blob: f65ae989d77c406016aeed1654656175662e9ee6 [file] [log] [blame]
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001/*
Damien Miller95def091999-11-25 00:26:21 +11002 *
3 * packet.c
4 *
5 * Author: Tatu Ylonen <ylo@cs.hut.fi>
6 *
7 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
8 * All rights reserved
9 *
10 * Created: Sat Mar 18 02:40:40 1995 ylo
11 *
12 * This file contains code implementing the packet protocol and communication
13 * with the other side. This same code is used both on client and server side.
14 *
15 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100016
17#include "includes.h"
Damien Miller98c7ad62000-03-09 21:27:49 +110018RCSID("$Id: packet.c,v 1.12 2000/03/09 10:27:50 damien Exp $");
Damien Millerd4a8b7e1999-10-27 13:42:43 +100019
20#include "xmalloc.h"
21#include "buffer.h"
22#include "packet.h"
23#include "bufaux.h"
24#include "ssh.h"
25#include "crc32.h"
26#include "cipher.h"
27#include "getput.h"
28
29#include "compress.h"
30#include "deattack.h"
31
Damien Miller5428f641999-11-25 11:54:57 +110032/*
33 * This variable contains the file descriptors used for communicating with
34 * the other side. connection_in is used for reading; connection_out for
35 * writing. These can be the same descriptor, in which case it is assumed to
36 * be a socket.
37 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100038static int connection_in = -1;
39static int connection_out = -1;
40
Damien Miller5428f641999-11-25 11:54:57 +110041/*
42 * Cipher type. This value is only used to determine whether to pad the
43 * packets with zeroes or random data.
44 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100045static int cipher_type = SSH_CIPHER_NONE;
46
47/* Protocol flags for the remote side. */
48static unsigned int remote_protocol_flags = 0;
49
50/* Encryption context for receiving data. This is only used for decryption. */
51static CipherContext receive_context;
Damien Miller95def091999-11-25 00:26:21 +110052
53/* Encryption context for sending data. This is only used for encryption. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100054static CipherContext send_context;
55
56/* Buffer for raw input data from the socket. */
57static Buffer input;
58
59/* Buffer for raw output data going to the socket. */
60static Buffer output;
61
62/* Buffer for the partial outgoing packet being constructed. */
63static Buffer outgoing_packet;
64
65/* Buffer for the incoming packet currently being processed. */
66static Buffer incoming_packet;
67
68/* Scratch buffer for packet compression/decompression. */
69static Buffer compression_buffer;
70
71/* Flag indicating whether packet compression/decompression is enabled. */
72static int packet_compression = 0;
73
Damien Miller6162d121999-11-21 13:23:52 +110074/* default maximum packet size */
75int max_packet_size = 32768;
76
Damien Millerd4a8b7e1999-10-27 13:42:43 +100077/* Flag indicating whether this module has been initialized. */
78static int initialized = 0;
79
80/* Set to true if the connection is interactive. */
81static int interactive_mode = 0;
82
Damien Miller5428f641999-11-25 11:54:57 +110083/*
84 * Sets the descriptors used for communication. Disables encryption until
85 * packet_set_encryption_key is called.
86 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100087
88void
89packet_set_connection(int fd_in, int fd_out)
90{
Damien Miller95def091999-11-25 00:26:21 +110091 connection_in = fd_in;
92 connection_out = fd_out;
93 cipher_type = SSH_CIPHER_NONE;
94 cipher_set_key(&send_context, SSH_CIPHER_NONE, (unsigned char *) "", 0, 1);
95 cipher_set_key(&receive_context, SSH_CIPHER_NONE, (unsigned char *) "", 0, 0);
96 if (!initialized) {
97 initialized = 1;
98 buffer_init(&input);
99 buffer_init(&output);
100 buffer_init(&outgoing_packet);
101 buffer_init(&incoming_packet);
102 }
103 /* Kludge: arrange the close function to be called from fatal(). */
104 fatal_add_cleanup((void (*) (void *)) packet_close, NULL);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000105}
106
Damien Miller34132e52000-01-14 15:45:46 +1100107/* Returns 1 if remote host is connected via socket, 0 if not. */
108
109int
110packet_connection_is_on_socket()
111{
112 struct sockaddr_storage from, to;
113 socklen_t fromlen, tolen;
114
115 /* filedescriptors in and out are the same, so it's a socket */
116 if (connection_in == connection_out)
117 return 1;
118 fromlen = sizeof(from);
119 memset(&from, 0, sizeof(from));
Damien Millerf052aaf2000-01-22 19:47:21 +1100120 if (getpeername(connection_in, (struct sockaddr *)&from, &fromlen) < 0)
Damien Miller34132e52000-01-14 15:45:46 +1100121 return 0;
122 tolen = sizeof(to);
123 memset(&to, 0, sizeof(to));
Damien Millerf052aaf2000-01-22 19:47:21 +1100124 if (getpeername(connection_out, (struct sockaddr *)&to, &tolen) < 0)
Damien Miller34132e52000-01-14 15:45:46 +1100125 return 0;
126 if (fromlen != tolen || memcmp(&from, &to, fromlen) != 0)
127 return 0;
128 if (from.ss_family != AF_INET && from.ss_family != AF_INET6)
129 return 0;
130 return 1;
131}
132
133/* returns 1 if connection is via ipv4 */
134
135int
136packet_connection_is_ipv4()
137{
138 struct sockaddr_storage to;
Damien Miller6fe375d2000-01-23 09:38:00 +1100139 socklen_t tolen = sizeof(to);
Damien Miller34132e52000-01-14 15:45:46 +1100140
141 memset(&to, 0, sizeof(to));
142 if (getsockname(connection_out, (struct sockaddr *)&to, &tolen) < 0)
143 return 0;
144 if (to.ss_family != AF_INET)
145 return 0;
146 return 1;
147}
148
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000149/* Sets the connection into non-blocking mode. */
150
151void
152packet_set_nonblocking()
153{
Damien Miller95def091999-11-25 00:26:21 +1100154 /* Set the socket into non-blocking mode. */
155 if (fcntl(connection_in, F_SETFL, O_NONBLOCK) < 0)
156 error("fcntl O_NONBLOCK: %.100s", strerror(errno));
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000157
Damien Miller95def091999-11-25 00:26:21 +1100158 if (connection_out != connection_in) {
159 if (fcntl(connection_out, F_SETFL, O_NONBLOCK) < 0)
160 error("fcntl O_NONBLOCK: %.100s", strerror(errno));
161 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000162}
163
164/* Returns the socket used for reading. */
165
166int
167packet_get_connection_in()
168{
Damien Miller95def091999-11-25 00:26:21 +1100169 return connection_in;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000170}
171
172/* Returns the descriptor used for writing. */
173
174int
175packet_get_connection_out()
176{
Damien Miller95def091999-11-25 00:26:21 +1100177 return connection_out;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000178}
179
180/* Closes the connection and clears and frees internal data structures. */
181
182void
183packet_close()
184{
Damien Miller95def091999-11-25 00:26:21 +1100185 if (!initialized)
186 return;
187 initialized = 0;
188 if (connection_in == connection_out) {
189 shutdown(connection_out, SHUT_RDWR);
190 close(connection_out);
191 } else {
192 close(connection_in);
193 close(connection_out);
194 }
195 buffer_free(&input);
196 buffer_free(&output);
197 buffer_free(&outgoing_packet);
198 buffer_free(&incoming_packet);
199 if (packet_compression) {
200 buffer_free(&compression_buffer);
201 buffer_compress_uninit();
202 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000203}
204
205/* Sets remote side protocol flags. */
206
207void
208packet_set_protocol_flags(unsigned int protocol_flags)
209{
Damien Miller95def091999-11-25 00:26:21 +1100210 remote_protocol_flags = protocol_flags;
211 channel_set_options((protocol_flags & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) != 0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000212}
213
214/* Returns the remote protocol flags set earlier by the above function. */
215
216unsigned int
217packet_get_protocol_flags()
218{
Damien Miller95def091999-11-25 00:26:21 +1100219 return remote_protocol_flags;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000220}
221
Damien Miller5428f641999-11-25 11:54:57 +1100222/*
223 * Starts packet compression from the next packet on in both directions.
224 * Level is compression level 1 (fastest) - 9 (slow, best) as in gzip.
225 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000226
227void
228packet_start_compression(int level)
229{
Damien Miller95def091999-11-25 00:26:21 +1100230 if (packet_compression)
231 fatal("Compression already enabled.");
232 packet_compression = 1;
233 buffer_init(&compression_buffer);
234 buffer_compress_init(level);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000235}
236
Damien Miller5428f641999-11-25 11:54:57 +1100237/*
238 * Encrypts the given number of bytes, copying from src to dest. bytes is
239 * known to be a multiple of 8.
240 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000241
242void
Damien Miller95def091999-11-25 00:26:21 +1100243packet_encrypt(CipherContext * cc, void *dest, void *src,
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000244 unsigned int bytes)
245{
Damien Miller95def091999-11-25 00:26:21 +1100246 cipher_encrypt(cc, dest, src, bytes);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000247}
248
Damien Miller5428f641999-11-25 11:54:57 +1100249/*
250 * Decrypts the given number of bytes, copying from src to dest. bytes is
251 * known to be a multiple of 8.
252 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000253
254void
Damien Miller95def091999-11-25 00:26:21 +1100255packet_decrypt(CipherContext * cc, void *dest, void *src,
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000256 unsigned int bytes)
257{
Damien Miller95def091999-11-25 00:26:21 +1100258 int i;
259
260 if ((bytes % 8) != 0)
261 fatal("packet_decrypt: bad ciphertext length %d", bytes);
262
Damien Miller5428f641999-11-25 11:54:57 +1100263 /*
264 * Cryptographic attack detector for ssh - Modifications for packet.c
265 * (C)1998 CORE-SDI, Buenos Aires Argentina Ariel Futoransky(futo@core-sdi.com)
266 */
Damien Miller95def091999-11-25 00:26:21 +1100267
268 switch (cc->type) {
269 case SSH_CIPHER_NONE:
270 i = DEATTACK_OK;
271 break;
272 default:
273 i = detect_attack(src, bytes, NULL);
274 break;
275 }
276
277 if (i == DEATTACK_DETECTED)
278 packet_disconnect("crc32 compensation attack: network attack detected");
279
280 cipher_decrypt(cc, dest, src, bytes);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000281}
282
Damien Miller5428f641999-11-25 11:54:57 +1100283/*
284 * Causes any further packets to be encrypted using the given key. The same
285 * key is used for both sending and reception. However, both directions are
286 * encrypted independently of each other.
287 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000288
289void
290packet_set_encryption_key(const unsigned char *key, unsigned int keylen,
Damien Miller7e8e8201999-11-16 13:37:16 +1100291 int cipher)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000292{
Damien Miller95def091999-11-25 00:26:21 +1100293 /* All other ciphers use the same key in both directions for now. */
294 cipher_set_key(&receive_context, cipher, key, keylen, 0);
295 cipher_set_key(&send_context, cipher, key, keylen, 1);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000296}
297
298/* Starts constructing a packet to send. */
299
300void
301packet_start(int type)
302{
Damien Miller95def091999-11-25 00:26:21 +1100303 char buf[9];
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000304
Damien Miller95def091999-11-25 00:26:21 +1100305 buffer_clear(&outgoing_packet);
306 memset(buf, 0, 8);
307 buf[8] = type;
308 buffer_append(&outgoing_packet, buf, 9);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000309}
310
311/* Appends a character to the packet data. */
312
313void
314packet_put_char(int value)
315{
Damien Miller95def091999-11-25 00:26:21 +1100316 char ch = value;
317 buffer_append(&outgoing_packet, &ch, 1);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000318}
319
320/* Appends an integer to the packet data. */
321
322void
323packet_put_int(unsigned int value)
324{
Damien Miller95def091999-11-25 00:26:21 +1100325 buffer_put_int(&outgoing_packet, value);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000326}
327
328/* Appends a string to packet data. */
329
330void
331packet_put_string(const char *buf, unsigned int len)
332{
Damien Miller95def091999-11-25 00:26:21 +1100333 buffer_put_string(&outgoing_packet, buf, len);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000334}
335
336/* Appends an arbitrary precision integer to packet data. */
337
338void
Damien Miller95def091999-11-25 00:26:21 +1100339packet_put_bignum(BIGNUM * value)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000340{
Damien Miller95def091999-11-25 00:26:21 +1100341 buffer_put_bignum(&outgoing_packet, value);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000342}
343
Damien Miller5428f641999-11-25 11:54:57 +1100344/*
345 * Finalizes and sends the packet. If the encryption key has been set,
346 * encrypts the packet before sending.
347 */
Damien Miller95def091999-11-25 00:26:21 +1100348
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000349void
350packet_send()
351{
Damien Miller95def091999-11-25 00:26:21 +1100352 char buf[8], *cp;
353 int i, padding, len;
354 unsigned int checksum;
355 u_int32_t rand = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000356
Damien Miller5428f641999-11-25 11:54:57 +1100357 /*
358 * If using packet compression, compress the payload of the outgoing
359 * packet.
360 */
Damien Miller95def091999-11-25 00:26:21 +1100361 if (packet_compression) {
362 buffer_clear(&compression_buffer);
363 /* Skip padding. */
364 buffer_consume(&outgoing_packet, 8);
365 /* padding */
366 buffer_append(&compression_buffer, "\0\0\0\0\0\0\0\0", 8);
367 buffer_compress(&outgoing_packet, &compression_buffer);
368 buffer_clear(&outgoing_packet);
369 buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
370 buffer_len(&compression_buffer));
371 }
372 /* Compute packet length without padding (add checksum, remove padding). */
373 len = buffer_len(&outgoing_packet) + 4 - 8;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000374
Damien Miller95def091999-11-25 00:26:21 +1100375 /* Insert padding. */
376 padding = 8 - len % 8;
377 if (cipher_type != SSH_CIPHER_NONE) {
378 cp = buffer_ptr(&outgoing_packet);
379 for (i = 0; i < padding; i++) {
380 if (i % 4 == 0)
381 rand = arc4random();
382 cp[7 - i] = rand & 0xff;
383 rand >>= 8;
384 }
385 }
386 buffer_consume(&outgoing_packet, 8 - padding);
387
388 /* Add check bytes. */
389 checksum = crc32((unsigned char *) buffer_ptr(&outgoing_packet),
390 buffer_len(&outgoing_packet));
391 PUT_32BIT(buf, checksum);
392 buffer_append(&outgoing_packet, buf, 4);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000393
394#ifdef PACKET_DEBUG
Damien Miller95def091999-11-25 00:26:21 +1100395 fprintf(stderr, "packet_send plain: ");
396 buffer_dump(&outgoing_packet);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000397#endif
398
Damien Miller95def091999-11-25 00:26:21 +1100399 /* Append to output. */
400 PUT_32BIT(buf, len);
401 buffer_append(&output, buf, 4);
402 buffer_append_space(&output, &cp, buffer_len(&outgoing_packet));
403 packet_encrypt(&send_context, cp, buffer_ptr(&outgoing_packet),
404 buffer_len(&outgoing_packet));
405
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000406#ifdef PACKET_DEBUG
Damien Miller95def091999-11-25 00:26:21 +1100407 fprintf(stderr, "encrypted: ");
408 buffer_dump(&output);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000409#endif
410
Damien Miller95def091999-11-25 00:26:21 +1100411 buffer_clear(&outgoing_packet);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000412
Damien Miller5428f641999-11-25 11:54:57 +1100413 /*
414 * Note that the packet is now only buffered in output. It won\'t be
415 * actually sent until packet_write_wait or packet_write_poll is
416 * called.
417 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000418}
419
Damien Miller5428f641999-11-25 11:54:57 +1100420/*
421 * Waits until a packet has been received, and returns its type. Note that
422 * no other data is processed until this returns, so this function should not
423 * be used during the interactive session.
424 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000425
426int
427packet_read(int *payload_len_ptr)
428{
Damien Miller95def091999-11-25 00:26:21 +1100429 int type, len;
430 fd_set set;
431 char buf[8192];
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000432
Damien Miller95def091999-11-25 00:26:21 +1100433 /* Since we are blocking, ensure that all written packets have been sent. */
434 packet_write_wait();
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000435
Damien Miller95def091999-11-25 00:26:21 +1100436 /* Stay in the loop until we have received a complete packet. */
437 for (;;) {
438 /* Try to read a packet from the buffer. */
439 type = packet_read_poll(payload_len_ptr);
440 if (type == SSH_SMSG_SUCCESS
441 || type == SSH_SMSG_FAILURE
442 || type == SSH_CMSG_EOF
443 || type == SSH_CMSG_EXIT_CONFIRMATION)
444 packet_integrity_check(*payload_len_ptr, 0, type);
445 /* If we got a packet, return it. */
446 if (type != SSH_MSG_NONE)
447 return type;
Damien Miller5428f641999-11-25 11:54:57 +1100448 /*
449 * Otherwise, wait for some data to arrive, add it to the
450 * buffer, and try again.
451 */
Damien Miller95def091999-11-25 00:26:21 +1100452 FD_ZERO(&set);
453 FD_SET(connection_in, &set);
Damien Miller5428f641999-11-25 11:54:57 +1100454
Damien Miller95def091999-11-25 00:26:21 +1100455 /* Wait for some data to arrive. */
456 select(connection_in + 1, &set, NULL, NULL, NULL);
Damien Miller5428f641999-11-25 11:54:57 +1100457
Damien Miller95def091999-11-25 00:26:21 +1100458 /* Read data from the socket. */
459 len = read(connection_in, buf, sizeof(buf));
Damien Miller5e7c10e1999-12-16 13:18:04 +1100460 if (len == 0) {
461 log("Connection closed by %.200s", get_remote_ipaddr());
462 fatal_cleanup();
463 }
Damien Miller95def091999-11-25 00:26:21 +1100464 if (len < 0)
465 fatal("Read from socket failed: %.100s", strerror(errno));
466 /* Append it to the buffer. */
467 packet_process_incoming(buf, len);
468 }
469 /* NOTREACHED */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000470}
471
Damien Miller5428f641999-11-25 11:54:57 +1100472/*
473 * Waits until a packet has been received, verifies that its type matches
474 * that given, and gives a fatal error and exits if there is a mismatch.
475 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000476
477void
478packet_read_expect(int *payload_len_ptr, int expected_type)
479{
Damien Miller95def091999-11-25 00:26:21 +1100480 int type;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000481
Damien Miller95def091999-11-25 00:26:21 +1100482 type = packet_read(payload_len_ptr);
483 if (type != expected_type)
484 packet_disconnect("Protocol error: expected packet type %d, got %d",
485 expected_type, type);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000486}
487
488/* Checks if a full packet is available in the data received so far via
Damien Miller95def091999-11-25 00:26:21 +1100489 * packet_process_incoming. If so, reads the packet; otherwise returns
490 * SSH_MSG_NONE. This does not wait for data from the connection.
491 *
492 * SSH_MSG_DISCONNECT is handled specially here. Also,
493 * SSH_MSG_IGNORE messages are skipped by this function and are never returned
494 * to higher levels.
495 *
496 * The returned payload_len does include space consumed by:
497 * Packet length
498 * Padding
499 * Packet type
500 * Check bytes
501 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000502
503int
504packet_read_poll(int *payload_len_ptr)
505{
Damien Miller95def091999-11-25 00:26:21 +1100506 unsigned int len, padded_len;
507 unsigned char *ucp;
Damien Miller98c7ad62000-03-09 21:27:49 +1100508 char buf[8], *cp, *msg;
Damien Miller95def091999-11-25 00:26:21 +1100509 unsigned int checksum, stored_checksum;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000510
Damien Miller95def091999-11-25 00:26:21 +1100511restart:
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000512
Damien Miller95def091999-11-25 00:26:21 +1100513 /* Check if input size is less than minimum packet size. */
514 if (buffer_len(&input) < 4 + 8)
515 return SSH_MSG_NONE;
516 /* Get length of incoming packet. */
517 ucp = (unsigned char *) buffer_ptr(&input);
518 len = GET_32BIT(ucp);
519 if (len < 1 + 2 + 2 || len > 256 * 1024)
520 packet_disconnect("Bad packet length %d.", len);
521 padded_len = (len + 8) & ~7;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000522
Damien Miller95def091999-11-25 00:26:21 +1100523 /* Check if the packet has been entirely received. */
524 if (buffer_len(&input) < 4 + padded_len)
525 return SSH_MSG_NONE;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000526
Damien Miller95def091999-11-25 00:26:21 +1100527 /* The entire packet is in buffer. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000528
Damien Miller95def091999-11-25 00:26:21 +1100529 /* Consume packet length. */
530 buffer_consume(&input, 4);
531
532 /* Copy data to incoming_packet. */
533 buffer_clear(&incoming_packet);
534 buffer_append_space(&incoming_packet, &cp, padded_len);
535 packet_decrypt(&receive_context, cp, buffer_ptr(&input), padded_len);
536 buffer_consume(&input, padded_len);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000537
538#ifdef PACKET_DEBUG
Damien Miller95def091999-11-25 00:26:21 +1100539 fprintf(stderr, "read_poll plain: ");
540 buffer_dump(&incoming_packet);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000541#endif
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000542
Damien Miller95def091999-11-25 00:26:21 +1100543 /* Compute packet checksum. */
544 checksum = crc32((unsigned char *) buffer_ptr(&incoming_packet),
545 buffer_len(&incoming_packet) - 4);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000546
Damien Miller95def091999-11-25 00:26:21 +1100547 /* Skip padding. */
548 buffer_consume(&incoming_packet, 8 - len % 8);
Damien Millerfd7c9111999-11-08 16:15:55 +1100549
Damien Miller95def091999-11-25 00:26:21 +1100550 /* Test check bytes. */
Damien Millerfd7c9111999-11-08 16:15:55 +1100551
Damien Miller95def091999-11-25 00:26:21 +1100552 if (len != buffer_len(&incoming_packet))
553 packet_disconnect("packet_read_poll: len %d != buffer_len %d.",
554 len, buffer_len(&incoming_packet));
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000555
Damien Miller95def091999-11-25 00:26:21 +1100556 ucp = (unsigned char *) buffer_ptr(&incoming_packet) + len - 4;
557 stored_checksum = GET_32BIT(ucp);
558 if (checksum != stored_checksum)
559 packet_disconnect("Corrupted check bytes on input.");
560 buffer_consume_end(&incoming_packet, 4);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000561
Damien Miller95def091999-11-25 00:26:21 +1100562 /* If using packet compression, decompress the packet. */
563 if (packet_compression) {
564 buffer_clear(&compression_buffer);
565 buffer_uncompress(&incoming_packet, &compression_buffer);
566 buffer_clear(&incoming_packet);
567 buffer_append(&incoming_packet, buffer_ptr(&compression_buffer),
568 buffer_len(&compression_buffer));
569 }
570 /* Get packet type. */
571 buffer_get(&incoming_packet, &buf[0], 1);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000572
Damien Miller95def091999-11-25 00:26:21 +1100573 /* Return length of payload (without type field). */
574 *payload_len_ptr = buffer_len(&incoming_packet);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000575
Damien Miller95def091999-11-25 00:26:21 +1100576 /* Handle disconnect message. */
Damien Milleraae6c611999-12-06 11:47:28 +1100577 if ((unsigned char) buf[0] == SSH_MSG_DISCONNECT) {
Damien Miller98c7ad62000-03-09 21:27:49 +1100578 msg = packet_get_string(NULL);
579 log("Received disconnect: %.900s", msg);
580 xfree(msg);
Damien Milleraae6c611999-12-06 11:47:28 +1100581 fatal_cleanup();
582 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000583
Damien Miller95def091999-11-25 00:26:21 +1100584 /* Ignore ignore messages. */
585 if ((unsigned char) buf[0] == SSH_MSG_IGNORE)
586 goto restart;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000587
Damien Miller95def091999-11-25 00:26:21 +1100588 /* Send debug messages as debugging output. */
589 if ((unsigned char) buf[0] == SSH_MSG_DEBUG) {
Damien Miller98c7ad62000-03-09 21:27:49 +1100590 msg = packet_get_string(NULL);
591 debug("Remote: %.900s", msg);
592 xfree(msg);
Damien Miller95def091999-11-25 00:26:21 +1100593 goto restart;
594 }
595 /* Return type. */
596 return (unsigned char) buf[0];
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000597}
Damien Miller95def091999-11-25 00:26:21 +1100598
Damien Miller5428f641999-11-25 11:54:57 +1100599/*
600 * Buffers the given amount of input characters. This is intended to be used
601 * together with packet_read_poll.
602 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000603
604void
605packet_process_incoming(const char *buf, unsigned int len)
606{
Damien Miller95def091999-11-25 00:26:21 +1100607 buffer_append(&input, buf, len);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000608}
609
610/* Returns a character from the packet. */
611
612unsigned int
613packet_get_char()
614{
Damien Miller95def091999-11-25 00:26:21 +1100615 char ch;
616 buffer_get(&incoming_packet, &ch, 1);
617 return (unsigned char) ch;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000618}
619
620/* Returns an integer from the packet data. */
621
622unsigned int
623packet_get_int()
624{
Damien Miller95def091999-11-25 00:26:21 +1100625 return buffer_get_int(&incoming_packet);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000626}
627
Damien Miller5428f641999-11-25 11:54:57 +1100628/*
629 * Returns an arbitrary precision integer from the packet data. The integer
630 * must have been initialized before this call.
631 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000632
633void
Damien Miller95def091999-11-25 00:26:21 +1100634packet_get_bignum(BIGNUM * value, int *length_ptr)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000635{
Damien Miller95def091999-11-25 00:26:21 +1100636 *length_ptr = buffer_get_bignum(&incoming_packet, value);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000637}
638
Damien Miller5428f641999-11-25 11:54:57 +1100639/*
640 * Returns a string from the packet data. The string is allocated using
641 * xmalloc; it is the responsibility of the calling program to free it when
642 * no longer needed. The length_ptr argument may be NULL, or point to an
643 * integer into which the length of the string is stored.
644 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000645
Damien Miller5428f641999-11-25 11:54:57 +1100646char *
Damien Miller95def091999-11-25 00:26:21 +1100647packet_get_string(unsigned int *length_ptr)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000648{
Damien Miller95def091999-11-25 00:26:21 +1100649 return buffer_get_string(&incoming_packet, length_ptr);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000650}
651
Damien Miller5428f641999-11-25 11:54:57 +1100652/*
653 * Sends a diagnostic message from the server to the client. This message
654 * can be sent at any time (but not while constructing another message). The
655 * message is printed immediately, but only if the client is being executed
656 * in verbose mode. These messages are primarily intended to ease debugging
657 * authentication problems. The length of the formatted message must not
658 * exceed 1024 bytes. This will automatically call packet_write_wait.
659 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000660
661void
Damien Miller95def091999-11-25 00:26:21 +1100662packet_send_debug(const char *fmt,...)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000663{
Damien Miller95def091999-11-25 00:26:21 +1100664 char buf[1024];
665 va_list args;
666
667 va_start(args, fmt);
668 vsnprintf(buf, sizeof(buf), fmt, args);
669 va_end(args);
670
671 packet_start(SSH_MSG_DEBUG);
672 packet_put_string(buf, strlen(buf));
673 packet_send();
674 packet_write_wait();
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000675}
676
Damien Miller5428f641999-11-25 11:54:57 +1100677/*
678 * Logs the error plus constructs and sends a disconnect packet, closes the
679 * connection, and exits. This function never returns. The error message
680 * should not contain a newline. The length of the formatted message must
681 * not exceed 1024 bytes.
682 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000683
684void
Damien Miller95def091999-11-25 00:26:21 +1100685packet_disconnect(const char *fmt,...)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000686{
Damien Miller95def091999-11-25 00:26:21 +1100687 char buf[1024];
688 va_list args;
689 static int disconnecting = 0;
690 if (disconnecting) /* Guard against recursive invocations. */
691 fatal("packet_disconnect called recursively.");
692 disconnecting = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000693
Damien Miller5428f641999-11-25 11:54:57 +1100694 /*
695 * Format the message. Note that the caller must make sure the
696 * message is of limited size.
697 */
Damien Miller95def091999-11-25 00:26:21 +1100698 va_start(args, fmt);
699 vsnprintf(buf, sizeof(buf), fmt, args);
700 va_end(args);
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000701
Damien Miller95def091999-11-25 00:26:21 +1100702 /* Send the disconnect message to the other side, and wait for it to get sent. */
703 packet_start(SSH_MSG_DISCONNECT);
704 packet_put_string(buf, strlen(buf));
705 packet_send();
706 packet_write_wait();
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000707
Damien Miller95def091999-11-25 00:26:21 +1100708 /* Stop listening for connections. */
709 channel_stop_listening();
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000710
Damien Miller95def091999-11-25 00:26:21 +1100711 /* Close the connection. */
712 packet_close();
713
714 /* Display the error locally and exit. */
Damien Milleraae6c611999-12-06 11:47:28 +1100715 log("Disconnecting: %.100s", buf);
716 fatal_cleanup();
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000717}
718
Damien Miller5428f641999-11-25 11:54:57 +1100719/* Checks if there is any buffered output, and tries to write some of the output. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000720
721void
722packet_write_poll()
723{
Damien Miller95def091999-11-25 00:26:21 +1100724 int len = buffer_len(&output);
725 if (len > 0) {
726 len = write(connection_out, buffer_ptr(&output), len);
727 if (len <= 0) {
728 if (errno == EAGAIN)
729 return;
730 else
731 fatal("Write failed: %.100s", strerror(errno));
732 }
733 buffer_consume(&output, len);
734 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000735}
736
Damien Miller5428f641999-11-25 11:54:57 +1100737/*
738 * Calls packet_write_poll repeatedly until all pending output data has been
739 * written.
740 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000741
742void
743packet_write_wait()
744{
Damien Miller95def091999-11-25 00:26:21 +1100745 packet_write_poll();
746 while (packet_have_data_to_write()) {
747 fd_set set;
748 FD_ZERO(&set);
749 FD_SET(connection_out, &set);
750 select(connection_out + 1, NULL, &set, NULL, NULL);
751 packet_write_poll();
752 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000753}
754
755/* Returns true if there is buffered data to write to the connection. */
756
757int
758packet_have_data_to_write()
759{
Damien Miller95def091999-11-25 00:26:21 +1100760 return buffer_len(&output) != 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000761}
762
763/* Returns true if there is not too much data to write to the connection. */
764
765int
766packet_not_very_much_data_to_write()
767{
Damien Miller95def091999-11-25 00:26:21 +1100768 if (interactive_mode)
769 return buffer_len(&output) < 16384;
770 else
771 return buffer_len(&output) < 128 * 1024;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000772}
773
774/* Informs that the current session is interactive. Sets IP flags for that. */
775
776void
777packet_set_interactive(int interactive, int keepalives)
778{
Damien Miller95def091999-11-25 00:26:21 +1100779 int on = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000780
Damien Miller95def091999-11-25 00:26:21 +1100781 /* Record that we are in interactive mode. */
782 interactive_mode = interactive;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000783
Damien Miller34132e52000-01-14 15:45:46 +1100784 /* Only set socket options if using a socket. */
785 if (!packet_connection_is_on_socket())
Damien Miller95def091999-11-25 00:26:21 +1100786 return;
Damien Miller95def091999-11-25 00:26:21 +1100787 if (keepalives) {
788 /* Set keepalives if requested. */
789 if (setsockopt(connection_in, SOL_SOCKET, SO_KEEPALIVE, (void *) &on,
Damien Miller34132e52000-01-14 15:45:46 +1100790 sizeof(on)) < 0)
Damien Miller95def091999-11-25 00:26:21 +1100791 error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
792 }
Damien Miller34132e52000-01-14 15:45:46 +1100793 /*
794 * IPTOS_LOWDELAY, TCP_NODELAY and IPTOS_THROUGHPUT are IPv4 only
795 */
796 if (!packet_connection_is_ipv4())
797 return;
Damien Miller95def091999-11-25 00:26:21 +1100798 if (interactive) {
Damien Miller5428f641999-11-25 11:54:57 +1100799 /*
800 * Set IP options for an interactive connection. Use
801 * IPTOS_LOWDELAY and TCP_NODELAY.
802 */
Damien Miller95def091999-11-25 00:26:21 +1100803 int lowdelay = IPTOS_LOWDELAY;
804 if (setsockopt(connection_in, IPPROTO_IP, IP_TOS, (void *) &lowdelay,
Damien Miller34132e52000-01-14 15:45:46 +1100805 sizeof(lowdelay)) < 0)
Damien Miller95def091999-11-25 00:26:21 +1100806 error("setsockopt IPTOS_LOWDELAY: %.100s", strerror(errno));
807 if (setsockopt(connection_in, IPPROTO_TCP, TCP_NODELAY, (void *) &on,
Damien Miller34132e52000-01-14 15:45:46 +1100808 sizeof(on)) < 0)
Damien Miller95def091999-11-25 00:26:21 +1100809 error("setsockopt TCP_NODELAY: %.100s", strerror(errno));
810 } else {
Damien Miller5428f641999-11-25 11:54:57 +1100811 /*
812 * Set IP options for a non-interactive connection. Use
813 * IPTOS_THROUGHPUT.
814 */
Damien Miller95def091999-11-25 00:26:21 +1100815 int throughput = IPTOS_THROUGHPUT;
816 if (setsockopt(connection_in, IPPROTO_IP, IP_TOS, (void *) &throughput,
Damien Miller34132e52000-01-14 15:45:46 +1100817 sizeof(throughput)) < 0)
Damien Miller95def091999-11-25 00:26:21 +1100818 error("setsockopt IPTOS_THROUGHPUT: %.100s", strerror(errno));
819 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000820}
821
822/* Returns true if the current connection is interactive. */
823
824int
825packet_is_interactive()
826{
Damien Miller95def091999-11-25 00:26:21 +1100827 return interactive_mode;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000828}
Damien Miller6162d121999-11-21 13:23:52 +1100829
830int
831packet_set_maxsize(int s)
832{
Damien Miller95def091999-11-25 00:26:21 +1100833 static int called = 0;
834 if (called) {
835 log("packet_set_maxsize: called twice: old %d new %d", max_packet_size, s);
836 return -1;
837 }
838 if (s < 4 * 1024 || s > 1024 * 1024) {
839 log("packet_set_maxsize: bad size %d", s);
840 return -1;
841 }
842 log("packet_set_maxsize: setting to %d", s);
843 max_packet_size = s;
844 return s;
Damien Miller6162d121999-11-21 13:23:52 +1100845}