Import of OpenSSH 5.2p1

[gssapi-openssh.git] / openssh / packet.c

diff --git a/openssh/packet.c b/openssh/packet.c
index 8abd43eb461946a1208b435a2abcf5c576283a43..5afc84ce0bc22715ae03d01f3131366c9f47817d 100644 (file)
--- a/openssh/packet.c
+++ b/openssh/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.157 2008/07/10 18:08:11 markus Exp $ */
+/* $OpenBSD: packet.c,v 1.160 2009/02/13 11:50:21 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -84,6 +84,8 @@
 #define DBG(x)
 #endif
 
+#define PACKET_MAX_SIZE (256 * 1024)
+
 /*
  * This variable contains the file descriptors used for communicating with
  * the other side.  connection_in is used for reading; connection_out for
@@ -160,6 +162,10 @@ static u_int ssh1_keylen;
 /* roundup current message to extra_pad bytes */
 static u_char extra_pad = 0;
 
+/* XXX discard incoming data after MAC error */
+static u_int packet_discard = 0;
+static Mac *packet_discard_mac = NULL;
+
 struct packet {
        TAILQ_ENTRY(packet) next;
        u_char type;
@@ -209,6 +215,36 @@ packet_set_timeout(int timeout, int count)
                packet_timeout_ms = timeout * count * 1000;
 }
 
+static void
+packet_stop_discard(void)
+{
+       if (packet_discard_mac) {
+               char buf[1024];
+               
+               memset(buf, 'a', sizeof(buf));
+               while (buffer_len(&incoming_packet) < PACKET_MAX_SIZE)
+                       buffer_append(&incoming_packet, buf, sizeof(buf));
+               (void) mac_compute(packet_discard_mac,
+                   p_read.seqnr,
+                   buffer_ptr(&incoming_packet),
+                   PACKET_MAX_SIZE);
+       }
+       logit("Finished discarding for %.200s", get_remote_ipaddr());
+       cleanup_exit(255);
+}
+
+static void
+packet_start_discard(Enc *enc, Mac *mac, u_int packet_length, u_int discard)
+{
+       if (enc == NULL || !cipher_is_cbc(enc->cipher))
+               packet_disconnect("Packet corrupt");
+       if (packet_length != PACKET_MAX_SIZE && mac && mac->enabled)
+               packet_discard_mac = mac;
+       if (buffer_len(&input) >= discard)
+               packet_stop_discard();
+       packet_discard = discard - buffer_len(&input);
+}
+
 /* Returns 1 if remote host is connected via socket, 0 if not. */
 
 int
@@ -1127,6 +1163,9 @@ packet_read_poll2(u_int32_t *seqnr_p)
        Mac *mac   = NULL;
        Comp *comp = NULL;
 
+       if (packet_discard)
+               return SSH_MSG_NONE;
+
        if (newkeys[MODE_IN] != NULL) {
                enc  = &newkeys[MODE_IN]->enc;
                mac  = &newkeys[MODE_IN]->mac;
@@ -1148,11 +1187,14 @@ packet_read_poll2(u_int32_t *seqnr_p)
                    block_size);
                cp = buffer_ptr(&incoming_packet);
                packet_length = get_u32(cp);
-               if (packet_length < 1 + 4 || packet_length > 256 * 1024) {
+               if (packet_length < 1 + 4 || packet_length > PACKET_MAX_SIZE) {
 #ifdef PACKET_DEBUG
                        buffer_dump(&incoming_packet);
 #endif
-                       packet_disconnect("Bad packet length %u.", packet_length);
+                       logit("Bad packet length %u.", packet_length);
+                       packet_start_discard(enc, mac, packet_length,
+                           PACKET_MAX_SIZE);
+                       return SSH_MSG_NONE;
                }
                DBG(debug("input: packet len %u", packet_length+4));
                buffer_consume(&input, block_size);
@@ -1161,9 +1203,13 @@ packet_read_poll2(u_int32_t *seqnr_p)
        need = 4 + packet_length - block_size;
        DBG(debug("partial packet %d, need %d, maclen %d", block_size,
            need, maclen));
-       if (need % block_size != 0)
-               fatal("padding error: need %d block %d mod %d",
+       if (need % block_size != 0) {
+               logit("padding error: need %d block %d mod %d",
                    need, block_size, need % block_size);
+               packet_start_discard(enc, mac, packet_length,
+                   PACKET_MAX_SIZE - block_size);
+               return SSH_MSG_NONE;
+       }
        /*
         * check if the entire packet has been received and
         * decrypt into incoming_packet
@@ -1185,11 +1231,19 @@ packet_read_poll2(u_int32_t *seqnr_p)
                macbuf = mac_compute(mac, p_read.seqnr,
                    buffer_ptr(&incoming_packet),
                    buffer_len(&incoming_packet));
-               if (memcmp(macbuf, buffer_ptr(&input), mac->mac_len) != 0)
-                       packet_disconnect("Corrupted MAC on input.");
+               if (memcmp(macbuf, buffer_ptr(&input), mac->mac_len) != 0) {
+                       logit("Corrupted MAC on input.");
+                       if (need > PACKET_MAX_SIZE)
+                               fatal("internal error need %d", need);
+                       packet_start_discard(enc, mac, packet_length,
+                           PACKET_MAX_SIZE - need);
+                       return SSH_MSG_NONE;
+               }
+                               
                DBG(debug("MAC #%d ok", p_read.seqnr));
                buffer_consume(&input, mac->mac_len);
        }
+       /* XXX now it's safe to use fatal/packet_disconnect */
        if (seqnr_p != NULL)
                *seqnr_p = p_read.seqnr;
        if (++p_read.seqnr == 0)
@@ -1322,6 +1376,13 @@ packet_read_poll(void)
 void
 packet_process_incoming(const char *buf, u_int len)
 {
+       if (packet_discard) {
+               keep_alive_timeouts = 0; /* ?? */
+               if (len >= packet_discard)
+                       packet_stop_discard();
+               packet_discard -= len;
+               return;
+       }
        buffer_append(&input, buf, len);
 }