/****************************************************************************
*																			*
*						cryptlib SSHv1 Session Management					*
*						Copyright Peter Gutmann 1998-2001					*
*																			*
****************************************************************************/

#if defined( INC_ALL )
  #include "crypt.h"
  #include "session.h"
  #include "ssh.h"
#else
  #include "crypt.h"
  #include "session/session.h"
  #include "session/ssh.h"
#endif /* Compiler-specific includes */

#ifdef USE_SSH1

#error The SSHv1 protocol is insecure and obsolete, you should only enable this if absolutely necessary.

/* Determine the number of padding bytes required to make the packet size a
   multiple of 8 bytes */

#define getPadLength( length ) \
		( 8 - ( ( ID_SIZE + ( length ) + SSH1_CRC_SIZE ) & 7 ) )

/****************************************************************************
*																			*
*								Utility Functions							*
*																			*
****************************************************************************/

/* Byte-reverse an array of 32-bit words, needed for Blowfish encryption,
   which in the original SSH implementation got the endianness wrong.  This
   code is safe even for CPUs with a word size > 32 bits since on a little-
   endian CPU the important 32 bits are stored first, so that by zeroizing
   the first 32 bits and or-ing the reversed value back in we don't have to
   rely on the processor only writing 32 bits into memory */

static void longReverse( unsigned long *buffer, int count )
	{
#if defined( SYSTEM_64BIT )
	BYTE *bufPtr = ( BYTE * ) buffer, temp;

	assert( ( count % 4 ) == 0 );

	count /= 4;		/* sizeof( unsigned long ) != 4 */
	while( count-- > 0 )
		{
  #if 0
		unsigned long temp;

		/* This code is cursed */
		temp = value = *buffer & 0xFFFFFFFFUL;
		value = ( ( value & 0xFF00FF00UL ) >> 8  ) | \
				( ( value & 0x00FF00FFUL ) << 8 );
		value = ( ( value << 16 ) | ( value >> 16 ) ) ^ temp;
		*buffer ^= value;
		buffer = ( unsigned long * ) ( ( BYTE * ) buffer + 4 );
  #endif /* 0 */
		/* There's really no nice way to do this - the above code generates
		   misaligned accesses on processors with a word size > 32 bits, so
		   we have to work at the byte level (either that or turn misaligned
		   access warnings off by trapping the signal the access corresponds
		   to, however a context switch per memory access is probably
		   somewhat slower than the current byte-twiddling mess) */
		temp = bufPtr[ 3 ];
		bufPtr[ 3 ] = bufPtr[ 0 ];
		bufPtr[ 0 ] = temp;
		temp = bufPtr[ 2 ];
		bufPtr[ 2 ] = bufPtr[ 1 ];
		bufPtr[ 1 ] = temp;
		bufPtr += 4;
		}
#elif defined( __WIN32__ )
	assert( ( count % 4 ) == 0 );

	/* The following code, which makes use of bswap, is rather faster than
	   what the compiler would otherwise generate */
__asm {
	mov ecx, count
	mov edx, buffer
	shr ecx, 2
swapLoop:
	mov eax, [edx]
	bswap eax
	mov [edx], eax
	add edx, 4
	dec ecx
	jnz swapLoop
	}
#else
	unsigned long value;

	assert( ( count % 4 ) == 0 );
	assert( sizeof( unsigned long ) == 4 );

	count /= sizeof( unsigned long );
	while( count-- > 0 )
		{
		value = *buffer;
		value = ( ( value & 0xFF00FF00UL ) >> 8  ) | \
				( ( value & 0x00FF00FFUL ) << 8 );
		*buffer++ = ( value << 16 ) | ( value >> 16 );
		}
#endif /* SYSTEM_64BIT */
	}

/* Calculate the CRC32 for a data block.  This uses the slightly nonstandard
   variant from the original SSH code, which calculates the UART-style
   reflected value and doesn't pre-set the value to all ones (done to to
   catch leading zero bytes, which happens quite a bit with SSH because of
   the 32-bit length at the start) or XOR it with all ones before returning
   it.  This means that the resulting CRC is not the same as the one in
   Ethernet, Pkzip, and most other implementations */

static const FAR_BSS unsigned long crc32table[] = {
	0x00000000UL, 0x77073096UL, 0xEE0E612CUL, 0x990951BAUL,
	0x076DC419UL, 0x706AF48FUL, 0xE963A535UL, 0x9E6495A3UL,
	0x0EDB8832UL, 0x79DCB8A4UL, 0xE0D5E91EUL, 0x97D2D988UL,
	0x09B64C2BUL, 0x7EB17CBDUL, 0xE7B82D07UL, 0x90BF1D91UL,
	0x1DB71064UL, 0x6AB020F2UL, 0xF3B97148UL, 0x84BE41DEUL,
	0x1ADAD47DUL, 0x6DDDE4EBUL, 0xF4D4B551UL, 0x83D385C7UL,
	0x136C9856UL, 0x646BA8C0UL, 0xFD62F97AUL, 0x8A65C9ECUL,
	0x14015C4FUL, 0x63066CD9UL, 0xFA0F3D63UL, 0x8D080DF5UL,
	0x3B6E20C8UL, 0x4C69105EUL, 0xD56041E4UL, 0xA2677172UL,
	0x3C03E4D1UL, 0x4B04D447UL, 0xD20D85FDUL, 0xA50AB56BUL,
	0x35B5A8FAUL, 0x42B2986CUL, 0xDBBBC9D6UL, 0xACBCF940UL,
	0x32D86CE3UL, 0x45DF5C75UL, 0xDCD60DCFUL, 0xABD13D59UL,
	0x26D930ACUL, 0x51DE003AUL, 0xC8D75180UL, 0xBFD06116UL,
	0x21B4F4B5UL, 0x56B3C423UL, 0xCFBA9599UL, 0xB8BDA50FUL,
	0x2802B89EUL, 0x5F058808UL, 0xC60CD9B2UL, 0xB10BE924UL,
	0x2F6F7C87UL, 0x58684C11UL, 0xC1611DABUL, 0xB6662D3DUL,
	0x76DC4190UL, 0x01DB7106UL, 0x98D220BCUL, 0xEFD5102AUL,
	0x71B18589UL, 0x06B6B51FUL, 0x9FBFE4A5UL, 0xE8B8D433UL,
	0x7807C9A2UL, 0x0F00F934UL, 0x9609A88EUL, 0xE10E9818UL,
	0x7F6A0DBBUL, 0x086D3D2DUL, 0x91646C97UL, 0xE6635C01UL,
	0x6B6B51F4UL, 0x1C6C6162UL, 0x856530D8UL, 0xF262004EUL,
	0x6C0695EDUL, 0x1B01A57BUL, 0x8208F4C1UL, 0xF50FC457UL,
	0x65B0D9C6UL, 0x12B7E950UL, 0x8BBEB8EAUL, 0xFCB9887CUL,
	0x62DD1DDFUL, 0x15DA2D49UL, 0x8CD37CF3UL, 0xFBD44C65UL,
	0x4DB26158UL, 0x3AB551CEUL, 0xA3BC0074UL, 0xD4BB30E2UL,
	0x4ADFA541UL, 0x3DD895D7UL, 0xA4D1C46DUL, 0xD3D6F4FBUL,
	0x4369E96AUL, 0x346ED9FCUL, 0xAD678846UL, 0xDA60B8D0UL,
	0x44042D73UL, 0x33031DE5UL, 0xAA0A4C5FUL, 0xDD0D7CC9UL,
	0x5005713CUL, 0x270241AAUL, 0xBE0B1010UL, 0xC90C2086UL,
	0x5768B525UL, 0x206F85B3UL, 0xB966D409UL, 0xCE61E49FUL,
	0x5EDEF90EUL, 0x29D9C998UL, 0xB0D09822UL, 0xC7D7A8B4UL,
	0x59B33D17UL, 0x2EB40D81UL, 0xB7BD5C3BUL, 0xC0BA6CADUL,
	0xEDB88320UL, 0x9ABFB3B6UL, 0x03B6E20CUL, 0x74B1D29AUL,
	0xEAD54739UL, 0x9DD277AFUL, 0x04DB2615UL, 0x73DC1683UL,
	0xE3630B12UL, 0x94643B84UL, 0x0D6D6A3EUL, 0x7A6A5AA8UL,
	0xE40ECF0BUL, 0x9309FF9DUL, 0x0A00AE27UL, 0x7D079EB1UL,
	0xF00F9344UL, 0x8708A3D2UL, 0x1E01F268UL, 0x6906C2FEUL,
	0xF762575DUL, 0x806567CBUL, 0x196C3671UL, 0x6E6B06E7UL,
	0xFED41B76UL, 0x89D32BE0UL, 0x10DA7A5AUL, 0x67DD4ACCUL,
	0xF9B9DF6FUL, 0x8EBEEFF9UL, 0x17B7BE43UL, 0x60B08ED5UL,
	0xD6D6A3E8UL, 0xA1D1937EUL, 0x38D8C2C4UL, 0x4FDFF252UL,
	0xD1BB67F1UL, 0xA6BC5767UL, 0x3FB506DDUL, 0x48B2364BUL,
	0xD80D2BDAUL, 0xAF0A1B4CUL, 0x36034AF6UL, 0x41047A60UL,
	0xDF60EFC3UL, 0xA867DF55UL, 0x316E8EEFUL, 0x4669BE79UL,
	0xCB61B38CUL, 0xBC66831AUL, 0x256FD2A0UL, 0x5268E236UL,
	0xCC0C7795UL, 0xBB0B4703UL, 0x220216B9UL, 0x5505262FUL,
	0xC5BA3BBEUL, 0xB2BD0B28UL, 0x2BB45A92UL, 0x5CB36A04UL,
	0xC2D7FFA7UL, 0xB5D0CF31UL, 0x2CD99E8BUL, 0x5BDEAE1DUL,
	0x9B64C2B0UL, 0xEC63F226UL, 0x756AA39CUL, 0x026D930AUL,
	0x9C0906A9UL, 0xEB0E363FUL, 0x72076785UL, 0x05005713UL,
	0x95BF4A82UL, 0xE2B87A14UL, 0x7BB12BAEUL, 0x0CB61B38UL,
	0x92D28E9BUL, 0xE5D5BE0DUL, 0x7CDCEFB7UL, 0x0BDBDF21UL,
	0x86D3D2D4UL, 0xF1D4E242UL, 0x68DDB3F8UL, 0x1FDA836EUL,
	0x81BE16CDUL, 0xF6B9265BUL, 0x6FB077E1UL, 0x18B74777UL,
	0x88085AE6UL, 0xFF0F6A70UL, 0x66063BCAUL, 0x11010B5CUL,
	0x8F659EFFUL, 0xF862AE69UL, 0x616BFFD3UL, 0x166CCF45UL,
	0xA00AE278UL, 0xD70DD2EEUL, 0x4E048354UL, 0x3903B3C2UL,
	0xA7672661UL, 0xD06016F7UL, 0x4969474DUL, 0x3E6E77DBUL,
	0xAED16A4AUL, 0xD9D65ADCUL, 0x40DF0B66UL, 0x37D83BF0UL,
	0xA9BCAE53UL, 0xDEBB9EC5UL, 0x47B2CF7FUL, 0x30B5FFE9UL,
	0xBDBDF21CUL, 0xCABAC28AUL, 0x53B39330UL, 0x24B4A3A6UL,
	0xBAD03605UL, 0xCDD70693UL, 0x54DE5729UL, 0x23D967BFUL,
	0xB3667A2EUL, 0xC4614AB8UL, 0x5D681B02UL, 0x2A6F2B94UL,
	0xB40BBE37UL, 0xC30C8EA1UL, 0x5A05DF1BUL, 0x2D02EF8DUL
	};

static unsigned long calculateCRC( const BYTE *data, const int dataLength )
	{
	unsigned long crc32 = 0;
	int i;

	for( i = 0; i < dataLength; i++ )
		crc32 = crc32table[ ( int ) ( crc32 ^ data[ i ] ) & 0xFF ] ^ ( crc32 >> 8 );

	return( crc32 );
	}

/* If we detect that the other side is also running cryptlib, we use a
   truncated MAC instead of a CRC32 once we're running in secure mode.  This
   prevents extension attacks on the CRC-protected data.  The reason for
   the truncation is to make it the same length as the CRC, this makes it a
   bit weaker than a full-length MAC but no weaker than a cryptographically
   strong CRC (in any case the chances of a successful attack are only 1/2^31,
   since you only get one chance to get it right) */

static unsigned long calculateTruncatedMAC( const CRYPT_CONTEXT iMacContext,
											const BYTE *data,
											const int dataLength )
	{
	MESSAGE_DATA msgData;
	BYTE macBuffer[ CRYPT_MAX_HASHSIZE + 8 ], *bufPtr = macBuffer;
	unsigned long macValue;
	int status;

	/* MAC the data and return the 32-bit truncated MAC value */
	krnlSendMessage( iMacContext, IMESSAGE_DELETEATTRIBUTE, NULL,
					 CRYPT_CTXINFO_HASHVALUE );
	krnlSendMessage( iMacContext, IMESSAGE_CTX_HASH, ( void * ) data,
					 dataLength );
	krnlSendMessage( iMacContext, IMESSAGE_CTX_HASH, "", 0 );
	setMessageData( &msgData, macBuffer, CRYPT_MAX_HASHSIZE );
	status = krnlSendMessage( iMacContext, IMESSAGE_GETATTRIBUTE_S,
							  &msgData, CRYPT_CTXINFO_HASHVALUE );
	if( cryptStatusError( status ) )
		return( 0 );	/* Will cause a protocol failure */
	macValue = mgetLong( bufPtr );

	return( macValue );
	}

/* Convert an SSHv1 algorithm ID to a cryptlib ID in preferred-algorithm
   order, and return a list of available algorithms in SSHv1 cipher-mask
   format.  We can't use 3DES since this uses inner-CBC which is both
   nonstandard and has known (although not serious) weaknesses.  If we
   wanted to implement it in a portable manner (i.e. usable with external
   drivers and devices) we'd have to synthesize it using three lots of
   DES-CBC since nothing implements the variant that SSHv1 uses.  SSHv2
   fixed this so it's no longer a problem in that case */

static CRYPT_ALGO_TYPE maskToAlgoID( const int value )
	{
	if( ( value & ( 1 << SSH1_CIPHER_BLOWFISH ) ) && \
		algoAvailable( CRYPT_ALGO_BLOWFISH ) )
		return( CRYPT_ALGO_BLOWFISH );
	if( ( value & ( 1 << SSH1_CIPHER_IDEA ) ) && \
		algoAvailable( CRYPT_ALGO_IDEA ) )
		return( CRYPT_ALGO_IDEA );
	if( ( value & ( 1 << SSH1_CIPHER_RC4 ) ) && \
		algoAvailable( CRYPT_ALGO_RC4 ) )
		return( CRYPT_ALGO_RC4 );
	if( value & ( 1 << SSH1_CIPHER_DES ) )
		return( CRYPT_ALGO_DES );

	return( CRYPT_ALGO_NONE );
	}

static CRYPT_ALGO_TYPE sshIDToAlgoID( const int value )
	{
	switch( value )
		{
		case SSH1_CIPHER_IDEA:
			if( algoAvailable( CRYPT_ALGO_IDEA ) )
				return( CRYPT_ALGO_IDEA );
			break;

		case SSH1_CIPHER_DES:
			return( CRYPT_ALGO_DES );

		case SSH1_CIPHER_RC4:
			if( algoAvailable( CRYPT_ALGO_RC4 ) )
				return( CRYPT_ALGO_RC4 );
			break;

		case SSH1_CIPHER_BLOWFISH:
			if( algoAvailable( CRYPT_ALGO_BLOWFISH ) )
				return( CRYPT_ALGO_BLOWFISH );
			break;
		}

	return( CRYPT_ALGO_NONE );
	}

static long getAlgorithmMask( void )
	{
	long value = 0;

	if( algoAvailable( CRYPT_ALGO_DES ) )
		value |= 1 << SSH1_CIPHER_DES;
	if( algoAvailable( CRYPT_ALGO_BLOWFISH ) )
		value |= 1 << SSH1_CIPHER_BLOWFISH;
	if( algoAvailable( CRYPT_ALGO_IDEA ) )
		value |= 1 << SSH1_CIPHER_IDEA;
	if( algoAvailable( CRYPT_ALGO_RC4 ) )
		value |= 1 << SSH1_CIPHER_RC4;

	return( value );
	}

/* Encode a value as an SSH string */

static int encodeString( BYTE *buffer, const BYTE *string,
						 const int stringLength )
	{
	BYTE *bufPtr = buffer;
	const int length = ( stringLength > 0 ) ? stringLength : strlen( string );

	if( buffer != NULL )
		{
		mputLong( bufPtr, length );
		memcpy( bufPtr, string, length );
		}
	return( LENGTH_SIZE + length );
	}

/* Generate an SSH session ID */

static void generateSessionID( SSH_HANDSHAKE_INFO *handshakeInfo )
	{
	HASHFUNCTION hashFunction;
	HASHINFO hashInfo;

	/* Get the hash algorithm information and hash the server key modulus,
	   host key modulus, and cookie.  The SSH documentation and source code
	   are quite confusing on this issue, giving the key components to be
	   hashed multiple names (server key, host key, session key, public key,
	   etc etc).  The correct order is:
		hash( host modulus || server modulus || cookie ) */
	getHashParameters( CRYPT_ALGO_MD5, &hashFunction, NULL );
	hashFunction( hashInfo, NULL, handshakeInfo->hostModulus,
				  handshakeInfo->hostModulusLength, HASH_START );
	hashFunction( hashInfo, NULL, handshakeInfo->serverModulus,
				  handshakeInfo->serverModulusLength, HASH_CONTINUE );
	hashFunction( hashInfo, handshakeInfo->sessionID,
				  handshakeInfo->cookie, SSH1_COOKIE_SIZE, HASH_END );
	handshakeInfo->sessionIDlength = SSH1_SESSIONID_SIZE;
	}

/* Generate/check an SSHv1 key fingerprint.  This is the same easily-
   spoofable MD5 hash of the raw RSA n and e values used by PGP 2.x */

static int processKeyFingerprint( SESSION_INFO *sessionInfoPtr,
								  const void *n, const int nLength,
								  const void *e, int eLength )
	{
	HASHFUNCTION hashFunction;
	HASHINFO hashInfo;
	const ATTRIBUTE_LIST *attributeListPtr = \
				findSessionAttribute( sessionInfoPtr->attributeList,
									  CRYPT_SESSINFO_SERVER_FINGERPRINT );
	BYTE fingerPrint[ CRYPT_MAX_HASHSIZE + 8 ];
	int hashSize;

	getHashParameters( CRYPT_ALGO_MD5, &hashFunction, &hashSize );
	hashFunction( hashInfo, NULL, n, nLength, HASH_START );
	hashFunction( hashInfo, fingerPrint, e, eLength, HASH_END );
	if( attributeListPtr == NULL )
		/* Remember the value for the caller */
		return( addSessionAttribute( &sessionInfoPtr->attributeList,
									 CRYPT_SESSINFO_SERVER_FINGERPRINT,
									 fingerPrint, hashSize ) );

	/* There's an existing fingerprint value, make sure that it matches what
	   we just calculated */
	if( attributeListPtr->valueLength != hashSize || \
		memcmp( attributeListPtr->value, fingerPrint, hashSize ) )
		retExt( sessionInfoPtr, CRYPT_ERROR_WRONGKEY,
				"Server key fingerprint doesn't match requested "
				"fingerprint" );
	return( CRYPT_OK );
	}

/* Generate a response to an RSA authentication challenge */

static void generateChallengeResponse( BYTE *response,
									   const SSH_HANDSHAKE_INFO *handshakeInfo,
									   const BYTE *challenge )
	{
	HASHFUNCTION hashFunction;
	HASHINFO hashInfo;

	/* Hash the session ID and challenge:
		hash( sessionID || challenge ) */
	getHashParameters( CRYPT_ALGO_MD5, &hashFunction, NULL );
	hashFunction( hashInfo, NULL, ( BYTE * ) handshakeInfo->sessionID,
				  handshakeInfo->sessionIDlength, HASH_START );
	hashFunction( hashInfo, response, ( BYTE * ) challenge,
				  SSH1_CHALLENGE_SIZE, HASH_END );
	}

/* Process the public key data.  The preceding key length value isn't useful
   because it contains the nominal key size in bits rather than the size of
   the following data, so we have to dig into the data to find out how much
   there is.  In addition we need to take a copy of the key modulus since
   it's needed later for calculating the session ID */

static int processPublickeyData( SSH_HANDSHAKE_INFO *handshakeInfo,
								 const void *data, const int dataLength,
								 const BOOLEAN isServerKey,
								 SESSION_INFO *sessionInfoPtr )
	{
	BYTE *dataPtr = ( BYTE * ) data, *ePtr;
	int nominalLength, eLength, nLength;

	nominalLength = ( int ) mgetLong( dataPtr );
	nominalLength = bitsToBytes( nominalLength );
	if( nominalLength < bitsToBytes( MIN_PKCSIZE_BITS ) || \
		nominalLength > CRYPT_MAX_PKCSIZE )
		retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
				"Invalid public key size %d", nominalLength );
	eLength = mgetWord( dataPtr );
	eLength = bitsToBytes( eLength );
	if( LENGTH_SIZE + SSH1_MPI_LENGTH_SIZE + eLength + \
					  SSH1_MPI_LENGTH_SIZE + nominalLength > dataLength )
		retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
				"Invalid exponent size %d for key size %d", eLength,
				nominalLength );
	ePtr = dataPtr;
	dataPtr += eLength;
	nLength = mgetWord( dataPtr );
	nLength = bitsToBytes( nLength );
	if( nLength != nominalLength )
		retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
				"Public key size %d doesn't match modulus size %d",
				nominalLength, nLength );
	if( isServerKey )
		{
		memcpy( handshakeInfo->serverModulus, dataPtr, nLength );
		handshakeInfo->serverModulusLength = nLength;
		}
	else
		{
		memcpy( handshakeInfo->hostModulus, dataPtr, nLength );
		handshakeInfo->hostModulusLength = nLength;
		}
	if( sessionInfoPtr != NULL )
		{
		int status;

		status = processKeyFingerprint( sessionInfoPtr, dataPtr, nLength,
										ePtr, eLength );
		if( cryptStatusError( status ) )
			return( status );
		}

	return( LENGTH_SIZE + SSH1_MPI_LENGTH_SIZE + eLength + \
						  SSH1_MPI_LENGTH_SIZE + nLength );
	}

/* Set up the security information required for the session */

static int initSecurityInfoSSH1( SESSION_INFO *sessionInfoPtr,
								 SSH_HANDSHAKE_INFO *handshakeInfo )
	{
	MESSAGE_DATA msgData;
	int keySize, ivSize, status;

	/* Create the security contexts required for the session */
	status = initSecurityContextsSSH( sessionInfoPtr );
	if( cryptStatusError( status ) )
		return( status );
	if( sessionInfoPtr->cryptAlgo == CRYPT_ALGO_BLOWFISH )
		/* For Blowfish the session key size doesn't match the default
		   Blowfish key size so we explicitly specify its length */
		keySize = SSH1_SECRET_SIZE;
	else
		krnlSendMessage( sessionInfoPtr->iCryptInContext,
						 IMESSAGE_GETATTRIBUTE, &keySize,
						 CRYPT_CTXINFO_KEYSIZE );
	if( krnlSendMessage( sessionInfoPtr->iCryptInContext,
						 IMESSAGE_GETATTRIBUTE, &ivSize,
						 CRYPT_CTXINFO_IVSIZE ) == CRYPT_ERROR_NOTAVAIL )
		/* It's a stream cipher */
		ivSize = 0;

	/* Load the keys.  For RC4, which is IV-less, the session key is split
	   into two parts, with the first part being the receive key and the
	   second part being the send key.  For other algorithms, the entire
	   session key is used for both send and receive contexts, leading to
	   a simple attack on the first data block since the initial IV is all
	   zeroes */
	setMessageData( &msgData, ( sessionInfoPtr->cryptAlgo == CRYPT_ALGO_RC4 ) ? \
					handshakeInfo->secretValue + 16 : handshakeInfo->secretValue,
					keySize );
	status = krnlSendMessage( sessionInfoPtr->iCryptOutContext,
							  IMESSAGE_SETATTRIBUTE_S, &msgData,
							  CRYPT_CTXINFO_KEY );
	if( cryptStatusOK( status ) )
		{
		setMessageData( &msgData, handshakeInfo->secretValue, keySize );
		status = krnlSendMessage( sessionInfoPtr->iCryptInContext,
								  IMESSAGE_SETATTRIBUTE_S, &msgData,
								  CRYPT_CTXINFO_KEY );
		}
	if( cryptStatusOK( status ) && ivSize > 0 )
		{
		static const char iv[ CRYPT_MAX_IVSIZE ] = { 0 };

		setMessageData( &msgData, ( void * ) iv, ivSize );
		krnlSendMessage( sessionInfoPtr->iCryptOutContext,
						 IMESSAGE_SETATTRIBUTE_S, &msgData, CRYPT_CTXINFO_IV );
		setMessageData( &msgData, ( void * ) iv, ivSize );
		krnlSendMessage( sessionInfoPtr->iCryptInContext,
						 IMESSAGE_SETATTRIBUTE_S, &msgData, CRYPT_CTXINFO_IV );
		}
	if( cryptStatusError( status ) )
		return( status );

	/* If we're talking to a cryptlib peer, set up the MAC context which is
	   used instead of a CRC32.  The key we use for this is taken from the
	   end of the SSH secret data, which isn't used for any cipher except
	   Blowfish */
	if( sessionInfoPtr->flags & SESSION_ISCRYPTLIB )
		{
		setMessageData( &msgData,
				handshakeInfo->secretValue + ( SSH1_SECRET_SIZE - 16 ), 16 );
		status = krnlSendMessage( sessionInfoPtr->iAuthInContext,
								  IMESSAGE_SETATTRIBUTE_S, &msgData,
								  CRYPT_CTXINFO_KEY );
		if( cryptStatusError( status ) )
			return( status );
		}

	/* We've set up the security info, from now on all data is encrypted */
	sessionInfoPtr->flags |= SESSION_ISSECURE_READ | SESSION_ISSECURE_WRITE;

	return( CRYPT_OK );
	}

/* Read an SSH packet */

static int decryptPayload( SESSION_INFO *sessionInfoPtr, BYTE *buffer,
						   const int length )
	{
	int status;

	/* Decrypt the payload, with handling for SSH's Blowfish endianness bug.
	   This may not be a true bug but more a problem in the spec, since the
	   original was rather vague about the endianness of the byte -> long
	   conversion */
	if( sessionInfoPtr->cryptAlgo == CRYPT_ALGO_BLOWFISH )
		longReverse( ( unsigned long * ) buffer, length );
	status = krnlSendMessage( sessionInfoPtr->iCryptInContext,
							  IMESSAGE_CTX_DECRYPT, buffer, length );
	if( sessionInfoPtr->cryptAlgo == CRYPT_ALGO_BLOWFISH )
		longReverse( ( unsigned long * ) buffer, length );
	return( status );
	}

static BOOLEAN checksumPayload( SESSION_INFO *sessionInfoPtr,
								const BYTE *buffer, const int length )
	{
	const int dataLength = length - SSH1_CRC_SIZE;	/* CRC isn't part of payload */
	BYTE *bufPtr = ( BYTE * ) buffer + dataLength;
	unsigned long crc32, storedCrc32;

	/* Calculate the checksum over the padding, type, and data and make sure
	   that it matches the transmitted value */
	if( ( sessionInfoPtr->flags & ( SESSION_ISCRYPTLIB | SESSION_ISSECURE_READ ) ) == \
								  ( SESSION_ISCRYPTLIB | SESSION_ISSECURE_READ ) )
		crc32 = calculateTruncatedMAC( sessionInfoPtr->iAuthInContext,
									   buffer, dataLength );
	else
		crc32 = calculateCRC( buffer, dataLength );
	storedCrc32 = mgetLong( bufPtr );
	return( ( crc32 == storedCrc32 ) ? TRUE : FALSE );
	}

static int getDisconnectInfoSSH1( SESSION_INFO *sessionInfoPtr, BYTE *bufPtr )
	{
	int length;

	/* Server is disconnecting, find out why */
	length = mgetLong( bufPtr );
	if( length > MAX_ERRMSG_SIZE - 32 )
		retExt( sessionInfoPtr, CRYPT_ERROR_OVERFLOW,
				"Invalid error information size %d", length );
	strcpy( sessionInfoPtr->errorMessage, "Received SSHv1 server message: " );
	memcpy( sessionInfoPtr->errorMessage + 31, bufPtr, length );
	sessionInfoPtr->errorMessage[ 31 + length ] = '\0';

	return( CRYPT_ERROR_READ );
	}

static int readPacketSSH1( SESSION_INFO *sessionInfoPtr, int expectedType )
	{
	BYTE *bufPtr = sessionInfoPtr->receiveBuffer;
	long length;
	int padLength, packetType, iterationCount = 0;

	/* Alongside the expected packets the server can also send us all sorts
	   of no-op messages, ranging from explicit no-ops (SSH_MSG_IGNORE)
	   through to general chattiness (SSH_MSG_DEBUG).  Because we can
	   receive any quantity of these at any time, we have to run the receive
	   code in a loop to strip them out */
	do
		{
		const BYTE *lengthPtr = bufPtr;
		int status;

		/* Read the SSHv1 packet header:

			uint32		length (excluding padding)
			byte[]		padding
			byte		type
			byte[]		data
			uint32		crc32

		  The padding length is implicitly calculated as
		  8 - ( length & 7 ) bytes, and the CRC is calculated over the
		  padding, type, and data */
		assert( sessionInfoPtr->receiveBufEnd == 0 );
		status = readFixedHeader( sessionInfoPtr, LENGTH_SIZE );
		if( cryptStatusError( status ) )
			return( status );
		assert( status == LENGTH_SIZE );
		length = mgetLong( lengthPtr );
		padLength = 8 - ( length & 7 );
		if( length < SSH1_HEADER_SIZE || \
			length + padLength >= sessionInfoPtr->receiveBufSize )
			retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
					"Invalid packet length %d", length );
		status = sread( &sessionInfoPtr->stream,
						sessionInfoPtr->receiveBuffer, padLength + length );
		if( cryptStatusError( status ) )
			{
			sNetGetErrorInfo( &sessionInfoPtr->stream,
							  sessionInfoPtr->errorMessage,
							  &sessionInfoPtr->errorCode );
			return( status );
			}
		if( status != padLength + length )
			retExt( sessionInfoPtr, CRYPT_ERROR_TIMEOUT,
					"Timeout during packet remainder read, only got %d of "
					"%d bytes", status, padLength + length );
		if( sessionInfoPtr->flags & SESSION_ISSECURE_READ )
			{
			status = decryptPayload( sessionInfoPtr,
									 sessionInfoPtr->receiveBuffer,
									 padLength + length );
			if( cryptStatusError( status ) )
				return( status );
			}
		if( !checksumPayload( sessionInfoPtr, sessionInfoPtr->receiveBuffer,
							  padLength + length ) )
			/* If we're expecting a success packet after a key exchange or an
			   immediate post key-exchange packet and don't get it then it's
			   more likely that the problem is due to the wrong key being
			   used than data corruption, so we return a wrong key error
			   instead of bad data */
			retExt( sessionInfoPtr, ( expectedType == SSH1_SMSG_SUCCESS ) ? \
						CRYPT_ERROR_WRONGKEY : CRYPT_ERROR_BADDATA,
					"Bad message checksum" );
		packetType = sessionInfoPtr->receiveBuffer[ padLength ];
		}
	while( ( packetType == SSH1_MSG_IGNORE || \
			 packetType == SSH1_MSG_DEBUG ) && iterationCount++ < 1000 );
	if( iterationCount >= 1000 )
		retExt( sessionInfoPtr, CRYPT_ERROR_OVERFLOW,
				"Peer sent excessive number of no-op packets" );
	length -= ID_SIZE + UINT_SIZE;	/* Remove fixed fields */

	/* Make sure we either got what we asked for or one of the allowed
	   special-case packets */
	if( packetType == SSH1_MSG_DISCONNECT )
		return( getDisconnectInfoSSH1( sessionInfoPtr,
					sessionInfoPtr->receiveBuffer + padLength + ID_SIZE ) );
	if( expectedType == SSH1_MSG_SPECIAL_USEROPT )
		{
		/* Sending an SSH1_CMSG_USER can result in an SSH1_SMSG_FAILURE if the
		   user needs some form of authentiction to log on, so we have to
		   filter this and convert it into a CRYPT_OK/OK_SPECIAL value to
		   let the caller know whether they have to send a password or not */
		if( packetType == SSH1_SMSG_SUCCESS )
			return( CRYPT_OK );
		if( packetType == SSH1_SMSG_FAILURE )
			return( OK_SPECIAL );
		}
	if( expectedType == SSH1_MSG_SPECIAL_PWOPT )
		{
		/* If we're reading a response to a password then getting a failure
		   response is valid (even if it's not what we're expecting) since
		   it's an indication that an incorrect password was used rather than
		   that there was some general type of failure */
		if( packetType == SSH1_SMSG_FAILURE )
			retExt( sessionInfoPtr, CRYPT_ERROR_WRONGKEY,
					"Server indicated incorrect password was used" );
		expectedType = SSH1_SMSG_SUCCESS;
		}
	if( expectedType == SSH1_MSG_SPECIAL_RSAOPT )
		{
		/* If we're reading a response to an RSA key ID then getting a
		   failure response is valid (even if it's not what we're expecting)
		   since it's an indication that an incorrect key was used rather
		   than that there was some general type of failure */
		if( packetType == SSH1_SMSG_FAILURE )
			retExt( sessionInfoPtr, CRYPT_ERROR_WRONGKEY,
					"Server indicated incorrect RSA key was used" );
		expectedType = SSH1_SMSG_AUTH_RSA_CHALLENGE;
		}
	if( expectedType == SSH1_MSG_SPECIAL_ANY )
		{
		/* If we're expecting any kind of data, save the type at the start
		   of the buffer.  The length increment means that we move one byte
		   of data too much down, but this isn't a big deal since the
		   returned data length excludes it, and it's not processed anyway -
		   this packet pseudo-type is only used to eat client or server
		   chattiness at the end of the handshake */
		*bufPtr++ = packetType;
		length += ID_SIZE;
		}
	else
		if( packetType != expectedType )
			retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
					"Invalid packet type 0x%02X, expected 0x%02X",
					packetType, expectedType );

	/* Move the data down in the buffer to get rid of the padding.  This
	   isn't as inefficient as it seems since it's only used for short
	   handshake messages */
	memmove( bufPtr, sessionInfoPtr->receiveBuffer + padLength + ID_SIZE,
			 length );

	return( length );
	}

/* Send an SSHv1 packet.  SSHv1 uses an awkward variable-length padding at
   the start, when we're sending short control packets we can pre-calculate
   the data start position or memmove() it into place, with longer payload
   data quantities we can no longer easily do this so we build the header
   backwards from the start of the data in the buffer.  Because of this we
   perform all operations on the data relative to a variable start position
   given by the parameter delta */

static int sendPacketSsh1( SESSION_INFO *sessionInfoPtr,
						   const int packetType, const int dataLength,
						   const int delta )
	{
	MESSAGE_DATA msgData;
	BYTE *bufStartPtr = sessionInfoPtr->sendBuffer + \
						( ( delta != CRYPT_UNUSED ) ? delta : 0 );
	BYTE *bufPtr = bufStartPtr;
	unsigned long crc32;
	const int length = ID_SIZE + dataLength + SSH1_CRC_SIZE;
	const int padLength = getPadLength( dataLength );
	int status;

	/* Add the SSH packet header:

		uint32		length
		byte[]		padding, 8 - ( length & 7 ) bytes
		byte		type
		byte[]		data
		uint32		crc32	- Calculated over padding, type, and data */
	mputLong( bufPtr, ( long ) length );
	setMessageData( &msgData, bufPtr, padLength );
	krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_GETATTRIBUTE_S,
					 &msgData, CRYPT_IATTRIBUTE_RANDOM_NONCE );
	bufPtr[ padLength ] = packetType;
	if( ( sessionInfoPtr->flags & ( SESSION_ISCRYPTLIB | SESSION_ISSECURE_WRITE ) ) == \
								  ( SESSION_ISCRYPTLIB | SESSION_ISSECURE_WRITE ) )
		crc32 = calculateTruncatedMAC( sessionInfoPtr->iAuthInContext,
									   bufPtr,
									   padLength + ID_SIZE + dataLength );
	else
		crc32 = calculateCRC( bufPtr, padLength + ID_SIZE + dataLength );
	bufPtr += padLength + ID_SIZE + dataLength;
	mputLong( bufPtr, crc32 );
	if( sessionInfoPtr->flags & SESSION_ISSECURE_WRITE )
		{
		/* Encrypt the payload with handling for SSH's Blowfish
		   endianness bug */
		if( sessionInfoPtr->cryptAlgo == CRYPT_ALGO_BLOWFISH )
			longReverse( ( unsigned long * ) ( bufStartPtr + LENGTH_SIZE ),
						 padLength + length );
		status = krnlSendMessage( sessionInfoPtr->iCryptOutContext,
								  IMESSAGE_CTX_ENCRYPT,
								  bufStartPtr + LENGTH_SIZE,
								  padLength + length );
		if( sessionInfoPtr->cryptAlgo == CRYPT_ALGO_BLOWFISH )
			longReverse( ( unsigned long * ) ( bufStartPtr + LENGTH_SIZE ),
						 padLength + length );
		if( cryptStatusError( status ) )
			return( status );
		}
	if( delta != CRYPT_UNUSED )
		{
		/* If we're sending payload data the send is interruptible, it's the
		   caller's responsibility to handle this.  Since the caller expects
		   to write data from the start of the buffer, we have to move it
		   down to line it up correctly.  This is somewhat inefficient, but
		   since SSHv1 is virtually extinct it's not worth going to a lot of
		   effort to work around this (the same applies to other SSHv1
		   issues like the Blowfish endianness problem and the weird 3DES
		   mode) */
		if( delta )
			memmove( sessionInfoPtr->sendBuffer, bufStartPtr,
					 LENGTH_SIZE + padLength + length );
		return( LENGTH_SIZE + padLength + length );
		}
	status = swrite( &sessionInfoPtr->stream, bufStartPtr,
					 LENGTH_SIZE + padLength + length );
	if( cryptStatusError( status ) )
		{
		sNetGetErrorInfo( &sessionInfoPtr->stream,
						  sessionInfoPtr->errorMessage,
						  &sessionInfoPtr->errorCode );
		return( status );
		}
	return( CRYPT_OK );	/* swrite() returns a byte count */
	}

/****************************************************************************
*																			*
*							Client-side Connect Functions					*
*																			*
****************************************************************************/

/* Perform the initial part of the handshake with the server */

static int beginClientHandshake( SESSION_INFO *sessionInfoPtr,
								 SSH_HANDSHAKE_INFO *handshakeInfo )
	{
	MESSAGE_CREATEOBJECT_INFO createInfo;
	MESSAGE_DATA msgData;
	BYTE *bufPtr;
	const BOOLEAN hasPassword = \
			( findSessionAttribute( sessionInfoPtr->attributeList,
								    CRYPT_SESSINFO_PASSWORD ) != NULL ) ? \
			TRUE : FALSE;
	const BOOLEAN hasPrivkey = \
			( findSessionAttribute( sessionInfoPtr->attributeList,
								    CRYPT_SESSINFO_PRIVATEKEY ) != NULL ) ? \
			TRUE : FALSE;
	BOOLEAN rsaOK, pwOK;
	int hostKeyLength, serverKeyLength, keyDataLength, length, value, status;

	/* The higher-level code has already read the server session info, send
	   back our own version info (SSHv1 uses only a LF as terminator).  For
	   SSHv1 we use the lowest common denominator of our version (1.5,
	   described in the only existing spec for SSHv1) and whatever the
	   server can handle */
	strcpy( sessionInfoPtr->sendBuffer, SSH1_ID_STRING "\n" );
	if( sessionInfoPtr->receiveBuffer[ 2 ] < \
							SSH1_ID_STRING[ SSH_ID_SIZE + 2 ] )
		sessionInfoPtr->sendBuffer[ SSH_ID_SIZE + 2 ] = \
								sessionInfoPtr->receiveBuffer[ 2 ];
	status = swrite( &sessionInfoPtr->stream, sessionInfoPtr->sendBuffer,
					 strlen( sessionInfoPtr->sendBuffer ) );
	if( cryptStatusError( status ) )
		{
		sNetGetErrorInfo( &sessionInfoPtr->stream,
						  sessionInfoPtr->errorMessage,
						  &sessionInfoPtr->errorCode );
		return( status );
		}

	/* Create the contexts to hold the server and host keys */
	setMessageCreateObjectInfo( &createInfo, CRYPT_ALGO_RSA );
	status = krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_DEV_CREATEOBJECT,
							  &createInfo, OBJECT_TYPE_CONTEXT );
	if( cryptStatusError( status ) )
		return( status );
	handshakeInfo->iServerCryptContext = createInfo.cryptHandle;
	setMessageCreateObjectInfo( &createInfo, CRYPT_ALGO_RSA );
	status = krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_DEV_CREATEOBJECT,
							  &createInfo, OBJECT_TYPE_CONTEXT );
	if( cryptStatusError( status ) )
		return( status );
	sessionInfoPtr->iKeyexCryptContext = createInfo.cryptHandle;

	/* If the peer is using cryptlib, we use HMAC-SHA instead of CRC32 */
	if( sessionInfoPtr->flags & SESSION_ISCRYPTLIB )
		{
		setMessageCreateObjectInfo( &createInfo, CRYPT_ALGO_HMAC_SHA );
		status = krnlSendMessage( SYSTEM_OBJECT_HANDLE,
								  IMESSAGE_DEV_CREATEOBJECT, &createInfo,
								  OBJECT_TYPE_CONTEXT );
		if( cryptStatusError( status ) )
			return( status );
		sessionInfoPtr->iAuthInContext = createInfo.cryptHandle;
		}

	/* Process the server public key packet:

		byte[8]		cookie
		uint32		keysize_bits		- Usually 768 bits
		mpint		serverkey_exponent
		mpint		serverkey_modulus
		uint32		keysize_bits		- Usually 1024 bits
		mpint		hostkey_exponent
		mpint		hostkey_modulus
		uint32		protocol_flags		- Not used
		uint32		offered_ciphers
		uint32		offered_authent */
	length = readPacketSSH1( sessionInfoPtr, SSH1_SMSG_PUBLIC_KEY );
	if( cryptStatusError( length ) )
		return( length );
	bufPtr = sessionInfoPtr->receiveBuffer;
	memcpy( handshakeInfo->cookie, bufPtr, SSH1_COOKIE_SIZE );
	bufPtr += SSH1_COOKIE_SIZE;
	length -= SSH1_COOKIE_SIZE;
	keyDataLength = status = processPublickeyData( handshakeInfo, bufPtr,
												   length, TRUE, NULL );
	if( cryptStatusError( status ) )
		return( status );
	setMessageData( &msgData, bufPtr, keyDataLength );
	status = krnlSendMessage( handshakeInfo->iServerCryptContext,
							  IMESSAGE_SETATTRIBUTE_S, &msgData,
							  CRYPT_IATTRIBUTE_KEY_SSH1 );
	if( cryptStatusError( status ) )
		return( status );
	serverKeyLength = mgetLong( bufPtr );
	bufPtr += keyDataLength - LENGTH_SIZE;
	length -= keyDataLength;
	keyDataLength = status = processPublickeyData( handshakeInfo, bufPtr,
												   length, FALSE,
												   sessionInfoPtr );
	if( cryptStatusError( status ) )
		return( status );
	setMessageData( &msgData, bufPtr, keyDataLength );
	status = krnlSendMessage( sessionInfoPtr->iKeyexCryptContext,
							  IMESSAGE_SETATTRIBUTE_S, &msgData,
							  CRYPT_IATTRIBUTE_KEY_SSH1 );
	if( cryptStatusError( status ) )
		return( status );
	hostKeyLength = mgetLong( bufPtr );
	bufPtr += keyDataLength - LENGTH_SIZE + UINT_SIZE;	/* Skip protocol flags */
	length -= keyDataLength + UINT_SIZE;
	if( length != UINT_SIZE + UINT_SIZE )
		retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
				"Invalid length %d, should be %d", length,
				UINT_SIZE + UINT_SIZE );
	value = ( int ) mgetLong( bufPtr );		/* Offered ciphers */
	sessionInfoPtr->cryptAlgo = maskToAlgoID( value );
	if( sessionInfoPtr->cryptAlgo == CRYPT_ALGO_NONE )
		retExt( sessionInfoPtr, CRYPT_ERROR_NOTAVAIL,
				"No crypto algorithm compatible with the remote system "
				"could be found" );
	value = ( int ) mgetLong( bufPtr );		/* Offered authentication */
	pwOK = hasPassword && ( value & ( 1 << SSH1_AUTH_PASSWORD ) );
	rsaOK = hasPrivkey && ( value & ( 1 << SSH1_AUTH_RSA ) );
	if( !pwOK )
		{
		/* If neither RSA nor password authentication is possible, we can't
		   authenticate ourselves */
		if( !rsaOK )
			{
			if( value & ( 1 << SSH1_AUTH_PASSWORD ) )
				{
				setErrorInfo( sessionInfoPtr, CRYPT_SESSINFO_PASSWORD,
							  CRYPT_ERRTYPE_ATTR_ABSENT );
				retExt( sessionInfoPtr, CRYPT_ERROR_NOTINITED,
						"Server requested password authentication but no "
						"password was available" );
				}
			setErrorInfo( sessionInfoPtr, CRYPT_SESSINFO_PRIVATEKEY,
						  CRYPT_ERRTYPE_ATTR_ABSENT );
			retExt( sessionInfoPtr, CRYPT_ERROR_NOTINITED,
					"Server requested public-key authentication but no "
					"key was available" );
			}

		/* Either the client or the server won't do passwords, turn it off
		   explicitly at the client in case it's the server */
		if( hasPassword )
			{
			ATTRIBUTE_LIST *attributeListPtr = ( ATTRIBUTE_LIST * ) \
					findSessionAttribute( sessionInfoPtr->attributeList,
										  CRYPT_SESSINFO_PASSWORD );

			deleteSessionAttribute( &sessionInfoPtr->attributeList,
									attributeListPtr );
			}
		}

	/* Although in theory the server key has to fit inside the host key, the
	   spec is vague enough to allow either of the keys to be larger (and at
	   least one SSH implementation has them the wrong way around), requiring
	   that the two be swapped before they can be used (which makes you
	   wonder why there's any distinction, since the two must be
	   interchangeable in order for this to work) */
	if( hostKeyLength < serverKeyLength )
		{
		int temp;

		/* Swap the two keys around */
		temp = sessionInfoPtr->iKeyexCryptContext;
		sessionInfoPtr->iKeyexCryptContext = \
								handshakeInfo->iServerCryptContext;
		handshakeInfo->iServerCryptContext = temp;
		temp = hostKeyLength;
		hostKeyLength = serverKeyLength;
		serverKeyLength = temp;
		}

	/* Make sure that the smaller of the two keys will fit inside the
	   larger */
	if( hostKeyLength < serverKeyLength + 128 )
		retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
				"Invalid host vs.server key lengths %d:%d bytes",
				hostKeyLength, serverKeyLength );

	return( CRYPT_OK );
	}

/* Exchange keys with the server */

static int exchangeClientKeys( SESSION_INFO *sessionInfoPtr,
							   SSH_HANDSHAKE_INFO *handshakeInfo )
	{
	MECHANISM_WRAP_INFO mechanismInfo;
	MESSAGE_DATA msgData;
	BYTE buffer[ CRYPT_MAX_PKCSIZE + 8 ];
	BYTE *bufPtr = sessionInfoPtr->sendBuffer;
	int length, dataLength, value, i, status;

	/* Output the start of the session key packet:

		byte		cipher_type
		byte[8]		cookie
		mpint		double_enc_sessionkey
		uint32		protocol_flags */
	switch( sessionInfoPtr->cryptAlgo )
		{
		case CRYPT_ALGO_BLOWFISH:
			value = SSH1_CIPHER_BLOWFISH;
			break;
		case CRYPT_ALGO_DES:
			value = SSH1_CIPHER_DES;
			break;
		case CRYPT_ALGO_IDEA:
			value = SSH1_CIPHER_IDEA;
			break;
		case CRYPT_ALGO_RC4:
			value = SSH1_CIPHER_RC4;
			break;
		default:
			assert( NOTREACHED );
			return( CRYPT_ERROR_NOTAVAIL );
		}
	*bufPtr++ = value;
	memcpy( bufPtr, handshakeInfo->cookie, SSH1_COOKIE_SIZE );
	bufPtr += SSH1_COOKIE_SIZE;

	/* Generate the session ID and secure state information and XOR the
	   secure state with the session ID */
	generateSessionID( handshakeInfo );
	setMessageData( &msgData, handshakeInfo->secretValue, SSH1_SECRET_SIZE );
	status = krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_GETATTRIBUTE_S,
							  &msgData, CRYPT_IATTRIBUTE_RANDOM );
	if( cryptStatusError( status ) )
		return( status );
	handshakeInfo->secretValueLength = SSH1_SECRET_SIZE;
	for( i = 0; i < SSH1_SESSIONID_SIZE; i++ )
		handshakeInfo->secretValue[ i ] ^= handshakeInfo->sessionID[ i ];

	/* Export the secure state information in double-encrypted form,
	   encrypted first with the server key, then with the host key */
	setMechanismWrapInfo( &mechanismInfo, buffer, CRYPT_MAX_PKCSIZE,
						  handshakeInfo->secretValue, SSH1_SECRET_SIZE,
						  CRYPT_UNUSED, handshakeInfo->iServerCryptContext,
						  CRYPT_UNUSED );
	status = krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_DEV_EXPORT,
							  &mechanismInfo, MECHANISM_ENC_PKCS1_RAW );
	if( cryptStatusError( status ) )
		return( status );
	length = mechanismInfo.wrappedDataLength;
	setMechanismWrapInfo( &mechanismInfo,
						  bufPtr + SSH1_MPI_LENGTH_SIZE, CRYPT_MAX_PKCSIZE,
						  buffer, length, CRYPT_UNUSED,
						  sessionInfoPtr->iKeyexCryptContext, CRYPT_UNUSED );
	status = krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_DEV_EXPORT,
							  &mechanismInfo, MECHANISM_ENC_PKCS1_RAW );
	if( cryptStatusError( status ) )
		return( status );
	length = bytesToBits( mechanismInfo.wrappedDataLength );
	mputWord( bufPtr, length );
	bufPtr += mechanismInfo.wrappedDataLength;
	clearMechanismInfo( &mechanismInfo );

	/* XOR the state with the session ID to recover the actual state */
	for( i = 0; i < SSH1_SESSIONID_SIZE; i++ )
		handshakeInfo->secretValue[ i ] ^= handshakeInfo->sessionID[ i ];

	/* Write the various flags */
	mputLong( bufPtr, 0 );		/* Protocol flags */

	/* Move the data up in the buffer to allow for the variable-length
	   padding and send it to the server */
	dataLength = bufPtr - sessionInfoPtr->sendBuffer;
	memmove( sessionInfoPtr->sendBuffer + LENGTH_SIZE + \
			 getPadLength( dataLength ) + ID_SIZE,
			 sessionInfoPtr->sendBuffer, dataLength );
	return( sendPacketSsh1( sessionInfoPtr, SSH1_CMSG_SESSION_KEY,
							dataLength, CRYPT_UNUSED ) );
	}

/* Complete the handshake with the server */

static int completeClientHandshake( SESSION_INFO *sessionInfoPtr,
									SSH_HANDSHAKE_INFO *handshakeInfo )
	{
	const ATTRIBUTE_LIST *userNamePtr = \
				findSessionAttribute( sessionInfoPtr->attributeList,
									  CRYPT_SESSINFO_USERNAME );
	const ATTRIBUTE_LIST *passwordPtr = \
				findSessionAttribute( sessionInfoPtr->attributeList,
									  CRYPT_SESSINFO_PASSWORD );
	BYTE *bufPtr;
	int padLength, modulusLength, length, status;

	/* Set up the security information required for the session */
	status = initSecurityInfoSSH1( sessionInfoPtr, handshakeInfo );
	if( cryptStatusError( status ) )
		return( status );

	/* Read back the server ack and send the user name:
		string		username */
	status = readPacketSSH1( sessionInfoPtr, SSH1_SMSG_SUCCESS );
	if( cryptStatusError( status ) )
		return( status );
	padLength = getPadLength( LENGTH_SIZE + userNamePtr->valueLength );
	bufPtr = sessionInfoPtr->sendBuffer + LENGTH_SIZE + padLength + ID_SIZE;
	encodeString( bufPtr, userNamePtr->value, userNamePtr->valueLength );
	status = sendPacketSsh1( sessionInfoPtr, SSH1_CMSG_USER,
							 LENGTH_SIZE + userNamePtr->valueLength,
							 CRYPT_UNUSED );
	if( cryptStatusError( status ) )
		return( status );

	/* Read back the server ack and send the authentication information if
	   required.  This information is optional, if the server returns a
	   failure packet (converted to an OK_SPECIAL return status) it means
	   authentication is required, otherwise it isn't and we're already
	   logged in */
	status = readPacketSSH1( sessionInfoPtr, SSH1_MSG_SPECIAL_USEROPT );
	if( status == OK_SPECIAL )
		{
		/* If there's a password present, we're using password-based
		   authentication:
			string		password */
		if( passwordPtr != NULL )
			{
			int maxLen, packetType, i;

			/* Since SSHv1 sends the packet length in the clear and uses
			   implicit-length padding, it reveals the length of the
			   encrypted password to an observer.  To get around this, we
			   send a series of packets of length 4...maxLen to the server,
			   one of which is the password, the rest are SSH_MSG_IGNOREs.
			   It's still possible for an attacker who can perform very
			   precise timing measurements to determine which one is the
			   password based on server response time, but it's a lot less
			   problematic than with a single packet.  Unfortunately, it's
			   also possible for an attacker to determine the password packet
			   by checking which one generates the password response, unless
			   the server somehow knows how many packets are coming reads
			   them all in a loop and only then sends a response, which
			   means that this defence isn't as effective as it seems */
			status = CRYPT_OK;
			for( maxLen = 16; maxLen <= passwordPtr->valueLength;
				 maxLen <<= 1 );
			for( i = min( 4, passwordPtr->valueLength );
				 i < maxLen && cryptStatusOK( status ); i++ )
				{
				padLength = getPadLength( LENGTH_SIZE + i );
				bufPtr = sessionInfoPtr->sendBuffer + LENGTH_SIZE + \
													  padLength + ID_SIZE;
				if( i == passwordPtr->valueLength )
					{
					encodeString( bufPtr, passwordPtr->value,
								  passwordPtr->valueLength );
					packetType = SSH1_CMSG_AUTH_PASSWORD;
					}
				else
					{
					MESSAGE_DATA msgData;

					setMessageData( &msgData, sessionInfoPtr->receiveBuffer,
									i );
					krnlSendMessage( SYSTEM_OBJECT_HANDLE,
									 IMESSAGE_GETATTRIBUTE_S, &msgData,
									 CRYPT_IATTRIBUTE_RANDOM_NONCE );
					encodeString( bufPtr, sessionInfoPtr->receiveBuffer, i );
					packetType = SSH1_MSG_IGNORE;
					}
				status = sendPacketSsh1( sessionInfoPtr, packetType,
										 LENGTH_SIZE + i, CRYPT_UNUSED );
				if( cryptStatusOK( status ) && \
					packetType == SSH1_CMSG_AUTH_PASSWORD )
					status = readPacketSSH1( sessionInfoPtr,
											 SSH1_MSG_SPECIAL_PWOPT );
				}
			}
		else
			{
			MECHANISM_WRAP_INFO mechanismInfo;
			MESSAGE_DATA msgData;
			BYTE challenge[ SSH1_CHALLENGE_SIZE + 8 ];
			BYTE response[ SSH1_RESPONSE_SIZE ];
			BYTE modulusBuffer[ ( ( SSH1_MPI_LENGTH_SIZE + \
									CRYPT_MAX_PKCSIZE ) * 2 ) + 8 ];
			BYTE *modulusPtr;

			/* We're using RSA authentication, initially we send just the user's
			   public-key info:

		        mpint	identity_public_modulus

			   First we get the modulus used to identify the client's key.
			   For no adequately explored reason this is only the modulus and
			   not the usual exponent+modulus combination, which means that
			   there's no way for a cryptlib server to identify the public
			   key from it, although at a pinch we could try with e=17, 257,
			   or F4 */
			setMessageData( &msgData, modulusBuffer,
							( SSH1_MPI_LENGTH_SIZE + CRYPT_MAX_PKCSIZE ) * 2 );
			status = krnlSendMessage( sessionInfoPtr->privateKey,
									  IMESSAGE_GETATTRIBUTE_S, &msgData,
									  CRYPT_IATTRIBUTE_KEY_SSH1 );
			if( cryptStatusError( status ) )
				return( status );

			/* Skip the key size and exponent to get to the modulus.  We
			   don't have to perform safety checks here since the data is
			   coming from within cryptlib */
			modulusPtr = modulusBuffer + sizeof( LENGTH_SIZE );
			length = mgetWord( modulusPtr );			/* Exponent */
			length = bitsToBytes( length );
			modulusPtr += length;
			modulusLength = mgetWord( modulusPtr );		/* Modulus */
			modulusLength = bitsToBytes( modulusLength );
			length = SSH1_MPI_LENGTH_SIZE + modulusLength;
			modulusPtr -= SSH1_MPI_LENGTH_SIZE;

			/* Send the modulus to the server */
			padLength = getPadLength( length );
			bufPtr = sessionInfoPtr->sendBuffer + LENGTH_SIZE + \
												  padLength + ID_SIZE;
			memcpy( bufPtr, modulusPtr, length );
			status = sendPacketSsh1( sessionInfoPtr, SSH1_CMSG_AUTH_RSA,
									 length, CRYPT_UNUSED );
			if( cryptStatusOK( status ) )
				status = readPacketSSH1( sessionInfoPtr,
										 SSH1_MSG_SPECIAL_RSAOPT );
			if( cryptStatusError( status ) )
				return( status );

			/* The server recognises our key (no mean feat, considering that
			   e could be anything) and has sent an RSA challenge, decrypt
			   it:

				mpint	encrypted_challenge */
			bufPtr = sessionInfoPtr->receiveBuffer;
			length = mgetWord( bufPtr );
			length = bitsToBytes( length );
			if( length < modulusLength - 8 || length > modulusLength )
				retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
						"Invalid encrypted challenge length %d for modulus "
						"length %d", length, modulusLength );
			setMechanismWrapInfo( &mechanismInfo, bufPtr, length,
								  challenge, SSH1_CHALLENGE_SIZE, CRYPT_UNUSED,
								  sessionInfoPtr->privateKey, CRYPT_UNUSED );
			status = krnlSendMessage( SYSTEM_OBJECT_HANDLE,
									  IMESSAGE_DEV_IMPORT, &mechanismInfo,
									  MECHANISM_ENC_PKCS1_RAW );
			clearMechanismInfo( &mechanismInfo );
			if( cryptStatusError( status ) )
				return( status );

			/* Send the response to the challenge:

				byte[16]	MD5 of decrypted challenge

			   Since this completes the authentication, we expect to see
			   either a success or failure packet once we're done */
			generateChallengeResponse( response, handshakeInfo, challenge );
			padLength = getPadLength( SSH1_RESPONSE_SIZE );
			bufPtr = sessionInfoPtr->sendBuffer + LENGTH_SIZE +
												  padLength + ID_SIZE;
			memcpy( bufPtr, response, SSH1_RESPONSE_SIZE );
			status = sendPacketSsh1( sessionInfoPtr,
									 SSH1_CMSG_AUTH_RSA_RESPONSE,
									 SSH1_RESPONSE_SIZE, CRYPT_UNUSED );
			if( cryptStatusOK( status ) )
				status = readPacketSSH1( sessionInfoPtr,
										 SSH1_MSG_SPECIAL_PWOPT );
			}
		}
	if( cryptStatusError( status ) )
		return( status );

	/* Tell the server to adjust its maximum packet size if required:

		uint32		packet_size */
	if( sessionInfoPtr->sendBufSize < EXTRA_PACKET_SIZE + MAX_PACKET_SIZE )
		{
		const int maxLength = sessionInfoPtr->sendBufSize - \
							  EXTRA_PACKET_SIZE;

		padLength = getPadLength( LENGTH_SIZE );
		bufPtr = sessionInfoPtr->sendBuffer + LENGTH_SIZE + padLength + ID_SIZE;
		mputLong( bufPtr, maxLength );
		status = sendPacketSsh1( sessionInfoPtr, SSH1_CMSG_MAX_PACKET_SIZE,
								 LENGTH_SIZE, CRYPT_UNUSED );
		if( cryptStatusOK( status ) )
			status = readPacketSSH1( sessionInfoPtr, SSH1_SMSG_SUCCESS );
		if( cryptStatusError( status ) )
			return( status );
		}

	/* Request a pty from the server:

		string		TERM environment variable = "vt100"
		uint32		rows = 24
		uint32		cols = 80
		uint32		pixel_width = 0
		uint32		pixel_height = 0
		byte		tty_mode_info = 0 */
	padLength = getPadLength( ( LENGTH_SIZE + 5 ) + ( UINT_SIZE * 4 ) + 1 );
	bufPtr = sessionInfoPtr->sendBuffer + LENGTH_SIZE + padLength + ID_SIZE;
	bufPtr += encodeString( bufPtr, "vt100", 0 );	/* Generic terminal type */
	mputLong( bufPtr, 24 );
	mputLong( bufPtr, 80 );			/* 24 x 80 */
	mputLong( bufPtr, 0 );
	mputLong( bufPtr, 0 );			/* No graphics capabilities */
	*bufPtr = 0;					/* No special TTY modes */
	status = sendPacketSsh1( sessionInfoPtr, SSH1_CMSG_REQUEST_PTY,
							 ( LENGTH_SIZE + 5 ) + ( UINT_SIZE * 4 ) + 1,
							 CRYPT_UNUSED );
	if( cryptStatusOK( status ) )
		status = readPacketSSH1( sessionInfoPtr, SSH1_SMSG_SUCCESS );
	if( cryptStatusError( status ) )
		return( status );

	/* Tell the server to create a shell for us.  This moves the server into
	   the interactive session mode, if we're talking to a standard Unix
	   server implementing a remote shell we could read the stdout data
	   response from starting the shell but this may not be the case so we
	   leave the response for the user to process explicitly */
	return( sendPacketSsh1( sessionInfoPtr, SSH1_CMSG_EXEC_SHELL, 0,
							CRYPT_UNUSED ) );
	}

/****************************************************************************
*																			*
*							Server-side Connect Functions					*
*																			*
****************************************************************************/

/* Perform the initial part of the handshake with the client */

static int beginServerHandshake( SESSION_INFO *sessionInfoPtr,
								 SSH_HANDSHAKE_INFO *handshakeInfo )
	{
	MESSAGE_CREATEOBJECT_INFO createInfo;
	MESSAGE_DATA msgData;
	BYTE *bufPtr = sessionInfoPtr->sendBuffer;
	static const int keyLength = bitsToBytes( 768 );
	long value;
	int length, status;

	krnlSendMessage( sessionInfoPtr->privateKey, IMESSAGE_GETATTRIBUTE,
					 &handshakeInfo->serverKeySize, CRYPT_CTXINFO_KEYSIZE );

	/* Generate the 768-bit RSA server key.  It would be better to do this
	   before the listen on the socket, but we can't do it until we know that
	   the client is v1, which we only know after the initial message
	   exchange */
	setMessageCreateObjectInfo( &createInfo, CRYPT_ALGO_RSA );
	status = krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_DEV_CREATEOBJECT,
							  &createInfo, OBJECT_TYPE_CONTEXT );
	if( cryptStatusError( status ) )
		return( status );
	setMessageData( &msgData, "SSH server key", 14 );
	status = krnlSendMessage( createInfo.cryptHandle,
							  IMESSAGE_SETATTRIBUTE_S, &msgData,
							  CRYPT_CTXINFO_LABEL );
	if( cryptStatusOK( status ) )
		status = krnlSendMessage( createInfo.cryptHandle,
								  IMESSAGE_SETATTRIBUTE, ( int * ) &keyLength,
								  CRYPT_CTXINFO_KEYSIZE );
	if( cryptStatusOK( status ) )
		status = krnlSendMessage( createInfo.cryptHandle,
								  IMESSAGE_CTX_GENKEY, NULL, FALSE );
	if( cryptStatusError( status ) )
		{
		krnlSendNotifier( createInfo.cryptHandle, IMESSAGE_DECREFCOUNT );
		return( status );
		}
	handshakeInfo->iServerCryptContext = createInfo.cryptHandle;

	/* Send the server public key packet:

		byte[8]		cookie
		uint32		keysize_bits		- Usually 768 bits
		mpint		serverkey_exponent
		mpint		serverkey_modulus
		uint32		keysize_bits		- Usually 1024 bits
		mpint		hostkey_exponent
		mpint		hostkey_modulus
		uint32		protocol_flags		- Not used
		uint32		offered_ciphers
		uint32		offered_authent */
	setMessageData( &msgData, handshakeInfo->cookie, SSH1_COOKIE_SIZE );
	status = krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_GETATTRIBUTE_S,
							  &msgData, CRYPT_IATTRIBUTE_RANDOM_NONCE );
	if( cryptStatusError( status ) )
		return( status );
	memcpy( bufPtr, handshakeInfo->cookie, SSH1_COOKIE_SIZE );
	bufPtr += SSH1_COOKIE_SIZE;
	setMessageData( &msgData, bufPtr, LENGTH_SIZE + \
					( ( SSH1_MPI_LENGTH_SIZE + CRYPT_MAX_PKCSIZE ) * 2 ) );
	status = krnlSendMessage( handshakeInfo->iServerCryptContext,
							  IMESSAGE_GETATTRIBUTE_S, &msgData,
							  CRYPT_IATTRIBUTE_KEY_SSH1 );
	if( cryptStatusError( status ) )
		return( status );
	length = processPublickeyData( handshakeInfo, bufPtr, msgData.length,
								   TRUE, NULL );
	bufPtr += length;
	setMessageData( &msgData, bufPtr, LENGTH_SIZE + \
					( ( SSH1_MPI_LENGTH_SIZE + CRYPT_MAX_PKCSIZE ) * 2 ) );
	status = krnlSendMessage( sessionInfoPtr->privateKey,
							  IMESSAGE_GETATTRIBUTE_S, &msgData,
							  CRYPT_IATTRIBUTE_KEY_SSH1 );
	if( cryptStatusError( status ) )
		return( status );
	length = processPublickeyData( handshakeInfo, bufPtr, msgData.length,
								   FALSE, NULL );
	bufPtr += length;
	mputLong( bufPtr, 0 );		/* No protocol flags */
	value = getAlgorithmMask();
	mputLong( bufPtr, value );	/* Cipher algorithms */
	value = 1 << SSH1_AUTH_PASSWORD;
	if( sessionInfoPtr->cryptKeyset != CRYPT_ERROR )
		value |= 1 << SSH1_AUTH_RSA;
	mputLong( bufPtr, value );	/* Authent algorithms */

	/* Move the data up in the buffer to allow for the variable-length
	   padding and send it to the client */
	length = bufPtr - sessionInfoPtr->sendBuffer;
	memmove( sessionInfoPtr->sendBuffer + LENGTH_SIZE + \
			 getPadLength( length ) + ID_SIZE, sessionInfoPtr->sendBuffer,
			 length );
	status = sendPacketSsh1( sessionInfoPtr, SSH1_SMSG_PUBLIC_KEY, length,
							 CRYPT_UNUSED );
	if( cryptStatusError( status ) )
		return( status );

	/* If the peer is using cryptlib, we use HMAC-SHA instead of CRC32 */
	if( sessionInfoPtr->flags & SESSION_ISCRYPTLIB )
		{
		setMessageCreateObjectInfo( &createInfo, CRYPT_ALGO_HMAC_SHA );
		status = krnlSendMessage( SYSTEM_OBJECT_HANDLE,
								  IMESSAGE_DEV_CREATEOBJECT, &createInfo,
								  OBJECT_TYPE_CONTEXT );
		if( cryptStatusError( status ) )
			return( status );
		sessionInfoPtr->iAuthInContext = createInfo.cryptHandle;
		}

	return( CRYPT_OK );
	}

/* Exchange keys with the client */

static int exchangeServerKeys( SESSION_INFO *sessionInfoPtr,
							   SSH_HANDSHAKE_INFO *handshakeInfo )
	{
	MECHANISM_WRAP_INFO mechanismInfo;
	BYTE buffer[ CRYPT_MAX_PKCSIZE + 8 ];
	BYTE *bufPtr = sessionInfoPtr->receiveBuffer;
	int length, keyLength, i, status;

	/* Read the client's encrypted session key info:

		byte		cipher_type
		byte[8]		cookie
		mpint		double_enc_sessionkey
		uint32		protocol_flags */
	length = readPacketSSH1( sessionInfoPtr, SSH1_CMSG_SESSION_KEY );
	if( cryptStatusError( length ) )
		return( length );
	sessionInfoPtr->cryptAlgo = sshIDToAlgoID( bufPtr[ 0 ] );
	if( sessionInfoPtr->cryptAlgo == CRYPT_ALGO_NONE )
		retExt( sessionInfoPtr, CRYPT_ERROR_NOTAVAIL,
				"No crypto algorithm compatible with the remote system "
				"could be found" );
	if( memcmp( bufPtr + 1, handshakeInfo->cookie, SSH1_COOKIE_SIZE ) )
		retExt( sessionInfoPtr, CRYPT_ERROR_INVALID,
				"Client cookie doesn't match server cookie" );
	bufPtr += 1 + SSH1_COOKIE_SIZE;
	length -= 1 + SSH1_COOKIE_SIZE;
	keyLength = mgetWord( bufPtr );
	keyLength = bitsToBytes( keyLength );
	if( length != SSH1_MPI_LENGTH_SIZE + keyLength + UINT_SIZE || \
		keyLength < handshakeInfo->serverKeySize - 8 || \
		keyLength > handshakeInfo->serverKeySize )
		retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
				"Invalid encrypted session key packet length %d, key "
				"length %d", length, keyLength );

	/* Import the double-encrypted secure state information, first decrypting
	   with the host key, then with the server key */
	setMechanismWrapInfo( &mechanismInfo, bufPtr, keyLength,
						  buffer, CRYPT_MAX_PKCSIZE, CRYPT_UNUSED,
						  sessionInfoPtr->privateKey, CRYPT_UNUSED );
	status = krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_DEV_IMPORT,
							  &mechanismInfo, MECHANISM_ENC_PKCS1_RAW );
	if( cryptStatusError( status ) )
		return( status );
	setMechanismWrapInfo( &mechanismInfo, buffer, mechanismInfo.keyDataLength,
						  handshakeInfo->secretValue, SSH1_SECRET_SIZE, CRYPT_UNUSED,
						  handshakeInfo->iServerCryptContext, CRYPT_UNUSED );
	status = krnlSendMessage( SYSTEM_OBJECT_HANDLE, IMESSAGE_DEV_IMPORT,
							  &mechanismInfo, MECHANISM_ENC_PKCS1_RAW );
	if( cryptStatusOK( status ) && \
		mechanismInfo.keyDataLength != SSH1_SECRET_SIZE )
		return( CRYPT_ERROR_BADDATA );
	clearMechanismInfo( &mechanismInfo );
	if( cryptStatusError( status ) )
		return( status );
	handshakeInfo->secretValueLength = SSH1_SECRET_SIZE;

	/* Generate the session ID from the handshake info and XOR it with the
	   recovered secure state information to get the final secure state
	   data */
	generateSessionID( handshakeInfo );
	for( i = 0; i < SSH1_SESSIONID_SIZE; i++ )
		handshakeInfo->secretValue[ i ] ^= handshakeInfo->sessionID[ i ];

	return( CRYPT_OK );
	}

/* Complete the handshake with the client */

static int completeServerHandshake( SESSION_INFO *sessionInfoPtr,
									SSH_HANDSHAKE_INFO *handshakeInfo )
	{
	BYTE *bufPtr;
	int packetType, stringLength, length, iterationCount = 0, status;

	/* Set up the security information required for the session */
	status = initSecurityInfoSSH1( sessionInfoPtr, handshakeInfo );
	if( cryptStatusError( status ) )
		return( status );

	/* Send the server ack and read back the user name:

		string		username */
	status = sendPacketSsh1( sessionInfoPtr, SSH1_SMSG_SUCCESS, 0,
							 CRYPT_UNUSED );
	if( cryptStatusOK( status ) )
		length = status = readPacketSSH1( sessionInfoPtr, SSH1_CMSG_USER );
	if( cryptStatusError( status ) )
		return( status );
	bufPtr = sessionInfoPtr->receiveBuffer;
	stringLength = ( int ) mgetLong( bufPtr );
	if( length != LENGTH_SIZE + stringLength || \
		stringLength <= 0 || stringLength > CRYPT_MAX_TEXTSIZE )
		retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
				"Invalid user name packet length %d, name length %d",
				length, stringLength );
	updateSessionAttribute( &sessionInfoPtr->attributeList,
							CRYPT_SESSINFO_USERNAME, bufPtr,
							stringLength, CRYPT_MAX_TEXTSIZE,
							ATTR_FLAG_NONE );

	/* Send the server ack (which is actually a nack since the user needs
	   to submit a password) and read back the password */
	status = sendPacketSsh1( sessionInfoPtr, SSH1_SMSG_FAILURE, 0,
							 CRYPT_UNUSED );
	if( cryptStatusOK( status ) )
		length = status = readPacketSSH1( sessionInfoPtr,
										  SSH1_CMSG_AUTH_PASSWORD );
	if( cryptStatusError( status ) )
		return( status );
	bufPtr = sessionInfoPtr->receiveBuffer;
	stringLength = ( int ) mgetLong( bufPtr );
	if( length != LENGTH_SIZE + stringLength || \
		stringLength <= 0 || stringLength > CRYPT_MAX_TEXTSIZE )
		retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
				"Invalid password packet length %d, password length %d",
				length, stringLength );
	updateSessionAttribute( &sessionInfoPtr->attributeList,
							CRYPT_SESSINFO_PASSWORD, bufPtr,
							stringLength, CRYPT_MAX_TEXTSIZE,
							ATTR_FLAG_NONE );

	/* Send the server ack and process any further junk that the caller may
	   throw at us until we get an exec shell or command request.  At the
	   moment it's set up in allow-all mode, it may be necessary to switch
	   to deny-all instead if clients pop up which submit things that cause
	   problems */
	status = sendPacketSsh1( sessionInfoPtr, SSH1_SMSG_SUCCESS, 0,
							 CRYPT_UNUSED );
	if( cryptStatusError( status ) )
		return( status );
	do
		{
		status = readPacketSSH1( sessionInfoPtr, SSH1_MSG_SPECIAL_ANY );
		if( cryptStatusError( status ) )
			break;
		packetType = sessionInfoPtr->receiveBuffer[ 0 ];
		switch( packetType )
			{
			case SSH1_CMSG_REQUEST_COMPRESSION:
			case SSH1_CMSG_X11_REQUEST_FORWARDING:
			case SSH1_CMSG_PORT_FORWARD_REQUEST:
			case SSH1_CMSG_AGENT_REQUEST_FORWARDING:
				/* Special operations aren't supported by cryptlib */
				status = sendPacketSsh1( sessionInfoPtr, SSH1_SMSG_FAILURE,
										 0, CRYPT_UNUSED );
				break;

			case SSH1_CMSG_EXEC_SHELL:
			case SSH1_CMSG_EXEC_CMD:
				/* These commands move the server into the interactive
				   session mode and aren't explicitly acknowledged */
				break;

			case SSH1_CMSG_REQUEST_PTY:
			default:
				status = sendPacketSsh1( sessionInfoPtr, SSH1_SMSG_SUCCESS,
										 0, CRYPT_UNUSED );
			}
		}
	while( !cryptStatusError( status ) && \
		   ( packetType != SSH1_CMSG_EXEC_SHELL && \
			 packetType != SSH1_CMSG_EXEC_CMD ) && iterationCount++ < 50 );
	if( iterationCount >= 50 )
		retExt( sessionInfoPtr, CRYPT_ERROR_OVERFLOW,
				"Peer sent excessive number of session open packets" );

	return( cryptStatusError( status ) ? status : CRYPT_OK );
	}

/****************************************************************************
*																			*
*								Get/Put Data Functions						*
*																			*
****************************************************************************/

/* Read data over the SSHv1 link */

static int readHeaderFunction( SESSION_INFO *sessionInfoPtr,
							   READSTATE_INFO *readInfo )
	{
	BYTE *bufPtr = sessionInfoPtr->receiveBuffer + \
				   sessionInfoPtr->receiveBufPos;
	long length;
	int status;

	/* Clear return value */
	*readInfo = READINFO_NONE;

	/* Try and read the header data from the remote system */
	assert( sessionInfoPtr->receiveBufPos == sessionInfoPtr->receiveBufEnd );
	status = readFixedHeader( sessionInfoPtr, LENGTH_SIZE );
	if( status <= 0 )
		return( status );

	/* Process the header data.  Since data errors are always fatal, we make
	   all errors fatal until we've finished handling the header */
	*readInfo = READINFO_FATAL;
	assert( status == LENGTH_SIZE );
	length = mgetLong( bufPtr );
	if( length < SSH1_HEADER_SIZE || \
		length > sessionInfoPtr->receiveBufSize - 8 )
		retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
				"Invalid packet length %d", length );

	/* Determine how much data we'll be expecting.  We set the remaining
	   data length to the actual length plus the padding length since we
	   need to read this much to get to the end of the packet */
	sessionInfoPtr->pendingPacketLength = length;
	sessionInfoPtr->pendingPacketRemaining = length + \
				( 8 - ( sessionInfoPtr->pendingPacketLength & 7 ) );

	/* Indicate that we got the header.  Since the header is out-of-band data
	   in SSHv1, we mark it as a no-op read */
	*readInfo = READINFO_NOOP;
	return( OK_SPECIAL );
	}

static int processBodyFunction( SESSION_INFO *sessionInfoPtr,
								READSTATE_INFO *readInfo )
	{
	BYTE *bufPtr = sessionInfoPtr->receiveBuffer + \
				   sessionInfoPtr->receiveBufPos;
	BYTE *bufStartPtr = bufPtr;
	long length;
	int padLength, status;

	/* All errors processing the payload are fatal */
	*readInfo = READINFO_FATAL;

	/* Decrypt the packet in the buffer and checksum the payload */
	padLength = 8 - ( sessionInfoPtr->pendingPacketLength & 7 );
	assert( bufPtr == sessionInfoPtr->receiveBuffer + \
					  sessionInfoPtr->receiveBufEnd - \
					  ( padLength + sessionInfoPtr->pendingPacketLength ) );
	status = decryptPayload( sessionInfoPtr, bufPtr,
							 padLength + sessionInfoPtr->pendingPacketLength );
	if( cryptStatusError( status ) )
		return( status );
	if( !checksumPayload( sessionInfoPtr, bufPtr,
						  padLength + sessionInfoPtr->pendingPacketLength ) )
		retExt( sessionInfoPtr, CRYPT_ERROR_SIGNATURE,
				"Bad message checksum" );

	/* See what we got */
	bufPtr += padLength;
	if( *bufPtr == SSH1_MSG_IGNORE || *bufPtr == SSH1_MSG_DEBUG || \
		*bufPtr == SSH1_CMSG_WINDOW_SIZE )
		{
		/* Nothing to see here, move along, move along */
		sessionInfoPtr->receiveBufEnd = sessionInfoPtr->receiveBufPos;
		sessionInfoPtr->pendingPacketLength = 0;
		*readInfo = READINFO_NOOP;
		return( OK_SPECIAL );	/* Tell the caller to try again */
		}
	if( *bufPtr == SSH1_MSG_DISCONNECT )
		return( getDisconnectInfoSSH1( sessionInfoPtr,
					sessionInfoPtr->receiveBuffer + padLength + ID_SIZE ) );
	if( *bufPtr == SSH1_SMSG_EXITSTATUS )
		{
		/* Confirm the server exit and bail out */
		sendPacketSsh1( sessionInfoPtr, SSH1_CMSG_EXIT_CONFIRMATION, 0,
						CRYPT_UNUSED );
		sessionInfoPtr->receiveBufEnd = sessionInfoPtr->receiveBufPos;
		sessionInfoPtr->pendingPacketLength = 0;
		return( 0 );
		}
	bufPtr++;

	/* It's payload data, move it down next to the previous data.  This
	   doesn't help performance much, but it shouldn't be a major problem
	   since SSHv1 is deprecated anyway */
	length = mgetLong( bufPtr );
	if( length < 0 || length > sessionInfoPtr->pendingPacketLength - \
							   ( ID_SIZE + LENGTH_SIZE + SSH1_CRC_SIZE ) )
		retExt( sessionInfoPtr, CRYPT_ERROR_BADDATA,
				"Invalid payload length %d", length );
	if( length > 0 )
		memmove( bufStartPtr, bufPtr, length );
	sessionInfoPtr->receiveBufEnd -= padLength + ID_SIZE + LENGTH_SIZE + \
									 SSH1_CRC_SIZE;
	sessionInfoPtr->receiveBufPos = sessionInfoPtr->receiveBufEnd;
	sessionInfoPtr->pendingPacketLength = 0;

	if( length < 1 )
		{
		*readInfo = READINFO_NOOP;
		return( OK_SPECIAL );
		}
	*readInfo = READINFO_NONE;
	return( length );
	}

/* Write data over the SSHv1 link */

static int preparePacketFunction( SESSION_INFO *sessionInfoPtr )
	{
	BYTE *bufPtr = sessionInfoPtr->sendBuffer + \
				   SSH1_MAX_HEADER_SIZE - LENGTH_SIZE;
	const int dataLength = sessionInfoPtr->sendBufPos - SSH1_MAX_HEADER_SIZE;
	const int delta = SSH1_MAX_HEADER_SIZE - \
					( LENGTH_SIZE + getPadLength( LENGTH_SIZE + dataLength ) + \
					  ID_SIZE + LENGTH_SIZE );

	/* Wrap up the payload ready for sending.  This doesn't actually send
	   the data since we're specifying the delta parameter, which tells the
	   send-packet code that it's an interruptible write that'll be handled
	   by the caller:

		string		data */
	mputLong( bufPtr, dataLength );
	return( sendPacketSsh1( sessionInfoPtr, isServer( sessionInfoPtr ) ? \
								SSH1_SMSG_STDOUT_DATA : SSH1_CMSG_STDIN_DATA,
							LENGTH_SIZE + dataLength, delta ) );
	}

/* Close a previously-opened SSH session */

static void shutdownFunction( SESSION_INFO *sessionInfoPtr )
	{
	sNetDisconnect( &sessionInfoPtr->stream );
	}

/****************************************************************************
*																			*
*							Session Access Routines							*
*																			*
****************************************************************************/

void initSSH1processing( SESSION_INFO *sessionInfoPtr,
						 SSH_HANDSHAKE_INFO *handshakeInfo,
						 const BOOLEAN isServer )
	{
	static const PROTOCOL_INFO protocolInfo = {
		/* General session information */
		FALSE,						/* Request-response protocol */
		SESSION_NONE,				/* Flags */
		SSH_PORT,					/* SSH port */
		SESSION_NEEDS_USERID |		/* Client attributes */
			SESSION_NEEDS_PASSWORD | \
			SESSION_NEEDS_KEYORPASSWORD | \
			SESSION_NEEDS_PRIVKEYCRYPT,
				/* The client private key is optional but if present, it has
				   to be encryption-capable */
		SESSION_NEEDS_PRIVATEKEY |	/* Server attributes */
			SESSION_NEEDS_PRIVKEYCRYPT,
		1, 1, 2,					/* Version 1 */
		NULL, NULL,					/* Content-type */

		/* Protocol-specific information */
		EXTRA_PACKET_SIZE + \
			DEFAULT_PACKET_SIZE,	/* Send/receive buffer size */
		SSH1_MAX_HEADER_SIZE,		/* Payload data start */
		DEFAULT_PACKET_SIZE,		/* (Default) maximum packet size */
		NULL,						/* Alt.transport protocol */
		128							/* Required priv.key size */
			/* The SSHv1 host key has to be at least 1024 bits long so that
			   it can be used to wrap the 768-bit server key */
		};

	sessionInfoPtr->protocolInfo = &protocolInfo;
	sessionInfoPtr->readHeaderFunction = readHeaderFunction;
	sessionInfoPtr->processBodyFunction = processBodyFunction;
	sessionInfoPtr->preparePacketFunction = preparePacketFunction;
	if( handshakeInfo != NULL )
		{
		if( isServer )
			{
			handshakeInfo->beginHandshake = beginServerHandshake;
			handshakeInfo->exchangeKeys = exchangeServerKeys;
			handshakeInfo->completeHandshake = completeServerHandshake;
			}
		else
			{
			handshakeInfo->beginHandshake = beginClientHandshake;
			handshakeInfo->exchangeKeys = exchangeClientKeys;
			handshakeInfo->completeHandshake = completeClientHandshake;
			}
		}

	/* SSHv1 has slightly different data handling than SSHv2, if we're
	   targeted at SSHv2 we need to override the SSHv2 shutdown function
	   with a default one */
	sessionInfoPtr->shutdownFunction = shutdownFunction;
	}
#endif /* USE_SSH1 */
