release/src/router/dropbear/session.h

   1 /*
   2  * Dropbear - a SSH2 server
   3  *
   4  * Copyright (c) 2002,2003 Matt Johnston
   5  * All rights reserved.
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  20  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  23  * SOFTWARE. */
  24
  25 #ifndef _SESSION_H_
  26 #define _SESSION_H_
  27
  28 #include "includes.h"
  29 #include "options.h"
  30 #include "buffer.h"
  31 #include "signkey.h"
  32 #include "kex.h"
  33 #include "auth.h"
  34 #include "channel.h"
  35 #include "queue.h"
  36 #include "listener.h"
  37 #include "packet.h"
  38 #include "tcpfwd.h"
  39 #include "chansession.h"
  40 #include "dbutil.h"
  41
  42 extern int sessinitdone; /* Is set to 0 somewhere */
  43 extern int exitflag;
  44
  45 void common_session_init(int sock_in, int sock_out);
  46 void session_loop(void(*loophandler)());
  47 void common_session_cleanup();
  48 void session_identification();
  49 void send_msg_ignore();
  50
  51 const char* get_user_shell();
  52 void fill_passwd(const char* username);
  53
  54 /* Server */
  55 void svr_session(int sock, int childpipe);
  56 void svr_dropbear_exit(int exitcode, const char* format, va_list param) ATTRIB_NORETURN;
  57 void svr_dropbear_log(int priority, const char* format, va_list param);
  58
  59 /* Client */
  60 void cli_session(int sock_in, int sock_out);
  61 void cli_session_cleanup();
  62 void cleantext(unsigned char* dirtytext);
  63
  64 /* crypto parameters that are stored individually for transmit and receive */
  65 struct key_context_directional {
  66         const struct dropbear_cipher *algo_crypt; /* NULL for none */
  67         const struct dropbear_cipher_mode *crypt_mode;
  68         const struct dropbear_hash *algo_mac; /* NULL for none */
  69         int hash_index; /* lookup for libtomcrypt */
  70         char algo_comp; /* compression */
  71 #ifndef DISABLE_ZLIB
  72         z_streamp zstream;
  73 #endif
  74         /* actual keys */
  75         union {
  76                 symmetric_CBC cbc;
  77 #ifdef DROPBEAR_ENABLE_CTR_MODE
  78                 symmetric_CTR ctr;
  79 #endif
  80         } cipher_state;
  81         unsigned char mackey[MAX_MAC_KEY];
  82 };
  83
  84 struct key_context {
  85
  86         struct key_context_directional recv;
  87         struct key_context_directional trans;
  88
  89         char algo_kex;
  90         char algo_hostkey;
  91
  92         int allow_compress; /* whether compression has started (useful in
  93                                                         zlib@openssh.com delayed compression case) */
  94 };
  95
  96 struct packetlist;
  97 struct packetlist {
  98         struct packetlist *next;
  99         buffer * payload;
 100 };
 101
 102 struct sshsession {
 103
 104         /* Is it a client or server? */
 105         unsigned char isserver;
 106
 107         time_t connect_time; /* time the connection was established
 108                                                         (cleared after auth once we're not
 109                                                         respecting AUTH_TIMEOUT any more) */
 110
 111         int sock_in;
 112         int sock_out;
 113
 114         unsigned char *remoteident;
 115
 116         int maxfd; /* the maximum file descriptor to check with select() */
 117
 118
 119         /* Packet buffers/values etc */
 120         buffer *writepayload; /* Unencrypted payload to write - this is used
 121                                                          throughout the code, as handlers fill out this
 122                                                          buffer with the packet to send. */
 123         struct Queue writequeue; /* A queue of encrypted packets to send */
 124         buffer *readbuf; /* From the wire, decrypted in-place */
 125         buffer *payload; /* Post-decompression, the actual SSH packet */
 126         unsigned int transseq, recvseq; /* Sequence IDs */
 127
 128         /* Packet-handling flags */
 129         const packettype * packettypes; /* Packet handler mappings for this
 130                                                                                 session, see process-packet.c */
 131
 132         unsigned dataallowed : 1; /* whether we can send data packets or we are in
 133                                                                  the middle of a KEX or something */
 134
 135         unsigned char requirenext; /* byte indicating what packet we require next,
 136                                                                 or 0x00 for any */
 137
 138         unsigned char ignorenext; /* whether to ignore the next packet,
 139                                                                  used for kex_follows stuff */
 140
 141         unsigned char lastpacket; /* What the last received packet type was */
 142
 143         int signal_pipe[2]; /* stores endpoints of a self-pipe used for
 144                                                    race-free signal handling */
 145
 146         time_t last_trx_packet_time; /* time of the last packet transmission, for
 147                                                         keepalive purposes */
 148
 149         time_t last_packet_time; /* time of the last packet transmission or receive, for
 150                                                                 idle timeout purposes */
 151
 152
 153         /* KEX/encryption related */
 154         struct KEXState kexstate;
 155         struct key_context *keys;
 156         struct key_context *newkeys;
 157         unsigned char *session_id; /* this is the hash from the first kex */
 158         /* The below are used temorarily during kex, are freed after use */
 159         mp_int * dh_K; /* SSH_MSG_KEXDH_REPLY and sending SSH_MSH_NEWKEYS */
 160         unsigned char hash[SHA1_HASH_SIZE]; /* the hash*/
 161         buffer* kexhashbuf; /* session hash buffer calculated from various packets*/
 162         buffer* transkexinit; /* the kexinit packet we send should be kept so we
 163                                                          can add it to the hash when generating keys */
 164
 165         /* Enables/disables compression */
 166         algo_type *compress_algos;
 167
 168         /* a list of queued replies that should be sent after a KEX has
 169            concluded (ie, while dataallowed was unset)*/
 170         struct packetlist *reply_queue_head, *reply_queue_tail;
 171
 172         algo_type*(*buf_match_algo)(buffer*buf, algo_type localalgos[],
 173                         int *goodguess); /* The function to use to choose which algorithm
 174                                                                 to use from the ones presented by the remote
 175                                                                 side. Is specific to the client/server mode,
 176                                                                 hence the function-pointer callback.*/
 177
 178         void(*remoteclosed)(); /* A callback to handle closure of the
 179                                                                           remote connection */
 180
 181
 182         struct AuthState authstate; /* Common amongst client and server, since most
 183                                                                    struct elements are common */
 184
 185         /* Channel related */
 186         struct Channel ** channels; /* these pointers may be null */
 187         unsigned int chansize; /* the number of Channel*s allocated for channels */
 188         unsigned int chancount; /* the number of Channel*s in use */
 189         const struct ChanType **chantypes; /* The valid channel types */
 190
 191
 192         /* TCP forwarding - where manage listeners */
 193         struct Listener ** listeners;
 194         unsigned int listensize;
 195
 196         /* Whether to allow binding to privileged ports (<1024). This doesn't
 197          * really belong here, but nowhere else fits nicely */
 198         int allowprivport;
 199
 200 };
 201
 202 struct serversession {
 203
 204         /* Server specific options */
 205         int childpipe; /* kept open until we successfully authenticate */
 206         /* userauth */
 207
 208         struct ChildPid * childpids; /* array of mappings childpid<->channel */
 209         unsigned int childpidsize;
 210
 211         /* Used to avoid a race in the exit returncode handling - see
 212          * svr-chansession.c for details */
 213         struct exitinfo lastexit;
 214
 215         /* The numeric address they connected from, used for logging */
 216         char * addrstring;
 217
 218         /* The resolved remote address, used for lastlog etc */
 219         char *remotehost;
 220
 221 #ifdef __uClinux__
 222         pid_t server_pid;
 223 #endif
 224
 225 };
 226
 227 typedef enum {
 228         KEX_NOTHING,
 229         KEXINIT_RCVD,
 230         KEXDH_INIT_SENT,
 231         KEXDONE
 232 } cli_kex_state;
 233
 234 typedef enum {
 235         STATE_NOTHING,
 236         SERVICE_AUTH_REQ_SENT,
 237         SERVICE_AUTH_ACCEPT_RCVD,
 238         SERVICE_CONN_REQ_SENT,
 239         SERVICE_CONN_ACCEPT_RCVD,
 240         USERAUTH_REQ_SENT,
 241         USERAUTH_FAIL_RCVD,
 242         USERAUTH_SUCCESS_RCVD,
 243         SESSION_RUNNING
 244 } cli_state;
 245
 246 struct clientsession {
 247
 248         mp_int *dh_e, *dh_x; /* Used during KEX */
 249         cli_kex_state kex_state; /* Used for progressing KEX */
 250         cli_state state; /* Used to progress auth/channelsession etc */
 251         unsigned donefirstkex : 1; /* Set when we set sentnewkeys, never reset */
 252
 253         int tty_raw_mode; /* Whether we're in raw mode (and have to clean up) */
 254         struct termios saved_tio;
 255         int stdincopy;
 256         int stdinflags;
 257         int stdoutcopy;
 258         int stdoutflags;
 259         int stderrcopy;
 260         int stderrflags;
 261
 262         int winchange; /* Set to 1 when a windowchange signal happens */
 263
 264         int lastauthtype; /* either AUTH_TYPE_PUBKEY or AUTH_TYPE_PASSWORD,
 265                                                  for the last type of auth we tried */
 266 #ifdef ENABLE_CLI_INTERACT_AUTH
 267         int auth_interact_failed; /* flag whether interactive auth can still
 268                                                                  be used */
 269         int interact_request_received; /* flag whether we've received an
 270                                                                           info request from the server for
 271                                                                           interactive auth.*/
 272 #endif
 273         sign_key *lastprivkey;
 274
 275         int retval; /* What the command exit status was - we emulate it */
 276 #if 0
 277         TODO
 278         struct AgentkeyList *agentkeys; /* Keys to use for public-key auth */
 279 #endif
 280
 281 };
 282
 283 /* Global structs storing the state */
 284 extern struct sshsession ses;
 285
 286 #ifdef DROPBEAR_SERVER
 287 extern struct serversession svr_ses;
 288 #endif /* DROPBEAR_SERVER */
 289
 290 #ifdef DROPBEAR_CLIENT
 291 extern struct clientsession cli_ses;
 292 #endif /* DROPBEAR_CLIENT */
 293
 294 #endif /* _SESSION_H_ */