11 +00:00
*/
Generalise SSH_MSG_CHANNEL_{SUCCESS,FAILURE} handling. Now each channel has a queue of arbitrary handlers for those messages, with anything that sends a CHANNEL_REQUEST with want_reply true pushing a new entry onto the queue, and a shared handler that dispatches responses appropriately. Currently, this is only used for winadj@putty.projects.tartarus.org, but extending it to cover the initial requests as well shouldn't be too painful. [originally from svn r9615]
2012-08-25 11:12:14 +00:00
ssh2_channel_check_close(c);
Add support for automatically tuning the SSH-2 window size for decent performance. The theory behind this is fairly simple, though the implementation turns out to be a little trickier than it looks. The basic idea is that when the connection isn't being limited by our ability to process data, we want to ensure that the window size _as seen by the server_ never drops to zero. Measuring the server's view of the window size is done by arranging for it to acknowledge every SSH_MSG_CHANNEL_WINDOW_ADJUST, or rather an SSH_MSG_CHANNEL_REQUEST sent just before it. That way we can tell when it its outgoing data stream it received the window adjustment, and thus how small the server's view of the window got. At present, we only ever increase the window size. In theory, we could arrange to reduce it again if the server's view of it seemed to be persistently too large, but my experiments suggest that getting this right will be tricky. [originally from svn r7735]
2007-09-24 15:18:11 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_channel_window_adjust(Ssh ssh, PktIn *pktin)
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
{
struct ssh_channel *c;
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
c = ssh_channel_msg(ssh, pktin);
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
if (!c)
return;
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
if (!(c->closes & CLOSES_SENT_EOF)) {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
c->v.v2.remwindow += get_uint32(pktin);
Patch from Alan Ning (somewhat polished by me): introduce a flag called 'pending_close'. This deals with the situation in which we're forwarding a port, have received and locally buffered some data from the local endpoint but not yet been able to pass it down the SSH connection due to window limitations, and then the local endpoint closes its socket. In this situation what we've been doing until now is to immediately send SSH2_MSG_CHANNEL_CLOSE, causing the data still in our local buffer to be lost; now we instead set the new flag, which will remind us to send SSH2_MSG_CHANNEL_CLOSE _after_ we empty our bufchain. Should fix at least one manifestation of 'portfwd-close', though I don't know if it's the cause of all the reports we've ever seen. [originally from svn r8971]
2010-07-04 22:53:53 +00:00
ssh2_try_send_and_unthrottle(ssh, c);
The structural reorganisation of ssh.c (r4909) caused ssh2_try_send() to no longer be run after receiving WINDOW_ADJUSTs. I believe this is likely to have been the cause of recent PSCP hanging issues. [originally from svn r5517] [r4909 == 02b0474f578ec550552989bd6461fd7151609006]
2005-03-17 19:49:51 +00:00
}
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_channel_data(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen data;
Don't completely ignore unknown types of SSH_MSG_CHANNEL_EXTENDED_DATA. It's important to do the usual window accounting in all cases. We still ignore the data themselves, which I think is the right thing to do.
2016-05-24 21:38:40 +00:00
unsigned ext_type = 0; /* 0 means not extended */
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
struct ssh_channel *c;
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
c = ssh_channel_msg(ssh, pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
if (!c)
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
return;
Don't completely ignore unknown types of SSH_MSG_CHANNEL_EXTENDED_DATA. It's important to do the usual window accounting in all cases. We still ignore the data themselves, which I think is the right thing to do.
2016-05-24 21:38:40 +00:00
if (pktin->type == SSH2_MSG_CHANNEL_EXTENDED_DATA)
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ext_type = get_uint32(pktin);
data = get_string(pktin);
if (!get_err(pktin)) {
Unify despatch of incoming channel data between SSH-1 and SSH-2.
2016-05-21 12:13:00 +00:00
int bufsize;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
c->v.v2.locwindow -= data.len;
c->v.v2.remlocwin -= data.len;
Don't completely ignore unknown types of SSH_MSG_CHANNEL_EXTENDED_DATA. It's important to do the usual window accounting in all cases. We still ignore the data themselves, which I think is the right thing to do.
2016-05-24 21:38:40 +00:00
if (ext_type != 0 && ext_type != SSH2_EXTENDED_DATA_STDERR)
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
data.len = 0; /* Don't do anything with unknown extended data. */
Don't completely ignore unknown types of SSH_MSG_CHANNEL_EXTENDED_DATA. It's important to do the usual window accounting in all cases. We still ignore the data themselves, which I think is the right thing to do.
2016-05-24 21:38:40 +00:00
bufsize = ssh_channel_data(c, ext_type == SSH2_EXTENDED_DATA_STDERR,
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
data.ptr, data.len);
Add support for automatically tuning the SSH-2 window size for decent performance. The theory behind this is fairly simple, though the implementation turns out to be a little trickier than it looks. The basic idea is that when the connection isn't being limited by our ability to process data, we want to ensure that the window size _as seen by the server_ never drops to zero. Measuring the server's view of the window size is done by arranging for it to acknowledge every SSH_MSG_CHANNEL_WINDOW_ADJUST, or rather an SSH_MSG_CHANNEL_REQUEST sent just before it. That way we can tell when it its outgoing data stream it received the window adjustment, and thus how small the server's view of the window got. At present, we only ever increase the window size. In theory, we could arrange to reduce it again if the server's view of it seemed to be persistently too large, but my experiments suggest that getting this right will be tricky. [originally from svn r7735]
2007-09-24 15:18:11 +00:00
/*
* If it looks like the remote end hit the end of its window,
* and we didn't want it to do that, think about using a
* larger window.
*/
if (c->v.v2.remlocwin <= 0 && c->v.v2.throttle_state == UNTHROTTLED &&
c->v.v2.locmaxwin < 0x40000000)
c->v.v2.locmaxwin += OUR_V2_WINSIZE;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
/*
* If we are not buffering too much data,
* enlarge the window again at the remote side.
Tweak to window handling: Keep the local window in a signed integer, and arrange to handle usefully the case where the server sends us more data than it's allowed to. There's no danger of overflow, since the maximum is OUR_V2_WINSIZE and the minimum is -OUR_V2_MAXPKT (at least if the server is nice). [originally from svn r7661]
2007-08-04 14:32:06 +00:00
* If we are buffering too much, we may still
* need to adjust the window if the server's
* sent excess data.
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
*/
Don't send SSH_MSG_CHANNEL_WINDOW_ADJUST with a zero adjustment.
2016-05-17 14:28:56 +00:00
if (bufsize < c->v.v2.locmaxwin)
ssh2_set_window(c, c->v.v2.locmaxwin - bufsize);
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
/*
* If we're either buffering way too much data, or if we're
* buffering anything at all and we're in "simple" mode,
* throttle the whole channel.
*/
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
if ((bufsize > c->v.v2.locmaxwin || (ssh_is_simple(ssh) && bufsize>0))
&& !c->throttling_conn) {
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
c->throttling_conn = 1;
ssh_throttle_conn(ssh, +1);
}
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
}
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
static void ssh_check_termination(Ssh ssh)
{
if (ssh->version == 2 &&
!conf_get_int(ssh->conf, CONF_ssh_no_shell) &&
Fix a crash when connection-sharing during userauth. If a sharing downstream disconnected while we were still in userauth (probably by deliberate user action, since such a downstream would have just been sitting there waiting for upstream to be ready for it) then we could crash by attempting to count234(ssh->channels) before the ssh->channels tree had been set up in the first place. A simple null-pointer check fixes it. Thanks to Antti Seppanen for the report.
2015-06-22 18:37:27 +00:00
(ssh->channels && count234(ssh->channels) == 0) &&
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
!(ssh->connshare && share_ndownstreams(ssh->connshare) > 0)) {
/*
* We used to send SSH_MSG_DISCONNECT here, because I'd
* believed that _every_ conforming SSH-2 connection had to
* end with a disconnect being sent by at least one side;
* apparently I was wrong and it's perfectly OK to
* unceremoniously slam the connection shut when you're done,
* and indeed OpenSSH feels this is more polite than sending a
* DISCONNECT. So now we don't.
*/
ssh_disconnect(ssh, "All channels closed", NULL, 0, TRUE);
}
}
Factor out code to close the local socket associated with a channel. The only visible effect should be that abrupt closure of an SSH connection now leads to a slew of messages about closing forwarded ports.
2016-05-28 13:50:02 +00:00
/*
* Close any local socket and free any local resources associated with
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
* a channel. This converts the channel into a zombie.
Factor out code to close the local socket associated with a channel. The only visible effect should be that abrupt closure of an SSH connection now leads to a slew of messages about closing forwarded ports.
2016-05-28 13:50:02 +00:00
*/
static void ssh_channel_close_local(struct ssh_channel *c, char const *reason)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
Ssh ssh = c->ssh;
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
const char *msg = NULL;
if (c->sharectx)
return;
msg = chan_log_close_msg(c->chan);
chan_free(c->chan);
c->chan = zombiechan_new();
Factor out code to close the local socket associated with a channel. The only visible effect should be that abrupt closure of an SSH connection now leads to a slew of messages about closing forwarded ports.
2016-05-28 13:50:02 +00:00
if (msg != NULL) {
if (reason != NULL)
logeventf(ssh, "%s %s", msg, reason);
else
logevent(msg);
}
}
static void ssh_channel_destroy(struct ssh_channel *c)
{
Ssh ssh = c->ssh;
ssh_channel_close_local(c, NULL);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
del234(ssh->channels, c);
Better handling of outstanding CHANNEL_REQUESTS on channel destruction. Part the first: make sure that all structures describing channel requests are freed when the SSH connection is freed. This involves adding a means to ask a response handler to free any memory it holds. Part the second: in ssh_channel_try_eof(), call ssh2_channel_check_close() rather than emitting an SSH_MSG_CHANNEL_EOF directly. This avoids the possibility of closing the channel while a CHANNEL_REQUEST is outstanding. Also add some assertions that helped with tracking down the latter problem. [originally from svn r9623]
2012-08-25 21:06:48 +00:00
if (ssh->version == 2) {
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
bufchain_clear(&c->v.v2.outbuffer);
Better handling of outstanding CHANNEL_REQUESTS on channel destruction. Part the first: make sure that all structures describing channel requests are freed when the SSH connection is freed. This involves adding a means to ask a response handler to free any memory it holds. Part the second: in ssh_channel_try_eof(), call ssh2_channel_check_close() rather than emitting an SSH_MSG_CHANNEL_EOF directly. This avoids the possibility of closing the channel while a CHANNEL_REQUEST is outstanding. Also add some assertions that helped with tracking down the latter problem. [originally from svn r9623]
2012-08-25 21:06:48 +00:00
assert(c->v.v2.chanreq_head == NULL);
}
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
sfree(c);
/*
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
* If that was the last channel left open, we might need to
* terminate.
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
*/
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
ssh_check_termination(ssh);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
}
static void ssh2_channel_check_close(struct ssh_channel *c)
{
Ssh ssh = c->ssh;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
Assert that ssh2_channel_check_close() is only called in SSH-2. That really should be true, but I don't entirely trust sshfwd_unclean_close().
2016-05-22 12:50:34 +00:00
assert(ssh->version == 2);
Handle socket errors on half-open channels. Anthony Ho reports that this can occur naturally in some situation involving Windows 8 + IE 11 and dynamic port forwarding: apparently we get through the SOCKS negotiation, send our CHANNEL_OPEN, and then *immediately* suffer a local WSAECONNABORTED error before the server has sent back its OPEN_CONFIRMATION or OPEN_FAILURE. In this situation ssh2_channel_check_close was failing to notice that the channel didn't yet have a valid server id, and sending out a CHANNEL_CLOSE anyway containing 32 bits of uninitialised nonsense. We now handle this by turning our half-open CHAN_SOCKDATA_DORMANT into a half-open CHAN_ZOMBIE, which means in turn that our handler functions for OPEN_CONFIRMATION and OPEN_FAILURE have to recognise and handle that case, the former by immediately initiating channel closure once we _do_ have the channel's server id to do it with. [originally from svn r10039]
2013-09-08 13:20:49 +00:00
if (c->halfopen) {
/*
* If we've sent out our own CHANNEL_OPEN but not yet seen
* either OPEN_CONFIRMATION or OPEN_FAILURE in response, then
* it's too early to be sending close messages of any kind.
*/
return;
}
Don't close SSH-2 channels with outstanding channel requests on local error. In sshfwd_unclean_close(), get ssh2_check_close() to handle sending SSH_MSG_CHANNEL_CLOSE. That way, it can hold off doing so until any outstanding channel requests are processed. Also add event log message for unclean channel closures. [originally from svn r9631]
2012-08-27 17:37:44 +00:00
if ((!((CLOSES_SENT_EOF | CLOSES_RCVD_EOF) & ~c->closes) ||
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
chan_want_close(c->chan, (c->closes & CLOSES_SENT_EOF),
(c->closes & CLOSES_RCVD_EOF))) &&
Don't close SSH-2 channels with outstanding channel requests on local error. In sshfwd_unclean_close(), get ssh2_check_close() to handle sending SSH_MSG_CHANNEL_CLOSE. That way, it can hold off doing so until any outstanding channel requests are processed. Also add event log message for unclean channel closures. [originally from svn r9631]
2012-08-27 17:37:44 +00:00
!c->v.v2.chanreq_head &&
!(c->closes & CLOSES_SENT_CLOSE)) {
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
/*
Don't close SSH-2 channels with outstanding channel requests on local error. In sshfwd_unclean_close(), get ssh2_check_close() to handle sending SSH_MSG_CHANNEL_CLOSE. That way, it can hold off doing so until any outstanding channel requests are processed. Also add event log message for unclean channel closures. [originally from svn r9631]
2012-08-27 17:37:44 +00:00
* We have both sent and received EOF (or the channel is a
* zombie), and we have no outstanding channel requests, which
* means the channel is in final wind-up. But we haven't sent
* CLOSE, so let's do so now.
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_CHANNEL_CLOSE);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, c->remoteid);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
ssh2_pkt_send(ssh, pktout);
Don't close SSH-2 channels with outstanding channel requests on local error. In sshfwd_unclean_close(), get ssh2_check_close() to handle sending SSH_MSG_CHANNEL_CLOSE. That way, it can hold off doing so until any outstanding channel requests are processed. Also add event log message for unclean channel closures. [originally from svn r9631]
2012-08-27 17:37:44 +00:00
c->closes |= CLOSES_SENT_EOF | CLOSES_SENT_CLOSE;
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
}
if (!((CLOSES_SENT_CLOSE | CLOSES_RCVD_CLOSE) & ~c->closes)) {
Better handling of outstanding CHANNEL_REQUESTS on channel destruction. Part the first: make sure that all structures describing channel requests are freed when the SSH connection is freed. This involves adding a means to ask a response handler to free any memory it holds. Part the second: in ssh_channel_try_eof(), call ssh2_channel_check_close() rather than emitting an SSH_MSG_CHANNEL_EOF directly. This avoids the possibility of closing the channel while a CHANNEL_REQUEST is outstanding. Also add some assertions that helped with tracking down the latter problem. [originally from svn r9623]
2012-08-25 21:06:48 +00:00
assert(c->v.v2.chanreq_head == NULL);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
/*
* We have both sent and received CLOSE, which means we're
* completely done with the channel.
*/
ssh_channel_destroy(c);
}
}
Use ssh2_channel_got_eof() in ssh1_msg_channel_close(). Of course, that means renaming it to ssh_channel_got_eof(). It also involves adding the assertions from ssh1_msg_channel_close(), just in case.
2016-05-25 22:16:09 +00:00
static void ssh_channel_got_eof(struct ssh_channel *c)
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
{
if (c->closes & CLOSES_RCVD_EOF)
return; /* already seen EOF */
c->closes |= CLOSES_RCVD_EOF;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
chan_send_eof(c->chan);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_channel_eof(Ssh ssh, PktIn *pktin)
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
{
struct ssh_channel *c;
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
c = ssh_channel_msg(ssh, pktin);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
if (!c)
return;
Use ssh2_channel_got_eof() in ssh1_msg_channel_close(). Of course, that means renaming it to ssh_channel_got_eof(). It also involves adding the assertions from ssh1_msg_channel_close(), just in case.
2016-05-25 22:16:09 +00:00
ssh_channel_got_eof(c);
Move call to ssh2_channnel_check_close(). From ssh2_channel_got_eof() to ssh2_msg_channel_eof(). This removes the only SSH-2 specicifity from the former. ssh2_channel_got_eof() can also be called from ssh2_msg_channel_close(), but that calls ssh2_channel_check_close() already.
2016-05-25 22:06:20 +00:00
ssh2_channel_check_close(c);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_channel_close(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
struct ssh_channel *c;
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
c = ssh_channel_msg(ssh, pktin);
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
if (!c)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
return;
/*
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
* When we receive CLOSE on a channel, we assume it comes with an
* implied EOF if we haven't seen EOF yet.
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
*/
Use ssh2_channel_got_eof() in ssh1_msg_channel_close(). Of course, that means renaming it to ssh_channel_got_eof(). It also involves adding the assertions from ssh1_msg_channel_close(), just in case.
2016-05-25 22:16:09 +00:00
ssh_channel_got_eof(c);
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
Implement this year's consensus on CHANNEL_FAILURE vs CHANNEL_CLOSE. We now expect that after the server has sent us CHANNEL_CLOSE, we should not expect to see any replies to our outstanding channel requests, and conversely after we have sent CHANNEL_CLOSE we avoid sending any reply to channel requests from the server. This was the consensus among implementors discussing the problem on ietf-ssh in April 2014. To cope with current OpenSSH's (and perhaps other servers we don't know about yet) willingness to send request replies after CHANNEL_CLOSE, I introduce a bug-compatibility flag which is detected for every OpenSSH version up to and including the current 6.6 - but not beyond, since https://bugzilla.mindrot.org/show_bug.cgi?id=1818 promises that 6.7 will also implement the new consensus behaviour. [originally from svn r10200]
2014-07-06 14:05:39 +00:00
if (!(ssh->remote_bugs & BUG_SENDS_LATE_REQUEST_REPLY)) {
/*
* It also means we stop expecting to see replies to any
* outstanding channel requests, so clean those up too.
* (ssh_chanreq_init will enforce by assertion that we don't
* subsequently put anything back on this list.)
*/
while (c->v.v2.chanreq_head) {
struct outstanding_channel_request *ocr = c->v.v2.chanreq_head;
ocr->handler(c, NULL, ocr->ctx);
c->v.v2.chanreq_head = ocr->next;
sfree(ocr);
}
}
Another tweak to EOF policy: invent an outgoing EOF on receipt of an incoming CHANNEL_CLOSE, if it's the main session channel. The idea is that invocations such as 'plink -T hostname sh' (running a shell without a remote pty) can be exited by typing 'exit' to the remote shell, without plink blocking forever waiting for outgoing EOF. I think it would be better to do the same for all other channel types too, but that would need an extra API call which I haven't implemented yet. [originally from svn r9283]
2011-09-14 09:09:35 +00:00
/*
* And we also send an outgoing EOF, if we haven't already, on the
* assumption that CLOSE is a pretty forceful announcement that
* the remote side is doing away with the entire channel. (If it
* had wanted to send us EOF and continue receiving data from us,
* it would have just sent CHANNEL_EOF.)
*/
No, I take that back: we _do_ have a mechanism for suppressing reads from forwarding data sources which will be good enough to last until we close the socket, in the form of the override_throttle() functions. So this finishes up the work in r9283, by manufacturing outgoing EOF in response to incoming CLOSE on all channel types. [originally from svn r9284] [r9283 == c54e228d0497409d72f336ea43f821b736a5ab29]
2011-09-14 09:49:00 +00:00
if (!(c->closes & CLOSES_SENT_EOF)) {
If the SSH server sends us CHANNEL_CLOSE for a channel on which we're sitting on a pile of buffered data waiting for WINDOW_ADJUSTs, we should throw away that buffered data, because the CHANNEL_CLOSE tells us that we won't be receiving those WINDOW_ADJUSTs, and if we hang on to the data and keep trying then it'll prevent ssh_channel_try_eof from sending the CHANNEL_EOF which is a prerequisite of sending our own CHANNEL_CLOSE. [originally from svn r9953]
2013-07-21 10:12:58 +00:00
/*
* Abandon any buffered data we still wanted to send to this
* channel. Receiving a CHANNEL_CLOSE is an indication that
* the server really wants to get on and _destroy_ this
* channel, and it isn't going to send us any further
* WINDOW_ADJUSTs to permit us to send pending stuff.
*/
bufchain_clear(&c->v.v2.outbuffer);
No, I take that back: we _do_ have a mechanism for suppressing reads from forwarding data sources which will be good enough to last until we close the socket, in the form of the override_throttle() functions. So this finishes up the work in r9283, by manufacturing outgoing EOF in response to incoming CLOSE on all channel types. [originally from svn r9284] [r9283 == c54e228d0497409d72f336ea43f821b736a5ab29]
2011-09-14 09:49:00 +00:00
/*
* Send outgoing EOF.
*/
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
sshfwd_write_eof(&c->sc);
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
/*
* Make sure we don't read any more from whatever our local
* data source is for this channel. (This will pick up on the
* changes made by sshfwd_write_eof.)
*/
ssh_channel_check_throttle(c);
Another tweak to EOF policy: invent an outgoing EOF on receipt of an incoming CHANNEL_CLOSE, if it's the main session channel. The idea is that invocations such as 'plink -T hostname sh' (running a shell without a remote pty) can be exited by typing 'exit' to the remote shell, without plink blocking forever waiting for outgoing EOF. I think it would be better to do the same for all other channel types too, but that would need an extra API call which I haven't implemented yet. [originally from svn r9283]
2011-09-14 09:09:35 +00:00
}
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
/*
* Now process the actual close.
*/
if (!(c->closes & CLOSES_RCVD_CLOSE)) {
c->closes |= CLOSES_RCVD_CLOSE;
ssh2_channel_check_close(c);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_channel_open_confirmation(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
struct ssh_channel *c;
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
c = ssh_channel_msg(ssh, pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
if (!c)
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
return;
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
assert(c->halfopen); /* ssh_channel_msg will have enforced this */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
c->remoteid = get_uint32(pktin);
Don't abuse a remote channel number of (unsigned)(-1) to indicate a channel for which we don't yet have a remote number, and instead add a flag to indicate this fact. Fixes bug ssh-remoteid-minusone. [originally from svn r5171]
2005-01-22 16:06:21 +00:00
c->halfopen = FALSE;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
c->v.v2.remwindow = get_uint32(pktin);
c->v.v2.remmaxpkt = get_uint32(pktin);
Handle socket errors on half-open channels. Anthony Ho reports that this can occur naturally in some situation involving Windows 8 + IE 11 and dynamic port forwarding: apparently we get through the SOCKS negotiation, send our CHANNEL_OPEN, and then *immediately* suffer a local WSAECONNABORTED error before the server has sent back its OPEN_CONFIRMATION or OPEN_FAILURE. In this situation ssh2_channel_check_close was failing to notice that the channel didn't yet have a valid server id, and sending out a CHANNEL_CLOSE anyway containing 32 bits of uninitialised nonsense. We now handle this by turning our half-open CHAN_SOCKDATA_DORMANT into a half-open CHAN_ZOMBIE, which means in turn that our handler functions for OPEN_CONFIRMATION and OPEN_FAILURE have to recognise and handle that case, the former by immediately initiating channel closure once we _do_ have the channel's server id to do it with. [originally from svn r10039]
2013-09-08 13:20:49 +00:00
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
chan_open_confirmation(c->chan);
/*
* Now that the channel is fully open, it's possible in principle
* to immediately close it. Check whether it wants us to!
*
* This can occur if a local socket error occurred between us
* sending out CHANNEL_OPEN and receiving OPEN_CONFIRMATION. If
* that happens, all we can do is immediately initiate close
* proceedings now that we know the server's id to put in the
* close message. We'll have handled that in this code by having
* already turned c->chan into a zombie, so its want_close method
* (which ssh2_channel_check_close will consult) will already be
* returning TRUE.
*/
ssh2_channel_check_close(c);
Handle socket errors on half-open channels. Anthony Ho reports that this can occur naturally in some situation involving Windows 8 + IE 11 and dynamic port forwarding: apparently we get through the SOCKS negotiation, send our CHANNEL_OPEN, and then *immediately* suffer a local WSAECONNABORTED error before the server has sent back its OPEN_CONFIRMATION or OPEN_FAILURE. In this situation ssh2_channel_check_close was failing to notice that the channel didn't yet have a valid server id, and sending out a CHANNEL_CLOSE anyway containing 32 bits of uninitialised nonsense. We now handle this by turning our half-open CHAN_SOCKDATA_DORMANT into a half-open CHAN_ZOMBIE, which means in turn that our handler functions for OPEN_CONFIRMATION and OPEN_FAILURE have to recognise and handle that case, the former by immediately initiating channel closure once we _do_ have the channel's server id to do it with. [originally from svn r10039]
2013-09-08 13:20:49 +00:00
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
if (c->pending_eof)
Handle socket errors on half-open channels. Anthony Ho reports that this can occur naturally in some situation involving Windows 8 + IE 11 and dynamic port forwarding: apparently we get through the SOCKS negotiation, send our CHANNEL_OPEN, and then *immediately* suffer a local WSAECONNABORTED error before the server has sent back its OPEN_CONFIRMATION or OPEN_FAILURE. In this situation ssh2_channel_check_close was failing to notice that the channel didn't yet have a valid server id, and sending out a CHANNEL_CLOSE anyway containing 32 bits of uninitialised nonsense. We now handle this by turning our half-open CHAN_SOCKDATA_DORMANT into a half-open CHAN_ZOMBIE, which means in turn that our handler functions for OPEN_CONFIRMATION and OPEN_FAILURE have to recognise and handle that case, the former by immediately initiating channel closure once we _do_ have the channel's server id to do it with. [originally from svn r10039]
2013-09-08 13:20:49 +00:00
ssh_channel_try_eof(c); /* in case we had a pending EOF */
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static char *ssh2_channel_open_failure_error_text(PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
static const char *const reasons[] = {
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
NULL,
"Administratively prohibited",
"Connect failed",
"Unknown channel type",
"Resource shortage",
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
};
unsigned reason_code;
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
const char *reason_code_string;
char reason_code_buf[256];
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen reason;
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
reason_code = get_uint32(pktin);
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
if (reason_code < lenof(reasons) && reasons[reason_code]) {
reason_code_string = reasons[reason_code];
} else {
reason_code_string = reason_code_buf;
sprintf(reason_code_buf, "unknown reason code %#x", reason_code);
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
reason = get_string(pktin);
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
return dupprintf("%s [%.*s]", reason_code_string, PTRLEN_PRINTF(reason));
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_channel_open_failure(Ssh ssh, PktIn *pktin)
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
{
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
struct ssh_channel *c;
Handle socket errors on half-open channels. Anthony Ho reports that this can occur naturally in some situation involving Windows 8 + IE 11 and dynamic port forwarding: apparently we get through the SOCKS negotiation, send our CHANNEL_OPEN, and then *immediately* suffer a local WSAECONNABORTED error before the server has sent back its OPEN_CONFIRMATION or OPEN_FAILURE. In this situation ssh2_channel_check_close was failing to notice that the channel didn't yet have a valid server id, and sending out a CHANNEL_CLOSE anyway containing 32 bits of uninitialised nonsense. We now handle this by turning our half-open CHAN_SOCKDATA_DORMANT into a half-open CHAN_ZOMBIE, which means in turn that our handler functions for OPEN_CONFIRMATION and OPEN_FAILURE have to recognise and handle that case, the former by immediately initiating channel closure once we _do_ have the channel's server id to do it with. [originally from svn r10039]
2013-09-08 13:20:49 +00:00
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
c = ssh_channel_msg(ssh, pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
if (!c)
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
return;
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
assert(c->halfopen); /* ssh_channel_msg will have enforced this */
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
{
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
char *errtext = ssh2_channel_open_failure_error_text(pktin);
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
chan_open_failed(c->chan, errtext);
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
sfree(errtext);
Handle socket errors on half-open channels. Anthony Ho reports that this can occur naturally in some situation involving Windows 8 + IE 11 and dynamic port forwarding: apparently we get through the SOCKS negotiation, send our CHANNEL_OPEN, and then *immediately* suffer a local WSAECONNABORTED error before the server has sent back its OPEN_CONFIRMATION or OPEN_FAILURE. In this situation ssh2_channel_check_close was failing to notice that the channel didn't yet have a valid server id, and sending out a CHANNEL_CLOSE anyway containing 32 bits of uninitialised nonsense. We now handle this by turning our half-open CHAN_SOCKDATA_DORMANT into a half-open CHAN_ZOMBIE, which means in turn that our handler functions for OPEN_CONFIRMATION and OPEN_FAILURE have to recognise and handle that case, the former by immediately initiating channel closure once we _do_ have the channel's server id to do it with. [originally from svn r10039]
2013-09-08 13:20:49 +00:00
}
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
chan_free(c->chan);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
del234(ssh->channels, c);
sfree(c);
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_channel_request(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen type;
int want_reply;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */
struct ssh_channel *c;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Generalise ssh2_channel_msg() to ssh_channel_msg(). It now supports both SSH-1 and SSH-2 channel messages. The SSH-1 code doesn't yet use it, though.
2016-05-22 21:14:00 +00:00
c = ssh_channel_msg(ssh, pktin);
Merge the looking up of channel numbers for SSH-2 channel messages into a single function which also handles checking that channels exist and are properly open. This should make PuTTY a little less tolerant of servers that send bogus messages. [originally from svn r7751]
2007-09-30 19:42:31 +00:00
if (!c)
return;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
type = get_string(pktin);
want_reply = get_bool(pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Implement this year's consensus on CHANNEL_FAILURE vs CHANNEL_CLOSE. We now expect that after the server has sent us CHANNEL_CLOSE, we should not expect to see any replies to our outstanding channel requests, and conversely after we have sent CHANNEL_CLOSE we avoid sending any reply to channel requests from the server. This was the consensus among implementors discussing the problem on ietf-ssh in April 2014. To cope with current OpenSSH's (and perhaps other servers we don't know about yet) willingness to send request replies after CHANNEL_CLOSE, I introduce a bug-compatibility flag which is detected for every OpenSSH version up to and including the current 6.6 - but not beyond, since https://bugzilla.mindrot.org/show_bug.cgi?id=1818 promises that 6.7 will also implement the new consensus behaviour. [originally from svn r10200]
2014-07-06 14:05:39 +00:00
if (c->closes & CLOSES_SENT_CLOSE) {
/*
* We don't reply to channel requests after we've sent
* CHANNEL_CLOSE for the channel, because our reply might
* cross in the network with the other side's CHANNEL_CLOSE
* and arrive after they have wound the channel up completely.
*/
want_reply = FALSE;
}
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
/*
* Having got the channel number, we now look at
* the request type string to see if it's something
* we recognise.
*/
if (c == ssh->mainchan) {
/*
* We recognise "exit-status" and "exit-signal" on
* the primary channel.
*/
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
if (ptrlen_eq_string(type, "exit-status")) {
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ssh->exitcode = get_uint32(pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
logeventf(ssh, "Server sent command exit status %d",
ssh->exitcode);
reply = SSH2_MSG_CHANNEL_SUCCESS;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
} else if (ptrlen_eq_string(type, "exit-signal")) {
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
char *fmt_sig = NULL, *fmt_msg = NULL;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen errmsg;
int core = FALSE;
int format, exitcode;
/* ICK: older versions of OpenSSH (e.g. 3.4p1)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
* provide an `int' for the signal, despite its
Replace mentions of SSH-2 I-Ds with references to the corresponding RFCs. [originally from svn r7759]
2007-10-03 21:21:18 +00:00
* having been a `string' in the drafts of RFC 4254 since at
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
* least 2001. (Fixed in session.c 1.147.) Try to
* infer which we can safely parse it as. */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
size_t startpos = BinarySource_UPCAST(pktin)->pos;
for (format = 0; format < 2; format++) {
BinarySource_UPCAST(pktin)->pos = startpos;
BinarySource_UPCAST(pktin)->err = BSE_NO_ERROR;
if (format == 0) { /* standard string-based format */
ptrlen signame = get_string(pktin);
fmt_sig = dupprintf(" \"%.*s\"", PTRLEN_PRINTF(signame));
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
/*
* Really hideous method of translating the
* signal description back into a locally
* meaningful number.
*/
if (0)
;
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
#define TRANSLATE_SIGNAL(s) \
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
else if (ptrlen_eq_string(signame, #s)) \
exitcode = 128 + SIG ## s
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#ifdef SIGABRT
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(ABRT);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGALRM
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(ALRM);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGFPE
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(FPE);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGHUP
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(HUP);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGILL
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(ILL);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGINT
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(INT);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGKILL
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(KILL);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGPIPE
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(PIPE);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGQUIT
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(QUIT);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGSEGV
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(SEGV);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGTERM
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(TERM);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGUSR1
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(USR1);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
#ifdef SIGUSR2
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
TRANSLATE_SIGNAL(USR2);
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
#endif
Use preprocessor trickery to make the signal translation mechanism a little less hideous. The output of the preprocessor should be basically unchanged. [originally from svn r7294]
2007-02-17 22:33:11 +00:00
#undef TRANSLATE_SIGNAL
Flag user cancellation of authentication as a clean exit, so that it will close the window even in `close window only on clean exit' mode. Also, while I'm here, arrange a suitable exit code for "exit-signal". [originally from svn r7121]
2007-01-17 18:38:45 +00:00
else
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
exitcode = 128;
} else { /* nonstandard integer format */
unsigned signum = get_uint32(pktin);
fmt_sig = dupprintf(" %u", signum);
exitcode = 128 + signum;
}
core = get_bool(pktin);
errmsg = get_string(pktin); /* error message */
get_string(pktin); /* language tag */
if (!get_err(pktin) && get_avail(pktin) == 0)
break; /* successful parse */
sfree(fmt_sig);
}
if (format == 2) {
fmt_sig = NULL;
exitcode = 128;
}
ssh->exitcode = exitcode;
if (errmsg.len) {
fmt_msg = dupprintf(" (\"%.*s\")", PTRLEN_PRINTF(errmsg));
}
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
logeventf(ssh, "Server exited on signal%s%s%s",
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
fmt_sig ? fmt_sig : "",
core ? " (core dumped)" : "",
fmt_msg ? fmt_msg : "");
sfree(fmt_sig);
sfree(fmt_msg);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
reply = SSH2_MSG_CHANNEL_SUCCESS;
}
} else {
/*
* This is a channel request we don't know
* about, so we now either ignore the request
* or respond with CHANNEL_FAILURE, depending
* on want_reply.
*/
reply = SSH2_MSG_CHANNEL_FAILURE;
}
if (want_reply) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, reply);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, c->remoteid);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
ssh2_pkt_send(ssh, pktout);
}
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_global_request(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
int want_reply;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
get_string(pktin); /* ignore request type (see below) */
want_reply = get_bool(pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
/*
* We currently don't support any global requests
* at all, so we either ignore the request or
* respond with REQUEST_FAILURE, depending on
* want_reply.
*/
if (want_reply) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_REQUEST_FAILURE);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
ssh2_pkt_send(ssh, pktout);
}
}
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
static struct X11FakeAuth *(ssh_add_sharing_x11_display)(
ConnectionLayer *cl, int authtype, ssh_sharing_connstate *share_cs,
Expose structure tags for the connection-sharing data types. This was a particularly confusing piece of type-danger, because three different types were passed outside sshshare.c as 'void *' and only human vigilance prevented one coming back as the wrong one. Now they all keep their opaque structure tags when they move through other parts of the code.
2018-09-13 08:09:10 +00:00
share_channel *share_chan)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
{
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
Ssh ssh = FROMFIELD(cl, struct ssh_tag, cl);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
struct X11FakeAuth *auth;
/*
* Make up a new set of fake X11 auth data, and add it to the tree
* of currently valid ones with an indication of the sharing
* context that it's relevant to.
*/
auth = x11_invent_fake_auth(ssh->x11authtree, authtype);
auth->share_cs = share_cs;
auth->share_chan = share_chan;
return auth;
}
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
static void (ssh_remove_sharing_x11_display)(
ConnectionLayer *cl, struct X11FakeAuth *auth)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
{
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
Ssh ssh = FROMFIELD(cl, struct ssh_tag, cl);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
del234(ssh->x11authtree, auth);
x11_free_fake_auth(auth);
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_channel_open(Ssh ssh, PktIn *pktin)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
{
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen type;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
int peerport;
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
const char *error = NULL;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
struct ssh_channel *c;
unsigned remid, winsize, pktsize;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
type = get_string(pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
c = snew(struct ssh_channel);
c->ssh = ssh;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
remid = get_uint32(pktin);
winsize = get_uint32(pktin);
pktsize = get_uint32(pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
if (ptrlen_eq_string(type, "x11")) {
char *addrstr = mkstr(get_string(pktin));
peerport = get_uint32(pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
logeventf(ssh, "Received X11 connect request from %s:%d",
addrstr, peerport);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
if (!ssh->X11_fwd_enabled && !ssh->connshare)
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
error = "X11 forwarding is not enabled";
Get rid of the error-return mechanism from x11_init. Now that it doesn't actually make a network connection because that's deferred until after the X authorisation exchange, there's no point in having it return an error message and write the real output through a pointer argument. Instead, we can just have it return xconn directly and simplify the call sites. [originally from svn r10081]
2013-11-17 14:05:23 +00:00
else {
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
c->chan = x11_new_channel(ssh->x11authtree, &c->sc,
addrstr, peerport,
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
ssh->connshare != NULL);
Get rid of the error-return mechanism from x11_init. Now that it doesn't actually make a network connection because that's deferred until after the X authorisation exchange, there's no point in having it return an error message and write the real output through a pointer argument. Instead, we can just have it return xconn directly and simplify the call sites. [originally from svn r10081]
2013-11-17 14:05:23 +00:00
logevent("Opened X11 forward channel");
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
}
sfree(addrstr);
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
} else if (ptrlen_eq_string(type, "forwarded-tcpip")) {
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
struct ssh_rportfwd pf, *realpf;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen peeraddr;
pf.shost = mkstr(get_string(pktin));
pf.sport = get_uint32(pktin);
peeraddr = get_string(pktin);
peerport = get_uint32(pktin);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
realpf = find234(ssh->rportfwds, &pf, NULL);
Clean up the semantics of the ssh_rportfwd structure. It's now indexed by source hostname as well as source port (so that separate requests for the server to listen on addr1:1234 and addr2:1234 can be disambiguated), and also its destination host name is dynamically allocated rather than a fixed-size buffer. [originally from svn r10062]
2013-11-17 14:03:21 +00:00
logeventf(ssh, "Received remote port %s:%d open request "
Tighten up pointer handling after ssh_pkt_getstring. ssh_pkt_getstring can return (NULL,0) if the input packet is too short to contain a valid string. In quite a few places we were passing the returned pointer,length pair to a printf function with "%.*s" type format, which seems in practice to have not been dereferencing the pointer but the C standard doesn't actually guarantee that. In one place we were doing the same job by hand with memcpy, and apparently that _can_ dereference the pointer in practice (so a server could have caused a NULL-dereference crash by sending an appropriately malformed "x11" type channel open request). And also I spotted a logging call in the "forwarded-tcpip" channel open handler which had forgotten the field width completely, so it was erroneously relying on the string happening to be NUL-terminated in the received packet. I've tightened all of this up in general by normalising (NULL,0) to ("",0) before calling printf("%.*s"), and replacing the two even more broken cases with the corrected version of that same idiom.
2016-02-29 19:38:12 +00:00
"from %.*s:%d", pf.shost, pf.sport,
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
PTRLEN_PRINTF(peeraddr), peerport);
Clean up the semantics of the ssh_rportfwd structure. It's now indexed by source hostname as well as source port (so that separate requests for the server to listen on addr1:1234 and addr2:1234 can be disambiguated), and also its destination host name is dynamically allocated rather than a fixed-size buffer. [originally from svn r10062]
2013-11-17 14:03:21 +00:00
sfree(pf.shost);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
if (realpf == NULL) {
error = "Remote port is not recognised";
} else {
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
char *err;
if (realpf->share_ctx) {
/*
* This port forwarding is on behalf of a
* connection-sharing downstream, so abandon our own
* channel-open procedure and just pass the message on
* to sshshare.c.
*/
share_got_pkt_from_server(realpf->share_ctx, pktin->type,
Remove body and length fields from PktIn. They were duplicating values stored in the BinarySource substructure. Mostly they're not referred to directly any more (instead, we call get_foo to access the BinarySource); and when they are, we can switch to reading the same values back out of the BinarySource anyway.
2018-06-06 06:17:09 +00:00
BinarySource_UPCAST(pktin)->data,
BinarySource_UPCAST(pktin)->len);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
sfree(c);
return;
}
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
err = portfwdmgr_connect(
ssh->portfwdmgr, &c->chan, realpf->dhost, realpf->dport,
&c->sc, realpf->addressfamily);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
logeventf(ssh, "Attempting to forward remote port to "
"%s:%d", realpf->dhost, realpf->dport);
Refactor ssh.c's APIs to x11fwd.c and portfwd.c. The most important change is that, where previously ssh.c held the Socket pointer for each X11 and port forwarding, and the support modules would find their internal state structure by calling sk_get_private_ptr on that Socket, it's now the other way round. ssh.c now directly holds the internal state structure pointer for each forwarding, and when the support module needs the Socket it looks it up in a field of that. This will come in handy when I decouple socket creation from logical forwarding setup, so that X forwardings can delay actually opening a connection to an X server until they look at the authentication data and see which server it has to be. However, while I'm here, I've also taken the opportunity to clean up a few other points, notably error message handling, and also the fact that the same kind of state structure was used for both connection-type and listening-type port forwardings. Now there are separate PortForwarding and PortListener structure types, which seems far more sensible. [originally from svn r10074]
2013-11-17 14:04:41 +00:00
if (err != NULL) {
logeventf(ssh, "Port open failed: %s", err);
sfree(err);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
error = "Port open failed";
} else {
logevent("Forwarded port opened successfully");
}
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
} else if (ptrlen_eq_string(type, "auth-agent@openssh.com")) {
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
if (!ssh->agentfwd_enabled)
error = "Agent forwarding is not enabled";
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
else
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
c->chan = agentf_new(&c->sc);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
} else {
error = "Unsupported channel type requested";
}
c->remoteid = remid;
Don't abuse a remote channel number of (unsigned)(-1) to indicate a channel for which we don't yet have a remote number, and instead add a flag to indicate this fact. Fixes bug ssh-remoteid-minusone. [originally from svn r5171]
2005-01-22 16:06:21 +00:00
c->halfopen = FALSE;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
if (error) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_CHANNEL_OPEN_FAILURE);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, c->remoteid);
put_uint32(pktout, SSH2_OPEN_CONNECT_FAILED);
put_stringz(pktout, error);
put_stringz(pktout, "en"); /* language tag */
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
ssh2_pkt_send(ssh, pktout);
logeventf(ssh, "Rejected channel open: %s", error);
sfree(c);
} else {
Convert ssh2_channel_init() into ssh_channel_init(). By adding support for initialising SSH-1 channels as well. Now all newly-created channels go through this function.
2016-05-21 21:29:57 +00:00
ssh_channel_init(c);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
c->v.v2.remwindow = winsize;
c->v.v2.remmaxpkt = pktsize;
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
if (c->chan->initial_fixed_window_size) {
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
c->v.v2.locwindow = c->v.v2.locmaxwin = c->v.v2.remlocwin =
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
c->chan->initial_fixed_window_size;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
}
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, c->remoteid);
put_uint32(pktout, c->localid);
put_uint32(pktout, c->v.v2.locwindow);
put_uint32(pktout, OUR_V2_MAXPKT); /* our max pkt size */
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
ssh2_pkt_send(ssh, pktout);
}
}
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
static void sshchannel_x11_sharing_handover(
SshChannel *sc, ssh_sharing_connstate *share_cs, share_channel *share_chan,
const char *peer_addr, int peer_port, int endian,
int protomajor, int protominor, const void *initial_data, int initial_len)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
{
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
struct ssh_channel *c = FROMFIELD(sc, struct ssh_channel, sc);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
/*
* This function is called when we've just discovered that an X
* forwarding channel on which we'd been handling the initial auth
* ourselves turns out to be destined for a connection-sharing
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
* downstream. So we turn the channel into a sharing one, meaning
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
* that we completely stop tracking windows and buffering data and
* just pass more or less unmodified SSH messages back and forth.
*/
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
c->sharectx = share_cs;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
share_setup_x11_channel(share_cs, share_chan,
c->localid, c->remoteid, c->v.v2.remwindow,
c->v.v2.remmaxpkt, c->v.v2.locwindow,
peer_addr, peer_port, endian,
protomajor, protominor,
initial_data, initial_len);
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
chan_free(c->chan);
c->chan = NULL;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
}
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
static void sshchannel_window_override_removed(SshChannel *sc)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
{
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
struct ssh_channel *c = FROMFIELD(sc, struct ssh_channel, sc);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
/*
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
* This function is called when a client-side Channel has just
* stopped requiring an initial fixed-size window.
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
*/
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
assert(!c->chan->initial_fixed_window_size);
Stop calling ssh2_set_window in SSH-1! This must have been a bug introduced during the SSH-2 connection sharing rework. Apparently nobody's ever re-tested SSH-1 X forwarding since then - until I did so yesterday in the course of testing my enormous refactor of the packet unmarshalling code.
2018-06-03 06:11:10 +00:00
if (c->ssh->version == 2)
ssh2_set_window(
c, ssh_is_simple(c->ssh) ? OUR_V2_BIGWIN : OUR_V2_WINSIZE);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
}
Use the packet dispatch table to handle USERAUTH_BANNER messages, which should hopefully solve `drop-banner'. I haven't been able to test the failure case, but the behaviour with OpenSSH appears no worse. [originally from svn r5772] [this svn revision also touched putty-wishlist]
2005-05-12 15:09:35 +00:00
/*
Add an option to disable SSH-2 banners. [originally from svn r9055]
2010-12-27 01:19:13 +00:00
* Buffer banner messages for later display at some convenient point,
* if we're going to display them.
Use the packet dispatch table to handle USERAUTH_BANNER messages, which should hopefully solve `drop-banner'. I haven't been able to test the failure case, but the behaviour with OpenSSH appears no worse. [originally from svn r5772] [this svn revision also touched putty-wishlist]
2005-05-12 15:09:35 +00:00
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_userauth_banner(Ssh ssh, PktIn *pktin)
Use the packet dispatch table to handle USERAUTH_BANNER messages, which should hopefully solve `drop-banner'. I haven't been able to test the failure case, but the behaviour with OpenSSH appears no worse. [originally from svn r5772] [this svn revision also touched putty-wishlist]
2005-05-12 15:09:35 +00:00
{
/* Arbitrary limit to prevent unbounded inflation of buffer */
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_ssh_show_banner) &&
Add an option to disable SSH-2 banners. [originally from svn r9055]
2010-12-27 01:19:13 +00:00
bufchain_size(&ssh->banner) <= 131072) {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen banner = get_string(pktin);
if (banner.len)
Rework handling of untrusted terminal data. Now there's a centralised routine in misc.c to do the sanitisation, which copies data on to an outgoing bufchain. This allows me to remove from_backend_untrusted() completely from the frontend API, simplifying code in several places. Two use cases for untrusted-terminal-data sanitisation were in the terminal.c prompts handler, and in the collection of SSH-2 userauth banners. Both of those were writing output to a bufchain anyway, so it was very convenient to just replace a bufchain_add with sanitise_term_data and then not have to worry about it again. There was also a simplistic sanitiser in uxcons.c, which I've now replaced with a call to the good one - and in wincons.c there was a FIXME saying I ought to get round to that, which now I have!
2018-09-19 17:22:36 +00:00
sanitise_term_data(&ssh->banner, banner.ptr, banner.len);
Use the packet dispatch table to handle USERAUTH_BANNER messages, which should hopefully solve `drop-banner'. I haven't been able to test the failure case, but the behaviour with OpenSSH appears no worse. [originally from svn r5772] [this svn revision also touched putty-wishlist]
2005-05-12 15:09:35 +00:00
}
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_setup_x11(struct ssh_channel *c, PktIn *pktin,
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
void *ctx)
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
{
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
struct ssh2_setup_x11_state {
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
int crLine;
};
Ssh ssh = c->ssh;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
crStateP(ssh2_setup_x11_state, ctx);
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
crBeginState;
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
logevent("Requesting X11 forwarding");
pktout = ssh2_chanreq_init(ssh->mainchan, "x11-req",
ssh2_setup_x11, s);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_bool(pktout, 0); /* many connections */
put_stringz(pktout, ssh->x11auth->protoname);
put_stringz(pktout, ssh->x11auth->datastring);
put_uint32(pktout, ssh->x11disp->screennum);
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
ssh2_pkt_send(ssh, pktout);
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
In the various channel request mini-coroutines, replace crWaitUntilV(pktin) with plain crReturnV, because those coroutines can be called back either with a response packet from the channel request _or_ with NULL by ssh_free meaning 'please just clean yourself up'. [originally from svn r9927]
2013-07-14 17:08:35 +00:00
/* Wait to be called back with either a response packet, or NULL
* meaning clean up and free our data */
crReturnV;
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
if (pktin) {
if (pktin->type == SSH2_MSG_CHANNEL_SUCCESS) {
logevent("X11 forwarding enabled");
ssh->X11_fwd_enabled = TRUE;
} else
logevent("X11 forwarding refused");
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
}
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
Slightly simplify crFinishFree{,V}. They're only likely to be useful for freeing a coroutine state structure, in which case there's no need to reset the line number (since all such coroutines keep their line number in the state structure) and the state structure pointer is always called "s". [originally from svn r9632]
2012-08-27 18:44:06 +00:00
crFinishFreeV;
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_setup_agent(struct ssh_channel *c, PktIn *pktin,
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
void *ctx)
{
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
struct ssh2_setup_agent_state {
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
int crLine;
};
Ssh ssh = c->ssh;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
crStateP(ssh2_setup_agent_state, ctx);
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
crBeginState;
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
logevent("Requesting OpenSSH-style agent forwarding");
pktout = ssh2_chanreq_init(ssh->mainchan, "auth-agent-req@openssh.com",
ssh2_setup_agent, s);
ssh2_pkt_send(ssh, pktout);
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
In the various channel request mini-coroutines, replace crWaitUntilV(pktin) with plain crReturnV, because those coroutines can be called back either with a response packet from the channel request _or_ with NULL by ssh_free meaning 'please just clean yourself up'. [originally from svn r9927]
2013-07-14 17:08:35 +00:00
/* Wait to be called back with either a response packet, or NULL
* meaning clean up and free our data */
crReturnV;
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
if (pktin) {
if (pktin->type == SSH2_MSG_CHANNEL_SUCCESS) {
logevent("Agent forwarding enabled");
ssh->agentfwd_enabled = TRUE;
} else
logevent("Agent forwarding refused");
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
}
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
Slightly simplify crFinishFree{,V}. They're only likely to be useful for freeing a coroutine state structure, in which case there's no need to reset the line number (since all such coroutines keep their line number in the state structure) and the state structure pointer is always called "s". [originally from svn r9632]
2012-08-27 18:44:06 +00:00
crFinishFreeV;
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_setup_pty(struct ssh_channel *c, PktIn *pktin,
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
void *ctx)
{
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
struct ssh2_setup_pty_state {
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
int crLine;
};
Ssh ssh = c->ssh;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
crStateP(ssh2_setup_pty_state, ctx);
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
crBeginState;
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
/* Unpick the terminal-speed string. */
/* XXX perhaps we should allow no speeds to be sent. */
ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
sscanf(conf_get_str(ssh->conf, CONF_termspeed), "%d,%d", &ssh->ospeed, &ssh->ispeed);
/* Build the pty request. */
pktout = ssh2_chanreq_init(ssh->mainchan, "pty-req",
ssh2_setup_pty, s);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(pktout, conf_get_str(ssh->conf, CONF_termtype));
put_uint32(pktout, ssh->term_width);
put_uint32(pktout, ssh->term_height);
put_uint32(pktout, 0); /* pixel width */
put_uint32(pktout, 0); /* pixel height */
Clean up the parse_ssh_ttymodes system. There's no reason to pass a 'void *' through and then cast it back to a packet. All those functions are really doing is serialising a pile of output on to an arbitrary receiver, so it's nicer to use the new abstract BinarySink type, and then the do_mode function doesn't have to cast it at all. This also removes one lingering ugliness from the previous commit, in the form of the variable 'stringstart' I introduced in ssh2_setup_pty to work around the removal of the addstring_start system. Now that's done the sensible way, by constructing the subsidiary terminal-modes string in a strbuf (taking advantage of the new type-genericity meaning I can pass that to the underlying functions just as easily as a struct Packet), and then putting that into the final packet afterwards.
2018-05-24 09:39:07 +00:00
{
strbuf *modebuf = strbuf_new();
Move the ttymode formatter into sshcommon.c. While I'm at it, I've brought it all into a single function: the parsing of data from Conf, the list of modes, and even the old callback system for writing to the destination buffer is now a simple if statement that formats mode parameters as byte or uint32 depending on SSH version. Also, the terminal speeds and the end byte are part of the same setup, so it's all together in one place instead of scattered all over ssh.c.
2018-09-19 19:36:40 +00:00
write_ttymodes_to_packet_from_conf(
BinarySink_UPCAST(modebuf), ssh->frontend, ssh->conf,
2, ssh->ospeed, ssh->ispeed);
Clean up the parse_ssh_ttymodes system. There's no reason to pass a 'void *' through and then cast it back to a packet. All those functions are really doing is serialising a pile of output on to an arbitrary receiver, so it's nicer to use the new abstract BinarySink type, and then the do_mode function doesn't have to cast it at all. This also removes one lingering ugliness from the previous commit, in the form of the variable 'stringstart' I introduced in ssh2_setup_pty to work around the removal of the addstring_start system. Now that's done the sensible way, by constructing the subsidiary terminal-modes string in a strbuf (taking advantage of the new type-genericity meaning I can pass that to the underlying functions just as easily as a struct Packet), and then putting that into the final packet afterwards.
2018-05-24 09:39:07 +00:00
put_stringsb(pktout, modebuf);
}
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
ssh2_pkt_send(ssh, pktout);
ssh->state = SSH_STATE_INTERMED;
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
In the various channel request mini-coroutines, replace crWaitUntilV(pktin) with plain crReturnV, because those coroutines can be called back either with a response packet from the channel request _or_ with NULL by ssh_free meaning 'please just clean yourself up'. [originally from svn r9927]
2013-07-14 17:08:35 +00:00
/* Wait to be called back with either a response packet, or NULL
* meaning clean up and free our data */
crReturnV;
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
if (pktin) {
if (pktin->type == SSH2_MSG_CHANNEL_SUCCESS) {
logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
ssh->ospeed, ssh->ispeed);
ssh->got_pty = TRUE;
} else {
c_write_str(ssh, "Server refused to allocate pty\r\n");
ssh->editing = ssh->echoing = 1;
}
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
}
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
Slightly simplify crFinishFree{,V}. They're only likely to be useful for freeing a coroutine state structure, in which case there's no need to reset the line number (since all such coroutines keep their line number in the state structure) and the state structure pointer is always called "s". [originally from svn r9632]
2012-08-27 18:44:06 +00:00
crFinishFreeV;
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_setup_env(struct ssh_channel *c, PktIn *pktin,
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
void *ctx)
{
struct ssh2_setup_env_state {
int crLine;
int num_env, env_left, env_ok;
};
Ssh ssh = c->ssh;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
crStateP(ssh2_setup_env_state, ctx);
crBeginState;
/*
* Send environment variables.
*
* Simplest thing here is to send all the requests at once, and
* then wait for a whole bunch of successes or failures.
*/
s->num_env = 0;
Rename the various ssh2_maybe_setup_* functions to ssh2_setup_*, and move the primary conditions out of them into their callers. Fixes a crash in 'plink -N', since those functions would be called with a NULL channel parameter and immediately dereference it to try to get c->ssh. [originally from svn r9644]
2012-08-30 18:44:35 +00:00
{
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
char *key, *val;
for (val = conf_get_str_strs(ssh->conf, CONF_environmt, NULL, &key);
val != NULL;
val = conf_get_str_strs(ssh->conf, CONF_environmt, key, &key)) {
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
pktout = ssh2_chanreq_init(ssh->mainchan, "env", ssh2_setup_env, s);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(pktout, key);
put_stringz(pktout, val);
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
ssh2_pkt_send(ssh, pktout);
s->num_env++;
}
if (s->num_env)
logeventf(ssh, "Sent %d environment variables", s->num_env);
}
if (s->num_env) {
s->env_ok = 0;
s->env_left = s->num_env;
while (s->env_left > 0) {
In the various channel request mini-coroutines, replace crWaitUntilV(pktin) with plain crReturnV, because those coroutines can be called back either with a response packet from the channel request _or_ with NULL by ssh_free meaning 'please just clean yourself up'. [originally from svn r9927]
2013-07-14 17:08:35 +00:00
/* Wait to be called back with either a response packet,
* or NULL meaning clean up and free our data */
crReturnV;
Better handling of outstanding CHANNEL_REQUESTS on channel destruction. Part the first: make sure that all structures describing channel requests are freed when the SSH connection is freed. This involves adding a means to ask a response handler to free any memory it holds. Part the second: in ssh_channel_try_eof(), call ssh2_channel_check_close() rather than emitting an SSH_MSG_CHANNEL_EOF directly. This avoids the possibility of closing the channel while a CHANNEL_REQUEST is outstanding. Also add some assertions that helped with tracking down the latter problem. [originally from svn r9623]
2012-08-25 21:06:48 +00:00
if (!pktin) goto out;
Simplify handling of responses to channel requests. The various setup routines can only receive CHANNEL_SUCCESS or CHANNEL_FAILURE, so there's no need for the to worry about receiving anything else. Strange packets will end up in do_ssh2_authconn instead. [originally from svn r9619]
2012-08-25 15:04:29 +00:00
if (pktin->type == SSH2_MSG_CHANNEL_SUCCESS)
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
s->env_ok++;
s->env_left--;
}
if (s->env_ok == s->num_env) {
logevent("All environment variables successfully set");
} else if (s->env_ok == 0) {
logevent("All environment variables refused");
c_write_str(ssh, "Server refused to set environment variables\r\n");
} else {
logeventf(ssh, "%d environment variables refused",
s->num_env - s->env_ok);
c_write_str(ssh, "Server refused to set all environment variables\r\n");
}
}
It's not legal to free a coroutine's state structure before invoking crFinish or crFinishV, since they will attempt to write to the coroutine state variable contained in that structure. Introduced some new all-in-one macros crFinishFree and crFinishFreeV, and used those instead. Should fix today's report of a crash just after authentication. [originally from svn r9630]
2012-08-27 14:34:41 +00:00
out:;
Slightly simplify crFinishFree{,V}. They're only likely to be useful for freeing a coroutine state structure, in which case there's no need to reset the line number (since all such coroutines keep their line number in the state structure) and the state structure pointer is always called "s". [originally from svn r9632]
2012-08-27 18:44:06 +00:00
crFinishFreeV;
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
}
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
/*
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
* Handle the SSH-2 userauth layer.
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_userauth(Ssh ssh, PktIn *pktin)
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
{
do_ssh2_authconn: get packets from a PacketQueue. Just like do_ssh1_login, do_ssh2_authconn is now no longer receiving its packets via function arguments; instead, it's pulling them off a dedicated PacketQueue populated by particular dispatch table entries, with the same reference-counting system to stop them being freed when the pq_full processing function regains control. This eliminates further ugly bombout()s from the code while waiting for authentication responses from the user or the SSH agent. As I mentioned in the previous commit, I've had to keep ssh2_authconn_input separate from do_ssh2_authconn, and this time the reason why is thoroughly annoying: it's because do_ssh2_authconn has changed its prototype to take the Ssh structure as a void * so that it can be called from the idempotent callback system, whereas ssh2_authconn_input has to have the type of ssh->current_user_input_fn which takes the more sensible pointer type 'Ssh'.
2018-05-18 06:22:58 +00:00
pktin->refcount++; /* avoid packet being freed when we return */
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
pq_push(&ssh->pq_ssh2_userauth, pktin);
Install ssh-connection packet handlers synchronously. I had a one-off 'Strange packet received' error yesterday for an SSH_MSG_GLOBAL_REQUEST at connection startup. I wasn't able to reproduce, but examining the packet logs from the successful retry suggested that the global request in question was an OpenSSH 'here are my hostkeys' message. My belief is that in the failing connection that request packet must have arrived exceptionally promptly, and been added to pq_full before the preceding SSH_MSG_USERAUTH_SUCCESS had been processed. So the code that loops along pq_full feeding everything to the dispatch table would have moved the USERAUTH_SUCCESS on to pq_ssh2_userauth and scheduled a callback to handle it, and then moved on to the GLOBAL_REQUEST which would have gone straight to the dispatch table handler for 'help, we weren't expecting this message'. The userauth callback would later on have installed a more sensible dispatch table handler for global requests, but by then, it was too late. Solution: make a special case during pq_full processing, so that when we see USERAUTH_SUCCESS we _immediately_ - before continuing to traverse pq_full - install the initial dispatch table entries for the ssh-connection protocol. That way, even if connection messages are already in the queue, we won't get confused by them.
2018-05-31 17:42:47 +00:00
if (pktin->type == SSH2_MSG_USERAUTH_SUCCESS) {
/*
* The very instant we see this message, the connection
* protocol has officially started, which means we must
* install the dispatch-table entries for all the
* connection-layer messages. In particular, we must do this
* _before_ we return to the loop in ssh_process_pq_full
* that's processing the currently queued packets through the
* dispatch table, because if (say) an SSH_MSG_GLOBAL_REQUEST
* is already pending in pq_full, we can't afford to delay
* installing its dispatch table entry until after that queue
* run is done.
*/
ssh2_connection_setup(ssh);
}
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
queue_idempotent_callback(&ssh->ssh2_userauth_icb);
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
}
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
static void do_ssh2_userauth(void *vctx)
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
{
do_ssh2_authconn: get packets from a PacketQueue. Just like do_ssh1_login, do_ssh2_authconn is now no longer receiving its packets via function arguments; instead, it's pulling them off a dedicated PacketQueue populated by particular dispatch table entries, with the same reference-counting system to stop them being freed when the pq_full processing function regains control. This eliminates further ugly bombout()s from the code while waiting for authentication responses from the user or the SSH agent. As I mentioned in the previous commit, I've had to keep ssh2_authconn_input separate from do_ssh2_authconn, and this time the reason why is thoroughly annoying: it's because do_ssh2_authconn has changed its prototype to take the Ssh structure as a void * so that it can be called from the idempotent callback system, whereas ssh2_authconn_input has to have the type of ssh->current_user_input_fn which takes the more sensible pointer type 'Ssh'.
2018-05-18 06:22:58 +00:00
Ssh ssh = (Ssh)vctx;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktIn *pktin;
do_ssh2_authconn: get packets from a PacketQueue. Just like do_ssh1_login, do_ssh2_authconn is now no longer receiving its packets via function arguments; instead, it's pulling them off a dedicated PacketQueue populated by particular dispatch table entries, with the same reference-counting system to stop them being freed when the pq_full processing function regains control. This eliminates further ugly bombout()s from the code while waiting for authentication responses from the user or the SSH agent. As I mentioned in the previous commit, I've had to keep ssh2_authconn_input separate from do_ssh2_authconn, and this time the reason why is thoroughly annoying: it's because do_ssh2_authconn has changed its prototype to take the Ssh structure as a void * so that it can be called from the idempotent callback system, whereas ssh2_authconn_input has to have the type of ssh->current_user_input_fn which takes the more sensible pointer type 'Ssh'.
2018-05-18 06:22:58 +00:00
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
struct do_ssh2_userauth_state {
Tweak to SSH coroutine code: put line number in the coroutine state structure, which is consistent with Simon's canonical version of the macros. [originally from svn r9607]
2012-08-18 09:30:01 +00:00
int crLine;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
enum {
AUTH_TYPE_NONE,
AUTH_TYPE_PUBLICKEY,
AUTH_TYPE_PUBLICKEY_OFFER_LOUD,
AUTH_TYPE_PUBLICKEY_OFFER_QUIET,
AUTH_TYPE_PASSWORD,
Reorganise the logging and display of messages about SSH authentication. We should now produce an Event Log entry for every authentication attempted and every authentication failure; meanwhile, messages in the PuTTY window will not be generated for the failure of auth types unless we also announced in the PuTTY window that we were trying them. (GSSAPI was getting the latter wrong, leading to spurious 'Access denied' for many users of 0.61.) [originally from svn r9226]
2011-07-16 12:06:32 +00:00
AUTH_TYPE_GSSAPI, /* always QUIET */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
AUTH_TYPE_KEYBOARD_INTERACTIVE,
AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
} type;
Implement `bypass-ssh2-userauth', since from correspondence it sounds like there are servers which could in principle operate in this mode, although I don't know if any do in practice. (Hence, I haven't been able to test it.) [originally from svn r5748] [this svn revision also touched putty-wishlist]
2005-05-05 22:37:54 +00:00
int done_service_req;
do_ssh2_authconn: replace s->gotit with pq_push_front. The userauth loop has always had a rather awkward feature whereby some of its branches have _already_ received an SSH_MSG_USERAUTH_SUCCESS or SSH_MSG_USERAUTH_FAILURE packet (e.g. because they have to wait for a packet that might be one of those _or_ a continuation packet of some kind), whereas other branches go back round to the top of the loop at the moment that they know one of those will be the next packet to arrive. So we had a flag 's->gotit' which tells the start of the loop whether it's already sitting on the success or failure message, or whether the first thing it should do is to crWait for one. Now that the packets are coming from a linked list, there's a simpler way to handle this: the top of the userauth loop _always_ expects to find a success/failure message as the first thing in the queue, and if any branch of the auth code finds it's already removed such a message from the queue, it can simply put it back on the front again before going back round.
2018-05-18 06:22:58 +00:00
int need_pw, can_pubkey, can_passwd, can_keyb_inter;
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
int userpass_ret;
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
int tried_pubkey_config, done_agent;
At some point recently, Unix PuTTY started suffering build errors using -DNO_GSSAPI. Move some ifdefs around so it stops. [originally from svn r8370]
2008-12-02 18:18:32 +00:00
#ifndef NO_GSSAPI
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
int can_gssapi;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
int can_gssapi_keyex_auth;
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
int tried_gssapi;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
int tried_gssapi_keyex_auth;
time_t gss_cred_expiry;
At some point recently, Unix PuTTY started suffering build errors using -DNO_GSSAPI. Move some ifdefs around so it stops. [originally from svn r8370]
2008-12-02 18:18:32 +00:00
#endif
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
int kbd_inter_refused;
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
int we_are_in, userauth_success;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
prompts_t *cur_prompt;
int num_prompts;
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
char *username;
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
char *password;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int got_username;
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf *publickey_blob;
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
int privatekey_available, privatekey_encrypted;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
char *publickey_algorithm;
char *publickey_comment;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
unsigned char *agent_response;
BinarySource asrc[1]; /* for reading SSH agent response */
size_t pkblob_pos_in_agent;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
int keyi, nkeys;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
ptrlen pk, alg, comment;
int len;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
Filename *keyfile;
At some point recently, Unix PuTTY started suffering build errors using -DNO_GSSAPI. Move some ifdefs around so it stops. [originally from svn r8370]
2008-12-02 18:18:32 +00:00
#ifndef NO_GSSAPI
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
Ssh_gss_ctx gss_ctx;
Ssh_gss_buf gss_buf;
Ssh_gss_buf gss_rcvtok, gss_sndtok;
Ssh_gss_stat gss_stat;
At some point recently, Unix PuTTY started suffering build errors using -DNO_GSSAPI. Move some ifdefs around so it stops. [originally from svn r8370]
2008-12-02 18:18:32 +00:00
#endif
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
};
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crState(do_ssh2_userauth_state);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Tweak to SSH coroutine code: put line number in the coroutine state structure, which is consistent with Simon's canonical version of the macros. [originally from svn r9607]
2012-08-18 09:30:01 +00:00
crBeginState;
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
/* Register as a handler for all the messages this coroutine handles. */
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh->packet_dispatch[SSH2_MSG_SERVICE_ACCEPT] = ssh2_msg_userauth;
ssh->packet_dispatch[SSH2_MSG_USERAUTH_REQUEST] = ssh2_msg_userauth;
ssh->packet_dispatch[SSH2_MSG_USERAUTH_FAILURE] = ssh2_msg_userauth;
ssh->packet_dispatch[SSH2_MSG_USERAUTH_SUCCESS] = ssh2_msg_userauth;
ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = ssh2_msg_userauth;
ssh->packet_dispatch[SSH2_MSG_USERAUTH_PK_OK] = ssh2_msg_userauth;
/* ssh->packet_dispatch[SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ] = ssh2_msg_userauth; duplicate case value */
/* ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_REQUEST] = ssh2_msg_userauth; duplicate case value */
ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_RESPONSE] = ssh2_msg_userauth;
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
Implement `bypass-ssh2-userauth', since from correspondence it sounds like there are servers which could in principle operate in this mode, although I don't know if any do in practice. (Hence, I haven't been able to test it.) [originally from svn r5748] [this svn revision also touched putty-wishlist]
2005-05-05 22:37:54 +00:00
s->done_service_req = FALSE;
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
s->we_are_in = s->userauth_success = FALSE;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
s->agent_response = NULL;
At some point recently, Unix PuTTY started suffering build errors using -DNO_GSSAPI. Move some ifdefs around so it stops. [originally from svn r8370]
2008-12-02 18:18:32 +00:00
#ifndef NO_GSSAPI
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
s->tried_gssapi = FALSE;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->tried_gssapi_keyex_auth = FALSE;
At some point recently, Unix PuTTY started suffering build errors using -DNO_GSSAPI. Move some ifdefs around so it stops. [originally from svn r8370]
2008-12-02 18:18:32 +00:00
#endif
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
if (!conf_get_int(ssh->conf, CONF_ssh_no_userauth)) {
/*
* Request userauth protocol, and await a response to it.
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_SERVICE_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "ssh-userauth");
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh2_pkt_send(ssh, s->pktout);
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
if (pktin->type == SSH2_MSG_SERVICE_ACCEPT)
s->done_service_req = TRUE;
}
if (!s->done_service_req) {
/*
* Request connection protocol directly, without authentication.
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_SERVICE_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "ssh-connection");
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh2_pkt_send(ssh, s->pktout);
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
if (pktin->type == SSH2_MSG_SERVICE_ACCEPT) {
s->we_are_in = TRUE; /* no auth required */
} else {
bombout(("Server refused service request"));
crStopV;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
}
Prevent network errors from summarily closing the window when CoE is off [originally from svn r613]
2000-09-22 11:04:57 +00:00
}
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* Arrange to be able to deal with any BANNERs that come in.
* (We do this now as packets may come in during the next bit.) */
bufchain_init(&ssh->banner);
ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] =
ssh2_msg_userauth_banner;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/*
* Misc one-time setup for authentication.
*/
s->publickey_blob = NULL;
if (!s->we_are_in) {
/*
* Load the public half of any configured public key file
* for later use.
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
Turn 'Filename' into a dynamically allocated type with no arbitrary length limit, just as I did to FontSpec yesterday. [originally from svn r9316]
2011-10-02 11:01:57 +00:00
if (!filename_is_null(s->keyfile)) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
int keytype;
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
logeventf(ssh, "Reading key file \"%.150s\"",
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
filename_to_str(s->keyfile));
keytype = key_type(s->keyfile);
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
if (keytype == SSH_KEYTYPE_SSH2 ||
keytype == SSH_KEYTYPE_SSH2_PUBLIC_RFC4716 ||
keytype == SSH_KEYTYPE_SSH2_PUBLIC_OPENSSH) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
const char *error;
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
s->publickey_blob = strbuf_new();
if (ssh2_userkey_loadpub(s->keyfile,
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
&s->publickey_algorithm,
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
BinarySink_UPCAST(s->publickey_blob),
&s->publickey_comment, &error)) {
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
s->privatekey_available = (keytype == SSH_KEYTYPE_SSH2);
if (!s->privatekey_available)
logeventf(ssh, "Key file contains public key only");
s->privatekey_encrypted =
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
ssh2_userkey_encrypted(s->keyfile, NULL);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else {
char *msgbuf;
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
logeventf(ssh, "Unable to load key (%s)",
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
error);
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
msgbuf = dupprintf("Unable to load key file "
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
"\"%.150s\" (%s)\r\n",
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
filename_to_str(s->keyfile),
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
error);
c_write_str(ssh, msgbuf);
sfree(msgbuf);
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf_free(s->publickey_blob);
s->publickey_blob = NULL;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
} else {
char *msgbuf;
logeventf(ssh, "Unable to use this key file (%s)",
key_type_to_str(keytype));
msgbuf = dupprintf("Unable to use key file \"%.150s\""
" (%s)\r\n",
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
filename_to_str(s->keyfile),
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
key_type_to_str(keytype));
c_write_str(ssh, msgbuf);
sfree(msgbuf);
s->publickey_blob = NULL;
}
}
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/*
* Find out about any keys Pageant has (but if there's a
* public key configured, filter out all others).
*/
s->nkeys = 0;
s->agent_response = NULL;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
s->pkblob_pos_in_agent = 0;
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_tryagent) && agent_exists()) {
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
void *r;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
int rlen;
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
strbuf *agent_request;
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
logevent("Pageant is running. Requesting keys.");
/* Request the keys held by the agent. */
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
agent_request = strbuf_new_for_agent_query();
put_byte(agent_request, SSH2_AGENTC_REQUEST_IDENTITIES);
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
ssh->auth_agent_query = agent_query(
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
agent_request, &r, &rlen, ssh_agent_callback, ssh);
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
strbuf_free(agent_request);
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
if (ssh->auth_agent_query) {
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
ssh->agent_response = NULL;
do_ssh2_authconn: get packets from a PacketQueue. Just like do_ssh1_login, do_ssh2_authconn is now no longer receiving its packets via function arguments; instead, it's pulling them off a dedicated PacketQueue populated by particular dispatch table entries, with the same reference-counting system to stop them being freed when the pq_full processing function regains control. This eliminates further ugly bombout()s from the code while waiting for authentication responses from the user or the SSH agent. As I mentioned in the previous commit, I've had to keep ssh2_authconn_input separate from do_ssh2_authconn, and this time the reason why is thoroughly annoying: it's because do_ssh2_authconn has changed its prototype to take the Ssh structure as a void * so that it can be called from the idempotent callback system, whereas ssh2_authconn_input has to have the type of ssh->current_user_input_fn which takes the more sensible pointer type 'Ssh'.
2018-05-18 06:22:58 +00:00
crWaitUntilV(ssh->agent_response);
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
r = ssh->agent_response;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
rlen = ssh->agent_response_len;
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
}
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
s->agent_response = r;
BinarySource_BARE_INIT(s->asrc, r, rlen);
get_uint32(s->asrc); /* skip length field */
if (get_byte(s->asrc) == SSH2_AGENT_IDENTITIES_ANSWER) {
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
int keyi;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
s->nkeys = toint(get_uint32(s->asrc));
Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918]
2013-07-14 10:45:54 +00:00
/*
* Vet the Pageant response to ensure that the key
* count and blob lengths make sense.
*/
if (s->nkeys < 0) {
logeventf(ssh, "Pageant response contained a negative"
" key count %d", s->nkeys);
s->nkeys = 0;
goto done_agent_query;
} else {
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
logeventf(ssh, "Pageant has %d SSH-2 keys", s->nkeys);
Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918]
2013-07-14 10:45:54 +00:00
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
/* See if configured key is in agent. */
Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918]
2013-07-14 10:45:54 +00:00
for (keyi = 0; keyi < s->nkeys; keyi++) {
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
size_t pos = s->asrc->pos;
ptrlen blob = get_string(s->asrc);
get_string(s->asrc); /* skip comment */
if (get_err(s->asrc)) {
Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918]
2013-07-14 10:45:54 +00:00
logeventf(ssh, "Pageant response was truncated");
s->nkeys = 0;
goto done_agent_query;
}
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
if (s->publickey_blob &&
blob.len == s->publickey_blob->len &&
!memcmp(blob.ptr, s->publickey_blob->s,
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
s->publickey_blob->len)) {
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
logeventf(ssh, "Pageant key #%d matches "
"configured key file", keyi);
s->keyi = keyi;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
s->pkblob_pos_in_agent = pos;
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
break;
}
}
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
if (s->publickey_blob && !s->pkblob_pos_in_agent) {
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
logevent("Configured key file not in Pageant");
s->nkeys = 0;
}
}
When we fail to get a response from Pageant, we should log the fact. Currently, if the IPC exchange goes wrong, the Event Log just prints "Pageant is running. Requesting keys." and then goes on to the next step without ever saying what happened. [originally from svn r9177]
2011-06-08 20:39:06 +00:00
} else {
logevent("Failed to get reply from Pageant");
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
}
Tighten up a lot of casts from unsigned to int which are read by one of the GET_32BIT macros and then used as length fields. Missing bounds checks against zero have been added, and also I've introduced a helper function toint() which casts from unsigned to int in such a way as to avoid C undefined behaviour, since I'm not sure I trust compilers any more to do the obviously sensible thing. [originally from svn r9918]
2013-07-14 10:45:54 +00:00
done_agent_query:;
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
/*
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
* We repeat this whole loop, including the username prompt,
* until we manage a successful authentication. If the user
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
* types the wrong _password_, they can be sent back to the
* beginning to try another username, if this is configured on.
* (If they specify a username in the config, they are never
* asked, even if they do give a wrong password.)
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
*
* I think this best serves the needs of
*
* - the people who have no configuration, no keys, and just
* want to try repeated (username,password) pairs until they
* type both correctly
*
* - people who have keys and configuration but occasionally
* need to fall back to passwords
*
* - people with a key held in Pageant, who might not have
* logged in to a particular machine before; so they want to
* type a username, and then _either_ their key will be
* accepted, _or_ they will type a password. If they mistype
* the username they will want to be able to get back and
* retype it!
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
*/
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->got_username = FALSE;
Implement `bypass-ssh2-userauth', since from correspondence it sounds like there are servers which could in principle operate in this mode, although I don't know if any do in practice. (Hence, I haven't been able to test it.) [originally from svn r5748] [this svn revision also touched putty-wishlist]
2005-05-05 22:37:54 +00:00
while (!s->we_are_in) {
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
/*
* Get a username.
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (s->got_username && !conf_get_int(ssh->conf, CONF_change_username)) {
Disable username switching between SSH2 auth attempts, and add a configurable option so users can re-enable the feature _if_ they know they have an SSH2 server that isn't going to get shirty about it. Inspired by a spectacular increase in OpenSSH's shirtiness. [originally from svn r1474]
2001-12-11 21:00:01 +00:00
/*
* We got a username last time round this loop, and
* with change_username turned off we don't try to get
* it again.
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
} else if ((ssh->username = get_remote_username(ssh->conf)) == NULL) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
s->cur_prompt = new_prompts(ssh->frontend);
s->cur_prompt->to_server = TRUE;
s->cur_prompt->name = dupstr("SSH login name");
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
add_prompt(s->cur_prompt, dupstr("login as: "), TRUE);
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(s->cur_prompt, NULL);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
while (1) {
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
while (s->userpass_ret < 0 &&
bufchain_size(&ssh->user_input) > 0)
s->userpass_ret = get_userpass_input(
s->cur_prompt, &ssh->user_input);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
if (s->userpass_ret >= 0)
break;
ssh->send_ok = 1;
crReturnV;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
ssh->send_ok = 0;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
if (!s->userpass_ret) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/*
* get_userpass_input() failed to get a username.
* Terminate.
*/
free_prompts(s->cur_prompt);
ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
crStopV;
}
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
ssh->username = dupstr(s->cur_prompt->prompts[0]->result);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
free_prompts(s->cur_prompt);
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
} else {
Robustness fixes for KEXINIT handling and others. In particular, I've created a self-mallocing variant of sprintf, to obviate any future need for paranoid %.100s type stuff in format strings. [originally from svn r2199]
2002-11-07 19:49:03 +00:00
char *stuff;
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
stuff = dupprintf("Using username \"%s\".\r\n", ssh->username);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write_str(ssh, stuff);
Robustness fixes for KEXINIT handling and others. In particular, I've created a self-mallocing variant of sprintf, to obviate any future need for paranoid %.100s type stuff in format strings. [originally from svn r2199]
2002-11-07 19:49:03 +00:00
sfree(stuff);
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
}
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->got_username = TRUE;
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
/*
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
* Send an authentication request using method "none": (a)
* just in case it succeeds, and (b) so that we know what
* authentication methods we can usefully try next.
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.actx = SSH2_PKTCTX_NOAUTH;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_USERAUTH_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, ssh->username);
put_stringz(s->pktout, "ssh-connection");/* service requested */
put_stringz(s->pktout, "none"); /* method */
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
ssh2_pkt_send(ssh, s->pktout);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->type = AUTH_TYPE_NONE;
s->we_are_in = FALSE;
s->tried_pubkey_config = FALSE;
`kbdint-failure': we now offer keyboard-interactive auth to the user for as long as the server offers it, rather than only once, unless the server responds to our initial USERAUTH_REQUEST("keyboard-interactive") with FAILURE, in which case we give up on it entirely. [originally from svn r5068] [this svn revision also touched putty-wishlist]
2005-01-06 13:23:47 +00:00
s->kbd_inter_refused = FALSE;
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* Reset agent request state. */
s->done_agent = FALSE;
if (s->agent_response) {
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
if (s->pkblob_pos_in_agent) {
s->asrc->pos = s->pkblob_pos_in_agent;
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
} else {
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
s->asrc->pos = 9; /* skip length + type + key count */
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
s->keyi = 0;
}
}
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
while (1) {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen methods;
methods.ptr = "";
methods.len = 0;
When we disconnect because we have no supported authentication methods left to try, it's nice to have the version of that message going to the client contain the list of methods sent by the server. Saves a user having to pull it out of an SSH packet log. [originally from svn r8981]
2010-08-10 18:45:51 +00:00
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
/*
* Wait for the result of the last authentication request.
*/
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
do_ssh2_authconn: replace s->gotit with pq_push_front. The userauth loop has always had a rather awkward feature whereby some of its branches have _already_ received an SSH_MSG_USERAUTH_SUCCESS or SSH_MSG_USERAUTH_FAILURE packet (e.g. because they have to wait for a packet that might be one of those _or_ a continuation packet of some kind), whereas other branches go back round to the top of the loop at the moment that they know one of those will be the next packet to arrive. So we had a flag 's->gotit' which tells the start of the loop whether it's already sitting on the success or failure message, or whether the first thing it should do is to crWait for one. Now that the packets are coming from a linked list, there's a simpler way to handle this: the top of the userauth loop _always_ expects to find a success/failure message as the first thing in the queue, and if any branch of the auth code finds it's already removed such a message from the queue, it can simply put it back on the front again before going back round.
2018-05-18 06:22:58 +00:00
Use the packet dispatch table to handle USERAUTH_BANNER messages, which should hopefully solve `drop-banner'. I haven't been able to test the failure case, but the behaviour with OpenSSH appears no worse. [originally from svn r5772] [this svn revision also touched putty-wishlist]
2005-05-12 15:09:35 +00:00
/*
* Now is a convenient point to spew any banner material
* that we've accumulated. (This should ensure that when
* we exit the auth loop, we haven't any left to deal
* with.)
*/
{
int size = bufchain_size(&ssh->banner);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
/*
* Don't show the banner if we're operating in
* non-verbose non-interactive mode. (It's probably
* a script, which means nobody will read the
* banner _anyway_, and moreover the printing of
* the banner will screw up processing on the
* output of (say) plink.)
Rework handling of untrusted terminal data. Now there's a centralised routine in misc.c to do the sanitisation, which copies data on to an outgoing bufchain. This allows me to remove from_backend_untrusted() completely from the frontend API, simplifying code in several places. Two use cases for untrusted-terminal-data sanitisation were in the terminal.c prompts handler, and in the collection of SSH-2 userauth banners. Both of those were writing output to a bufchain anyway, so it was very convenient to just replace a bufchain_add with sanitise_term_data and then not have to worry about it again. There was also a simplistic sanitiser in uxcons.c, which I've now replaced with a call to the good one - and in wincons.c there was a FIXME saying I ought to get round to that, which now I have!
2018-09-19 17:22:36 +00:00
*
* The banner data has been sanitised already by this
* point, so we can safely send it straight to the
* output channel.
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
*/
Use the packet dispatch table to handle USERAUTH_BANNER messages, which should hopefully solve `drop-banner'. I haven't been able to test the failure case, but the behaviour with OpenSSH appears no worse. [originally from svn r5772] [this svn revision also touched putty-wishlist]
2005-05-12 15:09:35 +00:00
if (size && (flags & (FLAG_VERBOSE | FLAG_INTERACTIVE))) {
char *banner = snewn(size, char);
bufchain_fetch(&ssh->banner, banner, size);
Rework handling of untrusted terminal data. Now there's a centralised routine in misc.c to do the sanitisation, which copies data on to an outgoing bufchain. This allows me to remove from_backend_untrusted() completely from the frontend API, simplifying code in several places. Two use cases for untrusted-terminal-data sanitisation were in the terminal.c prompts handler, and in the collection of SSH-2 userauth banners. Both of those were writing output to a bufchain anyway, so it was very convenient to just replace a bufchain_add with sanitise_term_data and then not have to worry about it again. There was also a simplistic sanitiser in uxcons.c, which I've now replaced with a call to the good one - and in wincons.c there was a FIXME saying I ought to get round to that, which now I have!
2018-09-19 17:22:36 +00:00
c_write(ssh, banner, size);
Use the packet dispatch table to handle USERAUTH_BANNER messages, which should hopefully solve `drop-banner'. I haven't been able to test the failure case, but the behaviour with OpenSSH appears no worse. [originally from svn r5772] [this svn revision also touched putty-wishlist]
2005-05-12 15:09:35 +00:00
sfree(banner);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Use the packet dispatch table to handle USERAUTH_BANNER messages, which should hopefully solve `drop-banner'. I haven't been able to test the failure case, but the behaviour with OpenSSH appears no worse. [originally from svn r5772] [this svn revision also touched putty-wishlist]
2005-05-12 15:09:35 +00:00
bufchain_clear(&ssh->banner);
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
}
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type == SSH2_MSG_USERAUTH_SUCCESS) {
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
logevent("Access granted");
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
s->we_are_in = s->userauth_success = TRUE;
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
break;
}
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
if (pktin->type != SSH2_MSG_USERAUTH_FAILURE && s->type != AUTH_TYPE_GSSAPI) {
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
bombout(("Strange packet received during authentication: "
"type %d", pktin->type));
Unix makefile now uses -O2, which massively cuts down key exchange time. This gives rise to a whole bunch of spare warnings, one or two of which might have been actual bugs; now all resolved. [originally from svn r3134]
2003-04-23 13:48:09 +00:00
crStopV;
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
}
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
/*
* OK, we're now sitting on a USERAUTH_FAILURE message, so
* we can look at the string in it and know what we can
* helpfully try next.
*/
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
if (pktin->type == SSH2_MSG_USERAUTH_FAILURE) {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
methods = get_string(pktin);
if (!get_bool(pktin)) {
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
/*
* We have received an unequivocal Access
* Denied. This can translate to a variety of
Reorganise the logging and display of messages about SSH authentication. We should now produce an Event Log entry for every authentication attempted and every authentication failure; meanwhile, messages in the PuTTY window will not be generated for the failure of auth types unless we also announced in the PuTTY window that we were trying them. (GSSAPI was getting the latter wrong, leading to spurious 'Access denied' for many users of 0.61.) [originally from svn r9226]
2011-07-16 12:06:32 +00:00
* messages, or no message at all.
*
* For forms of authentication which are attempted
* implicitly, by which I mean without printing
* anything in the window indicating that we're
* trying them, we should never print 'Access
* denied'.
*
* If we do print a message saying that we're
* attempting some kind of authentication, it's OK
* to print a followup message saying it failed -
* but the message may sometimes be more specific
* than simply 'Access denied'.
*
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
* Additionally, if we'd just tried password
* authentication, we should break out of this
* whole loop so as to go back to the username
As a result of the policy allowing changes of username to reset the authentication state, a failed `password' authentication in SSH-2 was sending us back to trying `none' and `keyboard-interactive' each time round, which uses up OpenSSH's quota of authentication attempts rather quickly. Added a check for `cfg.change_username' to the logic which sends us back to the start. [originally from svn r4849]
2004-11-20 17:11:38 +00:00
* prompt (iff we're configured to allow
* username change attempts).
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
*/
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (s->type == AUTH_TYPE_NONE) {
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
/* do nothing */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
} else if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD ||
s->type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) {
if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD)
c_write_str(ssh, "Server refused our key\r\n");
Reorganise the logging and display of messages about SSH authentication. We should now produce an Event Log entry for every authentication attempted and every authentication failure; meanwhile, messages in the PuTTY window will not be generated for the failure of auth types unless we also announced in the PuTTY window that we were trying them. (GSSAPI was getting the latter wrong, leading to spurious 'Access denied' for many users of 0.61.) [originally from svn r9226]
2011-07-16 12:06:32 +00:00
logevent("Server refused our key");
} else if (s->type == AUTH_TYPE_PUBLICKEY) {
/* This _shouldn't_ happen except by a
* protocol bug causing client and server to
* disagree on what is a correct signature. */
c_write_str(ssh, "Server refused public-key signature"
" despite accepting key!\r\n");
logevent("Server refused public-key signature"
" despite accepting key!");
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
} else if (s->type==AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) {
Reorganise the logging and display of messages about SSH authentication. We should now produce an Event Log entry for every authentication attempted and every authentication failure; meanwhile, messages in the PuTTY window will not be generated for the failure of auth types unless we also announced in the PuTTY window that we were trying them. (GSSAPI was getting the latter wrong, leading to spurious 'Access denied' for many users of 0.61.) [originally from svn r9226]
2011-07-16 12:06:32 +00:00
/* quiet, so no c_write */
logevent("Server refused keyboard-interactive authentication");
} else if (s->type==AUTH_TYPE_GSSAPI) {
/* always quiet, so no c_write */
Minor amendment to r9226: don't log GSSAPI failure in the Event Log twice. (Once in the GSSAPI code, once at the top of the main auth loop. Removed the latter.) [originally from svn r9232] [r9226 == 0b79fe0bcbfd4113e8ed413fe0c8e0bbd34ea5b2]
2011-07-18 18:09:36 +00:00
/* also, the code down in the GSSAPI block has
* already logged this in the Event Log */
Reorganise the logging and display of messages about SSH authentication. We should now produce an Event Log entry for every authentication attempted and every authentication failure; meanwhile, messages in the PuTTY window will not be generated for the failure of auth types unless we also announced in the PuTTY window that we were trying them. (GSSAPI was getting the latter wrong, leading to spurious 'Access denied' for many users of 0.61.) [originally from svn r9226]
2011-07-16 12:06:32 +00:00
} else if (s->type == AUTH_TYPE_KEYBOARD_INTERACTIVE) {
logevent("Keyboard-interactive authentication failed");
c_write_str(ssh, "Access denied\r\n");
} else {
assert(s->type == AUTH_TYPE_PASSWORD);
logevent("Password authentication failed");
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write_str(ssh, "Access denied\r\n");
Reorganise the logging and display of messages about SSH authentication. We should now produce an Event Log entry for every authentication attempted and every authentication failure; meanwhile, messages in the PuTTY window will not be generated for the failure of auth types unless we also announced in the PuTTY window that we were trying them. (GSSAPI was getting the latter wrong, leading to spurious 'Access denied' for many users of 0.61.) [originally from svn r9226]
2011-07-16 12:06:32 +00:00
if (conf_get_int(ssh->conf, CONF_change_username)) {
XXX comment in the logic which sends failed password auth back to username prompt for keyboard-interactive. I suspect we should do the same with that method (especially given the apparent number of systems that use it for regular password auth), but in the absence of systems to test against I've not actually made the change. (I'm worried that the `partial success' field might not be set correctly in a multi-stage authentication, for instance.) [originally from svn r4850]
2004-11-20 17:47:40 +00:00
/* XXX perhaps we should allow
* keyboard-interactive to do this too? */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->we_are_in = FALSE;
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
break;
}
}
} else {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
c_write_str(ssh, "Further authentication required\r\n");
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
logevent("Further authentication required");
}
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->can_pubkey =
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
in_commasep_string("publickey", methods.ptr, methods.len);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->can_passwd =
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
in_commasep_string("password", methods.ptr, methods.len);
s->can_keyb_inter =
conf_get_int(ssh->conf, CONF_try_ki_auth) &&
in_commasep_string("keyboard-interactive",
methods.ptr, methods.len);
Cleanups of the GSSAPI support. On Windows, standard GSS libraries are now loaded from standard locations (system32 for SSPI, the registry-stored MIT KfW install location for KfW) rather than using the risky default DLL search path; I've therefore also added an option to manually specify a GSS DLL we haven't heard of (which should in principle Just Work provided it supports proper GSS-API as specified in the RFC). The same option exists on Unix too, because it seemed like too useful an idea to reserve to Windows. In addition, GSSAPI is now documented, and also (unfortunately) its GUI configuration has been moved out into a sub-subpanel on the grounds that it was too big to fit in Auth. [originally from svn r9003]
2010-09-25 07:16:56 +00:00
#ifndef NO_GSSAPI
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->can_gssapi =
conf_get_int(ssh->conf, CONF_try_gssapi_auth) &&
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
in_commasep_string("gssapi-with-mic",
methods.ptr, methods.len) &&
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->gsslibs->nlibraries > 0;
s->can_gssapi_keyex_auth =
Make GSS kex and GSS userauth separately configurable. The former has advantages in terms of keeping Kerberos credentials up to date, but it also does something sufficiently weird to the usual SSH host key system that I think it's worth making sure users have a means of turning it off separately from the less intrusive GSS userauth.
2018-04-26 18:15:15 +00:00
conf_get_int(ssh->conf, CONF_try_gssapi_kex) &&
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
in_commasep_string("gssapi-keyex",
methods.ptr, methods.len) &&
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->gsslibs->nlibraries > 0 &&
ssh->gss_ctx;
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
#endif
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
}
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.actx = SSH2_PKTCTX_NOAUTH;
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
if (s->can_gssapi_keyex_auth && !s->tried_gssapi_keyex_auth) {
/* gssapi-keyex authentication */
s->type = AUTH_TYPE_GSSAPI;
s->tried_gssapi_keyex_auth = TRUE;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.actx = SSH2_PKTCTX_GSSAPI;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (ssh->gsslib->gsslogmsg)
logevent(ssh->gsslib->gsslogmsg);
logeventf(ssh, "Trying gssapi-keyex...");
s->pktout =
ssh2_gss_authpacket(ssh, ssh->gss_ctx, "gssapi-keyex");
ssh2_pkt_send(ssh, s->pktout);
ssh->gsslib->release_cred(ssh->gsslib, &ssh->gss_ctx);
ssh->gss_ctx = NULL;
continue;
} else
#endif /* NO_GSSAPI */
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
if (s->can_pubkey && !s->done_agent && s->nkeys) {
Final fixes to keyboard-interactive so it now works with packets containing more than one prompt instead of less than one, and also correctly enables echo on prompts that the server requests it for. In the process I've moved the whole username/password input routine out into its own function, where it's called independently of which SSH protocol we're using, so this should even have _saved_ code size. Rock! [originally from svn r1830]
2002-08-11 13:02:01 +00:00
SSH2 can now use Pageant to obtain keys from [originally from svn r977]
2001-03-03 15:56:39 +00:00
/*
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
* Attempt public-key authentication using a key from Pageant.
SSH2 can now use Pageant to obtain keys from [originally from svn r977]
2001-03-03 15:56:39 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.actx = SSH2_PKTCTX_PUBLICKEY;
Retired the #ifdef DUMP_PACKETS stuff in ssh.c because I'm utterly sick of recompiling to enable packet dumps. SSH packet dumping is now provided as a logging option, and dumps to putty.log like all the other logging options. While I'm at it I cleaned up the format so that packet types are translated into strings for easy browsing. POSSIBLE SIDE EFFECT: in the course of this work I had to re-enable the SSH1 packet length checks which it turns out hadn't actually been active for some time, so it's possible things might break as a result. If need be I can always disable those checks for the 0.52 release and think about it more carefully later. [originally from svn r1493]
2001-12-14 14:57:50 +00:00
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
logeventf(ssh, "Trying Pageant key #%d", s->keyi);
/* Unpack key from agent response */
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
s->pk = get_string(s->asrc);
s->comment = get_string(s->asrc);
{
BinarySource src[1];
BinarySource_BARE_INIT(src, s->pk.ptr, s->pk.len);
s->alg = get_string(src);
}
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* See if server will accept it */
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_USERAUTH_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, ssh->username);
put_stringz(s->pktout, "ssh-connection");
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* service requested */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "publickey");
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* method */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_bool(s->pktout, FALSE); /* no signature included */
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
put_stringpl(s->pktout, s->alg);
put_stringpl(s->pktout, s->pk);
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
ssh2_pkt_send(ssh, s->pktout);
s->type = AUTH_TYPE_PUBLICKEY_OFFER_QUIET;
SSH2 can now use Pageant to obtain keys from [originally from svn r977]
2001-03-03 15:56:39 +00:00
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
SSH2 can now use Pageant to obtain keys from [originally from svn r977]
2001-03-03 15:56:39 +00:00
do_ssh2_authconn: replace s->gotit with pq_push_front. The userauth loop has always had a rather awkward feature whereby some of its branches have _already_ received an SSH_MSG_USERAUTH_SUCCESS or SSH_MSG_USERAUTH_FAILURE packet (e.g. because they have to wait for a packet that might be one of those _or_ a continuation packet of some kind), whereas other branches go back round to the top of the loop at the moment that they know one of those will be the next packet to arrive. So we had a flag 's->gotit' which tells the start of the loop whether it's already sitting on the success or failure message, or whether the first thing it should do is to crWait for one. Now that the packets are coming from a linked list, there's a simpler way to handle this: the top of the userauth loop _always_ expects to find a success/failure message as the first thing in the queue, and if any branch of the auth code finds it's already removed such a message from the queue, it can simply put it back on the front again before going back round.
2018-05-18 06:22:58 +00:00
/* Offer of key refused, presumably via
* USERAUTH_FAILURE. Requeue for the next iteration. */
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
pq_push_front(&ssh->pq_ssh2_userauth, pktin);
SSH2 can now use Pageant to obtain keys from [originally from svn r977]
2001-03-03 15:56:39 +00:00
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
} else {
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
strbuf *agentreq, *sigdata;
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
void *r;
int rlen;
SSH2 can now use Pageant to obtain keys from [originally from svn r977]
2001-03-03 15:56:39 +00:00
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
if (flags & FLAG_VERBOSE) {
c_write_str(ssh, "Authenticating with "
"public key \"");
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
c_write(ssh, s->comment.ptr, s->comment.len);
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
c_write_str(ssh, "\" from agent\r\n");
}
SSH2 can now use Pageant to obtain keys from [originally from svn r977]
2001-03-03 15:56:39 +00:00
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/*
* Server is willing to accept the key.
* Construct a SIGN_REQUEST.
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_USERAUTH_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, ssh->username);
put_stringz(s->pktout, "ssh-connection");
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* service requested */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "publickey");
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* method */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_bool(s->pktout, TRUE); /* signature included */
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
put_stringpl(s->pktout, s->alg);
put_stringpl(s->pktout, s->pk);
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* Ask agent for signature. */
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
agentreq = strbuf_new_for_agent_query();
put_byte(agentreq, SSH2_AGENTC_SIGN_REQUEST);
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
put_stringpl(agentreq, s->pk);
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* Now the data to be signed... */
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
sigdata = strbuf_new();
if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID) {
put_data(sigdata, ssh->v2_session_id,
ssh->v2_session_id_len);
} else {
put_string(sigdata, ssh->v2_session_id,
ssh->v2_session_id_len);
}
put_data(sigdata, s->pktout->data + 5,
s->pktout->length - 5);
put_stringsb(agentreq, sigdata);
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* And finally the (zero) flags word. */
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
put_uint32(agentreq, 0);
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
ssh->auth_agent_query = agent_query(
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
agentreq, &r, &rlen, ssh_agent_callback, ssh);
Build outgoing SSH agent requests in a strbuf. This simplifies the client code both in ssh.c and in the client side of Pageant. I've cheated a tiny bit by preparing agent requests in a strbuf that has space reserved at the front for the packet frame, which makes life easier for the code that sends them off.
2018-05-24 12:18:13 +00:00
strbuf_free(agentreq);
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
if (ssh->auth_agent_query) {
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
ssh->agent_response = NULL;
do_ssh2_authconn: get packets from a PacketQueue. Just like do_ssh1_login, do_ssh2_authconn is now no longer receiving its packets via function arguments; instead, it's pulling them off a dedicated PacketQueue populated by particular dispatch table entries, with the same reference-counting system to stop them being freed when the pq_full processing function regains control. This eliminates further ugly bombout()s from the code while waiting for authentication responses from the user or the SSH agent. As I mentioned in the previous commit, I've had to keep ssh2_authconn_input separate from do_ssh2_authconn, and this time the reason why is thoroughly annoying: it's because do_ssh2_authconn has changed its prototype to take the Ssh structure as a void * so that it can be called from the idempotent callback system, whereas ssh2_authconn_input has to have the type of ssh->current_user_input_fn which takes the more sensible pointer type 'Ssh'.
2018-05-18 06:22:58 +00:00
crWaitUntilV(ssh->agent_response);
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
r = ssh->agent_response;
rlen = ssh->agent_response_len;
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
}
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
if (r) {
ptrlen sigblob;
BinarySource src[1];
BinarySource_BARE_INIT(src, r, rlen);
get_uint32(src); /* skip length field */
if (get_byte(src) == SSH2_AGENT_SIGN_RESPONSE &&
(sigblob = get_string(src), !get_err(src))) {
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
logevent("Sending Pageant's response");
ssh2_add_sigblob(ssh, s->pktout,
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
s->pk.ptr, s->pk.len,
sigblob.ptr, sigblob.len);
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
ssh2_pkt_send(ssh, s->pktout);
s->type = AUTH_TYPE_PUBLICKEY;
} else {
/* FIXME: less drastic response */
bombout(("Pageant failed to answer challenge"));
crStopV;
SSH2 can now use Pageant to obtain keys from [originally from svn r977]
2001-03-03 15:56:39 +00:00
}
}
}
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
/* Do we have any keys left to try? */
Pageant client code: parse replies using BinarySource. This affects both the client code used by Pageant itself, in pageant.c, and the client code in ssh.c used during SSH userauth.
2018-05-27 22:58:20 +00:00
if (s->pkblob_pos_in_agent) {
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
s->done_agent = TRUE;
s->tried_pubkey_config = TRUE;
} else {
s->keyi++;
if (s->keyi >= s->nkeys)
s->done_agent = TRUE;
}
SSH2 can now use Pageant to obtain keys from [originally from svn r977]
2001-03-03 15:56:39 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else if (s->can_pubkey && s->publickey_blob &&
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
s->privatekey_available && !s->tried_pubkey_config) {
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
struct ssh2_userkey *key; /* not live over crReturn */
char *passphrase; /* not live over crReturn */
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.actx = SSH2_PKTCTX_PUBLICKEY;
Retired the #ifdef DUMP_PACKETS stuff in ssh.c because I'm utterly sick of recompiling to enable packet dumps. SSH packet dumping is now provided as a logging option, and dumps to putty.log like all the other logging options. While I'm at it I cleaned up the format so that packet types are translated into strings for easy browsing. POSSIBLE SIDE EFFECT: in the course of this work I had to re-enable the SSH1 packet length checks which it turns out hadn't actually been active for some time, so it's possible things might break as a result. If need be I can always disable those checks for the 0.52 release and think about it more carefully later. [originally from svn r1493]
2001-12-14 14:57:50 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
s->tried_pubkey_config = TRUE;
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
/*
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
* Try the public key supplied in the configuration.
*
* First, offer the public blob to see if the server is
* willing to accept it.
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_USERAUTH_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, ssh->username);
put_stringz(s->pktout, "ssh-connection");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/* service requested */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "publickey"); /* method */
put_bool(s->pktout, FALSE);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/* no signature included */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, s->publickey_algorithm);
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
put_string(s->pktout, s->publickey_blob->s,
s->publickey_blob->len);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
ssh2_pkt_send(ssh, s->pktout);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
logevent("Offered public key");
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (pktin->type != SSH2_MSG_USERAUTH_PK_OK) {
/* Key refused. Give up. */
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
pq_push_front(&ssh->pq_ssh2_userauth, pktin);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
s->type = AUTH_TYPE_PUBLICKEY_OFFER_LOUD;
continue; /* process this new message */
Fix culpable lack of generality in keyboard-interactive authentication: a k-i request packet can contain any number of auth prompts (including zero!) and we must ask the user all of them and send back a packet containing the same number of responses. FreeBSD systems were sending a zero-prompts packet which was crashing us; this now appears fixed (we correctly return a zero-responses packet) but I haven't tested a multiple-prompts packet because I can't immediately think of a server that generates them. [originally from svn r1797]
2002-08-03 16:22:55 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
logevent("Offer of public key accepted");
D'oh! Putting keyboard-interactive authentication _before_ publickey causes password login to occur on a server that supports password- through-k-i. Of course when we use the new preference list mechanism for selecting the order of authentications this will all become much more sane, but for the moment I've put publickey back up to the top and things seem to be happier. [originally from svn r1220]
2001-08-28 08:43:33 +00:00
Fix culpable lack of generality in keyboard-interactive authentication: a k-i request packet can contain any number of auth prompts (including zero!) and we must ask the user all of them and send back a packet containing the same number of responses. FreeBSD systems were sending a zero-prompts packet which was crashing us; this now appears fixed (we correctly return a zero-responses packet) but I haven't tested a multiple-prompts packet because I can't immediately think of a server that generates them. [originally from svn r1797]
2002-08-03 16:22:55 +00:00
/*
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
* Actually attempt a serious authentication using
* the key.
Fix culpable lack of generality in keyboard-interactive authentication: a k-i request packet can contain any number of auth prompts (including zero!) and we must ask the user all of them and send back a packet containing the same number of responses. FreeBSD systems were sending a zero-prompts packet which was crashing us; this now appears fixed (we correctly return a zero-responses packet) but I haven't tested a multiple-prompts packet because I can't immediately think of a server that generates them. [originally from svn r1797]
2002-08-03 16:22:55 +00:00
*/
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (flags & FLAG_VERBOSE) {
c_write_str(ssh, "Authenticating with public key \"");
c_write_str(ssh, s->publickey_comment);
c_write_str(ssh, "\"\r\n");
}
key = NULL;
while (!key) {
const char *error; /* not live over crReturn */
Support using public-only key files in PuTTY proper. Obviously PuTTY can't actually do public-key authentication itself, if you give it a public rather than private key file. But it can still match the supplied public key file against the list of keys in the agent, and narrow down to that. So if for some reason you're forwarding an agent to a machine you don't want to trust with your _private_ key file (even encrypted), you can still use the '-i' option to select which key from the agent to use, by uploading just the public key file to that machine.
2015-05-12 11:30:25 +00:00
if (s->privatekey_encrypted) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/*
* Get a passphrase from the user.
*/
s->cur_prompt = new_prompts(ssh->frontend);
s->cur_prompt->to_server = FALSE;
s->cur_prompt->name = dupstr("SSH key passphrase");
add_prompt(s->cur_prompt,
dupprintf("Passphrase for key \"%.100s\": ",
s->publickey_comment),
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
FALSE);
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(
s->cur_prompt, NULL);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
while (1) {
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
while (s->userpass_ret < 0 &&
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
bufchain_size(&ssh->user_input) > 0)
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(
s->cur_prompt, &ssh->user_input);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
if (s->userpass_ret >= 0)
break;
ssh->send_ok = 1;
crReturnV;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
ssh->send_ok = 0;
}
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
if (!s->userpass_ret) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/* Failed to get a passphrase. Terminate. */
free_prompts(s->cur_prompt);
ssh_disconnect(ssh, NULL,
"Unable to authenticate",
SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
TRUE);
crStopV;
Someone complained that their keyboard-interactive password prompt was being truncated - it was from OpenSSH on HP/UX and had all sorts of stuff in it ("last successful login" etc). Bodged it by bumping up the space allocated in the fixed array for a password prompt. Also added an indication that the prompt is being truncated, as required by draft-ietf-secsh-auth-kbdinteract-06. (NB that before this checkin, there was a more-or-less harmless buffer overread where if we ever received a keyboard-interactive prompt with echo=1, we'd probably spew goo on the terminal; fixed now.) [originally from svn r4476]
2004-08-17 14:08:05 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
passphrase =
dupstr(s->cur_prompt->prompts[0]->result);
free_prompts(s->cur_prompt);
Fix culpable lack of generality in keyboard-interactive authentication: a k-i request packet can contain any number of auth prompts (including zero!) and we must ask the user all of them and send back a packet containing the same number of responses. FreeBSD systems were sending a zero-prompts packet which was crashing us; this now appears fixed (we correctly return a zero-responses packet) but I haven't tested a multiple-prompts packet because I can't immediately think of a server that generates them. [originally from svn r1797]
2002-08-03 16:22:55 +00:00
} else {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
passphrase = NULL; /* no passphrase needed */
Fix culpable lack of generality in keyboard-interactive authentication: a k-i request packet can contain any number of auth prompts (including zero!) and we must ask the user all of them and send back a packet containing the same number of responses. FreeBSD systems were sending a zero-prompts packet which was crashing us; this now appears fixed (we correctly return a zero-responses packet) but I haven't tested a multiple-prompts packet because I can't immediately think of a server that generates them. [originally from svn r1797]
2002-08-03 16:22:55 +00:00
}
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/*
* Try decrypting the key.
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
key = ssh2_load_userkey(s->keyfile, passphrase, &error);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (passphrase) {
/* burn the evidence */
Introduce a new utility function smemclr(), which memsets things to zero but does it in such a way that over-clever compilers hopefully won't helpfully optimise the call away if you do it just before freeing something or letting it go out of scope. Use this for (hopefully) every memset whose job is to destroy sensitive data that might otherwise be left lying around in the process's memory. [originally from svn r9586]
2012-07-22 19:51:50 +00:00
smemclr(passphrase, strlen(passphrase));
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
sfree(passphrase);
}
if (key == SSH2_WRONG_PASSPHRASE || key == NULL) {
if (passphrase &&
(key == SSH2_WRONG_PASSPHRASE)) {
c_write_str(ssh, "Wrong passphrase\r\n");
key = NULL;
/* and loop again */
} else {
c_write_str(ssh, "Unable to load private key (");
c_write_str(ssh, error);
c_write_str(ssh, ")\r\n");
key = NULL;
break; /* try something else */
}
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
}
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (key) {
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf *pkblob, *sigdata, *sigblob;
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
/*
* We have loaded the private key and the server
* has announced that it's willing to accept it.
* Hallelujah. Generate a signature and send it.
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_USERAUTH_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, ssh->username);
put_stringz(s->pktout, "ssh-connection");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/* service requested */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "publickey"); /* method */
put_bool(s->pktout, TRUE); /* signature follows */
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
put_stringz(s->pktout, ssh_key_ssh_id(key->key));
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
pkblob = strbuf_new();
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_key_public_blob(key->key, BinarySink_UPCAST(pkblob));
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
put_string(s->pktout, pkblob->s, pkblob->len);
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
/*
* The data to be signed is:
*
* string session-id
*
* followed by everything so far placed in the
* outgoing packet.
*/
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
sigdata = strbuf_new();
if (ssh->remote_bugs & BUG_SSH2_PK_SESSIONID) {
put_data(sigdata, ssh->v2_session_id,
ssh->v2_session_id_len);
} else {
put_string(sigdata, ssh->v2_session_id,
ssh->v2_session_id_len);
}
put_data(sigdata, s->pktout->data + 5,
s->pktout->length - 5);
sigblob = strbuf_new();
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_key_sign(key->key, sigdata->s, sigdata->len,
BinarySink_UPCAST(sigblob));
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf_free(sigdata);
ssh2_add_sigblob(ssh, s->pktout, pkblob->s, pkblob->len,
sigblob->s, sigblob->len);
strbuf_free(pkblob);
strbuf_free(sigblob);
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
ssh2_pkt_send(ssh, s->pktout);
Reorganise the logging and display of messages about SSH authentication. We should now produce an Event Log entry for every authentication attempted and every authentication failure; meanwhile, messages in the PuTTY window will not be generated for the failure of auth types unless we also announced in the PuTTY window that we were trying them. (GSSAPI was getting the latter wrong, leading to spurious 'Access denied' for many users of 0.61.) [originally from svn r9226]
2011-07-16 12:06:32 +00:00
logevent("Sent public key signature");
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
s->type = AUTH_TYPE_PUBLICKEY;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh_key_free(key->key);
Fix a few memory leaks. Patch due to Chris Staite.
2015-04-26 09:49:24 +00:00
sfree(key->comment);
sfree(key);
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
#ifndef NO_GSSAPI
} else if (s->can_gssapi && !s->tried_gssapi) {
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/* gssapi-with-mic authentication */
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen data;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
s->type = AUTH_TYPE_GSSAPI;
s->tried_gssapi = TRUE;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.actx = SSH2_PKTCTX_GSSAPI;
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (ssh->gsslib->gsslogmsg)
logevent(ssh->gsslib->gsslogmsg);
Patch from Alejandro Sedeno, somewhat modified by me, which reorganises the GSSAPI support so that it handles alternative implementations of the GSS-API. In particular, this means PuTTY can now talk to MIT Kerberos for Windows instead of being limited to SSPI. I don't know for sure whether further tweaking will be needed (to the UI, most likely, or to automatic selection of credentials), but testing reports suggest it's now at least worth committing to trunk to get it more widely tested. [originally from svn r8952]
2010-05-19 18:22:17 +00:00
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
/* Sending USERAUTH_REQUEST with "gssapi-with-mic" method */
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
logeventf(ssh, "Trying gssapi-with-mic...");
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_USERAUTH_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, ssh->username);
put_stringz(s->pktout, "ssh-connection");
put_stringz(s->pktout, "gssapi-with-mic");
Reorganise the logging and display of messages about SSH authentication. We should now produce an Event Log entry for every authentication attempted and every authentication failure; meanwhile, messages in the PuTTY window will not be generated for the failure of auth types unless we also announced in the PuTTY window that we were trying them. (GSSAPI was getting the latter wrong, leading to spurious 'Access denied' for many users of 0.61.) [originally from svn r9226]
2011-07-16 12:06:32 +00:00
logevent("Attempting GSSAPI authentication");
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
/* add mechanism info */
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->gsslib->indicate_mech(ssh->gsslib, &s->gss_buf);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
/* number of GSSAPI mechanisms */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(s->pktout, 1);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
/* length of OID + 2 */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(s->pktout, s->gss_buf.length + 2);
put_byte(s->pktout, SSH2_GSS_OIDTYPE);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
/* length of OID */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_byte(s->pktout, s->gss_buf.length);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_data(s->pktout, s->gss_buf.value, s->gss_buf.length);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
ssh2_pkt_send(ssh, s->pktout);
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
if (pktin->type != SSH2_MSG_USERAUTH_GSSAPI_RESPONSE) {
logevent("GSSAPI authentication request refused");
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
pq_push_front(&ssh->pq_ssh2_userauth, pktin);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
continue;
}
/* check returned packet ... */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
data = get_string(pktin);
s->gss_rcvtok.value = (char *)data.ptr;
s->gss_rcvtok.length = data.len;
Change how we handle the Ssh_gss_buf type. Previously, we defined it ourselves, but on Unix then assumed it was compatible with the system's gss_buffer_desc, which wasn't the case on LP64 systems. Now, on Unix we make Ssh_gss_buf into an alias for gss_buffer_desc, though we keep something similar to the existing behaviour on Windows. This requires renaming a couple of the fields in Ssh_gss_buf, and hence fixing all the references. Tested on Linux (MIT Kerberos) and Solaris. Compiled on NetBSD (Heimdal). Not tested on Windows because neither mingw32 nor winegcc worked out of the box for me. I think the Windows changes are all syntactic, though, so if this compiles it should work no worse than before. [originally from svn r8326]
2008-11-24 23:44:55 +00:00
if (s->gss_rcvtok.length != s->gss_buf.length + 2 ||
((char *)s->gss_rcvtok.value)[0] != SSH2_GSS_OIDTYPE ||
((char *)s->gss_rcvtok.value)[1] != s->gss_buf.length ||
memcmp((char *)s->gss_rcvtok.value + 2,
s->gss_buf.value,s->gss_buf.length) ) {
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
logevent("GSSAPI authentication - wrong response from server");
continue;
}
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/* Import server name if not cached from KEX */
if (ssh->gss_srv_name == GSS_C_NO_NAME) {
s->gss_stat = ssh->gsslib->import_name(ssh->gsslib,
ssh->fullhostname,
&ssh->gss_srv_name);
if (s->gss_stat != SSH_GSS_OK) {
if (s->gss_stat == SSH_GSS_BAD_HOST_NAME)
logevent("GSSAPI import name failed -"
" Bad service name");
else
logevent("GSSAPI import name failed");
continue;
}
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
}
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/* Allocate our gss_ctx */
s->gss_stat = ssh->gsslib->acquire_cred(ssh->gsslib,
&s->gss_ctx, NULL);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
if (s->gss_stat != SSH_GSS_OK) {
logevent("GSSAPI authentication failed to get credentials");
continue;
}
/* initial tokens are empty */
Change how we handle the Ssh_gss_buf type. Previously, we defined it ourselves, but on Unix then assumed it was compatible with the system's gss_buffer_desc, which wasn't the case on LP64 systems. Now, on Unix we make Ssh_gss_buf into an alias for gss_buffer_desc, though we keep something similar to the existing behaviour on Windows. This requires renaming a couple of the fields in Ssh_gss_buf, and hence fixing all the references. Tested on Linux (MIT Kerberos) and Solaris. Compiled on NetBSD (Heimdal). Not tested on Windows because neither mingw32 nor winegcc worked out of the box for me. I think the Windows changes are all syntactic, though, so if this compiles it should work no worse than before. [originally from svn r8326]
2008-11-24 23:44:55 +00:00
SSH_GSS_CLEAR_BUF(&s->gss_rcvtok);
Jacob correctly points out that I accidentally lost a clearing of s->gss_sndtok in r8326. I'm not sure it was strictly necessary, since even if there's no send token, gss_init_sec_context() is meant to explicitly make it empty, but it wasn't an intentional change. [originally from svn r8337] [r8326 == 81dafd906eb4817393fabe4d408c16de8586de8b]
2008-11-26 14:30:58 +00:00
SSH_GSS_CLEAR_BUF(&s->gss_sndtok);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
/* now enter the loop */
do {
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/*
* When acquire_cred yields no useful expiration, go with
* the service ticket expiration.
*/
s->gss_stat = ssh->gsslib->init_sec_context
(ssh->gsslib,
Patch from Alejandro Sedeno, somewhat modified by me, which reorganises the GSSAPI support so that it handles alternative implementations of the GSS-API. In particular, this means PuTTY can now talk to MIT Kerberos for Windows instead of being limited to SSPI. I don't know for sure whether further tweaking will be needed (to the UI, most likely, or to automatic selection of credentials), but testing reports suggest it's now at least worth committing to trunk to get it more widely tested. [originally from svn r8952]
2010-05-19 18:22:17 +00:00
&s->gss_ctx,
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->gss_srv_name,
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
conf_get_int(ssh->conf, CONF_gssapifwd),
Patch from Alejandro Sedeno, somewhat modified by me, which reorganises the GSSAPI support so that it handles alternative implementations of the GSS-API. In particular, this means PuTTY can now talk to MIT Kerberos for Windows instead of being limited to SSPI. I don't know for sure whether further tweaking will be needed (to the UI, most likely, or to automatic selection of credentials), but testing reports suggest it's now at least worth committing to trunk to get it more widely tested. [originally from svn r8952]
2010-05-19 18:22:17 +00:00
&s->gss_rcvtok,
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
&s->gss_sndtok,
NULL,
NULL);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
if (s->gss_stat!=SSH_GSS_S_COMPLETE &&
s->gss_stat!=SSH_GSS_S_CONTINUE_NEEDED) {
logevent("GSSAPI authentication initialisation failed");
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (ssh->gsslib->display_status(ssh->gsslib,
s->gss_ctx, &s->gss_buf) == SSH_GSS_OK) {
Change how we handle the Ssh_gss_buf type. Previously, we defined it ourselves, but on Unix then assumed it was compatible with the system's gss_buffer_desc, which wasn't the case on LP64 systems. Now, on Unix we make Ssh_gss_buf into an alias for gss_buffer_desc, though we keep something similar to the existing behaviour on Windows. This requires renaming a couple of the fields in Ssh_gss_buf, and hence fixing all the references. Tested on Linux (MIT Kerberos) and Solaris. Compiled on NetBSD (Heimdal). Not tested on Windows because neither mingw32 nor winegcc worked out of the box for me. I think the Windows changes are all syntactic, though, so if this compiles it should work no worse than before. [originally from svn r8326]
2008-11-24 23:44:55 +00:00
logevent(s->gss_buf.value);
sfree(s->gss_buf.value);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
}
Fix hang on failure of GSSAPI authentication. Added a missing pq_push_front (see commit a41eefff4), without which the SSH_MSG_USERAUTH_FAILURE was being dropped from the userauth packet queue before returning to the top of the loop which waits for it to arrive.
2018-05-25 11:33:14 +00:00
pq_push_front(&ssh->pq_ssh2_userauth, pktin);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
break;
}
logevent("GSSAPI authentication initialised");
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/*
* Client and server now exchange tokens until GSSAPI
* no longer says CONTINUE_NEEDED
*/
Change how we handle the Ssh_gss_buf type. Previously, we defined it ourselves, but on Unix then assumed it was compatible with the system's gss_buffer_desc, which wasn't the case on LP64 systems. Now, on Unix we make Ssh_gss_buf into an alias for gss_buffer_desc, though we keep something similar to the existing behaviour on Windows. This requires renaming a couple of the fields in Ssh_gss_buf, and hence fixing all the references. Tested on Linux (MIT Kerberos) and Solaris. Compiled on NetBSD (Heimdal). Not tested on Windows because neither mingw32 nor winegcc worked out of the box for me. I think the Windows changes are all syntactic, though, so if this compiles it should work no worse than before. [originally from svn r8326]
2008-11-24 23:44:55 +00:00
if (s->gss_sndtok.length != 0) {
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->pktout =
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_string(s->pktout,
s->gss_sndtok.value, s->gss_sndtok.length);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
ssh2_pkt_send(ssh, s->pktout);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->gsslib->free_tok(ssh->gsslib, &s->gss_sndtok);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
}
if (s->gss_stat == SSH_GSS_S_CONTINUE_NEEDED) {
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
if (pktin->type != SSH2_MSG_USERAUTH_GSSAPI_TOKEN) {
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
logevent("GSSAPI authentication -"
" bad server response");
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
s->gss_stat = SSH_GSS_FAILURE;
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
pq_push_front(&ssh->pq_ssh2_userauth, pktin);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
break;
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
data = get_string(pktin);
s->gss_rcvtok.value = (char *)data.ptr;
s->gss_rcvtok.length = data.len;
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
}
} while (s-> gss_stat == SSH_GSS_S_CONTINUE_NEEDED);
if (s->gss_stat != SSH_GSS_OK) {
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->gsslib->release_cred(ssh->gsslib, &s->gss_ctx);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
continue;
}
logevent("GSSAPI authentication loop finished OK");
/* Now send the MIC */
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
s->pktout =
ssh2_gss_authpacket(ssh, s->gss_ctx, "gssapi-with-mic");
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
ssh2_pkt_send(ssh, s->pktout);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->gsslib->release_cred(ssh->gsslib, &s->gss_ctx);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
continue;
#endif
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else if (s->can_keyb_inter && !s->kbd_inter_refused) {
/*
* Keyboard-interactive authentication.
*/
s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.actx = SSH2_PKTCTX_KBDINTER;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_USERAUTH_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, ssh->username);
put_stringz(s->pktout, "ssh-connection");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/* service requested */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "keyboard-interactive");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/* method */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, ""); /* lang */
put_stringz(s->pktout, ""); /* submethods */
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
ssh2_pkt_send(ssh, s->pktout);
Reorganise the logging and display of messages about SSH authentication. We should now produce an Event Log entry for every authentication attempted and every authentication failure; meanwhile, messages in the PuTTY window will not be generated for the failure of auth types unless we also announced in the PuTTY window that we were trying them. (GSSAPI was getting the latter wrong, leading to spurious 'Access denied' for many users of 0.61.) [originally from svn r9226]
2011-07-16 12:06:32 +00:00
logevent("Attempting keyboard-interactive authentication");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
if (pktin->type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
/* Server is not willing to do keyboard-interactive
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
* at all (or, bizarrely but legally, accepts the
* user without actually issuing any prompts).
* Give up on it entirely. */
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
pq_push_front(&ssh->pq_ssh2_userauth, pktin);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET;
s->kbd_inter_refused = TRUE; /* don't try it again */
continue;
}
/*
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
* Loop while the server continues to send INFO_REQUESTs.
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
*/
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
while (pktin->type == SSH2_MSG_USERAUTH_INFO_REQUEST) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen name, inst;
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
int i;
/*
* We've got a fresh USERAUTH_INFO_REQUEST.
* Get the preamble and start building a prompt.
*/
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
name = get_string(pktin);
inst = get_string(pktin);
get_string(pktin); /* skip language tag */
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
s->cur_prompt = new_prompts(ssh->frontend);
s->cur_prompt->to_server = TRUE;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
/*
If we got a keyboard-interactive INFO_REQUEST with an "instruction" string but no actual prompts, we weren't displaying the former, which was wrong. We should now (although I haven't found a server to test it against). [originally from svn r8172]
2008-09-09 20:36:40 +00:00
* Get any prompt(s) from the packet.
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
*/
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->num_prompts = get_uint32(pktin);
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
for (i = 0; i < s->num_prompts; i++) {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen prompt;
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
int echo;
static char noprompt[] =
"<server failed to send prompt>: ";
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
prompt = get_string(pktin);
echo = get_bool(pktin);
if (!prompt.len) {
prompt.ptr = noprompt;
prompt.len = lenof(noprompt)-1;
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
add_prompt(s->cur_prompt, mkstr(prompt), echo);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
if (name.len) {
Fix cosmetic keyboard-interactive issue: at the end of a normal k-i session, some servers (Debian in particular seems prone to this) send a k-i packet with no prompts and nothing to display. We were printing an extra "Using keyboard-interactive authentication" message in this case. (Introduced by me in r8172, I think.) [originally from svn r8492] [r8172 == 211fdb9f46377b0f3052c0a29f6934cce3dbfb02]
2009-03-03 19:57:58 +00:00
/* FIXME: better prefix to distinguish from
* local prompts? */
s->cur_prompt->name =
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
dupprintf("SSH server: %.*s", PTRLEN_PRINTF(name));
Fix cosmetic keyboard-interactive issue: at the end of a normal k-i session, some servers (Debian in particular seems prone to this) send a k-i packet with no prompts and nothing to display. We were printing an extra "Using keyboard-interactive authentication" message in this case. (Introduced by me in r8172, I think.) [originally from svn r8492] [r8172 == 211fdb9f46377b0f3052c0a29f6934cce3dbfb02]
2009-03-03 19:57:58 +00:00
s->cur_prompt->name_reqd = TRUE;
} else {
s->cur_prompt->name =
dupstr("SSH server authentication");
s->cur_prompt->name_reqd = FALSE;
}
/* We add a prefix to try to make it clear that a prompt
* has come from the server.
* FIXME: ugly to print "Using..." in prompt _every_
* time round. Can this be done more subtly? */
/* Special case: for reasons best known to themselves,
* some servers send k-i requests with no prompts and
* nothing to display. Keep quiet in this case. */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
if (s->num_prompts || name.len || inst.len) {
Fix cosmetic keyboard-interactive issue: at the end of a normal k-i session, some servers (Debian in particular seems prone to this) send a k-i packet with no prompts and nothing to display. We were printing an extra "Using keyboard-interactive authentication" message in this case. (Introduced by me in r8172, I think.) [originally from svn r8492] [r8172 == 211fdb9f46377b0f3052c0a29f6934cce3dbfb02]
2009-03-03 19:57:58 +00:00
s->cur_prompt->instruction =
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
dupprintf("Using keyboard-interactive "
"authentication.%s%.*s",
inst.len ? "\n" : "",
PTRLEN_PRINTF(inst));
Fix cosmetic keyboard-interactive issue: at the end of a normal k-i session, some servers (Debian in particular seems prone to this) send a k-i packet with no prompts and nothing to display. We were printing an extra "Using keyboard-interactive authentication" message in this case. (Introduced by me in r8172, I think.) [originally from svn r8492] [r8172 == 211fdb9f46377b0f3052c0a29f6934cce3dbfb02]
2009-03-03 19:57:58 +00:00
s->cur_prompt->instr_reqd = TRUE;
} else {
s->cur_prompt->instr_reqd = FALSE;
}
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
/*
If we got a keyboard-interactive INFO_REQUEST with an "instruction" string but no actual prompts, we weren't displaying the former, which was wrong. We should now (although I haven't found a server to test it against). [originally from svn r8172]
2008-09-09 20:36:40 +00:00
* Display any instructions, and get the user's
* response(s).
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
*/
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(s->cur_prompt, NULL);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
while (1) {
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
while (s->userpass_ret < 0 &&
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
bufchain_size(&ssh->user_input) > 0)
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(
s->cur_prompt, &ssh->user_input);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
if (s->userpass_ret >= 0)
break;
ssh->send_ok = 1;
crReturnV;
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
ssh->send_ok = 0;
}
if (!s->userpass_ret) {
/*
* Failed to get responses. Terminate.
*/
free_prompts(s->cur_prompt);
ssh_disconnect(ssh, NULL, "Unable to authenticate",
SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
TRUE);
crStopV;
}
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
/*
Move password-packet padding into the BPP module. Now when we construct a packet containing sensitive data, we just set a field saying '... and make it take up at least this much space, to disguise its true size', and nothing in the rest of the system worries about that flag until ssh2bpp.c acts on it. Also, I've changed the strategy for doing the padding. Previously, we were following the real packet with an SSH_MSG_IGNORE to make up the size. But that was only a partial defence: it works OK against passive traffic analysis, but an attacker proxying the TCP stream and dribbling it out one byte at a time could still have found out the size of the real packet by noting when the dribbled data provoked a response. Now I put the SSH_MSG_IGNORE _first_, which should defeat that attack. But that in turn doesn't work when we're doing compression, because we can't predict the compressed sizes accurately enough to make that strategy sensible. Fortunately, compression provides an alternative strategy anyway: if we've got zlib turned on when we send one of these sensitive packets, then we can pad out the compressed zlib data as much as we like by adding empty RFC1951 blocks (effectively chaining ZLIB_PARTIAL_FLUSHes). So both strategies should now be dribble-proof.
2018-07-09 19:30:11 +00:00
* Send the response(s) to the server, padding
* them to disguise their true length.
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_USERAUTH_INFO_RESPONSE);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(s->pktout, s->num_prompts);
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
for (i=0; i < s->num_prompts; i++) {
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout,
s->cur_prompt->prompts[i]->result);
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
}
Move password-packet padding into the BPP module. Now when we construct a packet containing sensitive data, we just set a field saying '... and make it take up at least this much space, to disguise its true size', and nothing in the rest of the system worries about that flag until ssh2bpp.c acts on it. Also, I've changed the strategy for doing the padding. Previously, we were following the real packet with an SSH_MSG_IGNORE to make up the size. But that was only a partial defence: it works OK against passive traffic analysis, but an attacker proxying the TCP stream and dribbling it out one byte at a time could still have found out the size of the real packet by noting when the dribbled data provoked a response. Now I put the SSH_MSG_IGNORE _first_, which should defeat that attack. But that in turn doesn't work when we're doing compression, because we can't predict the compressed sizes accurately enough to make that strategy sensible. Fortunately, compression provides an alternative strategy anyway: if we've got zlib turned on when we send one of these sensitive packets, then we can pad out the compressed zlib data as much as we like by adding empty RFC1951 blocks (effectively chaining ZLIB_PARTIAL_FLUSHes). So both strategies should now be dribble-proof.
2018-07-09 19:30:11 +00:00
s->pktout->minlen = 256;
ssh2_pkt_send(ssh, s->pktout);
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
Add a missing free_prompts() call in the keyboard-interactive code. [originally from svn r9357]
2011-12-07 19:07:02 +00:00
/*
* Free the prompts structure from this iteration.
* If there's another, a new one will be allocated
* when we return to the top of this while loop.
*/
free_prompts(s->cur_prompt);
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
/*
* Get the next packet in case it's another
* INFO_REQUEST.
*/
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
}
/*
I broke the ability to cope with multiple consecutive k-i INFO_REQUESTS in r6437. This ought to be better (but I can't test that case). [originally from svn r6451] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-11-09 23:19:33 +00:00
* We should have SUCCESS or FAILURE now.
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
*/
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
pq_push_front(&ssh->pq_ssh2_userauth, pktin);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
} else if (s->can_passwd) {
/*
* Plain old password authentication.
*/
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
int changereq_first_time; /* not live over crReturn */
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.actx = SSH2_PKTCTX_PASSWORD;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
s->cur_prompt = new_prompts(ssh->frontend);
s->cur_prompt->to_server = TRUE;
s->cur_prompt->name = dupstr("SSH password");
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
add_prompt(s->cur_prompt, dupprintf("%s@%s's password: ",
ssh->username,
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
ssh->savedhost),
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
FALSE);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(s->cur_prompt, NULL);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
while (1) {
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
while (s->userpass_ret < 0 &&
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
bufchain_size(&ssh->user_input) > 0)
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(
s->cur_prompt, &ssh->user_input);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
if (s->userpass_ret >= 0)
break;
ssh->send_ok = 1;
crReturnV;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
ssh->send_ok = 0;
}
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
if (!s->userpass_ret) {
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/*
* Failed to get responses. Terminate.
*/
free_prompts(s->cur_prompt);
ssh_disconnect(ssh, NULL, "Unable to authenticate",
SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
TRUE);
crStopV;
}
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
/*
* Squirrel away the password. (We may need it later if
* asked to change it.)
*/
s->password = dupstr(s->cur_prompt->prompts[0]->result);
free_prompts(s->cur_prompt);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/*
* Send the password packet.
*
In SSH2, rather than sending an SSH_MSG_IGNORE after every password, just pad the packet out to 256 bytes. Much simpler. This leavs ssh2_pkt_defer() unused, so ifdef it out. [originally from svn r5122]
2005-01-17 00:50:35 +00:00
* We pad out the password packet to 256 bytes to make
* it harder for an attacker to find the length of the
* user's password.
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
*
In SSH2, rather than sending an SSH_MSG_IGNORE after every password, just pad the packet out to 256 bytes. Much simpler. This leavs ssh2_pkt_defer() unused, so ifdef it out. [originally from svn r5122]
2005-01-17 00:50:35 +00:00
* Anyone using a password longer than 256 bytes
* probably doesn't have much to worry about from
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
* people who find out how long their password is!
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_USERAUTH_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, ssh->username);
put_stringz(s->pktout, "ssh-connection");
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/* service requested */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "password");
put_bool(s->pktout, FALSE);
put_stringz(s->pktout, s->password);
Move password-packet padding into the BPP module. Now when we construct a packet containing sensitive data, we just set a field saying '... and make it take up at least this much space, to disguise its true size', and nothing in the rest of the system worries about that flag until ssh2bpp.c acts on it. Also, I've changed the strategy for doing the padding. Previously, we were following the real packet with an SSH_MSG_IGNORE to make up the size. But that was only a partial defence: it works OK against passive traffic analysis, but an attacker proxying the TCP stream and dribbling it out one byte at a time could still have found out the size of the real packet by noting when the dribbled data provoked a response. Now I put the SSH_MSG_IGNORE _first_, which should defeat that attack. But that in turn doesn't work when we're doing compression, because we can't predict the compressed sizes accurately enough to make that strategy sensible. Fortunately, compression provides an alternative strategy anyway: if we've got zlib turned on when we send one of these sensitive packets, then we can pad out the compressed zlib data as much as we like by adding empty RFC1951 blocks (effectively chaining ZLIB_PARTIAL_FLUSHes). So both strategies should now be dribble-proof.
2018-07-09 19:30:11 +00:00
s->pktout->minlen = 256;
ssh2_pkt_send(ssh, s->pktout);
Remove a spurious \r\n from an Event Log message [originally from svn r978]
2001-03-03 16:05:52 +00:00
logevent("Sent password");
(do_ssh2_authconn_state).method is redundant since r6437; remove. Remove FIXMEs from .type assignments, as they look fine. [originally from svn r6442] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53]
2005-10-31 22:43:51 +00:00
s->type = AUTH_TYPE_PASSWORD;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
/*
* Wait for next packet, in case it's a password change
* request.
*/
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
changereq_first_time = TRUE;
while (pktin->type == SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ) {
/*
* We're being asked for a new password
* (perhaps not for the first time).
* Loop until the server accepts it.
*/
int got_new = FALSE; /* not live over crReturn */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen prompt; /* not live over crReturn */
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
{
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
const char *msg;
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
if (changereq_first_time)
msg = "Server requested password change";
else
msg = "Server rejected new password";
logevent(msg);
c_write_str(ssh, msg);
c_write_str(ssh, "\r\n");
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
prompt = get_string(pktin);
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
s->cur_prompt = new_prompts(ssh->frontend);
s->cur_prompt->to_server = TRUE;
s->cur_prompt->name = dupstr("New SSH password");
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
s->cur_prompt->instruction = mkstr(prompt);
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
s->cur_prompt->instr_reqd = TRUE;
Slight change to password expiry UI for the benefit of Cisco servers, which are as usual slightly odd. [originally from svn r6845]
2006-09-05 21:39:30 +00:00
/*
* There's no explicit requirement in the protocol
* for the "old" passwords in the original and
* password-change messages to be the same, and
* apparently some Cisco kit supports password change
* by the user entering a blank password originally
* and the real password subsequently, so,
* reluctantly, we prompt for the old password again.
*
* (On the other hand, some servers don't even bother
* to check this field.)
*/
add_prompt(s->cur_prompt,
dupstr("Current password (blank for previously entered password): "),
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
FALSE);
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
add_prompt(s->cur_prompt, dupstr("Enter new password: "),
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
FALSE);
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
add_prompt(s->cur_prompt, dupstr("Confirm new password: "),
While I'm crusading against arbitrary limits, here's a redesign of prompt_t to arrange that the buffer in which each prompt is stored can be reallocated larger during the input process. [originally from svn r9317]
2011-10-02 11:50:45 +00:00
FALSE);
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
/*
* Loop until the user manages to enter the same
* password twice.
*/
while (!got_new) {
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(
s->cur_prompt, NULL);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
while (1) {
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
while (s->userpass_ret < 0 &&
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
bufchain_size(&ssh->user_input) > 0)
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
s->userpass_ret = get_userpass_input(
s->cur_prompt, &ssh->user_input);
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
if (s->userpass_ret >= 0)
break;
ssh->send_ok = 1;
crReturnV;
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
ssh->send_ok = 0;
}
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
if (!s->userpass_ret) {
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
/*
* Failed to get responses. Terminate.
*/
/* burn the evidence */
free_prompts(s->cur_prompt);
Introduce a new utility function smemclr(), which memsets things to zero but does it in such a way that over-clever compilers hopefully won't helpfully optimise the call away if you do it just before freeing something or letting it go out of scope. Use this for (hopefully) every memset whose job is to destroy sensitive data that might otherwise be left lying around in the process's memory. [originally from svn r9586]
2012-07-22 19:51:50 +00:00
smemclr(s->password, strlen(s->password));
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
sfree(s->password);
ssh_disconnect(ssh, NULL, "Unable to authenticate",
SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER,
TRUE);
crStopV;
}
/*
Slight change to password expiry UI for the benefit of Cisco servers, which are as usual slightly odd. [originally from svn r6845]
2006-09-05 21:39:30 +00:00
* If the user specified a new original password
* (IYSWIM), overwrite any previously specified
* one.
* (A side effect is that the user doesn't have to
* re-enter it if they louse up the new password.)
*/
if (s->cur_prompt->prompts[0]->result[0]) {
Introduce a new utility function smemclr(), which memsets things to zero but does it in such a way that over-clever compilers hopefully won't helpfully optimise the call away if you do it just before freeing something or letting it go out of scope. Use this for (hopefully) every memset whose job is to destroy sensitive data that might otherwise be left lying around in the process's memory. [originally from svn r9586]
2012-07-22 19:51:50 +00:00
smemclr(s->password, strlen(s->password));
Slight change to password expiry UI for the benefit of Cisco servers, which are as usual slightly odd. [originally from svn r6845]
2006-09-05 21:39:30 +00:00
/* burn the evidence */
sfree(s->password);
s->password =
dupstr(s->cur_prompt->prompts[0]->result);
}
/*
* Check the two new passwords match.
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
*/
Slight change to password expiry UI for the benefit of Cisco servers, which are as usual slightly odd. [originally from svn r6845]
2006-09-05 21:39:30 +00:00
got_new = (strcmp(s->cur_prompt->prompts[1]->result,
s->cur_prompt->prompts[2]->result)
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
== 0);
if (!got_new)
/* They don't. Silly user. */
c_write_str(ssh, "Passwords do not match\r\n");
}
/*
* Send the new password (along with the old one).
* (see above for padding rationale)
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
s->pktout = ssh_bpp_new_pktout(
ssh->bpp, SSH2_MSG_USERAUTH_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, ssh->username);
put_stringz(s->pktout, "ssh-connection");
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
/* service requested */
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, "password");
put_bool(s->pktout, TRUE);
put_stringz(s->pktout, s->password);
put_stringz(s->pktout,
Slight change to password expiry UI for the benefit of Cisco servers, which are as usual slightly odd. [originally from svn r6845]
2006-09-05 21:39:30 +00:00
s->cur_prompt->prompts[1]->result);
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
free_prompts(s->cur_prompt);
Move password-packet padding into the BPP module. Now when we construct a packet containing sensitive data, we just set a field saying '... and make it take up at least this much space, to disguise its true size', and nothing in the rest of the system worries about that flag until ssh2bpp.c acts on it. Also, I've changed the strategy for doing the padding. Previously, we were following the real packet with an SSH_MSG_IGNORE to make up the size. But that was only a partial defence: it works OK against passive traffic analysis, but an attacker proxying the TCP stream and dribbling it out one byte at a time could still have found out the size of the real packet by noting when the dribbled data provoked a response. Now I put the SSH_MSG_IGNORE _first_, which should defeat that attack. But that in turn doesn't work when we're doing compression, because we can't predict the compressed sizes accurately enough to make that strategy sensible. Fortunately, compression provides an alternative strategy anyway: if we've got zlib turned on when we send one of these sensitive packets, then we can pad out the compressed zlib data as much as we like by adding empty RFC1951 blocks (effectively chaining ZLIB_PARTIAL_FLUSHes). So both strategies should now be dribble-proof.
2018-07-09 19:30:11 +00:00
s->pktout->minlen = 256;
ssh2_pkt_send(ssh, s->pktout);
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
logevent("Sent new password");
/*
* Now see what the server has to say about it.
* (If it's CHANGEREQ again, it's not happy with the
* new password.)
*/
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_userauth)) != NULL);
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
changereq_first_time = FALSE;
}
/*
* We need to reexamine the current pktin at the top
* of the loop. Either:
* - we weren't asked to change password at all, in
* which case it's a SUCCESS or FAILURE with the
* usual meaning
* - we sent a new password, and the server was
* either OK with it (SUCCESS or FAILURE w/partial
* success) or unhappy with the _old_ password
* (FAILURE w/o partial success)
* In any of these cases, we go back to the top of
* the loop and start again.
*/
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
pq_push_front(&ssh->pq_ssh2_userauth, pktin);
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
/*
* We don't need the old password any more, in any
* case. Burn the evidence.
*/
Introduce a new utility function smemclr(), which memsets things to zero but does it in such a way that over-clever compilers hopefully won't helpfully optimise the call away if you do it just before freeing something or letting it go out of scope. Use this for (hopefully) every memset whose job is to destroy sensitive data that might otherwise be left lying around in the process's memory. [originally from svn r9586]
2012-07-22 19:51:50 +00:00
smemclr(s->password, strlen(s->password));
Fix for `ssh2-password-expiry'. Success case tested. (Much easier since r6437, and actually works to boot.) [originally from svn r6445] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-04 14:49:22 +00:00
sfree(s->password);
The authentication diagnostics in SSH2 should now be better. Additionally, the ability to switch usernames if you mistype the first one has been restored (although it didn't actually work because OpenSSH didn't feel like playing; patch submitted :-). [originally from svn r975]
2001-03-03 13:53:44 +00:00
} else {
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
char *str = dupprintf(
"No supported authentication methods available"
" (server sent: %.*s)", PTRLEN_PRINTF(methods));
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
When we disconnect because we have no supported authentication methods left to try, it's nice to have the version of that message going to the client contain the list of methods sent by the server. Saves a user having to pull it out of an SSH packet log. [originally from svn r8981]
2010-08-10 18:45:51 +00:00
ssh_disconnect(ssh, str,
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
"No supported authentication methods available",
SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
FALSE);
When we disconnect because we have no supported authentication methods left to try, it's nice to have the version of that message going to the client contain the list of methods sent by the server. Saves a user having to pull it out of an SSH packet log. [originally from svn r8981]
2010-08-10 18:45:51 +00:00
sfree(str);
Unix makefile now uses -O2, which massively cuts down key exchange time. This gives rise to a whole bunch of spare warnings, one or two of which might have been actual bugs; now all resolved. [originally from svn r3134]
2003-04-23 13:48:09 +00:00
crStopV;
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
}
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
Preliminary support for RSA user authentication in SSH2! Most of the error messages are currently wrong, and Pageant doesn't yet support the new key type, and I haven't thoroughly tested that falling back to password authentication and trying invalid keys etc all work. But what I have here has successfully performed a public key authentication, so it's working to at least some extent. [originally from svn r973]
2001-03-03 11:54:34 +00:00
}
Implement `bypass-ssh2-userauth', since from correspondence it sounds like there are servers which could in principle operate in this mode, although I don't know if any do in practice. (Hence, I haven't been able to test it.) [originally from svn r5748] [this svn revision also touched putty-wishlist]
2005-05-05 22:37:54 +00:00
}
Use the packet dispatch table to handle USERAUTH_BANNER messages, which should hopefully solve `drop-banner'. I haven't been able to test the failure case, but the behaviour with OpenSSH appears no worse. [originally from svn r5772] [this svn revision also touched putty-wishlist]
2005-05-12 15:09:35 +00:00
ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = NULL;
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
/* Clear up various bits and pieces from authentication. */
if (s->publickey_blob) {
Const-correctness of name fields in struct ssh_*. All the name strings in ssh_cipher, ssh_mac, ssh_hash, ssh_signkey point to compile-time string literals, hence should obviously be const char *. Most of these const-correctness patches are just a mechanical job of adding a 'const' in the one place you need it right now, and then chasing the implications through the code adding further consts until it compiles. But this one has actually shown up a bug: the 'algorithm' output parameter in ssh2_userkey_loadpub was sometimes returning a pointer to a string literal, and sometimes a pointer to dynamically allocated memory, so callers were forced to either sometimes leak memory or sometimes free a bad thing. Now it's consistently dynamically allocated, and should be freed everywhere too.
2015-05-15 09:12:06 +00:00
sfree(s->publickey_algorithm);
Change ssh.h crypto APIs to output to BinarySink. This affects all the functions that generate public and private key and signature blobs of all kinds, plus ssh_ecdhkex_getpublic. Instead of returning a bare block of memory and taking an extra 'int *length' parameter, all these functions now write to a BinarySink, and it's the caller's job to have prepared an appropriate one where they want the output to go (usually a strbuf). The main value of this change is that those blob-generation functions were chock full of ad-hoc length-counting and data marshalling. You have only to look at rsa2_{public,private}_blob, for example, to see the kind of thing I was keen to get rid of!
2018-05-24 09:59:39 +00:00
strbuf_free(s->publickey_blob);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
sfree(s->publickey_comment);
}
r6437 broke the case where Pageant is running but contains no SSH-2 keys that the SSH-2 server is happy with. Fixed, and since I'm here, fix `pubkeyfile-and-pageant' as well (for SSH-1 and SSH-2). Also, in SSH-2, we now reexamine "methods that can continue" for every Pageant key offer, which is technically more correct although it seems unlikely that it was causing any real problems. (It's not entirely pretty, but neither was the old code. We could probably do with some sort of abstraction for public/private keys to avoid carting lots of fiddly bits of data around.) [originally from svn r6459] [r6437 == 8719f92c1426609de7ead4a490a15d1d18875f53] [this svn revision also touched putty-wishlist]
2005-11-13 16:06:41 +00:00
if (s->agent_response)
sfree(s->agent_response);
Revamp SSH authentication code so that user interaction is more abstracted out; replace loops structured around a single interaction per loop with less tortuous code (fixes: `ki-multiprompt-crash', `ssh1-bad-passphrase-crash'; makes `ssh2-password-expiry' and `proxy-password-prompt' easier). The new interaction abstraction has a lot of fields that are unused in the current code (things like window captions); this is groundwork for `gui-auth'. However, ssh.c still writes directly to stderr; that may want to be fixed. In the GUI apps, user interaction is moved to terminal.c. This should make it easier to fix things like UTF-8 username entry, although I haven't attempted to do so. Also, control character filtering can be tailored to be appropriate for individual front-ends; so far I don't promise anything other than not having made it any worse. I've tried to test this fairly exhaustively (although Mac stuff is untested, as usual). It all seems to basically work, but I bet there are new bugs. (One I know about is that you can no longer make the PuTTY window go away with a ^D at the password prompt; this should be fixed.) [originally from svn r6437] [this svn revision also touched putty-wishlist]
2005-10-30 20:24:09 +00:00
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
if (s->userauth_success) {
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
/*
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
* We've just received USERAUTH_SUCCESS, and we haven't sent
* any packets since. Signal the transport layer to consider
* doing an immediate rekey, if it has any reason to want to.
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
*
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
* (Relying on we_are_in is not sufficient. One of the reasons
* to do a post-userauth rekey is OpenSSH delayed compression;
* draft-miller-secsh-compression-delayed is quite clear that
* that triggers on USERAUTH_SUCCESS specifically, and
* we_are_in can become set for other reasons.)
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
*/
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->rekey_reason = NULL; /* will be filled in later */
ssh->rekey_class = RK_POST_USERAUTH;
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
queue_idempotent_callback(&ssh->ssh2_transport_icb);
Implement zlib@openssh.com, using the rekey-after-userauth method suggested in the wishlist entry. [originally from svn r9120] [this svn revision also touched putty-website,putty-wishlist]
2011-03-04 22:34:47 +00:00
}
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
/*
* Finally, hand over to the connection layer.
*/
do_ssh2_connection(ssh);
ssh->current_user_input_fn = ssh2_connection_input;
Call every new user input consumer when it's set up. This fixes further embarrassing hangs in the wake of the big restructuring, in which we'd assign a new function pointer into ssh->current_user_input_fn but not immediately call it to let it process whatever might already be waiting for it in the user input queue.
2018-05-18 10:40:21 +00:00
queue_idempotent_callback(&ssh->user_input_consumer);
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crFinishV;
}
static void ssh2_userauth_input(Ssh ssh)
{
do_ssh2_userauth(ssh);
}
/*
* Handle the SSH-2 connection layer.
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_connection(Ssh ssh, PktIn *pktin)
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
{
pktin->refcount++; /* avoid packet being freed when we return */
pq_push(&ssh->pq_ssh2_connection, pktin);
queue_idempotent_callback(&ssh->ssh2_connection_icb);
}
static void ssh2_response_connection(struct ssh_channel *c,
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktIn *pktin, void *ctx)
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
{
if (pktin)
ssh2_msg_connection(c->ssh, pktin);
}
Install ssh-connection packet handlers synchronously. I had a one-off 'Strange packet received' error yesterday for an SSH_MSG_GLOBAL_REQUEST at connection startup. I wasn't able to reproduce, but examining the packet logs from the successful retry suggested that the global request in question was an OpenSSH 'here are my hostkeys' message. My belief is that in the failing connection that request packet must have arrived exceptionally promptly, and been added to pq_full before the preceding SSH_MSG_USERAUTH_SUCCESS had been processed. So the code that loops along pq_full feeding everything to the dispatch table would have moved the USERAUTH_SUCCESS on to pq_ssh2_userauth and scheduled a callback to handle it, and then moved on to the GLOBAL_REQUEST which would have gone straight to the dispatch table handler for 'help, we weren't expecting this message'. The userauth callback would later on have installed a more sensible dispatch table handler for global requests, but by then, it was too late. Solution: make a special case during pq_full processing, so that when we see USERAUTH_SUCCESS we _immediately_ - before continuing to traverse pq_full - install the initial dispatch table entries for the ssh-connection protocol. That way, even if connection messages are already in the queue, we won't get confused by them.
2018-05-31 17:42:47 +00:00
static void ssh2_connection_setup(Ssh ssh)
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
{
Install ssh-connection packet handlers synchronously. I had a one-off 'Strange packet received' error yesterday for an SSH_MSG_GLOBAL_REQUEST at connection startup. I wasn't able to reproduce, but examining the packet logs from the successful retry suggested that the global request in question was an OpenSSH 'here are my hostkeys' message. My belief is that in the failing connection that request packet must have arrived exceptionally promptly, and been added to pq_full before the preceding SSH_MSG_USERAUTH_SUCCESS had been processed. So the code that loops along pq_full feeding everything to the dispatch table would have moved the USERAUTH_SUCCESS on to pq_ssh2_userauth and scheduled a callback to handle it, and then moved on to the GLOBAL_REQUEST which would have gone straight to the dispatch table handler for 'help, we weren't expecting this message'. The userauth callback would later on have installed a more sensible dispatch table handler for global requests, but by then, it was too late. Solution: make a special case during pq_full processing, so that when we see USERAUTH_SUCCESS we _immediately_ - before continuing to traverse pq_full - install the initial dispatch table entries for the ssh-connection protocol. That way, even if connection messages are already in the queue, we won't get confused by them.
2018-05-31 17:42:47 +00:00
/*
* Initially, most connection-protocol messages go to the function
* that queues them for handling by the main do_ssh2_connection
* coroutine.
*/
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = ssh2_msg_connection;
ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = ssh2_msg_connection;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = ssh2_msg_connection;
Install ssh-connection packet handlers synchronously. I had a one-off 'Strange packet received' error yesterday for an SSH_MSG_GLOBAL_REQUEST at connection startup. I wasn't able to reproduce, but examining the packet logs from the successful retry suggested that the global request in question was an OpenSSH 'here are my hostkeys' message. My belief is that in the failing connection that request packet must have arrived exceptionally promptly, and been added to pq_full before the preceding SSH_MSG_USERAUTH_SUCCESS had been processed. So the code that loops along pq_full feeding everything to the dispatch table would have moved the USERAUTH_SUCCESS on to pq_ssh2_userauth and scheduled a callback to handle it, and then moved on to the GLOBAL_REQUEST which would have gone straight to the dispatch table handler for 'help, we weren't expecting this message'. The userauth callback would later on have installed a more sensible dispatch table handler for global requests, but by then, it was too late. Solution: make a special case during pq_full processing, so that when we see USERAUTH_SUCCESS we _immediately_ - before continuing to traverse pq_full - install the initial dispatch table entries for the ssh-connection protocol. That way, even if connection messages are already in the queue, we won't get confused by them.
2018-05-31 17:42:47 +00:00
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] =
ssh2_msg_connection;
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = ssh2_msg_connection;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = ssh2_msg_connection;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = ssh2_msg_connection;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_connection;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_connection;
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
/*
Install ssh-connection packet handlers synchronously. I had a one-off 'Strange packet received' error yesterday for an SSH_MSG_GLOBAL_REQUEST at connection startup. I wasn't able to reproduce, but examining the packet logs from the successful retry suggested that the global request in question was an OpenSSH 'here are my hostkeys' message. My belief is that in the failing connection that request packet must have arrived exceptionally promptly, and been added to pq_full before the preceding SSH_MSG_USERAUTH_SUCCESS had been processed. So the code that loops along pq_full feeding everything to the dispatch table would have moved the USERAUTH_SUCCESS on to pq_ssh2_userauth and scheduled a callback to handle it, and then moved on to the GLOBAL_REQUEST which would have gone straight to the dispatch table handler for 'help, we weren't expecting this message'. The userauth callback would later on have installed a more sensible dispatch table handler for global requests, but by then, it was too late. Solution: make a special case during pq_full processing, so that when we see USERAUTH_SUCCESS we _immediately_ - before continuing to traverse pq_full - install the initial dispatch table entries for the ssh-connection protocol. That way, even if connection messages are already in the queue, we won't get confused by them.
2018-05-31 17:42:47 +00:00
* But a couple of them are easier to pass to special handler
* functions right from the start.
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
*/
ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] =
ssh2_msg_channel_window_adjust;
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] =
ssh2_msg_global_request;
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
Install ssh-connection packet handlers synchronously. I had a one-off 'Strange packet received' error yesterday for an SSH_MSG_GLOBAL_REQUEST at connection startup. I wasn't able to reproduce, but examining the packet logs from the successful retry suggested that the global request in question was an OpenSSH 'here are my hostkeys' message. My belief is that in the failing connection that request packet must have arrived exceptionally promptly, and been added to pq_full before the preceding SSH_MSG_USERAUTH_SUCCESS had been processed. So the code that loops along pq_full feeding everything to the dispatch table would have moved the USERAUTH_SUCCESS on to pq_ssh2_userauth and scheduled a callback to handle it, and then moved on to the GLOBAL_REQUEST which would have gone straight to the dispatch table handler for 'help, we weren't expecting this message'. The userauth callback would later on have installed a more sensible dispatch table handler for global requests, but by then, it was too late. Solution: make a special case during pq_full processing, so that when we see USERAUTH_SUCCESS we _immediately_ - before continuing to traverse pq_full - install the initial dispatch table entries for the ssh-connection protocol. That way, even if connection messages are already in the queue, we won't get confused by them.
2018-05-31 17:42:47 +00:00
/*
* Ensure our channels tree exists.
*/
if (!ssh->channels)
ssh->channels = newtree234(ssh_channelcmp);
}
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
typedef struct mainchan {
Ssh ssh;
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
SshChannel *sc;
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
Channel chan;
} mainchan;
static void mainchan_free(Channel *chan);
static void mainchan_open_confirmation(Channel *chan);
static void mainchan_open_failure(Channel *chan, const char *errtext);
static int mainchan_send(Channel *chan, int is_stderr, const void *, int);
static void mainchan_send_eof(Channel *chan);
static void mainchan_set_input_wanted(Channel *chan, int wanted);
static char *mainchan_log_close_msg(Channel *chan);
static const struct ChannelVtable mainchan_channelvt = {
mainchan_free,
mainchan_open_confirmation,
mainchan_open_failure,
mainchan_send,
mainchan_send_eof,
mainchan_set_input_wanted,
mainchan_log_close_msg,
chan_no_eager_close,
};
static mainchan *mainchan_new(Ssh ssh)
{
mainchan *mc = snew(mainchan);
mc->ssh = ssh;
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
mc->sc = NULL;
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
mc->chan.vt = &mainchan_channelvt;
mc->chan.initial_fixed_window_size = 0;
return mc;
}
static void mainchan_free(Channel *chan)
{
assert(chan->vt == &mainchan_channelvt);
mainchan *mc = FROMFIELD(chan, mainchan, chan);
mc->ssh->mainchan = NULL;
sfree(mc);
}
static void mainchan_open_confirmation(Channel *chan)
{
assert(FALSE && "OPEN_CONFIRMATION for main channel should be "
"handled by connection layer setup");
}
static void mainchan_open_failure(Channel *chan, const char *errtext)
{
assert(FALSE && "OPEN_FAILURE for main channel should be "
"handled by connection layer setup");
}
static int mainchan_send(Channel *chan, int is_stderr,
const void *data, int length)
{
assert(chan->vt == &mainchan_channelvt);
mainchan *mc = FROMFIELD(chan, mainchan, chan);
return from_backend(mc->ssh->frontend, is_stderr, data, length);
}
static void mainchan_send_eof(Channel *chan)
{
assert(chan->vt == &mainchan_channelvt);
mainchan *mc = FROMFIELD(chan, mainchan, chan);
if (!mc->ssh->sent_console_eof &&
(from_backend_eof(mc->ssh->frontend) || mc->ssh->got_pty)) {
/*
* Either from_backend_eof told us that the front end wants us
* to close the outgoing side of the connection as soon as we
* see EOF from the far end, or else we've unilaterally
* decided to do that because we've allocated a remote pty and
* hence EOF isn't a particularly meaningful concept.
*/
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
sshfwd_write_eof(mc->sc);
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
}
mc->ssh->sent_console_eof = TRUE;
}
static void mainchan_set_input_wanted(Channel *chan, int wanted)
{
assert(chan->vt == &mainchan_channelvt);
mainchan *mc = FROMFIELD(chan, mainchan, chan);
/*
* This is the main channel of the SSH session, i.e. the one tied
* to the standard input (or GUI) of the primary SSH client user
* interface. So ssh->send_ok is how we control whether we're
* reading from that input.
*/
mc->ssh->send_ok = wanted;
}
static char *mainchan_log_close_msg(Channel *chan)
{
return dupstr("Main session channel closed");
}
Install ssh-connection packet handlers synchronously. I had a one-off 'Strange packet received' error yesterday for an SSH_MSG_GLOBAL_REQUEST at connection startup. I wasn't able to reproduce, but examining the packet logs from the successful retry suggested that the global request in question was an OpenSSH 'here are my hostkeys' message. My belief is that in the failing connection that request packet must have arrived exceptionally promptly, and been added to pq_full before the preceding SSH_MSG_USERAUTH_SUCCESS had been processed. So the code that loops along pq_full feeding everything to the dispatch table would have moved the USERAUTH_SUCCESS on to pq_ssh2_userauth and scheduled a callback to handle it, and then moved on to the GLOBAL_REQUEST which would have gone straight to the dispatch table handler for 'help, we weren't expecting this message'. The userauth callback would later on have installed a more sensible dispatch table handler for global requests, but by then, it was too late. Solution: make a special case during pq_full processing, so that when we see USERAUTH_SUCCESS we _immediately_ - before continuing to traverse pq_full - install the initial dispatch table entries for the ssh-connection protocol. That way, even if connection messages are already in the queue, we won't get confused by them.
2018-05-31 17:42:47 +00:00
static void do_ssh2_connection(void *vctx)
{
Ssh ssh = (Ssh)vctx;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktIn *pktin;
Install ssh-connection packet handlers synchronously. I had a one-off 'Strange packet received' error yesterday for an SSH_MSG_GLOBAL_REQUEST at connection startup. I wasn't able to reproduce, but examining the packet logs from the successful retry suggested that the global request in question was an OpenSSH 'here are my hostkeys' message. My belief is that in the failing connection that request packet must have arrived exceptionally promptly, and been added to pq_full before the preceding SSH_MSG_USERAUTH_SUCCESS had been processed. So the code that loops along pq_full feeding everything to the dispatch table would have moved the USERAUTH_SUCCESS on to pq_ssh2_userauth and scheduled a callback to handle it, and then moved on to the GLOBAL_REQUEST which would have gone straight to the dispatch table handler for 'help, we weren't expecting this message'. The userauth callback would later on have installed a more sensible dispatch table handler for global requests, but by then, it was too late. Solution: make a special case during pq_full processing, so that when we see USERAUTH_SUCCESS we _immediately_ - before continuing to traverse pq_full - install the initial dispatch table entries for the ssh-connection protocol. That way, even if connection messages are already in the queue, we won't get confused by them.
2018-05-31 17:42:47 +00:00
struct do_ssh2_connection_state {
int crLine;
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Install ssh-connection packet handlers synchronously. I had a one-off 'Strange packet received' error yesterday for an SSH_MSG_GLOBAL_REQUEST at connection startup. I wasn't able to reproduce, but examining the packet logs from the successful retry suggested that the global request in question was an OpenSSH 'here are my hostkeys' message. My belief is that in the failing connection that request packet must have arrived exceptionally promptly, and been added to pq_full before the preceding SSH_MSG_USERAUTH_SUCCESS had been processed. So the code that loops along pq_full feeding everything to the dispatch table would have moved the USERAUTH_SUCCESS on to pq_ssh2_userauth and scheduled a callback to handle it, and then moved on to the GLOBAL_REQUEST which would have gone straight to the dispatch table handler for 'help, we weren't expecting this message'. The userauth callback would later on have installed a more sensible dispatch table handler for global requests, but by then, it was too late. Solution: make a special case during pq_full processing, so that when we see USERAUTH_SUCCESS we _immediately_ - before continuing to traverse pq_full - install the initial dispatch table entries for the ssh-connection protocol. That way, even if connection messages are already in the queue, we won't get confused by them.
2018-05-31 17:42:47 +00:00
};
crState(do_ssh2_connection_state);
crBeginState;
/*
* Initialise our dispatch table entries. Normally this will have
* been done as a side effect of USERAUTH_SUCCESS, but in some
* cases, it might not (e.g. if we bypassed userauth, or if we're
* running the bare-connection protocol).
*/
ssh2_connection_setup(ssh);
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
/*
Implement part of `ssh2-generality': introduce the ability to tell PuTTY / Plink not to run a remote shell/command at all. Supported in the GUI configuration and via the (OpenSSH-like) -N command-line option. No effort is currently made to arrange `nice' UI properties. If you do this in GUI PuTTY, a full-size terminal window will still be created, and will sit there with almost nothing in it throughout your session. If you do it in Plink, Plink will not accept any kind of request to terminate gracefully; you'll have to ^C or kill it. Nonetheless, even this little will be useful to some people... [originally from svn r4614]
2004-10-13 13:43:11 +00:00
* Create the main session channel.
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
*/
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_ssh_no_shell)) {
New command-line option in Plink (and PuTTY, though it's less useful there): `plink host -nc host2:port' causes the SSH connection's main channel to be replaced with a direct-tcpip connection to the specified destination. This feature is mainly designed for use as a local proxy: setting your local proxy command to `plink %proxyhost -nc %host:%port' lets you tunnel SSH over SSH with a minimum of fuss. Works on all platforms. [originally from svn r6823]
2006-08-28 15:12:37 +00:00
ssh->mainchan = NULL;
Most of the code for "nc" mode duplicated that for opening a session or a fowarded port. Arrange that this code is shared instead. The main visible change is a slight change of log messages. [originally from svn r9655]
2012-09-08 19:46:07 +00:00
} else {
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
mainchan *mc = mainchan_new(ssh);
New command-line option in Plink (and PuTTY, though it's less useful there): `plink host -nc host2:port' causes the SSH connection's main channel to be replaced with a direct-tcpip connection to the specified destination. This feature is mainly designed for use as a local proxy: setting your local proxy command to `plink %proxyhost -nc %host:%port' lets you tunnel SSH over SSH with a minimum of fuss. Works on all platforms. [originally from svn r6823]
2006-08-28 15:12:37 +00:00
Most of the code for "nc" mode duplicated that for opening a session or a fowarded port. Arrange that this code is shared instead. The main visible change is a slight change of log messages. [originally from svn r9655]
2012-09-08 19:46:07 +00:00
if (*conf_get_str(ssh->conf, CONF_ssh_nc_host)) {
/*
* Just start a direct-tcpip channel and use it as the main
* channel.
*/
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
mc->sc = ssh_lportfwd_open
(&ssh->cl, conf_get_str(ssh->conf, CONF_ssh_nc_host),
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
conf_get_int(ssh->conf, CONF_ssh_nc_port),
"main channel", &mc->chan);
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
ssh->mainchan = FROMFIELD(mc->sc, struct ssh_channel, sc);
Most of the code for "nc" mode duplicated that for opening a session or a fowarded port. Arrange that this code is shared instead. The main visible change is a slight change of log messages. [originally from svn r9655]
2012-09-08 19:46:07 +00:00
ssh->ncmode = TRUE;
} else {
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
ssh->mainchan = snew(struct ssh_channel);
mc->sc = &ssh->mainchan->sc;
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
ssh->mainchan->ssh = ssh;
ssh_channel_init(ssh->mainchan);
ssh->mainchan->chan = &mc->chan;
Most of the code for "nc" mode duplicated that for opening a session or a fowarded port. Arrange that this code is shared instead. The main visible change is a slight change of log messages. [originally from svn r9655]
2012-09-08 19:46:07 +00:00
s->pktout = ssh2_chanopen_init(ssh->mainchan, "session");
logevent("Opening session as main channel");
ssh2_pkt_send(ssh, s->pktout);
ssh->ncmode = FALSE;
New command-line option in Plink (and PuTTY, though it's less useful there): `plink host -nc host2:port' causes the SSH connection's main channel to be replaced with a direct-tcpip connection to the specified destination. This feature is mainly designed for use as a local proxy: setting your local proxy command to `plink %proxyhost -nc %host:%port' lets you tunnel SSH over SSH with a minimum of fuss. Works on all platforms. [originally from svn r6823]
2006-08-28 15:12:37 +00:00
}
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_connection)) != NULL);
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
if (pktin->type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION &&
pktin->type != SSH2_MSG_CHANNEL_OPEN_FAILURE) {
bombout(("Server sent strange packet %d in response to main "
"channel open request", pktin->type));
Implement part of `ssh2-generality': introduce the ability to tell PuTTY / Plink not to run a remote shell/command at all. Supported in the GUI configuration and via the (OpenSSH-like) -N command-line option. No effort is currently made to arrange `nice' UI properties. If you do this in GUI PuTTY, a full-size terminal window will still be created, and will sit there with almost nothing in it throughout your session. If you do it in Plink, Plink will not accept any kind of request to terminate gracefully; you'll have to ^C or kill it. Nonetheless, even this little will be useful to some people... [originally from svn r4614]
2004-10-13 13:43:11 +00:00
crStopV;
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
}
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
if (get_uint32(pktin) != ssh->mainchan->localid) {
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
bombout(("Server's response to main channel open cited wrong"
" channel number"));
crStopV;
}
if (pktin->type == SSH2_MSG_CHANNEL_OPEN_FAILURE) {
char *errtext = ssh2_channel_open_failure_error_text(pktin);
bombout(("Server refused to open main channel: %s", errtext));
sfree(errtext);
Implement part of `ssh2-generality': introduce the ability to tell PuTTY / Plink not to run a remote shell/command at all. Supported in the GUI configuration and via the (OpenSSH-like) -N command-line option. No effort is currently made to arrange `nice' UI properties. If you do this in GUI PuTTY, a full-size terminal window will still be created, and will sit there with almost nothing in it throughout your session. If you do it in Plink, Plink will not accept any kind of request to terminate gracefully; you'll have to ^C or kill it. Nonetheless, even this little will be useful to some people... [originally from svn r4614]
2004-10-13 13:43:11 +00:00
crStopV;
}
Log the server's diagnostics if main channel open fails. This has been a FIXME in the code for ages, because back when the main channel was always a pty session or a program run in a pipe, there weren't that many circumstances in which the actual CHANNEL_OPEN could return failure, so it never seemed like a priority to get round to pulling the error information out of the CHANNEL_OPEN_FAILURE response message and including it in PuTTY or Plink's local error message. However, 'plink -nc' is the real reason why this is actually important; if you tell the SSH server to make a direct-tcpip network connection as its main channel, then that can fail for all the usual network-unreliability reasons, and you actually do want to know which (did you misspell the hostname, or is the target server refusing connections, or has network connectivity failed?). This actually bit me today when I had such a network failure, and had to debug it by pulling that information manually out of a packet log. Time to eliminate that FIXME. So I've pulled the error-extracting code out of the previous handler for OPEN_FAILURE on non-main channels into a separate function, and arranged to call that function if the main channel open fails too. In the process I've made a couple of minor tweaks, e.g. if the server sends back a reason code we haven't heard of, we say _what_ that reason code was, and also we at least make a token effort to spot if we see a packet other than OPEN_{CONFIRMATION,FAILURE} reaching the main loop in response to the main channel-open.
2017-06-15 17:58:01 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ssh->mainchan->remoteid = get_uint32(pktin);
Don't abuse a remote channel number of (unsigned)(-1) to indicate a channel for which we don't yet have a remote number, and instead add a flag to indicate this fact. Fixes bug ssh-remoteid-minusone. [originally from svn r5171]
2005-01-22 16:06:21 +00:00
ssh->mainchan->halfopen = FALSE;
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ssh->mainchan->v.v2.remwindow = get_uint32(pktin);
ssh->mainchan->v.v2.remmaxpkt = get_uint32(pktin);
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
update_specials_menu(ssh->frontend);
Most of the code for "nc" mode duplicated that for opening a session or a fowarded port. Arrange that this code is shared instead. The main visible change is a slight change of log messages. [originally from svn r9655]
2012-09-08 19:46:07 +00:00
logevent("Opened main channel");
New command-line option in Plink (and PuTTY, though it's less useful there): `plink host -nc host2:port' causes the SSH connection's main channel to be replaced with a direct-tcpip connection to the specified destination. This feature is mainly designed for use as a local proxy: setting your local proxy command to `plink %proxyhost -nc %host:%port' lets you tunnel SSH over SSH with a minimum of fuss. Works on all platforms. [originally from svn r6823]
2006-08-28 15:12:37 +00:00
}
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
/*
* Now we have a channel, make dispatch table entries for
* general channel-based messages.
*/
ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] =
ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] =
ssh2_msg_channel_data;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_channel_eof;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_channel_close;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] =
ssh2_msg_channel_open_confirmation;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] =
ssh2_msg_channel_open_failure;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] =
ssh2_msg_channel_request;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] =
ssh2_msg_channel_open;
Handle all replies to CHANNEL_REQUESTs through the per-channel queue. Each of the minor start-of-session requests is now dealt with by its own little co-routine, while the shell/command is done in do_ssh2_authconn() itself. This eliminates one more round-trip in session setup: PuTTY gets all the way up to sending a shell request before worrying about any replies. [originally from svn r9616]
2012-08-25 13:39:32 +00:00
ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = ssh2_msg_channel_response;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = ssh2_msg_channel_response;
Revert premature queuing of channel messages. At the point where the do_ssh2_connection coroutine rewrites lots of dispatch table entries to point to things other than itself, there's a possibility that it's too late, because some packets of those types have already arrived and been put into pq_ssh2_connection. So you'd get weird errors like 'Strange packet received: type 94', in which the only thing that's strange is why packet 94 might conceivably be unexpected, since it's SSH_MSG_CHANNEL_DATA! (I observed this when 'plink host -nc otherhost:port' became a sharing downstream, but I have no reason to think that's the only circumstance where this can possibly occur, or even a reliable one. It just happened to have the right timing.) I'm not completely sure this is the _best_ solution, but it seems to work: at the point when I rewrite the dispatch table, I also return the whole of the connection packet queue to the main queue, so that it'll be run through the dispatch table a second time which will effectively filter out any packets that we've just installed new handlers for.
2018-05-25 20:17:09 +00:00
/*
* Put our current pending packet queue back to the front of
* pq_full, and then schedule a callback to re-process those
* packets (if any). That way, anything already in our queue that
* matches any of the table entries we've just modified will go to
* the right handler function, and won't come here to confuse us.
*/
Make pq_empty_on_to_front_of more general. It's really just a concatenator for a pair of linked lists, but unhelpfully restricted in which of the lists it replaces with the output. Better to have a three-argument function that puts the output wherever you like, whether it overlaps either or neither one of the inputs.
2018-09-19 19:30:40 +00:00
if (pq_peek(&ssh->pq_ssh2_connection)) {
pq_concatenate(&ssh->pq_full, &ssh->pq_ssh2_connection, &ssh->pq_full);
Revert premature queuing of channel messages. At the point where the do_ssh2_connection coroutine rewrites lots of dispatch table entries to point to things other than itself, there's a possibility that it's too late, because some packets of those types have already arrived and been put into pq_ssh2_connection. So you'd get weird errors like 'Strange packet received: type 94', in which the only thing that's strange is why packet 94 might conceivably be unexpected, since it's SSH_MSG_CHANNEL_DATA! (I observed this when 'plink host -nc otherhost:port' became a sharing downstream, but I have no reason to think that's the only circumstance where this can possibly occur, or even a reliable one. It just happened to have the right timing.) I'm not completely sure this is the _best_ solution, but it seems to work: at the point when I rewrite the dispatch table, I also return the whole of the connection packet queue to the main queue, so that it'll be run through the dispatch table a second time which will effectively filter out any packets that we've just installed new handlers for.
2018-05-25 20:17:09 +00:00
queue_idempotent_callback(&ssh->pq_full_consumer);
Make pq_empty_on_to_front_of more general. It's really just a concatenator for a pair of linked lists, but unhelpfully restricted in which of the lists it replaces with the output. Better to have a three-argument function that puts the output wherever you like, whether it overlaps either or neither one of the inputs.
2018-09-19 19:30:40 +00:00
}
Revert premature queuing of channel messages. At the point where the do_ssh2_connection coroutine rewrites lots of dispatch table entries to point to things other than itself, there's a possibility that it's too late, because some packets of those types have already arrived and been put into pq_ssh2_connection. So you'd get weird errors like 'Strange packet received: type 94', in which the only thing that's strange is why packet 94 might conceivably be unexpected, since it's SSH_MSG_CHANNEL_DATA! (I observed this when 'plink host -nc otherhost:port' became a sharing downstream, but I have no reason to think that's the only circumstance where this can possibly occur, or even a reliable one. It just happened to have the right timing.) I'm not completely sure this is the _best_ solution, but it seems to work: at the point when I rewrite the dispatch table, I also return the whole of the connection packet queue to the main queue, so that it'll be run through the dispatch table a second time which will effectively filter out any packets that we've just installed new handlers for.
2018-05-25 20:17:09 +00:00
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
/*
* Now the connection protocol is properly up and running, with
* all those dispatch table entries, so it's safe to let
* downstreams start trying to open extra channels through us.
*/
if (ssh->connshare)
share_activate(ssh->connshare, ssh->v_s);
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
if (ssh->mainchan && ssh_is_simple(ssh)) {
Small window-handling tweaks. Set the default big window to 0x7fffffff bytes, and tweak ssh2_set_window() so it can cope with that. Also arrange to send a private channel message in simple mode to tell the server that it can safely use a large window too. [originally from svn r7679]
2007-08-05 14:18:43 +00:00
/*
* This message indicates to the server that we promise
* not to try to run any other channel in parallel with
* this one, so it's safe for it to advertise a very large
* window and leave the flow control to TCP.
*/
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
s->pktout = ssh2_chanreq_init(ssh->mainchan,
"simple@putty.projects.tartarus.org",
NULL, NULL);
Small window-handling tweaks. Set the default big window to 0x7fffffff bytes, and tweak ssh2_set_window() so it can cope with that. Also arrange to send a private channel message in simple mode to tell the server that it can safely use a large window too. [originally from svn r7679]
2007-08-05 14:18:43 +00:00
ssh2_pkt_send(ssh, s->pktout);
}
Reduce the number of round-trips involved in opening an SSH-2 session by sending most of the initial SSH_MSG_CHANNEL_REQUEST messages before waiting for any replies. The initial version of this code was a clever thing with a two-pass loop, but that got hairy so I went for the simpler approach of separating the request and reply code and having flags to keep track of which requests have been sent. [originally from svn r9599]
2012-08-02 22:18:18 +00:00
/*
* Enable port forwardings.
*/
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
portfwdmgr_config(ssh->portfwdmgr, ssh->conf);
Reduce the number of round-trips involved in opening an SSH-2 session by sending most of the initial SSH_MSG_CHANNEL_REQUEST messages before waiting for any replies. The initial version of this code was a clever thing with a two-pass loop, but that got hairy so I went for the simpler approach of separating the request and reply code and having flags to keep track of which requests have been sent. [originally from svn r9599]
2012-08-02 22:18:18 +00:00
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
if (ssh->mainchan && !ssh->ncmode) {
/*
* Send the CHANNEL_REQUESTS for the main session channel.
* Each one is handled by its own little asynchronous
* co-routine.
*/
Reduce the number of round-trips involved in opening an SSH-2 session by sending most of the initial SSH_MSG_CHANNEL_REQUEST messages before waiting for any replies. The initial version of this code was a clever thing with a two-pass loop, but that got hairy so I went for the simpler approach of separating the request and reply code and having flags to keep track of which requests have been sent. [originally from svn r9599]
2012-08-02 22:18:18 +00:00
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
/* Potentially enable X11 forwarding. */
Prepare to have multiple X11 auth cookies valid at once. Rather than the top-level component of X forwarding being an X11Display structure which owns some auth data, it's now a collection of X11FakeAuth structures, each of which owns a display. The idea is that when we receive an X connection, we wait to see which of our available auth cookies it matches, and then connect to whatever X display that auth cookie identifies. At present the tree will only have one thing in it; this is all groundwork for later changes. [originally from svn r10079]
2013-11-17 14:05:10 +00:00
if (conf_get_int(ssh->conf, CONF_x11_forward)) {
ssh->x11disp =
x11_setup_display(conf_get_str(ssh->conf, CONF_x11_display),
ssh->conf);
if (!ssh->x11disp) {
/* FIXME: return an error message from x11_setup_display */
logevent("X11 forwarding not enabled: unable to"
" initialise X display");
} else {
ssh->x11auth = x11_invent_fake_auth
(ssh->x11authtree, conf_get_int(ssh->conf, CONF_x11_auth));
ssh->x11auth->disp = ssh->x11disp;
ssh2_setup_x11(ssh->mainchan, NULL, NULL);
}
}
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
/* Potentially enable agent forwarding. */
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
if (ssh_agent_forwarding_permitted(&ssh->cl))
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
ssh2_setup_agent(ssh->mainchan, NULL, NULL);
Implement OpenSSH's private agent forwarding extension. I believe we now interoperate with OpenSSH/SSH2 to _exactly_ the same level as we interoperate with SSH1. Which is pretty cool really. [originally from svn r980]
2001-03-03 16:38:44 +00:00
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
/* Now allocate a pty for the session. */
if (!conf_get_int(ssh->conf, CONF_nopty))
ssh2_setup_pty(ssh->mainchan, NULL, NULL);
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
/* Send environment variables. */
ssh2_setup_env(ssh->mainchan, NULL, NULL);
Moved the environment variables config block out of the Telnet panel into the Connection panel, and implemented support for the SSH2 "env" request. (I haven't yet found a server which accepts this request, so although I've visually checked the packet log and it looks OK, I haven't yet been able to do a full end-to-end test.) Also, the `pty' backend reads this data and does a series of `putenv' commands before launching the shell or application. This is mostly because in last week's UTF-8 faffings I got thoroughly sick of typing `export LANG=en_GB.UTF-8' every time I started a new testing pterm, and it suddenly occurred to me that this would be precisely the sort of thing you'd want to have pterm set up for you, particularly since you can configure it alongside the translation settings and so you can ensure they match up properly. [originally from svn r4645]
2004-10-16 10:56:54 +00:00
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
/*
* Start a shell or a remote command. We may have to attempt
* this twice if the config data has provided a second choice
* of command.
*/
while (1) {
int subsys;
char *cmd;
PSCP now uses the modern SFTP protocol if it can, and falls back to scp1 if it can't. Currently not very tested - I checked it in as soon as it completed a successful recursive copy in both directions. Also, one known bug: you can't specify a remote wildcard, because by the nature of SFTP we'll need to implement the wildcard engine on the client side. I do intend to do this (and use the same wildcard engine in PSFTP as well) but I haven't got round to it yet. [originally from svn r1208]
2001-08-26 18:32:28 +00:00
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
if (ssh->fallback_cmd) {
subsys = conf_get_int(ssh->conf, CONF_ssh_subsys2);
cmd = conf_get_str(ssh->conf, CONF_remote_cmd2);
} else {
subsys = conf_get_int(ssh->conf, CONF_ssh_subsys);
cmd = conf_get_str(ssh->conf, CONF_remote_cmd);
}
PSCP now uses the modern SFTP protocol if it can, and falls back to scp1 if it can't. Currently not very tested - I checked it in as soon as it completed a successful recursive copy in both directions. Also, one known bug: you can't specify a remote wildcard, because by the nature of SFTP we'll need to implement the wildcard engine on the client side. I do intend to do this (and use the same wildcard engine in PSFTP as well) but I haven't got round to it yet. [originally from svn r1208]
2001-08-26 18:32:28 +00:00
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
if (subsys) {
s->pktout = ssh2_chanreq_init(ssh->mainchan, "subsystem",
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh2_response_connection, NULL);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, cmd);
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
} else if (*cmd) {
s->pktout = ssh2_chanreq_init(ssh->mainchan, "exec",
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh2_response_connection, NULL);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(s->pktout, cmd);
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
} else {
s->pktout = ssh2_chanreq_init(ssh->mainchan, "shell",
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh2_response_connection, NULL);
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
}
ssh2_pkt_send(ssh, s->pktout);
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
crMaybeWaitUntilV((pktin = pq_pop(&ssh->pq_ssh2_connection)) != NULL);
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
bombout(("Unexpected response to shell/command request:"
" packet type %d", pktin->type));
crStopV;
}
/*
* We failed to start the command. If this is the
* fallback command, we really are finished; if it's
* not, and if the fallback command exists, try falling
* back to it before complaining.
*/
if (!ssh->fallback_cmd &&
*conf_get_str(ssh->conf, CONF_remote_cmd2)) {
logevent("Primary command failed; attempting fallback");
ssh->fallback_cmd = TRUE;
continue;
}
bombout(("Server refused to start a shell/command"));
Unix makefile now uses -O2, which massively cuts down key exchange time. This gives rise to a whole bunch of spare warnings, one or two of which might have been actual bugs; now all resolved. [originally from svn r3134]
2003-04-23 13:48:09 +00:00
crStopV;
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
} else {
logevent("Started a shell/command");
PSCP now uses the modern SFTP protocol if it can, and falls back to scp1 if it can't. Currently not very tested - I checked it in as soon as it completed a successful recursive copy in both directions. Also, one known bug: you can't specify a remote wildcard, because by the nature of SFTP we'll need to implement the wildcard engine on the client side. I do intend to do this (and use the same wildcard engine in PSFTP as well) but I haven't got round to it yet. [originally from svn r1208]
2001-08-26 18:32:28 +00:00
}
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
break;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
All of the initial CHANNEL_REQUESTs are conditional on (ssh->mainchan && !ssh->ncmode), so bundle them up in a big block conditional on this rather than checking it five times. [originally from svn r9647]
2012-09-01 12:03:12 +00:00
} else {
ssh->editing = ssh->echoing = TRUE;
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->state = SSH_STATE_SESSION;
if (ssh->size_needed)
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
backend_size(&ssh->backend, ssh->term_width, ssh->term_height);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->eof_needed)
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
backend_special(&ssh->backend, TS_EOF);
Window resizing wasn't working in SSH2 [originally from svn r753]
2000-10-24 09:49:03 +00:00
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
/*
* Transfer data!
*/
Line discipline module now uses dynamically allocated data. Also fixed one or two other minor problems. [originally from svn r2141]
2002-10-26 10:16:19 +00:00
if (ssh->ldisc)
Move echo/edit state change functionality out of ldisc_send. I'm not actually sure why we've always had back ends notify ldisc of changes to echo/edit settings by giving ldisc_send(ldisc,NULL,0,0) a special meaning, instead of by having a separate dedicated notify function with its own prototype and parameter set. Coverity's recent observation that the two kinds of call don't even have the same requirements on the ldisc (particularly, whether ldisc->term can be NULL) makes me realise that it's really high time I separated the two conceptually different operations into actually different functions. While I'm here, I've renamed the confusing ldisc_update() function which that special operation ends up feeding to, because it's not actually a function applying to an ldisc - it applies to a front end. So ldisc_send(ldisc,NULL,0,0) is now ldisc_echoedit_update(ldisc), and that in turn figures out the current echo/edit settings before passing them on to frontend_echoedit_update(). I think that should be clearer.
2014-11-22 16:12:47 +00:00
ldisc_echoedit_update(ssh->ldisc); /* cause ldisc to notice changes */
Implement part of `ssh2-generality': introduce the ability to tell PuTTY / Plink not to run a remote shell/command at all. Supported in the GUI configuration and via the (OpenSSH-like) -N command-line option. No effort is currently made to arrange `nice' UI properties. If you do this in GUI PuTTY, a full-size terminal window will still be created, and will sit there with almost nothing in it throughout your session. If you do it in Plink, Plink will not accept any kind of request to terminate gracefully; you'll have to ^C or kill it. Nonetheless, even this little will be useful to some people... [originally from svn r4614]
2004-10-13 13:43:11 +00:00
if (ssh->mainchan)
ssh->send_ok = 1;
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
while (1) {
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
if ((pktin = pq_pop(&ssh->pq_ssh2_connection)) != NULL) {
Add support for logging "exit-signal", why not. This is disgustingly huge because old versions of OpenSSH got the message format wrong, so we have to infer which format is in use. Tested with Debian stable OpenSSH (3.4p1), with `uint32' packet, and lshd, which uses the correct `string' packet, and also let me test "core dumped" and the explanatory message. [originally from svn r4653]
2004-10-18 00:41:48 +00:00
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
/*
* _All_ the connection-layer packets we expect to
* receive are now handled by the dispatch table.
* Anything that reaches here must be bogus.
*/
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
Almost _all_ of the final connection-layer loop, in both SSH1 and SSH2, is now handled by the packet dispatch table. Dispatch table entries are enabled as soon as possible, so that if anyone tries to (for example) start using a forwarded port before the main shell session setup has finished, things should work sensibly. The SSH code is now a hybrid of coroutine-based sequential logic and table-driven event dispatch, each where it makes the most sense. I'm rather pleased with it. Should fix: ext-data-at-start, portfwd-at-start. [originally from svn r4909] [this svn revision also touched putty-wishlist]
2004-11-27 15:32:45 +00:00
bombout(("Strange packet received: type %d", pktin->type));
crStopV;
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
}
while (ssh->mainchan && bufchain_size(&ssh->user_input) > 0) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
/*
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
* Add user input to the main channel's buffer.
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
*/
do_ssh2_authconn: remove user input parameters. Just as I did to do_ssh1_login, I'm removing the 'in' and 'inlen' parameters from the combined SSH-2 userauth + connection coroutine, in favour of it reading directly from ssh->user_input, and in particular also allowing get_userpass_input to do so on its behalf. Similarly to the previous case, I've completely emptied the wrapper function ssh2_authconn_input(), and again, there is a reason I can't quite get away with removing it...
2018-05-18 06:22:58 +00:00
void *data;
int len;
bufchain_prefix(&ssh->user_input, &data, &len);
ssh_send_channel_data(ssh->mainchan, data, len);
bufchain_consume(&ssh->user_input, len);
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
}
Restructure some loops with crReturn in them. A large part of the purpose of the 20-patch series just past is to arrange that user input is never dropped on the floor: if you type it at a moment where the active protocol coroutine has nothing it can usefully do with it, the default action will now be to leave it on the user_input queue where it will eventually be picked up by some later coroutine, or later phase of this one, that does. And did I _test_ this feature, end to end, just once, before pushing the giant patch series? I did not. It doesn't work, and the reason why it doesn't work is because various loops that spin round alternating a crReturn with a check of the input queue do the first crReturn _before_ the first queue check. So if there's already data in the queue, well, it won't be _dropped_, but it also won't be passed on immediately to where it needs to be - instead, it will sit in the queue until you press _another_ key, at which point a queue check will happen and all your backed-up typeahead data will come out. Fixed by restructuring those loops to do a queue check first. This applies to the final loop in do_ssh2_connection, and all the little loops during userauth that prompt for usernames, passwords, passphrases etc via get_userpass_input.
2018-05-18 10:01:12 +00:00
crReturnV;
SSH 2 support, phase 1, debugging. Currently does Diffie-Hellman and gets the same results as the server, which is a pretty good start. [originally from svn r569]
2000-09-05 14:28:17 +00:00
}
crFinishV;
}
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
static void ssh2_connection_input(Ssh ssh)
{
do_ssh2_connection(ssh);
}
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
/*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* Handlers for SSH-2 messages that might arrive at any moment.
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_disconnect(Ssh ssh, PktIn *pktin)
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
{
/* log reason code in disconnect message */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
char *buf;
ptrlen msg;
int reason;
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
reason = get_uint32(pktin);
msg = get_string(pktin);
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
buf = dupprintf("Received disconnect message (%s)",
ssh2_disconnect_reasons[reason]);
} else {
buf = dupprintf("Received disconnect message (unknown"
" type %d)", reason);
}
logevent(buf);
sfree(buf);
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
buf = dupprintf("Disconnection message text: %.*s", PTRLEN_PRINTF(msg));
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
logevent(buf);
Apparently Vista's printf-like functions don't support %n by default. We could explicitly re-enable %n, but we only use it in one place, so take the path of least resistance and remove that single instance. This stops dupvprintf() getting stuck in a loop (a behaviour that's caused by a workaround for a broken libc). <http://msdn.microsoft.com/en-us/library/ms175782(VS.80).aspx> [originally from svn r8030]
2008-05-31 17:22:29 +00:00
bombout(("Server sent disconnect message\ntype %d (%s):\n\"%.*s\"",
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
reason,
(reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ?
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ssh2_disconnect_reasons[reason] : "unknown", PTRLEN_PRINTF(msg)));
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
sfree(buf);
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_debug(Ssh ssh, PktIn *pktin)
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
{
/* log the debug message */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
ptrlen msg;
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
Fixes (mostly from Colin Watson, a couple redone by me) to make Unix PuTTY compile cleanly under gcc 4.6.0 without triggering any of its new warnings. [originally from svn r9169]
2011-05-07 10:57:19 +00:00
/* XXX maybe we should actually take notice of the return value */
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
get_bool(pktin);
msg = get_string(pktin);
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
Replace ssh_pkt_get* with BinarySource. The 'savedpos' field in 'struct Packet', which was already unused on the output side after I threw away ssh_pkt_addstring_start, is now unused on the input side too because a BinarySource implementation has taken over. So it's now completely gone.
2018-05-27 17:13:53 +00:00
logeventf(ssh, "Remote debug message: %.*s", PTRLEN_PRINTF(msg));
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_transport(Ssh ssh, PktIn *pktin)
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
{
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
pktin->refcount++; /* avoid packet being freed when we return */
pq_push(&ssh->pq_ssh2_transport, pktin);
queue_idempotent_callback(&ssh->ssh2_transport_icb);
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
}
/*
* Called if we receive a packet that isn't allowed by the protocol.
* This only applies to packets whose meaning PuTTY understands.
* Entirely unknown packets are handled below.
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_unexpected(Ssh ssh, PktIn *pktin)
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
{
char *buf = dupprintf("Server protocol violation: unexpected %s packet",
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh2_pkt_type(ssh->pls.kctx, ssh->pls.actx,
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
pktin->type));
ssh_disconnect(ssh, NULL, buf, SSH2_DISCONNECT_PROTOCOL_ERROR, FALSE);
Fix recently-introduced memory leak in ssh2_msg_unexpected(). [originally from svn r9611]
2012-08-21 23:04:22 +00:00
sfree(buf);
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_msg_something_unimplemented(Ssh ssh, PktIn *pktin)
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
{
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_UNIMPLEMENTED);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, pktin->sequence);
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
/*
* UNIMPLEMENTED messages MUST appear in the same order as the
* messages they respond to. Hence, never queue them.
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, pktout);
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
}
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
/*
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
* Handle the top-level SSH-2 protocol.
RSA key authentication in ssh1 works; SSH2 is nearly there [originally from svn r572]
2000-09-07 16:33:49 +00:00
*/
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
static void ssh2_protocol_setup(Ssh ssh)
{
int i;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->bpp = ssh2_bpp_new();
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
/* Load and pick the highest GSS library on the preference list. */
if (!ssh->gsslibs)
ssh->gsslibs = ssh_gss_setup(ssh->conf);
ssh->gsslib = NULL;
if (ssh->gsslibs->nlibraries > 0) {
int i, j;
for (i = 0; i < ngsslibs; i++) {
int want_id = conf_get_int_int(ssh->conf,
CONF_ssh_gsslist, i);
for (j = 0; j < ssh->gsslibs->nlibraries; j++)
if (ssh->gsslibs->libraries[j].id == want_id) {
ssh->gsslib = &ssh->gsslibs->libraries[j];
goto got_gsslib; /* double break */
}
}
got_gsslib:
/*
* We always expect to have found something in
* the above loop: we only came here if there
* was at least one viable GSS library, and the
* preference list should always mention
* everything and only change the order.
*/
assert(ssh->gsslib);
}
#endif
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
/*
* Most messages cause SSH2_MSG_UNIMPLEMENTED.
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
for (i = 0; i < SSH_MAX_MSG; i++)
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
ssh->packet_dispatch[i] = ssh2_msg_something_unimplemented;
/*
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
* Initially, we only accept transport messages (and a few generic
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
* ones). do_ssh2_userauth and do_ssh2_connection will each add
* more when they start. Messages that are understood but not
* currently acceptable go to ssh2_msg_unexpected.
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
*/
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
ssh->packet_dispatch[SSH2_MSG_UNIMPLEMENTED] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_SERVICE_REQUEST] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_SERVICE_ACCEPT] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_KEXINIT] = ssh2_msg_transport;
ssh->packet_dispatch[SSH2_MSG_NEWKEYS] = ssh2_msg_transport;
ssh->packet_dispatch[SSH2_MSG_KEXDH_INIT] = ssh2_msg_transport;
ssh->packet_dispatch[SSH2_MSG_KEXDH_REPLY] = ssh2_msg_transport;
/* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REQUEST] = ssh2_msg_transport; duplicate case value */
/* ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_GROUP] = ssh2_msg_transport; duplicate case value */
ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_INIT] = ssh2_msg_transport;
ssh->packet_dispatch[SSH2_MSG_KEX_DH_GEX_REPLY] = ssh2_msg_transport;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->packet_dispatch[SSH2_MSG_KEXGSS_GROUP] = ssh2_msg_transport;
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
ssh->packet_dispatch[SSH2_MSG_USERAUTH_REQUEST] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_USERAUTH_FAILURE] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_USERAUTH_SUCCESS] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_USERAUTH_BANNER] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_USERAUTH_PK_OK] = ssh2_msg_unexpected;
/* ssh->packet_dispatch[SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ] = ssh2_msg_unexpected; duplicate case value */
/* ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_REQUEST] = ssh2_msg_unexpected; duplicate case value */
ssh->packet_dispatch[SSH2_MSG_USERAUTH_INFO_RESPONSE] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = ssh2_msg_unexpected;
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
/*
Reworking of packet delivery to coroutines in SSH-2. Before, NULL in the dispatch table meant "send to the appropriate one of do_ssh2_transport() and do_ssh2_authconn()". Now those (via small shims) are specified directly in the dispatch table, so ssh2_protocol() is much simpler. In the process, this has somewhat centralised the handling of gross server protocol violations. PuTTY will now disconnect with a rude message when (e.g.) OpenSSH sends us an SSH_MSG_UNIMPLEMENTED when we try to KEXINIT during authentication. [originally from svn r9609]
2012-08-21 22:04:56 +00:00
* These messages have a special handler from the start.
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
*/
ssh->packet_dispatch[SSH2_MSG_DISCONNECT] = ssh2_msg_disconnect;
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
ssh->packet_dispatch[SSH2_MSG_IGNORE] = ssh_msg_ignore; /* shared with SSH-1 */
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
ssh->packet_dispatch[SSH2_MSG_DEBUG] = ssh2_msg_debug;
}
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
static void ssh2_bare_connection_protocol_setup(Ssh ssh)
{
int i;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->bpp = ssh2_bare_bpp_new();
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
/*
* Most messages cause SSH2_MSG_UNIMPLEMENTED.
*/
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
for (i = 0; i < SSH_MAX_MSG; i++)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
ssh->packet_dispatch[i] = ssh2_msg_something_unimplemented;
/*
* Initially, we set all ssh-connection messages to 'unexpected';
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
* do_ssh2_connection will fill things in properly. We also handle
* a couple of messages from the transport protocol which aren't
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
* related to key exchange (UNIMPLEMENTED, IGNORE, DEBUG,
* DISCONNECT).
*/
ssh->packet_dispatch[SSH2_MSG_GLOBAL_REQUEST] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_REQUEST_SUCCESS] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_REQUEST_FAILURE] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_CONFIRMATION] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN_FAILURE] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_WINDOW_ADJUST] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_DATA] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = ssh2_msg_unexpected;
ssh->packet_dispatch[SSH2_MSG_UNIMPLEMENTED] = ssh2_msg_unexpected;
/*
* These messages have a special handler from the start.
*/
ssh->packet_dispatch[SSH2_MSG_DISCONNECT] = ssh2_msg_disconnect;
ssh->packet_dispatch[SSH2_MSG_IGNORE] = ssh_msg_ignore;
ssh->packet_dispatch[SSH2_MSG_DEBUG] = ssh2_msg_debug;
}
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static PktOut *ssh2_gss_authpacket(Ssh ssh, Ssh_gss_ctx gss_ctx,
const char *authtype)
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
{
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
strbuf *sb;
PktOut *p;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
Ssh_gss_buf buf;
Ssh_gss_buf mic;
/*
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
* The mic is computed over the session id + intended
* USERAUTH_REQUEST packet.
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
*/
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
sb = strbuf_new();
put_string(sb, ssh->v2_session_id, ssh->v2_session_id_len);
put_byte(sb, SSH2_MSG_USERAUTH_REQUEST);
put_stringz(sb, ssh->username);
put_stringz(sb, "ssh-connection");
put_stringz(sb, authtype);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/* Compute the mic */
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
buf.value = sb->s;
buf.length = sb->len;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh->gsslib->get_mic(ssh->gsslib, gss_ctx, &buf, &mic);
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
strbuf_free(sb);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
/* Now we can build the real packet */
if (strcmp(authtype, "gssapi-with-mic") == 0) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
p = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_USERAUTH_GSSAPI_MIC);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
} else {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
p = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_USERAUTH_REQUEST);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(p, ssh->username);
put_stringz(p, "ssh-connection");
put_stringz(p, authtype);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
}
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_string(p, mic.value, mic.length);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
return p;
}
/*
* This is called at the beginning of each SSH rekey to determine whether we are
* GSS capable, and if we did GSS key exchange, and are delegating credentials,
* it is also called periodically to determine whether we should rekey in order
* to delegate (more) fresh credentials. This is called "credential cascading".
*
* On Windows, with SSPI, we may not get the credential expiration, as Windows
* automatically renews from cached passwords, so the credential effectively
* never expires. Since we still want to cascade when the local TGT is updated,
* we use the expiration of a newly obtained context as a proxy for the
* expiration of the TGT.
*/
Reduce verbosity of 'GSS init sec context failed' message. Now we don't generate that message as a side effect of the periodic check for new GSS credentials; we only generate it as part of the much larger slew of messages that happen during a rekey.
2018-05-01 17:54:04 +00:00
static void ssh2_gss_update(Ssh ssh, int definitely_rekeying)
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
{
int gss_stat;
time_t gss_cred_expiry;
unsigned long mins;
Ssh_gss_buf gss_sndtok;
Ssh_gss_buf gss_rcvtok;
Ssh_gss_ctx gss_ctx;
ssh->gss_status = 0;
/*
* Nothing to do if no GSSAPI libraries are configured or GSSAPI auth is not
* enabled.
*/
if (ssh->gsslibs->nlibraries == 0)
return;
Make GSS kex and GSS userauth separately configurable. The former has advantages in terms of keeping Kerberos credentials up to date, but it also does something sufficiently weird to the usual SSH host key system that I think it's worth making sure users have a means of turning it off separately from the less intrusive GSS userauth.
2018-04-26 18:15:15 +00:00
if (!conf_get_int(ssh->conf, CONF_try_gssapi_auth) &&
!conf_get_int(ssh->conf, CONF_try_gssapi_kex))
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
return;
/* Import server name and cache it */
if (ssh->gss_srv_name == GSS_C_NO_NAME) {
gss_stat = ssh->gsslib->import_name(ssh->gsslib,
ssh->fullhostname,
&ssh->gss_srv_name);
if (gss_stat != SSH_GSS_OK) {
if (gss_stat == SSH_GSS_BAD_HOST_NAME)
logevent("GSSAPI import name failed -"
" Bad service name; won't use GSS key exchange");
else
logevent("GSSAPI import name failed;"
" won't use GSS key exchange");
return;
}
}
/*
* Do we (still) have credentials? Capture the credential expiration when
* available
*/
gss_stat = ssh->gsslib->acquire_cred(ssh->gsslib,
&gss_ctx,
&gss_cred_expiry);
if (gss_stat != SSH_GSS_OK)
return;
SSH_GSS_CLEAR_BUF(&gss_sndtok);
SSH_GSS_CLEAR_BUF(&gss_rcvtok);
/*
* When acquire_cred yields no useful expiration, get a proxy for the cred
* expiration from the context expiration.
*/
gss_stat = ssh->gsslib->init_sec_context(
ssh->gsslib, &gss_ctx, ssh->gss_srv_name,
0 /* don't delegate */, &gss_rcvtok, &gss_sndtok,
(gss_cred_expiry == GSS_NO_EXPIRATION ? &gss_cred_expiry : NULL),
&ssh->gss_ctxt_lifetime);
/* This context was for testing only. */
if (gss_ctx)
ssh->gsslib->release_cred(ssh->gsslib, &gss_ctx);
if (gss_stat != SSH_GSS_OK &&
gss_stat != SSH_GSS_S_CONTINUE_NEEDED) {
Reduce verbosity of 'GSS init sec context failed' message. Now we don't generate that message as a side effect of the periodic check for new GSS credentials; we only generate it as part of the much larger slew of messages that happen during a rekey.
2018-05-01 17:54:04 +00:00
/*
* No point in verbosely interrupting the user to tell them we
* couldn't get GSS credentials, if this was only a check
* between key exchanges to see if fresh ones were available.
* When we do do a rekey, this message (if displayed) will
* appear among the standard rekey blurb, but when we're not,
* it shouldn't pop up all the time regardless.
*/
if (definitely_rekeying)
logeventf(ssh, "No GSSAPI security context available");
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
return;
}
if (gss_sndtok.length)
ssh->gsslib->free_tok(ssh->gsslib, &gss_sndtok);
ssh->gss_status |= GSS_KEX_CAPABLE;
/*
* When rekeying to cascade, avoding doing this too close to the context
* expiration time, since the key exchange might fail.
*/
if (ssh->gss_ctxt_lifetime < MIN_CTXT_LIFETIME)
ssh->gss_status |= GSS_CTXT_MAYFAIL;
/*
* If we're not delegating credentials, rekeying is not used to refresh
* them. We must avoid setting GSS_CRED_UPDATED or GSS_CTXT_EXPIRES when
* credential delegation is disabled.
*/
if (conf_get_int(ssh->conf, CONF_gssapifwd) == 0)
return;
if (ssh->gss_cred_expiry != GSS_NO_EXPIRATION &&
difftime(gss_cred_expiry, ssh->gss_cred_expiry) > 0)
ssh->gss_status |= GSS_CRED_UPDATED;
mins = conf_get_int(ssh->conf, CONF_gssapirekey);
mins = rekey_mins(mins, GSS_DEF_REKEY_MINS);
if (mins > 0 && ssh->gss_ctxt_lifetime <= mins * 60)
ssh->gss_status |= GSS_CTXT_EXPIRES;
}
#endif
Factor out ssh2_timer_update. This is a preliminary refactoring for an upcoming change which will need to affect every use of schedule_timer to wait for the next rekey: those calls to schedule_timer are now centralised into a function that does an organised piece of thinking about when the next timer should be. A side effect of this change is that the translation from CONF_ssh_rekey_time to an actual tick count is now better proofed against integer overflow (just in case the user entered a completely silly value).
2018-04-14 13:48:02 +00:00
/*
* The rekey_time is zero except when re-configuring.
*
* We either schedule the next timer and return 0, or return 1 to run the
* callback now, which will call us again to re-schedule on completion.
*/
static int ssh2_timer_update(Ssh ssh, unsigned long rekey_time)
{
unsigned long mins;
unsigned long ticks;
mins = conf_get_int(ssh->conf, CONF_ssh_rekey_time);
mins = rekey_mins(mins, 60);
ticks = mins * 60 * TICKSPERSEC;
/* Handle change from previous setting */
if (rekey_time != 0 && rekey_time != mins) {
unsigned long next;
unsigned long now = GETTICKCOUNT();
mins = rekey_time;
ticks = mins * 60 * TICKSPERSEC;
next = ssh->last_rekey + ticks;
/* If overdue, caller will rekey synchronously now */
if (now - ssh->last_rekey > ticks)
return 1;
ticks = next - now;
}
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
Don't periodically check GSS creds in non-GSS mode. The 2-minutely check to see whether new GSS credentials need to be forwarded to the server is pointless if we're not even in the mode where we _have_ forwarded a previous set. This was made obvious by the overly verbose diagnostic fixed in the previous commit, so it's a good thing that bug was temporarily there!
2018-05-01 17:54:09 +00:00
if (ssh->gss_kex_used) {
/*
* If we've used GSSAPI key exchange, then we should
* periodically check whether we need to do another one to
* pass new credentials to the server.
*/
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
unsigned long gssmins;
/* Check cascade conditions more frequently if configured */
gssmins = conf_get_int(ssh->conf, CONF_gssapirekey);
gssmins = rekey_mins(gssmins, GSS_DEF_REKEY_MINS);
if (gssmins > 0) {
if (gssmins < mins)
ticks = (mins = gssmins) * 60 * TICKSPERSEC;
if ((ssh->gss_status & GSS_KEX_CAPABLE) != 0) {
/*
* Run next timer even sooner if it would otherwise be too close
* to the context expiration time
*/
if ((ssh->gss_status & GSS_CTXT_EXPIRES) == 0 &&
ssh->gss_ctxt_lifetime - mins * 60 < 2 * MIN_CTXT_LIFETIME)
ticks -= 2 * MIN_CTXT_LIFETIME * TICKSPERSEC;
}
}
}
#endif
Factor out ssh2_timer_update. This is a preliminary refactoring for an upcoming change which will need to affect every use of schedule_timer to wait for the next rekey: those calls to schedule_timer are now centralised into a function that does an organised piece of thinking about when the next timer should be. A side effect of this change is that the translation from CONF_ssh_rekey_time to an actual tick count is now better proofed against integer overflow (just in case the user entered a completely silly value).
2018-04-14 13:48:02 +00:00
/* Schedule the next timer */
ssh->next_rekey = schedule_timer(ticks, ssh2_timer, ssh);
return 0;
}
Two related changes to timing code: First, make absolute times unsigned. This means that it's safe to depend on their overflow behaviour (which is undefined for signed integers). This requires a little extra care in handling comparisons, but I think I've correctly adjusted them all. Second, functions registered with schedule_timer() are guaranteed to be called with precisely the time that was returned by schedule_timer(). Thus, it's only necessary to check these values for equality rather than doing risky range checks, so do that. The timing code still does lots that's undefined, unnecessary, or just wrong, but this is a good start. [originally from svn r9667]
2012-09-18 21:42:48 +00:00
static void ssh2_timer(void *ctx, unsigned long now)
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
{
Ssh ssh = (Ssh)ctx;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
unsigned long mins;
unsigned long ticks;
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (ssh->state == SSH_STATE_CLOSED ||
ssh->kex_in_progress ||
ssh->bare_connection ||
now != ssh->next_rekey)
<1112163342.018492.101240@f14g2000cwb.googlegroups.com> on comp.security.ssh contains a Dr Watson log which looks to me as if `unclean-close-crash' occurred due to a rekey timer going off after the session had closed. Hence, ssh2_timer() now avoids doing anything if the session is already closed, and also ssh_do_close() proactively calls expire_timer_context(). Between those I think they ought to solve the problem. [originally from svn r5564]
2005-03-30 08:27:54 +00:00
return;
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
mins = conf_get_int(ssh->conf, CONF_ssh_rekey_time);
mins = rekey_mins(mins, 60);
if (mins == 0)
return;
/* Rekey if enough time has elapsed */
ticks = mins * 60 * TICKSPERSEC;
if (now - ssh->last_rekey > ticks - 30*TICKSPERSEC) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->rekey_reason = "timeout";
ssh->rekey_class = RK_NORMAL;
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
queue_idempotent_callback(&ssh->ssh2_transport_icb);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
return;
}
#ifndef NO_GSSAPI
/*
* Rekey now if we have a new cred or context expires this cycle, but not if
* this is unsafe.
*/
if (conf_get_int(ssh->conf, CONF_gssapirekey)) {
Reduce verbosity of 'GSS init sec context failed' message. Now we don't generate that message as a side effect of the periodic check for new GSS credentials; we only generate it as part of the much larger slew of messages that happen during a rekey.
2018-05-01 17:54:04 +00:00
ssh2_gss_update(ssh, FALSE);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if ((ssh->gss_status & GSS_KEX_CAPABLE) != 0 &&
(ssh->gss_status & GSS_CTXT_MAYFAIL) == 0 &&
(ssh->gss_status & (GSS_CRED_UPDATED|GSS_CTXT_EXPIRES)) != 0) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->rekey_reason = "GSS credentials updated";
ssh->rekey_class = RK_GSS_UPDATE;
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
queue_idempotent_callback(&ssh->ssh2_transport_icb);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
return;
}
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
}
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#endif
/* Try again later. */
(void) ssh2_timer_update(ssh, 0);
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
}
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
static void ssh2_general_packet_processing(Ssh ssh, PktIn *pktin)
Factor out general processing for all packets. NFC: I'm just moving a small piece of code out into a separate function, which does processing on incoming SSH-2 packets that is completely independent of the packet type. (Specifically, we count up the total amount of data so far transferred, and use it to trigger a rekey when we get over the per-session-key data limit.) The aim is that I'll be able to call this function from a central location that's not SSH-2 specific, by using a function pointer that points to this function in SSH-2 mode or is null in SSH-1 mode.
2018-05-18 06:22:57 +00:00
{
ssh->incoming_data_size += pktin->encrypted_len;
if (!ssh->kex_in_progress &&
ssh->max_data_size != 0 &&
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->incoming_data_size > ssh->max_data_size) {
ssh->rekey_reason = "too much data received";
ssh->rekey_class = RK_NORMAL;
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
queue_idempotent_callback(&ssh->ssh2_transport_icb);
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
}
Factor out general processing for all packets. NFC: I'm just moving a small piece of code out into a separate function, which does processing on incoming SSH-2 packets that is completely independent of the packet type. (Specifically, we count up the total amount of data so far transferred, and use it to trigger a rekey when we get over the per-session-key data limit.) The aim is that I'll be able to call this function from a central location that's not SSH-2 specific, by using a function pointer that points to this function in SSH-2 mode or is null in SSH-1 mode.
2018-05-18 06:22:57 +00:00
}
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
static void ssh_cache_conf_values(Ssh ssh)
{
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.omit_passwords = conf_get_int(ssh->conf, CONF_logomitpass);
ssh->pls.omit_data = conf_get_int(ssh->conf, CONF_logomitdata);
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
}
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
/*
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
* Called to set up the connection.
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
*
* Returns an error message, or NULL on success.
*/
Introduce a typedef for frontend handles. This is another major source of unexplained 'void *' parameters throughout the code. In particular, the currently unused testback.c actually gave the wrong pointer type to its internal store of the frontend handle - it cast the input void * to a Terminal *, from which it got implicitly cast back again when calling from_backend, and nobody noticed. Now it uses the right type internally as well as externally.
2018-09-12 08:10:51 +00:00
static const char *ssh_init(Frontend *frontend, Backend **backend_handle,
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
Conf *conf,
const char *host, int port, char **realhost,
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
int nodelay, int keepalive)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Colin's const-fixing Patch Of Death. Seems to build fine on Windows as well as Unix, so it can go in. [originally from svn r3162]
2003-05-04 14:18:18 +00:00
const char *p;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Ssh ssh;
Introduced wrapper macros snew(), snewn() and sresize() for the malloc functions, which automatically cast to the same type they're allocating the size of. Should prevent any future errors involving mallocing the size of the wrong structure type, and will also make life easier if we ever need to turn the PuTTY core code from real C into C++-friendly C. I haven't touched the Mac frontend in this checkin because I couldn't compile or test it. [originally from svn r3014]
2003-03-29 16:14:26 +00:00
ssh = snew(struct ssh_tag);
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
ssh->conf = conf_copy(conf);
ssh_cache_conf_values(ssh);
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
ssh->version = 0; /* when not ready yet */
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->s = NULL;
ssh->kex = NULL;
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
ssh->dh_ctx = NULL;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh->hostkey_alg = NULL;
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
ssh->hostkey_str = NULL;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->exitcode = -1;
Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. [originally from svn r5098] [this svn revision also touched putty-wishlist]
2005-01-11 19:33:41 +00:00
ssh->close_expected = FALSE;
Factor out all local SSH disconnections into a new function ssh_disconnect(), and add the ability to treat a local disconnection as "unclean" -- notably, if we can't agree any authentication methods to even try; someone was complaining that the PuTTY window by default just disappears for no apparent reason in this circumstance. Also, use appropriate disconnect codes for those SSH2_MSG_DISCONNECT messages that we do send. I don't think I've seriously broken any user-visible behaviour, but the way that connection-close distinctions are transmitted to the front-end is shaky (or so it seems to me), so there may be non-ideal changes on some platforms. [originally from svn r5824]
2005-05-21 16:49:27 +00:00
ssh->clean_exit = FALSE;
Try harder not to call connection_fatal twice. If the server sends an SSH_MSG_DISCONNECT, then we call connection_fatal(). But if the server closes the network connection, then we call connection_fatal(). In situations where the former happens, the latter happens too. Currently, calling connection_fatal twice is especially bad on GTK because all dialogs are now non-modal and an assertion fails in the GTK front end when two fatal message boxes try to exist at the same time (the register_dialog system finds that slot is already occupied). But regardless of that, we'd rather not even _try_ to print two fatal boxes, because even if the front end doesn't fail an assertion, there's no guarantee that the _more useful_ one of the messages will end up being displayed. So a better fix is to have ssh.c make a sensible decision about which message is the helpful one - in this case, the actual error message out of the SSH_MSG_DISCONNECT, rather than the predictable fact of the connection having been slammed shut immediately afterwards - and only pass that one to the front end in the first place.
2018-06-03 05:46:28 +00:00
ssh->disconnect_message_seen = FALSE;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->state = SSH_STATE_PREPACKET;
ssh->size_needed = FALSE;
ssh->eof_needed = FALSE;
Line discipline module now uses dynamically allocated data. Also fixed one or two other minor problems. [originally from svn r2141]
2002-10-26 10:16:19 +00:00
ssh->ldisc = NULL;
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
ssh->logctx = NULL;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->fallback_cmd = 0;
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->pls.kctx = SSH2_PKTCTX_NOKEX;
ssh->pls.actx = SSH2_PKTCTX_NOAUTH;
Revamp of the local X11 connection code. We now parse X display strings more rigorously, and then we look up the local X authority data in .Xauthority _ourself_ rather than delegating to an external xauth program. This is (negligibly) more efficient on Unix, assuming I haven't got it wrong in some subtle way, but its major benefit is that we can now support X authority lookups on Windows as well provided the user points us at an appropriate X authority file in the standard format. A new Windows-specific config option has been added for this purpose. [originally from svn r8305]
2008-11-17 18:38:09 +00:00
ssh->x11disp = NULL;
Prepare to have multiple X11 auth cookies valid at once. Rather than the top-level component of X forwarding being an X11Display structure which owns some auth data, it's now a collection of X11FakeAuth structures, each of which owns a display. The idea is that when we receive an X connection, we wait to see which of our available auth cookies it matches, and then connect to whatever X display that auth cookie identifies. At present the tree will only have one thing in it; this is all groundwork for later changes. [originally from svn r10079]
2013-11-17 14:05:10 +00:00
ssh->x11auth = NULL;
ssh->x11authtree = newtree234(x11_authcmp);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh->v2_cbc_ignore_workaround = FALSE;
ssh->bpp = NULL;
Re-architected the top level of the SSH protocol handlers. ssh1_protocol() and ssh2_protocol() are now high-level functions which see _every_ SSH packet and decide which lower-level function to pass it to. Also, they each support a dispatch table of simple handler functions for message types which can arrive at any time. Results are: - ignore, debug and disconnect messages are now handled by the dispatch table rather than being warts in the rdpkt functions - SSH2_MSG_WINDOW_ADJUST is handled by the dispatch table, which means that do_ssh2_authconn doesn't have to explicitly special-case it absolutely every time it waits for a response to its latest channel request - the top-level SSH2 protocol function chooses whether messages get funnelled to the transport layer or the auth/conn layer based on the message number ranges defined in the SSH architecture draft - so things that should go to auth/conn go there even in the middle of a rekey (although a special case is that nothing goes to auth/conn until initial kex has finished). This should fix the other half of ssh2-kex-data. [originally from svn r4901]
2004-11-24 20:35:15 +00:00
ssh->do_ssh1_connection_crstate = 0;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->do_ssh_init_state = NULL;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
ssh->do_ssh_connection_init_state = NULL;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->do_ssh1_login_state = NULL;
ssh->do_ssh2_transport_state = NULL;
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh->do_ssh2_userauth_state = NULL;
ssh->do_ssh2_connection_state = NULL;
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
bufchain_init(&ssh->incoming_data);
ssh->incoming_data_seen_eof = FALSE;
ssh->incoming_data_eof_message = NULL;
ssh->incoming_data_consumer.fn = ssh_process_incoming_data;
ssh->incoming_data_consumer.ctx = ssh;
ssh->incoming_data_consumer.queued = FALSE;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
pq_in_init(&ssh->pq_full);
Make the rdpkt functions output to a PacketQueue. Each of the coroutines that parses the incoming wire data into a stream of 'struct Packet' now delivers those packets to a PacketQueue called ssh->pq_full (containing the full, unfiltered stream of all packets received on the SSH connection), replacing the old API in which each coroutine would directly return a 'struct Packet *' to its caller, or NULL if it didn't have one ready yet. This simplifies the function-call API of the rdpkt coroutines (they now return void). It increases the complexity at the other end, because we've now got a function ssh_process_pq_full (scheduled as an idempotent callback whenever rdpkt appends anything to the queue) which pulls things out of the queue and passes them to ssh->protocol. But that's only a temporary complexity increase; by the time I finish the upcoming stream of refactorings, there won't be two chained functions there any more. One small workaround I had to add in this commit is a flag called 'pending_newkeys', which ssh2_rdpkt sets when it's just returned an SSH_MSG_NEWKEYS packet, and then waits for the transport layer to process the NEWKEYS and set up the new encryption context before processing any more wire data. This wasn't necessary before, because the old architecture was naturally synchronous - ssh2_rdpkt would return a NEWKEYS, which would be immediately passed to do_ssh2_transport, which would finish processing it immediately, and by the time ssh2_rdpkt was next called, the keys would already be in place. This change adds a big while loop around the whole of each rdpkt function, so it's easiest to read it as a whitespace-ignored diff.
2018-05-18 06:22:57 +00:00
ssh->pq_full_consumer.fn = ssh_process_pq_full;
ssh->pq_full_consumer.ctx = ssh;
ssh->pq_full_consumer.queued = FALSE;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
pq_in_init(&ssh->pq_ssh1_login);
do_ssh1_login: get packets from a PacketQueue. This introduces the first of several filtered PacketQueues that receive subsets of pq_full destined for a particular coroutine. The wrapper function ssh1_coro_wrapper_initial, whose purpose I just removed in the previous commit, now gains the replacement purpose of accepting a packet as a function argument and putting it on the new queue for do_ssh1_login to handle when it's ready. That wrapper in turn is called from the packet-type dispatch table, meaning that the new pq_ssh1_login will be filtered down to only the packets destined for this coroutine. This is the point where I finally start using the reference counting system that I added to 'struct Packet' about a dozen commits ago. The general packet handling calls ssh_unref_packet for everything that it's just pulled off pq_full and handed to a dispatch-table function - so _this_ dispatch-table function, which needs the packet not to be freed because it's going to go on to another queue and wait to be handled there, can arrange that by incrementing its ref count. This completes the transformation of do_ssh1_login into a function with a trivial argument list, whose job is to read from a pair of input queues (one for user keyboard input and one for SSH packets) and respond by taking action directly rather than returning a value to its caller to request action. It also lets me get rid of a big pile of those really annoying bombout() calls that I used to work around the old coroutine system's inability to deal with receiving an SSH packet when the control flow was in the middle of waiting for some other kind of input. That was always the weakness of the coroutine structure of this code, which I accepted as the price for the convenience of coroutines the rest of the time - but now I think I've got the benefits without that cost :-) The one remaining argument to do_ssh1_login is the main Ssh structure, although I've had to turn it into a void * to make the function's type compatible with the idempotent callback mechanism, since that will be calling do_ssh1_login directly when its input queue needs looking at.
2018-05-18 06:22:58 +00:00
ssh->ssh1_login_icb.fn = do_ssh1_login;
ssh->ssh1_login_icb.ctx = ssh;
ssh->ssh1_login_icb.queued = FALSE;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
pq_in_init(&ssh->pq_ssh1_connection);
do_ssh1_connection: get packets from a PacketQueue. Even with my love of verbose commit messages, I don't think there's anything interesting to say about this commit that the previous few similar ones haven't mentioned already. This is just more of the same transformations.
2018-05-18 06:22:58 +00:00
ssh->ssh1_connection_icb.fn = do_ssh1_connection;
ssh->ssh1_connection_icb.ctx = ssh;
ssh->ssh1_connection_icb.queued = FALSE;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
pq_in_init(&ssh->pq_ssh2_transport);
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
ssh->ssh2_transport_icb.fn = do_ssh2_transport;
ssh->ssh2_transport_icb.ctx = ssh;
ssh->ssh2_transport_icb.queued = FALSE;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
pq_in_init(&ssh->pq_ssh2_userauth);
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh->ssh2_userauth_icb.fn = do_ssh2_userauth;
ssh->ssh2_userauth_icb.ctx = ssh;
ssh->ssh2_userauth_icb.queued = FALSE;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
pq_in_init(&ssh->pq_ssh2_connection);
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
ssh->ssh2_connection_icb.fn = do_ssh2_connection;
ssh->ssh2_connection_icb.ctx = ssh;
ssh->ssh2_connection_icb.queued = FALSE;
Put all user input into a bufchain. This change introduces a new bufchain ssh->user_input, into which we put every byte received via back->send() (i.e. keyboard input from the GUI PuTTY window, data read by Plink from standard input, or outgoing SCP/SFTP protocol data made up by the file transfer utilities). Just like ssh->incoming_data, there's also a function pointer ssh->current_user_input_fn which says who currently has responsibility for pulling data back off that bufchain and processing it. So that can be changed over when the connection moves into a different major phase. At the moment, nothing very interesting is being done with this bufchain: each phase of the connection has its own little function that pulls chunks back out of it with bufchain_prefix and passes them to the unchanged main protocol coroutines. But this is groundwork for being able to switch over each of those coroutines in turn to read directly from ssh->user_input, with the aim of eliminating a collection of annoying bugs in which typed-ahead data is accidentally discarded at an SSH phase transition.
2018-05-18 06:22:58 +00:00
bufchain_init(&ssh->user_input);
ssh->user_input_consumer.fn = ssh_process_user_input;
ssh->user_input_consumer.ctx = ssh;
ssh->user_input_consumer.queued = FALSE;
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
bufchain_init(&ssh->outgoing_data);
ssh->outgoing_data_sender.fn = ssh_send_outgoing_data;
ssh->outgoing_data_sender.ctx = ssh;
ssh->outgoing_data_sender.queued = FALSE;
Null out a couple of pointers when they're empty. ssh->current_user_input_fn was not set to NULL when the ssh structure was initially set up, which meant that with sufficiently eager typeahead it could accidentally be called while still full of garbage. And ssh->connshare is freed in more than one place (by ssh_free and also by do_ssh_close), but only one of those places nulls it out to stop the other one trying to free it a second time.
2018-05-18 10:41:17 +00:00
ssh->current_user_input_fn = NULL;
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->rekey_reason = NULL;
ssh->rekey_class = RK_INITIAL;
Beginnings of support for multiple exchange hashes in SSH-2: rather than storing a SHA-1 hash of the client and server version strings, store the strings themselves so we can feed them through the appropriate hash when we know what it is. [originally from svn r6241]
2005-08-30 20:38:57 +00:00
ssh->v_c = NULL;
ssh->v_s = NULL;
Hmm. Probably best initialise mainchan as well; oops. [originally from svn r2157]
2002-10-29 14:41:10 +00:00
ssh->mainchan = NULL;
valgrind has caught two more uninitialised elements in the SSH context structure. I knew the Unix port would be a good idea! [originally from svn r2173]
2002-11-01 12:59:09 +00:00
ssh->throttled_all = 0;
ssh->v1_stdout_throttling = 0;
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
pq_out_init(&ssh->outq);
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
ssh->queueing = FALSE;
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
ssh->qhead = ssh->qtail = NULL;
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
ssh->deferred_rekey_reason = NULL;
Revamp interface to verify_ssh_host_key() and askalg(). Each of them now returns an integer: 0 means cancel the SSH connection and 1 means continue with it. Additionally, they can return -1, which means `front end has set an asynchronous alert box in motion, please wait to be called back with the result', and each one is passed a callback function pointer and context for this purpose. I have not yet done the same to askappend() yet, because it will take a certain amount of reorganisation of logging.c. Importantly, this checkin means the host key dialog box now works on OS X. [originally from svn r5330]
2005-02-17 18:34:24 +00:00
ssh->frozen = FALSE;
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
ssh->username = NULL;
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
ssh->sent_console_eof = FALSE;
Changed my mind about the EOF policy in SSH mode: I think the SSH backend should unilaterally assume outgoing EOF when it sees incoming EOF, if and only if the main session channel is talking to a pty. (Because ptys don't have a strong concept of EOF in the first place, that seems like a sensible place to draw the line.) This fixes a bug introduced by today's revamp in which if you used Unix Plink to run a console session it would hang after you hit ^D - because the server had sent EOF, but it was waiting for a client-side EOF too. [originally from svn r9282]
2011-09-13 15:38:12 +00:00
ssh->got_pty = FALSE;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
ssh->bare_connection = FALSE;
Add some missing initialisations. Spotted by valgrind, after I was testing all the Coverity bug fixes :-)
2014-11-22 14:57:06 +00:00
ssh->X11_fwd_enabled = FALSE;
ssh->connshare = NULL;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
ssh->attempting_connshare = FALSE;
Option to log proxy setup diagnostics to the terminal. It has three settings: on, off, and 'only until session starts'. The idea of the last one is that if you use something like 'ssh -v' as your proxy command, you probably wanted to see the initial SSH connection-setup messages while you were waiting to see if the connection would be set up successfully at all, but probably _didn't_ want a slew of diagnostics from rekeys disrupting your terminal in mid-emacs once the session had got properly under way. Default is off, to avoid startling people used to the old behaviour. I wonder if I should have set it more aggressively, though.
2015-11-22 14:33:28 +00:00
ssh->session_started = FALSE;
Allocate the SSH specials list dynamically. The last list we returned is now stored in the main Ssh structure rather than being a static array in ssh_get_specials. The main point of this is that I want to start adding more dynamic things to it, for which I can't predict the array's max length in advance. But also this fixes a conceptual wrongness, in that if a process had more than one Ssh instance in it then their specials arrays would have taken turns occupying the old static array, and although the current single-threaded client code in the GUI front ends wouldn't have minded (it would have read out the contents just once immediately after get_specials returned), it still feels as if it was a bug waiting to happen.
2016-03-21 06:50:50 +00:00
ssh->specials = NULL;
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
ssh->n_uncert_hostkeys = 0;
ssh->cross_certifying = FALSE;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
#ifndef NO_GSSAPI
ssh->gss_cred_expiry = GSS_NO_EXPIRATION;
ssh->gss_srv_name = GSS_C_NO_NAME;
ssh->gss_ctx = NULL;
ssh_init_transient_hostkey_store(ssh);
#endif
ssh->gss_kex_used = FALSE;
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
ssh->backend.vt = &ssh_backend;
*backend_handle = &ssh->backend;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
Introduce a typedef for frontend handles. This is another major source of unexplained 'void *' parameters throughout the code. In particular, the currently unused testback.c actually gave the wrong pointer type to its internal store of the frontend handle - it cast the input void * to a Terminal *, from which it got implicitly cast back again when calling from_backend, and nobody noticed. Now it uses the right type internally as well as externally.
2018-09-12 08:10:51 +00:00
ssh->frontend = frontend;
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
ssh->term_width = conf_get_int(ssh->conf, CONF_width);
ssh->term_height = conf_get_int(ssh->conf, CONF_height);
Major destabilisation, phase 1. In this phase I've moved (I think) all the global and function-static variables out of terminal.c into a dynamically allocated data structure. Note that this does not yet confer the ability to run more than one of them in the same process, because other things (the line discipline, the back end) are still global, and also in particular the address of the dynamically allocated terminal-data structure is held in a global variable `term'. But what I've got here represents a reasonable stopping point at which to check things in. In _theory_ this should all still work happily, on both Unix and Windows. In practice, who knows? [originally from svn r2115]
2002-10-22 16:11:33 +00:00
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
ssh->cl.vt = &ssh_connlayer_vtable;
ssh->cl.frontend = ssh->frontend;
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
ssh->channels = NULL;
ssh->rportfwds = NULL;
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
ssh->portfwdmgr = portfwdmgr_new(&ssh->cl);
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->send_ok = 0;
ssh->editing = 0;
ssh->echoing = 0;
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
ssh->conn_throttle_count = 0;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->overall_bufsize = 0;
ssh->fallback_cmd = 0;
Created a shiny new abstraction for the socket handling. Has many advantages: - protocol modules can call sk_write() without having to worry about writes blocking, because blocking writes are handled in the abstraction layer and retried later. - `Lost connection while sending' is a thing of the past. - <winsock.h> is no longer needed in most modules, because "putty.h" doesn't have to declare `SOCKET' variables any more, only the abstracted `Socket' type. - select()-equivalent between multiple sockets will now be handled sensibly, which opens the way for things like SSH port forwarding. [originally from svn r744]
2000-10-23 10:32:37 +00:00
Stop passing incoming packets through ssh->protocol. After the previous two refactorings, there's no longer any need to pass packets to ssh1_protocol or ssh2_protocol so that each one can do its own thing with them, because now the handling is the same in both cases: first call the general type-independent packet processing code (if any), and then call the dispatch table entry for the packet type (which now always exists).
2018-05-18 06:22:57 +00:00
ssh->general_packet_processing = NULL;
Initialise the "protocol" field of a new ssh_tag to NULL so Bad Things don't happen if we try to type things before the SSH banner has been received. [originally from svn r2492]
2003-01-07 22:45:12 +00:00
New timing infrastructure. There's a new function schedule_timer() which pretty much any module can call to request a call-back in the future. So terminal.c can do its own handling of blinking, visual bells and deferred screen updates, without having to rely on term_update() being called 50 times a second (fixes: pterm-timer); and ssh.c and telnet.c both invoke a new module pinger.c which takes care of sending keepalives, so they get sent uniformly in all front ends (fixes: plink-keepalives, unix-keepalives). [originally from svn r4906] [this svn revision also touched putty-wishlist]
2004-11-27 13:20:21 +00:00
ssh->pinger = NULL;
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
ssh->incoming_data_size = ssh->outgoing_data_size = 0L;
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
ssh->max_data_size = parse_blocksize(conf_get_str(ssh->conf,
CONF_ssh_rekey_data));
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
ssh->kex_in_progress = FALSE;
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
ssh->auth_agent_query = NULL;
Cleanups of the GSSAPI support. On Windows, standard GSS libraries are now loaded from standard locations (system32 for SSPI, the registry-stored MIT KfW install location for KfW) rather than using the risky default DLL search path; I've therefore also added an option to manually specify a GSS DLL we haven't heard of (which should in principle Just Work provided it supports proper GSS-API as specified in the RFC). The same option exists on Unix too, because it seemed like too useful an idea to reserve to Windows. In addition, GSSAPI is now documented, and also (unfortunately) its GUI configuration has been moved out into a sub-subpanel on the grounds that it was too big to fit in Auth. [originally from svn r9003]
2010-09-25 07:16:56 +00:00
#ifndef NO_GSSAPI
ssh->gsslibs = NULL;
#endif
Change the naming policy for connection-sharing Unix sockets. I had initially assumed that, since all of a user's per-connection subdirectories live inside a top-level putty-connshare.$USER directory that's not accessible to anyone else, there would be no need to obfuscate the names of the internal directories for privacy, because nobody would be able to look at them anyway. Unfortunately, that's not true: 'netstat -ax' run by any user will show up the full pathnames of Unix-domain sockets, including pathname components that you wouldn't have had the access to go and look at directly. So the Unix connection sharing socket names do need to be obfuscated after all. Since Unix doesn't have Windows's CryptProtectMemory, we have to do this manually, by creating a file of random salt data inside the top-level putty-connshare directory (if there isn't one there already) and then hashing that salt with the "user@host" connection identifier to get the socket directory name. What a pain. [originally from svn r10222]
2014-09-09 12:47:39 +00:00
random_ref(); /* do this now - may be needed by sharing setup code */
Avoid duplicate random_unref on freeing an Ssh. If ssh_init encounters a synchronous error, it will call random_unref before returning. But the Ssh structure it created will still exist, and if the caller (sensibly) responds by freeing it, then that will cause a second random_unref, leading to the RNG's refcount going below zero and failing an assertion. We never noticed this before because with only one PuTTY connection per process it was easier to just exit(1) without bothering to clean things up. Now, with all the multi-sessions-per-process fixes I'm doing, this has shown up as a problem. But other front ends may legitimately still just exit - I don't think I can sensibly enforce _not_ doing so at this late stage - so I've had to arrange to set a flag in the Ssh saying whether a random_unref is still pending or not.
2017-11-27 19:29:47 +00:00
ssh->need_random_unref = TRUE;
Change the naming policy for connection-sharing Unix sockets. I had initially assumed that, since all of a user's per-connection subdirectories live inside a top-level putty-connshare.$USER directory that's not accessible to anyone else, there would be no need to obfuscate the names of the internal directories for privacy, because nobody would be able to look at them anyway. Unfortunately, that's not true: 'netstat -ax' run by any user will show up the full pathnames of Unix-domain sockets, including pathname components that you wouldn't have had the access to go and look at directly. So the Unix connection sharing socket names do need to be obfuscated after all. Since Unix doesn't have Windows's CryptProtectMemory, we have to do this manually, by creating a file of random salt data inside the top-level putty-connshare directory (if there isn't one there already) and then hashing that salt with the "user@host" connection identifier to get the socket directory name. What a pain. [originally from svn r10222]
2014-09-09 12:47:39 +00:00
Add a configuration option for TCP keepalives (SO_KEEPALIVE), default off. No very good reason, but I've occasionally wanted to frob it to see if it makes any difference to problems I'm having, and it was easy. Tested that it does actually cause keepalives on Windows (with tcpdump); should also work on Unix. Not implemented on Mac (does nothing), but then neither is TCP_NODELAY. Quite a big checkin, much of which is adding `keepalive' alongside `nodelay' in network function calls. [originally from svn r4309]
2004-06-20 17:07:38 +00:00
p = connect_to_host(ssh, host, port, realhost, nodelay, keepalive);
Change the naming policy for connection-sharing Unix sockets. I had initially assumed that, since all of a user's per-connection subdirectories live inside a top-level putty-connshare.$USER directory that's not accessible to anyone else, there would be no need to obfuscate the names of the internal directories for privacy, because nobody would be able to look at them anyway. Unfortunately, that's not true: 'netstat -ax' run by any user will show up the full pathnames of Unix-domain sockets, including pathname components that you wouldn't have had the access to go and look at directly. So the Unix connection sharing socket names do need to be obfuscated after all. Since Unix doesn't have Windows's CryptProtectMemory, we have to do this manually, by creating a file of random salt data inside the top-level putty-connshare directory (if there isn't one there already) and then hashing that salt with the "user@host" connection identifier to get the socket directory name. What a pain. [originally from svn r10222]
2014-09-09 12:47:39 +00:00
if (p != NULL) {
Avoid duplicate random_unref on freeing an Ssh. If ssh_init encounters a synchronous error, it will call random_unref before returning. But the Ssh structure it created will still exist, and if the caller (sensibly) responds by freeing it, then that will cause a second random_unref, leading to the RNG's refcount going below zero and failing an assertion. We never noticed this before because with only one PuTTY connection per process it was easier to just exit(1) without bothering to clean things up. Now, with all the multi-sessions-per-process fixes I'm doing, this has shown up as a problem. But other front ends may legitimately still just exit - I don't think I can sensibly enforce _not_ doing so at this late stage - so I've had to arrange to set a flag in the Ssh saying whether a random_unref is still pending or not.
2017-11-27 19:29:47 +00:00
/* Call random_unref now instead of waiting until the caller
* frees this useless Ssh object, in case the caller is
* impatient and just exits without bothering, in which case
* the random seed won't be re-saved. */
ssh->need_random_unref = FALSE;
Change the naming policy for connection-sharing Unix sockets. I had initially assumed that, since all of a user's per-connection subdirectories live inside a top-level putty-connshare.$USER directory that's not accessible to anyone else, there would be no need to obfuscate the names of the internal directories for privacy, because nobody would be able to look at them anyway. Unfortunately, that's not true: 'netstat -ax' run by any user will show up the full pathnames of Unix-domain sockets, including pathname components that you wouldn't have had the access to go and look at directly. So the Unix connection sharing socket names do need to be obfuscated after all. Since Unix doesn't have Windows's CryptProtectMemory, we have to do this manually, by creating a file of random salt data inside the top-level putty-connshare directory (if there isn't one there already) and then hashing that salt with the "user@host" connection identifier to get the socket directory name. What a pain. [originally from svn r10222]
2014-09-09 12:47:39 +00:00
random_unref();
Joris van Rantwijk's unified SSH code suitable for PuTTY and PSCP [originally from svn r504] [this commit reordered to come after creation of 0.49 tag]
2000-06-22 12:18:34 +00:00
return p;
Change the naming policy for connection-sharing Unix sockets. I had initially assumed that, since all of a user's per-connection subdirectories live inside a top-level putty-connshare.$USER directory that's not accessible to anyone else, there would be no need to obfuscate the names of the internal directories for privacy, because nobody would be able to look at them anyway. Unfortunately, that's not true: 'netstat -ax' run by any user will show up the full pathnames of Unix-domain sockets, including pathname components that you wouldn't have had the access to go and look at directly. So the Unix connection sharing socket names do need to be obfuscated after all. Since Unix doesn't have Windows's CryptProtectMemory, we have to do this manually, by creating a file of random salt data inside the top-level putty-connshare directory (if there isn't one there already) and then hashing that salt with the "user@host" connection identifier to get the socket directory name. What a pain. [originally from svn r10222]
2014-09-09 12:47:39 +00:00
}
Loose end from timing shakeup: sshrand.c is now a client of timing.c, and hence takes its own responsibility for calling noise_regular() at regular intervals. Again, this means it will be called consistently in _all_ the SSH-speaking tools, not just those in which I remembered to call it! [originally from svn r4913]
2004-11-27 19:56:38 +00:00
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
return NULL;
}
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static void ssh_free(Backend *be)
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
struct ssh_channel *c;
struct ssh_rportfwd *pf;
Prepare to have multiple X11 auth cookies valid at once. Rather than the top-level component of X forwarding being an X11Display structure which owns some auth data, it's now a collection of X11FakeAuth structures, each of which owns a display. The idea is that when we receive an X connection, we wait to see which of our available auth cookies it matches, and then connect to whatever X display that auth cookie identifies. At present the tree will only have one thing in it; this is all groundwork for later changes. [originally from svn r10079]
2013-11-17 14:05:10 +00:00
struct X11FakeAuth *auth;
Avoid duplicate random_unref on freeing an Ssh. If ssh_init encounters a synchronous error, it will call random_unref before returning. But the Ssh structure it created will still exist, and if the caller (sensibly) responds by freeing it, then that will cause a second random_unref, leading to the RNG's refcount going below zero and failing an assertion. We never noticed this before because with only one PuTTY connection per process it was easier to just exit(1) without bothering to clean things up. Now, with all the multi-sessions-per-process fixes I'm doing, this has shown up as a problem. But other front ends may legitimately still just exit - I don't think I can sensibly enforce _not_ doing so at this late stage - so I've had to arrange to set a flag in the Ssh saying whether a random_unref is still pending or not.
2017-11-27 19:29:47 +00:00
int need_random_unref;
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
Expose the 'dh_ctx' struct tag used for Diffie-Hellman.
2018-09-14 07:48:54 +00:00
if (ssh->dh_ctx)
dh_cleanup(ssh->dh_ctx);
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
sfree(ssh->savedhost);
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
pq_out_clear(&ssh->outq);
Now that Packet structures are dynamically allocated, it means we can keep several of them in parallel. In particular, this allows us to queue outgoing packets during repeat key exchange, to be actually sent after the rekey completes. (This doesn't fully fix ssh2-kex-data; also required is the ability to handle _incoming_ connection-layer packets during rekey without exploding.) [originally from svn r4899]
2004-11-24 19:23:02 +00:00
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
while (ssh->qhead) {
struct queued_handler *qh = ssh->qhead;
ssh->qhead = qh->next;
A collection of small bug fixes from Chris West, apparently spotted by Coverity: assorted language-use goofs like freeing the wrong thing or forgetting to initialise a string on all code paths. [originally from svn r9889]
2013-07-01 17:56:33 +00:00
sfree(qh);
Abstracted out the rather large port-forwarding setup code into a routine which is common between SSH1 and SSH2. Since this routine is not part of the coroutine system, this means it can't sit and wait to get its various success/failure responses back. Hence, I've introduced a system of queued packet handlers, each of which waits for exactly one of a pair of messages (SSH1_SMSG_{SUCCESS,FAILURE} or SSH2_MSG_REQUEST_{SUCCESS,FAILURE}), handles it when it arrives, and automatically de-registers itself. Hence the port-forwarding setup code can be called once, and then subsequent packets related to it will automatically be handled as they arrive. The real purpose of all this is that the infrastructure is now there for me to arrange mid-session configurability of port forwarding. However, a side benefit is that fewer round trips are involved in session startup. I'd quite like to move more of the connection setup (X forwarding, agent forwarding, pty allocation etc) to using the new queued handler mechanism for this reason. [originally from svn r5029]
2004-12-28 14:04:58 +00:00
}
ssh->qhead = ssh->qtail = NULL;
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
if (ssh->channels) {
while ((c = delpos234(ssh->channels, 0)) != NULL) {
Factor out code to close the local socket associated with a channel. The only visible effect should be that abrupt closure of an SSH connection now leads to a slew of messages about closing forwarded ports.
2016-05-28 13:50:02 +00:00
ssh_channel_close_local(c, NULL);
Better handling of outstanding CHANNEL_REQUESTS on channel destruction. Part the first: make sure that all structures describing channel requests are freed when the SSH connection is freed. This involves adding a means to ask a response handler to free any memory it holds. Part the second: in ssh_channel_try_eof(), call ssh2_channel_check_close() rather than emitting an SSH_MSG_CHANNEL_EOF directly. This avoids the possibility of closing the channel while a CHANNEL_REQUEST is outstanding. Also add some assertions that helped with tracking down the latter problem. [originally from svn r9623]
2012-08-25 21:06:48 +00:00
if (ssh->version == 2) {
struct outstanding_channel_request *ocr, *nocr;
ocr = c->v.v2.chanreq_head;
while (ocr) {
ocr->handler(c, NULL, ocr->ctx);
nocr = ocr->next;
sfree(ocr);
ocr = nocr;
}
bufchain_clear(&c->v.v2.outbuffer);
}
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
sfree(c);
}
freetree234(ssh->channels);
NULL a couple of members after freeing them in ssh_free(). In particular, should stop ssh_do_close() accessing freed ssh->channels when invoked later from ssh_free(). Spotted by Fred Sauer. (Perhaps this is the cause of the crashes people have been reporting on abnormal closures such as `Software caused connection abort'? I've not been able to test this.) [originally from svn r4946]
2004-12-02 13:37:28 +00:00
ssh->channels = NULL;
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
}
Null out a couple of pointers when they're empty. ssh->current_user_input_fn was not set to NULL when the ssh structure was initially set up, which meant that with sufficiently eager typeahead it could accidentally be called while still full of garbage. And ssh->connshare is freed in more than one place (by ssh_free and also by do_ssh_close), but only one of those places nulls it out to stop the other one trying to free it a second time.
2018-05-18 10:41:17 +00:00
if (ssh->connshare) {
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
sharestate_free(ssh->connshare);
Null out a couple of pointers when they're empty. ssh->current_user_input_fn was not set to NULL when the ssh structure was initially set up, which meant that with sufficiently eager typeahead it could accidentally be called while still full of garbage. And ssh->connshare is freed in more than one place (by ssh_free and also by do_ssh_close), but only one of those places nulls it out to stop the other one trying to free it a second time.
2018-05-18 10:41:17 +00:00
ssh->connshare = NULL;
}
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
if (ssh->rportfwds) {
while ((pf = delpos234(ssh->rportfwds, 0)) != NULL)
Cancelling a remote port forwarding that had been refused by the server caused a double-free. Reported and diagnosed by Sven Schaepe. Also fix a minor memory leak in ssh_free(). [originally from svn r8975]
2010-07-30 20:47:03 +00:00
free_rportfwd(pf);
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
freetree234(ssh->rportfwds);
NULL a couple of members after freeing them in ssh_free(). In particular, should stop ssh_do_close() accessing freed ssh->channels when invoked later from ssh_free(). Spotted by Fred Sauer. (Perhaps this is the cause of the crashes people have been reporting on abnormal closures such as `Software caused connection abort'? I've not been able to test this.) [originally from svn r4946]
2004-12-02 13:37:28 +00:00
ssh->rportfwds = NULL;
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
}
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
portfwdmgr_free(ssh->portfwdmgr);
Revamp of the local X11 connection code. We now parse X display strings more rigorously, and then we look up the local X authority data in .Xauthority _ourself_ rather than delegating to an external xauth program. This is (negligibly) more efficient on Unix, assuming I haven't got it wrong in some subtle way, but its major benefit is that we can now support X authority lookups on Windows as well provided the user points us at an appropriate X authority file in the standard format. A new Windows-specific config option has been added for this purpose. [originally from svn r8305]
2008-11-17 18:38:09 +00:00
if (ssh->x11disp)
x11_free_display(ssh->x11disp);
Prepare to have multiple X11 auth cookies valid at once. Rather than the top-level component of X forwarding being an X11Display structure which owns some auth data, it's now a collection of X11FakeAuth structures, each of which owns a display. The idea is that when we receive an X connection, we wait to see which of our available auth cookies it matches, and then connect to whatever X display that auth cookie identifies. At present the tree will only have one thing in it; this is all groundwork for later changes. [originally from svn r10079]
2013-11-17 14:05:10 +00:00
while ((auth = delpos234(ssh->x11authtree, 0)) != NULL)
x11_free_fake_auth(auth);
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
if (ssh->bpp)
ssh_bpp_free(ssh->bpp);
Prepare to have multiple X11 auth cookies valid at once. Rather than the top-level component of X forwarding being an X11Display structure which owns some auth data, it's now a collection of X11FakeAuth structures, each of which owns a display. The idea is that when we receive an X connection, we wait to see which of our available auth cookies it matches, and then connect to whatever X display that auth cookie identifies. At present the tree will only have one thing in it; this is all groundwork for later changes. [originally from svn r10079]
2013-11-17 14:05:10 +00:00
freetree234(ssh->x11authtree);
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
sfree(ssh->do_ssh_init_state);
sfree(ssh->do_ssh1_login_state);
sfree(ssh->do_ssh2_transport_state);
Separate the SSH-2 userauth and connection coroutines. do_ssh2_authconn is no more! In its place are two separate functions do_ssh2_userauth and do_ssh2_connection, each handling just one of the three main protocol components of SSH-2, and each with its own separate packet queue feeding from pq_full via the dispatch table. This should be entirely NFC: no bugs are fixed as a side effect of this change. It's mostly done in the hope that further refactoring in the future might finally be able to split up ssh.c into smaller source files, for which it's useful to have these two routines separate, since each one will be talking to a completely different set of supporting machinery.
2018-05-18 06:22:59 +00:00
sfree(ssh->do_ssh2_userauth_state);
sfree(ssh->do_ssh2_connection_state);
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
bufchain_clear(&ssh->incoming_data);
Use a bufchain for outgoing SSH wire data. This mirrors the use of one for incoming wire data: now when we send raw data (be it the initial greeting, or the output of binary packet construction), we put it on ssh->outgoing_data, and schedule a callback to transfer that into the socket. Partly this is in preparation for delegating the task of appending to that bufchain to a separate self-contained module that won't have direct access to the connection's Socket. But also, it has the very nice feature that I get to throw away the ssh_pkt_defer system completely! That was there so that we could construct more than one packet in rapid succession, concatenate them into a single blob, and pass that blob to the socket in one go so that the TCP headers couldn't contain any trace of where the boundary between them was. But now we don't need a separate function to do that: calling the ordinary packet-send routine twice in the same function before returning to the main event loop will have that effect _anyway_.
2018-06-09 08:09:10 +00:00
bufchain_clear(&ssh->outgoing_data);
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
sfree(ssh->incoming_data_eof_message);
Extend PacketQueue to take PktOut as well. Some upcoming restructuring I've got planned will need to pass output packets back and forth on queues, as well as input ones. So here's a change that arranges that we can have a PktInQueue and a PktOutQueue, sharing most of their implementation via a PacketQueueBase structure which links together the PacketQueueNode fields in the two packet structures. There's a tricksy bit of macro manoeuvring to get all of this type-checked, so that I can't accidentally link a PktOut on to a PktInQueue or vice versa. It works by having the main queue functions wrapped by macros; when receiving a packet structure on input, they type-check it against the queue structure and then automatically look up its qnode field to pass to the underlying PacketQueueBase function; on output, they translate a returned PacketQueueNode back to its containing packet type by calling a 'get' function pointer.
2018-09-19 20:56:11 +00:00
pq_in_clear(&ssh->pq_full);
pq_in_clear(&ssh->pq_ssh1_login);
pq_in_clear(&ssh->pq_ssh1_connection);
pq_in_clear(&ssh->pq_ssh2_transport);
pq_in_clear(&ssh->pq_ssh2_userauth);
pq_in_clear(&ssh->pq_ssh2_connection);
Put all user input into a bufchain. This change introduces a new bufchain ssh->user_input, into which we put every byte received via back->send() (i.e. keyboard input from the GUI PuTTY window, data read by Plink from standard input, or outgoing SCP/SFTP protocol data made up by the file transfer utilities). Just like ssh->incoming_data, there's also a function pointer ssh->current_user_input_fn which says who currently has responsibility for pulling data back off that bufchain and processing it. So that can be changed over when the connection moves into a different major phase. At the moment, nothing very interesting is being done with this bufchain: each phase of the connection has its own little function that pulls chunks back out of it with bufchain_prefix and passes them to the unchanged main protocol coroutines. But this is groundwork for being able to switch over each of those coroutines in turn to read directly from ssh->user_input, with the aim of eliminating a collection of annoying bugs in which typed-ahead data is accidentally discarded at an SSH phase transition.
2018-05-18 06:22:58 +00:00
bufchain_clear(&ssh->user_input);
Beginnings of support for multiple exchange hashes in SSH-2: rather than storing a SHA-1 hash of the client and server version strings, store the strings themselves so we can feed them through the appropriate hash when we know what it is. [originally from svn r6241]
2005-08-30 20:38:57 +00:00
sfree(ssh->v_c);
sfree(ssh->v_s);
Initial commit of GSSAPI Kerberos support. [originally from svn r8138]
2008-08-10 13:10:31 +00:00
sfree(ssh->fullhostname);
Sensibly enforce non-interactive rekeying. We now only present the full set of host key algorithms we can handle in the first key exchange. In subsequent rekeys, we present only the host key algorithm that we agreed on the previous time, and then we verify the host key by simply enforcing that it's exactly the same as the one we saw at first and disconnecting rudely if it isn't. [originally from svn r10027]
2013-08-18 06:48:20 +00:00
sfree(ssh->hostkey_str);
Allocate the SSH specials list dynamically. The last list we returned is now stored in the main Ssh structure rather than being a static array in ssh_get_specials. The main point of this is that I want to start adding more dynamic things to it, for which I can't predict the array's max length in advance. But also this fixes a conceptual wrongness, in that if a process had more than one Ssh instance in it then their specials arrays would have taken turns occupying the old static array, and although the current single-threaded client code in the GUI front ends wouldn't have minded (it would have read out the contents just once immediately after get_specials returned), it still feels as if it was a bug waiting to happen.
2016-03-21 06:50:50 +00:00
sfree(ssh->specials);
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
if (ssh->s)
Fix `disconnect': arrange that we keep track of when we're expecting to see the server slam the TCP connection shut (i.e. almost never, unless it's just sent us an SSH_MSG_DISCONNECT), and treat an unexpected closure as a non-clean session termination. Previously any server-initiated connection closure was being treated as a clean exit, which was a hangover from the good old Telnet-only days. [originally from svn r5098] [this svn revision also touched putty-wishlist]
2005-01-11 19:33:41 +00:00
ssh_do_close(ssh, TRUE);
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
expire_timer_context(ssh);
New timing infrastructure. There's a new function schedule_timer() which pretty much any module can call to request a call-back in the future. So terminal.c can do its own handling of blinking, visual bells and deferred screen updates, without having to rely on term_update() being called 50 times a second (fixes: pterm-timer); and ssh.c and telnet.c both invoke a new module pinger.c which takes care of sending keepalives, so they get sent uniformly in all front ends (fixes: plink-keepalives, unix-keepalives). [originally from svn r4906] [this svn revision also touched putty-wishlist]
2004-11-27 13:20:21 +00:00
if (ssh->pinger)
pinger_free(ssh->pinger);
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
sfree(ssh->username);
conf_free(ssh->conf);
Make asynchronous agent_query() requests cancellable. Now, instead of returning a boolean indicating whether the query has completed or is still pending, agent_query() returns NULL to indicate that the query _has_ completed, and if it hasn't, it returns a pointer to a context structure representing the pending query, so that the latter can be used to cancel the query if (for example) you later decide you need to free the thing its callback was using as a context. This should fix a potential race-condition segfault if you overload an agent forwarding channel and then close it abruptly. (Which nobody will be doing for sensible purposes, of course! But I ran across this while stress-testing other aspects of agent forwarding.)
2017-01-29 20:24:15 +00:00
if (ssh->auth_agent_query)
agent_cancel_query(ssh->auth_agent_query);
Cleanups of the GSSAPI support. On Windows, standard GSS libraries are now loaded from standard locations (system32 for SSPI, the registry-stored MIT KfW install location for KfW) rather than using the risky default DLL search path; I've therefore also added an option to manually specify a GSS DLL we haven't heard of (which should in principle Just Work provided it supports proper GSS-API as specified in the RFC). The same option exists on Unix too, because it seemed like too useful an idea to reserve to Windows. In addition, GSSAPI is now documented, and also (unfortunately) its GUI configuration has been moved out into a sub-subpanel on the grounds that it was too big to fit in Auth. [originally from svn r9003]
2010-09-25 07:16:56 +00:00
#ifndef NO_GSSAPI
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
if (ssh->gss_srv_name)
ssh->gsslib->release_name(ssh->gsslib, &ssh->gss_srv_name);
if (ssh->gss_ctx != NULL)
ssh->gsslib->release_cred(ssh->gsslib, &ssh->gss_ctx);
Cleanups of the GSSAPI support. On Windows, standard GSS libraries are now loaded from standard locations (system32 for SSPI, the registry-stored MIT KfW install location for KfW) rather than using the risky default DLL search path; I've therefore also added an option to manually specify a GSS DLL we haven't heard of (which should in principle Just Work provided it supports proper GSS-API as specified in the RFC). The same option exists on Unix too, because it seemed like too useful an idea to reserve to Windows. In addition, GSSAPI is now documented, and also (unfortunately) its GUI configuration has been moved out into a sub-subpanel on the grounds that it was too big to fit in Auth. [originally from svn r9003]
2010-09-25 07:16:56 +00:00
if (ssh->gsslibs)
ssh_gss_cleanup(ssh->gsslibs);
Support GSS key exchange, for Kerberos 5 only. This is a heavily edited (by me) version of a patch originally due to Nico Williams and Viktor Dukhovni. Their comments: * Don't delegate credentials when rekeying unless there's a new TGT or the old service ticket is nearly expired. * Check for the above conditions more frequently (every two minutes by default) and rekey when we would delegate credentials. * Do not rekey with very short service ticket lifetimes; some GSSAPI libraries may lose the race to use an almost expired ticket. Adjust the timing of rekey checks to try to avoid this possibility. My further comments: The most interesting thing about this patch to me is that the use of GSS key exchange causes a switch over to a completely different model of what host keys are for. This comes from RFC 4462 section 2.1: the basic idea is that when your session is mostly bidirectionally authenticated by the GSSAPI exchanges happening in initial kex and every rekey, host keys become more or less vestigial, and their remaining purpose is to allow a rekey to happen if the requirements of the SSH protocol demand it at an awkward moment when the GSS credentials are not currently available (e.g. timed out and haven't been renewed yet). As such, there's no need for host keys to be _permanent_ or to be a reliable identifier of a particular host, and RFC 4462 allows for the possibility that they might be purely transient and only for this kind of emergency fallback purpose. Therefore, once PuTTY has done a GSS key exchange, it disconnects itself completely from the permanent host key cache functions in storage.h, and instead switches to a _transient_ host key cache stored in memory with the lifetime of just that SSH session. That cache is populated with keys received from the server as a side effect of GSS kex (via the optional SSH2_MSG_KEXGSS_HOSTKEY message), and used if later in the session we have to fall back to a non-GSS key exchange. However, in practice servers we've tested against do not send a host key in that way, so we also have a fallback method of populating the transient cache by triggering an immediate non-GSS rekey straight after userauth (reusing the code path we also use to turn on OpenSSH delayed encryption without the race condition).
2018-04-26 06:18:59 +00:00
ssh_cleanup_transient_hostkey_store(ssh);
Cleanups of the GSSAPI support. On Windows, standard GSS libraries are now loaded from standard locations (system32 for SSPI, the registry-stored MIT KfW install location for KfW) rather than using the risky default DLL search path; I've therefore also added an option to manually specify a GSS DLL we haven't heard of (which should in principle Just Work provided it supports proper GSS-API as specified in the RFC). The same option exists on Unix too, because it seemed like too useful an idea to reserve to Windows. In addition, GSSAPI is now documented, and also (unfortunately) its GUI configuration has been moved out into a sub-subpanel on the grounds that it was too big to fit in Auth. [originally from svn r9003]
2010-09-25 07:16:56 +00:00
#endif
Avoid duplicate random_unref on freeing an Ssh. If ssh_init encounters a synchronous error, it will call random_unref before returning. But the Ssh structure it created will still exist, and if the caller (sensibly) responds by freeing it, then that will cause a second random_unref, leading to the RNG's refcount going below zero and failing an assertion. We never noticed this before because with only one PuTTY connection per process it was easier to just exit(1) without bothering to clean things up. Now, with all the multi-sessions-per-process fixes I'm doing, this has shown up as a problem. But other front ends may legitimately still just exit - I don't think I can sensibly enforce _not_ doing so at this late stage - so I've had to arrange to set a flag in the Ssh saying whether a random_unref is still pending or not.
2017-11-27 19:29:47 +00:00
need_random_unref = ssh->need_random_unref;
Fix obviously stupid segfault. Ahem. [originally from svn r4989]
2004-12-16 15:38:39 +00:00
sfree(ssh);
Loose end from timing shakeup: sshrand.c is now a client of timing.c, and hence takes its own responsibility for calling noise_regular() at regular intervals. Again, this means it will be called consistently in _all_ the SSH-speaking tools, not just those in which I remembered to call it! [originally from svn r4913]
2004-11-27 19:56:38 +00:00
Avoid duplicate random_unref on freeing an Ssh. If ssh_init encounters a synchronous error, it will call random_unref before returning. But the Ssh structure it created will still exist, and if the caller (sensibly) responds by freeing it, then that will cause a second random_unref, leading to the RNG's refcount going below zero and failing an assertion. We never noticed this before because with only one PuTTY connection per process it was easier to just exit(1) without bothering to clean things up. Now, with all the multi-sessions-per-process fixes I'm doing, this has shown up as a problem. But other front ends may legitimately still just exit - I don't think I can sensibly enforce _not_ doing so at this late stage - so I've had to arrange to set a flag in the Ssh saying whether a random_unref is still pending or not.
2017-11-27 19:29:47 +00:00
if (need_random_unref)
random_unref();
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
}
The back ends now contain their own copies of the Config structure, and have a function to pass in a new one. (Well, actually several back ends don't actually bother to do this because they need nothing out of Config after the initial setup phase, but they could if they wanted to.) [originally from svn r2561]
2003-01-12 14:48:29 +00:00
/*
* Reconfigure the SSH backend.
*/
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static void ssh_reconfig(Backend *be, Conf *conf)
The back ends now contain their own copies of the Config structure, and have a function to pass in a new one. (Well, actually several back ends don't actually bother to do this because they need nothing out of Config after the initial setup phase, but they could if they wanted to.) [originally from svn r2561]
2003-01-12 14:48:29 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
const char *rekeying = NULL;
int rekey_mandatory = FALSE;
Support reconfiguration of key exchange in mid-session. The fiddly bit is working out when to reschedule the next rekey for when the timeout or data limit changes; sometimes it will be _right now_ because we're already over the new limit. Still to do: the Kex panel should not appear in mid-session if we are using SSHv1. [originally from svn r5031]
2004-12-28 14:10:32 +00:00
unsigned long old_max_data_size;
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
int i, rekey_time;
Support reconfiguration of key exchange in mid-session. The fiddly bit is working out when to reschedule the next rekey for when the timeout or data limit changes; sometimes it will be _right now_ because we're already over the new limit. Still to do: the Kex panel should not appear in mid-session if we are using SSHv1. [originally from svn r5031]
2004-12-28 14:10:32 +00:00
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
pinger_reconfig(ssh->pinger, ssh->conf, conf);
Move port-forwarding setup out of ssh.c. The tree234 storing currently active port forwardings - both local and remote - now lives in portfwd.c, as does the complicated function that updates it based on a Conf listing the new set of desired forwardings. Local port forwardings are passed to ssh.c via the same route as before - once the listening port receives a connection and portfwd.c knows where it should be directed to (in particular, after the SOCKS exchange, if any), it calls ssh_send_port_open. Remote forwardings are now initiated by calling ssh_rportfwd_alloc, which adds an entry to the rportfwds tree (which _is_ still in ssh.c, and still confusingly sorted by a different criterion depending on SSH protocol version) and sends out the appropriate protocol request. ssh_rportfwd_remove cancels one again, sending a protocol request too. Those functions look enough like ssh_{alloc,remove}_sharing_rportfwd that I've merged those into the new pair as well - now allocating an rportfwd allows you to specify either a destination host/port or a sharing context, and returns a handy pointer you can use to cancel the forwarding later.
2018-09-14 16:04:39 +00:00
portfwdmgr_config(ssh->portfwdmgr, conf);
Support reconfiguration of key exchange in mid-session. The fiddly bit is working out when to reschedule the next rekey for when the timeout or data limit changes; sometimes it will be _right now_ because we're already over the new limit. Still to do: the Kex panel should not appear in mid-session if we are using SSHv1. [originally from svn r5031]
2004-12-28 14:10:32 +00:00
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
rekey_time = conf_get_int(conf, CONF_ssh_rekey_time);
Factor out ssh2_timer_update. This is a preliminary refactoring for an upcoming change which will need to affect every use of schedule_timer to wait for the next rekey: those calls to schedule_timer are now centralised into a function that does an organised piece of thinking about when the next timer should be. A side effect of this change is that the translation from CONF_ssh_rekey_time to an actual tick count is now better proofed against integer overflow (just in case the user entered a completely silly value).
2018-04-14 13:48:02 +00:00
if (ssh2_timer_update(ssh, rekey_mins(rekey_time, 60)))
rekeying = "timeout shortened";
Support reconfiguration of key exchange in mid-session. The fiddly bit is working out when to reschedule the next rekey for when the timeout or data limit changes; sometimes it will be _right now_ because we're already over the new limit. Still to do: the Kex panel should not appear in mid-session if we are using SSHv1. [originally from svn r5031]
2004-12-28 14:10:32 +00:00
old_max_data_size = ssh->max_data_size;
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
ssh->max_data_size = parse_blocksize(conf_get_str(ssh->conf,
CONF_ssh_rekey_data));
Support reconfiguration of key exchange in mid-session. The fiddly bit is working out when to reschedule the next rekey for when the timeout or data limit changes; sometimes it will be _right now_ because we're already over the new limit. Still to do: the Kex panel should not appear in mid-session if we are using SSHv1. [originally from svn r5031]
2004-12-28 14:10:32 +00:00
if (old_max_data_size != ssh->max_data_size &&
ssh->max_data_size != 0) {
if (ssh->outgoing_data_size > ssh->max_data_size ||
ssh->incoming_data_size > ssh->max_data_size)
Servers announcing themselves as `Sun_SSH_1.0' apparently cannot deal with rekeys at all: they totally ignore mid-session KEXINIT sent by the client. Hence, a new bug entry so we don't try it. [originally from svn r5092]
2005-01-11 10:37:55 +00:00
rekeying = "data limit lowered";
Support reconfiguration of key exchange in mid-session. The fiddly bit is working out when to reschedule the next rekey for when the timeout or data limit changes; sometimes it will be _right now_ because we're already over the new limit. Still to do: the Kex panel should not appear in mid-session if we are using SSHv1. [originally from svn r5031]
2004-12-28 14:10:32 +00:00
}
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (conf_get_int(ssh->conf, CONF_compression) !=
conf_get_int(conf, CONF_compression)) {
Servers announcing themselves as `Sun_SSH_1.0' apparently cannot deal with rekeys at all: they totally ignore mid-session KEXINIT sent by the client. Hence, a new bug entry so we don't try it. [originally from svn r5092]
2005-01-11 10:37:55 +00:00
rekeying = "compression setting changed";
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
rekey_mandatory = TRUE;
}
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
for (i = 0; i < CIPHER_MAX; i++)
if (conf_get_int_int(ssh->conf, CONF_ssh_cipherlist, i) !=
conf_get_int_int(conf, CONF_ssh_cipherlist, i)) {
rekeying = "cipher settings changed";
rekey_mandatory = TRUE;
}
if (conf_get_int(ssh->conf, CONF_ssh2_des_cbc) !=
conf_get_int(conf, CONF_ssh2_des_cbc)) {
Servers announcing themselves as `Sun_SSH_1.0' apparently cannot deal with rekeys at all: they totally ignore mid-session KEXINIT sent by the client. Hence, a new bug entry so we don't try it. [originally from svn r5092]
2005-01-11 10:37:55 +00:00
rekeying = "cipher settings changed";
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
rekey_mandatory = TRUE;
Support reconfiguration of key exchange in mid-session. The fiddly bit is working out when to reschedule the next rekey for when the timeout or data limit changes; sometimes it will be _right now_ because we're already over the new limit. Still to do: the Kex panel should not appear in mid-session if we are using SSHv1. [originally from svn r5031]
2004-12-28 14:10:32 +00:00
}
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
conf_free(ssh->conf);
ssh->conf = conf_copy(conf);
ssh_cache_conf_values(ssh);
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
if (!ssh->bare_connection && rekeying) {
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
if (!ssh->kex_in_progress) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->rekey_reason = rekeying;
ssh->rekey_class = RK_NORMAL;
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
queue_idempotent_callback(&ssh->ssh2_transport_icb);
Allow reconfiguration of compression and cipher settings in mid-session in SSH2: this forces an immediate rekey to activate the new settings. I'm not sure exactly what this will be useful for (except possibly it might make comparative performance testing easier?), but it has wonderful James Bond value for being able to switch to a more secure cipher before doing anything sensitive :-) If, that is, you weren't using the most secure one to begin with... [originally from svn r5051]
2004-12-31 10:51:14 +00:00
} else if (rekey_mandatory) {
ssh->deferred_rekey_reason = rekeying;
}
}
The back ends now contain their own copies of the Config structure, and have a function to pass in a new one. (Well, actually several back ends don't actually bother to do this because they need nothing out of Config after the initial setup phase, but they could if they wanted to.) [originally from svn r2561]
2003-01-12 14:48:29 +00:00
}
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
/*
Remove a couple of mistaken references to Telnet in comments. [originally from svn r5853]
2005-05-28 13:46:04 +00:00
* Called to send data down the SSH connection.
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
*/
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static int ssh_send(Backend *be, const char *buf, int len)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
Remove the ssh*_protocol() functions completely. After the last few commits, neither incoming SSH packets nor incoming user input goes through those functions any more - each of those directions of data goes into a queue and from there to a callback specifically processing that queue. So the centralised top-level protocol switching functions have nothing left to switch, and can go.
2018-05-18 06:22:58 +00:00
if (ssh == NULL || ssh->s == NULL)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
return 0;
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
Put all user input into a bufchain. This change introduces a new bufchain ssh->user_input, into which we put every byte received via back->send() (i.e. keyboard input from the GUI PuTTY window, data read by Plink from standard input, or outgoing SCP/SFTP protocol data made up by the file transfer utilities). Just like ssh->incoming_data, there's also a function pointer ssh->current_user_input_fn which says who currently has responsibility for pulling data back off that bufchain and processing it. So that can be changed over when the connection moves into a different major phase. At the moment, nothing very interesting is being done with this bufchain: each phase of the connection has its own little function that pulls chunks back out of it with bufchain_prefix and passes them to the unchanged main protocol coroutines. But this is groundwork for being able to switch over each of those coroutines in turn to read directly from ssh->user_input, with the aim of eliminating a collection of annoying bugs in which typed-ahead data is accidentally discarded at an SSH phase transition.
2018-05-18 06:22:58 +00:00
bufchain_add(&ssh->user_input, buf, len);
queue_idempotent_callback(&ssh->user_input_consumer);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
return backend_sendbuffer(&ssh->backend);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
/*
* Called to query the current amount of buffered stdin data.
*/
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static int ssh_sendbuffer(Backend *be)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
int override_value;
Remove the ssh*_protocol() functions completely. After the last few commits, neither incoming SSH packets nor incoming user input goes through those functions any more - each of those directions of data goes into a queue and from there to a callback specifically processing that queue. So the centralised top-level protocol switching functions have nothing left to switch, and can go.
2018-05-18 06:22:58 +00:00
if (ssh == NULL || ssh->s == NULL)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
return 0;
/*
* If the SSH socket itself has backed up, add the total backup
* size on that to any individual buffer on the stdin channel.
*/
override_value = 0;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->throttled_all)
override_value = ssh->overall_bufsize;
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->version == 1) {
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
return override_value;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
} else if (ssh->version == 2) {
Revamp of EOF handling in all network connections, pipes and other data channels. Should comprehensively fix 'half-closed', in principle, though it's a big and complicated change and so there's a good chance I've made at least one mistake somewhere. All connections should now be rigorous about propagating end-of-file (or end-of-data-stream, or socket shutdown, or whatever) independently in both directions, except in frontends with no mechanism for sending explicit EOF (e.g. interactive terminal windows) or backends which are basically always used for interactive sessions so it's unlikely that an application would be depending on independent EOF (telnet, rlogin). EOF should now never accidentally be sent while there's still buffered data to go out before it. (May help fix 'portfwd-corrupt', and also I noticed recently that the ssh main session channel can accidentally have MSG_EOF sent before the output bufchain is clear, leading to embarrassment when it subsequently does send the output). [originally from svn r9279]
2011-09-13 11:44:03 +00:00
if (!ssh->mainchan)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
return override_value;
else
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
return (override_value +
bufchain_size(&ssh->mainchan->v.v2.outbuffer));
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
return 0;
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
/*
Window resizing wasn't working in SSH2 [originally from svn r753]
2000-10-24 09:49:03 +00:00
* Called to set the size of the window from SSH's POV.
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
*/
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static void ssh_size(Backend *be, int width, int height)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->term_width = width;
ssh->term_height = height;
Cleanups from yesterday's destabilisation: lots of stuff in terminal.c was apparently relying on implicit initialisation to zero, and also I've removed the backends' dependency on terminal.h by having terminal sizes explicitly passed in to back->size(). [originally from svn r2117]
2002-10-23 12:41:35 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
switch (ssh->state) {
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
case SSH_STATE_BEFORE_SIZE:
Ensure ssh specials (EOF and PING) don't occur except in connection states where they're meaningful. In case Plink misses an EOF by attempting to send it before reaching SSH_STATE_SESSION, it is buffered and sent later. PINGs can be sent during any part of the initialisation phase _except_ before deciding whether to use protocol 1 or 2. [originally from svn r850]
2001-01-08 13:57:45 +00:00
case SSH_STATE_PREPACKET:
Add SSH_STATE_CLOSED to prevent accidentally sending resizes down a closed connection; was causing process hangs under NT and whole- system hangs under '95 [originally from svn r126]
1999-03-23 17:21:44 +00:00
case SSH_STATE_CLOSED:
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
break; /* do nothing */
case SSH_STATE_INTERMED:
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->size_needed = TRUE; /* buffer for later */
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
break;
case SSH_STATE_SESSION:
Post-release destabilisation! Completely remove the struct type 'Config' in putty.h, which stores all PuTTY's settings and includes an arbitrary length limit on every single one of those settings which is stored in string form. In place of it is 'Conf', an opaque data type everywhere outside the new file conf.c, which stores a list of (key, value) pairs in which every key contains an integer identifying a configuration setting, and for some of those integers the key also contains extra parts (so that, for instance, CONF_environmt is a string-to-string mapping). Everywhere that a Config was previously used, a Conf is now; everywhere there was a Config structure copy, conf_copy() is called; every lookup, adjustment, load and save operation on a Config has been rewritten; and there's a mechanism for serialising a Conf into a binary blob and back for use with Duplicate Session. User-visible effects of this change _should_ be minimal, though I don't doubt I've introduced one or two bugs here and there which will eventually be found. The _intended_ visible effects of this change are that all arbitrary limits on configuration strings and lists (e.g. limit on number of port forwardings) should now disappear; that list boxes in the configuration will now be displayed in a sorted order rather than the arbitrary order in which they were added to the list (since the underlying data structure is now a sorted tree234 rather than an ad-hoc comma-separated string); and one more specific change, which is that local and dynamic port forwardings on the same port number are now mutually exclusive in the configuration (putting 'D' in the key rather than the value was a mistake in the first place). One other reorganisation as a result of this is that I've moved all the dialog.c standard handlers (dlg_stdeditbox_handler and friends) out into config.c, because I can't really justify calling them generic any more. When they took a pointer to an arbitrary structure type and the offset of a field within that structure, they were independent of whether that structure was a Config or something completely different, but now they really do expect to talk to a Conf, which can _only_ be used for PuTTY configuration, so I've renamed them all things like conf_editbox_handler and moved them out of the nominally independent dialog-box management module into the PuTTY-specific config.c. [originally from svn r9214]
2011-07-14 18:52:21 +00:00
if (!conf_get_int(ssh->conf, CONF_nopty)) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->version == 1) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_WINDOW_SIZE);
put_uint32(pktout, ssh->term_height);
put_uint32(pktout, ssh->term_width);
put_uint32(pktout, 0);
put_uint32(pktout, 0);
ssh_pkt_write(ssh, pktout);
Implement part of `ssh2-generality': introduce the ability to tell PuTTY / Plink not to run a remote shell/command at all. Supported in the GUI configuration and via the (OpenSSH-like) -N command-line option. No effort is currently made to arrange `nice' UI properties. If you do this in GUI PuTTY, a full-size terminal window will still be created, and will sit there with almost nothing in it throughout your session. If you do it in Plink, Plink will not accept any kind of request to terminate gracefully; you'll have to ^C or kill it. Nonetheless, even this little will be useful to some people... [originally from svn r4614]
2004-10-13 13:43:11 +00:00
} else if (ssh->mainchan) {
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
pktout = ssh2_chanreq_init(ssh->mainchan, "window-change",
NULL, NULL);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, ssh->term_width);
put_uint32(pktout, ssh->term_height);
put_uint32(pktout, 0);
put_uint32(pktout, 0);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
ssh2_pkt_send(ssh, pktout);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
}
break;
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
}
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
/*
* Return a list of the special codes that make sense in this
* protocol.
*/
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static const struct telnet_special *ssh_get_specials(Backend *be)
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
{
Don't offer repeat key exchange as a special command in SSH-1. [originally from svn r5026]
2004-12-24 10:04:28 +00:00
static const struct telnet_special ssh1_ignore_special[] = {
{"IGNORE message", TS_NOP}
};
New SSH bug flag, for 'can't handle SSH2_MSG_IGNORE'. Another user today reported an SSH2_MSG_UNIMPLEMENTED from a Cisco router which looks as if it was triggered by SSH2_MSG_IGNORE, so I'm experimentally putting this flag in. Currently must be manually enabled, though if it turns out to solve the user's problem then I'll probably add at least one version string... [Edited commit message: actually, I also committed in error a piece of experimental code as part of this checkin. Serve me right for not running 'svn diff' first.] [originally from svn r8926]
2010-04-23 18:32:15 +00:00
static const struct telnet_special ssh2_ignore_special[] = {
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
{"IGNORE message", TS_NOP},
New SSH bug flag, for 'can't handle SSH2_MSG_IGNORE'. Another user today reported an SSH2_MSG_UNIMPLEMENTED from a Cisco router which looks as if it was triggered by SSH2_MSG_IGNORE, so I'm experimentally putting this flag in. Currently must be manually enabled, though if it turns out to solve the user's problem then I'll probably add at least one version string... [Edited commit message: actually, I also committed in error a piece of experimental code as part of this checkin. Serve me right for not running 'svn diff' first.] [originally from svn r8926]
2010-04-23 18:32:15 +00:00
};
static const struct telnet_special ssh2_rekey_special[] = {
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
{"Repeat key exchange", TS_REKEY},
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
};
static const struct telnet_special ssh2_session_specials[] = {
Support the SSH-2 mechanism for sending signals to a running session. Neither of the SSH servers I conveniently have access to (Debian stable OpenSSH -- 3.4p1 -- and lshd) seem to take a blind bit of notice, but the channel requests look fine to me in the packet log. I've included all the signals explicitly defined by draft-ietf-secsh-connect-19, but I've put the more obscure ones in a submenu of the specials menu; there's therefore been some minor upheaval to support such submenus. [originally from svn r4652]
2004-10-17 21:22:22 +00:00
{NULL, TS_SEP},
{"Break", TS_BRK},
Replace mentions of SSH-2 I-Ds with references to the corresponding RFCs. [originally from svn r7759]
2007-10-03 21:21:18 +00:00
/* These are the signal names defined by RFC 4254.
Support the SSH-2 mechanism for sending signals to a running session. Neither of the SSH servers I conveniently have access to (Debian stable OpenSSH -- 3.4p1 -- and lshd) seem to take a blind bit of notice, but the channel requests look fine to me in the packet log. I've included all the signals explicitly defined by draft-ietf-secsh-connect-19, but I've put the more obscure ones in a submenu of the specials menu; there's therefore been some minor upheaval to support such submenus. [originally from svn r4652]
2004-10-17 21:22:22 +00:00
* They include all the ISO C signals, but are a subset of the POSIX
* required signals. */
{"SIGINT (Interrupt)", TS_SIGINT},
{"SIGTERM (Terminate)", TS_SIGTERM},
{"SIGKILL (Kill)", TS_SIGKILL},
{"SIGQUIT (Quit)", TS_SIGQUIT},
{"SIGHUP (Hangup)", TS_SIGHUP},
{"More signals", TS_SUBMENU},
{"SIGABRT", TS_SIGABRT}, {"SIGALRM", TS_SIGALRM},
{"SIGFPE", TS_SIGFPE}, {"SIGILL", TS_SIGILL},
{"SIGPIPE", TS_SIGPIPE}, {"SIGSEGV", TS_SIGSEGV},
{"SIGUSR1", TS_SIGUSR1}, {"SIGUSR2", TS_SIGUSR2},
{NULL, TS_EXITMENU}
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
};
static const struct telnet_special specials_end[] = {
Support the SSH-2 mechanism for sending signals to a running session. Neither of the SSH servers I conveniently have access to (Debian stable OpenSSH -- 3.4p1 -- and lshd) seem to take a blind bit of notice, but the channel requests look fine to me in the packet log. I've included all the signals explicitly defined by draft-ietf-secsh-connect-19, but I've put the more obscure ones in a submenu of the specials menu; there's therefore been some minor upheaval to support such submenus. [originally from svn r4652]
2004-10-17 21:22:22 +00:00
{NULL, TS_EXITMENU}
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
};
Allocate the SSH specials list dynamically. The last list we returned is now stored in the main Ssh structure rather than being a static array in ssh_get_specials. The main point of this is that I want to start adding more dynamic things to it, for which I can't predict the array's max length in advance. But also this fixes a conceptual wrongness, in that if a process had more than one Ssh instance in it then their specials arrays would have taken turns occupying the old static array, and although the current single-threaded client code in the GUI front ends wouldn't have minded (it would have read out the contents just once immediately after get_specials returned), it still feels as if it was a bug waiting to happen.
2016-03-21 06:50:50 +00:00
struct telnet_special *specials = NULL;
int nspecials = 0, specialsize = 0;
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Allocate the SSH specials list dynamically. The last list we returned is now stored in the main Ssh structure rather than being a static array in ssh_get_specials. The main point of this is that I want to start adding more dynamic things to it, for which I can't predict the array's max length in advance. But also this fixes a conceptual wrongness, in that if a process had more than one Ssh instance in it then their specials arrays would have taken turns occupying the old static array, and although the current single-threaded client code in the GUI front ends wouldn't have minded (it would have read out the contents just once immediately after get_specials returned), it still feels as if it was a bug waiting to happen.
2016-03-21 06:50:50 +00:00
sfree(ssh->specials);
#define ADD_SPECIALS(name) do \
{ \
int len = lenof(name); \
if (nspecials + len > specialsize) { \
specialsize = (nspecials + len) * 5 / 4 + 32; \
specials = sresize(specials, specialsize, struct telnet_special); \
} \
memcpy(specials+nspecials, name, len*sizeof(struct telnet_special)); \
nspecials += len; \
} while (0)
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
if (ssh->version == 1) {
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
/* Don't bother offering IGNORE if we've decided the remote
* won't cope with it, since we wouldn't bother sending it if
* asked anyway. */
if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
Don't offer repeat key exchange as a special command in SSH-1. [originally from svn r5026]
2004-12-24 10:04:28 +00:00
ADD_SPECIALS(ssh1_ignore_special);
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
} else if (ssh->version == 2) {
New SSH bug flag, for 'can't handle SSH2_MSG_IGNORE'. Another user today reported an SSH2_MSG_UNIMPLEMENTED from a Cisco router which looks as if it was triggered by SSH2_MSG_IGNORE, so I'm experimentally putting this flag in. Currently must be manually enabled, though if it turns out to solve the user's problem then I'll probably add at least one version string... [Edited commit message: actually, I also committed in error a piece of experimental code as part of this checkin. Serve me right for not running 'svn diff' first.] [originally from svn r8926]
2010-04-23 18:32:15 +00:00
if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE))
ADD_SPECIALS(ssh2_ignore_special);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
if (!(ssh->remote_bugs & BUG_SSH2_REKEY) && !ssh->bare_connection)
New SSH bug flag, for 'can't handle SSH2_MSG_IGNORE'. Another user today reported an SSH2_MSG_UNIMPLEMENTED from a Cisco router which looks as if it was triggered by SSH2_MSG_IGNORE, so I'm experimentally putting this flag in. Currently must be manually enabled, though if it turns out to solve the user's problem then I'll probably add at least one version string... [Edited commit message: actually, I also committed in error a piece of experimental code as part of this checkin. Serve me right for not running 'svn diff' first.] [originally from svn r8926]
2010-04-23 18:32:15 +00:00
ADD_SPECIALS(ssh2_rekey_special);
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
if (ssh->mainchan)
ADD_SPECIALS(ssh2_session_specials);
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
if (ssh->n_uncert_hostkeys) {
static const struct telnet_special uncert_start[] = {
{NULL, TS_SEP},
{"Cache new host key type", TS_SUBMENU},
};
static const struct telnet_special uncert_end[] = {
{NULL, TS_EXITMENU},
};
int i;
ADD_SPECIALS(uncert_start);
for (i = 0; i < ssh->n_uncert_hostkeys; i++) {
struct telnet_special uncert[1];
Invent a struct type for polymorphic SSH key data. During last week's work, I made a mistake in which I got the arguments backwards in one of the key-blob-generating functions - mistakenly swapped the 'void *' key instance with the 'BinarySink *' output destination - and I didn't spot the mistake until run time, because in C you can implicitly convert both to and from void * and so there was no compile-time failure of type checking. Now that I've introduced the FROMFIELD macro that downcasts a pointer to one field of a structure to retrieve a pointer to the whole structure, I think I might start using that more widely to indicate this kind of polymorphic subtyping. So now all the public-key functions in the struct ssh_signkey vtable handle their data instance in the form of a pointer to a subfield of a new zero-sized structure type 'ssh_key', which outside the key implementations indicates 'this is some kind of key instance but it could be of any type'; they downcast that pointer internally using FROMFIELD in place of the previous ordinary C cast, and return one by returning &foo->sshk for whatever foo they've just made up. The sshk member is not at the beginning of the structure, which means all those FROMFIELDs and &key->sshk are actually adding and subtracting an offset. Of course I could have put the member at the start anyway, but I had the idea that it's actually a feature _not_ to have the two types start at the same address, because it means you should notice earlier rather than later if you absentmindedly cast from one to the other directly rather than by the approved method (in particular, if you accidentally assign one through a void * and back without even _noticing_ you perpetrated a cast). In particular, this enforces that you can't sfree() the thing even once without realising you should instead of called the right freekey function. (I found several bugs by this method during initial testing, so I think it's already proved its worth!) While I'm here, I've also renamed the vtable structure ssh_signkey to ssh_keyalg, because it was a confusing name anyway - it describes the _algorithm_ for handling all keys of that type, not a specific key. So ssh_keyalg is the collection of code, and ssh_key is one instance of the data it handles.
2018-05-27 07:32:21 +00:00
const ssh_keyalg *alg =
Configurable preference list for SSH host key types. Now we actually have enough of them to worry about, and especially since some of the types we support are approved by organisations that people might make their own decisions about whether to trust, it seems worth having a config list for host keys the same way we have one for kex types and ciphers. To make room for this, I've created an SSH > Host Keys config panel, and moved the existing host-key related configuration (manually specified fingerprints) into there from the Kex panel.
2016-03-25 15:56:31 +00:00
hostkey_algs[ssh->uncert_hostkeys[i]].alg;
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
uncert[0].name = alg->ssh_id;
Ahem. Cross-certify the key the user actually asked for. I got momentarily confused between whether the special code (TS_LOCALSTART+i) meant the ith entry in the variable uncert_hostkeys[] array, or the ith entry in the fixed hostkey_algs[] array. Now I think everything agrees on it being the latter.
2016-03-21 18:59:01 +00:00
uncert[0].code = TS_LOCALSTART + ssh->uncert_hostkeys[i];
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
ADD_SPECIALS(uncert);
}
ADD_SPECIALS(uncert_end);
}
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
} /* else we're not ready yet */
Allocate the SSH specials list dynamically. The last list we returned is now stored in the main Ssh structure rather than being a static array in ssh_get_specials. The main point of this is that I want to start adding more dynamic things to it, for which I can't predict the array's max length in advance. But also this fixes a conceptual wrongness, in that if a process had more than one Ssh instance in it then their specials arrays would have taken turns occupying the old static array, and although the current single-threaded client code in the GUI front ends wouldn't have minded (it would have read out the contents just once immediately after get_specials returned), it still feels as if it was a bug waiting to happen.
2016-03-21 06:50:50 +00:00
if (nspecials)
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
ADD_SPECIALS(specials_end);
Allocate the SSH specials list dynamically. The last list we returned is now stored in the main Ssh structure rather than being a static array in ssh_get_specials. The main point of this is that I want to start adding more dynamic things to it, for which I can't predict the array's max length in advance. But also this fixes a conceptual wrongness, in that if a process had more than one Ssh instance in it then their specials arrays would have taken turns occupying the old static array, and although the current single-threaded client code in the GUI front ends wouldn't have minded (it would have read out the contents just once immediately after get_specials returned), it still feels as if it was a bug waiting to happen.
2016-03-21 06:50:50 +00:00
ssh->specials = specials;
if (nspecials) {
return specials;
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
} else {
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
return NULL;
We shouldn't offer the Break special when we don't have a session to send it down. (A side effect of fixing this is that ssh->mainchain is set to NULL when it closes, which might avoid other sorts of trouble.) While we're here, don't bother offering SSH1_MSG_IGNORE if we believe the remote will barf on it. [originally from svn r4650]
2004-10-17 15:32:42 +00:00
}
#undef ADD_SPECIALS
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
}
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
/*
Remove a couple of mistaken references to Telnet in comments. [originally from svn r5853]
2005-05-28 13:46:04 +00:00
* Send special codes. TS_EOF is useful for `plink', so you
plink can now execute a specific command instead of just a shell session [originally from svn r576]
2000-09-08 15:24:19 +00:00
* can send an EOF and collect resulting output (e.g. `plink
* hostname sort').
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
*/
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static void ssh_special(Backend *be, Telnet_Special code)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
plink can now execute a specific command instead of just a shell session [originally from svn r576]
2000-09-08 15:24:19 +00:00
if (code == TS_EOF) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->state != SSH_STATE_SESSION) {
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
/*
* Buffer the EOF in case we are pre-SESSION, so we can
* send it as soon as we reach SESSION.
*/
if (code == TS_EOF)
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
ssh->eof_needed = TRUE;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
return;
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->version == 1) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH1_CMSG_EOF);
ssh_pkt_write(ssh, pktout);
Implement part of `ssh2-generality': introduce the ability to tell PuTTY / Plink not to run a remote shell/command at all. Supported in the GUI configuration and via the (OpenSSH-like) -N command-line option. No effort is currently made to arrange `nice' UI properties. If you do this in GUI PuTTY, a full-size terminal window will still be created, and will sit there with almost nothing in it throughout your session. If you do it in Plink, Plink will not accept any kind of request to terminate gracefully; you'll have to ^C or kill it. Nonetheless, even this little will be useful to some people... [originally from svn r4614]
2004-10-13 13:43:11 +00:00
} else if (ssh->mainchan) {
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
sshfwd_write_eof(&ssh->mainchan->sc);
After we receive EOF on stdin, we should clear ssh->send_ok so that we stop trying to read anything further from stdin. Otherwise we send a continuous stream of SSH2_MSG_CHANNEL_EOF. [originally from svn r5561]
2005-03-29 13:10:33 +00:00
ssh->send_ok = 0; /* now stop trying to read from stdin */
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
logevent("Sent EOF message");
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
} else if (code == TS_PING || code == TS_NOP) {
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->state == SSH_STATE_CLOSED
|| ssh->state == SSH_STATE_PREPACKET) return;
if (ssh->version == 1) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE)) {
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_IGNORE);
put_stringz(pktout, "");
ssh_pkt_write(ssh, pktout);
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
} else {
New SSH bug flag, for 'can't handle SSH2_MSG_IGNORE'. Another user today reported an SSH2_MSG_UNIMPLEMENTED from a Cisco router which looks as if it was triggered by SSH2_MSG_IGNORE, so I'm experimentally putting this flag in. Currently must be manually enabled, though if it turns out to solve the user's problem then I'll probably add at least one version string... [Edited commit message: actually, I also committed in error a piece of experimental code as part of this checkin. Serve me right for not running 'svn diff' first.] [originally from svn r8926]
2010-04-23 18:32:15 +00:00
if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH2_IGNORE)) {
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH2_MSG_IGNORE);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(pktout, "");
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
ssh_pkt_write(ssh, pktout);
New SSH bug flag, for 'can't handle SSH2_MSG_IGNORE'. Another user today reported an SSH2_MSG_UNIMPLEMENTED from a Cisco router which looks as if it was triggered by SSH2_MSG_IGNORE, so I'm experimentally putting this flag in. Currently must be manually enabled, though if it turns out to solve the user's problem then I'll probably add at least one version string... [Edited commit message: actually, I also committed in error a piece of experimental code as part of this checkin. Serve me right for not running 'svn diff' first.] [originally from svn r8926]
2010-04-23 18:32:15 +00:00
}
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
} else if (code == TS_REKEY) {
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
if (!ssh->kex_in_progress && !ssh->bare_connection &&
ssh->version == 2) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->rekey_reason = "at user request";
ssh->rekey_class = RK_NORMAL;
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
queue_idempotent_callback(&ssh->ssh2_transport_icb);
Implement client-initiated rekeys after an hour, or after 1Gb of data transfer in either direction (whichever comes first), or at explicit client request (nice idea Jacob). Have tested by lowering the limits, and it all seems solid enough; in particular, this has also allowed me to test the behaviour when connection-level data is received during rekey, and that looks fine too (at least it does _now_ :-). [originally from svn r4908] [this svn revision also touched putty-wishlist]
2004-11-27 14:29:20 +00:00
}
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
} else if (code >= TS_LOCALSTART) {
Reorganise ssh_keyalg and use it as a vtable. After Pavel Kryukov pointed out that I have to put _something_ in the 'ssh_key' structure, I thought of an actually useful thing to put there: why not make it store a pointer to the ssh_keyalg structure? Then ssh_key becomes a classoid - or perhaps 'traitoid' is a closer analogy - in the same style as Socket and Plug. And just like Socket and Plug, I've also arranged a system of wrapper macros that avoid the need to mention the 'object' whose method you're invoking twice at each call site. The new vtable pointer directly replaces an existing field of struct ec_key (which was usable by several different ssh_keyalgs, so it already had to store a pointer to the currently active one), and also replaces the 'alg' field of the ssh2_userkey structure that wraps up a cryptographic key with its comment field. I've also taken the opportunity to clean things up a bit in general: most of the methods now have new and clearer names (e.g. you'd never know that 'newkey' made a public-only key while 'createkey' made a public+private key pair unless you went and looked it up, but now they're called 'new_pub' and 'new_priv' you might be in with a chance), and I've completely removed the openssh_private_npieces field after realising that it was duplicating information that is actually _more_ conveniently obtained by calling the new_priv_openssh method (formerly openssh_createkey) and throwing away the result.
2018-06-03 11:58:05 +00:00
ssh->hostkey_alg = hostkey_algs[code - TS_LOCALSTART].alg;
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
ssh->cross_certifying = TRUE;
if (!ssh->kex_in_progress && !ssh->bare_connection &&
ssh->version == 2) {
do_ssh2_transport: remove user input parameters. This is not as trivial as it sounds, because although do_ssh2_transport never uses user input, its in/inlen parameter pair were nonetheless actually doing something, because by setting inlen to special values -1 or -2 they doubled as a way to initiate a rekey with a stated textual reason. So _that_ use of in and inlen has to be replaced. (Good thing too - that was a horribly ugly API!) I've replaced them with a new pair of fields in the main ssh structure, a textual "rekey_reason" for the Event Log and an enumeration "rekey_class" for discrimination within the code. In particular, that allows me to get rid of the ugly strcmp that was checking the textual rekey reason to find out whether the rekey was due to a GSSAPI credentials update - now there's a separate enum value for that kind of rekey and we can test for that more sensibly.
2018-05-18 06:22:58 +00:00
ssh->rekey_reason = "cross-certifying new host key";
ssh->rekey_class = RK_NORMAL;
do_ssh2_transport: get packets from a PacketQueue. More of the same; no specially interesting features here.
2018-05-18 06:22:58 +00:00
queue_idempotent_callback(&ssh->ssh2_transport_icb);
Add manual cross-certification of new host keys. If a server offers host key algorithms that we don't have a stored key for, they will now appear in a submenu of the Special Commands menu. Selecting one will force a repeat key exchange with that key, and if it succeeds, will add the new host key to the cache. The idea is that the new key sent by the server is protected by the crypto established in the previous key exchange, so this is just as safe as typing some command like 'ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub' at the server prompt and transcribing the results manually. This allows switching over to newer host key algorithms if the client has begun to support them (e.g. people using PuTTY's new ECC functionality for the first time), or if the server has acquired a new key (e.g. due to a server OS upgrade). At the moment, it's only available manually, for a single host key type at a time. Automating it is potentially controversial for security policy reasons (what if someone doesn't agree this is what they want in their host key cache, or doesn't want to switch over to using whichever of the keys PuTTY would now put top of the list?), for code plumbing reasons (chaining several of these rekeys might be more annoying than doing one at a time) and for CPU usage reasons (rekeys are expensive), but even so, it might turn out to be a good idea in future.
2016-03-21 07:25:31 +00:00
}
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
} else if (code == TS_BRK) {
if (ssh->state == SSH_STATE_CLOSED
|| ssh->state == SSH_STATE_PREPACKET) return;
if (ssh->version == 1) {
Consistently use a single notation to refer to SSH protocol versions, as discussed. Use Barrett and Silverman's convention of "SSH-1" for SSH protocol version 1 and "SSH-2" for protocol 2 ("SSH1"/"SSH2" refer to ssh.com implementations in this scheme). <http://www.snailbook.com/terms.html> [originally from svn r5480]
2005-03-10 16:36:05 +00:00
logevent("Unable to send BREAK signal in SSH-1");
Implement part of `ssh2-generality': introduce the ability to tell PuTTY / Plink not to run a remote shell/command at all. Supported in the GUI configuration and via the (OpenSSH-like) -N command-line option. No effort is currently made to arrange `nice' UI properties. If you do this in GUI PuTTY, a full-size terminal window will still be created, and will sit there with almost nothing in it throughout your session. If you do it in Plink, Plink will not accept any kind of request to terminate gracefully; you'll have to ^C or kill it. Nonetheless, even this little will be useful to some people... [originally from svn r4614]
2004-10-13 13:43:11 +00:00
} else if (ssh->mainchan) {
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
pktout = ssh2_chanreq_init(ssh->mainchan, "break", NULL, NULL);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, 0); /* default break length */
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
ssh2_pkt_send(ssh, pktout);
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
}
plink can now execute a specific command instead of just a shell session [originally from svn r576]
2000-09-08 15:24:19 +00:00
} else {
Support the SSH-2 mechanism for sending signals to a running session. Neither of the SSH servers I conveniently have access to (Debian stable OpenSSH -- 3.4p1 -- and lshd) seem to take a blind bit of notice, but the channel requests look fine to me in the packet log. I've included all the signals explicitly defined by draft-ietf-secsh-connect-19, but I've put the more obscure ones in a submenu of the specials menu; there's therefore been some minor upheaval to support such submenus. [originally from svn r4652]
2004-10-17 21:22:22 +00:00
/* Is is a POSIX signal? */
Giant const-correctness patch of doom! Having found a lot of unfixed constness issues in recent development, I thought perhaps it was time to get proactive, so I compiled the whole codebase with -Wwrite-strings. That turned up a huge load of const problems, which I've fixed in this commit: the Unix build now goes cleanly through with -Wwrite-strings, and the Windows build is as close as I could get it (there are some lingering issues due to occasional Windows API functions like AcquireCredentialsHandle not having the right constness). Notable fallout beyond the purely mechanical changing of types: - the stuff saved by cmdline_save_param() is now explicitly dupstr()ed, and freed in cmdline_run_saved. - I couldn't make both string arguments to cmdline_process_param() const, because it intentionally writes to one of them in the case where it's the argument to -pw (in the vain hope of being at least slightly friendly to 'ps'), so elsewhere I had to temporarily dupstr() something for the sake of passing it to that function - I had to invent a silly parallel version of const_cmp() so I could pass const string literals in to lookup functions. - stripslashes() in pscp.c and psftp.c has the annoying strchr nature
2015-05-15 10:15:42 +00:00
const char *signame = NULL;
Support the SSH-2 mechanism for sending signals to a running session. Neither of the SSH servers I conveniently have access to (Debian stable OpenSSH -- 3.4p1 -- and lshd) seem to take a blind bit of notice, but the channel requests look fine to me in the packet log. I've included all the signals explicitly defined by draft-ietf-secsh-connect-19, but I've put the more obscure ones in a submenu of the specials menu; there's therefore been some minor upheaval to support such submenus. [originally from svn r4652]
2004-10-17 21:22:22 +00:00
if (code == TS_SIGABRT) signame = "ABRT";
if (code == TS_SIGALRM) signame = "ALRM";
if (code == TS_SIGFPE) signame = "FPE";
if (code == TS_SIGHUP) signame = "HUP";
if (code == TS_SIGILL) signame = "ILL";
if (code == TS_SIGINT) signame = "INT";
if (code == TS_SIGKILL) signame = "KILL";
if (code == TS_SIGPIPE) signame = "PIPE";
if (code == TS_SIGQUIT) signame = "QUIT";
if (code == TS_SIGSEGV) signame = "SEGV";
if (code == TS_SIGTERM) signame = "TERM";
if (code == TS_SIGUSR1) signame = "USR1";
if (code == TS_SIGUSR2) signame = "USR2";
/* The SSH-2 protocol does in principle support arbitrary named
* signals, including signame@domain, but we don't support those. */
if (signame) {
/* It's a signal. */
if (ssh->version == 2 && ssh->mainchan) {
Factor out common code to construct CHANNEL_REQUESTS. This reduces code size a little and also makes it harder to accidentally request a reply without putting in place a handler for it or vice versa. [originally from svn r9620]
2012-08-25 15:57:05 +00:00
pktout = ssh2_chanreq_init(ssh->mainchan, "signal", NULL, NULL);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(pktout, signame);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
ssh2_pkt_send(ssh, pktout);
Support the SSH-2 mechanism for sending signals to a running session. Neither of the SSH servers I conveniently have access to (Debian stable OpenSSH -- 3.4p1 -- and lshd) seem to take a blind bit of notice, but the channel requests look fine to me in the packet log. I've included all the signals explicitly defined by draft-ietf-secsh-connect-19, but I've put the more obscure ones in a submenu of the specials menu; there's therefore been some minor upheaval to support such submenus. [originally from svn r4652]
2004-10-17 21:22:22 +00:00
logeventf(ssh, "Sent signal SIG%s", signame);
}
} else {
/* Never heard of it. Do nothing */
}
plink can now execute a specific command instead of just a shell session [originally from svn r576]
2000-09-08 15:24:19 +00:00
}
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
}
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
static unsigned (ssh_alloc_sharing_channel)(
ConnectionLayer *cl, ssh_sharing_connstate *connstate)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
{
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
Ssh ssh = FROMFIELD(cl, struct ssh_tag, cl);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
struct ssh_channel *c;
c = snew(struct ssh_channel);
c->ssh = ssh;
Convert ssh2_channel_init() into ssh_channel_init(). By adding support for initialising SSH-1 channels as well. Now all newly-created channels go through this function.
2016-05-21 21:29:57 +00:00
ssh_channel_init(c);
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
c->chan = NULL;
Expose structure tags for the connection-sharing data types. This was a particularly confusing piece of type-danger, because three different types were passed outside sshshare.c as 'void *' and only human vigilance prevented one coming back as the wrong one. Now they all keep their opaque structure tags when they move through other parts of the code.
2018-09-13 08:09:10 +00:00
c->sharectx = connstate;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
return c->localid;
}
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
static void (ssh_delete_sharing_channel)(ConnectionLayer *cl, unsigned localid)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
{
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
Ssh ssh = FROMFIELD(cl, struct ssh_tag, cl);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
struct ssh_channel *c;
c = find234(ssh->channels, &localid, ssh_channelfind);
if (c)
ssh_channel_destroy(c);
}
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
static void (ssh_send_packet_from_downstream)(
ConnectionLayer *cl, unsigned id, int type,
const void *data, int datalen, const char *additional_log_text)
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
{
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
Ssh ssh = FROMFIELD(cl, struct ssh_tag, cl);
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pkt;
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
Move binary packet protocols and censoring out of ssh.c. sshbpp.h now defines a classoid that encapsulates both directions of an SSH binary packet protocol - that is, a system for reading a bufchain of incoming data and turning it into a stream of PktIn, and another system for taking a PktOut and turning it into data on an outgoing bufchain. The state structure in each of those files contains everything that used to be in the 'rdpkt2_state' structure and its friends, and also quite a lot of bits and pieces like cipher and MAC states that used to live in the main Ssh structure. One minor effect of this layer separation is that I've had to extend the packet dispatch table by one, because the BPP layer can no longer directly trigger sending of SSH_MSG_UNIMPLEMENTED for a message too short to have a type byte. Instead, I extend the PktIn type field to use an out-of-range value to encode that, and the easiest way to make that trigger an UNIMPLEMENTED message is to have the dispatch table contain an entry for it. (That's a system that may come in useful again - I was also wondering about inventing a fake type code to indicate network EOF, so that that could be propagated through the layers and be handled by whichever one currently knew best how to respond.) I've also moved the packet-censoring code into its own pair of files, partly because I was going to want to do that anyway sooner or later, and mostly because it's called from the BPP code, and the SSH-2 version in particular has to be called from both the main SSH-2 BPP and the bare unencrypted protocol used for connection sharing. While I was at it, I took the opportunity to merge the outgoing and incoming censor functions, so that the parts that were common between them (e.g. CHANNEL_DATA messages look the same in both directions) didn't need to be repeated.
2018-06-09 08:09:10 +00:00
pkt = ssh_bpp_new_pktout(ssh->bpp, type);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
pkt->downstream_id = id;
pkt->additional_log_text = additional_log_text;
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_data(pkt, data, datalen);
Implement connection sharing between instances of PuTTY. The basic strategy is described at the top of the new source file sshshare.c. In very brief: an 'upstream' PuTTY opens a Unix-domain socket or Windows named pipe, and listens for connections from other PuTTYs wanting to run sessions on the same server. The protocol spoken down that socket/pipe is essentially the bare ssh-connection protocol, using a trivial binary packet protocol with no encryption, and the upstream has to do some fiddly transformations that I've been referring to as 'channel-number NAT' to avoid resource clashes between the sessions it's managing. This is quite different from OpenSSH's approach of using the Unix- domain socket as a means of passing file descriptors around; the main reason for that is that fd-passing is Unix-specific but this system has to work on Windows too. However, there are additional advantages, such as making it easy for each downstream PuTTY to run its own independent set of port and X11 forwardings (though the method for making the latter work is quite painful). Sharing is off by default, but configuration is intended to be very easy in the normal case - just tick one box in the SSH config panel and everything else happens automatically. [originally from svn r10083]
2013-11-17 14:05:41 +00:00
ssh2_pkt_send(ssh, pkt);
}
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
/*
* This is called when stdout/stderr (the entity to which
* from_backend sends data) manages to clear some backlog.
*/
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static void ssh_unthrottle(Backend *be, int bufsize)
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->version == 1) {
if (ssh->v1_stdout_throttling && bufsize < SSH1_BUFFER_LIMIT) {
ssh->v1_stdout_throttling = 0;
Take the code that does flow control in SSH-1, and make it work in SSH-2 as well. This won't be triggered in the usual case, but it's useful if the remote end ignores our window, or if we're in "simple" mode and setting the window far larger than is necessary. [originally from svn r7756]
2007-10-03 20:29:27 +00:00
ssh_throttle_conn(ssh, -1);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
} else {
Factor out common parts of ssh_unthrottle and sshfwd_unthrottle. The SSH-2 code is essentially all shared, but SSH-1 still has some code specific to the stdout/stderr case.
2016-05-17 13:57:51 +00:00
if (ssh->mainchan)
ssh_channel_unthrottle(ssh->mainchan, bufsize);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
When we are asked to unthrottle an SSH connection (by the front end calling back->unthrottle), we should immediately call ssh_process_queued_incoming_data to handle the SSH packets that have been saved for later functioning while we were throttled. Otherwise, they'll sit there unhandled until the next call to ssh_gotdata, which might not be for ages if the server thinks it's waiting for us. [originally from svn r9523]
2012-05-12 17:00:54 +00:00
/*
* Now process any SSH connection data that was stashed in our
* queue while we were frozen.
*/
Put all incoming SSH wire data into a bufchain. I've completely removed the top-level coroutine ssh_gotdata(), and replaced it with a system in which ssh_receive (which is a plug function, i.e. called directly from the network code) simply adds the incoming data to a new bufchain called ssh->incoming_data, and then queues an idempotent callback to ensure that whatever function is currently responsible for the top-level handling of wire data will be invoked in the near future. So the decisions that ssh_gotdata was previously making are now made by changing which function is invoked by that idempotent callback: when we finish doing SSH greeting exchange and move on to the packet- structured main phase of the protocol, we just change ssh->current_incoming_data_fn and ensure that the new function gets called to take over anything still outstanding in the queue. This simplifies the _other_ end of the API of the rdpkt functions. In the previous commit, they stopped returning their 'struct Packet' directly, and instead put it on a queue; in this commit, they're no longer receiving a (data, length) pair in their parameter list, and instead, they're just reading from ssh->incoming_data. So now, API- wise, they take no arguments at all except the main 'ssh' state structure. It's not just the rdpkt functions that needed to change, of course. The SSH greeting handlers have also had to switch to reading from ssh->incoming_data, and are quite substantially rewritten as a result. (I think they look simpler in the new style, personally.) This new bufchain takes over from the previous queued_incoming_data, which was only used at all in cases where we throttled the entire SSH connection. Now, data is unconditionally left on the new bufchain whether we're throttled or not, and the only question is whether we're currently bothering to read it; so all the special-purpose code to read data from a bufchain and pass it to rdpkt can go away, because rdpkt itself already knows how to do that job. One slightly fiddly point is that we now have to defer processing of EOF from the SSH server: if we have data already in the incoming bufchain and then the server slams the connection shut, we want to process the data we've got _before_ reacting to the remote EOF, just in case that data gives us some reason to change our mind about how we react to the EOF, or a last-minute important piece of data we might need to log.
2018-05-18 06:22:57 +00:00
queue_idempotent_callback(&ssh->incoming_data_consumer);
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
}
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
static SshChannel *(ssh_lportfwd_open)(
ConnectionLayer *cl, const char *hostname, int port,
const char *org, Channel *chan)
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
{
New abstraction 'ConnectionLayer'. This is a vtable that wraps up all the functionality required from the SSH connection layer by associated modules like port forwarding and connection sharing. This extra layer of indirection adds nothing useful right now, but when I later separate the SSH-1 and SSH-2 connection layer implementations, it will be convenient for each one to be able to implement this vtable in terms of its own internal data structures. To simplify this vtable, I've moved a lot of the logging duties relating to connection sharing out of ssh.c into sshshare.c: now it handles nearly all the logging itself relating to setting up connection sharing in the first place and downstreams connecting and disconnecting. The only exception is the 'Reusing a shared connection' announcement in the console window, which is now done in ssh.c by detecting downstream status immediately after setup.
2018-09-17 11:14:00 +00:00
Ssh ssh = FROMFIELD(cl, struct ssh_tag, cl);
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
struct ssh_channel *c = snew(struct ssh_channel);
Separate Packet into two structures. This is the first stage of massively tidying up this very confused data structure. In this commit, I replace the unified 'struct Packet' with two structures PktIn and PktOut, each of which contains only the fields of struct Packet that are actually used for packets going in that direction - most notably, PktIn doesn't implement BinarySink, and PktOut doesn't implement BinarySource. All uses of the old structure were statically determinable to be one or the other, so I've done that determination and changed all the types of variables and function signatures. Unlike PktIn, PktOut is not reference-counted, so there's a new ssh_pktout_free function. The most immediately pleasing thing about this change is that it lets me finally get rid of the tedious comment explaining how the 'length' field in struct Packet meant something different depending on direction. Now it's two fields of the same name in two different structures, I can comment the same thing much less verbosely! (I've also got rid of the comment claiming the type field was only used for incoming packets. That wasn't even true! It might have been once, because you can write an outgoing packet's type byte straight into its data buffer, but in fact in the current code pktout->type is nonetheless used in various other places, e.g. log_outgoing_packet.) In this commit I've only removed the fields from each structure that were _already_ unused. There are still quite a few we can get rid of by _making_ them unused.
2018-06-05 07:20:10 +00:00
PktOut *pktout;
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
c->ssh = ssh;
ssh_channel_init(c);
c->halfopen = TRUE;
c->chan = chan;
Most of the code for "nc" mode duplicated that for opening a session or a fowarded port. Arrange that this code is shared instead. The main visible change is a slight change of log messages. [originally from svn r9655]
2012-09-08 19:46:07 +00:00
logeventf(ssh, "Opening connection to %s:%d for %s", hostname, port, org);
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
if (ssh->version == 1) {
Remove the SSH-1 variadic send_packet() system. Now we have the new marshalling system, I think it's outlived its usefulness, because the new system allows us to directly express various things (e.g. uint16 and non-zero-terminated strings) that were actually _more_ awkward to do via the variadic interface. So here's a rewrite that removes send_packet(), and replaces all its call sites with something that matches our SSH-2 packet construction idioms. This diff actually _reduces_ the number of lines of code in ssh.c. Since the variadic system was trying to save code by centralising things, that seems like the best possible evidence that it wasn't pulling its weight!
2018-06-09 08:59:58 +00:00
pktout = ssh_bpp_new_pktout(ssh->bpp, SSH1_MSG_PORT_OPEN);
put_uint32(pktout, c->localid);
put_stringz(pktout, hostname);
put_uint32(pktout, port);
/* originator string would go here, but we didn't specify
* SSH_PROTOFLAG_HOST_IN_FWD_OPEN */
ssh_pkt_write(ssh, pktout);
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
} else {
Factor out some common code for constructing SSH2_CHANNEL_OPEN. [originally from svn r9649]
2012-09-01 12:28:38 +00:00
pktout = ssh2_chanopen_init(c, "direct-tcpip");
Use the new host_str* functions to improve IPv6 literal support. I've gone through everywhere we handle host names / addresses (on command lines, in PuTTY config, in port forwarding, in X display names, in host key storage...) and tried to make them handle IPv6 literals sensibly, by using the host_str* functions I introduced in my previous commit. Generally it's now OK to use a bracketed IPv6 literal anywhere a hostname might have been valid; in a few cases where no ambiguity exists (e.g. no :port suffix is permitted anyway) unbracketed IPv6 literals are also acceptable. [originally from svn r10120]
2014-01-25 15:58:54 +00:00
{
char *trimmed_host = host_strduptrim(hostname);
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(pktout, trimmed_host);
Use the new host_str* functions to improve IPv6 literal support. I've gone through everywhere we handle host names / addresses (on command lines, in PuTTY config, in port forwarding, in X display names, in host key storage...) and tried to make them handle IPv6 literals sensibly, by using the host_str* functions I introduced in my previous commit. Generally it's now OK to use a bracketed IPv6 literal anywhere a hostname might have been valid; in a few cases where no ambiguity exists (e.g. no :port suffix is permitted anyway) unbracketed IPv6 literals are also acceptable. [originally from svn r10120]
2014-01-25 15:58:54 +00:00
sfree(trimmed_host);
}
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_uint32(pktout, port);
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
/*
* We make up values for the originator data; partly it's
* too much hassle to keep track, and partly I'm not
* convinced the server should be told details like that
* about my local network configuration.
Apparently some SSH servers object to our claiming port-forwarded connections to be from IP "client-side-connection". Claiming "0.0.0.0" instead seems to work. Spotted by Brant Thomsen. [originally from svn r6477] [this svn revision also touched putty-wishlist]
2005-12-07 18:01:40 +00:00
* The "originator IP address" is syntactically a numeric
* IP address, and some servers (e.g., Tectia) get upset
* if it doesn't match this syntax.
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
*/
Remove the ssh_pkt_add* functions. All previous uses of them are replaced by the new put_* family. This is a fairly mechanical transformation, which doesn't take full advantage of the new ways things can be done more usefully. I'll come back and clean parts of it up in separate patches later; muddling that together with this main search-and-replace part would make (even more of) a giant unreadable monolith.
2018-05-24 09:15:36 +00:00
put_stringz(pktout, "0.0.0.0");
put_uint32(pktout, 0);
Minor refactoring: the fields `pktin' and `pktout' in the Ssh structure have been retired. Now all Packet structures are dynamically allocated. Each rdpkt function allocates one, and it's freed after being used; and the packet construction functions allocate them too, and they're freed by the send functions. `pktin' and `pktout' were ugly. They were _morally_ still global variables; even though they were replicated per SSH session to comply with the Mac no-globals requirement, they weren't really in the _spirit_ of `dynamically allocate your data'. As a side effect of this change, the `pktout_blanks' and `pktout_nblanks' fields in the Ssh structure have been moved into the Packet structure. [originally from svn r4898]
2004-11-24 18:45:52 +00:00
ssh2_pkt_send(ssh, pktout);
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
}
Replace enum+union of local channel types with a vtable. There's now an interface called 'Channel', which handles the local side of an SSH connection-layer channel, in terms of knowing where to send incoming channel data to, whether to close the channel, etc. Channel and the previous 'struct ssh_channel' mutually refer. The latter contains all the SSH-specific parts, and as much of the common logic as possible: in particular, Channel doesn't have to know anything about SSH packet formats, or which SSH protocol version is in use, or deal with all the fiddly stuff about window sizes - with the exception that x11fwd.c's implementation of it does have to be able to ask for a small fixed initial window size for the bodgy system that distinguishes upstream from downstream X forwardings. I've taken the opportunity to move the code implementing the detailed behaviour of agent forwarding out of ssh.c, now that all of it is on the far side of a uniform interface. (This also means that if I later implement agent forwarding directly to a Unix socket as an alternative, it'll be a matter of changing just the one call to agentf_new() that makes the Channel to plug into a forwarding.)
2018-09-12 14:03:47 +00:00
Put a layer of abstraction in front of struct ssh_channel. Clients outside ssh.c - all implementations of Channel - will now not see the ssh_channel data type itself, but only a subobject of the interface type SshChannel. All the sshfwd_* functions have become methods in that interface type's vtable (though, wrapped in the usual kind of macros, the call sites look identical). This paves the way for me to split up the SSH-1 and SSH-2 connection layers and have each one lay out its channel bookkeeping structure as it sees fit; as long as they each provide an implementation of the sshfwd_ method family, the types behind that need not look different. A minor good effect of this is that the sshfwd_ methods are no longer global symbols, so they don't have to be stubbed in Unix Pageant to get it to compile.
2018-09-14 12:47:13 +00:00
return &c->sc;
SSH port forwarding! How cool is that? Only currently works on SSH1; SSH2 should be doable but it's late and I have other things to do tonight. The Cool Guy award for this one goes to Nicolas Barry, for doing most of the work and actually understanding the code he was adding to. [originally from svn r1176]
2001-08-08 20:44:35 +00:00
}
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static int ssh_connected(Backend *be)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
The `socket' function in the backends is only ever checked to see if it's NULL. Since we already have one back end (uxpty) which doesn't in fact talk to a network socket, and may well have more soon, I'm replacing this TCP/IP-centric function with a nice neutral `connected' function returning a boolean. Nothing else about its semantics has currently changed. [originally from svn r6810]
2006-08-27 08:03:19 +00:00
return ssh->s != NULL;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Stop plink losing data at start of session [originally from svn r577]
2000-09-08 16:42:11 +00:00
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static int ssh_sendok(Backend *be)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
return ssh->send_ok;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
}
Joris van Rantwijk's unified SSH code suitable for PuTTY and PSCP [originally from svn r504] [this commit reordered to come after creation of 0.49 tag]
2000-06-22 12:18:34 +00:00
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static int ssh_ldisc(Backend *be, int option)
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
if (option == LD_ECHO)
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
return ssh->echoing;
Run entire source base through GNU indent to tidy up the varying coding styles of the various contributors! Woohoo! [originally from svn r1098]
2001-05-06 14:35:20 +00:00
if (option == LD_EDIT)
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
return ssh->editing;
Rethink the whole line discipline architecture. Instead of having multiple switchable line disciplines, we now have a single unified one which changes its behaviour based on option settings. Each option setting can be suggested by the back end and/or the terminal handler, and can be forcibly overridden by the configuration. Local echo and local line editing are separate, independently switchable, options. [originally from svn r895]
2001-01-24 14:08:20 +00:00
return FALSE;
}
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static void ssh_provide_ldisc(Backend *be, Ldisc *ldisc)
Line discipline module now uses dynamically allocated data. Also fixed one or two other minor problems. [originally from svn r2141]
2002-10-26 10:16:19 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Line discipline module now uses dynamically allocated data. Also fixed one or two other minor problems. [originally from svn r2141]
2002-10-26 10:16:19 +00:00
ssh->ldisc = ldisc;
}
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static void ssh_provide_logctx(Backend *be, LogContext *logctx)
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
ssh->logctx = logctx;
}
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static int ssh_return_exitcode(Backend *be)
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Make sure the socket is closed properly in the various SSH exit paths. [originally from svn r3037]
2003-03-31 13:15:51 +00:00
if (ssh->s != NULL)
return -1;
else
Return a non-zero exit code in the event of a fatal-error SSH session termination. `Close window only on clean exit' was not working properly on Unix in the absence of this: notify_remote_exit() was being called and ssh_return_exitcode was returning zero, causing gtk_main_quit() to be called, _before_ connection_fatal() happened. [originally from svn r6801]
2006-08-26 09:21:52 +00:00
return (ssh->exitcode >= 0 ? ssh->exitcode : INT_MAX);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
}
Loose end from r5031: the Kex panel should only be displayed in mid-session if we are not using SSHv1. I've done this by introducing a generic `cfg_info' function which every back end can use to communicate an int's worth of data to setup_config_box; in SSH that's the protocol version in use, and in everything else it's currently zero. [originally from svn r5040] [r5031 == d77102a8d535a7000d6d909529a61a1564f6d678]
2004-12-29 12:32:25 +00:00
/*
Disable some mid-session configs for downstreams. Compression, encryption, and key exchange settings are all meaningless to reconfigure in connection-sharing downstreams.
2014-11-09 00:10:46 +00:00
* cfg_info for SSH is the protocol running in this session.
* (1 or 2 for the full SSH-1 or SSH-2 protocol; -1 for the bare
* SSH-2 connection protocol, i.e. a downstream; 0 for not-decided-yet.)
Loose end from r5031: the Kex panel should only be displayed in mid-session if we are not using SSHv1. I've done this by introducing a generic `cfg_info' function which every back end can use to communicate an int's worth of data to setup_config_box; in SSH that's the protocol version in use, and in everything else it's currently zero. [originally from svn r5040] [r5031 == d77102a8d535a7000d6d909529a61a1564f6d678]
2004-12-29 12:32:25 +00:00
*/
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
static int ssh_cfg_info(Backend *be)
Loose end from r5031: the Kex panel should only be displayed in mid-session if we are not using SSHv1. I've done this by introducing a generic `cfg_info' function which every back end can use to communicate an int's worth of data to setup_config_box; in SSH that's the protocol version in use, and in everything else it's currently zero. [originally from svn r5040] [r5031 == d77102a8d535a7000d6d909529a61a1564f6d678]
2004-12-29 12:32:25 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Disable some mid-session configs for downstreams. Compression, encryption, and key exchange settings are all meaningless to reconfigure in connection-sharing downstreams.
2014-11-09 00:10:46 +00:00
if (ssh->version == 0)
return 0; /* don't know yet */
else if (ssh->bare_connection)
return -1;
else
return ssh->version;
Loose end from r5031: the Kex panel should only be displayed in mid-session if we are not using SSHv1. I've done this by introducing a generic `cfg_info' function which every back end can use to communicate an int's worth of data to setup_config_box; in SSH that's the protocol version in use, and in everything else it's currently zero. [originally from svn r5040] [r5031 == d77102a8d535a7000d6d909529a61a1564f6d678]
2004-12-29 12:32:25 +00:00
}
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
/*
* Gross hack: pscp will try to start SFTP but fall back to scp1 if
* that fails. This variable is the means by which scp.c can reach
* into the SSH code and find out which one it got.
*/
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
extern int ssh_fallback_cmd(Backend *be)
Add a new back-end function to return the exit code of the remote process. This is functional in SSH, and vestigial (just returns 0) in the other three protocols. Plink's Windows exit code is now determined by the remote process exit code, which should make it more usable in scripting applications. Tested in both SSH1 and SSH2. [originally from svn r1518]
2001-12-29 15:31:42 +00:00
{
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
Ssh ssh = FROMFIELD(be, struct ssh_tag, backend);
Major destabilisation, phase 2. This time it's the backends' turn: each backend now stores all its internal variables in a big struct, and each backend function gets a pointer to this struct passed to it. This still isn't the end of the work - lots of subsidiary things still use globals, notably all the cipher and compressor modules and the X11 forwarding authentication stuff. But ssh.c itself has now been transformed, and that was the really painful bit, so from here on it all ought to be a sequence of much smaller and simpler pieces of work. [originally from svn r2127]
2002-10-25 11:30:33 +00:00
return ssh->fallback_cmd;
Add a new back-end function to return the exit code of the remote process. This is functional in SSH, and vestigial (just returns 0) in the other three protocols. Plink's Windows exit code is now determined by the remote process exit code, which should make it more usable in scripting applications. Tested in both SSH1 and SSH2. [originally from svn r1518]
2001-12-29 15:31:42 +00:00
}
Turn Backend into a sensible classoid. Nearly every part of the code that ever handles a full backend structure has historically done it using a pair of pointer variables, one pointing at a constant struct full of function pointers, and the other pointing to a 'void *' state object that's passed to each of those. While I'm modernising the rest of the code, this seems like a good time to turn that into the same more or less type-safe and less cumbersome system as I'm using for other parts of the code, such as Socket, Plug, BinaryPacketProtocol and so forth: the Backend structure contains a vtable pointer, and a system of macro wrappers handles dispatching through that vtable.
2018-09-11 15:23:38 +00:00
const struct Backend_vtable ssh_backend = {
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
ssh_init,
Add the ability to close sessions. This adds *_free() functions to most areas of the code. Not all back-ends have been tested, but Telnet and SSH behave reasonably. Incidentally, almost all of this patch was written through Mac PuTTY, admittedly over a Telnet connection. [originally from svn r2615]
2003-01-15 23:30:21 +00:00
ssh_free,
The back ends now contain their own copies of the Config structure, and have a function to pass in a new one. (Well, actually several back ends don't actually bother to do this because they need nothing out of Config after the initial setup phase, but they could if they wanted to.) [originally from svn r2561]
2003-01-12 14:48:29 +00:00
ssh_reconfig,
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
ssh_send,
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
ssh_sendbuffer,
Initial checkin: beta 0.43 [originally from svn r11]
1999-01-08 13:02:13 +00:00
ssh_size,
Added a fourth application: plink, a command line connection utility [originally from svn r575]
2000-09-08 14:45:20 +00:00
ssh_special,
Turned the old `Telnet Command' System-submenu into a more general `Special Command' menu, in which any backend can place its own list of magical things the user might want to ask the backend to do. In particular I've implemented the recently proposed "break" extension in SSH2 using this mechanism. NB this checkin slightly breaks the Mac build, since it needs to provide at least a stub form of update_specials_menu(). [originally from svn r3054]
2003-04-04 20:21:05 +00:00
ssh_get_specials,
The `socket' function in the backends is only ever checked to see if it's NULL. Since we already have one back end (uxpty) which doesn't in fact talk to a network socket, and may well have more soon, I'm replacing this TCP/IP-centric function with a nice neutral `connected' function returning a boolean. Nothing else about its semantics has currently changed. [originally from svn r6810]
2006-08-27 08:03:19 +00:00
ssh_connected,
Add a new back-end function to return the exit code of the remote process. This is functional in SSH, and vestigial (just returns 0) in the other three protocols. Plink's Windows exit code is now determined by the remote process exit code, which should make it more usable in scripting applications. Tested in both SSH1 and SSH2. [originally from svn r1518]
2001-12-29 15:31:42 +00:00
ssh_return_exitcode,
Store default port number in each back end [originally from svn r669]
2000-10-04 14:35:15 +00:00
ssh_sendok,
Rethink the whole line discipline architecture. Instead of having multiple switchable line disciplines, we now have a single unified one which changes its behaviour based on option settings. Each option setting can be suggested by the back end and/or the terminal handler, and can be forcibly overridden by the configuration. Local echo and local line editing are separate, independently switchable, options. [originally from svn r895]
2001-01-24 14:08:20 +00:00
ssh_ldisc,
Line discipline module now uses dynamically allocated data. Also fixed one or two other minor problems. [originally from svn r2141]
2002-10-26 10:16:19 +00:00
ssh_provide_ldisc,
Yet more global-removal. The static variables in logging.c are now absent, and also (I think) all the frontend request functions (such as request_resize) take a context pointer, so that multiple windows can be handled sensibly. I wouldn't swear to this, but I _think_ that only leaves the Unicode stuff as the last stubborn holdout. [originally from svn r2147]
2002-10-26 12:58:13 +00:00
ssh_provide_logctx,
Extensive changes that _should_ fix the socket buffering problems, by ceasing to listen on input channels if the corresponding output channel isn't accepting data. Has had basic check-I-didn't-actually- break-anything-too-badly testing, but hasn't been genuinely tested in stress conditions (because concocting stress conditions is non- trivial). [originally from svn r1198]
2001-08-25 17:09:23 +00:00
ssh_unthrottle,
Loose end from r5031: the Kex panel should only be displayed in mid-session if we are not using SSHv1. I've done this by introducing a generic `cfg_info' function which every back end can use to communicate an int's worth of data to setup_config_box; in SSH that's the protocol version in use, and in everything else it's currently zero. [originally from svn r5040] [r5031 == d77102a8d535a7000d6d909529a61a1564f6d678]
2004-12-29 12:32:25 +00:00
ssh_cfg_info,
New Plink operating mode: 'plink -shareexists'. A Plink invocation of the form 'plink -shareexists <session>' tests for a currently live connection-sharing upstream for the session in question. <session> can be any syntax you'd use with Plink to make the actual connection (a host/port number, a bare saved session name, -load, whatever). I envisage this being useful for things like adaptive proxying - e.g. if you want to connect to host A which you can't route to directly, and you might already have a connection to either of hosts B or C which are viable proxies, then you could write a proxy shell script which checks whether you already have an upstream for B or C and goes via whichever one is currently active. Testing for the upstream's existence has to be done by actually connecting to its socket, because on Unix the mere existence of a Unix-domain socket file doesn't guarantee that there's a process listening to it. So we make a test connection, and then immediately disconnect; hence, that shows up in the upstream's event log.
2015-09-25 10:46:28 +00:00
ssh_test_for_upstream,
Rationalise access to, and content of, backends[] array. Should be no significant change in behaviour. (Well, entering usernames containing commas on Plink's command line will be a little harder now.) [originally from svn r7628]
2007-06-30 21:56:44 +00:00
"ssh",
PROT_SSH,
Store default port number in each back end [originally from svn r669]
2000-10-04 14:35:15 +00:00
22
Port forwarding now works in SSH 2 as well as SSH 1. [originally from svn r1179]
2001-08-09 21:17:05 +00:00
};
Reference in New Issue Copy Permalink