From 90cf7f012cdc6143752464bc9bb2b4a9f94f7132 Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Mon, 1 Apr 2013 00:07:26 +0800 Subject: Move the more verbose TRACE() statements into TRACE2() --- debug.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'debug.h') diff --git a/debug.h b/debug.h index b20e685..289c577 100644 --- a/debug.h +++ b/debug.h @@ -39,7 +39,7 @@ * Caution: Don't use this in an unfriendly environment (ie unfirewalled), * since the printing may not sanitise strings etc. This will add a reasonable * amount to your executable size. */ -/*#define DEBUG_TRACE */ +/* #define DEBUG_TRACE */ /* All functions writing to the cleartext payload buffer call * CHECKCLEARTOWRITE() before writing. This is only really useful if you're @@ -63,8 +63,10 @@ /* you don't need to touch this block */ #ifdef DEBUG_TRACE #define TRACE(X) dropbear_trace X; +#define TRACE2(X) dropbear_trace2 X; #else /*DEBUG_TRACE*/ #define TRACE(X) +#define TRACE2(X) #endif /*DEBUG_TRACE*/ /* To debug with GDB it is easier to run with no forking of child processes. -- cgit v1.2.3 From 2fdb5fd6ced264fec1594cf674ef125f5dc6a500 Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Thu, 4 Apr 2013 07:51:13 +0800 Subject: setup tcp after requesting a channel - might hide some DNS latency --- cli-session.c | 15 ++++++++------- debug.h | 2 +- 2 files changed, 9 insertions(+), 8 deletions(-) (limited to 'debug.h') diff --git a/cli-session.c b/cli-session.c index 9639ffa..401c9e2 100644 --- a/cli-session.c +++ b/cli-session.c @@ -266,13 +266,6 @@ static void cli_sessionloop() { } } -#ifdef ENABLE_CLI_LOCALTCPFWD - setup_localtcp(); -#endif -#ifdef ENABLE_CLI_REMOTETCPFWD - setup_remotetcp(); -#endif - #ifdef ENABLE_CLI_NETCAT if (cli_opts.netcat_host) { cli_send_netcat_request(); @@ -281,6 +274,14 @@ static void cli_sessionloop() { if (!cli_opts.no_cmd) { cli_send_chansess_request(); } + +#ifdef ENABLE_CLI_LOCALTCPFWD + setup_localtcp(); +#endif +#ifdef ENABLE_CLI_REMOTETCPFWD + setup_remotetcp(); +#endif + TRACE(("leave cli_sessionloop: running")) cli_ses.state = SESSION_RUNNING; return; diff --git a/debug.h b/debug.h index 289c577..be09865 100644 --- a/debug.h +++ b/debug.h @@ -39,7 +39,7 @@ * Caution: Don't use this in an unfriendly environment (ie unfirewalled), * since the printing may not sanitise strings etc. This will add a reasonable * amount to your executable size. */ -/* #define DEBUG_TRACE */ +#define DEBUG_TRACE /* All functions writing to the cleartext payload buffer call * CHECKCLEARTOWRITE() before writing. This is only really useful if you're -- cgit v1.2.3 From ef151888fbef7f33f2140da579945b7fcb83151c Mon Sep 17 00:00:00 2001 From: Matt Johnston Date: Sun, 14 Apr 2013 23:16:16 +0800 Subject: requirenext fixup for firstkexfollows --- CHANGES | 36 ++++++++++++++++++++++++++++++++++++ cli-kex.c | 7 ++++--- common-kex.c | 2 +- common-session.c | 2 +- debug.h | 2 +- process-packet.c | 9 +++++---- session.h | 5 +++-- svr-kex.c | 3 ++- 8 files changed, 53 insertions(+), 13 deletions(-) (limited to 'debug.h') diff --git a/CHANGES b/CHANGES index d21dc99..22b5a37 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,39 @@ +2013.57 - + +- Improved initial connection time particularly with high latency connections. + The number of round trips has been reduced for both client and server. + CPU time hasn't been changed. + +- Client will attempt to send an initial key exchange packet to save a round + trip. Dropbear implements an extension kexguess2@matt.ucc.asn.au to allow + the first packet guess to succeed in wider circumstances than the standard + behaviour. When communicating with other implementations the standard + behaviour is used. + +- Client side: when public key or password authentication with + $DROPBEAR_PASSWORD is used, an initial authentication request will + be sent immediately rather than querying the list of available methods. + This behaviour is enabled by CLI_IMMEDIATE_AUTH option (on by default), + please let the Dropbear author know if it causes any interoperability + problems. + +- Implement client escape characters ~. (terminate session) and + ~^Z (background session) + +- Server will more reliably clean up utmp when connection is closed + +- Don't crash if /dev/urandom isn't writable (RHEL5), thanks to Scott Case + +- Add "-y -y" client option to skip host key checking, thanks to Hans Harder + +- scp didn't work properly on systems using vfork(), thanks to Frank Van Uffelen + +- Added IUTF8 terminal mode support. Not yet standardised though seems that it + will soon be + +- Some verbose DROPBEAR_TRACE output is now hidden unless $DROPBEAR_TRACE2 + enviroment variable is set + 2013.56 - Thursday 21 March 2013 - Allow specifying cipher (-c) and MAC (-m) lists for dbclient diff --git a/cli-kex.c b/cli-kex.c index 3859109..e4d41cb 100644 --- a/cli-kex.c +++ b/cli-kex.c @@ -61,8 +61,8 @@ void send_msg_kexdh_init() { buf_putbyte(ses.writepayload, SSH_MSG_KEXDH_INIT); buf_putmpint(ses.writepayload, cli_ses.dh_e); encrypt_packet(); - // XXX fixme - //ses.requirenext = SSH_MSG_KEXDH_REPLY; + ses.requirenext[0] = SSH_MSG_KEXDH_REPLY; + ses.requirenext[1] = SSH_MSG_KEXINIT; } /* Handle a diffie-hellman key exchange reply. */ @@ -118,7 +118,8 @@ void recv_msg_kexdh_reply() { hostkey = NULL; send_msg_newkeys(); - ses.requirenext = SSH_MSG_NEWKEYS; + ses.requirenext[0] = SSH_MSG_NEWKEYS; + ses.requirenext[1] = 0; TRACE(("leave recv_msg_kexdh_init")) } diff --git a/common-kex.c b/common-kex.c index 530de0b..ba06e4f 100644 --- a/common-kex.c +++ b/common-kex.c @@ -542,7 +542,7 @@ void recv_msg_kexinit() { buf_putstring(ses.kexhashbuf, ses.transkexinit->data, ses.transkexinit->len); - ses.requirenext = SSH_MSG_KEXDH_INIT; + ses.requirenext[0] = SSH_MSG_KEXDH_INIT; } buf_free(ses.transkexinit); diff --git a/common-session.c b/common-session.c index 6b357bf..9df0f3d 100644 --- a/common-session.c +++ b/common-session.c @@ -82,7 +82,7 @@ void common_session_init(int sock_in, int sock_out) { initqueue(&ses.writequeue); - ses.requirenext = SSH_MSG_KEXINIT; + ses.requirenext[0] = SSH_MSG_KEXINIT; ses.dataallowed = 1; /* we can send data until we actually send the SSH_MSG_KEXINIT */ ses.ignorenext = 0; diff --git a/debug.h b/debug.h index be09865..289c577 100644 --- a/debug.h +++ b/debug.h @@ -39,7 +39,7 @@ * Caution: Don't use this in an unfriendly environment (ie unfirewalled), * since the printing may not sanitise strings etc. This will add a reasonable * amount to your executable size. */ -#define DEBUG_TRACE +/* #define DEBUG_TRACE */ /* All functions writing to the cleartext payload buffer call * CHECKCLEARTOWRITE() before writing. This is only really useful if you're diff --git a/process-packet.c b/process-packet.c index 128eb72..3ac0c1b 100644 --- a/process-packet.c +++ b/process-packet.c @@ -74,14 +74,15 @@ void process_packet() { /* This applies for KEX, where the spec says the next packet MUST be * NEWKEYS */ - if (ses.requirenext != 0) { - if (ses.requirenext != type) { - /* TODO send disconnect? */ + if (ses.requirenext[0] != 0) { + if (ses.requirenext[0] != type + && (ses.requirenext[1] == 0 || ses.requirenext[1] != type)) { dropbear_exit("Unexpected packet type %d, expected %d", type, ses.requirenext); } else { /* Got what we expected */ - ses.requirenext = 0; + ses.requirenext[0] = 0; + ses.requirenext[1] = 0; } } diff --git a/session.h b/session.h index 4ba8ac8..28cb5a9 100644 --- a/session.h +++ b/session.h @@ -135,8 +135,9 @@ struct sshsession { unsigned dataallowed : 1; /* whether we can send data packets or we are in the middle of a KEX or something */ - unsigned char requirenext; /* byte indicating what packet we require next, - or 0x00 for any */ + unsigned char requirenext[2]; /* bytes indicating what packets we require next, + or 0x00 for any. Second option can only be + used if the first byte is also set */ unsigned char ignorenext; /* whether to ignore the next packet, used for kex_follows stuff */ diff --git a/svr-kex.c b/svr-kex.c index abd7986..e56f082 100644 --- a/svr-kex.c +++ b/svr-kex.c @@ -61,7 +61,8 @@ void recv_msg_kexdh_init() { mp_clear(&dh_e); send_msg_newkeys(); - ses.requirenext = SSH_MSG_NEWKEYS; + ses.requirenext[0] = SSH_MSG_NEWKEYS; + ses.requirenext[1] = 0; TRACE(("leave recv_msg_kexdh_init")) } -- cgit v1.2.3