Mercurial > 510Connectbot

comparison src/ch/ethz/ssh2/transport/ClientKexManager.java @ 330:6740870cf268 ganymed

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
fix java formatting
author Carl Byington <carl@five-ten-sg.com>
date Thu, 31 Jul 2014 12:59:08 -0700
parents 6896bfafa510
children d835e842d158
comparison
equal deleted inserted replaced
329:6896bfafa510 330:6740870cf268
78 78
79 throw new IOException("Unknown server host key algorithm '" + kxs.np.server_host_key_algo + "'"); 79 throw new IOException("Unknown server host key algorithm '" + kxs.np.server_host_key_algo + "'");
80 } 80 }
81 81
82 public void handleFailure(final IOException failure) { 82 public void handleFailure(final IOException failure) {
83 synchronized(accessLock) { 83 synchronized (accessLock) {
84 connectionClosed = true; 84 connectionClosed = true;
85 accessLock.notifyAll(); 85 accessLock.notifyAll();
86 } 86 }
87 } 87 }
88 88
95 accessLock.notifyAll(); 95 accessLock.notifyAll();
96 return; 96 return;
97 } 97 }
98 } 98 }
99 99
100 if((kxs == null) && (msg[0] != Packets.SSH_MSG_KEXINIT)) { 100 if ((kxs == null) && (msg[0] != Packets.SSH_MSG_KEXINIT)) {
101 throw new PacketTypeException(msg[0]); 101 throw new PacketTypeException(msg[0]);
102 } 102 }
103 103
104 if(ignore_next_kex_packet) { 104 if (ignore_next_kex_packet) {
105 ignore_next_kex_packet = false; 105 ignore_next_kex_packet = false;
106 return; 106 return;
107 } 107 }
108 108
109 if(msg[0] == Packets.SSH_MSG_KEXINIT) { 109 if (msg[0] == Packets.SSH_MSG_KEXINIT) {
110 if((kxs != null) && (kxs.state != 0)) { 110 if ((kxs != null) && (kxs.state != 0)) {
111 throw new PacketTypeException(msg[0]); 111 throw new PacketTypeException(msg[0]);
112 } 112 }
113 113
114 if(kxs == null) { 114 if (kxs == null) {
115 /* 115 /*
116 * Ah, OK, peer wants to do KEX. Let's be nice and play 116 * Ah, OK, peer wants to do KEX. Let's be nice and play
117 * together. 117 * together.
118 */ 118 */
119 kxs = new KexState(); 119 kxs = new KexState();
120 kxs.dhgexParameters = nextKEXdhgexParameters; 120 kxs.dhgexParameters = nextKEXdhgexParameters;
121 kip = new PacketKexInit(nextKEXcryptoWishList, rnd); 121 kip = new PacketKexInit(nextKEXcryptoWishList, rnd);
122 kxs.localKEX = kip; 122 kxs.localKEX = kip;
123 tm.sendKexMessage(kip.getPayload()); 123 tm.sendKexMessage(kip.getPayload());
128 kxs.np = mergeKexParameters(kxs.localKEX.getKexParameters(), kxs.remoteKEX.getKexParameters()); 128 kxs.np = mergeKexParameters(kxs.localKEX.getKexParameters(), kxs.remoteKEX.getKexParameters());
129 129
130 if (kxs.np == null) 130 if (kxs.np == null)
131 throw new IOException("Cannot negotiate, proposals do not match."); 131 throw new IOException("Cannot negotiate, proposals do not match.");
132 132
133 if(kxs.remoteKEX.isFirst_kex_packet_follows() && (kxs.np.guessOK == false)) { 133 if (kxs.remoteKEX.isFirst_kex_packet_follows() && (kxs.np.guessOK == false)) {
134 // Guess was wrong, we need to ignore the next kex packet. 134 // Guess was wrong, we need to ignore the next kex packet.
135 ignore_next_kex_packet = true; 135 ignore_next_kex_packet = true;
136 } 136 }
137 137
138 if (kxs.np.kex_algo.equals("diffie-hellman-group-exchange-sha1") || 138 if (kxs.np.kex_algo.equals("diffie-hellman-group-exchange-sha1") ||
139 kxs.np.kex_algo.equals("diffie-hellman-group-exchange-sha256")) { 139 kxs.np.kex_algo.equals("diffie-hellman-group-exchange-sha256")) {
140 if(kxs.dhgexParameters.getMin_group_len() == 0) { 140 if (kxs.dhgexParameters.getMin_group_len() == 0) {
141 PacketKexDhGexRequestOld dhgexreq = new PacketKexDhGexRequestOld(kxs.dhgexParameters); 141 PacketKexDhGexRequestOld dhgexreq = new PacketKexDhGexRequestOld(kxs.dhgexParameters);
142 tm.sendKexMessage(dhgexreq.getPayload()); 142 tm.sendKexMessage(dhgexreq.getPayload());
143 } 143 }
144 else { 144 else {
145 PacketKexDhGexRequest dhgexreq = new PacketKexDhGexRequest(kxs.dhgexParameters); 145 PacketKexDhGexRequest dhgexreq = new PacketKexDhGexRequest(kxs.dhgexParameters);
146 tm.sendKexMessage(dhgexreq.getPayload()); 146 tm.sendKexMessage(dhgexreq.getPayload());
147 } 147 }
148
148 if (kxs.np.kex_algo.endsWith("sha1")) { 149 if (kxs.np.kex_algo.endsWith("sha1")) {
149 kxs.hashAlgo = "SHA1"; 150 kxs.hashAlgo = "SHA1";
150 } 151 }
151 else { 152 else {
152 kxs.hashAlgo = "SHA-256"; 153 kxs.hashAlgo = "SHA-256";
153 } 154 }
155
154 kxs.state = 1; 156 kxs.state = 1;
155 return; 157 return;
156 } 158 }
157 159
158 if (kxs.np.kex_algo.equals("diffie-hellman-group1-sha1") || 160 if (kxs.np.kex_algo.equals("diffie-hellman-group1-sha1") ||
159 kxs.np.kex_algo.equals("diffie-hellman-group14-sha1") || 161 kxs.np.kex_algo.equals("diffie-hellman-group14-sha1") ||
160 kxs.np.kex_algo.equals("ecdh-sha2-nistp256") || 162 kxs.np.kex_algo.equals("ecdh-sha2-nistp256") ||
161 kxs.np.kex_algo.equals("ecdh-sha2-nistp384") || 163 kxs.np.kex_algo.equals("ecdh-sha2-nistp384") ||
162 kxs.np.kex_algo.equals("ecdh-sha2-nistp521")) { 164 kxs.np.kex_algo.equals("ecdh-sha2-nistp521")) {
163 kxs.dhx = GenericDhExchange.getInstance(kxs.np.kex_algo); 165 kxs.dhx = GenericDhExchange.getInstance(kxs.np.kex_algo);
164 kxs.dhx.init(kxs.np.kex_algo); 166 kxs.dhx.init(kxs.np.kex_algo);
165 kxs.hashAlgo = kxs.dhx.getHashAlgo(); 167 kxs.hashAlgo = kxs.dhx.getHashAlgo();
166 PacketKexDHInit kp = new PacketKexDHInit(kxs.dhx.getE()); 168 PacketKexDHInit kp = new PacketKexDHInit(kxs.dhx.getE());
167 tm.sendKexMessage(kp.getPayload()); 169 tm.sendKexMessage(kp.getPayload());
181 MAC mac; 183 MAC mac;
182 Compressor comp; 184 Compressor comp;
183 185
184 try { 186 try {
185 cbc = BlockCipherFactory.createCipher(kxs.np.enc_algo_server_to_client, false, 187 cbc = BlockCipherFactory.createCipher(kxs.np.enc_algo_server_to_client, false,
186 km.enc_key_server_to_client, km.initial_iv_server_to_client); 188 km.enc_key_server_to_client, km.initial_iv_server_to_client);
187 189
188 try { 190 try {
189 mac = new MAC(kxs.np.mac_algo_server_to_client, km.integrity_key_server_to_client); 191 mac = new MAC(kxs.np.mac_algo_server_to_client, km.integrity_key_server_to_client);
190 } 192 }
191 catch(DigestException e) { 193 catch (DigestException e) {
192 throw new IOException(e); 194 throw new IOException(e);
193 } 195 }
194 196
195 comp = CompressionFactory.createCompressor(kxs.np.comp_algo_server_to_client); 197 comp = CompressionFactory.createCompressor(kxs.np.comp_algo_server_to_client);
196 } 198 }
197 catch(IllegalArgumentException e) { 199 catch (IllegalArgumentException e) {
198 throw new IOException(e.getMessage()); 200 throw new IOException(e.getMessage());
199 } 201 }
200 202
201 tm.changeRecvCipher(cbc, mac); 203 tm.changeRecvCipher(cbc, mac);
202 tm.changeRecvCompression(comp); 204 tm.changeRecvCompression(comp);
209 sci.clientToServerMACAlgorithm = kxs.np.mac_algo_client_to_server; 211 sci.clientToServerMACAlgorithm = kxs.np.mac_algo_client_to_server;
210 sci.serverToClientMACAlgorithm = kxs.np.mac_algo_server_to_client; 212 sci.serverToClientMACAlgorithm = kxs.np.mac_algo_server_to_client;
211 sci.serverHostKeyAlgorithm = kxs.np.server_host_key_algo; 213 sci.serverHostKeyAlgorithm = kxs.np.server_host_key_algo;
212 sci.serverHostKey = kxs.remote_hostkey; 214 sci.serverHostKey = kxs.remote_hostkey;
213 215
214 synchronized(accessLock) { 216 synchronized (accessLock) {
215 lastConnInfo = sci; 217 lastConnInfo = sci;
216 accessLock.notifyAll(); 218 accessLock.notifyAll();
217 } 219 }
218 220
219 kxs = null; 221 kxs = null;
220 return; 222 return;
221 } 223 }
222 224
223 if((kxs == null) || (kxs.state == 0)) { 225 if ((kxs == null) || (kxs.state == 0)) {
224 throw new IOException("Unexpected Kex submessage!"); 226 throw new IOException("Unexpected Kex submessage!");
225 } 227 }
226 228
227 if (kxs.np.kex_algo.equals("diffie-hellman-group-exchange-sha1") || 229 if (kxs.np.kex_algo.equals("diffie-hellman-group-exchange-sha1") ||
228 kxs.np.kex_algo.equals("diffie-hellman-group-exchange-sha256")) { 230 kxs.np.kex_algo.equals("diffie-hellman-group-exchange-sha256")) {
229 if(kxs.state == 1) { 231 if (kxs.state == 1) {
230 PacketKexDhGexGroup dhgexgrp = new PacketKexDhGexGroup(msg); 232 PacketKexDhGexGroup dhgexgrp = new PacketKexDhGexGroup(msg);
231 kxs.dhgx = new DhGroupExchange(dhgexgrp.getP(), dhgexgrp.getG()); 233 kxs.dhgx = new DhGroupExchange(dhgexgrp.getP(), dhgexgrp.getG());
232 kxs.dhgx.init(rnd); 234 kxs.dhgx.init(rnd);
233 PacketKexDhGexInit dhgexinit = new PacketKexDhGexInit(kxs.dhgx.getE()); 235 PacketKexDhGexInit dhgexinit = new PacketKexDhGexInit(kxs.dhgx.getE());
234 tm.sendKexMessage(dhgexinit.getPayload()); 236 tm.sendKexMessage(dhgexinit.getPayload());
235 kxs.state = 2; 237 kxs.state = 2;
236 return; 238 return;
237 } 239 }
238 240
239 if(kxs.state == 2) { 241 if (kxs.state == 2) {
240 PacketKexDhGexReply dhgexrpl = new PacketKexDhGexReply(msg); 242 PacketKexDhGexReply dhgexrpl = new PacketKexDhGexReply(msg);
241
242 kxs.remote_hostkey = dhgexrpl.getHostKey(); 243 kxs.remote_hostkey = dhgexrpl.getHostKey();
243 244
244 if(verifier != null) { 245 if (verifier != null) {
245 try { 246 try {
246 if(!verifier.verifyServerHostKey(hostname, port, kxs.np.server_host_key_algo, kxs.remote_hostkey)) { 247 if (!verifier.verifyServerHostKey(hostname, port, kxs.np.server_host_key_algo, kxs.remote_hostkey)) {
247 throw new IOException("The server host key was not accepted by the verifier callback"); 248 throw new IOException("The server host key was not accepted by the verifier callback");
248 } 249 }
249 } 250 }
250 catch(Exception e) { 251 catch (Exception e) {
251 throw new IOException( 252 throw new IOException(
252 "The server host key was not accepted by the verifier callback.", e); 253 "The server host key was not accepted by the verifier callback.", e);
253 } 254 }
254 } 255 }
255 256
256 kxs.dhgx.setF(dhgexrpl.getF()); 257 kxs.dhgx.setF(dhgexrpl.getF());
257 258
258 try { 259 try {
259 kxs.H = kxs.dhgx.calculateH(kxs.hashAlgo, csh.getClientString(), csh.getServerString(), 260 kxs.H = kxs.dhgx.calculateH(kxs.hashAlgo, csh.getClientString(), csh.getServerString(),
260 kxs.localKEX.getPayload(), kxs.remoteKEX.getPayload(), dhgexrpl.getHostKey(), 261 kxs.localKEX.getPayload(), kxs.remoteKEX.getPayload(), dhgexrpl.getHostKey(),
261 kxs.dhgexParameters); 262 kxs.dhgexParameters);
262 } 263 }
263 catch(IllegalArgumentException e) { 264 catch (IllegalArgumentException e) {
264 throw new IOException("KEX error.", e); 265 throw new IOException("KEX error.", e);
265 } 266 }
266 if(!verifySignature(dhgexrpl.getSignature(), kxs.remote_hostkey)) { 267
268 if (!verifySignature(dhgexrpl.getSignature(), kxs.remote_hostkey)) {
267 throw new IOException("Invalid remote host key signature"); 269 throw new IOException("Invalid remote host key signature");
268 } 270 }
271
269 kxs.K = kxs.dhgx.getK(); 272 kxs.K = kxs.dhgx.getK();
270 finishKex(true); 273 finishKex(true);
271 kxs.state = -1; 274 kxs.state = -1;
272 return; 275 return;
273 } 276 }
274 277
275 throw new IllegalStateException("Illegal State in KEX Exchange!"); 278 throw new IllegalStateException("Illegal State in KEX Exchange!");
276 } 279 }
277 280
278 if (kxs.np.kex_algo.equals("diffie-hellman-group1-sha1") || 281 if (kxs.np.kex_algo.equals("diffie-hellman-group1-sha1") ||
279 kxs.np.kex_algo.equals("diffie-hellman-group14-sha1") || 282 kxs.np.kex_algo.equals("diffie-hellman-group14-sha1") ||
280 kxs.np.kex_algo.equals("ecdh-sha2-nistp256") || 283 kxs.np.kex_algo.equals("ecdh-sha2-nistp256") ||
281 kxs.np.kex_algo.equals("ecdh-sha2-nistp384") || 284 kxs.np.kex_algo.equals("ecdh-sha2-nistp384") ||
282 kxs.np.kex_algo.equals("ecdh-sha2-nistp521")) { 285 kxs.np.kex_algo.equals("ecdh-sha2-nistp521")) {
283 if(kxs.state == 1) { 286 if (kxs.state == 1) {
284 PacketKexDHReply dhr = new PacketKexDHReply(msg); 287 PacketKexDHReply dhr = new PacketKexDHReply(msg);
285 kxs.remote_hostkey = dhr.getHostKey(); 288 kxs.remote_hostkey = dhr.getHostKey();
286 289
287 if(verifier != null) { 290 if (verifier != null) {
288 try { 291 try {
289 if(!verifier.verifyServerHostKey(hostname, port, kxs.np.server_host_key_algo, kxs.remote_hostkey)) { 292 if (!verifier.verifyServerHostKey(hostname, port, kxs.np.server_host_key_algo, kxs.remote_hostkey)) {
290 throw new IOException("The server host key was not accepted by the verifier callback"); 293 throw new IOException("The server host key was not accepted by the verifier callback");
291 } 294 }
292 } 295 }
293 catch(Exception e) { 296 catch (Exception e) {
294 throw new IOException("The server host key was not accepted by the verifier callback", e); 297 throw new IOException("The server host key was not accepted by the verifier callback", e);
295 } 298 }
296 } 299 }
300
297 kxs.dhx.setF(dhr.getF().toByteArray()); 301 kxs.dhx.setF(dhr.getF().toByteArray());
302
298 try { 303 try {
299 kxs.H = kxs.dhx.calculateH(csh.getClientString(), csh.getServerString(), kxs.localKEX.getPayload(), 304 kxs.H = kxs.dhx.calculateH(csh.getClientString(), csh.getServerString(), kxs.localKEX.getPayload(),
300 kxs.remoteKEX.getPayload(), dhr.getHostKey()); 305 kxs.remoteKEX.getPayload(), dhr.getHostKey());
301 } 306 }
302 catch(IllegalArgumentException e) { 307 catch (IllegalArgumentException e) {
303 throw new IOException("KEX error.", e); 308 throw new IOException("KEX error.", e);
304 } 309 }
305 if(!verifySignature(dhr.getSignature(), kxs.remote_hostkey)) { 310
311 if (!verifySignature(dhr.getSignature(), kxs.remote_hostkey)) {
306 throw new IOException("Invalid remote host key signature"); 312 throw new IOException("Invalid remote host key signature");
307 } 313 }
314
308 kxs.K = kxs.dhx.getK(); 315 kxs.K = kxs.dhx.getK();
309 finishKex(true); 316 finishKex(true);
310 kxs.state = -1; 317 kxs.state = -1;
311 return; 318 return;
312 } 319 }
313 } 320 }
321
314 throw new IllegalStateException(String.format("Unknown KEX method %s", kxs.np.kex_algo)); 322 throw new IllegalStateException(String.format("Unknown KEX method %s", kxs.np.kex_algo));
315 } 323 }
316 } 324 }