packet SSH_KEXINIT received and parsed

Resolved some bugs in the callback mechanism as well

include/libssh/kex.h

@@ -0,0 +1,30 @@
+/*
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2009 by Aris Adamantiadis
+ *
+ * The SSH Library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ *
+ * The SSH Library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the SSH Library; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+#ifndef KEX_H_
+#define KEX_H_
+
+#include "libssh/priv.h"
+#include "libssh/callbacks.h"
+
+SSH_PACKET_CALLBACK(ssh_packet_kexinit);
+
+#endif /* KEX_H_ */

include/libssh/priv.h

@@ -120,6 +120,7 @@ SSH_PACKET_CALLBACK(ssh_packet_ignore_callback);
 /* client.c */
 
 int ssh_send_banner(ssh_session session, int is_server);
+void ssh_connection_callback(ssh_session session);
 
 /* config.c */
 int ssh_config_parse_file(ssh_session session, const char *filename);
@@ -156,7 +157,6 @@ extern const char *ssh_kex_nums[];
 int ssh_send_kex(ssh_session session, int server_kex);
 void ssh_list_kex(ssh_session session, KEX *kex);
 int set_kex(ssh_session session);
-int ssh_get_kex(ssh_session session, int server_kex);
 int verify_existing_algo(int algo, const char *name);
 char **space_tokenize(const char *chain);
 int ssh_get_kex1(ssh_session session);

include/libssh/session.h

@@ -34,6 +34,8 @@ enum ssh_session_state_e {
 	SSH_SESSION_STATE_SOCKET_CONNECTED,
 	SSH_SESSION_STATE_BANNER_RECEIVED,
 	SSH_SESSION_STATE_INITIAL_KEX,
+	SSH_SESSION_STATE_KEXINIT_RECEIVED,
+	SSH_SESSION_STATE_DH,
 	SSH_SESSION_STATE_AUTHENTICATING,
 	SSH_SESSION_STATE_AUTHENTICATED,
 	SSH_SESSION_STATE_ERROR

libssh/client.c

@@ -42,7 +42,6 @@
             session->callbacks->connect_status_function(session->callbacks->userdata, status); \
     } while (0)
 
-static void connection_callback(ssh_session session);
 /**
  * @internal
  * @brief Callback to be called when the socket is connected or had a
@@ -61,7 +60,7 @@ static void socket_callback_connected(int code, int errno, void *user){
 		session->session_state=SSH_SESSION_STATE_ERROR;
 		ssh_set_error(session,SSH_FATAL,"Connection failed: %s",strerror(errno));
 	}
-	connection_callback(session);
+	ssh_connection_callback(session);
 	leave_function();
 }
 
@@ -76,7 +75,7 @@ static void socket_callback_exception(int code, int errno, void *user){
 	ssh_log(session,SSH_LOG_RARE,"Socket exception callback: %d (%d)",code, errno);
 	session->session_state=SSH_SESSION_STATE_ERROR;
 	ssh_set_error(session,SSH_FATAL,"Socket error: %s",strerror(errno));
-	connection_callback(session);
+	ssh_connection_callback(session);
 	leave_function();
 }
 
@@ -114,7 +113,7 @@ static int callback_receive_banner(const void *data, size_t len, void *user) {
   		session->serverbanner=str;
   		session->session_state=SSH_SESSION_STATE_BANNER_RECEIVED;
   		ssh_log(session,SSH_LOG_PACKET,"Received banner: %s",str);
-  		connection_callback(session);
+  		ssh_connection_callback(session);
   		leave_function();
   		return ret;
   	}
@@ -519,7 +518,7 @@ int ssh_service_request(ssh_session session, const char *service) {
 /** @internal
  * @function to be called each time a step has been done in the connection
  */
-static void connection_callback(ssh_session session){
+void ssh_connection_callback(ssh_session session){
 	int ssh1,ssh2;
 	enter_function();
 	switch(session->session_state){
@@ -558,35 +557,37 @@ static void connection_callback(ssh_session session){
 		  session->session_state=SSH_SESSION_STATE_INITIAL_KEX;
 		  break;
 		case SSH_SESSION_STATE_INITIAL_KEX:
-			switch (session->version) {
+			if(session->version==1){
-				case 2:
+				if (ssh_get_kex1(session) < 0)
-					ssh_get_kex(session,0);
+					goto error;
-					set_status(session,0.6);
+				set_status(session,0.6);
-
+				session->connected = 1;
-					ssh_list_kex(session, &session->server_kex);
+				session->session_state=SSH_SESSION_STATE_AUTHENTICATING;
-					if (set_kex(session) < 0) {
+				break;
-						goto error;
-					}
-					if (ssh_send_kex(session, 0) < 0) {
-						goto error;
-					}
-					set_status(session,0.8);
-
-					if (dh_handshake(session) < 0) {
-						goto error;
-					}
-					set_status(session,1.0);
-					session->connected = 1;
-					break;
-				case 1:
-					if (ssh_get_kex1(session) < 0)
-						goto error;
-					set_status(session,0.6);
-
-					session->connected = 1;
-					break;
 			}
-			session->session_state=SSH_SESSION_STATE_AUTHENTICATING;
+		case SSH_SESSION_STATE_KEXINIT_RECEIVED:
+			set_status(session,0.6);
+			ssh_list_kex(session, &session->server_kex);
+			if (set_kex(session) < 0) {
+				goto error;
+			}
+			if (ssh_send_kex(session, 0) < 0) {
+				goto error;
+			}
+			set_status(session,0.8);
+			session->session_state=SSH_SESSION_STATE_DH;
+			break;
+		case SSH_SESSION_STATE_DH:
+			if (dh_handshake(session) < 0) {
+				goto error;
+			}
+			if(session->dh_handshake_state==DH_STATE_FINISHED){
+				set_status(session,1.0);
+				session->connected = 1;
+				break;
+				session->session_state=SSH_SESSION_STATE_AUTHENTICATING;
+			}
+			break;
 		case SSH_SESSION_STATE_AUTHENTICATING:
 					break;
 		default:

libssh/kex.c

@@ -40,6 +40,7 @@
 #include "libssh/wrapper.h"
 #include "libssh/keys.h"
 #include "libssh/dh.h"
+#include "libssh/kex.h"
 
 #ifdef HAVE_LIBGCRYPT
 #define BLOWFISH "blowfish-cbc,"
@@ -239,34 +240,33 @@ char *ssh_find_matching(const char *in_d, const char *what_d){
     return NULL;
 }
 
-int ssh_get_kex(ssh_session session, int server_kex) {
+SSH_PACKET_CALLBACK(ssh_packet_kexinit){
+	int server_kex=session->server;
   ssh_string str = NULL;
   char *strings[10];
   int i;
 
   enter_function();
-
+  (void)type;
-  if (packet_wait(session, SSH2_MSG_KEXINIT, 1) != SSH_OK) {
+  (void)user;
-    leave_function();
+  if(session->session_state != SSH_SESSION_STATE_INITIAL_KEX){
-    return -1;
+  	ssh_set_error(session,SSH_FATAL,"SSH_KEXINIT received in wrong state");
+  	goto error;
   }
-
+  if (buffer_get_data(packet,session->server_kex.cookie,16) != 16) {
-  if (buffer_get_data(session->in_buffer,session->server_kex.cookie,16) != 16) {
+    ssh_set_error(session, SSH_FATAL, "ssh_packet_kexinit: no cookie in packet");
-    ssh_set_error(session, SSH_FATAL, "get_kex(): no cookie in packet");
+    goto error;
-    leave_function();
-    return -1;
   }
 
   if (hashbufin_add_cookie(session, session->server_kex.cookie) < 0) {
-    ssh_set_error(session, SSH_FATAL, "get_kex(): adding cookie failed");
+    ssh_set_error(session, SSH_FATAL, "ssh_packet_kexinit: adding cookie failed");
-    leave_function();
+    goto error;
-    return -1;
   }
 
   memset(strings, 0, sizeof(char *) * 10);
 
   for (i = 0; i < 10; i++) {
-    str = buffer_get_ssh_string(session->in_buffer);
+    str = buffer_get_ssh_string(packet);
     if (str == NULL) {
       break;
     }
@@ -307,15 +307,18 @@ int ssh_get_kex(ssh_session session, int server_kex) {
   }
 
   leave_function();
-  return 0;
+  session->session_state=SSH_SESSION_STATE_KEXINIT_RECEIVED;
+  ssh_connection_callback(session);
+  return SSH_PACKET_USED;
 error:
   string_free(str);
   for (i = 0; i < 10; i++) {
     SAFE_FREE(strings[i]);
   }
 
+  session->session_state = SSH_SESSION_STATE_ERROR;
   leave_function();
-  return -1;
+  return SSH_PACKET_USED;
 }
 
 void ssh_list_kex(ssh_session session, KEX *kex) {

libssh/packet.c

@@ -44,6 +44,7 @@
 #include "libssh/session.h"
 #include "libssh/messages.h"
 #include "libssh/pcap.h"
+#include "libssh/kex.h"
 
 ssh_packet_callback default_packet_handlers[]= {
 
@@ -55,7 +56,7 @@ ssh_packet_callback default_packet_handlers[]= {
 	NULL, //#define SSH2_MSG_SERVICE_ACCEPT 6
 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
 	NULL, NULL, NULL, // 7-19
-	NULL, //#define SSH2_MSG_KEXINIT	 20
+	ssh_packet_kexinit, //#define SSH2_MSG_KEXINIT	 20
 	NULL, //#define SSH2_MSG_NEWKEYS 21
 	NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, //22-29
 	NULL, //#define SSH2_MSG_KEXDH_INIT 30 SSH2_MSG_KEX_DH_GEX_REQUEST_OLD 30
@@ -298,7 +299,7 @@ void ssh_packet_set_callbacks(ssh_session session, ssh_packet_callbacks callback
  * @brief sets the default packet handlers
  */
 void ssh_packet_set_default_callbacks(ssh_session session){
-	session->default_packet_callbacks.start=0;
+	session->default_packet_callbacks.start=1;
 	session->default_packet_callbacks.n_callbacks=sizeof(default_packet_handlers)/sizeof(ssh_packet_callback);
 	session->default_packet_callbacks.user=session;
 	session->default_packet_callbacks.callbacks=default_packet_handlers;
@@ -327,7 +328,7 @@ void ssh_packet_process(ssh_session session, uint8_t type){
 			continue;
 		if(cb->start > type)
 			continue;
-		if(cb->start + cb->n_callbacks > type)
+		if(cb->start + cb->n_callbacks <= type)
 			continue;
 		if(cb->callbacks[type - cb->start]==NULL)
 			continue;

libssh/server.c

@@ -528,9 +528,10 @@ int ssh_accept(ssh_session session) {
     return -1;
   }
 
-  if (ssh_get_kex(session,1) < 0) {
+  /* TODO here things won't work anymore */
-    return -1;
+//  if (ssh_get_kex(session,1) < 0) {
-  }
+//    return -1;
+//  }
 
   ssh_list_kex(session, &session->client_kex);
   crypt_set_algorithms_server(session);