Subversion Repositories Kolibri OS

Rev

Rev 9071 | Rev 9112 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed

Rev 9071 Rev 9106
Line 16... Line 16...
16 
;    along with this program.  If not, see .
 16 
;    along with this program.  If not, see .
Line 17... Line 17...
17 
 
 17 
 
Line 18... Line 18...
18 
format binary as ""
 18 
format binary as ""
19 
 
 19 
 
Line 20... Line 20...
20 
__DEBUG__       = 1
 20 
__DEBUG__               = 1
- 
 
 21 
__DEBUG_LEVEL__         = 2             ; 1: Everything, including sensitive information, 2: Debugging, 3: Errors only
21 
__DEBUG_LEVEL__ = 3             ; 1: Everything, including sinsitive information, 2: Debugging, 3: Errors only
 22 
 
Line 22... Line 23...
22 
 
 23 
BUFFERSIZE              = 64*1024       ; Must be at least 32K according rfc4253#section-6.1
- 
 
 24 
PACKETSIZE              = 32*1024       ; Must be at least 32K according rfc4253#section-6.1
- 
 
 25 
MAX_BITS                = 8192
- 
 
 26 
 
- 
 
 27 
DH_PRIVATE_KEY_SIZE     = 256
- 
 
 28 
MAX_INPUT_LENGTH        = 255 ;;; WHAT WAS THIS AGAIN ?!
Line 23... Line 29...
23 
BUFFERSIZE      = 4096
 29 
MAX_USERNAME_LENGTH     = 256
Line 24... Line 30...
24 
MAX_BITS        = 8192
 30 
MAX_PASSWORD_LENGTH     = 256
25 
 
 31 
MAX_HOSTNAME_LENGTH     = 4096
Line 43... Line 49...
43 
include '../../dll.inc'
 49 
include '../../dll.inc'
44 
include '../../debug-fdo.inc'
 50 
include '../../debug-fdo.inc'
45 
include '../../network.inc'
 51 
include '../../network.inc'
46 
include '../../develop/libraries/libcrash/trunk/libcrash.inc'
 52 
include '../../develop/libraries/libcrash/trunk/libcrash.inc'
Line 47... Line -...
47 
 
 - 
 
48 
include 'mcodes.inc'
 - 
 
49 
include 'ssh_transport.inc'
 - 
 
50 
 
 - 
 
51 
include 'dh_gex.inc'
 - 
 
52 
 
 - 
 
53 
include 'mpint.inc'
 - 
 
54 
include 'seed.inc'
 - 
 
55 
include 'random.inc'
 - 
 
56 
 
 - 
 
57 
include 'aes256.inc'
 - 
 
58 
include 'aes256-ctr.inc'
 - 
 
59 
include 'aes256-cbc.inc'
 - 
 
60 
 
 - 
 
61 
include 'blowfish.inc'
 - 
 
62 
include 'blowfish-ctr.inc'
 - 
 
63 
include 'blowfish-cbc.inc'
 - 
 
64 
 
 - 
 
65 
include 'hmac_sha256.inc'
 - 
 
66 
include 'hmac_sha1.inc'
 - 
 
67 
include 'hmac_md5.inc'
 - 
 
68 
 
 53 
 
69 
; macros for network byte order
 54 
; macros for network byte order
70 
macro dd_n op {
 55 
macro dd_n op {
71 
   dd 0 or (((op) and 0FF000000h) shr 24) or \
 56 
   dd 0 or (((op) and 0FF000000h) shr 24) or \
72 
           (((op) and 000FF0000h) shr  8) or \
 57 
           (((op) and 000FF0000h) shr  8) or \
Line 77... Line 62...
77 
macro dw_n op {
 62 
macro dw_n op {
78 
   dw 0 or (((op) and 0FF00h) shr 8) or \
 63 
   dw 0 or (((op) and 0FF00h) shr 8) or \
79 
           (((op) and 000FFh) shl 8)
 64 
           (((op) and 000FFh) shl 8)
80 
}
 65 
}
Line -... Line 66...
- 
 
 66 
 
- 
 
 67 
macro str string {
- 
 
 68 
    local .start, .stop
- 
 
 69 
 
- 
 
 70 
    dd_n (.stop-.start)
- 
 
 71 
 
- 
 
 72 
    .start db string
- 
 
 73 
    .stop:
- 
 
 74 
}
81 
 
 75 
 
82 
proc dump_hex _ptr, _length
 76 
proc dump_hex _ptr, _length
83 
if __DEBUG_LEVEL__ <= 1
 77 
if __DEBUG_LEVEL__ <= 1
Line 84... Line 78...
84 
        pushad
 78 
        pushad
Line 95... Line 89...
95 
        popad
 89 
        popad
96 
end if
 90 
end if
97 
        ret
 91 
        ret
98 
endp
 92 
endp
Line -... Line 93...
- 
 
 93 
 
- 
 
 94 
macro DEBUGM l, s, m {
99 
 
 95 
if __DEBUG__
- 
 
 96 
        DEBUGF  l, s
- 
 
 97 
  if l >=__DEBUG_LEVEL__
- 
 
 98 
        stdcall mpint_print, m
- 
 
 99 
  end if
- 
 
 100 
end if
Line 100... Line 101...
100 
struct  ssh_connection
 101 
}
- 
 
 102 
 
- 
 
 103 
include 'mpint.inc'
Line -... Line 104...
- 
 
 104 
include 'seed.inc'
101 
 
 105 
include 'random.inc'
- 
 
 106 
 
Line -... Line 107...
- 
 
 107 
include 'aes256.inc'
- 
 
 108 
include 'aes256-ctr.inc'
102 
; Connection
 109 
include 'aes256-cbc.inc'
Line 103... Line -...
103 
 
 - 
 
104 
        hostname                rb 1024
 - 
 
105 
 
 - 
 
106 
        socketnum               dd ?
 - 
 
107 
 
 - 
 
108 
        sockaddr                dw ?            ; Address family
 110 
 
109 
        port                    dw ?
 - 
 
110 
        ip                      dd ?
 - 
 
111 
                                rb 10
 - 
 
112 
 
 - 
 
113 
; Encryption/Decryption
 - 
 
114 
 
 - 
 
115 
        rx_crypt_proc           dd ?
 - 
 
116 
        tx_crypt_proc           dd ?
 - 
 
117 
        rx_crypt_ctx_ptr        dd ?
 - 
 
118 
        tx_crypt_ctx_ptr        dd ?
 - 
 
119 
        rx_crypt_blocksize      dd ?
 - 
 
120 
        tx_crypt_blocksize      dd ?
 - 
 
121 
 
 - 
 
122 
; Padding
 - 
 
123 
 
 111 
include 'blowfish.inc'
124 
;        rx_padsize              dd ?    ; = Max(8, rx_crypt_blocksize)
 - 
 
125 
        tx_pad_size             dd ?    ; = Max(8, tx_crypt_blocksize)
 - 
 
126 
        tx_pad_proc             dd ?
 - 
 
127 
 
 - 
 
128 
; Message authentication
 - 
 
129 
 
 - 
 
130 
        rx_mac_proc             dd ?
 - 
 
131 
        tx_mac_proc             dd ?
 - 
 
132 
        rx_mac_ctx              hmac_sha256_context
 - 
 
133 
        tx_mac_ctx              hmac_sha256_context
 - 
 
134 
        rx_mac_length           dd ?
 - 
 
135 
        tx_mac_length           dd ?
 - 
 
136 
 
 - 
 
137 
; Buffers
 - 
 
138 
 
 - 
 
139 
        rx_seq                  dd ?            ; Packet sequence number for MAC
 - 
 
140 
        rx_buffer               ssh_packet_header
 - 
 
141 
                                rb BUFFERSIZE-sizeof.ssh_packet_header
 - 
 
142 
 
 - 
 
143 
        tx_seq                  dd ?            ; Packet sequence number for MAC
 - 
 
144 
        tx_buffer               ssh_packet_header
 112 
include 'blowfish-ctr.inc'
145 
                                rb BUFFERSIZE-sizeof.ssh_packet_header
 - 
 
146 
 
 - 
 
147 
        send_data               dw ?
 - 
 
148 
 
 - 
 
149 
; Output from key exchange
 - 
 
150 
        dh_K                    dd ?            ; Shared Secret (Big endian)
 - 
 
151 
                                rb MAX_BITS/8
 - 
 
152 
        dh_K_length             dd ?            ; Length in little endian
 - 
 
153 
 
 - 
 
154 
        dh_H                    rb 32           ; Exchange Hash
 - 
 
155 
        session_id_prefix       db ?
 - 
 
156 
        session_id              rb 32
 - 
 
157 
        rx_iv                   rb 32           ; Rx initialisation vector
 - 
 
158 
        tx_iv                   rb 32           ; Tx initialisation vector
 - 
 
159 
        rx_enc_key              rb 32           ; Rx encryption key
 - 
 
160 
        tx_enc_key              rb 32           ; Tx encryption key
 - 
 
161 
        rx_int_key              rb 32           ; Rx integrity key
 - 
 
162 
        tx_int_key              rb 32           ; Tx integrity key
 - 
 
163 
 
 - 
 
164 
; Diffie Hellman
 - 
 
165 
        dh_p                    dd ?
 - 
 
166 
                                rb MAX_BITS/8
 - 
 
167 
        dh_g                    dd ?
 - 
 
168 
                                rb MAX_BITS/8
 - 
 
169 
        dh_x                    dd ?
 - 
 
170 
                                rb MAX_BITS/8
 - 
 
171 
        dh_e                    dd ?
 - 
 
172 
                                rb MAX_BITS/8
 - 
 
Line 173... Line -...
173 
        dh_f                    dd ?
 - 
 
174 
                                rb MAX_BITS/8
 113 
include 'blowfish-cbc.inc'
Line -... Line 114...
- 
 
 114 
 
- 
 
 115 
include 'hmac_sha256.inc'
175 
 
 116 
include 'hmac_sha1.inc'
- 
 
 117 
include 'hmac_md5.inc'
- 
 
 118 
 
- 
 
 119 
include 'sshlib.inc'
176 
        dh_signature            dd ?
 120 
 
Line 177... Line -...
177 
                                rb MAX_BITS/8
 - 
 
- 
 
 121 
include 'sshlib_mcodes.inc'
Line 178... Line 122...
178 
 
 122 
include 'sshlib_transport.inc'
179 
        temp_ctx                crash_ctx
 123 
include 'sshlib_connection.inc'
Line 180... Line 124...
180 
        k_h_ctx                 crash_ctx
 124 
include 'sshlib_dh_gex.inc'
181 
 
 125 
include 'sshlib_host.inc'
182 
        mpint_tmp               dd ?
 126 
include 'sshlib_channel.inc'
183 
                                rb MAX_BITS/8
 127 
include 'sshlib_userauth.inc'
Line 184... Line 128...
184 
 
 128 
 
185 
ends
 129 
include 'encodings.inc'         ; Unfortunately, we dont have UTF-8 capable console yet :(
186 
 
 130 
 
Line 187... Line 131...
187 
start:
 131 
start:
188 
        mcall   68, 11          ; Init heap
 132 
        mcall   68, 11          ; Init heap
189 
 
 133 
 
Line 190... Line -...
190 
        DEBUGF  2, "SSH: Loading libraries\n"
 - 
 
191 
        stdcall dll.Load, @IMPORT
 134 
        DEBUGF  2, "SSH: Loading libraries\n"
192 
        test    eax, eax
 135 
        stdcall dll.Load, @IMPORT
Line 193... Line 136...
193 
        jnz     exit
 136 
        test    eax, eax
194 
 
 137 
        jnz     main.fail
195 
        DEBUGF  2, "SSH: Init PRNG\n"
 138 
 
196 
        call    create_seed
 139 
        DEBUGF  2, "SSH: Init PRNG\n"
197 
        call    init_random
 - 
 
198 
 
 140 
        call    create_seed
- 
 
 141 
        call    init_random
- 
 
 142 
 
- 
 
 143 
        DEBUGF  2, "SSH: Init Console\n"
199 
        DEBUGF  2, "SSH: Init Console\n"
 144 
        invoke  con_start, 1
200 
        invoke  con_start, 1
 145 
        invoke  con_init, 80, 25, 800, 250, title
201 
        invoke  con_init, 80, 25, 80, 25, title
 146 
 
202 
 
 147 
        cmp     byte[params], 0
203 
; Check for parameters TODO
 148 
        jne     main.connect
204 
;        cmp     byte[params], 0
 149 
 
205 
;        jne     resolve
 150 
main:
206 
 
 151 
        invoke  con_cls
207 
main:
 152 
; Welcome user
208 
        invoke  con_cls
 153 
        invoke  con_write_asciiz, str1a
209 
; Welcome user
 - 
 
210 
        invoke  con_write_asciiz, str1
 - 
 
211 
 
 - 
 
212 
prompt:
 - 
 
213 
; write prompt
 - 
 
214 
        invoke  con_write_asciiz, str2
 - 
 
215 
; read string
 - 
 
216 
        mov     esi, con.hostname
 - 
 
217 
        invoke  con_gets, esi, 256
 - 
 
218 
; check for exit
 - 
 
219 
        test    eax, eax
 - 
 
220 
        jz      done
 - 
 
221 
        cmp     byte[esi], 10
 - 
 
222 
        jz      done
 - 
 
223 
 
 - 
 
224 
resolve:
 - 
 
225 
        mov     [con.sockaddr], AF_INET4
 - 
 
226 
        mov     [con.port], 22 shl 8
 - 
 
227 
 
 - 
 
228 
; delete terminating '\n'
 - 
 
229 
        mov     esi, con.hostname
 - 
 
230 
  @@:
 - 
 
231 
        lodsb
 - 
 
232 
        cmp     al, ':'
 - 
 
233 
        je      .do_port
 - 
 
234 
        cmp     al, 0x20
 - 
 
235 
        ja      @r
 - 
 
236 
        mov     byte[esi-1], 0
 - 
 
237 
        jmp     .done
 - 
 
238 
 
 - 
 
239 
  .do_port:
 - 
 
240 
        xor     eax, eax
 - 
 
241 
        xor     ebx, ebx
 - 
 
242 
        mov     byte[esi-1], 0
 - 
 
243 
  .portloop:
 - 
 
244 
        lodsb
 - 
 
245 
        cmp     al, 0x20
 - 
 
246 
        jbe     .port_done
 - 
 
247 
        sub     al, '0'
 - 
 
248 
        jb      hostname_error
 - 
 
249 
        cmp     al, 9
 - 
 
250 
        ja      hostname_error
 - 
 
251 
        lea     ebx, [ebx*4+ebx]
 - 
 
252 
        shl     ebx, 1
 - 
 
253 
        add     ebx, eax
 - 
 
254 
        jmp     .portloop
 - 
 
255 
 
 - 
 
256 
  .port_done:
 - 
 
257 
        xchg    bl, bh
 - 
 
258 
        mov     [con.port], bx
 - 
 
259 
 
 - 
 
260 
  .done:
 - 
 
261 
 
 - 
 
262 
; resolve name
 - 
 
263 
        push    esp     ; reserve stack place
 - 
 
264 
        push    esp
 - 
 
265 
        invoke  getaddrinfo, con.hostname, 0, 0
 - 
 
266 
        pop     esi
 - 
 
267 
; test for error
 - 
 
268 
        test    eax, eax
 - 
 
269 
        jnz     dns_error
 - 
 
270 
 
 - 
 
271 
        invoke  con_write_asciiz, str3
 - 
 
272 
        invoke  con_write_asciiz, con.hostname
 - 
 
273 
 
 - 
 
274 
; write results
 - 
 
275 
        invoke  con_write_asciiz, str8
 - 
 
276 
 
 - 
 
277 
; convert IP address to decimal notation
 - 
 
278 
        mov     eax, [esi+addrinfo.ai_addr]
 - 
 
279 
        mov     eax, [eax+sockaddr_in.sin_addr]
 - 
 
280 
        mov     [con.ip], eax
 - 
 
281 
        invoke  inet_ntoa, eax
 - 
 
282 
; write result
 - 
 
283 
        invoke  con_write_asciiz, eax
 - 
 
284 
; free allocated memory
 - 
 
285 
        invoke  freeaddrinfo, esi
 - 
 
286 
 
 - 
 
287 
        invoke  con_write_asciiz, str9
 - 
 
288 
 
 - 
 
289 
        mcall   40, EVM_STACK + EVM_KEY
 - 
 
290 
 
 - 
 
291 
; Create socket
 - 
 
292 
        mcall   socket, AF_INET4, SOCK_STREAM, 0
 - 
 
293 
        cmp     eax, -1
 - 
 
294 
        jz      socket_err
 - 
 
295 
        mov     [con.socketnum], eax
 - 
 
296 
 
 - 
 
297 
; Connect
 - 
 
298 
        DEBUGF  2, "Connecting to server\n"
 - 
 
299 
        mcall   connect, [con.socketnum], con.sockaddr, 18
 - 
 
300 
        test    eax, eax
 - 
 
301 
        jnz     socket_err
 - 
 
302 
 
 - 
 
303 
; Start calculating hash
 - 
 
304 
        invoke  sha256_init, con.temp_ctx
 - 
 
305 
; HASH: string  V_C, the client's version string (CR and NL excluded)
 - 
 
306 
        invoke  sha256_update, con.temp_ctx, ssh_ident_ha, ssh_ident.length+4-2
 - 
 
307 
 
 - 
 
308 
; >> Send our identification string
 - 
 
309 
        DEBUGF  2, "Sending ID string\n"
 - 
 
310 
        mcall   send, [con.socketnum], ssh_ident, ssh_ident.length, 0
 - 
 
311 
        cmp     eax, -1
 - 
 
312 
        je      socket_err
 - 
 
313 
 
 - 
 
314 
; << Check protocol version of server
 - 
 
315 
        mcall   recv, [con.socketnum], con.rx_buffer, BUFFERSIZE, 0
 - 
 
316 
        cmp     eax, -1
 - 
 
317 
        je      socket_err
 - 
 
318 
 
 - 
 
319 
        DEBUGF  2, "Received ID string\n"
 - 
 
320 
        cmp     dword[con.rx_buffer], "SSH-"
 - 
 
321 
        jne     proto_err
 - 
 
322 
        cmp     dword[con.rx_buffer+4], "2.0-"
 - 
 
323 
        jne     proto_err
 - 
 
324 
 
 - 
 
325 
; HASH: string  V_S, the server's version string (CR and NL excluded)
 - 
 
326 
        lea     edx, [eax+2]
 - 
 
327 
        sub     eax, 2
 - 
 
328 
        bswap   eax
 - 
 
329 
        mov     dword[con.rx_buffer-4], eax
 - 
 
330 
        invoke  sha256_update, con.temp_ctx, con.rx_buffer-4, edx
 - 
 
331 
 
 - 
 
332 
; >> Key Exchange init
 - 
 
333 
        mov     [con.rx_seq], 0
 - 
 
334 
        mov     [con.tx_seq], 0
 - 
 
335 
        mov     [con.rx_crypt_blocksize], 4             ; minimum blocksize
 - 
 
336 
        mov     [con.tx_crypt_blocksize], 4
 - 
 
337 
        mov     [con.rx_crypt_proc], 0
 - 
 
338 
        mov     [con.tx_crypt_proc], 0
 - 
 
339 
        mov     [con.rx_mac_proc], 0
 - 
 
340 
        mov     [con.tx_mac_proc], 0
 - 
 
341 
        mov     [con.rx_mac_length], 0
 - 
 
342 
        mov     [con.tx_mac_length], 0
 - 
 
343 
;        mov     [con.rx_padsize], 8                     ; minimum padsize
 - 
 
344 
        mov     [con.tx_pad_size], 8
 - 
 
345 
        mov     [con.tx_pad_proc], padding_zero
 - 
 
346 
 
 - 
 
347 
        DEBUGF  2, "Sending KEX init\n"
 - 
 
348 
        mov     edi, ssh_kex.cookie
 - 
 
349 
        call    MBRandom
 - 
 
350 
        stosd
 - 
 
351 
        call    MBRandom
 - 
 
352 
        stosd
 - 
 
353 
        call    MBRandom
 - 
 
354 
        stosd
 - 
 
355 
        call    MBRandom
 - 
 
356 
        stosd
 - 
 
357 
        stdcall ssh_send_packet, con, ssh_kex, ssh_kex.length, 0
 - 
 
358 
        cmp     eax, -1
 - 
 
359 
        je      socket_err
 - 
 
360 
 
 - 
 
361 
; HASH: string  I_C, the payload of the client's SSH_MSG_KEXINIT
 - 
 
362 
        mov     eax, dword[con.tx_buffer+ssh_packet_header.packet_length]
 - 
 
363 
        bswap   eax
 - 
 
364 
        movzx   ebx, [con.tx_buffer+ssh_packet_header.padding_length]
 - 
 
365 
        sub     eax, ebx
 - 
 
366 
        dec     eax
 - 
 
367 
        lea     edx, [eax+4]
 - 
 
368 
        bswap   eax
 - 
 
369 
        mov     dword[con.tx_buffer+1], eax
 - 
 
370 
        invoke  sha256_update, con.temp_ctx, con.tx_buffer+1, edx
 - 
 
371 
 
 - 
 
372 
; << Check key exchange init of server
 - 
 
373 
        stdcall ssh_recv_packet, con, 0
 - 
 
374 
        cmp     eax, -1
 - 
 
375 
        je      socket_err
 - 
 
376 
 
 - 
 
377 
        cmp     [con.rx_buffer.message_code], SSH_MSG_KEXINIT
 - 
 
378 
        jne     proto_err
 - 
 
379 
        DEBUGF  2, "Received KEX init\n"
 - 
 
380 
 
 - 
 
381 
        lea     esi, [con.rx_buffer+sizeof.ssh_packet_header+16]
 - 
 
382 
        lodsd
 - 
 
383 
        bswap   eax
 - 
 
384 
        DEBUGF  1, "kex_algorithms: %s\n", esi
 - 
 
385 
        add     esi, eax
 - 
 
386 
        lodsd
 - 
 
387 
        bswap   eax
 - 
 
388 
        DEBUGF  1, "server_host_key_algorithms: %s\n", esi
 - 
 
389 
        add     esi, eax
 - 
 
390 
        lodsd
 - 
 
391 
        bswap   eax
 - 
 
392 
        DEBUGF  1, "encryption_algorithms_client_to_server: %s\n", esi
 - 
 
393 
        add     esi, eax
 - 
 
394 
        lodsd
 - 
 
395 
        bswap   eax
 - 
 
396 
        DEBUGF  1, "encryption_algorithms_server_to_client: %s\n", esi
 - 
 
397 
        add     esi, eax
 - 
 
398 
        lodsd
 - 
 
399 
        bswap   eax
 - 
 
400 
        DEBUGF  1, "mac_algorithms_client_to_server: %s\n", esi
 - 
 
401 
        add     esi, eax
 - 
 
402 
        lodsd
 - 
 
403 
        bswap   eax
 - 
 
404 
        DEBUGF  1, "mac_algorithms_server_to_client: %s\n", esi
 - 
 
405 
        add     esi, eax
 - 
 
406 
        lodsd
 - 
 
407 
        bswap   eax
 - 
 
408 
        DEBUGF  1, "compression_algorithms_client_to_server: %s\n", esi
 - 
 
409 
        add     esi, eax
 - 
 
410 
        lodsd
 - 
 
411 
        bswap   eax
 - 
 
412 
        DEBUGF  1, "compression_algorithms_server_to_client: %s\n", esi
 - 
 
413 
        add     esi, eax
 - 
 
414 
        lodsd
 - 
 
415 
        bswap   eax
 - 
 
416 
        DEBUGF  1, "languages_client_to_server: %s\n", esi
 - 
 
417 
        add     esi, eax
 - 
 
418 
        lodsd
 - 
 
419 
        bswap   eax
 - 
 
420 
        DEBUGF  1, "languages_server_to_client: %s\n", esi
 - 
 
421 
        add     esi, eax
 - 
 
422 
        lodsb
 - 
 
423 
        DEBUGF  1, "KEX First Packet Follows: %u\n", al
 - 
 
424 
 
 - 
 
425 
; TODO: parse this structure and init procedures accordingly
 - 
 
426 
 
 - 
 
427 
; HASH: string I_S, the payload of the servers's SSH_MSG_KEXINIT
 - 
 
428 
        mov     eax, dword[con.rx_buffer+ssh_packet_header.packet_length]
 - 
 
429 
        movzx   ebx, [con.rx_buffer+ssh_packet_header.padding_length]
 - 
 
430 
        sub     eax, ebx
 - 
 
431 
        dec     eax
 - 
 
432 
        lea     edx, [eax+4]
 - 
 
433 
        bswap   eax
 - 
 
434 
        mov     dword[con.rx_buffer+sizeof.ssh_packet_header-5], eax
 - 
 
435 
        invoke  sha256_update, con.temp_ctx, con.rx_buffer+sizeof.ssh_packet_header-5, edx
 - 
 
436 
 
 - 
 
437 
; Exchange keys with the server
 - 
 
438 
 
 - 
 
439 
; TODO: host verification
 - 
 
440 
 
 - 
 
441 
        stdcall dh_gex
 - 
 
442 
        test    eax, eax
 - 
 
443 
        jnz     exit
 - 
 
444 
 
 - 
 
445 
; Set keys and initialize transport subroutines
 - 
 
446 
 
 - 
 
447 
        DEBUGF  2, "SSH: Setting encryption keys\n"
 - 
 
448 
 
 - 
 
449 
        stdcall aes256_ctr_init, con.rx_iv
 - 
 
450 
        mov     [con.rx_crypt_ctx_ptr], eax
 - 
 
451 
 
 - 
 
452 
        stdcall aes256_set_encrypt_key, eax, con.rx_enc_key
 - 
 
453 
        mov     [con.rx_crypt_proc], aes256_ctr_crypt
 - 
 
454 
        mov     [con.rx_crypt_blocksize], AES256_BLOCKSIZE
 - 
 
455 
;        mov     [con.rx_pad_size], AES256_BLOCKSIZE
 - 
 
456 
 
 - 
 
457 
        stdcall aes256_ctr_init, con.tx_iv
 - 
 
458 
        mov     [con.tx_crypt_ctx_ptr], eax
 - 
 
459 
 
 - 
 
Line 460... Line -...
460 
        stdcall aes256_set_encrypt_key, eax, con.tx_enc_key
 - 
 
461 
        mov     [con.tx_crypt_proc], aes256_ctr_crypt
 - 
 
462 
        mov     [con.tx_crypt_blocksize], AES256_BLOCKSIZE
 - 
 
463 
 
 - 
 
464 
        mov     [con.tx_pad_size], AES256_BLOCKSIZE
 - 
 
465 
        mov     [con.tx_pad_proc], MBRandom
 - 
 
466 
 
 - 
 
467 
        stdcall hmac_sha256_setkey, con.rx_mac_ctx, con.rx_int_key, SHA256_HASH_SIZE
 - 
 
468 
        mov     [con.rx_mac_proc], hmac_sha256
 - 
 
469 
        mov     [con.rx_mac_length], SHA256_HASH_SIZE
 - 
 
470 
 
 - 
 
471 
        stdcall hmac_sha256_setkey, con.tx_mac_ctx, con.tx_int_key, SHA256_HASH_SIZE
 154 
  .prompt:
472 
        mov     [con.tx_mac_proc], hmac_sha256
 - 
 
473 
        mov     [con.tx_mac_length], SHA256_HASH_SIZE
 - 
 
474 
 
 - 
 
475 
; Re-seed RNG for padding bytes
 - 
 
476 
        call    create_seed
 155 
        invoke  con_write_asciiz, str1b
477 
        call    init_random
 156 
; Reset window title
478 
 
 157 
        invoke  con_set_title, title
479 
; TODO: erase all keys from memory and free the memory
 - 
 
480 
 
 - 
 
481 
; >> Request service (user-auth)
 158 
; Write prompt
482 
 
 - 
 
483 
        DEBUGF  2, "SSH: Requesting service\n"
 - 
 
484 
 
 - 
 
485 
        stdcall ssh_send_packet, con, ssh_request_service, ssh_request_service.length, 0
 - 
 
Line -... Line 159...
- 
 
 159 
        invoke  con_write_asciiz, str2
486 
        cmp     eax, -1
 160 
; read string
487 
        je      socket_err
 161 
        mov     esi, params
488 
 
 162 
        invoke  con_gets, esi, MAX_HOSTNAME_LENGTH
489 
; << Check for service acceptance
 163 
; check for exit
490 
 
 - 
 
491 
        stdcall ssh_msg_handler, con, 0
 164 
        test    eax, eax
492 
        cmp     eax, -1
 - 
 
Line 493... Line 165...
493 
        je      socket_err
 165 
        jz      .done
494 
 
 - 
 
495 
        cmp     [con.rx_buffer.message_code], SSH_MSG_SERVICE_ACCEPT
 166 
        cmp     byte[esi], 10
496 
        jne     proto_err
 167 
        jz      .done
497 
 
 168 
 
498 
; >> Request user authentication
 169 
  .connect:
499 
 
 - 
 
500 
        DEBUGF  2, "SSH: User authentication\n"
 - 
 
501 
 
 - 
 
502 
        mcall   68, 12, 1024    ; FIXME
 - 
 
503 
        test    eax, eax
 - 
 
504 
        jz      done            ; FIXME
 - 
 
505 
        mov     edi, eax
 - 
 
506 
        mov     ebx, eax
 - 
 
507 
        mov     byte[edi], SSH_MSG_USERAUTH_REQUEST
 - 
 
508 
        inc     edi
 - 
 
509 
 
 - 
 
510 
        ; Get username
 - 
 
511 
        add     edi, 4
 - 
 
512 
        invoke  con_write_asciiz, str12
 - 
 
513 
        invoke  con_gets, edi, 256      ; FIXME
 - 
 
514 
        test    eax, eax
 - 
 
515 
        jz      done            ; FIXME
 - 
 
516 
 
 - 
 
517 
        mov     edx, eax
 - 
 
518 
        mov     ecx, 256
 - 
 
519 
        xor     al, al
 - 
 
520 
        repne   scasb
 - 
 
521 
 
 - 
 
522 
        dec     edi             ; \0
 - 
 
523 
        dec     edi             ; \n
 - 
 
524 
        push    edi
 - 
 
525 
        sub     edi, edx
 - 
 
Line 526... Line 170...
526 
        bswap   edi
 170 
        stdcall sshlib_connect, ssh_con, params
527 
        mov     [edx-4], edi
 - 
 
528 
        pop     edi
 171 
        cmp     eax, 0
529 
 
 - 
 
530 
        mov     dword[edi], 0x0e000000  ; 14 Bswapped
 172 
        jg      .prompt
531 
        mov     dword[edi+4], "ssh-"
 173 
        jl      .error
532 
        mov     dword[edi+8], "conn"
 174 
 
- 
 
 175 
  .login:
Line 533... Line -...
533 
        mov     dword[edi+12], "ecti"
 - 
 
534 
        mov     word[edi+16], "on"
 - 
 
535 
        add     edi, 18
 - 
 
536 
 
 176 
        mcall   68, 12, (MAX_USERNAME_LENGTH + MAX_PASSWORD_LENGTH)
537 
        mov     dword[edi], 0x08000000  ; 8 Bswapped
 - 
 
538 
        mov     dword[edi+4], "pass"
 - 
 
539 
        mov     dword[edi+8], "word"
 - 
 
540 
 
 - 
 
541 
        mov     byte[edi+12], 0         ; bool
 - 
 
542 
        add     edi, 13
 - 
 
543 
 
 - 
 
544 
        ; Get password
 - 
 
545 
        add     edi, 4
 - 
 
546 
        invoke  con_write_asciiz, str13
 - 
 
547 
        push    eax
 - 
 
548 
        invoke  con_gets, edi, 256      ; FIXME
 177 
        test    eax, eax
549 
        test    eax, eax
 - 
 
550 
        jz      done            ; FIXME
 178 
        jz      .done   ; ERR_NOMEM
551 
 
 179 
        mov     esi, eax
552 
        mov     edx, eax
 - 
 
553 
        mov     ecx, 256
 180 
        lea     edi, [eax + MAX_USERNAME_LENGTH]
554 
        xor     al, al
 181 
 
555 
        repne scasb
 182 
; Get username
- 
 
 183 
        invoke  con_write_asciiz, str12
556 
 
 184 
        invoke  con_gets, esi, MAX_USERNAME_LENGTH
557 
        dec     edi             ; \0
 185 
        test    eax, eax
558 
        dec     edi             ; \n
 186 
;;        jz      .con_closed_must_clear
Line 559... Line 187...
559 
        push    edi
 187 
 
560 
        sub     edi, edx
 - 
 
561 
        bswap   edi
 - 
 
562 
        mov     [edx-4], edi
 188 
; Get password
563 
        pop     edi
 - 
 
564 
        sub     edi, ebx
 - 
 
565 
 
 - 
 
566 
        push    ebx
 - 
 
567 
        stdcall ssh_send_packet, con, ebx, edi, 0
 - 
 
568 
 
 - 
 
569 
        ; Clear used buffer and free
 - 
 
570 
        pop     edx
 - 
 
571 
        mov     edi, edx
 - 
 
572 
        push    eax
 - 
 
573 
        mov     ecx, 1024/4     ; FIXME
 - 
 
574 
        xor     eax, eax
 - 
 
575 
        rep stosd
 189 
        invoke  con_write_asciiz, str13a
576 
        mcall   68, 13, edx
 - 
 
577 
        pop     eax
 - 
 
578 
 
 - 
 
579 
        cmp     eax, -1
 - 
 
580 
        je      socket_err
 - 
 
581 
 
 - 
 
582 
        invoke  con_write_asciiz, str14
 - 
 
583 
 
 - 
 
584 
; << Check for userauth acceptance
 - 
 
585 
 
 - 
 
586 
        stdcall ssh_msg_handler, con, 0
 - 
 
587 
        cmp     eax, -1
 - 
 
588 
        je      socket_err
 - 
 
589 
 
 - 
 
590 
        cmp     [con.rx_buffer.message_code], SSH_MSG_USERAUTH_SUCCESS
 - 
 
591 
        jne     proto_err
 - 
 
592 
 
 - 
 
593 
; >> Open channel
 - 
 
594 
 
 - 
 
595 
        DEBUGF  2, "SSH: Open channel\n"
 - 
 
596 
 
 - 
 
597 
        stdcall ssh_send_packet, con, ssh_channel_open, ssh_channel_open.length, 0
 - 
 
598 
        cmp     eax, -1
 - 
 
599 
        je      socket_err
 - 
 
600 
 
 - 
 
601 
; << Check for channel open confirmation
 - 
 
602 
 
 - 
 
603 
        stdcall ssh_msg_handler, con, 0
 - 
 
604 
        cmp     eax, -1
 - 
 
605 
        je      socket_err
 - 
 
606 
 
 - 
 
607 
        cmp     [con.rx_buffer.message_code], SSH_MSG_CHANNEL_OPEN_CONFIRMATION
 - 
 
608 
        jne     proto_err
 - 
 
609 
 
 - 
 
610 
; >> Channel request: pty
 - 
 
611 
 
 - 
 
612 
        DEBUGF  2, "SSH: Request pty\n"
 - 
 
613 
 
 - 
 
614 
        stdcall ssh_send_packet, con, ssh_channel_request, ssh_channel_request.length, 0
 - 
 
615 
        cmp     eax, -1
 - 
 
616 
        je      socket_err
 - 
 
617 
 
 - 
 
618 
; << Check for channel request confirmation
 - 
 
619 
 
 - 
 
620 
        stdcall ssh_msg_handler, con, 0
 - 
 
621 
        cmp     eax, -1
 - 
 
Line -... Line 190...
- 
 
 190 
        invoke  con_gets, edi, MAX_PASSWORD_LENGTH
622 
        je      socket_err
 191 
        test    eax, eax
623 
 
 192 
;;        jz      .con_closed_must_clear
- 
 
 193 
        invoke  con_write_asciiz, str13b
- 
 
 194 
 
Line -... Line 195...
- 
 
 195 
; Authenticate
624 
        cmp     [con.rx_buffer.message_code], SSH_MSG_CHANNEL_SUCCESS
 196 
        stdcall sshlib_userauth_password, ssh_con, esi, edi
625 
        jne     proto_err
 197 
; Clear and free username and password
626 
 
 198 
  .clear:
- 
 
 199 
        push    eax
627 
; >> Channel request: shell
 200 
        mov     edx, edi
- 
 
 201 
        xor     eax, eax
628 
 
 202 
        mov     ecx, (MAX_USERNAME_LENGTH + MAX_PASSWORD_LENGTH)/4
629 
        DEBUGF  2, "SSH: Request shell\n"
 203 
        rep     stosd
Line 630... Line 204...
630 
 
 204 
        mcall   68, 13, edx
631 
        stdcall ssh_send_packet, con, ssh_shell_request, ssh_shell_request.length, 0
 205 
        pop     eax
632 
        cmp     eax, -1
 206 
 
633 
        je      socket_err
 207 
        cmp     eax, 0
Line 634... Line 208...
634 
 
 208 
        jg      .login          ; Authentication failed
635 
; << Check for channel request confirmation (FIXME: this may not be first packet!)
 209 
        jl      .error          ; An error occured
636 
 
 210 
 
Line 637... Line 211...
637 
; TODO
 211 
; Open a channel
638 
;
 212 
        stdcall sshlib_chan_open, ssh_con
Line 639... Line 213...
639 
;        stdcall ssh_msg_handler, con, 0
 213 
        cmp     eax, 0
640 
;        cmp     eax, -1
 214 
        jg      .prompt         ; Authentication failed
641 
;        je      socket_err
 215 
        jl      .error          ; An error occured
Line 642... Line 216...
642 
 
 216 
 
643 
;        cmp     [con.rx_buffer.message_code], SSH_MSG_CHANNEL_SUCCESS
 217 
; Start console input handler thread without deactivating the current window
644 
;        jne     proto_err
 218 
; Get active window ID
- 
 
 219 
        mcall   18, 7
- 
 
 220 
        push    eax
- 
 
 221 
; Create thread
645 
 
 222 
        mcall   51, 1, con_in_thread, mem - 2048
- 
 
 223 
; Activate window with given ID
- 
 
 224 
        pop     ecx
- 
 
 225 
        mcall   18, 3
- 
 
 226 
 
- 
 
 227 
  .loop:
- 
 
 228 
        invoke  con_get_flags
- 
 
 229 
        test    eax, 0x200                      ; console window closed?
646 
; Launch network thread
 230 
        jnz     .con_closed
647 
        mcall   18, 7
 231 
 
Line 648... Line 232...
648 
        push    eax
 232 
        stdcall sshlib_msg_handler, ssh_con, 0
- 
 
 233 
        cmp     eax, 0
649 
        mcall   51, 1, thread, mem - 2048
 234 
        jle     .check_err
650 
        pop     ecx
 235 
 
651 
        mcall   18, 3
 236 
        cmp     [ssh_con.rx_buffer.message_code], SSH_MSG_CHANNEL_DATA
652 
 
 237 
        jne     .dump
653 
mainloop:
 238 
 
654 
        call    [con_get_flags]
 239 
        mov     eax, dword[ssh_con.rx_buffer.message_code+5]
655 
        test    eax, 0x200                      ; con window closed?
 240 
        bswap   eax
656 
        jnz     exit
 241 
        DEBUGF  1, 'SSH: got %u bytes of data !\n', eax
657 
 
 242 
 
658 
        stdcall ssh_msg_handler, con, 0
 243 
        lea     esi, [ssh_con.rx_buffer.message_code+5+4]
659 
        cmp     eax, 0
 244 
        lea     edx, [esi+eax]
- 
 
 245 
        lea     edi, [ssh_con.rx_buffer]
- 
 
 246 
  @@:
- 
 
 247 
        call    get_byte_utf8
- 
 
 248 
        stosb
- 
 
 249 
        cmp     esi, edx
- 
 
 250 
        jb      @r
- 
 
 251 
        xor     al, al
- 
 
 252 
        stosb
- 
 
 253 
 
- 
 
 254 
        lea     esi, [ssh_con.rx_buffer]
- 
 
 255 
        DEBUGF  3, 'SSH msg: %s\n', esi
- 
 
 256 
 
- 
 
 257 
        invoke  con_write_asciiz, esi
Line -... Line 258...
- 
 
 258 
        jmp     .loop
Line -... Line 259...
- 
 
 259 
 
660 
        jbe     closed
 260 
  .dump:
661 
 
 261 
        DEBUGF  3, "SSH: Unsupported message: "
- 
 
 262 
        lea     esi, [ssh_con.rx_buffer.message_code]
- 
 
 263 
        mov     ecx, eax
662 
        cmp     [con.rx_buffer.message_code], SSH_MSG_CHANNEL_DATA
 264 
        pusha
- 
 
 265 
  @@:
- 
 
 266 
        lodsb
- 
 
 267 
        DEBUGF  3, "%x ", eax:2
- 
 
 268 
        dec     ecx
- 
 
 269 
        jnz     @r
- 
 
 270 
        popa
- 
 
 271 
        DEBUGF  3, "\n"
- 
 
 272 
        jmp     .loop
Line -... Line 273...
- 
 
 273 
 
- 
 
 274 
  .check_err:
- 
 
 275 
        jz      .err_conn_closed
- 
 
 276 
        cmp     ebx, EWOULDBLOCK
663 
        jne     .dump
 277 
        je      .loop
- 
 
 278 
        jmp     .err_sock
664 
 
 279 
 
665 
        mov     eax, dword[con.rx_buffer.message_code+5]
 280 
  .con_closed:
Line 666... Line 281...
666 
        bswap   eax
 281 
        ; Send close message on the active channel
667 
        DEBUGF  1, 'SSH: got %u bytes of data !\n', eax
 - 
 
668 
 
 282 
        stdcall sshlib_send_packet, ssh_con, ssh_msg_channel_close, ssh_msg_channel_close.length, 0
669 
        lea     esi, [con.rx_buffer.message_code+5+4]
 - 
 
Line 670... Line 283...
670 
        mov     ecx, eax
 283 
        jmp     .done
- 
 
 284 
 
671 
        lea     edi, [esi + eax]
 285 
  .error:
- 
 
 286 
 
- 
 
 287 
; TODO: proper cleanup after error
- 
 
 288 
 
- 
 
 289 
        cmp     eax, SSHLIB_ERR_NOMEM
- 
 
 290 
        je      .done
- 
 
 291 
        cmp     eax, SSHLIB_ERR_SOCKET
- 
 
 292 
        je      .err_sock
- 
 
 293 
        cmp     eax, SSHLIB_ERR_PROTOCOL
672 
        mov     byte [edi], 0
 294 
        je      .err_proto
673 
        invoke  con_write_asciiz, esi
 295 
        cmp     eax, SSHLIB_ERR_HOSTNAME
Line 674... Line 296...
674 
        jmp     mainloop
 296 
        je      .err_hostname
675 
 
 297 
        cmp     eax, SSHLIB_ERR_HKEY_VERIFY_FAIL
676 
  .dump:
 298 
        je      .err_hostkey_fail
Line 677... Line 299...
677 
        lea     esi, [con.rx_buffer]
 299 
        cmp     eax, SSHLIB_ERR_HKEY_SIGNATURE
678 
        mov     ecx, eax
 300 
        je      .err_hostkey_signature
679 
        pusha
 301 
        cmp     eax, SSHLIB_ERR_HKEY_PUBLIC_KEY
Line -... Line 302...
- 
 
 302 
        je      .err_hostkey
- 
 
 303 
 
- 
 
 304 
        jmp     .done
- 
 
 305 
 
- 
 
 306 
 
- 
 
 307 
  .err_proto:
- 
 
 308 
;        lea     eax, [ssh_con.rx_buffer]
- 
 
 309 
;        int3
- 
 
 310 
        invoke  con_write_asciiz, str7
- 
 
 311 
        jmp     .prompt
- 
 
 312 
 
- 
 
 313 
  .err_sock:
680 
@@:
 314 
        invoke  con_write_asciiz, str6
681 
        lodsb
 315 
 
682 
        DEBUGF  1, "%x ", eax:2
 316 
        mov     eax, str14
683 
        dec     ecx
 317 
        cmp     ebx, ETIMEDOUT
684 
        jnz     @r
 318 
        je      .err_sock_detail
- 
 
 319 
        mov     eax, str15
685 
        popa
 320 
        cmp     ebx, ECONNREFUSED
Line 686... Line -...
686 
        DEBUGF  1, "\n"
 - 
 
687 
        jmp     mainloop
 - 
 
688 
 
 - 
 
689 
 
 - 
 
690 
proto_err:
 - 
 
691 
        mov     eax, con.rx_buffer
 321 
        je      .err_sock_detail
Line 692... Line 322...
692 
        int3
 322 
        mov     eax, str16
- 
 
 323 
        cmp     ebx, ECONNRESET
693 
 
 324 
        je      .err_sock_detail
694 
        DEBUGF  3, "SSH: protocol error\n"
 325 
        mov     eax, str17
- 
 
 326 
  .err_sock_detail:
- 
 
 327 
        invoke  con_write_asciiz, eax
695 
        invoke  con_write_asciiz, str7
 328 
        jmp     .prompt
Line -... Line 329...
- 
 
 329 
 
- 
 
 330 
  .err_hostname:
Line 696... Line -...
696 
        jmp     prompt
 - 
 
697 
 
 - 
 
Line 698... Line -...
698 
socket_err:
 - 
 
699 
        DEBUGF  3, "SSH: socket error %d\n", ebx
 331 
        invoke  con_write_asciiz, str10
700 
        invoke  con_write_asciiz, str6
 - 
 
701 
        jmp     prompt
 - 
 
702 
 
 - 
 
703 
dns_error:
 - 
 
704 
        DEBUGF  3, "SSH: DNS error %d\n", eax
 - 
 
705 
        invoke  con_write_asciiz, str5
 - 
 
706 
        jmp     prompt
 - 
 
707 
 
 - 
 
708 
hostname_error:
 - 
 
709 
        invoke  con_write_asciiz, str10
 - 
 
710 
        jmp     prompt
 - 
 
Line -... Line 332...
- 
 
 332 
        jmp     .prompt
711 
 
 333 
 
- 
 
 334 
  .err_conn_closed:
712 
closed:
 335 
        invoke  con_write_asciiz, str11
Line 713... Line -...
713 
        invoke  con_write_asciiz, str11
 - 
 
714 
        jmp     prompt
 336 
        jmp     .prompt
715 
 
 337 
 
Line 716... Line 338...
716 
done:
 338 
  .err_hostkey:
- 
 
 339 
        invoke  con_write_asciiz, str19
717 
        invoke  con_exit, 1
 340 
        jmp     .prompt
718 
exit:
 341 
 
- 
 
 342 
  .err_hostkey_signature:
- 
 
 343 
        invoke  con_write_asciiz, str20
- 
 
 344 
        jmp     .prompt
719 
        DEBUGF  3, "SSH: Exiting\n"
 345 
 
- 
 
 346 
  .err_hostkey_fail:
- 
 
 347 
        invoke  con_write_asciiz, str21
720 
        mcall   close, [con.socketnum]
 348 
        jmp     .prompt
- 
 
 349 
 
- 
 
 350 
  .done:
- 
 
 351 
        invoke  con_exit, 1
- 
 
 352 
  .exit:
- 
 
 353 
        DEBUGF  3, "SSH: Exiting\n"
721 
        mcall   -1
 354 
        mcall   close, [ssh_con.socketnum]
- 
 
 355 
  .fail:
- 
 
 356 
        mcall   -1
- 
 
 357 
 
Line -... Line 358...
- 
 
 358 
 
- 
 
 359 
proc sshlib_callback_connecting, con_ptr, connstring_sz
- 
 
 360 
 
- 
 
 361 
        invoke  con_write_asciiz, str3
- 
 
 362 
        mov     eax, [con_ptr]
722 
 
 363 
        lea     eax, [eax+sshlib_connection.hostname_sz]
- 
 
 364 
        invoke  con_write_asciiz, eax
- 
 
 365 
        invoke  con_write_asciiz, str8
- 
 
 366 
        invoke  con_write_asciiz, [connstring_sz]
Line 723... Line 367...
723 
 
 367 
        invoke  con_write_asciiz, str9
Line -... Line 368...
- 
 
 368 
 
- 
 
 369 
        ret
- 
 
 370 
endp
- 
 
 371 
 
- 
 
 372 
 
- 
 
 373 
proc sshlib_callback_hostkey_problem, con_ptr, problem_type, hostkey_sz
- 
 
 374 
 
- 
 
 375 
        cmp     [problem_type], SSHLIB_HOSTKEY_PROBLEM_UNKNOWN
- 
 
 376 
        je      .unknown
- 
 
 377 
        cmp     [problem_type], SSHLIB_HOSTKEY_PROBLEM_MISMATCH
- 
 
 378 
        je      .mismatch
- 
 
 379 
 
- 
 
 380 
        mov     eax, -1
- 
 
 381 
        ret
- 
 
 382 
 
- 
 
 383 
  .unknown:
- 
 
 384 
        invoke  con_write_asciiz, str22
- 
 
 385 
        jmp     .ask
- 
 
 386 
 
- 
 
 387 
  .mismatch:
- 
 
 388 
        invoke  con_write_asciiz, str23
- 
 
 389 
;        jmp     .ask
- 
 
 390 
  .ask:
- 
 
 391 
  ;;; TODO: print hostkey
- 
 
 392 
        invoke  con_write_asciiz, str24
- 
 
 393 
  .getansw:
- 
 
 394 
        invoke  con_getch2
- 
 
 395 
        or      al, 0x20        ; convert to lowercase
724 
thread:
 396 
        cmp     al, 'a'
725 
        mcall   40, 0
 397 
        je      .accept
726 
  .loop:
 398 
        cmp     al, 'c'
727 
        invoke  con_getch2
 399 
        je      .once
728 
        mov     [ssh_channel_data+9], al
 400 
        cmp     al, 'x'
729 
        stdcall ssh_send_packet, con, ssh_channel_data, ssh_channel_data.length, MSG_DONTWAIT
 401 
        je      .refuse
730 
 
 402 
        jmp     .getansw
731 
        invoke  con_get_flags
 - 
 
732 
        test    eax, 0x200                      ; con window closed?
 403 
 
733 
        jz      .loop
 404 
  .accept:
734 
        mcall   -1
 405 
        mov     eax, SSHLIB_HOSTKEY_ACCEPT
735 
 
 406 
        ret
736 
 
 407 
  .once:
737 
; Handle common messages and return from specific ones
 408 
        mov     eax, SSHLIB_HOSTKEY_ONCE
738 
proc ssh_msg_handler, con, flags
 409 
        ret
739 
 
 410 
  .refuse:
740 
  .recv:
 411 
        mov     eax, SSHLIB_HOSTKEY_REFUSE
- 
 
 412 
        ret
- 
 
 413 
 
- 
 
 414 
endp
- 
 
 415 
 
- 
 
 416 
 
- 
 
 417 
 
- 
 
 418 
align 16
- 
 
 419 
con_in_thread:
- 
 
 420 
 
- 
 
 421 
  .loop:
- 
 
 422 
; TODO: check if channel is still open somehow
- 
 
 423 
 
- 
 
 424 
        invoke  con_get_input, ssh_msg_channel_data.data, MAX_INPUT_LENGTH
- 
 
 425 
        test    eax, eax
- 
 
 426 
        jz      .no_input
- 
 
 427 
 
- 
 
 428 
        lea     ecx, [eax + ssh_msg_channel_data.data - ssh_msg_channel_data]
- 
 
 429 
        bswap   eax
Line 741... Line 430...
741 
        stdcall ssh_recv_packet, [con], [flags]
 430 
        mov     [ssh_msg_channel_data.len], eax
742 
        cmp     eax, -1
 431 
        stdcall sshlib_send_packet, ssh_con, ssh_msg_channel_data, ecx, 0
743 
        je      .ret
 432 
        cmp     eax, 0
744 
 
 433 
        jle     .exit
745 
        cmp     [con.rx_buffer.message_code], SSH_MSG_DISCONNECT
 434 
 
- 
 
 435 
  .no_input:
Line 746... Line 436...
746 
        je      .disc
 436 
        invoke  con_get_flags
747 
        cmp     [con.rx_buffer.message_code], SSH_MSG_IGNORE
 437 
        test    eax, 0x200                      ; con window closed?
748 
        je      .ign
 438 
        jz      .loop
749 
        cmp     [con.rx_buffer.message_code], SSH_MSG_DEBUG
 439 
 
750 
        je      .dbg
 440 
  .exit:
751 
        cmp     [con.rx_buffer.message_code], SSH_MSG_GLOBAL_REQUEST
 - 
 
752 
        je      .glob
 441 
        mcall   -1
753 
 
 442 
 
754 
  .ret:
 - 
 
755 
        ret
 443 
 
756 
 
 444 
; data
757 
  .disc:
 - 
 
758 
        mov     eax, -1
 445 
title   db 'Secure Shell',0
759 
        ret
 446 
str1a   db 'SSHv2 client for KolibriOS',10,0
760 
 
 - 
 
761 
  .ign:
 447 
str1b   db 10,'Please enter URL of SSH server (hostname:port)',10,0
762 
        jmp     .recv
 448 
str2    db '> ',0
763 
 
 - 
 
764 
  .dbg:
 449 
str3    db 'Connecting to ',0
765 
  .glob:
 450 
str4    db 10,0
766 
        ; TODO
 - 
 
767 
 
 451 
str6    db 10, 27, '[2J',27,'[mA network error has occured.',10,0
768 
        jmp     .recv
 452 
str7    db 10, 27, '[2J',27,'[mAn SSH protocol error has occured.',10,0
769 
 
 - 
 
770 
endp
 453 
str8    db ' (',0
771 
 
 454 
str9    db ')',10,0
772 
; data
 - 
 
773 
title   db      'Secure Shell',0
 455 
str10   db 'Host does not exist.',10,10,0
774 
str1    db      'SSH client for KolibriOS',10,10,\
 456 
str11   db 10, 27, '[2J',27,'[mThe remote host closed the connection.',10,0
775 
                'Please enter URL of SSH server (hostname:port)',10,10,0
 - 
 
776 
str2    db      '> ',0
 457 
str12   db 'Login as: ',0
777 
str3    db      'Connecting to ',0
 458 
str13a  db 'Password: ', 27, '[?25l', 27, '[30;40m', 0
778 
str4    db      10,0
 - 
 
779 
str5    db      'Name resolution failed.',10,10,0
 459 
str13b  db 10, 27, '[?25h', 27, '[0m', 27, '[2J', 0
780 
str6    db      'A socket error occured.',10,10,0
 460 
str14   db 'The connection timed out',10,0
781 
str7    db      'A protocol error occured.',10,10,0
 461 
str15   db 'The connection was refused',10,0
782 
str8    db      ' (',0
 462 
str16   db 'The connection was reset',10,0
783 
str9    db      ')',10,0
 463 
str17   db 'No details available',10,0
784 
str10   db      'Invalid hostname.',10,10,0
 464 
;str18   db 'User authentication failed',10,0;;;;
Line 785... Line 465...
785 
str11   db      10,'Remote host closed the connection.',10,10,0
 465 
str19   db "The remote host's public key is invalid.", 10, 0
786 
str12   db      'Login as: ',0
 466 
str20   db "The remote host's signature is invalid.", 10, 0
787 
str13   db      'Password: ', 27, '[?25l', 27, '[30;40m', 0
 467 
str21   db "The remote host failed to verify it's own public key.", 10, 0
788 
str14   db      10, 27, '[?25h', 27, '[0m', 0
 468 
str22   db "The host key for the server was not found in the cache.", 10
789 
 
 469 
        db "There is no guarantee to the servers identity !",10, 0
790 
ssh_ident_ha:
 470 
 
Line 791... Line 471...
791 
        dd_n (ssh_ident.length-2)
 471 
str23   db "The host key provided by the host does not match the cached one.", 10
792 
ssh_ident:
 472 
        db "This may indicate that the remote server has been compromised!", 10, 0
793 
        db "SSH-2.0-KolibriOS_SSH_0.04",13,10
 473 
 
Line 794... Line 474...
794 
  .length = $ - ssh_ident
 474 
str24   db 10, "If you trust this host, press A to accept and store the (new) key.", 10
795 
 
 475 
        db "Press C to connect to the host but don't store the (new) key.", 10
796 
ssh_kex:
 - 
 
797 
        db SSH_MSG_KEXINIT
 476 
        db "Press X to abort.", 10, 0
798 
  .cookie:
 477 
 
799 
        rd 4
 - 
 
800 
  .kex_algorithms:
 - 
 
801 
        dd_n .server_host_key_algorithms - .kex_algorithms - 4
 - 
 
802 
        db "diffie-hellman-group-exchange-sha256" ; diffie-hellman-group-exchange-sha1
 - 
 
803 
  .server_host_key_algorithms:
 - 
 
804 
        dd_n .encryption_algorithms_client_to_server - .server_host_key_algorithms - 4
 - 
 
805 
        db "ssh-rsa"                    ;,ssh-dss
 - 
 
806 
  .encryption_algorithms_client_to_server:
 - 
 
807 
        dd_n .encryption_algorithms_server_to_client - .encryption_algorithms_client_to_server - 4
 - 
 
808 
        db "aes256-ctr"                 ;,aes256-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128"
 - 
 
809 
  .encryption_algorithms_server_to_client:
 - 
 
810 
        dd_n .mac_algorithms_client_to_server - .encryption_algorithms_server_to_client - 4
 - 
 
811 
        db "aes256-ctr"                 ;,aes256-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128"
 - 
 
812 
  .mac_algorithms_client_to_server:
 - 
 
Line 813... Line 478...
813 
        dd_n .mac_algorithms_server_to_client - .mac_algorithms_client_to_server - 4
 478 
 
814 
        db "hmac-sha2-256"              ;,hmac-sha1,hmac-sha1-96,hmac-md5"
 479 
ssh_ident_ha:
815 
  .mac_algorithms_server_to_client:
 480 
        dd_n (ssh_msg_ident.length-2)
- 
 
 481 
ssh_msg_ident:
- 
 
 482 
        db "SSH-2.0-KolibriOS_SSH_0.05",13,10
- 
 
 483 
  .length = $ - ssh_msg_ident
- 
 
 484 
 
- 
 
 485 
 
- 
 
 486 
ssh_msg_kex:
- 
 
 487 
        db SSH_MSG_KEXINIT
816 
        dd_n .compression_algorithms_client_to_server - .mac_algorithms_server_to_client - 4
 488 
  .cookie:
817 
        db "hmac-sha2-256"              ;,hmac-sha1,hmac-sha1-96,hmac-md5"
 489 
        rd 4
818 
  .compression_algorithms_client_to_server:
 - 
 
819 
        dd_n .compression_algorithms_server_to_client - .compression_algorithms_client_to_server - 4
 - 
 
820 
        db "none"                       ;,zlib"
 490 
  .kex_algorithms:
Line -... Line 491...
- 
 
 491 
        str "diffie-hellman-group-exchange-sha256" ; diffie-hellman-group-exchange-sha1
821 
  .compression_algorithms_server_to_client:
 492 
  .server_host_key_algorithms:
822 
        dd_n .languages_client_to_server - .compression_algorithms_server_to_client - 4
 493 
        str "ssh-rsa"                    ;,ssh-dss
823 
        db "none"                       ;,zlib"
 494 
  .encryption_algorithms_client_to_server:
824 
  .languages_client_to_server:
 - 
 
825 
        dd_n .languages_server_to_client - .languages_client_to_server - 4
 495 
        str "aes256-ctr"                 ;,aes256-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128"
826 
        db ""
 496 
  .encryption_algorithms_server_to_client:
827 
  .languages_server_to_client:
 - 
 
828 
        dd_n .first_kex_packet_follows - .languages_server_to_client - 4
 497 
        str "aes256-ctr"                 ;,aes256-cbc,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128"
829 
        db ""
 498 
  .mac_algorithms_client_to_server:
830 
  .first_kex_packet_follows:
 499 
        str "hmac-sha2-256"              ;,hmac-sha1,hmac-sha1-96,hmac-md5"
831 
        db 0
 500 
  .mac_algorithms_server_to_client:
832 
  .reserved:
 501 
        str "hmac-sha2-256"              ;,hmac-sha1,hmac-sha1-96,hmac-md5"
Line 833... Line 502...
833 
        dd_n 0
 502 
  .compression_algorithms_client_to_server:
834 
  .length = $ - ssh_kex
 503 
        str "none"                       ;,zlib"
- 
 
 504 
  .compression_algorithms_server_to_client:
Line 835... Line 505...
835 
 
 505 
        str "none"                       ;,zlib"
836 
 
 506 
  .languages_client_to_server:
837 
ssh_gex_req:
 507 
        str ""
838 
        db SSH_MSG_KEX_DH_GEX_REQUEST
 - 
 
839 
        dd_n 4096/4                      ; DH GEX min
 508 
  .languages_server_to_client:
840 
        dd_n 4096/2                      ; DH GEX number of bits
 509 
        str ""
841 
        dd_n 4096                        ; DH GEX Max
 510 
  .first_kex_packet_follows:
- 
 
 511 
        db 0
Line 842... Line 512...
842 
  .length = $ - ssh_gex_req
 512 
  .reserved:
843 
 
 513 
        dd_n 0
844 
 
 514 
  .length = $ - ssh_msg_kex
845 
ssh_new_keys:
 515 
 
- 
 
 516 
 
- 
 
 517 
ssh_msg_gex_req:
- 
 
 518 
        db SSH_MSG_KEX_DH_GEX_REQUEST
- 
 
 519 
        dd_n 4096/4                      ; DH GEX min
- 
 
 520 
        dd_n 4096/2                      ; DH GEX number of bits
- 
 
 521 
        dd_n 4096                        ; DH GEX Max
846 
        db SSH_MSG_NEWKEYS
 522 
  .length = $ - ssh_msg_gex_req
847 
  .length = $ - ssh_new_keys
 523 
 
Line 848... Line 524...
848 
 
 524 
 
Line 849... Line 525...
849 
 
 525 
ssh_msg_new_keys:
Line 929... Line 605...
929 
        con_write_asciiz, 'con_write_asciiz', \
 605 
        con_write_asciiz, 'con_write_asciiz', \
930 
        con_exit, 'con_exit', \
 606 
        con_exit, 'con_exit', \
931 
        con_gets, 'con_gets', \
 607 
        con_gets, 'con_gets', \
932 
        con_cls, 'con_cls', \
 608 
        con_cls, 'con_cls', \
933 
        con_getch2, 'con_getch2', \
 609 
        con_getch2, 'con_getch2', \
934 
        con_set_cursor_pos, 'con_set_cursor_pos', \
 - 
 
935 
        con_write_string, 'con_write_string', \
 - 
 
936 
        con_get_flags,  'con_get_flags', \
 610 
        con_get_flags, 'con_get_flags', \
- 
 
 611 
        con_set_title, 'con_set_title', \
937 
        con_set_flags,  'con_set_flags'
 612 
        con_get_input, 'con_get_input'
Line 938... Line 613...
938 
 
 613 
 
939 
import  libcrash, \
 614 
import  libcrash, \
940 
        sha256_init, 'sha256_init', \
 615 
        sha256_init, 'sha256_init', \
941 
        sha256_update, 'sha256_update', \
 616 
        sha256_update, 'sha256_update', \
Line 951... Line 626...
951 
 
 626 
 
Line 952... Line 627...
952 
i_end:
 627 
i_end:
Line 953... Line 628...
953 
 
 628 
 
Line 954... Line 629...
954 
IncludeUGlobals
 629 
IncludeUGlobals
- 
 
 630 
 
Line 955... Line 631...
955 
 
 631 
params          rb MAX_HOSTNAME_LENGTH