1 /*
2 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24 /*
25 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
26 * Use is subject to license terms.
27 */
28
29 #include "includes.h"
30 RCSID("$OpenBSD: compat.c,v 1.65 2002/09/27 10:42:09 mickey Exp $");
31
32 #include "buffer.h"
33 #include "packet.h"
34 #include "xmalloc.h"
35 #include "compat.h"
36 #include "log.h"
37 #include "match.h"
38
39 int compat13 = 0;
40 int compat20 = 0;
41 uint32_t datafellows = 0;
42
43 void
enable_compat20(void)44 enable_compat20(void)
45 {
46 debug("Enabling compatibility mode for protocol 2.0");
47 compat20 = 1;
48 }
49 void
enable_compat13(void)50 enable_compat13(void)
51 {
52 debug("Enabling compatibility mode for protocol 1.3");
53 compat13 = 1;
54 }
55 /* datafellows bug compatibility */
56 void
compat_datafellows(const char * version)57 compat_datafellows(const char *version)
58 {
59 int i;
60 static struct {
61 char *pat;
62 uint32_t bugs;
63 } check[] = {
64 { "OpenSSH-2.0*,"
65 "OpenSSH-2.1*,"
66 "OpenSSH_2.1*,"
67 "OpenSSH_2.2*", SSH_OLD_SESSIONID|SSH_BUG_BANNER|
68 SSH_OLD_DHGEX|SSH_BUG_NOREKEY|
69 SSH_BUG_EXTEOF|SSH_OLD_FORWARD_ADDR},
70 { "OpenSSH_2.3.0*", SSH_BUG_BANNER|SSH_BUG_BIGENDIANAES|
71 SSH_OLD_DHGEX|SSH_BUG_NOREKEY|
72 SSH_BUG_EXTEOF|SSH_OLD_FORWARD_ADDR},
73 { "OpenSSH_2.3.*", SSH_BUG_BIGENDIANAES|SSH_OLD_DHGEX|
74 SSH_BUG_NOREKEY|SSH_BUG_EXTEOF|
75 SSH_OLD_FORWARD_ADDR},
76 { "OpenSSH_2.5.0p1*,"
77 "OpenSSH_2.5.1p1*",
78 SSH_BUG_BIGENDIANAES|SSH_OLD_DHGEX|
79 SSH_BUG_NOREKEY|SSH_BUG_EXTEOF|
80 SSH_OLD_GSSAPI|SSH_OLD_FORWARD_ADDR},
81 { "OpenSSH_2.5.0*,"
82 "OpenSSH_2.5.1*,"
83 "OpenSSH_2.5.2*", SSH_OLD_DHGEX|SSH_BUG_NOREKEY|
84 SSH_BUG_EXTEOF|SSH_OLD_FORWARD_ADDR},
85 { "OpenSSH_2.5.3*", SSH_BUG_NOREKEY|SSH_BUG_EXTEOF|
86 SSH_OLD_FORWARD_ADDR},
87 { "OpenSSH_2.9p*", SSH_BUG_EXTEOF|SSH_OLD_GSSAPI|
88 SSH_BUG_GSSKEX_HOSTKEY|SSH_OLD_FORWARD_ADDR},
89 { "OpenSSH_2.*,"
90 "OpenSSH_3.0*,"
91 "OpenSSH_3.1*", SSH_BUG_EXTEOF|SSH_OLD_FORWARD_ADDR|
92 SSH_OLD_GSSAPI|SSH_BUG_GSSAPI_BER|
93 SSH_BUG_GSSKEX_HOSTKEY},
94 { "OpenSSH_3.2*,"
95 "OpenSSH_3.3*,"
96 "OpenSSH_3.4*,"
97 "OpenSSH_3.5*", SSH_BUG_GSSAPI_BER|SSH_OLD_GSSAPI|
98 SSH_BUG_GSSKEX_HOSTKEY|SSH_OLD_FORWARD_ADDR},
99 { "OpenSSH_3.6*,"
100 "OpenSSH_3.7*,"
101 "OpenSSH_3.8*", SSH_BUG_GSSKEX_HOSTKEY|SSH_OLD_FORWARD_ADDR},
102 { "OpenSSH_3.*", SSH_OLD_FORWARD_ADDR},
103 { "OpenSSH*", 0 },
104 { "Sun_SSH_1.0.*", SSH_BUG_NOREKEY|
105 SSH_BUG_LOCALES_NOT_LANGTAGS|SSH_OLD_FORWARD_ADDR},
106 { "Sun_SSH_1.0*", SSH_BUG_NOREKEY|SSH_BUG_EXTEOF|
107 SSH_BUG_LOCALES_NOT_LANGTAGS|SSH_OLD_FORWARD_ADDR},
108 { "Sun_SSH_1.1.1*", SSH_OLD_FORWARD_ADDR|SSH_BUG_STRING_ENCODING},
109 { "Sun_SSH_1.1.2*", SSH_OLD_FORWARD_ADDR},
110 { "Sun_SSH_1.1*", SSH_OLD_FORWARD_ADDR|SSH_BUG_STRING_ENCODING},
111 { "Sun_SSH_1.2*", SSH_BUG_STRING_ENCODING},
112 { "Sun_SSH_1.3*", SSH_BUG_STRING_ENCODING},
113 { "Sun_SSH_1.4*", 0 },
114 { "Sun_SSH_1.5*", 0 },
115 { "Sun_SSH_*", 0 },
116 { "*MindTerm*", 0 },
117 { "2.1.0*", SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
118 SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
119 SSH_BUG_RSASIGMD5|SSH_BUG_HBSERVICE|
120 SSH_BUG_FIRSTKEX },
121 { "2.1 *", SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
122 SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
123 SSH_BUG_RSASIGMD5|SSH_BUG_HBSERVICE|
124 SSH_BUG_FIRSTKEX },
125 { "2.0.13*,"
126 "2.0.14*,"
127 "2.0.15*,"
128 "2.0.16*,"
129 "2.0.17*,"
130 "2.0.18*,"
131 "2.0.19*", SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
132 SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
133 SSH_BUG_PKSERVICE|SSH_BUG_X11FWD|
134 SSH_BUG_PKOK|SSH_BUG_RSASIGMD5|
135 SSH_BUG_HBSERVICE|SSH_BUG_OPENFAILURE|
136 SSH_BUG_DUMMYCHAN|SSH_BUG_FIRSTKEX },
137 { "2.0.11*,"
138 "2.0.12*", SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
139 SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
140 SSH_BUG_PKSERVICE|SSH_BUG_X11FWD|
141 SSH_BUG_PKAUTH|SSH_BUG_PKOK|
142 SSH_BUG_RSASIGMD5|SSH_BUG_OPENFAILURE|
143 SSH_BUG_DUMMYCHAN|SSH_BUG_FIRSTKEX },
144 { "2.0.*", SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
145 SSH_OLD_SESSIONID|SSH_BUG_DEBUG|
146 SSH_BUG_PKSERVICE|SSH_BUG_X11FWD|
147 SSH_BUG_PKAUTH|SSH_BUG_PKOK|
148 SSH_BUG_RSASIGMD5|SSH_BUG_OPENFAILURE|
149 SSH_BUG_DERIVEKEY|SSH_BUG_DUMMYCHAN|
150 SSH_BUG_FIRSTKEX },
151 { "2.2.0*,"
152 "2.3.0*", SSH_BUG_HMAC|SSH_BUG_DEBUG|
153 SSH_BUG_RSASIGMD5|SSH_BUG_FIRSTKEX },
154 { "2.3.*", SSH_BUG_DEBUG|SSH_BUG_RSASIGMD5|
155 SSH_BUG_FIRSTKEX },
156 { "2.4", SSH_OLD_SESSIONID }, /* Van Dyke */
157 { "2.*", SSH_BUG_DEBUG|SSH_BUG_FIRSTKEX|
158 SSH_BUG_RFWD_ADDR},
159 { "3.0.*", SSH_BUG_DEBUG },
160 { "3.0 SecureCRT*", SSH_OLD_SESSIONID },
161 { "1.7 SecureFX*", SSH_OLD_SESSIONID },
162 { "1.2.18*,"
163 "1.2.19*,"
164 "1.2.20*,"
165 "1.2.21*,"
166 "1.2.22*", SSH_BUG_IGNOREMSG|SSH_BUG_K5USER },
167 { "1.3.2*", /* F-Secure */
168 SSH_BUG_IGNOREMSG|SSH_BUG_K5USER },
169 { "1.2.1*,"
170 "1.2.2*,"
171 "1.2.3*", SSH_BUG_K5USER },
172 { "*SSH Compatible Server*", /* Netscreen */
173 SSH_BUG_PASSWORDPAD },
174 { "*OSU_0*,"
175 "OSU_1.0*,"
176 "OSU_1.1*,"
177 "OSU_1.2*,"
178 "OSU_1.3*,"
179 "OSU_1.4*,"
180 "OSU_1.5alpha1*,"
181 "OSU_1.5alpha2*,"
182 "OSU_1.5alpha3*", SSH_BUG_PASSWORDPAD },
183 { "*SSH_Version_Mapper*",
184 SSH_BUG_SCANNER },
185 { "Probe-*",
186 SSH_BUG_PROBE },
187 { NULL, 0 }
188 };
189
190 /* process table, return first match */
191 for (i = 0; check[i].pat; i++) {
192 if (match_pattern_list(version, check[i].pat,
193 strlen(check[i].pat), 0) == 1) {
194 debug("match: %s pat %s", version, check[i].pat);
195 datafellows = check[i].bugs;
196 return;
197 }
198 }
199 debug("no match: %s", version);
200 }
201
202 #define SEP ","
203 int
proto_spec(const char * spec)204 proto_spec(const char *spec)
205 {
206 char *s, *p, *q;
207 int ret = SSH_PROTO_UNKNOWN;
208
209 if (spec == NULL)
210 return ret;
211 q = s = xstrdup(spec);
212 for ((p = strsep(&q, SEP)); p && *p != '\0'; (p = strsep(&q, SEP))) {
213 switch (atoi(p)) {
214 case 1:
215 if (ret == SSH_PROTO_UNKNOWN)
216 ret |= SSH_PROTO_1_PREFERRED;
217 ret |= SSH_PROTO_1;
218 break;
219 case 2:
220 ret |= SSH_PROTO_2;
221 break;
222 default:
223 log("ignoring bad proto spec: '%s'.", p);
224 break;
225 }
226 }
227 xfree(s);
228 return ret;
229 }
230
231 char *
compat_cipher_proposal(char * cipher_prop)232 compat_cipher_proposal(char *cipher_prop)
233 {
234 Buffer b;
235 char *orig_prop, *fix_ciphers;
236 char *cp, *tmp;
237
238 if (!(datafellows & SSH_BUG_BIGENDIANAES))
239 return(cipher_prop);
240
241 buffer_init(&b);
242 tmp = orig_prop = xstrdup(cipher_prop);
243 while ((cp = strsep(&tmp, ",")) != NULL) {
244 if (strncmp(cp, "aes", 3) != 0) {
245 if (buffer_len(&b) > 0)
246 buffer_append(&b, ",", 1);
247 buffer_append(&b, cp, strlen(cp));
248 }
249 }
250 buffer_append(&b, "\0", 1);
251 fix_ciphers = xstrdup(buffer_ptr(&b));
252 buffer_free(&b);
253 xfree(orig_prop);
254 debug2("Original cipher proposal: %s", cipher_prop);
255 debug2("Compat cipher proposal: %s", fix_ciphers);
256 if (!*fix_ciphers)
257 fatal("No available ciphers found.");
258
259 return(fix_ciphers);
260 }
261