955 lines
31 KiB
C
955 lines
31 KiB
C
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipssh_h.h,v $ $Revision: 1.65.10.13 $
|
|
* $Source: /home/interpeak/CVSRoot/ipssh/src/ipssh_h.h,v $
|
|
* $Author: svc-cmnet $ $Date: 2018-09-12 23:36:06 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Roger Boden <roger@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#ifndef ipssh_h_h
|
|
#define ipssh_h_h
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#if defined(IPCRYPTO) || defined(IP_PORT_OSE5)
|
|
#define IPCOM_USE_CLIB_PROTO
|
|
#endif
|
|
|
|
#include <ipssh_config.h>
|
|
#include <ipssh.h>
|
|
#include <ipcom_type.h>
|
|
#include <ipcom_list.h>
|
|
#include <ipcom_buffer.h>
|
|
#include <ipcom_sock.h>
|
|
#include <ipcom_os.h>
|
|
#include <ipcom_shell.h>
|
|
#include <ipcom_sysvar.h>
|
|
#include "ipssh_list.h"
|
|
#include "ipssh_channel.h"
|
|
|
|
#include <openssl/bn.h>
|
|
#ifdef IPSSH_USE_RSA
|
|
#include <openssl/rsa.h>
|
|
#endif
|
|
#include <openssl/dsa.h>
|
|
#include <openssl/evp.h>
|
|
#include <openssl/hmac.h>
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 DEFINES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#define IPCOM_SYSLOG_FACILITY IPCOM_LOG_IPSSH
|
|
#define IPCOM_SYSLOG_PRIORITY IPSSH_SYSLOG_PRIORITY
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_MAX_LISTEN_PORTS
|
|
*===========================================================================
|
|
* Maximum number of ports the daemon shall be able to listen on.
|
|
*/
|
|
#define IPSSH_MAX_LISTEN_PORTS 5
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_MAX_PKT_SIZE
|
|
*===========================================================================
|
|
* Maximum size of SSH packets we accept.
|
|
*/
|
|
#define IPSSH_MAX_PKT_SIZE 35000
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_CH_WIN_SIZE
|
|
*===========================================================================
|
|
* The initial size of ssh channel window size.
|
|
*
|
|
* Reduce this with caution.
|
|
* Some SSH clients have bugs in the channel window size handling that will
|
|
* erroneusly truncate data if the window size is smaller than the data to
|
|
* be sent.
|
|
*/
|
|
#define IPSSH_CH_WIN_SIZE (64*1024)
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_CH_MAX_PKT
|
|
*===========================================================================
|
|
* When an SSH channel is opened both parties tell the peer the maximum
|
|
* packet size it can handle.
|
|
*/
|
|
#define IPSSH_CH_MAX_PKT (32*1024)
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_SFTP_MAX_PATH
|
|
*===========================================================================
|
|
* Maximum length of paths in the sftp protocol
|
|
*/
|
|
#define IPSSH_SFTP_MAX_PATH 256
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_MAX_PAD
|
|
*===========================================================================
|
|
* The maximum no of padding bytes: largest blocksize + 3
|
|
*
|
|
*/
|
|
#define IPSSH_MAX_PAD (16+3)
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_SUPPORT_LONG_BANNER
|
|
*===========================================================================
|
|
* Define to enable supporting long Login Banner on IPSSH, or its maximum
|
|
* length only can be 255 bytes.
|
|
#define IPSSH_SUPPORT_LONG_BANNER
|
|
*/
|
|
|
|
|
|
/* Maximum size in bytes of signature blob */
|
|
#define IPSSH_SIG_LEN 20 /* TODO: Rename this define? */
|
|
#define IPSSH_MAX_INT_LEN 100
|
|
|
|
#define IPSSH_VERSION "6.9.0"
|
|
|
|
#define IPSSH_VERSION_STRING_MAX_LEN 255
|
|
|
|
#define IPSSH_NONE_STR "none"
|
|
|
|
/* Ciphers */
|
|
#define IPSSH_ENC_NONE_STR IPSSH_NONE_STR
|
|
#define IPSSH_ENC_3DES_CBC_STR "3des-cbc"
|
|
#define IPSSH_ENC_DES_CBC_STR "des-cbc"
|
|
#define IPSSH_ENC_BLOWFISH_CBC_STR "blowfish-cbc"
|
|
#define IPSSH_ENC_TWOFISH_CBC_STR "twofish-cbc"
|
|
#define IPSSH_ENC_AES128_CBC_STR "aes128-cbc"
|
|
#define IPSSH_ENC_AES192_CBC_STR "aes192-cbc"
|
|
#define IPSSH_ENC_AES256_CBC_STR "aes256-cbc"
|
|
#define IPSSH_ENC_ARCFOUR_STR "arcfour"
|
|
#define IPSSH_ENC_ARCFOUR128_STR "arcfour128"
|
|
#define IPSSH_ENC_CAST128_CBC_STR "cast128-cbc"
|
|
|
|
#define IPSSH_ID_END 0
|
|
#define IPSSH_ID_UNKNOWN 0xfe
|
|
#define IPSSH_ID_ERR 0xff
|
|
|
|
#define IPSSH_NONE_ID 1
|
|
|
|
#define IPSSH_ENC_ID_BASE 10
|
|
#define IPSSH_ENC_NONE_ID 1 + IPSSH_ENC_ID_BASE
|
|
#define IPSSH_ENC_3DES_CBC_ID 2 + IPSSH_ENC_ID_BASE
|
|
#define IPSSH_ENC_DES_CBC_ID 3 + IPSSH_ENC_ID_BASE
|
|
#define IPSSH_ENC_BLOWFISH_CBC_ID 4 + IPSSH_ENC_ID_BASE
|
|
#define IPSSH_ENC_TWOFISH_CBC_ID 5 + IPSSH_ENC_ID_BASE
|
|
#define IPSSH_ENC_AES128_CBC_ID 6 + IPSSH_ENC_ID_BASE
|
|
#define IPSSH_ENC_AES192_CBC_ID 7 + IPSSH_ENC_ID_BASE
|
|
#define IPSSH_ENC_AES256_CBC_ID 8 + IPSSH_ENC_ID_BASE
|
|
#define IPSSH_ENC_ARCFOUR_ID 9 + IPSSH_ENC_ID_BASE
|
|
#define IPSSH_ENC_ARCFOUR_128_ID 10 + IPSSH_ENC_ID_BASE
|
|
#define IPSSH_ENC_CAST128_CBC_ID 11 + IPSSH_ENC_ID_BASE
|
|
|
|
#define IPSSH_V1_CIPHER_NONE 0
|
|
#define IPSSH_V1_CIPHER_IDEA 1
|
|
#define IPSSH_V1_CIPHER_DES 2
|
|
#define IPSSH_V1_CIPHER_3DES 3
|
|
#define IPSSH_V1_CIPHER_RC4 5
|
|
#define IPSSH_V1_CIPHER_BLOWFISH 6
|
|
|
|
/* Key exchange methods */
|
|
#define IPSSH_KEYEX_DH_GR1_SHA1_STR "diffie-hellman-group1-sha1"
|
|
#define IPSSH_KEYEX_DH_GR14_SHA1_STR "diffie-hellman-group14-sha1"
|
|
#define IPSSH_KEYEX_DH_GEX_SHA1_STR "diffie-hellman-group-exchange-sha1"
|
|
#define IPSSH_KEYEX_DH_GEX_SHA256_STR "diffie-hellman-group-exchange-sha256"
|
|
#define IPSSH_KEYEX_RSA1024_SHA1_STR "rsa1024-sha1"
|
|
#define IPSSH_KEYEX_RSA2048_SHA256_STR "rsa2048-sha256"
|
|
|
|
#define IPSSH_KEYEX_ID_BASE 30
|
|
#define IPSSH_KEYEX_DH_GR1_SHA1_ID (0 + IPSSH_KEYEX_ID_BASE)
|
|
#define IPSSH_KEYEX_DH_GR14_SHA1_ID (1 + IPSSH_KEYEX_ID_BASE)
|
|
#define IPSSH_KEYEX_DH_GEX_SHA1_ID (2 + IPSSH_KEYEX_ID_BASE)
|
|
#define IPSSH_KEYEX_DH_GEX_SHA256_ID (3 + IPSSH_KEYEX_ID_BASE)
|
|
#define IPSSH_KEYEX_RSA1024_SHA1_ID (4 + IPSSH_KEYEX_ID_BASE)
|
|
#define IPSSH_KEYEX_RSA2048_SHA256_ID (5 + IPSSH_KEYEX_ID_BASE)
|
|
|
|
/* Server key algorithms */
|
|
#define IPSSH_DSA_STR "ssh-dss"
|
|
#define IPSSH_RSA_STR "ssh-rsa"
|
|
#define IPSSH_SERVER_KEY_BASE 40
|
|
#define IPSSH_DSA_ID 0 + IPSSH_SERVER_KEY_BASE
|
|
#define IPSSH_RSA_ID 1 + IPSSH_SERVER_KEY_BASE
|
|
#define IPSSH_V1_RSA_ID 2 + IPSSH_SERVER_KEY_BASE
|
|
|
|
/* MAC algorithms */
|
|
#define IPSSH_MAC_SHA1_STR "hmac-sha1"
|
|
#define IPSSH_MAC_SHA1_96_STR "hmac-sha1-96"
|
|
#define IPSSH_MAC_SHA256_STR "hmac-sha2-256"
|
|
#define IPSSH_MAC_SHA512_STR "hmac-sha2-512"
|
|
#define IPSSH_MAC_MD5_STR "hmac-md5"
|
|
#define IPSSH_MAC_MD5_96_STR "hmac-md5-96"
|
|
#define IPSSH_MAC_NONE_STR IPSSH_NONE_STR
|
|
|
|
#define IPSSH_MAC_ID_BASE 50
|
|
#define IPSSH_MAC_NONE_ID 0 + IPSSH_MAC_ID_BASE
|
|
#define IPSSH_MAC_SHA1_ID 1 + IPSSH_MAC_ID_BASE
|
|
#define IPSSH_MAC_SHA1_96_ID 2 + IPSSH_MAC_ID_BASE
|
|
#define IPSSH_MAC_MD5_ID 3 + IPSSH_MAC_ID_BASE
|
|
#define IPSSH_MAC_MD5_96_ID 4 + IPSSH_MAC_ID_BASE
|
|
#define IPSSH_MAC_SHA256_ID 5 + IPSSH_MAC_ID_BASE
|
|
#define IPSSH_MAC_SHA512_ID 6 + IPSSH_MAC_ID_BASE
|
|
|
|
/* Compression methods */
|
|
#define IPSSH_COMPR_NONE_STR IPSSH_NONE_STR
|
|
|
|
#define IPSSH_COMPR_ID_BASE 60
|
|
#define IPSSH_COMPR_NONE_ID 0 + IPSSH_COMPR_ID_BASE
|
|
|
|
#define IPSSH_FLAG_ALG_ENC 1
|
|
#define IPSSH_FLAG_ALG_MAC 2
|
|
#define IPSSH_FLAG_ALG_KEX 4
|
|
#define IPSSH_FLAG_ALG_SRV_KEY 8
|
|
#define IPSSH_FLAG_ALG_COMPR 16
|
|
#define IPSSH_FLAG_ALG_NOT_ALLOWED_IN_FIPS_MODE 32
|
|
|
|
#define IPSSH_HANDSHAKE_MSG_FLAG_SAVE_VER_STR 1
|
|
|
|
/* Service names */
|
|
#define IPSSH_USERAUTH_STR "ssh-userauth"
|
|
#define IPSSH_CONNECTION_STR "ssh-connection"
|
|
#define IPSSH_SFTP_STR "sftp"
|
|
#define IPSSH_SUBSYSTEM_STR "subsystem"
|
|
|
|
/* Authentication methods */
|
|
#define IPSSH_PW_AUTH_STR "password"
|
|
#define IPSSH_PUBKEY_AUTH_STR "publickey"
|
|
#define IPSSH_HOSTBASED_AUTH_STR "hostbased"
|
|
|
|
#define IPSSH_AUTH_METH_NONE 0
|
|
#define IPSSH_AUTH_METH_PUBLIC_KEY 1
|
|
#define IPSSH_AUTH_METH_PW 2
|
|
#define IPSSH_AUTH_METH_HOSTBASED 4
|
|
|
|
#define IPSSH_V1_RSA_AUTH 2
|
|
#define IPSSH_V1_PW_AUTH 3
|
|
|
|
/* Channel types */
|
|
#define IPSSH_SESSION "session"
|
|
#define IPSSH_DIRECT_TCPIP "direct-tcpip"
|
|
#define IPSSH_TCPIP_FWD "tcpip-forward"
|
|
#define IPSSH_FORWARDED_TCPIP "forwarded-tcpip"
|
|
#define IPSSH_CANCEL_TCPIP_FWD "cancel-tcpip-forward"
|
|
|
|
|
|
/* Reason codes */
|
|
#define IPSSH_OPEN_ADMINISTRATIVELY_PROHIBITED 1
|
|
#define IPSSH_OPEN_CONNECT_FAILED 2
|
|
#define IPSSH_OPEN_UNKNOWN_CHANNEL_TYPE 3
|
|
#define IPSSH_OPEN_RESOURCE_SHORTAGE 4
|
|
|
|
/* Message number, SSH version 1 */
|
|
#define IPSSH_MSG_V1_NONE 0
|
|
#define IPSSH_MSG_V1_DISCONNECT 1
|
|
#define IPSSH_SMSG_V1_PUBLIC_KEY 2
|
|
#define IPSSH_CMSG_V1_SESSION_KEY 3
|
|
#define IPSSH_CMSG_V1_USER 4
|
|
#define IPSSH_CMSG_V1_AUTH_RHOSTS 5
|
|
#define IPSSH_CMSG_V1_AUTH_RSA 6
|
|
#define IPSSH_SMSG_V1_AUTH_RSA_CHALLENGE 7
|
|
#define IPSSH_CMSG_V1_AUTH_RSA_RESPONSE 8
|
|
#define IPSSH_CMSG_V1_AUTH_PASSWORD 9
|
|
#define IPSSH_CMSG_V1_REQUEST_PTY 10
|
|
#define IPSSH_CMSG_V1_WINDOW_SIZE 11
|
|
#define IPSSH_CMSG_V1_EXEC_SHELL 12
|
|
#define IPSSH_CMSG_V1_EXEC_CMD 13
|
|
#define IPSSH_SMSG_V1_SUCCESS 14
|
|
#define IPSSH_SMSG_V1_FAILURE 15
|
|
#define IPSSH_CMSG_V1_STDIN_DATA 16
|
|
#define IPSSH_SMSG_V1_STDOUT_DATA 17
|
|
#define IPSSH_SMSG_V1_STDERR_DATA 18
|
|
#define IPSSH_CMSG_V1_EOF 19
|
|
#define IPSSH_SMSG_V1_EXITSTATUS 20
|
|
#define IPSSH_MSG_V1_CHANNEL_OPEN_CONFIRMATION 21
|
|
#define IPSSH_MSG_V1_CHANNEL_OPEN_FAILURE 22
|
|
#define IPSSH_MSG_V1_CHANNEL_DATA 23
|
|
#define IPSSH_MSG_V1_CHANNEL_CLOSE 24
|
|
#define IPSSH_MSG_V1_CHANNEL_CLOSE_CONFIRMATION 25
|
|
#define IPSSH_SMSG_V1_X11_OPEN 27
|
|
#define IPSSH_CMSG_V1_PORT_FORWARD_REQUEST 28
|
|
#define IPSSH_MSG_V1_PORT_OPEN 29
|
|
#define IPSSH_CMSG_V1_AGENT_REQUEST_FORWARDING 30
|
|
#define IPSSH_SMSG_V1_AGENT_OPEN 31
|
|
#define IPSSH_MSG_V1_IGNORE 32
|
|
#define IPSSH_CMSG_V1_EXIT_CONFIRMATION 33
|
|
#define IPSSH_CMSG_V1_X11_REQUEST_FORWARDING 34
|
|
#define IPSSH_CMSG_V1_AUTH_RHOSTS_RSA 35
|
|
#define IPSSH_MSG_V1_DEBUG 36
|
|
#define IPSSH_CMSG_V1_REQUEST_COMPRESSION 37
|
|
#define IPSSH_CMSG_V1_MAX_PACKET_SIZE 38
|
|
#define IPSSH_CMSG_V1_AUTH_TIS 39
|
|
#define IPSSH_SMSG_V1_AUTH_TIS_CHALLENGE 40
|
|
#define IPSSH_CMSG_V1_AUTH_TIS_RESPONSE 41
|
|
#define IPSSH_CMSG_V1_AUTH_KERBEROS 42
|
|
#define IPSSH_SMSG_V1_AUTH_KERBEROS_RESPONSE 43
|
|
#define IPSSH_CMSG_V1_HAVE_KERBEROS_TGT 44
|
|
|
|
/* Message numbers, transport protocol */
|
|
#define IPSSH_MSG_DISCONNECT 1
|
|
#define IPSSH_MSG_IGNORE 2
|
|
#define IPSSH_MSG_UNIMPLEMENTED 3
|
|
#define IPSSH_MSG_DEBUG 4
|
|
#define IPSSH_MSG_SERVICE_REQUEST 5
|
|
#define IPSSH_MSG_SERVICE_ACCEPT 6
|
|
#define IPSSH_MSG_KEXINIT 20
|
|
#define IPSSH_MSG_NEWKEYS 21
|
|
|
|
#define IPSSH_MSG_KEXDH_INIT 30
|
|
#define IPSSH_MSG_KEXDH_REPLY 31
|
|
|
|
#define IPSSH_MSG_KEX_DH_GEX_REQUEST_OLD 30
|
|
#define IPSSH_MSG_KEX_DH_GEX_REQUEST 34
|
|
#define IPSSH_MSG_KEX_DH_GEX_GROUP 31
|
|
#define IPSSH_MSG_KEX_DH_GEX_INIT 32
|
|
#define IPSSH_MSG_KEX_DH_GEX_REPLY 33
|
|
|
|
/* RFC 4432 */
|
|
#define IPSSH_MSG_KEX_RSA_PUBKEY 30
|
|
#define IPSSH_MSG_KEX_RSA_SECRET 31
|
|
#define IPSSH_MSG_KEX_RSA_DONE 32
|
|
|
|
/* Message numbers, authentication protocol */
|
|
#define IPSSH_MSG_USERAUTH_REQUEST 50
|
|
#define IPSSH_MSG_USERAUTH_FAILURE 51
|
|
#define IPSSH_MSG_USERAUTH_SUCCESS 52
|
|
#define IPSSH_MSG_USERAUTH_BANNER 53
|
|
#define IPSSH_MSG_USERAUTH_PASSWD_CHANGEREQ 60
|
|
#define IPSSH_MSG_USERAUTH_PK_OK 60
|
|
|
|
/* Message numbers, connect protocol */
|
|
#define IPSSH_MSG_GLOBAL_REQUEST 80
|
|
#define IPSSH_MSG_REQUEST_SUCCESS 81
|
|
#define IPSSH_MSG_REQUEST_FAILURE 82
|
|
#define IPSSH_MSG_CHANNEL_OPEN 90
|
|
#define IPSSH_MSG_CHANNEL_OPEN_CONFIRMATION 91
|
|
#define IPSSH_MSG_CHANNEL_OPEN_FAILURE 92
|
|
#define IPSSH_MSG_CHANNEL_WINDOW_ADJUST 93
|
|
#define IPSSH_MSG_CHANNEL_DATA 94
|
|
#define IPSSH_MSG_CHANNEL_EXTENDED_DATA 95
|
|
#define IPSSH_MSG_CHANNEL_EOF 96
|
|
#define IPSSH_MSG_CHANNEL_CLOSE 97
|
|
#define IPSSH_MSG_CHANNEL_REQUEST 98
|
|
#define IPSSH_MSG_CHANNEL_SUCCESS 99
|
|
#define IPSSH_MSG_CHANNEL_FAILURE 100
|
|
|
|
/* Request types */
|
|
#define IPSSH_SHELL "shell"
|
|
#define IPSSH_PTY_REQ "pty-req"
|
|
#define IPSSH_WIN_CHANGE "window-change"
|
|
#define IPSSH_X11_REQ "x11-req"
|
|
#define IPSSH_EXEC "exec"
|
|
#define IPSSH_EXIT_STATUS "exit-status"
|
|
|
|
/* Reason codes, disconnect message */
|
|
#define IPSSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1
|
|
#define IPSSH_DISCONNECT_PROTOCOL_ERROR 2
|
|
#define IPSSH_DISCONNECT_KEY_EXCHANGE_FAILED 3
|
|
#define IPSSH_DISCONNECT_RESERVED 4
|
|
#define IPSSH_DISCONNECT_MAC_ERROR 5
|
|
#define IPSSH_DISCONNECT_COMPRESSION_ERROR 6
|
|
#define IPSSH_DISCONNECT_SERVICE_NOT_AVAILABLE 7
|
|
#define IPSSH_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED 8
|
|
#define IPSSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE 9
|
|
#define IPSSH_DISCONNECT_CONNECTION_LOST 10
|
|
#define IPSSH_DISCONNECT_BY_APPLICATION 11
|
|
#define IPSSH_DISCONNECT_TOO_MANY_CONNECTIONS 12
|
|
#define IPSSH_DISCONNECT_AUTH_CANCELLED_BY_USER 13
|
|
#define IPSSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE 14
|
|
#define IPSSH_DISCONNECT_ILLEGAL_USER_NAME 15
|
|
|
|
/* Flags */
|
|
#define IPSSH_FLAG_NO_CLOSE 1
|
|
|
|
#define IPSSH_FLAG_BUG_UNRESTRICTED_SFTP_MSG_SIZE 1
|
|
|
|
/* Connection states */
|
|
#define IPSSH_CONN_STATE_SERVICE_REQ 1
|
|
#define IPSSH_CONN_STATE_SERVICE_ACCEPT 1 << 1
|
|
|
|
/* Version 2 states */
|
|
#define IPSSH_CONN_STATE_SRV_KEX_INIT 1 << 3
|
|
#define IPSSH_CONN_STATE_SRV_KEX_DH_INIT 1 << 4
|
|
#define IPSSH_CONN_STATE_SRV_KEX_GEX 1 << 5
|
|
#define IPSSH_CONN_STATE_SRV_KEX_RSA 1 << 6
|
|
#define IPSSH_CONN_STATE_SRV_NEW_KEY 1 << 7
|
|
#define IPSSH_CONN_STATE_SRV_SSH_SFTP 1 << 8
|
|
|
|
#define IPSSH_CONN_STATE_SRV_USER_AUTH 1 << 10
|
|
#define IPSSH_CONN_STATE_SRV_TERM 1 << 11
|
|
|
|
#define IPSSH_CONN_STATE_CLT_USER_AUTH_START 1 << 15
|
|
#define IPSSH_CONN_STATE_CLT_USER_AUTH 1 << 16
|
|
#define IPSSH_CONN_STATE_CLT_CONNECTED 1 << 17
|
|
|
|
|
|
|
|
/* Version 1 states */
|
|
#define IPSSH_CONN_STATE_SRV_KEY_EX_V1 1 << 28
|
|
#define IPSSH_CONN_STATE_SRV_PENDING_REQUEST 1 << 29
|
|
|
|
#define IPSSH_CONN_STATE_ALL -1
|
|
|
|
#define IPSSH_SET_LEN_PTR(ptr, len) do { \
|
|
ptr[0] = (Ip_u8) (((len) >> 24) & 0xff);\
|
|
ptr[1] = (Ip_u8) (((len) >> 16) & 0xff);\
|
|
ptr[2] = (Ip_u8) (((len) >> 8) & 0xff);\
|
|
ptr[3] = (Ip_u8) ((len) & 0xff); \
|
|
} while(0)
|
|
|
|
#define IPSSH_SET_32_PTR(ptr, len) do { \
|
|
((Ip_u8*)ptr)[0] = (Ip_u8) (((len) >> 24) & 0xff);\
|
|
((Ip_u8*)ptr)[1] = (Ip_u8) (((len) >> 16) & 0xff);\
|
|
((Ip_u8*)ptr)[2] = (Ip_u8) (((len) >> 8) & 0xff);\
|
|
((Ip_u8*)ptr)[3] = (Ip_u8) ((len) & 0xff); \
|
|
} while(0)
|
|
|
|
#define IPSSH_SET_16_PTR(ptr, value) do { \
|
|
((Ip_u8*)ptr)[0] = (Ip_u8) (((value) >> 8) & 0xff);\
|
|
((Ip_u8*)ptr)[1] = (Ip_u8) ((value) & 0xff);\
|
|
} while(0)
|
|
|
|
#define IPSSH_GET_32_PTR(ptr) \
|
|
(Ip_u32)((ptr)[0] << 24) + \
|
|
(Ip_u32)((ptr)[1] << 16) + \
|
|
(Ip_u32)((ptr)[2] << 8) + \
|
|
(Ip_u32)(ptr)[3]
|
|
|
|
#define IPSSH_GET_LEN(ptr) IPSSH_GET_32_PTR(ptr)
|
|
|
|
#define IPSSH_GET_STR_LEN(sshstr) ipssh_get_len(sshstr)
|
|
#define IPSSH_GET_STR_PTR(sshstr) (&(sshstr[4]))
|
|
|
|
#define IPSSH_GET_MPINT_LEN(mp_int) ipssh_get_len(mp_int)
|
|
#define IPSSH_GET_MPINT_VALUE(mp_int) (&(mp_int[4]))
|
|
#define IPSSH_SET_MPINT_LEN(mp_int, len) IPSSH_SET_LEN_PTR(mp_int, len)
|
|
|
|
/* Used to mark the type of data to hash, in the hash-data list */
|
|
#define IPSSH_MPINT 1
|
|
#define IPSSH_STR 2
|
|
#define IPSSH_CHAR 3
|
|
#define IPSSH_RAW 4
|
|
#define IPSSH_INT 5
|
|
|
|
#define IPSSH_NOT_COMPL_PKT 1
|
|
#define IPSSH_DISPATCH_PKT 2
|
|
|
|
#define IPSSH_ERR -1
|
|
#define IPSSH_BAD_MAC -2
|
|
|
|
|
|
/* Terminal modes SSH v1 */
|
|
#define IPSSH_TTY_OP_END 0
|
|
|
|
/* Terminal modes SSH */
|
|
#define IPSSH_INLCR 34 /* Map NL into CR on input. */
|
|
#define IPSSH_IGNCR 35 /* Ignore CR on input. */
|
|
#define IPSSH_ICRNL 36 /* Map CR to NL on input. */
|
|
#define IPSSH_ONLCR 72 /* Translate newline to carriage return-newline (output) */
|
|
|
|
/* Name of ipssh daemon process */
|
|
#define IPSSH_DAEMON_NAME "ipsshd"
|
|
|
|
#define IPSSH_MODE_UNDEF 0
|
|
#define IPSSH_MODE_CLT 1
|
|
#define IPSSH_MODE_SRV 2
|
|
|
|
#define IPSSH_PORT_FWD_EVENT_OPEN 1
|
|
#define IPSSH_PORT_FWD_EVENT_LISTEN 2
|
|
#define IPSSH_PORT_FWD_EVENT_CLOSE 3
|
|
#define IPSSH_PORT_FWD_EVENT_SEND_WINDOW_OPEN 4
|
|
#define IPSSH_PORT_FWD_EVENT_SEND_WINDOW_CLOSED 5
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH code lock
|
|
*===========================================================================
|
|
*/
|
|
|
|
#ifdef IPSSH_ASSERT
|
|
#define IPSSH_CODE_ISLOCKED_ASSERT() ip_assert(g_ipssh.code_mutex_count == 1)
|
|
#define IPSSH_CODE_LOCK() do { ip_assert(g_ipssh.code_lock_owner != ipcom_getpid()); \
|
|
ipcom_mutex_lock(g_ipssh.code_mutex); \
|
|
g_ipssh.code_lock_owner = ipcom_getpid(); \
|
|
ip_assert(g_ipssh.code_mutex_count == 0); \
|
|
g_ipssh.code_mutex_count++; \
|
|
} while(0)
|
|
#define IPSSH_CODE_UNLOCK() do { ip_assert(g_ipssh.code_mutex_count == 1); \
|
|
g_ipssh.code_mutex_count--; \
|
|
g_ipssh.code_lock_owner = 0; \
|
|
ipcom_mutex_unlock(g_ipssh.code_mutex); \
|
|
} while(0)
|
|
#else
|
|
#define IPSSH_CODE_ISLOCKED_ASSERT() IP_NOOP
|
|
#define IPSSH_CODE_LOCK() ipcom_mutex_lock(g_ipssh.code_mutex)
|
|
#define IPSSH_CODE_UNLOCK() ipcom_mutex_unlock(g_ipssh.code_mutex)
|
|
#endif
|
|
|
|
#if defined(IPCOM_USE_INET) && defined(IPCOM_USE_INET6) && defined(IPLITE)
|
|
#define IPSSH_V6_MAPPED_V4_ADDR_NOT_SUPPORTED
|
|
#endif
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 5 TYPES
|
|
****************************************************************************
|
|
*/
|
|
|
|
/* Forward declarations */
|
|
struct Ipssh_srv_ctx_st;
|
|
struct Ipssh_conn_st;
|
|
struct Ipssh_conn_ctx_st;
|
|
struct Ipssh_channel_st;
|
|
|
|
typedef struct
|
|
{
|
|
Ip_s32 len;
|
|
Ip_u8* value;
|
|
} Ipssh_mp_int;
|
|
|
|
typedef struct Ipssh_msg_list_st
|
|
{
|
|
Ipcom_list list;
|
|
Ip_u8 hash_pos;
|
|
Ip_u8 type;
|
|
Ip_size_t msg_len;
|
|
Ip_u8* value;
|
|
} Ipssh_msg_list;
|
|
|
|
#ifdef _WRS_CONFIG_COMPONENT_IPSSH_SUPPORT_SHA2
|
|
struct Ipssh_conn_prop_st
|
|
{
|
|
Ip_u8 kex_alg[16];
|
|
Ip_u8 srv_host_key_alg[8];
|
|
Ip_u8 enc_alg_clt2srv[32];
|
|
Ip_u8 enc_alg_srv2clt[32];
|
|
Ip_u8 mac_alg_clt2srv[16];
|
|
Ip_u8 mac_alg_srv2clt[16];
|
|
Ip_u8 compr_alg_clt2srv[8];
|
|
Ip_u8 compr_alg_srv2clt[8];
|
|
Ip_u8 lang_clt2srv[4];
|
|
Ip_u8 lang_srv2clt[4];
|
|
};
|
|
#else
|
|
struct Ipssh_conn_prop_st
|
|
{
|
|
Ip_u8 kex_alg[8];
|
|
Ip_u8 srv_host_key_alg[4];
|
|
Ip_u8 enc_alg_clt2srv[16];
|
|
Ip_u8 enc_alg_srv2clt[16];
|
|
Ip_u8 mac_alg_clt2srv[8];
|
|
Ip_u8 mac_alg_srv2clt[8];
|
|
Ip_u8 compr_alg_clt2srv[4];
|
|
Ip_u8 compr_alg_srv2clt[4];
|
|
Ip_u8 lang_clt2srv[4];
|
|
Ip_u8 lang_srv2clt[4];
|
|
};
|
|
#endif
|
|
typedef struct Ipssh_conn_prop_st Ipssh_conn_prop;
|
|
|
|
struct Ipssh_conn_config_st
|
|
{
|
|
/* Config */
|
|
Ip_u8 v1;
|
|
Ip_u8 v2;
|
|
|
|
/* Services, on/off */
|
|
Ip_u8 term;
|
|
Ip_u8 sftp;
|
|
Ip_u8 port_fwd;
|
|
|
|
/* Authentication */
|
|
Ip_u8 auth_none_allowed;
|
|
Ip_u8 pw_allowed;
|
|
Ip_u8 pw_required;
|
|
Ip_u8 pub_key_allowed;
|
|
Ip_u8 pub_key_required;
|
|
Ip_u8 pub_key_first;
|
|
Ip_u8 hostbased_allowed;
|
|
Ip_u8 hostbased_required;
|
|
Ip_u8 pad[3];
|
|
|
|
int max_fail;
|
|
int v1_auth_meth;
|
|
int max_channels;
|
|
|
|
/* v1 config */
|
|
int v1_enc_algs;
|
|
|
|
/* v2 config */
|
|
struct Ipssh_conn_prop_st v2_algs;
|
|
|
|
char sftp_start_dir[IPSSH_SFTP_MAX_PATH];
|
|
#ifdef IPSSH_SUPPORT_LONG_BANNER
|
|
char *auth_banner;
|
|
#else
|
|
char auth_banner[IPSSH_AUTH_BANNER_MAX_LEN];
|
|
#endif
|
|
|
|
/* Clt config parameters for group key exchange */
|
|
int gex_min;
|
|
int gex_n;
|
|
int gex_max;
|
|
};
|
|
typedef struct Ipssh_conn_config_st Ipssh_conn_config;
|
|
|
|
struct Ipssh_srv_ctx_st
|
|
{
|
|
#ifdef IPSSH_USE_RSA
|
|
RSA* rsa_key;
|
|
RSA* rsa_keyex_key;
|
|
#endif
|
|
DSA* dsa_key;
|
|
/* Config */
|
|
int port[IPSSH_MAX_LISTEN_PORTS];
|
|
int idle_timeout;
|
|
int max_clients;
|
|
|
|
Ipssh_conn_config config;
|
|
|
|
int ref;
|
|
};
|
|
typedef struct Ipssh_srv_ctx_st Ipssh_srv_ctx;
|
|
|
|
typedef struct Ipssh_data_st
|
|
{
|
|
Ipcom_list clt_list; /* A list of Ipssh_conn_ctx */
|
|
Ipcom_mutex code_mutex;
|
|
Ipcom_list subsystem_init_cb_list;
|
|
#ifdef IPSSH_ASSERT
|
|
int code_mutex_count;
|
|
Ip_pid_t code_lock_owner;
|
|
#endif
|
|
Ip_u16 task_name_id; /* To avoid same SSH task name, add once created a new task */
|
|
} Ipssh_data;
|
|
|
|
struct Ipssh_conn_ctx_st;
|
|
struct Ipssh_map_entry_st;
|
|
|
|
typedef Ip_err (*Ipssh_sock_handler)(Ip_fd sock,
|
|
struct Ipssh_conn_ctx_st* ctx,
|
|
struct Ipssh_map_entry_st* map_entry);
|
|
|
|
typedef Ip_err (*Ipssh_pkt_handler)(struct Ipssh_conn_st* ssh_conn);
|
|
|
|
struct Ipssh_map_entry_st
|
|
{
|
|
Ipcom_list list;
|
|
Ip_fd sock;
|
|
struct Ipssh_conn_ctx_st* ctx;
|
|
Ipssh_sock_handler handler;
|
|
int flags;
|
|
};
|
|
typedef struct Ipssh_map_entry_st Ipssh_map_entry;
|
|
|
|
typedef Ipcom_list Ipssh_ctx_map;
|
|
|
|
typedef struct
|
|
{
|
|
BIGNUM* e;
|
|
BIGNUM* f;
|
|
DH* dh;
|
|
} Ipssh_kex_dh_data;
|
|
|
|
typedef struct
|
|
{
|
|
Ip_u8* key;
|
|
Ip_s32 len;
|
|
Ip_s32 alloc;
|
|
} Ipssh_key;
|
|
|
|
typedef struct
|
|
{
|
|
Ipssh_key iv_c2s;
|
|
Ipssh_key iv_s2c;
|
|
Ipssh_key key_c2s;
|
|
Ipssh_key key_s2c;
|
|
Ipssh_key mac_key_c2s;
|
|
Ipssh_key mac_key_s2c;
|
|
Ipssh_key mac_key_c2s_active;
|
|
Ipssh_key mac_key_s2c_active;
|
|
} Ipssh_key_mtrl;
|
|
|
|
typedef struct Ipssh_port_fwd_addr_map_st
|
|
{
|
|
Ipcom_list list;
|
|
Ip_fd sock;
|
|
char* addr;
|
|
Ip_u32 port;
|
|
} Ipssh_port_fwd_addr_map;
|
|
|
|
struct Ipssh_conn_ctx_st
|
|
{
|
|
Ipcom_list list;
|
|
|
|
struct Ipssh_conn_st* ssh_conn;
|
|
|
|
Ip_pid_t pid;
|
|
char* version_str; /* Holds version string received from client */
|
|
char* clt_id; /* Holds name of clt implementation (from ver str) */
|
|
Ip_fd_set read_set;
|
|
Ip_fd_set write_set;
|
|
Ipssh_ctx_map ctx_map;
|
|
Ipssh_srv_ctx* srv_ctx;
|
|
|
|
|
|
#ifdef IPSSH_USE_STOP_SPAWN
|
|
/* Socket used to implement termination of spawned ipssh processes */
|
|
Ip_fd stop_sock;
|
|
Ip_u16 stop_port;
|
|
#endif
|
|
|
|
};
|
|
typedef struct Ipssh_conn_ctx_st Ipssh_conn_ctx;
|
|
|
|
typedef struct Ipssh_spawn_args_st
|
|
{
|
|
Ip_fd sock;
|
|
Ipssh_srv_ctx* srv_ctx;
|
|
} Ipssh_spawn_args;
|
|
|
|
typedef struct Ipssh_daemon_args_st
|
|
{
|
|
void* config;
|
|
} Ipssh_daemon_args;
|
|
|
|
typedef Ip_err (*Ipssh_port_fwd_cb)(struct Ipssh_conn_st* ssh_conn, Ip_fd port_fwd_sock, int event);
|
|
|
|
struct Ipssh_mac_st
|
|
{
|
|
const EVP_MD* md;
|
|
int use_bits;
|
|
};
|
|
typedef struct Ipssh_mac_st Ipssh_mac;
|
|
|
|
struct Ipssh_clt_conn_st
|
|
{
|
|
/* Authentication parameters */
|
|
char userid[32];
|
|
char pw[32];
|
|
int auth_flags;
|
|
EVP_PKEY* srv_pub_key;
|
|
EVP_PKEY* key; /* For public key authentication */
|
|
EVP_PKEY* host_key; /* For hostbased authentication */
|
|
struct Ipssh_channel_st* channel;
|
|
};
|
|
typedef struct Ipssh_clt_conn_st Ipssh_clt_conn;
|
|
|
|
struct Ipssh_srv_conn_st
|
|
{
|
|
#ifdef IPSSH_USE_RSA
|
|
struct rsa_st* rsa_key;
|
|
#endif
|
|
struct dsa_st* dsa_key;
|
|
};
|
|
typedef struct Ipssh_srv_conn_st Ipssh_srv_conn;
|
|
|
|
union Ipssh_clt_srv_st
|
|
{
|
|
Ipssh_clt_conn clt;
|
|
Ipssh_srv_conn srv;
|
|
};
|
|
|
|
struct Ipssh_conn_st
|
|
{
|
|
Ip_fd sock;
|
|
|
|
struct Ipssh_conn_config_st config;
|
|
Ipssh_conn_ctx* ssh_conn_ctx;
|
|
|
|
int conn_state;
|
|
int post_kex_conn_state;
|
|
int mode; /* clt or srv */
|
|
union Ipssh_clt_srv_st data;
|
|
|
|
/* Server keys */
|
|
#ifdef IPSSH_USE_RSA
|
|
RSA* srv_rsa_key;
|
|
RSA* srv_rsa_keyex_key;
|
|
#endif
|
|
DSA* srv_dsa_key;
|
|
|
|
Ipcom_buffer* recv_enc_buf; /* Holds received data. In encrypted form */
|
|
Ipcom_buffer* recv_plain_buf; /* Holds received data, decrypted */
|
|
Ip_bool complete_pkt_read;
|
|
|
|
EVP_CIPHER_CTX send_ctx;
|
|
EVP_CIPHER_CTX recv_ctx;
|
|
HMAC_CTX send_hmac_ctx;
|
|
HMAC_CTX recv_hmac_ctx;
|
|
Ipssh_mac send_mac;
|
|
Ipssh_mac recv_mac;
|
|
|
|
Ip_u8 first_kex_pkt_follows;
|
|
Ip_bool kexinit_sent;
|
|
Ip_bool kexinit_received;
|
|
Ip_u8 v2_cookie[16];
|
|
Ipssh_conn_prop conn_prop; /* These are the algs currently used */
|
|
Ipssh_conn_prop conn_prop_pending; /* These are the algs being negotiated */
|
|
Ipssh_conn_prop peer_proposal; /* These are the algs the peer proposed in the SSH handshake */
|
|
|
|
const EVP_MD* (*hash_func)(void);
|
|
Ip_u8* shared_secret; /* Denoted K in spec */
|
|
Ip_s32 secr_len; /* Length of shared secret */
|
|
Ip_u8* hash; /* Denoted H in spec */
|
|
Ip_u32 hash_len;
|
|
Ipssh_key_mtrl key_mtrl;
|
|
Ipcom_list handshake_msgs;
|
|
|
|
int ssh_version;
|
|
|
|
/* Session id */
|
|
Ip_u8* sess_id;
|
|
Ip_s32 sess_id_len;
|
|
|
|
/* Key exchange variables */
|
|
Ipssh_kex_dh_data* dh_data;
|
|
Ip_s32 skip_guessed_kex_pkt;
|
|
Ip_bool dh_gex_old; /* Client uses the old group exchange */
|
|
|
|
/* User authentication data */
|
|
char* user;
|
|
char* service;
|
|
int auth_meth;
|
|
int auth_failure_count;
|
|
int auth_state;
|
|
Ip_bool auth_banner_sent;
|
|
|
|
Ipcom_shell_ctx* sh_ctx;
|
|
|
|
Ip_u32 seq_no_recv;
|
|
Ip_u32 seq_no_send;
|
|
|
|
/* Channels pertaining to this ssh connection */
|
|
Ipssh_channel_map ch_map;
|
|
|
|
/* Port forwarding data */
|
|
Ipcom_list port_fwd_addr_map;
|
|
Ipssh_port_fwd_cb port_fwd_cb;
|
|
|
|
int no_channels; /* Number of currently open channels */
|
|
|
|
Ip_u32 flags;
|
|
|
|
/* Version 1 data */
|
|
#ifdef IPSSH_USE_V1
|
|
RSA* server_key;
|
|
RSA* client_pub_key;
|
|
Ip_u8 cipher;
|
|
Ip_u8 v1_cookie[8];
|
|
Ip_u8 session_key[32];
|
|
Ip_u8 session_id_v1[16];
|
|
Ip_u8 rsa_challenge[32];
|
|
Ipssh_channel* stdio_channel;
|
|
Ip_u32 v1_pad_len;
|
|
#endif
|
|
|
|
void* extra;
|
|
};
|
|
typedef struct Ipssh_conn_st Ipssh_conn;
|
|
|
|
IP_EXTERN Ipssh_data g_ipssh;
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
|
|
IP_GLOBAL void ipssh_conn_free(struct Ipssh_conn_st* ssh_conn);
|
|
IP_GLOBAL Ip_err ipssh_conn_init(struct Ipssh_conn_st* ssh_conn);
|
|
IP_GLOBAL const char* ipssh_alg_id2str(Ip_u8 id);
|
|
IP_GLOBAL Ip_err ipssh_alg_list_str2id(const char* str_list_org, Ip_u8* id_list, int id_list_len);
|
|
IP_GLOBAL Ip_err ipssh_make_version_str(int v1, int v2, char* buf, int buf_len);
|
|
IP_GLOBAL int ipssh_get_conn_version(int major_ver, int minor_ver, int v1, int v2, Ip_bool comp_mode);
|
|
IP_GLOBAL Ip_err ipssh_read_from_socket(Ip_fd sock, char* buf, Ip_size_t* buf_len, const char* delim);
|
|
|
|
IP_GLOBAL Ipssh_map_entry*
|
|
ipssh_store_map_entry(Ipssh_conn_ctx* ctx,
|
|
Ip_fd sock,
|
|
Ipssh_sock_handler handler,
|
|
int flags);
|
|
|
|
IP_GLOBAL void ipssh_register_shell_cmds(void);
|
|
|
|
IP_GLOBAL void ipssh_unregister_shell_cmds(void);
|
|
|
|
IP_GLOBAL void ipssh_free_handshake_msgs(Ipssh_conn* ssh_conn, int flags);
|
|
|
|
IP_PUBLIC Ip_err ipssh_validate_userid_pw(const char* user, const char* pw, void** cookie);
|
|
|
|
#ifdef IPSSH_USE_V1
|
|
IP_GLOBAL RSA* ipssh_generate_server_key(RSA* host_key);
|
|
#endif
|
|
IP_GLOBAL Ip_s32 ipssh_store_char(Ipcom_buffer* buf, Ipssh_term_modes* term_modes, Ip_u8 chr, Ip_u8* last_chr);
|
|
IP_GLOBAL char * ipssh_key_fingerprint_bubblebabble(Ip_u8* dgst_raw, unsigned int dgst_raw_len);
|
|
|
|
IP_GLOBAL Ip_err ipssh_get_config(Ipssh_conn_config* config);
|
|
IP_GLOBAL Ip_err ipssh_get_banner_config(Ipssh_conn_config* config);
|
|
|
|
IP_GLOBAL void ipssh_handle_term_modes(Ip_u8* buf, int len, Ipssh_term_modes *term_modes);
|
|
IP_GLOBAL int ipssh_get_no_clients(void);
|
|
|
|
IP_GLOBAL Ipssh_srv_ctx* ipssh_srv_ctx_new(void);
|
|
IP_GLOBAL void ipssh_srv_ctx_free(Ipssh_srv_ctx* srv_ctx);
|
|
IP_GLOBAL Ipssh_srv_ctx* ipssh_srv_ctx_dup(Ipssh_srv_ctx* srv_ctx);
|
|
|
|
IP_GLOBAL Ip_fd ipssh_sock_shell_start(Ipssh_conn* ssh_ctx, const char* user, Ipcom_shell_ctx* sh_ctx);
|
|
IP_GLOBAL Ip_err ipssh_sock_shell_stdin(Ip_fd shell_fd, const char* data, int len);
|
|
IP_GLOBAL int ipssh_send_shell_stdout_data2(Ipssh_conn* ssh_conn, Ip_fd shell_fd, const char* data, Ip_ssize_t len);
|
|
#ifdef IPTESTENGINE
|
|
IP_GLOBAL Ip_err ipssh_test_subsystem_init_cb(Ipssh_channel* channel, Ip_fd* sock);
|
|
#endif
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
#endif
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|