+void
+set_newkeys(int mode)
+{
+ Enc *enc;
+ Mac *mac;
+ Comp *comp;
+ CipherContext *cc;
+ u_int64_t *max_blocks;
+ int encrypt;
+
+ debug2("set_newkeys: mode %d", mode);
+
+ if (mode == MODE_OUT) {
+ cc = &send_context;
+ encrypt = CIPHER_ENCRYPT;
+ p_send.packets = p_send.blocks = 0;
+ max_blocks = &max_blocks_out;
+ } else {
+ cc = &receive_context;
+ encrypt = CIPHER_DECRYPT;
+ p_read.packets = p_read.blocks = 0;
+ max_blocks = &max_blocks_in;
+ }
+ if (newkeys[mode] != NULL) {
+ debug("set_newkeys: rekeying");
+ cipher_cleanup(cc);
+ enc = &newkeys[mode]->enc;
+ mac = &newkeys[mode]->mac;
+ comp = &newkeys[mode]->comp;
+ memset(mac->key, 0, mac->key_len);
+ xfree(enc->name);
+ xfree(enc->iv);
+ xfree(enc->key);
+ xfree(mac->name);
+ xfree(mac->key);
+ xfree(comp->name);
+ xfree(newkeys[mode]);
+ }
+ newkeys[mode] = kex_get_newkeys(mode);
+ if (newkeys[mode] == NULL)
+ fatal("newkeys: no keys for mode %d", mode);
+ enc = &newkeys[mode]->enc;
+ mac = &newkeys[mode]->mac;
+ comp = &newkeys[mode]->comp;
+ if (mac->md != NULL)
+ mac->enabled = 1;
+ DBG(debug("cipher_init_context: %d", mode));
+ cipher_init(cc, enc->cipher, enc->key, enc->key_len,
+ enc->iv, enc->block_size, encrypt);
+ /* Deleting the keys does not gain extra security */
+ /* memset(enc->iv, 0, enc->block_size);
+ memset(enc->key, 0, enc->key_len); */
+ if (comp->type != 0 && comp->enabled == 0) {
+ packet_init_compression();
+ if (mode == MODE_OUT)
+ buffer_compress_init_send(6);
+ else
+ buffer_compress_init_recv();
+ comp->enabled = 1;
+ }
+ *max_blocks = ((u_int64_t)1 << (enc->block_size*2));
+ if (rekey_limit)
+ *max_blocks = MIN(*max_blocks, rekey_limit / enc->block_size);
+}
+
+/*
+ * Finalize packet in SSH2 format (compress, mac, encrypt, enqueue)
+ */
+static void
+packet_send2_wrapped(void)
+{
+ u_char type, *cp, *macbuf = NULL;
+ u_char padlen, pad;
+ u_int packet_length = 0;
+ u_int i, len;
+ u_int32_t rand = 0;
+ Enc *enc = NULL;
+ Mac *mac = NULL;
+ Comp *comp = NULL;
+ int block_size;
+
+ if (newkeys[MODE_OUT] != NULL) {
+ enc = &newkeys[MODE_OUT]->enc;
+ mac = &newkeys[MODE_OUT]->mac;
+ comp = &newkeys[MODE_OUT]->comp;
+ }
+ block_size = enc ? enc->block_size : 8;
+
+ cp = buffer_ptr(&outgoing_packet);
+ type = cp[5];
+
+#ifdef PACKET_DEBUG
+ fprintf(stderr, "plain: ");
+ buffer_dump(&outgoing_packet);
+#endif
+
+ if (comp && comp->enabled) {
+ len = buffer_len(&outgoing_packet);
+ /* skip header, compress only payload */
+ buffer_consume(&outgoing_packet, 5);
+ buffer_clear(&compression_buffer);
+ buffer_compress(&outgoing_packet, &compression_buffer);
+ buffer_clear(&outgoing_packet);
+ buffer_append(&outgoing_packet, "\0\0\0\0\0", 5);
+ buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
+ buffer_len(&compression_buffer));
+ DBG(debug("compression: raw %d compressed %d", len,
+ buffer_len(&outgoing_packet)));
+ }
+
+ /* sizeof (packet_len + pad_len + payload) */
+ len = buffer_len(&outgoing_packet);
+
+ /*
+ * calc size of padding, alloc space, get random data,
+ * minimum padding is 4 bytes
+ */
+ padlen = block_size - (len % block_size);
+ if (padlen < 4)
+ padlen += block_size;
+ if (extra_pad) {
+ /* will wrap if extra_pad+padlen > 255 */
+ extra_pad = roundup(extra_pad, block_size);
+ pad = extra_pad - ((len + padlen) % extra_pad);
+ debug3("packet_send2: adding %d (len %d padlen %d extra_pad %d)",
+ pad, len, padlen, extra_pad);
+ padlen += pad;
+ extra_pad = 0;
+ }
+ cp = buffer_append_space(&outgoing_packet, padlen);
+ if (enc && !send_context.plaintext) {
+ /* random padding */
+ for (i = 0; i < padlen; i++) {
+ if (i % 4 == 0)
+ rand = arc4random();
+ cp[i] = rand & 0xff;
+ rand >>= 8;
+ }
+ } else {
+ /* clear padding */
+ memset(cp, 0, padlen);
+ }
+ /* packet_length includes payload, padding and padding length field */
+ packet_length = buffer_len(&outgoing_packet) - 4;
+ cp = buffer_ptr(&outgoing_packet);
+ PUT_32BIT(cp, packet_length);
+ cp[4] = padlen;
+ DBG(debug("send: len %d (includes padlen %d)", packet_length+4, padlen));
+
+ /* compute MAC over seqnr and packet(length fields, payload, padding) */
+ if (mac && mac->enabled) {
+ macbuf = mac_compute(mac, p_send.seqnr,
+ buffer_ptr(&outgoing_packet),
+ buffer_len(&outgoing_packet));
+ DBG(debug("done calc MAC out #%d", p_send.seqnr));
+ }
+ /* encrypt packet and append to output buffer. */
+ cp = buffer_append_space(&output, buffer_len(&outgoing_packet));
+ cipher_crypt(&send_context, cp, buffer_ptr(&outgoing_packet),
+ buffer_len(&outgoing_packet));
+ /* append unencrypted MAC */
+ if (mac && mac->enabled)
+ buffer_append(&output, (char *)macbuf, mac->mac_len);
+#ifdef PACKET_DEBUG
+ fprintf(stderr, "encrypted: ");
+ buffer_dump(&output);
+#endif
+ /* increment sequence number for outgoing packets */
+ if (++p_send.seqnr == 0)
+ logit("outgoing seqnr wraps around");
+ if (++p_send.packets == 0)
+ if (!(datafellows & SSH_BUG_NOREKEY))
+ fatal("XXX too many packets with same key");
+ p_send.blocks += (packet_length + 4) / block_size;
+ buffer_clear(&outgoing_packet);
+
+ if (type == SSH2_MSG_NEWKEYS)
+ set_newkeys(MODE_OUT);
+}
+
+static void
+packet_send2(void)
+{
+ static int rekeying = 0;
+ struct packet *p;
+ u_char type, *cp;
+
+ cp = buffer_ptr(&outgoing_packet);
+ type = cp[5];
+
+ /* during rekeying we can only send key exchange messages */
+ if (rekeying) {
+ if (!((type >= SSH2_MSG_TRANSPORT_MIN) &&
+ (type <= SSH2_MSG_TRANSPORT_MAX))) {
+ debug("enqueue packet: %u", type);
+ p = xmalloc(sizeof(*p));
+ p->type = type;
+ memcpy(&p->payload, &outgoing_packet, sizeof(Buffer));
+ buffer_init(&outgoing_packet);
+ TAILQ_INSERT_TAIL(&outgoing, p, next);
+ return;
+ }
+ }
+
+ /* rekeying starts with sending KEXINIT */
+ if (type == SSH2_MSG_KEXINIT)
+ rekeying = 1;
+
+ packet_send2_wrapped();
+
+ /* after a NEWKEYS message we can send the complete queue */
+ if (type == SSH2_MSG_NEWKEYS) {
+ rekeying = 0;
+ while ((p = TAILQ_FIRST(&outgoing))) {
+ type = p->type;
+ debug("dequeue packet: %u", type);
+ buffer_free(&outgoing_packet);
+ memcpy(&outgoing_packet, &p->payload,
+ sizeof(Buffer));
+ TAILQ_REMOVE(&outgoing, p, next);
+ xfree(p);
+ packet_send2_wrapped();
+ }
+ }
+}
+
+void
+packet_send(void)
+{
+ if (compat20)
+ packet_send2();
+ else
+ packet_send1();
+ DBG(debug("packet_send done"));
+}
+