text: // Copyright 2013 The Go Authors. All rights reserved.
  // Use of this source code is governed by a BSD-style
  // license that can be found in the LICENSE file.
  
  package ssh
  
  import (
  	"crypto/rand"
  	"errors"
  	"fmt"
  	"io"
  	"log"
  	"net"
  	"sync"
  )
  
  // debugHandshake, if set, prints messages sent and received.  Key
  // exchange messages are printed as if DH were used, so the debug
  // messages are wrong when using ECDH.
  const debugHandshake = false
  
  // chanSize sets the amount of buffering SSH connections. This is
  // primarily for testing: setting chanSize=0 uncovers deadlocks more
  // quickly.
  const chanSize = 16
  
  // keyingTransport is a packet based transport that supports key
  // changes. It need not be thread-safe. It should pass through
  // msgNewKeys in both directions.
  type keyingTransport interface {
  	packetConn
  
  	// prepareKeyChange sets up a key change. The key change for a
  	// direction will be effected if a msgNewKeys message is sent
  	// or received.
  	prepareKeyChange(*algorithms, *kexResult) error
  }
  
  // handshakeTransport implements rekeying on top of a keyingTransport
  // and offers a thread-safe writePacket() interface.
  type handshakeTransport struct {
  	conn   keyingTransport
  	config *Config
  
  	serverVersion []byte
  	clientVersion []byte
  
  	// hostKeys is non-empty if we are the server. In that case,
  	// it contains all host keys that can be used to sign the
  	// connection.
  	hostKeys []Signer
  
  	// hostKeyAlgorithms is non-empty if we are the client. In that case,
  	// we accept these key types from the server as host key.
  	hostKeyAlgorithms []string
  
  	// On read error, incoming is closed, and readError is set.
  	incoming  chan []byte
  	readError error
  
  	mu             sync.Mutex
  	writeError     error
  	sentInitPacket []byte
  	sentInitMsg    *kexInitMsg
  	pendingPackets [][]byte // Used when a key exchange is in progress.
  
  	// If the read loop wants to schedule a kex, it pings this
  	// channel, and the write loop will send out a kex
  	// message.
  	requestKex chan struct{}
  
  	// If the other side requests or confirms a kex, its kexInit
  	// packet is sent here for the write loop to find it.
  	startKex chan *pendingKex
  
  	// data for host key checking
  	hostKeyCallback HostKeyCallback
  	dialAddress     string
  	remoteAddr      net.Addr
  
  	// bannerCallback is non-empty if we are the client and it has been set in
  	// ClientConfig. In that case it is called during the user authentication
  	// dance to handle a custom server's message.
  	bannerCallback BannerCallback
  
  	// Algorithms agreed in the last key exchange.
  	algorithms *algorithms
  
  	readPacketsLeft uint32
  	readBytesLeft   int64
  
  	writePacketsLeft uint32
  	writeBytesLeft   int64
  
  	// The session ID or nil if first kex did not complete yet.
  	sessionID []byte
  }
  
  type pendingKex struct {
  	otherInit []byte
  	done      chan error
  }
  
  func newHandshakeTransport(conn keyingTransport, config *Config, clientVersion, serverVersion []byte) *handshakeTransport {
  	t := &handshakeTransport{
  		conn:          conn,
  		serverVersion: serverVersion,
  		clientVersion: clientVersion,
  		incoming:      make(chan []byte, chanSize),
  		requestKex:    make(chan struct{}, 1),
  		startKex:      make(chan *pendingKex, 1),
  
  		config: config,
  	}
  	t.resetReadThresholds()
  	t.resetWriteThresholds()
  
  	// We always start with a mandatory key exchange.
  	t.requestKex <- struct{}{}
  	return t
  }
  
  func newClientTransport(conn keyingTransport, clientVersion, serverVersion []byte, config *ClientConfig, dialAddr string, addr net.Addr) *handshakeTransport {
  	t := newHandshakeTransport(conn, &config.Config, clientVersion, serverVersion)
  	t.dialAddress = dialAddr
  	t.remoteAddr = addr
  	t.hostKeyCallback = config.HostKeyCallback
  	t.bannerCallback = config.BannerCallback
  	if config.HostKeyAlgorithms != nil {
  		t.hostKeyAlgorithms = config.HostKeyAlgorithms
  	} else {
  		t.hostKeyAlgorithms = supportedHostKeyAlgos
  	}
  	go t.readLoop()
  	go t.kexLoop()
  	return t
  }
  
  func newServerTransport(conn keyingTransport, clientVersion, serverVersion []byte, config *ServerConfig) *handshakeTransport {
  	t := newHandshakeTransport(conn, &config.Config, clientVersion, serverVersion)
  	t.hostKeys = config.hostKeys
  	go t.readLoop()
  	go t.kexLoop()
  	return t
  }
  
  func (t *handshakeTransport) getSessionID() []byte {
  	return t.sessionID
  }
  
  // waitSession waits for the session to be established. This should be
  // the first thing to call after instantiating handshakeTransport.
  func (t *handshakeTransport) waitSession() error {
  	p, err := t.readPacket()
  	if err != nil {
  		return err
  	}
  	if p[0] != msgNewKeys {
  		return fmt.Errorf("ssh: first packet should be msgNewKeys")
  	}
  
  	return nil
  }
  
  func (t *handshakeTransport) id() string {
  	if len(t.hostKeys) > 0 {
  		return "server"
  	}
  	return "client"
  }
  
  func (t *handshakeTransport) printPacket(p []byte, write bool) {
  	action := "got"
  	if write {
  		action = "sent"
  	}
  
  	if p[0] == msgChannelData || p[0] == msgChannelExtendedData {
  		log.Printf("%s %s data (packet %d bytes)", t.id(), action, len(p))
  	} else {
  		msg, err := decode(p)
  		log.Printf("%s %s %T %v (%v)", t.id(), action, msg, msg, err)
  	}
  }
  
  func (t *handshakeTransport) readPacket() ([]byte, error) {
  	p, ok := <-t.incoming
  	if !ok {
  		return nil, t.readError
  	}
  	return p, nil
  }
  
  func (t *handshakeTransport) readLoop() {
  	first := true
  	for {
  		p, err := t.readOnePacket(first)
  		first = false
  		if err != nil {
  			t.readError = err
  			close(t.incoming)
  			break
  		}
  		if p[0] == msgIgnore || p[0] == msgDebug {
  			continue
  		}
  		t.incoming <- p
  	}
  
  	// Stop writers too.
  	t.recordWriteError(t.readError)
  
  	// Unblock the writer should it wait for this.
  	close(t.startKex)
  
  	// Don't close t.requestKex; it's also written to from writePacket.
  }
  
  func (t *handshakeTransport) pushPacket(p []byte) error {
  	if debugHandshake {
  		t.printPacket(p, true)
  	}
  	return t.conn.writePacket(p)
  }
  
  func (t *handshakeTransport) getWriteError() error {
  	t.mu.Lock()
  	defer t.mu.Unlock()
  	return t.writeError
  }
  
  func (t *handshakeTransport) recordWriteError(err error) {
  	t.mu.Lock()
  	defer t.mu.Unlock()
  	if t.writeError == nil && err != nil {
  		t.writeError = err
  	}
  }
  
  func (t *handshakeTransport) requestKeyExchange() {
  	select {
  	case t.requestKex <- struct{}{}:
  	default:
  		// something already requested a kex, so do nothing.
  	}
  }
  
  func (t *handshakeTransport) resetWriteThresholds() {
  	t.writePacketsLeft = packetRekeyThreshold
  	if t.config.RekeyThreshold > 0 {
  		t.writeBytesLeft = int64(t.config.RekeyThreshold)
  	} else if t.algorithms != nil {
  		t.writeBytesLeft = t.algorithms.w.rekeyBytes()
  	} else {
  		t.writeBytesLeft = 1 << 30
  	}
  }
  
  func (t *handshakeTransport) kexLoop() {
  
  write:
  	for t.getWriteError() == nil {
  		var request *pendingKex
  		var sent bool
  
  		for request == nil || !sent {
  			var ok bool
  			select {
  			case request, ok = <-t.startKex:
  				if !ok {
  					break write
  				}
  			case <-t.requestKex:
  				break
  			}
  
  			if !sent {
  				if err := t.sendKexInit(); err != nil {
  					t.recordWriteError(err)
  					break
  				}
  				sent = true
  			}
  		}
  
  		if err := t.getWriteError(); err != nil {
  			if request != nil {
  				request.done <- err
  			}
  			break
  		}
  
  		// We're not servicing t.requestKex, but that is OK:
  		// we never block on sending to t.requestKex.
  
  		// We're not servicing t.startKex, but the remote end
  		// has just sent us a kexInitMsg, so it can't send
  		// another key change request, until we close the done
  		// channel on the pendingKex request.
  
  		err := t.enterKeyExchange(request.otherInit)
  
  		t.mu.Lock()
  		t.writeError = err
  		t.sentInitPacket = nil
  		t.sentInitMsg = nil
  
  		t.resetWriteThresholds()
  
  		// we have completed the key exchange. Since the
  		// reader is still blocked, it is safe to clear out
  		// the requestKex channel. This avoids the situation
  		// where: 1) we consumed our own request for the
  		// initial kex, and 2) the kex from the remote side
  		// caused another send on the requestKex channel,
  	clear:
  		for {
  			select {
  			case <-t.requestKex:
  				//
  			default:
  				break clear
  			}
  		}
  
  		request.done <- t.writeError
  
  		// kex finished. Push packets that we received while
  		// the kex was in progress. Don't look at t.startKex
  		// and don't increment writtenSinceKex: if we trigger
  		// another kex while we are still busy with the last
  		// one, things will become very confusing.
  		for _, p := range t.pendingPackets {
  			t.writeError = t.pushPacket(p)
  			if t.writeError != nil {
  				break
  			}
  		}
  		t.pendingPackets = t.pendingPackets[:0]
  		t.mu.Unlock()
  	}
  
  	// drain startKex channel. We don't service t.requestKex
  	// because nobody does blocking sends there.
  	go func() {
  		for init := range t.startKex {
  			init.done <- t.writeError
  		}
  	}()
  
  	// Unblock reader.
  	t.conn.Close()
  }
  
  // The protocol uses uint32 for packet counters, so we can't let them
  // reach 1<<32.  We will actually read and write more packets than
  // this, though: the other side may send more packets, and after we
  // hit this limit on writing we will send a few more packets for the
  // key exchange itself.
  const packetRekeyThreshold = (1 << 31)
  
  func (t *handshakeTransport) resetReadThresholds() {
  	t.readPacketsLeft = packetRekeyThreshold
  	if t.config.RekeyThreshold > 0 {
  		t.readBytesLeft = int64(t.config.RekeyThreshold)
  	} else if t.algorithms != nil {
  		t.readBytesLeft = t.algorithms.r.rekeyBytes()
  	} else {
  		t.readBytesLeft = 1 << 30
  	}
  }
  
  func (t *handshakeTransport) readOnePacket(first bool) ([]byte, error) {
  	p, err := t.conn.readPacket()
  	if err != nil {
  		return nil, err
  	}
  
  	if t.readPacketsLeft > 0 {
  		t.readPacketsLeft--
  	} else {
  		t.requestKeyExchange()
  	}
  
  	if t.readBytesLeft > 0 {
  		t.readBytesLeft -= int64(len(p))
  	} else {
  		t.requestKeyExchange()
  	}
  
  	if debugHandshake {
  		t.printPacket(p, false)
  	}
  
  	if first && p[0] != msgKexInit {
  		return nil, fmt.Errorf("ssh: first packet should be msgKexInit")
  	}
  
  	if p[0] != msgKexInit {
  		return p, nil
  	}
  
  	firstKex := t.sessionID == nil
  
  	kex := pendingKex{
  		done:      make(chan error, 1),
  		otherInit: p,
  	}
  	t.startKex <- &kex
  	err = <-kex.done
  
  	if debugHandshake {
  		log.Printf("%s exited key exchange (first %v), err %v", t.id(), firstKex, err)
  	}
  
  	if err != nil {
  		return nil, err
  	}
  
  	t.resetReadThresholds()
  
  	// By default, a key exchange is hidden from higher layers by
  	// translating it into msgIgnore.
  	successPacket := []byte{msgIgnore}
  	if firstKex {
  		// sendKexInit() for the first kex waits for
  		// msgNewKeys so the authentication process is
  		// guaranteed to happen over an encrypted transport.
  		successPacket = []byte{msgNewKeys}
  	}
  
  	return successPacket, nil
  }
  
  // sendKexInit sends a key change message.
  func (t *handshakeTransport) sendKexInit() error {
  	t.mu.Lock()
  	defer t.mu.Unlock()
  	if t.sentInitMsg != nil {
  		// kexInits may be sent either in response to the other side,
  		// or because our side wants to initiate a key change, so we
  		// may have already sent a kexInit. In that case, don't send a
  		// second kexInit.
  		return nil
  	}
  
  	msg := &kexInitMsg{
  		KexAlgos:                t.config.KeyExchanges,
  		CiphersClientServer:     t.config.Ciphers,
  		CiphersServerClient:     t.config.Ciphers,
  		MACsClientServer:        t.config.MACs,
  		MACsServerClient:        t.config.MACs,
  		CompressionClientServer: supportedCompressions,
  		CompressionServerClient: supportedCompressions,
  	}
  	io.ReadFull(rand.Reader, msg.Cookie[:])
  
  	if len(t.hostKeys) > 0 {
  		for _, k := range t.hostKeys {
  			msg.ServerHostKeyAlgos = append(
  				msg.ServerHostKeyAlgos, k.PublicKey().Type())
  		}
  	} else {
  		msg.ServerHostKeyAlgos = t.hostKeyAlgorithms
  	}
  	packet := Marshal(msg)
  
  	// writePacket destroys the contents, so save a copy.
  	packetCopy := make([]byte, len(packet))
  	copy(packetCopy, packet)
  
  	if err := t.pushPacket(packetCopy); err != nil {
  		return err
  	}
  
  	t.sentInitMsg = msg
  	t.sentInitPacket = packet
  
  	return nil
  }
  
  func (t *handshakeTransport) writePacket(p []byte) error {
  	switch p[0] {
  	case msgKexInit:
  		return errors.New("ssh: only handshakeTransport can send kexInit")
  	case msgNewKeys:
  		return errors.New("ssh: only handshakeTransport can send newKeys")
  	}
  
  	t.mu.Lock()
  	defer t.mu.Unlock()
  	if t.writeError != nil {
  		return t.writeError
  	}
  
  	if t.sentInitMsg != nil {
  		// Copy the packet so the writer can reuse the buffer.
  		cp := make([]byte, len(p))
  		copy(cp, p)
  		t.pendingPackets = append(t.pendingPackets, cp)
  		return nil
  	}
  
  	if t.writeBytesLeft > 0 {
  		t.writeBytesLeft -= int64(len(p))
  	} else {
  		t.requestKeyExchange()
  	}
  
  	if t.writePacketsLeft > 0 {
  		t.writePacketsLeft--
  	} else {
  		t.requestKeyExchange()
  	}
  
  	if err := t.pushPacket(p); err != nil {
  		t.writeError = err
  	}
  
  	return nil
  }
  
  func (t *handshakeTransport) Close() error {
  	return t.conn.Close()
  }
  
  func (t *handshakeTransport) enterKeyExchange(otherInitPacket []byte) error {
  	if debugHandshake {
  		log.Printf("%s entered key exchange", t.id())
  	}
  
  	otherInit := &kexInitMsg{}
  	if err := Unmarshal(otherInitPacket, otherInit); err != nil {
  		return err
  	}
  
  	magics := handshakeMagics{
  		clientVersion: t.clientVersion,
  		serverVersion: t.serverVersion,
  		clientKexInit: otherInitPacket,
  		serverKexInit: t.sentInitPacket,
  	}
  
  	clientInit := otherInit
  	serverInit := t.sentInitMsg
  	isClient := len(t.hostKeys) == 0
  	if isClient {
  		clientInit, serverInit = serverInit, clientInit
  
  		magics.clientKexInit = t.sentInitPacket
  		magics.serverKexInit = otherInitPacket
  	}
  
  	var err error
  	t.algorithms, err = findAgreedAlgorithms(isClient, clientInit, serverInit)
  	if err != nil {
  		return err
  	}
  
  	// We don't send FirstKexFollows, but we handle receiving it.
  	//
  	// RFC 4253 section 7 defines the kex and the agreement method for
  	// first_kex_packet_follows. It states that the guessed packet
  	// should be ignored if the "kex algorithm and/or the host
  	// key algorithm is guessed wrong (server and client have
  	// different preferred algorithm), or if any of the other
  	// algorithms cannot be agreed upon". The other algorithms have
  	// already been checked above so the kex algorithm and host key
  	// algorithm are checked here.
  	if otherInit.FirstKexFollows && (clientInit.KexAlgos[0] != serverInit.KexAlgos[0] || clientInit.ServerHostKeyAlgos[0] != serverInit.ServerHostKeyAlgos[0]) {
  		// other side sent a kex message for the wrong algorithm,
  		// which we have to ignore.
  		if _, err := t.conn.readPacket(); err != nil {
  			return err
  		}
  	}
  
  	kex, ok := kexAlgoMap[t.algorithms.kex]
  	if !ok {
  		return fmt.Errorf("ssh: unexpected key exchange algorithm %v", t.algorithms.kex)
  	}
  
  	var result *kexResult
  	if len(t.hostKeys) > 0 {
  		result, err = t.server(kex, t.algorithms, &magics)
  	} else {
  		result, err = t.client(kex, t.algorithms, &magics)
  	}
  
  	if err != nil {
  		return err
  	}
  
  	if t.sessionID == nil {
  		t.sessionID = result.H
  	}
  	result.SessionID = t.sessionID
  
  	if err := t.conn.prepareKeyChange(t.algorithms, result); err != nil {
  		return err
  	}
  	if err = t.conn.writePacket([]byte{msgNewKeys}); err != nil {
  		return err
  	}
  	if packet, err := t.conn.readPacket(); err != nil {
  		return err
  	} else if packet[0] != msgNewKeys {
  		return unexpectedMessageError(msgNewKeys, packet[0])
  	}
  
  	return nil
  }
  
  func (t *handshakeTransport) server(kex kexAlgorithm, algs *algorithms, magics *handshakeMagics) (*kexResult, error) {
  	var hostKey Signer
  	for _, k := range t.hostKeys {
  		if algs.hostKey == k.PublicKey().Type() {
  			hostKey = k
  		}
  	}
  
  	r, err := kex.Server(t.conn, t.config.Rand, magics, hostKey)
  	return r, err
  }
  
  func (t *handshakeTransport) client(kex kexAlgorithm, algs *algorithms, magics *handshakeMagics) (*kexResult, error) {
  	result, err := kex.Client(t.conn, t.config.Rand, magics)
  	if err != nil {
  		return nil, err
  	}
  
  	hostKey, err := ParsePublicKey(result.HostKey)
  	if err != nil {
  		return nil, err
  	}
  
  	if err := verifyHostKeySignature(hostKey, result); err != nil {
  		return nil, err
  	}
  
  	err = t.hostKeyCallback(t.dialAddress, t.remoteAddr, hostKey)
  	if err != nil {
  		return nil, err
  	}
  
  	return result, nil
  }
  