Mercurial > 510Connectbot

comparison src/ch/ethz/ssh2/transport/ServerKexManager.java @ 307:071eccdff8ea ganymed

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
fix java formatting
author Carl Byington <carl@five-ten-sg.com>
date Wed, 30 Jul 2014 14:16:58 -0700
parents d2b303406d63
children 42b15aaa7ac7
comparison
equal deleted inserted replaced
305:d2b303406d63 307:071eccdff8ea
42 super(state.tm, state.csh, state.next_cryptoWishList, state.generator); 42 super(state.tm, state.csh, state.next_cryptoWishList, state.generator);
43 this.state = state; 43 this.state = state;
44 } 44 }
45 45
46 public void handleFailure(final IOException failure) { 46 public void handleFailure(final IOException failure) {
47 synchronized(accessLock) { 47 synchronized (accessLock) {
48 connectionClosed = true; 48 connectionClosed = true;
49 accessLock.notifyAll(); 49 accessLock.notifyAll();
50 } 50 }
51 } 51 }
52 52
53 public void handleMessage(byte[] msg) throws IOException { 53 public void handleMessage(byte[] msg) throws IOException {
54 PacketKexInit kip; 54 PacketKexInit kip;
55 55
56 if((kxs == null) && (msg[0] != Packets.SSH_MSG_KEXINIT)) { 56 if ((kxs == null) && (msg[0] != Packets.SSH_MSG_KEXINIT)) {
57 throw new PacketTypeException(msg[0]); 57 throw new PacketTypeException(msg[0]);
58 } 58 }
59 59
60 if(ignore_next_kex_packet) { 60 if (ignore_next_kex_packet) {
61 ignore_next_kex_packet = false; 61 ignore_next_kex_packet = false;
62 return; 62 return;
63 } 63 }
64 64
65 if(msg[0] == Packets.SSH_MSG_KEXINIT) { 65 if (msg[0] == Packets.SSH_MSG_KEXINIT) {
66 if((kxs != null) && (kxs.state != 0)) { 66 if ((kxs != null) && (kxs.state != 0)) {
67 throw new PacketTypeException(msg[0]); 67 throw new PacketTypeException(msg[0]);
68 } 68 }
69 69
70 if(kxs == null) { 70 if (kxs == null) {
71 /* 71 /*
72 * Ah, OK, peer wants to do KEX. Let's be nice and play 72 * Ah, OK, peer wants to do KEX. Let's be nice and play
73 * together. 73 * together.
74 */ 74 */
75 kxs = new KexState(); 75 kxs = new KexState();
76 kxs.local_dsa_key = nextKEXdsakey; 76 kxs.local_dsa_key = nextKEXdsakey;
77 kxs.local_rsa_key = nextKEXrsakey; 77 kxs.local_rsa_key = nextKEXrsakey;
78 kxs.local_ec_key = nextKEXeckey; 78 kxs.local_ec_key = nextKEXeckey;
79 kxs.dhgexParameters = nextKEXdhgexParameters; 79 kxs.dhgexParameters = nextKEXdhgexParameters;
82 tm.sendKexMessage(kip.getPayload()); 82 tm.sendKexMessage(kip.getPayload());
83 } 83 }
84 84
85 kip = new PacketKexInit(msg); 85 kip = new PacketKexInit(msg);
86 kxs.remoteKEX = kip; 86 kxs.remoteKEX = kip;
87
88 kxs.np = mergeKexParameters(kxs.remoteKEX.getKexParameters(), kxs.localKEX.getKexParameters()); 87 kxs.np = mergeKexParameters(kxs.remoteKEX.getKexParameters(), kxs.localKEX.getKexParameters());
89 88
90 if(kxs.remoteKEX.isFirst_kex_packet_follows() && (kxs.np.guessOK == false)) { 89 if (kxs.remoteKEX.isFirst_kex_packet_follows() && (kxs.np.guessOK == false)) {
91 // Guess was wrong, we need to ignore the next kex packet. 90 // Guess was wrong, we need to ignore the next kex packet.
92 ignore_next_kex_packet = true; 91 ignore_next_kex_packet = true;
93 } 92 }
94 93
95 if(kxs.np.kex_algo.equals("diffie-hellman-group1-sha1") 94 if (kxs.np.kex_algo.equals("diffie-hellman-group1-sha1")
96 || kxs.np.kex_algo.equals("diffie-hellman-group14-sha1")) { 95 || kxs.np.kex_algo.equals("diffie-hellman-group14-sha1")) {
97 kxs.dhx = new DhExchange(); 96 kxs.dhx = new DhExchange();
98 97
99 if(kxs.np.kex_algo.equals("diffie-hellman-group1-sha1")) { 98 if (kxs.np.kex_algo.equals("diffie-hellman-group1-sha1")) {
100 kxs.dhx.serverInit(1, rnd); 99 kxs.dhx.serverInit(1, rnd);
101 } 100 }
102 else { 101 else {
103 kxs.dhx.serverInit(14, rnd); 102 kxs.dhx.serverInit(14, rnd);
104 } 103 }
108 } 107 }
109 108
110 throw new IllegalStateException("Unkown KEX method!"); 109 throw new IllegalStateException("Unkown KEX method!");
111 } 110 }
112 111
113 if(msg[0] == Packets.SSH_MSG_NEWKEYS) { 112 if (msg[0] == Packets.SSH_MSG_NEWKEYS) {
114 if(km == null) { 113 if (km == null) {
115 throw new IOException("Peer sent SSH_MSG_NEWKEYS, but I have no key material ready!"); 114 throw new IOException("Peer sent SSH_MSG_NEWKEYS, but I have no key material ready!");
116 } 115 }
117 116
118 BlockCipher cbc; 117 BlockCipher cbc;
119 MAC mac; 118 MAC mac;
120 119
121 try { 120 try {
122 cbc = BlockCipherFactory.createCipher(kxs.np.enc_algo_client_to_server, false, 121 cbc = BlockCipherFactory.createCipher(kxs.np.enc_algo_client_to_server, false,
123 km.enc_key_client_to_server, km.initial_iv_client_to_server); 122 km.enc_key_client_to_server, km.initial_iv_client_to_server);
124 123
125 try { 124 try {
126 mac = new MAC(kxs.np.mac_algo_client_to_server, km.integrity_key_client_to_server); 125 mac = new MAC(kxs.np.mac_algo_client_to_server, km.integrity_key_client_to_server);
127 } 126 }
128 catch(DigestException e) { 127 catch (DigestException e) {
129 throw new IOException(e); 128 throw new IOException(e);
130 } 129 }
131 130 }
132 } 131 catch (IllegalArgumentException e) {
133 catch(IllegalArgumentException e) {
134 throw new IOException(e); 132 throw new IOException(e);
135 } 133 }
136 134
137 tm.changeRecvCipher(cbc, mac); 135 tm.changeRecvCipher(cbc, mac);
138
139 ConnectionInfo sci = new ConnectionInfo(); 136 ConnectionInfo sci = new ConnectionInfo();
140
141 kexCount++; 137 kexCount++;
142
143 sci.keyExchangeAlgorithm = kxs.np.kex_algo; 138 sci.keyExchangeAlgorithm = kxs.np.kex_algo;
144 sci.keyExchangeCounter = kexCount; 139 sci.keyExchangeCounter = kexCount;
145 sci.clientToServerCryptoAlgorithm = kxs.np.enc_algo_client_to_server; 140 sci.clientToServerCryptoAlgorithm = kxs.np.enc_algo_client_to_server;
146 sci.serverToClientCryptoAlgorithm = kxs.np.enc_algo_server_to_client; 141 sci.serverToClientCryptoAlgorithm = kxs.np.enc_algo_server_to_client;
147 sci.clientToServerMACAlgorithm = kxs.np.mac_algo_client_to_server; 142 sci.clientToServerMACAlgorithm = kxs.np.mac_algo_client_to_server;
148 sci.serverToClientMACAlgorithm = kxs.np.mac_algo_server_to_client; 143 sci.serverToClientMACAlgorithm = kxs.np.mac_algo_server_to_client;
149 sci.serverHostKeyAlgorithm = kxs.np.server_host_key_algo; 144 sci.serverHostKeyAlgorithm = kxs.np.server_host_key_algo;
150 sci.serverHostKey = kxs.remote_hostkey; 145 sci.serverHostKey = kxs.remote_hostkey;
151 146
152 synchronized(accessLock) { 147 synchronized (accessLock) {
153 lastConnInfo = sci; 148 lastConnInfo = sci;
154 accessLock.notifyAll(); 149 accessLock.notifyAll();
155 } 150 }
156 151
157 kxs = null; 152 kxs = null;
158 return; 153 return;
159 } 154 }
160 155
161 if((kxs == null) || (kxs.state == 0)) { 156 if ((kxs == null) || (kxs.state == 0)) {
162 throw new IOException("Unexpected Kex submessage!"); 157 throw new IOException("Unexpected Kex submessage!");
163 } 158 }
164 159
165 if(kxs.np.kex_algo.equals("diffie-hellman-group1-sha1") 160 if (kxs.np.kex_algo.equals("diffie-hellman-group1-sha1")
166 || kxs.np.kex_algo.equals("diffie-hellman-group14-sha1")) { 161 || kxs.np.kex_algo.equals("diffie-hellman-group14-sha1")) {
167 if(kxs.state == 1) { 162 if (kxs.state == 1) {
168 PacketKexDHInit dhi = new PacketKexDHInit(msg); 163 PacketKexDHInit dhi = new PacketKexDHInit(msg);
169
170 kxs.dhx.setE(dhi.getE()); 164 kxs.dhx.setE(dhi.getE());
171
172 byte[] hostKey = null; 165 byte[] hostKey = null;
173 166
174 if (kxs.np.server_host_key_algo.startsWith("ecdsa-sha2-")) { 167 if (kxs.np.server_host_key_algo.startsWith("ecdsa-sha2-")) {
175 hostKey = ECDSASHA2Verify.encodeSSHECDSAPublicKey((ECPublicKey)kxs.local_ec_key.getPublic()); 168 hostKey = ECDSASHA2Verify.encodeSSHECDSAPublicKey((ECPublicKey)kxs.local_ec_key.getPublic());
176 } 169 }
177 170
178 if(kxs.np.server_host_key_algo.equals("ssh-rsa")) { 171 if (kxs.np.server_host_key_algo.equals("ssh-rsa")) {
179 hostKey = RSASHA1Verify.encodeSSHRSAPublicKey((RSAPublicKey)kxs.local_rsa_key.getPublic()); 172 hostKey = RSASHA1Verify.encodeSSHRSAPublicKey((RSAPublicKey)kxs.local_rsa_key.getPublic());
180 } 173 }
181 174
182 if(kxs.np.server_host_key_algo.equals("ssh-dss")) { 175 if (kxs.np.server_host_key_algo.equals("ssh-dss")) {
183 hostKey = DSASHA1Verify.encodeSSHDSAPublicKey((DSAPublicKey)kxs.local_dsa_key.getPublic()); 176 hostKey = DSASHA1Verify.encodeSSHDSAPublicKey((DSAPublicKey)kxs.local_dsa_key.getPublic());
184 } 177 }
185 178
186 try { 179 try {
187 kxs.H = kxs.dhx.calculateH(csh.getClientString(), csh.getServerString(), 180 kxs.H = kxs.dhx.calculateH(csh.getClientString(), csh.getServerString(),
188 kxs.remoteKEX.getPayload(), kxs.localKEX.getPayload(), hostKey); 181 kxs.remoteKEX.getPayload(), kxs.localKEX.getPayload(), hostKey);
189 } 182 }
190 catch(IllegalArgumentException e) { 183 catch (IllegalArgumentException e) {
191 throw new IOException("KEX error.", e); 184 throw new IOException("KEX error.", e);
192 } 185 }
193 186
194 kxs.K = kxs.dhx.getK(); 187 kxs.K = kxs.dhx.getK();
195
196 byte[] signature = null; 188 byte[] signature = null;
197 189
198 if (kxs.np.server_host_key_algo.startsWith("ecdsa-sha2-")) { 190 if (kxs.np.server_host_key_algo.startsWith("ecdsa-sha2-")) {
199 ECPrivateKey pk = (ECPrivateKey)kxs.local_ec_key.getPrivate(); 191 ECPrivateKey pk = (ECPrivateKey)kxs.local_ec_key.getPrivate();
200 byte[] es = ECDSASHA2Verify.generateSignature(kxs.H, pk); 192 byte[] es = ECDSASHA2Verify.generateSignature(kxs.H, pk);
211 signature = DSASHA1Verify.encodeSSHDSASignature(ds); 203 signature = DSASHA1Verify.encodeSSHDSASignature(ds);
212 } 204 }
213 205
214 PacketKexDHReply dhr = new PacketKexDHReply(hostKey, kxs.dhx.getF(), signature); 206 PacketKexDHReply dhr = new PacketKexDHReply(hostKey, kxs.dhx.getF(), signature);
215 tm.sendKexMessage(dhr.getPayload()); 207 tm.sendKexMessage(dhr.getPayload());
216
217 finishKex(false); 208 finishKex(false);
218 kxs.state = -1; 209 kxs.state = -1;
219 210
220 if(authenticationStarted == false) { 211 if (authenticationStarted == false) {
221 authenticationStarted = true; 212 authenticationStarted = true;
222 state.am = new ServerAuthenticationManager(state); 213 state.am = new ServerAuthenticationManager(state);
223 } 214 }
224 215
225 return; 216 return;
226 } 217 }
227 } 218 }
219
228 throw new IllegalStateException(String.format("Unknown KEX method %s", kxs.np.kex_algo)); 220 throw new IllegalStateException(String.format("Unknown KEX method %s", kxs.np.kex_algo));
229 } 221 }
230 } 222 }