version 1.109, 2001/04/17 12:55:03 |
version 1.109.2.5, 2002/03/09 00:20:44 |
|
|
* incompatible with the protocol description in the RFC file, it must be |
* incompatible with the protocol description in the RFC file, it must be |
* called by a name other than "ssh" or "Secure Shell". |
* called by a name other than "ssh" or "Secure Shell". |
* |
* |
* |
|
* SSH2 support added by Markus Friedl. |
* SSH2 support added by Markus Friedl. |
* Copyright (c) 1999,2000 Markus Friedl. All rights reserved. |
* Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. |
* Copyright (c) 1999 Dug Song. All rights reserved. |
* Copyright (c) 1999 Dug Song. All rights reserved. |
* Copyright (c) 1999 Theo de Raadt. All rights reserved. |
* Copyright (c) 1999 Theo de Raadt. All rights reserved. |
* |
* |
|
|
#include "includes.h" |
#include "includes.h" |
RCSID("$OpenBSD$"); |
RCSID("$OpenBSD$"); |
|
|
#include <openssl/rsa.h> |
|
#include <openssl/dsa.h> |
|
|
|
#include "ssh.h" |
#include "ssh.h" |
#include "ssh1.h" |
#include "ssh1.h" |
#include "ssh2.h" |
#include "ssh2.h" |
#include "packet.h" |
#include "packet.h" |
#include "xmalloc.h" |
#include "xmalloc.h" |
#include "buffer.h" |
|
#include "bufaux.h" |
|
#include "uidswap.h" |
#include "uidswap.h" |
#include "log.h" |
#include "log.h" |
#include "misc.h" |
#include "misc.h" |
#include "channels.h" |
#include "channels.h" |
#include "nchan.h" |
|
#include "compat.h" |
#include "compat.h" |
#include "canohost.h" |
#include "canohost.h" |
#include "key.h" |
#include "key.h" |
#include "authfd.h" |
#include "authfd.h" |
|
#include "pathnames.h" |
|
|
/* Maximum number of fake X11 displays to try. */ |
|
#define MAX_DISPLAYS 1000 |
|
|
|
/* Max len of agent socket */ |
/* -- channel core */ |
#define MAX_SOCKET_NAME 100 |
|
|
|
/* |
/* |
* Pointer to an array containing all allocated channels. The array is |
* Pointer to an array containing all allocated channels. The array is |
* dynamically extended as needed. |
* dynamically extended as needed. |
*/ |
*/ |
static Channel *channels = NULL; |
static Channel **channels = NULL; |
|
|
/* |
/* |
* Size of the channel array. All slots of the array must always be |
* Size of the channel array. All slots of the array must always be |
* initialized (at least the type field); unused slots are marked with type |
* initialized (at least the type field); unused slots set to NULL |
* SSH_CHANNEL_FREE. |
|
*/ |
*/ |
static int channels_alloc = 0; |
static int channels_alloc = 0; |
|
|
/* |
/* |
* Maximum file descriptor value used in any of the channels. This is |
* Maximum file descriptor value used in any of the channels. This is |
* updated in channel_allocate. |
* updated in channel_new. |
*/ |
*/ |
static int channel_max_fd = 0; |
static int channel_max_fd = 0; |
|
|
/* Name and directory of socket for authentication agent forwarding. */ |
|
static char *channel_forwarded_auth_socket_name = NULL; |
|
static char *channel_forwarded_auth_socket_dir = NULL; |
|
|
|
/* Saved X11 authentication protocol name. */ |
/* -- tcp forwarding */ |
char *x11_saved_proto = NULL; |
|
|
|
/* Saved X11 authentication data. This is the real data. */ |
|
char *x11_saved_data = NULL; |
|
u_int x11_saved_data_len = 0; |
|
|
|
/* |
/* |
* Fake X11 authentication data. This is what the server will be sending us; |
|
* we should replace any occurrences of this by the real data. |
|
*/ |
|
char *x11_fake_data = NULL; |
|
u_int x11_fake_data_len; |
|
|
|
/* |
|
* Data structure for storing which hosts are permitted for forward requests. |
* Data structure for storing which hosts are permitted for forward requests. |
* The local sides of any remote forwards are stored in this array to prevent |
* The local sides of any remote forwards are stored in this array to prevent |
* a corrupt remote server from accessing arbitrary TCP/IP ports on our local |
* a corrupt remote server from accessing arbitrary TCP/IP ports on our local |
|
|
|
|
/* List of all permitted host/port pairs to connect. */ |
/* List of all permitted host/port pairs to connect. */ |
static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION]; |
static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION]; |
|
|
/* Number of permitted host/port pairs in the array. */ |
/* Number of permitted host/port pairs in the array. */ |
static int num_permitted_opens = 0; |
static int num_permitted_opens = 0; |
/* |
/* |
|
|
*/ |
*/ |
static int all_opens_permitted = 0; |
static int all_opens_permitted = 0; |
|
|
/* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */ |
|
static int have_hostname_in_open = 0; |
|
|
|
/* AF_UNSPEC or AF_INET or AF_INET6 */ |
/* -- X11 forwarding */ |
extern int IPv4or6; |
|
|
|
void port_open_helper(Channel *c, char *rtype); |
/* Maximum number of fake X11 displays to try. */ |
|
#define MAX_DISPLAYS 1000 |
|
|
/* Sets specific protocol options. */ |
/* Saved X11 authentication protocol name. */ |
|
static char *x11_saved_proto = NULL; |
|
|
void |
/* Saved X11 authentication data. This is the real data. */ |
channel_set_options(int hostname_in_open) |
static char *x11_saved_data = NULL; |
{ |
static u_int x11_saved_data_len = 0; |
have_hostname_in_open = hostname_in_open; |
|
} |
|
|
|
/* lookup channel by id */ |
/* |
|
* Fake X11 authentication data. This is what the server will be sending us; |
|
* we should replace any occurrences of this by the real data. |
|
*/ |
|
static char *x11_fake_data = NULL; |
|
static u_int x11_fake_data_len; |
|
|
|
|
|
/* -- agent forwarding */ |
|
|
|
#define NUM_SOCKS 10 |
|
|
|
/* Name and directory of socket for authentication agent forwarding. */ |
|
static char *auth_sock_name = NULL; |
|
static char *auth_sock_dir = NULL; |
|
|
|
/* AF_UNSPEC or AF_INET or AF_INET6 */ |
|
static int IPv4or6 = AF_UNSPEC; |
|
|
|
/* helper */ |
|
static void port_open_helper(Channel *c, char *rtype); |
|
|
|
/* -- channel core */ |
|
|
Channel * |
Channel * |
channel_lookup(int id) |
channel_lookup(int id) |
{ |
{ |
Channel *c; |
Channel *c; |
if (id < 0 || id > channels_alloc) { |
|
|
if (id < 0 || id >= channels_alloc) { |
log("channel_lookup: %d: bad id", id); |
log("channel_lookup: %d: bad id", id); |
return NULL; |
return NULL; |
} |
} |
c = &channels[id]; |
c = channels[id]; |
if (c->type == SSH_CHANNEL_FREE) { |
if (c == NULL) { |
log("channel_lookup: %d: bad id: channel free", id); |
log("channel_lookup: %d: bad id: channel free", id); |
return NULL; |
return NULL; |
} |
} |
|
|
* when the channel consumer/producer is ready, e.g. shell exec'd |
* when the channel consumer/producer is ready, e.g. shell exec'd |
*/ |
*/ |
|
|
void |
static void |
channel_register_fds(Channel *c, int rfd, int wfd, int efd, |
channel_register_fds(Channel *c, int rfd, int wfd, int efd, |
int extusage, int nonblock) |
int extusage, int nonblock) |
{ |
{ |
|
|
* remote_name to be freed. |
* remote_name to be freed. |
*/ |
*/ |
|
|
int |
Channel * |
channel_new(char *ctype, int type, int rfd, int wfd, int efd, |
channel_new(char *ctype, int type, int rfd, int wfd, int efd, |
int window, int maxpack, int extusage, char *remote_name, int nonblock) |
int window, int maxpack, int extusage, char *remote_name, int nonblock) |
{ |
{ |
|
|
|
|
/* Do initial allocation if this is the first call. */ |
/* Do initial allocation if this is the first call. */ |
if (channels_alloc == 0) { |
if (channels_alloc == 0) { |
chan_init(); |
|
channels_alloc = 10; |
channels_alloc = 10; |
channels = xmalloc(channels_alloc * sizeof(Channel)); |
channels = xmalloc(channels_alloc * sizeof(Channel *)); |
for (i = 0; i < channels_alloc; i++) |
for (i = 0; i < channels_alloc; i++) |
channels[i].type = SSH_CHANNEL_FREE; |
channels[i] = NULL; |
/* |
fatal_add_cleanup((void (*) (void *)) channel_free_all, NULL); |
* Kludge: arrange a call to channel_stop_listening if we |
|
* terminate with fatal(). |
|
*/ |
|
fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL); |
|
} |
} |
/* Try to find a free slot where to put the new channel. */ |
/* Try to find a free slot where to put the new channel. */ |
for (found = -1, i = 0; i < channels_alloc; i++) |
for (found = -1, i = 0; i < channels_alloc; i++) |
if (channels[i].type == SSH_CHANNEL_FREE) { |
if (channels[i] == NULL) { |
/* Found a free slot. */ |
/* Found a free slot. */ |
found = i; |
found = i; |
break; |
break; |
|
|
found = channels_alloc; |
found = channels_alloc; |
channels_alloc += 10; |
channels_alloc += 10; |
debug2("channel: expanding %d", channels_alloc); |
debug2("channel: expanding %d", channels_alloc); |
channels = xrealloc(channels, channels_alloc * sizeof(Channel)); |
channels = xrealloc(channels, channels_alloc * sizeof(Channel *)); |
for (i = found; i < channels_alloc; i++) |
for (i = found; i < channels_alloc; i++) |
channels[i].type = SSH_CHANNEL_FREE; |
channels[i] = NULL; |
} |
} |
/* Initialize and return new channel number. */ |
/* Initialize and return new channel. */ |
c = &channels[found]; |
c = channels[found] = xmalloc(sizeof(Channel)); |
|
memset(c, 0, sizeof(Channel)); |
buffer_init(&c->input); |
buffer_init(&c->input); |
buffer_init(&c->output); |
buffer_init(&c->output); |
buffer_init(&c->extended); |
buffer_init(&c->extended); |
chan_init_iostates(c); |
c->ostate = CHAN_OUTPUT_OPEN; |
|
c->istate = CHAN_INPUT_OPEN; |
|
c->flags = 0; |
channel_register_fds(c, rfd, wfd, efd, extusage, nonblock); |
channel_register_fds(c, rfd, wfd, efd, extusage, nonblock); |
c->self = found; |
c->self = found; |
c->type = type; |
c->type = type; |
|
|
c->remote_name = remote_name; |
c->remote_name = remote_name; |
c->remote_window = 0; |
c->remote_window = 0; |
c->remote_maxpacket = 0; |
c->remote_maxpacket = 0; |
c->cb_fn = NULL; |
c->force_drain = 0; |
c->cb_arg = NULL; |
c->single_connection = 0; |
c->cb_event = 0; |
c->detach_user = NULL; |
c->dettach_user = NULL; |
c->confirm = NULL; |
c->input_filter = NULL; |
c->input_filter = NULL; |
debug("channel %d: new [%s]", found, remote_name); |
debug("channel %d: new [%s]", found, remote_name); |
return found; |
return c; |
} |
} |
/* old interface XXX */ |
|
int |
static int |
channel_allocate(int type, int sock, char *remote_name) |
channel_find_maxfd(void) |
{ |
{ |
return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1); |
int i, max = 0; |
|
Channel *c; |
|
|
|
for (i = 0; i < channels_alloc; i++) { |
|
c = channels[i]; |
|
if (c != NULL) { |
|
max = MAX(max, c->rfd); |
|
max = MAX(max, c->wfd); |
|
max = MAX(max, c->efd); |
|
} |
|
} |
|
return max; |
} |
} |
|
|
|
int |
|
channel_close_fd(int *fdp) |
|
{ |
|
int ret = 0, fd = *fdp; |
|
|
|
if (fd != -1) { |
|
ret = close(fd); |
|
*fdp = -1; |
|
if (fd == channel_max_fd) |
|
channel_max_fd = channel_find_maxfd(); |
|
} |
|
return ret; |
|
} |
|
|
/* Close all channel fd/socket. */ |
/* Close all channel fd/socket. */ |
|
|
void |
static void |
channel_close_fds(Channel *c) |
channel_close_fds(Channel *c) |
{ |
{ |
if (c->sock != -1) { |
debug3("channel_close_fds: channel %d: r %d w %d e %d", |
close(c->sock); |
c->self, c->rfd, c->wfd, c->efd); |
c->sock = -1; |
|
} |
channel_close_fd(&c->sock); |
if (c->rfd != -1) { |
channel_close_fd(&c->rfd); |
close(c->rfd); |
channel_close_fd(&c->wfd); |
c->rfd = -1; |
channel_close_fd(&c->efd); |
} |
|
if (c->wfd != -1) { |
|
close(c->wfd); |
|
c->wfd = -1; |
|
} |
|
if (c->efd != -1) { |
|
close(c->efd); |
|
c->efd = -1; |
|
} |
|
} |
} |
|
|
/* Free the channel and close its fd/socket. */ |
/* Free the channel and close its fd/socket. */ |
|
|
void |
void |
channel_free(int id) |
channel_free(Channel *c) |
{ |
{ |
Channel *c = channel_lookup(id); |
char *s; |
char *s = channel_open_message(); |
int i, n; |
|
|
if (c == NULL) |
for (n = 0, i = 0; i < channels_alloc; i++) |
packet_disconnect("channel free: bad local channel %d", id); |
if (channels[i]) |
debug("channel_free: channel %d: status: %s", id, s); |
n++; |
|
debug("channel_free: channel %d: %s, nchannels %d", c->self, |
|
c->remote_name ? c->remote_name : "???", n); |
|
|
|
s = channel_open_message(); |
|
debug3("channel_free: status: %s", s); |
xfree(s); |
xfree(s); |
|
|
if (c->dettach_user != NULL) { |
|
debug("channel_free: channel %d: dettaching channel user", id); |
|
c->dettach_user(c->self, NULL); |
|
} |
|
if (c->sock != -1) |
if (c->sock != -1) |
shutdown(c->sock, SHUT_RDWR); |
shutdown(c->sock, SHUT_RDWR); |
channel_close_fds(c); |
channel_close_fds(c); |
buffer_free(&c->input); |
buffer_free(&c->input); |
buffer_free(&c->output); |
buffer_free(&c->output); |
buffer_free(&c->extended); |
buffer_free(&c->extended); |
c->type = SSH_CHANNEL_FREE; |
|
if (c->remote_name) { |
if (c->remote_name) { |
xfree(c->remote_name); |
xfree(c->remote_name); |
c->remote_name = NULL; |
c->remote_name = NULL; |
} |
} |
|
channels[c->self] = NULL; |
|
xfree(c); |
} |
} |
|
|
|
void |
|
channel_free_all(void) |
|
{ |
|
int i; |
|
|
|
for (i = 0; i < channels_alloc; i++) |
|
if (channels[i] != NULL) |
|
channel_free(channels[i]); |
|
} |
|
|
/* |
/* |
|
* Closes the sockets/fds of all channels. This is used to close extra file |
|
* descriptors after a fork. |
|
*/ |
|
|
|
void |
|
channel_close_all(void) |
|
{ |
|
int i; |
|
|
|
for (i = 0; i < channels_alloc; i++) |
|
if (channels[i] != NULL) |
|
channel_close_fds(channels[i]); |
|
} |
|
|
|
/* |
|
* Stop listening to channels. |
|
*/ |
|
|
|
void |
|
channel_stop_listening(void) |
|
{ |
|
int i; |
|
Channel *c; |
|
|
|
for (i = 0; i < channels_alloc; i++) { |
|
c = channels[i]; |
|
if (c != NULL) { |
|
switch (c->type) { |
|
case SSH_CHANNEL_AUTH_SOCKET: |
|
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
|
case SSH_CHANNEL_X11_LISTENER: |
|
channel_close_fd(&c->sock); |
|
channel_free(c); |
|
break; |
|
} |
|
} |
|
} |
|
} |
|
|
|
/* |
|
* Returns true if no channel has too much buffered data, and false if one or |
|
* more channel is overfull. |
|
*/ |
|
|
|
int |
|
channel_not_very_much_buffered_data(void) |
|
{ |
|
u_int i; |
|
Channel *c; |
|
|
|
for (i = 0; i < channels_alloc; i++) { |
|
c = channels[i]; |
|
if (c != NULL && c->type == SSH_CHANNEL_OPEN) { |
|
#if 0 |
|
if (!compat20 && |
|
buffer_len(&c->input) > packet_get_maxsize()) { |
|
debug("channel %d: big input buffer %d", |
|
c->self, buffer_len(&c->input)); |
|
return 0; |
|
} |
|
#endif |
|
if (buffer_len(&c->output) > packet_get_maxsize()) { |
|
debug("channel %d: big output buffer %d > %d", |
|
c->self, buffer_len(&c->output), |
|
packet_get_maxsize()); |
|
return 0; |
|
} |
|
} |
|
} |
|
return 1; |
|
} |
|
|
|
/* Returns true if any channel is still open. */ |
|
|
|
int |
|
channel_still_open(void) |
|
{ |
|
int i; |
|
Channel *c; |
|
|
|
for (i = 0; i < channels_alloc; i++) { |
|
c = channels[i]; |
|
if (c == NULL) |
|
continue; |
|
switch (c->type) { |
|
case SSH_CHANNEL_X11_LISTENER: |
|
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
|
case SSH_CHANNEL_CLOSED: |
|
case SSH_CHANNEL_AUTH_SOCKET: |
|
case SSH_CHANNEL_DYNAMIC: |
|
case SSH_CHANNEL_CONNECTING: |
|
case SSH_CHANNEL_ZOMBIE: |
|
continue; |
|
case SSH_CHANNEL_LARVAL: |
|
if (!compat20) |
|
fatal("cannot happen: SSH_CHANNEL_LARVAL"); |
|
continue; |
|
case SSH_CHANNEL_OPENING: |
|
case SSH_CHANNEL_OPEN: |
|
case SSH_CHANNEL_X11_OPEN: |
|
return 1; |
|
case SSH_CHANNEL_INPUT_DRAINING: |
|
case SSH_CHANNEL_OUTPUT_DRAINING: |
|
if (!compat13) |
|
fatal("cannot happen: OUT_DRAIN"); |
|
return 1; |
|
default: |
|
fatal("channel_still_open: bad channel type %d", c->type); |
|
/* NOTREACHED */ |
|
} |
|
} |
|
return 0; |
|
} |
|
|
|
/* Returns the id of an open channel suitable for keepaliving */ |
|
|
|
int |
|
channel_find_open(void) |
|
{ |
|
int i; |
|
Channel *c; |
|
|
|
for (i = 0; i < channels_alloc; i++) { |
|
c = channels[i]; |
|
if (c == NULL) |
|
continue; |
|
switch (c->type) { |
|
case SSH_CHANNEL_CLOSED: |
|
case SSH_CHANNEL_DYNAMIC: |
|
case SSH_CHANNEL_X11_LISTENER: |
|
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
|
case SSH_CHANNEL_OPENING: |
|
case SSH_CHANNEL_CONNECTING: |
|
case SSH_CHANNEL_ZOMBIE: |
|
continue; |
|
case SSH_CHANNEL_LARVAL: |
|
case SSH_CHANNEL_AUTH_SOCKET: |
|
case SSH_CHANNEL_OPEN: |
|
case SSH_CHANNEL_X11_OPEN: |
|
return i; |
|
case SSH_CHANNEL_INPUT_DRAINING: |
|
case SSH_CHANNEL_OUTPUT_DRAINING: |
|
if (!compat13) |
|
fatal("cannot happen: OUT_DRAIN"); |
|
return i; |
|
default: |
|
fatal("channel_find_open: bad channel type %d", c->type); |
|
/* NOTREACHED */ |
|
} |
|
} |
|
return -1; |
|
} |
|
|
|
|
|
/* |
|
* Returns a message describing the currently open forwarded connections, |
|
* suitable for sending to the client. The message contains crlf pairs for |
|
* newlines. |
|
*/ |
|
|
|
char * |
|
channel_open_message(void) |
|
{ |
|
Buffer buffer; |
|
Channel *c; |
|
char buf[1024], *cp; |
|
int i; |
|
|
|
buffer_init(&buffer); |
|
snprintf(buf, sizeof buf, "The following connections are open:\r\n"); |
|
buffer_append(&buffer, buf, strlen(buf)); |
|
for (i = 0; i < channels_alloc; i++) { |
|
c = channels[i]; |
|
if (c == NULL) |
|
continue; |
|
switch (c->type) { |
|
case SSH_CHANNEL_X11_LISTENER: |
|
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
|
case SSH_CHANNEL_CLOSED: |
|
case SSH_CHANNEL_AUTH_SOCKET: |
|
case SSH_CHANNEL_ZOMBIE: |
|
continue; |
|
case SSH_CHANNEL_LARVAL: |
|
case SSH_CHANNEL_OPENING: |
|
case SSH_CHANNEL_CONNECTING: |
|
case SSH_CHANNEL_DYNAMIC: |
|
case SSH_CHANNEL_OPEN: |
|
case SSH_CHANNEL_X11_OPEN: |
|
case SSH_CHANNEL_INPUT_DRAINING: |
|
case SSH_CHANNEL_OUTPUT_DRAINING: |
|
snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n", |
|
c->self, c->remote_name, |
|
c->type, c->remote_id, |
|
c->istate, buffer_len(&c->input), |
|
c->ostate, buffer_len(&c->output), |
|
c->rfd, c->wfd); |
|
buffer_append(&buffer, buf, strlen(buf)); |
|
continue; |
|
default: |
|
fatal("channel_open_message: bad channel type %d", c->type); |
|
/* NOTREACHED */ |
|
} |
|
} |
|
buffer_append(&buffer, "\0", 1); |
|
cp = xstrdup(buffer_ptr(&buffer)); |
|
buffer_free(&buffer); |
|
return cp; |
|
} |
|
|
|
void |
|
channel_send_open(int id) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
|
log("channel_send_open: %d: bad id", id); |
|
return; |
|
} |
|
debug("send channel open %d", id); |
|
packet_start(SSH2_MSG_CHANNEL_OPEN); |
|
packet_put_cstring(c->ctype); |
|
packet_put_int(c->self); |
|
packet_put_int(c->local_window); |
|
packet_put_int(c->local_maxpacket); |
|
packet_send(); |
|
} |
|
|
|
void |
|
channel_request_start(int local_id, char *service, int wantconfirm) |
|
{ |
|
Channel *c = channel_lookup(local_id); |
|
if (c == NULL) { |
|
log("channel_request_start: %d: unknown channel id", local_id); |
|
return; |
|
} |
|
debug("channel request %d: %s", local_id, service) ; |
|
packet_start(SSH2_MSG_CHANNEL_REQUEST); |
|
packet_put_int(c->remote_id); |
|
packet_put_cstring(service); |
|
packet_put_char(wantconfirm); |
|
} |
|
void |
|
channel_register_confirm(int id, channel_callback_fn *fn) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
|
log("channel_register_comfirm: %d: bad id", id); |
|
return; |
|
} |
|
c->confirm = fn; |
|
} |
|
void |
|
channel_register_cleanup(int id, channel_callback_fn *fn) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
|
log("channel_register_cleanup: %d: bad id", id); |
|
return; |
|
} |
|
c->detach_user = fn; |
|
} |
|
void |
|
channel_cancel_cleanup(int id) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
|
log("channel_cancel_cleanup: %d: bad id", id); |
|
return; |
|
} |
|
c->detach_user = NULL; |
|
} |
|
void |
|
channel_register_filter(int id, channel_filter_fn *fn) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
|
log("channel_register_filter: %d: bad id", id); |
|
return; |
|
} |
|
c->input_filter = fn; |
|
} |
|
|
|
void |
|
channel_set_fds(int id, int rfd, int wfd, int efd, |
|
int extusage, int nonblock, u_int window_max) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL || c->type != SSH_CHANNEL_LARVAL) |
|
fatal("channel_activate for non-larval channel %d.", id); |
|
channel_register_fds(c, rfd, wfd, efd, extusage, nonblock); |
|
c->type = SSH_CHANNEL_OPEN; |
|
c->local_window = c->local_window_max = window_max; |
|
packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); |
|
packet_put_int(c->remote_id); |
|
packet_put_int(c->local_window); |
|
packet_send(); |
|
} |
|
|
|
/* |
* 'channel_pre*' are called just before select() to add any bits relevant to |
* 'channel_pre*' are called just before select() to add any bits relevant to |
* channels in the select bitmasks. |
* channels in the select bitmasks. |
*/ |
*/ |
|
|
chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE]; |
chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE]; |
chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE]; |
chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE]; |
|
|
void |
static void |
channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset) |
channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
FD_SET(c->sock, readset); |
FD_SET(c->sock, readset); |
} |
} |
|
|
void |
static void |
channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset) |
channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
debug3("channel %d: waiting for connection", c->self); |
debug3("channel %d: waiting for connection", c->self); |
FD_SET(c->sock, writeset); |
FD_SET(c->sock, writeset); |
} |
} |
|
|
void |
static void |
channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset) |
channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
if (buffer_len(&c->input) < packet_get_maxsize()) |
if (buffer_len(&c->input) < packet_get_maxsize()) |
|
|
FD_SET(c->sock, writeset); |
FD_SET(c->sock, writeset); |
} |
} |
|
|
void |
static void |
channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset) |
channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
/* test whether sockets are 'alive' for read/write */ |
u_int limit = compat20 ? c->remote_window : packet_get_maxsize(); |
if (c->istate == CHAN_INPUT_OPEN) |
|
if (buffer_len(&c->input) < packet_get_maxsize()) |
|
FD_SET(c->sock, readset); |
|
if (c->ostate == CHAN_OUTPUT_OPEN || |
|
c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { |
|
if (buffer_len(&c->output) > 0) { |
|
FD_SET(c->sock, writeset); |
|
} else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { |
|
chan_obuf_empty(c); |
|
} |
|
} |
|
} |
|
|
|
void |
|
channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset) |
|
{ |
|
if (c->istate == CHAN_INPUT_OPEN && |
if (c->istate == CHAN_INPUT_OPEN && |
c->remote_window > 0 && |
limit > 0 && |
buffer_len(&c->input) < c->remote_window) |
buffer_len(&c->input) < limit) |
FD_SET(c->rfd, readset); |
FD_SET(c->rfd, readset); |
if (c->ostate == CHAN_OUTPUT_OPEN || |
if (c->ostate == CHAN_OUTPUT_OPEN || |
c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { |
c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { |
|
|
} |
} |
} |
} |
/** XXX check close conditions, too */ |
/** XXX check close conditions, too */ |
if (c->efd != -1) { |
if (compat20 && c->efd != -1) { |
if (c->extended_usage == CHAN_EXTENDED_WRITE && |
if (c->extended_usage == CHAN_EXTENDED_WRITE && |
buffer_len(&c->extended) > 0) |
buffer_len(&c->extended) > 0) |
FD_SET(c->efd, writeset); |
FD_SET(c->efd, writeset); |
|
|
} |
} |
} |
} |
|
|
void |
static void |
channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset) |
channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
if (buffer_len(&c->input) == 0) { |
if (buffer_len(&c->input) == 0) { |
|
|
} |
} |
} |
} |
|
|
void |
static void |
channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset) |
channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
if (buffer_len(&c->output) == 0) |
if (buffer_len(&c->output) == 0) |
channel_free(c->self); |
chan_mark_dead(c); |
else |
else |
FD_SET(c->sock, writeset); |
FD_SET(c->sock, writeset); |
} |
} |
|
|
* data in that packet is then substituted by the real data if it matches the |
* data in that packet is then substituted by the real data if it matches the |
* fake data, and the channel is put into normal mode. |
* fake data, and the channel is put into normal mode. |
* XXX All this happens at the client side. |
* XXX All this happens at the client side. |
|
* Returns: 0 = need more data, -1 = wrong cookie, 1 = ok |
*/ |
*/ |
int |
static int |
x11_open_helper(Channel *c) |
x11_open_helper(Buffer *b) |
{ |
{ |
u_char *ucp; |
u_char *ucp; |
u_int proto_len, data_len; |
u_int proto_len, data_len; |
|
|
/* Check if the fixed size part of the packet is in buffer. */ |
/* Check if the fixed size part of the packet is in buffer. */ |
if (buffer_len(&c->output) < 12) |
if (buffer_len(b) < 12) |
return 0; |
return 0; |
|
|
/* Parse the lengths of variable-length fields. */ |
/* Parse the lengths of variable-length fields. */ |
ucp = (u_char *) buffer_ptr(&c->output); |
ucp = buffer_ptr(b); |
if (ucp[0] == 0x42) { /* Byte order MSB first. */ |
if (ucp[0] == 0x42) { /* Byte order MSB first. */ |
proto_len = 256 * ucp[6] + ucp[7]; |
proto_len = 256 * ucp[6] + ucp[7]; |
data_len = 256 * ucp[8] + ucp[9]; |
data_len = 256 * ucp[8] + ucp[9]; |
|
|
data_len = ucp[8] + 256 * ucp[9]; |
data_len = ucp[8] + 256 * ucp[9]; |
} else { |
} else { |
debug("Initial X11 packet contains bad byte order byte: 0x%x", |
debug("Initial X11 packet contains bad byte order byte: 0x%x", |
ucp[0]); |
ucp[0]); |
return -1; |
return -1; |
} |
} |
|
|
/* Check if the whole packet is in buffer. */ |
/* Check if the whole packet is in buffer. */ |
if (buffer_len(&c->output) < |
if (buffer_len(b) < |
12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3)) |
12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3)) |
return 0; |
return 0; |
|
|
|
|
return 1; |
return 1; |
} |
} |
|
|
void |
static void |
channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset) |
channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
int ret = x11_open_helper(c); |
int ret = x11_open_helper(&c->output); |
if (ret == 1) { |
if (ret == 1) { |
/* Start normal processing for the channel. */ |
/* Start normal processing for the channel. */ |
c->type = SSH_CHANNEL_OPEN; |
c->type = SSH_CHANNEL_OPEN; |
|
|
log("X11 connection rejected because of wrong authentication."); |
log("X11 connection rejected because of wrong authentication."); |
buffer_clear(&c->input); |
buffer_clear(&c->input); |
buffer_clear(&c->output); |
buffer_clear(&c->output); |
close(c->sock); |
channel_close_fd(&c->sock); |
c->sock = -1; |
c->sock = -1; |
c->type = SSH_CHANNEL_CLOSED; |
c->type = SSH_CHANNEL_CLOSED; |
packet_start(SSH_MSG_CHANNEL_CLOSE); |
packet_start(SSH_MSG_CHANNEL_CLOSE); |
|
|
} |
} |
} |
} |
|
|
void |
static void |
channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset) |
channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
int ret = x11_open_helper(c); |
int ret = x11_open_helper(&c->output); |
|
|
|
/* c->force_drain = 1; */ |
|
|
if (ret == 1) { |
if (ret == 1) { |
c->type = SSH_CHANNEL_OPEN; |
c->type = SSH_CHANNEL_OPEN; |
if (compat20) |
channel_pre_open(c, readset, writeset); |
channel_pre_open_20(c, readset, writeset); |
|
else |
|
channel_pre_open_15(c, readset, writeset); |
|
} else if (ret == -1) { |
} else if (ret == -1) { |
|
log("X11 connection rejected because of wrong authentication."); |
debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate); |
debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate); |
chan_read_failed(c); /** force close? */ |
chan_read_failed(c); |
chan_write_failed(c); |
buffer_clear(&c->input); |
|
chan_ibuf_empty(c); |
|
buffer_clear(&c->output); |
|
/* for proto v1, the peer will send an IEOF */ |
|
if (compat20) |
|
chan_write_failed(c); |
|
else |
|
c->type = SSH_CHANNEL_OPEN; |
debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate); |
debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate); |
} |
} |
} |
} |
|
|
/* try to decode a socks4 header */ |
/* try to decode a socks4 header */ |
int |
static int |
channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset) |
channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
u_char *p, *host; |
u_char *p, *host; |
int len, have, i, found; |
int len, have, i, found; |
char username[256]; |
char username[256]; |
struct { |
struct { |
u_int8_t version; |
u_int8_t version; |
u_int8_t command; |
u_int8_t command; |
|
|
host = inet_ntoa(s4_req.dest_addr); |
host = inet_ntoa(s4_req.dest_addr); |
strlcpy(c->path, host, sizeof(c->path)); |
strlcpy(c->path, host, sizeof(c->path)); |
c->host_port = ntohs(s4_req.dest_port); |
c->host_port = ntohs(s4_req.dest_port); |
|
|
debug("channel %d: dynamic request: socks4 host %s port %u command %u", |
debug("channel %d: dynamic request: socks4 host %s port %u command %u", |
c->self, host, c->host_port, s4_req.command); |
c->self, host, c->host_port, s4_req.command); |
|
|
|
|
} |
} |
|
|
/* dynamic port forwarding */ |
/* dynamic port forwarding */ |
void |
static void |
channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset) |
channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
u_char *p; |
u_char *p; |
int have, ret; |
int have, ret; |
|
|
have = buffer_len(&c->input); |
have = buffer_len(&c->input); |
|
c->delayed = 0; |
debug2("channel %d: pre_dynamic: have %d", c->self, have); |
debug2("channel %d: pre_dynamic: have %d", c->self, have); |
/* buffer_dump(&c->input); */ |
/* buffer_dump(&c->input); */ |
/* check if the fixed size part of the packet is in buffer. */ |
/* check if the fixed size part of the packet is in buffer. */ |
|
|
break; |
break; |
} |
} |
if (ret < 0) { |
if (ret < 0) { |
channel_free(c->self); |
chan_mark_dead(c); |
} else if (ret == 0) { |
} else if (ret == 0) { |
debug2("channel %d: pre_dynamic: need more", c->self); |
debug2("channel %d: pre_dynamic: need more", c->self); |
/* need more */ |
/* need more */ |
|
|
} |
} |
|
|
/* This is our fake X11 server socket. */ |
/* This is our fake X11 server socket. */ |
void |
static void |
channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset) |
channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
|
Channel *nc; |
struct sockaddr addr; |
struct sockaddr addr; |
int newsock, newch; |
int newsock; |
socklen_t addrlen; |
socklen_t addrlen; |
char buf[16384], *remote_ipaddr; |
char buf[16384], *remote_ipaddr; |
int remote_port; |
int remote_port; |
|
|
debug("X11 connection requested."); |
debug("X11 connection requested."); |
addrlen = sizeof(addr); |
addrlen = sizeof(addr); |
newsock = accept(c->sock, &addr, &addrlen); |
newsock = accept(c->sock, &addr, &addrlen); |
|
if (c->single_connection) { |
|
debug("single_connection: closing X11 listener."); |
|
channel_close_fd(&c->sock); |
|
chan_mark_dead(c); |
|
} |
if (newsock < 0) { |
if (newsock < 0) { |
error("accept: %.100s", strerror(errno)); |
error("accept: %.100s", strerror(errno)); |
return; |
return; |
} |
} |
|
set_nodelay(newsock); |
remote_ipaddr = get_peer_ipaddr(newsock); |
remote_ipaddr = get_peer_ipaddr(newsock); |
remote_port = get_peer_port(newsock); |
remote_port = get_peer_port(newsock); |
snprintf(buf, sizeof buf, "X11 connection from %.200s port %d", |
snprintf(buf, sizeof buf, "X11 connection from %.200s port %d", |
remote_ipaddr, remote_port); |
remote_ipaddr, remote_port); |
|
|
newch = channel_new("x11", |
nc = channel_new("accepted x11 socket", |
SSH_CHANNEL_OPENING, newsock, newsock, -1, |
SSH_CHANNEL_OPENING, newsock, newsock, -1, |
c->local_window_max, c->local_maxpacket, |
c->local_window_max, c->local_maxpacket, |
0, xstrdup(buf), 1); |
0, xstrdup(buf), 1); |
if (compat20) { |
if (compat20) { |
packet_start(SSH2_MSG_CHANNEL_OPEN); |
packet_start(SSH2_MSG_CHANNEL_OPEN); |
packet_put_cstring("x11"); |
packet_put_cstring("x11"); |
packet_put_int(newch); |
packet_put_int(nc->self); |
packet_put_int(c->local_window_max); |
packet_put_int(nc->local_window_max); |
packet_put_int(c->local_maxpacket); |
packet_put_int(nc->local_maxpacket); |
/* originator ipaddr and port */ |
/* originator ipaddr and port */ |
packet_put_cstring(remote_ipaddr); |
packet_put_cstring(remote_ipaddr); |
if (datafellows & SSH_BUG_X11FWD) { |
if (datafellows & SSH_BUG_X11FWD) { |
|
|
packet_send(); |
packet_send(); |
} else { |
} else { |
packet_start(SSH_SMSG_X11_OPEN); |
packet_start(SSH_SMSG_X11_OPEN); |
packet_put_int(newch); |
packet_put_int(nc->self); |
if (have_hostname_in_open) |
if (packet_get_protocol_flags() & |
packet_put_string(buf, strlen(buf)); |
SSH_PROTOFLAG_HOST_IN_FWD_OPEN) |
|
packet_put_cstring(buf); |
packet_send(); |
packet_send(); |
} |
} |
xfree(remote_ipaddr); |
xfree(remote_ipaddr); |
} |
} |
} |
} |
|
|
void |
static void |
port_open_helper(Channel *c, char *rtype) |
port_open_helper(Channel *c, char *rtype) |
{ |
{ |
int direct; |
int direct; |
|
|
packet_put_int(c->self); |
packet_put_int(c->self); |
packet_put_cstring(c->path); |
packet_put_cstring(c->path); |
packet_put_int(c->host_port); |
packet_put_int(c->host_port); |
if (have_hostname_in_open) |
if (packet_get_protocol_flags() & |
|
SSH_PROTOFLAG_HOST_IN_FWD_OPEN) |
packet_put_cstring(c->remote_name); |
packet_put_cstring(c->remote_name); |
packet_send(); |
packet_send(); |
} |
} |
|
|
/* |
/* |
* This socket is listening for connections to a forwarded TCP/IP port. |
* This socket is listening for connections to a forwarded TCP/IP port. |
*/ |
*/ |
void |
static void |
channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset) |
channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
Channel *nc; |
Channel *nc; |
struct sockaddr addr; |
struct sockaddr addr; |
int newsock, newch, nextstate; |
int newsock, nextstate; |
socklen_t addrlen; |
socklen_t addrlen; |
char *rtype; |
char *rtype; |
|
|
|
|
"to %.100s port %d requested.", |
"to %.100s port %d requested.", |
c->listening_port, c->path, c->host_port); |
c->listening_port, c->path, c->host_port); |
|
|
rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ? |
if (c->type == SSH_CHANNEL_RPORT_LISTENER) { |
"forwarded-tcpip" : "direct-tcpip"; |
nextstate = SSH_CHANNEL_OPENING; |
nextstate = (c->host_port == 0) ? SSH_CHANNEL_DYNAMIC : |
rtype = "forwarded-tcpip"; |
SSH_CHANNEL_OPENING; |
} else { |
|
if (c->host_port == 0) { |
|
nextstate = SSH_CHANNEL_DYNAMIC; |
|
rtype = "dynamic-tcpip"; |
|
} else { |
|
nextstate = SSH_CHANNEL_OPENING; |
|
rtype = "direct-tcpip"; |
|
} |
|
} |
|
|
addrlen = sizeof(addr); |
addrlen = sizeof(addr); |
newsock = accept(c->sock, &addr, &addrlen); |
newsock = accept(c->sock, &addr, &addrlen); |
|
|
error("accept: %.100s", strerror(errno)); |
error("accept: %.100s", strerror(errno)); |
return; |
return; |
} |
} |
newch = channel_new(rtype, |
set_nodelay(newsock); |
|
nc = channel_new(rtype, |
nextstate, newsock, newsock, -1, |
nextstate, newsock, newsock, -1, |
c->local_window_max, c->local_maxpacket, |
c->local_window_max, c->local_maxpacket, |
0, xstrdup(rtype), 1); |
0, xstrdup(rtype), 1); |
|
|
nc = channel_lookup(newch); |
|
if (nc == NULL) { |
|
error("xxx: no new channel:"); |
|
return; |
|
} |
|
nc->listening_port = c->listening_port; |
nc->listening_port = c->listening_port; |
nc->host_port = c->host_port; |
nc->host_port = c->host_port; |
strlcpy(nc->path, c->path, sizeof(nc->path)); |
strlcpy(nc->path, c->path, sizeof(nc->path)); |
|
|
if (nextstate != SSH_CHANNEL_DYNAMIC) |
if (nextstate == SSH_CHANNEL_DYNAMIC) { |
|
/* |
|
* do not call the channel_post handler until |
|
* this flag has been reset by a pre-handler. |
|
* otherwise the FD_ISSET calls might overflow |
|
*/ |
|
nc->delayed = 1; |
|
} else { |
port_open_helper(nc, rtype); |
port_open_helper(nc, rtype); |
|
} |
} |
} |
} |
} |
|
|
|
|
* This is the authentication agent socket listening for connections from |
* This is the authentication agent socket listening for connections from |
* clients. |
* clients. |
*/ |
*/ |
void |
static void |
channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset) |
channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
|
Channel *nc; |
|
char *name; |
|
int newsock; |
struct sockaddr addr; |
struct sockaddr addr; |
int newsock, newch; |
|
socklen_t addrlen; |
socklen_t addrlen; |
|
|
if (FD_ISSET(c->sock, readset)) { |
if (FD_ISSET(c->sock, readset)) { |
|
|
error("accept from auth socket: %.100s", strerror(errno)); |
error("accept from auth socket: %.100s", strerror(errno)); |
return; |
return; |
} |
} |
newch = channel_new("accepted auth socket", |
name = xstrdup("accepted auth socket"); |
|
nc = channel_new("accepted auth socket", |
SSH_CHANNEL_OPENING, newsock, newsock, -1, |
SSH_CHANNEL_OPENING, newsock, newsock, -1, |
c->local_window_max, c->local_maxpacket, |
c->local_window_max, c->local_maxpacket, |
0, xstrdup("accepted auth socket"), 1); |
0, name, 1); |
if (compat20) { |
if (compat20) { |
packet_start(SSH2_MSG_CHANNEL_OPEN); |
packet_start(SSH2_MSG_CHANNEL_OPEN); |
packet_put_cstring("auth-agent@openssh.com"); |
packet_put_cstring("auth-agent@openssh.com"); |
packet_put_int(newch); |
packet_put_int(nc->self); |
packet_put_int(c->local_window_max); |
packet_put_int(c->local_window_max); |
packet_put_int(c->local_maxpacket); |
packet_put_int(c->local_maxpacket); |
} else { |
} else { |
packet_start(SSH_SMSG_AGENT_OPEN); |
packet_start(SSH_SMSG_AGENT_OPEN); |
packet_put_int(newch); |
packet_put_int(nc->self); |
} |
} |
packet_send(); |
packet_send(); |
} |
} |
} |
} |
|
|
void |
static void |
channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset) |
channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
|
int err = 0; |
|
socklen_t sz = sizeof(err); |
|
|
if (FD_ISSET(c->sock, writeset)) { |
if (FD_ISSET(c->sock, writeset)) { |
int err = 0; |
if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, &err, &sz) < 0) { |
int sz = sizeof(err); |
err = errno; |
c->type = SSH_CHANNEL_OPEN; |
error("getsockopt SO_ERROR failed"); |
if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &sz) < 0) { |
} |
debug("getsockopt SO_ERROR failed"); |
if (err == 0) { |
|
debug("channel %d: connected", c->self); |
|
c->type = SSH_CHANNEL_OPEN; |
|
if (compat20) { |
|
packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); |
|
packet_put_int(c->remote_id); |
|
packet_put_int(c->self); |
|
packet_put_int(c->local_window); |
|
packet_put_int(c->local_maxpacket); |
|
} else { |
|
packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); |
|
packet_put_int(c->remote_id); |
|
packet_put_int(c->self); |
|
} |
} else { |
} else { |
if (err == 0) { |
debug("channel %d: not connected: %s", |
debug("channel %d: connected)", c->self); |
c->self, strerror(err)); |
|
if (compat20) { |
|
packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE); |
|
packet_put_int(c->remote_id); |
|
packet_put_int(SSH2_OPEN_CONNECT_FAILED); |
|
if (!(datafellows & SSH_BUG_OPENFAILURE)) { |
|
packet_put_cstring(strerror(err)); |
|
packet_put_cstring(""); |
|
} |
} else { |
} else { |
debug("channel %d: not connected: %s", |
packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); |
c->self, strerror(err)); |
packet_put_int(c->remote_id); |
chan_read_failed(c); |
|
chan_write_failed(c); |
|
} |
} |
|
chan_mark_dead(c); |
} |
} |
|
packet_send(); |
} |
} |
} |
} |
|
|
int |
static int |
channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset) |
channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
char buf[16*1024]; |
char buf[16*1024]; |
|
|
c->self, c->rfd, len); |
c->self, c->rfd, len); |
if (c->type != SSH_CHANNEL_OPEN) { |
if (c->type != SSH_CHANNEL_OPEN) { |
debug("channel %d: not open", c->self); |
debug("channel %d: not open", c->self); |
channel_free(c->self); |
chan_mark_dead(c); |
return -1; |
return -1; |
} else if (compat13) { |
} else if (compat13) { |
buffer_consume(&c->output, buffer_len(&c->output)); |
buffer_clear(&c->output); |
c->type = SSH_CHANNEL_INPUT_DRAINING; |
c->type = SSH_CHANNEL_INPUT_DRAINING; |
debug("channel %d: status set to input draining.", c->self); |
debug("channel %d: input draining.", c->self); |
} else { |
} else { |
chan_read_failed(c); |
chan_read_failed(c); |
} |
} |
return -1; |
return -1; |
} |
} |
if(c->input_filter != NULL) { |
if (c->input_filter != NULL) { |
if (c->input_filter(c, buf, len) == -1) { |
if (c->input_filter(c, buf, len) == -1) { |
debug("channel %d: filter stops", c->self); |
debug("channel %d: filter stops", c->self); |
chan_read_failed(c); |
chan_read_failed(c); |
|
|
} |
} |
return 1; |
return 1; |
} |
} |
int |
static int |
channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset) |
channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
struct termios tio; |
struct termios tio; |
|
u_char *data; |
|
u_int dlen; |
int len; |
int len; |
|
|
/* Send buffered output data to the socket. */ |
/* Send buffered output data to the socket. */ |
if (c->wfd != -1 && |
if (c->wfd != -1 && |
FD_ISSET(c->wfd, writeset) && |
FD_ISSET(c->wfd, writeset) && |
buffer_len(&c->output) > 0) { |
buffer_len(&c->output) > 0) { |
len = write(c->wfd, buffer_ptr(&c->output), |
data = buffer_ptr(&c->output); |
buffer_len(&c->output)); |
dlen = buffer_len(&c->output); |
|
len = write(c->wfd, data, dlen); |
if (len < 0 && (errno == EINTR || errno == EAGAIN)) |
if (len < 0 && (errno == EINTR || errno == EAGAIN)) |
return 1; |
return 1; |
if (len <= 0) { |
if (len <= 0) { |
if (c->type != SSH_CHANNEL_OPEN) { |
if (c->type != SSH_CHANNEL_OPEN) { |
debug("channel %d: not open", c->self); |
debug("channel %d: not open", c->self); |
channel_free(c->self); |
chan_mark_dead(c); |
return -1; |
return -1; |
} else if (compat13) { |
} else if (compat13) { |
buffer_consume(&c->output, buffer_len(&c->output)); |
buffer_clear(&c->output); |
debug("channel %d: status set to input draining.", c->self); |
debug("channel %d: input draining.", c->self); |
c->type = SSH_CHANNEL_INPUT_DRAINING; |
c->type = SSH_CHANNEL_INPUT_DRAINING; |
} else { |
} else { |
chan_write_failed(c); |
chan_write_failed(c); |
} |
} |
return -1; |
return -1; |
} |
} |
if (compat20 && c->isatty) { |
if (compat20 && c->isatty && dlen >= 1 && data[0] != '\r') { |
if (tcgetattr(c->wfd, &tio) == 0 && |
if (tcgetattr(c->wfd, &tio) == 0 && |
!(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) { |
!(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) { |
/* |
/* |
|
|
} |
} |
return 1; |
return 1; |
} |
} |
int |
static int |
channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset) |
channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
char buf[16*1024]; |
char buf[16*1024]; |
|
|
if (len <= 0) { |
if (len <= 0) { |
debug2("channel %d: closing write-efd %d", |
debug2("channel %d: closing write-efd %d", |
c->self, c->efd); |
c->self, c->efd); |
close(c->efd); |
channel_close_fd(&c->efd); |
c->efd = -1; |
|
} else { |
} else { |
buffer_consume(&c->extended, len); |
buffer_consume(&c->extended, len); |
c->local_consumed += len; |
c->local_consumed += len; |
|
|
FD_ISSET(c->efd, readset)) { |
FD_ISSET(c->efd, readset)) { |
len = read(c->efd, buf, sizeof(buf)); |
len = read(c->efd, buf, sizeof(buf)); |
debug2("channel %d: read %d from efd %d", |
debug2("channel %d: read %d from efd %d", |
c->self, len, c->efd); |
c->self, len, c->efd); |
if (len < 0 && (errno == EINTR || errno == EAGAIN)) |
if (len < 0 && (errno == EINTR || errno == EAGAIN)) |
return 1; |
return 1; |
if (len <= 0) { |
if (len <= 0) { |
debug2("channel %d: closing read-efd %d", |
debug2("channel %d: closing read-efd %d", |
c->self, c->efd); |
c->self, c->efd); |
close(c->efd); |
channel_close_fd(&c->efd); |
c->efd = -1; |
|
} else { |
} else { |
buffer_append(&c->extended, buf, len); |
buffer_append(&c->extended, buf, len); |
} |
} |
|
|
} |
} |
return 1; |
return 1; |
} |
} |
int |
static int |
channel_check_window(Channel *c) |
channel_check_window(Channel *c) |
{ |
{ |
if (c->type == SSH_CHANNEL_OPEN && |
if (c->type == SSH_CHANNEL_OPEN && |
|
|
return 1; |
return 1; |
} |
} |
|
|
void |
static void |
channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset) |
channel_post_open(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
|
if (c->delayed) |
|
return; |
channel_handle_rfd(c, readset, writeset); |
channel_handle_rfd(c, readset, writeset); |
channel_handle_wfd(c, readset, writeset); |
channel_handle_wfd(c, readset, writeset); |
} |
if (!compat20) |
|
return; |
void |
|
channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset) |
|
{ |
|
channel_handle_rfd(c, readset, writeset); |
|
channel_handle_wfd(c, readset, writeset); |
|
channel_handle_efd(c, readset, writeset); |
channel_handle_efd(c, readset, writeset); |
|
|
channel_check_window(c); |
channel_check_window(c); |
} |
} |
|
|
void |
static void |
channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset) |
channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
int len; |
int len; |
|
|
len = write(c->sock, buffer_ptr(&c->output), |
len = write(c->sock, buffer_ptr(&c->output), |
buffer_len(&c->output)); |
buffer_len(&c->output)); |
if (len <= 0) |
if (len <= 0) |
buffer_consume(&c->output, buffer_len(&c->output)); |
buffer_clear(&c->output); |
else |
else |
buffer_consume(&c->output, len); |
buffer_consume(&c->output, len); |
} |
} |
} |
} |
|
|
void |
static void |
channel_handler_init_20(void) |
channel_handler_init_20(void) |
{ |
{ |
channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20; |
channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open; |
channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; |
channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; |
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener; |
|
|
channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; |
channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; |
channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; |
channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; |
|
|
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2; |
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; |
channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; |
channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_2; |
channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; |
} |
} |
|
|
void |
static void |
channel_handler_init_13(void) |
channel_handler_init_13(void) |
{ |
{ |
channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13; |
channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13; |
|
|
channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; |
channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; |
channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; |
channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; |
|
|
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1; |
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; |
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13; |
channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13; |
channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; |
channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; |
channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_1; |
channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; |
} |
} |
|
|
void |
static void |
channel_handler_init_15(void) |
channel_handler_init_15(void) |
{ |
{ |
channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15; |
channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open; |
channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; |
channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; |
channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; |
|
|
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1; |
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; |
channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; |
channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; |
channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_1; |
channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; |
} |
} |
|
|
void |
static void |
channel_handler_init(void) |
channel_handler_init(void) |
{ |
{ |
int i; |
int i; |
for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) { |
for (i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) { |
channel_pre[i] = NULL; |
channel_pre[i] = NULL; |
channel_post[i] = NULL; |
channel_post[i] = NULL; |
} |
} |
|
|
channel_handler_init_15(); |
channel_handler_init_15(); |
} |
} |
|
|
void |
/* gc dead channels */ |
|
static void |
|
channel_garbage_collect(Channel *c) |
|
{ |
|
if (c == NULL) |
|
return; |
|
if (c->detach_user != NULL) { |
|
if (!chan_is_dead(c, 0)) |
|
return; |
|
debug("channel %d: gc: notify user", c->self); |
|
c->detach_user(c->self, NULL); |
|
/* if we still have a callback */ |
|
if (c->detach_user != NULL) |
|
return; |
|
debug("channel %d: gc: user detached", c->self); |
|
} |
|
if (!chan_is_dead(c, 1)) |
|
return; |
|
debug("channel %d: garbage collecting", c->self); |
|
channel_free(c); |
|
} |
|
|
|
static void |
channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset) |
channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset) |
{ |
{ |
static int did_init = 0; |
static int did_init = 0; |
|
|
did_init = 1; |
did_init = 1; |
} |
} |
for (i = 0; i < channels_alloc; i++) { |
for (i = 0; i < channels_alloc; i++) { |
c = &channels[i]; |
c = channels[i]; |
if (c->type == SSH_CHANNEL_FREE) |
if (c == NULL) |
continue; |
continue; |
if (ftab[c->type] == NULL) |
if (ftab[c->type] != NULL) |
continue; |
(*ftab[c->type])(c, readset, writeset); |
(*ftab[c->type])(c, readset, writeset); |
channel_garbage_collect(c); |
if (chan_is_dead(c)) { |
|
/* |
|
* we have to remove the fd's from the select mask |
|
* before the channels are free'd and the fd's are |
|
* closed |
|
*/ |
|
if (c->wfd != -1) |
|
FD_CLR(c->wfd, writeset); |
|
if (c->rfd != -1) |
|
FD_CLR(c->rfd, readset); |
|
if (c->efd != -1) { |
|
if (c->extended_usage == CHAN_EXTENDED_READ) |
|
FD_CLR(c->efd, readset); |
|
if (c->extended_usage == CHAN_EXTENDED_WRITE) |
|
FD_CLR(c->efd, writeset); |
|
} |
|
channel_free(c->self); |
|
} |
|
} |
} |
} |
} |
|
|
|
/* |
|
* Allocate/update select bitmasks and add any bits relevant to channels in |
|
* select bitmasks. |
|
*/ |
void |
void |
channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp, |
channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp, |
int rekeying) |
int *nallocp, int rekeying) |
{ |
{ |
int n; |
int n; |
u_int sz; |
u_int sz; |
|
|
n = MAX(*maxfdp, channel_max_fd); |
n = MAX(*maxfdp, channel_max_fd); |
|
|
sz = howmany(n+1, NFDBITS) * sizeof(fd_mask); |
sz = howmany(n+1, NFDBITS) * sizeof(fd_mask); |
if (*readsetp == NULL || n > *maxfdp) { |
/* perhaps check sz < nalloc/2 and shrink? */ |
if (*readsetp) |
if (*readsetp == NULL || sz > *nallocp) { |
xfree(*readsetp); |
*readsetp = xrealloc(*readsetp, sz); |
if (*writesetp) |
*writesetp = xrealloc(*writesetp, sz); |
xfree(*writesetp); |
*nallocp = sz; |
*readsetp = xmalloc(sz); |
|
*writesetp = xmalloc(sz); |
|
*maxfdp = n; |
|
} |
} |
|
*maxfdp = n; |
memset(*readsetp, 0, sz); |
memset(*readsetp, 0, sz); |
memset(*writesetp, 0, sz); |
memset(*writesetp, 0, sz); |
|
|
|
|
channel_handler(channel_pre, *readsetp, *writesetp); |
channel_handler(channel_pre, *readsetp, *writesetp); |
} |
} |
|
|
|
/* |
|
* After select, perform any appropriate operations for channels which have |
|
* events pending. |
|
*/ |
void |
void |
channel_after_select(fd_set * readset, fd_set * writeset) |
channel_after_select(fd_set * readset, fd_set * writeset) |
{ |
{ |
channel_handler(channel_post, readset, writeset); |
channel_handler(channel_post, readset, writeset); |
} |
} |
|
|
|
|
/* If there is data to send to the connection, enqueue some of it now. */ |
/* If there is data to send to the connection, enqueue some of it now. */ |
|
|
void |
void |
channel_output_poll() |
channel_output_poll(void) |
{ |
{ |
int len, i; |
int len, i; |
Channel *c; |
Channel *c; |
|
|
for (i = 0; i < channels_alloc; i++) { |
for (i = 0; i < channels_alloc; i++) { |
c = &channels[i]; |
c = channels[i]; |
|
if (c == NULL) |
|
continue; |
|
|
/* We are only interested in channels that can have buffered incoming data. */ |
/* |
|
* We are only interested in channels that can have buffered |
|
* incoming data. |
|
*/ |
if (compat13) { |
if (compat13) { |
if (c->type != SSH_CHANNEL_OPEN && |
if (c->type != SSH_CHANNEL_OPEN && |
c->type != SSH_CHANNEL_INPUT_DRAINING) |
c->type != SSH_CHANNEL_INPUT_DRAINING) |
|
|
if (compat20 && |
if (compat20 && |
(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) { |
(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) { |
/* XXX is this true? */ |
/* XXX is this true? */ |
debug2("channel %d: no data after CLOSE", c->self); |
debug3("channel %d: will not send data after close", c->self); |
continue; |
continue; |
} |
} |
|
|
|
|
if ((c->istate == CHAN_INPUT_OPEN || |
if ((c->istate == CHAN_INPUT_OPEN || |
c->istate == CHAN_INPUT_WAIT_DRAIN) && |
c->istate == CHAN_INPUT_WAIT_DRAIN) && |
(len = buffer_len(&c->input)) > 0) { |
(len = buffer_len(&c->input)) > 0) { |
/* Send some data for the other side over the secure connection. */ |
/* |
|
* Send some data for the other side over the secure |
|
* connection. |
|
*/ |
if (compat20) { |
if (compat20) { |
if (len > c->remote_window) |
if (len > c->remote_window) |
len = c->remote_window; |
len = c->remote_window; |
|
|
} |
} |
} |
} |
|
|
/* |
|
* This is called when a packet of type CHANNEL_DATA has just been received. |
|
* The message type has already been consumed, but channel number and data is |
|
* still there. |
|
*/ |
|
|
|
|
/* -- protocol input */ |
|
|
void |
void |
channel_input_data(int type, int plen, void *ctxt) |
channel_input_data(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int id; |
int id; |
char *data; |
char *data; |
|
|
|
|
/* Get the data. */ |
/* Get the data. */ |
data = packet_get_string(&data_len); |
data = packet_get_string(&data_len); |
packet_done(); |
|
|
|
if (compat20){ |
if (compat20) { |
if (data_len > c->local_maxpacket) { |
if (data_len > c->local_maxpacket) { |
log("channel %d: rcvd big packet %d, maxpack %d", |
log("channel %d: rcvd big packet %d, maxpack %d", |
c->self, data_len, c->local_maxpacket); |
c->self, data_len, c->local_maxpacket); |
|
|
return; |
return; |
} |
} |
c->local_window -= data_len; |
c->local_window -= data_len; |
}else{ |
|
packet_integrity_check(plen, 4 + 4 + data_len, type); |
|
} |
} |
|
packet_check_eom(); |
buffer_append(&c->output, data, data_len); |
buffer_append(&c->output, data, data_len); |
xfree(data); |
xfree(data); |
} |
} |
|
|
void |
void |
channel_input_extended_data(int type, int plen, void *ctxt) |
channel_input_extended_data(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int id; |
int id; |
int tcode; |
int tcode; |
|
|
return; |
return; |
} |
} |
data = packet_get_string(&data_len); |
data = packet_get_string(&data_len); |
packet_done(); |
packet_check_eom(); |
if (data_len > c->local_window) { |
if (data_len > c->local_window) { |
log("channel %d: rcvd too much extended_data %d, win %d", |
log("channel %d: rcvd too much extended_data %d, win %d", |
c->self, data_len, c->local_window); |
c->self, data_len, c->local_window); |
|
|
xfree(data); |
xfree(data); |
} |
} |
|
|
|
|
/* |
|
* Returns true if no channel has too much buffered data, and false if one or |
|
* more channel is overfull. |
|
*/ |
|
|
|
int |
|
channel_not_very_much_buffered_data() |
|
{ |
|
u_int i; |
|
Channel *c; |
|
|
|
for (i = 0; i < channels_alloc; i++) { |
|
c = &channels[i]; |
|
if (c->type == SSH_CHANNEL_OPEN) { |
|
if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) { |
|
debug("channel %d: big input buffer %d", |
|
c->self, buffer_len(&c->input)); |
|
return 0; |
|
} |
|
if (buffer_len(&c->output) > packet_get_maxsize()) { |
|
debug("channel %d: big output buffer %d", |
|
c->self, buffer_len(&c->output)); |
|
return 0; |
|
} |
|
} |
|
} |
|
return 1; |
|
} |
|
|
|
void |
void |
channel_input_ieof(int type, int plen, void *ctxt) |
channel_input_ieof(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int id; |
int id; |
Channel *c; |
Channel *c; |
|
|
packet_integrity_check(plen, 4, type); |
|
|
|
id = packet_get_int(); |
id = packet_get_int(); |
|
packet_check_eom(); |
c = channel_lookup(id); |
c = channel_lookup(id); |
if (c == NULL) |
if (c == NULL) |
packet_disconnect("Received ieof for nonexistent channel %d.", id); |
packet_disconnect("Received ieof for nonexistent channel %d.", id); |
chan_rcvd_ieof(c); |
chan_rcvd_ieof(c); |
|
|
|
/* XXX force input close */ |
|
if (c->force_drain && c->istate == CHAN_INPUT_OPEN) { |
|
debug("channel %d: FORCE input drain", c->self); |
|
c->istate = CHAN_INPUT_WAIT_DRAIN; |
|
if (buffer_len(&c->input) == 0) |
|
chan_ibuf_empty(c); |
|
} |
|
|
} |
} |
|
|
void |
void |
channel_input_close(int type, int plen, void *ctxt) |
channel_input_close(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int id; |
int id; |
Channel *c; |
Channel *c; |
|
|
packet_integrity_check(plen, 4, type); |
|
|
|
id = packet_get_int(); |
id = packet_get_int(); |
|
packet_check_eom(); |
c = channel_lookup(id); |
c = channel_lookup(id); |
if (c == NULL) |
if (c == NULL) |
packet_disconnect("Received close for nonexistent channel %d.", id); |
packet_disconnect("Received close for nonexistent channel %d.", id); |
|
|
* Not a closed channel - mark it as draining, which will |
* Not a closed channel - mark it as draining, which will |
* cause it to be freed later. |
* cause it to be freed later. |
*/ |
*/ |
buffer_consume(&c->input, buffer_len(&c->input)); |
buffer_clear(&c->input); |
c->type = SSH_CHANNEL_OUTPUT_DRAINING; |
c->type = SSH_CHANNEL_OUTPUT_DRAINING; |
} |
} |
} |
} |
|
|
/* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */ |
/* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */ |
void |
void |
channel_input_oclose(int type, int plen, void *ctxt) |
channel_input_oclose(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int id = packet_get_int(); |
int id = packet_get_int(); |
Channel *c = channel_lookup(id); |
Channel *c = channel_lookup(id); |
packet_integrity_check(plen, 4, type); |
|
|
packet_check_eom(); |
if (c == NULL) |
if (c == NULL) |
packet_disconnect("Received oclose for nonexistent channel %d.", id); |
packet_disconnect("Received oclose for nonexistent channel %d.", id); |
chan_rcvd_oclose(c); |
chan_rcvd_oclose(c); |
} |
} |
|
|
void |
void |
channel_input_close_confirmation(int type, int plen, void *ctxt) |
channel_input_close_confirmation(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int id = packet_get_int(); |
int id = packet_get_int(); |
Channel *c = channel_lookup(id); |
Channel *c = channel_lookup(id); |
|
|
packet_done(); |
packet_check_eom(); |
if (c == NULL) |
if (c == NULL) |
packet_disconnect("Received close confirmation for " |
packet_disconnect("Received close confirmation for " |
"out-of-range channel %d.", id); |
"out-of-range channel %d.", id); |
if (c->type != SSH_CHANNEL_CLOSED) |
if (c->type != SSH_CHANNEL_CLOSED) |
packet_disconnect("Received close confirmation for " |
packet_disconnect("Received close confirmation for " |
"non-closed channel %d (type %d).", id, c->type); |
"non-closed channel %d (type %d).", id, c->type); |
channel_free(c->self); |
channel_free(c); |
} |
} |
|
|
void |
void |
channel_input_open_confirmation(int type, int plen, void *ctxt) |
channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int id, remote_id; |
int id, remote_id; |
Channel *c; |
Channel *c; |
|
|
if (!compat20) |
|
packet_integrity_check(plen, 4 + 4, type); |
|
|
|
id = packet_get_int(); |
id = packet_get_int(); |
c = channel_lookup(id); |
c = channel_lookup(id); |
|
|
|
|
if (compat20) { |
if (compat20) { |
c->remote_window = packet_get_int(); |
c->remote_window = packet_get_int(); |
c->remote_maxpacket = packet_get_int(); |
c->remote_maxpacket = packet_get_int(); |
packet_done(); |
if (c->confirm) { |
if (c->cb_fn != NULL && c->cb_event == type) { |
|
debug2("callback start"); |
debug2("callback start"); |
c->cb_fn(c->self, c->cb_arg); |
c->confirm(c->self, NULL); |
debug2("callback done"); |
debug2("callback done"); |
} |
} |
debug("channel %d: open confirm rwindow %d rmax %d", c->self, |
debug("channel %d: open confirm rwindow %d rmax %d", c->self, |
c->remote_window, c->remote_maxpacket); |
c->remote_window, c->remote_maxpacket); |
} |
} |
|
packet_check_eom(); |
} |
} |
|
|
|
static char * |
|
reason2txt(int reason) |
|
{ |
|
switch (reason) { |
|
case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED: |
|
return "administratively prohibited"; |
|
case SSH2_OPEN_CONNECT_FAILED: |
|
return "connect failed"; |
|
case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE: |
|
return "unknown channel type"; |
|
case SSH2_OPEN_RESOURCE_SHORTAGE: |
|
return "resource shortage"; |
|
} |
|
return "unknown reason"; |
|
} |
|
|
void |
void |
channel_input_open_failure(int type, int plen, void *ctxt) |
channel_input_open_failure(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int id, reason; |
int id, reason; |
char *msg = NULL, *lang = NULL; |
char *msg = NULL, *lang = NULL; |
Channel *c; |
Channel *c; |
|
|
if (!compat20) |
|
packet_integrity_check(plen, 4, type); |
|
|
|
id = packet_get_int(); |
id = packet_get_int(); |
c = channel_lookup(id); |
c = channel_lookup(id); |
|
|
|
|
"non-opening channel %d.", id); |
"non-opening channel %d.", id); |
if (compat20) { |
if (compat20) { |
reason = packet_get_int(); |
reason = packet_get_int(); |
if (packet_remaining() > 0) { |
if (!(datafellows & SSH_BUG_OPENFAILURE)) { |
msg = packet_get_string(NULL); |
msg = packet_get_string(NULL); |
lang = packet_get_string(NULL); |
lang = packet_get_string(NULL); |
} |
} |
packet_done(); |
log("channel %d: open failed: %s%s%s", id, |
log("channel_open_failure: %d: reason %d %s", id, |
reason2txt(reason), msg ? ": ": "", msg ? msg : ""); |
reason, msg ? msg : "<no additional info>"); |
|
if (msg != NULL) |
if (msg != NULL) |
xfree(msg); |
xfree(msg); |
if (lang != NULL) |
if (lang != NULL) |
xfree(lang); |
xfree(lang); |
} |
} |
|
packet_check_eom(); |
/* Free the channel. This will also close the socket. */ |
/* Free the channel. This will also close the socket. */ |
channel_free(id); |
channel_free(c); |
} |
} |
|
|
void |
void |
channel_input_channel_request(int type, int plen, void *ctxt) |
channel_input_window_adjust(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int id; |
|
Channel *c; |
Channel *c; |
|
|
id = packet_get_int(); |
|
c = channel_lookup(id); |
|
|
|
if (c == NULL || |
|
(c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL)) |
|
packet_disconnect("Received request for " |
|
"non-open channel %d.", id); |
|
if (c->cb_fn != NULL && c->cb_event == type) { |
|
debug2("callback start"); |
|
c->cb_fn(c->self, c->cb_arg); |
|
debug2("callback done"); |
|
} else { |
|
char *service = packet_get_string(NULL); |
|
debug("channel %d: rcvd request for %s", c->self, service); |
|
debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event); |
|
xfree(service); |
|
} |
|
} |
|
|
|
void |
|
channel_input_window_adjust(int type, int plen, void *ctxt) |
|
{ |
|
Channel *c; |
|
int id, adjust; |
int id, adjust; |
|
|
if (!compat20) |
if (!compat20) |
|
|
return; |
return; |
} |
} |
adjust = packet_get_int(); |
adjust = packet_get_int(); |
packet_done(); |
packet_check_eom(); |
debug2("channel %d: rcvd adjust %d", id, adjust); |
debug2("channel %d: rcvd adjust %d", id, adjust); |
c->remote_window += adjust; |
c->remote_window += adjust; |
} |
} |
|
|
/* |
|
* Stops listening for channels, and removes any unix domain sockets that we |
|
* might have. |
|
*/ |
|
|
|
void |
void |
channel_stop_listening() |
channel_input_port_open(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int i; |
Channel *c = NULL; |
for (i = 0; i < channels_alloc; i++) { |
u_short host_port; |
switch (channels[i].type) { |
char *host, *originator_string; |
case SSH_CHANNEL_AUTH_SOCKET: |
int remote_id, sock = -1; |
close(channels[i].sock); |
|
unlink(channels[i].path); |
|
channel_free(i); |
|
break; |
|
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
|
case SSH_CHANNEL_X11_LISTENER: |
|
close(channels[i].sock); |
|
channel_free(i); |
|
break; |
|
default: |
|
break; |
|
} |
|
} |
|
} |
|
|
|
/* |
remote_id = packet_get_int(); |
* Closes the sockets/fds of all channels. This is used to close extra file |
host = packet_get_string(NULL); |
* descriptors after a fork. |
host_port = packet_get_int(); |
*/ |
|
|
|
void |
if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) { |
channel_close_all() |
originator_string = packet_get_string(NULL); |
{ |
} else { |
int i; |
originator_string = xstrdup("unknown (remote did not supply name)"); |
for (i = 0; i < channels_alloc; i++) |
} |
if (channels[i].type != SSH_CHANNEL_FREE) |
packet_check_eom(); |
channel_close_fds(&channels[i]); |
sock = channel_connect_to(host, host_port); |
|
if (sock != -1) { |
|
c = channel_new("connected socket", |
|
SSH_CHANNEL_CONNECTING, sock, sock, -1, 0, 0, 0, |
|
originator_string, 1); |
|
c->remote_id = remote_id; |
|
} |
|
if (c == NULL) { |
|
packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); |
|
packet_put_int(remote_id); |
|
packet_send(); |
|
} |
|
xfree(host); |
} |
} |
|
|
/* Returns true if any channel is still open. */ |
|
|
|
int |
/* -- tcp forwarding */ |
channel_still_open() |
|
{ |
|
u_int i; |
|
for (i = 0; i < channels_alloc; i++) |
|
switch (channels[i].type) { |
|
case SSH_CHANNEL_FREE: |
|
case SSH_CHANNEL_X11_LISTENER: |
|
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
|
case SSH_CHANNEL_CLOSED: |
|
case SSH_CHANNEL_AUTH_SOCKET: |
|
case SSH_CHANNEL_DYNAMIC: |
|
case SSH_CHANNEL_CONNECTING: /* XXX ??? */ |
|
continue; |
|
case SSH_CHANNEL_LARVAL: |
|
if (!compat20) |
|
fatal("cannot happen: SSH_CHANNEL_LARVAL"); |
|
continue; |
|
case SSH_CHANNEL_OPENING: |
|
case SSH_CHANNEL_OPEN: |
|
case SSH_CHANNEL_X11_OPEN: |
|
return 1; |
|
case SSH_CHANNEL_INPUT_DRAINING: |
|
case SSH_CHANNEL_OUTPUT_DRAINING: |
|
if (!compat13) |
|
fatal("cannot happen: OUT_DRAIN"); |
|
return 1; |
|
default: |
|
fatal("channel_still_open: bad channel type %d", channels[i].type); |
|
/* NOTREACHED */ |
|
} |
|
return 0; |
|
} |
|
|
|
/* Returns the id of an open channel suitable for keepaliving */ |
void |
|
channel_set_af(int af) |
int |
|
channel_find_open() |
|
{ |
{ |
u_int i; |
IPv4or6 = af; |
for (i = 0; i < channels_alloc; i++) |
|
switch (channels[i].type) { |
|
case SSH_CHANNEL_CLOSED: |
|
case SSH_CHANNEL_DYNAMIC: |
|
case SSH_CHANNEL_FREE: |
|
case SSH_CHANNEL_X11_LISTENER: |
|
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
|
case SSH_CHANNEL_OPENING: |
|
continue; |
|
case SSH_CHANNEL_LARVAL: |
|
case SSH_CHANNEL_AUTH_SOCKET: |
|
case SSH_CHANNEL_CONNECTING: /* XXX ??? */ |
|
case SSH_CHANNEL_OPEN: |
|
case SSH_CHANNEL_X11_OPEN: |
|
return i; |
|
case SSH_CHANNEL_INPUT_DRAINING: |
|
case SSH_CHANNEL_OUTPUT_DRAINING: |
|
if (!compat13) |
|
fatal("cannot happen: OUT_DRAIN"); |
|
return i; |
|
default: |
|
fatal("channel_find_open: bad channel type %d", channels[i].type); |
|
/* NOTREACHED */ |
|
} |
|
return -1; |
|
} |
} |
|
|
|
static int |
/* |
channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_port, |
* Returns a message describing the currently open forwarded connections, |
const char *host_to_connect, u_short port_to_connect, int gateway_ports) |
* suitable for sending to the client. The message contains crlf pairs for |
|
* newlines. |
|
*/ |
|
|
|
char * |
|
channel_open_message() |
|
{ |
{ |
Buffer buffer; |
Channel *c; |
int i; |
int success, sock, on = 1; |
char buf[512], *cp; |
|
|
|
buffer_init(&buffer); |
|
snprintf(buf, sizeof buf, "The following connections are open:\r\n"); |
|
buffer_append(&buffer, buf, strlen(buf)); |
|
for (i = 0; i < channels_alloc; i++) { |
|
Channel *c = &channels[i]; |
|
switch (c->type) { |
|
case SSH_CHANNEL_FREE: |
|
case SSH_CHANNEL_X11_LISTENER: |
|
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
|
case SSH_CHANNEL_CLOSED: |
|
case SSH_CHANNEL_AUTH_SOCKET: |
|
continue; |
|
case SSH_CHANNEL_LARVAL: |
|
case SSH_CHANNEL_OPENING: |
|
case SSH_CHANNEL_CONNECTING: |
|
case SSH_CHANNEL_DYNAMIC: |
|
case SSH_CHANNEL_OPEN: |
|
case SSH_CHANNEL_X11_OPEN: |
|
case SSH_CHANNEL_INPUT_DRAINING: |
|
case SSH_CHANNEL_OUTPUT_DRAINING: |
|
snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n", |
|
c->self, c->remote_name, |
|
c->type, c->remote_id, |
|
c->istate, buffer_len(&c->input), |
|
c->ostate, buffer_len(&c->output), |
|
c->rfd, c->wfd); |
|
buffer_append(&buffer, buf, strlen(buf)); |
|
continue; |
|
default: |
|
fatal("channel_open_message: bad channel type %d", c->type); |
|
/* NOTREACHED */ |
|
} |
|
} |
|
buffer_append(&buffer, "\0", 1); |
|
cp = xstrdup(buffer_ptr(&buffer)); |
|
buffer_free(&buffer); |
|
return cp; |
|
} |
|
|
|
/* |
|
* Initiate forwarding of connections to local port "port" through the secure |
|
* channel to host:port from remote side. |
|
*/ |
|
int |
|
channel_request_local_forwarding(u_short listen_port, const char *host_to_connect, |
|
u_short port_to_connect, int gateway_ports) |
|
{ |
|
return channel_request_forwarding( |
|
NULL, listen_port, |
|
host_to_connect, port_to_connect, |
|
gateway_ports, /*remote_fwd*/ 0); |
|
} |
|
|
|
/* |
|
* If 'remote_fwd' is true we have a '-R style' listener for protocol 2 |
|
* (SSH_CHANNEL_RPORT_LISTENER). |
|
*/ |
|
int |
|
channel_request_forwarding( |
|
const char *listen_address, u_short listen_port, |
|
const char *host_to_connect, u_short port_to_connect, |
|
int gateway_ports, int remote_fwd) |
|
{ |
|
int success, ch, sock, on = 1, ctype; |
|
struct addrinfo hints, *ai, *aitop; |
struct addrinfo hints, *ai, *aitop; |
char ntop[NI_MAXHOST], strport[NI_MAXSERV]; |
|
const char *host; |
const char *host; |
|
char ntop[NI_MAXHOST], strport[NI_MAXSERV]; |
struct linger linger; |
struct linger linger; |
|
|
success = 0; |
success = 0; |
|
host = (type == SSH_CHANNEL_RPORT_LISTENER) ? |
|
listen_addr : host_to_connect; |
|
|
if (remote_fwd) { |
if (host == NULL) { |
host = listen_address; |
error("No forward host name."); |
ctype = SSH_CHANNEL_RPORT_LISTENER; |
return success; |
} else { |
|
host = host_to_connect; |
|
ctype =SSH_CHANNEL_PORT_LISTENER; |
|
} |
} |
|
if (strlen(host) > SSH_CHANNEL_PATH_LEN - 1) { |
if (strlen(host) > sizeof(channels[0].path) - 1) { |
|
error("Forward host name too long."); |
error("Forward host name too long."); |
return success; |
return success; |
} |
} |
|
|
/* XXX listen_address is currently ignored */ |
|
/* |
/* |
* getaddrinfo returns a loopback address if the hostname is |
* getaddrinfo returns a loopback address if the hostname is |
* set to NULL and hints.ai_flags is not AI_PASSIVE |
* set to NULL and hints.ai_flags is not AI_PASSIVE |
|
|
continue; |
continue; |
if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), |
if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), |
strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { |
strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { |
error("channel_request_forwarding: getnameinfo failed"); |
error("channel_setup_fwd_listener: getnameinfo failed"); |
continue; |
continue; |
} |
} |
/* Create a port to listen for the host. */ |
/* Create a port to listen for the host. */ |
|
|
* Set socket options. We would like the socket to disappear |
* Set socket options. We would like the socket to disappear |
* as soon as it has been closed for whatever reason. |
* as soon as it has been closed for whatever reason. |
*/ |
*/ |
setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on)); |
setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)); |
linger.l_onoff = 1; |
linger.l_onoff = 1; |
linger.l_linger = 5; |
linger.l_linger = 5; |
setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger)); |
setsockopt(sock, SOL_SOCKET, SO_LINGER, &linger, sizeof(linger)); |
debug("Local forwarding listening on %s port %s.", ntop, strport); |
debug("Local forwarding listening on %s port %s.", ntop, strport); |
|
|
/* Bind the socket to the address. */ |
/* Bind the socket to the address. */ |
|
|
continue; |
continue; |
} |
} |
/* Allocate a channel number for the socket. */ |
/* Allocate a channel number for the socket. */ |
ch = channel_new("port listener", ctype, sock, sock, -1, |
c = channel_new("port listener", type, sock, sock, -1, |
CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, |
CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, |
0, xstrdup("port listener"), 1); |
0, xstrdup("port listener"), 1); |
strlcpy(channels[ch].path, host, sizeof(channels[ch].path)); |
strlcpy(c->path, host, sizeof(c->path)); |
channels[ch].host_port = port_to_connect; |
c->host_port = port_to_connect; |
channels[ch].listening_port = listen_port; |
c->listening_port = listen_port; |
success = 1; |
success = 1; |
} |
} |
if (success == 0) |
if (success == 0) |
error("channel_request_forwarding: cannot listen to port: %d", |
error("channel_setup_fwd_listener: cannot listen to port: %d", |
listen_port); |
listen_port); |
freeaddrinfo(aitop); |
freeaddrinfo(aitop); |
return success; |
return success; |
} |
} |
|
|
|
/* protocol local port fwd, used by ssh (and sshd in v1) */ |
|
int |
|
channel_setup_local_fwd_listener(u_short listen_port, |
|
const char *host_to_connect, u_short port_to_connect, int gateway_ports) |
|
{ |
|
return channel_setup_fwd_listener(SSH_CHANNEL_PORT_LISTENER, |
|
NULL, listen_port, host_to_connect, port_to_connect, gateway_ports); |
|
} |
|
|
|
/* protocol v2 remote port fwd, used by sshd */ |
|
int |
|
channel_setup_remote_fwd_listener(const char *listen_address, |
|
u_short listen_port, int gateway_ports) |
|
{ |
|
return channel_setup_fwd_listener(SSH_CHANNEL_RPORT_LISTENER, |
|
listen_address, listen_port, NULL, 0, gateway_ports); |
|
} |
|
|
/* |
/* |
* Initiate forwarding of connections to port "port" on remote host through |
* Initiate forwarding of connections to port "port" on remote host through |
* the secure channel to host:port from local side. |
* the secure channel to host:port from local side. |
|
|
channel_request_remote_forwarding(u_short listen_port, |
channel_request_remote_forwarding(u_short listen_port, |
const char *host_to_connect, u_short port_to_connect) |
const char *host_to_connect, u_short port_to_connect) |
{ |
{ |
int payload_len, type, success = 0; |
int type, success = 0; |
|
|
/* Record locally that connection to this host/port is permitted. */ |
/* Record locally that connection to this host/port is permitted. */ |
if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) |
if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) |
|
|
packet_write_wait(); |
packet_write_wait(); |
|
|
/* Wait for response from the remote side. */ |
/* Wait for response from the remote side. */ |
type = packet_read(&payload_len); |
type = packet_read(); |
switch (type) { |
switch (type) { |
case SSH_SMSG_SUCCESS: |
case SSH_SMSG_SUCCESS: |
success = 1; |
success = 1; |
|
|
packet_disconnect("Requested forwarding of port %d but user is not root.", |
packet_disconnect("Requested forwarding of port %d but user is not root.", |
port); |
port); |
/* Initiate forwarding */ |
/* Initiate forwarding */ |
channel_request_local_forwarding(port, hostname, host_port, gateway_ports); |
channel_setup_local_fwd_listener(port, hostname, host_port, gateway_ports); |
|
|
/* Free the argument string. */ |
/* Free the argument string. */ |
xfree(hostname); |
xfree(hostname); |
|
|
* anyway, and the server has no way to know but to trust the client anyway. |
* anyway, and the server has no way to know but to trust the client anyway. |
*/ |
*/ |
void |
void |
channel_permit_all_opens() |
channel_permit_all_opens(void) |
{ |
{ |
if (num_permitted_opens == 0) |
if (num_permitted_opens == 0) |
all_opens_permitted = 1; |
all_opens_permitted = 1; |
|
|
|
|
|
|
/* return socket to remote host, port */ |
/* return socket to remote host, port */ |
int |
static int |
connect_to(const char *host, u_short port) |
connect_to(const char *host, u_short port) |
{ |
{ |
struct addrinfo hints, *ai, *aitop; |
struct addrinfo hints, *ai, *aitop; |
|
|
return -1; |
return -1; |
} |
} |
/* success */ |
/* success */ |
|
set_nodelay(sock); |
return sock; |
return sock; |
} |
} |
|
|
int |
int |
channel_connect_by_listen_adress(u_short listen_port) |
channel_connect_by_listen_address(u_short listen_port) |
{ |
{ |
int i; |
int i; |
|
|
|
|
return connect_to(host, port); |
return connect_to(host, port); |
} |
} |
|
|
/* |
/* -- X11 forwarding */ |
* This is called after receiving PORT_OPEN message. This attempts to |
|
* connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION |
|
* or CHANNEL_OPEN_FAILURE. |
|
*/ |
|
|
|
void |
|
channel_input_port_open(int type, int plen, void *ctxt) |
|
{ |
|
u_short host_port; |
|
char *host, *originator_string; |
|
int remote_channel, sock = -1, newch; |
|
|
|
remote_channel = packet_get_int(); |
|
host = packet_get_string(NULL); |
|
host_port = packet_get_int(); |
|
|
|
if (have_hostname_in_open) { |
|
originator_string = packet_get_string(NULL); |
|
} else { |
|
originator_string = xstrdup("unknown (remote did not supply name)"); |
|
} |
|
packet_done(); |
|
sock = channel_connect_to(host, host_port); |
|
if (sock != -1) { |
|
newch = channel_allocate(SSH_CHANNEL_CONNECTING, |
|
sock, originator_string); |
|
channels[newch].remote_id = remote_channel; |
|
|
|
/*XXX delay answer? */ |
|
packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); |
|
packet_put_int(remote_channel); |
|
packet_put_int(newch); |
|
packet_send(); |
|
} else { |
|
packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); |
|
packet_put_int(remote_channel); |
|
packet_send(); |
|
} |
|
xfree(host); |
|
} |
|
|
|
/* |
/* |
* Creates an internet domain socket for listening for X11 connections. |
* Creates an internet domain socket for listening for X11 connections. |
* Returns a suitable value for the DISPLAY variable, or NULL if an error |
* Returns a suitable display number for the DISPLAY variable, or -1 if |
* occurs. |
* an error occurs. |
*/ |
*/ |
|
int |
#define NUM_SOCKS 10 |
x11_create_display_inet(int x11_display_offset, int x11_use_localhost, |
|
int single_connection) |
char * |
|
x11_create_display_inet(int screen_number, int x11_display_offset) |
|
{ |
{ |
|
Channel *nc = NULL; |
int display_number, sock; |
int display_number, sock; |
u_short port; |
u_short port; |
struct addrinfo hints, *ai, *aitop; |
struct addrinfo hints, *ai, *aitop; |
char strport[NI_MAXSERV]; |
char strport[NI_MAXSERV]; |
int gaierr, n, num_socks = 0, socks[NUM_SOCKS]; |
int gaierr, n, num_socks = 0, socks[NUM_SOCKS]; |
char display[512]; |
|
char hostname[MAXHOSTNAMELEN]; |
|
|
|
for (display_number = x11_display_offset; |
for (display_number = x11_display_offset; |
display_number < MAX_DISPLAYS; |
display_number < MAX_DISPLAYS; |
display_number++) { |
display_number++) { |
port = 6000 + display_number; |
port = 6000 + display_number; |
memset(&hints, 0, sizeof(hints)); |
memset(&hints, 0, sizeof(hints)); |
hints.ai_family = IPv4or6; |
hints.ai_family = IPv4or6; |
hints.ai_flags = AI_PASSIVE; /* XXX loopback only ? */ |
hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE; |
hints.ai_socktype = SOCK_STREAM; |
hints.ai_socktype = SOCK_STREAM; |
snprintf(strport, sizeof strport, "%d", port); |
snprintf(strport, sizeof strport, "%d", port); |
if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) { |
if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) { |
error("getaddrinfo: %.100s", gai_strerror(gaierr)); |
error("getaddrinfo: %.100s", gai_strerror(gaierr)); |
return NULL; |
return -1; |
} |
} |
for (ai = aitop; ai; ai = ai->ai_next) { |
for (ai = aitop; ai; ai = ai->ai_next) { |
if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) |
if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) |
|
|
sock = socket(ai->ai_family, SOCK_STREAM, 0); |
sock = socket(ai->ai_family, SOCK_STREAM, 0); |
if (sock < 0) { |
if (sock < 0) { |
error("socket: %.100s", strerror(errno)); |
error("socket: %.100s", strerror(errno)); |
return NULL; |
return -1; |
} |
} |
if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { |
if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { |
debug("bind port %d: %.100s", port, strerror(errno)); |
debug("bind port %d: %.100s", port, strerror(errno)); |
shutdown(sock, SHUT_RDWR); |
|
close(sock); |
close(sock); |
for (n = 0; n < num_socks; n++) { |
for (n = 0; n < num_socks; n++) { |
shutdown(socks[n], SHUT_RDWR); |
|
close(socks[n]); |
close(socks[n]); |
} |
} |
num_socks = 0; |
num_socks = 0; |
|
|
} |
} |
if (display_number >= MAX_DISPLAYS) { |
if (display_number >= MAX_DISPLAYS) { |
error("Failed to allocate internet-domain X11 display socket."); |
error("Failed to allocate internet-domain X11 display socket."); |
return NULL; |
return -1; |
} |
} |
/* Start listening for connections on the socket. */ |
/* Start listening for connections on the socket. */ |
for (n = 0; n < num_socks; n++) { |
for (n = 0; n < num_socks; n++) { |
sock = socks[n]; |
sock = socks[n]; |
if (listen(sock, 5) < 0) { |
if (listen(sock, 5) < 0) { |
error("listen: %.100s", strerror(errno)); |
error("listen: %.100s", strerror(errno)); |
shutdown(sock, SHUT_RDWR); |
|
close(sock); |
close(sock); |
return NULL; |
return -1; |
} |
} |
} |
} |
|
|
/* Set up a suitable value for the DISPLAY variable. */ |
|
if (gethostname(hostname, sizeof(hostname)) < 0) |
|
fatal("gethostname: %.100s", strerror(errno)); |
|
snprintf(display, sizeof display, "%.400s:%d.%d", hostname, |
|
display_number, screen_number); |
|
|
|
/* Allocate a channel for each socket. */ |
/* Allocate a channel for each socket. */ |
for (n = 0; n < num_socks; n++) { |
for (n = 0; n < num_socks; n++) { |
sock = socks[n]; |
sock = socks[n]; |
(void) channel_new("x11 listener", |
nc = channel_new("x11 listener", |
SSH_CHANNEL_X11_LISTENER, sock, sock, -1, |
SSH_CHANNEL_X11_LISTENER, sock, sock, -1, |
CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, |
CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, |
0, xstrdup("X11 inet listener"), 1); |
0, xstrdup("X11 inet listener"), 1); |
|
nc->single_connection = single_connection; |
} |
} |
|
|
/* Return a suitable value for the DISPLAY environment variable. */ |
/* Return the display number for the DISPLAY environment variable. */ |
return xstrdup(display); |
return display_number; |
} |
} |
|
|
#ifndef X_UNIX_PATH |
static int |
#define X_UNIX_PATH "/tmp/.X11-unix/X" |
|
#endif |
|
|
|
static |
|
int |
|
connect_local_xsocket(u_int dnr) |
connect_local_xsocket(u_int dnr) |
{ |
{ |
static const char *const x_sockets[] = { |
|
X_UNIX_PATH "%u", |
|
"/var/X/.X11-unix/X" "%u", |
|
"/usr/spool/sockets/X11/" "%u", |
|
NULL |
|
}; |
|
int sock; |
int sock; |
struct sockaddr_un addr; |
struct sockaddr_un addr; |
const char *const * path; |
|
|
|
for (path = x_sockets; *path; ++path) { |
sock = socket(AF_UNIX, SOCK_STREAM, 0); |
sock = socket(AF_UNIX, SOCK_STREAM, 0); |
if (sock < 0) |
if (sock < 0) |
error("socket: %.100s", strerror(errno)); |
error("socket: %.100s", strerror(errno)); |
memset(&addr, 0, sizeof(addr)); |
memset(&addr, 0, sizeof(addr)); |
addr.sun_family = AF_UNIX; |
addr.sun_family = AF_UNIX; |
snprintf(addr.sun_path, sizeof addr.sun_path, _PATH_UNIX_X, dnr); |
snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr); |
if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0) |
if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0) |
return sock; |
return sock; |
close(sock); |
close(sock); |
|
} |
|
error("connect %.100s: %.100s", addr.sun_path, strerror(errno)); |
error("connect %.100s: %.100s", addr.sun_path, strerror(errno)); |
return -1; |
return -1; |
} |
} |
|
|
/* Connect to the unix domain socket. */ |
/* Connect to the unix domain socket. */ |
if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) { |
if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) { |
error("Could not parse display number from DISPLAY: %.100s", |
error("Could not parse display number from DISPLAY: %.100s", |
display); |
display); |
return -1; |
return -1; |
} |
} |
/* Create a socket. */ |
/* Create a socket. */ |
|
|
* Connect to an inet socket. The DISPLAY value is supposedly |
* Connect to an inet socket. The DISPLAY value is supposedly |
* hostname:d[.s], where hostname may also be numeric IP address. |
* hostname:d[.s], where hostname may also be numeric IP address. |
*/ |
*/ |
strncpy(buf, display, sizeof(buf)); |
strlcpy(buf, display, sizeof(buf)); |
buf[sizeof(buf) - 1] = 0; |
|
cp = strchr(buf, ':'); |
cp = strchr(buf, ':'); |
if (!cp) { |
if (!cp) { |
error("Could not find ':' in DISPLAY: %.100s", display); |
error("Could not find ':' in DISPLAY: %.100s", display); |
|
|
/* buf now contains the host name. But first we parse the display number. */ |
/* buf now contains the host name. But first we parse the display number. */ |
if (sscanf(cp + 1, "%d", &display_number) != 1) { |
if (sscanf(cp + 1, "%d", &display_number) != 1) { |
error("Could not parse display number from DISPLAY: %.100s", |
error("Could not parse display number from DISPLAY: %.100s", |
display); |
display); |
return -1; |
return -1; |
} |
} |
|
|
|
|
strerror(errno)); |
strerror(errno)); |
return -1; |
return -1; |
} |
} |
|
set_nodelay(sock); |
return sock; |
return sock; |
} |
} |
|
|
|
|
*/ |
*/ |
|
|
void |
void |
x11_input_open(int type, int plen, void *ctxt) |
x11_input_open(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int remote_channel, sock = 0, newch; |
Channel *c = NULL; |
|
int remote_id, sock = 0; |
char *remote_host; |
char *remote_host; |
u_int remote_len; |
|
|
|
/* Get remote channel number. */ |
debug("Received X11 open request."); |
remote_channel = packet_get_int(); |
|
|
|
/* Get remote originator name. */ |
remote_id = packet_get_int(); |
if (have_hostname_in_open) { |
|
remote_host = packet_get_string(&remote_len); |
if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) { |
remote_len += 4; |
remote_host = packet_get_string(NULL); |
} else { |
} else { |
remote_host = xstrdup("unknown (remote did not supply name)"); |
remote_host = xstrdup("unknown (remote did not supply name)"); |
remote_len = 0; |
|
} |
} |
|
packet_check_eom(); |
|
|
debug("Received X11 open request."); |
|
packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN); |
|
|
|
/* Obtain a connection to the real X display. */ |
/* Obtain a connection to the real X display. */ |
sock = x11_connect_display(); |
sock = x11_connect_display(); |
if (sock == -1) { |
if (sock != -1) { |
|
/* Allocate a channel for this connection. */ |
|
c = channel_new("connected x11 socket", |
|
SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0, |
|
remote_host, 1); |
|
c->remote_id = remote_id; |
|
c->force_drain = 1; |
|
} |
|
if (c == NULL) { |
/* Send refusal to the remote host. */ |
/* Send refusal to the remote host. */ |
packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); |
packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); |
packet_put_int(remote_channel); |
packet_put_int(remote_id); |
packet_send(); |
|
} else { |
} else { |
/* Allocate a channel for this connection. */ |
|
newch = channel_allocate( |
|
(x11_saved_proto == NULL) ? |
|
SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN, |
|
sock, remote_host); |
|
channels[newch].remote_id = remote_channel; |
|
|
|
/* Send a confirmation to the remote host. */ |
/* Send a confirmation to the remote host. */ |
packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); |
packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); |
packet_put_int(remote_channel); |
packet_put_int(remote_id); |
packet_put_int(newch); |
packet_put_int(c->self); |
packet_send(); |
|
} |
} |
|
packet_send(); |
} |
} |
|
|
/* dummy protocol handler that denies SSH-1 requests (agent/x11) */ |
/* dummy protocol handler that denies SSH-1 requests (agent/x11) */ |
void |
void |
deny_input_open(int type, int plen, void *ctxt) |
deny_input_open(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int rchan = packet_get_int(); |
int rchan = packet_get_int(); |
switch(type){ |
switch (type) { |
case SSH_SMSG_AGENT_OPEN: |
case SSH_SMSG_AGENT_OPEN: |
error("Warning: ssh server tried agent forwarding."); |
error("Warning: ssh server tried agent forwarding."); |
break; |
break; |
|
|
error("Warning: ssh server tried X11 forwarding."); |
error("Warning: ssh server tried X11 forwarding."); |
break; |
break; |
default: |
default: |
error("deny_input_open: type %d plen %d", type, plen); |
error("deny_input_open: type %d", type); |
break; |
break; |
} |
} |
error("Warning: this is probably a break in attempt by a malicious server."); |
error("Warning: this is probably a break in attempt by a malicious server."); |
|
|
/* |
/* |
* Requests forwarding of X11 connections, generates fake authentication |
* Requests forwarding of X11 connections, generates fake authentication |
* data, and enables authentication spoofing. |
* data, and enables authentication spoofing. |
|
* This should be called in the client only. |
*/ |
*/ |
|
|
void |
void |
x11_request_forwarding_with_spoofing(int client_session_id, |
x11_request_forwarding_with_spoofing(int client_session_id, |
const char *proto, const char *data) |
const char *proto, const char *data) |
|
|
xfree(new_data); |
xfree(new_data); |
} |
} |
|
|
|
|
|
/* -- agent forwarding */ |
|
|
/* Sends a message to the server to request authentication fd forwarding. */ |
/* Sends a message to the server to request authentication fd forwarding. */ |
|
|
void |
void |
auth_request_forwarding() |
auth_request_forwarding(void) |
{ |
{ |
packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING); |
packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING); |
packet_send(); |
packet_send(); |
|
|
*/ |
*/ |
|
|
char * |
char * |
auth_get_socket_name() |
auth_get_socket_name(void) |
{ |
{ |
return channel_forwarded_auth_socket_name; |
return auth_sock_name; |
} |
} |
|
|
/* removes the agent forwarding socket */ |
/* removes the agent forwarding socket */ |
|
|
void |
void |
cleanup_socket(void) |
auth_sock_cleanup_proc(void *_pw) |
{ |
{ |
unlink(channel_forwarded_auth_socket_name); |
struct passwd *pw = _pw; |
rmdir(channel_forwarded_auth_socket_dir); |
|
|
if (auth_sock_name) { |
|
temporarily_use_uid(pw); |
|
unlink(auth_sock_name); |
|
rmdir(auth_sock_dir); |
|
auth_sock_name = NULL; |
|
restore_uid(); |
|
} |
} |
} |
|
|
/* |
/* |
|
|
int |
int |
auth_input_request_forwarding(struct passwd * pw) |
auth_input_request_forwarding(struct passwd * pw) |
{ |
{ |
int sock, newch; |
Channel *nc; |
|
int sock; |
struct sockaddr_un sunaddr; |
struct sockaddr_un sunaddr; |
|
|
if (auth_get_socket_name() != NULL) |
if (auth_get_socket_name() != NULL) { |
fatal("Protocol error: authentication forwarding requested twice."); |
error("authentication forwarding requested twice."); |
|
return 0; |
|
} |
|
|
/* Temporarily drop privileged uid for mkdir/bind. */ |
/* Temporarily drop privileged uid for mkdir/bind. */ |
temporarily_use_uid(pw); |
temporarily_use_uid(pw); |
|
|
/* Allocate a buffer for the socket name, and format the name. */ |
/* Allocate a buffer for the socket name, and format the name. */ |
channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME); |
auth_sock_name = xmalloc(MAXPATHLEN); |
channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME); |
auth_sock_dir = xmalloc(MAXPATHLEN); |
strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME); |
strlcpy(auth_sock_dir, "/tmp/ssh-XXXXXXXX", MAXPATHLEN); |
|
|
/* Create private directory for socket */ |
/* Create private directory for socket */ |
if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) { |
if (mkdtemp(auth_sock_dir) == NULL) { |
packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s", |
packet_send_debug("Agent forwarding disabled: " |
strerror(errno)); |
"mkdtemp() failed: %.100s", strerror(errno)); |
restore_uid(); |
restore_uid(); |
xfree(channel_forwarded_auth_socket_name); |
xfree(auth_sock_name); |
xfree(channel_forwarded_auth_socket_dir); |
xfree(auth_sock_dir); |
channel_forwarded_auth_socket_name = NULL; |
auth_sock_name = NULL; |
channel_forwarded_auth_socket_dir = NULL; |
auth_sock_dir = NULL; |
return 0; |
return 0; |
} |
} |
snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d", |
snprintf(auth_sock_name, MAXPATHLEN, "%s/agent.%d", |
channel_forwarded_auth_socket_dir, (int) getpid()); |
auth_sock_dir, (int) getpid()); |
|
|
if (atexit(cleanup_socket) < 0) { |
/* delete agent socket on fatal() */ |
int saved = errno; |
fatal_add_cleanup(auth_sock_cleanup_proc, pw); |
cleanup_socket(); |
|
packet_disconnect("socket: %.100s", strerror(saved)); |
|
} |
|
/* Create the socket. */ |
/* Create the socket. */ |
sock = socket(AF_UNIX, SOCK_STREAM, 0); |
sock = socket(AF_UNIX, SOCK_STREAM, 0); |
if (sock < 0) |
if (sock < 0) |
|
|
/* Bind it to the name. */ |
/* Bind it to the name. */ |
memset(&sunaddr, 0, sizeof(sunaddr)); |
memset(&sunaddr, 0, sizeof(sunaddr)); |
sunaddr.sun_family = AF_UNIX; |
sunaddr.sun_family = AF_UNIX; |
strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name, |
strlcpy(sunaddr.sun_path, auth_sock_name, sizeof(sunaddr.sun_path)); |
sizeof(sunaddr.sun_path)); |
|
|
|
if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0) |
if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0) |
packet_disconnect("bind: %.100s", strerror(errno)); |
packet_disconnect("bind: %.100s", strerror(errno)); |
|
|
packet_disconnect("listen: %.100s", strerror(errno)); |
packet_disconnect("listen: %.100s", strerror(errno)); |
|
|
/* Allocate a channel for the authentication agent socket. */ |
/* Allocate a channel for the authentication agent socket. */ |
newch = channel_new("auth socket", |
nc = channel_new("auth socket", |
SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1, |
SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1, |
CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, |
CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, |
0, xstrdup("auth socket"), 1); |
0, xstrdup("auth socket"), 1); |
|
strlcpy(nc->path, auth_sock_name, sizeof(nc->path)); |
strlcpy(channels[newch].path, channel_forwarded_auth_socket_name, |
|
sizeof(channels[newch].path)); |
|
return 1; |
return 1; |
} |
} |
|
|
/* This is called to process an SSH_SMSG_AGENT_OPEN message. */ |
/* This is called to process an SSH_SMSG_AGENT_OPEN message. */ |
|
|
void |
void |
auth_input_open_request(int type, int plen, void *ctxt) |
auth_input_open_request(int type, u_int32_t seq, void *ctxt) |
{ |
{ |
int remch, sock, newch; |
Channel *c = NULL; |
char *dummyname; |
int remote_id, sock; |
|
char *name; |
|
|
packet_integrity_check(plen, 4, type); |
|
|
|
/* Read the remote channel number from the message. */ |
/* Read the remote channel number from the message. */ |
remch = packet_get_int(); |
remote_id = packet_get_int(); |
|
packet_check_eom(); |
|
|
/* |
/* |
* Get a connection to the local authentication agent (this may again |
* Get a connection to the local authentication agent (this may again |
|
|
* because authentication forwarding is only enabled if we have an |
* because authentication forwarding is only enabled if we have an |
* agent. |
* agent. |
*/ |
*/ |
if (sock < 0) { |
if (sock >= 0) { |
packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); |
name = xstrdup("authentication agent connection"); |
packet_put_int(remch); |
c = channel_new("", SSH_CHANNEL_OPEN, sock, sock, |
packet_send(); |
-1, 0, 0, 0, name, 1); |
return; |
c->remote_id = remote_id; |
|
c->force_drain = 1; |
} |
} |
debug("Forwarding authentication connection."); |
|
|
|
/* |
|
* Dummy host name. This will be freed when the channel is freed; it |
|
* will still be valid in the packet_put_string below since the |
|
* channel cannot yet be freed at that point. |
|
*/ |
|
dummyname = xstrdup("authentication agent connection"); |
|
|
|
newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname); |
|
channels[newch].remote_id = remch; |
|
|
|
/* Send a confirmation to the remote host. */ |
|
packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); |
|
packet_put_int(remch); |
|
packet_put_int(newch); |
|
packet_send(); |
|
} |
|
|
|
void |
|
channel_start_open(int id) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
if (c == NULL) { |
log("channel_open: %d: bad id", id); |
packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); |
return; |
packet_put_int(remote_id); |
|
} else { |
|
/* Send a confirmation to the remote host. */ |
|
debug("Forwarding authentication connection."); |
|
packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); |
|
packet_put_int(remote_id); |
|
packet_put_int(c->self); |
} |
} |
debug("send channel open %d", id); |
|
packet_start(SSH2_MSG_CHANNEL_OPEN); |
|
packet_put_cstring(c->ctype); |
|
packet_put_int(c->self); |
|
packet_put_int(c->local_window); |
|
packet_put_int(c->local_maxpacket); |
|
} |
|
void |
|
channel_open(int id) |
|
{ |
|
/* XXX REMOVE ME */ |
|
channel_start_open(id); |
|
packet_send(); |
|
} |
|
void |
|
channel_request(int id, char *service, int wantconfirm) |
|
{ |
|
channel_request_start(id, service, wantconfirm); |
|
packet_send(); |
|
debug("channel request %d: %s", id, service) ; |
|
} |
|
void |
|
channel_request_start(int id, char *service, int wantconfirm) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
|
log("channel_request: %d: bad id", id); |
|
return; |
|
} |
|
packet_start(SSH2_MSG_CHANNEL_REQUEST); |
|
packet_put_int(c->remote_id); |
|
packet_put_cstring(service); |
|
packet_put_char(wantconfirm); |
|
} |
|
void |
|
channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
|
log("channel_register_callback: %d: bad id", id); |
|
return; |
|
} |
|
c->cb_event = mtype; |
|
c->cb_fn = fn; |
|
c->cb_arg = arg; |
|
} |
|
void |
|
channel_register_cleanup(int id, channel_callback_fn *fn) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
|
log("channel_register_cleanup: %d: bad id", id); |
|
return; |
|
} |
|
c->dettach_user = fn; |
|
} |
|
void |
|
channel_cancel_cleanup(int id) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
|
log("channel_cancel_cleanup: %d: bad id", id); |
|
return; |
|
} |
|
c->dettach_user = NULL; |
|
} |
|
void |
|
channel_register_filter(int id, channel_filter_fn *fn) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL) { |
|
log("channel_register_filter: %d: bad id", id); |
|
return; |
|
} |
|
c->input_filter = fn; |
|
} |
|
|
|
void |
|
channel_set_fds(int id, int rfd, int wfd, int efd, |
|
int extusage, int nonblock) |
|
{ |
|
Channel *c = channel_lookup(id); |
|
if (c == NULL || c->type != SSH_CHANNEL_LARVAL) |
|
fatal("channel_activate for non-larval channel %d.", id); |
|
channel_register_fds(c, rfd, wfd, efd, extusage, nonblock); |
|
c->type = SSH_CHANNEL_OPEN; |
|
/* XXX window size? */ |
|
c->local_window = c->local_window_max = c->local_maxpacket * 2; |
|
packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); |
|
packet_put_int(c->remote_id); |
|
packet_put_int(c->local_window); |
|
packet_send(); |
packet_send(); |
} |
} |