*/
#include "includes.h"
-RCSID("$OpenBSD: packet.c,v 1.40 2000/12/19 23:17:57 markus Exp $");
+RCSID("$OpenBSD: packet.c,v 1.55 2001/03/01 02:45:10 deraadt Exp $");
#include "xmalloc.h"
#include "buffer.h"
#include "packet.h"
#include "bufaux.h"
-#include "ssh.h"
#include "crc32.h"
#include "getput.h"
#include "channels.h"
#include "compat.h"
+#include "ssh1.h"
#include "ssh2.h"
-#include <openssl/bn.h>
-#include <openssl/dh.h>
-#include <openssl/hmac.h>
-#include "buffer.h"
#include "cipher.h"
#include "kex.h"
-#include "hmac.h"
+#include "mac.h"
+#include "log.h"
+#include "canohost.h"
#ifdef PACKET_DEBUG
#define DBG(x) x
void
packet_start(int type)
{
- DBG(debug("packet_start[%d]",type));
+ DBG(debug("packet_start[%d]", type));
if (use_ssh2_packet_format)
packet_start2(type);
else
*/
void
-packet_send1()
+packet_send1(void)
{
char buf[8], *cp;
int i, padding, len;
* Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
*/
void
-packet_send2()
+packet_send2(void)
{
+ static u_int32_t seqnr = 0;
u_char *macbuf = NULL;
char *cp;
u_int packet_length = 0;
u_int i, padlen, len;
u_int32_t rand = 0;
- static u_int seqnr = 0;
int type;
Enc *enc = NULL;
Mac *mac = NULL;
if (i % 4 == 0)
rand = arc4random();
cp[i] = rand & 0xff;
- rand <<= 8;
+ rand >>= 8;
}
} else {
/* clear padding */
/* compute MAC over seqnr and packet(length fields, payload, padding) */
if (mac && mac->enabled) {
- macbuf = hmac( mac->md, seqnr,
+ macbuf = mac_compute(mac, seqnr,
(u_char *) buffer_ptr(&outgoing_packet),
- buffer_len(&outgoing_packet),
- mac->key, mac->key_len
- );
+ buffer_len(&outgoing_packet));
DBG(debug("done calc MAC out #%d", seqnr));
}
/* encrypt packet and append to output buffer. */
FD_SET(connection_in, &set);
/* Wait for some data to arrive. */
- select(connection_in + 1, &set, NULL, NULL, NULL);
+ while (select(connection_in + 1, &set, NULL, NULL, NULL) == -1 &&
+ (errno == EAGAIN || errno == EINTR))
+ ;
/* Read data from the socket. */
len = read(connection_in, buf, sizeof(buf));
int
packet_read_poll2(int *payload_len_ptr)
{
+ static u_int32_t seqnr = 0;
+ static u_int packet_length = 0;
u_int padlen, need;
u_char buf[8], *macbuf;
u_char *ucp;
char *cp;
- static u_int packet_length = 0;
- static u_int seqnr = 0;
int type;
int maclen, block_size;
Enc *enc = NULL;
* increment sequence number for incoming packet
*/
if (mac && mac->enabled) {
- macbuf = hmac( mac->md, seqnr,
+ macbuf = mac_compute(mac, seqnr,
(u_char *) buffer_ptr(&incoming_packet),
- buffer_len(&incoming_packet),
- mac->key, mac->key_len
- );
+ buffer_len(&incoming_packet));
if (memcmp(macbuf, buffer_ptr(&input), mac->mac_len) != 0)
packet_disconnect("Corrupted MAC on input.");
DBG(debug("MAC #%d ok", seqnr));
}
#ifdef PACKET_DEBUG
- fprintf(stderr, "read/plain[%d]:\r\n",type);
+ fprintf(stderr, "read/plain[%d]:\r\n", type);
buffer_dump(&incoming_packet);
#endif
return (u_char)type;
case SSH2_MSG_DISCONNECT:
reason = packet_get_int();
msg = packet_get_string(NULL);
- log("Received disconnect: %d: %.900s", reason, msg);
+ log("Received disconnect from %s: %d: %.400s", get_remote_ipaddr(),
+ reason, msg);
xfree(msg);
fatal_cleanup();
break;
default:
return type;
break;
- }
+ }
} else {
switch(type) {
case SSH_MSG_IGNORE:
break;
case SSH_MSG_DISCONNECT:
msg = packet_get_string(NULL);
- log("Received disconnect: %.900s", msg);
+ log("Received disconnect from %s: %.400s", get_remote_ipaddr(),
+ msg);
fatal_cleanup();
xfree(msg);
break;
DBG(debug("received packet type %d", type));
return type;
break;
- }
+ }
}
}
}
packet_write_poll();
while (packet_have_data_to_write()) {
fd_set set;
+
FD_ZERO(&set);
FD_SET(connection_out, &set);
- select(connection_out + 1, NULL, &set, NULL, NULL);
+ while (select(connection_out + 1, NULL, &set, NULL, NULL) == -1 &&
+ (errno == EAGAIN || errno == EINTR))
+ ;
packet_write_poll();
}
}
/* Informs that the current session is interactive. Sets IP flags for that. */
void
-packet_set_interactive(int interactive, int keepalives)
+packet_set_interactive(int interactive)
{
+ static int called = 0;
+#if defined(IP_TOS) && !defined(IP_TOS_IS_BROKEN)
+ int lowdelay = IPTOS_LOWDELAY;
+ int throughput = IPTOS_THROUGHPUT;
+#endif
int on = 1;
+ if (called)
+ return;
+ called = 1;
+
/* Record that we are in interactive mode. */
interactive_mode = interactive;
/* Only set socket options if using a socket. */
if (!packet_connection_is_on_socket())
return;
- if (keepalives) {
- /* Set keepalives if requested. */
- if (setsockopt(connection_in, SOL_SOCKET, SO_KEEPALIVE, (void *) &on,
- sizeof(on)) < 0)
- error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
- }
/*
- * IPTOS_LOWDELAY, TCP_NODELAY and IPTOS_THROUGHPUT are IPv4 only
+ * IPTOS_LOWDELAY and IPTOS_THROUGHPUT are IPv4 only
*/
- if (!packet_connection_is_ipv4())
- return;
if (interactive) {
/*
* Set IP options for an interactive connection. Use
* IPTOS_LOWDELAY and TCP_NODELAY.
*/
#if defined(IP_TOS) && !defined(IP_TOS_IS_BROKEN)
- int lowdelay = IPTOS_LOWDELAY;
- if (setsockopt(connection_in, IPPROTO_IP, IP_TOS, (void *) &lowdelay,
- sizeof(lowdelay)) < 0)
- error("setsockopt IPTOS_LOWDELAY: %.100s", strerror(errno));
+ if (packet_connection_is_ipv4()) {
+ if (setsockopt(connection_in, IPPROTO_IP, IP_TOS,
+ (void *) &lowdelay, sizeof(lowdelay)) < 0)
+ error("setsockopt IPTOS_LOWDELAY: %.100s",
+ strerror(errno));
+ }
#endif
if (setsockopt(connection_in, IPPROTO_TCP, TCP_NODELAY, (void *) &on,
sizeof(on)) < 0)
error("setsockopt TCP_NODELAY: %.100s", strerror(errno));
- } else {
+ } else if (packet_connection_is_ipv4()) {
/*
* Set IP options for a non-interactive connection. Use
* IPTOS_THROUGHPUT.
*/
#if defined(IP_TOS) && !defined(IP_TOS_IS_BROKEN)
- int throughput = IPTOS_THROUGHPUT;
if (setsockopt(connection_in, IPPROTO_IP, IP_TOS, (void *) &throughput,
sizeof(throughput)) < 0)
error("setsockopt IPTOS_THROUGHPUT: %.100s", strerror(errno));
max_packet_size = s;
return s;
}
+
+/*
+ * 9.2. Ignored Data Message
+ *
+ * byte SSH_MSG_IGNORE
+ * string data
+ *
+ * All implementations MUST understand (and ignore) this message at any
+ * time (after receiving the protocol version). No implementation is
+ * required to send them. This message can be used as an additional
+ * protection measure against advanced traffic analysis techniques.
+ */
+/* size of current + ignore message should be n*sumlen bytes (w/o mac) */
+void
+packet_inject_ignore(int sumlen)
+{
+ int blocksize, padlen, have, need, nb, mini, nbytes;
+ Enc *enc = NULL;
+
+ if (use_ssh2_packet_format == 0)
+ return;
+
+ have = buffer_len(&outgoing_packet);
+ debug2("packet_inject_ignore: current %d", have);
+ if (kex != NULL)
+ enc = &kex->enc[MODE_OUT];
+ blocksize = enc ? enc->cipher->block_size : 8;
+ padlen = blocksize - (have % blocksize);
+ if (padlen < 4)
+ padlen += blocksize;
+ have += padlen;
+ have /= blocksize; /* # of blocks for current message */
+
+ nb = roundup(sumlen, blocksize) / blocksize; /* blocks for both */
+ mini = roundup(5+1+4+4, blocksize) / blocksize; /* minsize ignore msg */
+ need = nb - (have % nb); /* blocks for ignore */
+ if (need <= mini)
+ need += nb;
+ nbytes = (need - mini) * blocksize; /* size of ignore payload */
+ debug2("packet_inject_ignore: block %d have %d nb %d mini %d need %d",
+ blocksize, have, nb, mini, need);
+
+ /* enqueue current message and append a ignore message */
+ packet_send();
+ packet_send_ignore(nbytes);
+}
+
+void
+packet_send_ignore(int nbytes)
+{
+ u_int32_t rand = 0;
+ int i;
+
+ packet_start(compat20 ? SSH2_MSG_IGNORE : SSH_MSG_IGNORE);
+ packet_put_int(nbytes);
+ for(i = 0; i < nbytes; i++) {
+ if (i % 4 == 0)
+ rand = arc4random();
+ packet_put_char(rand & 0xff);
+ rand >>= 8;
+ }
+}
andersk / openssh.git / blobdiff