blob: 71a345109a7251ee752cf0f3de68bf9d74c81069 [file] [log] [blame]
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001/*
Damien Miller95def091999-11-25 00:26:21 +11002 * Author: Tatu Ylonen <ylo@cs.hut.fi>
Damien Miller95def091999-11-25 00:26:21 +11003 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
Damien Miller95def091999-11-25 00:26:21 +11005 * This file contains functions for generic socket connection forwarding.
6 * There is also code for initiating connection forwarding for X11 connections,
7 * arbitrary tcp/ip connections, and the authentication agent connection.
Damien Miller4af51302000-04-16 11:18:38 +10008 *
Damien Millere4340be2000-09-16 13:29:08 +11009 * As far as I am concerned, the code I have written for this software
10 * can be used freely for any purpose. Any derived versions of this
11 * software must be clearly marked as such, and if the derived work is
12 * incompatible with the protocol description in the RFC file, it must be
13 * called by a name other than "ssh" or "Secure Shell".
14 *
15 *
Damien Miller33b13562000-04-04 14:38:59 +100016 * SSH2 support added by Markus Friedl.
Damien Millere4340be2000-09-16 13:29:08 +110017 * Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
18 * Copyright (c) 1999 Dug Song. All rights reserved.
19 * Copyright (c) 1999 Theo de Raadt. All rights reserved.
20 *
21 * Redistribution and use in source and binary forms, with or without
22 * modification, are permitted provided that the following conditions
23 * are met:
24 * 1. Redistributions of source code must retain the above copyright
25 * notice, this list of conditions and the following disclaimer.
26 * 2. Redistributions in binary form must reproduce the above copyright
27 * notice, this list of conditions and the following disclaimer in the
28 * documentation and/or other materials provided with the distribution.
29 *
30 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
32 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
33 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
34 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
35 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
39 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Damien Miller95def091999-11-25 00:26:21 +110040 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100041
42#include "includes.h"
Ben Lindstrom813f9402001-02-16 15:56:31 +000043RCSID("$OpenBSD: channels.c,v 1.92 2001/02/16 13:38:18 markus Exp $");
Ben Lindstrom226cfa02001-01-22 05:34:40 +000044
45#include <openssl/rsa.h>
46#include <openssl/dsa.h>
Damien Millerd4a8b7e1999-10-27 13:42:43 +100047
48#include "ssh.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000049#include "ssh1.h"
50#include "ssh2.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100051#include "packet.h"
52#include "xmalloc.h"
53#include "buffer.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100054#include "uidswap.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000055#include "log.h"
56#include "misc.h"
Damien Millerd4a8b7e1999-10-27 13:42:43 +100057#include "channels.h"
58#include "nchan.h"
59#include "compat.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000060#include "canohost.h"
Damien Miller994cf142000-07-21 10:19:44 +100061#include "key.h"
62#include "authfd.h"
63
Damien Millerd4a8b7e1999-10-27 13:42:43 +100064/* Maximum number of fake X11 displays to try. */
65#define MAX_DISPLAYS 1000
66
67/* Max len of agent socket */
68#define MAX_SOCKET_NAME 100
69
Damien Miller5428f641999-11-25 11:54:57 +110070/*
71 * Pointer to an array containing all allocated channels. The array is
72 * dynamically extended as needed.
73 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100074static Channel *channels = NULL;
75
Damien Miller5428f641999-11-25 11:54:57 +110076/*
77 * Size of the channel array. All slots of the array must always be
78 * initialized (at least the type field); unused slots are marked with type
79 * SSH_CHANNEL_FREE.
80 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100081static int channels_alloc = 0;
82
Damien Miller5428f641999-11-25 11:54:57 +110083/*
84 * Maximum file descriptor value used in any of the channels. This is
85 * updated in channel_allocate.
86 */
Damien Miller5e953212001-01-30 09:14:00 +110087static int channel_max_fd = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100088
89/* Name and directory of socket for authentication agent forwarding. */
90static char *channel_forwarded_auth_socket_name = NULL;
Damien Miller95def091999-11-25 00:26:21 +110091static char *channel_forwarded_auth_socket_dir = NULL;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100092
93/* Saved X11 authentication protocol name. */
94char *x11_saved_proto = NULL;
95
96/* Saved X11 authentication data. This is the real data. */
97char *x11_saved_data = NULL;
Ben Lindstrom46c16222000-12-22 01:43:59 +000098u_int x11_saved_data_len = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100099
Damien Miller5428f641999-11-25 11:54:57 +1100100/*
101 * Fake X11 authentication data. This is what the server will be sending us;
102 * we should replace any occurrences of this by the real data.
103 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000104char *x11_fake_data = NULL;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000105u_int x11_fake_data_len;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000106
Damien Miller5428f641999-11-25 11:54:57 +1100107/*
108 * Data structure for storing which hosts are permitted for forward requests.
109 * The local sides of any remote forwards are stored in this array to prevent
110 * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
111 * network (which might be behind a firewall).
112 */
Damien Miller95def091999-11-25 00:26:21 +1100113typedef struct {
Damien Millerb38eff82000-04-01 11:09:21 +1000114 char *host_to_connect; /* Connect to 'host'. */
115 u_short port_to_connect; /* Connect to 'port'. */
116 u_short listen_port; /* Remote side should listen port number. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000117} ForwardPermission;
118
119/* List of all permitted host/port pairs to connect. */
120static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
121/* Number of permitted host/port pairs in the array. */
122static int num_permitted_opens = 0;
Damien Miller5428f641999-11-25 11:54:57 +1100123/*
124 * If this is true, all opens are permitted. This is the case on the server
125 * on which we have to trust the client anyway, and the user could do
126 * anything after logging in anyway.
127 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000128static int all_opens_permitted = 0;
129
130/* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
131static int have_hostname_in_open = 0;
132
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000133/* AF_UNSPEC or AF_INET or AF_INET6 */
134extern int IPv4or6;
135
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000136/* Sets specific protocol options. */
137
Damien Miller4af51302000-04-16 11:18:38 +1000138void
Damien Miller95def091999-11-25 00:26:21 +1100139channel_set_options(int hostname_in_open)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000140{
Damien Miller95def091999-11-25 00:26:21 +1100141 have_hostname_in_open = hostname_in_open;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000142}
143
Damien Miller5428f641999-11-25 11:54:57 +1100144/*
145 * Permits opening to any host/port in SSH_MSG_PORT_OPEN. This is usually
146 * called by the server, because the user could connect to any port anyway,
147 * and the server has no way to know but to trust the client anyway.
148 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000149
Damien Miller4af51302000-04-16 11:18:38 +1000150void
Damien Miller95def091999-11-25 00:26:21 +1100151channel_permit_all_opens()
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000152{
Damien Miller95def091999-11-25 00:26:21 +1100153 all_opens_permitted = 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000154}
155
Damien Millerb38eff82000-04-01 11:09:21 +1000156/* lookup channel by id */
157
158Channel *
159channel_lookup(int id)
160{
161 Channel *c;
Damien Millerc0fd17f2000-06-26 10:22:53 +1000162 if (id < 0 || id > channels_alloc) {
Damien Millerb38eff82000-04-01 11:09:21 +1000163 log("channel_lookup: %d: bad id", id);
164 return NULL;
165 }
166 c = &channels[id];
167 if (c->type == SSH_CHANNEL_FREE) {
168 log("channel_lookup: %d: bad id: channel free", id);
169 return NULL;
170 }
171 return c;
172}
173
Damien Miller5428f641999-11-25 11:54:57 +1100174/*
Damien Millere247cc42000-05-07 12:03:14 +1000175 * Register filedescriptors for a channel, used when allocating a channel or
Damien Miller6f83b8e2000-05-02 09:23:45 +1000176 * when the channel consumer/producer is ready, e.g. shell exec'd
Damien Miller5428f641999-11-25 11:54:57 +1100177 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000178
Damien Miller6f83b8e2000-05-02 09:23:45 +1000179void
Damien Miller69b69aa2000-10-28 14:19:58 +1100180channel_register_fds(Channel *c, int rfd, int wfd, int efd,
181 int extusage, int nonblock)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000182{
Damien Miller95def091999-11-25 00:26:21 +1100183 /* Update the maximum file descriptor value. */
Damien Miller5e953212001-01-30 09:14:00 +1100184 channel_max_fd = MAX(channel_max_fd, rfd);
185 channel_max_fd = MAX(channel_max_fd, wfd);
186 channel_max_fd = MAX(channel_max_fd, efd);
187
Damien Miller5428f641999-11-25 11:54:57 +1100188 /* XXX set close-on-exec -markus */
Damien Millere247cc42000-05-07 12:03:14 +1000189
Damien Miller6f83b8e2000-05-02 09:23:45 +1000190 c->rfd = rfd;
191 c->wfd = wfd;
192 c->sock = (rfd == wfd) ? rfd : -1;
193 c->efd = efd;
194 c->extended_usage = extusage;
Damien Miller69b69aa2000-10-28 14:19:58 +1100195
Damien Miller79438cc2001-02-16 12:34:57 +1100196 /* XXX ugly hack: nonblock is only set by the server */
197 if (nonblock && isatty(c->rfd)) {
198 debug("channel: %d: rfd %d isatty", c->self, c->rfd);
199 c->isatty = 1;
200 if (!isatty(c->wfd)) {
201 error("channel: %d: wfd %d is not a tty?",
202 c->self, c->wfd);
203 }
204 } else {
205 c->isatty = 0;
206 }
207
Damien Miller69b69aa2000-10-28 14:19:58 +1100208 /* enable nonblocking mode */
209 if (nonblock) {
210 if (rfd != -1)
211 set_nonblock(rfd);
212 if (wfd != -1)
213 set_nonblock(wfd);
214 if (efd != -1)
215 set_nonblock(efd);
216 }
Damien Miller6f83b8e2000-05-02 09:23:45 +1000217}
218
219/*
220 * Allocate a new channel object and set its type and socket. This will cause
221 * remote_name to be freed.
222 */
223
224int
225channel_new(char *ctype, int type, int rfd, int wfd, int efd,
Damien Miller69b69aa2000-10-28 14:19:58 +1100226 int window, int maxpack, int extusage, char *remote_name, int nonblock)
Damien Miller6f83b8e2000-05-02 09:23:45 +1000227{
228 int i, found;
229 Channel *c;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000230
Damien Miller95def091999-11-25 00:26:21 +1100231 /* Do initial allocation if this is the first call. */
232 if (channels_alloc == 0) {
Damien Miller33b13562000-04-04 14:38:59 +1000233 chan_init();
Damien Miller95def091999-11-25 00:26:21 +1100234 channels_alloc = 10;
235 channels = xmalloc(channels_alloc * sizeof(Channel));
236 for (i = 0; i < channels_alloc; i++)
237 channels[i].type = SSH_CHANNEL_FREE;
Damien Miller5428f641999-11-25 11:54:57 +1100238 /*
239 * Kludge: arrange a call to channel_stop_listening if we
240 * terminate with fatal().
241 */
Damien Miller95def091999-11-25 00:26:21 +1100242 fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
243 }
244 /* Try to find a free slot where to put the new channel. */
245 for (found = -1, i = 0; i < channels_alloc; i++)
246 if (channels[i].type == SSH_CHANNEL_FREE) {
247 /* Found a free slot. */
248 found = i;
249 break;
250 }
251 if (found == -1) {
Damien Miller5428f641999-11-25 11:54:57 +1100252 /* There are no free slots. Take last+1 slot and expand the array. */
Damien Miller95def091999-11-25 00:26:21 +1100253 found = channels_alloc;
254 channels_alloc += 10;
Damien Millerd3444942000-09-30 14:20:03 +1100255 debug2("channel: expanding %d", channels_alloc);
Damien Miller95def091999-11-25 00:26:21 +1100256 channels = xrealloc(channels, channels_alloc * sizeof(Channel));
257 for (i = found; i < channels_alloc; i++)
258 channels[i].type = SSH_CHANNEL_FREE;
259 }
260 /* Initialize and return new channel number. */
261 c = &channels[found];
262 buffer_init(&c->input);
263 buffer_init(&c->output);
Damien Millerb38eff82000-04-01 11:09:21 +1000264 buffer_init(&c->extended);
Damien Miller95def091999-11-25 00:26:21 +1100265 chan_init_iostates(c);
Damien Miller69b69aa2000-10-28 14:19:58 +1100266 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
Damien Miller95def091999-11-25 00:26:21 +1100267 c->self = found;
268 c->type = type;
Damien Millerb38eff82000-04-01 11:09:21 +1000269 c->ctype = ctype;
Damien Millerbd483e72000-04-30 10:00:53 +1000270 c->local_window = window;
271 c->local_window_max = window;
272 c->local_consumed = 0;
273 c->local_maxpacket = maxpack;
Damien Miller95def091999-11-25 00:26:21 +1100274 c->remote_id = -1;
275 c->remote_name = remote_name;
Damien Millerb38eff82000-04-01 11:09:21 +1000276 c->remote_window = 0;
277 c->remote_maxpacket = 0;
278 c->cb_fn = NULL;
279 c->cb_arg = NULL;
280 c->cb_event = 0;
281 c->dettach_user = NULL;
Damien Millerad833b32000-08-23 10:46:23 +1000282 c->input_filter = NULL;
Damien Miller95def091999-11-25 00:26:21 +1100283 debug("channel %d: new [%s]", found, remote_name);
284 return found;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000285}
Damien Miller6f83b8e2000-05-02 09:23:45 +1000286/* old interface XXX */
Damien Miller4af51302000-04-16 11:18:38 +1000287int
Damien Millerb38eff82000-04-01 11:09:21 +1000288channel_allocate(int type, int sock, char *remote_name)
289{
Damien Miller69b69aa2000-10-28 14:19:58 +1100290 return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1);
Damien Millerb38eff82000-04-01 11:09:21 +1000291}
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000292
Damien Miller6f83b8e2000-05-02 09:23:45 +1000293
294/* Close all channel fd/socket. */
295
296void
297channel_close_fds(Channel *c)
298{
299 if (c->sock != -1) {
300 close(c->sock);
301 c->sock = -1;
302 }
303 if (c->rfd != -1) {
304 close(c->rfd);
305 c->rfd = -1;
306 }
307 if (c->wfd != -1) {
308 close(c->wfd);
309 c->wfd = -1;
310 }
311 if (c->efd != -1) {
312 close(c->efd);
313 c->efd = -1;
314 }
315}
316
317/* Free the channel and close its fd/socket. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000318
Damien Miller4af51302000-04-16 11:18:38 +1000319void
Damien Millerb38eff82000-04-01 11:09:21 +1000320channel_free(int id)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000321{
Damien Millerb38eff82000-04-01 11:09:21 +1000322 Channel *c = channel_lookup(id);
Ben Lindstrom6c3ae2b2000-12-30 03:25:14 +0000323 char *s = channel_open_message();
324
Damien Millerb38eff82000-04-01 11:09:21 +1000325 if (c == NULL)
326 packet_disconnect("channel free: bad local channel %d", id);
Ben Lindstrom6c3ae2b2000-12-30 03:25:14 +0000327 debug("channel_free: channel %d: status: %s", id, s);
328 xfree(s);
329
Damien Miller33b13562000-04-04 14:38:59 +1000330 if (c->dettach_user != NULL) {
331 debug("channel_free: channel %d: dettaching channel user", id);
332 c->dettach_user(c->self, NULL);
333 }
Damien Miller6f83b8e2000-05-02 09:23:45 +1000334 if (c->sock != -1)
Damien Millerb38eff82000-04-01 11:09:21 +1000335 shutdown(c->sock, SHUT_RDWR);
Damien Miller6f83b8e2000-05-02 09:23:45 +1000336 channel_close_fds(c);
Damien Millerb38eff82000-04-01 11:09:21 +1000337 buffer_free(&c->input);
338 buffer_free(&c->output);
339 buffer_free(&c->extended);
340 c->type = SSH_CHANNEL_FREE;
341 if (c->remote_name) {
342 xfree(c->remote_name);
343 c->remote_name = NULL;
Damien Miller95def091999-11-25 00:26:21 +1100344 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000345}
346
Damien Miller5428f641999-11-25 11:54:57 +1100347/*
Damien Millerb38eff82000-04-01 11:09:21 +1000348 * 'channel_pre*' are called just before select() to add any bits relevant to
349 * channels in the select bitmasks.
Damien Miller5428f641999-11-25 11:54:57 +1100350 */
Damien Millerb38eff82000-04-01 11:09:21 +1000351/*
352 * 'channel_post*': perform any appropriate operations for channels which
353 * have events pending.
354 */
355typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
356chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
357chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
358
359void
360channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
361{
362 FD_SET(c->sock, readset);
363}
364
365void
Ben Lindstrom7ad97102000-12-06 01:42:49 +0000366channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset)
367{
368 debug3("channel %d: waiting for connection", c->self);
369 FD_SET(c->sock, writeset);
370}
371
372void
Damien Millerb38eff82000-04-01 11:09:21 +1000373channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
374{
375 if (buffer_len(&c->input) < packet_get_maxsize())
376 FD_SET(c->sock, readset);
377 if (buffer_len(&c->output) > 0)
378 FD_SET(c->sock, writeset);
379}
380
381void
382channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
383{
384 /* test whether sockets are 'alive' for read/write */
385 if (c->istate == CHAN_INPUT_OPEN)
386 if (buffer_len(&c->input) < packet_get_maxsize())
387 FD_SET(c->sock, readset);
388 if (c->ostate == CHAN_OUTPUT_OPEN ||
389 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
390 if (buffer_len(&c->output) > 0) {
391 FD_SET(c->sock, writeset);
392 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
393 chan_obuf_empty(c);
394 }
395 }
396}
397
398void
Damien Miller33b13562000-04-04 14:38:59 +1000399channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
400{
401 if (c->istate == CHAN_INPUT_OPEN &&
402 c->remote_window > 0 &&
403 buffer_len(&c->input) < c->remote_window)
404 FD_SET(c->rfd, readset);
405 if (c->ostate == CHAN_OUTPUT_OPEN ||
406 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
407 if (buffer_len(&c->output) > 0) {
408 FD_SET(c->wfd, writeset);
409 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
410 chan_obuf_empty(c);
411 }
412 }
413 /** XXX check close conditions, too */
414 if (c->efd != -1) {
415 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
416 buffer_len(&c->extended) > 0)
417 FD_SET(c->efd, writeset);
418 else if (c->extended_usage == CHAN_EXTENDED_READ &&
419 buffer_len(&c->extended) < c->remote_window)
420 FD_SET(c->efd, readset);
421 }
422}
423
424void
Damien Millerb38eff82000-04-01 11:09:21 +1000425channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
426{
427 if (buffer_len(&c->input) == 0) {
428 packet_start(SSH_MSG_CHANNEL_CLOSE);
429 packet_put_int(c->remote_id);
430 packet_send();
431 c->type = SSH_CHANNEL_CLOSED;
432 debug("Closing channel %d after input drain.", c->self);
433 }
434}
435
436void
437channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
438{
439 if (buffer_len(&c->output) == 0)
440 channel_free(c->self);
Damien Miller4af51302000-04-16 11:18:38 +1000441 else
Damien Millerb38eff82000-04-01 11:09:21 +1000442 FD_SET(c->sock, writeset);
443}
444
445/*
446 * This is a special state for X11 authentication spoofing. An opened X11
447 * connection (when authentication spoofing is being done) remains in this
448 * state until the first packet has been completely read. The authentication
449 * data in that packet is then substituted by the real data if it matches the
450 * fake data, and the channel is put into normal mode.
Damien Millerbd483e72000-04-30 10:00:53 +1000451 * XXX All this happens at the client side.
Damien Millerb38eff82000-04-01 11:09:21 +1000452 */
453int
454x11_open_helper(Channel *c)
455{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000456 u_char *ucp;
457 u_int proto_len, data_len;
Damien Millerb38eff82000-04-01 11:09:21 +1000458
459 /* Check if the fixed size part of the packet is in buffer. */
460 if (buffer_len(&c->output) < 12)
461 return 0;
462
463 /* Parse the lengths of variable-length fields. */
Ben Lindstrom46c16222000-12-22 01:43:59 +0000464 ucp = (u_char *) buffer_ptr(&c->output);
Damien Millerb38eff82000-04-01 11:09:21 +1000465 if (ucp[0] == 0x42) { /* Byte order MSB first. */
466 proto_len = 256 * ucp[6] + ucp[7];
467 data_len = 256 * ucp[8] + ucp[9];
468 } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */
469 proto_len = ucp[6] + 256 * ucp[7];
470 data_len = ucp[8] + 256 * ucp[9];
471 } else {
472 debug("Initial X11 packet contains bad byte order byte: 0x%x",
473 ucp[0]);
474 return -1;
475 }
476
477 /* Check if the whole packet is in buffer. */
478 if (buffer_len(&c->output) <
479 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
480 return 0;
481
482 /* Check if authentication protocol matches. */
483 if (proto_len != strlen(x11_saved_proto) ||
484 memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
485 debug("X11 connection uses different authentication protocol.");
486 return -1;
487 }
488 /* Check if authentication data matches our fake data. */
489 if (data_len != x11_fake_data_len ||
490 memcmp(ucp + 12 + ((proto_len + 3) & ~3),
491 x11_fake_data, x11_fake_data_len) != 0) {
492 debug("X11 auth data does not match fake data.");
493 return -1;
494 }
495 /* Check fake data length */
496 if (x11_fake_data_len != x11_saved_data_len) {
497 error("X11 fake_data_len %d != saved_data_len %d",
498 x11_fake_data_len, x11_saved_data_len);
499 return -1;
500 }
501 /*
502 * Received authentication protocol and data match
503 * our fake data. Substitute the fake data with real
504 * data.
505 */
506 memcpy(ucp + 12 + ((proto_len + 3) & ~3),
507 x11_saved_data, x11_saved_data_len);
508 return 1;
509}
510
511void
512channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
513{
514 int ret = x11_open_helper(c);
515 if (ret == 1) {
516 /* Start normal processing for the channel. */
517 c->type = SSH_CHANNEL_OPEN;
Damien Miller78928792000-04-12 20:17:38 +1000518 channel_pre_open_13(c, readset, writeset);
Damien Millerb38eff82000-04-01 11:09:21 +1000519 } else if (ret == -1) {
520 /*
521 * We have received an X11 connection that has bad
522 * authentication information.
523 */
524 log("X11 connection rejected because of wrong authentication.\r\n");
525 buffer_clear(&c->input);
526 buffer_clear(&c->output);
527 close(c->sock);
528 c->sock = -1;
529 c->type = SSH_CHANNEL_CLOSED;
530 packet_start(SSH_MSG_CHANNEL_CLOSE);
531 packet_put_int(c->remote_id);
532 packet_send();
533 }
534}
535
536void
Damien Millerbd483e72000-04-30 10:00:53 +1000537channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
Damien Millerb38eff82000-04-01 11:09:21 +1000538{
539 int ret = x11_open_helper(c);
540 if (ret == 1) {
541 c->type = SSH_CHANNEL_OPEN;
Damien Miller30c3d422000-05-09 11:02:59 +1000542 if (compat20)
543 channel_pre_open_20(c, readset, writeset);
544 else
545 channel_pre_open_15(c, readset, writeset);
Damien Millerb38eff82000-04-01 11:09:21 +1000546 } else if (ret == -1) {
547 debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
Damien Millerbd483e72000-04-30 10:00:53 +1000548 chan_read_failed(c); /** force close? */
Damien Millerb38eff82000-04-01 11:09:21 +1000549 chan_write_failed(c);
550 debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
551 }
552}
553
554/* This is our fake X11 server socket. */
555void
556channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
557{
558 struct sockaddr addr;
559 int newsock, newch;
560 socklen_t addrlen;
Damien Millerd83ff352001-01-30 09:19:34 +1100561 char buf[16384], *remote_ipaddr;
Damien Millerbd483e72000-04-30 10:00:53 +1000562 int remote_port;
Damien Millerb38eff82000-04-01 11:09:21 +1000563
564 if (FD_ISSET(c->sock, readset)) {
565 debug("X11 connection requested.");
566 addrlen = sizeof(addr);
567 newsock = accept(c->sock, &addr, &addrlen);
568 if (newsock < 0) {
569 error("accept: %.100s", strerror(errno));
570 return;
571 }
Damien Millerd83ff352001-01-30 09:19:34 +1100572 remote_ipaddr = get_peer_ipaddr(newsock);
Damien Millerbd483e72000-04-30 10:00:53 +1000573 remote_port = get_peer_port(newsock);
Damien Millerb38eff82000-04-01 11:09:21 +1000574 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
Damien Millerd83ff352001-01-30 09:19:34 +1100575 remote_ipaddr, remote_port);
Damien Millerbd483e72000-04-30 10:00:53 +1000576
577 newch = channel_new("x11",
578 SSH_CHANNEL_OPENING, newsock, newsock, -1,
579 c->local_window_max, c->local_maxpacket,
Damien Miller69b69aa2000-10-28 14:19:58 +1100580 0, xstrdup(buf), 1);
Damien Millerbd483e72000-04-30 10:00:53 +1000581 if (compat20) {
582 packet_start(SSH2_MSG_CHANNEL_OPEN);
583 packet_put_cstring("x11");
584 packet_put_int(newch);
585 packet_put_int(c->local_window_max);
586 packet_put_int(c->local_maxpacket);
Damien Millerd83ff352001-01-30 09:19:34 +1100587 /* originator ipaddr and port */
588 packet_put_cstring(remote_ipaddr);
Damien Miller30c3d422000-05-09 11:02:59 +1000589 if (datafellows & SSH_BUG_X11FWD) {
590 debug("ssh2 x11 bug compat mode");
591 } else {
592 packet_put_int(remote_port);
593 }
Damien Millerbd483e72000-04-30 10:00:53 +1000594 packet_send();
595 } else {
596 packet_start(SSH_SMSG_X11_OPEN);
597 packet_put_int(newch);
598 if (have_hostname_in_open)
599 packet_put_string(buf, strlen(buf));
600 packet_send();
601 }
Damien Millerd83ff352001-01-30 09:19:34 +1100602 xfree(remote_ipaddr);
Damien Millerb38eff82000-04-01 11:09:21 +1000603 }
604}
605
606/*
607 * This socket is listening for connections to a forwarded TCP/IP port.
608 */
609void
610channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
611{
612 struct sockaddr addr;
613 int newsock, newch;
614 socklen_t addrlen;
Damien Miller33804262001-02-04 23:20:18 +1100615 char buf[1024], *remote_ipaddr, *rtype;
Damien Millerb38eff82000-04-01 11:09:21 +1000616 int remote_port;
617
Damien Miller0bc1bd82000-11-13 22:57:25 +1100618 rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ?
619 "forwarded-tcpip" : "direct-tcpip";
620
Damien Millerb38eff82000-04-01 11:09:21 +1000621 if (FD_ISSET(c->sock, readset)) {
622 debug("Connection to port %d forwarding "
623 "to %.100s port %d requested.",
624 c->listening_port, c->path, c->host_port);
625 addrlen = sizeof(addr);
626 newsock = accept(c->sock, &addr, &addrlen);
627 if (newsock < 0) {
628 error("accept: %.100s", strerror(errno));
629 return;
630 }
Damien Miller33804262001-02-04 23:20:18 +1100631 remote_ipaddr = get_peer_ipaddr(newsock);
Damien Millerb38eff82000-04-01 11:09:21 +1000632 remote_port = get_peer_port(newsock);
633 snprintf(buf, sizeof buf,
634 "listen port %d for %.100s port %d, "
635 "connect from %.200s port %d",
636 c->listening_port, c->path, c->host_port,
Damien Miller33804262001-02-04 23:20:18 +1100637 remote_ipaddr, remote_port);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100638
639 newch = channel_new(rtype,
Damien Millerb38eff82000-04-01 11:09:21 +1000640 SSH_CHANNEL_OPENING, newsock, newsock, -1,
641 c->local_window_max, c->local_maxpacket,
Damien Miller69b69aa2000-10-28 14:19:58 +1100642 0, xstrdup(buf), 1);
Damien Miller33b13562000-04-04 14:38:59 +1000643 if (compat20) {
644 packet_start(SSH2_MSG_CHANNEL_OPEN);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100645 packet_put_cstring(rtype);
Damien Miller33b13562000-04-04 14:38:59 +1000646 packet_put_int(newch);
647 packet_put_int(c->local_window_max);
648 packet_put_int(c->local_maxpacket);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100649 if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
650 /* listen address, port */
651 packet_put_string(c->path, strlen(c->path));
652 packet_put_int(c->listening_port);
653 } else {
654 /* target host, port */
655 packet_put_string(c->path, strlen(c->path));
656 packet_put_int(c->host_port);
657 }
Damien Miller4af51302000-04-16 11:18:38 +1000658 /* originator host and port */
Damien Miller33804262001-02-04 23:20:18 +1100659 packet_put_cstring(remote_ipaddr);
Damien Miller33b13562000-04-04 14:38:59 +1000660 packet_put_int(remote_port);
661 packet_send();
662 } else {
663 packet_start(SSH_MSG_PORT_OPEN);
664 packet_put_int(newch);
665 packet_put_string(c->path, strlen(c->path));
666 packet_put_int(c->host_port);
667 if (have_hostname_in_open) {
668 packet_put_string(buf, strlen(buf));
669 }
670 packet_send();
Damien Millerb38eff82000-04-01 11:09:21 +1000671 }
Damien Miller33804262001-02-04 23:20:18 +1100672 xfree(remote_ipaddr);
Damien Millerb38eff82000-04-01 11:09:21 +1000673 }
674}
675
676/*
677 * This is the authentication agent socket listening for connections from
678 * clients.
679 */
680void
681channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
682{
683 struct sockaddr addr;
684 int newsock, newch;
685 socklen_t addrlen;
686
687 if (FD_ISSET(c->sock, readset)) {
688 addrlen = sizeof(addr);
689 newsock = accept(c->sock, &addr, &addrlen);
690 if (newsock < 0) {
691 error("accept from auth socket: %.100s", strerror(errno));
692 return;
693 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100694 newch = channel_new("accepted auth socket",
695 SSH_CHANNEL_OPENING, newsock, newsock, -1,
696 c->local_window_max, c->local_maxpacket,
697 0, xstrdup("accepted auth socket"), 1);
698 if (compat20) {
699 packet_start(SSH2_MSG_CHANNEL_OPEN);
700 packet_put_cstring("auth-agent@openssh.com");
701 packet_put_int(newch);
702 packet_put_int(c->local_window_max);
703 packet_put_int(c->local_maxpacket);
704 } else {
705 packet_start(SSH_SMSG_AGENT_OPEN);
706 packet_put_int(newch);
707 }
Damien Millerb38eff82000-04-01 11:09:21 +1000708 packet_send();
709 }
710}
711
Ben Lindstrom7ad97102000-12-06 01:42:49 +0000712void
713channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
714{
715 if (FD_ISSET(c->sock, writeset)) {
716 int err = 0;
717 int sz = sizeof(err);
718 c->type = SSH_CHANNEL_OPEN;
Kevin Stevesef4eea92001-02-05 12:42:17 +0000719 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &sz) < 0) {
Ben Lindstrom7ad97102000-12-06 01:42:49 +0000720 debug("getsockopt SO_ERROR failed");
721 } else {
722 if (err == 0) {
723 debug("channel %d: connected)", c->self);
724 } else {
725 debug("channel %d: not connected: %s",
726 c->self, strerror(err));
727 chan_read_failed(c);
728 chan_write_failed(c);
729 }
730 }
731 }
732}
733
Damien Millerb38eff82000-04-01 11:09:21 +1000734int
735channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
736{
737 char buf[16*1024];
738 int len;
739
740 if (c->rfd != -1 &&
741 FD_ISSET(c->rfd, readset)) {
742 len = read(c->rfd, buf, sizeof(buf));
Damien Miller6f83b8e2000-05-02 09:23:45 +1000743 if (len < 0 && (errno == EINTR || errno == EAGAIN))
744 return 1;
Damien Millerb38eff82000-04-01 11:09:21 +1000745 if (len <= 0) {
Damien Millerbd483e72000-04-30 10:00:53 +1000746 debug("channel %d: read<=0 rfd %d len %d",
Damien Millerb38eff82000-04-01 11:09:21 +1000747 c->self, c->rfd, len);
748 if (compat13) {
749 buffer_consume(&c->output, buffer_len(&c->output));
750 c->type = SSH_CHANNEL_INPUT_DRAINING;
751 debug("Channel %d status set to input draining.", c->self);
752 } else {
753 chan_read_failed(c);
754 }
755 return -1;
756 }
Damien Millerad833b32000-08-23 10:46:23 +1000757 if(c->input_filter != NULL) {
758 if (c->input_filter(c, buf, len) == -1) {
759 debug("filter stops channel %d", c->self);
760 chan_read_failed(c);
761 }
762 } else {
763 buffer_append(&c->input, buf, len);
764 }
Damien Millerb38eff82000-04-01 11:09:21 +1000765 }
766 return 1;
767}
768int
769channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
770{
771 int len;
772
773 /* Send buffered output data to the socket. */
774 if (c->wfd != -1 &&
775 FD_ISSET(c->wfd, writeset) &&
776 buffer_len(&c->output) > 0) {
777 len = write(c->wfd, buffer_ptr(&c->output),
Damien Miller6f83b8e2000-05-02 09:23:45 +1000778 buffer_len(&c->output));
779 if (len < 0 && (errno == EINTR || errno == EAGAIN))
780 return 1;
Damien Millerb38eff82000-04-01 11:09:21 +1000781 if (len <= 0) {
782 if (compat13) {
783 buffer_consume(&c->output, buffer_len(&c->output));
784 debug("Channel %d status set to input draining.", c->self);
785 c->type = SSH_CHANNEL_INPUT_DRAINING;
786 } else {
787 chan_write_failed(c);
788 }
789 return -1;
790 }
Damien Miller79438cc2001-02-16 12:34:57 +1100791 if (compat20 && c->isatty) {
792 struct termios tio;
793 if (tcgetattr(c->wfd, &tio) == 0 &&
794 !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
795 /*
796 * Simulate echo to reduce the impact of
797 * traffic analysis.
798 */
799 packet_start(SSH2_MSG_IGNORE);
800 memset(buffer_ptr(&c->output), 0, len);
801 packet_put_string(buffer_ptr(&c->output), len);
802 packet_send();
Damien Miller79438cc2001-02-16 12:34:57 +1100803 }
804 }
Damien Millerb38eff82000-04-01 11:09:21 +1000805 buffer_consume(&c->output, len);
Damien Miller33b13562000-04-04 14:38:59 +1000806 if (compat20 && len > 0) {
807 c->local_consumed += len;
808 }
809 }
810 return 1;
811}
812int
813channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
814{
815 char buf[16*1024];
816 int len;
817
Damien Miller1383bd82000-04-06 12:32:37 +1000818/** XXX handle drain efd, too */
Damien Miller33b13562000-04-04 14:38:59 +1000819 if (c->efd != -1) {
820 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
821 FD_ISSET(c->efd, writeset) &&
822 buffer_len(&c->extended) > 0) {
823 len = write(c->efd, buffer_ptr(&c->extended),
824 buffer_len(&c->extended));
Damien Millerd3444942000-09-30 14:20:03 +1100825 debug2("channel %d: written %d to efd %d",
Damien Miller33b13562000-04-04 14:38:59 +1000826 c->self, len, c->efd);
827 if (len > 0) {
828 buffer_consume(&c->extended, len);
829 c->local_consumed += len;
830 }
831 } else if (c->extended_usage == CHAN_EXTENDED_READ &&
832 FD_ISSET(c->efd, readset)) {
833 len = read(c->efd, buf, sizeof(buf));
Damien Millerd3444942000-09-30 14:20:03 +1100834 debug2("channel %d: read %d from efd %d",
Damien Miller33b13562000-04-04 14:38:59 +1000835 c->self, len, c->efd);
Damien Miller1383bd82000-04-06 12:32:37 +1000836 if (len == 0) {
837 debug("channel %d: closing efd %d",
838 c->self, c->efd);
839 close(c->efd);
840 c->efd = -1;
841 } else if (len > 0)
Damien Miller33b13562000-04-04 14:38:59 +1000842 buffer_append(&c->extended, buf, len);
843 }
844 }
845 return 1;
846}
847int
848channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
849{
Damien Millerefb4afe2000-04-12 18:45:05 +1000850 if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
Damien Miller33b13562000-04-04 14:38:59 +1000851 c->local_window < c->local_window_max/2 &&
852 c->local_consumed > 0) {
853 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
854 packet_put_int(c->remote_id);
855 packet_put_int(c->local_consumed);
856 packet_send();
Damien Millerd3444942000-09-30 14:20:03 +1100857 debug2("channel %d: window %d sent adjust %d",
Damien Miller33b13562000-04-04 14:38:59 +1000858 c->self, c->local_window,
859 c->local_consumed);
860 c->local_window += c->local_consumed;
861 c->local_consumed = 0;
Damien Millerb38eff82000-04-01 11:09:21 +1000862 }
863 return 1;
864}
865
866void
867channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
868{
869 channel_handle_rfd(c, readset, writeset);
870 channel_handle_wfd(c, readset, writeset);
871}
872
873void
Damien Miller33b13562000-04-04 14:38:59 +1000874channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
875{
876 channel_handle_rfd(c, readset, writeset);
877 channel_handle_wfd(c, readset, writeset);
878 channel_handle_efd(c, readset, writeset);
879 channel_check_window(c, readset, writeset);
880}
881
882void
Damien Millerb38eff82000-04-01 11:09:21 +1000883channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
884{
885 int len;
886 /* Send buffered output data to the socket. */
887 if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
888 len = write(c->sock, buffer_ptr(&c->output),
889 buffer_len(&c->output));
890 if (len <= 0)
891 buffer_consume(&c->output, buffer_len(&c->output));
892 else
893 buffer_consume(&c->output, len);
894 }
895}
896
897void
Damien Miller33b13562000-04-04 14:38:59 +1000898channel_handler_init_20(void)
899{
900 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20;
Damien Millerbd483e72000-04-30 10:00:53 +1000901 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
Damien Miller33b13562000-04-04 14:38:59 +1000902 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100903 channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener;
Damien Millerbd483e72000-04-30 10:00:53 +1000904 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100905 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
Ben Lindstrom7ad97102000-12-06 01:42:49 +0000906 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
Damien Miller33b13562000-04-04 14:38:59 +1000907
908 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2;
909 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100910 channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener;
Damien Millerbd483e72000-04-30 10:00:53 +1000911 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100912 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
Ben Lindstrom7ad97102000-12-06 01:42:49 +0000913 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
Damien Miller33b13562000-04-04 14:38:59 +1000914}
915
916void
Damien Millerb38eff82000-04-01 11:09:21 +1000917channel_handler_init_13(void)
918{
919 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13;
920 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13;
921 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
922 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
923 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
924 channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining;
925 channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining;
Ben Lindstrom7ad97102000-12-06 01:42:49 +0000926 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
Damien Millerb38eff82000-04-01 11:09:21 +1000927
928 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
929 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
930 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
931 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
932 channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13;
Ben Lindstrom7ad97102000-12-06 01:42:49 +0000933 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
Damien Millerb38eff82000-04-01 11:09:21 +1000934}
935
936void
937channel_handler_init_15(void)
938{
939 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15;
Damien Millerbd483e72000-04-30 10:00:53 +1000940 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
Damien Millerb38eff82000-04-01 11:09:21 +1000941 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
942 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
943 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
Ben Lindstrom7ad97102000-12-06 01:42:49 +0000944 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
Damien Millerb38eff82000-04-01 11:09:21 +1000945
946 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
947 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
948 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
949 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
Ben Lindstrom7ad97102000-12-06 01:42:49 +0000950 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
Damien Millerb38eff82000-04-01 11:09:21 +1000951}
952
953void
954channel_handler_init(void)
955{
956 int i;
957 for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
958 channel_pre[i] = NULL;
959 channel_post[i] = NULL;
960 }
Damien Miller33b13562000-04-04 14:38:59 +1000961 if (compat20)
962 channel_handler_init_20();
963 else if (compat13)
Damien Millerb38eff82000-04-01 11:09:21 +1000964 channel_handler_init_13();
965 else
966 channel_handler_init_15();
967}
968
Damien Miller4af51302000-04-16 11:18:38 +1000969void
Damien Millerb38eff82000-04-01 11:09:21 +1000970channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
971{
972 static int did_init = 0;
973 int i;
974 Channel *c;
975
976 if (!did_init) {
977 channel_handler_init();
978 did_init = 1;
979 }
980 for (i = 0; i < channels_alloc; i++) {
981 c = &channels[i];
982 if (c->type == SSH_CHANNEL_FREE)
983 continue;
984 if (ftab[c->type] == NULL)
985 continue;
986 (*ftab[c->type])(c, readset, writeset);
Damien Miller33b13562000-04-04 14:38:59 +1000987 chan_delete_if_full_closed(c);
Damien Millerb38eff82000-04-01 11:09:21 +1000988 }
989}
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000990
Damien Miller4af51302000-04-16 11:18:38 +1000991void
Damien Miller5e953212001-01-30 09:14:00 +1100992channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000993{
Damien Miller5e953212001-01-30 09:14:00 +1100994 int n;
995 u_int sz;
996
997 n = MAX(*maxfdp, channel_max_fd);
998
999 sz = howmany(n+1, NFDBITS) * sizeof(fd_mask);
1000 if (*readsetp == NULL || n > *maxfdp) {
1001 if (*readsetp)
1002 xfree(*readsetp);
1003 if (*writesetp)
1004 xfree(*writesetp);
1005 *readsetp = xmalloc(sz);
1006 *writesetp = xmalloc(sz);
1007 *maxfdp = n;
1008 }
1009 memset(*readsetp, 0, sz);
1010 memset(*writesetp, 0, sz);
1011
1012 channel_handler(channel_pre, *readsetp, *writesetp);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001013}
1014
Damien Miller4af51302000-04-16 11:18:38 +10001015void
Damien Miller95def091999-11-25 00:26:21 +11001016channel_after_select(fd_set * readset, fd_set * writeset)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001017{
Damien Millerb38eff82000-04-01 11:09:21 +10001018 channel_handler(channel_post, readset, writeset);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001019}
1020
Damien Miller5e953212001-01-30 09:14:00 +11001021/* If there is data to send to the connection, enqueue some of it now. */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001022
Damien Miller4af51302000-04-16 11:18:38 +10001023void
Damien Miller95def091999-11-25 00:26:21 +11001024channel_output_poll()
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001025{
Damien Miller95def091999-11-25 00:26:21 +11001026 int len, i;
Damien Millerb38eff82000-04-01 11:09:21 +10001027 Channel *c;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001028
Damien Miller95def091999-11-25 00:26:21 +11001029 for (i = 0; i < channels_alloc; i++) {
Damien Millerb38eff82000-04-01 11:09:21 +10001030 c = &channels[i];
Damien Miller34132e52000-01-14 15:45:46 +11001031
Damien Miller5428f641999-11-25 11:54:57 +11001032 /* We are only interested in channels that can have buffered incoming data. */
Damien Miller34132e52000-01-14 15:45:46 +11001033 if (compat13) {
Damien Millerb38eff82000-04-01 11:09:21 +10001034 if (c->type != SSH_CHANNEL_OPEN &&
1035 c->type != SSH_CHANNEL_INPUT_DRAINING)
Damien Miller34132e52000-01-14 15:45:46 +11001036 continue;
1037 } else {
Damien Millerb38eff82000-04-01 11:09:21 +10001038 if (c->type != SSH_CHANNEL_OPEN)
Damien Miller34132e52000-01-14 15:45:46 +11001039 continue;
Damien Millerb38eff82000-04-01 11:09:21 +10001040 if (c->istate != CHAN_INPUT_OPEN &&
1041 c->istate != CHAN_INPUT_WAIT_DRAIN)
Damien Miller34132e52000-01-14 15:45:46 +11001042 continue;
1043 }
Damien Millerefb4afe2000-04-12 18:45:05 +10001044 if (compat20 &&
1045 (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
Damien Miller33b13562000-04-04 14:38:59 +10001046 debug("channel: %d: no data after CLOSE", c->self);
1047 continue;
1048 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001049
Damien Miller95def091999-11-25 00:26:21 +11001050 /* Get the amount of buffered data for this channel. */
Damien Millerb38eff82000-04-01 11:09:21 +10001051 len = buffer_len(&c->input);
Damien Miller95def091999-11-25 00:26:21 +11001052 if (len > 0) {
Damien Miller5428f641999-11-25 11:54:57 +11001053 /* Send some data for the other side over the secure connection. */
Damien Miller33b13562000-04-04 14:38:59 +10001054 if (compat20) {
1055 if (len > c->remote_window)
1056 len = c->remote_window;
1057 if (len > c->remote_maxpacket)
1058 len = c->remote_maxpacket;
Damien Miller95def091999-11-25 00:26:21 +11001059 } else {
Damien Miller33b13562000-04-04 14:38:59 +10001060 if (packet_is_interactive()) {
1061 if (len > 1024)
1062 len = 512;
1063 } else {
1064 /* Keep the packets at reasonable size. */
1065 if (len > packet_get_maxsize()/2)
1066 len = packet_get_maxsize()/2;
1067 }
Damien Miller95def091999-11-25 00:26:21 +11001068 }
Damien Millerb38eff82000-04-01 11:09:21 +10001069 if (len > 0) {
Damien Miller33b13562000-04-04 14:38:59 +10001070 packet_start(compat20 ?
1071 SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
Damien Millerb38eff82000-04-01 11:09:21 +10001072 packet_put_int(c->remote_id);
1073 packet_put_string(buffer_ptr(&c->input), len);
1074 packet_send();
1075 buffer_consume(&c->input, len);
1076 c->remote_window -= len;
Damien Millerb38eff82000-04-01 11:09:21 +10001077 }
1078 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
Damien Miller95def091999-11-25 00:26:21 +11001079 if (compat13)
1080 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
Damien Miller5428f641999-11-25 11:54:57 +11001081 /*
1082 * input-buffer is empty and read-socket shutdown:
1083 * tell peer, that we will not send more data: send IEOF
1084 */
Damien Millerb38eff82000-04-01 11:09:21 +10001085 chan_ibuf_empty(c);
Damien Miller95def091999-11-25 00:26:21 +11001086 }
Damien Miller33b13562000-04-04 14:38:59 +10001087 /* Send extended data, i.e. stderr */
1088 if (compat20 &&
1089 c->remote_window > 0 &&
1090 (len = buffer_len(&c->extended)) > 0 &&
1091 c->extended_usage == CHAN_EXTENDED_READ) {
1092 if (len > c->remote_window)
1093 len = c->remote_window;
1094 if (len > c->remote_maxpacket)
1095 len = c->remote_maxpacket;
1096 packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
1097 packet_put_int(c->remote_id);
1098 packet_put_int(SSH2_EXTENDED_DATA_STDERR);
1099 packet_put_string(buffer_ptr(&c->extended), len);
1100 packet_send();
1101 buffer_consume(&c->extended, len);
1102 c->remote_window -= len;
1103 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001104 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001105}
1106
Damien Miller5428f641999-11-25 11:54:57 +11001107/*
1108 * This is called when a packet of type CHANNEL_DATA has just been received.
1109 * The message type has already been consumed, but channel number and data is
1110 * still there.
1111 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001112
Damien Miller4af51302000-04-16 11:18:38 +10001113void
Damien Miller62cee002000-09-23 17:15:56 +11001114channel_input_data(int type, int plen, void *ctxt)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001115{
Damien Miller34132e52000-01-14 15:45:46 +11001116 int id;
Damien Miller95def091999-11-25 00:26:21 +11001117 char *data;
Ben Lindstrom46c16222000-12-22 01:43:59 +00001118 u_int data_len;
Damien Millerb38eff82000-04-01 11:09:21 +10001119 Channel *c;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001120
Damien Miller95def091999-11-25 00:26:21 +11001121 /* Get the channel number and verify it. */
Damien Miller34132e52000-01-14 15:45:46 +11001122 id = packet_get_int();
Damien Millerb38eff82000-04-01 11:09:21 +10001123 c = channel_lookup(id);
1124 if (c == NULL)
Damien Miller34132e52000-01-14 15:45:46 +11001125 packet_disconnect("Received data for nonexistent channel %d.", id);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001126
Damien Miller95def091999-11-25 00:26:21 +11001127 /* Ignore any data for non-open channels (might happen on close) */
Damien Millerb38eff82000-04-01 11:09:21 +10001128 if (c->type != SSH_CHANNEL_OPEN &&
1129 c->type != SSH_CHANNEL_X11_OPEN)
Damien Miller34132e52000-01-14 15:45:46 +11001130 return;
1131
1132 /* same for protocol 1.5 if output end is no longer open */
Damien Millerb38eff82000-04-01 11:09:21 +10001133 if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
Damien Miller95def091999-11-25 00:26:21 +11001134 return;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001135
Damien Miller95def091999-11-25 00:26:21 +11001136 /* Get the data. */
1137 data = packet_get_string(&data_len);
Damien Miller4af51302000-04-16 11:18:38 +10001138 packet_done();
Damien Millerb38eff82000-04-01 11:09:21 +10001139
Damien Miller33b13562000-04-04 14:38:59 +10001140 if (compat20){
1141 if (data_len > c->local_maxpacket) {
1142 log("channel %d: rcvd big packet %d, maxpack %d",
1143 c->self, data_len, c->local_maxpacket);
1144 }
1145 if (data_len > c->local_window) {
1146 log("channel %d: rcvd too much data %d, win %d",
1147 c->self, data_len, c->local_window);
1148 xfree(data);
1149 return;
1150 }
1151 c->local_window -= data_len;
1152 }else{
1153 packet_integrity_check(plen, 4 + 4 + data_len, type);
1154 }
Damien Millerb38eff82000-04-01 11:09:21 +10001155 buffer_append(&c->output, data, data_len);
Damien Miller95def091999-11-25 00:26:21 +11001156 xfree(data);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001157}
Damien Miller4af51302000-04-16 11:18:38 +10001158void
Damien Miller62cee002000-09-23 17:15:56 +11001159channel_input_extended_data(int type, int plen, void *ctxt)
Damien Miller33b13562000-04-04 14:38:59 +10001160{
1161 int id;
1162 int tcode;
1163 char *data;
Ben Lindstrom46c16222000-12-22 01:43:59 +00001164 u_int data_len;
Damien Miller33b13562000-04-04 14:38:59 +10001165 Channel *c;
1166
1167 /* Get the channel number and verify it. */
1168 id = packet_get_int();
1169 c = channel_lookup(id);
1170
1171 if (c == NULL)
1172 packet_disconnect("Received extended_data for bad channel %d.", id);
1173 if (c->type != SSH_CHANNEL_OPEN) {
1174 log("channel %d: ext data for non open", id);
1175 return;
1176 }
1177 tcode = packet_get_int();
1178 if (c->efd == -1 ||
1179 c->extended_usage != CHAN_EXTENDED_WRITE ||
1180 tcode != SSH2_EXTENDED_DATA_STDERR) {
1181 log("channel %d: bad ext data", c->self);
1182 return;
1183 }
1184 data = packet_get_string(&data_len);
Damien Miller4af51302000-04-16 11:18:38 +10001185 packet_done();
Damien Miller33b13562000-04-04 14:38:59 +10001186 if (data_len > c->local_window) {
1187 log("channel %d: rcvd too much extended_data %d, win %d",
1188 c->self, data_len, c->local_window);
1189 xfree(data);
1190 return;
1191 }
Damien Millerd3444942000-09-30 14:20:03 +11001192 debug2("channel %d: rcvd ext data %d", c->self, data_len);
Damien Miller33b13562000-04-04 14:38:59 +10001193 c->local_window -= data_len;
1194 buffer_append(&c->extended, data, data_len);
1195 xfree(data);
1196}
1197
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001198
Damien Miller5428f641999-11-25 11:54:57 +11001199/*
1200 * Returns true if no channel has too much buffered data, and false if one or
1201 * more channel is overfull.
1202 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001203
Damien Miller4af51302000-04-16 11:18:38 +10001204int
Damien Miller95def091999-11-25 00:26:21 +11001205channel_not_very_much_buffered_data()
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001206{
Ben Lindstrom46c16222000-12-22 01:43:59 +00001207 u_int i;
Damien Millerb38eff82000-04-01 11:09:21 +10001208 Channel *c;
Damien Miller95def091999-11-25 00:26:21 +11001209
1210 for (i = 0; i < channels_alloc; i++) {
Damien Millerb38eff82000-04-01 11:09:21 +10001211 c = &channels[i];
1212 if (c->type == SSH_CHANNEL_OPEN) {
Damien Miller33b13562000-04-04 14:38:59 +10001213 if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
Damien Millerb38eff82000-04-01 11:09:21 +10001214 debug("channel %d: big input buffer %d",
1215 c->self, buffer_len(&c->input));
Damien Miller95def091999-11-25 00:26:21 +11001216 return 0;
Damien Millerb38eff82000-04-01 11:09:21 +10001217 }
1218 if (buffer_len(&c->output) > packet_get_maxsize()) {
1219 debug("channel %d: big output buffer %d",
1220 c->self, buffer_len(&c->output));
Damien Miller95def091999-11-25 00:26:21 +11001221 return 0;
Damien Millerb38eff82000-04-01 11:09:21 +10001222 }
Damien Miller95def091999-11-25 00:26:21 +11001223 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001224 }
Damien Miller95def091999-11-25 00:26:21 +11001225 return 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001226}
1227
Damien Miller4af51302000-04-16 11:18:38 +10001228void
Damien Miller62cee002000-09-23 17:15:56 +11001229channel_input_ieof(int type, int plen, void *ctxt)
Damien Millerb38eff82000-04-01 11:09:21 +10001230{
1231 int id;
1232 Channel *c;
1233
1234 packet_integrity_check(plen, 4, type);
1235
1236 id = packet_get_int();
1237 c = channel_lookup(id);
1238 if (c == NULL)
1239 packet_disconnect("Received ieof for nonexistent channel %d.", id);
1240 chan_rcvd_ieof(c);
1241}
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001242
Damien Miller4af51302000-04-16 11:18:38 +10001243void
Damien Miller62cee002000-09-23 17:15:56 +11001244channel_input_close(int type, int plen, void *ctxt)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001245{
Damien Millerb38eff82000-04-01 11:09:21 +10001246 int id;
1247 Channel *c;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001248
Damien Millerb38eff82000-04-01 11:09:21 +10001249 packet_integrity_check(plen, 4, type);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001250
Damien Millerb38eff82000-04-01 11:09:21 +10001251 id = packet_get_int();
1252 c = channel_lookup(id);
1253 if (c == NULL)
1254 packet_disconnect("Received close for nonexistent channel %d.", id);
Damien Miller5428f641999-11-25 11:54:57 +11001255
1256 /*
1257 * Send a confirmation that we have closed the channel and no more
1258 * data is coming for it.
1259 */
Damien Miller95def091999-11-25 00:26:21 +11001260 packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
Damien Millerb38eff82000-04-01 11:09:21 +10001261 packet_put_int(c->remote_id);
Damien Miller95def091999-11-25 00:26:21 +11001262 packet_send();
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001263
Damien Miller5428f641999-11-25 11:54:57 +11001264 /*
1265 * If the channel is in closed state, we have sent a close request,
1266 * and the other side will eventually respond with a confirmation.
1267 * Thus, we cannot free the channel here, because then there would be
1268 * no-one to receive the confirmation. The channel gets freed when
1269 * the confirmation arrives.
1270 */
Damien Millerb38eff82000-04-01 11:09:21 +10001271 if (c->type != SSH_CHANNEL_CLOSED) {
Damien Miller5428f641999-11-25 11:54:57 +11001272 /*
1273 * Not a closed channel - mark it as draining, which will
1274 * cause it to be freed later.
1275 */
Damien Millerb38eff82000-04-01 11:09:21 +10001276 buffer_consume(&c->input, buffer_len(&c->input));
1277 c->type = SSH_CHANNEL_OUTPUT_DRAINING;
Damien Miller95def091999-11-25 00:26:21 +11001278 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001279}
1280
Damien Millerb38eff82000-04-01 11:09:21 +10001281/* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
Damien Miller4af51302000-04-16 11:18:38 +10001282void
Damien Miller62cee002000-09-23 17:15:56 +11001283channel_input_oclose(int type, int plen, void *ctxt)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001284{
Damien Millerb38eff82000-04-01 11:09:21 +10001285 int id = packet_get_int();
1286 Channel *c = channel_lookup(id);
1287 packet_integrity_check(plen, 4, type);
1288 if (c == NULL)
1289 packet_disconnect("Received oclose for nonexistent channel %d.", id);
1290 chan_rcvd_oclose(c);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001291}
1292
Damien Miller4af51302000-04-16 11:18:38 +10001293void
Damien Miller62cee002000-09-23 17:15:56 +11001294channel_input_close_confirmation(int type, int plen, void *ctxt)
Damien Millerb38eff82000-04-01 11:09:21 +10001295{
1296 int id = packet_get_int();
1297 Channel *c = channel_lookup(id);
1298
Damien Miller4af51302000-04-16 11:18:38 +10001299 packet_done();
Damien Millerb38eff82000-04-01 11:09:21 +10001300 if (c == NULL)
1301 packet_disconnect("Received close confirmation for "
1302 "out-of-range channel %d.", id);
1303 if (c->type != SSH_CHANNEL_CLOSED)
1304 packet_disconnect("Received close confirmation for "
1305 "non-closed channel %d (type %d).", id, c->type);
1306 channel_free(c->self);
1307}
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001308
Damien Miller4af51302000-04-16 11:18:38 +10001309void
Damien Miller62cee002000-09-23 17:15:56 +11001310channel_input_open_confirmation(int type, int plen, void *ctxt)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001311{
Damien Millerb38eff82000-04-01 11:09:21 +10001312 int id, remote_id;
1313 Channel *c;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001314
Damien Miller33b13562000-04-04 14:38:59 +10001315 if (!compat20)
1316 packet_integrity_check(plen, 4 + 4, type);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001317
Damien Millerb38eff82000-04-01 11:09:21 +10001318 id = packet_get_int();
1319 c = channel_lookup(id);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001320
Damien Millerb38eff82000-04-01 11:09:21 +10001321 if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1322 packet_disconnect("Received open confirmation for "
1323 "non-opening channel %d.", id);
1324 remote_id = packet_get_int();
Damien Miller5428f641999-11-25 11:54:57 +11001325 /* Record the remote channel number and mark that the channel is now open. */
Damien Millerb38eff82000-04-01 11:09:21 +10001326 c->remote_id = remote_id;
1327 c->type = SSH_CHANNEL_OPEN;
Damien Miller33b13562000-04-04 14:38:59 +10001328
1329 if (compat20) {
1330 c->remote_window = packet_get_int();
1331 c->remote_maxpacket = packet_get_int();
Damien Miller4af51302000-04-16 11:18:38 +10001332 packet_done();
Damien Miller33b13562000-04-04 14:38:59 +10001333 if (c->cb_fn != NULL && c->cb_event == type) {
Damien Millerd3444942000-09-30 14:20:03 +11001334 debug2("callback start");
Damien Miller33b13562000-04-04 14:38:59 +10001335 c->cb_fn(c->self, c->cb_arg);
Damien Millerd3444942000-09-30 14:20:03 +11001336 debug2("callback done");
Damien Miller33b13562000-04-04 14:38:59 +10001337 }
1338 debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1339 c->remote_window, c->remote_maxpacket);
1340 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001341}
1342
Damien Miller4af51302000-04-16 11:18:38 +10001343void
Damien Miller62cee002000-09-23 17:15:56 +11001344channel_input_open_failure(int type, int plen, void *ctxt)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001345{
Kevin Steves12057502001-02-05 14:54:34 +00001346 int id, reason;
1347 char *msg = NULL, *lang = NULL;
Damien Millerb38eff82000-04-01 11:09:21 +10001348 Channel *c;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001349
Damien Miller33b13562000-04-04 14:38:59 +10001350 if (!compat20)
1351 packet_integrity_check(plen, 4, type);
Damien Millerb38eff82000-04-01 11:09:21 +10001352
1353 id = packet_get_int();
1354 c = channel_lookup(id);
1355
1356 if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1357 packet_disconnect("Received open failure for "
1358 "non-opening channel %d.", id);
Damien Miller33b13562000-04-04 14:38:59 +10001359 if (compat20) {
Kevin Steves12057502001-02-05 14:54:34 +00001360 reason = packet_get_int();
1361 if (packet_remaining() > 0) {
1362 msg = packet_get_string(NULL);
1363 lang = packet_get_string(NULL);
1364 }
Damien Miller4af51302000-04-16 11:18:38 +10001365 packet_done();
Kevin Steves12057502001-02-05 14:54:34 +00001366 log("channel_open_failure: %d: reason %d %s", id,
1367 reason, msg ? msg : "<no additional info>");
1368 if (msg != NULL)
1369 xfree(msg);
1370 if (lang != NULL)
1371 xfree(lang);
Damien Miller33b13562000-04-04 14:38:59 +10001372 }
Damien Miller95def091999-11-25 00:26:21 +11001373 /* Free the channel. This will also close the socket. */
Damien Millerb38eff82000-04-01 11:09:21 +10001374 channel_free(id);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001375}
1376
Damien Miller33b13562000-04-04 14:38:59 +10001377void
Damien Miller62cee002000-09-23 17:15:56 +11001378channel_input_channel_request(int type, int plen, void *ctxt)
Damien Miller33b13562000-04-04 14:38:59 +10001379{
1380 int id;
1381 Channel *c;
1382
1383 id = packet_get_int();
1384 c = channel_lookup(id);
1385
1386 if (c == NULL ||
1387 (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1388 packet_disconnect("Received request for "
1389 "non-open channel %d.", id);
1390 if (c->cb_fn != NULL && c->cb_event == type) {
Damien Millerd3444942000-09-30 14:20:03 +11001391 debug2("callback start");
Damien Miller33b13562000-04-04 14:38:59 +10001392 c->cb_fn(c->self, c->cb_arg);
Damien Millerd3444942000-09-30 14:20:03 +11001393 debug2("callback done");
Damien Miller33b13562000-04-04 14:38:59 +10001394 } else {
1395 char *service = packet_get_string(NULL);
1396 debug("channel: %d rcvd request for %s", c->self, service);
Damien Millerd3444942000-09-30 14:20:03 +11001397 debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
Damien Miller33b13562000-04-04 14:38:59 +10001398 xfree(service);
1399 }
1400}
1401
Damien Miller4af51302000-04-16 11:18:38 +10001402void
Damien Miller62cee002000-09-23 17:15:56 +11001403channel_input_window_adjust(int type, int plen, void *ctxt)
Damien Miller33b13562000-04-04 14:38:59 +10001404{
1405 Channel *c;
1406 int id, adjust;
1407
1408 if (!compat20)
1409 return;
1410
1411 /* Get the channel number and verify it. */
1412 id = packet_get_int();
1413 c = channel_lookup(id);
1414
1415 if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1416 log("Received window adjust for "
1417 "non-open channel %d.", id);
1418 return;
1419 }
1420 adjust = packet_get_int();
Damien Miller4af51302000-04-16 11:18:38 +10001421 packet_done();
Damien Millerd3444942000-09-30 14:20:03 +11001422 debug2("channel %d: rcvd adjust %d", id, adjust);
Damien Miller33b13562000-04-04 14:38:59 +10001423 c->remote_window += adjust;
1424}
1425
Damien Miller5428f641999-11-25 11:54:57 +11001426/*
1427 * Stops listening for channels, and removes any unix domain sockets that we
1428 * might have.
1429 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001430
Damien Miller4af51302000-04-16 11:18:38 +10001431void
Damien Miller95def091999-11-25 00:26:21 +11001432channel_stop_listening()
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001433{
Damien Miller95def091999-11-25 00:26:21 +11001434 int i;
1435 for (i = 0; i < channels_alloc; i++) {
1436 switch (channels[i].type) {
1437 case SSH_CHANNEL_AUTH_SOCKET:
1438 close(channels[i].sock);
Damien Miller78315eb2000-09-29 23:01:36 +11001439 unlink(channels[i].path);
Damien Miller95def091999-11-25 00:26:21 +11001440 channel_free(i);
1441 break;
1442 case SSH_CHANNEL_PORT_LISTENER:
Damien Miller0bc1bd82000-11-13 22:57:25 +11001443 case SSH_CHANNEL_RPORT_LISTENER:
Damien Miller95def091999-11-25 00:26:21 +11001444 case SSH_CHANNEL_X11_LISTENER:
1445 close(channels[i].sock);
1446 channel_free(i);
1447 break;
1448 default:
1449 break;
1450 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001451 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001452}
1453
Damien Miller5428f641999-11-25 11:54:57 +11001454/*
Damien Miller6f83b8e2000-05-02 09:23:45 +10001455 * Closes the sockets/fds of all channels. This is used to close extra file
Damien Miller5428f641999-11-25 11:54:57 +11001456 * descriptors after a fork.
1457 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001458
Damien Miller4af51302000-04-16 11:18:38 +10001459void
Damien Miller95def091999-11-25 00:26:21 +11001460channel_close_all()
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001461{
Damien Miller95def091999-11-25 00:26:21 +11001462 int i;
Damien Miller6f83b8e2000-05-02 09:23:45 +10001463 for (i = 0; i < channels_alloc; i++)
Damien Miller95def091999-11-25 00:26:21 +11001464 if (channels[i].type != SSH_CHANNEL_FREE)
Damien Miller6f83b8e2000-05-02 09:23:45 +10001465 channel_close_fds(&channels[i]);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001466}
1467
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001468/* Returns true if any channel is still open. */
1469
Damien Miller4af51302000-04-16 11:18:38 +10001470int
Damien Miller95def091999-11-25 00:26:21 +11001471channel_still_open()
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001472{
Ben Lindstrom46c16222000-12-22 01:43:59 +00001473 u_int i;
Damien Miller95def091999-11-25 00:26:21 +11001474 for (i = 0; i < channels_alloc; i++)
1475 switch (channels[i].type) {
1476 case SSH_CHANNEL_FREE:
1477 case SSH_CHANNEL_X11_LISTENER:
1478 case SSH_CHANNEL_PORT_LISTENER:
Damien Miller0bc1bd82000-11-13 22:57:25 +11001479 case SSH_CHANNEL_RPORT_LISTENER:
Damien Miller95def091999-11-25 00:26:21 +11001480 case SSH_CHANNEL_CLOSED:
1481 case SSH_CHANNEL_AUTH_SOCKET:
Ben Lindstrom7ad97102000-12-06 01:42:49 +00001482 case SSH_CHANNEL_CONNECTING: /* XXX ??? */
Damien Miller95def091999-11-25 00:26:21 +11001483 continue;
Damien Miller33b13562000-04-04 14:38:59 +10001484 case SSH_CHANNEL_LARVAL:
1485 if (!compat20)
1486 fatal("cannot happen: SSH_CHANNEL_LARVAL");
1487 continue;
Damien Miller95def091999-11-25 00:26:21 +11001488 case SSH_CHANNEL_OPENING:
1489 case SSH_CHANNEL_OPEN:
1490 case SSH_CHANNEL_X11_OPEN:
1491 return 1;
1492 case SSH_CHANNEL_INPUT_DRAINING:
1493 case SSH_CHANNEL_OUTPUT_DRAINING:
1494 if (!compat13)
1495 fatal("cannot happen: OUT_DRAIN");
1496 return 1;
1497 default:
1498 fatal("channel_still_open: bad channel type %d", channels[i].type);
1499 /* NOTREACHED */
1500 }
1501 return 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001502}
1503
Damien Miller5428f641999-11-25 11:54:57 +11001504/*
1505 * Returns a message describing the currently open forwarded connections,
1506 * suitable for sending to the client. The message contains crlf pairs for
1507 * newlines.
1508 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001509
Damien Miller95def091999-11-25 00:26:21 +11001510char *
1511channel_open_message()
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001512{
Damien Miller95def091999-11-25 00:26:21 +11001513 Buffer buffer;
1514 int i;
1515 char buf[512], *cp;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001516
Damien Miller95def091999-11-25 00:26:21 +11001517 buffer_init(&buffer);
1518 snprintf(buf, sizeof buf, "The following connections are open:\r\n");
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001519 buffer_append(&buffer, buf, strlen(buf));
Damien Miller95def091999-11-25 00:26:21 +11001520 for (i = 0; i < channels_alloc; i++) {
1521 Channel *c = &channels[i];
1522 switch (c->type) {
1523 case SSH_CHANNEL_FREE:
1524 case SSH_CHANNEL_X11_LISTENER:
1525 case SSH_CHANNEL_PORT_LISTENER:
Damien Miller0bc1bd82000-11-13 22:57:25 +11001526 case SSH_CHANNEL_RPORT_LISTENER:
Damien Miller95def091999-11-25 00:26:21 +11001527 case SSH_CHANNEL_CLOSED:
1528 case SSH_CHANNEL_AUTH_SOCKET:
1529 continue;
Damien Miller33b13562000-04-04 14:38:59 +10001530 case SSH_CHANNEL_LARVAL:
Damien Miller95def091999-11-25 00:26:21 +11001531 case SSH_CHANNEL_OPENING:
Ben Lindstrom7ad97102000-12-06 01:42:49 +00001532 case SSH_CHANNEL_CONNECTING:
Damien Miller95def091999-11-25 00:26:21 +11001533 case SSH_CHANNEL_OPEN:
1534 case SSH_CHANNEL_X11_OPEN:
1535 case SSH_CHANNEL_INPUT_DRAINING:
1536 case SSH_CHANNEL_OUTPUT_DRAINING:
Damien Millerb38eff82000-04-01 11:09:21 +10001537 snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
Damien Miller34132e52000-01-14 15:45:46 +11001538 c->self, c->remote_name,
1539 c->type, c->remote_id,
1540 c->istate, buffer_len(&c->input),
Damien Millerb38eff82000-04-01 11:09:21 +10001541 c->ostate, buffer_len(&c->output),
1542 c->rfd, c->wfd);
Damien Miller95def091999-11-25 00:26:21 +11001543 buffer_append(&buffer, buf, strlen(buf));
1544 continue;
1545 default:
Damien Millerb38eff82000-04-01 11:09:21 +10001546 fatal("channel_open_message: bad channel type %d", c->type);
Damien Miller95def091999-11-25 00:26:21 +11001547 /* NOTREACHED */
1548 }
1549 }
1550 buffer_append(&buffer, "\0", 1);
1551 cp = xstrdup(buffer_ptr(&buffer));
1552 buffer_free(&buffer);
1553 return cp;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001554}
1555
Damien Miller5428f641999-11-25 11:54:57 +11001556/*
1557 * Initiate forwarding of connections to local port "port" through the secure
1558 * channel to host:port from remote side.
1559 */
Kevin Steves12057502001-02-05 14:54:34 +00001560int
Damien Miller0bc1bd82000-11-13 22:57:25 +11001561channel_request_local_forwarding(u_short listen_port, const char *host_to_connect,
1562 u_short port_to_connect, int gateway_ports)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001563{
Kevin Steves12057502001-02-05 14:54:34 +00001564 return channel_request_forwarding(
Damien Miller0bc1bd82000-11-13 22:57:25 +11001565 NULL, listen_port,
1566 host_to_connect, port_to_connect,
1567 gateway_ports, /*remote_fwd*/ 0);
1568}
1569
1570/*
1571 * If 'remote_fwd' is true we have a '-R style' listener for protocol 2
1572 * (SSH_CHANNEL_RPORT_LISTENER).
1573 */
Kevin Steves12057502001-02-05 14:54:34 +00001574int
Damien Miller0bc1bd82000-11-13 22:57:25 +11001575channel_request_forwarding(
1576 const char *listen_address, u_short listen_port,
1577 const char *host_to_connect, u_short port_to_connect,
1578 int gateway_ports, int remote_fwd)
1579{
1580 int success, ch, sock, on = 1, ctype;
Damien Miller34132e52000-01-14 15:45:46 +11001581 struct addrinfo hints, *ai, *aitop;
1582 char ntop[NI_MAXHOST], strport[NI_MAXSERV];
Damien Miller0bc1bd82000-11-13 22:57:25 +11001583 const char *host;
Damien Miller5428f641999-11-25 11:54:57 +11001584 struct linger linger;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001585
Kevin Steves12057502001-02-05 14:54:34 +00001586 success = 0;
1587
Damien Miller0bc1bd82000-11-13 22:57:25 +11001588 if (remote_fwd) {
1589 host = listen_address;
Kevin Stevesef4eea92001-02-05 12:42:17 +00001590 ctype = SSH_CHANNEL_RPORT_LISTENER;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001591 } else {
1592 host = host_to_connect;
1593 ctype =SSH_CHANNEL_PORT_LISTENER;
1594 }
1595
Kevin Steves12057502001-02-05 14:54:34 +00001596 if (strlen(host) > sizeof(channels[0].path) - 1) {
1597 error("Forward host name too long.");
1598 return success;
1599 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001600
Damien Miller0bc1bd82000-11-13 22:57:25 +11001601 /* XXX listen_address is currently ignored */
Damien Miller5428f641999-11-25 11:54:57 +11001602 /*
Damien Miller34132e52000-01-14 15:45:46 +11001603 * getaddrinfo returns a loopback address if the hostname is
1604 * set to NULL and hints.ai_flags is not AI_PASSIVE
Damien Miller5428f641999-11-25 11:54:57 +11001605 */
Damien Miller34132e52000-01-14 15:45:46 +11001606 memset(&hints, 0, sizeof(hints));
1607 hints.ai_family = IPv4or6;
1608 hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1609 hints.ai_socktype = SOCK_STREAM;
Damien Miller0bc1bd82000-11-13 22:57:25 +11001610 snprintf(strport, sizeof strport, "%d", listen_port);
Damien Miller34132e52000-01-14 15:45:46 +11001611 if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1612 packet_disconnect("getaddrinfo: fatal error");
Damien Miller5428f641999-11-25 11:54:57 +11001613
Damien Miller34132e52000-01-14 15:45:46 +11001614 for (ai = aitop; ai; ai = ai->ai_next) {
1615 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1616 continue;
1617 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1618 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
Damien Miller0bc1bd82000-11-13 22:57:25 +11001619 error("channel_request_forwarding: getnameinfo failed");
Damien Miller34132e52000-01-14 15:45:46 +11001620 continue;
1621 }
1622 /* Create a port to listen for the host. */
1623 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1624 if (sock < 0) {
1625 /* this is no error since kernel may not support ipv6 */
1626 verbose("socket: %.100s", strerror(errno));
1627 continue;
1628 }
1629 /*
1630 * Set socket options. We would like the socket to disappear
1631 * as soon as it has been closed for whatever reason.
1632 */
1633 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1634 linger.l_onoff = 1;
1635 linger.l_linger = 5;
1636 setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1637 debug("Local forwarding listening on %s port %s.", ntop, strport);
Damien Miller95def091999-11-25 00:26:21 +11001638
Damien Miller34132e52000-01-14 15:45:46 +11001639 /* Bind the socket to the address. */
1640 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1641 /* address can be in use ipv6 address is already bound */
Damien Miller3c7eeb22000-03-03 22:35:33 +11001642 if (!ai->ai_next)
1643 error("bind: %.100s", strerror(errno));
1644 else
1645 verbose("bind: %.100s", strerror(errno));
Kevin Stevesef4eea92001-02-05 12:42:17 +00001646
Damien Miller34132e52000-01-14 15:45:46 +11001647 close(sock);
1648 continue;
1649 }
1650 /* Start listening for connections on the socket. */
1651 if (listen(sock, 5) < 0) {
1652 error("listen: %.100s", strerror(errno));
1653 close(sock);
1654 continue;
1655 }
1656 /* Allocate a channel number for the socket. */
Damien Miller0bc1bd82000-11-13 22:57:25 +11001657 ch = channel_new("port listener", ctype, sock, sock, -1,
Damien Millerbd483e72000-04-30 10:00:53 +10001658 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
Damien Miller69b69aa2000-10-28 14:19:58 +11001659 0, xstrdup("port listener"), 1);
Damien Miller34132e52000-01-14 15:45:46 +11001660 strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
Damien Miller0bc1bd82000-11-13 22:57:25 +11001661 channels[ch].host_port = port_to_connect;
1662 channels[ch].listening_port = listen_port;
Damien Miller34132e52000-01-14 15:45:46 +11001663 success = 1;
1664 }
1665 if (success == 0)
Kevin Steves12057502001-02-05 14:54:34 +00001666 error("channel_request_forwarding: cannot listen to port: %d",
1667 listen_port);
Damien Miller34132e52000-01-14 15:45:46 +11001668 freeaddrinfo(aitop);
Kevin Steves12057502001-02-05 14:54:34 +00001669 return success;
Damien Miller95def091999-11-25 00:26:21 +11001670}
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001671
Damien Miller5428f641999-11-25 11:54:57 +11001672/*
1673 * Initiate forwarding of connections to port "port" on remote host through
1674 * the secure channel to host:port from local side.
1675 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001676
Damien Miller4af51302000-04-16 11:18:38 +10001677void
Damien Miller0bc1bd82000-11-13 22:57:25 +11001678channel_request_remote_forwarding(u_short listen_port,
1679 const char *host_to_connect, u_short port_to_connect)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001680{
Damien Miller0bc1bd82000-11-13 22:57:25 +11001681 int payload_len, type, success = 0;
1682
Damien Miller95def091999-11-25 00:26:21 +11001683 /* Record locally that connection to this host/port is permitted. */
1684 if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1685 fatal("channel_request_remote_forwarding: too many forwards");
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001686
Damien Miller95def091999-11-25 00:26:21 +11001687 /* Send the forward request to the remote side. */
Damien Miller33b13562000-04-04 14:38:59 +10001688 if (compat20) {
1689 const char *address_to_bind = "0.0.0.0";
1690 packet_start(SSH2_MSG_GLOBAL_REQUEST);
1691 packet_put_cstring("tcpip-forward");
1692 packet_put_char(0); /* boolean: want reply */
1693 packet_put_cstring(address_to_bind);
1694 packet_put_int(listen_port);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001695 packet_send();
1696 packet_write_wait();
1697 /* Assume that server accepts the request */
1698 success = 1;
Damien Miller33b13562000-04-04 14:38:59 +10001699 } else {
1700 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
Damien Miller33b13562000-04-04 14:38:59 +10001701 packet_put_int(listen_port);
Damien Miller8bb73be2000-04-19 16:26:12 +10001702 packet_put_cstring(host_to_connect);
1703 packet_put_int(port_to_connect);
Damien Miller33b13562000-04-04 14:38:59 +10001704 packet_send();
1705 packet_write_wait();
Damien Miller0bc1bd82000-11-13 22:57:25 +11001706
1707 /* Wait for response from the remote side. */
1708 type = packet_read(&payload_len);
1709 switch (type) {
1710 case SSH_SMSG_SUCCESS:
1711 success = 1;
1712 break;
1713 case SSH_SMSG_FAILURE:
1714 log("Warning: Server denied remote port forwarding.");
1715 break;
1716 default:
1717 /* Unknown packet */
1718 packet_disconnect("Protocol error for port forward request:"
1719 "received packet type %d.", type);
1720 }
1721 }
1722 if (success) {
1723 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
1724 permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
1725 permitted_opens[num_permitted_opens].listen_port = listen_port;
1726 num_permitted_opens++;
Damien Miller33b13562000-04-04 14:38:59 +10001727 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001728}
1729
Damien Miller5428f641999-11-25 11:54:57 +11001730/*
1731 * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
1732 * listening for the port, and sends back a success reply (or disconnect
1733 * message if there was an error). This never returns if there was an error.
1734 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001735
Damien Miller4af51302000-04-16 11:18:38 +10001736void
Damien Millere247cc42000-05-07 12:03:14 +10001737channel_input_port_forward_request(int is_root, int gateway_ports)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001738{
Damien Milleraae6c611999-12-06 11:47:28 +11001739 u_short port, host_port;
Damien Miller95def091999-11-25 00:26:21 +11001740 char *hostname;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001741
Damien Miller95def091999-11-25 00:26:21 +11001742 /* Get arguments from the packet. */
1743 port = packet_get_int();
1744 hostname = packet_get_string(NULL);
1745 host_port = packet_get_int();
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001746
Damien Millerbac2d8a2000-09-05 16:13:06 +11001747#ifndef HAVE_CYGWIN
Damien Miller5428f641999-11-25 11:54:57 +11001748 /*
1749 * Check that an unprivileged user is not trying to forward a
1750 * privileged port.
1751 */
Damien Miller95def091999-11-25 00:26:21 +11001752 if (port < IPPORT_RESERVED && !is_root)
1753 packet_disconnect("Requested forwarding of port %d but user is not root.",
1754 port);
Damien Millerbac2d8a2000-09-05 16:13:06 +11001755#endif
Damien Miller0bc1bd82000-11-13 22:57:25 +11001756 /* Initiate forwarding */
Damien Millere247cc42000-05-07 12:03:14 +10001757 channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
Damien Miller95def091999-11-25 00:26:21 +11001758
1759 /* Free the argument string. */
1760 xfree(hostname);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001761}
1762
Damien Millerb38eff82000-04-01 11:09:21 +10001763/* XXX move to aux.c */
1764int
1765channel_connect_to(const char *host, u_short host_port)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001766{
Damien Miller34132e52000-01-14 15:45:46 +11001767 struct addrinfo hints, *ai, *aitop;
1768 char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1769 int gaierr;
Damien Millerb38eff82000-04-01 11:09:21 +10001770 int sock = -1;
Damien Miller95def091999-11-25 00:26:21 +11001771
Damien Miller34132e52000-01-14 15:45:46 +11001772 memset(&hints, 0, sizeof(hints));
1773 hints.ai_family = IPv4or6;
1774 hints.ai_socktype = SOCK_STREAM;
1775 snprintf(strport, sizeof strport, "%d", host_port);
1776 if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1777 error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
Damien Millerb38eff82000-04-01 11:09:21 +10001778 return -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001779 }
Damien Miller34132e52000-01-14 15:45:46 +11001780 for (ai = aitop; ai; ai = ai->ai_next) {
1781 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1782 continue;
1783 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1784 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
Damien Millerb38eff82000-04-01 11:09:21 +10001785 error("channel_connect_to: getnameinfo failed");
Damien Miller34132e52000-01-14 15:45:46 +11001786 continue;
1787 }
1788 /* Create the socket. */
1789 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1790 if (sock < 0) {
1791 error("socket: %.100s", strerror(errno));
1792 continue;
1793 }
Ben Lindstrom48bd7c12001-01-09 00:35:42 +00001794 if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
Ben Lindstrom7ad97102000-12-06 01:42:49 +00001795 fatal("connect_to: F_SETFL: %s", strerror(errno));
Damien Miller34132e52000-01-14 15:45:46 +11001796 /* Connect to the host/port. */
Ben Lindstrom7ad97102000-12-06 01:42:49 +00001797 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 &&
1798 errno != EINPROGRESS) {
Damien Miller34132e52000-01-14 15:45:46 +11001799 error("connect %.100s port %s: %.100s", ntop, strport,
1800 strerror(errno));
1801 close(sock);
Kevin Stevesef4eea92001-02-05 12:42:17 +00001802 continue; /* fail -- try next */
Damien Miller34132e52000-01-14 15:45:46 +11001803 }
1804 break; /* success */
1805
1806 }
1807 freeaddrinfo(aitop);
Damien Miller34132e52000-01-14 15:45:46 +11001808 if (!ai) {
Kevin Stevesef4eea92001-02-05 12:42:17 +00001809 error("connect %.100s port %d: failed.", host, host_port);
Damien Millerb38eff82000-04-01 11:09:21 +10001810 return -1;
1811 }
1812 /* success */
1813 return sock;
1814}
Damien Miller0bc1bd82000-11-13 22:57:25 +11001815int
1816channel_connect_by_listen_adress(u_short listen_port)
1817{
1818 int i;
1819 for (i = 0; i < num_permitted_opens; i++)
1820 if (permitted_opens[i].listen_port == listen_port)
1821 return channel_connect_to(
1822 permitted_opens[i].host_to_connect,
1823 permitted_opens[i].port_to_connect);
Ben Lindstromc72745a2000-12-02 19:03:54 +00001824 error("WARNING: Server requests forwarding for unknown listen_port %d",
1825 listen_port);
Damien Miller0bc1bd82000-11-13 22:57:25 +11001826 return -1;
1827}
Damien Millerb38eff82000-04-01 11:09:21 +10001828
1829/*
1830 * This is called after receiving PORT_OPEN message. This attempts to
1831 * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1832 * or CHANNEL_OPEN_FAILURE.
1833 */
1834
Damien Miller4af51302000-04-16 11:18:38 +10001835void
Damien Miller62cee002000-09-23 17:15:56 +11001836channel_input_port_open(int type, int plen, void *ctxt)
Damien Millerb38eff82000-04-01 11:09:21 +10001837{
1838 u_short host_port;
1839 char *host, *originator_string;
1840 int remote_channel, sock = -1, newch, i, denied;
Ben Lindstrom46c16222000-12-22 01:43:59 +00001841 u_int host_len, originator_len;
Damien Millerb38eff82000-04-01 11:09:21 +10001842
1843 /* Get remote channel number. */
1844 remote_channel = packet_get_int();
1845
1846 /* Get host name to connect to. */
1847 host = packet_get_string(&host_len);
1848
1849 /* Get port to connect to. */
1850 host_port = packet_get_int();
1851
1852 /* Get remote originator name. */
1853 if (have_hostname_in_open) {
1854 originator_string = packet_get_string(&originator_len);
1855 originator_len += 4; /* size of packet_int */
1856 } else {
1857 originator_string = xstrdup("unknown (remote did not supply name)");
1858 originator_len = 0; /* no originator supplied */
Damien Miller95def091999-11-25 00:26:21 +11001859 }
Damien Miller34132e52000-01-14 15:45:46 +11001860
Damien Millerb38eff82000-04-01 11:09:21 +10001861 packet_integrity_check(plen,
1862 4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001863
Damien Millerb38eff82000-04-01 11:09:21 +10001864 /* Check if opening that port is permitted. */
1865 denied = 0;
1866 if (!all_opens_permitted) {
1867 /* Go trough all permitted ports. */
1868 for (i = 0; i < num_permitted_opens; i++)
1869 if (permitted_opens[i].port_to_connect == host_port &&
1870 strcmp(permitted_opens[i].host_to_connect, host) == 0)
1871 break;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001872
Damien Millerb38eff82000-04-01 11:09:21 +10001873 /* Check if we found the requested port among those permitted. */
1874 if (i >= num_permitted_opens) {
1875 /* The port is not permitted. */
1876 log("Received request to connect to %.100s:%d, but the request was denied.",
1877 host, host_port);
1878 denied = 1;
1879 }
1880 }
1881 sock = denied ? -1 : channel_connect_to(host, host_port);
1882 if (sock > 0) {
1883 /* Allocate a channel for this connection. */
Ben Lindstrom7ad97102000-12-06 01:42:49 +00001884 newch = channel_allocate(SSH_CHANNEL_CONNECTING,
1885 sock, originator_string);
1886/*XXX delay answer? */
Damien Millerb38eff82000-04-01 11:09:21 +10001887 channels[newch].remote_id = remote_channel;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001888
Damien Millerb38eff82000-04-01 11:09:21 +10001889 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1890 packet_put_int(remote_channel);
1891 packet_put_int(newch);
1892 packet_send();
1893 } else {
1894 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1895 packet_put_int(remote_channel);
1896 packet_send();
1897 }
Damien Miller95def091999-11-25 00:26:21 +11001898 xfree(host);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001899}
1900
Damien Miller5428f641999-11-25 11:54:57 +11001901/*
1902 * Creates an internet domain socket for listening for X11 connections.
1903 * Returns a suitable value for the DISPLAY variable, or NULL if an error
1904 * occurs.
1905 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001906
Damien Miller34132e52000-01-14 15:45:46 +11001907#define NUM_SOCKS 10
1908
Damien Miller95def091999-11-25 00:26:21 +11001909char *
Damien Millera34a28b1999-12-14 10:47:15 +11001910x11_create_display_inet(int screen_number, int x11_display_offset)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001911{
Damien Milleraae6c611999-12-06 11:47:28 +11001912 int display_number, sock;
1913 u_short port;
Damien Miller34132e52000-01-14 15:45:46 +11001914 struct addrinfo hints, *ai, *aitop;
1915 char strport[NI_MAXSERV];
1916 int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1917 char display[512];
Damien Miller95def091999-11-25 00:26:21 +11001918 char hostname[MAXHOSTNAMELEN];
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001919
Damien Millera34a28b1999-12-14 10:47:15 +11001920 for (display_number = x11_display_offset;
Damien Miller95def091999-11-25 00:26:21 +11001921 display_number < MAX_DISPLAYS;
1922 display_number++) {
1923 port = 6000 + display_number;
Damien Miller34132e52000-01-14 15:45:46 +11001924 memset(&hints, 0, sizeof(hints));
1925 hints.ai_family = IPv4or6;
1926 hints.ai_flags = AI_PASSIVE; /* XXX loopback only ? */
1927 hints.ai_socktype = SOCK_STREAM;
1928 snprintf(strport, sizeof strport, "%d", port);
1929 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1930 error("getaddrinfo: %.100s", gai_strerror(gaierr));
Damien Miller95def091999-11-25 00:26:21 +11001931 return NULL;
1932 }
Damien Miller34132e52000-01-14 15:45:46 +11001933 for (ai = aitop; ai; ai = ai->ai_next) {
1934 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1935 continue;
1936 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1937 if (sock < 0) {
Damien Miller89d97962000-10-14 12:37:19 +11001938 if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) {
Damien Millere2192732000-01-17 13:22:55 +11001939 error("socket: %.100s", strerror(errno));
1940 return NULL;
1941 } else {
Damien Millercb5e44a2000-09-29 12:12:36 +11001942 debug("x11_create_display_inet: Socket family %d not supported",
1943 ai->ai_family);
Damien Millere2192732000-01-17 13:22:55 +11001944 continue;
1945 }
Damien Miller34132e52000-01-14 15:45:46 +11001946 }
1947 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1948 debug("bind port %d: %.100s", port, strerror(errno));
1949 shutdown(sock, SHUT_RDWR);
1950 close(sock);
Damien Miller3c7eeb22000-03-03 22:35:33 +11001951
1952 if (ai->ai_next)
1953 continue;
1954
Damien Miller34132e52000-01-14 15:45:46 +11001955 for (n = 0; n < num_socks; n++) {
1956 shutdown(socks[n], SHUT_RDWR);
1957 close(socks[n]);
1958 }
1959 num_socks = 0;
1960 break;
1961 }
1962 socks[num_socks++] = sock;
Damien Miller7bcb0892000-03-11 20:45:40 +11001963#ifndef DONT_TRY_OTHER_AF
Damien Miller34132e52000-01-14 15:45:46 +11001964 if (num_socks == NUM_SOCKS)
1965 break;
Damien Miller7bcb0892000-03-11 20:45:40 +11001966#else
1967 break;
1968#endif
Damien Miller95def091999-11-25 00:26:21 +11001969 }
Ben Lindstrom87b147f2001-01-25 00:41:12 +00001970 freeaddrinfo(aitop);
Damien Miller34132e52000-01-14 15:45:46 +11001971 if (num_socks > 0)
1972 break;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001973 }
Damien Miller95def091999-11-25 00:26:21 +11001974 if (display_number >= MAX_DISPLAYS) {
1975 error("Failed to allocate internet-domain X11 display socket.");
1976 return NULL;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001977 }
Damien Miller95def091999-11-25 00:26:21 +11001978 /* Start listening for connections on the socket. */
Damien Miller34132e52000-01-14 15:45:46 +11001979 for (n = 0; n < num_socks; n++) {
1980 sock = socks[n];
1981 if (listen(sock, 5) < 0) {
1982 error("listen: %.100s", strerror(errno));
1983 shutdown(sock, SHUT_RDWR);
1984 close(sock);
1985 return NULL;
1986 }
Damien Miller95def091999-11-25 00:26:21 +11001987 }
Damien Miller34132e52000-01-14 15:45:46 +11001988
Damien Miller95def091999-11-25 00:26:21 +11001989 /* Set up a suitable value for the DISPLAY variable. */
1990 if (gethostname(hostname, sizeof(hostname)) < 0)
1991 fatal("gethostname: %.100s", strerror(errno));
Damien Miller76112de1999-12-21 11:18:08 +11001992
1993#ifdef IPADDR_IN_DISPLAY
Kevin Stevesef4eea92001-02-05 12:42:17 +00001994 /*
Damien Miller76112de1999-12-21 11:18:08 +11001995 * HPUX detects the local hostname in the DISPLAY variable and tries
1996 * to set up a shared memory connection to the server, which it
1997 * incorrectly supposes to be local.
1998 *
1999 * The workaround - as used in later $$H and other programs - is
2000 * is to set display to the host's IP address.
2001 */
2002 {
2003 struct hostent *he;
2004 struct in_addr my_addr;
2005
2006 he = gethostbyname(hostname);
2007 if (he == NULL) {
2008 error("[X11-broken-fwd-hostname-workaround] Could not get "
2009 "IP address for hostname %s.", hostname);
2010
2011 packet_send_debug("[X11-broken-fwd-hostname-workaround]"
2012 "Could not get IP address for hostname %s.", hostname);
2013
2014 shutdown(sock, SHUT_RDWR);
2015 close(sock);
2016
2017 return NULL;
2018 }
2019
2020 memcpy(&my_addr, he->h_addr_list[0], sizeof(struct in_addr));
2021
2022 /* Set DISPLAY to <ip address>:screen.display */
Kevin Stevesef4eea92001-02-05 12:42:17 +00002023 snprintf(display, sizeof(display), "%.50s:%d.%d", inet_ntoa(my_addr),
Kevin Stevesda6cd592000-12-29 18:41:21 +00002024 display_number, screen_number);
Damien Miller76112de1999-12-21 11:18:08 +11002025 }
2026#else /* IPADDR_IN_DISPLAY */
2027 /* Just set DISPLAY to hostname:screen.display */
Damien Miller34132e52000-01-14 15:45:46 +11002028 snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
Kevin Stevesda6cd592000-12-29 18:41:21 +00002029 display_number, screen_number);
Damien Miller76112de1999-12-21 11:18:08 +11002030#endif /* IPADDR_IN_DISPLAY */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002031
Damien Miller34132e52000-01-14 15:45:46 +11002032 /* Allocate a channel for each socket. */
2033 for (n = 0; n < num_socks; n++) {
2034 sock = socks[n];
Damien Millerbd483e72000-04-30 10:00:53 +10002035 (void) channel_new("x11 listener",
2036 SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
2037 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
Damien Miller69b69aa2000-10-28 14:19:58 +11002038 0, xstrdup("X11 inet listener"), 1);
Damien Miller34132e52000-01-14 15:45:46 +11002039 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002040
Damien Miller95def091999-11-25 00:26:21 +11002041 /* Return a suitable value for the DISPLAY environment variable. */
Damien Miller34132e52000-01-14 15:45:46 +11002042 return xstrdup(display);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002043}
2044
2045#ifndef X_UNIX_PATH
2046#define X_UNIX_PATH "/tmp/.X11-unix/X"
2047#endif
2048
2049static
2050int
Ben Lindstrom46c16222000-12-22 01:43:59 +00002051connect_local_xsocket(u_int dnr)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002052{
Damien Miller95def091999-11-25 00:26:21 +11002053 static const char *const x_sockets[] = {
2054 X_UNIX_PATH "%u",
2055 "/var/X/.X11-unix/X" "%u",
2056 "/usr/spool/sockets/X11/" "%u",
2057 NULL
2058 };
2059 int sock;
2060 struct sockaddr_un addr;
2061 const char *const * path;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002062
Damien Miller95def091999-11-25 00:26:21 +11002063 for (path = x_sockets; *path; ++path) {
2064 sock = socket(AF_UNIX, SOCK_STREAM, 0);
2065 if (sock < 0)
2066 error("socket: %.100s", strerror(errno));
2067 memset(&addr, 0, sizeof(addr));
2068 addr.sun_family = AF_UNIX;
2069 snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
2070 if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
2071 return sock;
2072 close(sock);
2073 }
2074 error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
2075 return -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002076}
2077
Damien Millerbd483e72000-04-30 10:00:53 +10002078int
2079x11_connect_display(void)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002080{
Damien Millerbd483e72000-04-30 10:00:53 +10002081 int display_number, sock = 0;
Damien Miller95def091999-11-25 00:26:21 +11002082 const char *display;
Damien Millerbd483e72000-04-30 10:00:53 +10002083 char buf[1024], *cp;
Damien Miller34132e52000-01-14 15:45:46 +11002084 struct addrinfo hints, *ai, *aitop;
2085 char strport[NI_MAXSERV];
2086 int gaierr;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002087
Damien Miller95def091999-11-25 00:26:21 +11002088 /* Try to open a socket for the local X server. */
2089 display = getenv("DISPLAY");
2090 if (!display) {
2091 error("DISPLAY not set.");
Damien Millerbd483e72000-04-30 10:00:53 +10002092 return -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002093 }
Damien Miller5428f641999-11-25 11:54:57 +11002094 /*
2095 * Now we decode the value of the DISPLAY variable and make a
2096 * connection to the real X server.
2097 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002098
Damien Miller5428f641999-11-25 11:54:57 +11002099 /*
2100 * Check if it is a unix domain socket. Unix domain displays are in
2101 * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
2102 */
Damien Miller95def091999-11-25 00:26:21 +11002103 if (strncmp(display, "unix:", 5) == 0 ||
2104 display[0] == ':') {
2105 /* Connect to the unix domain socket. */
2106 if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
2107 error("Could not parse display number from DISPLAY: %.100s",
2108 display);
Damien Millerbd483e72000-04-30 10:00:53 +10002109 return -1;
Damien Miller95def091999-11-25 00:26:21 +11002110 }
2111 /* Create a socket. */
2112 sock = connect_local_xsocket(display_number);
2113 if (sock < 0)
Damien Millerbd483e72000-04-30 10:00:53 +10002114 return -1;
Damien Miller95def091999-11-25 00:26:21 +11002115
2116 /* OK, we now have a connection to the display. */
Damien Millerbd483e72000-04-30 10:00:53 +10002117 return sock;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002118 }
Damien Miller5428f641999-11-25 11:54:57 +11002119 /*
2120 * Connect to an inet socket. The DISPLAY value is supposedly
2121 * hostname:d[.s], where hostname may also be numeric IP address.
2122 */
Damien Miller95def091999-11-25 00:26:21 +11002123 strncpy(buf, display, sizeof(buf));
2124 buf[sizeof(buf) - 1] = 0;
2125 cp = strchr(buf, ':');
2126 if (!cp) {
2127 error("Could not find ':' in DISPLAY: %.100s", display);
Damien Millerbd483e72000-04-30 10:00:53 +10002128 return -1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002129 }
Damien Miller95def091999-11-25 00:26:21 +11002130 *cp = 0;
Damien Miller5428f641999-11-25 11:54:57 +11002131 /* buf now contains the host name. But first we parse the display number. */
Damien Miller95def091999-11-25 00:26:21 +11002132 if (sscanf(cp + 1, "%d", &display_number) != 1) {
2133 error("Could not parse display number from DISPLAY: %.100s",
2134 display);
Damien Millerbd483e72000-04-30 10:00:53 +10002135 return -1;
Damien Miller95def091999-11-25 00:26:21 +11002136 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002137
Damien Miller34132e52000-01-14 15:45:46 +11002138 /* Look up the host address */
2139 memset(&hints, 0, sizeof(hints));
2140 hints.ai_family = IPv4or6;
2141 hints.ai_socktype = SOCK_STREAM;
2142 snprintf(strport, sizeof strport, "%d", 6000 + display_number);
2143 if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
2144 error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
Damien Millerbd483e72000-04-30 10:00:53 +10002145 return -1;
Damien Miller95def091999-11-25 00:26:21 +11002146 }
Damien Miller34132e52000-01-14 15:45:46 +11002147 for (ai = aitop; ai; ai = ai->ai_next) {
2148 /* Create a socket. */
2149 sock = socket(ai->ai_family, SOCK_STREAM, 0);
2150 if (sock < 0) {
2151 debug("socket: %.100s", strerror(errno));
Damien Millerb38eff82000-04-01 11:09:21 +10002152 continue;
2153 }
2154 /* Connect it to the display. */
2155 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2156 debug("connect %.100s port %d: %.100s", buf,
2157 6000 + display_number, strerror(errno));
2158 close(sock);
2159 continue;
2160 }
2161 /* Success */
2162 break;
Damien Miller34132e52000-01-14 15:45:46 +11002163 }
Damien Miller34132e52000-01-14 15:45:46 +11002164 freeaddrinfo(aitop);
2165 if (!ai) {
Damien Miller4af51302000-04-16 11:18:38 +10002166 error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
Damien Miller34132e52000-01-14 15:45:46 +11002167 strerror(errno));
Damien Millerbd483e72000-04-30 10:00:53 +10002168 return -1;
Damien Miller95def091999-11-25 00:26:21 +11002169 }
Damien Millerbd483e72000-04-30 10:00:53 +10002170 return sock;
2171}
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002172
Damien Millerbd483e72000-04-30 10:00:53 +10002173/*
2174 * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
2175 * the remote channel number. We should do whatever we want, and respond
2176 * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
2177 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002178
Damien Millerbd483e72000-04-30 10:00:53 +10002179void
Damien Miller62cee002000-09-23 17:15:56 +11002180x11_input_open(int type, int plen, void *ctxt)
Damien Millerbd483e72000-04-30 10:00:53 +10002181{
2182 int remote_channel, sock = 0, newch;
2183 char *remote_host;
Ben Lindstrom46c16222000-12-22 01:43:59 +00002184 u_int remote_len;
Damien Miller95def091999-11-25 00:26:21 +11002185
Damien Millerbd483e72000-04-30 10:00:53 +10002186 /* Get remote channel number. */
2187 remote_channel = packet_get_int();
Damien Miller95def091999-11-25 00:26:21 +11002188
Damien Millerbd483e72000-04-30 10:00:53 +10002189 /* Get remote originator name. */
2190 if (have_hostname_in_open) {
2191 remote_host = packet_get_string(&remote_len);
2192 remote_len += 4;
2193 } else {
2194 remote_host = xstrdup("unknown (remote did not supply name)");
2195 remote_len = 0;
2196 }
2197
2198 debug("Received X11 open request.");
2199 packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
2200
2201 /* Obtain a connection to the real X display. */
2202 sock = x11_connect_display();
2203 if (sock == -1) {
2204 /* Send refusal to the remote host. */
2205 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2206 packet_put_int(remote_channel);
2207 packet_send();
2208 } else {
2209 /* Allocate a channel for this connection. */
2210 newch = channel_allocate(
2211 (x11_saved_proto == NULL) ?
2212 SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
2213 sock, remote_host);
2214 channels[newch].remote_id = remote_channel;
2215
2216 /* Send a confirmation to the remote host. */
2217 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2218 packet_put_int(remote_channel);
2219 packet_put_int(newch);
2220 packet_send();
2221 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002222}
2223
Damien Miller69b69aa2000-10-28 14:19:58 +11002224/* dummy protocol handler that denies SSH-1 requests (agent/x11) */
2225void
2226deny_input_open(int type, int plen, void *ctxt)
2227{
2228 int rchan = packet_get_int();
2229 switch(type){
2230 case SSH_SMSG_AGENT_OPEN:
2231 error("Warning: ssh server tried agent forwarding.");
2232 break;
2233 case SSH_SMSG_X11_OPEN:
2234 error("Warning: ssh server tried X11 forwarding.");
2235 break;
2236 default:
2237 error("deny_input_open: type %d plen %d", type, plen);
2238 break;
2239 }
2240 error("Warning: this is probably a break in attempt by a malicious server.");
2241 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2242 packet_put_int(rchan);
2243 packet_send();
2244}
2245
Damien Miller5428f641999-11-25 11:54:57 +11002246/*
2247 * Requests forwarding of X11 connections, generates fake authentication
2248 * data, and enables authentication spoofing.
2249 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002250
Damien Miller4af51302000-04-16 11:18:38 +10002251void
Damien Millerbd483e72000-04-30 10:00:53 +10002252x11_request_forwarding_with_spoofing(int client_session_id,
2253 const char *proto, const char *data)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002254{
Ben Lindstrom46c16222000-12-22 01:43:59 +00002255 u_int data_len = (u_int) strlen(data) / 2;
Ben Lindstromb3211a82001-02-10 22:33:19 +00002256 u_int i, value, len;
Damien Miller95def091999-11-25 00:26:21 +11002257 char *new_data;
2258 int screen_number;
2259 const char *cp;
2260 u_int32_t rand = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002261
Damien Miller95def091999-11-25 00:26:21 +11002262 cp = getenv("DISPLAY");
2263 if (cp)
2264 cp = strchr(cp, ':');
2265 if (cp)
2266 cp = strchr(cp, '.');
2267 if (cp)
2268 screen_number = atoi(cp + 1);
2269 else
2270 screen_number = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002271
Damien Miller95def091999-11-25 00:26:21 +11002272 /* Save protocol name. */
2273 x11_saved_proto = xstrdup(proto);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002274
Damien Miller5428f641999-11-25 11:54:57 +11002275 /*
2276 * Extract real authentication data and generate fake data of the
2277 * same length.
2278 */
Damien Miller95def091999-11-25 00:26:21 +11002279 x11_saved_data = xmalloc(data_len);
2280 x11_fake_data = xmalloc(data_len);
2281 for (i = 0; i < data_len; i++) {
2282 if (sscanf(data + 2 * i, "%2x", &value) != 1)
2283 fatal("x11_request_forwarding: bad authentication data: %.100s", data);
2284 if (i % 4 == 0)
2285 rand = arc4random();
2286 x11_saved_data[i] = value;
2287 x11_fake_data[i] = rand & 0xff;
2288 rand >>= 8;
2289 }
2290 x11_saved_data_len = data_len;
2291 x11_fake_data_len = data_len;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002292
Damien Miller95def091999-11-25 00:26:21 +11002293 /* Convert the fake data into hex. */
Ben Lindstromb3211a82001-02-10 22:33:19 +00002294 len = 2 * data_len + 1;
2295 new_data = xmalloc(len);
Damien Miller95def091999-11-25 00:26:21 +11002296 for (i = 0; i < data_len; i++)
Ben Lindstromb3211a82001-02-10 22:33:19 +00002297 snprintf(new_data + 2 * i, len - 2 * i,
2298 "%02x", (u_char) x11_fake_data[i]);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002299
Damien Miller95def091999-11-25 00:26:21 +11002300 /* Send the request packet. */
Damien Millerbd483e72000-04-30 10:00:53 +10002301 if (compat20) {
2302 channel_request_start(client_session_id, "x11-req", 0);
2303 packet_put_char(0); /* XXX bool single connection */
2304 } else {
2305 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2306 }
2307 packet_put_cstring(proto);
2308 packet_put_cstring(new_data);
Damien Miller95def091999-11-25 00:26:21 +11002309 packet_put_int(screen_number);
2310 packet_send();
2311 packet_write_wait();
2312 xfree(new_data);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002313}
2314
2315/* Sends a message to the server to request authentication fd forwarding. */
2316
Damien Miller4af51302000-04-16 11:18:38 +10002317void
Damien Miller95def091999-11-25 00:26:21 +11002318auth_request_forwarding()
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002319{
Damien Miller95def091999-11-25 00:26:21 +11002320 packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2321 packet_send();
2322 packet_write_wait();
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002323}
2324
Damien Miller5428f641999-11-25 11:54:57 +11002325/*
2326 * Returns the name of the forwarded authentication socket. Returns NULL if
2327 * there is no forwarded authentication socket. The returned value points to
2328 * a static buffer.
2329 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002330
Damien Miller95def091999-11-25 00:26:21 +11002331char *
2332auth_get_socket_name()
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002333{
Damien Miller95def091999-11-25 00:26:21 +11002334 return channel_forwarded_auth_socket_name;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002335}
2336
2337/* removes the agent forwarding socket */
2338
Damien Miller4af51302000-04-16 11:18:38 +10002339void
Damien Miller95def091999-11-25 00:26:21 +11002340cleanup_socket(void)
2341{
Damien Miller78315eb2000-09-29 23:01:36 +11002342 unlink(channel_forwarded_auth_socket_name);
Damien Miller95def091999-11-25 00:26:21 +11002343 rmdir(channel_forwarded_auth_socket_dir);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002344}
2345
Damien Miller5428f641999-11-25 11:54:57 +11002346/*
Damien Millerd3a18572000-06-07 19:55:44 +10002347 * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
Damien Miller5428f641999-11-25 11:54:57 +11002348 * This starts forwarding authentication requests.
2349 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002350
Damien Millerd3a18572000-06-07 19:55:44 +10002351int
Damien Miller95def091999-11-25 00:26:21 +11002352auth_input_request_forwarding(struct passwd * pw)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002353{
Damien Miller95def091999-11-25 00:26:21 +11002354 int sock, newch;
2355 struct sockaddr_un sunaddr;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002356
Damien Miller95def091999-11-25 00:26:21 +11002357 if (auth_get_socket_name() != NULL)
2358 fatal("Protocol error: authentication forwarding requested twice.");
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002359
Damien Miller95def091999-11-25 00:26:21 +11002360 /* Temporarily drop privileged uid for mkdir/bind. */
2361 temporarily_use_uid(pw->pw_uid);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002362
Damien Miller95def091999-11-25 00:26:21 +11002363 /* Allocate a buffer for the socket name, and format the name. */
2364 channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2365 channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2366 strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002367
Damien Miller95def091999-11-25 00:26:21 +11002368 /* Create private directory for socket */
Damien Millerd3a18572000-06-07 19:55:44 +10002369 if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {
2370 packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",
2371 strerror(errno));
2372 restore_uid();
2373 xfree(channel_forwarded_auth_socket_name);
2374 xfree(channel_forwarded_auth_socket_dir);
2375 channel_forwarded_auth_socket_name = NULL;
2376 channel_forwarded_auth_socket_dir = NULL;
2377 return 0;
2378 }
Damien Miller95def091999-11-25 00:26:21 +11002379 snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2380 channel_forwarded_auth_socket_dir, (int) getpid());
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002381
Damien Miller95def091999-11-25 00:26:21 +11002382 if (atexit(cleanup_socket) < 0) {
2383 int saved = errno;
2384 cleanup_socket();
2385 packet_disconnect("socket: %.100s", strerror(saved));
2386 }
2387 /* Create the socket. */
2388 sock = socket(AF_UNIX, SOCK_STREAM, 0);
2389 if (sock < 0)
2390 packet_disconnect("socket: %.100s", strerror(errno));
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002391
Damien Miller95def091999-11-25 00:26:21 +11002392 /* Bind it to the name. */
2393 memset(&sunaddr, 0, sizeof(sunaddr));
2394 sunaddr.sun_family = AF_UNIX;
2395 strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2396 sizeof(sunaddr.sun_path));
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002397
Damien Miller95def091999-11-25 00:26:21 +11002398 if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2399 packet_disconnect("bind: %.100s", strerror(errno));
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002400
Damien Miller95def091999-11-25 00:26:21 +11002401 /* Restore the privileged uid. */
2402 restore_uid();
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002403
Damien Miller95def091999-11-25 00:26:21 +11002404 /* Start listening on the socket. */
2405 if (listen(sock, 5) < 0)
2406 packet_disconnect("listen: %.100s", strerror(errno));
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002407
Damien Miller95def091999-11-25 00:26:21 +11002408 /* Allocate a channel for the authentication agent socket. */
Damien Miller0bc1bd82000-11-13 22:57:25 +11002409 newch = channel_new("auth socket",
2410 SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
2411 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
2412 0, xstrdup("auth socket"), 1);
2413
Damien Miller037a0dc1999-12-07 15:38:31 +11002414 strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2415 sizeof(channels[newch].path));
Damien Millerd3a18572000-06-07 19:55:44 +10002416 return 1;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002417}
2418
2419/* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2420
Damien Miller4af51302000-04-16 11:18:38 +10002421void
Damien Miller62cee002000-09-23 17:15:56 +11002422auth_input_open_request(int type, int plen, void *ctxt)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002423{
Damien Miller95def091999-11-25 00:26:21 +11002424 int remch, sock, newch;
2425 char *dummyname;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002426
Damien Millerb38eff82000-04-01 11:09:21 +10002427 packet_integrity_check(plen, 4, type);
2428
Damien Miller95def091999-11-25 00:26:21 +11002429 /* Read the remote channel number from the message. */
2430 remch = packet_get_int();
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002431
Damien Miller5428f641999-11-25 11:54:57 +11002432 /*
2433 * Get a connection to the local authentication agent (this may again
2434 * get forwarded).
2435 */
Damien Miller95def091999-11-25 00:26:21 +11002436 sock = ssh_get_authentication_socket();
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002437
Damien Miller5428f641999-11-25 11:54:57 +11002438 /*
2439 * If we could not connect the agent, send an error message back to
2440 * the server. This should never happen unless the agent dies,
2441 * because authentication forwarding is only enabled if we have an
2442 * agent.
2443 */
Damien Miller95def091999-11-25 00:26:21 +11002444 if (sock < 0) {
2445 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2446 packet_put_int(remch);
2447 packet_send();
2448 return;
2449 }
2450 debug("Forwarding authentication connection.");
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002451
Damien Miller5428f641999-11-25 11:54:57 +11002452 /*
2453 * Dummy host name. This will be freed when the channel is freed; it
2454 * will still be valid in the packet_put_string below since the
2455 * channel cannot yet be freed at that point.
2456 */
Damien Miller95def091999-11-25 00:26:21 +11002457 dummyname = xstrdup("authentication agent connection");
2458
2459 newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2460 channels[newch].remote_id = remch;
2461
2462 /* Send a confirmation to the remote host. */
2463 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2464 packet_put_int(remch);
2465 packet_put_int(newch);
2466 packet_send();
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002467}
Damien Miller33b13562000-04-04 14:38:59 +10002468
2469void
Damien Millerbd483e72000-04-30 10:00:53 +10002470channel_start_open(int id)
Damien Miller33b13562000-04-04 14:38:59 +10002471{
2472 Channel *c = channel_lookup(id);
2473 if (c == NULL) {
2474 log("channel_open: %d: bad id", id);
2475 return;
2476 }
Damien Millerbd483e72000-04-30 10:00:53 +10002477 debug("send channel open %d", id);
Damien Miller33b13562000-04-04 14:38:59 +10002478 packet_start(SSH2_MSG_CHANNEL_OPEN);
2479 packet_put_cstring(c->ctype);
2480 packet_put_int(c->self);
2481 packet_put_int(c->local_window);
2482 packet_put_int(c->local_maxpacket);
Damien Millerbd483e72000-04-30 10:00:53 +10002483}
2484void
2485channel_open(int id)
2486{
2487 /* XXX REMOVE ME */
2488 channel_start_open(id);
Damien Miller33b13562000-04-04 14:38:59 +10002489 packet_send();
Damien Miller33b13562000-04-04 14:38:59 +10002490}
2491void
2492channel_request(int id, char *service, int wantconfirm)
2493{
2494 channel_request_start(id, service, wantconfirm);
2495 packet_send();
2496 debug("channel request %d: %s", id, service) ;
2497}
2498void
2499channel_request_start(int id, char *service, int wantconfirm)
2500{
2501 Channel *c = channel_lookup(id);
2502 if (c == NULL) {
2503 log("channel_request: %d: bad id", id);
2504 return;
2505 }
2506 packet_start(SSH2_MSG_CHANNEL_REQUEST);
2507 packet_put_int(c->remote_id);
2508 packet_put_cstring(service);
2509 packet_put_char(wantconfirm);
2510}
2511void
2512channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2513{
2514 Channel *c = channel_lookup(id);
2515 if (c == NULL) {
2516 log("channel_register_callback: %d: bad id", id);
2517 return;
2518 }
2519 c->cb_event = mtype;
2520 c->cb_fn = fn;
2521 c->cb_arg = arg;
2522}
2523void
2524channel_register_cleanup(int id, channel_callback_fn *fn)
2525{
2526 Channel *c = channel_lookup(id);
2527 if (c == NULL) {
2528 log("channel_register_cleanup: %d: bad id", id);
2529 return;
2530 }
2531 c->dettach_user = fn;
2532}
2533void
2534channel_cancel_cleanup(int id)
2535{
2536 Channel *c = channel_lookup(id);
2537 if (c == NULL) {
2538 log("channel_cancel_cleanup: %d: bad id", id);
2539 return;
2540 }
2541 c->dettach_user = NULL;
2542}
Kevin Stevesef4eea92001-02-05 12:42:17 +00002543void
Damien Millerad833b32000-08-23 10:46:23 +10002544channel_register_filter(int id, channel_filter_fn *fn)
2545{
2546 Channel *c = channel_lookup(id);
2547 if (c == NULL) {
2548 log("channel_register_filter: %d: bad id", id);
2549 return;
2550 }
2551 c->input_filter = fn;
2552}
Damien Miller33b13562000-04-04 14:38:59 +10002553
2554void
Damien Miller69b69aa2000-10-28 14:19:58 +11002555channel_set_fds(int id, int rfd, int wfd, int efd,
2556 int extusage, int nonblock)
Damien Miller33b13562000-04-04 14:38:59 +10002557{
2558 Channel *c = channel_lookup(id);
2559 if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2560 fatal("channel_activate for non-larval channel %d.", id);
Damien Miller69b69aa2000-10-28 14:19:58 +11002561 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
Damien Miller33b13562000-04-04 14:38:59 +10002562 c->type = SSH_CHANNEL_OPEN;
Damien Miller33b13562000-04-04 14:38:59 +10002563 /* XXX window size? */
Damien Millere4340be2000-09-16 13:29:08 +11002564 c->local_window = c->local_window_max = c->local_maxpacket * 2;
Damien Miller33b13562000-04-04 14:38:59 +10002565 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2566 packet_put_int(c->remote_id);
2567 packet_put_int(c->local_window);
2568 packet_send();
2569}