Annotation of src/usr.bin/ssh/channels.c, Revision 1.128
1.1 deraadt 1: /*
1.26 deraadt 2: * Author: Tatu Ylonen <ylo@cs.hut.fi>
3: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: * All rights reserved
5: * This file contains functions for generic socket connection forwarding.
6: * There is also code for initiating connection forwarding for X11 connections,
7: * arbitrary tcp/ip connections, and the authentication agent connection.
1.49 markus 8: *
1.67 deraadt 9: * As far as I am concerned, the code I have written for this software
10: * can be used freely for any purpose. Any derived versions of this
11: * software must be clearly marked as such, and if the derived work is
12: * incompatible with the protocol description in the RFC file, it must be
13: * called by a name other than "ssh" or "Secure Shell".
14: *
1.44 markus 15: * SSH2 support added by Markus Friedl.
1.128 ! markus 16: * Copyright (c) 1999, 2000, 2001 Markus Friedl. All rights reserved.
1.67 deraadt 17: * Copyright (c) 1999 Dug Song. All rights reserved.
18: * Copyright (c) 1999 Theo de Raadt. All rights reserved.
19: *
20: * Redistribution and use in source and binary forms, with or without
21: * modification, are permitted provided that the following conditions
22: * are met:
23: * 1. Redistributions of source code must retain the above copyright
24: * notice, this list of conditions and the following disclaimer.
25: * 2. Redistributions in binary form must reproduce the above copyright
26: * notice, this list of conditions and the following disclaimer in the
27: * documentation and/or other materials provided with the distribution.
28: *
29: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
30: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
31: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
32: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
33: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
34: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
35: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
36: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
37: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
38: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.26 deraadt 39: */
1.1 deraadt 40:
41: #include "includes.h"
1.128 ! markus 42: RCSID("$OpenBSD: channels.c,v 1.127 2001/06/23 15:12:17 itojun Exp $");
1.1 deraadt 43:
44: #include "ssh.h"
1.82 markus 45: #include "ssh1.h"
46: #include "ssh2.h"
1.1 deraadt 47: #include "packet.h"
48: #include "xmalloc.h"
49: #include "uidswap.h"
1.82 markus 50: #include "log.h"
51: #include "misc.h"
1.14 markus 52: #include "channels.h"
53: #include "compat.h"
1.82 markus 54: #include "canohost.h"
1.64 markus 55: #include "key.h"
56: #include "authfd.h"
1.44 markus 57:
1.1 deraadt 58:
1.121 markus 59: /* -- channel core */
1.12 markus 60:
1.27 markus 61: /*
62: * Pointer to an array containing all allocated channels. The array is
63: * dynamically extended as needed.
64: */
1.113 markus 65: static Channel **channels = NULL;
1.1 deraadt 66:
1.27 markus 67: /*
68: * Size of the channel array. All slots of the array must always be
1.113 markus 69: * initialized (at least the type field); unused slots set to NULL
1.27 markus 70: */
1.1 deraadt 71: static int channels_alloc = 0;
72:
1.27 markus 73: /*
74: * Maximum file descriptor value used in any of the channels. This is
1.113 markus 75: * updated in channel_new.
1.27 markus 76: */
1.84 markus 77: static int channel_max_fd = 0;
1.1 deraadt 78:
79:
1.121 markus 80: /* -- tcp forwarding */
1.1 deraadt 81:
1.27 markus 82: /*
83: * Data structure for storing which hosts are permitted for forward requests.
84: * The local sides of any remote forwards are stored in this array to prevent
85: * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
86: * network (which might be behind a firewall).
87: */
1.25 markus 88: typedef struct {
1.41 markus 89: char *host_to_connect; /* Connect to 'host'. */
90: u_short port_to_connect; /* Connect to 'port'. */
91: u_short listen_port; /* Remote side should listen port number. */
1.1 deraadt 92: } ForwardPermission;
93:
94: /* List of all permitted host/port pairs to connect. */
95: static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
1.121 markus 96:
1.1 deraadt 97: /* Number of permitted host/port pairs in the array. */
98: static int num_permitted_opens = 0;
1.27 markus 99: /*
100: * If this is true, all opens are permitted. This is the case on the server
101: * on which we have to trust the client anyway, and the user could do
102: * anything after logging in anyway.
103: */
1.1 deraadt 104: static int all_opens_permitted = 0;
105:
1.121 markus 106:
107: /* -- X11 forwarding */
108:
109: /* Maximum number of fake X11 displays to try. */
110: #define MAX_DISPLAYS 1000
111:
112: /* Saved X11 authentication protocol name. */
113: static char *x11_saved_proto = NULL;
114:
115: /* Saved X11 authentication data. This is the real data. */
116: static char *x11_saved_data = NULL;
117: static u_int x11_saved_data_len = 0;
118:
119: /*
120: * Fake X11 authentication data. This is what the server will be sending us;
121: * we should replace any occurrences of this by the real data.
122: */
123: static char *x11_fake_data = NULL;
124: static u_int x11_fake_data_len;
125:
126:
127: /* -- agent forwarding */
128:
129: #define NUM_SOCKS 10
130:
131: /* Name and directory of socket for authentication agent forwarding. */
132: static char *auth_sock_name = NULL;
133: static char *auth_sock_dir = NULL;
134:
1.82 markus 135: /* AF_UNSPEC or AF_INET or AF_INET6 */
136: extern int IPv4or6;
1.1 deraadt 137:
1.121 markus 138: /* helper */
1.127 itojun 139: static void port_open_helper(Channel *c, char *rtype);
1.103 markus 140:
1.121 markus 141: /* -- channel core */
1.41 markus 142:
143: Channel *
144: channel_lookup(int id)
145: {
146: Channel *c;
1.113 markus 147:
1.63 provos 148: if (id < 0 || id > channels_alloc) {
1.41 markus 149: log("channel_lookup: %d: bad id", id);
150: return NULL;
151: }
1.113 markus 152: c = channels[id];
153: if (c == NULL) {
1.41 markus 154: log("channel_lookup: %d: bad id: channel free", id);
155: return NULL;
156: }
157: return c;
1.55 markus 158: }
159:
1.27 markus 160: /*
1.55 markus 161: * Register filedescriptors for a channel, used when allocating a channel or
1.52 markus 162: * when the channel consumer/producer is ready, e.g. shell exec'd
1.27 markus 163: */
1.1 deraadt 164:
1.127 itojun 165: static void
1.71 markus 166: channel_register_fds(Channel *c, int rfd, int wfd, int efd,
167: int extusage, int nonblock)
1.1 deraadt 168: {
1.25 markus 169: /* Update the maximum file descriptor value. */
1.84 markus 170: channel_max_fd = MAX(channel_max_fd, rfd);
171: channel_max_fd = MAX(channel_max_fd, wfd);
172: channel_max_fd = MAX(channel_max_fd, efd);
173:
1.27 markus 174: /* XXX set close-on-exec -markus */
1.55 markus 175:
1.52 markus 176: c->rfd = rfd;
177: c->wfd = wfd;
178: c->sock = (rfd == wfd) ? rfd : -1;
179: c->efd = efd;
180: c->extended_usage = extusage;
1.71 markus 181:
1.91 markus 182: /* XXX ugly hack: nonblock is only set by the server */
183: if (nonblock && isatty(c->rfd)) {
1.94 markus 184: debug("channel %d: rfd %d isatty", c->self, c->rfd);
1.91 markus 185: c->isatty = 1;
186: if (!isatty(c->wfd)) {
1.94 markus 187: error("channel %d: wfd %d is not a tty?",
1.91 markus 188: c->self, c->wfd);
189: }
190: } else {
191: c->isatty = 0;
192: }
193:
1.71 markus 194: /* enable nonblocking mode */
195: if (nonblock) {
196: if (rfd != -1)
197: set_nonblock(rfd);
198: if (wfd != -1)
199: set_nonblock(wfd);
200: if (efd != -1)
201: set_nonblock(efd);
202: }
1.52 markus 203: }
204:
205: /*
206: * Allocate a new channel object and set its type and socket. This will cause
207: * remote_name to be freed.
208: */
209:
1.113 markus 210: Channel *
1.52 markus 211: channel_new(char *ctype, int type, int rfd, int wfd, int efd,
1.71 markus 212: int window, int maxpack, int extusage, char *remote_name, int nonblock)
1.52 markus 213: {
214: int i, found;
215: Channel *c;
1.25 markus 216:
217: /* Do initial allocation if this is the first call. */
218: if (channels_alloc == 0) {
1.44 markus 219: chan_init();
1.25 markus 220: channels_alloc = 10;
1.113 markus 221: channels = xmalloc(channels_alloc * sizeof(Channel *));
1.25 markus 222: for (i = 0; i < channels_alloc; i++)
1.113 markus 223: channels[i] = NULL;
1.126 markus 224: fatal_add_cleanup((void (*) (void *)) channel_free_all, NULL);
1.25 markus 225: }
226: /* Try to find a free slot where to put the new channel. */
227: for (found = -1, i = 0; i < channels_alloc; i++)
1.113 markus 228: if (channels[i] == NULL) {
1.25 markus 229: /* Found a free slot. */
230: found = i;
231: break;
232: }
233: if (found == -1) {
1.27 markus 234: /* There are no free slots. Take last+1 slot and expand the array. */
1.25 markus 235: found = channels_alloc;
236: channels_alloc += 10;
1.70 markus 237: debug2("channel: expanding %d", channels_alloc);
1.113 markus 238: channels = xrealloc(channels, channels_alloc * sizeof(Channel *));
1.25 markus 239: for (i = found; i < channels_alloc; i++)
1.113 markus 240: channels[i] = NULL;
1.25 markus 241: }
1.113 markus 242: /* Initialize and return new channel. */
243: c = channels[found] = xmalloc(sizeof(Channel));
1.25 markus 244: buffer_init(&c->input);
245: buffer_init(&c->output);
1.41 markus 246: buffer_init(&c->extended);
1.25 markus 247: chan_init_iostates(c);
1.71 markus 248: channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
1.25 markus 249: c->self = found;
250: c->type = type;
1.41 markus 251: c->ctype = ctype;
1.51 markus 252: c->local_window = window;
253: c->local_window_max = window;
254: c->local_consumed = 0;
255: c->local_maxpacket = maxpack;
1.25 markus 256: c->remote_id = -1;
257: c->remote_name = remote_name;
1.41 markus 258: c->remote_window = 0;
259: c->remote_maxpacket = 0;
260: c->cb_fn = NULL;
261: c->cb_arg = NULL;
262: c->cb_event = 0;
263: c->dettach_user = NULL;
1.65 markus 264: c->input_filter = NULL;
1.25 markus 265: debug("channel %d: new [%s]", found, remote_name);
1.113 markus 266: return c;
1.1 deraadt 267: }
1.52 markus 268:
269: /* Close all channel fd/socket. */
270:
1.127 itojun 271: static void
1.52 markus 272: channel_close_fds(Channel *c)
273: {
1.118 markus 274: debug3("channel_close_fds: channel %d: r %d w %d e %d",
275: c->self, c->rfd, c->wfd, c->efd);
276:
1.52 markus 277: if (c->sock != -1) {
278: close(c->sock);
279: c->sock = -1;
280: }
281: if (c->rfd != -1) {
282: close(c->rfd);
1.121 markus 283: c->rfd = -1;
284: }
285: if (c->wfd != -1) {
286: close(c->wfd);
287: c->wfd = -1;
288: }
289: if (c->efd != -1) {
290: close(c->efd);
291: c->efd = -1;
292: }
293: }
294:
295: /* Free the channel and close its fd/socket. */
296:
297: void
298: channel_free(Channel *c)
299: {
300: char *s;
301: int i, n;
302:
303: for (n = 0, i = 0; i < channels_alloc; i++)
304: if (channels[i])
305: n++;
306: debug("channel_free: channel %d: %s, nchannels %d", c->self,
307: c->remote_name ? c->remote_name : "???", n);
308:
309: s = channel_open_message();
310: debug3("channel_free: status: %s", s);
311: xfree(s);
312:
313: if (c->dettach_user != NULL) {
314: debug("channel_free: channel %d: dettaching channel user", c->self);
315: c->dettach_user(c->self, NULL);
316: }
317: if (c->sock != -1)
318: shutdown(c->sock, SHUT_RDWR);
319: channel_close_fds(c);
320: buffer_free(&c->input);
321: buffer_free(&c->output);
322: buffer_free(&c->extended);
323: if (c->remote_name) {
324: xfree(c->remote_name);
325: c->remote_name = NULL;
326: }
327: channels[c->self] = NULL;
328: xfree(c);
329: }
330:
331: void
1.126 markus 332: channel_free_all(void)
1.121 markus 333: {
334: int i;
335:
1.126 markus 336: for (i = 0; i < channels_alloc; i++)
337: if (channels[i] != NULL)
338: channel_free(channels[i]);
1.121 markus 339: }
340:
341: /*
342: * Closes the sockets/fds of all channels. This is used to close extra file
343: * descriptors after a fork.
344: */
345:
346: void
347: channel_close_all()
348: {
349: int i;
350:
351: for (i = 0; i < channels_alloc; i++)
352: if (channels[i] != NULL)
353: channel_close_fds(channels[i]);
354: }
355:
356: /*
357: * Returns true if no channel has too much buffered data, and false if one or
358: * more channel is overfull.
359: */
360:
361: int
362: channel_not_very_much_buffered_data()
363: {
364: u_int i;
365: Channel *c;
366:
367: for (i = 0; i < channels_alloc; i++) {
368: c = channels[i];
369: if (c != NULL && c->type == SSH_CHANNEL_OPEN) {
370: if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
371: debug("channel %d: big input buffer %d",
372: c->self, buffer_len(&c->input));
373: return 0;
374: }
375: if (buffer_len(&c->output) > packet_get_maxsize()) {
376: debug("channel %d: big output buffer %d",
377: c->self, buffer_len(&c->output));
378: return 0;
379: }
380: }
381: }
382: return 1;
383: }
384:
385: /* Returns true if any channel is still open. */
386:
387: int
388: channel_still_open()
389: {
390: int i;
391: Channel *c;
392:
393: for (i = 0; i < channels_alloc; i++) {
394: c = channels[i];
395: if (c == NULL)
396: continue;
397: switch (c->type) {
398: case SSH_CHANNEL_X11_LISTENER:
399: case SSH_CHANNEL_PORT_LISTENER:
400: case SSH_CHANNEL_RPORT_LISTENER:
401: case SSH_CHANNEL_CLOSED:
402: case SSH_CHANNEL_AUTH_SOCKET:
403: case SSH_CHANNEL_DYNAMIC:
404: case SSH_CHANNEL_CONNECTING:
405: case SSH_CHANNEL_ZOMBIE:
406: continue;
407: case SSH_CHANNEL_LARVAL:
408: if (!compat20)
409: fatal("cannot happen: SSH_CHANNEL_LARVAL");
410: continue;
411: case SSH_CHANNEL_OPENING:
412: case SSH_CHANNEL_OPEN:
413: case SSH_CHANNEL_X11_OPEN:
414: return 1;
415: case SSH_CHANNEL_INPUT_DRAINING:
416: case SSH_CHANNEL_OUTPUT_DRAINING:
417: if (!compat13)
418: fatal("cannot happen: OUT_DRAIN");
419: return 1;
420: default:
421: fatal("channel_still_open: bad channel type %d", c->type);
422: /* NOTREACHED */
423: }
424: }
425: return 0;
426: }
427:
428: /* Returns the id of an open channel suitable for keepaliving */
429:
430: int
431: channel_find_open()
432: {
433: int i;
434: Channel *c;
435:
436: for (i = 0; i < channels_alloc; i++) {
437: c = channels[i];
438: if (c == NULL)
439: continue;
440: switch (c->type) {
441: case SSH_CHANNEL_CLOSED:
442: case SSH_CHANNEL_DYNAMIC:
443: case SSH_CHANNEL_X11_LISTENER:
444: case SSH_CHANNEL_PORT_LISTENER:
445: case SSH_CHANNEL_RPORT_LISTENER:
446: case SSH_CHANNEL_OPENING:
447: case SSH_CHANNEL_CONNECTING:
448: case SSH_CHANNEL_ZOMBIE:
449: continue;
450: case SSH_CHANNEL_LARVAL:
451: case SSH_CHANNEL_AUTH_SOCKET:
452: case SSH_CHANNEL_OPEN:
453: case SSH_CHANNEL_X11_OPEN:
454: return i;
455: case SSH_CHANNEL_INPUT_DRAINING:
456: case SSH_CHANNEL_OUTPUT_DRAINING:
457: if (!compat13)
458: fatal("cannot happen: OUT_DRAIN");
459: return i;
460: default:
461: fatal("channel_find_open: bad channel type %d", c->type);
462: /* NOTREACHED */
463: }
464: }
465: return -1;
466: }
467:
468:
469: /*
470: * Returns a message describing the currently open forwarded connections,
471: * suitable for sending to the client. The message contains crlf pairs for
472: * newlines.
473: */
474:
475: char *
476: channel_open_message()
477: {
478: Buffer buffer;
479: Channel *c;
480: char buf[1024], *cp;
481: int i;
482:
483: buffer_init(&buffer);
484: snprintf(buf, sizeof buf, "The following connections are open:\r\n");
485: buffer_append(&buffer, buf, strlen(buf));
486: for (i = 0; i < channels_alloc; i++) {
487: c = channels[i];
488: if (c == NULL)
489: continue;
490: switch (c->type) {
491: case SSH_CHANNEL_X11_LISTENER:
492: case SSH_CHANNEL_PORT_LISTENER:
493: case SSH_CHANNEL_RPORT_LISTENER:
494: case SSH_CHANNEL_CLOSED:
495: case SSH_CHANNEL_AUTH_SOCKET:
496: case SSH_CHANNEL_ZOMBIE:
497: continue;
498: case SSH_CHANNEL_LARVAL:
499: case SSH_CHANNEL_OPENING:
500: case SSH_CHANNEL_CONNECTING:
501: case SSH_CHANNEL_DYNAMIC:
502: case SSH_CHANNEL_OPEN:
503: case SSH_CHANNEL_X11_OPEN:
504: case SSH_CHANNEL_INPUT_DRAINING:
505: case SSH_CHANNEL_OUTPUT_DRAINING:
506: snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
507: c->self, c->remote_name,
508: c->type, c->remote_id,
509: c->istate, buffer_len(&c->input),
510: c->ostate, buffer_len(&c->output),
511: c->rfd, c->wfd);
512: buffer_append(&buffer, buf, strlen(buf));
513: continue;
514: default:
515: fatal("channel_open_message: bad channel type %d", c->type);
516: /* NOTREACHED */
517: }
518: }
519: buffer_append(&buffer, "\0", 1);
520: cp = xstrdup(buffer_ptr(&buffer));
521: buffer_free(&buffer);
522: return cp;
523: }
524:
525: void
526: channel_send_open(int id)
527: {
528: Channel *c = channel_lookup(id);
529: if (c == NULL) {
530: log("channel_send_open: %d: bad id", id);
531: return;
532: }
533: debug("send channel open %d", id);
534: packet_start(SSH2_MSG_CHANNEL_OPEN);
535: packet_put_cstring(c->ctype);
536: packet_put_int(c->self);
537: packet_put_int(c->local_window);
538: packet_put_int(c->local_maxpacket);
539: packet_send();
540: }
541:
542: void
543: channel_request(int id, char *service, int wantconfirm)
544: {
545: channel_request_start(id, service, wantconfirm);
546: packet_send();
547: debug("channel request %d: %s", id, service) ;
548: }
549: void
550: channel_request_start(int id, char *service, int wantconfirm)
551: {
552: Channel *c = channel_lookup(id);
553: if (c == NULL) {
554: log("channel_request: %d: bad id", id);
555: return;
556: }
557: packet_start(SSH2_MSG_CHANNEL_REQUEST);
558: packet_put_int(c->remote_id);
559: packet_put_cstring(service);
560: packet_put_char(wantconfirm);
561: }
562: void
563: channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
564: {
565: Channel *c = channel_lookup(id);
566: if (c == NULL) {
567: log("channel_register_callback: %d: bad id", id);
568: return;
569: }
570: c->cb_event = mtype;
571: c->cb_fn = fn;
572: c->cb_arg = arg;
573: }
574: void
575: channel_register_cleanup(int id, channel_callback_fn *fn)
576: {
577: Channel *c = channel_lookup(id);
578: if (c == NULL) {
579: log("channel_register_cleanup: %d: bad id", id);
580: return;
581: }
582: c->dettach_user = fn;
583: }
584: void
585: channel_cancel_cleanup(int id)
586: {
587: Channel *c = channel_lookup(id);
588: if (c == NULL) {
589: log("channel_cancel_cleanup: %d: bad id", id);
590: return;
1.52 markus 591: }
1.121 markus 592: c->dettach_user = NULL;
593: }
594: void
595: channel_register_filter(int id, channel_filter_fn *fn)
596: {
597: Channel *c = channel_lookup(id);
598: if (c == NULL) {
599: log("channel_register_filter: %d: bad id", id);
600: return;
1.52 markus 601: }
1.121 markus 602: c->input_filter = fn;
1.52 markus 603: }
604:
1.49 markus 605: void
1.121 markus 606: channel_set_fds(int id, int rfd, int wfd, int efd,
607: int extusage, int nonblock)
1.1 deraadt 608: {
1.121 markus 609: Channel *c = channel_lookup(id);
610: if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
611: fatal("channel_activate for non-larval channel %d.", id);
612: channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
613: c->type = SSH_CHANNEL_OPEN;
614: /* XXX window size? */
615: c->local_window = c->local_window_max = c->local_maxpacket * 2;
616: packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
617: packet_put_int(c->remote_id);
618: packet_put_int(c->local_window);
619: packet_send();
1.1 deraadt 620: }
621:
1.27 markus 622: /*
1.41 markus 623: * 'channel_pre*' are called just before select() to add any bits relevant to
624: * channels in the select bitmasks.
625: */
626: /*
627: * 'channel_post*': perform any appropriate operations for channels which
628: * have events pending.
1.27 markus 629: */
1.41 markus 630: typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
631: chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
632: chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
633:
1.127 itojun 634: static void
1.41 markus 635: channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
636: {
637: FD_SET(c->sock, readset);
638: }
639:
1.127 itojun 640: static void
1.75 markus 641: channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset)
642: {
643: debug3("channel %d: waiting for connection", c->self);
644: FD_SET(c->sock, writeset);
645: }
646:
1.127 itojun 647: static void
1.41 markus 648: channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
649: {
650: if (buffer_len(&c->input) < packet_get_maxsize())
651: FD_SET(c->sock, readset);
652: if (buffer_len(&c->output) > 0)
653: FD_SET(c->sock, writeset);
654: }
1.1 deraadt 655:
1.127 itojun 656: static void
1.41 markus 657: channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
658: {
659: /* test whether sockets are 'alive' for read/write */
660: if (c->istate == CHAN_INPUT_OPEN)
661: if (buffer_len(&c->input) < packet_get_maxsize())
662: FD_SET(c->sock, readset);
663: if (c->ostate == CHAN_OUTPUT_OPEN ||
664: c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
665: if (buffer_len(&c->output) > 0) {
666: FD_SET(c->sock, writeset);
667: } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
668: chan_obuf_empty(c);
669: }
670: }
671: }
672:
1.127 itojun 673: static void
1.44 markus 674: channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
675: {
676: if (c->istate == CHAN_INPUT_OPEN &&
677: c->remote_window > 0 &&
678: buffer_len(&c->input) < c->remote_window)
679: FD_SET(c->rfd, readset);
680: if (c->ostate == CHAN_OUTPUT_OPEN ||
681: c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
682: if (buffer_len(&c->output) > 0) {
683: FD_SET(c->wfd, writeset);
684: } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
685: chan_obuf_empty(c);
686: }
687: }
688: /** XXX check close conditions, too */
689: if (c->efd != -1) {
690: if (c->extended_usage == CHAN_EXTENDED_WRITE &&
691: buffer_len(&c->extended) > 0)
692: FD_SET(c->efd, writeset);
693: else if (c->extended_usage == CHAN_EXTENDED_READ &&
694: buffer_len(&c->extended) < c->remote_window)
695: FD_SET(c->efd, readset);
696: }
697: }
698:
1.127 itojun 699: static void
1.41 markus 700: channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
701: {
702: if (buffer_len(&c->input) == 0) {
703: packet_start(SSH_MSG_CHANNEL_CLOSE);
704: packet_put_int(c->remote_id);
705: packet_send();
706: c->type = SSH_CHANNEL_CLOSED;
1.105 markus 707: debug("channel %d: closing after input drain.", c->self);
1.41 markus 708: }
709: }
710:
1.127 itojun 711: static void
1.41 markus 712: channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
713: {
714: if (buffer_len(&c->output) == 0)
1.113 markus 715: chan_mark_dead(c);
1.49 markus 716: else
1.41 markus 717: FD_SET(c->sock, writeset);
718: }
719:
720: /*
721: * This is a special state for X11 authentication spoofing. An opened X11
722: * connection (when authentication spoofing is being done) remains in this
723: * state until the first packet has been completely read. The authentication
724: * data in that packet is then substituted by the real data if it matches the
725: * fake data, and the channel is put into normal mode.
1.51 markus 726: * XXX All this happens at the client side.
1.121 markus 727: * Returns: 0 = need more data, -1 = wrong cookie, 1 = ok
1.41 markus 728: */
1.127 itojun 729: static int
1.121 markus 730: x11_open_helper(Buffer *b)
1.1 deraadt 731: {
1.77 markus 732: u_char *ucp;
733: u_int proto_len, data_len;
1.25 markus 734:
1.41 markus 735: /* Check if the fixed size part of the packet is in buffer. */
1.121 markus 736: if (buffer_len(b) < 12)
1.41 markus 737: return 0;
738:
739: /* Parse the lengths of variable-length fields. */
1.121 markus 740: ucp = (u_char *) buffer_ptr(b);
1.41 markus 741: if (ucp[0] == 0x42) { /* Byte order MSB first. */
742: proto_len = 256 * ucp[6] + ucp[7];
743: data_len = 256 * ucp[8] + ucp[9];
744: } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */
745: proto_len = ucp[6] + 256 * ucp[7];
746: data_len = ucp[8] + 256 * ucp[9];
747: } else {
748: debug("Initial X11 packet contains bad byte order byte: 0x%x",
749: ucp[0]);
750: return -1;
751: }
752:
753: /* Check if the whole packet is in buffer. */
1.121 markus 754: if (buffer_len(b) <
1.41 markus 755: 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
756: return 0;
757:
758: /* Check if authentication protocol matches. */
759: if (proto_len != strlen(x11_saved_proto) ||
760: memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
761: debug("X11 connection uses different authentication protocol.");
762: return -1;
763: }
764: /* Check if authentication data matches our fake data. */
765: if (data_len != x11_fake_data_len ||
766: memcmp(ucp + 12 + ((proto_len + 3) & ~3),
767: x11_fake_data, x11_fake_data_len) != 0) {
768: debug("X11 auth data does not match fake data.");
769: return -1;
770: }
771: /* Check fake data length */
772: if (x11_fake_data_len != x11_saved_data_len) {
773: error("X11 fake_data_len %d != saved_data_len %d",
774: x11_fake_data_len, x11_saved_data_len);
775: return -1;
776: }
777: /*
778: * Received authentication protocol and data match
779: * our fake data. Substitute the fake data with real
780: * data.
781: */
782: memcpy(ucp + 12 + ((proto_len + 3) & ~3),
783: x11_saved_data, x11_saved_data_len);
784: return 1;
785: }
786:
1.127 itojun 787: static void
1.41 markus 788: channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
789: {
1.121 markus 790: int ret = x11_open_helper(&c->output);
1.41 markus 791: if (ret == 1) {
792: /* Start normal processing for the channel. */
793: c->type = SSH_CHANNEL_OPEN;
1.47 markus 794: channel_pre_open_13(c, readset, writeset);
1.41 markus 795: } else if (ret == -1) {
796: /*
797: * We have received an X11 connection that has bad
798: * authentication information.
799: */
1.98 millert 800: log("X11 connection rejected because of wrong authentication.");
1.41 markus 801: buffer_clear(&c->input);
802: buffer_clear(&c->output);
803: close(c->sock);
804: c->sock = -1;
805: c->type = SSH_CHANNEL_CLOSED;
806: packet_start(SSH_MSG_CHANNEL_CLOSE);
807: packet_put_int(c->remote_id);
808: packet_send();
809: }
810: }
1.25 markus 811:
1.127 itojun 812: static void
1.51 markus 813: channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
1.41 markus 814: {
1.121 markus 815: int ret = x11_open_helper(&c->output);
1.41 markus 816: if (ret == 1) {
817: c->type = SSH_CHANNEL_OPEN;
1.57 markus 818: if (compat20)
819: channel_pre_open_20(c, readset, writeset);
820: else
821: channel_pre_open_15(c, readset, writeset);
1.41 markus 822: } else if (ret == -1) {
823: debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
1.51 markus 824: chan_read_failed(c); /** force close? */
1.41 markus 825: chan_write_failed(c);
826: debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
827: }
828: }
1.25 markus 829:
1.104 markus 830: /* try to decode a socks4 header */
1.127 itojun 831: static int
1.104 markus 832: channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset)
1.103 markus 833: {
834: u_char *p, *host;
1.109 markus 835: int len, have, i, found;
1.104 markus 836: char username[256];
1.103 markus 837: struct {
838: u_int8_t version;
839: u_int8_t command;
840: u_int16_t dest_port;
1.104 markus 841: struct in_addr dest_addr;
1.103 markus 842: } s4_req, s4_rsp;
843:
1.104 markus 844: debug2("channel %d: decode socks4", c->self);
1.109 markus 845:
846: have = buffer_len(&c->input);
847: len = sizeof(s4_req);
848: if (have < len)
849: return 0;
850: p = buffer_ptr(&c->input);
851: for (found = 0, i = len; i < have; i++) {
852: if (p[i] == '\0') {
853: found = 1;
854: break;
855: }
856: if (i > 1024) {
857: /* the peer is probably sending garbage */
858: debug("channel %d: decode socks4: too long",
859: c->self);
860: return -1;
861: }
862: }
863: if (!found)
864: return 0;
1.103 markus 865: buffer_get(&c->input, (char *)&s4_req.version, 1);
866: buffer_get(&c->input, (char *)&s4_req.command, 1);
867: buffer_get(&c->input, (char *)&s4_req.dest_port, 2);
1.104 markus 868: buffer_get(&c->input, (char *)&s4_req.dest_addr, 4);
1.109 markus 869: have = buffer_len(&c->input);
1.103 markus 870: p = buffer_ptr(&c->input);
871: len = strlen(p);
1.106 markus 872: debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
1.103 markus 873: if (len > have)
1.104 markus 874: fatal("channel %d: decode socks4: len %d > have %d",
1.103 markus 875: c->self, len, have);
876: strlcpy(username, p, sizeof(username));
877: buffer_consume(&c->input, len);
878: buffer_consume(&c->input, 1); /* trailing '\0' */
879:
1.104 markus 880: host = inet_ntoa(s4_req.dest_addr);
1.103 markus 881: strlcpy(c->path, host, sizeof(c->path));
882: c->host_port = ntohs(s4_req.dest_port);
883:
1.106 markus 884: debug("channel %d: dynamic request: socks4 host %s port %u command %u",
885: c->self, host, c->host_port, s4_req.command);
1.103 markus 886:
1.104 markus 887: if (s4_req.command != 1) {
888: debug("channel %d: cannot handle: socks4 cn %d",
889: c->self, s4_req.command);
890: return -1;
1.103 markus 891: }
1.104 markus 892: s4_rsp.version = 0; /* vn: 0 for reply */
893: s4_rsp.command = 90; /* cd: req granted */
1.103 markus 894: s4_rsp.dest_port = 0; /* ignored */
1.104 markus 895: s4_rsp.dest_addr.s_addr = INADDR_ANY; /* ignored */
1.103 markus 896: buffer_append(&c->output, (char *)&s4_rsp, sizeof(s4_rsp));
1.104 markus 897: return 1;
898: }
899:
900: /* dynamic port forwarding */
1.127 itojun 901: static void
1.104 markus 902: channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset)
903: {
904: u_char *p;
905: int have, ret;
1.103 markus 906:
1.104 markus 907: have = buffer_len(&c->input);
908:
909: debug2("channel %d: pre_dynamic: have %d", c->self, have);
1.105 markus 910: /* buffer_dump(&c->input); */
1.104 markus 911: /* check if the fixed size part of the packet is in buffer. */
912: if (have < 4) {
913: /* need more */
914: FD_SET(c->sock, readset);
915: return;
916: }
917: /* try to guess the protocol */
918: p = buffer_ptr(&c->input);
919: switch (p[0]) {
920: case 0x04:
921: ret = channel_decode_socks4(c, readset, writeset);
922: break;
923: default:
924: ret = -1;
925: break;
926: }
927: if (ret < 0) {
1.113 markus 928: chan_mark_dead(c);
1.104 markus 929: } else if (ret == 0) {
930: debug2("channel %d: pre_dynamic: need more", c->self);
931: /* need more */
932: FD_SET(c->sock, readset);
933: } else {
934: /* switch to the next state */
935: c->type = SSH_CHANNEL_OPENING;
936: port_open_helper(c, "direct-tcpip");
937: }
1.103 markus 938: }
939:
1.41 markus 940: /* This is our fake X11 server socket. */
1.127 itojun 941: static void
1.41 markus 942: channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
943: {
1.113 markus 944: Channel *nc;
1.41 markus 945: struct sockaddr addr;
1.113 markus 946: int newsock;
1.41 markus 947: socklen_t addrlen;
1.85 markus 948: char buf[16384], *remote_ipaddr;
1.51 markus 949: int remote_port;
1.25 markus 950:
1.41 markus 951: if (FD_ISSET(c->sock, readset)) {
952: debug("X11 connection requested.");
953: addrlen = sizeof(addr);
954: newsock = accept(c->sock, &addr, &addrlen);
955: if (newsock < 0) {
956: error("accept: %.100s", strerror(errno));
957: return;
958: }
1.85 markus 959: remote_ipaddr = get_peer_ipaddr(newsock);
1.51 markus 960: remote_port = get_peer_port(newsock);
1.41 markus 961: snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
1.85 markus 962: remote_ipaddr, remote_port);
1.51 markus 963:
1.113 markus 964: nc = channel_new("accepted x11 socket",
1.51 markus 965: SSH_CHANNEL_OPENING, newsock, newsock, -1,
966: c->local_window_max, c->local_maxpacket,
1.71 markus 967: 0, xstrdup(buf), 1);
1.113 markus 968: if (nc == NULL) {
969: close(newsock);
970: xfree(remote_ipaddr);
971: return;
972: }
1.51 markus 973: if (compat20) {
974: packet_start(SSH2_MSG_CHANNEL_OPEN);
975: packet_put_cstring("x11");
1.113 markus 976: packet_put_int(nc->self);
1.51 markus 977: packet_put_int(c->local_window_max);
978: packet_put_int(c->local_maxpacket);
1.85 markus 979: /* originator ipaddr and port */
980: packet_put_cstring(remote_ipaddr);
1.57 markus 981: if (datafellows & SSH_BUG_X11FWD) {
982: debug("ssh2 x11 bug compat mode");
983: } else {
984: packet_put_int(remote_port);
985: }
1.51 markus 986: packet_send();
987: } else {
988: packet_start(SSH_SMSG_X11_OPEN);
1.113 markus 989: packet_put_int(nc->self);
1.121 markus 990: if (packet_get_protocol_flags() &
991: SSH_PROTOFLAG_HOST_IN_FWD_OPEN)
1.125 markus 992: packet_put_cstring(buf);
1.51 markus 993: packet_send();
994: }
1.85 markus 995: xfree(remote_ipaddr);
1.41 markus 996: }
997: }
1.25 markus 998:
1.127 itojun 999: static void
1.103 markus 1000: port_open_helper(Channel *c, char *rtype)
1001: {
1002: int direct;
1003: char buf[1024];
1004: char *remote_ipaddr = get_peer_ipaddr(c->sock);
1005: u_short remote_port = get_peer_port(c->sock);
1006:
1007: direct = (strcmp(rtype, "direct-tcpip") == 0);
1008:
1009: snprintf(buf, sizeof buf,
1010: "%s: listening port %d for %.100s port %d, "
1011: "connect from %.200s port %d",
1012: rtype, c->listening_port, c->path, c->host_port,
1013: remote_ipaddr, remote_port);
1014:
1015: xfree(c->remote_name);
1016: c->remote_name = xstrdup(buf);
1017:
1018: if (compat20) {
1019: packet_start(SSH2_MSG_CHANNEL_OPEN);
1020: packet_put_cstring(rtype);
1021: packet_put_int(c->self);
1022: packet_put_int(c->local_window_max);
1023: packet_put_int(c->local_maxpacket);
1024: if (direct) {
1025: /* target host, port */
1026: packet_put_cstring(c->path);
1027: packet_put_int(c->host_port);
1028: } else {
1029: /* listen address, port */
1030: packet_put_cstring(c->path);
1031: packet_put_int(c->listening_port);
1032: }
1033: /* originator host and port */
1034: packet_put_cstring(remote_ipaddr);
1035: packet_put_int(remote_port);
1036: packet_send();
1037: } else {
1038: packet_start(SSH_MSG_PORT_OPEN);
1039: packet_put_int(c->self);
1040: packet_put_cstring(c->path);
1041: packet_put_int(c->host_port);
1.121 markus 1042: if (packet_get_protocol_flags() &
1043: SSH_PROTOFLAG_HOST_IN_FWD_OPEN)
1.103 markus 1044: packet_put_cstring(c->remote_name);
1045: packet_send();
1046: }
1047: xfree(remote_ipaddr);
1048: }
1049:
1.41 markus 1050: /*
1051: * This socket is listening for connections to a forwarded TCP/IP port.
1052: */
1.127 itojun 1053: static void
1.41 markus 1054: channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
1055: {
1.103 markus 1056: Channel *nc;
1.41 markus 1057: struct sockaddr addr;
1.113 markus 1058: int newsock, nextstate;
1.41 markus 1059: socklen_t addrlen;
1.103 markus 1060: char *rtype;
1.73 markus 1061:
1.41 markus 1062: if (FD_ISSET(c->sock, readset)) {
1063: debug("Connection to port %d forwarding "
1064: "to %.100s port %d requested.",
1065: c->listening_port, c->path, c->host_port);
1.103 markus 1066:
1067: rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ?
1068: "forwarded-tcpip" : "direct-tcpip";
1.115 markus 1069: nextstate = (c->host_port == 0 &&
1070: c->type != SSH_CHANNEL_RPORT_LISTENER) ?
1071: SSH_CHANNEL_DYNAMIC : SSH_CHANNEL_OPENING;
1.103 markus 1072:
1.41 markus 1073: addrlen = sizeof(addr);
1074: newsock = accept(c->sock, &addr, &addrlen);
1075: if (newsock < 0) {
1076: error("accept: %.100s", strerror(errno));
1077: return;
1078: }
1.113 markus 1079: nc = channel_new(rtype,
1.103 markus 1080: nextstate, newsock, newsock, -1,
1.41 markus 1081: c->local_window_max, c->local_maxpacket,
1.103 markus 1082: 0, xstrdup(rtype), 1);
1083: if (nc == NULL) {
1.113 markus 1084: error("channel_post_port_listener: no new channel:");
1085: close(newsock);
1.103 markus 1086: return;
1.41 markus 1087: }
1.103 markus 1088: nc->listening_port = c->listening_port;
1089: nc->host_port = c->host_port;
1090: strlcpy(nc->path, c->path, sizeof(nc->path));
1091:
1092: if (nextstate != SSH_CHANNEL_DYNAMIC)
1093: port_open_helper(nc, rtype);
1.41 markus 1094: }
1095: }
1.25 markus 1096:
1.41 markus 1097: /*
1098: * This is the authentication agent socket listening for connections from
1099: * clients.
1100: */
1.127 itojun 1101: static void
1.41 markus 1102: channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
1103: {
1.113 markus 1104: Channel *nc;
1.121 markus 1105: char *name;
1.113 markus 1106: int newsock;
1.41 markus 1107: struct sockaddr addr;
1108: socklen_t addrlen;
1.25 markus 1109:
1.41 markus 1110: if (FD_ISSET(c->sock, readset)) {
1111: addrlen = sizeof(addr);
1112: newsock = accept(c->sock, &addr, &addrlen);
1113: if (newsock < 0) {
1114: error("accept from auth socket: %.100s", strerror(errno));
1115: return;
1116: }
1.121 markus 1117: name = xstrdup("accepted auth socket");
1.113 markus 1118: nc = channel_new("accepted auth socket",
1.73 markus 1119: SSH_CHANNEL_OPENING, newsock, newsock, -1,
1120: c->local_window_max, c->local_maxpacket,
1.121 markus 1121: 0, name, 1);
1.113 markus 1122: if (nc == NULL) {
1123: error("channel_post_auth_listener: channel_new failed");
1.121 markus 1124: xfree(name);
1.113 markus 1125: close(newsock);
1126: }
1.73 markus 1127: if (compat20) {
1128: packet_start(SSH2_MSG_CHANNEL_OPEN);
1129: packet_put_cstring("auth-agent@openssh.com");
1.113 markus 1130: packet_put_int(nc->self);
1.73 markus 1131: packet_put_int(c->local_window_max);
1132: packet_put_int(c->local_maxpacket);
1133: } else {
1134: packet_start(SSH_SMSG_AGENT_OPEN);
1.113 markus 1135: packet_put_int(nc->self);
1.73 markus 1136: }
1.41 markus 1137: packet_send();
1138: }
1139: }
1.25 markus 1140:
1.127 itojun 1141: static void
1.75 markus 1142: channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
1143: {
1.114 markus 1144: int err = 0;
1145: int sz = sizeof(err);
1146:
1.75 markus 1147: if (FD_ISSET(c->sock, writeset)) {
1.114 markus 1148: if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err,
1149: &sz) < 0) {
1150: err = errno;
1151: error("getsockopt SO_ERROR failed");
1152: }
1153: if (err == 0) {
1154: debug("channel %d: connected", c->self);
1155: c->type = SSH_CHANNEL_OPEN;
1156: if (compat20) {
1157: packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
1158: packet_put_int(c->remote_id);
1159: packet_put_int(c->self);
1160: packet_put_int(c->local_window);
1161: packet_put_int(c->local_maxpacket);
1162: } else {
1163: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1164: packet_put_int(c->remote_id);
1165: packet_put_int(c->self);
1166: }
1.75 markus 1167: } else {
1.114 markus 1168: debug("channel %d: not connected: %s",
1169: c->self, strerror(err));
1170: if (compat20) {
1171: packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE);
1172: packet_put_int(c->remote_id);
1173: packet_put_int(SSH2_OPEN_CONNECT_FAILED);
1174: if (!(datafellows & SSH_BUG_OPENFAILURE)) {
1175: packet_put_cstring(strerror(err));
1176: packet_put_cstring("");
1177: }
1.75 markus 1178: } else {
1.114 markus 1179: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1180: packet_put_int(c->remote_id);
1.75 markus 1181: }
1.114 markus 1182: chan_mark_dead(c);
1.75 markus 1183: }
1.114 markus 1184: packet_send();
1.75 markus 1185: }
1186: }
1187:
1.127 itojun 1188: static int
1.41 markus 1189: channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
1190: {
1191: char buf[16*1024];
1192: int len;
1.25 markus 1193:
1.118 markus 1194: if (c->rfd != -1 &&
1.41 markus 1195: FD_ISSET(c->rfd, readset)) {
1196: len = read(c->rfd, buf, sizeof(buf));
1.53 markus 1197: if (len < 0 && (errno == EINTR || errno == EAGAIN))
1198: return 1;
1.41 markus 1199: if (len <= 0) {
1.51 markus 1200: debug("channel %d: read<=0 rfd %d len %d",
1.41 markus 1201: c->self, c->rfd, len);
1.104 markus 1202: if (c->type != SSH_CHANNEL_OPEN) {
1203: debug("channel %d: not open", c->self);
1.113 markus 1204: chan_mark_dead(c);
1.103 markus 1205: return -1;
1.104 markus 1206: } else if (compat13) {
1.41 markus 1207: buffer_consume(&c->output, buffer_len(&c->output));
1208: c->type = SSH_CHANNEL_INPUT_DRAINING;
1.121 markus 1209: debug("channel %d: input draining.", c->self);
1.25 markus 1210: } else {
1.41 markus 1211: chan_read_failed(c);
1.25 markus 1212: }
1.41 markus 1213: return -1;
1214: }
1.65 markus 1215: if(c->input_filter != NULL) {
1.66 markus 1216: if (c->input_filter(c, buf, len) == -1) {
1.105 markus 1217: debug("channel %d: filter stops", c->self);
1.65 markus 1218: chan_read_failed(c);
1219: }
1220: } else {
1221: buffer_append(&c->input, buf, len);
1222: }
1.41 markus 1223: }
1224: return 1;
1225: }
1.127 itojun 1226: static int
1.41 markus 1227: channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
1228: {
1.95 markus 1229: struct termios tio;
1.41 markus 1230: int len;
1.25 markus 1231:
1.41 markus 1232: /* Send buffered output data to the socket. */
1.118 markus 1233: if (c->wfd != -1 &&
1.41 markus 1234: FD_ISSET(c->wfd, writeset) &&
1235: buffer_len(&c->output) > 0) {
1236: len = write(c->wfd, buffer_ptr(&c->output),
1.53 markus 1237: buffer_len(&c->output));
1238: if (len < 0 && (errno == EINTR || errno == EAGAIN))
1239: return 1;
1.41 markus 1240: if (len <= 0) {
1.104 markus 1241: if (c->type != SSH_CHANNEL_OPEN) {
1242: debug("channel %d: not open", c->self);
1.113 markus 1243: chan_mark_dead(c);
1.104 markus 1244: return -1;
1245: } else if (compat13) {
1.41 markus 1246: buffer_consume(&c->output, buffer_len(&c->output));
1.121 markus 1247: debug("channel %d: input draining.", c->self);
1.41 markus 1248: c->type = SSH_CHANNEL_INPUT_DRAINING;
1249: } else {
1250: chan_write_failed(c);
1251: }
1252: return -1;
1.91 markus 1253: }
1254: if (compat20 && c->isatty) {
1255: if (tcgetattr(c->wfd, &tio) == 0 &&
1256: !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
1257: /*
1258: * Simulate echo to reduce the impact of
1.96 markus 1259: * traffic analysis. We need to match the
1.95 markus 1260: * size of a SSH2_MSG_CHANNEL_DATA message
1261: * (4 byte channel id + data)
1.91 markus 1262: */
1.95 markus 1263: packet_send_ignore(4 + len);
1.91 markus 1264: packet_send();
1265: }
1.25 markus 1266: }
1.41 markus 1267: buffer_consume(&c->output, len);
1.44 markus 1268: if (compat20 && len > 0) {
1269: c->local_consumed += len;
1270: }
1271: }
1272: return 1;
1273: }
1.127 itojun 1274: static int
1.44 markus 1275: channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
1276: {
1277: char buf[16*1024];
1278: int len;
1279:
1.45 markus 1280: /** XXX handle drain efd, too */
1.44 markus 1281: if (c->efd != -1) {
1282: if (c->extended_usage == CHAN_EXTENDED_WRITE &&
1283: FD_ISSET(c->efd, writeset) &&
1284: buffer_len(&c->extended) > 0) {
1285: len = write(c->efd, buffer_ptr(&c->extended),
1286: buffer_len(&c->extended));
1.70 markus 1287: debug2("channel %d: written %d to efd %d",
1.44 markus 1288: c->self, len, c->efd);
1.93 markus 1289: if (len < 0 && (errno == EINTR || errno == EAGAIN))
1290: return 1;
1291: if (len <= 0) {
1292: debug2("channel %d: closing write-efd %d",
1293: c->self, c->efd);
1294: close(c->efd);
1295: c->efd = -1;
1296: } else {
1.44 markus 1297: buffer_consume(&c->extended, len);
1298: c->local_consumed += len;
1299: }
1300: } else if (c->extended_usage == CHAN_EXTENDED_READ &&
1301: FD_ISSET(c->efd, readset)) {
1302: len = read(c->efd, buf, sizeof(buf));
1.70 markus 1303: debug2("channel %d: read %d from efd %d",
1.44 markus 1304: c->self, len, c->efd);
1.93 markus 1305: if (len < 0 && (errno == EINTR || errno == EAGAIN))
1306: return 1;
1307: if (len <= 0) {
1308: debug2("channel %d: closing read-efd %d",
1.45 markus 1309: c->self, c->efd);
1310: close(c->efd);
1311: c->efd = -1;
1.93 markus 1312: } else {
1.44 markus 1313: buffer_append(&c->extended, buf, len);
1.93 markus 1314: }
1.44 markus 1315: }
1316: }
1317: return 1;
1318: }
1.127 itojun 1319: static int
1.93 markus 1320: channel_check_window(Channel *c)
1.44 markus 1321: {
1.104 markus 1322: if (c->type == SSH_CHANNEL_OPEN &&
1323: !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
1.44 markus 1324: c->local_window < c->local_window_max/2 &&
1325: c->local_consumed > 0) {
1326: packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
1327: packet_put_int(c->remote_id);
1328: packet_put_int(c->local_consumed);
1329: packet_send();
1.70 markus 1330: debug2("channel %d: window %d sent adjust %d",
1.44 markus 1331: c->self, c->local_window,
1332: c->local_consumed);
1333: c->local_window += c->local_consumed;
1334: c->local_consumed = 0;
1.1 deraadt 1335: }
1.41 markus 1336: return 1;
1.1 deraadt 1337: }
1338:
1.127 itojun 1339: static void
1.41 markus 1340: channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
1341: {
1342: channel_handle_rfd(c, readset, writeset);
1343: channel_handle_wfd(c, readset, writeset);
1344: }
1.1 deraadt 1345:
1.127 itojun 1346: static void
1.44 markus 1347: channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
1348: {
1349: channel_handle_rfd(c, readset, writeset);
1350: channel_handle_wfd(c, readset, writeset);
1351: channel_handle_efd(c, readset, writeset);
1.93 markus 1352:
1353: channel_check_window(c);
1.44 markus 1354: }
1355:
1.127 itojun 1356: static void
1.41 markus 1357: channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
1.1 deraadt 1358: {
1.41 markus 1359: int len;
1360: /* Send buffered output data to the socket. */
1361: if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
1362: len = write(c->sock, buffer_ptr(&c->output),
1363: buffer_len(&c->output));
1364: if (len <= 0)
1365: buffer_consume(&c->output, buffer_len(&c->output));
1366: else
1367: buffer_consume(&c->output, len);
1368: }
1369: }
1.25 markus 1370:
1.127 itojun 1371: static void
1.44 markus 1372: channel_handler_init_20(void)
1373: {
1374: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20;
1.51 markus 1375: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
1.44 markus 1376: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
1.73 markus 1377: channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener;
1.51 markus 1378: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
1.73 markus 1379: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
1.75 markus 1380: channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
1.103 markus 1381: channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic;
1.44 markus 1382:
1383: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2;
1384: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
1.73 markus 1385: channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener;
1.51 markus 1386: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
1.73 markus 1387: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
1.75 markus 1388: channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
1.104 markus 1389: channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_2;
1.44 markus 1390: }
1391:
1.127 itojun 1392: static void
1.41 markus 1393: channel_handler_init_13(void)
1394: {
1395: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13;
1396: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13;
1397: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
1398: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
1399: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
1400: channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining;
1401: channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining;
1.75 markus 1402: channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
1.103 markus 1403: channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic;
1.25 markus 1404:
1.41 markus 1405: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
1406: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
1407: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
1408: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
1409: channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13;
1.75 markus 1410: channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
1.104 markus 1411: channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_1;
1.41 markus 1412: }
1.25 markus 1413:
1.127 itojun 1414: static void
1.41 markus 1415: channel_handler_init_15(void)
1416: {
1417: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15;
1.51 markus 1418: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
1.41 markus 1419: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
1420: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
1421: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
1.75 markus 1422: channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
1.103 markus 1423: channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic;
1.25 markus 1424:
1.41 markus 1425: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
1426: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
1427: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
1428: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
1.75 markus 1429: channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
1.104 markus 1430: channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open_1;
1.41 markus 1431: }
1.27 markus 1432:
1.127 itojun 1433: static void
1.41 markus 1434: channel_handler_init(void)
1435: {
1436: int i;
1437: for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
1438: channel_pre[i] = NULL;
1439: channel_post[i] = NULL;
1440: }
1.44 markus 1441: if (compat20)
1442: channel_handler_init_20();
1443: else if (compat13)
1.41 markus 1444: channel_handler_init_13();
1445: else
1446: channel_handler_init_15();
1447: }
1.25 markus 1448:
1.127 itojun 1449: static void
1.41 markus 1450: channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
1451: {
1452: static int did_init = 0;
1453: int i;
1454: Channel *c;
1.25 markus 1455:
1.41 markus 1456: if (!did_init) {
1457: channel_handler_init();
1458: did_init = 1;
1459: }
1460: for (i = 0; i < channels_alloc; i++) {
1.113 markus 1461: c = channels[i];
1462: if (c == NULL)
1.41 markus 1463: continue;
1.118 markus 1464: if (ftab[c->type] != NULL)
1465: (*ftab[c->type])(c, readset, writeset);
1.93 markus 1466: if (chan_is_dead(c)) {
1467: /*
1468: * we have to remove the fd's from the select mask
1469: * before the channels are free'd and the fd's are
1470: * closed
1471: */
1472: if (c->wfd != -1)
1473: FD_CLR(c->wfd, writeset);
1474: if (c->rfd != -1)
1475: FD_CLR(c->rfd, readset);
1476: if (c->efd != -1) {
1477: if (c->extended_usage == CHAN_EXTENDED_READ)
1478: FD_CLR(c->efd, readset);
1479: if (c->extended_usage == CHAN_EXTENDED_WRITE)
1480: FD_CLR(c->efd, writeset);
1481: }
1.113 markus 1482: channel_free(c);
1.93 markus 1483: }
1.1 deraadt 1484: }
1485: }
1486:
1.121 markus 1487: /*
1488: * Allocate/update select bitmasks and add any bits relevant to channels in
1489: * select bitmasks.
1490: */
1.49 markus 1491: void
1.100 markus 1492: channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp,
1493: int rekeying)
1.41 markus 1494: {
1.84 markus 1495: int n;
1496: u_int sz;
1497:
1498: n = MAX(*maxfdp, channel_max_fd);
1499:
1500: sz = howmany(n+1, NFDBITS) * sizeof(fd_mask);
1501: if (*readsetp == NULL || n > *maxfdp) {
1502: if (*readsetp)
1503: xfree(*readsetp);
1504: if (*writesetp)
1505: xfree(*writesetp);
1506: *readsetp = xmalloc(sz);
1507: *writesetp = xmalloc(sz);
1508: *maxfdp = n;
1509: }
1510: memset(*readsetp, 0, sz);
1511: memset(*writesetp, 0, sz);
1512:
1.100 markus 1513: if (!rekeying)
1514: channel_handler(channel_pre, *readsetp, *writesetp);
1.41 markus 1515: }
1516:
1.121 markus 1517: /*
1518: * After select, perform any appropriate operations for channels which have
1519: * events pending.
1520: */
1.49 markus 1521: void
1.41 markus 1522: channel_after_select(fd_set * readset, fd_set * writeset)
1523: {
1524: channel_handler(channel_post, readset, writeset);
1525: }
1526:
1.121 markus 1527:
1.84 markus 1528: /* If there is data to send to the connection, enqueue some of it now. */
1.1 deraadt 1529:
1.49 markus 1530: void
1.25 markus 1531: channel_output_poll()
1.1 deraadt 1532: {
1.25 markus 1533: int len, i;
1.41 markus 1534: Channel *c;
1.1 deraadt 1535:
1.25 markus 1536: for (i = 0; i < channels_alloc; i++) {
1.113 markus 1537: c = channels[i];
1538: if (c == NULL)
1539: continue;
1.37 markus 1540:
1.121 markus 1541: /*
1542: * We are only interested in channels that can have buffered
1543: * incoming data.
1544: */
1.37 markus 1545: if (compat13) {
1.41 markus 1546: if (c->type != SSH_CHANNEL_OPEN &&
1547: c->type != SSH_CHANNEL_INPUT_DRAINING)
1.37 markus 1548: continue;
1549: } else {
1.41 markus 1550: if (c->type != SSH_CHANNEL_OPEN)
1.37 markus 1551: continue;
1552: }
1.46 markus 1553: if (compat20 &&
1554: (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
1.93 markus 1555: /* XXX is this true? */
1.97 markus 1556: debug2("channel %d: no data after CLOSE", c->self);
1.44 markus 1557: continue;
1558: }
1.25 markus 1559:
1560: /* Get the amount of buffered data for this channel. */
1.93 markus 1561: if ((c->istate == CHAN_INPUT_OPEN ||
1562: c->istate == CHAN_INPUT_WAIT_DRAIN) &&
1563: (len = buffer_len(&c->input)) > 0) {
1.121 markus 1564: /*
1565: * Send some data for the other side over the secure
1566: * connection.
1567: */
1.44 markus 1568: if (compat20) {
1569: if (len > c->remote_window)
1570: len = c->remote_window;
1571: if (len > c->remote_maxpacket)
1572: len = c->remote_maxpacket;
1.25 markus 1573: } else {
1.44 markus 1574: if (packet_is_interactive()) {
1575: if (len > 1024)
1576: len = 512;
1577: } else {
1578: /* Keep the packets at reasonable size. */
1579: if (len > packet_get_maxsize()/2)
1580: len = packet_get_maxsize()/2;
1581: }
1.25 markus 1582: }
1.41 markus 1583: if (len > 0) {
1.44 markus 1584: packet_start(compat20 ?
1585: SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
1.41 markus 1586: packet_put_int(c->remote_id);
1587: packet_put_string(buffer_ptr(&c->input), len);
1588: packet_send();
1589: buffer_consume(&c->input, len);
1590: c->remote_window -= len;
1591: }
1592: } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
1.25 markus 1593: if (compat13)
1594: fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
1.27 markus 1595: /*
1596: * input-buffer is empty and read-socket shutdown:
1597: * tell peer, that we will not send more data: send IEOF
1598: */
1.41 markus 1599: chan_ibuf_empty(c);
1.25 markus 1600: }
1.44 markus 1601: /* Send extended data, i.e. stderr */
1602: if (compat20 &&
1603: c->remote_window > 0 &&
1604: (len = buffer_len(&c->extended)) > 0 &&
1605: c->extended_usage == CHAN_EXTENDED_READ) {
1.93 markus 1606: debug2("channel %d: rwin %d elen %d euse %d",
1607: c->self, c->remote_window, buffer_len(&c->extended),
1608: c->extended_usage);
1.44 markus 1609: if (len > c->remote_window)
1610: len = c->remote_window;
1611: if (len > c->remote_maxpacket)
1612: len = c->remote_maxpacket;
1613: packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
1614: packet_put_int(c->remote_id);
1615: packet_put_int(SSH2_EXTENDED_DATA_STDERR);
1616: packet_put_string(buffer_ptr(&c->extended), len);
1617: packet_send();
1618: buffer_consume(&c->extended, len);
1619: c->remote_window -= len;
1.93 markus 1620: debug2("channel %d: sent ext data %d", c->self, len);
1.44 markus 1621: }
1.25 markus 1622: }
1.1 deraadt 1623: }
1624:
1.121 markus 1625:
1626: /* -- protocol input */
1.1 deraadt 1627:
1.49 markus 1628: void
1.69 markus 1629: channel_input_data(int type, int plen, void *ctxt)
1.1 deraadt 1630: {
1.37 markus 1631: int id;
1.25 markus 1632: char *data;
1.77 markus 1633: u_int data_len;
1.41 markus 1634: Channel *c;
1.25 markus 1635:
1636: /* Get the channel number and verify it. */
1.37 markus 1637: id = packet_get_int();
1.41 markus 1638: c = channel_lookup(id);
1639: if (c == NULL)
1.37 markus 1640: packet_disconnect("Received data for nonexistent channel %d.", id);
1.25 markus 1641:
1642: /* Ignore any data for non-open channels (might happen on close) */
1.41 markus 1643: if (c->type != SSH_CHANNEL_OPEN &&
1644: c->type != SSH_CHANNEL_X11_OPEN)
1.37 markus 1645: return;
1646:
1647: /* same for protocol 1.5 if output end is no longer open */
1.41 markus 1648: if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
1.25 markus 1649: return;
1650:
1651: /* Get the data. */
1652: data = packet_get_string(&data_len);
1.48 markus 1653: packet_done();
1.41 markus 1654:
1.44 markus 1655: if (compat20){
1656: if (data_len > c->local_maxpacket) {
1657: log("channel %d: rcvd big packet %d, maxpack %d",
1658: c->self, data_len, c->local_maxpacket);
1659: }
1660: if (data_len > c->local_window) {
1661: log("channel %d: rcvd too much data %d, win %d",
1662: c->self, data_len, c->local_window);
1663: xfree(data);
1664: return;
1665: }
1666: c->local_window -= data_len;
1667: }else{
1668: packet_integrity_check(plen, 4 + 4 + data_len, type);
1669: }
1.41 markus 1670: buffer_append(&c->output, data, data_len);
1.25 markus 1671: xfree(data);
1.1 deraadt 1672: }
1.121 markus 1673:
1.49 markus 1674: void
1.69 markus 1675: channel_input_extended_data(int type, int plen, void *ctxt)
1.44 markus 1676: {
1677: int id;
1678: int tcode;
1679: char *data;
1.77 markus 1680: u_int data_len;
1.44 markus 1681: Channel *c;
1682:
1683: /* Get the channel number and verify it. */
1684: id = packet_get_int();
1685: c = channel_lookup(id);
1686:
1687: if (c == NULL)
1688: packet_disconnect("Received extended_data for bad channel %d.", id);
1689: if (c->type != SSH_CHANNEL_OPEN) {
1690: log("channel %d: ext data for non open", id);
1691: return;
1692: }
1693: tcode = packet_get_int();
1694: if (c->efd == -1 ||
1695: c->extended_usage != CHAN_EXTENDED_WRITE ||
1696: tcode != SSH2_EXTENDED_DATA_STDERR) {
1697: log("channel %d: bad ext data", c->self);
1698: return;
1699: }
1700: data = packet_get_string(&data_len);
1.48 markus 1701: packet_done();
1.44 markus 1702: if (data_len > c->local_window) {
1703: log("channel %d: rcvd too much extended_data %d, win %d",
1704: c->self, data_len, c->local_window);
1705: xfree(data);
1706: return;
1707: }
1.70 markus 1708: debug2("channel %d: rcvd ext data %d", c->self, data_len);
1.44 markus 1709: c->local_window -= data_len;
1710: buffer_append(&c->extended, data, data_len);
1711: xfree(data);
1712: }
1713:
1.49 markus 1714: void
1.69 markus 1715: channel_input_ieof(int type, int plen, void *ctxt)
1.41 markus 1716: {
1717: int id;
1718: Channel *c;
1719:
1720: packet_integrity_check(plen, 4, type);
1721:
1722: id = packet_get_int();
1723: c = channel_lookup(id);
1724: if (c == NULL)
1725: packet_disconnect("Received ieof for nonexistent channel %d.", id);
1726: chan_rcvd_ieof(c);
1727: }
1.1 deraadt 1728:
1.49 markus 1729: void
1.69 markus 1730: channel_input_close(int type, int plen, void *ctxt)
1.1 deraadt 1731: {
1.41 markus 1732: int id;
1733: Channel *c;
1.1 deraadt 1734:
1.41 markus 1735: packet_integrity_check(plen, 4, type);
1736:
1737: id = packet_get_int();
1738: c = channel_lookup(id);
1739: if (c == NULL)
1740: packet_disconnect("Received close for nonexistent channel %d.", id);
1.27 markus 1741:
1742: /*
1743: * Send a confirmation that we have closed the channel and no more
1744: * data is coming for it.
1745: */
1.25 markus 1746: packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
1.41 markus 1747: packet_put_int(c->remote_id);
1.25 markus 1748: packet_send();
1749:
1.27 markus 1750: /*
1751: * If the channel is in closed state, we have sent a close request,
1752: * and the other side will eventually respond with a confirmation.
1753: * Thus, we cannot free the channel here, because then there would be
1754: * no-one to receive the confirmation. The channel gets freed when
1755: * the confirmation arrives.
1756: */
1.41 markus 1757: if (c->type != SSH_CHANNEL_CLOSED) {
1.27 markus 1758: /*
1759: * Not a closed channel - mark it as draining, which will
1760: * cause it to be freed later.
1761: */
1.41 markus 1762: buffer_consume(&c->input, buffer_len(&c->input));
1763: c->type = SSH_CHANNEL_OUTPUT_DRAINING;
1.25 markus 1764: }
1.1 deraadt 1765: }
1766:
1.41 markus 1767: /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
1.49 markus 1768: void
1.69 markus 1769: channel_input_oclose(int type, int plen, void *ctxt)
1.41 markus 1770: {
1771: int id = packet_get_int();
1772: Channel *c = channel_lookup(id);
1773: packet_integrity_check(plen, 4, type);
1774: if (c == NULL)
1775: packet_disconnect("Received oclose for nonexistent channel %d.", id);
1776: chan_rcvd_oclose(c);
1777: }
1.1 deraadt 1778:
1.49 markus 1779: void
1.69 markus 1780: channel_input_close_confirmation(int type, int plen, void *ctxt)
1.1 deraadt 1781: {
1.41 markus 1782: int id = packet_get_int();
1783: Channel *c = channel_lookup(id);
1.1 deraadt 1784:
1.48 markus 1785: packet_done();
1.41 markus 1786: if (c == NULL)
1787: packet_disconnect("Received close confirmation for "
1788: "out-of-range channel %d.", id);
1789: if (c->type != SSH_CHANNEL_CLOSED)
1790: packet_disconnect("Received close confirmation for "
1791: "non-closed channel %d (type %d).", id, c->type);
1.113 markus 1792: channel_free(c);
1.1 deraadt 1793: }
1794:
1.49 markus 1795: void
1.69 markus 1796: channel_input_open_confirmation(int type, int plen, void *ctxt)
1.1 deraadt 1797: {
1.41 markus 1798: int id, remote_id;
1799: Channel *c;
1.1 deraadt 1800:
1.44 markus 1801: if (!compat20)
1802: packet_integrity_check(plen, 4 + 4, type);
1.25 markus 1803:
1.41 markus 1804: id = packet_get_int();
1805: c = channel_lookup(id);
1.25 markus 1806:
1.41 markus 1807: if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1808: packet_disconnect("Received open confirmation for "
1809: "non-opening channel %d.", id);
1810: remote_id = packet_get_int();
1.27 markus 1811: /* Record the remote channel number and mark that the channel is now open. */
1.41 markus 1812: c->remote_id = remote_id;
1813: c->type = SSH_CHANNEL_OPEN;
1.44 markus 1814:
1815: if (compat20) {
1816: c->remote_window = packet_get_int();
1817: c->remote_maxpacket = packet_get_int();
1.48 markus 1818: packet_done();
1.44 markus 1819: if (c->cb_fn != NULL && c->cb_event == type) {
1.70 markus 1820: debug2("callback start");
1.44 markus 1821: c->cb_fn(c->self, c->cb_arg);
1.70 markus 1822: debug2("callback done");
1.44 markus 1823: }
1824: debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1825: c->remote_window, c->remote_maxpacket);
1826: }
1.1 deraadt 1827: }
1828:
1.127 itojun 1829: static char *
1.114 markus 1830: reason2txt(int reason)
1831: {
1832: switch(reason) {
1833: case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED:
1834: return "administratively prohibited";
1835: case SSH2_OPEN_CONNECT_FAILED:
1836: return "connect failed";
1837: case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE:
1838: return "unknown channel type";
1839: case SSH2_OPEN_RESOURCE_SHORTAGE:
1840: return "resource shortage";
1841: }
1.117 stevesk 1842: return "unknown reason";
1.114 markus 1843: }
1844:
1.49 markus 1845: void
1.69 markus 1846: channel_input_open_failure(int type, int plen, void *ctxt)
1.1 deraadt 1847: {
1.86 markus 1848: int id, reason;
1849: char *msg = NULL, *lang = NULL;
1.41 markus 1850: Channel *c;
1851:
1.44 markus 1852: if (!compat20)
1853: packet_integrity_check(plen, 4, type);
1.41 markus 1854:
1855: id = packet_get_int();
1856: c = channel_lookup(id);
1.25 markus 1857:
1.41 markus 1858: if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1859: packet_disconnect("Received open failure for "
1860: "non-opening channel %d.", id);
1.44 markus 1861: if (compat20) {
1.86 markus 1862: reason = packet_get_int();
1.110 markus 1863: if (!(datafellows & SSH_BUG_OPENFAILURE)) {
1.86 markus 1864: msg = packet_get_string(NULL);
1865: lang = packet_get_string(NULL);
1866: }
1.48 markus 1867: packet_done();
1.114 markus 1868: log("channel %d: open failed: %s%s%s", id,
1869: reason2txt(reason), msg ? ": ": "", msg ? msg : "");
1.86 markus 1870: if (msg != NULL)
1871: xfree(msg);
1872: if (lang != NULL)
1873: xfree(lang);
1.44 markus 1874: }
1.25 markus 1875: /* Free the channel. This will also close the socket. */
1.113 markus 1876: channel_free(c);
1.1 deraadt 1877: }
1878:
1.44 markus 1879: void
1.69 markus 1880: channel_input_channel_request(int type, int plen, void *ctxt)
1.44 markus 1881: {
1882: int id;
1883: Channel *c;
1884:
1885: id = packet_get_int();
1886: c = channel_lookup(id);
1887:
1888: if (c == NULL ||
1889: (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1890: packet_disconnect("Received request for "
1891: "non-open channel %d.", id);
1892: if (c->cb_fn != NULL && c->cb_event == type) {
1.70 markus 1893: debug2("callback start");
1.44 markus 1894: c->cb_fn(c->self, c->cb_arg);
1.70 markus 1895: debug2("callback done");
1.44 markus 1896: } else {
1897: char *service = packet_get_string(NULL);
1.94 markus 1898: debug("channel %d: rcvd request for %s", c->self, service);
1.70 markus 1899: debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
1.44 markus 1900: xfree(service);
1901: }
1902: }
1903:
1.121 markus 1904: void
1905: channel_input_window_adjust(int type, int plen, void *ctxt)
1906: {
1907: Channel *c;
1908: int id, adjust;
1909:
1910: if (!compat20)
1911: return;
1912:
1913: /* Get the channel number and verify it. */
1914: id = packet_get_int();
1915: c = channel_lookup(id);
1.1 deraadt 1916:
1.121 markus 1917: if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1918: log("Received window adjust for "
1919: "non-open channel %d.", id);
1920: return;
1921: }
1922: adjust = packet_get_int();
1923: packet_done();
1924: debug2("channel %d: rcvd adjust %d", id, adjust);
1925: c->remote_window += adjust;
1926: }
1.1 deraadt 1927:
1.121 markus 1928: void
1929: channel_input_port_open(int type, int plen, void *ctxt)
1.1 deraadt 1930: {
1.121 markus 1931: Channel *c = NULL;
1932: u_short host_port;
1933: char *host, *originator_string;
1934: int remote_id, sock = -1;
1935:
1936: remote_id = packet_get_int();
1937: host = packet_get_string(NULL);
1938: host_port = packet_get_int();
1.25 markus 1939:
1.121 markus 1940: if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {
1941: originator_string = packet_get_string(NULL);
1942: } else {
1943: originator_string = xstrdup("unknown (remote did not supply name)");
1944: }
1945: packet_done();
1946: sock = channel_connect_to(host, host_port);
1947: if (sock != -1) {
1948: c = channel_new("connected socket",
1949: SSH_CHANNEL_CONNECTING, sock, sock, -1, 0, 0, 0,
1950: originator_string, 1);
1951: if (c == NULL) {
1952: error("channel_input_port_open: channel_new failed");
1953: close(sock);
1954: } else {
1955: c->remote_id = remote_id;
1.25 markus 1956: }
1957: }
1.121 markus 1958: if (c == NULL) {
1959: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1960: packet_put_int(remote_id);
1961: packet_send();
1962: }
1963: xfree(host);
1.1 deraadt 1964: }
1965:
1.121 markus 1966:
1967: /* -- tcp forwarding */
1968:
1.27 markus 1969: /*
1970: * Initiate forwarding of connections to local port "port" through the secure
1971: * channel to host:port from remote side.
1972: */
1.87 markus 1973: int
1.73 markus 1974: channel_request_local_forwarding(u_short listen_port, const char *host_to_connect,
1975: u_short port_to_connect, int gateway_ports)
1976: {
1.87 markus 1977: return channel_request_forwarding(
1.73 markus 1978: NULL, listen_port,
1979: host_to_connect, port_to_connect,
1980: gateway_ports, /*remote_fwd*/ 0);
1981: }
1.1 deraadt 1982:
1.73 markus 1983: /*
1984: * If 'remote_fwd' is true we have a '-R style' listener for protocol 2
1985: * (SSH_CHANNEL_RPORT_LISTENER).
1986: */
1.87 markus 1987: int
1.73 markus 1988: channel_request_forwarding(
1989: const char *listen_address, u_short listen_port,
1990: const char *host_to_connect, u_short port_to_connect,
1991: int gateway_ports, int remote_fwd)
1.25 markus 1992: {
1.113 markus 1993: Channel *c;
1.121 markus 1994: int success, sock, on = 1, type;
1.35 markus 1995: struct addrinfo hints, *ai, *aitop;
1996: char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1.73 markus 1997: const char *host;
1.28 markus 1998: struct linger linger;
1.25 markus 1999:
1.87 markus 2000: success = 0;
2001:
1.73 markus 2002: if (remote_fwd) {
2003: host = listen_address;
1.121 markus 2004: type = SSH_CHANNEL_RPORT_LISTENER;
1.73 markus 2005: } else {
2006: host = host_to_connect;
1.121 markus 2007: type = SSH_CHANNEL_PORT_LISTENER;
1.73 markus 2008: }
2009:
1.113 markus 2010: if (strlen(host) > SSH_CHANNEL_PATH_LEN - 1) {
1.87 markus 2011: error("Forward host name too long.");
2012: return success;
2013: }
1.25 markus 2014:
1.73 markus 2015: /* XXX listen_address is currently ignored */
1.28 markus 2016: /*
1.35 markus 2017: * getaddrinfo returns a loopback address if the hostname is
2018: * set to NULL and hints.ai_flags is not AI_PASSIVE
1.28 markus 2019: */
1.35 markus 2020: memset(&hints, 0, sizeof(hints));
2021: hints.ai_family = IPv4or6;
2022: hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
2023: hints.ai_socktype = SOCK_STREAM;
1.73 markus 2024: snprintf(strport, sizeof strport, "%d", listen_port);
1.35 markus 2025: if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
2026: packet_disconnect("getaddrinfo: fatal error");
2027:
2028: for (ai = aitop; ai; ai = ai->ai_next) {
2029: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
2030: continue;
2031: if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
2032: strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1.73 markus 2033: error("channel_request_forwarding: getnameinfo failed");
1.35 markus 2034: continue;
2035: }
2036: /* Create a port to listen for the host. */
2037: sock = socket(ai->ai_family, SOCK_STREAM, 0);
2038: if (sock < 0) {
2039: /* this is no error since kernel may not support ipv6 */
2040: verbose("socket: %.100s", strerror(errno));
2041: continue;
2042: }
2043: /*
2044: * Set socket options. We would like the socket to disappear
2045: * as soon as it has been closed for whatever reason.
2046: */
2047: setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
2048: linger.l_onoff = 1;
2049: linger.l_linger = 5;
2050: setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
2051: debug("Local forwarding listening on %s port %s.", ntop, strport);
2052:
2053: /* Bind the socket to the address. */
2054: if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2055: /* address can be in use ipv6 address is already bound */
2056: verbose("bind: %.100s", strerror(errno));
2057: close(sock);
2058: continue;
2059: }
2060: /* Start listening for connections on the socket. */
2061: if (listen(sock, 5) < 0) {
2062: error("listen: %.100s", strerror(errno));
2063: close(sock);
2064: continue;
2065: }
2066: /* Allocate a channel number for the socket. */
1.121 markus 2067: c = channel_new("port listener", type, sock, sock, -1,
1.51 markus 2068: CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1.71 markus 2069: 0, xstrdup("port listener"), 1);
1.113 markus 2070: if (c == NULL) {
2071: error("channel_request_forwarding: channel_new failed");
2072: close(sock);
2073: continue;
2074: }
2075: strlcpy(c->path, host, sizeof(c->path));
2076: c->host_port = port_to_connect;
2077: c->listening_port = listen_port;
1.35 markus 2078: success = 1;
2079: }
2080: if (success == 0)
1.87 markus 2081: error("channel_request_forwarding: cannot listen to port: %d",
2082: listen_port);
1.35 markus 2083: freeaddrinfo(aitop);
1.87 markus 2084: return success;
1.25 markus 2085: }
1.1 deraadt 2086:
1.27 markus 2087: /*
2088: * Initiate forwarding of connections to port "port" on remote host through
2089: * the secure channel to host:port from local side.
2090: */
1.1 deraadt 2091:
1.49 markus 2092: void
1.73 markus 2093: channel_request_remote_forwarding(u_short listen_port,
2094: const char *host_to_connect, u_short port_to_connect)
1.25 markus 2095: {
1.73 markus 2096: int payload_len, type, success = 0;
2097:
1.25 markus 2098: /* Record locally that connection to this host/port is permitted. */
2099: if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
2100: fatal("channel_request_remote_forwarding: too many forwards");
2101:
2102: /* Send the forward request to the remote side. */
1.44 markus 2103: if (compat20) {
2104: const char *address_to_bind = "0.0.0.0";
2105: packet_start(SSH2_MSG_GLOBAL_REQUEST);
2106: packet_put_cstring("tcpip-forward");
2107: packet_put_char(0); /* boolean: want reply */
2108: packet_put_cstring(address_to_bind);
2109: packet_put_int(listen_port);
1.73 markus 2110: packet_send();
2111: packet_write_wait();
2112: /* Assume that server accepts the request */
2113: success = 1;
1.44 markus 2114: } else {
2115: packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
1.50 markus 2116: packet_put_int(listen_port);
2117: packet_put_cstring(host_to_connect);
1.44 markus 2118: packet_put_int(port_to_connect);
2119: packet_send();
2120: packet_write_wait();
1.73 markus 2121:
2122: /* Wait for response from the remote side. */
2123: type = packet_read(&payload_len);
2124: switch (type) {
2125: case SSH_SMSG_SUCCESS:
2126: success = 1;
2127: break;
2128: case SSH_SMSG_FAILURE:
2129: log("Warning: Server denied remote port forwarding.");
2130: break;
2131: default:
2132: /* Unknown packet */
2133: packet_disconnect("Protocol error for port forward request:"
2134: "received packet type %d.", type);
2135: }
2136: }
2137: if (success) {
2138: permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
2139: permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
2140: permitted_opens[num_permitted_opens].listen_port = listen_port;
2141: num_permitted_opens++;
1.44 markus 2142: }
1.1 deraadt 2143: }
2144:
1.27 markus 2145: /*
2146: * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
2147: * listening for the port, and sends back a success reply (or disconnect
2148: * message if there was an error). This never returns if there was an error.
2149: */
1.1 deraadt 2150:
1.49 markus 2151: void
1.56 markus 2152: channel_input_port_forward_request(int is_root, int gateway_ports)
1.1 deraadt 2153: {
1.31 markus 2154: u_short port, host_port;
1.25 markus 2155: char *hostname;
1.1 deraadt 2156:
1.25 markus 2157: /* Get arguments from the packet. */
2158: port = packet_get_int();
2159: hostname = packet_get_string(NULL);
2160: host_port = packet_get_int();
2161:
1.27 markus 2162: /*
2163: * Check that an unprivileged user is not trying to forward a
2164: * privileged port.
2165: */
1.25 markus 2166: if (port < IPPORT_RESERVED && !is_root)
2167: packet_disconnect("Requested forwarding of port %d but user is not root.",
2168: port);
1.73 markus 2169: /* Initiate forwarding */
1.56 markus 2170: channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
1.25 markus 2171:
2172: /* Free the argument string. */
2173: xfree(hostname);
1.1 deraadt 2174: }
2175:
1.99 markus 2176: /*
2177: * Permits opening to any host/port if permitted_opens[] is empty. This is
2178: * usually called by the server, because the user could connect to any port
2179: * anyway, and the server has no way to know but to trust the client anyway.
2180: */
2181: void
2182: channel_permit_all_opens()
2183: {
2184: if (num_permitted_opens == 0)
2185: all_opens_permitted = 1;
2186: }
2187:
1.101 markus 2188: void
1.99 markus 2189: channel_add_permitted_opens(char *host, int port)
2190: {
2191: if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
2192: fatal("channel_request_remote_forwarding: too many forwards");
2193: debug("allow port forwarding to host %s port %d", host, port);
2194:
2195: permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host);
2196: permitted_opens[num_permitted_opens].port_to_connect = port;
2197: num_permitted_opens++;
2198:
2199: all_opens_permitted = 0;
2200: }
2201:
1.101 markus 2202: void
1.99 markus 2203: channel_clear_permitted_opens(void)
2204: {
2205: int i;
2206:
2207: for (i = 0; i < num_permitted_opens; i++)
2208: xfree(permitted_opens[i].host_to_connect);
2209: num_permitted_opens = 0;
2210:
2211: }
2212:
2213:
2214: /* return socket to remote host, port */
1.127 itojun 2215: static int
1.99 markus 2216: connect_to(const char *host, u_short port)
1.41 markus 2217: {
2218: struct addrinfo hints, *ai, *aitop;
2219: char ntop[NI_MAXHOST], strport[NI_MAXSERV];
2220: int gaierr;
2221: int sock = -1;
2222:
2223: memset(&hints, 0, sizeof(hints));
2224: hints.ai_family = IPv4or6;
2225: hints.ai_socktype = SOCK_STREAM;
1.99 markus 2226: snprintf(strport, sizeof strport, "%d", port);
1.41 markus 2227: if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1.99 markus 2228: error("connect_to %.100s: unknown host (%s)", host,
2229: gai_strerror(gaierr));
1.41 markus 2230: return -1;
2231: }
2232: for (ai = aitop; ai; ai = ai->ai_next) {
2233: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
2234: continue;
2235: if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
2236: strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1.99 markus 2237: error("connect_to: getnameinfo failed");
1.41 markus 2238: continue;
2239: }
2240: sock = socket(ai->ai_family, SOCK_STREAM, 0);
2241: if (sock < 0) {
2242: error("socket: %.100s", strerror(errno));
2243: continue;
2244: }
1.80 markus 2245: if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
1.75 markus 2246: fatal("connect_to: F_SETFL: %s", strerror(errno));
2247: if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 &&
2248: errno != EINPROGRESS) {
1.99 markus 2249: error("connect_to %.100s port %s: %.100s", ntop, strport,
1.41 markus 2250: strerror(errno));
2251: close(sock);
1.89 stevesk 2252: continue; /* fail -- try next */
1.41 markus 2253: }
2254: break; /* success */
2255:
2256: }
2257: freeaddrinfo(aitop);
2258: if (!ai) {
1.99 markus 2259: error("connect_to %.100s port %d: failed.", host, port);
1.41 markus 2260: return -1;
2261: }
2262: /* success */
2263: return sock;
2264: }
1.99 markus 2265:
1.73 markus 2266: int
2267: channel_connect_by_listen_adress(u_short listen_port)
2268: {
2269: int i;
1.99 markus 2270:
1.73 markus 2271: for (i = 0; i < num_permitted_opens; i++)
2272: if (permitted_opens[i].listen_port == listen_port)
1.99 markus 2273: return connect_to(
1.73 markus 2274: permitted_opens[i].host_to_connect,
2275: permitted_opens[i].port_to_connect);
1.74 markus 2276: error("WARNING: Server requests forwarding for unknown listen_port %d",
2277: listen_port);
1.73 markus 2278: return -1;
2279: }
2280:
1.99 markus 2281: /* Check if connecting to that port is permitted and connect. */
2282: int
2283: channel_connect_to(const char *host, u_short port)
2284: {
2285: int i, permit;
2286:
2287: permit = all_opens_permitted;
2288: if (!permit) {
2289: for (i = 0; i < num_permitted_opens; i++)
2290: if (permitted_opens[i].port_to_connect == port &&
2291: strcmp(permitted_opens[i].host_to_connect, host) == 0)
2292: permit = 1;
2293:
2294: }
2295: if (!permit) {
2296: log("Received request to connect to host %.100s port %d, "
2297: "but the request was denied.", host, port);
2298: return -1;
2299: }
2300: return connect_to(host, port);
2301: }
2302:
1.121 markus 2303: /* -- X11 forwarding */
1.1 deraadt 2304:
1.27 markus 2305: /*
2306: * Creates an internet domain socket for listening for X11 connections.
2307: * Returns a suitable value for the DISPLAY variable, or NULL if an error
2308: * occurs.
2309: */
1.25 markus 2310: char *
1.33 markus 2311: x11_create_display_inet(int screen_number, int x11_display_offset)
1.1 deraadt 2312: {
1.31 markus 2313: int display_number, sock;
2314: u_short port;
1.35 markus 2315: struct addrinfo hints, *ai, *aitop;
2316: char strport[NI_MAXSERV];
2317: int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
2318: char display[512];
1.25 markus 2319: char hostname[MAXHOSTNAMELEN];
2320:
1.33 markus 2321: for (display_number = x11_display_offset;
1.25 markus 2322: display_number < MAX_DISPLAYS;
2323: display_number++) {
2324: port = 6000 + display_number;
1.35 markus 2325: memset(&hints, 0, sizeof(hints));
2326: hints.ai_family = IPv4or6;
1.36 markus 2327: hints.ai_flags = AI_PASSIVE; /* XXX loopback only ? */
1.35 markus 2328: hints.ai_socktype = SOCK_STREAM;
2329: snprintf(strport, sizeof strport, "%d", port);
2330: if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
2331: error("getaddrinfo: %.100s", gai_strerror(gaierr));
1.25 markus 2332: return NULL;
2333: }
1.35 markus 2334: for (ai = aitop; ai; ai = ai->ai_next) {
2335: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
2336: continue;
2337: sock = socket(ai->ai_family, SOCK_STREAM, 0);
2338: if (sock < 0) {
2339: error("socket: %.100s", strerror(errno));
2340: return NULL;
2341: }
2342: if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2343: debug("bind port %d: %.100s", port, strerror(errno));
2344: shutdown(sock, SHUT_RDWR);
2345: close(sock);
2346: for (n = 0; n < num_socks; n++) {
2347: shutdown(socks[n], SHUT_RDWR);
2348: close(socks[n]);
2349: }
2350: num_socks = 0;
2351: break;
2352: }
2353: socks[num_socks++] = sock;
2354: if (num_socks == NUM_SOCKS)
2355: break;
1.25 markus 2356: }
1.83 stevesk 2357: freeaddrinfo(aitop);
1.35 markus 2358: if (num_socks > 0)
2359: break;
1.25 markus 2360: }
2361: if (display_number >= MAX_DISPLAYS) {
2362: error("Failed to allocate internet-domain X11 display socket.");
2363: return NULL;
2364: }
2365: /* Start listening for connections on the socket. */
1.35 markus 2366: for (n = 0; n < num_socks; n++) {
2367: sock = socks[n];
2368: if (listen(sock, 5) < 0) {
2369: error("listen: %.100s", strerror(errno));
2370: shutdown(sock, SHUT_RDWR);
2371: close(sock);
2372: return NULL;
2373: }
1.25 markus 2374: }
1.35 markus 2375:
1.25 markus 2376: /* Set up a suitable value for the DISPLAY variable. */
2377: if (gethostname(hostname, sizeof(hostname)) < 0)
2378: fatal("gethostname: %.100s", strerror(errno));
1.35 markus 2379: snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
1.25 markus 2380: display_number, screen_number);
2381:
1.35 markus 2382: /* Allocate a channel for each socket. */
2383: for (n = 0; n < num_socks; n++) {
2384: sock = socks[n];
1.51 markus 2385: (void) channel_new("x11 listener",
2386: SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
2387: CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
1.71 markus 2388: 0, xstrdup("X11 inet listener"), 1);
1.35 markus 2389: }
1.1 deraadt 2390:
1.25 markus 2391: /* Return a suitable value for the DISPLAY environment variable. */
1.35 markus 2392: return xstrdup(display);
1.1 deraadt 2393: }
2394:
2395: #ifndef X_UNIX_PATH
2396: #define X_UNIX_PATH "/tmp/.X11-unix/X"
2397: #endif
2398:
1.127 itojun 2399: static int
1.77 markus 2400: connect_local_xsocket(u_int dnr)
1.1 deraadt 2401: {
1.25 markus 2402: static const char *const x_sockets[] = {
2403: X_UNIX_PATH "%u",
2404: "/var/X/.X11-unix/X" "%u",
2405: "/usr/spool/sockets/X11/" "%u",
2406: NULL
2407: };
2408: int sock;
2409: struct sockaddr_un addr;
2410: const char *const * path;
2411:
2412: for (path = x_sockets; *path; ++path) {
2413: sock = socket(AF_UNIX, SOCK_STREAM, 0);
2414: if (sock < 0)
2415: error("socket: %.100s", strerror(errno));
2416: memset(&addr, 0, sizeof(addr));
2417: addr.sun_family = AF_UNIX;
2418: snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
2419: if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
2420: return sock;
2421: close(sock);
2422: }
2423: error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
2424: return -1;
1.1 deraadt 2425: }
2426:
1.51 markus 2427: int
2428: x11_connect_display(void)
1.1 deraadt 2429: {
1.51 markus 2430: int display_number, sock = 0;
1.25 markus 2431: const char *display;
1.51 markus 2432: char buf[1024], *cp;
1.35 markus 2433: struct addrinfo hints, *ai, *aitop;
2434: char strport[NI_MAXSERV];
2435: int gaierr;
1.25 markus 2436:
2437: /* Try to open a socket for the local X server. */
2438: display = getenv("DISPLAY");
2439: if (!display) {
2440: error("DISPLAY not set.");
1.51 markus 2441: return -1;
1.25 markus 2442: }
1.27 markus 2443: /*
2444: * Now we decode the value of the DISPLAY variable and make a
2445: * connection to the real X server.
2446: */
2447:
2448: /*
2449: * Check if it is a unix domain socket. Unix domain displays are in
2450: * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
2451: */
1.25 markus 2452: if (strncmp(display, "unix:", 5) == 0 ||
2453: display[0] == ':') {
2454: /* Connect to the unix domain socket. */
2455: if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
2456: error("Could not parse display number from DISPLAY: %.100s",
2457: display);
1.51 markus 2458: return -1;
1.25 markus 2459: }
2460: /* Create a socket. */
2461: sock = connect_local_xsocket(display_number);
2462: if (sock < 0)
1.51 markus 2463: return -1;
1.25 markus 2464:
2465: /* OK, we now have a connection to the display. */
1.51 markus 2466: return sock;
1.25 markus 2467: }
1.27 markus 2468: /*
2469: * Connect to an inet socket. The DISPLAY value is supposedly
2470: * hostname:d[.s], where hostname may also be numeric IP address.
2471: */
1.25 markus 2472: strncpy(buf, display, sizeof(buf));
2473: buf[sizeof(buf) - 1] = 0;
2474: cp = strchr(buf, ':');
2475: if (!cp) {
2476: error("Could not find ':' in DISPLAY: %.100s", display);
1.51 markus 2477: return -1;
1.25 markus 2478: }
2479: *cp = 0;
1.27 markus 2480: /* buf now contains the host name. But first we parse the display number. */
1.25 markus 2481: if (sscanf(cp + 1, "%d", &display_number) != 1) {
2482: error("Could not parse display number from DISPLAY: %.100s",
2483: display);
1.51 markus 2484: return -1;
1.25 markus 2485: }
1.35 markus 2486:
2487: /* Look up the host address */
2488: memset(&hints, 0, sizeof(hints));
2489: hints.ai_family = IPv4or6;
2490: hints.ai_socktype = SOCK_STREAM;
2491: snprintf(strport, sizeof strport, "%d", 6000 + display_number);
2492: if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
2493: error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
1.51 markus 2494: return -1;
1.25 markus 2495: }
1.35 markus 2496: for (ai = aitop; ai; ai = ai->ai_next) {
2497: /* Create a socket. */
2498: sock = socket(ai->ai_family, SOCK_STREAM, 0);
2499: if (sock < 0) {
2500: debug("socket: %.100s", strerror(errno));
1.41 markus 2501: continue;
2502: }
2503: /* Connect it to the display. */
2504: if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2505: debug("connect %.100s port %d: %.100s", buf,
2506: 6000 + display_number, strerror(errno));
2507: close(sock);
2508: continue;
2509: }
2510: /* Success */
2511: break;
1.35 markus 2512: }
2513: freeaddrinfo(aitop);
2514: if (!ai) {
1.49 markus 2515: error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
1.35 markus 2516: strerror(errno));
1.51 markus 2517: return -1;
1.25 markus 2518: }
1.51 markus 2519: return sock;
2520: }
2521:
2522: /*
2523: * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
2524: * the remote channel number. We should do whatever we want, and respond
2525: * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
2526: */
2527:
2528: void
1.69 markus 2529: x11_input_open(int type, int plen, void *ctxt)
1.51 markus 2530: {
1.113 markus 2531: Channel *c = NULL;
2532: int remote_id, sock = 0;
1.51 markus 2533: char *remote_host;
1.25 markus 2534:
1.113 markus 2535: debug("Received X11 open request.");
1.51 markus 2536:
1.113 markus 2537: remote_id = packet_get_int();
1.121 markus 2538:
2539: if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {
1.113 markus 2540: remote_host = packet_get_string(NULL);
1.51 markus 2541: } else {
2542: remote_host = xstrdup("unknown (remote did not supply name)");
2543: }
1.113 markus 2544: packet_done();
1.25 markus 2545:
1.51 markus 2546: /* Obtain a connection to the real X display. */
2547: sock = x11_connect_display();
1.113 markus 2548: if (sock != -1) {
2549: /* Allocate a channel for this connection. */
2550: c = channel_new("connected x11 socket",
2551: SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0,
2552: remote_host, 1);
2553: if (c == NULL) {
2554: error("x11_input_open: channel_new failed");
2555: close(sock);
2556: } else {
2557: c->remote_id = remote_id;
2558: }
2559: }
2560: if (c == NULL) {
1.51 markus 2561: /* Send refusal to the remote host. */
2562: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1.113 markus 2563: packet_put_int(remote_id);
1.51 markus 2564: } else {
2565: /* Send a confirmation to the remote host. */
2566: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1.113 markus 2567: packet_put_int(remote_id);
2568: packet_put_int(c->self);
1.51 markus 2569: }
1.113 markus 2570: packet_send();
1.72 markus 2571: }
2572:
2573: /* dummy protocol handler that denies SSH-1 requests (agent/x11) */
2574: void
2575: deny_input_open(int type, int plen, void *ctxt)
2576: {
2577: int rchan = packet_get_int();
2578: switch(type){
2579: case SSH_SMSG_AGENT_OPEN:
2580: error("Warning: ssh server tried agent forwarding.");
2581: break;
2582: case SSH_SMSG_X11_OPEN:
2583: error("Warning: ssh server tried X11 forwarding.");
2584: break;
2585: default:
2586: error("deny_input_open: type %d plen %d", type, plen);
2587: break;
2588: }
2589: error("Warning: this is probably a break in attempt by a malicious server.");
2590: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2591: packet_put_int(rchan);
2592: packet_send();
1.1 deraadt 2593: }
2594:
1.27 markus 2595: /*
2596: * Requests forwarding of X11 connections, generates fake authentication
2597: * data, and enables authentication spoofing.
1.121 markus 2598: * This should be called in the client only.
1.27 markus 2599: */
1.49 markus 2600: void
1.51 markus 2601: x11_request_forwarding_with_spoofing(int client_session_id,
2602: const char *proto, const char *data)
1.1 deraadt 2603: {
1.77 markus 2604: u_int data_len = (u_int) strlen(data) / 2;
1.90 markus 2605: u_int i, value, len;
1.25 markus 2606: char *new_data;
2607: int screen_number;
2608: const char *cp;
2609: u_int32_t rand = 0;
2610:
2611: cp = getenv("DISPLAY");
2612: if (cp)
2613: cp = strchr(cp, ':');
2614: if (cp)
2615: cp = strchr(cp, '.');
2616: if (cp)
2617: screen_number = atoi(cp + 1);
2618: else
2619: screen_number = 0;
2620:
2621: /* Save protocol name. */
2622: x11_saved_proto = xstrdup(proto);
2623:
1.27 markus 2624: /*
2625: * Extract real authentication data and generate fake data of the
2626: * same length.
2627: */
1.25 markus 2628: x11_saved_data = xmalloc(data_len);
2629: x11_fake_data = xmalloc(data_len);
2630: for (i = 0; i < data_len; i++) {
2631: if (sscanf(data + 2 * i, "%2x", &value) != 1)
2632: fatal("x11_request_forwarding: bad authentication data: %.100s", data);
2633: if (i % 4 == 0)
2634: rand = arc4random();
2635: x11_saved_data[i] = value;
2636: x11_fake_data[i] = rand & 0xff;
2637: rand >>= 8;
2638: }
2639: x11_saved_data_len = data_len;
2640: x11_fake_data_len = data_len;
2641:
2642: /* Convert the fake data into hex. */
1.90 markus 2643: len = 2 * data_len + 1;
2644: new_data = xmalloc(len);
1.25 markus 2645: for (i = 0; i < data_len; i++)
1.90 markus 2646: snprintf(new_data + 2 * i, len - 2 * i,
2647: "%02x", (u_char) x11_fake_data[i]);
1.25 markus 2648:
2649: /* Send the request packet. */
1.51 markus 2650: if (compat20) {
2651: channel_request_start(client_session_id, "x11-req", 0);
2652: packet_put_char(0); /* XXX bool single connection */
2653: } else {
2654: packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2655: }
2656: packet_put_cstring(proto);
2657: packet_put_cstring(new_data);
1.25 markus 2658: packet_put_int(screen_number);
2659: packet_send();
2660: packet_write_wait();
2661: xfree(new_data);
1.1 deraadt 2662: }
2663:
1.121 markus 2664:
2665: /* -- agent forwarding */
2666:
1.1 deraadt 2667: /* Sends a message to the server to request authentication fd forwarding. */
2668:
1.49 markus 2669: void
1.25 markus 2670: auth_request_forwarding()
1.1 deraadt 2671: {
1.25 markus 2672: packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2673: packet_send();
2674: packet_write_wait();
1.1 deraadt 2675: }
2676:
1.27 markus 2677: /*
2678: * Returns the name of the forwarded authentication socket. Returns NULL if
2679: * there is no forwarded authentication socket. The returned value points to
2680: * a static buffer.
2681: */
1.1 deraadt 2682:
1.25 markus 2683: char *
2684: auth_get_socket_name()
1.1 deraadt 2685: {
1.121 markus 2686: return auth_sock_name;
1.1 deraadt 2687: }
2688:
1.12 markus 2689: /* removes the agent forwarding socket */
2690:
1.49 markus 2691: void
1.123 markus 2692: auth_sock_cleanup_proc(void *_pw)
1.25 markus 2693: {
1.123 markus 2694: struct passwd *pw = _pw;
2695:
1.122 markus 2696: if (auth_sock_name) {
1.123 markus 2697: temporarily_use_uid(pw);
1.122 markus 2698: unlink(auth_sock_name);
2699: rmdir(auth_sock_dir);
2700: auth_sock_name = NULL;
1.123 markus 2701: restore_uid();
1.122 markus 2702: }
1.12 markus 2703: }
2704:
1.27 markus 2705: /*
1.59 markus 2706: * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
1.27 markus 2707: * This starts forwarding authentication requests.
2708: */
1.1 deraadt 2709:
1.59 markus 2710: int
1.25 markus 2711: auth_input_request_forwarding(struct passwd * pw)
1.1 deraadt 2712: {
1.113 markus 2713: Channel *nc;
2714: int sock;
1.25 markus 2715: struct sockaddr_un sunaddr;
2716:
1.121 markus 2717: if (auth_get_socket_name() != NULL) {
2718: error("authentication forwarding requested twice.");
2719: return 0;
2720: }
1.25 markus 2721:
2722: /* Temporarily drop privileged uid for mkdir/bind. */
1.102 markus 2723: temporarily_use_uid(pw);
1.25 markus 2724:
2725: /* Allocate a buffer for the socket name, and format the name. */
1.121 markus 2726: auth_sock_name = xmalloc(MAXPATHLEN);
2727: auth_sock_dir = xmalloc(MAXPATHLEN);
2728: strlcpy(auth_sock_dir, "/tmp/ssh-XXXXXXXX", MAXPATHLEN);
1.25 markus 2729:
2730: /* Create private directory for socket */
1.121 markus 2731: if (mkdtemp(auth_sock_dir) == NULL) {
2732: packet_send_debug("Agent forwarding disabled: "
2733: "mkdtemp() failed: %.100s", strerror(errno));
1.59 markus 2734: restore_uid();
1.121 markus 2735: xfree(auth_sock_name);
2736: xfree(auth_sock_dir);
2737: auth_sock_name = NULL;
2738: auth_sock_dir = NULL;
1.59 markus 2739: return 0;
2740: }
1.121 markus 2741: snprintf(auth_sock_name, MAXPATHLEN, "%s/agent.%d",
2742: auth_sock_dir, (int) getpid());
1.25 markus 2743:
1.122 markus 2744: /* delete agent socket on fatal() */
1.123 markus 2745: fatal_add_cleanup(auth_sock_cleanup_proc, pw);
1.122 markus 2746:
1.25 markus 2747: /* Create the socket. */
2748: sock = socket(AF_UNIX, SOCK_STREAM, 0);
2749: if (sock < 0)
2750: packet_disconnect("socket: %.100s", strerror(errno));
2751:
2752: /* Bind it to the name. */
2753: memset(&sunaddr, 0, sizeof(sunaddr));
2754: sunaddr.sun_family = AF_UNIX;
1.121 markus 2755: strncpy(sunaddr.sun_path, auth_sock_name,
1.25 markus 2756: sizeof(sunaddr.sun_path));
2757:
2758: if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2759: packet_disconnect("bind: %.100s", strerror(errno));
2760:
2761: /* Restore the privileged uid. */
2762: restore_uid();
2763:
2764: /* Start listening on the socket. */
2765: if (listen(sock, 5) < 0)
2766: packet_disconnect("listen: %.100s", strerror(errno));
2767:
2768: /* Allocate a channel for the authentication agent socket. */
1.113 markus 2769: nc = channel_new("auth socket",
1.73 markus 2770: SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
2771: CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
2772: 0, xstrdup("auth socket"), 1);
1.113 markus 2773: if (nc == NULL) {
2774: error("auth_input_request_forwarding: channel_new failed");
1.123 markus 2775: auth_sock_cleanup_proc(pw);
1.124 markus 2776: fatal_remove_cleanup(auth_sock_cleanup_proc, pw);
1.113 markus 2777: close(sock);
2778: return 0;
2779: }
1.121 markus 2780: strlcpy(nc->path, auth_sock_name, sizeof(nc->path));
1.59 markus 2781: return 1;
1.1 deraadt 2782: }
2783:
2784: /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2785:
1.49 markus 2786: void
1.69 markus 2787: auth_input_open_request(int type, int plen, void *ctxt)
1.1 deraadt 2788: {
1.113 markus 2789: Channel *c = NULL;
2790: int remote_id, sock;
1.121 markus 2791: char *name;
1.41 markus 2792:
2793: packet_integrity_check(plen, 4, type);
1.25 markus 2794:
2795: /* Read the remote channel number from the message. */
1.113 markus 2796: remote_id = packet_get_int();
1.25 markus 2797:
1.27 markus 2798: /*
2799: * Get a connection to the local authentication agent (this may again
2800: * get forwarded).
2801: */
1.25 markus 2802: sock = ssh_get_authentication_socket();
2803:
1.27 markus 2804: /*
2805: * If we could not connect the agent, send an error message back to
2806: * the server. This should never happen unless the agent dies,
2807: * because authentication forwarding is only enabled if we have an
2808: * agent.
2809: */
1.113 markus 2810: if (sock >= 0) {
1.121 markus 2811: name = xstrdup("authentication agent connection");
2812: c = channel_new("", SSH_CHANNEL_OPEN, sock, sock,
2813: -1, 0, 0, 0, name, 1);
1.113 markus 2814: if (c == NULL) {
2815: error("auth_input_open_request: channel_new failed");
1.121 markus 2816: xfree(name);
1.113 markus 2817: close(sock);
2818: } else {
2819: c->remote_id = remote_id;
2820: }
2821: }
2822: if (c == NULL) {
1.25 markus 2823: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1.113 markus 2824: packet_put_int(remote_id);
2825: } else {
2826: /* Send a confirmation to the remote host. */
2827: debug("Forwarding authentication connection.");
2828: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2829: packet_put_int(remote_id);
2830: packet_put_int(c->self);
1.25 markus 2831: }
2832: packet_send();
1.1 deraadt 2833: }
![[BACK]](/icons/back.gif){kind=icon}
Return to channels.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh