release/src/router/dropbear/process-packet.c

   1 /*
   2  * Dropbear - a SSH2 server
   3  *
   4  * Copyright (c) 2002-2004 Matt Johnston
   5  * All rights reserved.
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  20  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  23  * SOFTWARE. */
  24
  25 #include "includes.h"
  26 #include "packet.h"
  27 #include "session.h"
  28 #include "dbutil.h"
  29 #include "ssh.h"
  30 #include "algo.h"
  31 #include "buffer.h"
  32 #include "kex.h"
  33 #include "dbrandom.h"
  34 #include "service.h"
  35 #include "auth.h"
  36 #include "channel.h"
  37
  38 #define MAX_UNAUTH_PACKET_TYPE SSH_MSG_USERAUTH_PK_OK
  39
  40 static void recv_unimplemented(void);
  41
  42 /* process a decrypted packet, call the appropriate handler */
  43 void process_packet() {
  44
  45         unsigned char type;
  46         unsigned int i;
  47         time_t now;
  48
  49         TRACE2(("enter process_packet"))
  50
  51         type = buf_getbyte(ses.payload);
  52         TRACE(("process_packet: packet type = %d,  len %d", type, ses.payload->len))
  53
  54         ses.lastpacket = type;
  55
  56         now = monotonic_now();
  57         ses.last_packet_time_keepalive_recv = now;
  58
  59         /* These packets we can receive at any time */
  60         switch(type) {
  61
  62                 case SSH_MSG_IGNORE:
  63                         goto out;
  64                 case SSH_MSG_DEBUG:
  65                         goto out;
  66
  67                 case SSH_MSG_UNIMPLEMENTED:
  68                         /* debugging XXX */
  69                         TRACE(("SSH_MSG_UNIMPLEMENTED"))
  70                         goto out;
  71
  72                 case SSH_MSG_DISCONNECT:
  73                         /* TODO cleanup? */
  74                         dropbear_close("Disconnect received");
  75         }
  76
  77         /* Ignore these packet types so that keepalives don't interfere with
  78         idle detection. This is slightly incorrect since a tcp forwarded
  79         global request with failure won't trigger the idle timeout,
  80         but that's probably acceptable */
  81         if (!(type == SSH_MSG_GLOBAL_REQUEST || type == SSH_MSG_REQUEST_FAILURE)) {
  82                 ses.last_packet_time_idle = now;
  83         }
  84
  85         /* This applies for KEX, where the spec says the next packet MUST be
  86          * NEWKEYS */
  87         if (ses.requirenext != 0) {
  88                 if (ses.requirenext == type)
  89                 {
  90                         /* Got what we expected */
  91                         TRACE(("got expected packet %d during kexinit", type))
  92                 }
  93                 else
  94                 {
  95                         /* RFC4253 7.1 - various messages are allowed at this point.
  96                         The only ones we know about have already been handled though,
  97                         so just return "unimplemented" */
  98                         if (type >= 1 && type <= 49
  99                                 && type != SSH_MSG_SERVICE_REQUEST
 100                                 && type != SSH_MSG_SERVICE_ACCEPT
 101                                 && type != SSH_MSG_KEXINIT)
 102                         {
 103                                 TRACE(("unknown allowed packet during kexinit"))
 104                                 recv_unimplemented();
 105                                 goto out;
 106                         }
 107                         else
 108                         {
 109                                 TRACE(("disallowed packet during kexinit"))
 110                                 dropbear_exit("Unexpected packet type %d, expected %d", type,
 111                                                 ses.requirenext);
 112                         }
 113                 }
 114         }
 115
 116         /* Check if we should ignore this packet. Used currently only for
 117          * KEX code, with first_kex_packet_follows */
 118         if (ses.ignorenext) {
 119                 TRACE(("Ignoring packet, type = %d", type))
 120                 ses.ignorenext = 0;
 121                 goto out;
 122         }
 123
 124         /* Only clear the flag after we have checked ignorenext */
 125         if (ses.requirenext != 0 && ses.requirenext == type)
 126         {
 127                 ses.requirenext = 0;
 128         }
 129
 130
 131         /* Kindly the protocol authors gave all the preauth packets type values
 132          * less-than-or-equal-to 60 ( == MAX_UNAUTH_PACKET_TYPE ).
 133          * NOTE: if the protocol changes and new types are added, revisit this
 134          * assumption */
 135         if ( !ses.authstate.authdone && type > MAX_UNAUTH_PACKET_TYPE ) {
 136                 dropbear_exit("Received message %d before userauth", type);
 137         }
 138
 139         for (i = 0; ; i++) {
 140                 if (ses.packettypes[i].type == 0) {
 141                         /* end of list */
 142                         break;
 143                 }
 144
 145                 if (ses.packettypes[i].type == type) {
 146                         ses.packettypes[i].handler();
 147                         goto out;
 148                 }
 149         }
 150
 151
 152         /* TODO do something more here? */
 153         TRACE(("preauth unknown packet"))
 154         recv_unimplemented();
 155
 156 out:
 157         buf_free(ses.payload);
 158         ses.payload = NULL;
 159
 160         TRACE2(("leave process_packet"))
 161 }
 162
 163
 164
 165 /* This must be called directly after receiving the unimplemented packet.
 166  * Isn't the most clean implementation, it relies on packet processing
 167  * occurring directly after decryption (direct use of ses.recvseq).
 168  * This is reasonably valid, since there is only a single decryption buffer */
 169 static void recv_unimplemented() {
 170
 171         CHECKCLEARTOWRITE();
 172
 173         buf_putbyte(ses.writepayload, SSH_MSG_UNIMPLEMENTED);
 174         /* the decryption routine increments the sequence number, we must
 175          * decrement */
 176         buf_putint(ses.writepayload, ses.recvseq - 1);
 177
 178         encrypt_packet();
 179 }