Tera Term

[Ttssh2-commit] [6972] EtM 絡みのコード整理。

scmno****@osdn***** scmno****@osdn*****
2017年 11月 8日 (水) 07:26:20 JST

• 前の記事 [Ttssh2-commit] [6971] hmac-{sha1, md5}-96-e****@opens***** が抜けていたので修正。
• 次の記事 [Ttssh2-commit] [6973] OpenSSL 1.0.2mにアップデート
• 記事の並び順: [ 日付 ] [ スレッド ] [ 件名 ] [ 著者 ]

Revision: 6972
          http://sourceforge.jp/projects/ttssh2/scm/svn/commits/6972
Author:   doda
Date:     2017-11-08 07:26:20 +0900 (Wed, 08 Nov 2017)
Log Message:
-----------
EtM 絡みのコード整理。

・コメント追加
・読みやすいようにコードを修正

Modified Paths:
--------------
    trunk/ttssh2/ttxssh/pkt.c
    trunk/ttssh2/ttxssh/ssh.c

-------------- next part --------------
Modified: trunk/ttssh2/ttxssh/pkt.c
===================================================================
--- trunk/ttssh2/ttxssh/pkt.c	2017-11-07 22:26:16 UTC (rev 6971)
+++ trunk/ttssh2/ttxssh/pkt.c	2017-11-07 22:26:20 UTC (rev 6972)
@@ -88,7 +88,6 @@
 	return amount_read;
 }
 
-
 // \x89\xFC\x8Ds\x83R\x81[\x83h\x82\xAA\x8Fo\x82Ă\xAD\x82\xE9\x82܂œǂ\xDE
 static int recv_line_data(PTInstVar pvar)
 {
@@ -128,7 +127,6 @@
 	return amount_read;
 }
 
-
 /* This function does two things:
    -- reads data from the sshd and feeds the SSH protocol packets to ssh.c
    -- copies any available decrypted session data into the application buffer
@@ -186,7 +184,11 @@
 
 			etm = mac && mac->enabled && mac->etm;
 
-			// \x88Í\x86\x89\xBB\x83p\x83P\x83b\x83g\x82̈ꕔ\x82𕜍\x86\x89\xBB\x82\xB7\x82\xE9\x81B
+			/*
+			 * \x92ʏ\xED\x82\xCC MAC \x95\xFB\x8E\xAE (E&M: Encrypt & MAC) \x82ł̓p\x83P\x83b\x83g\x92\xB7\x95\x94\x95\xAA\x82\xE0\x88Í\x86\x89\xBB\x82\xB3\x82\xEA\x82Ă\xA2\x82邽\x82߁A
+			 * \x90擪\x82\xCC 1 \x83u\x83\x8D\x83b\x83N\x82𕜍\x86\x82\xB7\x82\xE9\x81BMAC \x95\x{33AE0AA} EtM (Encrypt then MAC) \x82̎\x9E\x82\xCD
+			 * \x83p\x83P\x83b\x83g\x92\xB7\x95\x94\x95\xAA\x82͈Í\x86\x89\xBB\x82\xB3\x82\xEA\x82Ă\xA2\x82Ȃ\xA2\x82̂ŕ\x9C\x8D\x86\x82͕K\x97v\x96\xB3\x82\xA2\x81B
+			 */
 			if (!pvar->pkt_state.predecrypted_packet && !etm) {
 				SSH_predecrpyt_packet(pvar, data);
 				pvar->pkt_state.predecrypted_packet = TRUE;
@@ -198,36 +200,43 @@
 				padding = 8 - (realpktsize % 8);
 				pktsize = realpktsize + padding;
 			} else {
-				// SSH2\x82̃p\x83P\x83b\x83g\x82͐擪\x82\xC9 packet-size(4)+padding(1)+type(1) \x82\xAA\x91\xB1\x82\xAD\x81B
+				// SSH2 \x82ł̓p\x83P\x83b\x83g\x82̐擪\x82\xC9 uint32 (4\x83o\x83C\x83g) \x82̃p\x83P\x83b\x83g\x92\xB7\x82\xAA\x97\x88\x82\xE9
 				pktsize = get_uint32_MSBfirst(data);
+
+				// \x91\xB1\x82\xAD 1 \x83o\x83C\x83g\x82\xCD padding \x82̒\xB7\x82\xB3
 				if (etm) {
+					// EtM \x82ł\xCD padding length \x88ȍ~\x82͈Í\x86\x89\xBB\x82\xB3\x82\xEA\x82Ă\xA2\x82\xE9\x81B
+					// \x82\xB1\x82̎\x9E\x93_\x82ł͂܂\xBE\x95\x9C\x8D\x86\x82\xB5\x82Ă\xA2\x82Ȃ\xA2\x82̂\xC5 padding length \x82\xAA\x95\xAA\x82\xA9\x82\xE7\x82Ȃ\xA2\x81B
+					// \x89\xBC\x82\xC9 0 \x82\xF0\x93\xFC\x82\xEA\x82Ēu\x82\xAD\x81B
 					padding = 0;
 				}
 				else {
+					// E&M \x82ł͕\x9C\x8D\x86\x8Dς\xDD
 					padding = (unsigned char) data[4];
 				}
 			}
 
-			// \x83p\x83P\x83b\x83g(TCP\x83y\x83C\x83\x8D\x81[\x83h)\x82̑S\x91̂̃T\x83C\x83Y\x82́ASSH\x83y\x83C\x83\x8D\x81[\x83h\x81{4\x81i\x81{MAC\x81j\x82ƂȂ\xE9\x81B
+			// \x83p\x83P\x83b\x83g(TCP\x83y\x83C\x83\x8D\x81[\x83h)\x82̑S\x91̂̃T\x83C\x83Y\x82́ASSH\x83y\x83C\x83\x8D\x81[\x83h+4\x81i+MAC\x81j\x82ƂȂ\xE9\x81B
 			// +4\x82́ASSH\x83y\x83C\x83\x8D\x81[\x83h\x82̃T\x83C\x83Y\x82\xF0\x8Ai\x94[\x82\xB5\x82Ă\xA2\x82镔\x95\xAA\x81iint\x8C^\x81j\x81B
 			total_packet_size = pktsize + 4 + SSH_get_clear_MAC_size(pvar);
 
 			if (total_packet_size <= pvar->pkt_state.datalen) {
-				/* the data must be 4 byte aligned. */
+				// \x8E\xF3\x90M\x8Dς݃f\x81[\x83^\x82\xAA\x8F\\x95\xAA\x97L\x82\xE9\x8Fꍇ\x82̓p\x83P\x83b\x83g\x82̎\xC0\x8F\x88\x97\x9D\x82\xF0\x8Ds\x82\xA4
 				if (SSHv1(pvar)) {
+					// SSH1 \x82\xCD EtM \x94\xF1\x91Ή\x9E
 					SSH_handle_packet1(pvar, data, pktsize, padding);
 				}
 				else {
 					SSH_handle_packet2(pvar, data, pktsize, padding, etm);
 				}
+
 				pvar->pkt_state.predecrypted_packet = FALSE;
-
 				pvar->pkt_state.datastart += total_packet_size;
 				pvar->pkt_state.datalen -= total_packet_size;
 
 			} else if (total_packet_size > PACKET_MAX_SIZE) {
-				// 4MB\x82𒴂\xA6\x82鋐\x91\xE5\x82ȃp\x83P\x83b\x83g\x82\xAA\x93͂\xA2\x82\xBD\x82\xE7\x81A\x88ُ\xED\x8FI\x97\xB9\x82\xB7\x82\xE9\x81B
-				// \x8E\xC0\x8Dۂɂ̓f\x81[\x83^\x89\xBB\x82\xAF\x82ŕ\x9C\x8D\x86\x8E\xB8\x94s\x8E\x9E\x82ɁA\x8C\xEB\x94F\x8E\xAF\x82\xB7\x82邱\x82Ƃ\xAA\x91\xBD\x82\xA2\x81B
+				// \x83p\x83P\x83b\x83g\x92\xB7\x82\xAA\x91傫\x82\xB7\x82\xAC\x82\xE9\x8Fꍇ\x82ُ͈\xED\x8FI\x97\xB9\x82\xB7\x82\xE9\x81B
+				// \x8E\xC0\x8Dۂɂ͉\xBD\x82炩\x82̗v\x88\xF6\x82ŕ\x9C\x8D\x86\x8E\xB8\x94s\x81˃p\x83P\x83b\x83g\x92\xB7\x95\x94\x95\xAA\x82\xAA\x89\xF3\x82\xEA\x82Ă\xA2\x82鎖\x82\xAA\x91\xBD\x82\xA2\x81B
 				UTIL_get_lang_msg("MSG_PKT_OVERSIZED_ERROR", pvar,
 				                  "Oversized packet received from server; connection will close.");
 				notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);

Modified: trunk/ttssh2/ttxssh/ssh.c
===================================================================
--- trunk/ttssh2/ttxssh/ssh.c	2017-11-07 22:26:16 UTC (rev 6971)
+++ trunk/ttssh2/ttxssh/ssh.c	2017-11-07 22:26:20 UTC (rev 6972)
@@ -774,12 +774,24 @@
 	return pvar->ssh_state.payload[-1];
 }
 
+/*
+ * \x83p\x83P\x83b\x83g\x8F\x88\x97\x9D\x82ׂ̈̈ȉ\xBA\x82̏\x80\x94\xF5\x82\xF0\x8Ds\x82\xA4\x81B(SSHv2\x97p)
+ * \x81E\x83f\x81[\x83^\x95\x9C\x8D\x86
+ * \x81EMAC \x82̌\x9F\x8F\xD8
+ * \x81Epadding \x82\xF0\x8E\xE6\x82菜\x82\xAD
+ * \x81E\x83\x81\x83b\x83Z\x81[\x83W\x83^\x83C\x83v\x82𔻕ʂ\xB5\x82ĕԂ\xB7
+ *
+ * \x88\xF8\x90\x94:
+ *   data - ssh \x83p\x83P\x83b\x83g\x82̐擪\x82\xF0\x8Ew\x82\xB7\x83|\x83C\x83\x93\x83^
+ *   len - \x83p\x83P\x83b\x83g\x92\xB7 (\x90擪\x82̃p\x83P\x83b\x83g\x92\xB7\x97̈\xE6(4\x83o\x83C\x83g)\x82\xF0\x8F\x9C\x82\xA2\x82\xBD\x92l)
+ *   padding - \x83p\x83f\x83B\x83\x93\x83O\x92\xB7 (EtM\x82̏ꍇ\x82\xCD0\x82ƂȂ\xC1\x82Ă\xA2\x82\xE9\x82̂ŁA\x95\x9C\x8D\x86\x8C\xE3\x82Ɏ擾\x82\xB7\x82\xE9\x95K\x97v\x82\xA0\x82\xE8)
+ *   etm - MAC \x95\x{33AE0AA} EtM \x82\xA9\x82ǂ\xA4\x82\xA9\x82̃t\x83\x89\x83O
+ */
+
 static int prep_packet_ssh2(PTInstVar pvar, char *data, int len, int padding, int etm)
 {
-	pvar->ssh_state.payload = data + 4;
-	pvar->ssh_state.payloadlen = len;
-
 	if (etm) {
+		// EtM \x82̏ꍇ\x82͐\xE6\x82\xC9 MAC \x82̌\x9F\x8F؂\xF0\x8Ds\x82\xA4
 		if (!CRYPT_verify_receiver_MAC(pvar, pvar->ssh_state.receiver_sequence_number, data, len + 4, data + len + 4)) {
 			UTIL_get_lang_msg("MSG_SSH_CORRUPTDATA_ERROR", pvar, "Detected corrupted data; connection terminating.");
 			notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
@@ -786,14 +798,21 @@
 			return SSH_MSG_NONE;
 		}
 
+		// \x83p\x83P\x83b\x83g\x92\xB7\x95\x94\x95\xAA(\x90擪4\x83o\x83C\x83g)\x82͈Í\x86\x89\xBB\x82\xB3\x82\xEA\x82Ă\xA2\x82Ȃ\xA2\x82̂ŁA\x82\xBB\x82\xB1\x82\xF0\x83X\x83L\x83b\x83v\x82\xB5\x82ĕ\x9C\x8D\x86\x82\xB7\x82\xE9\x81B
 		CRYPT_decrypt(pvar, data + 4, len);
+
+		// EtM \x82̏ꍇ\x82\xCD \x8CĂяo\x82\xB5\x8C\xB3\x82ł\xCD padding \x95\x94\x95\xAA\x82\xAA\x93ǂ߂Ȃ\xA2\x88ׁA\x82\xB1\x82\xB1\x82Œl\x82\xF0\x8E擾\x82\xB7\x82\xE9\x81B
 		padding = (unsigned int) data[4];
 	}
 	else {
+		// E&M \x82ł͐擪\x95\x94\x95\xAA\x82\xAA\x8E\x96\x91O\x95\x9C\x8D\x86\x82\xB3\x82\xEA\x82Ă\xA2\x82\xE9\x81B
+		// \x8E\x96\x91O\x95\x9C\x8D\x86\x82\xB3\x82ꂽ\x92\xB7\x82\xB3\x82\xF0\x8E擾\x82\xB7\x82\xE9\x81B
 		int already_decrypted = get_predecryption_amount(pvar);
 
+		// \x8E\x96\x91O\x95\x9C\x8D\x86\x82\xB3\x82ꂽ\x95\x94\x95\xAA\x82\xF0\x83X\x83L\x83b\x83v\x82\xB5\x82āA\x8Ec\x82\xE8\x82̕\x94\x95\xAA\x82𕜍\x86\x82\xB7\x82\xE9\x81B
 		CRYPT_decrypt(pvar, data + already_decrypted, (4 + len) - already_decrypted);
 
+		// E&M \x82ł͕\x9C\x8D\x86\x8C\xE3\x82\xC9 MAC \x82̌\x9F\x8F؂\xF0\x8Ds\x82\xA4\x81B
 		if (!CRYPT_verify_receiver_MAC(pvar, pvar->ssh_state.receiver_sequence_number, data, len + 4, data + len + 4)) {
 			UTIL_get_lang_msg("MSG_SSH_CORRUPTDATA_ERROR", pvar, "Detected corrupted data; connection terminating.");
 			notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
@@ -801,9 +820,12 @@
 		}
 	}
 
-	pvar->ssh_state.payload++;
-	pvar->ssh_state.payloadlen -= padding + 1;
+	// \x83p\x83P\x83b\x83g\x92\xB7(4\x83o\x83C\x83g) \x95\x94\x95\xAA\x82ƃp\x83f\x83B\x83\x93\x83O\x92\xB7(1\x83o\x83C\x83g)\x95\x94\x95\xAA\x82\xF0\x83X\x83L\x83b\x83v\x82\xB5\x82\xBD SSH \x83y\x83C\x83\x8D\x81[\x83h\x82̐擪
+	pvar->ssh_state.payload = data + 4 + 1;
 
+	// \x83p\x83f\x83B\x83\x93\x83O\x92\xB7\x95\x94\x95\xAA(1\x83o\x83C\x83g)\x82ƃp\x83f\x83B\x83\x93\x83O\x82\xF0\x8F\x9C\x82\xA2\x82\xBD\x8E\xC0\x8Dۂ̃y\x83C\x83\x8D\x81[\x83h\x92\xB7
+	pvar->ssh_state.payloadlen = len - 1 - padding;
+
 	pvar->ssh_state.payload_grabbed = 0;
 
 	// data compression
@@ -1002,7 +1024,7 @@
 		unsigned int padding;
 		BOOL ret;
 		struct Mac *mac = &pvar->ssh2_keys[MODE_OUT].mac;
-		int aadlen = 0;
+		int aadlen = 0, maclen = 0;
 
 		/*
 		 \x83f\x81[\x83^\x8D\\x91\xA2
@@ -1056,6 +1078,7 @@
 		}
 
 		if (mac && mac->etm) {
+			// \x88Í\x86\x89\xBB\x91Ώۂł͖\xB3\x82\xA2\x82\xAA\x81AMAC \x82̑ΏۂƂȂ镔\x95\xAA\x82̒\xB7\x82\xB3
 			aadlen = 4;
 		}
 
@@ -1066,7 +1089,6 @@
 		encryption_size += padding;
 		set_uint32(data, encryption_size - 4 + aadlen);
 		data[4] = (unsigned char) padding;
-		data_length = encryption_size;
 		if (msg) {
 			// \x83p\x83P\x83b\x83g\x88\xB3\x8Fk\x82̏ꍇ\x81A\x83o\x83b\x83t\x83@\x82\xF0\x8Ag\x92\xA3\x82\xB7\x82\xE9\x81B(2011.6.10 yutaka)
 			buffer_append_space(msg, padding + EVP_MAX_MD_SIZE);
@@ -1074,15 +1096,14 @@
 			data = buffer_ptr(msg);
 		}
 
-		//if (pvar->ssh_state.outbuflen <= 7 + data_length) *(int *)0 = 0;
 		CRYPT_set_random_data(pvar, data + 5 + len, padding);
 
 		if (aadlen == 0) {
+			// E&M \x82ł͐\xE6\x82\xC9 MAC \x82\xF0\x8Cv\x8EZ\x82\xB7\x82\xE9
 			ret = CRYPT_build_sender_MAC(pvar, pvar->ssh_state.sender_sequence_number,
 			                             data, encryption_size, data + encryption_size);
 			if (ret) {
-				data_length += CRYPT_get_sender_MAC_size(pvar);
-//				data[encryption_size + 5] = 0;
+				maclen = CRYPT_get_sender_MAC_size(pvar);
 			}
 		}
 
@@ -1090,19 +1111,19 @@
 		CRYPT_encrypt(pvar, data + aadlen, encryption_size);
 
 		if (aadlen) {
-			int maclen;
-			encryption_size += aadlen;
+			// EtM \x82ł͈Í\x86\x89\xBB\x8C\xE3\x82\xC9 MAC \x82\xF0\x8Cv\x8EZ\x82\xB7\x82\xE9
 			ret = CRYPT_build_sender_MAC(pvar, pvar->ssh_state.sender_sequence_number,
-			                             data, encryption_size, data + encryption_size);
+			                             data, aadlen + encryption_size, data + aadlen + encryption_size);
 			if (ret) {
 				maclen = CRYPT_get_sender_MAC_size(pvar);
-				data_length = encryption_size + maclen;
 			}
-			logprintf(LOG_LEVEL_ERROR, __FUNCTION__
-				": EtM test. aadlen:%d, enclen:%d, pad:%d, datalen:%d, maclen:%d",
-				aadlen, encryption_size, padding, data_length, maclen);
 		}
 
+		data_length = encryption_size + aadlen + maclen;
+
+		logprintf(150, __FUNCTION__
+			": built packet info: aadlen:%d, enclen:%d, padlen:%d, datalen:%d, maclen:%d, mode:%s",
+			aadlen, encryption_size, padding, data_length, maclen, aadlen ? "EtM" : "E&M");
 	}
 
 	send_packet_blocking(pvar, data, data_length);

• 前の記事 [Ttssh2-commit] [6971] hmac-{sha1, md5}-96-e****@opens***** が抜けていたので修正。
• 次の記事 [Ttssh2-commit] [6973] OpenSSL 1.0.2mにアップデート
• 記事の並び順: [ 日付 ] [ スレッド ] [ 件名 ] [ 著者 ]