/*

 * packet.c - packet building functions

 *

 * This file is part of the SSH Library

 *

 * Copyright (c) 2003-2013 by Aris Adamantiadis

 *

 * The SSH Library is free software; you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as published by

 * the Free Software Foundation; either version 2.1 of the License, or (at your

 * option) any later version.

 *

 * The SSH Library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY

 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public

 * License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with the SSH Library; see the file COPYING.  If not, write to

 * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,

 * MA 02111-1307, USA.

 */

#include "config.h"

#include <stdlib.h>

#include <stdio.h>

#include <string.h>

#include <errno.h>

#ifndef _WIN32

#include <netinet/in.h>

#include <arpa/inet.h>

#endif

#include "libssh/priv.h"

#include "libssh/ssh2.h"

#include "libssh/crypto.h"

#include "libssh/buffer.h"

#include "libssh/packet.h"

#include "libssh/socket.h"

#include "libssh/channels.h"

#include "libssh/misc.h"

#include "libssh/session.h"

#include "libssh/messages.h"

#include "libssh/pcap.h"

#include "libssh/kex.h"

#include "libssh/auth.h"

#include "libssh/gssapi.h"

#include "libssh/bytearray.h"

#include "libssh/dh.h"

static ssh_packet_callback default_packet_handlers[]= {

  ssh_packet_disconnect_callback,          // SSH2_MSG_DISCONNECT                 1

  ssh_packet_ignore_callback,              // SSH2_MSG_IGNORE	                    2

  ssh_packet_unimplemented,                // SSH2_MSG_UNIMPLEMENTED              3

  ssh_packet_ignore_callback,              // SSH2_MSG_DEBUG	                    4

#if WITH_SERVER

  ssh_packet_service_request,              // SSH2_MSG_SERVICE_REQUEST	          5

#else

  NULL,

#endif

  ssh_packet_service_accept,               // SSH2_MSG_SERVICE_ACCEPT             6

  ssh_packet_ext_info,                     // SSH2_MSG_EXT_INFO                   7

  NULL, NULL, NULL, NULL, NULL, NULL,

  NULL, NULL, NULL, NULL, NULL, NULL,      //                                     8-19

  ssh_packet_kexinit,                      // SSH2_MSG_KEXINIT	                  20

  ssh_packet_newkeys,                      // SSH2_MSG_NEWKEYS                    21

  NULL, NULL, NULL, NULL, NULL, NULL, NULL,

  NULL,                                    //                                     22-29

#if WITH_SERVER

  ssh_packet_kexdh_init,                   // SSH2_MSG_KEXDH_INIT                 30

                                           // SSH2_MSG_KEX_DH_GEX_REQUEST_OLD     30

#else

  NULL,

#endif

  NULL,                                    // SSH2_MSG_KEXDH_REPLY                31

                                           // SSH2_MSG_KEX_DH_GEX_GROUP           31

  NULL,                                    // SSH2_MSG_KEX_DH_GEX_INIT            32

  NULL,                                    // SSH2_MSG_KEX_DH_GEX_REPLY           33

  NULL,                                    // SSH2_MSG_KEX_DH_GEX_REQUEST         34

  NULL, NULL, NULL, NULL, NULL, NULL,	NULL,

  NULL, NULL, NULL, NULL, NULL, NULL, NULL,

  NULL,                                    //                                     35-49

#if WITH_SERVER

  ssh_packet_userauth_request,             // SSH2_MSG_USERAUTH_REQUEST           50

#else

  NULL,

#endif

  ssh_packet_userauth_failure,             // SSH2_MSG_USERAUTH_FAILURE           51

  ssh_packet_userauth_success,             // SSH2_MSG_USERAUTH_SUCCESS           52

  ssh_packet_userauth_banner,              // SSH2_MSG_USERAUTH_BANNER            53

  NULL,NULL,NULL,NULL,NULL,NULL,           //                                     54-59

  ssh_packet_userauth_pk_ok,               // SSH2_MSG_USERAUTH_PK_OK             60

                                           // SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ  60

                                           // SSH2_MSG_USERAUTH_INFO_REQUEST	  60

                                           // SSH2_MSG_USERAUTH_GSSAPI_RESPONSE   60

  ssh_packet_userauth_info_response,       // SSH2_MSG_USERAUTH_INFO_RESPONSE     61

                                           // SSH2_MSG_USERAUTH_GSSAPI_TOKEN      61

  NULL,                                    //                                     62

  NULL,                             // SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE 63

  NULL,                                    // SSH2_MSG_USERAUTH_GSSAPI_ERROR      64

  NULL,                                    // SSH2_MSG_USERAUTH_GSSAPI_ERRTOK     65

#if defined(WITH_GSSAPI) && defined(WITH_SERVER)

  ssh_packet_userauth_gssapi_mic,          // SSH2_MSG_USERAUTH_GSSAPI_MIC        66

#else /* WITH_GSSAPI && WITH_SERVER */

  NULL,

#endif /* WITH_GSSAPI && WITH_SERVER */

  NULL, NULL,

  NULL, NULL, NULL, NULL, NULL, NULL, NULL,

  NULL, NULL, NULL, NULL,                  //                                     67-79

#ifdef WITH_SERVER

  ssh_packet_global_request,               // SSH2_MSG_GLOBAL_REQUEST             80

#else /* WITH_SERVER */

  NULL,

#endif /* WITH_SERVER */ 

  ssh_request_success,                     // SSH2_MSG_REQUEST_SUCCESS            81

  ssh_request_denied,                      // SSH2_MSG_REQUEST_FAILURE            82

  NULL, NULL, NULL, NULL, NULL, NULL, NULL,//                                     83-89

  ssh_packet_channel_open,                 // SSH2_MSG_CHANNEL_OPEN               90

  ssh_packet_channel_open_conf,            // SSH2_MSG_CHANNEL_OPEN_CONFIRMATION  91

  ssh_packet_channel_open_fail,            // SSH2_MSG_CHANNEL_OPEN_FAILURE       92

  channel_rcv_change_window,               // SSH2_MSG_CHANNEL_WINDOW_ADJUST      93

  channel_rcv_data,                        // SSH2_MSG_CHANNEL_DATA               94

  channel_rcv_data,                        // SSH2_MSG_CHANNEL_EXTENDED_DATA      95

  channel_rcv_eof,                         // SSH2_MSG_CHANNEL_EOF	              96

  channel_rcv_close,                       // SSH2_MSG_CHANNEL_CLOSE              97

  channel_rcv_request,                     // SSH2_MSG_CHANNEL_REQUEST            98

  ssh_packet_channel_success,              // SSH2_MSG_CHANNEL_SUCCESS            99

  ssh_packet_channel_failure,              // SSH2_MSG_CHANNEL_FAILURE            100

};

/** @internal

 * @brief check if the received packet is allowed for the current session state

 * @param session current ssh_session

 * @returns SSH_PACKET_ALLOWED if the packet is allowed; SSH_PACKET_DENIED

 * if the packet arrived in wrong state; SSH_PACKET_UNKNOWN if the packet type

 * is unknown

 */

static enum ssh_packet_filter_result_e ssh_packet_incoming_filter(ssh_session session)

{

    enum ssh_packet_filter_result_e rc;

#ifdef DEBUG_PACKET

    SSH_LOG(SSH_LOG_PACKET, "Filtering packet type %d",

            session->in_packet.type);

#endif

    switch(session->in_packet.type) {

    case SSH2_MSG_DISCONNECT:                         // 1

        /*

         * States required:

         * - None

         *

         * Transitions:

         * - session->socket->state = SSH_SOCKET_CLOSED

         * - session->session_state = SSH_SESSION_STATE_ERROR

         * */

        /* Always allowed */

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_IGNORE:                             // 2

        /*

         * States required:

         * - None

         *

         * Transitions:

         * - None

         * */

        /* Always allowed */

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_UNIMPLEMENTED:                      // 3

        /*

         * States required:

         * - None

         *

         * Transitions:

         * - None

         * */

        /* Always allowed */

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_DEBUG:                              // 4

        /*

         * States required:

         * - None

         *

         * Transitions:

         * - None

         * */

        /* Always allowed */

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_SERVICE_REQUEST:                    // 5

        /* Server only */

        /*

         * States required:

         * - session->session_state == SSH_SESSION_STATE_AUTHENTICATING

         *   or session->session_state == SSH_SESSION_STATE_AUTHENTICATED

         * - session->dh_handshake_state == DH_STATE_FINISHED

         *

         * Transitions:

         * - None

         * */

        /* If this is a client, reject the message */

        if (session->client) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if ((session->session_state != SSH_SESSION_STATE_AUTHENTICATING) &&

            (session->session_state != SSH_SESSION_STATE_AUTHENTICATED))

        {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->dh_handshake_state != DH_STATE_FINISHED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_SERVICE_ACCEPT:                     // 6

        /*

         * States required:

         * - session->session_state == SSH_SESSION_STATE_AUTHENTICATING

         *   or session->session_state == SSH_SESSION_STATE_AUTHENTICATED

         * - session->dh_handshake_state == DH_STATE_FINISHED

         * - session->auth.service_state == SSH_AUTH_SERVICE_SENT

         *

         * Transitions:

         * - auth.service_state = SSH_AUTH_SERVICE_ACCEPTED

         * */

        if ((session->session_state != SSH_SESSION_STATE_AUTHENTICATING) &&

            (session->session_state != SSH_SESSION_STATE_AUTHENTICATED))

        {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->dh_handshake_state != DH_STATE_FINISHED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        /* TODO check if only auth service can be requested */

        if (session->auth.service_state != SSH_AUTH_SERVICE_SENT) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_EXT_INFO:                           // 7

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATING

         *   or session->session_state == SSH_SESSION_STATE_AUTHENTICATED

         *   (re-exchange)

         * - dh_handshake_state == DH_STATE_FINISHED

         *

         * Transitions:

         * - None

         * */

        if ((session->session_state != SSH_SESSION_STATE_AUTHENTICATING) &&

            (session->session_state != SSH_SESSION_STATE_AUTHENTICATED))

        {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->dh_handshake_state != DH_STATE_FINISHED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_KEXINIT:                            // 20

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *   or session_state == SSH_SESSION_STATE_INITIAL_KEX

         * - dh_handshake_state == DH_STATE_INIT

         *   or dh_handshake_state == DH_STATE_INIT_SENT (re-exchange)

         *   or dh_handshake_state == DH_STATE_FINISHED (re-exchange)

         *

         * Transitions:

         * - session->dh_handshake_state = DH_STATE_INIT

         * - session->session_state = SSH_SESSION_STATE_KEXINIT_RECEIVED

         *

         * On server:

         * - session->session_state = SSH_SESSION_STATE_DH

         * */

        if ((session->session_state != SSH_SESSION_STATE_AUTHENTICATED) &&

            (session->session_state != SSH_SESSION_STATE_INITIAL_KEX))

        {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if ((session->dh_handshake_state != DH_STATE_INIT) &&

            (session->dh_handshake_state != DH_STATE_INIT_SENT) &&

            (session->dh_handshake_state != DH_STATE_FINISHED))

        {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_NEWKEYS:                            // 21

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_DH

         * - dh_handshake_state == DH_STATE_NEWKEYS_SENT

         *

         * Transitions:

         * - session->dh_handshake_state = DH_STATE_FINISHED

         * - session->session_state = SSH_SESSION_STATE_AUTHENTICATING

         * if session->flags & SSH_SESSION_FLAG_AUTHENTICATED

         * - session->session_state = SSH_SESSION_STATE_AUTHENTICATED

         * */

        /* If DH has not been started, reject message */

        if (session->session_state != SSH_SESSION_STATE_DH) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        /* Only allowed if dh_handshake_state is in NEWKEYS_SENT state */

        if (session->dh_handshake_state != DH_STATE_NEWKEYS_SENT) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_KEXDH_INIT:                         // 30

      // SSH2_MSG_KEX_ECDH_INIT:                      // 30

      // SSH2_MSG_ECMQV_INIT:                         // 30

      // SSH2_MSG_KEX_DH_GEX_REQUEST_OLD:             // 30

        /* Server only */

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_DH

         * - dh_handshake_state == DH_STATE_INIT

         *

         * Transitions:

         * - session->dh_handshake_state = DH_STATE_INIT_SENT

         * then calls dh_handshake_server which triggers:

         * - session->dh_handhsake_state = DH_STATE_NEWKEYS_SENT

         * */

        if (session->session_state != SSH_SESSION_STATE_DH) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        /* Only allowed if dh_handshake_state is in initial state */

        if (session->dh_handshake_state != DH_STATE_INIT) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_KEXDH_REPLY:                        // 31

      // SSH2_MSG_KEX_ECDH_REPLY:                     // 31

      // SSH2_MSG_ECMQV_REPLY:                        // 31

      // SSH2_MSG_KEX_DH_GEX_GROUP:                   // 31

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_DH

         * - dh_handshake_state == DH_STATE_INIT_SENT

         *   or dh_handshake_state == DH_STATE_REQUEST_SENT (dh-gex)

         *

         * Transitions:

         * - session->dh_handhsake_state = DH_STATE_NEWKEYS_SENT

         * */

        if (session->session_state != SSH_SESSION_STATE_DH) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->dh_handshake_state != DH_STATE_INIT_SENT &&

            session->dh_handshake_state != DH_STATE_REQUEST_SENT) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_KEX_DH_GEX_INIT:                    // 32

        /* TODO Not filtered */

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_KEX_DH_GEX_REPLY:                   // 33

        /* TODO Not filtered */

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_KEX_DH_GEX_REQUEST:                 // 34

        /* TODO Not filtered */

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_USERAUTH_REQUEST:                   // 50

        /* Server only */

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATING

         * - dh_hanshake_state == DH_STATE_FINISHED

         *

         * Transitions:

         * - if authentication was successful:

         *   - session_state = SSH_SESSION_STATE_AUTHENTICATED

         * */

        /* If this is a client, reject the message */

        if (session->client) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->dh_handshake_state != DH_STATE_FINISHED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATING) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_USERAUTH_FAILURE:                   // 51

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATING

         * - dh_hanshake_state == DH_STATE_FINISHED

         * - session->auth.state == SSH_AUTH_STATE_KBDINT_SENT

         *   or session->auth.state == SSH_AUTH_STATE_PUBKEY_OFFER_SENT

         *   or session->auth.state == SSH_AUTH_STATE_PUBKEY_AUTH_SENT

         *   or session->auth.state == SSH_AUTH_STATE_PASSWORD_AUTH_SENT

         *   or session->auth.state == SSH_AUTH_STATE_GSSAPI_MIC_SENT

         *

         * Transitions:

         * - if unpacking failed:

         *   - session->auth.state = SSH_AUTH_ERROR

         * - if failure was partial:

         *   - session->auth.state = SSH_AUTH_PARTIAL

         * - else:

         *   - session->auth.state = SSH_AUTH_STATE_FAILED

         * */

        /* If this is a server, reject the message */

        if (session->server) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->dh_handshake_state != DH_STATE_FINISHED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATING) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_USERAUTH_SUCCESS:                   // 52

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATING

         * - dh_hanshake_state == DH_STATE_FINISHED

         * - session->auth.state == SSH_AUTH_STATE_KBDINT_SENT

         *   or session->auth.state == SSH_AUTH_STATE_PUBKEY_AUTH_SENT

         *   or session->auth.state == SSH_AUTH_STATE_PASSWORD_AUTH_SENT

         *   or session->auth.state == SSH_AUTH_STATE_GSSAPI_MIC_SENT

         *   or session->auth.state == SSH_AUTH_STATE_AUTH_NONE_SENT

         *

         * Transitions:

         * - session->auth.state = SSH_AUTH_STATE_SUCCESS

         * - session->session_state = SSH_SESSION_STATE_AUTHENTICATED

         * - session->flags |= SSH_SESSION_FLAG_AUTHENTICATED

         * - sessions->auth.current_method = SSH_AUTH_METHOD_UNKNOWN

         * */

        /* If this is a server, reject the message */

        if (session->server) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->dh_handshake_state != DH_STATE_FINISHED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATING) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if ((session->auth.state != SSH_AUTH_STATE_KBDINT_SENT) &&

            (session->auth.state != SSH_AUTH_STATE_PUBKEY_AUTH_SENT) &&

            (session->auth.state != SSH_AUTH_STATE_PASSWORD_AUTH_SENT) &&

            (session->auth.state != SSH_AUTH_STATE_GSSAPI_MIC_SENT) &&

            (session->auth.state != SSH_AUTH_STATE_AUTH_NONE_SENT))

        {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_USERAUTH_BANNER:                    // 53

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATING

         *

         * Transitions:

         * - None

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATING) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_USERAUTH_PK_OK:                     // 60

      // SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ:          // 60

      // SSH2_MSG_USERAUTH_INFO_REQUEST:              // 60

      // SSH2_MSG_USERAUTH_GSSAPI_RESPONSE:           // 60

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATING

         * - session->auth.state == SSH_AUTH_STATE_KBDINT_SENT

         *   or

         *   session->auth.state == SSH_AUTH_STATE_GSSAPI_REQUEST_SENT

         *   or

         *   session->auth.state == SSH_AUTH_STATE_PUBKEY_OFFER_SENT

         *

         * Transitions:

         * Depending on the current state, the message is treated

         * differently:

         * - session->auth.state == SSH_AUTH_STATE_KBDINT_SENT

         *   - session->auth.state = SSH_AUTH_STATE_INFO

         * - session->auth.state == SSH_AUTH_STATE_GSSAPI_REQUEST_SENT

         *   - session->auth.state = SSH_AUTH_STATE_GSSAPI_TOKEN

         * - session->auth.state == SSH_AUTH_STATE_PUBKEY_OFFER_SENT

         *   - session->auth.state = SSH_AUTH_STATE_PK_OK

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATING) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if ((session->auth.state != SSH_AUTH_STATE_KBDINT_SENT) &&

            (session->auth.state != SSH_AUTH_STATE_PUBKEY_OFFER_SENT) &&

            (session->auth.state != SSH_AUTH_STATE_GSSAPI_REQUEST_SENT))

        {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_USERAUTH_INFO_RESPONSE:             // 61

      // SSH2_MSG_USERAUTH_GSSAPI_TOKEN:              // 61

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATING

         * - session_state->auth.state == SSH_SESSION_STATE_GSSAPI_TOKEN

         *   or

         *   session_state->auth.state == SSH_SESSION_STATE_INFO

         *

         * Transitions:

         * - None

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATING) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if ((session->auth.state != SSH_AUTH_STATE_INFO) &&

            (session->auth.state != SSH_AUTH_STATE_GSSAPI_TOKEN))

        {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE:  // 63

        /* TODO Not filtered */

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_USERAUTH_GSSAPI_ERROR:              // 64

        /* TODO Not filtered */

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_USERAUTH_GSSAPI_ERRTOK:             // 65

        /* TODO Not filtered */

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_USERAUTH_GSSAPI_MIC:                // 66

        /* Server only */

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATING

         * - session->gssapi->state == SSH_GSSAPI_STATE_RCV_MIC

         *

         * Transitions:

         * Depending on the result of the verification, the states are

         * changed:

         * - SSH_AUTH_SUCCESS:

         *   - session->session_state = SSH_SESSION_STATE_AUTHENTICATED

         *   - session->flags != SSH_SESSION_FLAG_AUTHENTICATED

         * - SSH_AUTH_PARTIAL:

         *   - None

         * - any other case:

         *   - None

         * */

        /* If this is a client, reject the message */

        if (session->client) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->dh_handshake_state != DH_STATE_FINISHED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATING) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_GLOBAL_REQUEST:                     // 80

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *

         * Transitions:

         * - None

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_REQUEST_SUCCESS:                    // 81

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         * - session->global_req_state == SSH_CHANNEL_REQ_STATE_PENDING

         *

         * Transitions:

         * - session->global_req_state == SSH_CHANNEL_REQ_STATE_ACCEPTED

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->global_req_state != SSH_CHANNEL_REQ_STATE_PENDING) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_REQUEST_FAILURE:                    // 82

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         * - session->global_req_state == SSH_CHANNEL_REQ_STATE_PENDING

         *

         * Transitions:

         * - session->global_req_state == SSH_CHANNEL_REQ_STATE_DENIED

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        if (session->global_req_state != SSH_CHANNEL_REQ_STATE_PENDING) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_CHANNEL_OPEN:                       // 90

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *

         * Transitions:

         * - None

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_CHANNEL_OPEN_CONFIRMATION:          // 91

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *

         * Transitions:

         * - channel->state = SSH_CHANNEL_STATE_OPEN

         * - channel->flags &= ~SSH_CHANNEL_FLAG_NOT_BOUND

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_CHANNEL_OPEN_FAILURE:               // 92

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *

         * Transitions:

         * - channel->state = SSH_CHANNEL_STATE_OPEN_DENIED

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_CHANNEL_WINDOW_ADJUST:              // 93

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *

         * Transitions:

         * - None

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_CHANNEL_DATA:                       // 94

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *

         * Transitions:

         * - None

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_CHANNEL_EXTENDED_DATA:              // 95

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *

         * Transitions:

         * - None

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_CHANNEL_EOF:                        // 96

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *

         * Transitions:

         * - None

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_CHANNEL_CLOSE:                      // 97

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *

         * Transitions:

         * - channel->state = SSH_CHANNEL_STATE_CLOSED

         * - channel->flags |= SSH_CHANNEL_FLAG_CLOSED_REMOTE

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_CHANNEL_REQUEST:                    // 98

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED

         *

         * Transitions:

         * - Depends on the request

         * */

        if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED) {

            rc = SSH_PACKET_DENIED;

            break;

        }

        rc = SSH_PACKET_ALLOWED;

        break;

    case SSH2_MSG_CHANNEL_SUCCESS:                    // 99

        /*

         * States required:

         * - session_state == SSH_SESSION_STATE_AUTHENTICATED