crypto/openssh/packet.c

   1 /* $OpenBSD: packet.c,v 1.160 2009/02/13 11:50:21 markus Exp $ */
   2 /*
   3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  * This file contains code implementing the packet protocol and communication
   7  * with the other side.  This same code is used both on client and server side.
   8  *
   9  * As far as I am concerned, the code I have written for this software
  10  * can be used freely for any purpose.  Any derived versions of this
  11  * software must be clearly marked as such, and if the derived work is
  12  * incompatible with the protocol description in the RFC file, it must be
  13  * called by a name other than "ssh" or "Secure Shell".
  14  *
  15  *
  16  * SSH2 packet format added by Markus Friedl.
  17  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  18  *
  19  * Redistribution and use in source and binary forms, with or without
  20  * modification, are permitted provided that the following conditions
  21  * are met:
  22  * 1. Redistributions of source code must retain the above copyright
  23  *    notice, this list of conditions and the following disclaimer.
  24  * 2. Redistributions in binary form must reproduce the above copyright
  25  *    notice, this list of conditions and the following disclaimer in the
  26  *    documentation and/or other materials provided with the distribution.
  27  *
  28  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  29  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  30  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  31  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  32  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  33  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  34  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  35  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  36  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  37  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  38  */
  39
  40 #include "includes.h"
  41
  42 #include <sys/types.h>
  43 #include "openbsd-compat/sys-queue.h"
  44 #include <sys/param.h>
  45 #include <sys/socket.h>
  46 #ifdef HAVE_SYS_TIME_H
  47 # include <sys/time.h>
  48 #endif
  49
  50 #include <netinet/in.h>
  51 #include <netinet/ip.h>
  52 #include <arpa/inet.h>
  53
  54 #include <errno.h>
  55 #include <stdarg.h>
  56 #include <stdio.h>
  57 #include <stdlib.h>
  58 #include <string.h>
  59 #include <unistd.h>
  60 #include <signal.h>
  61
  62 #include "xmalloc.h"
  63 #include "buffer.h"
  64 #include "packet.h"
  65 #include "crc32.h"
  66 #include "compress.h"
  67 #include "deattack.h"
  68 #include "channels.h"
  69 #include "compat.h"
  70 #include "ssh1.h"
  71 #include "ssh2.h"
  72 #include "cipher.h"
  73 #include "key.h"
  74 #include "kex.h"
  75 #include "mac.h"
  76 #include "log.h"
  77 #include "canohost.h"
  78 #include "misc.h"
  79 #include "ssh.h"
  80
  81 #ifdef PACKET_DEBUG
  82 #define DBG(x) x
  83 #else
  84 #define DBG(x)
  85 #endif
  86
  87 #define PACKET_MAX_SIZE (256 * 1024)
  88
  89 /*
  90  * This variable contains the file descriptors used for communicating with
  91  * the other side.  connection_in is used for reading; connection_out for
  92  * writing.  These can be the same descriptor, in which case it is assumed to
  93  * be a socket.
  94  */
  95 static int connection_in = -1;
  96 static int connection_out = -1;
  97
  98 /* Protocol flags for the remote side. */
  99 static u_int remote_protocol_flags = 0;
 100
 101 /* Encryption context for receiving data.  This is only used for decryption. */
 102 static CipherContext receive_context;
 103
 104 /* Encryption context for sending data.  This is only used for encryption. */
 105 static CipherContext send_context;
 106
 107 /* Buffer for raw input data from the socket. */
 108 Buffer input;
 109
 110 /* Buffer for raw output data going to the socket. */
 111 Buffer output;
 112
 113 /* Buffer for the partial outgoing packet being constructed. */
 114 static Buffer outgoing_packet;
 115
 116 /* Buffer for the incoming packet currently being processed. */
 117 static Buffer incoming_packet;
 118
 119 /* Scratch buffer for packet compression/decompression. */
 120 static Buffer compression_buffer;
 121 static int compression_buffer_ready = 0;
 122
 123 /* Flag indicating whether packet compression/decompression is enabled. */
 124 static int packet_compression = 0;
 125
 126 /* default maximum packet size */
 127 u_int max_packet_size = 32768;
 128
 129 /* Flag indicating whether this module has been initialized. */
 130 static int initialized = 0;
 131
 132 /* Set to true if the connection is interactive. */
 133 static int interactive_mode = 0;
 134
 135 /* Set to true if we are the server side. */
 136 static int server_side = 0;
 137
 138 /* Set to true if we are authenticated. */
 139 static int after_authentication = 0;
 140
 141 int keep_alive_timeouts = 0;
 142
 143 /* Set to the maximum time that we will wait to send or receive a packet */
 144 static int packet_timeout_ms = -1;
 145
 146 /* Session key information for Encryption and MAC */
 147 Newkeys *newkeys[MODE_MAX];
 148 static struct packet_state {
 149         u_int32_t seqnr;
 150         u_int32_t packets;
 151         u_int64_t blocks;
 152         u_int64_t bytes;
 153 } p_read, p_send;
 154
 155 static u_int64_t max_blocks_in, max_blocks_out;
 156 static u_int32_t rekey_limit;
 157
 158 /* Session key for protocol v1 */
 159 static u_char ssh1_key[SSH_SESSION_KEY_LENGTH];
 160 static u_int ssh1_keylen;
 161
 162 /* roundup current message to extra_pad bytes */
 163 static u_char extra_pad = 0;
 164
 165 /* XXX discard incoming data after MAC error */
 166 static u_int packet_discard = 0;
 167 static Mac *packet_discard_mac = NULL;
 168
 169 struct packet {
 170         TAILQ_ENTRY(packet) next;
 171         u_char type;
 172         Buffer payload;
 173 };
 174 TAILQ_HEAD(, packet) outgoing;
 175
 176 /*
 177  * Sets the descriptors used for communication.  Disables encryption until
 178  * packet_set_encryption_key is called.
 179  */
 180 void
 181 packet_set_connection(int fd_in, int fd_out)
 182 {
 183         Cipher *none = cipher_by_name("none");
 184
 185         if (none == NULL)
 186                 fatal("packet_set_connection: cannot load cipher 'none'");
 187         connection_in = fd_in;
 188         connection_out = fd_out;
 189         cipher_init(&send_context, none, (const u_char *)"",
 190             0, NULL, 0, CIPHER_ENCRYPT);
 191         cipher_init(&receive_context, none, (const u_char *)"",
 192             0, NULL, 0, CIPHER_DECRYPT);
 193         newkeys[MODE_IN] = newkeys[MODE_OUT] = NULL;
 194         if (!initialized) {
 195                 initialized = 1;
 196                 buffer_init(&input);
 197                 buffer_init(&output);
 198                 buffer_init(&outgoing_packet);
 199                 buffer_init(&incoming_packet);
 200                 TAILQ_INIT(&outgoing);
 201                 p_send.packets = p_read.packets = 0;
 202         }
 203 }
 204
 205 void
 206 packet_set_timeout(int timeout, int count)
 207 {
 208         if (timeout == 0 || count == 0) {
 209                 packet_timeout_ms = -1;
 210                 return;
 211         }
 212         if ((INT_MAX / 1000) / count < timeout)
 213                 packet_timeout_ms = INT_MAX;
 214         else
 215                 packet_timeout_ms = timeout * count * 1000;
 216 }
 217
 218 static void
 219 packet_stop_discard(void)
 220 {
 221         if (packet_discard_mac) {
 222                 char buf[1024];
 223
 224                 memset(buf, 'a', sizeof(buf));
 225                 while (buffer_len(&incoming_packet) < PACKET_MAX_SIZE)
 226                         buffer_append(&incoming_packet, buf, sizeof(buf));
 227                 (void) mac_compute(packet_discard_mac,
 228                     p_read.seqnr,
 229                     buffer_ptr(&incoming_packet),
 230                     PACKET_MAX_SIZE);
 231         }
 232         logit("Finished discarding for %.200s", get_remote_ipaddr());
 233         cleanup_exit(255);
 234 }
 235
 236 static void
 237 packet_start_discard(Enc *enc, Mac *mac, u_int packet_length, u_int discard)
 238 {
 239         if (enc == NULL || !cipher_is_cbc(enc->cipher))
 240                 packet_disconnect("Packet corrupt");
 241         if (packet_length != PACKET_MAX_SIZE && mac && mac->enabled)
 242                 packet_discard_mac = mac;
 243         if (buffer_len(&input) >= discard)
 244                 packet_stop_discard();
 245         packet_discard = discard - buffer_len(&input);
 246 }
 247
 248 /* Returns 1 if remote host is connected via socket, 0 if not. */
 249
 250 int
 251 packet_connection_is_on_socket(void)
 252 {
 253         struct sockaddr_storage from, to;
 254         socklen_t fromlen, tolen;
 255
 256         /* filedescriptors in and out are the same, so it's a socket */
 257         if (connection_in == connection_out)
 258                 return 1;
 259         fromlen = sizeof(from);
 260         memset(&from, 0, sizeof(from));
 261         if (getpeername(connection_in, (struct sockaddr *)&from, &fromlen) < 0)
 262                 return 0;
 263         tolen = sizeof(to);
 264         memset(&to, 0, sizeof(to));
 265         if (getpeername(connection_out, (struct sockaddr *)&to, &tolen) < 0)
 266                 return 0;
 267         if (fromlen != tolen || memcmp(&from, &to, fromlen) != 0)
 268                 return 0;
 269         if (from.ss_family != AF_INET && from.ss_family != AF_INET6)
 270                 return 0;
 271         return 1;
 272 }
 273
 274 /*
 275  * Exports an IV from the CipherContext required to export the key
 276  * state back from the unprivileged child to the privileged parent
 277  * process.
 278  */
 279
 280 void
 281 packet_get_keyiv(int mode, u_char *iv, u_int len)
 282 {
 283         CipherContext *cc;
 284
 285         if (mode == MODE_OUT)
 286                 cc = &send_context;
 287         else
 288                 cc = &receive_context;
 289
 290         cipher_get_keyiv(cc, iv, len);
 291 }
 292
 293 int
 294 packet_get_keycontext(int mode, u_char *dat)
 295 {
 296         CipherContext *cc;
 297
 298         if (mode == MODE_OUT)
 299                 cc = &send_context;
 300         else
 301                 cc = &receive_context;
 302
 303         return (cipher_get_keycontext(cc, dat));
 304 }
 305
 306 void
 307 packet_set_keycontext(int mode, u_char *dat)
 308 {
 309         CipherContext *cc;
 310
 311         if (mode == MODE_OUT)
 312                 cc = &send_context;
 313         else
 314                 cc = &receive_context;
 315
 316         cipher_set_keycontext(cc, dat);
 317 }
 318
 319 int
 320 packet_get_keyiv_len(int mode)
 321 {
 322         CipherContext *cc;
 323
 324         if (mode == MODE_OUT)
 325                 cc = &send_context;
 326         else
 327                 cc = &receive_context;
 328
 329         return (cipher_get_keyiv_len(cc));
 330 }
 331
 332 void
 333 packet_set_iv(int mode, u_char *dat)
 334 {
 335         CipherContext *cc;
 336
 337         if (mode == MODE_OUT)
 338                 cc = &send_context;
 339         else
 340                 cc = &receive_context;
 341
 342         cipher_set_keyiv(cc, dat);
 343 }
 344
 345 int
 346 packet_get_ssh1_cipher(void)
 347 {
 348         return (cipher_get_number(receive_context.cipher));
 349 }
 350
 351 void
 352 packet_get_state(int mode, u_int32_t *seqnr, u_int64_t *blocks, u_int32_t *packets,
 353     u_int64_t *bytes)
 354 {
 355         struct packet_state *state;
 356
 357         state = (mode == MODE_IN) ? &p_read : &p_send;
 358         if (seqnr)
 359                 *seqnr = state->seqnr;
 360         if (blocks)
 361                 *blocks = state->blocks;
 362         if (packets)
 363                 *packets = state->packets;
 364         if (bytes)
 365                 *bytes = state->bytes;
 366 }
 367
 368 void
 369 packet_set_state(int mode, u_int32_t seqnr, u_int64_t blocks, u_int32_t packets,
 370     u_int64_t bytes)
 371 {
 372         struct packet_state *state;
 373
 374         state = (mode == MODE_IN) ? &p_read : &p_send;
 375         state->seqnr = seqnr;
 376         state->blocks = blocks;
 377         state->packets = packets;
 378         state->bytes = bytes;
 379 }
 380
 381 /* returns 1 if connection is via ipv4 */
 382
 383 int
 384 packet_connection_is_ipv4(void)
 385 {
 386         struct sockaddr_storage to;
 387         socklen_t tolen = sizeof(to);
 388
 389         memset(&to, 0, sizeof(to));
 390         if (getsockname(connection_out, (struct sockaddr *)&to, &tolen) < 0)
 391                 return 0;
 392         if (to.ss_family == AF_INET)
 393                 return 1;
 394 #ifdef IPV4_IN_IPV6
 395         if (to.ss_family == AF_INET6 &&
 396             IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&to)->sin6_addr))
 397                 return 1;
 398 #endif
 399         return 0;
 400 }
 401
 402 /* Sets the connection into non-blocking mode. */
 403
 404 void
 405 packet_set_nonblocking(void)
 406 {
 407         /* Set the socket into non-blocking mode. */
 408         set_nonblock(connection_in);
 409
 410         if (connection_out != connection_in)
 411                 set_nonblock(connection_out);
 412 }
 413
 414 /* Returns the socket used for reading. */
 415
 416 int
 417 packet_get_connection_in(void)
 418 {
 419         return connection_in;
 420 }
 421
 422 /* Returns the descriptor used for writing. */
 423
 424 int
 425 packet_get_connection_out(void)
 426 {
 427         return connection_out;
 428 }
 429
 430 /* Closes the connection and clears and frees internal data structures. */
 431
 432 void
 433 packet_close(void)
 434 {
 435         if (!initialized)
 436                 return;
 437         initialized = 0;
 438         if (connection_in == connection_out) {
 439                 shutdown(connection_out, SHUT_RDWR);
 440                 close(connection_out);
 441         } else {
 442                 close(connection_in);
 443                 close(connection_out);
 444         }
 445         buffer_free(&input);
 446         buffer_free(&output);
 447         buffer_free(&outgoing_packet);
 448         buffer_free(&incoming_packet);
 449         if (compression_buffer_ready) {
 450                 buffer_free(&compression_buffer);
 451                 buffer_compress_uninit();
 452         }
 453         cipher_cleanup(&send_context);
 454         cipher_cleanup(&receive_context);
 455 }
 456
 457 /* Sets remote side protocol flags. */
 458
 459 void
 460 packet_set_protocol_flags(u_int protocol_flags)
 461 {
 462         remote_protocol_flags = protocol_flags;
 463 }
 464
 465 /* Returns the remote protocol flags set earlier by the above function. */
 466
 467 u_int
 468 packet_get_protocol_flags(void)
 469 {
 470         return remote_protocol_flags;
 471 }
 472
 473 /*
 474  * Starts packet compression from the next packet on in both directions.
 475  * Level is compression level 1 (fastest) - 9 (slow, best) as in gzip.
 476  */
 477
 478 static void
 479 packet_init_compression(void)
 480 {
 481         if (compression_buffer_ready == 1)
 482                 return;
 483         compression_buffer_ready = 1;
 484         buffer_init(&compression_buffer);
 485 }
 486
 487 void
 488 packet_start_compression(int level)
 489 {
 490         if (packet_compression && !compat20)
 491                 fatal("Compression already enabled.");
 492         packet_compression = 1;
 493         packet_init_compression();
 494         buffer_compress_init_send(level);
 495         buffer_compress_init_recv();
 496 }
 497
 498 /*
 499  * Causes any further packets to be encrypted using the given key.  The same
 500  * key is used for both sending and reception.  However, both directions are
 501  * encrypted independently of each other.
 502  */
 503
 504 void
 505 packet_set_encryption_key(const u_char *key, u_int keylen,
 506     int number)
 507 {
 508         Cipher *cipher = cipher_by_number(number);
 509
 510         if (cipher == NULL)
 511                 fatal("packet_set_encryption_key: unknown cipher number %d", number);
 512         if (keylen < 20)
 513                 fatal("packet_set_encryption_key: keylen too small: %d", keylen);
 514         if (keylen > SSH_SESSION_KEY_LENGTH)
 515                 fatal("packet_set_encryption_key: keylen too big: %d", keylen);
 516         memcpy(ssh1_key, key, keylen);
 517         ssh1_keylen = keylen;
 518         cipher_init(&send_context, cipher, key, keylen, NULL, 0, CIPHER_ENCRYPT);
 519         cipher_init(&receive_context, cipher, key, keylen, NULL, 0, CIPHER_DECRYPT);
 520 }
 521
 522 u_int
 523 packet_get_encryption_key(u_char *key)
 524 {
 525         if (key == NULL)
 526                 return (ssh1_keylen);
 527         memcpy(key, ssh1_key, ssh1_keylen);
 528         return (ssh1_keylen);
 529 }
 530
 531 /* Start constructing a packet to send. */
 532 void
 533 packet_start(u_char type)
 534 {
 535         u_char buf[9];
 536         int len;
 537
 538         DBG(debug("packet_start[%d]", type));
 539         len = compat20 ? 6 : 9;
 540         memset(buf, 0, len - 1);
 541         buf[len - 1] = type;
 542         buffer_clear(&outgoing_packet);
 543         buffer_append(&outgoing_packet, buf, len);
 544 }
 545
 546 /* Append payload. */
 547 void
 548 packet_put_char(int value)
 549 {
 550         char ch = value;
 551
 552         buffer_append(&outgoing_packet, &ch, 1);
 553 }
 554
 555 void
 556 packet_put_int(u_int value)
 557 {
 558         buffer_put_int(&outgoing_packet, value);
 559 }
 560
 561 void
 562 packet_put_string(const void *buf, u_int len)
 563 {
 564         buffer_put_string(&outgoing_packet, buf, len);
 565 }
 566
 567 void
 568 packet_put_cstring(const char *str)
 569 {
 570         buffer_put_cstring(&outgoing_packet, str);
 571 }
 572
 573 void
 574 packet_put_raw(const void *buf, u_int len)
 575 {
 576         buffer_append(&outgoing_packet, buf, len);
 577 }
 578
 579 void
 580 packet_put_bignum(BIGNUM * value)
 581 {
 582         buffer_put_bignum(&outgoing_packet, value);
 583 }
 584
 585 void
 586 packet_put_bignum2(BIGNUM * value)
 587 {
 588         buffer_put_bignum2(&outgoing_packet, value);
 589 }
 590
 591 /*
 592  * Finalizes and sends the packet.  If the encryption key has been set,
 593  * encrypts the packet before sending.
 594  */
 595
 596 static void
 597 packet_send1(void)
 598 {
 599         u_char buf[8], *cp;
 600         int i, padding, len;
 601         u_int checksum;
 602         u_int32_t rnd = 0;
 603
 604         /*
 605          * If using packet compression, compress the payload of the outgoing
 606          * packet.
 607          */
 608         if (packet_compression) {
 609                 buffer_clear(&compression_buffer);
 610                 /* Skip padding. */
 611                 buffer_consume(&outgoing_packet, 8);
 612                 /* padding */
 613                 buffer_append(&compression_buffer, "\0\0\0\0\0\0\0\0", 8);
 614                 buffer_compress(&outgoing_packet, &compression_buffer);
 615                 buffer_clear(&outgoing_packet);
 616                 buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
 617                     buffer_len(&compression_buffer));
 618         }
 619         /* Compute packet length without padding (add checksum, remove padding). */
 620         len = buffer_len(&outgoing_packet) + 4 - 8;
 621
 622         /* Insert padding. Initialized to zero in packet_start1() */
 623         padding = 8 - len % 8;
 624         if (!send_context.plaintext) {
 625                 cp = buffer_ptr(&outgoing_packet);
 626                 for (i = 0; i < padding; i++) {
 627                         if (i % 4 == 0)
 628                                 rnd = arc4random();
 629                         cp[7 - i] = rnd & 0xff;
 630                         rnd >>= 8;
 631                 }
 632         }
 633         buffer_consume(&outgoing_packet, 8 - padding);
 634
 635         /* Add check bytes. */
 636         checksum = ssh_crc32(buffer_ptr(&outgoing_packet),
 637             buffer_len(&outgoing_packet));
 638         put_u32(buf, checksum);
 639         buffer_append(&outgoing_packet, buf, 4);
 640
 641 #ifdef PACKET_DEBUG
 642         fprintf(stderr, "packet_send plain: ");
 643         buffer_dump(&outgoing_packet);
 644 #endif
 645
 646         /* Append to output. */
 647         put_u32(buf, len);
 648         buffer_append(&output, buf, 4);
 649         cp = buffer_append_space(&output, buffer_len(&outgoing_packet));
 650         cipher_crypt(&send_context, cp, buffer_ptr(&outgoing_packet),
 651             buffer_len(&outgoing_packet));
 652
 653 #ifdef PACKET_DEBUG
 654         fprintf(stderr, "encrypted: ");
 655         buffer_dump(&output);
 656 #endif
 657         p_send.packets++;
 658         p_send.bytes += len + buffer_len(&outgoing_packet);
 659         buffer_clear(&outgoing_packet);
 660
 661         /*
 662          * Note that the packet is now only buffered in output.  It won't be
 663          * actually sent until packet_write_wait or packet_write_poll is
 664          * called.
 665          */
 666 }
 667
 668 void
 669 set_newkeys(int mode)
 670 {
 671         Enc *enc;
 672         Mac *mac;
 673         Comp *comp;
 674         CipherContext *cc;
 675         u_int64_t *max_blocks;
 676         int crypt_type;
 677
 678         debug2("set_newkeys: mode %d", mode);
 679
 680         if (mode == MODE_OUT) {
 681                 cc = &send_context;
 682                 crypt_type = CIPHER_ENCRYPT;
 683                 p_send.packets = p_send.blocks = 0;
 684                 max_blocks = &max_blocks_out;
 685         } else {
 686                 cc = &receive_context;
 687                 crypt_type = CIPHER_DECRYPT;
 688                 p_read.packets = p_read.blocks = 0;
 689                 max_blocks = &max_blocks_in;
 690         }
 691         if (newkeys[mode] != NULL) {
 692                 debug("set_newkeys: rekeying");
 693                 cipher_cleanup(cc);
 694                 enc  = &newkeys[mode]->enc;
 695                 mac  = &newkeys[mode]->mac;
 696                 comp = &newkeys[mode]->comp;
 697                 mac_clear(mac);
 698                 xfree(enc->name);
 699                 xfree(enc->iv);
 700                 xfree(enc->key);
 701                 xfree(mac->name);
 702                 xfree(mac->key);
 703                 xfree(comp->name);
 704                 xfree(newkeys[mode]);
 705         }
 706         newkeys[mode] = kex_get_newkeys(mode);
 707         if (newkeys[mode] == NULL)
 708                 fatal("newkeys: no keys for mode %d", mode);
 709         enc  = &newkeys[mode]->enc;
 710         mac  = &newkeys[mode]->mac;
 711         comp = &newkeys[mode]->comp;
 712         if (mac_init(mac) == 0)
 713                 mac->enabled = 1;
 714         DBG(debug("cipher_init_context: %d", mode));
 715         cipher_init(cc, enc->cipher, enc->key, enc->key_len,
 716             enc->iv, enc->block_size, crypt_type);
 717         /* Deleting the keys does not gain extra security */
 718         /* memset(enc->iv,  0, enc->block_size);
 719            memset(enc->key, 0, enc->key_len);
 720            memset(mac->key, 0, mac->key_len); */
 721         if ((comp->type == COMP_ZLIB ||
 722             (comp->type == COMP_DELAYED && after_authentication)) &&
 723             comp->enabled == 0) {
 724                 packet_init_compression();
 725                 if (mode == MODE_OUT)
 726                         buffer_compress_init_send(6);
 727                 else
 728                         buffer_compress_init_recv();
 729                 comp->enabled = 1;
 730         }
 731         /*
 732          * The 2^(blocksize*2) limit is too expensive for 3DES,
 733          * blowfish, etc, so enforce a 1GB limit for small blocksizes.
 734          */
 735         if (enc->block_size >= 16)
 736                 *max_blocks = (u_int64_t)1 << (enc->block_size*2);
 737         else
 738                 *max_blocks = ((u_int64_t)1 << 30) / enc->block_size;
 739         if (rekey_limit)
 740                 *max_blocks = MIN(*max_blocks, rekey_limit / enc->block_size);
 741 }
 742
 743 /*
 744  * Delayed compression for SSH2 is enabled after authentication:
 745  * This happens on the server side after a SSH2_MSG_USERAUTH_SUCCESS is sent,
 746  * and on the client side after a SSH2_MSG_USERAUTH_SUCCESS is received.
 747  */
 748 static void
 749 packet_enable_delayed_compress(void)
 750 {
 751         Comp *comp = NULL;
 752         int mode;
 753
 754         /*
 755          * Remember that we are past the authentication step, so rekeying
 756          * with COMP_DELAYED will turn on compression immediately.
 757          */
 758         after_authentication = 1;
 759         for (mode = 0; mode < MODE_MAX; mode++) {
 760                 /* protocol error: USERAUTH_SUCCESS received before NEWKEYS */
 761                 if (newkeys[mode] == NULL)
 762                         continue;
 763                 comp = &newkeys[mode]->comp;
 764                 if (comp && !comp->enabled && comp->type == COMP_DELAYED) {
 765                         packet_init_compression();
 766                         if (mode == MODE_OUT)
 767                                 buffer_compress_init_send(6);
 768                         else
 769                                 buffer_compress_init_recv();
 770                         comp->enabled = 1;
 771                 }
 772         }
 773 }
 774
 775 /*
 776  * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
 777  */
 778 static void
 779 packet_send2_wrapped(void)
 780 {
 781         u_char type, *cp, *macbuf = NULL;
 782         u_char padlen, pad;
 783         u_int packet_length = 0;
 784         u_int i, len;
 785         u_int32_t rnd = 0;
 786         Enc *enc   = NULL;
 787         Mac *mac   = NULL;
 788         Comp *comp = NULL;
 789         int block_size;
 790
 791         if (newkeys[MODE_OUT] != NULL) {
 792                 enc  = &newkeys[MODE_OUT]->enc;
 793                 mac  = &newkeys[MODE_OUT]->mac;
 794                 comp = &newkeys[MODE_OUT]->comp;
 795         }
 796         block_size = enc ? enc->block_size : 8;
 797
 798         cp = buffer_ptr(&outgoing_packet);
 799         type = cp[5];
 800
 801 #ifdef PACKET_DEBUG
 802         fprintf(stderr, "plain:     ");
 803         buffer_dump(&outgoing_packet);
 804 #endif
 805
 806         if (comp && comp->enabled) {
 807                 len = buffer_len(&outgoing_packet);
 808                 /* skip header, compress only payload */
 809                 buffer_consume(&outgoing_packet, 5);
 810                 buffer_clear(&compression_buffer);
 811                 buffer_compress(&outgoing_packet, &compression_buffer);
 812                 buffer_clear(&outgoing_packet);
 813                 buffer_append(&outgoing_packet, "\0\0\0\0\0", 5);
 814                 buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
 815                     buffer_len(&compression_buffer));
 816                 DBG(debug("compression: raw %d compressed %d", len,
 817                     buffer_len(&outgoing_packet)));
 818         }
 819
 820         /* sizeof (packet_len + pad_len + payload) */
 821         len = buffer_len(&outgoing_packet);
 822
 823         /*
 824          * calc size of padding, alloc space, get random data,
 825          * minimum padding is 4 bytes
 826          */
 827         padlen = block_size - (len % block_size);
 828         if (padlen < 4)
 829                 padlen += block_size;
 830         if (extra_pad) {
 831                 /* will wrap if extra_pad+padlen > 255 */
 832                 extra_pad  = roundup(extra_pad, block_size);
 833                 pad = extra_pad - ((len + padlen) % extra_pad);
 834                 debug3("packet_send2: adding %d (len %d padlen %d extra_pad %d)",
 835                     pad, len, padlen, extra_pad);
 836                 padlen += pad;
 837                 extra_pad = 0;
 838         }
 839         cp = buffer_append_space(&outgoing_packet, padlen);
 840         if (enc && !send_context.plaintext) {
 841                 /* random padding */
 842                 for (i = 0; i < padlen; i++) {
 843                         if (i % 4 == 0)
 844                                 rnd = arc4random();
 845                         cp[i] = rnd & 0xff;
 846                         rnd >>= 8;
 847                 }
 848         } else {
 849                 /* clear padding */
 850                 memset(cp, 0, padlen);
 851         }
 852         /* packet_length includes payload, padding and padding length field */
 853         packet_length = buffer_len(&outgoing_packet) - 4;
 854         cp = buffer_ptr(&outgoing_packet);
 855         put_u32(cp, packet_length);
 856         cp[4] = padlen;
 857         DBG(debug("send: len %d (includes padlen %d)", packet_length+4, padlen));
 858
 859         /* compute MAC over seqnr and packet(length fields, payload, padding) */
 860         if (mac && mac->enabled) {
 861                 macbuf = mac_compute(mac, p_send.seqnr,
 862                     buffer_ptr(&outgoing_packet),
 863                     buffer_len(&outgoing_packet));
 864                 DBG(debug("done calc MAC out #%d", p_send.seqnr));
 865         }
 866         /* encrypt packet and append to output buffer. */
 867         cp = buffer_append_space(&output, buffer_len(&outgoing_packet));
 868         cipher_crypt(&send_context, cp, buffer_ptr(&outgoing_packet),
 869             buffer_len(&outgoing_packet));
 870         /* append unencrypted MAC */
 871         if (mac && mac->enabled)
 872                 buffer_append(&output, macbuf, mac->mac_len);
 873 #ifdef PACKET_DEBUG
 874         fprintf(stderr, "encrypted: ");
 875         buffer_dump(&output);
 876 #endif
 877         /* increment sequence number for outgoing packets */
 878         if (++p_send.seqnr == 0)
 879                 logit("outgoing seqnr wraps around");
 880         if (++p_send.packets == 0)
 881                 if (!(datafellows & SSH_BUG_NOREKEY))
 882                         fatal("XXX too many packets with same key");
 883         p_send.blocks += (packet_length + 4) / block_size;
 884         p_send.bytes += packet_length + 4;
 885         buffer_clear(&outgoing_packet);
 886
 887         if (type == SSH2_MSG_NEWKEYS)
 888                 set_newkeys(MODE_OUT);
 889         else if (type == SSH2_MSG_USERAUTH_SUCCESS && server_side)
 890                 packet_enable_delayed_compress();
 891 }
 892
 893 static void
 894 packet_send2(void)
 895 {
 896         static int rekeying = 0;
 897         struct packet *p;
 898         u_char type, *cp;
 899
 900         cp = buffer_ptr(&outgoing_packet);
 901         type = cp[5];
 902
 903         /* during rekeying we can only send key exchange messages */
 904         if (rekeying) {
 905                 if (!((type >= SSH2_MSG_TRANSPORT_MIN) &&
 906                     (type <= SSH2_MSG_TRANSPORT_MAX))) {
 907                         debug("enqueue packet: %u", type);
 908                         p = xmalloc(sizeof(*p));
 909                         p->type = type;
 910                         memcpy(&p->payload, &outgoing_packet, sizeof(Buffer));
 911                         buffer_init(&outgoing_packet);
 912                         TAILQ_INSERT_TAIL(&outgoing, p, next);
 913                         return;
 914                 }
 915         }
 916
 917         /* rekeying starts with sending KEXINIT */
 918         if (type == SSH2_MSG_KEXINIT)
 919                 rekeying = 1;
 920
 921         packet_send2_wrapped();
 922
 923         /* after a NEWKEYS message we can send the complete queue */
 924         if (type == SSH2_MSG_NEWKEYS) {
 925                 rekeying = 0;
 926                 while ((p = TAILQ_FIRST(&outgoing))) {
 927                         type = p->type;
 928                         debug("dequeue packet: %u", type);
 929                         buffer_free(&outgoing_packet);
 930                         memcpy(&outgoing_packet, &p->payload,
 931                             sizeof(Buffer));
 932                         TAILQ_REMOVE(&outgoing, p, next);
 933                         xfree(p);
 934                         packet_send2_wrapped();
 935                 }
 936         }
 937 }
 938
 939 void
 940 packet_send(void)
 941 {
 942         if (compat20)
 943                 packet_send2();
 944         else
 945                 packet_send1();
 946         DBG(debug("packet_send done"));
 947 }
 948
 949 /*
 950  * Waits until a packet has been received, and returns its type.  Note that
 951  * no other data is processed until this returns, so this function should not
 952  * be used during the interactive session.
 953  */
 954
 955 int
 956 packet_read_seqnr(u_int32_t *seqnr_p)
 957 {
 958         int type, len, ret, ms_remain;
 959         fd_set *setp;
 960         char buf[8192];
 961         struct timeval timeout, start, *timeoutp = NULL;
 962
 963         DBG(debug("packet_read()"));
 964
 965         setp = (fd_set *)xcalloc(howmany(connection_in+1, NFDBITS),
 966             sizeof(fd_mask));
 967
 968         /* Since we are blocking, ensure that all written packets have been sent. */
 969         packet_write_wait();
 970
 971         /* Stay in the loop until we have received a complete packet. */
 972         for (;;) {
 973                 /* Try to read a packet from the buffer. */
 974                 type = packet_read_poll_seqnr(seqnr_p);
 975                 if (!compat20 && (
 976                     type == SSH_SMSG_SUCCESS
 977                     || type == SSH_SMSG_FAILURE
 978                     || type == SSH_CMSG_EOF
 979                     || type == SSH_CMSG_EXIT_CONFIRMATION))
 980                         packet_check_eom();
 981                 /* If we got a packet, return it. */
 982                 if (type != SSH_MSG_NONE) {
 983                         xfree(setp);
 984                         return type;
 985                 }
 986                 /*
 987                  * Otherwise, wait for some data to arrive, add it to the
 988                  * buffer, and try again.
 989                  */
 990                 memset(setp, 0, howmany(connection_in + 1, NFDBITS) *
 991                     sizeof(fd_mask));
 992                 FD_SET(connection_in, setp);
 993
 994                 if (packet_timeout_ms > 0) {
 995                         ms_remain = packet_timeout_ms;
 996                         timeoutp = &timeout;
 997                 }
 998                 /* Wait for some data to arrive. */
 999                 for (;;) {
1000                         if (packet_timeout_ms != -1) {
1001                                 ms_to_timeval(&timeout, ms_remain);
1002                                 gettimeofday(&start, NULL);
1003                         }
1004                         if ((ret = select(connection_in + 1, setp, NULL,
1005                             NULL, timeoutp)) >= 0)
1006                                 break;
1007                         if (errno != EAGAIN && errno != EINTR &&
1008                             errno != EWOULDBLOCK)
1009                                 break;
1010                         if (packet_timeout_ms == -1)
1011                                 continue;
1012                         ms_subtract_diff(&start, &ms_remain);
1013                         if (ms_remain <= 0) {
1014                                 ret = 0;
1015                                 break;
1016                         }
1017                 }
1018                 if (ret == 0) {
1019                         logit("Connection to %.200s timed out while "
1020                             "waiting to read", get_remote_ipaddr());
1021                         cleanup_exit(255);
1022                 }
1023                 /* Read data from the socket. */
1024                 len = read(connection_in, buf, sizeof(buf));
1025                 if (len == 0) {
1026                         logit("Connection closed by %.200s", get_remote_ipaddr());
1027                         cleanup_exit(255);
1028                 }
1029                 if (len < 0)
1030                         fatal("Read from socket failed: %.100s", strerror(errno));
1031                 /* Append it to the buffer. */
1032                 packet_process_incoming(buf, len);
1033         }
1034         /* NOTREACHED */
1035 }
1036
1037 int
1038 packet_read(void)
1039 {
1040         return packet_read_seqnr(NULL);
1041 }
1042
1043 /*
1044  * Waits until a packet has been received, verifies that its type matches
1045  * that given, and gives a fatal error and exits if there is a mismatch.
1046  */
1047
1048 void
1049 packet_read_expect(int expected_type)
1050 {
1051         int type;
1052
1053         type = packet_read();
1054         if (type != expected_type)
1055                 packet_disconnect("Protocol error: expected packet type %d, got %d",
1056                     expected_type, type);
1057 }
1058
1059 /* Checks if a full packet is available in the data received so far via
1060  * packet_process_incoming.  If so, reads the packet; otherwise returns
1061  * SSH_MSG_NONE.  This does not wait for data from the connection.
1062  *
1063  * SSH_MSG_DISCONNECT is handled specially here.  Also,
1064  * SSH_MSG_IGNORE messages are skipped by this function and are never returned
1065  * to higher levels.
1066  */
1067
1068 static int
1069 packet_read_poll1(void)
1070 {
1071         u_int len, padded_len;
1072         u_char *cp, type;
1073         u_int checksum, stored_checksum;
1074
1075         /* Check if input size is less than minimum packet size. */
1076         if (buffer_len(&input) < 4 + 8)
1077                 return SSH_MSG_NONE;
1078         /* Get length of incoming packet. */
1079         cp = buffer_ptr(&input);
1080         len = get_u32(cp);
1081         if (len < 1 + 2 + 2 || len > 256 * 1024)
1082                 packet_disconnect("Bad packet length %u.", len);
1083         padded_len = (len + 8) & ~7;
1084
1085         /* Check if the packet has been entirely received. */
1086         if (buffer_len(&input) < 4 + padded_len)
1087                 return SSH_MSG_NONE;
1088
1089         /* The entire packet is in buffer. */
1090
1091         /* Consume packet length. */
1092         buffer_consume(&input, 4);
1093
1094         /*
1095          * Cryptographic attack detector for ssh
1096          * (C)1998 CORE-SDI, Buenos Aires Argentina
1097          * Ariel Futoransky(futo@core-sdi.com)
1098          */
1099         if (!receive_context.plaintext) {
1100                 switch (detect_attack(buffer_ptr(&input), padded_len)) {
1101                 case DEATTACK_DETECTED:
1102                         packet_disconnect("crc32 compensation attack: "
1103                             "network attack detected");
1104                 case DEATTACK_DOS_DETECTED:
1105                         packet_disconnect("deattack denial of "
1106                             "service detected");
1107                 }
1108         }
1109
1110         /* Decrypt data to incoming_packet. */
1111         buffer_clear(&incoming_packet);
1112         cp = buffer_append_space(&incoming_packet, padded_len);
1113         cipher_crypt(&receive_context, cp, buffer_ptr(&input), padded_len);
1114
1115         buffer_consume(&input, padded_len);
1116
1117 #ifdef PACKET_DEBUG
1118         fprintf(stderr, "read_poll plain: ");
1119         buffer_dump(&incoming_packet);
1120 #endif
1121
1122         /* Compute packet checksum. */
1123         checksum = ssh_crc32(buffer_ptr(&incoming_packet),
1124             buffer_len(&incoming_packet) - 4);
1125
1126         /* Skip padding. */
1127         buffer_consume(&incoming_packet, 8 - len % 8);
1128
1129         /* Test check bytes. */
1130         if (len != buffer_len(&incoming_packet))
1131                 packet_disconnect("packet_read_poll1: len %d != buffer_len %d.",
1132                     len, buffer_len(&incoming_packet));
1133
1134         cp = (u_char *)buffer_ptr(&incoming_packet) + len - 4;
1135         stored_checksum = get_u32(cp);
1136         if (checksum != stored_checksum)
1137                 packet_disconnect("Corrupted check bytes on input.");
1138         buffer_consume_end(&incoming_packet, 4);
1139
1140         if (packet_compression) {
1141                 buffer_clear(&compression_buffer);
1142                 buffer_uncompress(&incoming_packet, &compression_buffer);
1143                 buffer_clear(&incoming_packet);
1144                 buffer_append(&incoming_packet, buffer_ptr(&compression_buffer),
1145                     buffer_len(&compression_buffer));
1146         }
1147         p_read.packets++;
1148         p_read.bytes += padded_len + 4;
1149         type = buffer_get_char(&incoming_packet);
1150         if (type < SSH_MSG_MIN || type > SSH_MSG_MAX)
1151                 packet_disconnect("Invalid ssh1 packet type: %d", type);
1152         return type;
1153 }
1154
1155 static int
1156 packet_read_poll2(u_int32_t *seqnr_p)
1157 {
1158         static u_int packet_length = 0;
1159         u_int padlen, need;
1160         u_char *macbuf, *cp, type;
1161         u_int maclen, block_size;
1162         Enc *enc   = NULL;
1163         Mac *mac   = NULL;
1164         Comp *comp = NULL;
1165
1166         if (packet_discard)
1167                 return SSH_MSG_NONE;
1168
1169         if (newkeys[MODE_IN] != NULL) {
1170                 enc  = &newkeys[MODE_IN]->enc;
1171                 mac  = &newkeys[MODE_IN]->mac;
1172                 comp = &newkeys[MODE_IN]->comp;
1173         }
1174         maclen = mac && mac->enabled ? mac->mac_len : 0;
1175         block_size = enc ? enc->block_size : 8;
1176
1177         if (packet_length == 0) {
1178                 /*
1179                  * check if input size is less than the cipher block size,
1180                  * decrypt first block and extract length of incoming packet
1181                  */
1182                 if (buffer_len(&input) < block_size)
1183                         return SSH_MSG_NONE;
1184                 buffer_clear(&incoming_packet);
1185                 cp = buffer_append_space(&incoming_packet, block_size);
1186                 cipher_crypt(&receive_context, cp, buffer_ptr(&input),
1187                     block_size);
1188                 cp = buffer_ptr(&incoming_packet);
1189                 packet_length = get_u32(cp);
1190                 if (packet_length < 1 + 4 || packet_length > PACKET_MAX_SIZE) {
1191 #ifdef PACKET_DEBUG
1192                         buffer_dump(&incoming_packet);
1193 #endif
1194                         logit("Bad packet length %u.", packet_length);
1195                         packet_start_discard(enc, mac, packet_length,
1196                             PACKET_MAX_SIZE);
1197                         return SSH_MSG_NONE;
1198                 }
1199                 DBG(debug("input: packet len %u", packet_length+4));
1200                 buffer_consume(&input, block_size);
1201         }
1202         /* we have a partial packet of block_size bytes */
1203         need = 4 + packet_length - block_size;
1204         DBG(debug("partial packet %d, need %d, maclen %d", block_size,
1205             need, maclen));
1206         if (need % block_size != 0) {
1207                 logit("padding error: need %d block %d mod %d",
1208                     need, block_size, need % block_size);
1209                 packet_start_discard(enc, mac, packet_length,
1210                     PACKET_MAX_SIZE - block_size);
1211                 return SSH_MSG_NONE;
1212         }
1213         /*
1214          * check if the entire packet has been received and
1215          * decrypt into incoming_packet
1216          */
1217         if (buffer_len(&input) < need + maclen)
1218                 return SSH_MSG_NONE;
1219 #ifdef PACKET_DEBUG
1220         fprintf(stderr, "read_poll enc/full: ");
1221         buffer_dump(&input);
1222 #endif
1223         cp = buffer_append_space(&incoming_packet, need);
1224         cipher_crypt(&receive_context, cp, buffer_ptr(&input), need);
1225         buffer_consume(&input, need);
1226         /*
1227          * compute MAC over seqnr and packet,
1228          * increment sequence number for incoming packet
1229          */
1230         if (mac && mac->enabled) {
1231                 macbuf = mac_compute(mac, p_read.seqnr,
1232                     buffer_ptr(&incoming_packet),
1233                     buffer_len(&incoming_packet));
1234                 if (memcmp(macbuf, buffer_ptr(&input), mac->mac_len) != 0) {
1235                         logit("Corrupted MAC on input.");
1236                         if (need > PACKET_MAX_SIZE)
1237                                 fatal("internal error need %d", need);
1238                         packet_start_discard(enc, mac, packet_length,
1239                             PACKET_MAX_SIZE - need);
1240                         return SSH_MSG_NONE;
1241                 }
1242
1243                 DBG(debug("MAC #%d ok", p_read.seqnr));
1244                 buffer_consume(&input, mac->mac_len);
1245         }
1246         /* XXX now it's safe to use fatal/packet_disconnect */
1247         if (seqnr_p != NULL)
1248                 *seqnr_p = p_read.seqnr;
1249         if (++p_read.seqnr == 0)
1250                 logit("incoming seqnr wraps around");
1251         if (++p_read.packets == 0)
1252                 if (!(datafellows & SSH_BUG_NOREKEY))
1253                         fatal("XXX too many packets with same key");
1254         p_read.blocks += (packet_length + 4) / block_size;
1255         p_read.bytes += packet_length + 4;
1256
1257         /* get padlen */
1258         cp = buffer_ptr(&incoming_packet);
1259         padlen = cp[4];
1260         DBG(debug("input: padlen %d", padlen));
1261         if (padlen < 4)
1262                 packet_disconnect("Corrupted padlen %d on input.", padlen);
1263
1264         /* skip packet size + padlen, discard padding */
1265         buffer_consume(&incoming_packet, 4 + 1);
1266         buffer_consume_end(&incoming_packet, padlen);
1267
1268         DBG(debug("input: len before de-compress %d", buffer_len(&incoming_packet)));
1269         if (comp && comp->enabled) {
1270                 buffer_clear(&compression_buffer);
1271                 buffer_uncompress(&incoming_packet, &compression_buffer);
1272                 buffer_clear(&incoming_packet);
1273                 buffer_append(&incoming_packet, buffer_ptr(&compression_buffer),
1274                     buffer_len(&compression_buffer));
1275                 DBG(debug("input: len after de-compress %d",
1276                     buffer_len(&incoming_packet)));
1277         }
1278         /*
1279          * get packet type, implies consume.
1280          * return length of payload (without type field)
1281          */
1282         type = buffer_get_char(&incoming_packet);
1283         if (type < SSH2_MSG_MIN || type >= SSH2_MSG_LOCAL_MIN)
1284                 packet_disconnect("Invalid ssh2 packet type: %d", type);
1285         if (type == SSH2_MSG_NEWKEYS)
1286                 set_newkeys(MODE_IN);
1287         else if (type == SSH2_MSG_USERAUTH_SUCCESS && !server_side)
1288                 packet_enable_delayed_compress();
1289 #ifdef PACKET_DEBUG
1290         fprintf(stderr, "read/plain[%d]:\r\n", type);
1291         buffer_dump(&incoming_packet);
1292 #endif
1293         /* reset for next packet */
1294         packet_length = 0;
1295         return type;
1296 }
1297
1298 int
1299 packet_read_poll_seqnr(u_int32_t *seqnr_p)
1300 {
1301         u_int reason, seqnr;
1302         u_char type;
1303         char *msg;
1304
1305         for (;;) {
1306                 if (compat20) {
1307                         type = packet_read_poll2(seqnr_p);
1308                         if (type) {
1309                                 keep_alive_timeouts = 0;
1310                                 DBG(debug("received packet type %d", type));
1311                         }
1312                         switch (type) {
1313                         case SSH2_MSG_IGNORE:
1314                                 debug3("Received SSH2_MSG_IGNORE");
1315                                 break;
1316                         case SSH2_MSG_DEBUG:
1317                                 packet_get_char();
1318                                 msg = packet_get_string(NULL);
1319                                 debug("Remote: %.900s", msg);
1320                                 xfree(msg);
1321                                 msg = packet_get_string(NULL);
1322                                 xfree(msg);
1323                                 break;
1324                         case SSH2_MSG_DISCONNECT:
1325                                 reason = packet_get_int();
1326                                 msg = packet_get_string(NULL);
1327                                 logit("Received disconnect from %s: %u: %.400s",
1328                                     get_remote_ipaddr(), reason, msg);
1329                                 xfree(msg);
1330                                 cleanup_exit(255);
1331                                 break;
1332                         case SSH2_MSG_UNIMPLEMENTED:
1333                                 seqnr = packet_get_int();
1334                                 debug("Received SSH2_MSG_UNIMPLEMENTED for %u",
1335                                     seqnr);
1336                                 break;
1337                         default:
1338                                 return type;
1339                         }
1340                 } else {
1341                         type = packet_read_poll1();
1342                         switch (type) {
1343                         case SSH_MSG_IGNORE:
1344                                 break;
1345                         case SSH_MSG_DEBUG:
1346                                 msg = packet_get_string(NULL);
1347                                 debug("Remote: %.900s", msg);
1348                                 xfree(msg);
1349                                 break;
1350                         case SSH_MSG_DISCONNECT:
1351                                 msg = packet_get_string(NULL);
1352                                 logit("Received disconnect from %s: %.400s",
1353                                     get_remote_ipaddr(), msg);
1354                                 cleanup_exit(255);
1355                                 break;
1356                         default:
1357                                 if (type)
1358                                         DBG(debug("received packet type %d", type));
1359                                 return type;
1360                         }
1361                 }
1362         }
1363 }
1364
1365 int
1366 packet_read_poll(void)
1367 {
1368         return packet_read_poll_seqnr(NULL);
1369 }
1370
1371 /*
1372  * Buffers the given amount of input characters.  This is intended to be used
1373  * together with packet_read_poll.
1374  */
1375
1376 void
1377 packet_process_incoming(const char *buf, u_int len)
1378 {
1379         if (packet_discard) {
1380                 keep_alive_timeouts = 0; /* ?? */
1381                 if (len >= packet_discard)
1382                         packet_stop_discard();
1383                 packet_discard -= len;
1384                 return;
1385         }
1386         buffer_append(&input, buf, len);
1387 }
1388
1389 /* Returns a character from the packet. */
1390
1391 u_int
1392 packet_get_char(void)
1393 {
1394         char ch;
1395
1396         buffer_get(&incoming_packet, &ch, 1);
1397         return (u_char) ch;
1398 }
1399
1400 /* Returns an integer from the packet data. */
1401
1402 u_int
1403 packet_get_int(void)
1404 {
1405         return buffer_get_int(&incoming_packet);
1406 }
1407
1408 /*
1409  * Returns an arbitrary precision integer from the packet data.  The integer
1410  * must have been initialized before this call.
1411  */
1412
1413 void
1414 packet_get_bignum(BIGNUM * value)
1415 {
1416         buffer_get_bignum(&incoming_packet, value);
1417 }
1418
1419 void
1420 packet_get_bignum2(BIGNUM * value)
1421 {
1422         buffer_get_bignum2(&incoming_packet, value);
1423 }
1424
1425 void *
1426 packet_get_raw(u_int *length_ptr)
1427 {
1428         u_int bytes = buffer_len(&incoming_packet);
1429
1430         if (length_ptr != NULL)
1431                 *length_ptr = bytes;
1432         return buffer_ptr(&incoming_packet);
1433 }
1434
1435 int
1436 packet_remaining(void)
1437 {
1438         return buffer_len(&incoming_packet);
1439 }
1440
1441 /*
1442  * Returns a string from the packet data.  The string is allocated using
1443  * xmalloc; it is the responsibility of the calling program to free it when
1444  * no longer needed.  The length_ptr argument may be NULL, or point to an
1445  * integer into which the length of the string is stored.
1446  */
1447
1448 void *
1449 packet_get_string(u_int *length_ptr)
1450 {
1451         return buffer_get_string(&incoming_packet, length_ptr);
1452 }
1453
1454 void *
1455 packet_get_string_ptr(u_int *length_ptr)
1456 {
1457         return buffer_get_string_ptr(&incoming_packet, length_ptr);
1458 }
1459
1460 /*
1461  * Sends a diagnostic message from the server to the client.  This message
1462  * can be sent at any time (but not while constructing another message). The
1463  * message is printed immediately, but only if the client is being executed
1464  * in verbose mode.  These messages are primarily intended to ease debugging
1465  * authentication problems.   The length of the formatted message must not
1466  * exceed 1024 bytes.  This will automatically call packet_write_wait.
1467  */
1468
1469 void
1470 packet_send_debug(const char *fmt,...)
1471 {
1472         char buf[1024];
1473         va_list args;
1474
1475         if (compat20 && (datafellows & SSH_BUG_DEBUG))
1476                 return;
1477
1478         va_start(args, fmt);
1479         vsnprintf(buf, sizeof(buf), fmt, args);
1480         va_end(args);
1481
1482         if (compat20) {
1483                 packet_start(SSH2_MSG_DEBUG);
1484                 packet_put_char(0);     /* bool: always display */
1485                 packet_put_cstring(buf);
1486                 packet_put_cstring("");
1487         } else {
1488                 packet_start(SSH_MSG_DEBUG);
1489                 packet_put_cstring(buf);
1490         }
1491         packet_send();
1492         packet_write_wait();
1493 }
1494
1495 /*
1496  * Logs the error plus constructs and sends a disconnect packet, closes the
1497  * connection, and exits.  This function never returns. The error message
1498  * should not contain a newline.  The length of the formatted message must
1499  * not exceed 1024 bytes.
1500  */
1501
1502 void
1503 packet_disconnect(const char *fmt,...)
1504 {
1505         char buf[1024];
1506         va_list args;
1507         static int disconnecting = 0;
1508
1509         if (disconnecting)      /* Guard against recursive invocations. */
1510                 fatal("packet_disconnect called recursively.");
1511         disconnecting = 1;
1512
1513         /*
1514          * Format the message.  Note that the caller must make sure the
1515          * message is of limited size.
1516          */
1517         va_start(args, fmt);
1518         vsnprintf(buf, sizeof(buf), fmt, args);
1519         va_end(args);
1520
1521         /* Display the error locally */
1522         logit("Disconnecting: %.100s", buf);
1523
1524         /* Send the disconnect message to the other side, and wait for it to get sent. */
1525         if (compat20) {
1526                 packet_start(SSH2_MSG_DISCONNECT);
1527                 packet_put_int(SSH2_DISCONNECT_PROTOCOL_ERROR);
1528                 packet_put_cstring(buf);
1529                 packet_put_cstring("");
1530         } else {
1531                 packet_start(SSH_MSG_DISCONNECT);
1532                 packet_put_cstring(buf);
1533         }
1534         packet_send();
1535         packet_write_wait();
1536
1537         /* Stop listening for connections. */
1538         channel_close_all();
1539
1540         /* Close the connection. */
1541         packet_close();
1542         cleanup_exit(255);
1543 }
1544
1545 /* Checks if there is any buffered output, and tries to write some of the output. */
1546
1547 void
1548 packet_write_poll(void)
1549 {
1550         int len = buffer_len(&output);
1551
1552         if (len > 0) {
1553                 len = write(connection_out, buffer_ptr(&output), len);
1554                 if (len == -1) {
1555                         if (errno == EINTR || errno == EAGAIN ||
1556                             errno == EWOULDBLOCK)
1557                                 return;
1558                         fatal("Write failed: %.100s", strerror(errno));
1559                 }
1560                 if (len == 0)
1561                         fatal("Write connection closed");
1562                 buffer_consume(&output, len);
1563         }
1564 }
1565
1566
1567 /*
1568  * Calls packet_write_poll repeatedly until all pending output data has been
1569  * written.
1570  */
1571
1572 void
1573 packet_write_wait(void)
1574 {
1575         fd_set *setp;
1576         int ret, ms_remain;
1577         struct timeval start, timeout, *timeoutp = NULL;
1578
1579         setp = (fd_set *)xcalloc(howmany(connection_out + 1, NFDBITS),
1580             sizeof(fd_mask));
1581         packet_write_poll();
1582         while (packet_have_data_to_write()) {
1583                 memset(setp, 0, howmany(connection_out + 1, NFDBITS) *
1584                     sizeof(fd_mask));
1585                 FD_SET(connection_out, setp);
1586
1587                 if (packet_timeout_ms > 0) {
1588                         ms_remain = packet_timeout_ms;
1589                         timeoutp = &timeout;
1590                 }
1591                 for (;;) {
1592                         if (packet_timeout_ms != -1) {
1593                                 ms_to_timeval(&timeout, ms_remain);
1594                                 gettimeofday(&start, NULL);
1595                         }
1596                         if ((ret = select(connection_out + 1, NULL, setp,
1597                             NULL, timeoutp)) >= 0)
1598                                 break;
1599                         if (errno != EAGAIN && errno != EINTR &&
1600                             errno != EWOULDBLOCK)
1601                                 break;
1602                         if (packet_timeout_ms == -1)
1603                                 continue;
1604                         ms_subtract_diff(&start, &ms_remain);
1605                         if (ms_remain <= 0) {
1606                                 ret = 0;
1607                                 break;
1608                         }
1609                 }
1610                 if (ret == 0) {
1611                         logit("Connection to %.200s timed out while "
1612                             "waiting to write", get_remote_ipaddr());
1613                         cleanup_exit(255);
1614                 }
1615                 packet_write_poll();
1616         }
1617         xfree(setp);
1618 }
1619
1620 /* Returns true if there is buffered data to write to the connection. */
1621
1622 int
1623 packet_have_data_to_write(void)
1624 {
1625         return buffer_len(&output) != 0;
1626 }
1627
1628 /* Returns true if there is not too much data to write to the connection. */
1629
1630 int
1631 packet_not_very_much_data_to_write(void)
1632 {
1633         if (interactive_mode)
1634                 return buffer_len(&output) < 16384;
1635         else
1636                 return buffer_len(&output) < 128 * 1024;
1637 }
1638
1639
1640 static void
1641 packet_set_tos(int interactive)
1642 {
1643 #if defined(IP_TOS) && !defined(IP_TOS_IS_BROKEN)
1644         int tos = interactive ? IPTOS_LOWDELAY : IPTOS_THROUGHPUT;
1645
1646         if (!packet_connection_is_on_socket() ||
1647             !packet_connection_is_ipv4())
1648                 return;
1649         if (setsockopt(connection_in, IPPROTO_IP, IP_TOS, &tos,
1650             sizeof(tos)) < 0)
1651                 error("setsockopt IP_TOS %d: %.100s:",
1652                     tos, strerror(errno));
1653 #endif
1654 }
1655
1656 /* Informs that the current session is interactive.  Sets IP flags for that. */
1657
1658 void
1659 packet_set_interactive(int interactive)
1660 {
1661         static int called = 0;
1662
1663         if (called)
1664                 return;
1665         called = 1;
1666
1667         /* Record that we are in interactive mode. */
1668         interactive_mode = interactive;
1669
1670         /* Only set socket options if using a socket.  */
1671         if (!packet_connection_is_on_socket())
1672                 return;
1673         set_nodelay(connection_in);
1674         packet_set_tos(interactive);
1675 }
1676
1677 /* Returns true if the current connection is interactive. */
1678
1679 int
1680 packet_is_interactive(void)
1681 {
1682         return interactive_mode;
1683 }
1684
1685 int
1686 packet_set_maxsize(u_int s)
1687 {
1688         static int called = 0;
1689
1690         if (called) {
1691                 logit("packet_set_maxsize: called twice: old %d new %d",
1692                     max_packet_size, s);
1693                 return -1;
1694         }
1695         if (s < 4 * 1024 || s > 1024 * 1024) {
1696                 logit("packet_set_maxsize: bad size %d", s);
1697                 return -1;
1698         }
1699         called = 1;
1700         debug("packet_set_maxsize: setting to %d", s);
1701         max_packet_size = s;
1702         return s;
1703 }
1704
1705 /* roundup current message to pad bytes */
1706 void
1707 packet_add_padding(u_char pad)
1708 {
1709         extra_pad = pad;
1710 }
1711
1712 /*
1713  * 9.2.  Ignored Data Message
1714  *
1715  *   byte      SSH_MSG_IGNORE
1716  *   string    data
1717  *
1718  * All implementations MUST understand (and ignore) this message at any
1719  * time (after receiving the protocol version). No implementation is
1720  * required to send them. This message can be used as an additional
1721  * protection measure against advanced traffic analysis techniques.
1722  */
1723 void
1724 packet_send_ignore(int nbytes)
1725 {
1726         u_int32_t rnd = 0;
1727         int i;
1728
1729         packet_start(compat20 ? SSH2_MSG_IGNORE : SSH_MSG_IGNORE);
1730         packet_put_int(nbytes);
1731         for (i = 0; i < nbytes; i++) {
1732                 if (i % 4 == 0)
1733                         rnd = arc4random();
1734                 packet_put_char((u_char)rnd & 0xff);
1735                 rnd >>= 8;
1736         }
1737 }
1738
1739 #define MAX_PACKETS     (1U<<31)
1740 int
1741 packet_need_rekeying(void)
1742 {
1743         if (datafellows & SSH_BUG_NOREKEY)
1744                 return 0;
1745         return
1746             (p_send.packets > MAX_PACKETS) ||
1747             (p_read.packets > MAX_PACKETS) ||
1748             (max_blocks_out && (p_send.blocks > max_blocks_out)) ||
1749             (max_blocks_in  && (p_read.blocks > max_blocks_in));
1750 }
1751
1752 void
1753 packet_set_rekey_limit(u_int32_t bytes)
1754 {
1755         rekey_limit = bytes;
1756 }
1757
1758 void
1759 packet_set_server(void)
1760 {
1761         server_side = 1;
1762 }
1763
1764 void
1765 packet_set_authenticated(void)
1766 {
1767         after_authentication = 1;
1768 }