src/usr.bin/ssh/channels.c - diff

Return to channels.c CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/channels.c between version 1.109 and 1.109.2.4

version 1.109, 2001/04/17 12:55:03

version 1.109.2.4, 2001/11/15 00:15:19

Line 12

* incompatible with the protocol description in the RFC file, it must be

* called by a name other than "ssh" or "Secure Shell".

* SSH2 support added by Markus Friedl.

Line 42

Line 41

#include "includes.h"

RCSID("$OpenBSD$");

#include <openssl/rsa.h>

#include <openssl/dsa.h>

#include "ssh.h"

#include "ssh1.h"

#include "ssh2.h"

#include "packet.h"

#include "xmalloc.h"

#include "buffer.h"

#include "bufaux.h"

#include "uidswap.h"

#include "log.h"

#include "misc.h"

#include "channels.h"

#include "nchan.h"

#include "compat.h"

#include "canohost.h"

#include "key.h"

#include "authfd.h"

/* Maximum number of fake X11 displays to try. */

#define MAX_DISPLAYS 1000

/* Max len of agent socket */

/* -- channel core */

#define MAX_SOCKET_NAME 100

* Pointer to an array containing all allocated channels. The array is

* dynamically extended as needed.

static Channel *channels = NULL;

static Channel **channels = NULL;

* Size of the channel array. All slots of the array must always be

* initialized (at least the type field); unused slots are marked with type

* initialized (at least the type field); unused slots set to NULL

* SSH_CHANNEL_FREE.

static int channels_alloc = 0;

* Maximum file descriptor value used in any of the channels. This is

* updated in channel_allocate.

* updated in channel_new.

static int channel_max_fd = 0;

/* Name and directory of socket for authentication agent forwarding. */

static char *channel_forwarded_auth_socket_name = NULL;

static char *channel_forwarded_auth_socket_dir = NULL;

/* Saved X11 authentication protocol name. */

/* -- tcp forwarding */

char *x11_saved_proto = NULL;

/* Saved X11 authentication data. This is the real data. */

char *x11_saved_data = NULL;

u_int x11_saved_data_len = 0;

* Fake X11 authentication data. This is what the server will be sending us;

* we should replace any occurrences of this by the real data.

char *x11_fake_data = NULL;

u_int x11_fake_data_len;

* Data structure for storing which hosts are permitted for forward requests.

* The local sides of any remote forwards are stored in this array to prevent

* a corrupt remote server from accessing arbitrary TCP/IP ports on our local

Line 119

Line 93

/* List of all permitted host/port pairs to connect. */

static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];

/* Number of permitted host/port pairs in the array. */

static int num_permitted_opens = 0;

Line 128

Line 103

static int all_opens_permitted = 0;

/* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */

static int have_hostname_in_open = 0;

/* AF_UNSPEC or AF_INET or AF_INET6 */

/* -- X11 forwarding */

extern int IPv4or6;

void port_open_helper(Channel *c, char *rtype);

/* Maximum number of fake X11 displays to try. */

#define MAX_DISPLAYS 1000

/* Sets specific protocol options. */

/* Saved X11 authentication protocol name. */

static char *x11_saved_proto = NULL;

void

/* Saved X11 authentication data. This is the real data. */

channel_set_options(int hostname_in_open)

static char *x11_saved_data = NULL;

{

static u_int x11_saved_data_len = 0;

have_hostname_in_open = hostname_in_open;

}

/* lookup channel by id */

* Fake X11 authentication data. This is what the server will be sending us;

* we should replace any occurrences of this by the real data.

static char *x11_fake_data = NULL;

static u_int x11_fake_data_len;

/* -- agent forwarding */

#define NUM_SOCKS 10

/* Name and directory of socket for authentication agent forwarding. */

static char *auth_sock_name = NULL;

static char *auth_sock_dir = NULL;

/* AF_UNSPEC or AF_INET or AF_INET6 */

static int IPv4or6 = AF_UNSPEC;

/* helper */

static void port_open_helper(Channel *c, char *rtype);

/* -- channel core */

Channel *

channel_lookup(int id)

{

Channel *c;

if (id < 0 || id > channels_alloc) {

log("channel_lookup: %d: bad id", id);

return NULL;

}

c = &channels[id];

c = channels[id];

if (c->type == SSH_CHANNEL_FREE) {

if (c == NULL) {

log("channel_lookup: %d: bad id: channel free", id);

return NULL;

}

Line 167

Line 162

* when the channel consumer/producer is ready, e.g. shell exec'd

void

static void

channel_register_fds(Channel *c, int rfd, int wfd, int efd,

int extusage, int nonblock)

{

Line 212

Line 207

* remote_name to be freed.

int

Channel *

channel_new(char *ctype, int type, int rfd, int wfd, int efd,

int window, int maxpack, int extusage, char *remote_name, int nonblock)

{

Line 223

Line 218

if (channels_alloc == 0) {

chan_init();

channels_alloc = 10;

channels = xmalloc(channels_alloc * sizeof(Channel));

channels = xmalloc(channels_alloc * sizeof(Channel *));

for (i = 0; i < channels_alloc; i++)

channels[i].type = SSH_CHANNEL_FREE;

channels[i] = NULL;

fatal_add_cleanup((void (*) (void *)) channel_free_all, NULL);

* Kludge: arrange a call to channel_stop_listening if we

* terminate with fatal().

fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);

}

/* Try to find a free slot where to put the new channel. */

for (found = -1, i = 0; i < channels_alloc; i++)

if (channels[i].type == SSH_CHANNEL_FREE) {

if (channels[i] == NULL) {

/* Found a free slot. */

found = i;

break;

Line 244

Line 235

found = channels_alloc;

channels_alloc += 10;

debug2("channel: expanding %d", channels_alloc);

channels = xrealloc(channels, channels_alloc * sizeof(Channel));

channels = xrealloc(channels, channels_alloc * sizeof(Channel *));

for (i = found; i < channels_alloc; i++)

channels[i].type = SSH_CHANNEL_FREE;

channels[i] = NULL;

}

/* Initialize and return new channel number. */

/* Initialize and return new channel. */

c = &channels[found];

c = channels[found] = xmalloc(sizeof(Channel));

memset(c, 0, sizeof(Channel));

buffer_init(&c->input);

buffer_init(&c->output);

buffer_init(&c->extended);

Line 269

Line 261

c->cb_fn = NULL;

c->cb_arg = NULL;

c->cb_event = 0;

c->dettach_user = NULL;

c->force_drain = 0;

c->detach_user = NULL;

c->input_filter = NULL;

debug("channel %d: new [%s]", found, remote_name);

return found;

return c;

}

/* old interface XXX */

int

static int

channel_allocate(int type, int sock, char *remote_name)

channel_find_maxfd(void)

{

return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1);

int i, max = 0;

Channel *c;

for (i = 0; i < channels_alloc; i++) {

c = channels[i];

if (c != NULL) {

max = MAX(max, c->rfd);

max = MAX(max, c->wfd);

max = MAX(max, c->efd);

}

return max;

}

int

channel_close_fd(int *fdp)

{

int ret = 0, fd = *fdp;

if (fd != -1) {

ret = close(fd);

*fdp = -1;

if (fd == channel_max_fd)

channel_max_fd = channel_find_maxfd();

}

return ret;

}

/* Close all channel fd/socket. */

void

static void

channel_close_fds(Channel *c)

{

if (c->sock != -1) {

debug3("channel_close_fds: channel %d: r %d w %d e %d",

close(c->sock);

c->self, c->rfd, c->wfd, c->efd);

c->sock = -1;

}

channel_close_fd(&c->sock);

if (c->rfd != -1) {

channel_close_fd(&c->rfd);

close(c->rfd);

channel_close_fd(&c->wfd);

c->rfd = -1;

channel_close_fd(&c->efd);

}

if (c->wfd != -1) {

close(c->wfd);

c->wfd = -1;

}

if (c->efd != -1) {

close(c->efd);

c->efd = -1;

}

/* Free the channel and close its fd/socket. */

void

channel_free(int id)

channel_free(Channel *c)

{

Channel *c = channel_lookup(id);

char *s;

char *s = channel_open_message();

int i, n;

if (c == NULL)

for (n = 0, i = 0; i < channels_alloc; i++)

packet_disconnect("channel free: bad local channel %d", id);

if (channels[i])

debug("channel_free: channel %d: status: %s", id, s);

n++;

debug("channel_free: channel %d: %s, nchannels %d", c->self,

c->remote_name ? c->remote_name : "???", n);

s = channel_open_message();

debug3("channel_free: status: %s", s);

xfree(s);

if (c->dettach_user != NULL) {

debug("channel_free: channel %d: dettaching channel user", id);

c->dettach_user(c->self, NULL);

}

if (c->sock != -1)

shutdown(c->sock, SHUT_RDWR);

channel_close_fds(c);

buffer_free(&c->input);

buffer_free(&c->output);

buffer_free(&c->extended);

c->type = SSH_CHANNEL_FREE;

if (c->remote_name) {

xfree(c->remote_name);

c->remote_name = NULL;

}

channels[c->self] = NULL;

xfree(c);

}

void

channel_free_all(void)

{

int i;

for (i = 0; i < channels_alloc; i++)

if (channels[i] != NULL)

channel_free(channels[i]);

}

* Closes the sockets/fds of all channels. This is used to close extra file

* descriptors after a fork.

void

channel_close_all()

{

int i;

for (i = 0; i < channels_alloc; i++)

if (channels[i] != NULL)

channel_close_fds(channels[i]);

}

* Stop listening to channels.

void

channel_stop_listening(void)

{

int i;

Channel *c;

for (i = 0; i < channels_alloc; i++) {

c = channels[i];

if (c != NULL) {

switch (c->type) {

case SSH_CHANNEL_AUTH_SOCKET:

case SSH_CHANNEL_PORT_LISTENER:

case SSH_CHANNEL_RPORT_LISTENER:

case SSH_CHANNEL_X11_LISTENER:

channel_close_fd(&c->sock);

channel_free(c);

break;

}

* Returns true if no channel has too much buffered data, and false if one or

* more channel is overfull.

int

channel_not_very_much_buffered_data()

{

u_int i;

Channel *c;

for (i = 0; i < channels_alloc; i++) {

c = channels[i];

if (c != NULL && c->type == SSH_CHANNEL_OPEN) {

#if 0

if (!compat20 &&

buffer_len(&c->input) > packet_get_maxsize()) {

debug("channel %d: big input buffer %d",

c->self, buffer_len(&c->input));

return 0;

}

#endif

if (buffer_len(&c->output) > packet_get_maxsize()) {

debug("channel %d: big output buffer %d > %d",

c->self, buffer_len(&c->output),

packet_get_maxsize());

return 0;

}

return 1;

}

/* Returns true if any channel is still open. */

int

channel_still_open()

{

int i;

Channel *c;

for (i = 0; i < channels_alloc; i++) {

c = channels[i];

if (c == NULL)

continue;

switch (c->type) {

case SSH_CHANNEL_X11_LISTENER:

case SSH_CHANNEL_PORT_LISTENER:

case SSH_CHANNEL_RPORT_LISTENER:

case SSH_CHANNEL_CLOSED:

case SSH_CHANNEL_AUTH_SOCKET:

case SSH_CHANNEL_DYNAMIC:

case SSH_CHANNEL_CONNECTING:

case SSH_CHANNEL_ZOMBIE:

continue;

case SSH_CHANNEL_LARVAL:

if (!compat20)

fatal("cannot happen: SSH_CHANNEL_LARVAL");

continue;

case SSH_CHANNEL_OPENING:

case SSH_CHANNEL_OPEN:

case SSH_CHANNEL_X11_OPEN:

return 1;

case SSH_CHANNEL_INPUT_DRAINING:

case SSH_CHANNEL_OUTPUT_DRAINING:

if (!compat13)

fatal("cannot happen: OUT_DRAIN");

return 1;

default:

fatal("channel_still_open: bad channel type %d", c->type);

/* NOTREACHED */

}

return 0;

}

/* Returns the id of an open channel suitable for keepaliving */

int

channel_find_open()

{

int i;

Channel *c;

for (i = 0; i < channels_alloc; i++) {

c = channels[i];

if (c == NULL)

continue;

switch (c->type) {

case SSH_CHANNEL_CLOSED:

case SSH_CHANNEL_DYNAMIC:

case SSH_CHANNEL_X11_LISTENER:

case SSH_CHANNEL_PORT_LISTENER:

case SSH_CHANNEL_RPORT_LISTENER:

case SSH_CHANNEL_OPENING:

case SSH_CHANNEL_CONNECTING:

case SSH_CHANNEL_ZOMBIE:

continue;

case SSH_CHANNEL_LARVAL:

case SSH_CHANNEL_AUTH_SOCKET:

case SSH_CHANNEL_OPEN:

case SSH_CHANNEL_X11_OPEN:

return i;

case SSH_CHANNEL_INPUT_DRAINING:

case SSH_CHANNEL_OUTPUT_DRAINING:

if (!compat13)

fatal("cannot happen: OUT_DRAIN");

return i;

default:

fatal("channel_find_open: bad channel type %d", c->type);

/* NOTREACHED */

}

return -1;

}

* Returns a message describing the currently open forwarded connections,

* suitable for sending to the client. The message contains crlf pairs for

* newlines.

char *

channel_open_message()

{

Buffer buffer;

Channel *c;

char buf[1024], *cp;

int i;

buffer_init(&buffer);

snprintf(buf, sizeof buf, "The following connections are open:\r\n");

buffer_append(&buffer, buf, strlen(buf));

for (i = 0; i < channels_alloc; i++) {

c = channels[i];

if (c == NULL)

continue;

switch (c->type) {

case SSH_CHANNEL_X11_LISTENER:

case SSH_CHANNEL_PORT_LISTENER:

case SSH_CHANNEL_RPORT_LISTENER:

case SSH_CHANNEL_CLOSED:

case SSH_CHANNEL_AUTH_SOCKET:

case SSH_CHANNEL_ZOMBIE:

continue;

case SSH_CHANNEL_LARVAL:

case SSH_CHANNEL_OPENING:

case SSH_CHANNEL_CONNECTING:

case SSH_CHANNEL_DYNAMIC:

case SSH_CHANNEL_OPEN:

case SSH_CHANNEL_X11_OPEN:

case SSH_CHANNEL_INPUT_DRAINING:

case SSH_CHANNEL_OUTPUT_DRAINING:

snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",

c->self, c->remote_name,

c->type, c->remote_id,

c->istate, buffer_len(&c->input),

c->ostate, buffer_len(&c->output),

c->rfd, c->wfd);

buffer_append(&buffer, buf, strlen(buf));

continue;

default:

fatal("channel_open_message: bad channel type %d", c->type);

/* NOTREACHED */

}

buffer_append(&buffer, "\0", 1);

cp = xstrdup(buffer_ptr(&buffer));

buffer_free(&buffer);

return cp;

}

void

channel_send_open(int id)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_send_open: %d: bad id", id);

return;

}

debug("send channel open %d", id);

packet_start(SSH2_MSG_CHANNEL_OPEN);

packet_put_cstring(c->ctype);

packet_put_int(c->self);

packet_put_int(c->local_window);

packet_put_int(c->local_maxpacket);

packet_send();

}

void

channel_request(int id, char *service, int wantconfirm)

{

channel_request_start(id, service, wantconfirm);

packet_send();

debug("channel request %d: %s", id, service) ;

}

void

channel_request_start(int id, char *service, int wantconfirm)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_request: %d: bad id", id);

return;

}

packet_start(SSH2_MSG_CHANNEL_REQUEST);

packet_put_int(c->remote_id);

packet_put_cstring(service);

packet_put_char(wantconfirm);

}

void

channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_register_callback: %d: bad id", id);

return;

}

c->cb_event = mtype;

c->cb_fn = fn;

c->cb_arg = arg;

}

void

channel_register_cleanup(int id, channel_callback_fn *fn)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_register_cleanup: %d: bad id", id);

return;

}

c->detach_user = fn;

}

void

channel_cancel_cleanup(int id)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_cancel_cleanup: %d: bad id", id);

return;

}

c->detach_user = NULL;

}

void

channel_register_filter(int id, channel_filter_fn *fn)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_register_filter: %d: bad id", id);

return;

}

c->input_filter = fn;

}

void

channel_set_fds(int id, int rfd, int wfd, int efd,

int extusage, int nonblock)

{

Channel *c = channel_lookup(id);

if (c == NULL || c->type != SSH_CHANNEL_LARVAL)

fatal("channel_activate for non-larval channel %d.", id);

channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);

c->type = SSH_CHANNEL_OPEN;

/* XXX window size? */

c->local_window = c->local_window_max = c->local_maxpacket * 2;

packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);

packet_put_int(c->remote_id);

packet_put_int(c->local_window);

packet_send();

}

* 'channel_pre*' are called just before select() to add any bits relevant to

* channels in the select bitmasks.

Line 347

Line 678

chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];

chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];

void

static void

channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)

{

FD_SET(c->sock, readset);

}

void

static void

channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset)

{

debug3("channel %d: waiting for connection", c->self);

FD_SET(c->sock, writeset);

}

void

static void

channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)

{

if (buffer_len(&c->input) < packet_get_maxsize())

Line 369

Line 700

FD_SET(c->sock, writeset);

}

void

static void

channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)

{

/* test whether sockets are 'alive' for read/write */

Line 386

Line 717

}

void

static void

channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)

{

if (c->istate == CHAN_INPUT_OPEN &&

Line 412

Line 743

}

void

static void

channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)

{

if (buffer_len(&c->input) == 0) {

Line 424

Line 755

}

void

static void

channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)

{

if (buffer_len(&c->output) == 0)

channel_free(c->self);

chan_mark_dead(c);

else

FD_SET(c->sock, writeset);

}

Line 440

Line 771

* data in that packet is then substituted by the real data if it matches the

* fake data, and the channel is put into normal mode.

* XXX All this happens at the client side.

* Returns: 0 = need more data, -1 = wrong cookie, 1 = ok

int

static int

x11_open_helper(Channel *c)

x11_open_helper(Buffer *b)

{

u_char *ucp;

u_int proto_len, data_len;

/* Check if the fixed size part of the packet is in buffer. */

if (buffer_len(&c->output) < 12)

if (buffer_len(b) < 12)

return 0;

/* Parse the lengths of variable-length fields. */

ucp = (u_char *) buffer_ptr(&c->output);

ucp = (u_char *) buffer_ptr(b);

if (ucp[0] == 0x42) { /* Byte order MSB first. */

proto_len = 256 * ucp[6] + ucp[7];

data_len = 256 * ucp[8] + ucp[9];

Line 466

Line 798

}

/* Check if the whole packet is in buffer. */

if (buffer_len(&c->output) <

if (buffer_len(b) <

12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))

return 0;

Line 499

Line 831

return 1;

}

void

static void

channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)

{

int ret = x11_open_helper(c);

int ret = x11_open_helper(&c->output);

if (ret == 1) {

/* Start normal processing for the channel. */

c->type = SSH_CHANNEL_OPEN;

Line 515

Line 847

log("X11 connection rejected because of wrong authentication.");

buffer_clear(&c->input);

buffer_clear(&c->output);

close(c->sock);

channel_close_fd(&c->sock);

c->sock = -1;

c->type = SSH_CHANNEL_CLOSED;

packet_start(SSH_MSG_CHANNEL_CLOSE);

Line 524

Line 856

}

void

static void

channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)

{

int ret = x11_open_helper(c);

int ret = x11_open_helper(&c->output);

/* c->force_drain = 1; */

if (ret == 1) {

c->type = SSH_CHANNEL_OPEN;

if (compat20)

Line 543

Line 878

}

/* try to decode a socks4 header */

int

static int

channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset)

{

u_char *p, *host;

Line 613

Line 948

}

/* dynamic port forwarding */

void

static void

channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset)

{

u_char *p;

int have, ret;

have = buffer_len(&c->input);

c->delayed = 0;

debug2("channel %d: pre_dynamic: have %d", c->self, have);

/* buffer_dump(&c->input); */

/* check if the fixed size part of the packet is in buffer. */

Line 640

Line 975

break;

}

if (ret < 0) {

channel_free(c->self);

chan_mark_dead(c);

} else if (ret == 0) {

debug2("channel %d: pre_dynamic: need more", c->self);

/* need more */

Line 653

Line 988

}

/* This is our fake X11 server socket. */

void

static void

channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)

{

Channel *nc;

struct sockaddr addr;

int newsock, newch;

int newsock;

socklen_t addrlen;

char buf[16384], *remote_ipaddr;

int remote_port;

Line 675

Line 1011

snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",

remote_ipaddr, remote_port);

newch = channel_new("x11",

nc = channel_new("accepted x11 socket",

SSH_CHANNEL_OPENING, newsock, newsock, -1,

c->local_window_max, c->local_maxpacket,

0, xstrdup(buf), 1);

if (nc == NULL) {

close(newsock);

xfree(remote_ipaddr);

return;

}

if (compat20) {

packet_start(SSH2_MSG_CHANNEL_OPEN);

packet_put_cstring("x11");

packet_put_int(newch);

packet_put_int(nc->self);

packet_put_int(c->local_window_max);

packet_put_int(c->local_maxpacket);

/* originator ipaddr and port */

Line 695

Line 1036

packet_send();

} else {

packet_start(SSH_SMSG_X11_OPEN);

packet_put_int(newch);

packet_put_int(nc->self);

if (have_hostname_in_open)

if (packet_get_protocol_flags() &

packet_put_string(buf, strlen(buf));

SSH_PROTOFLAG_HOST_IN_FWD_OPEN)

packet_put_cstring(buf);

packet_send();

}

xfree(remote_ipaddr);

}

void

static void

port_open_helper(Channel *c, char *rtype)

{

int direct;

Line 747

Line 1089

packet_put_int(c->self);

packet_put_cstring(c->path);

packet_put_int(c->host_port);

if (have_hostname_in_open)

if (packet_get_protocol_flags() &

SSH_PROTOFLAG_HOST_IN_FWD_OPEN)

packet_put_cstring(c->remote_name);

packet_send();

}

Line 757

Line 1100

* This socket is listening for connections to a forwarded TCP/IP port.

void

static void

channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)

{

Channel *nc;

struct sockaddr addr;

int newsock, newch, nextstate;

int newsock, nextstate;

socklen_t addrlen;

char *rtype;

Line 771

Line 1114

"to %.100s port %d requested.",

c->listening_port, c->path, c->host_port);

rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ?

if (c->type == SSH_CHANNEL_RPORT_LISTENER) {

"forwarded-tcpip" : "direct-tcpip";

nextstate = SSH_CHANNEL_OPENING;

nextstate = (c->host_port == 0) ? SSH_CHANNEL_DYNAMIC :

rtype = "forwarded-tcpip";

SSH_CHANNEL_OPENING;

} else {

if (c->host_port == 0) {

nextstate = SSH_CHANNEL_DYNAMIC;

rtype = "dynamic-tcpip";

} else {

nextstate = SSH_CHANNEL_OPENING;

rtype = "direct-tcpip";

}

addrlen = sizeof(addr);

newsock = accept(c->sock, &addr, &addrlen);

Line 782

Line 1133

error("accept: %.100s", strerror(errno));

return;

}

newch = channel_new(rtype,

nc = channel_new(rtype,

nextstate, newsock, newsock, -1,

c->local_window_max, c->local_maxpacket,

0, xstrdup(rtype), 1);

nc = channel_lookup(newch);

if (nc == NULL) {

error("xxx: no new channel:");

error("channel_post_port_listener: no new channel:");

close(newsock);

return;

}

nc->listening_port = c->listening_port;

nc->host_port = c->host_port;

strlcpy(nc->path, c->path, sizeof(nc->path));

if (nextstate != SSH_CHANNEL_DYNAMIC)

if (nextstate == SSH_CHANNEL_DYNAMIC) {

* do not call the channel_post handler until

* this flag has been reset by a pre-handler.

* otherwise the FD_ISSET calls might overflow

nc->delayed = 1;

} else {

port_open_helper(nc, rtype);

}

Line 805

Line 1163

* This is the authentication agent socket listening for connections from

* clients.

void

static void

channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)

{

Channel *nc;

char *name;

int newsock;

struct sockaddr addr;

int newsock, newch;

socklen_t addrlen;

if (FD_ISSET(c->sock, readset)) {

Line 819

Line 1179

error("accept from auth socket: %.100s", strerror(errno));

return;

}

newch = channel_new("accepted auth socket",

name = xstrdup("accepted auth socket");

nc = channel_new("accepted auth socket",

SSH_CHANNEL_OPENING, newsock, newsock, -1,

c->local_window_max, c->local_maxpacket,

0, xstrdup("accepted auth socket"), 1);

0, name, 1);

if (nc == NULL) {

error("channel_post_auth_listener: channel_new failed");

xfree(name);

close(newsock);

}

if (compat20) {

packet_start(SSH2_MSG_CHANNEL_OPEN);

packet_put_cstring("auth-agent@openssh.com");

packet_put_int(newch);

packet_put_int(nc->self);

packet_put_int(c->local_window_max);

packet_put_int(c->local_maxpacket);

} else {

packet_start(SSH_SMSG_AGENT_OPEN);

packet_put_int(newch);

packet_put_int(nc->self);

}

packet_send();

}

void

static void

channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)

{

int err = 0;

socklen_t sz = sizeof(err);

if (FD_ISSET(c->sock, writeset)) {

int err = 0;

if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err,

int sz = sizeof(err);

&sz) < 0) {

c->type = SSH_CHANNEL_OPEN;

err = errno;

if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &sz) < 0) {

error("getsockopt SO_ERROR failed");

debug("getsockopt SO_ERROR failed");

}

if (err == 0) {

debug("channel %d: connected", c->self);

c->type = SSH_CHANNEL_OPEN;

if (compat20) {

packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);

packet_put_int(c->remote_id);

packet_put_int(c->self);

packet_put_int(c->local_window);

packet_put_int(c->local_maxpacket);

} else {

packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);

packet_put_int(c->remote_id);

packet_put_int(c->self);

}

} else {

if (err == 0) {

debug("channel %d: not connected: %s",

debug("channel %d: connected)", c->self);

c->self, strerror(err));

if (compat20) {

packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE);

packet_put_int(c->remote_id);

packet_put_int(SSH2_OPEN_CONNECT_FAILED);

if (!(datafellows & SSH_BUG_OPENFAILURE)) {

packet_put_cstring(strerror(err));

packet_put_cstring("");

}

} else {

debug("channel %d: not connected: %s",

packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);

c->self, strerror(err));

packet_put_int(c->remote_id);

chan_read_failed(c);

chan_write_failed(c);

}

chan_mark_dead(c);

}

packet_send();

}

int

static int

channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)

{

char buf[16*1024];

Line 875

Line 1266

c->self, c->rfd, len);

if (c->type != SSH_CHANNEL_OPEN) {

debug("channel %d: not open", c->self);

channel_free(c->self);

chan_mark_dead(c);

return -1;

} else if (compat13) {

buffer_consume(&c->output, buffer_len(&c->output));

c->type = SSH_CHANNEL_INPUT_DRAINING;

debug("channel %d: status set to input draining.", c->self);

debug("channel %d: input draining.", c->self);

} else {

chan_read_failed(c);

}

Line 897

Line 1288

}

return 1;

}

int

static int

channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)

{

struct termios tio;

u_char *data;

u_int dlen;

int len;

/* Send buffered output data to the socket. */

if (c->wfd != -1 &&

FD_ISSET(c->wfd, writeset) &&

buffer_len(&c->output) > 0) {

len = write(c->wfd, buffer_ptr(&c->output),

data = buffer_ptr(&c->output);

buffer_len(&c->output));

dlen = buffer_len(&c->output);

len = write(c->wfd, data, dlen);

if (len < 0 && (errno == EINTR || errno == EAGAIN))

return 1;

if (len <= 0) {

if (c->type != SSH_CHANNEL_OPEN) {

debug("channel %d: not open", c->self);

channel_free(c->self);

chan_mark_dead(c);

return -1;

} else if (compat13) {

buffer_consume(&c->output, buffer_len(&c->output));

debug("channel %d: status set to input draining.", c->self);

debug("channel %d: input draining.", c->self);

c->type = SSH_CHANNEL_INPUT_DRAINING;

} else {

chan_write_failed(c);

}

return -1;

}

if (compat20 && c->isatty) {

if (compat20 && c->isatty && dlen >= 1 && data[0] != '\r') {

if (tcgetattr(c->wfd, &tio) == 0 &&

!(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {

Line 945

Line 1339

}

return 1;

}

int

static int

channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)

{

char buf[16*1024];

Line 965

Line 1359

if (len <= 0) {

debug2("channel %d: closing write-efd %d",

c->self, c->efd);

close(c->efd);

channel_close_fd(&c->efd);

c->efd = -1;

} else {

buffer_consume(&c->extended, len);

c->local_consumed += len;

Line 981

Line 1374

if (len <= 0) {

debug2("channel %d: closing read-efd %d",

c->self, c->efd);

close(c->efd);

channel_close_fd(&c->efd);

c->efd = -1;

} else {

buffer_append(&c->extended, buf, len);

}

Line 990

Line 1382

}

return 1;

}

int

static int

channel_check_window(Channel *c)

{

if (c->type == SSH_CHANNEL_OPEN &&

Line 1010

Line 1402

return 1;

}

void

static void

channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)

{

if (c->delayed)

return;

channel_handle_rfd(c, readset, writeset);

channel_handle_wfd(c, readset, writeset);

}

void

static void

channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)

{

if (c->delayed)

return;

channel_handle_rfd(c, readset, writeset);

channel_handle_wfd(c, readset, writeset);

channel_handle_efd(c, readset, writeset);

Line 1027

Line 1423

channel_check_window(c);

}

void

static void

channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)

{

int len;

Line 1042

Line 1438

}

void

static void

channel_handler_init_20(void)

{

channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20;

Line 1063

Line 1459

channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_2;

}

void

static void

channel_handler_init_13(void)

{

channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13;

Line 1085

Line 1481

channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_1;

}

void

static void

channel_handler_init_15(void)

{

channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15;

Line 1104

Line 1500

channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_1;

}

void

static void

channel_handler_init(void)

{

int i;

Line 1120

Line 1516

channel_handler_init_15();

}

void

/* gc dead channels */

static void

channel_garbage_collect(Channel *c)

{

if (c == NULL)

return;

if (c->detach_user != NULL) {

if (!chan_is_dead(c, 0))

return;

debug("channel %d: gc: notify user", c->self);

c->detach_user(c->self, NULL);

/* if we still have a callback */

if (c->detach_user != NULL)

return;

debug("channel %d: gc: user detached", c->self);

}

if (!chan_is_dead(c, 1))

return;

debug("channel %d: garbage collecting", c->self);

channel_free(c);

}

static void

channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)

{

static int did_init = 0;

Line 1132

Line 1550

did_init = 1;

}

for (i = 0; i < channels_alloc; i++) {

c = &channels[i];

c = channels[i];

if (c->type == SSH_CHANNEL_FREE)

if (c == NULL)

continue;

if (ftab[c->type] == NULL)

if (ftab[c->type] != NULL)

continue;

(*ftab[c->type])(c, readset, writeset);

channel_garbage_collect(c);

if (chan_is_dead(c)) {

* we have to remove the fd's from the select mask

* before the channels are free'd and the fd's are

* closed

if (c->wfd != -1)

FD_CLR(c->wfd, writeset);

if (c->rfd != -1)

FD_CLR(c->rfd, readset);

if (c->efd != -1) {

if (c->extended_usage == CHAN_EXTENDED_READ)

FD_CLR(c->efd, readset);

if (c->extended_usage == CHAN_EXTENDED_WRITE)

FD_CLR(c->efd, writeset);

}

channel_free(c->self);

}

* Allocate/update select bitmasks and add any bits relevant to channels in

* select bitmasks.

void

channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp,

int rekeying)

int *nallocp, int rekeying)

{

int n;

u_int sz;

Line 1169

Line 1573

n = MAX(*maxfdp, channel_max_fd);

sz = howmany(n+1, NFDBITS) * sizeof(fd_mask);

if (*readsetp == NULL || n > *maxfdp) {

/* perhaps check sz < nalloc/2 and shrink? */

if (*readsetp)

if (*readsetp == NULL || sz > *nallocp) {

xfree(*readsetp);

*readsetp = xrealloc(*readsetp, sz);

if (*writesetp)

*writesetp = xrealloc(*writesetp, sz);

xfree(*writesetp);

*nallocp = sz;

*readsetp = xmalloc(sz);

*writesetp = xmalloc(sz);

*maxfdp = n;

}

*maxfdp = n;

memset(*readsetp, 0, sz);

memset(*writesetp, 0, sz);

Line 1185

Line 1587

channel_handler(channel_pre, *readsetp, *writesetp);

}

* After select, perform any appropriate operations for channels which have

* events pending.

void

channel_after_select(fd_set * readset, fd_set * writeset)

{

channel_handler(channel_post, readset, writeset);

}

/* If there is data to send to the connection, enqueue some of it now. */

void

Line 1200

Line 1607

Channel *c;

for (i = 0; i < channels_alloc; i++) {

c = &channels[i];

c = channels[i];

if (c == NULL)

continue;

/* We are only interested in channels that can have buffered incoming data. */

* We are only interested in channels that can have buffered

* incoming data.

if (compat13) {

if (c->type != SSH_CHANNEL_OPEN &&

c->type != SSH_CHANNEL_INPUT_DRAINING)

Line 1214

Line 1626

if (compat20 &&

(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {

/* XXX is this true? */

debug2("channel %d: no data after CLOSE", c->self);

debug3("channel %d: will not send data after close", c->self);

continue;

}

Line 1222

Line 1634

if ((c->istate == CHAN_INPUT_OPEN ||

c->istate == CHAN_INPUT_WAIT_DRAIN) &&

(len = buffer_len(&c->input)) > 0) {

/* Send some data for the other side over the secure connection. */

* Send some data for the other side over the secure

* connection.

if (compat20) {

if (len > c->remote_window)

len = c->remote_window;

Line 1280

Line 1695

}

* This is called when a packet of type CHANNEL_DATA has just been received.

* The message type has already been consumed, but channel number and data is

* still there.

/* -- protocol input */

void

channel_input_data(int type, int plen, void *ctxt)

{

Line 1331

Line 1743

buffer_append(&c->output, data, data_len);

xfree(data);

}

void

channel_input_extended_data(int type, int plen, void *ctxt)

{

Line 1371

Line 1784

xfree(data);

}

* Returns true if no channel has too much buffered data, and false if one or

* more channel is overfull.

int

channel_not_very_much_buffered_data()

{

u_int i;

Channel *c;

for (i = 0; i < channels_alloc; i++) {

c = &channels[i];

if (c->type == SSH_CHANNEL_OPEN) {

if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {

debug("channel %d: big input buffer %d",

c->self, buffer_len(&c->input));

return 0;

}

if (buffer_len(&c->output) > packet_get_maxsize()) {

debug("channel %d: big output buffer %d",

c->self, buffer_len(&c->output));

return 0;

}

return 1;

}

void

channel_input_ieof(int type, int plen, void *ctxt)

{

Line 1414

Line 1797

if (c == NULL)

packet_disconnect("Received ieof for nonexistent channel %d.", id);

chan_rcvd_ieof(c);

/* XXX force input close */

if (c->force_drain) {

debug("channel %d: FORCE input drain", c->self);

c->istate = CHAN_INPUT_WAIT_DRAIN;

}

void

Line 1479

Line 1869

if (c->type != SSH_CHANNEL_CLOSED)

packet_disconnect("Received close confirmation for "

"non-closed channel %d (type %d).", id, c->type);

channel_free(c->self);

channel_free(c);

}

void

Line 1516

Line 1906

}

static char *

reason2txt(int reason)

{

switch(reason) {

case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED:

return "administratively prohibited";

case SSH2_OPEN_CONNECT_FAILED:

return "connect failed";

case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE:

return "unknown channel type";

case SSH2_OPEN_RESOURCE_SHORTAGE:

return "resource shortage";

}

return "unknown reason";

}

void

channel_input_open_failure(int type, int plen, void *ctxt)

{

Line 1534

Line 1940

"non-opening channel %d.", id);

if (compat20) {

reason = packet_get_int();

if (packet_remaining() > 0) {

if (!(datafellows & SSH_BUG_OPENFAILURE)) {

msg = packet_get_string(NULL);

lang = packet_get_string(NULL);

}

packet_done();

log("channel_open_failure: %d: reason %d %s", id,

log("channel %d: open failed: %s%s%s", id,

reason, msg ? msg : "<no additional info>");

reason2txt(reason), msg ? ": ": "", msg ? msg : "");

if (msg != NULL)

xfree(msg);

if (lang != NULL)

xfree(lang);

}

/* Free the channel. This will also close the socket. */

channel_free(id);

channel_free(c);

}

void

Line 1599

Line 2005

c->remote_window += adjust;

}

* Stops listening for channels, and removes any unix domain sockets that we

* might have.

void

channel_stop_listening()

channel_input_port_open(int type, int plen, void *ctxt)

{

int i;

Channel *c = NULL;

for (i = 0; i < channels_alloc; i++) {

u_short host_port;

switch (channels[i].type) {

char *host, *originator_string;

case SSH_CHANNEL_AUTH_SOCKET:

int remote_id, sock = -1;

close(channels[i].sock);

unlink(channels[i].path);

channel_free(i);

break;

case SSH_CHANNEL_PORT_LISTENER:

case SSH_CHANNEL_RPORT_LISTENER:

case SSH_CHANNEL_X11_LISTENER:

close(channels[i].sock);

channel_free(i);

break;

default:

break;

}

remote_id = packet_get_int();

* Closes the sockets/fds of all channels. This is used to close extra file

host = packet_get_string(NULL);

* descriptors after a fork.

host_port = packet_get_int();

void

if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {

channel_close_all()

originator_string = packet_get_string(NULL);

{

} else {

int i;

originator_string = xstrdup("unknown (remote did not supply name)");

for (i = 0; i < channels_alloc; i++)

}

if (channels[i].type != SSH_CHANNEL_FREE)

packet_done();

channel_close_fds(&channels[i]);

sock = channel_connect_to(host, host_port);

}

if (sock != -1) {

c = channel_new("connected socket",

/* Returns true if any channel is still open. */

SSH_CHANNEL_CONNECTING, sock, sock, -1, 0, 0, 0,

originator_string, 1);

int

if (c == NULL) {

channel_still_open()

error("channel_input_port_open: channel_new failed");

{

close(sock);

u_int i;

} else {

for (i = 0; i < channels_alloc; i++)

c->remote_id = remote_id;

switch (channels[i].type) {

case SSH_CHANNEL_FREE:

case SSH_CHANNEL_X11_LISTENER:

case SSH_CHANNEL_PORT_LISTENER:

case SSH_CHANNEL_RPORT_LISTENER:

case SSH_CHANNEL_CLOSED:

case SSH_CHANNEL_AUTH_SOCKET:

case SSH_CHANNEL_DYNAMIC:

case SSH_CHANNEL_CONNECTING: /* XXX ??? */

continue;

case SSH_CHANNEL_LARVAL:

if (!compat20)

fatal("cannot happen: SSH_CHANNEL_LARVAL");

continue;

case SSH_CHANNEL_OPENING:

case SSH_CHANNEL_OPEN:

case SSH_CHANNEL_X11_OPEN:

return 1;

case SSH_CHANNEL_INPUT_DRAINING:

case SSH_CHANNEL_OUTPUT_DRAINING:

if (!compat13)

fatal("cannot happen: OUT_DRAIN");

return 1;

default:

fatal("channel_still_open: bad channel type %d", channels[i].type);

/* NOTREACHED */

}

return 0;

}

if (c == NULL) {

packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);

packet_put_int(remote_id);

packet_send();

}

xfree(host);

}

/* Returns the id of an open channel suitable for keepaliving */

int

/* -- tcp forwarding */

channel_find_open()

{

u_int i;

for (i = 0; i < channels_alloc; i++)

switch (channels[i].type) {

case SSH_CHANNEL_CLOSED:

case SSH_CHANNEL_DYNAMIC:

case SSH_CHANNEL_FREE:

case SSH_CHANNEL_X11_LISTENER:

case SSH_CHANNEL_PORT_LISTENER:

case SSH_CHANNEL_RPORT_LISTENER:

case SSH_CHANNEL_OPENING:

continue;

case SSH_CHANNEL_LARVAL:

case SSH_CHANNEL_AUTH_SOCKET:

case SSH_CHANNEL_CONNECTING: /* XXX ??? */

case SSH_CHANNEL_OPEN:

case SSH_CHANNEL_X11_OPEN:

return i;

case SSH_CHANNEL_INPUT_DRAINING:

case SSH_CHANNEL_OUTPUT_DRAINING:

if (!compat13)

fatal("cannot happen: OUT_DRAIN");

return i;

default:

fatal("channel_find_open: bad channel type %d", channels[i].type);

/* NOTREACHED */

}

return -1;

}

void

channel_set_af(int af)

* Returns a message describing the currently open forwarded connections,

* suitable for sending to the client. The message contains crlf pairs for

* newlines.

char *

channel_open_message()

{

Buffer buffer;

IPv4or6 = af;

int i;

char buf[512], *cp;

buffer_init(&buffer);

snprintf(buf, sizeof buf, "The following connections are open:\r\n");

buffer_append(&buffer, buf, strlen(buf));

for (i = 0; i < channels_alloc; i++) {

Channel *c = &channels[i];

switch (c->type) {

case SSH_CHANNEL_FREE:

case SSH_CHANNEL_X11_LISTENER:

case SSH_CHANNEL_PORT_LISTENER:

case SSH_CHANNEL_RPORT_LISTENER:

case SSH_CHANNEL_CLOSED:

case SSH_CHANNEL_AUTH_SOCKET:

continue;

case SSH_CHANNEL_LARVAL:

case SSH_CHANNEL_OPENING:

case SSH_CHANNEL_CONNECTING:

case SSH_CHANNEL_DYNAMIC:

case SSH_CHANNEL_OPEN:

case SSH_CHANNEL_X11_OPEN:

case SSH_CHANNEL_INPUT_DRAINING:

case SSH_CHANNEL_OUTPUT_DRAINING:

snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",

c->self, c->remote_name,

c->type, c->remote_id,

c->istate, buffer_len(&c->input),

c->ostate, buffer_len(&c->output),

c->rfd, c->wfd);

buffer_append(&buffer, buf, strlen(buf));

continue;

default:

fatal("channel_open_message: bad channel type %d", c->type);

/* NOTREACHED */

}

buffer_append(&buffer, "\0", 1);

cp = xstrdup(buffer_ptr(&buffer));

buffer_free(&buffer);

return cp;

}

Line 1790

Line 2076

const char *host_to_connect, u_short port_to_connect,

int gateway_ports, int remote_fwd)

{

int success, ch, sock, on = 1, ctype;

Channel *c;

int success, sock, on = 1, type;

struct addrinfo hints, *ai, *aitop;

char ntop[NI_MAXHOST], strport[NI_MAXSERV];

const char *host;

Line 1800

Line 2087

if (remote_fwd) {

host = listen_address;

ctype = SSH_CHANNEL_RPORT_LISTENER;

type = SSH_CHANNEL_RPORT_LISTENER;

} else {

host = host_to_connect;

ctype =SSH_CHANNEL_PORT_LISTENER;

type = SSH_CHANNEL_PORT_LISTENER;

}

if (strlen(host) > sizeof(channels[0].path) - 1) {

if (strlen(host) > SSH_CHANNEL_PATH_LEN - 1) {

error("Forward host name too long.");

return success;

}

Line 1863

Line 2150

continue;

}

/* Allocate a channel number for the socket. */

ch = channel_new("port listener", ctype, sock, sock, -1,

c = channel_new("port listener", type, sock, sock, -1,

CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,

0, xstrdup("port listener"), 1);

strlcpy(channels[ch].path, host, sizeof(channels[ch].path));

if (c == NULL) {

channels[ch].host_port = port_to_connect;

error("channel_request_forwarding: channel_new failed");

channels[ch].listening_port = listen_port;

close(sock);

continue;

}

strlcpy(c->path, host, sizeof(c->path));

c->host_port = port_to_connect;

c->listening_port = listen_port;

success = 1;

}

if (success == 0)

Line 2006

Line 2298

/* return socket to remote host, port */

int

static int

connect_to(const char *host, u_short port)

{

struct addrinfo hints, *ai, *aitop;

Line 2058

Line 2350

}

int

channel_connect_by_listen_adress(u_short listen_port)

channel_connect_by_listen_address(u_short listen_port)

{

int i;

Line 2094

Line 2386

return connect_to(host, port);

}

/* -- X11 forwarding */

* This is called after receiving PORT_OPEN message. This attempts to

* connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION

* or CHANNEL_OPEN_FAILURE.

void

channel_input_port_open(int type, int plen, void *ctxt)

{

u_short host_port;

char *host, *originator_string;

int remote_channel, sock = -1, newch;

remote_channel = packet_get_int();

host = packet_get_string(NULL);

host_port = packet_get_int();

if (have_hostname_in_open) {

originator_string = packet_get_string(NULL);

} else {

originator_string = xstrdup("unknown (remote did not supply name)");

}

packet_done();

sock = channel_connect_to(host, host_port);

if (sock != -1) {

newch = channel_allocate(SSH_CHANNEL_CONNECTING,

sock, originator_string);

channels[newch].remote_id = remote_channel;

/*XXX delay answer? */

packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);

packet_put_int(remote_channel);

packet_put_int(newch);

packet_send();

} else {

packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);

packet_put_int(remote_channel);

packet_send();

}

xfree(host);

}

* Creates an internet domain socket for listening for X11 connections.

* Returns a suitable value for the DISPLAY variable, or NULL if an error

* occurs.

#define NUM_SOCKS 10

char *

x11_create_display_inet(int screen_number, int x11_display_offset)

{

Line 2233

Line 2482

#define X_UNIX_PATH "/tmp/.X11-unix/X"

#endif

static

static int

int

connect_local_xsocket(u_int dnr)

{

static const char *const x_sockets[] = {

Line 2366

Line 2614

void

x11_input_open(int type, int plen, void *ctxt)

{

int remote_channel, sock = 0, newch;

Channel *c = NULL;

int remote_id, sock = 0;

char *remote_host;

u_int remote_len;

/* Get remote channel number. */

debug("Received X11 open request.");

remote_channel = packet_get_int();

/* Get remote originator name. */

remote_id = packet_get_int();

if (have_hostname_in_open) {

remote_host = packet_get_string(&remote_len);

if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {

remote_len += 4;

remote_host = packet_get_string(NULL);

} else {

remote_host = xstrdup("unknown (remote did not supply name)");

remote_len = 0;

}

packet_done();

debug("Received X11 open request.");

packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);

/* Obtain a connection to the real X display. */

sock = x11_connect_display();

if (sock == -1) {

if (sock != -1) {

/* Allocate a channel for this connection. */

c = channel_new("connected x11 socket",

SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0,

remote_host, 1);

if (c == NULL) {

error("x11_input_open: channel_new failed");

close(sock);

} else {

c->remote_id = remote_id;

c->force_drain = 1;

}

if (c == NULL) {

/* Send refusal to the remote host. */

packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);

packet_put_int(remote_channel);

packet_put_int(remote_id);

packet_send();

} else {

/* Allocate a channel for this connection. */

newch = channel_allocate(

(x11_saved_proto == NULL) ?

SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,

sock, remote_host);

channels[newch].remote_id = remote_channel;

/* Send a confirmation to the remote host. */

packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);

packet_put_int(remote_channel);

packet_put_int(remote_id);

packet_put_int(newch);

packet_put_int(c->self);

packet_send();

}

packet_send();

}

/* dummy protocol handler that denies SSH-1 requests (agent/x11) */

Line 2433

Line 2682

* Requests forwarding of X11 connections, generates fake authentication

* data, and enables authentication spoofing.

* This should be called in the client only.

void

x11_request_forwarding_with_spoofing(int client_session_id,

const char *proto, const char *data)

Line 2499

Line 2748

xfree(new_data);

}

/* -- agent forwarding */

/* Sends a message to the server to request authentication fd forwarding. */

void

Line 2518

Line 2770

char *

auth_get_socket_name()

{

return channel_forwarded_auth_socket_name;

return auth_sock_name;

}

/* removes the agent forwarding socket */

void

cleanup_socket(void)

auth_sock_cleanup_proc(void *_pw)

{

unlink(channel_forwarded_auth_socket_name);

struct passwd *pw = _pw;

rmdir(channel_forwarded_auth_socket_dir);

if (auth_sock_name) {

temporarily_use_uid(pw);

unlink(auth_sock_name);

rmdir(auth_sock_dir);

auth_sock_name = NULL;

restore_uid();

}

Line 2538

Line 2797

int

auth_input_request_forwarding(struct passwd * pw)

{

int sock, newch;

Channel *nc;

int sock;

struct sockaddr_un sunaddr;

if (auth_get_socket_name() != NULL)

if (auth_get_socket_name() != NULL) {

fatal("Protocol error: authentication forwarding requested twice.");

error("authentication forwarding requested twice.");

return 0;

}

/* Temporarily drop privileged uid for mkdir/bind. */

temporarily_use_uid(pw);

/* Allocate a buffer for the socket name, and format the name. */

channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);

auth_sock_name = xmalloc(MAXPATHLEN);

channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);

auth_sock_dir = xmalloc(MAXPATHLEN);

strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);

strlcpy(auth_sock_dir, "/tmp/ssh-XXXXXXXX", MAXPATHLEN);

/* Create private directory for socket */

if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {

if (mkdtemp(auth_sock_dir) == NULL) {

packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",

packet_send_debug("Agent forwarding disabled: "

strerror(errno));

"mkdtemp() failed: %.100s", strerror(errno));

restore_uid();

xfree(channel_forwarded_auth_socket_name);

xfree(auth_sock_name);

xfree(channel_forwarded_auth_socket_dir);

xfree(auth_sock_dir);

channel_forwarded_auth_socket_name = NULL;

auth_sock_name = NULL;

channel_forwarded_auth_socket_dir = NULL;

auth_sock_dir = NULL;

return 0;

}

snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",

snprintf(auth_sock_name, MAXPATHLEN, "%s/agent.%d",

channel_forwarded_auth_socket_dir, (int) getpid());

auth_sock_dir, (int) getpid());

if (atexit(cleanup_socket) < 0) {

/* delete agent socket on fatal() */

int saved = errno;

fatal_add_cleanup(auth_sock_cleanup_proc, pw);

cleanup_socket();

packet_disconnect("socket: %.100s", strerror(saved));

}

/* Create the socket. */

sock = socket(AF_UNIX, SOCK_STREAM, 0);

if (sock < 0)

Line 2579

Line 2839

/* Bind it to the name. */

memset(&sunaddr, 0, sizeof(sunaddr));

sunaddr.sun_family = AF_UNIX;

strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,

strncpy(sunaddr.sun_path, auth_sock_name,

sizeof(sunaddr.sun_path));

if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)

Line 2593

Line 2853

packet_disconnect("listen: %.100s", strerror(errno));

/* Allocate a channel for the authentication agent socket. */

newch = channel_new("auth socket",

nc = channel_new("auth socket",

SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,

CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,

0, xstrdup("auth socket"), 1);

if (nc == NULL) {

strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,

error("auth_input_request_forwarding: channel_new failed");

sizeof(channels[newch].path));

auth_sock_cleanup_proc(pw);

fatal_remove_cleanup(auth_sock_cleanup_proc, pw);

close(sock);

return 0;

}

strlcpy(nc->path, auth_sock_name, sizeof(nc->path));

return 1;

}

Line 2608

Line 2873

void

auth_input_open_request(int type, int plen, void *ctxt)

{

int remch, sock, newch;

Channel *c = NULL;

char *dummyname;

int remote_id, sock;

char *name;

packet_integrity_check(plen, 4, type);

/* Read the remote channel number from the message. */

remch = packet_get_int();

remote_id = packet_get_int();

* Get a connection to the local authentication agent (this may again

Line 2628

Line 2894

* because authentication forwarding is only enabled if we have an

* agent.

if (sock < 0) {

if (sock >= 0) {

packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);

name = xstrdup("authentication agent connection");

packet_put_int(remch);

c = channel_new("", SSH_CHANNEL_OPEN, sock, sock,

packet_send();

-1, 0, 0, 0, name, 1);

return;

if (c == NULL) {

error("auth_input_open_request: channel_new failed");

xfree(name);

close(sock);

} else {

c->remote_id = remote_id;

c->force_drain = 1;

}

debug("Forwarding authentication connection.");

* Dummy host name. This will be freed when the channel is freed; it

* will still be valid in the packet_put_string below since the

* channel cannot yet be freed at that point.

dummyname = xstrdup("authentication agent connection");

newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);

channels[newch].remote_id = remch;

/* Send a confirmation to the remote host. */

packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);

packet_put_int(remch);

packet_put_int(newch);

packet_send();

}

void

channel_start_open(int id)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_open: %d: bad id", id);

packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);

return;

packet_put_int(remote_id);

} else {

/* Send a confirmation to the remote host. */

debug("Forwarding authentication connection.");

packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);

packet_put_int(remote_id);

packet_put_int(c->self);

}

debug("send channel open %d", id);

packet_start(SSH2_MSG_CHANNEL_OPEN);

packet_put_cstring(c->ctype);

packet_put_int(c->self);

packet_put_int(c->local_window);

packet_put_int(c->local_maxpacket);

}

void

channel_open(int id)

{

/* XXX REMOVE ME */

channel_start_open(id);

packet_send();

}

void

channel_request(int id, char *service, int wantconfirm)

{

channel_request_start(id, service, wantconfirm);

packet_send();

debug("channel request %d: %s", id, service) ;

}

void

channel_request_start(int id, char *service, int wantconfirm)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_request: %d: bad id", id);

return;

}

packet_start(SSH2_MSG_CHANNEL_REQUEST);

packet_put_int(c->remote_id);

packet_put_cstring(service);

packet_put_char(wantconfirm);

}

void

channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_register_callback: %d: bad id", id);

return;

}

c->cb_event = mtype;

c->cb_fn = fn;

c->cb_arg = arg;

}

void

channel_register_cleanup(int id, channel_callback_fn *fn)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_register_cleanup: %d: bad id", id);

return;

}

c->dettach_user = fn;

}

void

channel_cancel_cleanup(int id)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_cancel_cleanup: %d: bad id", id);

return;

}

c->dettach_user = NULL;

}

void

channel_register_filter(int id, channel_filter_fn *fn)

{

Channel *c = channel_lookup(id);

if (c == NULL) {

log("channel_register_filter: %d: bad id", id);

return;

}

c->input_filter = fn;

}

void

channel_set_fds(int id, int rfd, int wfd, int efd,

int extusage, int nonblock)

{

Channel *c = channel_lookup(id);

if (c == NULL || c->type != SSH_CHANNEL_LARVAL)

fatal("channel_activate for non-larval channel %d.", id);

channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);

c->type = SSH_CHANNEL_OPEN;

/* XXX window size? */

c->local_window = c->local_window_max = c->local_maxpacket * 2;

packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);

packet_put_int(c->remote_id);

packet_put_int(c->local_window);

packet_send();

}