File 3836-ssh-Split-huge-fsm-in-ssh_connection_handl... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 3836-ssh-Split-huge-fsm-in-ssh_connection_handler.patch of Package erlang (Revision 9dd171ce7ed830ae09b52982720094c8)

Currently displaying revision 9dd171ce7ed830ae09b52982720094c8 , Show latest

From 39741762bae53cd7a2dcb8b8dc4fbeb224475b34 Mon Sep 17 00:00:00 2001
From: Hans Nilsson <hans@erlang.org>
Date: Tue, 2 Feb 2021 09:58:03 +0100
Subject: [PATCH 06/10] ssh: Split huge fsm in ssh_connection_handler

into
        ssh_connection_handler      start, terminate, timers and handling of call, cast, info
        ssh_fsm_kexinit.erl         key exchange fsm, both server and client should be split into two
        ssh_fsm_userauth_server.erl userauth fsm, server side
        ssh_fsm_userauth.erl        userauth fsm, client side
for better readability.
---
 lib/ssh/src/Makefile                    |  20 +-
 lib/ssh/src/ssh.app.src                 |   3 +
 lib/ssh/src/ssh_connection_handler.erl  | 439 +-----------------------
 lib/ssh/src/ssh_fsm.hrl                 |  55 +++
 lib/ssh/src/ssh_fsm_kexinit.erl         | 219 ++++++++++++
 lib/ssh/src/ssh_fsm_userauth_client.erl | 179 ++++++++++
 lib/ssh/src/ssh_fsm_userauth_server.erl | 191 +++++++++++
 7 files changed, 682 insertions(+), 424 deletions(-)
 create mode 100644 lib/ssh/src/ssh_fsm.hrl
 create mode 100644 lib/ssh/src/ssh_fsm_kexinit.erl
 create mode 100644 lib/ssh/src/ssh_fsm_userauth_client.erl
 create mode 100644 lib/ssh/src/ssh_fsm_userauth_server.erl

diff --git a/lib/ssh/src/Makefile b/lib/ssh/src/Makefile
index dd8fcdf99c..4f4b55f5c5 100644
--- a/lib/ssh/src/Makefile
+++ b/lib/ssh/src/Makefile
@@ -69,6 +69,9 @@ MODULES= \
 	ssh_connection_sup \
 	ssh_controller \
 	ssh_file \
+	ssh_fsm_kexinit \
+	ssh_fsm_userauth_client \
+	ssh_fsm_userauth_server \
 	ssh_info \
 	ssh_io \
 	ssh_lib \
@@ -114,7 +117,14 @@ APP_TARGET= $(EBIN)/$(APP_FILE)
 APPUP_SRC= $(APPUP_FILE).src
 APPUP_TARGET= $(EBIN)/$(APPUP_FILE)
 
-INTERNAL_HRL_FILES = ssh_agent.hrl ssh_auth.hrl ssh_connect.hrl ssh_transport.hrl ssh.hrl ssh_xfer.hrl
+INTERNAL_HRL_FILES = \
+	ssh.hrl \
+	ssh_agent.hrl \
+	ssh_auth.hrl \
+	ssh_connect.hrl \
+	ssh_fsm.hrl \
+	ssh_transport.hrl \
+	ssh_xfer.hrl
 
 # ----------------------------------------------------
 # FLAGS
@@ -183,7 +193,13 @@ $(EBIN)/ssh_connection_sup.$(EMULATOR): ssh_connection_sup.erl
 $(EBIN)/ssh_connection.$(EMULATOR): ssh_connection.erl ssh.hrl ssh_connect.hrl \
   ssh_transport.hrl
 $(EBIN)/ssh_connection_handler.$(EMULATOR): ssh_connection_handler.erl ssh.hrl \
-  ssh_transport.hrl ssh_auth.hrl ssh_connect.hrl
+  ssh_transport.hrl ssh_auth.hrl ssh_connect.hrl ssh_fsm.hrl
+$(EBIN)/ssh_fsm_kexint.$(EMULATOR): ssh.hrl \
+  ssh_transport.hrl ssh_auth.hrl ssh_connect.hrl ssh_fsm.hrl
+$(EBIN)/ssh_fsm_userauth_client.$(EMULATOR): ssh.hrl \
+  ssh_transport.hrl ssh_auth.hrl ssh_connect.hrl ssh_fsm.hrl
+$(EBIN)/ssh_fsm_userauth_server.$(EMULATOR): ssh.hrl \
+  ssh_transport.hrl ssh_auth.hrl ssh_connect.hrl ssh_fsm.hrl
 $(EBIN)/ssh_shell.$(EMULATOR): ssh_shell.erl ssh_connect.hrl
 $(EBIN)/ssh_system_sup.$(EMULATOR): ssh_system_sup.erl ssh.hrl
 $(EBIN)/ssh_subsystem_sup.$(EMULATOR): ssh_subsystem_sup.erl
diff --git a/lib/ssh/src/ssh.app.src b/lib/ssh/src/ssh.app.src
index 9ec0d2c9bd..8943e223b8 100644
--- a/lib/ssh/src/ssh.app.src
+++ b/lib/ssh/src/ssh.app.src
@@ -19,6 +19,9 @@
 	     ssh_channel,
 	     ssh_connection,
 	     ssh_connection_handler,
+             ssh_fsm_kexinit,
+             ssh_fsm_userauth_client,
+             ssh_fsm_userauth_server,
 	     ssh_connection_sup,
              ssh_controller,
 	     ssh_daemon_channel,
diff --git a/lib/ssh/src/ssh_connection_handler.erl b/lib/ssh/src/ssh_connection_handler.erl
index ea6d4a87c3..13dfd48a35 100644
--- a/lib/ssh/src/ssh_connection_handler.erl
+++ b/lib/ssh/src/ssh_connection_handler.erl
@@ -35,6 +35,8 @@
 -include("ssh_auth.hrl").
 -include("ssh_connect.hrl").
 
+-include("ssh_fsm.hrl").
+
 %%====================================================================
 %%% Exports
 %%====================================================================
@@ -52,8 +54,13 @@
 	 request/6, request/7,
 	 reply_request/3, 
          global_request/5,
+         handle_ssh_msg_ext_info/2,
 	 send/5,
+         send_bytes/2,
+         send_msg/2,
 	 send_eof/2,
+         send_disconnect/6,
+         send_disconnect/7,
          store/3,
          retrieve/2,
 	 info/1, info/2,
@@ -66,9 +73,6 @@
          prohibited_sock_option/1
 	]).
 
--type connection_ref() :: ssh:connection_ref().
--type channel_id()     :: ssh:channel_id().
-
 %%% Behaviour callbacks
 -export([init/1, callback_mode/0, handle_event/4, terminate/3,
 	 format_status/2, code_change/4]).
@@ -83,12 +87,6 @@
          ssh_dbg_format/2, ssh_dbg_format/3]).
 
 
--define(send_disconnect(Code, DetailedText, StateName, State),
-        send_disconnect(Code, DetailedText, ?MODULE, ?LINE, StateName, State)).
-
--define(send_disconnect(Code, Reason, DetailedText, StateName, State),
-        send_disconnect(Code, Reason, DetailedText, ?MODULE, ?LINE, StateName, State)).
-
 -define(call_disconnectfun_and_log_cond(LogMsg, DetailedText, StateName, D),
         call_disconnectfun_and_log_cond(LogMsg, DetailedText, ?MODULE, ?LINE, StateName, D)).
 
@@ -408,43 +406,6 @@ renegotiate(ConnectionHandler) ->
 alg(ConnectionHandler) ->
     call(ConnectionHandler, get_alg).
 
-%%====================================================================
-%% Internal process state
-%%====================================================================
--record(data, {
-	  starter                               :: pid()
-						 | undefined,
-	  auth_user                             :: string()
-						 | undefined,
-	  connection_state                      :: #connection{}
-						 | undefined,
-	  latest_channel_id         = 0         :: non_neg_integer()
-                                                 | undefined,
-	  transport_protocol                    :: atom()
-                                                 | undefined,	% ex: tcp
-	  transport_cb                          :: atom()
-                                                 | undefined,	% ex: gen_tcp
-	  transport_close_tag                   :: atom()
-                                                 | undefined,	% ex: tcp_closed
-	  ssh_params                            :: #ssh{}
-                                                 | undefined,
-	  socket                                :: gen_tcp:socket()
-                                                 | undefined,
-	  decrypted_data_buffer     = <<>>      :: binary()
-                                                 | undefined,
-	  encrypted_data_buffer     = <<>>      :: binary()
-                                                 | undefined,
-	  aead_data                 = <<>>      :: binary()
-                                                 | undefined,
-	  undecrypted_packet_length             :: undefined | non_neg_integer(),
-	  key_exchange_init_msg                 :: #ssh_msg_kexinit{}
-						 | undefined,
-	  last_size_rekey           = 0         :: non_neg_integer(),
-	  event_queue               = []        :: list(),
-	  inet_initial_recbuf_size              :: pos_integer()
-						 | undefined
-	 }).
-
 %%====================================================================
 %% Intitialisation
 %%====================================================================
@@ -698,8 +659,10 @@ handle_event(internal, {version_exchange,Version}, {hello,Role}, D0) ->
 					 {recbuf, D0#data.inet_initial_recbuf_size}]),
 	    {KeyInitMsg, SshPacket, Ssh} = ssh_transport:key_exchange_init_msg(Ssh1),
 	    send_bytes(SshPacket, D0),
-	    {next_state, {kexinit,Role,init}, D0#data{ssh_params = Ssh,
-						     key_exchange_init_msg = KeyInitMsg}};
+            D = D0#data{ssh_params = Ssh,
+                        key_exchange_init_msg = KeyInitMsg},
+	    {next_state, {kexinit,Role,init}, D, {change_callback_module, ssh_fsm_kexinit}};
+
 	not_supported ->
             {Shutdown, D} =  
                 ?send_disconnect(?SSH_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED,
@@ -709,150 +672,12 @@ handle_event(internal, {version_exchange,Version}, {hello,Role}, D0) ->
 	    {stop, Shutdown, D}
     end;
 
+%%% timeout after tcp:connect but then nothing arrives
 handle_event(internal, no_hello_received, {hello,_Role}=StateName, D0) ->
     {Shutdown, D} =
         ?send_disconnect(?SSH_DISCONNECT_PROTOCOL_ERROR, "No HELLO received", StateName, D0),
     {stop, Shutdown, D};
 		  
-%%% ######## {kexinit, client|server, init|renegotiate} ####
-
-handle_event(internal, {#ssh_msg_kexinit{}=Kex, Payload}, {kexinit,Role,ReNeg},
-	     D = #data{key_exchange_init_msg = OwnKex}) ->
-    Ssh1 = ssh_transport:key_init(peer_role(Role), D#data.ssh_params, Payload),
-    Ssh = case ssh_transport:handle_kexinit_msg(Kex, OwnKex, Ssh1) of
-	      {ok, NextKexMsg, Ssh2} when Role==client ->
-		  send_bytes(NextKexMsg, D),
-		  Ssh2;
-	      {ok, Ssh2} when Role==server ->
-		  Ssh2
-	  end,
-    {next_state, {key_exchange,Role,ReNeg}, D#data{ssh_params=Ssh}};
-
-
-%%% ######## {key_exchange, client|server, init|renegotiate} ####
-
-%%%---- diffie-hellman
-handle_event(internal, #ssh_msg_kexdh_init{} = Msg, {key_exchange,server,ReNeg}, D) ->
-    {ok, KexdhReply, Ssh1} = ssh_transport:handle_kexdh_init(Msg, D#data.ssh_params),
-    send_bytes(KexdhReply, D),
-    {ok, NewKeys, Ssh2} = ssh_transport:new_keys_message(Ssh1),
-    send_bytes(NewKeys, D),
-    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh2),
-    send_bytes(ExtInfo, D),
-    {next_state, {new_keys,server,ReNeg}, D#data{ssh_params=Ssh}};
-
-handle_event(internal, #ssh_msg_kexdh_reply{} = Msg, {key_exchange,client,ReNeg}, D) ->
-    {ok, NewKeys, Ssh1} = ssh_transport:handle_kexdh_reply(Msg, D#data.ssh_params),
-    send_bytes(NewKeys, D),
-    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh1),
-    send_bytes(ExtInfo, D),
-    {next_state, {new_keys,client,ReNeg}, D#data{ssh_params=Ssh}};
-
-%%%---- diffie-hellman group exchange
-handle_event(internal, #ssh_msg_kex_dh_gex_request{} = Msg, {key_exchange,server,ReNeg}, D) ->
-    {ok, GexGroup, Ssh1} = ssh_transport:handle_kex_dh_gex_request(Msg, D#data.ssh_params),
-    send_bytes(GexGroup, D),
-    Ssh = ssh_transport:parallell_gen_key(Ssh1),
-    {next_state, {key_exchange_dh_gex_init,server,ReNeg}, D#data{ssh_params=Ssh}};
-
-handle_event(internal, #ssh_msg_kex_dh_gex_request_old{} = Msg, {key_exchange,server,ReNeg}, D) ->
-    {ok, GexGroup, Ssh1} = ssh_transport:handle_kex_dh_gex_request(Msg, D#data.ssh_params),
-    send_bytes(GexGroup, D),
-    Ssh = ssh_transport:parallell_gen_key(Ssh1),
-    {next_state, {key_exchange_dh_gex_init,server,ReNeg}, D#data{ssh_params=Ssh}};
-
-handle_event(internal, #ssh_msg_kex_dh_gex_group{} = Msg, {key_exchange,client,ReNeg}, D) ->
-    {ok, KexGexInit, Ssh} = ssh_transport:handle_kex_dh_gex_group(Msg, D#data.ssh_params),
-    send_bytes(KexGexInit, D),
-    {next_state, {key_exchange_dh_gex_reply,client,ReNeg}, D#data{ssh_params=Ssh}};
-
-%%%---- elliptic curve diffie-hellman
-handle_event(internal, #ssh_msg_kex_ecdh_init{} = Msg, {key_exchange,server,ReNeg}, D) ->
-    {ok, KexEcdhReply, Ssh1} = ssh_transport:handle_kex_ecdh_init(Msg, D#data.ssh_params),
-    send_bytes(KexEcdhReply, D),
-    {ok, NewKeys, Ssh2} = ssh_transport:new_keys_message(Ssh1),
-    send_bytes(NewKeys, D),
-    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh2),
-    send_bytes(ExtInfo, D),
-    {next_state, {new_keys,server,ReNeg}, D#data{ssh_params=Ssh}};
-
-handle_event(internal, #ssh_msg_kex_ecdh_reply{} = Msg, {key_exchange,client,ReNeg}, D) ->
-    {ok, NewKeys, Ssh1} = ssh_transport:handle_kex_ecdh_reply(Msg, D#data.ssh_params),
-    send_bytes(NewKeys, D),
-    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh1),
-    send_bytes(ExtInfo, D),
-    {next_state, {new_keys,client,ReNeg}, D#data{ssh_params=Ssh}};
-
-
-%%% ######## {key_exchange_dh_gex_init, server, init|renegotiate} ####
-
-handle_event(internal, #ssh_msg_kex_dh_gex_init{} = Msg, {key_exchange_dh_gex_init,server,ReNeg}, D) ->
-    {ok, KexGexReply, Ssh1} =  ssh_transport:handle_kex_dh_gex_init(Msg, D#data.ssh_params),
-    send_bytes(KexGexReply, D),
-    {ok, NewKeys, Ssh2} = ssh_transport:new_keys_message(Ssh1),
-    send_bytes(NewKeys, D),
-    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh2),
-    send_bytes(ExtInfo, D),
-    {next_state, {new_keys,server,ReNeg}, D#data{ssh_params=Ssh}};
-
-
-%%% ######## {key_exchange_dh_gex_reply, client, init|renegotiate} ####
-
-handle_event(internal, #ssh_msg_kex_dh_gex_reply{} = Msg, {key_exchange_dh_gex_reply,client,ReNeg}, D) ->
-    {ok, NewKeys, Ssh1} = ssh_transport:handle_kex_dh_gex_reply(Msg, D#data.ssh_params),
-    send_bytes(NewKeys, D),
-    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh1),
-    send_bytes(ExtInfo, D),
-    {next_state, {new_keys,client,ReNeg}, D#data{ssh_params=Ssh}};
-
-
-%%% ######## {new_keys, client|server} ####
-
-%% First key exchange round:
-handle_event(internal, #ssh_msg_newkeys{} = Msg, {new_keys,client,init}, D0) ->
-    {ok, Ssh1} = ssh_transport:handle_new_keys(Msg, D0#data.ssh_params),
-    %% {ok, ExtInfo, Ssh2} = ssh_transport:ext_info_message(Ssh1),
-    %% send_bytes(ExtInfo, D0),
-    {MsgReq, Ssh} = ssh_auth:service_request_msg(Ssh1),
-    D = send_msg(MsgReq, D0#data{ssh_params = Ssh}),
-    {next_state, {ext_info,client,init}, D};
-
-handle_event(internal, #ssh_msg_newkeys{} = Msg, {new_keys,server,init}, D) ->
-    {ok, Ssh} = ssh_transport:handle_new_keys(Msg, D#data.ssh_params),
-    %% {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh1),
-    %% send_bytes(ExtInfo, D),
-    {next_state, {ext_info,server,init}, D#data{ssh_params=Ssh}};
-
-%% Subsequent key exchange rounds (renegotiation):
-handle_event(internal, #ssh_msg_newkeys{} = Msg, {new_keys,Role,renegotiate}, D) ->
-    {ok, Ssh} = ssh_transport:handle_new_keys(Msg, D#data.ssh_params),
-    %% {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh1),
-    %% send_bytes(ExtInfo, D),
-    {next_state, {ext_info,Role,renegotiate}, D#data{ssh_params=Ssh}};
-
-
-%%% ######## {ext_info, client|server, init|renegotiate} ####
-
-handle_event(internal, #ssh_msg_ext_info{}=Msg, {ext_info,Role,init}, D0) ->
-    D = handle_ssh_msg_ext_info(Msg, D0),
-    {next_state, {service_request,Role}, D};
-
-handle_event(internal, #ssh_msg_ext_info{}=Msg, {ext_info,Role,renegotiate}, D0) ->
-    D = handle_ssh_msg_ext_info(Msg, D0),
-    {next_state, {connected,Role}, D};
-
-handle_event(internal, #ssh_msg_newkeys{}=Msg, {ext_info,_Role,renegotiate}, D) ->
-    {ok, Ssh} = ssh_transport:handle_new_keys(Msg, D#data.ssh_params),
-    {keep_state, D#data{ssh_params = Ssh}};
-    
-
-handle_event(internal, Msg, {ext_info,Role,init}, D) when is_tuple(Msg) ->
-    %% If something else arrives, goto next state and handle the event in that one
-    {next_state, {service_request,Role}, D, [postpone]};
-
-handle_event(internal, Msg, {ext_info,Role,_ReNegFlag}, D) when is_tuple(Msg) ->
-    %% If something else arrives, goto next state and handle the event in that one
-    {next_state, {connected,Role}, D, [postpone]};
 
 %%% ######## {service_request, client|server} ####
 
@@ -862,7 +687,7 @@ handle_event(internal, Msg = #ssh_msg_service_request{name=ServiceName}, StateNa
 	    Ssh0 = #ssh{session_id=SessionId} = D0#data.ssh_params,
 	    {ok, {Reply, Ssh}} = ssh_auth:handle_userauth_request(Msg, SessionId, Ssh0),
             D = send_msg(Reply, D0#data{ssh_params = Ssh}),
-	    {next_state, {userauth,server}, D};
+	    {next_state, {userauth,server}, D, {change_callback_module,ssh_fsm_userauth_server}};
 
 	_ ->
             {Shutdown, D} =  
@@ -878,201 +703,8 @@ handle_event(internal, #ssh_msg_service_accept{name = "ssh-userauth"}, {service_
     D = send_msg(Msg, D0#data{ssh_params = Ssh,
                               auth_user = Ssh#ssh.user
                              }),
-    {next_state, {userauth,client}, D};
-
-
-%%% ######## {userauth, client|server} ####
-
-%%---- userauth request to server
-handle_event(internal, 
-	     Msg = #ssh_msg_userauth_request{service = ServiceName, method = Method},
-	     StateName = {userauth,server},
-	     D0 = #data{ssh_params=Ssh0}) ->
-
-    case {ServiceName, Ssh0#ssh.service, Method} of
-	{"ssh-connection", "ssh-connection", "none"} ->
-	    %% Probably the very first userauth_request but we deny unauthorized login
-	    {not_authorized, _, {Reply,Ssh}} =
-		ssh_auth:handle_userauth_request(Msg, Ssh0#ssh.session_id, Ssh0),
-            D = send_msg(Reply, D0#data{ssh_params = Ssh}),
-	    {keep_state, D};
-	
-	{"ssh-connection", "ssh-connection", Method} ->
-	    %% Userauth request with a method like "password" or so
-	    case lists:member(Method, Ssh0#ssh.userauth_methods) of
-		true ->
-		    %% Yepp! we support this method
-		    case ssh_auth:handle_userauth_request(Msg, Ssh0#ssh.session_id, Ssh0) of
-			{authorized, User, {Reply, Ssh1}} ->
-                            D = #data{ssh_params=Ssh} = 
-                                send_msg(Reply, D0#data{ssh_params = Ssh1}),
-			    D#data.starter ! ssh_connected,
-			    connected_fun(User, Method, D),
-			    {next_state, {connected,server},
-                             D#data{auth_user=User, 
-                                    %% Note: authenticated=true MUST NOT be sent
-                                    %% before send_msg!
-                                    ssh_params = Ssh#ssh{authenticated = true}}};
-			{not_authorized, {User, Reason}, {Reply, Ssh}} when Method == "keyboard-interactive" ->
-			    retry_fun(User, Reason, D0),
-                            D = send_msg(Reply, D0#data{ssh_params = Ssh}),
-			    {next_state, {userauth_keyboard_interactive,server}, D};
-			{not_authorized, {User, Reason}, {Reply, Ssh}} ->
-			    retry_fun(User, Reason, D0),
-                            D = send_msg(Reply, D0#data{ssh_params = Ssh}),
-			    {keep_state, D}
-		    end;
-		false ->
-		    %% No we do not support this method (=/= none)
-		    %% At least one non-erlang client does like this. Retry as the next event
-		    {keep_state_and_data,
-		     [{next_event, internal, Msg#ssh_msg_userauth_request{method="none"}}]
-		    }
-	    end;
-
-	%% {"ssh-connection", Expected, Method} when Expected =/= ServiceName -> Do what?
-	%% {ServiceName,      Expected, Method} when Expected =/= ServiceName -> Do what?
-
-	{ServiceName, _, _} when ServiceName =/= "ssh-connection" ->
-            {Shutdown, D} =  
-                ?send_disconnect(?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
-                                 io_lib:format("Unknown service: ~p",[ServiceName]),
-                                 StateName, D0),
-            {stop, Shutdown, D}
-    end;
-
-%%---- userauth success to client
-handle_event(internal, #ssh_msg_ext_info{}=Msg, {userauth,client}, D0) ->
-    %% FIXME: need new state to receive this msg!
-    D = handle_ssh_msg_ext_info(Msg, D0),
-    {keep_state, D};
-
-handle_event(internal, #ssh_msg_userauth_success{}, {userauth,client}, D=#data{ssh_params = Ssh}) ->
-    ssh_auth:ssh_msg_userauth_result(success),
-    D#data.starter ! ssh_connected,
-    {next_state, {connected,client}, D#data{ssh_params=Ssh#ssh{authenticated = true}}};
-
-
-%%---- userauth failure response to client
-handle_event(internal, #ssh_msg_userauth_failure{}, {userauth,client}=StateName,
-	     #data{ssh_params = #ssh{userauth_methods = []}} = D0) ->
-    {Shutdown, D} =
-        ?send_disconnect(?SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE, 
-                         io_lib:format("User auth failed for: ~p",[D0#data.auth_user]),
-                         StateName, D0),
-    {stop, Shutdown, D};
-handle_event(internal, #ssh_msg_userauth_failure{authentications = Methods}, StateName={userauth,client},
-	     D0 = #data{ssh_params = Ssh0}) ->
-    %% The prefered authentication method failed try next method
-    Ssh1 = case Ssh0#ssh.userauth_methods of
-	       none ->
-		   %% Server tells us which authentication methods that are allowed
-		   Ssh0#ssh{userauth_methods = string:tokens(Methods, ",")};
-	       _ ->
-		   %% We already know...
-		   Ssh0
-	   end,
-    case ssh_auth:userauth_request_msg(Ssh1) of
-        {send_disconnect, Code, Ssh} ->
-            {Shutdown, D} =
-                ?send_disconnect(Code, 
-                                 io_lib:format("User auth failed for: ~p",[D0#data.auth_user]),
-                                 StateName, D0#data{ssh_params = Ssh}),
-	    {stop, Shutdown, D};
-	{"keyboard-interactive", {Msg, Ssh}} ->
-            D = send_msg(Msg, D0#data{ssh_params = Ssh}),
-	    {next_state, {userauth_keyboard_interactive,client}, D};
-	{_Method, {Msg, Ssh}} ->
-            D = send_msg(Msg, D0#data{ssh_params = Ssh}),
-	    {keep_state, D}
-    end;
+    {next_state, {userauth,client}, D, {change_callback_module,ssh_fsm_userauth_client}};
 
-%%---- banner to client
-handle_event(internal, #ssh_msg_userauth_banner{message = Msg}, {userauth,client}, D) ->
-    case D#data.ssh_params#ssh.userauth_quiet_mode of
-	false -> io:format("~s", [Msg]);
-	true -> ok
-    end,
-    keep_state_and_data;
-
-
-%%% ######## {userauth_keyboard_interactive, client|server}
-
-handle_event(internal, #ssh_msg_userauth_info_request{} = Msg, {userauth_keyboard_interactive, client},
-	     #data{ssh_params = Ssh0} = D0) ->
-    case ssh_auth:handle_userauth_info_request(Msg, Ssh0) of
-	{ok, {Reply, Ssh}} ->
-            D = send_msg(Reply, D0#data{ssh_params = Ssh}),
-	    {next_state, {userauth_keyboard_interactive_info_response,client}, D};
-	not_ok ->
-	    {next_state, {userauth,client}, D0, [postpone]}
-    end;
-
-handle_event(internal, #ssh_msg_userauth_info_response{} = Msg, {userauth_keyboard_interactive, server}, D0) ->
-    case ssh_auth:handle_userauth_info_response(Msg, D0#data.ssh_params) of
-	{authorized, User, {Reply, Ssh1}} ->
-            D = #data{ssh_params=Ssh} = 
-                send_msg(Reply, D0#data{ssh_params = Ssh1}),
-	    D#data.starter ! ssh_connected,
-	    connected_fun(User, "keyboard-interactive", D),
-	    {next_state, {connected,server}, D#data{auth_user = User,
-                                                    %% Note: authenticated=true MUST NOT be sent
-                                                    %% before send_msg!
-						    ssh_params = Ssh#ssh{authenticated = true}}};
-	{not_authorized, {User, Reason}, {Reply, Ssh}} ->
-	    retry_fun(User, Reason, D0),
-            D = send_msg(Reply, D0#data{ssh_params = Ssh}),
-	    {next_state, {userauth,server}, D};
-
-	{authorized_but_one_more, _User,  {Reply, Ssh}} ->
-            D = send_msg(Reply, D0#data{ssh_params = Ssh}),
-	    {next_state, {userauth_keyboard_interactive_extra,server}, D}
-    end;
-
-handle_event(internal, #ssh_msg_userauth_info_response{} = Msg, {userauth_keyboard_interactive_extra, server}, D0) ->
-    {authorized, User, {Reply, Ssh1}} =
-        ssh_auth:handle_userauth_info_response({extra,Msg}, D0#data.ssh_params),
-    D = #data{ssh_params=Ssh} = 
-        send_msg(Reply, D0#data{ssh_params = Ssh1}),
-    D#data.starter ! ssh_connected,
-    connected_fun(User, "keyboard-interactive", D),
-    {next_state, {connected,server}, D#data{auth_user = User,
-                                            %% Note: authenticated=true MUST NOT be sent
-                                            %% before send_msg!
-					    ssh_params = Ssh#ssh{authenticated = true}}};
-
-handle_event(internal, #ssh_msg_userauth_failure{}, {userauth_keyboard_interactive, client},
-	     #data{ssh_params = Ssh0} = D0) ->
-    Prefs = [{Method,M,F,A} || {Method,M,F,A} <- Ssh0#ssh.userauth_preference,
-			       Method =/= "keyboard-interactive"],
-    D = D0#data{ssh_params = Ssh0#ssh{userauth_preference=Prefs}},
-    {next_state, {userauth,client}, D, [postpone]};
-
-handle_event(internal, #ssh_msg_userauth_failure{}, {userauth_keyboard_interactive_info_response, client},
-	     #data{ssh_params = Ssh0} = D0) ->
-    Opts = Ssh0#ssh.opts,
-    D = case ?GET_OPT(password, Opts) of
-	    undefined ->
-		D0;
-	    _ ->
-		D0#data{ssh_params =
-			    Ssh0#ssh{opts = ?PUT_OPT({password,not_ok}, Opts)}} % FIXME:intermodule dependency
-	end,
-    {next_state, {userauth,client}, D, [postpone]};
-
-handle_event(internal, #ssh_msg_ext_info{}=Msg, {userauth_keyboard_interactive_info_response, client}, D0) ->
-    %% FIXME: need new state to receive this msg!
-    D = handle_ssh_msg_ext_info(Msg, D0),
-    {keep_state, D};
-
-handle_event(internal, #ssh_msg_userauth_success{}, {userauth_keyboard_interactive_info_response, client}, D) ->
-    {next_state, {userauth,client}, D, [postpone]};
-
-handle_event(internal, #ssh_msg_userauth_info_request{}, {userauth_keyboard_interactive_info_response, client}, D) ->
-    {next_state, {userauth_keyboard_interactive,client}, D, [postpone]};
-
-
-%%% ######## {connected, client|server} ####
 
 %% Skip ext_info messages in connected state (for example from OpenSSH >= 7.7)
 handle_event(internal, #ssh_msg_ext_info{}, {connected,_Role}, D) ->
@@ -1083,7 +715,7 @@ handle_event(internal, {#ssh_msg_kexinit{},_}, {connected,Role}, D0) ->
     D = D0#data{ssh_params = Ssh,
 		key_exchange_init_msg = KeyInitMsg},
     send_bytes(SshPacket, D),
-    {next_state, {kexinit,Role,renegotiate}, D, [postpone]};
+    {next_state, {kexinit,Role,renegotiate}, D, [postpone, {change_callback_module,ssh_fsm_kexinit}]};
 
 handle_event(internal, #ssh_msg_disconnect{description=Desc} = Msg, StateName, D0) ->
     {disconnect, _, RepliesCon} =
@@ -1098,7 +730,7 @@ handle_event(internal, #ssh_msg_ignore{}, _, _) ->
 handle_event(internal, #ssh_msg_unimplemented{}, _, _) ->
     keep_state_and_data;
 
-handle_event(internal, #ssh_msg_debug{} = Msg, _, D) ->
+handle_event(internal, #ssh_msg_debug{} = Msg, _StateName, D) ->
     debug_fun(Msg, D),
     keep_state_and_data;
 
@@ -1893,11 +1525,6 @@ close_transport(#data{transport_cb = Transport,
         _:_ -> ok
     end.
 
-%%--------------------------------------------------------------------
-%% "Invert" the Role
-peer_role(client) -> server;
-peer_role(server) -> client.
-
 %%--------------------------------------------------------------------
 available_hkey_algorithms(client, Options) ->
     case available_hkey_algos(Options) of
@@ -2126,7 +1753,7 @@ start_rekeying(Role, D0) ->
     send_bytes(SshPacket, D0),
     D = D0#data{ssh_params = Ssh,
                 key_exchange_init_msg = KeyInitMsg},
-    {next_state, {kexinit,Role,renegotiate}, D}.
+    {next_state, {kexinit,Role,renegotiate}, D, {change_callback_module,ssh_fsm_kexinit}}.
 
 
 init_renegotiate_timers(_OldState, NewState, D) ->
@@ -2387,8 +2014,6 @@ get_repl(X, Acc) ->
     exit({get_repl,X,Acc}).
 
 %%%----------------------------------------------------------------
--define(CALL_FUN(Key,D), catch (?GET_OPT(Key, (D#data.ssh_params)#ssh.opts)) ).
-
 %%disconnect_fun({disconnect,Msg}, D) -> ?CALL_FUN(disconnectfun,D)(Msg);
 disconnect_fun(Reason, D)           -> ?CALL_FUN(disconnectfun,D)(Reason).
 
@@ -2402,36 +2027,6 @@ debug_fun(#ssh_msg_debug{always_display = Display,
     ?CALL_FUN(ssh_msg_debug_fun,D)(self(), Display, DbgMsg, Lang).
 
 
-connected_fun(User, Method, #data{ssh_params = #ssh{peer = {_,Peer}}} = D) ->
-    ?CALL_FUN(connectfun,D)(User, Peer, Method).
-
-
-retry_fun(_, undefined, _) ->
-    ok;
-retry_fun(User, Reason, #data{ssh_params = #ssh{opts = Opts,
-						peer = {_,Peer}
-					       }}) ->
-    {Tag,Info} =
-	case Reason of
-	    {error, Error} ->
-		{failfun, Error};
-	    _ ->
-		{infofun, Reason}
-	end,
-    Fun = ?GET_OPT(Tag, Opts),
-    try erlang:fun_info(Fun, arity)
-    of
-	{arity, 2} -> %% Backwards compatible
-	    catch Fun(User, Info);
-	{arity, 3} ->
-	    catch Fun(User, Peer, Info);
-	_ ->
-	    ok
-    catch
-	_:_ ->
-	    ok
-    end.
-
 %%%----------------------------------------------------------------
 %%% Cache idle timer that closes the connection if there are no
 %%% channels open for a while.
diff --git a/lib/ssh/src/ssh_fsm.hrl b/lib/ssh/src/ssh_fsm.hrl
new file mode 100644
index 0000000000..2b2903690c
--- /dev/null
+++ b/lib/ssh/src/ssh_fsm.hrl
@@ -0,0 +1,55 @@
+%%====================================================================
+%% Types
+%%====================================================================
+-type connection_ref() :: ssh:connection_ref().
+-type channel_id()     :: ssh:channel_id().
+
+%%====================================================================
+%% Internal process state
+%%====================================================================
+-record(data, {
+	  starter                               :: pid()
+						 | undefined,
+	  auth_user                             :: string()
+						 | undefined,
+	  connection_state                      :: #connection{}
+						 | undefined,
+	  latest_channel_id         = 0         :: non_neg_integer()
+                                                 | undefined,
+	  transport_protocol                    :: atom()
+                                                 | undefined,	% ex: tcp
+	  transport_cb                          :: atom()
+                                                 | undefined,	% ex: gen_tcp
+	  transport_close_tag                   :: atom()
+                                                 | undefined,	% ex: tcp_closed
+	  ssh_params                            :: #ssh{}
+                                                 | undefined,
+	  socket                                :: gen_tcp:socket()
+                                                 | undefined,
+	  decrypted_data_buffer     = <<>>      :: binary()
+                                                 | undefined,
+	  encrypted_data_buffer     = <<>>      :: binary()
+                                                 | undefined,
+	  aead_data                 = <<>>      :: binary()
+                                                 | undefined,
+	  undecrypted_packet_length             :: undefined | non_neg_integer(),
+	  key_exchange_init_msg                 :: #ssh_msg_kexinit{}
+						 | undefined,
+	  last_size_rekey           = 0         :: non_neg_integer(),
+	  event_queue               = []        :: list(),
+	  inet_initial_recbuf_size              :: pos_integer()
+						 | undefined
+	 }).
+
+
+%%====================================================================
+%% Macros
+%%====================================================================
+-define(send_disconnect(Code, DetailedText, StateName, State),
+        ssh_connection_handler:send_disconnect(Code, DetailedText, ?MODULE, ?LINE, StateName, State)).
+
+-define(send_disconnect(Code, Reason, DetailedText, StateName, State),
+        ssh_connection_handler:send_disconnect(Code, Reason, DetailedText, ?MODULE, ?LINE, StateName, State)).
+
+
+-define(CALL_FUN(Key,D), catch (?GET_OPT(Key, (D#data.ssh_params)#ssh.opts)) ).
diff --git a/lib/ssh/src/ssh_fsm_kexinit.erl b/lib/ssh/src/ssh_fsm_kexinit.erl
new file mode 100644
index 0000000000..285f083674
--- /dev/null
+++ b/lib/ssh/src/ssh_fsm_kexinit.erl
@@ -0,0 +1,219 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2008-2020. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+%%
+%%----------------------------------------------------------------------
+%% Purpose: Handles an ssh connection, e.i. both the
+%% setup SSH Transport Layer Protocol (RFC 4253), Authentication
+%% Protocol (RFC 4252) and SSH connection Protocol (RFC 4255)
+%% Details of the different protocols are
+%% implemented in ssh_transport.erl, ssh_auth.erl and ssh_connection.erl
+%% ----------------------------------------------------------------------
+
+-module(ssh_fsm_kexinit).
+
+-include("ssh.hrl").
+-include("ssh_transport.hrl").
+-include("ssh_auth.hrl").
+-include("ssh_connect.hrl").
+
+-include("ssh_fsm.hrl").
+
+%%====================================================================
+%%% Exports
+%%====================================================================
+
+%%% Behaviour callbacks
+-export([callback_mode/0, handle_event/4, terminate/3,
+	 format_status/2, code_change/4]).
+
+%%====================================================================
+%% gen_statem callbacks
+%%====================================================================
+
+callback_mode() ->
+    [handle_event_function,
+     state_enter].
+
+%%--------------------------------------------------------------------
+
+%%% ######## {kexinit, client|server, init|renegotiate} ####
+
+handle_event(internal, {#ssh_msg_kexinit{}=Kex, Payload}, {kexinit,Role,ReNeg},
+	     D = #data{key_exchange_init_msg = OwnKex}) ->
+    Ssh1 = ssh_transport:key_init(peer_role(Role), D#data.ssh_params, Payload),
+    Ssh = case ssh_transport:handle_kexinit_msg(Kex, OwnKex, Ssh1) of
+	      {ok, NextKexMsg, Ssh2} when Role==client ->
+		  ssh_connection_handler:send_bytes(NextKexMsg, D),
+		  Ssh2;
+	      {ok, Ssh2} when Role==server ->
+		  Ssh2
+	  end,
+    {next_state, {key_exchange,Role,ReNeg}, D#data{ssh_params=Ssh}};
+
+
+%%% ######## {key_exchange, client|server, init|renegotiate} ####
+
+%%%---- diffie-hellman
+handle_event(internal, #ssh_msg_kexdh_init{} = Msg, {key_exchange,server,ReNeg}, D) ->
+    {ok, KexdhReply, Ssh1} = ssh_transport:handle_kexdh_init(Msg, D#data.ssh_params),
+    ssh_connection_handler:send_bytes(KexdhReply, D),
+    {ok, NewKeys, Ssh2} = ssh_transport:new_keys_message(Ssh1),
+    ssh_connection_handler:send_bytes(NewKeys, D),
+    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh2),
+    ssh_connection_handler:send_bytes(ExtInfo, D),
+    {next_state, {new_keys,server,ReNeg}, D#data{ssh_params=Ssh}};
+
+handle_event(internal, #ssh_msg_kexdh_reply{} = Msg, {key_exchange,client,ReNeg}, D) ->
+    {ok, NewKeys, Ssh1} = ssh_transport:handle_kexdh_reply(Msg, D#data.ssh_params),
+    ssh_connection_handler:send_bytes(NewKeys, D),
+    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh1),
+    ssh_connection_handler:send_bytes(ExtInfo, D),
+    {next_state, {new_keys,client,ReNeg}, D#data{ssh_params=Ssh}};
+
+%%%---- diffie-hellman group exchange
+handle_event(internal, #ssh_msg_kex_dh_gex_request{} = Msg, {key_exchange,server,ReNeg}, D) ->
+    {ok, GexGroup, Ssh1} = ssh_transport:handle_kex_dh_gex_request(Msg, D#data.ssh_params),
+    ssh_connection_handler:send_bytes(GexGroup, D),
+    Ssh = ssh_transport:parallell_gen_key(Ssh1),
+    {next_state, {key_exchange_dh_gex_init,server,ReNeg}, D#data{ssh_params=Ssh}};
+
+handle_event(internal, #ssh_msg_kex_dh_gex_request_old{} = Msg, {key_exchange,server,ReNeg}, D) ->
+    {ok, GexGroup, Ssh1} = ssh_transport:handle_kex_dh_gex_request(Msg, D#data.ssh_params),
+    ssh_connection_handler:send_bytes(GexGroup, D),
+    Ssh = ssh_transport:parallell_gen_key(Ssh1),
+    {next_state, {key_exchange_dh_gex_init,server,ReNeg}, D#data{ssh_params=Ssh}};
+
+handle_event(internal, #ssh_msg_kex_dh_gex_group{} = Msg, {key_exchange,client,ReNeg}, D) ->
+    {ok, KexGexInit, Ssh} = ssh_transport:handle_kex_dh_gex_group(Msg, D#data.ssh_params),
+    ssh_connection_handler:send_bytes(KexGexInit, D),
+    {next_state, {key_exchange_dh_gex_reply,client,ReNeg}, D#data{ssh_params=Ssh}};
+
+%%%---- elliptic curve diffie-hellman
+handle_event(internal, #ssh_msg_kex_ecdh_init{} = Msg, {key_exchange,server,ReNeg}, D) ->
+    {ok, KexEcdhReply, Ssh1} = ssh_transport:handle_kex_ecdh_init(Msg, D#data.ssh_params),
+    ssh_connection_handler:send_bytes(KexEcdhReply, D),
+    {ok, NewKeys, Ssh2} = ssh_transport:new_keys_message(Ssh1),
+    ssh_connection_handler:send_bytes(NewKeys, D),
+    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh2),
+    ssh_connection_handler:send_bytes(ExtInfo, D),
+    {next_state, {new_keys,server,ReNeg}, D#data{ssh_params=Ssh}};
+
+handle_event(internal, #ssh_msg_kex_ecdh_reply{} = Msg, {key_exchange,client,ReNeg}, D) ->
+    {ok, NewKeys, Ssh1} = ssh_transport:handle_kex_ecdh_reply(Msg, D#data.ssh_params),
+    ssh_connection_handler:send_bytes(NewKeys, D),
+    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh1),
+    ssh_connection_handler:send_bytes(ExtInfo, D),
+    {next_state, {new_keys,client,ReNeg}, D#data{ssh_params=Ssh}};
+
+
+%%% ######## {key_exchange_dh_gex_init, server, init|renegotiate} ####
+
+handle_event(internal, #ssh_msg_kex_dh_gex_init{} = Msg, {key_exchange_dh_gex_init,server,ReNeg}, D) ->
+    {ok, KexGexReply, Ssh1} =  ssh_transport:handle_kex_dh_gex_init(Msg, D#data.ssh_params),
+    ssh_connection_handler:send_bytes(KexGexReply, D),
+    {ok, NewKeys, Ssh2} = ssh_transport:new_keys_message(Ssh1),
+    ssh_connection_handler:send_bytes(NewKeys, D),
+    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh2),
+    ssh_connection_handler:send_bytes(ExtInfo, D),
+    {next_state, {new_keys,server,ReNeg}, D#data{ssh_params=Ssh}};
+
+
+%%% ######## {key_exchange_dh_gex_reply, client, init|renegotiate} ####
+
+handle_event(internal, #ssh_msg_kex_dh_gex_reply{} = Msg, {key_exchange_dh_gex_reply,client,ReNeg}, D) ->
+    {ok, NewKeys, Ssh1} = ssh_transport:handle_kex_dh_gex_reply(Msg, D#data.ssh_params),
+    ssh_connection_handler:send_bytes(NewKeys, D),
+    {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh1),
+    ssh_connection_handler:send_bytes(ExtInfo, D),
+    {next_state, {new_keys,client,ReNeg}, D#data{ssh_params=Ssh}};
+
+
+%%% ######## {new_keys, client|server} ####
+
+%% First key exchange round:
+handle_event(internal, #ssh_msg_newkeys{} = Msg, {new_keys,client,init}, D0) ->
+    {ok, Ssh1} = ssh_transport:handle_new_keys(Msg, D0#data.ssh_params),
+    %% {ok, ExtInfo, Ssh2} = ssh_transport:ext_info_message(Ssh1),
+    %% ssh_connection_handler:send_bytes(ExtInfo, D0),
+    {MsgReq, Ssh} = ssh_auth:service_request_msg(Ssh1),
+    D = ssh_connection_handler:send_msg(MsgReq, D0#data{ssh_params = Ssh}),
+    {next_state, {ext_info,client,init}, D};
+
+handle_event(internal, #ssh_msg_newkeys{} = Msg, {new_keys,server,init}, D) ->
+    {ok, Ssh} = ssh_transport:handle_new_keys(Msg, D#data.ssh_params),
+    %% {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh1),
+    %% ssh_connection_handler:send_bytes(ExtInfo, D),
+    {next_state, {ext_info,server,init}, D#data{ssh_params=Ssh}};
+
+%% Subsequent key exchange rounds (renegotiation):
+handle_event(internal, #ssh_msg_newkeys{} = Msg, {new_keys,Role,renegotiate}, D) ->
+    {ok, Ssh} = ssh_transport:handle_new_keys(Msg, D#data.ssh_params),
+    %% {ok, ExtInfo, Ssh} = ssh_transport:ext_info_message(Ssh1),
+    %% ssh_connection_handler:send_bytes(ExtInfo, D),
+    {next_state, {ext_info,Role,renegotiate}, D#data{ssh_params=Ssh}};
+
+
+%%% ######## {ext_info, client|server, init|renegotiate} ####
+
+handle_event(internal, #ssh_msg_ext_info{}=Msg, {ext_info,Role,init}, D0) ->
+    D = ssh_connection_handler:handle_ssh_msg_ext_info(Msg, D0),
+    {next_state, {service_request,Role}, D, {change_callback_module,ssh_connection_handler}};
+
+handle_event(internal, #ssh_msg_ext_info{}=Msg, {ext_info,Role,renegotiate}, D0) ->
+    D = ssh_connection_handler:handle_ssh_msg_ext_info(Msg, D0),
+    {next_state, {connected,Role}, D, {change_callback_module,ssh_connection_handler}};
+
+handle_event(internal, #ssh_msg_newkeys{}=Msg, {ext_info,_Role,renegotiate}, D) ->
+    {ok, Ssh} = ssh_transport:handle_new_keys(Msg, D#data.ssh_params),
+    {keep_state, D#data{ssh_params = Ssh}};
+    
+
+handle_event(internal, Msg, {ext_info,Role,init}, D) when is_tuple(Msg) ->
+    %% If something else arrives, goto next state and handle the event in that one
+    {next_state, {service_request,Role}, D, [postpone, {change_callback_module,ssh_connection_handler}]};
+
+handle_event(internal, Msg, {ext_info,Role,renegotiate}, D) when is_tuple(Msg) ->
+    %% If something else arrives, goto next state and handle the event in that one
+    {next_state, {connected,Role}, D, [postpone, {change_callback_module,ssh_connection_handler}]};
+
+%%% ######## UNHANDLED EVENT!
+handle_event(Type, Event, StateName, D) ->
+    ssh_connection_handler:handle_event(Type, Event, StateName, D).
+
+%%--------------------------------------------------------------------
+format_status(A, B) ->
+    ssh_connection_handler:format_status(A, B).
+
+%%--------------------------------------------------------------------
+terminate(Reason, StateName, D) ->
+    ssh_connection_handler:terminate(Reason, StateName, D).
+
+%%--------------------------------------------------------------------
+code_change(_OldVsn, StateName, State, _Extra) ->
+    {ok, StateName, State}.
+
+%%====================================================================
+%% Internal functions
+%%====================================================================
+
+%% "Invert" the Role
+peer_role(client) -> server;
+peer_role(server) -> client.
+
diff --git a/lib/ssh/src/ssh_fsm_userauth_client.erl b/lib/ssh/src/ssh_fsm_userauth_client.erl
new file mode 100644
index 0000000000..938070efc2
--- /dev/null
+++ b/lib/ssh/src/ssh_fsm_userauth_client.erl
@@ -0,0 +1,179 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2008-2020. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+%%
+%%----------------------------------------------------------------------
+%% Purpose: Handles an ssh connection, e.i. both the
+%% setup SSH Transport Layer Protocol (RFC 4253), Authentication
+%% Protocol (RFC 4252) and SSH connection Protocol (RFC 4255)
+%% Details of the different protocols are
+%% implemented in ssh_transport.erl, ssh_auth.erl and ssh_connection.erl
+%% ----------------------------------------------------------------------
+
+-module(ssh_fsm_userauth_client).
+
+-include("ssh.hrl").
+-include("ssh_transport.hrl").
+-include("ssh_auth.hrl").
+-include("ssh_connect.hrl").
+
+-include("ssh_fsm.hrl").
+
+%%====================================================================
+%%% Exports
+%%====================================================================
+
+%%% Behaviour callbacks
+-export([callback_mode/0, handle_event/4, terminate/3,
+	 format_status/2, code_change/4]).
+
+%%====================================================================
+%% gen_statem callbacks
+%%====================================================================
+
+callback_mode() ->
+    [handle_event_function,
+     state_enter].
+
+%%--------------------------------------------------------------------
+
+%%% ######## {userauth, client} ####
+
+%%---- #ssh_msg_ext_info could follow after the key exchange, both the intial and the re-negotiation
+handle_event(internal, #ssh_msg_ext_info{}=Msg, {userauth,client}, D0) ->
+    %% FIXME: need new state to receive this msg!
+    D = ssh_connection_handler:handle_ssh_msg_ext_info(Msg, D0),
+    {keep_state, D};
+
+%%---- recevied userauth success from the server
+handle_event(internal, #ssh_msg_userauth_success{}, {userauth,client}, D0=#data{ssh_params = Ssh}) ->
+    ssh_auth:ssh_msg_userauth_result(success),
+    D0#data.starter ! ssh_connected,
+    D = D0#data{ssh_params=Ssh#ssh{authenticated = true}},
+    {next_state, {connected,client}, D, {change_callback_module,ssh_connection_handler}};
+
+
+%%---- userauth failure response to clientfrom the server
+handle_event(internal, #ssh_msg_userauth_failure{}, {userauth,client}=StateName,
+	     #data{ssh_params = #ssh{userauth_methods = []}} = D0) ->
+    {Shutdown, D} =
+        ?send_disconnect(?SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE, 
+                         io_lib:format("User auth failed for: ~p",[D0#data.auth_user]),
+                         StateName, D0),
+    {stop, Shutdown, D};
+
+handle_event(internal, #ssh_msg_userauth_failure{authentications = Methods}, StateName={userauth,client},
+	     D0 = #data{ssh_params = Ssh0}) ->
+    %% The prefered authentication method failed, try next method
+    Ssh1 = case Ssh0#ssh.userauth_methods of
+	       none ->
+		   %% Server tells us which authentication methods that are allowed
+		   Ssh0#ssh{userauth_methods = string:tokens(Methods, ",")};
+	       _ ->
+		   %% We already know...
+		   Ssh0 
+	   end,
+    case ssh_auth:userauth_request_msg(Ssh1) of
+        {send_disconnect, Code, Ssh} ->
+            {Shutdown, D} =
+                ?send_disconnect(Code, 
+                                 io_lib:format("User auth failed for: ~p",[D0#data.auth_user]),
+                                 StateName, D0#data{ssh_params = Ssh}),
+	    {stop, Shutdown, D};
+	{"keyboard-interactive", {Msg, Ssh}} ->
+            D = ssh_connection_handler:send_msg(Msg, D0#data{ssh_params = Ssh}),
+	    {next_state, {userauth_keyboard_interactive,client}, D};
+	{_Method, {Msg, Ssh}} ->
+            D = ssh_connection_handler:send_msg(Msg, D0#data{ssh_params = Ssh}),
+	    {keep_state, D}
+    end;
+
+%%---- banner to client
+handle_event(internal, #ssh_msg_userauth_banner{message = Msg}, {userauth,client}, D) ->
+    case D#data.ssh_params#ssh.userauth_quiet_mode of
+	false -> io:format("~s", [Msg]);
+	true -> ok
+    end,
+    keep_state_and_data;
+
+
+%%% ######## {userauth_keyboard_interactive, client}
+
+handle_event(internal, #ssh_msg_userauth_info_request{} = Msg, {userauth_keyboard_interactive, client},
+	     #data{ssh_params = Ssh0} = D0) ->
+    case ssh_auth:handle_userauth_info_request(Msg, Ssh0) of
+	{ok, {Reply, Ssh}} ->
+            D = ssh_connection_handler:send_msg(Reply, D0#data{ssh_params = Ssh}),
+	    {next_state, {userauth_keyboard_interactive_info_response,client}, D};
+	not_ok ->
+	    {next_state, {userauth,client}, D0, [postpone]}
+    end;
+
+handle_event(internal, #ssh_msg_userauth_failure{}, {userauth_keyboard_interactive, client},
+	     #data{ssh_params = Ssh0} = D0) ->
+    Prefs = [{Method,M,F,A} || {Method,M,F,A} <- Ssh0#ssh.userauth_preference,
+			       Method =/= "keyboard-interactive"],
+    D = D0#data{ssh_params = Ssh0#ssh{userauth_preference=Prefs}},
+    {next_state, {userauth,client}, D, [postpone]};
+
+handle_event(internal, #ssh_msg_userauth_failure{}, {userauth_keyboard_interactive_info_response, client},
+	     #data{ssh_params = Ssh0} = D0) ->
+    Opts = Ssh0#ssh.opts,
+    D = case ?GET_OPT(password, Opts) of
+	    undefined ->
+		D0;
+	    _ ->
+		D0#data{ssh_params =
+			    Ssh0#ssh{opts = ?PUT_OPT({password,not_ok}, Opts)}} % FIXME:intermodule dependency
+	end,
+    {next_state, {userauth,client}, D, [postpone]};
+
+handle_event(internal, #ssh_msg_ext_info{}=Msg, {userauth_keyboard_interactive_info_response, client}, D0) ->
+    %% FIXME: need new state to receive this msg!
+    D = ssh_connection_handler:handle_ssh_msg_ext_info(Msg, D0),
+    {keep_state, D};
+
+handle_event(internal, #ssh_msg_userauth_success{}, {userauth_keyboard_interactive_info_response, client}, D) ->
+    {next_state, {userauth,client}, D, [postpone]};
+
+handle_event(internal, #ssh_msg_userauth_info_request{}, {userauth_keyboard_interactive_info_response, client}, D) ->
+    {next_state, {userauth_keyboard_interactive,client}, D, [postpone]};
+
+
+%%% ######## UNHANDLED EVENT!
+handle_event(Type, Event, StateName, D) ->
+    ssh_connection_handler:handle_event(Type, Event, StateName, D).
+
+%%--------------------------------------------------------------------
+format_status(A, B) ->
+    ssh_connection_handler:format_status(A, B).
+
+%%--------------------------------------------------------------------
+terminate(Reason, StateName, D) ->
+    ssh_connection_handler:terminate(Reason, StateName, D).
+
+%%--------------------------------------------------------------------
+code_change(_OldVsn, StateName, State, _Extra) ->
+    {ok, StateName, State}.
+
+%%====================================================================
+%% Internal functions
+%%====================================================================
+
+
diff --git a/lib/ssh/src/ssh_fsm_userauth_server.erl b/lib/ssh/src/ssh_fsm_userauth_server.erl
new file mode 100644
index 0000000000..9fbe102aa2
--- /dev/null
+++ b/lib/ssh/src/ssh_fsm_userauth_server.erl
@@ -0,0 +1,191 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2008-2020. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+%%
+%%----------------------------------------------------------------------
+%% Purpose: Handles an ssh connection, e.i. both the
+%% setup SSH Transport Layer Protocol (RFC 4253), Authentication
+%% Protocol (RFC 4252) and SSH connection Protocol (RFC 4255)
+%% Details of the different protocols are
+%% implemented in ssh_transport.erl, ssh_auth.erl and ssh_connection.erl
+%% ----------------------------------------------------------------------
+
+-module(ssh_fsm_userauth_server).
+
+-include("ssh.hrl").
+-include("ssh_transport.hrl").
+-include("ssh_auth.hrl").
+-include("ssh_connect.hrl").
+
+-include("ssh_fsm.hrl").
+
+%%====================================================================
+%%% Exports
+%%====================================================================
+
+%%% Behaviour callbacks
+-export([callback_mode/0, handle_event/4, terminate/3,
+	 format_status/2, code_change/4]).
+
+%%====================================================================
+%% gen_statem callbacks
+%%====================================================================
+
+callback_mode() ->
+    [handle_event_function,
+     state_enter].
+
+%%--------------------------------------------------------------------
+
+%%% ######## {userauth, server} ####
+%%---- userauth request to server
+handle_event(internal, 
+	     Msg = #ssh_msg_userauth_request{service = ServiceName,
+                                             method = Method},
+	     StateName = {userauth,server},
+	     D0 = #data{ssh_params=Ssh0}) ->
+
+    case {ServiceName, Ssh0#ssh.service, Method} of
+	{"ssh-connection", "ssh-connection", "none"} ->
+	    %% Probably the very first userauth_request but we deny unauthorized login
+	    {not_authorized, _, {Reply,Ssh}} =
+		ssh_auth:handle_userauth_request(Msg, Ssh0#ssh.session_id, Ssh0),
+            D = ssh_connection_handler:send_msg(Reply, D0#data{ssh_params = Ssh}),
+	    {keep_state, D};
+	
+	{"ssh-connection", "ssh-connection", Method} ->
+	    %% Userauth request with a method like "password" or so
+	    case lists:member(Method, Ssh0#ssh.userauth_methods) of
+		true ->
+		    %% Yepp! we support this method
+		    case ssh_auth:handle_userauth_request(Msg, Ssh0#ssh.session_id, Ssh0) of
+			{authorized, User, {Reply, Ssh1}} ->
+                            D = connected_state(Reply, Ssh1, User, Method, D0),
+                            {next_state, {connected,server}, D, {change_callback_module,ssh_connection_handler}};
+			{not_authorized, {User, Reason}, {Reply, Ssh}} when Method == "keyboard-interactive" ->
+			    retry_fun(User, Reason, D0),
+                            D = ssh_connection_handler:send_msg(Reply, D0#data{ssh_params = Ssh}),
+			    {next_state, {userauth_keyboard_interactive,server}, D};
+			{not_authorized, {User, Reason}, {Reply, Ssh}} ->
+			    retry_fun(User, Reason, D0),
+                            D = ssh_connection_handler:send_msg(Reply, D0#data{ssh_params = Ssh}),
+			    {keep_state, D}
+		    end;
+		false ->
+		    %% No we do not support this method (=/= none)
+		    %% At least one non-erlang client does like this. Retry as the next event
+		    {keep_state_and_data,
+		     [{next_event, internal, Msg#ssh_msg_userauth_request{method="none"}}]
+		    }
+	    end;
+
+	%% {"ssh-connection", Expected, Method} when Expected =/= ServiceName -> Do what?
+	%% {ServiceName,      Expected, Method} when Expected =/= ServiceName -> Do what?
+
+	{ServiceName, _, _} when ServiceName =/= "ssh-connection" ->
+            {Shutdown, D} =  
+                ?send_disconnect(?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+                                 io_lib:format("Unknown service: ~p",[ServiceName]),
+                                 StateName, D0),
+            {stop, Shutdown, D}
+    end;
+
+handle_event(internal, #ssh_msg_userauth_info_response{} = Msg, {userauth_keyboard_interactive, server}, D0) ->
+    case ssh_auth:handle_userauth_info_response(Msg, D0#data.ssh_params) of
+	{authorized, User, {Reply, Ssh1}} ->
+            D = connected_state(Reply, Ssh1, User, "keyboard-interactive", D0),
+            {next_state, {connected,server}, D, {change_callback_module,ssh_connection_handler}};
+	{not_authorized, {User, Reason}, {Reply, Ssh}} ->
+	    retry_fun(User, Reason, D0),
+            D = ssh_connection_handler:send_msg(Reply, D0#data{ssh_params = Ssh}),
+	    {next_state, {userauth,server}, D};
+
+	{authorized_but_one_more, _User,  {Reply, Ssh}} ->
+            D = ssh_connection_handler:send_msg(Reply, D0#data{ssh_params = Ssh}),
+	    {next_state, {userauth_keyboard_interactive_extra,server}, D}
+    end;
+
+handle_event(internal, #ssh_msg_userauth_info_response{} = Msg, {userauth_keyboard_interactive_extra, server}, D0) ->
+    {authorized, User, {Reply, Ssh1}} =
+        ssh_auth:handle_userauth_info_response({extra,Msg}, D0#data.ssh_params),
+    D = connected_state(Reply, Ssh1, User, "keyboard-interactive", D0),
+    {next_state, {connected,server}, D, {change_callback_module,ssh_connection_handler}};
+
+
+%%% ######## UNHANDLED EVENT!
+handle_event(Type, Event, StateName, D) ->
+    ssh_connection_handler:handle_event(Type, Event, StateName, D).
+
+%%--------------------------------------------------------------------
+format_status(A, B) ->
+    ssh_connection_handler:format_status(A, B).
+
+%%--------------------------------------------------------------------
+terminate(Reason, StateName, D) ->
+    ssh_connection_handler:terminate(Reason, StateName, D).
+
+%%--------------------------------------------------------------------
+code_change(_OldVsn, StateName, State, _Extra) ->
+    {ok, StateName, State}.
+
+%%====================================================================
+%% Internal functions
+%%====================================================================
+
+connected_state(Reply, Ssh1, User, Method, D0) ->
+    D1 = #data{ssh_params=Ssh} =
+        ssh_connection_handler:send_msg(Reply, D0#data{ssh_params = Ssh1}),
+    D1#data.starter ! ssh_connected,
+    connected_fun(User, Method, D1),
+    D1#data{auth_user=User,
+            %% Note: authenticated=true MUST NOT be sent
+            %% before send_msg!
+            ssh_params = Ssh#ssh{authenticated = true}}.
+
+
+connected_fun(User, Method, #data{ssh_params = #ssh{peer = {_,Peer}}} = D) ->
+    ?CALL_FUN(connectfun,D)(User, Peer, Method).
+
+
+retry_fun(_, undefined, _) ->
+    ok;
+retry_fun(User, Reason, #data{ssh_params = #ssh{opts = Opts,
+						peer = {_,Peer}
+					       }}) ->
+    {Tag,Info} =
+	case Reason of
+	    {error, Error} ->
+		{failfun, Error};
+	    _ ->
+		{infofun, Reason}
+	end,
+    Fun = ?GET_OPT(Tag, Opts),
+    try erlang:fun_info(Fun, arity)
+    of
+	{arity, 2} -> %% Backwards compatible
+	    catch Fun(User, Info);
+	{arity, 3} ->
+	    catch Fun(User, Peer, Info);
+	_ ->
+	    ok
+    catch
+	_:_ ->
+	    ok
+    end.
+
-- 
2.26.2

Places

File 3836-ssh-Split-huge-fsm-in-ssh_connection_handler.patch of Package erlang (Revision 9dd171ce7ed830ae09b52982720094c8)

Places