version 1.72, 2000/10/27 07:48:22 |
version 1.72.2.5, 2001/06/12 22:47:33 |
|
|
#include "includes.h" |
#include "includes.h" |
RCSID("$OpenBSD$"); |
RCSID("$OpenBSD$"); |
|
|
|
#include <openssl/rsa.h> |
|
#include <openssl/dsa.h> |
|
|
#include "ssh.h" |
#include "ssh.h" |
|
#include "ssh1.h" |
|
#include "ssh2.h" |
#include "packet.h" |
#include "packet.h" |
#include "xmalloc.h" |
#include "xmalloc.h" |
#include "buffer.h" |
#include "buffer.h" |
|
#include "bufaux.h" |
#include "uidswap.h" |
#include "uidswap.h" |
#include "readconf.h" |
#include "log.h" |
#include "servconf.h" |
#include "misc.h" |
|
|
#include "channels.h" |
#include "channels.h" |
#include "nchan.h" |
#include "nchan.h" |
#include "compat.h" |
#include "compat.h" |
|
#include "canohost.h" |
#include "ssh2.h" |
|
|
|
#include <openssl/rsa.h> |
|
#include <openssl/dsa.h> |
|
#include "key.h" |
#include "key.h" |
#include "authfd.h" |
#include "authfd.h" |
|
|
|
|
* Maximum file descriptor value used in any of the channels. This is |
* Maximum file descriptor value used in any of the channels. This is |
* updated in channel_allocate. |
* updated in channel_allocate. |
*/ |
*/ |
static int channel_max_fd_value = 0; |
static int channel_max_fd = 0; |
|
|
/* Name and directory of socket for authentication agent forwarding. */ |
/* Name and directory of socket for authentication agent forwarding. */ |
static char *channel_forwarded_auth_socket_name = NULL; |
static char *channel_forwarded_auth_socket_name = NULL; |
|
|
|
|
/* Saved X11 authentication data. This is the real data. */ |
/* Saved X11 authentication data. This is the real data. */ |
char *x11_saved_data = NULL; |
char *x11_saved_data = NULL; |
unsigned int x11_saved_data_len = 0; |
u_int x11_saved_data_len = 0; |
|
|
/* |
/* |
* Fake X11 authentication data. This is what the server will be sending us; |
* Fake X11 authentication data. This is what the server will be sending us; |
* we should replace any occurrences of this by the real data. |
* we should replace any occurrences of this by the real data. |
*/ |
*/ |
char *x11_fake_data = NULL; |
char *x11_fake_data = NULL; |
unsigned int x11_fake_data_len; |
u_int x11_fake_data_len; |
|
|
/* |
/* |
* Data structure for storing which hosts are permitted for forward requests. |
* Data structure for storing which hosts are permitted for forward requests. |
|
|
/* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */ |
/* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */ |
static int have_hostname_in_open = 0; |
static int have_hostname_in_open = 0; |
|
|
|
/* AF_UNSPEC or AF_INET or AF_INET6 */ |
|
extern int IPv4or6; |
|
|
|
void port_open_helper(Channel *c, char *rtype); |
|
|
/* Sets specific protocol options. */ |
/* Sets specific protocol options. */ |
|
|
void |
void |
|
|
have_hostname_in_open = hostname_in_open; |
have_hostname_in_open = hostname_in_open; |
} |
} |
|
|
/* |
|
* Permits opening to any host/port in SSH_MSG_PORT_OPEN. This is usually |
|
* called by the server, because the user could connect to any port anyway, |
|
* and the server has no way to know but to trust the client anyway. |
|
*/ |
|
|
|
void |
|
channel_permit_all_opens() |
|
{ |
|
all_opens_permitted = 1; |
|
} |
|
|
|
/* lookup channel by id */ |
/* lookup channel by id */ |
|
|
Channel * |
Channel * |
|
|
int extusage, int nonblock) |
int extusage, int nonblock) |
{ |
{ |
/* Update the maximum file descriptor value. */ |
/* Update the maximum file descriptor value. */ |
if (rfd > channel_max_fd_value) |
channel_max_fd = MAX(channel_max_fd, rfd); |
channel_max_fd_value = rfd; |
channel_max_fd = MAX(channel_max_fd, wfd); |
if (wfd > channel_max_fd_value) |
channel_max_fd = MAX(channel_max_fd, efd); |
channel_max_fd_value = wfd; |
|
if (efd > channel_max_fd_value) |
|
channel_max_fd_value = efd; |
|
/* XXX set close-on-exec -markus */ |
/* XXX set close-on-exec -markus */ |
|
|
c->rfd = rfd; |
c->rfd = rfd; |
|
|
c->efd = efd; |
c->efd = efd; |
c->extended_usage = extusage; |
c->extended_usage = extusage; |
|
|
|
/* XXX ugly hack: nonblock is only set by the server */ |
|
if (nonblock && isatty(c->rfd)) { |
|
debug("channel %d: rfd %d isatty", c->self, c->rfd); |
|
c->isatty = 1; |
|
if (!isatty(c->wfd)) { |
|
error("channel %d: wfd %d is not a tty?", |
|
c->self, c->wfd); |
|
} |
|
} else { |
|
c->isatty = 0; |
|
} |
|
|
/* enable nonblocking mode */ |
/* enable nonblocking mode */ |
if (nonblock) { |
if (nonblock) { |
if (rfd != -1) |
if (rfd != -1) |
|
|
channel_free(int id) |
channel_free(int id) |
{ |
{ |
Channel *c = channel_lookup(id); |
Channel *c = channel_lookup(id); |
|
char *s = channel_open_message(); |
|
|
if (c == NULL) |
if (c == NULL) |
packet_disconnect("channel free: bad local channel %d", id); |
packet_disconnect("channel free: bad local channel %d", id); |
debug("channel_free: channel %d: status: %s", id, channel_open_message()); |
debug("channel_free: channel %d: status: %s", id, s); |
|
xfree(s); |
|
|
if (c->dettach_user != NULL) { |
if (c->dettach_user != NULL) { |
debug("channel_free: channel %d: dettaching channel user", id); |
debug("channel_free: channel %d: dettaching channel user", id); |
c->dettach_user(c->self, NULL); |
c->dettach_user(c->self, NULL); |
|
|
} |
} |
|
|
void |
void |
|
channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset) |
|
{ |
|
debug3("channel %d: waiting for connection", c->self); |
|
FD_SET(c->sock, writeset); |
|
} |
|
|
|
void |
channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset) |
channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
if (buffer_len(&c->input) < packet_get_maxsize()) |
if (buffer_len(&c->input) < packet_get_maxsize()) |
|
|
packet_put_int(c->remote_id); |
packet_put_int(c->remote_id); |
packet_send(); |
packet_send(); |
c->type = SSH_CHANNEL_CLOSED; |
c->type = SSH_CHANNEL_CLOSED; |
debug("Closing channel %d after input drain.", c->self); |
debug("channel %d: closing after input drain.", c->self); |
} |
} |
} |
} |
|
|
|
|
int |
int |
x11_open_helper(Channel *c) |
x11_open_helper(Channel *c) |
{ |
{ |
unsigned char *ucp; |
u_char *ucp; |
unsigned int proto_len, data_len; |
u_int proto_len, data_len; |
|
|
/* Check if the fixed size part of the packet is in buffer. */ |
/* Check if the fixed size part of the packet is in buffer. */ |
if (buffer_len(&c->output) < 12) |
if (buffer_len(&c->output) < 12) |
return 0; |
return 0; |
|
|
/* Parse the lengths of variable-length fields. */ |
/* Parse the lengths of variable-length fields. */ |
ucp = (unsigned char *) buffer_ptr(&c->output); |
ucp = (u_char *) buffer_ptr(&c->output); |
if (ucp[0] == 0x42) { /* Byte order MSB first. */ |
if (ucp[0] == 0x42) { /* Byte order MSB first. */ |
proto_len = 256 * ucp[6] + ucp[7]; |
proto_len = 256 * ucp[6] + ucp[7]; |
data_len = 256 * ucp[8] + ucp[9]; |
data_len = 256 * ucp[8] + ucp[9]; |
|
|
* We have received an X11 connection that has bad |
* We have received an X11 connection that has bad |
* authentication information. |
* authentication information. |
*/ |
*/ |
log("X11 connection rejected because of wrong authentication.\r\n"); |
log("X11 connection rejected because of wrong authentication."); |
buffer_clear(&c->input); |
buffer_clear(&c->input); |
buffer_clear(&c->output); |
buffer_clear(&c->output); |
close(c->sock); |
close(c->sock); |
|
|
} |
} |
} |
} |
|
|
|
/* try to decode a socks4 header */ |
|
int |
|
channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset) |
|
{ |
|
u_char *p, *host; |
|
int len, have, i, found; |
|
char username[256]; |
|
struct { |
|
u_int8_t version; |
|
u_int8_t command; |
|
u_int16_t dest_port; |
|
struct in_addr dest_addr; |
|
} s4_req, s4_rsp; |
|
|
|
debug2("channel %d: decode socks4", c->self); |
|
|
|
have = buffer_len(&c->input); |
|
len = sizeof(s4_req); |
|
if (have < len) |
|
return 0; |
|
p = buffer_ptr(&c->input); |
|
for (found = 0, i = len; i < have; i++) { |
|
if (p[i] == '\0') { |
|
found = 1; |
|
break; |
|
} |
|
if (i > 1024) { |
|
/* the peer is probably sending garbage */ |
|
debug("channel %d: decode socks4: too long", |
|
c->self); |
|
return -1; |
|
} |
|
} |
|
if (!found) |
|
return 0; |
|
buffer_get(&c->input, (char *)&s4_req.version, 1); |
|
buffer_get(&c->input, (char *)&s4_req.command, 1); |
|
buffer_get(&c->input, (char *)&s4_req.dest_port, 2); |
|
buffer_get(&c->input, (char *)&s4_req.dest_addr, 4); |
|
have = buffer_len(&c->input); |
|
p = buffer_ptr(&c->input); |
|
len = strlen(p); |
|
debug2("channel %d: decode socks4: user %s/%d", c->self, p, len); |
|
if (len > have) |
|
fatal("channel %d: decode socks4: len %d > have %d", |
|
c->self, len, have); |
|
strlcpy(username, p, sizeof(username)); |
|
buffer_consume(&c->input, len); |
|
buffer_consume(&c->input, 1); /* trailing '\0' */ |
|
|
|
host = inet_ntoa(s4_req.dest_addr); |
|
strlcpy(c->path, host, sizeof(c->path)); |
|
c->host_port = ntohs(s4_req.dest_port); |
|
|
|
debug("channel %d: dynamic request: socks4 host %s port %u command %u", |
|
c->self, host, c->host_port, s4_req.command); |
|
|
|
if (s4_req.command != 1) { |
|
debug("channel %d: cannot handle: socks4 cn %d", |
|
c->self, s4_req.command); |
|
return -1; |
|
} |
|
s4_rsp.version = 0; /* vn: 0 for reply */ |
|
s4_rsp.command = 90; /* cd: req granted */ |
|
s4_rsp.dest_port = 0; /* ignored */ |
|
s4_rsp.dest_addr.s_addr = INADDR_ANY; /* ignored */ |
|
buffer_append(&c->output, (char *)&s4_rsp, sizeof(s4_rsp)); |
|
return 1; |
|
} |
|
|
|
/* dynamic port forwarding */ |
|
void |
|
channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset) |
|
{ |
|
u_char *p; |
|
int have, ret; |
|
|
|
have = buffer_len(&c->input); |
|
|
|
debug2("channel %d: pre_dynamic: have %d", c->self, have); |
|
/* buffer_dump(&c->input); */ |
|
/* check if the fixed size part of the packet is in buffer. */ |
|
if (have < 4) { |
|
/* need more */ |
|
FD_SET(c->sock, readset); |
|
return; |
|
} |
|
/* try to guess the protocol */ |
|
p = buffer_ptr(&c->input); |
|
switch (p[0]) { |
|
case 0x04: |
|
ret = channel_decode_socks4(c, readset, writeset); |
|
break; |
|
default: |
|
ret = -1; |
|
break; |
|
} |
|
if (ret < 0) { |
|
channel_free(c->self); |
|
} else if (ret == 0) { |
|
debug2("channel %d: pre_dynamic: need more", c->self); |
|
/* need more */ |
|
FD_SET(c->sock, readset); |
|
} else { |
|
/* switch to the next state */ |
|
c->type = SSH_CHANNEL_OPENING; |
|
port_open_helper(c, "direct-tcpip"); |
|
} |
|
} |
|
|
/* This is our fake X11 server socket. */ |
/* This is our fake X11 server socket. */ |
void |
void |
channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset) |
channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset) |
|
|
struct sockaddr addr; |
struct sockaddr addr; |
int newsock, newch; |
int newsock, newch; |
socklen_t addrlen; |
socklen_t addrlen; |
char buf[16384], *remote_hostname; |
char buf[16384], *remote_ipaddr; |
int remote_port; |
int remote_port; |
|
|
if (FD_ISSET(c->sock, readset)) { |
if (FD_ISSET(c->sock, readset)) { |
|
|
error("accept: %.100s", strerror(errno)); |
error("accept: %.100s", strerror(errno)); |
return; |
return; |
} |
} |
remote_hostname = get_remote_hostname(newsock); |
remote_ipaddr = get_peer_ipaddr(newsock); |
remote_port = get_peer_port(newsock); |
remote_port = get_peer_port(newsock); |
snprintf(buf, sizeof buf, "X11 connection from %.200s port %d", |
snprintf(buf, sizeof buf, "X11 connection from %.200s port %d", |
remote_hostname, remote_port); |
remote_ipaddr, remote_port); |
|
|
newch = channel_new("x11", |
newch = channel_new("x11", |
SSH_CHANNEL_OPENING, newsock, newsock, -1, |
SSH_CHANNEL_OPENING, newsock, newsock, -1, |
|
|
packet_put_int(newch); |
packet_put_int(newch); |
packet_put_int(c->local_window_max); |
packet_put_int(c->local_window_max); |
packet_put_int(c->local_maxpacket); |
packet_put_int(c->local_maxpacket); |
/* originator host and port */ |
/* originator ipaddr and port */ |
packet_put_cstring(remote_hostname); |
packet_put_cstring(remote_ipaddr); |
if (datafellows & SSH_BUG_X11FWD) { |
if (datafellows & SSH_BUG_X11FWD) { |
debug("ssh2 x11 bug compat mode"); |
debug("ssh2 x11 bug compat mode"); |
} else { |
} else { |
|
|
packet_put_string(buf, strlen(buf)); |
packet_put_string(buf, strlen(buf)); |
packet_send(); |
packet_send(); |
} |
} |
xfree(remote_hostname); |
xfree(remote_ipaddr); |
} |
} |
} |
} |
|
|
|
void |
|
port_open_helper(Channel *c, char *rtype) |
|
{ |
|
int direct; |
|
char buf[1024]; |
|
char *remote_ipaddr = get_peer_ipaddr(c->sock); |
|
u_short remote_port = get_peer_port(c->sock); |
|
|
|
direct = (strcmp(rtype, "direct-tcpip") == 0); |
|
|
|
snprintf(buf, sizeof buf, |
|
"%s: listening port %d for %.100s port %d, " |
|
"connect from %.200s port %d", |
|
rtype, c->listening_port, c->path, c->host_port, |
|
remote_ipaddr, remote_port); |
|
|
|
xfree(c->remote_name); |
|
c->remote_name = xstrdup(buf); |
|
|
|
if (compat20) { |
|
packet_start(SSH2_MSG_CHANNEL_OPEN); |
|
packet_put_cstring(rtype); |
|
packet_put_int(c->self); |
|
packet_put_int(c->local_window_max); |
|
packet_put_int(c->local_maxpacket); |
|
if (direct) { |
|
/* target host, port */ |
|
packet_put_cstring(c->path); |
|
packet_put_int(c->host_port); |
|
} else { |
|
/* listen address, port */ |
|
packet_put_cstring(c->path); |
|
packet_put_int(c->listening_port); |
|
} |
|
/* originator host and port */ |
|
packet_put_cstring(remote_ipaddr); |
|
packet_put_int(remote_port); |
|
packet_send(); |
|
} else { |
|
packet_start(SSH_MSG_PORT_OPEN); |
|
packet_put_int(c->self); |
|
packet_put_cstring(c->path); |
|
packet_put_int(c->host_port); |
|
if (have_hostname_in_open) |
|
packet_put_cstring(c->remote_name); |
|
packet_send(); |
|
} |
|
xfree(remote_ipaddr); |
|
} |
|
|
/* |
/* |
* This socket is listening for connections to a forwarded TCP/IP port. |
* This socket is listening for connections to a forwarded TCP/IP port. |
*/ |
*/ |
void |
void |
channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset) |
channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
|
Channel *nc; |
struct sockaddr addr; |
struct sockaddr addr; |
int newsock, newch; |
int newsock, newch, nextstate; |
socklen_t addrlen; |
socklen_t addrlen; |
char buf[1024], *remote_hostname; |
char *rtype; |
int remote_port; |
|
|
|
if (FD_ISSET(c->sock, readset)) { |
if (FD_ISSET(c->sock, readset)) { |
debug("Connection to port %d forwarding " |
debug("Connection to port %d forwarding " |
"to %.100s port %d requested.", |
"to %.100s port %d requested.", |
c->listening_port, c->path, c->host_port); |
c->listening_port, c->path, c->host_port); |
|
|
|
rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ? |
|
"forwarded-tcpip" : "direct-tcpip"; |
|
nextstate = (c->host_port == 0) ? SSH_CHANNEL_DYNAMIC : |
|
SSH_CHANNEL_OPENING; |
|
|
addrlen = sizeof(addr); |
addrlen = sizeof(addr); |
newsock = accept(c->sock, &addr, &addrlen); |
newsock = accept(c->sock, &addr, &addrlen); |
if (newsock < 0) { |
if (newsock < 0) { |
error("accept: %.100s", strerror(errno)); |
error("accept: %.100s", strerror(errno)); |
return; |
return; |
} |
} |
remote_hostname = get_remote_hostname(newsock); |
newch = channel_new(rtype, |
remote_port = get_peer_port(newsock); |
nextstate, newsock, newsock, -1, |
snprintf(buf, sizeof buf, |
|
"listen port %d for %.100s port %d, " |
|
"connect from %.200s port %d", |
|
c->listening_port, c->path, c->host_port, |
|
remote_hostname, remote_port); |
|
newch = channel_new("direct-tcpip", |
|
SSH_CHANNEL_OPENING, newsock, newsock, -1, |
|
c->local_window_max, c->local_maxpacket, |
c->local_window_max, c->local_maxpacket, |
0, xstrdup(buf), 1); |
0, xstrdup(rtype), 1); |
if (compat20) { |
|
packet_start(SSH2_MSG_CHANNEL_OPEN); |
nc = channel_lookup(newch); |
packet_put_cstring("direct-tcpip"); |
if (nc == NULL) { |
packet_put_int(newch); |
error("xxx: no new channel:"); |
packet_put_int(c->local_window_max); |
return; |
packet_put_int(c->local_maxpacket); |
|
/* target host and port */ |
|
packet_put_string(c->path, strlen(c->path)); |
|
packet_put_int(c->host_port); |
|
/* originator host and port */ |
|
packet_put_cstring(remote_hostname); |
|
packet_put_int(remote_port); |
|
packet_send(); |
|
} else { |
|
packet_start(SSH_MSG_PORT_OPEN); |
|
packet_put_int(newch); |
|
packet_put_string(c->path, strlen(c->path)); |
|
packet_put_int(c->host_port); |
|
if (have_hostname_in_open) { |
|
packet_put_string(buf, strlen(buf)); |
|
} |
|
packet_send(); |
|
} |
} |
xfree(remote_hostname); |
nc->listening_port = c->listening_port; |
|
nc->host_port = c->host_port; |
|
strlcpy(nc->path, c->path, sizeof(nc->path)); |
|
|
|
if (nextstate != SSH_CHANNEL_DYNAMIC) |
|
port_open_helper(nc, rtype); |
} |
} |
} |
} |
|
|
|
|
error("accept from auth socket: %.100s", strerror(errno)); |
error("accept from auth socket: %.100s", strerror(errno)); |
return; |
return; |
} |
} |
newch = channel_allocate(SSH_CHANNEL_OPENING, newsock, |
newch = channel_new("accepted auth socket", |
xstrdup("accepted auth socket")); |
SSH_CHANNEL_OPENING, newsock, newsock, -1, |
packet_start(SSH_SMSG_AGENT_OPEN); |
c->local_window_max, c->local_maxpacket, |
packet_put_int(newch); |
0, xstrdup("accepted auth socket"), 1); |
|
if (compat20) { |
|
packet_start(SSH2_MSG_CHANNEL_OPEN); |
|
packet_put_cstring("auth-agent@openssh.com"); |
|
packet_put_int(newch); |
|
packet_put_int(c->local_window_max); |
|
packet_put_int(c->local_maxpacket); |
|
} else { |
|
packet_start(SSH_SMSG_AGENT_OPEN); |
|
packet_put_int(newch); |
|
} |
packet_send(); |
packet_send(); |
} |
} |
} |
} |
|
|
|
void |
|
channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset) |
|
{ |
|
if (FD_ISSET(c->sock, writeset)) { |
|
int err = 0; |
|
int sz = sizeof(err); |
|
c->type = SSH_CHANNEL_OPEN; |
|
if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &sz) < 0) { |
|
debug("getsockopt SO_ERROR failed"); |
|
} else { |
|
if (err == 0) { |
|
debug("channel %d: connected)", c->self); |
|
} else { |
|
debug("channel %d: not connected: %s", |
|
c->self, strerror(err)); |
|
chan_read_failed(c); |
|
chan_write_failed(c); |
|
} |
|
} |
|
} |
|
} |
|
|
int |
int |
channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset) |
channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
|
|
if (len <= 0) { |
if (len <= 0) { |
debug("channel %d: read<=0 rfd %d len %d", |
debug("channel %d: read<=0 rfd %d len %d", |
c->self, c->rfd, len); |
c->self, c->rfd, len); |
if (compat13) { |
if (c->type != SSH_CHANNEL_OPEN) { |
|
debug("channel %d: not open", c->self); |
|
channel_free(c->self); |
|
return -1; |
|
} else if (compat13) { |
buffer_consume(&c->output, buffer_len(&c->output)); |
buffer_consume(&c->output, buffer_len(&c->output)); |
c->type = SSH_CHANNEL_INPUT_DRAINING; |
c->type = SSH_CHANNEL_INPUT_DRAINING; |
debug("Channel %d status set to input draining.", c->self); |
debug("channel %d: status set to input draining.", c->self); |
} else { |
} else { |
chan_read_failed(c); |
chan_read_failed(c); |
} |
} |
|
|
} |
} |
if(c->input_filter != NULL) { |
if(c->input_filter != NULL) { |
if (c->input_filter(c, buf, len) == -1) { |
if (c->input_filter(c, buf, len) == -1) { |
debug("filter stops channel %d", c->self); |
debug("channel %d: filter stops", c->self); |
chan_read_failed(c); |
chan_read_failed(c); |
} |
} |
} else { |
} else { |
|
|
int |
int |
channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset) |
channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset) |
{ |
{ |
|
struct termios tio; |
int len; |
int len; |
|
|
/* Send buffered output data to the socket. */ |
/* Send buffered output data to the socket. */ |
|
|
if (len < 0 && (errno == EINTR || errno == EAGAIN)) |
if (len < 0 && (errno == EINTR || errno == EAGAIN)) |
return 1; |
return 1; |
if (len <= 0) { |
if (len <= 0) { |
if (compat13) { |
if (c->type != SSH_CHANNEL_OPEN) { |
|
debug("channel %d: not open", c->self); |
|
channel_free(c->self); |
|
return -1; |
|
} else if (compat13) { |
buffer_consume(&c->output, buffer_len(&c->output)); |
buffer_consume(&c->output, buffer_len(&c->output)); |
debug("Channel %d status set to input draining.", c->self); |
debug("channel %d: status set to input draining.", c->self); |
c->type = SSH_CHANNEL_INPUT_DRAINING; |
c->type = SSH_CHANNEL_INPUT_DRAINING; |
} else { |
} else { |
chan_write_failed(c); |
chan_write_failed(c); |
} |
} |
return -1; |
return -1; |
} |
} |
|
if (compat20 && c->isatty) { |
|
if (tcgetattr(c->wfd, &tio) == 0 && |
|
!(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) { |
|
/* |
|
* Simulate echo to reduce the impact of |
|
* traffic analysis. We need to match the |
|
* size of a SSH2_MSG_CHANNEL_DATA message |
|
* (4 byte channel id + data) |
|
*/ |
|
packet_send_ignore(4 + len); |
|
packet_send(); |
|
} |
|
} |
buffer_consume(&c->output, len); |
buffer_consume(&c->output, len); |
if (compat20 && len > 0) { |
if (compat20 && len > 0) { |
c->local_consumed += len; |
c->local_consumed += len; |
|
|
buffer_len(&c->extended)); |
buffer_len(&c->extended)); |
debug2("channel %d: written %d to efd %d", |
debug2("channel %d: written %d to efd %d", |
c->self, len, c->efd); |
c->self, len, c->efd); |
if (len > 0) { |
if (len < 0 && (errno == EINTR || errno == EAGAIN)) |
|
return 1; |
|
if (len <= 0) { |
|
debug2("channel %d: closing write-efd %d", |
|
c->self, c->efd); |
|
close(c->efd); |
|
c->efd = -1; |
|
} else { |
buffer_consume(&c->extended, len); |
buffer_consume(&c->extended, len); |
c->local_consumed += len; |
c->local_consumed += len; |
} |
} |
|
|
len = read(c->efd, buf, sizeof(buf)); |
len = read(c->efd, buf, sizeof(buf)); |
debug2("channel %d: read %d from efd %d", |
debug2("channel %d: read %d from efd %d", |
c->self, len, c->efd); |
c->self, len, c->efd); |
if (len == 0) { |
if (len < 0 && (errno == EINTR || errno == EAGAIN)) |
debug("channel %d: closing efd %d", |
return 1; |
|
if (len <= 0) { |
|
debug2("channel %d: closing read-efd %d", |
c->self, c->efd); |
c->self, c->efd); |
close(c->efd); |
close(c->efd); |
c->efd = -1; |
c->efd = -1; |
} else if (len > 0) |
} else { |
buffer_append(&c->extended, buf, len); |
buffer_append(&c->extended, buf, len); |
|
} |
} |
} |
} |
} |
return 1; |
return 1; |
} |
} |
int |
int |
channel_check_window(Channel *c, fd_set * readset, fd_set * writeset) |
channel_check_window(Channel *c) |
{ |
{ |
if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) && |
if (c->type == SSH_CHANNEL_OPEN && |
|
!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) && |
c->local_window < c->local_window_max/2 && |
c->local_window < c->local_window_max/2 && |
c->local_consumed > 0) { |
c->local_consumed > 0) { |
packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); |
packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); |
|
|
channel_handle_rfd(c, readset, writeset); |
channel_handle_rfd(c, readset, writeset); |
channel_handle_wfd(c, readset, writeset); |
channel_handle_wfd(c, readset, writeset); |
channel_handle_efd(c, readset, writeset); |
channel_handle_efd(c, readset, writeset); |
channel_check_window(c, readset, writeset); |
|
|
channel_check_window(c); |
} |
} |
|
|
void |
void |
|
|
channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20; |
channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20; |
channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; |
channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; |
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; |
|
channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; |
|
channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; |
|
channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; |
|
channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; |
|
|
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2; |
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
|
channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
|
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
|
channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; |
|
channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_2; |
} |
} |
|
|
void |
void |
|
|
channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining; |
channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining; |
channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining; |
channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining; |
|
channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; |
|
channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; |
|
|
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1; |
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1; |
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13; |
channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13; |
|
channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; |
|
channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_1; |
} |
} |
|
|
void |
void |
|
|
channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; |
channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; |
|
channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; |
|
channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; |
|
|
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; |
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; |
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1; |
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1; |
|
channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; |
|
channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_1; |
} |
} |
|
|
void |
void |
|
|
if (ftab[c->type] == NULL) |
if (ftab[c->type] == NULL) |
continue; |
continue; |
(*ftab[c->type])(c, readset, writeset); |
(*ftab[c->type])(c, readset, writeset); |
chan_delete_if_full_closed(c); |
if (chan_is_dead(c)) { |
|
/* |
|
* we have to remove the fd's from the select mask |
|
* before the channels are free'd and the fd's are |
|
* closed |
|
*/ |
|
if (c->wfd != -1) |
|
FD_CLR(c->wfd, writeset); |
|
if (c->rfd != -1) |
|
FD_CLR(c->rfd, readset); |
|
if (c->efd != -1) { |
|
if (c->extended_usage == CHAN_EXTENDED_READ) |
|
FD_CLR(c->efd, readset); |
|
if (c->extended_usage == CHAN_EXTENDED_WRITE) |
|
FD_CLR(c->efd, writeset); |
|
} |
|
channel_free(c->self); |
|
} |
} |
} |
} |
} |
|
|
void |
void |
channel_prepare_select(fd_set * readset, fd_set * writeset) |
channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp, |
|
int rekeying) |
{ |
{ |
channel_handler(channel_pre, readset, writeset); |
int n; |
|
u_int sz; |
|
|
|
n = MAX(*maxfdp, channel_max_fd); |
|
|
|
sz = howmany(n+1, NFDBITS) * sizeof(fd_mask); |
|
if (*readsetp == NULL || n > *maxfdp) { |
|
if (*readsetp) |
|
xfree(*readsetp); |
|
if (*writesetp) |
|
xfree(*writesetp); |
|
*readsetp = xmalloc(sz); |
|
*writesetp = xmalloc(sz); |
|
*maxfdp = n; |
|
} |
|
memset(*readsetp, 0, sz); |
|
memset(*writesetp, 0, sz); |
|
|
|
if (!rekeying) |
|
channel_handler(channel_pre, *readsetp, *writesetp); |
} |
} |
|
|
void |
void |
|
|
channel_handler(channel_post, readset, writeset); |
channel_handler(channel_post, readset, writeset); |
} |
} |
|
|
/* If there is data to send to the connection, send some of it now. */ |
/* If there is data to send to the connection, enqueue some of it now. */ |
|
|
void |
void |
channel_output_poll() |
channel_output_poll() |
|
|
} else { |
} else { |
if (c->type != SSH_CHANNEL_OPEN) |
if (c->type != SSH_CHANNEL_OPEN) |
continue; |
continue; |
if (c->istate != CHAN_INPUT_OPEN && |
|
c->istate != CHAN_INPUT_WAIT_DRAIN) |
|
continue; |
|
} |
} |
if (compat20 && |
if (compat20 && |
(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) { |
(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) { |
debug("channel: %d: no data after CLOSE", c->self); |
/* XXX is this true? */ |
|
debug2("channel %d: no data after CLOSE", c->self); |
continue; |
continue; |
} |
} |
|
|
/* Get the amount of buffered data for this channel. */ |
/* Get the amount of buffered data for this channel. */ |
len = buffer_len(&c->input); |
if ((c->istate == CHAN_INPUT_OPEN || |
if (len > 0) { |
c->istate == CHAN_INPUT_WAIT_DRAIN) && |
|
(len = buffer_len(&c->input)) > 0) { |
/* Send some data for the other side over the secure connection. */ |
/* Send some data for the other side over the secure connection. */ |
if (compat20) { |
if (compat20) { |
if (len > c->remote_window) |
if (len > c->remote_window) |
|
|
c->remote_window > 0 && |
c->remote_window > 0 && |
(len = buffer_len(&c->extended)) > 0 && |
(len = buffer_len(&c->extended)) > 0 && |
c->extended_usage == CHAN_EXTENDED_READ) { |
c->extended_usage == CHAN_EXTENDED_READ) { |
|
debug2("channel %d: rwin %d elen %d euse %d", |
|
c->self, c->remote_window, buffer_len(&c->extended), |
|
c->extended_usage); |
if (len > c->remote_window) |
if (len > c->remote_window) |
len = c->remote_window; |
len = c->remote_window; |
if (len > c->remote_maxpacket) |
if (len > c->remote_maxpacket) |
|
|
packet_send(); |
packet_send(); |
buffer_consume(&c->extended, len); |
buffer_consume(&c->extended, len); |
c->remote_window -= len; |
c->remote_window -= len; |
|
debug2("channel %d: sent ext data %d", c->self, len); |
} |
} |
} |
} |
} |
} |
|
|
{ |
{ |
int id; |
int id; |
char *data; |
char *data; |
unsigned int data_len; |
u_int data_len; |
Channel *c; |
Channel *c; |
|
|
/* Get the channel number and verify it. */ |
/* Get the channel number and verify it. */ |
|
|
int id; |
int id; |
int tcode; |
int tcode; |
char *data; |
char *data; |
unsigned int data_len; |
u_int data_len; |
Channel *c; |
Channel *c; |
|
|
/* Get the channel number and verify it. */ |
/* Get the channel number and verify it. */ |
|
|
int |
int |
channel_not_very_much_buffered_data() |
channel_not_very_much_buffered_data() |
{ |
{ |
unsigned int i; |
u_int i; |
Channel *c; |
Channel *c; |
|
|
for (i = 0; i < channels_alloc; i++) { |
for (i = 0; i < channels_alloc; i++) { |
|
|
void |
void |
channel_input_open_failure(int type, int plen, void *ctxt) |
channel_input_open_failure(int type, int plen, void *ctxt) |
{ |
{ |
int id; |
int id, reason; |
|
char *msg = NULL, *lang = NULL; |
Channel *c; |
Channel *c; |
|
|
if (!compat20) |
if (!compat20) |
|
|
packet_disconnect("Received open failure for " |
packet_disconnect("Received open failure for " |
"non-opening channel %d.", id); |
"non-opening channel %d.", id); |
if (compat20) { |
if (compat20) { |
int reason = packet_get_int(); |
reason = packet_get_int(); |
char *msg = packet_get_string(NULL); |
if (packet_remaining() > 0) { |
char *lang = packet_get_string(NULL); |
msg = packet_get_string(NULL); |
log("channel_open_failure: %d: reason %d: %s", id, reason, msg); |
lang = packet_get_string(NULL); |
|
} |
packet_done(); |
packet_done(); |
xfree(msg); |
log("channel_open_failure: %d: reason %d %s", id, |
xfree(lang); |
reason, msg ? msg : "<no additional info>"); |
|
if (msg != NULL) |
|
xfree(msg); |
|
if (lang != NULL) |
|
xfree(lang); |
} |
} |
/* Free the channel. This will also close the socket. */ |
/* Free the channel. This will also close the socket. */ |
channel_free(id); |
channel_free(id); |
|
|
debug2("callback done"); |
debug2("callback done"); |
} else { |
} else { |
char *service = packet_get_string(NULL); |
char *service = packet_get_string(NULL); |
debug("channel: %d rcvd request for %s", c->self, service); |
debug("channel %d: rcvd request for %s", c->self, service); |
debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event); |
debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event); |
xfree(service); |
xfree(service); |
} |
} |
|
|
switch (channels[i].type) { |
switch (channels[i].type) { |
case SSH_CHANNEL_AUTH_SOCKET: |
case SSH_CHANNEL_AUTH_SOCKET: |
close(channels[i].sock); |
close(channels[i].sock); |
remove(channels[i].path); |
unlink(channels[i].path); |
channel_free(i); |
channel_free(i); |
break; |
break; |
case SSH_CHANNEL_PORT_LISTENER: |
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
case SSH_CHANNEL_X11_LISTENER: |
case SSH_CHANNEL_X11_LISTENER: |
close(channels[i].sock); |
close(channels[i].sock); |
channel_free(i); |
channel_free(i); |
|
|
channel_close_fds(&channels[i]); |
channel_close_fds(&channels[i]); |
} |
} |
|
|
/* Returns the maximum file descriptor number used by the channels. */ |
|
|
|
int |
|
channel_max_fd() |
|
{ |
|
return channel_max_fd_value; |
|
} |
|
|
|
/* Returns true if any channel is still open. */ |
/* Returns true if any channel is still open. */ |
|
|
int |
int |
channel_still_open() |
channel_still_open() |
{ |
{ |
unsigned int i; |
u_int i; |
for (i = 0; i < channels_alloc; i++) |
for (i = 0; i < channels_alloc; i++) |
switch (channels[i].type) { |
switch (channels[i].type) { |
case SSH_CHANNEL_FREE: |
case SSH_CHANNEL_FREE: |
case SSH_CHANNEL_X11_LISTENER: |
case SSH_CHANNEL_X11_LISTENER: |
case SSH_CHANNEL_PORT_LISTENER: |
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
case SSH_CHANNEL_CLOSED: |
case SSH_CHANNEL_CLOSED: |
case SSH_CHANNEL_AUTH_SOCKET: |
case SSH_CHANNEL_AUTH_SOCKET: |
|
case SSH_CHANNEL_DYNAMIC: |
|
case SSH_CHANNEL_CONNECTING: /* XXX ??? */ |
continue; |
continue; |
case SSH_CHANNEL_LARVAL: |
case SSH_CHANNEL_LARVAL: |
if (!compat20) |
if (!compat20) |
|
|
return 0; |
return 0; |
} |
} |
|
|
|
/* Returns the id of an open channel suitable for keepaliving */ |
|
|
|
int |
|
channel_find_open() |
|
{ |
|
u_int i; |
|
for (i = 0; i < channels_alloc; i++) |
|
switch (channels[i].type) { |
|
case SSH_CHANNEL_CLOSED: |
|
case SSH_CHANNEL_DYNAMIC: |
|
case SSH_CHANNEL_FREE: |
|
case SSH_CHANNEL_X11_LISTENER: |
|
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
|
case SSH_CHANNEL_OPENING: |
|
continue; |
|
case SSH_CHANNEL_LARVAL: |
|
case SSH_CHANNEL_AUTH_SOCKET: |
|
case SSH_CHANNEL_CONNECTING: /* XXX ??? */ |
|
case SSH_CHANNEL_OPEN: |
|
case SSH_CHANNEL_X11_OPEN: |
|
return i; |
|
case SSH_CHANNEL_INPUT_DRAINING: |
|
case SSH_CHANNEL_OUTPUT_DRAINING: |
|
if (!compat13) |
|
fatal("cannot happen: OUT_DRAIN"); |
|
return i; |
|
default: |
|
fatal("channel_find_open: bad channel type %d", channels[i].type); |
|
/* NOTREACHED */ |
|
} |
|
return -1; |
|
} |
|
|
|
|
/* |
/* |
* Returns a message describing the currently open forwarded connections, |
* Returns a message describing the currently open forwarded connections, |
* suitable for sending to the client. The message contains crlf pairs for |
* suitable for sending to the client. The message contains crlf pairs for |
|
|
case SSH_CHANNEL_FREE: |
case SSH_CHANNEL_FREE: |
case SSH_CHANNEL_X11_LISTENER: |
case SSH_CHANNEL_X11_LISTENER: |
case SSH_CHANNEL_PORT_LISTENER: |
case SSH_CHANNEL_PORT_LISTENER: |
|
case SSH_CHANNEL_RPORT_LISTENER: |
case SSH_CHANNEL_CLOSED: |
case SSH_CHANNEL_CLOSED: |
case SSH_CHANNEL_AUTH_SOCKET: |
case SSH_CHANNEL_AUTH_SOCKET: |
continue; |
continue; |
case SSH_CHANNEL_LARVAL: |
case SSH_CHANNEL_LARVAL: |
case SSH_CHANNEL_OPENING: |
case SSH_CHANNEL_OPENING: |
|
case SSH_CHANNEL_CONNECTING: |
|
case SSH_CHANNEL_DYNAMIC: |
case SSH_CHANNEL_OPEN: |
case SSH_CHANNEL_OPEN: |
case SSH_CHANNEL_X11_OPEN: |
case SSH_CHANNEL_X11_OPEN: |
case SSH_CHANNEL_INPUT_DRAINING: |
case SSH_CHANNEL_INPUT_DRAINING: |
|
|
* Initiate forwarding of connections to local port "port" through the secure |
* Initiate forwarding of connections to local port "port" through the secure |
* channel to host:port from remote side. |
* channel to host:port from remote side. |
*/ |
*/ |
|
int |
|
channel_request_local_forwarding(u_short listen_port, const char *host_to_connect, |
|
u_short port_to_connect, int gateway_ports) |
|
{ |
|
return channel_request_forwarding( |
|
NULL, listen_port, |
|
host_to_connect, port_to_connect, |
|
gateway_ports, /*remote_fwd*/ 0); |
|
} |
|
|
void |
/* |
channel_request_local_forwarding(u_short port, const char *host, |
* If 'remote_fwd' is true we have a '-R style' listener for protocol 2 |
u_short host_port, int gateway_ports) |
* (SSH_CHANNEL_RPORT_LISTENER). |
|
*/ |
|
int |
|
channel_request_forwarding( |
|
const char *listen_address, u_short listen_port, |
|
const char *host_to_connect, u_short port_to_connect, |
|
int gateway_ports, int remote_fwd) |
{ |
{ |
int success, ch, sock, on = 1; |
int success, ch, sock, on = 1, ctype; |
struct addrinfo hints, *ai, *aitop; |
struct addrinfo hints, *ai, *aitop; |
char ntop[NI_MAXHOST], strport[NI_MAXSERV]; |
char ntop[NI_MAXHOST], strport[NI_MAXSERV]; |
|
const char *host; |
struct linger linger; |
struct linger linger; |
|
|
if (strlen(host) > sizeof(channels[0].path) - 1) |
success = 0; |
packet_disconnect("Forward host name too long."); |
|
|
|
|
if (remote_fwd) { |
|
host = listen_address; |
|
ctype = SSH_CHANNEL_RPORT_LISTENER; |
|
} else { |
|
host = host_to_connect; |
|
ctype =SSH_CHANNEL_PORT_LISTENER; |
|
} |
|
|
|
if (strlen(host) > sizeof(channels[0].path) - 1) { |
|
error("Forward host name too long."); |
|
return success; |
|
} |
|
|
|
/* XXX listen_address is currently ignored */ |
/* |
/* |
* getaddrinfo returns a loopback address if the hostname is |
* getaddrinfo returns a loopback address if the hostname is |
* set to NULL and hints.ai_flags is not AI_PASSIVE |
* set to NULL and hints.ai_flags is not AI_PASSIVE |
|
|
hints.ai_family = IPv4or6; |
hints.ai_family = IPv4or6; |
hints.ai_flags = gateway_ports ? AI_PASSIVE : 0; |
hints.ai_flags = gateway_ports ? AI_PASSIVE : 0; |
hints.ai_socktype = SOCK_STREAM; |
hints.ai_socktype = SOCK_STREAM; |
snprintf(strport, sizeof strport, "%d", port); |
snprintf(strport, sizeof strport, "%d", listen_port); |
if (getaddrinfo(NULL, strport, &hints, &aitop) != 0) |
if (getaddrinfo(NULL, strport, &hints, &aitop) != 0) |
packet_disconnect("getaddrinfo: fatal error"); |
packet_disconnect("getaddrinfo: fatal error"); |
|
|
success = 0; |
|
for (ai = aitop; ai; ai = ai->ai_next) { |
for (ai = aitop; ai; ai = ai->ai_next) { |
if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) |
if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) |
continue; |
continue; |
if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), |
if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), |
strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { |
strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { |
error("channel_request_local_forwarding: getnameinfo failed"); |
error("channel_request_forwarding: getnameinfo failed"); |
continue; |
continue; |
} |
} |
/* Create a port to listen for the host. */ |
/* Create a port to listen for the host. */ |
|
|
continue; |
continue; |
} |
} |
/* Allocate a channel number for the socket. */ |
/* Allocate a channel number for the socket. */ |
ch = channel_new( |
ch = channel_new("port listener", ctype, sock, sock, -1, |
"port listener", SSH_CHANNEL_PORT_LISTENER, |
|
sock, sock, -1, |
|
CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, |
CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, |
0, xstrdup("port listener"), 1); |
0, xstrdup("port listener"), 1); |
strlcpy(channels[ch].path, host, sizeof(channels[ch].path)); |
strlcpy(channels[ch].path, host, sizeof(channels[ch].path)); |
channels[ch].host_port = host_port; |
channels[ch].host_port = port_to_connect; |
channels[ch].listening_port = port; |
channels[ch].listening_port = listen_port; |
success = 1; |
success = 1; |
} |
} |
if (success == 0) |
if (success == 0) |
packet_disconnect("cannot listen port: %d", port); |
error("channel_request_forwarding: cannot listen to port: %d", |
|
listen_port); |
freeaddrinfo(aitop); |
freeaddrinfo(aitop); |
|
return success; |
} |
} |
|
|
/* |
/* |
|
|
*/ |
*/ |
|
|
void |
void |
channel_request_remote_forwarding(u_short listen_port, const char *host_to_connect, |
channel_request_remote_forwarding(u_short listen_port, |
u_short port_to_connect) |
const char *host_to_connect, u_short port_to_connect) |
{ |
{ |
int payload_len; |
int payload_len, type, success = 0; |
|
|
/* Record locally that connection to this host/port is permitted. */ |
/* Record locally that connection to this host/port is permitted. */ |
if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) |
if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) |
fatal("channel_request_remote_forwarding: too many forwards"); |
fatal("channel_request_remote_forwarding: too many forwards"); |
|
|
permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect); |
|
permitted_opens[num_permitted_opens].port_to_connect = port_to_connect; |
|
permitted_opens[num_permitted_opens].listen_port = listen_port; |
|
num_permitted_opens++; |
|
|
|
/* Send the forward request to the remote side. */ |
/* Send the forward request to the remote side. */ |
if (compat20) { |
if (compat20) { |
const char *address_to_bind = "0.0.0.0"; |
const char *address_to_bind = "0.0.0.0"; |
|
|
packet_put_char(0); /* boolean: want reply */ |
packet_put_char(0); /* boolean: want reply */ |
packet_put_cstring(address_to_bind); |
packet_put_cstring(address_to_bind); |
packet_put_int(listen_port); |
packet_put_int(listen_port); |
|
packet_send(); |
|
packet_write_wait(); |
|
/* Assume that server accepts the request */ |
|
success = 1; |
} else { |
} else { |
packet_start(SSH_CMSG_PORT_FORWARD_REQUEST); |
packet_start(SSH_CMSG_PORT_FORWARD_REQUEST); |
packet_put_int(listen_port); |
packet_put_int(listen_port); |
|
|
packet_put_int(port_to_connect); |
packet_put_int(port_to_connect); |
packet_send(); |
packet_send(); |
packet_write_wait(); |
packet_write_wait(); |
/* |
|
* Wait for response from the remote side. It will send a disconnect |
/* Wait for response from the remote side. */ |
* message on failure, and we will never see it here. |
type = packet_read(&payload_len); |
*/ |
switch (type) { |
packet_read_expect(&payload_len, SSH_SMSG_SUCCESS); |
case SSH_SMSG_SUCCESS: |
|
success = 1; |
|
break; |
|
case SSH_SMSG_FAILURE: |
|
log("Warning: Server denied remote port forwarding."); |
|
break; |
|
default: |
|
/* Unknown packet */ |
|
packet_disconnect("Protocol error for port forward request:" |
|
"received packet type %d.", type); |
|
} |
} |
} |
|
if (success) { |
|
permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect); |
|
permitted_opens[num_permitted_opens].port_to_connect = port_to_connect; |
|
permitted_opens[num_permitted_opens].listen_port = listen_port; |
|
num_permitted_opens++; |
|
} |
} |
} |
|
|
/* |
/* |
|
|
if (port < IPPORT_RESERVED && !is_root) |
if (port < IPPORT_RESERVED && !is_root) |
packet_disconnect("Requested forwarding of port %d but user is not root.", |
packet_disconnect("Requested forwarding of port %d but user is not root.", |
port); |
port); |
/* |
/* Initiate forwarding */ |
* Initiate forwarding, |
|
*/ |
|
channel_request_local_forwarding(port, hostname, host_port, gateway_ports); |
channel_request_local_forwarding(port, hostname, host_port, gateway_ports); |
|
|
/* Free the argument string. */ |
/* Free the argument string. */ |
xfree(hostname); |
xfree(hostname); |
} |
} |
|
|
/* XXX move to aux.c */ |
/* |
|
* Permits opening to any host/port if permitted_opens[] is empty. This is |
|
* usually called by the server, because the user could connect to any port |
|
* anyway, and the server has no way to know but to trust the client anyway. |
|
*/ |
|
void |
|
channel_permit_all_opens() |
|
{ |
|
if (num_permitted_opens == 0) |
|
all_opens_permitted = 1; |
|
} |
|
|
|
void |
|
channel_add_permitted_opens(char *host, int port) |
|
{ |
|
if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) |
|
fatal("channel_request_remote_forwarding: too many forwards"); |
|
debug("allow port forwarding to host %s port %d", host, port); |
|
|
|
permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host); |
|
permitted_opens[num_permitted_opens].port_to_connect = port; |
|
num_permitted_opens++; |
|
|
|
all_opens_permitted = 0; |
|
} |
|
|
|
void |
|
channel_clear_permitted_opens(void) |
|
{ |
|
int i; |
|
|
|
for (i = 0; i < num_permitted_opens; i++) |
|
xfree(permitted_opens[i].host_to_connect); |
|
num_permitted_opens = 0; |
|
|
|
} |
|
|
|
|
|
/* return socket to remote host, port */ |
int |
int |
channel_connect_to(const char *host, u_short host_port) |
connect_to(const char *host, u_short port) |
{ |
{ |
struct addrinfo hints, *ai, *aitop; |
struct addrinfo hints, *ai, *aitop; |
char ntop[NI_MAXHOST], strport[NI_MAXSERV]; |
char ntop[NI_MAXHOST], strport[NI_MAXSERV]; |
|
|
memset(&hints, 0, sizeof(hints)); |
memset(&hints, 0, sizeof(hints)); |
hints.ai_family = IPv4or6; |
hints.ai_family = IPv4or6; |
hints.ai_socktype = SOCK_STREAM; |
hints.ai_socktype = SOCK_STREAM; |
snprintf(strport, sizeof strport, "%d", host_port); |
snprintf(strport, sizeof strport, "%d", port); |
if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) { |
if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) { |
error("%.100s: unknown host (%s)", host, gai_strerror(gaierr)); |
error("connect_to %.100s: unknown host (%s)", host, |
|
gai_strerror(gaierr)); |
return -1; |
return -1; |
} |
} |
for (ai = aitop; ai; ai = ai->ai_next) { |
for (ai = aitop; ai; ai = ai->ai_next) { |
|
|
continue; |
continue; |
if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), |
if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), |
strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { |
strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { |
error("channel_connect_to: getnameinfo failed"); |
error("connect_to: getnameinfo failed"); |
continue; |
continue; |
} |
} |
/* Create the socket. */ |
|
sock = socket(ai->ai_family, SOCK_STREAM, 0); |
sock = socket(ai->ai_family, SOCK_STREAM, 0); |
if (sock < 0) { |
if (sock < 0) { |
error("socket: %.100s", strerror(errno)); |
error("socket: %.100s", strerror(errno)); |
continue; |
continue; |
} |
} |
/* Connect to the host/port. */ |
if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0) |
if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) { |
fatal("connect_to: F_SETFL: %s", strerror(errno)); |
error("connect %.100s port %s: %.100s", ntop, strport, |
if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 && |
|
errno != EINPROGRESS) { |
|
error("connect_to %.100s port %s: %.100s", ntop, strport, |
strerror(errno)); |
strerror(errno)); |
close(sock); |
close(sock); |
continue; /* fail -- try next */ |
continue; /* fail -- try next */ |
} |
} |
break; /* success */ |
break; /* success */ |
|
|
} |
} |
freeaddrinfo(aitop); |
freeaddrinfo(aitop); |
if (!ai) { |
if (!ai) { |
error("connect %.100s port %d: failed.", host, host_port); |
error("connect_to %.100s port %d: failed.", host, port); |
return -1; |
return -1; |
} |
} |
/* success */ |
/* success */ |
return sock; |
return sock; |
} |
} |
|
|
|
int |
|
channel_connect_by_listen_adress(u_short listen_port) |
|
{ |
|
int i; |
|
|
|
for (i = 0; i < num_permitted_opens; i++) |
|
if (permitted_opens[i].listen_port == listen_port) |
|
return connect_to( |
|
permitted_opens[i].host_to_connect, |
|
permitted_opens[i].port_to_connect); |
|
error("WARNING: Server requests forwarding for unknown listen_port %d", |
|
listen_port); |
|
return -1; |
|
} |
|
|
|
/* Check if connecting to that port is permitted and connect. */ |
|
int |
|
channel_connect_to(const char *host, u_short port) |
|
{ |
|
int i, permit; |
|
|
|
permit = all_opens_permitted; |
|
if (!permit) { |
|
for (i = 0; i < num_permitted_opens; i++) |
|
if (permitted_opens[i].port_to_connect == port && |
|
strcmp(permitted_opens[i].host_to_connect, host) == 0) |
|
permit = 1; |
|
|
|
} |
|
if (!permit) { |
|
log("Received request to connect to host %.100s port %d, " |
|
"but the request was denied.", host, port); |
|
return -1; |
|
} |
|
return connect_to(host, port); |
|
} |
|
|
/* |
/* |
* This is called after receiving PORT_OPEN message. This attempts to |
* This is called after receiving PORT_OPEN message. This attempts to |
* connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION |
* connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION |
|
|
{ |
{ |
u_short host_port; |
u_short host_port; |
char *host, *originator_string; |
char *host, *originator_string; |
int remote_channel, sock = -1, newch, i, denied; |
int remote_channel, sock = -1, newch; |
unsigned int host_len, originator_len; |
|
|
|
/* Get remote channel number. */ |
|
remote_channel = packet_get_int(); |
remote_channel = packet_get_int(); |
|
host = packet_get_string(NULL); |
/* Get host name to connect to. */ |
|
host = packet_get_string(&host_len); |
|
|
|
/* Get port to connect to. */ |
|
host_port = packet_get_int(); |
host_port = packet_get_int(); |
|
|
/* Get remote originator name. */ |
|
if (have_hostname_in_open) { |
if (have_hostname_in_open) { |
originator_string = packet_get_string(&originator_len); |
originator_string = packet_get_string(NULL); |
originator_len += 4; /* size of packet_int */ |
|
} else { |
} else { |
originator_string = xstrdup("unknown (remote did not supply name)"); |
originator_string = xstrdup("unknown (remote did not supply name)"); |
originator_len = 0; /* no originator supplied */ |
|
} |
} |
|
packet_done(); |
packet_integrity_check(plen, |
sock = channel_connect_to(host, host_port); |
4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN); |
if (sock != -1) { |
|
newch = channel_allocate(SSH_CHANNEL_CONNECTING, |
/* Check if opening that port is permitted. */ |
sock, originator_string); |
denied = 0; |
|
if (!all_opens_permitted) { |
|
/* Go trough all permitted ports. */ |
|
for (i = 0; i < num_permitted_opens; i++) |
|
if (permitted_opens[i].port_to_connect == host_port && |
|
strcmp(permitted_opens[i].host_to_connect, host) == 0) |
|
break; |
|
|
|
/* Check if we found the requested port among those permitted. */ |
|
if (i >= num_permitted_opens) { |
|
/* The port is not permitted. */ |
|
log("Received request to connect to %.100s:%d, but the request was denied.", |
|
host, host_port); |
|
denied = 1; |
|
} |
|
} |
|
sock = denied ? -1 : channel_connect_to(host, host_port); |
|
if (sock > 0) { |
|
/* Allocate a channel for this connection. */ |
|
newch = channel_allocate(SSH_CHANNEL_OPEN, sock, originator_string); |
|
channels[newch].remote_id = remote_channel; |
channels[newch].remote_id = remote_channel; |
|
|
|
/*XXX delay answer? */ |
packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); |
packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); |
packet_put_int(remote_channel); |
packet_put_int(remote_channel); |
packet_put_int(newch); |
packet_put_int(newch); |
|
|
if (num_socks == NUM_SOCKS) |
if (num_socks == NUM_SOCKS) |
break; |
break; |
} |
} |
|
freeaddrinfo(aitop); |
if (num_socks > 0) |
if (num_socks > 0) |
break; |
break; |
} |
} |
|
|
|
|
static |
static |
int |
int |
connect_local_xsocket(unsigned int dnr) |
connect_local_xsocket(u_int dnr) |
{ |
{ |
static const char *const x_sockets[] = { |
static const char *const x_sockets[] = { |
X_UNIX_PATH "%u", |
X_UNIX_PATH "%u", |
|
|
{ |
{ |
int remote_channel, sock = 0, newch; |
int remote_channel, sock = 0, newch; |
char *remote_host; |
char *remote_host; |
unsigned int remote_len; |
u_int remote_len; |
|
|
/* Get remote channel number. */ |
/* Get remote channel number. */ |
remote_channel = packet_get_int(); |
remote_channel = packet_get_int(); |
|
|
x11_request_forwarding_with_spoofing(int client_session_id, |
x11_request_forwarding_with_spoofing(int client_session_id, |
const char *proto, const char *data) |
const char *proto, const char *data) |
{ |
{ |
unsigned int data_len = (unsigned int) strlen(data) / 2; |
u_int data_len = (u_int) strlen(data) / 2; |
unsigned int i, value; |
u_int i, value, len; |
char *new_data; |
char *new_data; |
int screen_number; |
int screen_number; |
const char *cp; |
const char *cp; |
|
|
x11_fake_data_len = data_len; |
x11_fake_data_len = data_len; |
|
|
/* Convert the fake data into hex. */ |
/* Convert the fake data into hex. */ |
new_data = xmalloc(2 * data_len + 1); |
len = 2 * data_len + 1; |
|
new_data = xmalloc(len); |
for (i = 0; i < data_len; i++) |
for (i = 0; i < data_len; i++) |
sprintf(new_data + 2 * i, "%02x", (unsigned char) x11_fake_data[i]); |
snprintf(new_data + 2 * i, len - 2 * i, |
|
"%02x", (u_char) x11_fake_data[i]); |
|
|
/* Send the request packet. */ |
/* Send the request packet. */ |
if (compat20) { |
if (compat20) { |
|
|
/* removes the agent forwarding socket */ |
/* removes the agent forwarding socket */ |
|
|
void |
void |
cleanup_socket(void) |
auth_sock_cleanup_proc(void *_pw) |
{ |
{ |
remove(channel_forwarded_auth_socket_name); |
struct passwd *pw = _pw; |
rmdir(channel_forwarded_auth_socket_dir); |
|
|
if (channel_forwarded_auth_socket_name) { |
|
temporarily_use_uid(pw); |
|
unlink(channel_forwarded_auth_socket_name); |
|
rmdir(channel_forwarded_auth_socket_dir); |
|
channel_forwarded_auth_socket_name = NULL; |
|
restore_uid(); |
|
} |
} |
} |
|
|
/* |
/* |
|
|
fatal("Protocol error: authentication forwarding requested twice."); |
fatal("Protocol error: authentication forwarding requested twice."); |
|
|
/* Temporarily drop privileged uid for mkdir/bind. */ |
/* Temporarily drop privileged uid for mkdir/bind. */ |
temporarily_use_uid(pw->pw_uid); |
temporarily_use_uid(pw); |
|
|
/* Allocate a buffer for the socket name, and format the name. */ |
/* Allocate a buffer for the socket name, and format the name. */ |
channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME); |
channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME); |
|
|
snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d", |
snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d", |
channel_forwarded_auth_socket_dir, (int) getpid()); |
channel_forwarded_auth_socket_dir, (int) getpid()); |
|
|
if (atexit(cleanup_socket) < 0) { |
/* delete agent socket on fatal() */ |
int saved = errno; |
fatal_add_cleanup(auth_sock_cleanup_proc, pw); |
cleanup_socket(); |
|
packet_disconnect("socket: %.100s", strerror(saved)); |
|
} |
|
/* Create the socket. */ |
/* Create the socket. */ |
sock = socket(AF_UNIX, SOCK_STREAM, 0); |
sock = socket(AF_UNIX, SOCK_STREAM, 0); |
if (sock < 0) |
if (sock < 0) |
|
|
packet_disconnect("listen: %.100s", strerror(errno)); |
packet_disconnect("listen: %.100s", strerror(errno)); |
|
|
/* Allocate a channel for the authentication agent socket. */ |
/* Allocate a channel for the authentication agent socket. */ |
newch = channel_allocate(SSH_CHANNEL_AUTH_SOCKET, sock, |
newch = channel_new("auth socket", |
xstrdup("auth socket")); |
SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1, |
|
CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, |
|
0, xstrdup("auth socket"), 1); |
|
|
strlcpy(channels[newch].path, channel_forwarded_auth_socket_name, |
strlcpy(channels[newch].path, channel_forwarded_auth_socket_name, |
sizeof(channels[newch].path)); |
sizeof(channels[newch].path)); |
return 1; |
return 1; |
|
|
} |
} |
c->dettach_user = NULL; |
c->dettach_user = NULL; |
} |
} |
void |
void |
channel_register_filter(int id, channel_filter_fn *fn) |
channel_register_filter(int id, channel_filter_fn *fn) |
{ |
{ |
Channel *c = channel_lookup(id); |
Channel *c = channel_lookup(id); |