From e5f0e711b05c2ec4c2d016a6abaedae2959ddba2 Mon Sep 17 00:00:00 2001

From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Date: Wed, 19 Sep 2018 14:08:28 +0200

Subject: [PATCH 1/8] CVE-2018-10933: Introduced new auth states

Introduced the states SSH_AUTH_STATE_PUBKEY_OFFER_SENT and

SSH_AUTH_STATE_PUBKEY_AUTH_SENT to know when SSH2_MSG_USERAUTH_PK_OK and

SSH2_MSG_USERAUTH_SUCCESS should be expected.

Fixes T101

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

---

 include/libssh/auth.h |  4 ++++

 src/auth.c            | 32 +++++++++++++++++++++-----------

 2 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/include/libssh/auth.h b/include/libssh/auth.h

index 2c0012b0..05754460 100644

--- a/include/libssh/auth.h

+++ b/include/libssh/auth.h

@@ -90,6 +90,10 @@ enum ssh_auth_state_e {

   SSH_AUTH_STATE_GSSAPI_TOKEN,

   /** We have sent the MIC and expecting to be authenticated */

   SSH_AUTH_STATE_GSSAPI_MIC_SENT,

+  /** We have offered a pubkey to check if it is supported */

+  SSH_AUTH_STATE_PUBKEY_OFFER_SENT,

+  /** We have sent pubkey and signature expecting to be authenticated */

+  SSH_AUTH_STATE_PUBKEY_AUTH_SENT,

 };

 /** @internal

diff --git a/src/auth.c b/src/auth.c

index b411f226..964e82a6 100755

--- a/src/auth.c

+++ b/src/auth.c

@@ -85,6 +85,8 @@ static int ssh_auth_response_termination(void *user){

     case SSH_AUTH_STATE_GSSAPI_REQUEST_SENT:

     case SSH_AUTH_STATE_GSSAPI_TOKEN:

     case SSH_AUTH_STATE_GSSAPI_MIC_SENT:

+    case SSH_AUTH_STATE_PUBKEY_AUTH_SENT:

+    case SSH_AUTH_STATE_PUBKEY_OFFER_SENT:

       return 0;

     default:

       return 1;

@@ -137,6 +139,8 @@ static int ssh_userauth_get_response(ssh_session session) {

         case SSH_AUTH_STATE_GSSAPI_REQUEST_SENT:

         case SSH_AUTH_STATE_GSSAPI_TOKEN:

         case SSH_AUTH_STATE_GSSAPI_MIC_SENT:

+        case SSH_AUTH_STATE_PUBKEY_OFFER_SENT:

+        case SSH_AUTH_STATE_PUBKEY_AUTH_SENT:

         case SSH_AUTH_STATE_NONE:

             /* not reached */

             rc = SSH_AUTH_ERROR;

@@ -275,21 +279,27 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_success){

 SSH_PACKET_CALLBACK(ssh_packet_userauth_pk_ok){

 	int rc;

-  SSH_LOG(SSH_LOG_TRACE, "Received SSH_USERAUTH_PK_OK/INFO_REQUEST/GSSAPI_RESPONSE");

+  SSH_LOG(SSH_LOG_TRACE,

+          "Received SSH_USERAUTH_PK_OK/INFO_REQUEST/GSSAPI_RESPONSE");

-  if(session->auth_state==SSH_AUTH_STATE_KBDINT_SENT){

+  if (session->auth_state == SSH_AUTH_STATE_KBDINT_SENT) {

     /* Assuming we are in keyboard-interactive context */

     SSH_LOG(SSH_LOG_TRACE,

-            "keyboard-interactive context, assuming SSH_USERAUTH_INFO_REQUEST");

-    rc=ssh_packet_userauth_info_request(session,type,packet,user);

+            "keyboard-interactive context, "

+            "assuming SSH_USERAUTH_INFO_REQUEST");

+    rc = ssh_packet_userauth_info_request(session, type, packet, user);

 #ifdef WITH_GSSAPI

-  } else if (session->auth_state == SSH_AUTH_STATE_GSSAPI_REQUEST_SENT){

+  } else if (session->auth_state == SSH_AUTH_STATE_GSSAPI_REQUEST_SENT) {

     rc = ssh_packet_userauth_gssapi_response(session, type, packet, user);

 #endif

+  } else if (session->auth_state == SSH_AUTH_STATE_PUBKEY_OFFER_SENT) {

+      session->auth_state = SSH_AUTH_STATE_PK_OK;

+      SSH_LOG(SSH_LOG_TRACE, "Assuming SSH_USERAUTH_PK_OK");

+      rc = SSH_PACKET_USED;

   } else {

-    session->auth_state=SSH_AUTH_STATE_PK_OK;

-    SSH_LOG(SSH_LOG_TRACE, "Assuming SSH_USERAUTH_PK_OK");

-    rc=SSH_PACKET_USED;

+      session->auth_state = SSH_AUTH_STATE_ERROR;

+      SSH_LOG(SSH_LOG_TRACE, "SSH_USERAUTH_PK_OK received in wrong state");

+      rc = SSH_PACKET_USED;

   }

   return rc;

@@ -501,7 +511,7 @@ int ssh_userauth_try_publickey(ssh_session session,

     ssh_string_free(pubkey_s);

-    session->auth_state = SSH_AUTH_STATE_NONE;

+    session->auth_state = SSH_AUTH_STATE_PUBKEY_OFFER_SENT;

     session->pending_call_state = SSH_PENDING_CALL_AUTH_OFFER_PUBKEY;

     rc = packet_send(session);

     if (rc == SSH_ERROR) {

@@ -622,7 +632,7 @@ int ssh_userauth_publickey(ssh_session session,

         goto fail;

     }

-    session->auth_state = SSH_AUTH_STATE_NONE;

+    session->auth_state = SSH_AUTH_STATE_PUBKEY_AUTH_SENT;

     session->pending_call_state = SSH_PENDING_CALL_AUTH_PUBKEY;

     rc = packet_send(session);

     if (rc == SSH_ERROR) {

@@ -706,7 +716,7 @@ static int ssh_userauth_agent_publickey(ssh_session session,

         goto fail;

     }

-    session->auth_state = SSH_AUTH_STATE_NONE;

+    session->auth_state = SSH_AUTH_STATE_PUBKEY_AUTH_SENT;

     session->pending_call_state = SSH_PENDING_CALL_AUTH_AGENT;

     rc = packet_send(session);

     if (rc == SSH_ERROR) {

-- 

2.19.0

From ddea46f890bd5d87669f23b26d676adedaa5f610 Mon Sep 17 00:00:00 2001

From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Date: Wed, 19 Sep 2018 14:12:56 +0200

Subject: [PATCH 2/8] CVE-2018-10933: Introduce

 SSH_AUTH_STATE_PASSWORD_AUTH_SENT

The introduced auth state allows to identify when authentication using

password was tried.

Fixes T101

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

---

 include/libssh/auth.h | 2 ++

 src/auth.c            | 4 +++-

 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/libssh/auth.h b/include/libssh/auth.h

index 05754460..1fc00e20 100644

--- a/include/libssh/auth.h

+++ b/include/libssh/auth.h

@@ -94,6 +94,8 @@ enum ssh_auth_state_e {

   SSH_AUTH_STATE_PUBKEY_OFFER_SENT,

   /** We have sent pubkey and signature expecting to be authenticated */

   SSH_AUTH_STATE_PUBKEY_AUTH_SENT,

+  /** We have sent a password expecting to be authenticated */

+  SSH_AUTH_STATE_PASSWORD_AUTH_SENT,

 };

 /** @internal

diff --git a/src/auth.c b/src/auth.c

index 964e82a6..3719b18a 100755

--- a/src/auth.c

+++ b/src/auth.c

@@ -87,6 +87,7 @@ static int ssh_auth_response_termination(void *user){

     case SSH_AUTH_STATE_GSSAPI_MIC_SENT:

     case SSH_AUTH_STATE_PUBKEY_AUTH_SENT:

     case SSH_AUTH_STATE_PUBKEY_OFFER_SENT:

+    case SSH_AUTH_STATE_PASSWORD_AUTH_SENT:

       return 0;

     default:

       return 1;

@@ -141,6 +142,7 @@ static int ssh_userauth_get_response(ssh_session session) {

         case SSH_AUTH_STATE_GSSAPI_MIC_SENT:

         case SSH_AUTH_STATE_PUBKEY_OFFER_SENT:

         case SSH_AUTH_STATE_PUBKEY_AUTH_SENT:

+        case SSH_AUTH_STATE_PASSWORD_AUTH_SENT:

         case SSH_AUTH_STATE_NONE:

             /* not reached */

             rc = SSH_AUTH_ERROR;

@@ -1173,7 +1175,7 @@ int ssh_userauth_password(ssh_session session,

         goto fail;

     }

-    session->auth_state = SSH_AUTH_STATE_NONE;

+    session->auth_state = SSH_AUTH_STATE_PASSWORD_AUTH_SENT;

     session->pending_call_state = SSH_PENDING_CALL_AUTH_OFFER_PUBKEY;

     rc = packet_send(session);

     if (rc == SSH_ERROR) {

-- 

2.19.0

From acd6a1ca8a332a204b616ab6bef413bee5d3409d Mon Sep 17 00:00:00 2001

From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Date: Wed, 19 Sep 2018 15:55:43 +0200

Subject: [PATCH 3/8] CVE-2018-10933: Introduce SSH_AUTH_STATE_AUTH_NONE_SENT

The introduced auth state allows to identify when a request without

authentication information was sent.

Fixes T101

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

---

 include/libssh/auth.h | 2 ++

 src/auth.c            | 4 +++-

 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/libssh/auth.h b/include/libssh/auth.h

index 1fc00e20..75bc7546 100644

--- a/include/libssh/auth.h

+++ b/include/libssh/auth.h

@@ -96,6 +96,8 @@ enum ssh_auth_state_e {

   SSH_AUTH_STATE_PUBKEY_AUTH_SENT,

   /** We have sent a password expecting to be authenticated */

   SSH_AUTH_STATE_PASSWORD_AUTH_SENT,

+  /** We have sent a request without auth information (method 'none') */

+  SSH_AUTH_STATE_AUTH_NONE_SENT,

 };

 /** @internal

diff --git a/src/auth.c b/src/auth.c

index 3719b18a..2bc73760 100755

--- a/src/auth.c

+++ b/src/auth.c

@@ -88,6 +88,7 @@ static int ssh_auth_response_termination(void *user){

     case SSH_AUTH_STATE_PUBKEY_AUTH_SENT:

     case SSH_AUTH_STATE_PUBKEY_OFFER_SENT:

     case SSH_AUTH_STATE_PASSWORD_AUTH_SENT:

+    case SSH_AUTH_STATE_AUTH_NONE_SENT:

       return 0;

     default:

       return 1;

@@ -143,6 +144,7 @@ static int ssh_userauth_get_response(ssh_session session) {

         case SSH_AUTH_STATE_PUBKEY_OFFER_SENT:

         case SSH_AUTH_STATE_PUBKEY_AUTH_SENT:

         case SSH_AUTH_STATE_PASSWORD_AUTH_SENT:

+        case SSH_AUTH_STATE_AUTH_NONE_SENT:

         case SSH_AUTH_STATE_NONE:

             /* not reached */

             rc = SSH_AUTH_ERROR;

@@ -401,7 +403,7 @@ int ssh_userauth_none(ssh_session session, const char *username) {

         goto fail;

     }

-    session->auth_state = SSH_AUTH_STATE_NONE;

+    session->auth_state = SSH_AUTH_STATE_AUTH_NONE_SENT;

     session->pending_call_state = SSH_PENDING_CALL_AUTH_NONE;

     rc = packet_send(session);

     if (rc == SSH_ERROR) {

-- 

2.19.0

From 7985acb76842ebf27e32e4afddfef55555209e8e Mon Sep 17 00:00:00 2001

From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Date: Wed, 19 Sep 2018 14:23:35 +0200

Subject: [PATCH 4/8] CVE-2018-10933: Set correct state after sending MIC

After sending the client token, the auth state is set as

SSH_AUTH_STATE_GSSAPI_MIC_SENT.  Then this can be expected to be the

state when a USERAUTH_FAILURE or USERAUTH_SUCCESS arrives.

Fixes T101

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

---

 src/gssapi.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/gssapi.c b/src/gssapi.c

index c2b30f6d..9306672a 100644

--- a/src/gssapi.c

+++ b/src/gssapi.c

@@ -943,8 +943,8 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_gssapi_token_client){

         packet_send(session);

     }

     if(maj_stat == GSS_S_COMPLETE){

-        session->auth_state = SSH_AUTH_STATE_NONE;

         ssh_gssapi_send_mic(session);

+        session->auth_state = SSH_AUTH_STATE_GSSAPI_MIC_SENT;

     }

     return SSH_PACKET_USED;

 }

-- 

2.19.0

From 3837a0547f08b160749fed7496316a62d6c11dea Mon Sep 17 00:00:00 2001

From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Date: Wed, 19 Sep 2018 14:30:33 +0200

Subject: [PATCH 5/8] CVE-2018-10933: Check channel state when

 OPEN_CONFIRMATION arrives

When a SSH2_MSG_OPEN_CONFIRMATION arrives, the channel state is checked

to be in SSH_CHANNEL_STATE_OPENING.

Fixes T101

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

---

 src/channels.c | 9 +++++++++

 1 file changed, 9 insertions(+)

diff --git a/src/channels.c b/src/channels.c

index 30c31468..d5d36af5 100644

--- a/src/channels.c

+++ b/src/channels.c

@@ -170,6 +170,15 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open_conf){

       "Received a CHANNEL_OPEN_CONFIRMATION for channel %d:%d",

       channel->local_channel,

       channel->remote_channel);

+

+  if (channel->state != SSH_CHANNEL_STATE_OPENING) {

+      SSH_LOG(SSH_LOG_RARE,

+              "SSH2_MSG_CHANNEL_OPEN_CONFIRMATION received in incorrect "

+              "channel state %d",

+              channel->state);

+      goto error;

+  }

+

   SSH_LOG(SSH_LOG_PROTOCOL,

       "Remote window : %lu, maxpacket : %lu",

       (long unsigned int) channel->remote_window,

-- 

2.19.0

From e5ff7aa410c23954a2963b52e7b721a2d41536f3 Mon Sep 17 00:00:00 2001

From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Date: Wed, 19 Sep 2018 14:37:40 +0200

Subject: [PATCH 6/8] CVE-2018-10933: Check channel state when OPEN_FAILURE

 arrives

When a SSH2_MSG_OPEN_FAILURE arrives, the channel state is checked

to be in SSH_CHANNEL_STATE_OPENING.

Fixes T101

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

---

 src/channels.c | 11 +++++++++++

 1 file changed, 11 insertions(+)

diff --git a/src/channels.c b/src/channels.c

index d5d36af5..538956dd 100644

--- a/src/channels.c

+++ b/src/channels.c

@@ -219,6 +219,14 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open_fail){

       return SSH_PACKET_USED;

   }

+  if (channel->state != SSH_CHANNEL_STATE_OPENING) {

+      SSH_LOG(SSH_LOG_RARE,

+              "SSH2_MSG_CHANNEL_OPEN_FAILURE received in incorrect channel "

+              "state %d",

+              channel->state);

+      goto error;

+  }

+

   ssh_set_error(session, SSH_REQUEST_DENIED,

       "Channel opening failure: channel %u error (%lu) %s",

       channel->local_channel,

@@ -226,6 +234,9 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open_fail){

       error);

   SAFE_FREE(error);

   channel->state=SSH_CHANNEL_STATE_OPEN_DENIED;

+

+error:

+  ssh_set_error(session, SSH_FATAL, "Invalid packet");

   return SSH_PACKET_USED;

 }

-- 

2.19.0

From b9033ad56a498d0642f3258a54a32251278a319e Mon Sep 17 00:00:00 2001

From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

Date: Wed, 19 Sep 2018 15:04:31 +0200

Subject: [PATCH 7/8] CVE-2018-10933: Introduced packet filtering

The packet filter checks required states for the incoming packets and

reject them if they arrived in the wrong state.

Fixes T101

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>

---

 include/libssh/packet.h |   6 +

 src/packet.c            | 787 +++++++++++++++++++++++++++++++++++++++-

 2 files changed, 791 insertions(+), 2 deletions(-)

diff --git a/include/libssh/packet.h b/include/libssh/packet.h

index d8ef35bb..206c0b21 100644

--- a/include/libssh/packet.h

+++ b/include/libssh/packet.h

@@ -43,6 +43,12 @@ enum ssh_packet_state_e {

   PACKET_STATE_PROCESSING

 };

+enum ssh_packet_filter_result_e {

+    SSH_PACKET_UNKNOWN,

+    SSH_PACKET_ALLOWED,

+    SSH_PACKET_DENIED

+};

+

 int packet_send(ssh_session session);

 #ifdef WITH_SSH1

diff --git a/src/packet.c b/src/packet.c

index d16cd165..5a263328 100644

--- a/src/packet.c

+++ b/src/packet.c

@@ -127,6 +127,775 @@ static ssh_packet_callback default_packet_handlers[]= {

   ssh_packet_channel_failure,              // SSH2_MSG_CHANNEL_FAILURE            100

 };

+/** @internal

+ * @brief check if the received packet is allowed for the current session state

+ * @param session current ssh_session

+ * @returns SSH_PACKET_ALLOWED if the packet is allowed; SSH_PACKET_DENIED

+ * if the packet arrived in wrong state; SSH_PACKET_UNKNOWN if the packet type

+ * is unknown

+ */

+static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session session)

+{

+    enum ssh_packet_filter_result_e rc;

+

+#ifdef DEBUG_PACKET

+    SSH_LOG(SSH_LOG_PACKET, "Filtering packet type %d",

+            session->in_packet.type);

+#endif

+

+    switch(session->in_packet.type) {

+    case SSH2_MSG_DISCONNECT:                         // 1

+        /*

+         * States required:

+         * - None

+         *

+         * Transitions:

+         * - session->socket->state = SSH_SOCKET_CLOSED

+         * - session->session_state = SSH_SESSION_STATE_ERROR

+         * */

+

+        /* Always allowed */

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_IGNORE:                             // 2

+        /*

+         * States required:

+         * - None

+         *

+         * Transitions:

+         * - None

+         * */

+

+        /* Always allowed */

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_UNIMPLEMENTED:                      // 3

+        /*

+         * States required:

+         * - None

+         *

+         * Transitions:

+         * - None

+         * */

+

+        /* Always allowed */

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_DEBUG:                              // 4

+        /*

+         * States required:

+         * - None

+         *

+         * Transitions:

+         * - None

+         * */

+

+        /* Always allowed */

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_SERVICE_REQUEST:                    // 5

+        /* Server only */

+

+        /*

+         * States required:

+         * - session->session_state == SSH_SESSION_STATE_AUTHENTICATING

+         *   or session->session_state == SSH_SESSION_STATE_AUTHENTICATED

+         * - session->dh_handshake_state == DH_STATE_FINISHED

+         *

+         * Transitions:

+         * - None

+         * */

+

+        /* If this is a client, reject the message */

+        if (session->client) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        if ((session->session_state != SSH_SESSION_STATE_AUTHENTICATING) &&

+            (session->session_state != SSH_SESSION_STATE_AUTHENTICATED))

+        {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        if (session->dh_handshake_state != DH_STATE_FINISHED) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_SERVICE_ACCEPT:                     // 6

+        /*

+         * States required:

+         * - session->session_state == SSH_SESSION_STATE_AUTHENTICATING

+         *   or session->session_state == SSH_SESSION_STATE_AUTHENTICATED

+         * - session->dh_handshake_state == DH_STATE_FINISHED

+         * - session->auth_service_state == SSH_AUTH_SERVICE_SENT

+         *

+         * Transitions:

+         * - auth_service_state = SSH_AUTH_SERVICE_ACCEPTED

+         * */

+

+        if ((session->session_state != SSH_SESSION_STATE_AUTHENTICATING) &&

+            (session->session_state != SSH_SESSION_STATE_AUTHENTICATED))

+        {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        if (session->dh_handshake_state != DH_STATE_FINISHED) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        /* TODO check if only auth service can be requested */

+        if (session->auth_service_state != SSH_AUTH_SERVICE_SENT) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_KEXINIT:                            // 20

+        /*

+         * States required:

+         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

+         *   or session_state == SSH_SESSION_STATE_INITIAL_KEX

+         * - dh_handshake_state == DH_STATE_INIT

+         *   or dh_handshake_state == DH_STATE_FINISHED (re-exchange)

+         *

+         * Transitions:

+         * - session->dh_handshake_state = DH_STATE_INIT

+         * - session->session_state = SSH_SESSION_STATE_KEXINIT_RECEIVED

+         *

+         * On server:

+         * - session->session_state = SSH_SESSION_STATE_DH

+         * */

+

+        if ((session->session_state != SSH_SESSION_STATE_AUTHENTICATED) &&

+            (session->session_state != SSH_SESSION_STATE_INITIAL_KEX))

+        {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        if ((session->dh_handshake_state != DH_STATE_INIT) &&

+            (session->dh_handshake_state != DH_STATE_FINISHED))

+        {

+            rc = SSH_PACKET_DENIED;

+        }

+

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_NEWKEYS:                            // 21

+        /*

+         * States required:

+         * - session_state == SSH_SESSION_STATE_DH

+         * - dh_handshake_state == DH_STATE_NEWKEYS_SENT

+         *

+         * Transitions:

+         * - session->dh_handshake_state = DH_STATE_FINISHED

+         * - session->session_state = SSH_SESSION_STATE_AUTHENTICATING

+         * if session->flags & SSH_SESSION_FLAG_AUTHENTICATED

+         * - session->session_state = SSH_SESSION_STATE_AUTHENTICATED

+         * */

+

+        /* If DH has not been started, reject message */

+        if (session->session_state != SSH_SESSION_STATE_DH) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        /* Only allowed if dh_handshake_state is in NEWKEYS_SENT state */

+        if (session->dh_handshake_state != DH_STATE_NEWKEYS_SENT) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_KEXDH_INIT:                         // 30

+      // SSH2_MSG_KEX_ECDH_INIT:                      // 30

+      // SSH2_MSG_ECMQV_INIT:                         // 30

+      // SSH2_MSG_KEX_DH_GEX_REQUEST_OLD:             // 30

+

+        /* Server only */

+

+        /*

+         * States required:

+         * - session_state == SSH_SESSION_STATE_DH

+         * - dh_handshake_state == DH_STATE_INIT

+         *

+         * Transitions:

+         * - session->dh_handshake_state = DH_STATE_INIT_SENT

+         * then calls dh_handshake_server which triggers:

+         * - session->dh_handhsake_state = DH_STATE_NEWKEYS_SENT

+         * */

+

+        if (session->session_state != SSH_SESSION_STATE_DH) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        /* Only allowed if dh_handshake_state is in initial state */

+        if (session->dh_handshake_state != DH_STATE_INIT) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_KEXDH_REPLY:                        // 31

+      // SSH2_MSG_KEX_ECDH_REPLY:                     // 31

+      // SSH2_MSG_ECMQV_REPLY:                        // 31

+      // SSH2_MSG_KEX_DH_GEX_GROUP:                   // 31

+

+        /*

+         * States required:

+         * - session_state == SSH_SESSION_STATE_DH

+         * - dh_handshake_state == DH_STATE_INIT_SENT

+         *

+         * Transitions:

+         * - session->dh_handhsake_state = DH_STATE_NEWKEYS_SENT

+         * */

+

+        if (session->session_state != SSH_SESSION_STATE_DH) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        if (session->dh_handshake_state != DH_STATE_INIT_SENT) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_KEX_DH_GEX_INIT:                    // 32

+        /* TODO Not filtered */

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_KEX_DH_GEX_REPLY:                   // 33

+        /* TODO Not filtered */

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_KEX_DH_GEX_REQUEST:                 // 34

+        /* TODO Not filtered */

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_USERAUTH_REQUEST:                   // 50

+        /* Server only */

+

+        /*

+         * States required:

+         * - session_state == SSH_SESSION_STATE_AUTHENTICATING

+         * - dh_hanshake_state == DH_STATE_FINISHED

+         *

+         * Transitions:

+         * - if authentication was successful:

+         *   - session_state = SSH_SESSION_STATE_AUTHENTICATED

+         * */

+

+        /* If this is a client, reject the message */

+        if (session->client) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        if (session->dh_handshake_state != DH_STATE_FINISHED) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATING) {

+            rc = SSH_PACKET_DENIED;

+            break;

+        }

+

+        rc = SSH_PACKET_ALLOWED;

+        break;

+    case SSH2_MSG_USERAUTH_FAILURE:                   // 51

+        /*

+         * States required:

+         * - session_state == SSH_SESSION_STATE_AUTHENTICATING

+         * - dh_hanshake_state == DH_STATE_FINISHED

+         * - session->auth_state == SSH_AUTH_STATE_KBDINT_SENT

+         *   or session->auth_state == SSH_AUTH_STATE_PUBKEY_OFFER_SENT

+         *   or session->auth_state == SSH_AUTH_STATE_PUBKEY_AUTH_SENT

+         *   or session->auth_state == SSH_AUTH_STATE_PASSWORD_AUTH_SENT

+         *   or session->auth_state == SSH_AUTH_STATE_GSSAPI_MIC_SENT

+         *

+         * Transitions:

+         * - if unpacking failed:

+         *   - session->auth_state = SSH_AUTH_ERROR

+         * - if failure was partial:

+         *   - session->auth_state = SSH_AUTH_PARTIAL

+         * - else:

+         *   - session->auth_state = SSH_AUTH_STATE_FAILED

+         * */

+