| blob | 5a36ebd2e5fe61c1527f2c4ed77c8511b0e20028 |
1 /* packet-ssh.c
2 * Routines for ssh packet dissection
3 *
4 * Huagang XIE <huagang@intruvert.com>
5 * Kees Cook <kees@outflux.net>
6 *
7 * Wireshark - Network traffic analyzer
8 * By Gerald Combs <gerald@wireshark.org>
9 * Copyright 1998 Gerald Combs
10 *
11 * Copied from packet-mysql.c
12 *
13 * SPDX-License-Identifier: GPL-2.0-or-later
14 *
15 *
16 * Note: support SSH v1 and v2 now.
17 *
18 */
20 /* SSH version 2 is defined in:
21 *
22 * RFC 4250: The Secure Shell (SSH) Protocol Assigned Numbers
23 * RFC 4251: The Secure Shell (SSH) Protocol Architecture
24 * RFC 4252: The Secure Shell (SSH) Authentication Protocol
25 * RFC 4253: The Secure Shell (SSH) Transport Layer Protocol
26 * RFC 4254: The Secure Shell (SSH) Connection Protocol
27 *
28 * SSH versions under 2 were never officially standardized.
29 *
30 * Diffie-Hellman Group Exchange is defined in:
31 *
32 * RFC 4419: Diffie-Hellman Group Exchange for
33 * the Secure Shell (SSH) Transport Layer Protocol
34 */
36 /* "SSH" prefixes are for version 2, whereas "SSH1" is for version 1 */
39 /* Start with WIRESHARK_LOG_DOMAINS=packet-ssh and WIRESHARK_LOG_LEVEL=debug to see messages. */
42 // Define this to get hex dumps more similar to what you get in openssh. If not defined, dumps look more like what you get with other dissectors.
43 #define OPENSSH_STYLE
45 #include <errno.h>
47 #include <epan/packet.h>
48 #include <epan/exceptions.h>
49 #include <epan/sctpppids.h>
50 #include <epan/prefs.h>
51 #include <epan/expert.h>
52 #include <epan/proto_data.h>
53 #include <wsutil/strtoi.h>
54 #include <wsutil/to_str.h>
55 #include <wsutil/file_util.h>
56 #include <wsutil/filesystem.h>
57 #include <wsutil/wsgcrypt.h>
58 #include <wsutil/curve25519.h>
59 #include <wsutil/pint.h>
60 #include <wsutil/str_util.h>
61 #include <wsutil/wslog.h>
62 #include <epan/secrets.h>
63 #include <wiretap/secrets-types.h>
65 #if defined(HAVE_LIBGNUTLS)
66 #include <gnutls/abstract.h>
67 #endif
74 /* SSH Version 1 definition , from openssh ssh1.h */
82 #define SSH_VERSION_UNKNOWN 0
83 #define SSH_VERSION_1 1
84 #define SSH_VERSION_2 2
86 /* proto data */
93 #define SSH_KEX_CURVE25519 0x00010000
94 #define SSH_KEX_DH_GEX 0x00020000
95 #define SSH_KEX_DH_GROUP1 0x00030001
96 #define SSH_KEX_DH_GROUP14 0x00030014
97 #define SSH_KEX_DH_GROUP16 0x00030016
98 #define SSH_KEX_DH_GROUP18 0x00030018
100 #define SSH_KEX_HASH_SHA1 1
101 #define SSH_KEX_HASH_SHA256 2
102 #define SSH_KEX_HASH_SHA512 4
104 #define DIGEST_MAX_SIZE 48
111 (there can be multiple records in a frame). */
127 dissector_handle_t handle;
142 /* For all subsequent proposals,
143 [0] is client-to-server and [1] is server-to-client. */
144 #define CLIENT_TO_SERVER_PROPOSAL 0
145 #define SERVER_TO_CLIENT_PROPOSAL 1
159 // see libgcrypt source, gcrypt.h:gcry_cipher_algos
162 // chacha20 needs two cipher handles
166 // union ??? -- begin
171 // --
174 // --
177 // union ??? -- end
187 };
197 /* [0] is client's, [1] is server's */
198 #define CLIENT_PEER_DATA 0
199 #define SERVER_PEER_DATA 1
221 };
232 /* Version exchange */
235 /* Framing */
247 /* Message codes */
255 /* Algorithm negotiation */
284 /* Key exchange common elements */
308 /* Key exchange: Diffie-Hellman */
312 /* Key exchange: Diffie-Hellman Group Exchange */
319 /* Key exchange: Elliptic Curve Diffie-Hellman */
325 /* Extension negotiation */
340 /* Miscellaneous */
463 "Segments"
464 };
466 #define SSH_DECRYPT_DEBUG
468 #ifdef SSH_DECRYPT_DEBUG
470 #endif
473 #define SCTP_PORT_SSH 22
475 /* Message Numbers (from RFC 4250) (1-255) */
477 /* Transport layer protocol: generic (1-19) */
478 #define SSH_MSG_DISCONNECT 1
479 #define SSH_MSG_IGNORE 2
480 #define SSH_MSG_UNIMPLEMENTED 3
481 #define SSH_MSG_DEBUG 4
482 #define SSH_MSG_SERVICE_REQUEST 5
483 #define SSH_MSG_SERVICE_ACCEPT 6
484 #define SSH_MSG_EXT_INFO 7
485 #define SSH_MSG_NEWCOMPRESS 8
487 /* Transport layer protocol: Algorithm negotiation (20-29) */
488 #define SSH_MSG_KEXINIT 20
489 #define SSH_MSG_NEWKEYS 21
491 /* Transport layer: Key exchange method specific (reusable) (30-49) */
492 #define SSH_MSG_KEXDH_INIT 30
493 #define SSH_MSG_KEXDH_REPLY 31
495 #define SSH_MSG_KEX_DH_GEX_REQUEST_OLD 30
496 #define SSH_MSG_KEX_DH_GEX_GROUP 31
497 #define SSH_MSG_KEX_DH_GEX_INIT 32
498 #define SSH_MSG_KEX_DH_GEX_REPLY 33
499 #define SSH_MSG_KEX_DH_GEX_REQUEST 34
501 #define SSH_MSG_KEX_ECDH_INIT 30
502 #define SSH_MSG_KEX_ECDH_REPLY 31
504 /* User authentication protocol: generic (50-59) */
505 #define SSH_MSG_USERAUTH_REQUEST 50
506 #define SSH_MSG_USERAUTH_FAILURE 51
507 #define SSH_MSG_USERAUTH_SUCCESS 52
508 #define SSH_MSG_USERAUTH_BANNER 53
510 /* User authentication protocol: method specific (reusable) (50-79) */
511 #define SSH_MSG_USERAUTH_PK_OK 60
513 /* Connection protocol: generic (80-89) */
514 #define SSH_MSG_GLOBAL_REQUEST 80
515 #define SSH_MSG_REQUEST_SUCCESS 81
516 #define SSH_MSG_REQUEST_FAILURE 82
518 /* Connection protocol: channel related messages (90-127) */
519 #define SSH_MSG_CHANNEL_OPEN 90
520 #define SSH_MSG_CHANNEL_OPEN_CONFIRMATION 91
521 #define SSH_MSG_CHANNEL_OPEN_FAILURE 92
522 #define SSH_MSG_CHANNEL_WINDOW_ADJUST 93
523 #define SSH_MSG_CHANNEL_DATA 94
524 #define SSH_MSG_CHANNEL_EXTENDED_DATA 95
525 #define SSH_MSG_CHANNEL_EOF 96
526 #define SSH_MSG_CHANNEL_CLOSE 97
527 #define SSH_MSG_CHANNEL_REQUEST 98
528 #define SSH_MSG_CHANNEL_SUCCESS 99
529 #define SSH_MSG_CHANNEL_FAILURE 100
531 /* 128-191 reserved for client protocols */
532 /* 192-255 local extensions */
533 #define SSH_MSG_PING 192
534 #define SSH_MSG_PONG 193
536 #define CIPHER_AES128_CTR 0x00010001
537 #define CIPHER_AES192_CTR 0x00010003
538 #define CIPHER_AES256_CTR 0x00010004
539 #define CIPHER_AES128_CBC 0x00020001
540 #define CIPHER_AES192_CBC 0x00020002
541 #define CIPHER_AES256_CBC 0x00020004
542 #define CIPHER_AES128_GCM 0x00040001
543 //#define CIPHER_AES192_GCM 0x00040002 -- does not exist
544 #define CIPHER_AES256_GCM 0x00040004
546 #define CIPHER_MAC_SHA2_256 0x00020001
552 };
585 };
591 };
600 };
606 };
612 };
621 };
623 static int ssh_dissect_key_init(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *tree,
673 static ssh_bignum *ssh_kex_shared_secret(int kex_type, ssh_bignum *pub, ssh_bignum *priv, ssh_bignum *modulo);
699 static proto_item * ssh_tree_add_mac(proto_tree *tree, tvbuff_t *tvb, const unsigned offset, const unsigned mac_len,
726 static void create_channel(struct ssh_peer_data *peer_data, uint32_t recipient_channel, uint32_t sender_channel);
727 static ssh_channel_info_t* get_channel_info_for_channel(struct ssh_peer_data *peer_data, uint32_t recipient_channel);
728 static void set_subdissector_for_channel(struct ssh_peer_data *peer_data, uint32_t recipient_channel, const uint8_t* subsystem_name);
732 #ifdef SSH_DECRYPT_DEBUG
733 static void
735 static void
737 static void
739 static void
741 #else
743 /* No debug: nullify debug operation*/
746 {
747 }
748 #define ssh_print_data(a, b, c)
749 #define ssh_print_string(a, b)
750 #define ssh_set_debug(name)
751 #define ssh_debug_flush()
755 static int
757 {
764 need_desegmentation;
770 ssh_debug_printf("\ndissect_ssh enter frame #%u (%s)\n", pinfo->num, (pinfo->fd->visited)?"already visited":"first time");
820 }
840 }
861 global_data,
868 }
888 }
889 }
894 /* XXX - add an expert info in the function
895 that decrements offset */
897 }
898 }
901 ti = proto_tree_add_boolean_format_value(ssh_tree, hf_ssh_direction, tvb, 0, 0, is_response, "%s",
908 }
910 static int
915 {
943 }
945 ssh2_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_ssh2, NULL, wmem_strbuf_get_str(title));
946 }
947 ws_noisy("....ssh_dissect_ssh2[%c]: frame_key_start=%d, pinfo->num=%d, frame_key_end=%d, offset=%d, frame_key_end_offset=%d ", is_response==SERVER_PEER_DATA?'S':'C', peer_data->frame_key_start, pinfo->num, peer_data->frame_key_end, offset, peer_data->frame_key_end_offset);
954 need_desegmentation);
960 }
967 }
968 }
972 }
975 }
978 }
979 static int
984 {
995 /*
996 * We use "tvb_ensure_captured_length_remaining()" to make sure there
997 * actually *is* data remaining.
998 *
999 * This means we're guaranteed that "remain_length" is positive.
1000 */
1002 /*
1003 * Can we do reassembly?
1004 */
1006 /*
1007 * Yes - would an SSH header starting at this offset be split
1008 * across segment boundaries?
1009 */
1011 /*
1012 * Yes. Tell the TCP dissector where the data for
1013 * this message starts in the data it handed us and
1014 * that we need "some more data." Don't tell it
1015 * exactly how many bytes we need because if/when we
1016 * ask for even more (after the header) that will
1017 * break reassembly.
1018 */
1023 }
1024 }
1035 }
1036 }
1042 }
1048 }
1049 }
1051 /* padding length */
1057 /* msg_code */
1071 }
1075 }
1076 /* payload */
1080 }
1084 }
1086 static int
1089 {
1097 }
1099 static int
1102 {
1110 }
1112 static unsigned
1116 {
1129 /* Read the key type before creating the tree so we can append it as info. */
1132 key_type = (char *) tvb_get_string_enc(wmem_packet_scope(), tvb, offset, type_len, ENC_ASCII|ENC_NA);
1136 tree_title);
1140 // server host key (K_S / Q)
1168 }
1171 }
1173 static unsigned
1174 ssh_tree_add_hostsignature(tvbuff_t *tvb, packet_info *pinfo, int offset, proto_tree *parent_tree,
1177 {
1193 /* Read the signature type before creating the tree so we can append it as info. */
1200 tree_title);
1213 // } else if (g_str_has_prefix(sig_type, "ecdsa-sha2-")) {
1214 // offset += ssh_tree_add_string(tvb, offset, tree,
1215 // hf_ssh_hostkey_ecdsa_curve_id, hf_ssh_hostkey_ecdsa_curve_id_length);
1216 // ssh_tree_add_string(tvb, offset, tree,
1217 // hf_ssh_hostkey_ecdsa_q, hf_ssh_hostkey_ecdsa_q_length);
1218 // } else if (g_str_has_prefix(sig_type, "ssh-ed")) {
1219 // ssh_tree_add_string(tvb, offset, tree,
1220 // hf_ssh_hostkey_eddsa_key, hf_ssh_hostkey_eddsa_key_length);
1225 }
1228 expert_add_info_format(pinfo, ti, &ei_ssh_packet_decode, "Decoded %d bytes, but packet length is %d bytes", offset-offset0, sig_len);
1229 }
1232 }
1234 static int
1239 {
1253 /*
1254 * We use "tvb_ensure_captured_length_remaining()" to make sure there
1255 * actually *is* data remaining.
1256 *
1257 * This means we're guaranteed that "remain_length" is positive.
1258 */
1260 /*
1261 * Can we do reassembly?
1262 */
1264 /*
1265 * Yes - would an SSH header starting at this offset
1266 * be split across segment boundaries?
1267 */
1269 /*
1270 * Yes. Tell the TCP dissector where the data for
1271 * this message starts in the data it handed us and
1272 * that we need "some more data." Don't tell it
1273 * exactly how many bytes we need because if/when we
1274 * ask for even more (after the header) that will
1275 * break reassembly.
1276 */
1281 }
1282 }
1291 }
1292 }
1293 /*
1294 * Need to check plen > 0x80000000 here
1295 */
1302 }
1305 /* padding length */
1311 key_ex_title = wmem_strdup_printf(pinfo->pool, "%s (method:%s)", key_ex_title, global_data->kex);
1312 key_ex_tree = proto_tree_add_subtree(tree, tvb, offset, plen-1, ett_key_exchange, NULL, key_ex_title);
1314 /* msg_code */
1327 /* 16 bytes cookie */
1329 {
1336 global_data->peer_data[is_response].seq_num_kex_init = global_data->peer_data[is_response].sequence_number;
1338 ssh_debug_printf("%s->sequence_number{SSH_MSG_KEXINIT=%d}++ > %d\n", is_response?"server":"client", global_data->peer_data[is_response].seq_num_kex_init, global_data->peer_data[is_response].sequence_number);
1339 }
1340 }
1341 }
1350 global_data->peer_data[is_response].seq_num_new_key = global_data->peer_data[is_response].sequence_number;
1352 ssh_debug_printf("%s->sequence_number{SSH_MSG_NEWKEYS=%d}++ > %d\n", is_response?"server":"client", global_data->peer_data[is_response].seq_num_new_key, global_data->peer_data[is_response].sequence_number);
1353 }
1355 // the client sent SSH_MSG_NEWKEYS
1358 ssh_decryption_setup_cipher(&global_data->peer_data[CLIENT_PEER_DATA], &global_data->new_keys[0], &global_data->new_keys[2]);
1359 ssh_decryption_setup_mac(&global_data->peer_data[CLIENT_PEER_DATA], &global_data->new_keys[4]);
1362 ssh_decryption_setup_cipher(&global_data->peer_data[SERVER_PEER_DATA], &global_data->new_keys[1], &global_data->new_keys[3]);
1363 ssh_decryption_setup_mac(&global_data->peer_data[SERVER_PEER_DATA], &global_data->new_keys[5]);
1364 }
1365 }
1369 }
1370 }
1375 }
1378 /* padding */
1385 }
1390 {
1400 // e (client ephemeral key public part)
1404 }
1409 global_data->peer_data[CLIENT_PEER_DATA].seq_num_dh_ini = global_data->peer_data[CLIENT_PEER_DATA].sequence_number;
1410 ssh_debug_printf("%s->sequence_number{SSH_MSG_KEXDH_INIT}++ > %d\n", CLIENT_PEER_DATA?"serveur":"client", global_data->peer_data[CLIENT_PEER_DATA].sequence_number);
1411 }
1419 // f (server ephemeral key public part), K_S (host key)
1423 }
1432 global_data->peer_data[SERVER_PEER_DATA].seq_num_dh_rep = global_data->peer_data[SERVER_PEER_DATA].sequence_number;
1433 ssh_debug_printf("%s->sequence_number{SSH_MSG_KEXDH_REPLY}++ > %d\n", SERVER_PEER_DATA?"serveur":"client", global_data->peer_data[SERVER_PEER_DATA].sequence_number);
1434 }
1437 }
1440 }
1445 {
1460 // p (Group modulo)
1463 // g (Group generator)
1468 global_data->peer_data[SERVER_PEER_DATA].seq_num_gex_grp = global_data->peer_data[SERVER_PEER_DATA].sequence_number;
1469 ssh_debug_printf("%s->sequence_number{SSH_MSG_KEX_DH_GEX_GROUP}++ > %d\n", SERVER_PEER_DATA?"serveur":"client", global_data->peer_data[SERVER_PEER_DATA].sequence_number);
1470 }
1475 // e (Client public key)
1479 }
1483 global_data->peer_data[CLIENT_PEER_DATA].seq_num_gex_ini = global_data->peer_data[CLIENT_PEER_DATA].sequence_number;
1484 ssh_debug_printf("%s->sequence_number{SSH_MSG_KEX_DH_GEX_INIT}++ > %d\n", CLIENT_PEER_DATA?"serveur":"client", global_data->peer_data[CLIENT_PEER_DATA].sequence_number);
1485 }
1494 // f (server ephemeral key public part), K_S (host key)
1497 }
1503 global_data->peer_data[SERVER_PEER_DATA].seq_num_gex_rep = global_data->peer_data[SERVER_PEER_DATA].sequence_number;
1504 ssh_debug_printf("%s->sequence_number{SSH_MSG_KEX_DH_GEX_REPLY}++ > %d\n", SERVER_PEER_DATA?"serveur":"client", global_data->peer_data[SERVER_PEER_DATA].sequence_number);
1505 }
1513 }
1518 }
1523 }
1528 global_data->peer_data[CLIENT_PEER_DATA].seq_num_gex_req = global_data->peer_data[CLIENT_PEER_DATA].sequence_number;
1529 ssh_debug_printf("%s->sequence_number{SSH_MSG_KEX_DH_GEX_REQUEST}++ > %d\n", CLIENT_PEER_DATA?"serveur":"client", global_data->peer_data[CLIENT_PEER_DATA].sequence_number);
1530 }
1533 }
1534 }
1537 }
1539 static int
1543 {
1555 }
1559 global_data->peer_data[CLIENT_PEER_DATA].seq_num_ecdh_ini = global_data->peer_data[CLIENT_PEER_DATA].sequence_number;
1561 ssh_debug_printf("%s->sequence_number{SSH_MSG_KEX_ECDH_INIT=%d}++ > %d\n", CLIENT_PEER_DATA?"server":"client", global_data->peer_data[CLIENT_PEER_DATA].seq_num_ecdh_ini, global_data->peer_data[CLIENT_PEER_DATA].sequence_number);
1562 }
1563 }
1576 }
1581 global_data->peer_data[SERVER_PEER_DATA].seq_num_ecdh_rep = global_data->peer_data[SERVER_PEER_DATA].sequence_number;
1583 ssh_debug_printf("%s->sequence_number{SSH_MSG_KEX_ECDH_REPLY=%d}++ > %d\n", SERVER_PEER_DATA?"server":"client", global_data->peer_data[SERVER_PEER_DATA].seq_num_ecdh_rep, global_data->peer_data[SERVER_PEER_DATA].sequence_number);
1584 }
1591 }
1594 }
1598 {
1604 }
1611 }
1612 }
1615 }
1617 static int
1620 {
1627 }
1633 offset += ssh_dissect_decrypted_packet(tvb_new_subset_remaining(tvb, offset), pinfo, peer_data, tree, message);
1635 }
1636 }
1639 }
1641 static int
1645 {
1659 }
1663 }
1675 }
1678 }
1680 static int
1685 {
1689 /*
1690 * If the first packet do not contain the banner,
1691 * it is dump in the middle of a flow or not a ssh at all
1692 */
1697 }
1706 }
1707 }
1709 /*
1710 * We use "tvb_ensure_captured_length_remaining()" to make sure there
1711 * actually *is* data remaining.
1712 *
1713 * This means we're guaranteed that "remain_length" is positive.
1714 */
1716 /*linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, false);
1717 */
1726 }
1727 }
1729 /* XXX - reassemble across segment boundaries? */
1737 else
1739 }
1744 // V_C / V_S (client and server identification strings) RFC4253 4.2
1745 // format: SSH-protoversion-softwareversion SP comments [CR LF not incl.]
1752 }
1753 }
1759 }
1761 static void
1763 {
1772 /* wmem_strdup() never returns NULL */
1775 /* strip trailing "-etm@openssh.com" or "@openssh.com" */
1780 }
1784 }
1789 }
1792 }
1795 }
1798 }
1801 }
1804 }
1807 {
1814 {
1816 }
1821 {
1823 }
1829 {
1831 }
1832 }
1834 static int
1836 {
1844 }
1846 /* expects that *result is NULL */
1847 static void
1849 {
1861 }
1869 }
1870 }
1875 }
1877 static int
1880 {
1891 key_init_tree = proto_tree_add_subtree(tree, tvb, offset, -1, ett_key_init, &tf, "Algorithms");
1894 }
1903 hf_ssh_server_host_key_algorithms_length,
1906 hf_ssh_encryption_algorithms_client_to_server_length,
1907 hf_ssh_encryption_algorithms_client_to_server,
1910 hf_ssh_encryption_algorithms_server_to_client_length,
1911 hf_ssh_encryption_algorithms_server_to_client,
1914 hf_ssh_mac_algorithms_client_to_server_length,
1915 hf_ssh_mac_algorithms_client_to_server,
1918 hf_ssh_mac_algorithms_server_to_client_length,
1919 hf_ssh_mac_algorithms_server_to_client,
1922 hf_ssh_compression_algorithms_client_to_server_length,
1923 hf_ssh_compression_algorithms_client_to_server,
1926 hf_ssh_compression_algorithms_server_to_client_length,
1927 hf_ssh_compression_algorithms_server_to_client,
1930 hf_ssh_languages_client_to_server_length,
1933 hf_ssh_languages_server_to_client_length,
1946 wmem_strbuf_append_printf(hassh_algo, "%s;%s;%s;%s", peer_data->kex_proposal, peer_data->enc_proposals[CLIENT_TO_SERVER_PROPOSAL],
1947 peer_data->mac_proposals[CLIENT_TO_SERVER_PROPOSAL], peer_data->comp_proposals[CLIENT_TO_SERVER_PROPOSAL]);
1948 hassh = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(hassh_algo), wmem_strbuf_get_len(hassh_algo));
1949 ti = proto_tree_add_string(key_init_tree, hf_ssh_kex_hassh_algo, tvb, offset, 0, wmem_strbuf_get_str(hassh_algo));
1955 wmem_strbuf_append_printf(hassh_algo, "%s;%s;%s;%s", peer_data->kex_proposal, peer_data->enc_proposals[SERVER_TO_CLIENT_PROPOSAL],
1956 peer_data->mac_proposals[SERVER_TO_CLIENT_PROPOSAL], peer_data->comp_proposals[SERVER_TO_CLIENT_PROPOSAL]);
1957 hassh = g_compute_checksum_for_string(G_CHECKSUM_MD5, wmem_strbuf_get_str(hassh_algo), wmem_strbuf_get_len(hassh_algo));
1958 ti = proto_tree_add_string(key_init_tree, hf_ssh_kex_hasshserver_algo, tvb, offset, 0, wmem_strbuf_get_str(hassh_algo));
1963 }
1968 {
1969 /* Note: we're ignoring first_kex_packet_follows. */
1975 }
1981 }
1983 // I_C / I_S (client and server SSH_MSG_KEXINIT payload) RFC4253 4.2
1989 ssh_hash_buffer_put_string(global_data->kex_server_key_exchange_init, data, payload_length + 1);
1991 ssh_hash_buffer_put_string(global_data->kex_client_key_exchange_init, data, payload_length + 1);
1992 }
1993 }
1996 }
1998 static int
2001 {
2007 ENC_ASCII);
2013 }
2015 static void
2017 {
2021 }
2024 pref_keylog_file)) {
2027 }
2035 }
2036 }
2038 /* File format: each line follows the format "<cookie> <type> <key>".
2039 * <cookie> is the hex-encoded (client or server) 16 bytes cookie
2040 * (32 characters) found in the SSH_MSG_KEXINIT of the endpoint whose
2041 * private random is disclosed.
2042 * <type> is either SHARED_SECRET or PRIVATE_KEY depending on the
2043 * type of key provided. PRIVAT_KEY is only supported for DH,
2044 * DH group exchange, and ECDH (including Curve25519) key exchanges.
2045 * <key> is the private random number that is used to generate the DH
2046 * negotiation (length depends on algorithm). In RFC4253 it is called
2047 * x for the client and y for the server.
2048 * For openssh and DH group exchange, it can be retrieved using
2049 * DH_get0_key(kex->dh, NULL, &server_random)
2050 * for groupN in file kexdh.c function kex_dh_compute_key
2051 * for custom group in file kexgexs.c function input_kex_dh_gex_init
2052 * For openssh and curve25519, it can be found in function kex_c25519_enc
2053 * in variable server_key. One may also provide the shared secret
2054 * directly if <type> is set to SHARED_SECRET.
2055 *
2056 * Example:
2057 * 90d886612f9c35903db5bb30d11f23c2 PRIVATE_KEY DEF830C22F6C927E31972FFB20B46C96D0A5F2D5E7BE5A3A8804D6BFC431619ED10AF589EEDFF4750DEA00EFD7AFDB814B6F3528729692B1F2482041521AE9DC
2058 */
2068 }
2070 }
2076 }
2077 }
2079 static void
2081 {
2087 ssize_t linelen;
2094 }
2097 }
2104 }
2105 }
2107 static void
2109 {
2117 // New format: [hex-encoded cookie] [key type] [hex-encoded key material]
2122 // Old format: [hex-encoded cookie] [hex-encoded private key]
2131 }
2139 }
2144 }
2150 int8_t h0 = (v0>='0' && v0<='9')?v0-'0':(v0>='a' && v0<='f')?v0-'a'+10:(v0>='A' && v0<='F')?v0-'A'+10:-1;
2152 int8_t h1 = (v1>='0' && v1<='9')?v1-'0':(v1>='a' && v1<='f')?v1-'a'+10:(v1>='A' && v1<='F')?v1-'A'+10:-1;
2158 }
2163 }
2166 int8_t h0 = (v0>='0' && v0<='9')?v0-'0':(v0>='a' && v0<='f')?v0-'a'+10:(v0>='A' && v0<='F')?v0-'A'+10:-1;
2168 int8_t h1 = (v1>='0' && v1<='9')?v1-'0':(v1>='a' && v1<='f')?v1-'a'+10:(v1>='A' && v1<='F')?v1-'A'+10:-1;
2174 }
2179 }
2193 }
2195 static void
2197 {
2201 }
2202 }
2204 static unsigned
2206 {
2220 }
2221 }
2224 }
2226 static unsigned
2228 {
2240 }
2241 }
2245 {
2246 // 512 bytes (4096 bits) is the maximum bignum size we're supporting
2247 // Actually we need 513 bytes, to make provision for signed values
2248 // Diffie-Hellman group 18 has 8192 bits
2251 }
2258 }
2262 }
2264 static bool
2266 {
2267 // store the client's public part (e) for later usage
2272 }
2275 }
2277 static bool
2279 {
2280 // store the server's public part (f) for later usage
2285 }
2288 }
2292 {
2293 // store the DH group modulo (p) for later usage
2299 }
2302 }
2304 static void
2306 {
2307 /*
2308 * This computation is defined differently for each key exchange method:
2309 * https://tools.ietf.org/html/rfc4253#page-23
2310 * https://tools.ietf.org/html/rfc5656#page-8
2311 * https://tools.ietf.org/html/rfc4419#page-4
2312 * All key exchange methods:
2313 * https://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml#ssh-parameters-16
2314 */
2316 gcry_md_hd_t hd;
2327 entry = (ssh_key_map_entry_t *)g_hash_table_lookup(ssh_master_key_map, global_data->peer_data[SERVER_PEER_DATA].bn_cookie);
2329 entry = (ssh_key_map_entry_t *)g_hash_table_lookup(ssh_master_key_map, global_data->peer_data[CLIENT_PEER_DATA].bn_cookie);
2331 }
2336 }
2340 secret = ssh_kex_shared_secret(kex_type, global_data->kex_f, entry->key_material, global_data->kex_gex_p);
2342 secret = ssh_kex_shared_secret(kex_type, global_data->kex_e, entry->key_material, global_data->kex_gex_p);
2343 }
2350 }
2356 }
2358 // shared secret data needs to be written as an mpint, and we need it later
2366 }
2370 if(global_data->kex_gex_p){ssh_hash_buffer_put_string(kex_gex_p, global_data->kex_gex_p->data, global_data->kex_gex_p->length);}
2372 if(global_data->kex_gex_g){ssh_hash_buffer_put_string(kex_gex_g, global_data->kex_gex_g->data, global_data->kex_gex_g->length);}
2374 if(global_data->kex_e){ssh_hash_buffer_put_string(kex_e, global_data->kex_e->data, global_data->kex_e->length);}
2376 if(global_data->kex_f){ssh_hash_buffer_put_string(kex_f, global_data->kex_f->data, global_data->kex_f->length);}
2379 ssh_print_data("client_version", (const unsigned char *)wmem_array_get_raw(global_data->kex_client_version), wmem_array_get_count(global_data->kex_client_version));
2380 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(global_data->kex_client_version), wmem_array_get_count(global_data->kex_client_version));
2381 ssh_print_data("server_version", (const unsigned char *)wmem_array_get_raw(global_data->kex_server_version), wmem_array_get_count(global_data->kex_server_version));
2382 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(global_data->kex_server_version), wmem_array_get_count(global_data->kex_server_version));
2383 ssh_print_data("client_key_exchange_init", (const unsigned char *)wmem_array_get_raw(global_data->kex_client_key_exchange_init), wmem_array_get_count(global_data->kex_client_key_exchange_init));
2384 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(global_data->kex_client_key_exchange_init), wmem_array_get_count(global_data->kex_client_key_exchange_init));
2385 ssh_print_data("server_key_exchange_init", (const unsigned char *)wmem_array_get_raw(global_data->kex_server_key_exchange_init), wmem_array_get_count(global_data->kex_server_key_exchange_init));
2386 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(global_data->kex_server_key_exchange_init), wmem_array_get_count(global_data->kex_server_key_exchange_init));
2387 ssh_print_data("kex_server_host_key_blob", (const unsigned char *)wmem_array_get_raw(global_data->kex_server_host_key_blob), wmem_array_get_count(global_data->kex_server_host_key_blob));
2388 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(global_data->kex_server_host_key_blob), wmem_array_get_count(global_data->kex_server_host_key_blob));
2390 ssh_print_data("kex_gex_bits_min", (const unsigned char *)wmem_array_get_raw(global_data->kex_gex_bits_min), wmem_array_get_count(global_data->kex_gex_bits_min));
2391 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(global_data->kex_gex_bits_min), wmem_array_get_count(global_data->kex_gex_bits_min));
2392 ssh_print_data("kex_gex_bits_req", (const unsigned char *)wmem_array_get_raw(global_data->kex_gex_bits_req), wmem_array_get_count(global_data->kex_gex_bits_req));
2393 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(global_data->kex_gex_bits_req), wmem_array_get_count(global_data->kex_gex_bits_req));
2394 ssh_print_data("kex_gex_bits_max", (const unsigned char *)wmem_array_get_raw(global_data->kex_gex_bits_max), wmem_array_get_count(global_data->kex_gex_bits_max));
2395 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(global_data->kex_gex_bits_max), wmem_array_get_count(global_data->kex_gex_bits_max));
2396 ssh_print_data("key modulo (p)", (const unsigned char *)wmem_array_get_raw(kex_gex_p), wmem_array_get_count(kex_gex_p));
2397 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(kex_gex_p), wmem_array_get_count(kex_gex_p));
2398 ssh_print_data("key base (g)", (const unsigned char *)wmem_array_get_raw(kex_gex_g), wmem_array_get_count(kex_gex_g));
2399 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(kex_gex_g), wmem_array_get_count(kex_gex_g));
2400 ssh_print_data("key client (e)", (const unsigned char *)wmem_array_get_raw(kex_e), wmem_array_get_count(kex_e));
2402 ssh_print_data("key server (f)", (const unsigned char *)wmem_array_get_raw(kex_f), wmem_array_get_count(kex_f));
2404 }
2405 if(kex_type==SSH_KEX_DH_GROUP1 || kex_type==SSH_KEX_DH_GROUP14 || kex_type==SSH_KEX_DH_GROUP16 || kex_type==SSH_KEX_DH_GROUP18){
2406 ssh_print_data("key client (e)", (const unsigned char *)wmem_array_get_raw(kex_e), wmem_array_get_count(kex_e));
2408 ssh_print_data("key server (f)", (const unsigned char *)wmem_array_get_raw(kex_f), wmem_array_get_count(kex_f));
2410 }
2412 ssh_print_data("key client (Q_C)", (const unsigned char *)wmem_array_get_raw(kex_e), wmem_array_get_count(kex_e));
2414 ssh_print_data("key server (Q_S)", (const unsigned char *)wmem_array_get_raw(kex_f), wmem_array_get_count(kex_f));
2416 }
2417 ssh_print_data("shared secret", (const unsigned char *)wmem_array_get_raw(global_data->kex_shared_secret), wmem_array_get_count(global_data->kex_shared_secret));
2418 wmem_array_append(kex_hash_buffer, wmem_array_get_raw(global_data->kex_shared_secret), wmem_array_get_count(global_data->kex_shared_secret));
2420 ssh_print_data("exchange", (const unsigned char *)wmem_array_get_raw(kex_hash_buffer), wmem_array_get_count(kex_hash_buffer));
2435 }
2443 }
2445 // the purpose of this function is to deal with all different kex methods
2448 {
2456 }
2468 secret->length = (unsigned)result_len; // Should not be larger than what fits in a 32-bit unsigned integer...
2474 }else if(kex_type==SSH_KEX_DH_GROUP1 || kex_type==SSH_KEX_DH_GROUP14 || kex_type==SSH_KEX_DH_GROUP16 || kex_type==SSH_KEX_DH_GROUP18){
2478 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
2479 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
2480 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
2481 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
2482 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
2483 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
2484 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
2485 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE6, 0x53, 0x81, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,};
2488 //p:FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF
2490 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
2491 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
2492 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
2493 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
2494 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
2495 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
2496 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
2497 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
2498 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
2499 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
2500 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
2501 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
2502 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
2503 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
2504 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
2505 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAC, 0xAA, 0x68, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
2508 //p:FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA993B4EA988D8FDDC186FFB7DC90A6C08F4DF435C934063199FFFFFFFFFFFFFFFF
2510 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
2511 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
2512 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
2513 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
2514 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
2515 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
2516 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
2517 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
2518 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
2519 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
2520 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
2521 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
2522 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
2523 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
2524 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
2525 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D, 0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33,
2526 0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64, 0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A,
2527 0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D, 0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7,
2528 0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7, 0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D,
2529 0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B, 0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64,
2530 0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64, 0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C,
2531 0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C, 0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2,
2532 0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31, 0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E,
2533 0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x21, 0x08, 0x01, 0x1A, 0x72, 0x3C, 0x12, 0xA7, 0x87, 0xE6, 0xD7,
2534 0x88, 0x71, 0x9A, 0x10, 0xBD, 0xBA, 0x5B, 0x26, 0x99, 0xC3, 0x27, 0x18, 0x6A, 0xF4, 0xE2, 0x3C,
2535 0x1A, 0x94, 0x68, 0x34, 0xB6, 0x15, 0x0B, 0xDA, 0x25, 0x83, 0xE9, 0xCA, 0x2A, 0xD4, 0x4C, 0xE8,
2536 0xDB, 0xBB, 0xC2, 0xDB, 0x04, 0xDE, 0x8E, 0xF9, 0x2E, 0x8E, 0xFC, 0x14, 0x1F, 0xBE, 0xCA, 0xA6,
2537 0x28, 0x7C, 0x59, 0x47, 0x4E, 0x6B, 0xC0, 0x5D, 0x99, 0xB2, 0x96, 0x4F, 0xA0, 0x90, 0xC3, 0xA2,
2538 0x23, 0x3B, 0xA1, 0x86, 0x51, 0x5B, 0xE7, 0xED, 0x1F, 0x61, 0x29, 0x70, 0xCE, 0xE2, 0xD7, 0xAF,
2539 0xB8, 0x1B, 0xDD, 0x76, 0x21, 0x70, 0x48, 0x1C, 0xD0, 0x06, 0x91, 0x27, 0xD5, 0xB0, 0x5A, 0xA9,
2540 0x93, 0xB4, 0xEA, 0x98, 0x8D, 0x8F, 0xDD, 0xC1, 0x86, 0xFF, 0xB7, 0xDC, 0x90, 0xA6, 0xC0, 0x8F,
2541 0x4D, 0xF4, 0x35, 0xC9, 0x34, 0x06, 0x31, 0x99, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,};
2544 //p:FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA993B4EA988D8FDDC186FFB7DC90A6C08F4DF435C93402849236C3FAB4D27C7026C1D4DCB2602646DEC9751E763DBA37BDF8FF9406AD9E530EE5DB382F413001AEB06A53ED9027D831179727B0865A8918DA3EDBEBCF9B14ED44CE6CBACED4BB1BDB7F1447E6CC254B332051512BD7AF426FB8F401378CD2BF5983CA01C64B92ECF032EA15D1721D03F482D7CE6E74FEF6D55E702F46980C82B5A84031900B1C9E59E7C97FBEC7E8F323A97A7E36CC88BE0F1D45B7FF585AC54BD407B22B4154AACC8F6D7EBF48E1D814CC5ED20F8037E0A79715EEF29BE32806A1D58BB7C5DA76F550AA3D8A1FBFF0EB19CCB1A313D55CDA56C9EC2EF29632387FE8D76E3C0468043E8F663F4860EE12BF2D5B0B7474D6E694F91E6DBE115974A3926F12FEE5E438777CB6A932DF8CD8BEC4D073B931BA3BC832B68D9DD300741FA7BF8AFC47ED2576F6936BA424663AAB639C5AE4F5683423B4742BF1C978238F16CBE39D652DE3FDB8BEFC848AD922222E04A4037C0713EB57A81A23F0C73473FC646CEA306B4BCBC8862F8385DDFA9D4B7FA2C087E879683303ED5BDD3A062B3CF5B3A278A66D2A13F83F44F82DDF310EE074AB6A364597E899A0255DC164F31CC50846851DF9AB48195DED7EA1B1D510BD7EE74D73FAF36BC31ECFA268359046F4EB879F924009438B481C6CD7889A002ED5EE382BC9190DA6FC026E479558E4475677E9AA9E3050E2765694DFC81F56E880B96E7160C980DD98EDD3DFFFFFFFFFFFFFFFFF
2546 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
2547 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
2548 0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
2549 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
2550 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
2551 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
2552 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
2553 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
2554 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
2555 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
2556 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
2557 0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C, 0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
2558 0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03, 0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
2559 0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9, 0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
2560 0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5, 0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
2561 0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D, 0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33,
2562 0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64, 0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A,
2563 0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D, 0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7,
2564 0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7, 0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D,
2565 0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B, 0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64,
2566 0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64, 0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C,
2567 0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C, 0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2,
2568 0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31, 0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E,
2569 0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x21, 0x08, 0x01, 0x1A, 0x72, 0x3C, 0x12, 0xA7, 0x87, 0xE6, 0xD7,
2570 0x88, 0x71, 0x9A, 0x10, 0xBD, 0xBA, 0x5B, 0x26, 0x99, 0xC3, 0x27, 0x18, 0x6A, 0xF4, 0xE2, 0x3C,
2571 0x1A, 0x94, 0x68, 0x34, 0xB6, 0x15, 0x0B, 0xDA, 0x25, 0x83, 0xE9, 0xCA, 0x2A, 0xD4, 0x4C, 0xE8,
2572 0xDB, 0xBB, 0xC2, 0xDB, 0x04, 0xDE, 0x8E, 0xF9, 0x2E, 0x8E, 0xFC, 0x14, 0x1F, 0xBE, 0xCA, 0xA6,
2573 0x28, 0x7C, 0x59, 0x47, 0x4E, 0x6B, 0xC0, 0x5D, 0x99, 0xB2, 0x96, 0x4F, 0xA0, 0x90, 0xC3, 0xA2,
2574 0x23, 0x3B, 0xA1, 0x86, 0x51, 0x5B, 0xE7, 0xED, 0x1F, 0x61, 0x29, 0x70, 0xCE, 0xE2, 0xD7, 0xAF,
2575 0xB8, 0x1B, 0xDD, 0x76, 0x21, 0x70, 0x48, 0x1C, 0xD0, 0x06, 0x91, 0x27, 0xD5, 0xB0, 0x5A, 0xA9,
2576 0x93, 0xB4, 0xEA, 0x98, 0x8D, 0x8F, 0xDD, 0xC1, 0x86, 0xFF, 0xB7, 0xDC, 0x90, 0xA6, 0xC0, 0x8F,
2577 0x4D, 0xF4, 0x35, 0xC9, 0x34, 0x02, 0x84, 0x92, 0x36, 0xC3, 0xFA, 0xB4, 0xD2, 0x7C, 0x70, 0x26,
2578 0xC1, 0xD4, 0xDC, 0xB2, 0x60, 0x26, 0x46, 0xDE, 0xC9, 0x75, 0x1E, 0x76, 0x3D, 0xBA, 0x37, 0xBD,
2579 0xF8, 0xFF, 0x94, 0x06, 0xAD, 0x9E, 0x53, 0x0E, 0xE5, 0xDB, 0x38, 0x2F, 0x41, 0x30, 0x01, 0xAE,
2580 0xB0, 0x6A, 0x53, 0xED, 0x90, 0x27, 0xD8, 0x31, 0x17, 0x97, 0x27, 0xB0, 0x86, 0x5A, 0x89, 0x18,
2581 0xDA, 0x3E, 0xDB, 0xEB, 0xCF, 0x9B, 0x14, 0xED, 0x44, 0xCE, 0x6C, 0xBA, 0xCE, 0xD4, 0xBB, 0x1B,
2582 0xDB, 0x7F, 0x14, 0x47, 0xE6, 0xCC, 0x25, 0x4B, 0x33, 0x20, 0x51, 0x51, 0x2B, 0xD7, 0xAF, 0x42,
2583 0x6F, 0xB8, 0xF4, 0x01, 0x37, 0x8C, 0xD2, 0xBF, 0x59, 0x83, 0xCA, 0x01, 0xC6, 0x4B, 0x92, 0xEC,
2584 0xF0, 0x32, 0xEA, 0x15, 0xD1, 0x72, 0x1D, 0x03, 0xF4, 0x82, 0xD7, 0xCE, 0x6E, 0x74, 0xFE, 0xF6,
2585 0xD5, 0x5E, 0x70, 0x2F, 0x46, 0x98, 0x0C, 0x82, 0xB5, 0xA8, 0x40, 0x31, 0x90, 0x0B, 0x1C, 0x9E,
2586 0x59, 0xE7, 0xC9, 0x7F, 0xBE, 0xC7, 0xE8, 0xF3, 0x23, 0xA9, 0x7A, 0x7E, 0x36, 0xCC, 0x88, 0xBE,
2587 0x0F, 0x1D, 0x45, 0xB7, 0xFF, 0x58, 0x5A, 0xC5, 0x4B, 0xD4, 0x07, 0xB2, 0x2B, 0x41, 0x54, 0xAA,
2588 0xCC, 0x8F, 0x6D, 0x7E, 0xBF, 0x48, 0xE1, 0xD8, 0x14, 0xCC, 0x5E, 0xD2, 0x0F, 0x80, 0x37, 0xE0,
2589 0xA7, 0x97, 0x15, 0xEE, 0xF2, 0x9B, 0xE3, 0x28, 0x06, 0xA1, 0xD5, 0x8B, 0xB7, 0xC5, 0xDA, 0x76,
2590 0xF5, 0x50, 0xAA, 0x3D, 0x8A, 0x1F, 0xBF, 0xF0, 0xEB, 0x19, 0xCC, 0xB1, 0xA3, 0x13, 0xD5, 0x5C,
2591 0xDA, 0x56, 0xC9, 0xEC, 0x2E, 0xF2, 0x96, 0x32, 0x38, 0x7F, 0xE8, 0xD7, 0x6E, 0x3C, 0x04, 0x68,
2592 0x04, 0x3E, 0x8F, 0x66, 0x3F, 0x48, 0x60, 0xEE, 0x12, 0xBF, 0x2D, 0x5B, 0x0B, 0x74, 0x74, 0xD6,
2593 0xE6, 0x94, 0xF9, 0x1E, 0x6D, 0xBE, 0x11, 0x59, 0x74, 0xA3, 0x92, 0x6F, 0x12, 0xFE, 0xE5, 0xE4,
2594 0x38, 0x77, 0x7C, 0xB6, 0xA9, 0x32, 0xDF, 0x8C, 0xD8, 0xBE, 0xC4, 0xD0, 0x73, 0xB9, 0x31, 0xBA,
2595 0x3B, 0xC8, 0x32, 0xB6, 0x8D, 0x9D, 0xD3, 0x00, 0x74, 0x1F, 0xA7, 0xBF, 0x8A, 0xFC, 0x47, 0xED,
2596 0x25, 0x76, 0xF6, 0x93, 0x6B, 0xA4, 0x24, 0x66, 0x3A, 0xAB, 0x63, 0x9C, 0x5A, 0xE4, 0xF5, 0x68,
2597 0x34, 0x23, 0xB4, 0x74, 0x2B, 0xF1, 0xC9, 0x78, 0x23, 0x8F, 0x16, 0xCB, 0xE3, 0x9D, 0x65, 0x2D,
2598 0xE3, 0xFD, 0xB8, 0xBE, 0xFC, 0x84, 0x8A, 0xD9, 0x22, 0x22, 0x2E, 0x04, 0xA4, 0x03, 0x7C, 0x07,
2599 0x13, 0xEB, 0x57, 0xA8, 0x1A, 0x23, 0xF0, 0xC7, 0x34, 0x73, 0xFC, 0x64, 0x6C, 0xEA, 0x30, 0x6B,
2600 0x4B, 0xCB, 0xC8, 0x86, 0x2F, 0x83, 0x85, 0xDD, 0xFA, 0x9D, 0x4B, 0x7F, 0xA2, 0xC0, 0x87, 0xE8,
2601 0x79, 0x68, 0x33, 0x03, 0xED, 0x5B, 0xDD, 0x3A, 0x06, 0x2B, 0x3C, 0xF5, 0xB3, 0xA2, 0x78, 0xA6,
2602 0x6D, 0x2A, 0x13, 0xF8, 0x3F, 0x44, 0xF8, 0x2D, 0xDF, 0x31, 0x0E, 0xE0, 0x74, 0xAB, 0x6A, 0x36,
2603 0x45, 0x97, 0xE8, 0x99, 0xA0, 0x25, 0x5D, 0xC1, 0x64, 0xF3, 0x1C, 0xC5, 0x08, 0x46, 0x85, 0x1D,
2604 0xF9, 0xAB, 0x48, 0x19, 0x5D, 0xED, 0x7E, 0xA1, 0xB1, 0xD5, 0x10, 0xBD, 0x7E, 0xE7, 0x4D, 0x73,
2605 0xFA, 0xF3, 0x6B, 0xC3, 0x1E, 0xCF, 0xA2, 0x68, 0x35, 0x90, 0x46, 0xF4, 0xEB, 0x87, 0x9F, 0x92,
2606 0x40, 0x09, 0x43, 0x8B, 0x48, 0x1C, 0x6C, 0xD7, 0x88, 0x9A, 0x00, 0x2E, 0xD5, 0xEE, 0x38, 0x2B,
2607 0xC9, 0x19, 0x0D, 0xA6, 0xFC, 0x02, 0x6E, 0x47, 0x95, 0x58, 0xE4, 0x47, 0x56, 0x77, 0xE9, 0xAA,
2608 0x9E, 0x30, 0x50, 0xE2, 0x76, 0x56, 0x94, 0xDF, 0xC8, 0x1F, 0x56, 0xE8, 0x80, 0xB9, 0x6E, 0x71,
2609 0x60, 0xC9, 0x80, 0xDD, 0x98, 0xED, 0xD3, 0xDF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,};
2611 }
2621 secret->length = (unsigned)result_len; // Should not be larger than what fits in a 32-bit unsigned integer...
2630 }
2634 }
2637 }
2641 {
2649 }
2651 static void
2654 {
2657 }
2661 }
2663 static void
2665 {
2668 }
2673 }
2677 {
2681 }
2686 // required size of key depends on cipher used. chacha20 wants 64 bytes
2690 } else if (CIPHER_AES128_CBC == peer_data->cipher_id || CIPHER_AES128_CTR == peer_data->cipher_id || CIPHER_AES128_GCM == peer_data->cipher_id) {
2692 } else if (CIPHER_AES192_CBC == peer_data->cipher_id || CIPHER_AES192_CTR == peer_data->cipher_id) {
2694 } else if (CIPHER_AES256_CBC == peer_data->cipher_id || CIPHER_AES256_CTR == peer_data->cipher_id || CIPHER_AES256_GCM == peer_data->cipher_id) {
2699 }
2705 }
2708 }
2709 }
2714 if(i==0){ ssh_print_data("Initial IV client to server", global_data->new_keys[i].data, global_data->new_keys[i].length);
2715 }else if(i==1){ ssh_print_data("Initial IV server to client", global_data->new_keys[i].data, global_data->new_keys[i].length);
2716 }else if(i==2){ ssh_print_data("Encryption key client to server", global_data->new_keys[i].data, global_data->new_keys[i].length);
2717 }else if(i==3){ ssh_print_data("Encryption key server to client", global_data->new_keys[i].data, global_data->new_keys[i].length);
2718 }else if(i==4){ ssh_print_data("Integrity key client to server", global_data->new_keys[i].data, global_data->new_keys[i].length);
2719 }else if(i==5){ ssh_print_data("Integrity key server to client", global_data->new_keys[i].data, global_data->new_keys[i].length);
2720 }
2721 }
2722 }
2727 {
2728 gcry_md_hd_t hd;
2738 }
2753 }
2755 // expand key
2764 }
2765 }
2768 }
2770 static void
2772 {
2778 /* some ciphers have their own MAC so the "negotiated" one is meaningless */
2784 }
2788 }
2794 }
2798 }
2804 }
2806 static void
2808 {
2839 }
2840 }
2842 static void
2844 {
2854 }
2855 }
2857 static bool
2858 gcry_cipher_destroy_cb(wmem_allocator_t *allocator _U_, wmem_cb_event_t event _U_, void *user_data)
2859 {
2865 }
2867 static void
2870 {
2871 gcry_error_t err;
2884 }
2894 }
2904 }
2911 }
2916 } else if (CIPHER_AES128_CBC == peer_data->cipher_id || CIPHER_AES192_CBC == peer_data->cipher_id || CIPHER_AES256_CBC == peer_data->cipher_id) {
2917 int iKeyLen = CIPHER_AES128_CBC == peer_data->cipher_id?16:CIPHER_AES192_CBC == peer_data->cipher_id?24:32;
2918 if (gcry_cipher_open(hd1, CIPHER_AES128_CBC == peer_data->cipher_id?GCRY_CIPHER_AES128:CIPHER_AES192_CBC == peer_data->cipher_id?GCRY_CIPHER_AES192:GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_CBC, 0)) {
2922 }
2928 }
2933 }
2944 }
2951 }
2955 } else if (CIPHER_AES128_CTR == peer_data->cipher_id || CIPHER_AES192_CTR == peer_data->cipher_id || CIPHER_AES256_CTR == peer_data->cipher_id) {
2956 int iKeyLen = CIPHER_AES128_CTR == peer_data->cipher_id?16:CIPHER_AES192_CTR == peer_data->cipher_id?24:32;
2957 if (gcry_cipher_open(hd1, CIPHER_AES128_CTR == peer_data->cipher_id?GCRY_CIPHER_AES128:CIPHER_AES192_CTR == peer_data->cipher_id?GCRY_CIPHER_AES192:GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_CTR, 0)) {
2961 }
2967 }
2972 }
2983 }
2990 }
2994 } else if (CIPHER_AES128_GCM == peer_data->cipher_id || CIPHER_AES256_GCM == peer_data->cipher_id) {
2996 if (gcry_cipher_open(hd1, CIPHER_AES128_GCM == peer_data->cipher_id?GCRY_CIPHER_AES128:GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_GCM, 0)) {
3000 }
3007 }
3012 }
3023 }
3029 }
3030 }
3032 static void
3035 {
3041 }
3047 }
3048 }
3050 /* libgcrypt wrappers for HMAC/message digest operations {{{ */
3051 /* hmac abstraction layer */
3052 #define SSH_HMAC gcry_md_hd_t
3056 {
3057 gcry_error_t err;
3066 }
3071 ssh_debug_printf("ssh_hmac_init(): gcry_md_setkey(..., ..., %d) failed %s/%s", len, err_str, err_src);
3073 }
3075 }
3079 {
3081 }
3085 {
3094 }
3098 {
3100 }
3101 /* libgcrypt wrappers for HMAC/message digest operations }}} */
3103 /* Decryption integrity check {{{ */
3105 static int
3107 {
3110 }
3112 }
3114 static void
3115 ssh_calc_mac(struct ssh_peer_data *peer_data, uint32_t seqnr, uint8_t* data, uint32_t datalen, uint8_t* calc_mac)
3116 {
3117 SSH_HMAC hm;
3123 // ssl_debug_printf("ssh_check_mac mac type:%s md %d\n",
3124 // ssl_cipher_suite_dig(decoder->cipher_suite)->name, md);
3131 /* hash sequence number */
3142 /* get digest and digest len*/
3150 }
3151 /* Decryption integrity check }}} */
3153 static void
3156 {
3158 ssh_packet_info_t * packet = (ssh_packet_info_t *)p_get_proto_data(wmem_file_scope(), pinfo, proto_ssh, 0);
3164 }
3166 }
3167 }
3169 static unsigned
3172 {
3175 gcry_error_t err;
3193 }
3199 ssh_debug_printf("%s plain for seq = %d len = %u\n", is_response?"s2c":"c2s", seqnr, message_length);
3203 }
3208 message_length);
3214 }
3225 gcry_mac_hd_t mac_hd;
3232 }
3239 // ssh_print_data(is_response?"s2c encrypted":"c2s encrypted", ctext2, message_length+4+mac_len);
3242 } else if (CIPHER_AES128_GCM == peer_data->cipher_id || CIPHER_AES256_GCM == peer_data->cipher_id) {
3244 /* AES GCM for Secure Shell [RFC 5647] */
3245 /* The message length is Additional Authenticated Data */
3246 /* XXX: If there are fewer than 4 octets available, we need to
3247 * ask the TCP dissector for DESEGMENT_ONE_MORE_SEGMENT instead
3248 * of throwing an exception here, if we're desegmenting.
3249 */
3253 /* The minimum size of a packet (not counting mac) is 16. */
3257 }
3259 /* SSH requires that the data to be encrypted (not including the AAD,
3260 * so message_length) be a multiple of the block size, 16 octets */
3263 }
3265 /* If tvb_reported_length_remaining(tvb, offset + 4) is less
3266 * than message_length + mac_len, then we should ask the TCP
3267 * dissector for more data if we're desegmenting. That is
3268 * simpler than trying to handle fragmentation ourselves.
3269 */
3271 message_length);
3275 /* gcry_cipher_setiv(peer_data->cipher, iv, 12); */
3277 //gcry_cipher_close(peer_data->cipher);
3278 //Don't close this unless we also remove the wmem callback
3279 // TODO: temporary work-around as long as a Windows python bug is triggered by automated tests
3280 #ifndef _WIN32
3285 }
3293 // TODO: temporary work-around as long as a Windows python bug is triggered by automated tests
3294 #ifndef _WIN32
3298 }
3302 // TODO: temporary work-around as long as a Windows python bug is triggered by automated tests
3303 #ifndef _WIN32
3304 ws_debug("can't decrypt aes-gcm %d %s %s", gcry_err_code(err), gcry_strsource(err), gcry_strerror(err));
3308 }
3311 // TODO: temporary work-around as long as a Windows python bug is triggered by automated tests
3312 #ifndef _WIN32
3316 }
3319 // TODO: temporary work-around as long as a Windows python bug is triggered by automated tests
3320 #ifndef _WIN32
3324 }
3328 // ssh_print_data(is_response?"s2c encrypted":"c2s encrypted", ctl, message_length+4+mac_len);
3332 } else if (CIPHER_AES128_CBC == peer_data->cipher_id || CIPHER_AES128_CTR == peer_data->cipher_id ||
3338 // TODO: see how to handle fragmentation...
3340 /* In CBC and CTR mode, the message length is encrypted as well.
3341 * We need to decrypt one block to get the length.
3342 * If we have fewer than 16 octets, and we're doing desegmentation,
3343 * we should tell the TCP dissector we need ONE_MORE_SEGMENT.
3344 */
3349 {
3352 }
3357 /* The message_length value doesn't include the length of the
3358 * message_length field itself, so it must be at least 12 bytes.
3359 */
3363 }
3366 /* SSH requires that the data to be encrypted (message_length+4)
3367 * be a multiple of the block size, 16 octets. */
3370 }
3374 /* If we're desegmenting, we want to test if we have enough
3375 * remaining bytes here. It's easier to have the TCP
3376 * dissector put together a PDU based on our length.
3377 */
3380 /* All of these functions actually do handle the case where
3381 * there is no data left, so the check is unnecessary.
3382 */
3384 if ((err = gcry_cipher_decrypt(peer_data->cipher, plain + 16, message_length - 12, ct, message_length - 12)))
3385 {
3386 ws_debug("can't decrypt aes-cbc/ctr %d %s %s", gcry_err_code(err), gcry_strsource(err), gcry_strerror(err));
3388 }
3389 }
3391 /* XXX: Need to test if we have enough data above if we're
3392 * doing desegmentation; the tvb_get_ptr() calls will throw
3393 * exceptions if there's not enough data before we get here.
3394 */
3396 // Need desegmentation
3399 /* Make data available to ssh_follow_tap_listener */
3401 }
3403 // ssh_print_data(is_response?"s2c encrypted":"c2s encrypted", ctext, message_length+4+mac_len);
3407 // TODO: process fragments
3411 }
3419 /* Bad MAC, just show the packet as encrypted. We can get
3420 * this for a known encryption type with no keys currently. */
3421 /* XXX: The TLS dissector has a preference to show the attempt
3422 * anyway if it failed.
3423 */
3425 }
3426 }
3429 // Save message
3438 }
3450 ssh_debug_printf("%s->sequence_number++ > %d\n", is_response?"server":"client", peer_data->sequence_number);
3455 }
3457 }
3461 }
3463 proto_item *
3464 ssh_tree_add_mac(proto_tree *tree, tvbuff_t *tvb, const unsigned offset, const unsigned mac_len,
3467 {
3468 // header_field_info *hfinfo = proto_registrar_get_nth(hf_checksum);
3474 // DISSECTOR_ASSERT_HINT(hfinfo != NULL, "Not passed hfi!");
3475 /*
3476 if (flags & PROTO_CHECKSUM_NOT_PRESENT) {
3477 ti = proto_tree_add_uint_format_value(tree, hf_checksum, tvb, offset, len, 0, "[missing]");
3478 proto_item_set_generated(ti);
3479 if (hf_checksum_status > 0) {
3480 ti2 = proto_tree_add_uint(tree, hf_checksum_status, tvb, offset, len, PROTO_CHECKSUM_E_NOT_PRESENT);
3481 proto_item_set_generated(ti2);
3482 }
3483 return ti;
3484 }
3485 */
3488 // ti = proto_tree_add_uint(tree, hf_checksum, tvb, offset, len, computed_checksum);
3489 // proto_item_set_generated(ti);
3499 }
3502 // computed_checksum = in_cksum_shouldbe(checksum, computed_checksum);
3503 }
3510 }
3512 }
3513 }
3519 }
3523 expert_add_info_format(pinfo, ti, bad_checksum_expert, "%s", expert_get_summary(bad_checksum_expert));
3529 expert_add_info_format(pinfo, ti, bad_checksum_expert, "%s", expert_get_summary(bad_checksum_expert));
3530 }
3531 }
3537 }
3538 }
3539 }
3542 }
3544 static bool
3548 {
3554 // chacha20 uses a different cipher handle for the packet payload & length
3555 // the payload uses a block counter
3560 }
3565 }
3567 static int
3571 {
3578 col_append_sep_fstr(pinfo->cinfo, COL_INFO, NULL, "Encrypted packet (plaintext_len=%d)", plaintext_len);
3592 /*
3593 * We use "tvb_ensure_captured_length_remaining()" to make sure there
3594 * actually *is* data remaining.
3595 *
3596 * This means we're guaranteed that "remain_length" is positive.
3597 */
3599 /*
3600 * Can we do reassembly?
3601 */
3603 /*
3604 * Yes - would an SSH header starting at this offset
3605 * be split across segment boundaries?
3606 */
3608 /*
3609 * Yes. Tell the TCP dissector where the data for
3610 * this message starts in the data it handed us and
3611 * that we need "some more data." Don't tell it
3612 * exactly how many bytes we need because if/when we
3613 * ask for even more (after the header) that will
3614 * break reassembly.
3615 */
3619 }
3620 }
3628 }
3629 }
3630 /*
3631 * Need to check plen > 0x80000000 here
3632 */
3639 }
3642 /* padding length */
3647 /* msg_code */
3650 /* Transport layer protocol */
3651 /* Generic (1-19) */
3653 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, val_to_str(msg_code, ssh2_msg_vals, "Unknown (%u)"));
3654 msg_type_tree = proto_tree_add_subtree(tree, packet_tvb, offset, plen-1, ett_key_exchange, NULL, "Message: Transport (generic)");
3656 dissected_len = ssh_dissect_transport_generic(packet_tvb, pinfo, offset+1, peer_data, msg_type_tree, msg_code) - offset;
3657 // offset = ssh_dissect_transport_generic(packet_tvb, pinfo, global_data, offset, msg_type_tree, is_response, msg_code);
3658 }
3659 /* Algorithm negotiation (20-29) */
3661 msg_type_tree = proto_tree_add_subtree(tree, packet_tvb, offset, plen-1, ett_key_exchange, NULL, "Message: Transport (algorithm negotiation)");
3662 //TODO: See if the complete dissector should be refactored to always got through here first offset = ssh_dissect_transport_algorithm_negotiation(packet_tvb, pinfo, global_data, offset, msg_type_tree, is_response, msg_code);
3663 }
3664 /* Key exchange method specific (reusable) (30-49) */
3666 msg_type_tree = proto_tree_add_subtree(tree, packet_tvb, offset, plen-1, ett_key_exchange, NULL, "Message: Transport (key exchange method specific)");
3667 //TODO: See if the complete dissector should be refactored to always got through here first offset = global_data->kex_specific_dissector(msg_code, packet_tvb, pinfo, offset, msg_type_tree);
3668 }
3670 /* User authentication protocol */
3671 /* Generic (50-59) */
3673 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, val_to_str(msg_code, ssh2_msg_vals, "Unknown (%u)"));
3674 msg_type_tree = proto_tree_add_subtree(tree, packet_tvb, offset, plen-1, ett_key_exchange, NULL, "Message: User Authentication (generic)");
3676 dissected_len = ssh_dissect_userauth_generic(packet_tvb, pinfo, offset+1, msg_type_tree, msg_code) - offset;
3677 // TODO: offset = ssh_dissect_userauth_generic(packet_tvb, pinfo, global_data, offset, msg_type_tree, is_response, msg_code);
3678 }
3679 /* User authentication method specific (reusable) (60-79) */
3681 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, val_to_str(msg_code, ssh2_msg_vals, "Unknown (%u)"));
3682 msg_type_tree = proto_tree_add_subtree(tree, packet_tvb, offset, plen-1, ett_key_exchange, NULL, "Message: User Authentication: (method specific)");
3684 // TODO: offset = ssh_dissect_userauth_specific(packet_tvb, pinfo, global_data, offset, msg_type_tree, is_response, msg_code);
3685 dissected_len = ssh_dissect_userauth_specific(packet_tvb, pinfo, offset+1, msg_type_tree, msg_code) - offset;
3686 }
3688 /* Connection protocol */
3689 /* Generic (80-89) */
3691 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, val_to_str(msg_code, ssh2_msg_vals, "Unknown (%u)"));
3692 msg_type_tree = proto_tree_add_subtree(tree, packet_tvb, offset, plen-1, ett_key_exchange, NULL, "Message: Connection (generic)");
3694 // TODO: offset = ssh_dissect_connection_generic(packet_tvb, pinfo, global_data, offset, msg_type_tree, is_response, msg_code);
3695 dissected_len = ssh_dissect_connection_generic(packet_tvb, pinfo, offset+1, msg_type_tree, msg_code) - offset;
3696 }
3697 /* Channel related messages (90-127) */
3699 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, val_to_str(msg_code, ssh2_msg_vals, "Unknown (%u)"));
3700 msg_type_tree = proto_tree_add_subtree(tree, packet_tvb, offset, plen-1, ett_key_exchange, NULL, "Message: Connection: (channel related message)");
3702 // TODO: offset = ssh_dissect_connection_channel(packet_tvb, pinfo, global_data, offset, msg_type_tree, is_response, msg_code);
3703 dissected_len = ssh_dissect_connection_specific(packet_tvb, pinfo, peer_data, offset+1, msg_type_tree, msg_code, message) - offset;
3704 }
3706 /* Reserved for client protocols (128-191) */
3708 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, val_to_str(msg_code, ssh2_msg_vals, "Unknown (%u)"));
3709 msg_type_tree = proto_tree_add_subtree(tree, packet_tvb, offset, plen-1, ett_key_exchange, NULL, "Message: Client protocol");
3712 // TODO: offset = ssh_dissect_client(packet_tvb, pinfo, global_data, offset, msg_type_tree, is_response, msg_code);
3713 }
3715 /* Local extensions (192-255) */
3717 msg_type_tree = proto_tree_add_subtree(tree, packet_tvb, offset, plen-1, ett_key_exchange, NULL, "Message: Local extension");
3718 dissected_len = ssh_dissect_local_extension(packet_tvb, pinfo, offset, peer_data, msg_type_tree, msg_code) - offset;
3719 }
3724 }
3726 // expert_add_info_format(pinfo, ti, &ei_ssh_packet_decode, "Decoded %d bytes, but packet length is %d bytes", dissected_len, len);
3727 expert_add_info_format(pinfo, ti, &ei_ssh_packet_decode, "Decoded %d bytes, but packet length is %d bytes [%d]", dissected_len, len, msg_code);
3728 }
3731 /* padding */
3736 ssh_tree_add_mac(tree, tvb, offset, peer_data->mac_length, hf_ssh_mac_string, hf_ssh_mac_status, &ei_ssh_mac_bad, pinfo, message->calc_mac,
3739 }
3743 }
3745 static int
3748 {
3751 proto_tree_add_item(msg_type_tree, hf_ssh_disconnect_reason, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3755 proto_tree_add_item(msg_type_tree, hf_ssh_disconnect_description_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3757 proto_tree_add_item(msg_type_tree, hf_ssh_disconnect_description, packet_tvb, offset, nlen, ENC_ASCII);
3760 proto_tree_add_item(msg_type_tree, hf_ssh_lang_tag_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3765 offset += ssh_tree_add_string(packet_tvb, offset, msg_type_tree, hf_ssh_ignore_data, hf_ssh_ignore_data_length);
3768 proto_tree_add_item(msg_type_tree, hf_ssh_debug_always_display, packet_tvb, offset, 1, ENC_BIG_ENDIAN);
3771 proto_tree_add_item(msg_type_tree, hf_ssh_debug_message_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3776 proto_tree_add_item(msg_type_tree, hf_ssh_lang_tag_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3783 proto_tree_add_item(msg_type_tree, hf_ssh_service_name_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3790 proto_tree_add_item(msg_type_tree, hf_ssh_service_name_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3801 }
3802 }
3804 }
3806 static int
3809 {
3812 uint8_t *ext_name = tvb_get_string_enc(pinfo->pool, packet_tvb, offset + 4, ext_name_slen, ENC_ASCII);
3815 proto_item *ext_tree = proto_tree_add_subtree_format(msg_type_tree, packet_tvb, offset, ext_len, ett_extension, NULL, "Extension: %s", ext_name);
3826 // server-sig-algs (RFC8308 Sec. 3.1)
3827 proto_tree_add_item(ext_tree, hf_ssh_ext_server_sig_algs_algorithms, packet_tvb, offset, ext_value_slen, ENC_ASCII);
3830 // delay-compression (RFC8308 Sec 3.2)
3833 proto_tree_add_item(ext_tree, hf_ssh_ext_delay_compression_algorithms_client_to_server_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3835 proto_tree_add_item(ext_tree, hf_ssh_ext_delay_compression_algorithms_client_to_server, packet_tvb, offset, slen, ENC_ASCII);
3838 proto_tree_add_item(ext_tree, hf_ssh_ext_delay_compression_algorithms_server_to_client_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3840 proto_tree_add_item(ext_tree, hf_ssh_ext_delay_compression_algorithms_server_to_client, packet_tvb, offset, slen, ENC_ASCII);
3843 // no-flow-control (RFC 8308 Sec 3.3)
3844 proto_tree_add_item(ext_tree, hf_ssh_ext_no_flow_control_value, packet_tvb, offset, ext_value_slen, ENC_ASCII);
3847 // elevation (RFC 8308 Sec 3.4)
3848 proto_tree_add_item(ext_tree, hf_ssh_ext_elevation_value, packet_tvb, offset, ext_value_slen, ENC_ASCII);
3851 // publickey-algorithms@roumenpetrov.info (proprietary)
3852 proto_tree_add_item(ext_tree, hf_ssh_ext_prop_publickey_algorithms_algorithms, packet_tvb, offset, ext_value_slen, ENC_ASCII);
3855 // ping@openssh.com (proprietary w/ primitive extension value)
3860 }
3862 // The following extensions do not require advanced dissection:
3863 // - global-requests-ok
3864 // - ext-auth-info
3865 // - publickey-hostbound@openssh.com
3866 // - ext-info-in-auth@openssh.com
3869 }
3871 static int
3874 {
3878 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_user_name_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3880 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_user_name, packet_tvb, offset, slen, ENC_ASCII);
3883 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_service_name_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3885 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_service_name, packet_tvb, offset, slen, ENC_ASCII);
3888 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_method_name_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3890 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_method_name, packet_tvb, offset, slen, ENC_ASCII);
3899 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_have_signature, packet_tvb, offset, 1, ENC_BIG_ENDIAN);
3902 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_pka_name_len, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3904 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_pka_name, packet_tvb, offset, slen, ENC_ASCII);
3910 blob_tree = proto_tree_add_subtree(msg_type_tree, packet_tvb, offset, slen, ett_userauth_pk_blob, NULL, "Public key blob");
3911 // proto_tree_add_item(blob_tree, hf_ssh2_msg_code, packet_tvb, offset, 1, ENC_BIG_ENDIAN);
3914 expert_add_info_format(pinfo, blob_tree, &ei_ssh_packet_decode, "Decoded %d bytes, but packet length is %d bytes", dissected_len, slen);
3915 }
3919 proto_tree_add_item(msg_type_tree, hf_ssh_signature_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3922 signature_tree = proto_tree_add_subtree(msg_type_tree, packet_tvb, offset, slen, ett_userauth_pk_signautre, NULL, "Public key signature");
3923 dissected_len = ssh_dissect_public_key_signature(packet_tvb, pinfo, offset, signature_tree) - offset;
3925 expert_add_info_format(pinfo, signature_tree, &ei_ssh_packet_decode, "Decoded %d bytes, but packet length is %d bytes", dissected_len, slen);
3926 }
3928 }
3931 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_change_password, packet_tvb, offset, 1, ENC_BIG_ENDIAN);
3934 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_password_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3936 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_password, packet_tvb, offset, slen, ENC_ASCII);
3940 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_new_password_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3942 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_new_password, packet_tvb, offset, slen, ENC_ASCII);
3944 }
3946 }
3951 proto_tree_add_item(msg_type_tree, hf_ssh_auth_failure_list_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3953 proto_tree_add_item(msg_type_tree, hf_ssh_auth_failure_list, packet_tvb, offset, slen, ENC_ASCII);
3955 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_partial_success, packet_tvb, offset, 1, ENC_BIG_ENDIAN);
3957 }
3959 }
3961 static int
3964 {
3970 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_pka_name_len, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3972 proto_tree_add_item(msg_type_tree, hf_ssh_userauth_pka_name, packet_tvb, offset, slen, ENC_ASCII);
3976 ti = proto_tree_add_item(msg_type_tree, hf_ssh_blob_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
3978 blob_tree = proto_tree_add_subtree(msg_type_tree, packet_tvb, offset, slen, ett_userauth_pk_blob, NULL, "Public key blob");
3981 expert_add_info_format(pinfo, ti, &ei_ssh_packet_decode, "Decoded %d bytes, but packet length is %d bytes", dissected_len, slen);
3982 }
3984 }
3986 }
3988 static void
3989 ssh_process_payload(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, ssh_channel_info_t *channel)
3990 {
3996 }
3997 }
3999 static void
4000 print_ssh_fragment_tree(fragment_head *ipfd_head, proto_tree *tree, proto_tree *ssh_tree, packet_info *pinfo, tvbuff_t *next_tvb)
4001 {
4004 /*
4005 * The subdissector thought it was completely
4006 * desegmented (although the stuff at the
4007 * end may, in turn, require desegmentation),
4008 * so we show a tree with all segments.
4009 */
4012 /*
4013 * The toplevel fragment subtree is now
4014 * behind all desegmented data; move it
4015 * right behind the SSH tree.
4016 */
4018 /* The SSH protocol item is up a few levels from the message tree */
4022 }
4023 }
4025 static uint32_t
4027 {
4028 /*
4029 * If a frame contains multiple PDUs, then "first_frame" is not
4030 * sufficient to uniquely identify groups of fragments. Therefore we use
4031 * the tcp reassembly functions that also test msp->seq (the position of
4032 * the initial fragment in the SSH channel).
4033 */
4035 }
4037 static void
4044 {
4046 tree,
4047 hf_ssh_segment_data,
4048 tvb,
4049 offset,
4050 length,
4051 NULL,
4056 }
4058 static void
4061 {
4074 again:
4081 /*
4082 * Initialize these to assume no desegmentation.
4083 * If that's not the case, these will be set appropriately
4084 * by the subdissector.
4085 */
4089 /*
4090 * Initialize this to assume that this segment will just be
4091 * added to the middle of a desegmented chunk of data, so
4092 * that we should show it all as data.
4093 * If that's not the case, it will be set appropriately.
4094 */
4097 /* If we've seen this segment before (e.g., it's a retransmission),
4098 * there's nothing for us to do. Certainly, don't add it to the list
4099 * of multisegment_pdus (that would cause subsequent lookups to find
4100 * the retransmission instead of the original transmission, breaking
4101 * dissection of the desegmented pdu if we'd already seen the end of
4102 * the pdu).
4103 */
4104 if ((msp = (struct tcp_multisegment_pdu *)wmem_tree_lookup32(channel->multisegment_pdus, seq))) {
4109 /* This must be after the first pass. */
4116 }
4117 }
4121 }
4127 /* Show what frame this was reassembled in if not this one. */
4131 }
4132 }
4136 }
4138 /* Else, find the most previous PDU starting before this sequence number */
4146 }
4148 /* OK, this PDU was found, which means the segment continues
4149 * a higher-level PDU and that we must desegment it.
4150 */
4152 /* The dissector asked for the entire segment */
4156 }
4167 /* If we consumed the entire segment there is no
4168 * other pdu starting anywhere inside this segment.
4169 * So update nxtpdu to point at least to the start
4170 * of the next segment.
4171 * (If the subdissector asks for even more data we
4172 * will advance nxtpdu even further later down in
4173 * the code.)
4174 */
4176 }
4182 }
4184 /* This segment was not found in our table, so it doesn't
4185 * contain a continuation of a higher-level PDU.
4186 * Call the normal subdissector.
4187 */
4191 /* Did the subdissector ask us to desegment some more data
4192 * before it could handle the packet?
4193 * If so we have to create some structures in our table but
4194 * this is something we only do the first time we see this
4195 * packet.
4196 */
4201 /*
4202 * Set "deseg_offset" to the offset in "tvb"
4203 * of the first byte of data that the
4204 * subdissector didn't process.
4205 */
4207 }
4209 /* Either no desegmentation is necessary, or this is
4210 * segment contains the beginning but not the end of
4211 * a higher-level PDU and thus isn't completely
4212 * desegmented.
4213 */
4215 }
4217 /* is it completely desegmented? */
4219 /*
4220 * Yes, we think it is.
4221 * We only call subdissector for the last segment.
4222 * Note that the last segment may include more than what
4223 * we needed.
4224 */
4226 /*
4227 * This is *not* the last segment. It is part of a PDU in the same
4228 * frame, so no another PDU can follow this one.
4229 * Do not reassemble SSH yet, it will be done in the final segment.
4230 * (If we are reassembling at FIN, we will do that in dissect_ssl()
4231 * after iterating through all the records.)
4232 * Clear the Info column and avoid displaying [SSH segment of a
4233 * reassembled PDU], the payload dissector will typically set it.
4234 * (This is needed here for the second pass.)
4235 */
4240 /*
4241 * OK, this is the last segment of the PDU and also the
4242 * last segment in this frame.
4243 * Let's call the subdissector with the desegmented
4244 * data.
4245 */
4249 /*
4250 * Reset column in case multiple SSH segments form the PDU
4251 * and this last SSH segment is not in the first TCP segment of
4252 * this frame.
4253 * XXX prevent clearing the column if the last layer is not SSH?
4254 */
4255 /* Clear column during the first pass. */
4258 /* create a new TVB structure for desegmented data */
4261 /* add desegmented data to the data source list */
4264 /* call subdissector */
4268 /*
4269 * OK, did the subdissector think it was completely
4270 * desegmented, or does it think we need even more
4271 * data?
4272 */
4275 /*
4276 * "desegment_len" isn't 0, so it needs more
4277 * data for something - and "desegment_offset"
4278 * is before "old_len", so it needs more data
4279 * to dissect the stuff we thought was
4280 * completely desegmented (as opposed to the
4281 * stuff at the beginning being completely
4282 * desegmented, but the stuff at the end
4283 * being a new higher-level PDU that also
4284 * needs desegmentation).
4285 */
4288 /* Update msp->nxtpdu to point to the new next
4289 * pdu boundary.
4290 */
4292 /* We want reassembly of at least one
4293 * more segment so set the nxtpdu
4294 * boundary to one byte into the next
4295 * segment.
4296 * This means that the next segment
4297 * will complete reassembly even if it
4298 * is only one single byte in length.
4299 */
4303 /* This is not the first segment, and we thought reassembly
4304 * would be done now, but now we know we desegment at FIN.
4305 * E.g., a HTTP response where the headers were split
4306 * across segments (so previous ONE_MORE_SEGMENT) and
4307 * also no Content-Length (so now DESEGMENT_UNTIL_FIN).
4308 */
4313 }
4314 /* Since we need at least some more data
4315 * there can be no pdu following in the
4316 * tail of this segment.
4317 */
4320 /*
4321 * Show the stuff in this TCP segment as
4322 * just raw TCP segment data.
4323 */
4325 ? another_pdu_follows
4329 /* Show details of the reassembly */
4332 /* Did the subdissector ask us to desegment
4333 * some more data? This means that the data
4334 * at the beginning of this segment completed
4335 * a higher-level PDU, but the data at the
4336 * end of this segment started a higher-level
4337 * PDU but didn't complete it.
4338 *
4339 * If so, we have to create some structures
4340 * in our table, but this is something we
4341 * only do the first time we see this packet.
4342 */
4347 /* The stuff we couldn't dissect
4348 * must have come from this segment,
4349 * so it's all in "tvb".
4350 *
4351 * "pinfo->desegment_offset" is
4352 * relative to the beginning of
4353 * "next_tvb"; we want an offset
4354 * relative to the beginning of "tvb".
4355 *
4356 * First, compute the offset relative
4357 * to the *end* of "next_tvb" - i.e.,
4358 * the number of bytes before the end
4359 * of "next_tvb" at which the
4360 * subdissector stopped. That's the
4361 * length of "next_tvb" minus the
4362 * offset, relative to the beginning
4363 * of "next_tvb, at which the
4364 * subdissector stopped.
4365 */
4368 /* "tvb" and "next_tvb" end at the
4369 * same byte of data, so the offset
4370 * relative to the end of "next_tvb"
4371 * of the byte at which we stopped
4372 * is also the offset relative to
4373 * the end of "tvb" of the byte at
4374 * which we stopped.
4375 *
4376 * Convert that back into an offset
4377 * relative to the beginning of
4378 * "tvb", by taking the length of
4379 * "tvb" and subtracting the offset
4380 * relative to the end.
4381 */
4383 }
4384 }
4385 }
4386 }
4389 /* If the dissector requested "reassemble until FIN"
4390 * just set this flag for the flow and let reassembly
4391 * proceed at normal. We will check/pick up these
4392 * reassembled PDUs later down in dissect_tcp() when checking
4393 * for the FIN flag.
4394 */
4397 }
4398 /*
4399 * The sequence number at which the stuff to be desegmented
4400 * starts is the sequence number of the byte at an offset
4401 * of "deseg_offset" into "tvb".
4402 *
4403 * The sequence number of the byte at an offset of "offset"
4404 * is "seq", i.e. the starting sequence number of this
4405 * segment, so the sequence number of the byte at
4406 * "deseg_offset" is "seq + (deseg_offset - offset)".
4407 */
4413 /* The subdissector asked to reassemble using the
4414 * entire next segment.
4415 * Just ask reassembly for one more byte
4416 * but set this msp flag so we can pick it up
4417 * above.
4418 */
4423 /* Set nxtseq very large so that reassembly won't happen
4424 * until we force it at the end of the stream in dissect_ssl()
4425 * outside this function.
4426 */
4432 }
4434 /* add this segment as the first one for this new pdu */
4439 }
4440 }
4446 /*
4447 * We know what other frame this PDU is reassembled in;
4448 * let the user know.
4449 */
4453 }
4455 /*
4456 * Either we didn't call the subdissector at all (i.e.,
4457 * this is a segment that contains the middle of a
4458 * higher-level PDU, but contains neither the beginning
4459 * nor the end), or the subdissector couldn't dissect it
4460 * all, as some data was missing (i.e., it set
4461 * "pinfo->desegment_len" to the amount of additional
4462 * data it needs).
4463 */
4465 /*
4466 * It couldn't, in fact, dissect any of it (the
4467 * first byte it couldn't dissect is at an offset
4468 * of "pinfo->desegment_offset" from the beginning
4469 * of the payload, and that's 0).
4470 * Just mark this as SSH.
4471 */
4473 /* SFTP checks the length before setting the protocol column.
4474 * If other subdissectors don't do this, we'd want to set the
4475 * protocol column back - but we want to get the SSH version
4476 */
4477 //col_set_str(pinfo->cinfo, COL_PROTOCOL,
4478 // val_to_str_const(session->version, ssl_version_short_names, "SSH"));
4481 }
4482 }
4484 /*
4485 * Show what's left in the packet as just raw SSH segment data.
4486 * XXX - remember what protocol the last subdissector
4487 * was, and report it as a continuation of that, instead?
4488 */
4491 }
4497 /* there was another pdu following this one. */
4499 /* we also have to prevent the dissector from changing the
4500 * PROTOCOL and INFO colums since what follows may be an
4501 * incomplete PDU and we don't want it be changed back from
4502 * <Protocol> to <SSH>
4503 */
4510 }
4511 }
4513 static void
4517 {
4531 }
4534 }
4536 static int
4540 {
4545 proto_tree_add_item_ret_uint(msg_type_tree, hf_ssh_connection_type_name_len, packet_tvb, offset, 4, ENC_BIG_ENDIAN, &slen);
4547 proto_tree_add_item(msg_type_tree, hf_ssh_connection_type_name, packet_tvb, offset, slen, ENC_UTF_8);
4549 proto_tree_add_item(msg_type_tree, hf_ssh_connection_sender_channel, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4551 proto_tree_add_item(msg_type_tree, hf_ssh_connection_initial_window, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4553 proto_tree_add_item(msg_type_tree, hf_ssh_connection_maximum_packet_size, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4556 proto_tree_add_item_ret_uint(msg_type_tree, hf_ssh_connection_recipient_channel, packet_tvb, offset, 4, ENC_BIG_ENDIAN, &recipient_channel);
4558 proto_tree_add_item_ret_uint(msg_type_tree, hf_ssh_connection_sender_channel, packet_tvb, offset, 4, ENC_BIG_ENDIAN, &sender_channel);
4562 }
4563 proto_tree_add_item(msg_type_tree, hf_ssh_connection_initial_window, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4565 proto_tree_add_item(msg_type_tree, hf_ssh_connection_maximum_packet_size, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4568 proto_tree_add_item(msg_type_tree, hf_ssh_connection_recipient_channel, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4570 proto_tree_add_item(msg_type_tree, hf_ssh_channel_window_adjust, packet_tvb, offset, 4, ENC_BIG_ENDIAN); // TODO: maintain count of transferred bytes and window size
4573 proto_item *ti = proto_tree_add_item_ret_uint(msg_type_tree, hf_ssh_connection_recipient_channel, packet_tvb, offset, 4, ENC_BIG_ENDIAN, &recipient_channel);
4575 // TODO: process according to the type of channel
4577 proto_tree_add_item_ret_uint(msg_type_tree, hf_ssh_channel_data_len, packet_tvb, offset, 4, ENC_BIG_ENDIAN, &slen);
4587 }
4590 expert_add_info_format(pinfo, ti, &ei_ssh_channel_number, "Could not find configuration for channel %d", recipient_channel);
4591 }
4594 proto_tree_add_item(msg_type_tree, hf_ssh_connection_recipient_channel, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4597 proto_tree_add_item(msg_type_tree, hf_ssh_connection_recipient_channel, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4600 proto_tree_add_item_ret_uint(msg_type_tree, hf_ssh_connection_recipient_channel, packet_tvb, offset, 4, ENC_BIG_ENDIAN, &recipient_channel);
4604 proto_tree_add_item_ret_uint(msg_type_tree, hf_ssh_channel_request_name_len, packet_tvb, offset, 4, ENC_BIG_ENDIAN, &slen);
4606 proto_tree_add_item_ret_string(msg_type_tree, hf_ssh_channel_request_name, packet_tvb, offset, slen, ENC_UTF_8, pinfo->pool, &request_name);
4608 proto_tree_add_item(msg_type_tree, hf_ssh_channel_request_want_reply, packet_tvb, offset, 1, ENC_BIG_ENDIAN);
4610 /* RFC 4254 6.5: "Only one of these requests ["shell", "exec",
4611 * or "subsystem"] can succeed per channel." Set up the
4612 * appropriate handler for future CHANNEL_DATA and
4613 * CHANNEL_EXTENDED_DATA messages on the channel.
4614 */
4616 proto_tree_add_item_ret_uint(msg_type_tree, hf_ssh_subsystem_name_len, packet_tvb, offset, 4, ENC_BIG_ENDIAN, &slen);
4619 proto_tree_add_item_ret_string(msg_type_tree, hf_ssh_subsystem_name, packet_tvb, offset, slen, ENC_UTF_8, pinfo->pool, &subsystem_name);
4625 }
4627 proto_tree_add_item(msg_type_tree, hf_ssh_connection_recipient_channel, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4629 }
4631 }
4633 /* Channel mapping {{{ */
4635 /* The usual flow:
4636 * 1. client sends SSH_MSG_CHANNEL_OPEN with its (sender) channel number
4637 * 2. server responds with SSH_MSG_CHANNEL_OPEN_CONFIRMATION with
4638 * its channel number and echoing the client's number, creating
4639 * a bijective map
4640 * 3. client sends SSH_MSG_CHANNEL_REQUEST which has the name of
4641 * the shell, command, or subsystem to start. This has the recipient's
4642 * channel number (i.e. the server's)
4643 * 4. server may send back a SSG_MSG_CHANNEL_SUCCESS (or _FAILURE) with
4644 * the the recipient (i.e., client) channel number, but this does not
4645 * contain the subsystem name or anything identifying the request to
4646 * which it responds. It MUST be sent in the same order as the
4647 * corresponding request message (RFC 4254 4 Global Requests), so we
4648 * could track it that way, but for our purposes we just treat all
4649 * requests as successes. (If not, either there won't be data or another
4650 * request will supercede it later.)
4651 *
4652 * Either side can open a channel (RFC 4254 5 Channel Mechanism). The
4653 * typical flow is the client opening a channel, but in the case of
4654 * remote port forwarding (7 TCP/IP Port Forwarding) the directions are
4655 * swapped. For port forwarding, all the information is contained in the
4656 * SSH_MSG_CHANNEL_OPEN, there is no SSH_MSG_CHANNEL_REQUEST.
4657 *
4658 * XXX: Channel numbers can be re-used after being closed (5.3 Closing a
4659 * Channel), but not necessarily mapped to the same channel number on the
4660 * other side. If that actually happens, the right way to handle this is
4661 * to track the state changes over time for random packet access (e.g.,
4662 * using a multimap with the packet number instead of maps.)
4663 */
4667 {
4673 }
4674 }
4676 /* Create pairings between a recipient channel and the sender's channel,
4677 * from a SSH_MSG_CHANNEL_OPEN_CONFIRMATION. */
4678 static void
4679 create_channel(struct ssh_peer_data *peer_data, uint32_t recipient_channel, uint32_t sender_channel)
4680 {
4683 }
4684 wmem_map_insert(peer_data->channel_info, GUINT_TO_POINTER(sender_channel), GUINT_TO_POINTER(recipient_channel));
4688 }
4694 /* If the recipient channel is already configured in the other direction,
4695 * set the handle. We need this if we eventually handle port forwarding,
4696 * where all the information to handle the traffic is sent in the
4697 * SSH_MSG_CHANNEL_OPEN message before the CONFIRMATION. It might also
4698 * help if the packets are out of order (i.e. we get the client
4699 * CHANNEL_REQUEST before the CHANNEL_OPEN_CONFIRMATION.)
4700 */
4703 ssh_channel_info_t *peer_channel = wmem_map_lookup(other_peer_data->channel_handles, GUINT_TO_POINTER(sender_channel));
4706 }
4707 }
4708 }
4712 {
4715 }
4716 ssh_channel_info_t *channel = wmem_map_lookup(peer_data->channel_handles, GUINT_TO_POINTER(recipient_channel));
4719 }
4721 static void
4722 set_subdissector_for_channel(struct ssh_peer_data *peer_data, uint32_t recipient_channel, const uint8_t* subsystem_name)
4723 {
4727 }
4730 /* Map this handle to the recipient channel */
4736 }
4741 }
4744 /* This recipient channel is the sender channel for the other side.
4745 * Do we know what the recipient channel on the other side is? */
4751 if (wmem_map_lookup_extended(channel_info, GUINT_TO_POINTER(recipient_channel), NULL, (void**)&sender_channel)) {
4752 /* Yes. See the handle for the other side too. */
4754 other_peer_data->channel_handles = wmem_map_new(wmem_file_scope(), g_direct_hash, g_direct_equal);
4758 }
4763 }
4765 }
4766 }
4767 }
4768 }
4770 /* Channel mapping. }}} */
4772 static int
4775 {
4781 proto_tree_add_item(msg_type_tree, hf_ssh_global_request_name_len, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4784 proto_tree_add_item(msg_type_tree, hf_ssh_global_request_name, packet_tvb, offset, slen, ENC_ASCII);
4786 proto_tree_add_item(msg_type_tree, hf_ssh_global_request_want_reply, packet_tvb, offset, 1, ENC_BIG_ENDIAN);
4793 ti = proto_tree_add_item(msg_type_tree, hf_ssh_global_request_hostkeys_array_len, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4796 blob_tree = proto_tree_add_subtree(msg_type_tree, packet_tvb, offset, alen, ett_userauth_pk_blob, NULL, "Public key blob");
4799 expert_add_info_format(pinfo, ti, &ei_ssh_packet_decode, "Decoded %d bytes, but packet length is %d bytes", dissected_len, alen);
4800 }
4802 }
4803 }
4805 }
4807 static int
4811 if (peer_data->global_data->ext_ping_openssh_offered && msg_code >= SSH_MSG_PING && msg_code <= SSH_MSG_PONG) {
4812 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, val_to_str(msg_code, ssh2_ext_ping_msg_vals, "Unknown (%u)"));
4813 proto_tree_add_item(msg_type_tree, hf_ssh2_ext_ping_msg_code, packet_tvb, offset, 1, ENC_BIG_ENDIAN);
4817 proto_tree_add_item(msg_type_tree, hf_ssh_ping_data_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4823 proto_tree_add_item(msg_type_tree, hf_ssh_pong_data_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4827 }
4829 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, val_to_str(msg_code, ssh2_msg_vals, "Unknown (%u)"));
4832 }
4834 }
4836 static int
4839 {
4843 proto_tree_add_item(msg_type_tree, hf_ssh_pk_blob_name_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4850 }
4852 static int
4855 {
4859 proto_tree_add_item(msg_type_tree, hf_ssh_pk_sig_blob_name_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4861 proto_tree_add_item(msg_type_tree, hf_ssh_pk_sig_blob_name, packet_tvb, offset, slen, ENC_ASCII);
4864 proto_tree_add_item(msg_type_tree, hf_ssh_pk_sig_s_length, packet_tvb, offset, 4, ENC_BIG_ENDIAN);
4869 }
4875 static void
4877 {
4879 }
4881 static void
4883 {
4896 else
4901 else
4905 #ifdef HAVE_LIBGNUTLS
4907 #endif
4910 }
4912 static void
4914 {
4917 }
4919 static void
4921 {
4930 }
4932 static void
4934 {
4938 #ifdef OPENSSH_STYLE
4940 #else
4942 #endif
4944 #ifdef OPENSSH_STYLE
4946 #else
4948 #endif
4953 #ifdef OPENSSH_STYLE
4955 #else
4957 #endif
4962 }
4963 #ifdef OPENSSH_STYLE
4965 #else
4969 #endif
4970 }
4971 }
4975 static void
4977 {
4979 }
4981 /* Functions for SSH random hashtables. {{{ */
4982 static int
4984 {
4987 }
4997 }
4999 }
5001 static unsigned
5003 {
5010 }
5015 /* id and id->data are mallocated in ssh_save_master_key(). As such 'data'
5016 * should be aligned for any kind of access (for example as a unsigned as
5017 * is done below). The intermediate void* cast is to prevent "cast
5018 * increases required alignment of target type" warnings on CPUs (such
5019 * as SPARCs) that do not allow misaligned memory accesses.
5020 */
5027 }
5029 static void
5031 {
5035 }
5040 }
5042 static void
5044 {
5048 }
5054 }
5055 /* Functions for SSH random hashtables. }}} */
5057 static void
5060 }
5062 void
5064 {
5166 { "encryption_algorithms_client_to_server string", "ssh.encryption_algorithms_client_to_server",
5171 { "encryption_algorithms_server_to_client string", "ssh.encryption_algorithms_server_to_client",
5186 { "compression_algorithms_client_to_server string", "ssh.compression_algorithms_client_to_server",
5191 { "compression_algorithms_server_to_client string", "ssh.compression_algorithms_server_to_client",
5216 { "encryption_algorithms_client_to_server length", "ssh.encryption_algorithms_client_to_server_length",
5221 { "encryption_algorithms_server_to_client length", "ssh.encryption_algorithms_server_to_client_length",
5236 { "compression_algorithms_client_to_server length", "ssh.compression_algorithms_client_to_server_length",
5241 { "compression_algorithms_server_to_client length", "ssh.compression_algorithms_server_to_client_length",
5536 { "Compression algorithms (client to server) length", "ssh.extension.delay_compression.compression_algorithms_client_to_server_length",
5541 { "Compression algorithms (client to server)", "ssh.extension.delay_compression.compression_algorithms_client_to_server",
5546 { "Compression algorithms (server to client) length", "ssh.extension.delay_compression.compression_algorithms_server_to_client_length",
5551 { "Compression algorithms (server to client)", "ssh.extension.delay_compression.compression_algorithms_server_to_client",
5885 },
5887 };
5901 &ett_ssh_segment
5902 };
5905 { &ei_ssh_packet_length, { "ssh.packet_length.error", PI_PROTOCOL, PI_WARN, "Overly large number", EXPFILL }},
5906 { &ei_ssh_packet_decode, { "ssh.packet_decode.error", PI_PROTOCOL, PI_WARN, "Packet decoded length not equal to packet length", EXPFILL }},
5907 { &ei_ssh_channel_number, { "ssh.channel_number.error", PI_PROTOCOL, PI_WARN, "Coud not find channel", EXPFILL }},
5908 { &ei_ssh_invalid_keylen, { "ssh.key_length.error", PI_PROTOCOL, PI_ERROR, "Invalid key length", EXPFILL }},
5910 };
5921 #ifdef SSH_DECRYPT_DEBUG
5923 #else
5925 #endif
5928 "Whether the SSH dissector should reassemble SSH buffers spanning multiple TCP segments. "
5929 "To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",
5932 ssh_master_key_map = g_hash_table_new_full(ssh_hash, ssh_equal, ssh_free_glib_allocated_bignum, ssh_free_glib_allocated_entry);
5934 "The path to the file which contains a list of key exchange secrets in the following format:\n"
5935 "\"<hex-encoded-cookie> <PRIVATE_KEY|SHARED_SECRET> <hex-encoded-key>\" (without quotes or leading spaces).\n",
5939 "Redirect SSH debug to the file specified. Leave empty to disable debugging "
5948 }
5950 void
5952 {
5953 #ifdef SSH_DECRYPT_DEBUG
5955 #endif
5960 }
5962 /*
5963 * Editor modelines - https://www.wireshark.org/tools/modelines.html
5964 *
5965 * Local variables:
5966 * c-basic-offset: 4
5967 * tab-width: 8
5968 * indent-tabs-mode: nil
5969 * End:
5970 *
5971 * vi: set shiftwidth=4 tabstop=8 expandtab:
5972 * :indentSize=4:tabSize=8:noTabs=true:
5973 */