Mercurial > 510Connectbot

comparison src/ch/ethz/ssh2/transport/KexManager.java @ 307:071eccdff8ea ganymed

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
fix java formatting
author Carl Byington <carl@five-ten-sg.com>
date Wed, 30 Jul 2014 14:16:58 -0700
parents ca5dd224a87b
children 90537ba71897
comparison
equal deleted inserted replaced
305:d2b303406d63 307:071eccdff8ea
89 this.nextKEXdhgexParameters = new DHGexParameters(); 89 this.nextKEXdhgexParameters = new DHGexParameters();
90 this.rnd = rnd; 90 this.rnd = rnd;
91 } 91 }
92 92
93 public ConnectionInfo getOrWaitForConnectionInfo(int minKexCount) throws IOException { 93 public ConnectionInfo getOrWaitForConnectionInfo(int minKexCount) throws IOException {
94 synchronized(accessLock) { 94 synchronized (accessLock) {
95 while(true) { 95 while (true) {
96 if((lastConnInfo != null) && (lastConnInfo.keyExchangeCounter >= minKexCount)) { 96 if ((lastConnInfo != null) && (lastConnInfo.keyExchangeCounter >= minKexCount)) {
97 return lastConnInfo; 97 return lastConnInfo;
98 } 98 }
99 if(connectionClosed) { 99
100 if (connectionClosed) {
100 throw tm.getReasonClosedCause(); 101 throw tm.getReasonClosedCause();
101 } 102 }
103
102 try { 104 try {
103 accessLock.wait(); 105 accessLock.wait();
104 } 106 }
105 catch(InterruptedException e) { 107 catch (InterruptedException e) {
106 throw new InterruptedIOException(e.getMessage()); 108 throw new InterruptedIOException(e.getMessage());
107 } 109 }
108 } 110 }
109 } 111 }
110 } 112 }
111 113
112 private String getFirstMatch(String[] client, String[] server) throws NegotiateException { 114 private String getFirstMatch(String[] client, String[] server) throws NegotiateException {
113 if(client == null || server == null) { 115 if (client == null || server == null) {
114 throw new IllegalArgumentException(); 116 throw new IllegalArgumentException();
115 } 117 }
116 for(String c : client) { 118
117 for(String s : server) { 119 for (String c : client) {
118 if(c.equals(s)) { 120 for (String s : server) {
121 if (c.equals(s)) {
119 return c; 122 return c;
120 } 123 }
121 } 124 }
122 } 125 }
126
123 throw new NegotiateException(String.format("Negotiation failed for %s", Arrays.toString(server))); 127 throw new NegotiateException(String.format("Negotiation failed for %s", Arrays.toString(server)));
124 } 128 }
125 129
126 private boolean compareFirstOfNameList(String[] a, String[] b) { 130 private boolean compareFirstOfNameList(String[] a, String[] b) {
127 if(a == null || b == null) { 131 if (a == null || b == null) {
128 throw new IllegalArgumentException(); 132 throw new IllegalArgumentException();
129 } 133 }
130 if((a.length == 0) && (b.length == 0)) { 134
135 if ((a.length == 0) && (b.length == 0)) {
131 return true; 136 return true;
132 } 137 }
133 if((a.length == 0) || (b.length == 0)) { 138
139 if ((a.length == 0) || (b.length == 0)) {
134 return false; 140 return false;
135 } 141 }
142
136 return (a[0].equals(b[0])); 143 return (a[0].equals(b[0]));
137 } 144 }
138 145
139 private boolean isGuessOK(KexParameters cpar, KexParameters spar) { 146 private boolean isGuessOK(KexParameters cpar, KexParameters spar) {
140 if(cpar == null || spar == null) { 147 if (cpar == null || spar == null) {
141 throw new IllegalArgumentException(); 148 throw new IllegalArgumentException();
142 } 149 }
143 if(!compareFirstOfNameList(cpar.kex_algorithms, spar.kex_algorithms)) { 150
151 if (!compareFirstOfNameList(cpar.kex_algorithms, spar.kex_algorithms)) {
144 return false; 152 return false;
145 } 153 }
146 if(!compareFirstOfNameList(cpar.server_host_key_algorithms, spar.server_host_key_algorithms)) { 154
155 if (!compareFirstOfNameList(cpar.server_host_key_algorithms, spar.server_host_key_algorithms)) {
147 return false; 156 return false;
148 } 157 }
149 158
150 /* 159 /*
151 * We do NOT check here if the other algorithms can be agreed on, this 160 * We do NOT check here if the other algorithms can be agreed on, this
152 * is just a check if kex_algorithms and server_host_key_algorithms were 161 * is just a check if kex_algorithms and server_host_key_algorithms were
153 * guessed right! 162 * guessed right!
154 */ 163 */
155
156 return true; 164 return true;
157 } 165 }
158 166
159 protected NegotiatedParameters mergeKexParameters(KexParameters client, KexParameters server) 167 protected NegotiatedParameters mergeKexParameters(KexParameters client, KexParameters server)
160 throws NegotiateException { 168 throws NegotiateException {
161 NegotiatedParameters np = new NegotiatedParameters(); 169 NegotiatedParameters np = new NegotiatedParameters();
162
163 np.kex_algo = getFirstMatch(client.kex_algorithms, server.kex_algorithms); 170 np.kex_algo = getFirstMatch(client.kex_algorithms, server.kex_algorithms);
164
165 log.info("kex_algo=" + np.kex_algo); 171 log.info("kex_algo=" + np.kex_algo);
166
167 np.server_host_key_algo = getFirstMatch(client.server_host_key_algorithms, 172 np.server_host_key_algo = getFirstMatch(client.server_host_key_algorithms,
168 server.server_host_key_algorithms); 173 server.server_host_key_algorithms);
169
170 log.info("server_host_key_algo=" + np.server_host_key_algo); 174 log.info("server_host_key_algo=" + np.server_host_key_algo);
171
172 np.enc_algo_client_to_server = getFirstMatch(client.encryption_algorithms_client_to_server, 175 np.enc_algo_client_to_server = getFirstMatch(client.encryption_algorithms_client_to_server,
173 server.encryption_algorithms_client_to_server); 176 server.encryption_algorithms_client_to_server);
174 np.enc_algo_server_to_client = getFirstMatch(client.encryption_algorithms_server_to_client, 177 np.enc_algo_server_to_client = getFirstMatch(client.encryption_algorithms_server_to_client,
175 server.encryption_algorithms_server_to_client); 178 server.encryption_algorithms_server_to_client);
176
177 log.info("enc_algo_client_to_server=" + np.enc_algo_client_to_server); 179 log.info("enc_algo_client_to_server=" + np.enc_algo_client_to_server);
178 log.info("enc_algo_server_to_client=" + np.enc_algo_server_to_client); 180 log.info("enc_algo_server_to_client=" + np.enc_algo_server_to_client);
179
180 np.mac_algo_client_to_server = getFirstMatch(client.mac_algorithms_client_to_server, 181 np.mac_algo_client_to_server = getFirstMatch(client.mac_algorithms_client_to_server,
181 server.mac_algorithms_client_to_server); 182 server.mac_algorithms_client_to_server);
182 np.mac_algo_server_to_client = getFirstMatch(client.mac_algorithms_server_to_client, 183 np.mac_algo_server_to_client = getFirstMatch(client.mac_algorithms_server_to_client,
183 server.mac_algorithms_server_to_client); 184 server.mac_algorithms_server_to_client);
184
185 log.info("mac_algo_client_to_server=" + np.mac_algo_client_to_server); 185 log.info("mac_algo_client_to_server=" + np.mac_algo_client_to_server);
186 log.info("mac_algo_server_to_client=" + np.mac_algo_server_to_client); 186 log.info("mac_algo_server_to_client=" + np.mac_algo_server_to_client);
187
188 np.comp_algo_client_to_server = getFirstMatch(client.compression_algorithms_client_to_server, 187 np.comp_algo_client_to_server = getFirstMatch(client.compression_algorithms_client_to_server,
189 server.compression_algorithms_client_to_server); 188 server.compression_algorithms_client_to_server);
190 np.comp_algo_server_to_client = getFirstMatch(client.compression_algorithms_server_to_client, 189 np.comp_algo_server_to_client = getFirstMatch(client.compression_algorithms_server_to_client,
191 server.compression_algorithms_server_to_client); 190 server.compression_algorithms_server_to_client);
192
193 log.info("comp_algo_client_to_server=" + np.comp_algo_client_to_server); 191 log.info("comp_algo_client_to_server=" + np.comp_algo_client_to_server);
194 log.info("comp_algo_server_to_client=" + np.comp_algo_server_to_client); 192 log.info("comp_algo_server_to_client=" + np.comp_algo_server_to_client);
195
196 np.lang_client_to_server = getFirstMatch(client.languages_client_to_server, 193 np.lang_client_to_server = getFirstMatch(client.languages_client_to_server,
197 server.languages_client_to_server); 194 server.languages_client_to_server);
198
199 np.lang_server_to_client = getFirstMatch(client.languages_server_to_client, 195 np.lang_server_to_client = getFirstMatch(client.languages_server_to_client,
200 server.languages_server_to_client); 196 server.languages_server_to_client);
201 197
202 if(isGuessOK(client, server)) { 198 if (isGuessOK(client, server)) {
203 np.guessOK = true; 199 np.guessOK = true;
204 } 200 }
201
205 return np; 202 return np;
206 } 203 }
207 204
208 public synchronized void initiateKEX(CryptoWishList cwl, DHGexParameters dhgex, KeyPair dsa, KeyPair rsa, KeyPair ec) 205 public synchronized void initiateKEX(CryptoWishList cwl, DHGexParameters dhgex, KeyPair dsa, KeyPair rsa, KeyPair ec)
209 throws IOException { 206 throws IOException {
210 nextKEXcryptoWishList = cwl; 207 nextKEXcryptoWishList = cwl;
211 nextKEXdhgexParameters = dhgex; 208 nextKEXdhgexParameters = dhgex;
212 nextKEXdsakey = dsa; 209 nextKEXdsakey = dsa;
213 nextKEXrsakey = rsa; 210 nextKEXrsakey = rsa;
214 nextKEXeckey = ec; 211 nextKEXeckey = ec;
215 212
216 if(kxs == null) { 213 if (kxs == null) {
217 kxs = new KexState(); 214 kxs = new KexState();
218 kxs.local_dsa_key = dsa; 215 kxs.local_dsa_key = dsa;
219 kxs.local_rsa_key = rsa; 216 kxs.local_rsa_key = rsa;
220 kxs.local_ec_key = ec; 217 kxs.local_ec_key = ec;
221 kxs.dhgexParameters = nextKEXdhgexParameters; 218 kxs.dhgexParameters = nextKEXdhgexParameters;
227 private boolean establishKeyMaterial() throws IOException { 224 private boolean establishKeyMaterial() throws IOException {
228 try { 225 try {
229 int mac_cs_key_len = MAC.getKeyLen(kxs.np.mac_algo_client_to_server); 226 int mac_cs_key_len = MAC.getKeyLen(kxs.np.mac_algo_client_to_server);
230 int enc_cs_key_len = BlockCipherFactory.getKeySize(kxs.np.enc_algo_client_to_server); 227 int enc_cs_key_len = BlockCipherFactory.getKeySize(kxs.np.enc_algo_client_to_server);
231 int enc_cs_block_len = BlockCipherFactory.getBlockSize(kxs.np.enc_algo_client_to_server); 228 int enc_cs_block_len = BlockCipherFactory.getBlockSize(kxs.np.enc_algo_client_to_server);
232
233 int mac_sc_key_len = MAC.getKeyLen(kxs.np.mac_algo_server_to_client); 229 int mac_sc_key_len = MAC.getKeyLen(kxs.np.mac_algo_server_to_client);
234 int enc_sc_key_len = BlockCipherFactory.getKeySize(kxs.np.enc_algo_server_to_client); 230 int enc_sc_key_len = BlockCipherFactory.getKeySize(kxs.np.enc_algo_server_to_client);
235 int enc_sc_block_len = BlockCipherFactory.getBlockSize(kxs.np.enc_algo_server_to_client); 231 int enc_sc_block_len = BlockCipherFactory.getBlockSize(kxs.np.enc_algo_server_to_client);
236
237 km = KeyMaterial.create("SHA1", kxs.H, kxs.K, sessionId, enc_cs_key_len, enc_cs_block_len, mac_cs_key_len, 232 km = KeyMaterial.create("SHA1", kxs.H, kxs.K, sessionId, enc_cs_key_len, enc_cs_block_len, mac_cs_key_len,
238 enc_sc_key_len, enc_sc_block_len, mac_sc_key_len); 233 enc_sc_key_len, enc_sc_block_len, mac_sc_key_len);
239 } 234 }
240 catch(IllegalArgumentException e) { 235 catch (IllegalArgumentException e) {
241 return false; 236 return false;
242 } 237 }
238
243 return true; 239 return true;
244 } 240 }
245 241
246 protected void finishKex(boolean clientMode) throws IOException { 242 protected void finishKex(boolean clientMode) throws IOException {
247 if(sessionId == null) { 243 if (sessionId == null) {
248 sessionId = kxs.H; 244 sessionId = kxs.H;
249 } 245 }
250 246
251 establishKeyMaterial(); 247 establishKeyMaterial();
252 248 /* Tell the other side that we start using the new material */
253 /* Tell the other side that we start using the new material */
254
255 PacketNewKeys ign = new PacketNewKeys(); 249 PacketNewKeys ign = new PacketNewKeys();
256 tm.sendKexMessage(ign.getPayload()); 250 tm.sendKexMessage(ign.getPayload());
257
258 BlockCipher cbc; 251 BlockCipher cbc;
259 MAC mac; 252 MAC mac;
260 Compressor comp; 253 Compressor comp;
261 254
262 try { 255 try {
263 cbc = BlockCipherFactory.createCipher(clientMode ? kxs.np.enc_algo_client_to_server 256 cbc = BlockCipherFactory.createCipher(clientMode ? kxs.np.enc_algo_client_to_server
264 : kxs.np.enc_algo_server_to_client, true, clientMode ? km.enc_key_client_to_server 257 : kxs.np.enc_algo_server_to_client, true, clientMode ? km.enc_key_client_to_server
265 : km.enc_key_server_to_client, clientMode ? km.initial_iv_client_to_server 258 : km.enc_key_server_to_client, clientMode ? km.initial_iv_client_to_server
266 : km.initial_iv_server_to_client); 259 : km.initial_iv_server_to_client);
267 260
268 try { 261 try {
269 mac = new MAC(clientMode ? kxs.np.mac_algo_client_to_server : kxs.np.mac_algo_server_to_client, clientMode 262 mac = new MAC(clientMode ? kxs.np.mac_algo_client_to_server : kxs.np.mac_algo_server_to_client, clientMode
270 ? km.integrity_key_client_to_server : km.integrity_key_server_to_client); 263 ? km.integrity_key_client_to_server : km.integrity_key_server_to_client);
271 } 264 }
272 catch(DigestException e) { 265 catch (DigestException e) {
273 throw new IOException(e); 266 throw new IOException(e);
274 } 267 }
275 268
276 comp = CompressionFactory.createCompressor(kxs.np.comp_algo_client_to_server); 269 comp = CompressionFactory.createCompressor(kxs.np.comp_algo_client_to_server);
277 } 270 }
278 catch(IllegalArgumentException f) { 271 catch (IllegalArgumentException f) {
279 throw new IOException(String.format("Fatal error initializing ciphers. %s", f.getMessage())); 272 throw new IOException(String.format("Fatal error initializing ciphers. %s", f.getMessage()));
280 } 273 }
281 274
282 tm.changeSendCipher(cbc, mac); 275 tm.changeSendCipher(cbc, mac);
283 tm.changeSendCompression(comp); 276 tm.changeSendCompression(comp);