Subversion Repositories Kolibri OS

Rev

Rev 6419 | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed

Rev 6419 Rev 6469
Line 13... Line 13...
13 
;    GNU General Public License for more details.
 13 
;    GNU General Public License for more details.
14 
;
 14 
;
15 
;    You should have received a copy of the GNU General Public License
 15 
;    You should have received a copy of the GNU General Public License
16 
;    along with this program.  If not, see .
 16 
;    along with this program.  If not, see .
Line 17... Line -...
17 
 
 - 
 
18 
struct  ssh_header
 - 
 
19 
        length          dd ?
 - 
 
20 
        padding         db ?
 - 
 
21 
        message_code    db ?
 - 
 
Line 22... Line 17...
22 
ends
 17 
 
- 
 
 18 
 
- 
 
 19 
struct  ssh_packet_header
- 
 
 20 
        packet_length   dd ?    ; The length of the packet in bytes, not including 'mac' or the
- 
 
 21 
                                ; 'packet_length' field itself.
- 
 
 22 
        padding_length  db ?    ; Length of 'random padding' (bytes).
- 
 
 23 
 
Line 23... Line -...
23 
 
 - 
 
24 
proc dummy_encrypt _key, _in, _out
 - 
 
Line 25... Line 24...
25 
 
 24 
        message_code    db ?    ; First byte of payload
Line 26... Line 25...
26 
        ret
 25 
ends
27 
endp
 - 
 
28 
 
 - 
 
29 
proc ssh_recv_packet sock, buf, size, flags
 26 
 
30 
 
 27 
 
Line 31... Line 28...
31 
locals
 28 
proc ssh_recv_packet connection, flags
32 
        bufferptr       dd ?
 29 
 
- 
 
 30 
locals
- 
 
 31 
        data_length     dd ?    ; Total length of packet without MAC
33 
        remaining       dd ?
 32 
endl
- 
 
 33 
 
- 
 
 34 
        DEBUGF  2, "> "
- 
 
 35 
; Receive first block (Read length, padding length, message code)
34 
        padding         dd ?
 36 
        mov     ebx, [connection]
35 
endl
 37 
        mov     ecx, [ebx+ssh_connection.socketnum]
- 
 
 38 
        mov     esi, [ebx+ssh_connection.rx_crypt_blocksize]
36 
 
 39 
        lea     edx, [ebx+ssh_connection.rx_buffer]
37 
        DEBUGF  1, "ssh_recv_packet\n"
 40 
        mov     edi, [flags]
- 
 
 41 
        mcall   recv
38 
; Receive first block (Read length, padding length, message code)
 42 
        DEBUGF  1, "chunk = %u ", eax
39 
        mcall   recv, [sock], [buf], [rx_blocksize], [flags]
 - 
 
40 
        DEBUGF  1, "chunk = %u\n", eax
 43 
        mov     ebx, [connection]
- 
 
 44 
        cmp     eax, [ebx+ssh_connection.rx_crypt_blocksize]
41 
        cmp     eax, [rx_blocksize]
 45 
        jne     .fail
- 
 
 46 
 
42 
        jne     .fail       ;;;;
 47 
; Decrypt first block
- 
 
 48 
        cmp     [ebx+ssh_connection.rx_crypt_proc], 0
- 
 
 49 
        je      @f
- 
 
 50 
        pusha
43 
 
 51 
        lea     esi, [ebx+ssh_connection.rx_buffer]
44 
;        stdcall [decrypt_proc], [rx_context], [buf], [buf]
 52 
        stdcall [ebx+ssh_connection.rx_crypt_proc], [ebx+ssh_connection.rx_crypt_ctx_ptr], esi, esi
45 
 
 53 
        popa
46 
        mov     ebx, [buf]
 54 
  @@:
- 
 
 55 
 
- 
 
 56 
; Check data length
47 
        movzx   eax, [ebx+ssh_header.padding]
 57 
        mov     esi, [ebx+ssh_connection.rx_buffer.packet_length]
- 
 
 58 
        bswap   esi                                             ; convert length to little endian
- 
 
 59 
        mov     [ebx+ssh_connection.rx_buffer.packet_length], esi
- 
 
 60 
        DEBUGF  1, "packet length=%u ", esi
48 
        mov     [padding], eax
 61 
        cmp     esi, BUFFERSIZE
49 
        mov     eax, [ebx+ssh_header.length]
 62 
        ja      .fail                                           ; packet is too large
50 
        bswap   eax                                             ; length to little endian
 63 
 
51 
        mov     [ebx+ssh_header.length], eax
 64 
; Calculate amount of remaining data
52 
        DEBUGF  1, "ssh_recv_packet length = %u\n", eax
 65 
        add     esi, 4                                          ; Packet length field itself is not included in the count
53 
 
 66 
        sub     esi, [ebx+ssh_connection.rx_crypt_blocksize]    ; Already received this amount of data
54 
        cmp     eax, [size]
 67 
        add     esi, [ebx+ssh_connection.rx_mac_length]
55 
        ja      .fail       ;;;;
 68 
        jz      .got_all_data
56 
 
 69 
 
57 
        sub     eax, [rx_blocksize]
 70 
; Receive remaining data
58 
        add     eax, 4
 71 
        lea     edx, [ebx+ssh_connection.rx_buffer]
59 
        mov     [remaining], eax
 72 
        add     edx, [ebx+ssh_connection.rx_crypt_blocksize]
60 
        add     ebx, [rx_blocksize]
 73 
        mov     ecx, [ebx+ssh_connection.socketnum]
61 
        mov     [bufferptr], ebx
 74 
        mov     edi, [flags]
62 
  .receive_loop:
 75 
  .receive_loop:
63 
        mcall   recv, [sock], [bufferptr], [remaining], 0
 76 
        mcall   recv
64 
        DEBUGF  1, "chunk = %u\n", eax
 77 
        DEBUGF  1, "chunk = %u ", eax
65 
        cmp     eax, 0
 78 
        cmp     eax, 0
- 
 
 79 
        jbe     .fail
66 
        jbe     .fail
 80 
        add     edx, eax
- 
 
 81 
        sub     esi, eax
- 
 
 82 
        jnz     .receive_loop
- 
 
 83 
 
- 
 
 84 
; Decrypt data
67 
        add     [bufferptr], eax
 85 
        mov     ebx, [connection]
68 
        sub     [remaining], eax
 86 
        cmp     [ebx+ssh_connection.rx_crypt_proc], 0
- 
 
 87 
        je      .decrypt_complete
- 
 
 88 
        mov     ecx, [ebx+ssh_connection.rx_buffer.packet_length]
69 
        ja      .receive_loop
 89 
        add     ecx, 4                                          ; Packet_length field itself
- 
 
 90 
        sub     ecx, [ebx+ssh_connection.rx_crypt_blocksize]    ; Already decrypted this amount of data
- 
 
 91 
        jz      .decrypt_complete
70 
 
 92 
 
- 
 
 93 
        lea     esi, [ebx+ssh_connection.rx_buffer]
- 
 
 94 
        add     esi, [ebx+ssh_connection.rx_crypt_blocksize]
71 
;  .decrypt_loop:
 95 
  .decrypt_loop:
- 
 
 96 
        pusha
72 
;        stdcall [decrypt_proc], [rx_context], [buf], [buf]
 97 
        stdcall [ebx+ssh_connection.rx_crypt_proc], [ebx+ssh_connection.rx_crypt_ctx_ptr], esi, esi
73 
;        ja      .decrypt_loop
 98 
        popa
- 
 
 99 
        add     esi, [ebx+ssh_connection.rx_crypt_blocksize]
- 
 
 100 
        sub     ecx, [ebx+ssh_connection.rx_crypt_blocksize]
- 
 
 101 
        jnz     .decrypt_loop
- 
 
 102 
  .decrypt_complete:
- 
 
 103 
 
- 
 
 104 
; Authenticate message
- 
 
 105 
        cmp     [ebx+ssh_connection.rx_mac_proc], 0
- 
 
 106 
        je      .mac_complete
- 
 
 107 
        lea     esi, [ebx+ssh_connection.rx_seq]
- 
 
 108 
        mov     ecx, [ebx+ssh_connection.rx_buffer.packet_length]
- 
 
 109 
        add     ecx, 8                                          ; packet_length field itself + sequence number
- 
 
 110 
        lea     eax, [ebx+ssh_connection.rx_mac_ctx]
- 
 
 111 
        mov     edx, [ebx+ssh_connection.rx_buffer.packet_length]
- 
 
 112 
        bswap   edx                                             ; convert length to big endian
- 
 
 113 
        mov     [ebx+ssh_connection.rx_buffer.packet_length], edx
- 
 
 114 
        stdcall [ebx+ssh_connection.rx_mac_proc], eax, esi, ecx
- 
 
 115 
        mov     edx, [ebx+ssh_connection.rx_buffer.packet_length]
74 
 
 116 
        bswap   edx                                             ; convert length to little endian
75 
;  .hmac_loop:
 117 
        mov     [ebx+ssh_connection.rx_buffer.packet_length], edx
- 
 
 118 
 
- 
 
 119 
        lea     esi, [ebx+ssh_connection.rx_mac_ctx]
- 
 
 120 
        lea     edi, [ebx+ssh_connection.rx_buffer]
- 
 
 121 
        add     edi, [ebx+ssh_connection.rx_buffer.packet_length]
- 
 
 122 
        add     edi, 4
- 
 
 123 
        mov     ecx, [ebx+ssh_connection.rx_mac_length]
- 
 
 124 
        shr     ecx, 2
- 
 
 125 
        repe cmpsd
- 
 
 126 
        jne     .mac_failed
- 
 
 127 
  .mac_complete:
- 
 
 128 
        inc     byte[ebx+ssh_connection.rx_seq+3]               ; Update sequence counter
- 
 
 129 
        jnc     @f
- 
 
 130 
        inc     byte[ebx+ssh_connection.rx_seq+2]
- 
 
 131 
        jnc     @f
- 
 
 132 
        inc     byte[ebx+ssh_connection.rx_seq+1]
76 
; TODO
 133 
        jnc     @f
- 
 
 134 
        inc     byte[ebx+ssh_connection.rx_seq+0]
77 
;        ja      .hmac_loop
 135 
  @@:
78 
 
 136 
 
79 
; Return usefull data length in eax
 137 
; Return useful data length to the caller via eax register
Line 80... Line 138...
80 
        mov     eax, [buf]
 138 
  .got_all_data:
81 
        movzx   ebx, [eax+ssh_header.padding]
 139 
        mov     eax, [ebx+ssh_connection.rx_buffer.packet_length]
- 
 
 140 
        movzx   ebx, [ebx+ssh_connection.rx_buffer.padding_length]
- 
 
 141 
        sub     eax, ebx
- 
 
 142 
        DEBUGF  1, "useful data length=%u\n", eax
- 
 
 143 
        ret
- 
 
 144 
 
82 
        mov     eax, [eax+ssh_header.length]
 145 
  .fail:
83 
        sub     eax, ebx
 146 
        DEBUGF  3, "ssh_recv_packet failed!\n"
Line 84... Line 147...
84 
        DEBUGF  1, "ssh_recv_packet complete, usefull data length=%u\n", eax
 147 
        mov     eax, -1
Line 85... Line 148...
85 
        ret
 148 
        ret
Line 86... Line 149...
86 
 
 149 
 
87 
  .fail:
 150 
  .mac_failed:
88 
        DEBUGF  1, "ssh_recv_packet failed!\n"
 151 
        DEBUGF  3, "ssh_recv_packet MAC failed!\n"
89 
        mov     eax, -1
 152 
        mov     eax, -1
Line -... Line 153...
- 
 
 153 
        ret
90 
        ret
 154 
 
91 
 
 155 
endp
92 
endp
 - 
 
93 
 
 156 
 
94 
 
 157 
 
95 
proc ssh_send_packet sock, buf, payloadsize, flags
 158 
proc ssh_send_packet connection, buf, payload_size, flags
- 
 
 159 
 
96 
 
 160 
locals
97 
locals
 161 
        packet_size    dd ?
98 
        size    dd ?
 162 
endl
99 
endl
 163 
        DEBUGF  2, "< "
100 
        DEBUGF  1, "ssh_send_packet: size=%u\n", [payloadsize]
 164 
 
101 
 
 165 
; Pad the packet with random data
102 
        mov     eax, [payloadsize]
 166 
        mov     eax, [payload_size]
103 
        inc     eax             ; padding length byte
 167 
        inc     eax                     ; padding length byte
104 
 
 168 
        lea     edx, [eax+4]            ; total packet size (without padding and MAC)
105 
        lea     edx, [eax+4]    ; total packet size (without padding)
 169 
        mov     [packet_size], edx
Line 106... Line 170...
106 
        mov     [size], edx
 170 
        mov     ecx, [connection]
107 
        mov     ebx, [tx_blocksize]
 171 
        mov     ebx, [ecx+ssh_connection.tx_crypt_blocksize]
108 
        dec     ebx
 172 
        dec     ebx
109 
        and     edx, ebx
 173 
        and     edx, ebx
110 
        neg     edx
 174 
        neg     edx
111 
        add     edx, [tx_blocksize]
 175 
        add     edx, [ecx+ssh_connection.tx_crypt_blocksize]
112 
        cmp     edx, 4          ; minimum padding size
 176 
        cmp     edx, 4                  ; minimum padding size
113 
        jae     @f
 177 
        jae     @f
114 
        add     edx, [tx_blocksize]
 - 
 
115 
  @@:
 - 
 
116 
        DEBUGF  1, "Padding %u bytes\n", edx
 178 
        add     edx, [ecx+ssh_connection.tx_crypt_blocksize]
117 
        add     [size], edx
 179 
  @@:
118 
 
 - 
 
Line 119... Line 180...
119 
        add     eax, edx
 180 
        DEBUGF  1, "padding %u bytes ", edx
120 
        DEBUGF  1, "Total size: %u\n", eax
 181 
        add     [packet_size], edx
121 
        bswap   eax
 182 
 
122 
        mov     edi, tx_buffer
 183 
        add     eax, edx
Line 144... Line 205...
144 
        call    MBRandom
 205 
        call    MBRandom
145 
        stosd
 206 
        stosd
146 
        dec     esi
 207 
        dec     esi
147 
        jnz     @r
 208 
        jnz     @r
Line -... Line 209...
- 
 
 209 
 
- 
 
 210 
; Message authentication
- 
 
 211 
        mov     edx, [connection]
- 
 
 212 
        cmp     [edx+ssh_connection.tx_mac_proc], 0
- 
 
 213 
        je      .mac_complete
- 
 
 214 
;        DEBUGF  1, "MAC sequence number: 0x%x\n", [edx+ssh_connection.tx_seq]
- 
 
 215 
        lea     esi, [edx+ssh_connection.tx_seq]
- 
 
 216 
        mov     ecx, [packet_size]
- 
 
 217 
        add     ecx, 4                                          ; Sequence number length
- 
 
 218 
        lea     eax, [edx+ssh_connection.tx_mac_ctx]
- 
 
 219 
        stdcall [edx+ssh_connection.tx_mac_proc], eax, esi, ecx
- 
 
 220 
 
- 
 
 221 
        lea     esi, [edx+ssh_connection.tx_mac_ctx]
- 
 
 222 
        lea     edi, [edx+ssh_connection.tx_buffer]
148 
 
 223 
        add     edi, [packet_size]
- 
 
 224 
        mov     ecx, [edx+ssh_connection.tx_mac_length]
- 
 
 225 
        shr     ecx, 2
- 
 
 226 
        rep movsd
- 
 
 227 
  .mac_complete:
- 
 
 228 
        inc     byte[edx+ssh_connection.tx_seq+3]               ; Update sequence counter
- 
 
 229 
        jnc     @f
- 
 
 230 
        inc     byte[edx+ssh_connection.tx_seq+2]
- 
 
 231 
        jnc     @f
- 
 
 232 
        inc     byte[edx+ssh_connection.tx_seq+1]
- 
 
 233 
        jnc     @f
- 
 
 234 
        inc     byte[edx+ssh_connection.tx_seq+0]
- 
 
 235 
  @@:
- 
 
 236 
 
- 
 
 237 
; Encrypt data
- 
 
 238 
        cmp     [edx+ssh_connection.tx_crypt_proc], 0
- 
 
 239 
        je      .encrypt_complete
- 
 
 240 
        lea     esi, [edx+ssh_connection.tx_buffer]
- 
 
 241 
        mov     ecx, [packet_size]
- 
 
 242 
  .encrypt_loop:
- 
 
 243 
        pusha
- 
 
 244 
        stdcall [edx+ssh_connection.tx_crypt_proc], [edx+ssh_connection.tx_crypt_ctx_ptr], esi, esi
- 
 
 245 
        popa
- 
 
 246 
        add     esi, [edx+ssh_connection.tx_crypt_blocksize]
- 
 
 247 
        sub     ecx, [edx+ssh_connection.tx_crypt_blocksize]
- 
 
 248 
        jnz     .encrypt_loop
- 
 
 249 
  .encrypt_complete:
- 
 
 250 
 
- 
 
 251 
; Send the packet
- 
 
 252 
        mov     ebx, [connection]
- 
 
 253 
        mov     ecx, [ebx+ssh_connection.socketnum]
- 
 
 254 
        lea     edx, [ebx+ssh_connection.tx_buffer]
- 
 
 255 
        mov     esi, [packet_size]
- 
 
 256 
        add     esi, [ebx+ssh_connection.tx_mac_length]
- 
 
 257 
        mov     edi, [flags]
- 
 
 258 
        mcall   send
- 
 
 259 
 
Line 149... Line 260...
149 
        mcall   send, [sock], tx_buffer, [size], [flags]
 260 
        DEBUGF  1, "\n"
Line 150... Line 261...
150 
 
 261 
 
151 
        ret
 262 
        ret
- 
 
 263