Annotation of src/usr.bin/ssh/channels.c, Revision 1.52
1.1 deraadt 1: /*
1.49 markus 2: *
1.26 deraadt 3: * channels.c
1.49 markus 4: *
1.26 deraadt 5: * Author: Tatu Ylonen <ylo@cs.hut.fi>
1.49 markus 6: *
1.26 deraadt 7: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
8: * All rights reserved
1.49 markus 9: *
1.26 deraadt 10: * Created: Fri Mar 24 16:35:24 1995 ylo
1.49 markus 11: *
1.26 deraadt 12: * This file contains functions for generic socket connection forwarding.
13: * There is also code for initiating connection forwarding for X11 connections,
14: * arbitrary tcp/ip connections, and the authentication agent connection.
1.49 markus 15: *
1.44 markus 16: * SSH2 support added by Markus Friedl.
1.26 deraadt 17: */
1.1 deraadt 18:
19: #include "includes.h"
1.52 ! markus 20: RCSID("$Id: channels.c,v 1.51 2000/04/28 08:10:20 markus Exp $");
1.1 deraadt 21:
22: #include "ssh.h"
23: #include "packet.h"
24: #include "xmalloc.h"
25: #include "buffer.h"
26: #include "authfd.h"
27: #include "uidswap.h"
1.20 markus 28: #include "readconf.h"
1.3 deraadt 29: #include "servconf.h"
1.1 deraadt 30:
1.14 markus 31: #include "channels.h"
32: #include "nchan.h"
33: #include "compat.h"
34:
1.44 markus 35: #include "ssh2.h"
36:
1.1 deraadt 37: /* Maximum number of fake X11 displays to try. */
38: #define MAX_DISPLAYS 1000
39:
1.12 markus 40: /* Max len of agent socket */
41: #define MAX_SOCKET_NAME 100
42:
1.51 markus 43: /* default window/packet sizes for tcp/x11-fwd-channel */
44: #define CHAN_TCP_WINDOW_DEFAULT (8*1024)
45: #define CHAN_TCP_PACKET_DEFAULT (CHAN_TCP_WINDOW_DEFAULT/2)
46: #define CHAN_X11_WINDOW_DEFAULT (4*1024)
47: #define CHAN_X11_PACKET_DEFAULT (CHAN_X11_WINDOW_DEFAULT/2)
1.41 markus 48:
1.27 markus 49: /*
50: * Pointer to an array containing all allocated channels. The array is
51: * dynamically extended as needed.
52: */
1.1 deraadt 53: static Channel *channels = NULL;
54:
1.27 markus 55: /*
56: * Size of the channel array. All slots of the array must always be
57: * initialized (at least the type field); unused slots are marked with type
58: * SSH_CHANNEL_FREE.
59: */
1.1 deraadt 60: static int channels_alloc = 0;
61:
1.27 markus 62: /*
63: * Maximum file descriptor value used in any of the channels. This is
64: * updated in channel_allocate.
65: */
1.1 deraadt 66: static int channel_max_fd_value = 0;
67:
1.12 markus 68: /* Name and directory of socket for authentication agent forwarding. */
1.1 deraadt 69: static char *channel_forwarded_auth_socket_name = NULL;
1.25 markus 70: static char *channel_forwarded_auth_socket_dir = NULL;
1.1 deraadt 71:
72: /* Saved X11 authentication protocol name. */
73: char *x11_saved_proto = NULL;
74:
75: /* Saved X11 authentication data. This is the real data. */
76: char *x11_saved_data = NULL;
77: unsigned int x11_saved_data_len = 0;
78:
1.27 markus 79: /*
80: * Fake X11 authentication data. This is what the server will be sending us;
81: * we should replace any occurrences of this by the real data.
82: */
1.1 deraadt 83: char *x11_fake_data = NULL;
84: unsigned int x11_fake_data_len;
85:
1.27 markus 86: /*
87: * Data structure for storing which hosts are permitted for forward requests.
88: * The local sides of any remote forwards are stored in this array to prevent
89: * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
90: * network (which might be behind a firewall).
91: */
1.25 markus 92: typedef struct {
1.41 markus 93: char *host_to_connect; /* Connect to 'host'. */
94: u_short port_to_connect; /* Connect to 'port'. */
95: u_short listen_port; /* Remote side should listen port number. */
1.1 deraadt 96: } ForwardPermission;
97:
98: /* List of all permitted host/port pairs to connect. */
99: static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
100: /* Number of permitted host/port pairs in the array. */
101: static int num_permitted_opens = 0;
1.27 markus 102: /*
103: * If this is true, all opens are permitted. This is the case on the server
104: * on which we have to trust the client anyway, and the user could do
105: * anything after logging in anyway.
106: */
1.1 deraadt 107: static int all_opens_permitted = 0;
108:
109: /* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
110: static int have_hostname_in_open = 0;
111:
112: /* Sets specific protocol options. */
113:
1.49 markus 114: void
1.25 markus 115: channel_set_options(int hostname_in_open)
1.1 deraadt 116: {
1.25 markus 117: have_hostname_in_open = hostname_in_open;
1.1 deraadt 118: }
119:
1.27 markus 120: /*
121: * Permits opening to any host/port in SSH_MSG_PORT_OPEN. This is usually
122: * called by the server, because the user could connect to any port anyway,
123: * and the server has no way to know but to trust the client anyway.
124: */
1.1 deraadt 125:
1.49 markus 126: void
1.25 markus 127: channel_permit_all_opens()
1.1 deraadt 128: {
1.25 markus 129: all_opens_permitted = 1;
1.1 deraadt 130: }
131:
1.41 markus 132: /* lookup channel by id */
133:
134: Channel *
135: channel_lookup(int id)
136: {
137: Channel *c;
138: if (id < 0 && id > channels_alloc) {
139: log("channel_lookup: %d: bad id", id);
140: return NULL;
141: }
142: c = &channels[id];
143: if (c->type == SSH_CHANNEL_FREE) {
144: log("channel_lookup: %d: bad id: channel free", id);
145: return NULL;
146: }
147: return c;
148: }
149:
1.27 markus 150: /*
1.52 ! markus 151: * register filedescriptors for a channel, used when allocating a channel or
! 152: * when the channel consumer/producer is ready, e.g. shell exec'd
1.27 markus 153: */
1.1 deraadt 154:
1.52 ! markus 155: void
! 156: channel_register_fds(Channel *c, int rfd, int wfd, int efd, int extusage)
1.1 deraadt 157: {
1.25 markus 158: /* Update the maximum file descriptor value. */
1.41 markus 159: if (rfd > channel_max_fd_value)
160: channel_max_fd_value = rfd;
161: if (wfd > channel_max_fd_value)
162: channel_max_fd_value = wfd;
163: if (efd > channel_max_fd_value)
164: channel_max_fd_value = efd;
1.27 markus 165: /* XXX set close-on-exec -markus */
1.52 ! markus 166: c->rfd = rfd;
! 167: c->wfd = wfd;
! 168: c->sock = (rfd == wfd) ? rfd : -1;
! 169: c->efd = efd;
! 170: c->extended_usage = extusage;
! 171: }
! 172:
! 173: /*
! 174: * Allocate a new channel object and set its type and socket. This will cause
! 175: * remote_name to be freed.
! 176: */
! 177:
! 178: int
! 179: channel_new(char *ctype, int type, int rfd, int wfd, int efd,
! 180: int window, int maxpack, int extusage, char *remote_name)
! 181: {
! 182: int i, found;
! 183: Channel *c;
1.25 markus 184:
185: /* Do initial allocation if this is the first call. */
186: if (channels_alloc == 0) {
1.44 markus 187: chan_init();
1.25 markus 188: channels_alloc = 10;
189: channels = xmalloc(channels_alloc * sizeof(Channel));
190: for (i = 0; i < channels_alloc; i++)
191: channels[i].type = SSH_CHANNEL_FREE;
1.27 markus 192: /*
193: * Kludge: arrange a call to channel_stop_listening if we
194: * terminate with fatal().
195: */
1.25 markus 196: fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
197: }
198: /* Try to find a free slot where to put the new channel. */
199: for (found = -1, i = 0; i < channels_alloc; i++)
200: if (channels[i].type == SSH_CHANNEL_FREE) {
201: /* Found a free slot. */
202: found = i;
203: break;
204: }
205: if (found == -1) {
1.27 markus 206: /* There are no free slots. Take last+1 slot and expand the array. */
1.25 markus 207: found = channels_alloc;
208: channels_alloc += 10;
209: debug("channel: expanding %d", channels_alloc);
210: channels = xrealloc(channels, channels_alloc * sizeof(Channel));
211: for (i = found; i < channels_alloc; i++)
212: channels[i].type = SSH_CHANNEL_FREE;
213: }
214: /* Initialize and return new channel number. */
215: c = &channels[found];
216: buffer_init(&c->input);
217: buffer_init(&c->output);
1.41 markus 218: buffer_init(&c->extended);
1.25 markus 219: chan_init_iostates(c);
1.52 ! markus 220: channel_register_fds(c, rfd, wfd, efd, extusage);
1.25 markus 221: c->self = found;
222: c->type = type;
1.41 markus 223: c->ctype = ctype;
1.51 markus 224: c->local_window = window;
225: c->local_window_max = window;
226: c->local_consumed = 0;
227: c->local_maxpacket = maxpack;
1.25 markus 228: c->remote_id = -1;
229: c->remote_name = remote_name;
1.41 markus 230: c->remote_window = 0;
231: c->remote_maxpacket = 0;
232: c->cb_fn = NULL;
233: c->cb_arg = NULL;
234: c->cb_event = 0;
235: c->dettach_user = NULL;
1.25 markus 236: debug("channel %d: new [%s]", found, remote_name);
237: return found;
1.1 deraadt 238: }
1.52 ! markus 239: /* old interface XXX */
1.49 markus 240: int
1.41 markus 241: channel_allocate(int type, int sock, char *remote_name)
242: {
243: return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name);
244: }
1.1 deraadt 245:
1.52 ! markus 246:
! 247: /* Close all channel fd/socket. */
! 248:
! 249: void
! 250: channel_close_fds(Channel *c)
! 251: {
! 252: if (c->sock != -1) {
! 253: shutdown(c->sock, SHUT_RDWR);
! 254: close(c->sock);
! 255: c->sock = -1;
! 256: }
! 257: if (c->rfd != -1) {
! 258: close(c->rfd);
! 259: c->rfd = -1;
! 260: }
! 261: if (c->wfd != -1) {
! 262: close(c->wfd);
! 263: c->wfd = -1;
! 264: }
! 265: if (c->efd != -1) {
! 266: close(c->efd);
! 267: c->efd = -1;
! 268: }
! 269: }
! 270:
! 271: /* Free the channel and close its fd/socket. */
1.1 deraadt 272:
1.49 markus 273: void
1.41 markus 274: channel_free(int id)
1.1 deraadt 275: {
1.41 markus 276: Channel *c = channel_lookup(id);
277: if (c == NULL)
278: packet_disconnect("channel free: bad local channel %d", id);
279: debug("channel_free: channel %d: status: %s", id, channel_open_message());
1.44 markus 280: if (c->dettach_user != NULL) {
281: debug("channel_free: channel %d: dettaching channel user", id);
282: c->dettach_user(c->self, NULL);
283: }
1.52 ! markus 284: channel_close_fds(c);
1.41 markus 285: buffer_free(&c->input);
286: buffer_free(&c->output);
287: buffer_free(&c->extended);
288: c->type = SSH_CHANNEL_FREE;
289: if (c->remote_name) {
290: xfree(c->remote_name);
291: c->remote_name = NULL;
1.25 markus 292: }
1.1 deraadt 293: }
294:
1.27 markus 295: /*
1.41 markus 296: * 'channel_pre*' are called just before select() to add any bits relevant to
297: * channels in the select bitmasks.
298: */
299: /*
300: * 'channel_post*': perform any appropriate operations for channels which
301: * have events pending.
1.27 markus 302: */
1.41 markus 303: typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
304: chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
305: chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
306:
307: void
308: channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
309: {
310: FD_SET(c->sock, readset);
311: }
312:
313: void
314: channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
315: {
316: if (buffer_len(&c->input) < packet_get_maxsize())
317: FD_SET(c->sock, readset);
318: if (buffer_len(&c->output) > 0)
319: FD_SET(c->sock, writeset);
320: }
1.1 deraadt 321:
1.41 markus 322: void
323: channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
324: {
325: /* test whether sockets are 'alive' for read/write */
326: if (c->istate == CHAN_INPUT_OPEN)
327: if (buffer_len(&c->input) < packet_get_maxsize())
328: FD_SET(c->sock, readset);
329: if (c->ostate == CHAN_OUTPUT_OPEN ||
330: c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
331: if (buffer_len(&c->output) > 0) {
332: FD_SET(c->sock, writeset);
333: } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
334: chan_obuf_empty(c);
335: }
336: }
337: }
338:
339: void
1.44 markus 340: channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
341: {
342: if (c->istate == CHAN_INPUT_OPEN &&
343: c->remote_window > 0 &&
344: buffer_len(&c->input) < c->remote_window)
345: FD_SET(c->rfd, readset);
346: if (c->ostate == CHAN_OUTPUT_OPEN ||
347: c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
348: if (buffer_len(&c->output) > 0) {
349: FD_SET(c->wfd, writeset);
350: } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
351: chan_obuf_empty(c);
352: }
353: }
354: /** XXX check close conditions, too */
355: if (c->efd != -1) {
356: if (c->extended_usage == CHAN_EXTENDED_WRITE &&
357: buffer_len(&c->extended) > 0)
358: FD_SET(c->efd, writeset);
359: else if (c->extended_usage == CHAN_EXTENDED_READ &&
360: buffer_len(&c->extended) < c->remote_window)
361: FD_SET(c->efd, readset);
362: }
363: }
364:
365: void
1.41 markus 366: channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
367: {
368: if (buffer_len(&c->input) == 0) {
369: packet_start(SSH_MSG_CHANNEL_CLOSE);
370: packet_put_int(c->remote_id);
371: packet_send();
372: c->type = SSH_CHANNEL_CLOSED;
373: debug("Closing channel %d after input drain.", c->self);
374: }
375: }
376:
377: void
378: channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
379: {
380: if (buffer_len(&c->output) == 0)
381: channel_free(c->self);
1.49 markus 382: else
1.41 markus 383: FD_SET(c->sock, writeset);
384: }
385:
386: /*
387: * This is a special state for X11 authentication spoofing. An opened X11
388: * connection (when authentication spoofing is being done) remains in this
389: * state until the first packet has been completely read. The authentication
390: * data in that packet is then substituted by the real data if it matches the
391: * fake data, and the channel is put into normal mode.
1.51 markus 392: * XXX All this happens at the client side.
1.41 markus 393: */
394: int
395: x11_open_helper(Channel *c)
1.1 deraadt 396: {
1.25 markus 397: unsigned char *ucp;
398: unsigned int proto_len, data_len;
399:
1.41 markus 400: /* Check if the fixed size part of the packet is in buffer. */
401: if (buffer_len(&c->output) < 12)
402: return 0;
403:
404: /* Parse the lengths of variable-length fields. */
405: ucp = (unsigned char *) buffer_ptr(&c->output);
406: if (ucp[0] == 0x42) { /* Byte order MSB first. */
407: proto_len = 256 * ucp[6] + ucp[7];
408: data_len = 256 * ucp[8] + ucp[9];
409: } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */
410: proto_len = ucp[6] + 256 * ucp[7];
411: data_len = ucp[8] + 256 * ucp[9];
412: } else {
413: debug("Initial X11 packet contains bad byte order byte: 0x%x",
414: ucp[0]);
415: return -1;
416: }
417:
418: /* Check if the whole packet is in buffer. */
419: if (buffer_len(&c->output) <
420: 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
421: return 0;
422:
423: /* Check if authentication protocol matches. */
424: if (proto_len != strlen(x11_saved_proto) ||
425: memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
426: debug("X11 connection uses different authentication protocol.");
427: return -1;
428: }
429: /* Check if authentication data matches our fake data. */
430: if (data_len != x11_fake_data_len ||
431: memcmp(ucp + 12 + ((proto_len + 3) & ~3),
432: x11_fake_data, x11_fake_data_len) != 0) {
433: debug("X11 auth data does not match fake data.");
434: return -1;
435: }
436: /* Check fake data length */
437: if (x11_fake_data_len != x11_saved_data_len) {
438: error("X11 fake_data_len %d != saved_data_len %d",
439: x11_fake_data_len, x11_saved_data_len);
440: return -1;
441: }
442: /*
443: * Received authentication protocol and data match
444: * our fake data. Substitute the fake data with real
445: * data.
446: */
447: memcpy(ucp + 12 + ((proto_len + 3) & ~3),
448: x11_saved_data, x11_saved_data_len);
449: return 1;
450: }
451:
452: void
453: channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
454: {
455: int ret = x11_open_helper(c);
456: if (ret == 1) {
457: /* Start normal processing for the channel. */
458: c->type = SSH_CHANNEL_OPEN;
1.47 markus 459: channel_pre_open_13(c, readset, writeset);
1.41 markus 460: } else if (ret == -1) {
461: /*
462: * We have received an X11 connection that has bad
463: * authentication information.
464: */
465: log("X11 connection rejected because of wrong authentication.\r\n");
466: buffer_clear(&c->input);
467: buffer_clear(&c->output);
468: close(c->sock);
469: c->sock = -1;
470: c->type = SSH_CHANNEL_CLOSED;
471: packet_start(SSH_MSG_CHANNEL_CLOSE);
472: packet_put_int(c->remote_id);
473: packet_send();
474: }
475: }
1.25 markus 476:
1.41 markus 477: void
1.51 markus 478: channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
1.41 markus 479: {
480: int ret = x11_open_helper(c);
481: if (ret == 1) {
482: c->type = SSH_CHANNEL_OPEN;
1.47 markus 483: channel_pre_open_15(c, readset, writeset);
1.41 markus 484: } else if (ret == -1) {
485: debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
1.51 markus 486: chan_read_failed(c); /** force close? */
1.41 markus 487: chan_write_failed(c);
488: debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
489: }
490: }
1.25 markus 491:
1.41 markus 492: /* This is our fake X11 server socket. */
493: void
494: channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
495: {
496: struct sockaddr addr;
497: int newsock, newch;
498: socklen_t addrlen;
499: char buf[16384], *remote_hostname;
1.51 markus 500: int remote_port;
1.25 markus 501:
1.41 markus 502: if (FD_ISSET(c->sock, readset)) {
503: debug("X11 connection requested.");
504: addrlen = sizeof(addr);
505: newsock = accept(c->sock, &addr, &addrlen);
506: if (newsock < 0) {
507: error("accept: %.100s", strerror(errno));
508: return;
509: }
510: remote_hostname = get_remote_hostname(newsock);
1.51 markus 511: remote_port = get_peer_port(newsock);
1.41 markus 512: snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
1.51 markus 513: remote_hostname, remote_port);
514:
515: newch = channel_new("x11",
516: SSH_CHANNEL_OPENING, newsock, newsock, -1,
517: c->local_window_max, c->local_maxpacket,
518: 0, xstrdup(buf));
519: if (compat20) {
520: packet_start(SSH2_MSG_CHANNEL_OPEN);
521: packet_put_cstring("x11");
522: packet_put_int(newch);
523: packet_put_int(c->local_window_max);
524: packet_put_int(c->local_maxpacket);
525: /* originator host and port */
526: packet_put_cstring(remote_hostname);
527: packet_put_int(remote_port);
528: packet_send();
529: } else {
530: packet_start(SSH_SMSG_X11_OPEN);
531: packet_put_int(newch);
532: if (have_hostname_in_open)
533: packet_put_string(buf, strlen(buf));
534: packet_send();
535: }
1.41 markus 536: xfree(remote_hostname);
537: }
538: }
1.25 markus 539:
1.41 markus 540: /*
541: * This socket is listening for connections to a forwarded TCP/IP port.
542: */
543: void
544: channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
545: {
546: struct sockaddr addr;
547: int newsock, newch;
548: socklen_t addrlen;
549: char buf[1024], *remote_hostname;
550: int remote_port;
1.25 markus 551:
1.41 markus 552: if (FD_ISSET(c->sock, readset)) {
553: debug("Connection to port %d forwarding "
554: "to %.100s port %d requested.",
555: c->listening_port, c->path, c->host_port);
556: addrlen = sizeof(addr);
557: newsock = accept(c->sock, &addr, &addrlen);
558: if (newsock < 0) {
559: error("accept: %.100s", strerror(errno));
560: return;
561: }
562: remote_hostname = get_remote_hostname(newsock);
563: remote_port = get_peer_port(newsock);
564: snprintf(buf, sizeof buf,
565: "listen port %d for %.100s port %d, "
566: "connect from %.200s port %d",
567: c->listening_port, c->path, c->host_port,
568: remote_hostname, remote_port);
569: newch = channel_new("direct-tcpip",
570: SSH_CHANNEL_OPENING, newsock, newsock, -1,
571: c->local_window_max, c->local_maxpacket,
572: 0, xstrdup(buf));
1.44 markus 573: if (compat20) {
574: packet_start(SSH2_MSG_CHANNEL_OPEN);
575: packet_put_cstring("direct-tcpip");
576: packet_put_int(newch);
577: packet_put_int(c->local_window_max);
578: packet_put_int(c->local_maxpacket);
1.48 markus 579: /* target host and port */
1.44 markus 580: packet_put_string(c->path, strlen(c->path));
581: packet_put_int(c->host_port);
1.48 markus 582: /* originator host and port */
1.44 markus 583: packet_put_cstring(remote_hostname);
584: packet_put_int(remote_port);
585: packet_send();
586: } else {
587: packet_start(SSH_MSG_PORT_OPEN);
588: packet_put_int(newch);
589: packet_put_string(c->path, strlen(c->path));
590: packet_put_int(c->host_port);
591: if (have_hostname_in_open) {
592: packet_put_string(buf, strlen(buf));
593: }
594: packet_send();
1.41 markus 595: }
596: xfree(remote_hostname);
597: }
598: }
1.25 markus 599:
1.41 markus 600: /*
601: * This is the authentication agent socket listening for connections from
602: * clients.
603: */
604: void
605: channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
606: {
607: struct sockaddr addr;
608: int newsock, newch;
609: socklen_t addrlen;
1.25 markus 610:
1.41 markus 611: if (FD_ISSET(c->sock, readset)) {
612: addrlen = sizeof(addr);
613: newsock = accept(c->sock, &addr, &addrlen);
614: if (newsock < 0) {
615: error("accept from auth socket: %.100s", strerror(errno));
616: return;
617: }
618: newch = channel_allocate(SSH_CHANNEL_OPENING, newsock,
619: xstrdup("accepted auth socket"));
620: packet_start(SSH_SMSG_AGENT_OPEN);
621: packet_put_int(newch);
622: packet_send();
623: }
624: }
1.25 markus 625:
1.41 markus 626: int
627: channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
628: {
629: char buf[16*1024];
630: int len;
1.25 markus 631:
1.41 markus 632: if (c->rfd != -1 &&
633: FD_ISSET(c->rfd, readset)) {
634: len = read(c->rfd, buf, sizeof(buf));
635: if (len <= 0) {
1.51 markus 636: debug("channel %d: read<=0 rfd %d len %d",
1.41 markus 637: c->self, c->rfd, len);
1.25 markus 638: if (compat13) {
1.41 markus 639: buffer_consume(&c->output, buffer_len(&c->output));
640: c->type = SSH_CHANNEL_INPUT_DRAINING;
641: debug("Channel %d status set to input draining.", c->self);
1.25 markus 642: } else {
1.41 markus 643: chan_read_failed(c);
1.25 markus 644: }
1.41 markus 645: return -1;
646: }
647: buffer_append(&c->input, buf, len);
648: }
649: return 1;
650: }
651: int
652: channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
653: {
654: int len;
1.25 markus 655:
1.41 markus 656: /* Send buffered output data to the socket. */
657: if (c->wfd != -1 &&
658: FD_ISSET(c->wfd, writeset) &&
659: buffer_len(&c->output) > 0) {
660: len = write(c->wfd, buffer_ptr(&c->output),
661: buffer_len(&c->output));
662: if (len <= 0) {
663: if (compat13) {
664: buffer_consume(&c->output, buffer_len(&c->output));
665: debug("Channel %d status set to input draining.", c->self);
666: c->type = SSH_CHANNEL_INPUT_DRAINING;
667: } else {
668: chan_write_failed(c);
669: }
670: return -1;
1.25 markus 671: }
1.41 markus 672: buffer_consume(&c->output, len);
1.44 markus 673: if (compat20 && len > 0) {
674: c->local_consumed += len;
675: }
676: }
677: return 1;
678: }
679: int
680: channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
681: {
682: char buf[16*1024];
683: int len;
684:
1.45 markus 685: /** XXX handle drain efd, too */
1.44 markus 686: if (c->efd != -1) {
687: if (c->extended_usage == CHAN_EXTENDED_WRITE &&
688: FD_ISSET(c->efd, writeset) &&
689: buffer_len(&c->extended) > 0) {
690: len = write(c->efd, buffer_ptr(&c->extended),
691: buffer_len(&c->extended));
692: debug("channel %d: written %d to efd %d",
693: c->self, len, c->efd);
694: if (len > 0) {
695: buffer_consume(&c->extended, len);
696: c->local_consumed += len;
697: }
698: } else if (c->extended_usage == CHAN_EXTENDED_READ &&
699: FD_ISSET(c->efd, readset)) {
700: len = read(c->efd, buf, sizeof(buf));
701: debug("channel %d: read %d from efd %d",
702: c->self, len, c->efd);
1.45 markus 703: if (len == 0) {
704: debug("channel %d: closing efd %d",
705: c->self, c->efd);
706: close(c->efd);
707: c->efd = -1;
708: } else if (len > 0)
1.44 markus 709: buffer_append(&c->extended, buf, len);
710: }
711: }
712: return 1;
713: }
714: int
715: channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
716: {
1.46 markus 717: if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
1.44 markus 718: c->local_window < c->local_window_max/2 &&
719: c->local_consumed > 0) {
720: packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
721: packet_put_int(c->remote_id);
722: packet_put_int(c->local_consumed);
723: packet_send();
724: debug("channel %d: window %d sent adjust %d",
725: c->self, c->local_window,
726: c->local_consumed);
727: c->local_window += c->local_consumed;
728: c->local_consumed = 0;
1.1 deraadt 729: }
1.41 markus 730: return 1;
1.1 deraadt 731: }
732:
1.41 markus 733: void
734: channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
735: {
736: channel_handle_rfd(c, readset, writeset);
737: channel_handle_wfd(c, readset, writeset);
738: }
1.1 deraadt 739:
1.41 markus 740: void
1.44 markus 741: channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
742: {
743: channel_handle_rfd(c, readset, writeset);
744: channel_handle_wfd(c, readset, writeset);
745: channel_handle_efd(c, readset, writeset);
746: channel_check_window(c, readset, writeset);
747: }
748:
749: void
1.41 markus 750: channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
1.1 deraadt 751: {
1.41 markus 752: int len;
753: /* Send buffered output data to the socket. */
754: if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
755: len = write(c->sock, buffer_ptr(&c->output),
756: buffer_len(&c->output));
757: if (len <= 0)
758: buffer_consume(&c->output, buffer_len(&c->output));
759: else
760: buffer_consume(&c->output, len);
761: }
762: }
1.25 markus 763:
1.41 markus 764: void
1.44 markus 765: channel_handler_init_20(void)
766: {
767: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20;
1.51 markus 768: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
1.44 markus 769: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
1.51 markus 770: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
1.44 markus 771:
772: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2;
773: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
1.51 markus 774: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
1.44 markus 775: }
776:
777: void
1.41 markus 778: channel_handler_init_13(void)
779: {
780: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13;
781: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13;
782: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
783: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
784: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
785: channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining;
786: channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining;
1.25 markus 787:
1.41 markus 788: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
789: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
790: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
791: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
792: channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13;
793: }
1.25 markus 794:
1.41 markus 795: void
796: channel_handler_init_15(void)
797: {
798: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15;
1.51 markus 799: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
1.41 markus 800: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
801: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
802: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
1.25 markus 803:
1.41 markus 804: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
805: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
806: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
807: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
808: }
1.27 markus 809:
1.41 markus 810: void
811: channel_handler_init(void)
812: {
813: int i;
814: for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
815: channel_pre[i] = NULL;
816: channel_post[i] = NULL;
817: }
1.44 markus 818: if (compat20)
819: channel_handler_init_20();
820: else if (compat13)
1.41 markus 821: channel_handler_init_13();
822: else
823: channel_handler_init_15();
824: }
1.25 markus 825:
1.49 markus 826: void
1.41 markus 827: channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
828: {
829: static int did_init = 0;
830: int i;
831: Channel *c;
1.25 markus 832:
1.41 markus 833: if (!did_init) {
834: channel_handler_init();
835: did_init = 1;
836: }
837: for (i = 0; i < channels_alloc; i++) {
838: c = &channels[i];
839: if (c->type == SSH_CHANNEL_FREE)
840: continue;
841: if (ftab[c->type] == NULL)
1.25 markus 842: continue;
1.41 markus 843: (*ftab[c->type])(c, readset, writeset);
1.44 markus 844: chan_delete_if_full_closed(c);
1.1 deraadt 845: }
846: }
847:
1.49 markus 848: void
1.41 markus 849: channel_prepare_select(fd_set * readset, fd_set * writeset)
850: {
851: channel_handler(channel_pre, readset, writeset);
852: }
853:
1.49 markus 854: void
1.41 markus 855: channel_after_select(fd_set * readset, fd_set * writeset)
856: {
857: channel_handler(channel_post, readset, writeset);
858: }
859:
1.1 deraadt 860: /* If there is data to send to the connection, send some of it now. */
861:
1.49 markus 862: void
1.25 markus 863: channel_output_poll()
1.1 deraadt 864: {
1.25 markus 865: int len, i;
1.41 markus 866: Channel *c;
1.1 deraadt 867:
1.25 markus 868: for (i = 0; i < channels_alloc; i++) {
1.41 markus 869: c = &channels[i];
1.37 markus 870:
1.27 markus 871: /* We are only interested in channels that can have buffered incoming data. */
1.37 markus 872: if (compat13) {
1.41 markus 873: if (c->type != SSH_CHANNEL_OPEN &&
874: c->type != SSH_CHANNEL_INPUT_DRAINING)
1.37 markus 875: continue;
876: } else {
1.41 markus 877: if (c->type != SSH_CHANNEL_OPEN)
1.37 markus 878: continue;
1.41 markus 879: if (c->istate != CHAN_INPUT_OPEN &&
880: c->istate != CHAN_INPUT_WAIT_DRAIN)
1.37 markus 881: continue;
882: }
1.46 markus 883: if (compat20 &&
884: (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
1.44 markus 885: debug("channel: %d: no data after CLOSE", c->self);
886: continue;
887: }
1.25 markus 888:
889: /* Get the amount of buffered data for this channel. */
1.41 markus 890: len = buffer_len(&c->input);
1.25 markus 891: if (len > 0) {
1.27 markus 892: /* Send some data for the other side over the secure connection. */
1.44 markus 893: if (compat20) {
894: if (len > c->remote_window)
895: len = c->remote_window;
896: if (len > c->remote_maxpacket)
897: len = c->remote_maxpacket;
1.25 markus 898: } else {
1.44 markus 899: if (packet_is_interactive()) {
900: if (len > 1024)
901: len = 512;
902: } else {
903: /* Keep the packets at reasonable size. */
904: if (len > packet_get_maxsize()/2)
905: len = packet_get_maxsize()/2;
906: }
1.25 markus 907: }
1.41 markus 908: if (len > 0) {
1.44 markus 909: packet_start(compat20 ?
910: SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
1.41 markus 911: packet_put_int(c->remote_id);
912: packet_put_string(buffer_ptr(&c->input), len);
913: packet_send();
914: buffer_consume(&c->input, len);
915: c->remote_window -= len;
1.44 markus 916: debug("channel %d: send data len %d", c->self, len);
1.41 markus 917: }
918: } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
1.25 markus 919: if (compat13)
920: fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
1.27 markus 921: /*
922: * input-buffer is empty and read-socket shutdown:
923: * tell peer, that we will not send more data: send IEOF
924: */
1.41 markus 925: chan_ibuf_empty(c);
1.25 markus 926: }
1.44 markus 927: /* Send extended data, i.e. stderr */
928: if (compat20 &&
929: c->remote_window > 0 &&
930: (len = buffer_len(&c->extended)) > 0 &&
931: c->extended_usage == CHAN_EXTENDED_READ) {
932: if (len > c->remote_window)
933: len = c->remote_window;
934: if (len > c->remote_maxpacket)
935: len = c->remote_maxpacket;
936: packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
937: packet_put_int(c->remote_id);
938: packet_put_int(SSH2_EXTENDED_DATA_STDERR);
939: packet_put_string(buffer_ptr(&c->extended), len);
940: packet_send();
941: buffer_consume(&c->extended, len);
942: c->remote_window -= len;
943: }
1.25 markus 944: }
1.1 deraadt 945: }
946:
1.27 markus 947: /*
948: * This is called when a packet of type CHANNEL_DATA has just been received.
949: * The message type has already been consumed, but channel number and data is
950: * still there.
951: */
1.1 deraadt 952:
1.49 markus 953: void
1.41 markus 954: channel_input_data(int type, int plen)
1.1 deraadt 955: {
1.37 markus 956: int id;
1.25 markus 957: char *data;
958: unsigned int data_len;
1.41 markus 959: Channel *c;
1.25 markus 960:
961: /* Get the channel number and verify it. */
1.37 markus 962: id = packet_get_int();
1.41 markus 963: c = channel_lookup(id);
964: if (c == NULL)
1.37 markus 965: packet_disconnect("Received data for nonexistent channel %d.", id);
1.25 markus 966:
967: /* Ignore any data for non-open channels (might happen on close) */
1.41 markus 968: if (c->type != SSH_CHANNEL_OPEN &&
969: c->type != SSH_CHANNEL_X11_OPEN)
1.37 markus 970: return;
971:
972: /* same for protocol 1.5 if output end is no longer open */
1.41 markus 973: if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
1.25 markus 974: return;
975:
976: /* Get the data. */
977: data = packet_get_string(&data_len);
1.48 markus 978: packet_done();
1.41 markus 979:
1.44 markus 980: if (compat20){
981: if (data_len > c->local_maxpacket) {
982: log("channel %d: rcvd big packet %d, maxpack %d",
983: c->self, data_len, c->local_maxpacket);
984: }
985: if (data_len > c->local_window) {
986: log("channel %d: rcvd too much data %d, win %d",
987: c->self, data_len, c->local_window);
988: xfree(data);
989: return;
990: }
991: c->local_window -= data_len;
992: }else{
993: packet_integrity_check(plen, 4 + 4 + data_len, type);
994: }
1.41 markus 995: buffer_append(&c->output, data, data_len);
1.25 markus 996: xfree(data);
1.1 deraadt 997: }
1.49 markus 998: void
1.44 markus 999: channel_input_extended_data(int type, int plen)
1000: {
1001: int id;
1002: int tcode;
1003: char *data;
1004: unsigned int data_len;
1005: Channel *c;
1006:
1007: /* Get the channel number and verify it. */
1008: id = packet_get_int();
1009: c = channel_lookup(id);
1010:
1011: if (c == NULL)
1012: packet_disconnect("Received extended_data for bad channel %d.", id);
1013: if (c->type != SSH_CHANNEL_OPEN) {
1014: log("channel %d: ext data for non open", id);
1015: return;
1016: }
1017: tcode = packet_get_int();
1018: if (c->efd == -1 ||
1019: c->extended_usage != CHAN_EXTENDED_WRITE ||
1020: tcode != SSH2_EXTENDED_DATA_STDERR) {
1021: log("channel %d: bad ext data", c->self);
1022: return;
1023: }
1024: data = packet_get_string(&data_len);
1.48 markus 1025: packet_done();
1.44 markus 1026: if (data_len > c->local_window) {
1027: log("channel %d: rcvd too much extended_data %d, win %d",
1028: c->self, data_len, c->local_window);
1029: xfree(data);
1030: return;
1031: }
1032: debug("channel %d: rcvd ext data %d", c->self, data_len);
1033: c->local_window -= data_len;
1034: buffer_append(&c->extended, data, data_len);
1035: xfree(data);
1036: }
1037:
1.1 deraadt 1038:
1.27 markus 1039: /*
1040: * Returns true if no channel has too much buffered data, and false if one or
1041: * more channel is overfull.
1042: */
1.1 deraadt 1043:
1.49 markus 1044: int
1.25 markus 1045: channel_not_very_much_buffered_data()
1.1 deraadt 1046: {
1.25 markus 1047: unsigned int i;
1.41 markus 1048: Channel *c;
1.25 markus 1049:
1050: for (i = 0; i < channels_alloc; i++) {
1.41 markus 1051: c = &channels[i];
1052: if (c->type == SSH_CHANNEL_OPEN) {
1.44 markus 1053: if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
1.41 markus 1054: debug("channel %d: big input buffer %d",
1055: c->self, buffer_len(&c->input));
1.25 markus 1056: return 0;
1.41 markus 1057: }
1058: if (buffer_len(&c->output) > packet_get_maxsize()) {
1059: debug("channel %d: big output buffer %d",
1060: c->self, buffer_len(&c->output));
1.25 markus 1061: return 0;
1.41 markus 1062: }
1.25 markus 1063: }
1.1 deraadt 1064: }
1.25 markus 1065: return 1;
1.1 deraadt 1066: }
1067:
1.49 markus 1068: void
1.41 markus 1069: channel_input_ieof(int type, int plen)
1070: {
1071: int id;
1072: Channel *c;
1073:
1074: packet_integrity_check(plen, 4, type);
1075:
1076: id = packet_get_int();
1077: c = channel_lookup(id);
1078: if (c == NULL)
1079: packet_disconnect("Received ieof for nonexistent channel %d.", id);
1080: chan_rcvd_ieof(c);
1081: }
1.1 deraadt 1082:
1.49 markus 1083: void
1.41 markus 1084: channel_input_close(int type, int plen)
1.1 deraadt 1085: {
1.41 markus 1086: int id;
1087: Channel *c;
1.1 deraadt 1088:
1.41 markus 1089: packet_integrity_check(plen, 4, type);
1090:
1091: id = packet_get_int();
1092: c = channel_lookup(id);
1093: if (c == NULL)
1094: packet_disconnect("Received close for nonexistent channel %d.", id);
1.27 markus 1095:
1096: /*
1097: * Send a confirmation that we have closed the channel and no more
1098: * data is coming for it.
1099: */
1.25 markus 1100: packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
1.41 markus 1101: packet_put_int(c->remote_id);
1.25 markus 1102: packet_send();
1103:
1.27 markus 1104: /*
1105: * If the channel is in closed state, we have sent a close request,
1106: * and the other side will eventually respond with a confirmation.
1107: * Thus, we cannot free the channel here, because then there would be
1108: * no-one to receive the confirmation. The channel gets freed when
1109: * the confirmation arrives.
1110: */
1.41 markus 1111: if (c->type != SSH_CHANNEL_CLOSED) {
1.27 markus 1112: /*
1113: * Not a closed channel - mark it as draining, which will
1114: * cause it to be freed later.
1115: */
1.41 markus 1116: buffer_consume(&c->input, buffer_len(&c->input));
1117: c->type = SSH_CHANNEL_OUTPUT_DRAINING;
1.25 markus 1118: }
1.1 deraadt 1119: }
1120:
1.41 markus 1121: /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
1.49 markus 1122: void
1.41 markus 1123: channel_input_oclose(int type, int plen)
1124: {
1125: int id = packet_get_int();
1126: Channel *c = channel_lookup(id);
1127: packet_integrity_check(plen, 4, type);
1128: if (c == NULL)
1129: packet_disconnect("Received oclose for nonexistent channel %d.", id);
1130: chan_rcvd_oclose(c);
1131: }
1.1 deraadt 1132:
1.49 markus 1133: void
1.41 markus 1134: channel_input_close_confirmation(int type, int plen)
1.1 deraadt 1135: {
1.41 markus 1136: int id = packet_get_int();
1137: Channel *c = channel_lookup(id);
1.1 deraadt 1138:
1.48 markus 1139: packet_done();
1.41 markus 1140: if (c == NULL)
1141: packet_disconnect("Received close confirmation for "
1142: "out-of-range channel %d.", id);
1143: if (c->type != SSH_CHANNEL_CLOSED)
1144: packet_disconnect("Received close confirmation for "
1145: "non-closed channel %d (type %d).", id, c->type);
1146: channel_free(c->self);
1.1 deraadt 1147: }
1148:
1.49 markus 1149: void
1.41 markus 1150: channel_input_open_confirmation(int type, int plen)
1.1 deraadt 1151: {
1.41 markus 1152: int id, remote_id;
1153: Channel *c;
1.1 deraadt 1154:
1.44 markus 1155: if (!compat20)
1156: packet_integrity_check(plen, 4 + 4, type);
1.25 markus 1157:
1.41 markus 1158: id = packet_get_int();
1159: c = channel_lookup(id);
1.25 markus 1160:
1.41 markus 1161: if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1162: packet_disconnect("Received open confirmation for "
1163: "non-opening channel %d.", id);
1164: remote_id = packet_get_int();
1.27 markus 1165: /* Record the remote channel number and mark that the channel is now open. */
1.41 markus 1166: c->remote_id = remote_id;
1167: c->type = SSH_CHANNEL_OPEN;
1.44 markus 1168:
1169: if (compat20) {
1170: c->remote_window = packet_get_int();
1171: c->remote_maxpacket = packet_get_int();
1.48 markus 1172: packet_done();
1.44 markus 1173: if (c->cb_fn != NULL && c->cb_event == type) {
1174: debug("callback start");
1175: c->cb_fn(c->self, c->cb_arg);
1176: debug("callback done");
1177: }
1178: debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1179: c->remote_window, c->remote_maxpacket);
1180: }
1.1 deraadt 1181: }
1182:
1.49 markus 1183: void
1.41 markus 1184: channel_input_open_failure(int type, int plen)
1.1 deraadt 1185: {
1.41 markus 1186: int id;
1187: Channel *c;
1188:
1.44 markus 1189: if (!compat20)
1190: packet_integrity_check(plen, 4, type);
1.41 markus 1191:
1192: id = packet_get_int();
1193: c = channel_lookup(id);
1.25 markus 1194:
1.41 markus 1195: if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1196: packet_disconnect("Received open failure for "
1197: "non-opening channel %d.", id);
1.44 markus 1198: if (compat20) {
1199: int reason = packet_get_int();
1200: char *msg = packet_get_string(NULL);
1.48 markus 1201: char *lang = packet_get_string(NULL);
1.44 markus 1202: log("channel_open_failure: %d: reason %d: %s", id, reason, msg);
1.48 markus 1203: packet_done();
1.44 markus 1204: xfree(msg);
1.48 markus 1205: xfree(lang);
1.44 markus 1206: }
1.25 markus 1207: /* Free the channel. This will also close the socket. */
1.41 markus 1208: channel_free(id);
1.1 deraadt 1209: }
1210:
1.44 markus 1211: void
1212: channel_input_channel_request(int type, int plen)
1213: {
1214: int id;
1215: Channel *c;
1216:
1217: id = packet_get_int();
1218: c = channel_lookup(id);
1219:
1220: if (c == NULL ||
1221: (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1222: packet_disconnect("Received request for "
1223: "non-open channel %d.", id);
1224: if (c->cb_fn != NULL && c->cb_event == type) {
1225: debug("callback start");
1226: c->cb_fn(c->self, c->cb_arg);
1227: debug("callback done");
1228: } else {
1229: char *service = packet_get_string(NULL);
1230: debug("channel: %d rcvd request for %s", c->self, service);
1231: debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
1232: xfree(service);
1233: }
1234: }
1235:
1.49 markus 1236: void
1.44 markus 1237: channel_input_window_adjust(int type, int plen)
1238: {
1239: Channel *c;
1240: int id, adjust;
1241:
1242: if (!compat20)
1243: return;
1244:
1245: /* Get the channel number and verify it. */
1246: id = packet_get_int();
1247: c = channel_lookup(id);
1248:
1249: if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1250: log("Received window adjust for "
1251: "non-open channel %d.", id);
1252: return;
1253: }
1254: adjust = packet_get_int();
1.48 markus 1255: packet_done();
1.44 markus 1256: debug("channel %d: rcvd adjust %d", id, adjust);
1257: c->remote_window += adjust;
1258: }
1259:
1.27 markus 1260: /*
1261: * Stops listening for channels, and removes any unix domain sockets that we
1262: * might have.
1263: */
1.1 deraadt 1264:
1.49 markus 1265: void
1.25 markus 1266: channel_stop_listening()
1.1 deraadt 1267: {
1.25 markus 1268: int i;
1269: for (i = 0; i < channels_alloc; i++) {
1270: switch (channels[i].type) {
1271: case SSH_CHANNEL_AUTH_SOCKET:
1272: close(channels[i].sock);
1273: remove(channels[i].path);
1274: channel_free(i);
1275: break;
1276: case SSH_CHANNEL_PORT_LISTENER:
1277: case SSH_CHANNEL_X11_LISTENER:
1278: close(channels[i].sock);
1279: channel_free(i);
1280: break;
1281: default:
1282: break;
1283: }
1.1 deraadt 1284: }
1285: }
1286:
1.27 markus 1287: /*
1.52 ! markus 1288: * Closes the sockets/fds of all channels. This is used to close extra file
1.27 markus 1289: * descriptors after a fork.
1290: */
1.1 deraadt 1291:
1.49 markus 1292: void
1.25 markus 1293: channel_close_all()
1.1 deraadt 1294: {
1.25 markus 1295: int i;
1.52 ! markus 1296: for (i = 0; i < channels_alloc; i++)
1.25 markus 1297: if (channels[i].type != SSH_CHANNEL_FREE)
1.52 ! markus 1298: channel_close_fds(&channels[i]);
1.1 deraadt 1299: }
1300:
1301: /* Returns the maximum file descriptor number used by the channels. */
1302:
1.49 markus 1303: int
1.25 markus 1304: channel_max_fd()
1.1 deraadt 1305: {
1.25 markus 1306: return channel_max_fd_value;
1.1 deraadt 1307: }
1308:
1309: /* Returns true if any channel is still open. */
1310:
1.49 markus 1311: int
1.25 markus 1312: channel_still_open()
1.1 deraadt 1313: {
1.25 markus 1314: unsigned int i;
1315: for (i = 0; i < channels_alloc; i++)
1316: switch (channels[i].type) {
1317: case SSH_CHANNEL_FREE:
1318: case SSH_CHANNEL_X11_LISTENER:
1319: case SSH_CHANNEL_PORT_LISTENER:
1320: case SSH_CHANNEL_CLOSED:
1321: case SSH_CHANNEL_AUTH_SOCKET:
1322: continue;
1.44 markus 1323: case SSH_CHANNEL_LARVAL:
1324: if (!compat20)
1325: fatal("cannot happen: SSH_CHANNEL_LARVAL");
1326: continue;
1.25 markus 1327: case SSH_CHANNEL_OPENING:
1328: case SSH_CHANNEL_OPEN:
1329: case SSH_CHANNEL_X11_OPEN:
1330: return 1;
1331: case SSH_CHANNEL_INPUT_DRAINING:
1332: case SSH_CHANNEL_OUTPUT_DRAINING:
1333: if (!compat13)
1334: fatal("cannot happen: OUT_DRAIN");
1335: return 1;
1336: default:
1337: fatal("channel_still_open: bad channel type %d", channels[i].type);
1338: /* NOTREACHED */
1339: }
1340: return 0;
1.1 deraadt 1341: }
1342:
1.27 markus 1343: /*
1344: * Returns a message describing the currently open forwarded connections,
1345: * suitable for sending to the client. The message contains crlf pairs for
1346: * newlines.
1347: */
1.1 deraadt 1348:
1.25 markus 1349: char *
1350: channel_open_message()
1.1 deraadt 1351: {
1.25 markus 1352: Buffer buffer;
1353: int i;
1354: char buf[512], *cp;
1355:
1356: buffer_init(&buffer);
1357: snprintf(buf, sizeof buf, "The following connections are open:\r\n");
1.1 deraadt 1358: buffer_append(&buffer, buf, strlen(buf));
1.25 markus 1359: for (i = 0; i < channels_alloc; i++) {
1360: Channel *c = &channels[i];
1361: switch (c->type) {
1362: case SSH_CHANNEL_FREE:
1363: case SSH_CHANNEL_X11_LISTENER:
1364: case SSH_CHANNEL_PORT_LISTENER:
1365: case SSH_CHANNEL_CLOSED:
1366: case SSH_CHANNEL_AUTH_SOCKET:
1367: continue;
1.44 markus 1368: case SSH_CHANNEL_LARVAL:
1.25 markus 1369: case SSH_CHANNEL_OPENING:
1370: case SSH_CHANNEL_OPEN:
1371: case SSH_CHANNEL_X11_OPEN:
1372: case SSH_CHANNEL_INPUT_DRAINING:
1373: case SSH_CHANNEL_OUTPUT_DRAINING:
1.41 markus 1374: snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
1.37 markus 1375: c->self, c->remote_name,
1376: c->type, c->remote_id,
1377: c->istate, buffer_len(&c->input),
1.41 markus 1378: c->ostate, buffer_len(&c->output),
1379: c->rfd, c->wfd);
1.25 markus 1380: buffer_append(&buffer, buf, strlen(buf));
1381: continue;
1382: default:
1.41 markus 1383: fatal("channel_open_message: bad channel type %d", c->type);
1.25 markus 1384: /* NOTREACHED */
1385: }
1386: }
1387: buffer_append(&buffer, "\0", 1);
1388: cp = xstrdup(buffer_ptr(&buffer));
1389: buffer_free(&buffer);
1390: return cp;
1.1 deraadt 1391: }
1392:
1.27 markus 1393: /*
1394: * Initiate forwarding of connections to local port "port" through the secure
1395: * channel to host:port from remote side.
1396: */
1.1 deraadt 1397:
1.49 markus 1398: void
1.31 markus 1399: channel_request_local_forwarding(u_short port, const char *host,
1.33 markus 1400: u_short host_port, int gateway_ports)
1.25 markus 1401: {
1.35 markus 1402: int success, ch, sock, on = 1;
1403: struct addrinfo hints, *ai, *aitop;
1404: char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1.28 markus 1405: struct linger linger;
1.25 markus 1406:
1407: if (strlen(host) > sizeof(channels[0].path) - 1)
1408: packet_disconnect("Forward host name too long.");
1409:
1.28 markus 1410: /*
1.35 markus 1411: * getaddrinfo returns a loopback address if the hostname is
1412: * set to NULL and hints.ai_flags is not AI_PASSIVE
1.28 markus 1413: */
1.35 markus 1414: memset(&hints, 0, sizeof(hints));
1415: hints.ai_family = IPv4or6;
1416: hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1417: hints.ai_socktype = SOCK_STREAM;
1418: snprintf(strport, sizeof strport, "%d", port);
1419: if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1420: packet_disconnect("getaddrinfo: fatal error");
1421:
1422: success = 0;
1423: for (ai = aitop; ai; ai = ai->ai_next) {
1424: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1425: continue;
1426: if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1427: strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1428: error("channel_request_local_forwarding: getnameinfo failed");
1429: continue;
1430: }
1431: /* Create a port to listen for the host. */
1432: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1433: if (sock < 0) {
1434: /* this is no error since kernel may not support ipv6 */
1435: verbose("socket: %.100s", strerror(errno));
1436: continue;
1437: }
1438: /*
1439: * Set socket options. We would like the socket to disappear
1440: * as soon as it has been closed for whatever reason.
1441: */
1442: setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1443: linger.l_onoff = 1;
1444: linger.l_linger = 5;
1445: setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1446: debug("Local forwarding listening on %s port %s.", ntop, strport);
1447:
1448: /* Bind the socket to the address. */
1449: if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1450: /* address can be in use ipv6 address is already bound */
1451: verbose("bind: %.100s", strerror(errno));
1452: close(sock);
1453: continue;
1454: }
1455: /* Start listening for connections on the socket. */
1456: if (listen(sock, 5) < 0) {
1457: error("listen: %.100s", strerror(errno));
1458: close(sock);
1459: continue;
1460: }
1461: /* Allocate a channel number for the socket. */
1.41 markus 1462: ch = channel_new(
1463: "port listener", SSH_CHANNEL_PORT_LISTENER,
1464: sock, sock, -1,
1.51 markus 1465: CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1.41 markus 1466: 0, xstrdup("port listener"));
1.35 markus 1467: strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
1468: channels[ch].host_port = host_port;
1469: channels[ch].listening_port = port;
1470: success = 1;
1471: }
1472: if (success == 0)
1473: packet_disconnect("cannot listen port: %d", port);
1474: freeaddrinfo(aitop);
1.25 markus 1475: }
1.1 deraadt 1476:
1.27 markus 1477: /*
1478: * Initiate forwarding of connections to port "port" on remote host through
1479: * the secure channel to host:port from local side.
1480: */
1.1 deraadt 1481:
1.49 markus 1482: void
1.41 markus 1483: channel_request_remote_forwarding(u_short listen_port, const char *host_to_connect,
1484: u_short port_to_connect)
1.25 markus 1485: {
1486: int payload_len;
1487: /* Record locally that connection to this host/port is permitted. */
1488: if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1489: fatal("channel_request_remote_forwarding: too many forwards");
1490:
1.41 markus 1491: permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
1492: permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
1493: permitted_opens[num_permitted_opens].listen_port = listen_port;
1.25 markus 1494: num_permitted_opens++;
1495:
1496: /* Send the forward request to the remote side. */
1.44 markus 1497: if (compat20) {
1498: const char *address_to_bind = "0.0.0.0";
1499: packet_start(SSH2_MSG_GLOBAL_REQUEST);
1500: packet_put_cstring("tcpip-forward");
1501: packet_put_char(0); /* boolean: want reply */
1502: packet_put_cstring(address_to_bind);
1503: packet_put_int(listen_port);
1504: } else {
1505: packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
1.50 markus 1506: packet_put_int(listen_port);
1507: packet_put_cstring(host_to_connect);
1.44 markus 1508: packet_put_int(port_to_connect);
1509: packet_send();
1510: packet_write_wait();
1511: /*
1512: * Wait for response from the remote side. It will send a disconnect
1513: * message on failure, and we will never see it here.
1514: */
1515: packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
1516: }
1.1 deraadt 1517: }
1518:
1.27 markus 1519: /*
1520: * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
1521: * listening for the port, and sends back a success reply (or disconnect
1522: * message if there was an error). This never returns if there was an error.
1523: */
1.1 deraadt 1524:
1.49 markus 1525: void
1.25 markus 1526: channel_input_port_forward_request(int is_root)
1.1 deraadt 1527: {
1.31 markus 1528: u_short port, host_port;
1.25 markus 1529: char *hostname;
1.1 deraadt 1530:
1.25 markus 1531: /* Get arguments from the packet. */
1532: port = packet_get_int();
1533: hostname = packet_get_string(NULL);
1534: host_port = packet_get_int();
1535:
1.27 markus 1536: /*
1537: * Check that an unprivileged user is not trying to forward a
1538: * privileged port.
1539: */
1.25 markus 1540: if (port < IPPORT_RESERVED && !is_root)
1541: packet_disconnect("Requested forwarding of port %d but user is not root.",
1542: port);
1.33 markus 1543: /*
1544: * Initiate forwarding,
1545: * bind port to localhost only (gateway ports == 0).
1546: */
1547: channel_request_local_forwarding(port, hostname, host_port, 0);
1.25 markus 1548:
1549: /* Free the argument string. */
1550: xfree(hostname);
1.1 deraadt 1551: }
1552:
1.41 markus 1553: /* XXX move to aux.c */
1554: int
1555: channel_connect_to(const char *host, u_short host_port)
1556: {
1557: struct addrinfo hints, *ai, *aitop;
1558: char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1559: int gaierr;
1560: int sock = -1;
1561:
1562: memset(&hints, 0, sizeof(hints));
1563: hints.ai_family = IPv4or6;
1564: hints.ai_socktype = SOCK_STREAM;
1565: snprintf(strport, sizeof strport, "%d", host_port);
1566: if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1567: error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
1568: return -1;
1569: }
1570: for (ai = aitop; ai; ai = ai->ai_next) {
1571: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1572: continue;
1573: if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1574: strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1575: error("channel_connect_to: getnameinfo failed");
1576: continue;
1577: }
1578: /* Create the socket. */
1579: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1580: if (sock < 0) {
1581: error("socket: %.100s", strerror(errno));
1582: continue;
1583: }
1584: /* Connect to the host/port. */
1585: if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1586: error("connect %.100s port %s: %.100s", ntop, strport,
1587: strerror(errno));
1588: close(sock);
1589: continue; /* fail -- try next */
1590: }
1591: break; /* success */
1592:
1593: }
1594: freeaddrinfo(aitop);
1595: if (!ai) {
1596: error("connect %.100s port %d: failed.", host, host_port);
1597: return -1;
1598: }
1599: /* success */
1600: return sock;
1601: }
1.27 markus 1602: /*
1603: * This is called after receiving PORT_OPEN message. This attempts to
1604: * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1605: * or CHANNEL_OPEN_FAILURE.
1606: */
1.1 deraadt 1607:
1.49 markus 1608: void
1.41 markus 1609: channel_input_port_open(int type, int plen)
1.1 deraadt 1610: {
1.31 markus 1611: u_short host_port;
1.25 markus 1612: char *host, *originator_string;
1.41 markus 1613: int remote_channel, sock = -1, newch, i, denied;
1.39 markus 1614: unsigned int host_len, originator_len;
1.25 markus 1615:
1616: /* Get remote channel number. */
1617: remote_channel = packet_get_int();
1618:
1619: /* Get host name to connect to. */
1620: host = packet_get_string(&host_len);
1621:
1622: /* Get port to connect to. */
1623: host_port = packet_get_int();
1624:
1625: /* Get remote originator name. */
1.29 markus 1626: if (have_hostname_in_open) {
1.25 markus 1627: originator_string = packet_get_string(&originator_len);
1.29 markus 1628: originator_len += 4; /* size of packet_int */
1629: } else {
1.25 markus 1630: originator_string = xstrdup("unknown (remote did not supply name)");
1.29 markus 1631: originator_len = 0; /* no originator supplied */
1632: }
1.25 markus 1633:
1.41 markus 1634: packet_integrity_check(plen,
1635: 4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
1.25 markus 1636:
1637: /* Check if opening that port is permitted. */
1.41 markus 1638: denied = 0;
1.25 markus 1639: if (!all_opens_permitted) {
1640: /* Go trough all permitted ports. */
1641: for (i = 0; i < num_permitted_opens; i++)
1.41 markus 1642: if (permitted_opens[i].port_to_connect == host_port &&
1643: strcmp(permitted_opens[i].host_to_connect, host) == 0)
1.25 markus 1644: break;
1645:
1646: /* Check if we found the requested port among those permitted. */
1647: if (i >= num_permitted_opens) {
1648: /* The port is not permitted. */
1649: log("Received request to connect to %.100s:%d, but the request was denied.",
1650: host, host_port);
1.41 markus 1651: denied = 1;
1.25 markus 1652: }
1653: }
1.41 markus 1654: sock = denied ? -1 : channel_connect_to(host, host_port);
1655: if (sock > 0) {
1656: /* Allocate a channel for this connection. */
1657: newch = channel_allocate(SSH_CHANNEL_OPEN, sock, originator_string);
1658: channels[newch].remote_id = remote_channel;
1659:
1660: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1661: packet_put_int(remote_channel);
1662: packet_put_int(newch);
1663: packet_send();
1664: } else {
1665: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1666: packet_put_int(remote_channel);
1667: packet_send();
1.25 markus 1668: }
1669: xfree(host);
1.1 deraadt 1670: }
1671:
1.27 markus 1672: /*
1673: * Creates an internet domain socket for listening for X11 connections.
1674: * Returns a suitable value for the DISPLAY variable, or NULL if an error
1675: * occurs.
1676: */
1.1 deraadt 1677:
1.35 markus 1678: #define NUM_SOCKS 10
1679:
1.25 markus 1680: char *
1.33 markus 1681: x11_create_display_inet(int screen_number, int x11_display_offset)
1.1 deraadt 1682: {
1.31 markus 1683: int display_number, sock;
1684: u_short port;
1.35 markus 1685: struct addrinfo hints, *ai, *aitop;
1686: char strport[NI_MAXSERV];
1687: int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1688: char display[512];
1.25 markus 1689: char hostname[MAXHOSTNAMELEN];
1690:
1.33 markus 1691: for (display_number = x11_display_offset;
1.25 markus 1692: display_number < MAX_DISPLAYS;
1693: display_number++) {
1694: port = 6000 + display_number;
1.35 markus 1695: memset(&hints, 0, sizeof(hints));
1696: hints.ai_family = IPv4or6;
1.36 markus 1697: hints.ai_flags = AI_PASSIVE; /* XXX loopback only ? */
1.35 markus 1698: hints.ai_socktype = SOCK_STREAM;
1699: snprintf(strport, sizeof strport, "%d", port);
1700: if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1701: error("getaddrinfo: %.100s", gai_strerror(gaierr));
1.25 markus 1702: return NULL;
1703: }
1.35 markus 1704: for (ai = aitop; ai; ai = ai->ai_next) {
1705: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1706: continue;
1707: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1708: if (sock < 0) {
1709: error("socket: %.100s", strerror(errno));
1710: return NULL;
1711: }
1712: if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1713: debug("bind port %d: %.100s", port, strerror(errno));
1714: shutdown(sock, SHUT_RDWR);
1715: close(sock);
1716: for (n = 0; n < num_socks; n++) {
1717: shutdown(socks[n], SHUT_RDWR);
1718: close(socks[n]);
1719: }
1720: num_socks = 0;
1721: break;
1722: }
1723: socks[num_socks++] = sock;
1724: if (num_socks == NUM_SOCKS)
1725: break;
1.25 markus 1726: }
1.35 markus 1727: if (num_socks > 0)
1728: break;
1.25 markus 1729: }
1730: if (display_number >= MAX_DISPLAYS) {
1731: error("Failed to allocate internet-domain X11 display socket.");
1732: return NULL;
1733: }
1734: /* Start listening for connections on the socket. */
1.35 markus 1735: for (n = 0; n < num_socks; n++) {
1736: sock = socks[n];
1737: if (listen(sock, 5) < 0) {
1738: error("listen: %.100s", strerror(errno));
1739: shutdown(sock, SHUT_RDWR);
1740: close(sock);
1741: return NULL;
1742: }
1.25 markus 1743: }
1.35 markus 1744:
1.25 markus 1745: /* Set up a suitable value for the DISPLAY variable. */
1746: if (gethostname(hostname, sizeof(hostname)) < 0)
1747: fatal("gethostname: %.100s", strerror(errno));
1.35 markus 1748: snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
1.25 markus 1749: display_number, screen_number);
1750:
1.35 markus 1751: /* Allocate a channel for each socket. */
1752: for (n = 0; n < num_socks; n++) {
1753: sock = socks[n];
1.51 markus 1754: (void) channel_new("x11 listener",
1755: SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
1756: CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
1757: 0, xstrdup("X11 inet listener"));
1.35 markus 1758: }
1.1 deraadt 1759:
1.25 markus 1760: /* Return a suitable value for the DISPLAY environment variable. */
1.35 markus 1761: return xstrdup(display);
1.1 deraadt 1762: }
1763:
1764: #ifndef X_UNIX_PATH
1765: #define X_UNIX_PATH "/tmp/.X11-unix/X"
1766: #endif
1767:
1768: static
1769: int
1.30 deraadt 1770: connect_local_xsocket(unsigned int dnr)
1.1 deraadt 1771: {
1.25 markus 1772: static const char *const x_sockets[] = {
1773: X_UNIX_PATH "%u",
1774: "/var/X/.X11-unix/X" "%u",
1775: "/usr/spool/sockets/X11/" "%u",
1776: NULL
1777: };
1778: int sock;
1779: struct sockaddr_un addr;
1780: const char *const * path;
1781:
1782: for (path = x_sockets; *path; ++path) {
1783: sock = socket(AF_UNIX, SOCK_STREAM, 0);
1784: if (sock < 0)
1785: error("socket: %.100s", strerror(errno));
1786: memset(&addr, 0, sizeof(addr));
1787: addr.sun_family = AF_UNIX;
1788: snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
1789: if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
1790: return sock;
1791: close(sock);
1792: }
1793: error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
1794: return -1;
1.1 deraadt 1795: }
1796:
1.51 markus 1797: int
1798: x11_connect_display(void)
1.1 deraadt 1799: {
1.51 markus 1800: int display_number, sock = 0;
1.25 markus 1801: const char *display;
1.51 markus 1802: char buf[1024], *cp;
1.35 markus 1803: struct addrinfo hints, *ai, *aitop;
1804: char strport[NI_MAXSERV];
1805: int gaierr;
1.25 markus 1806:
1807: /* Try to open a socket for the local X server. */
1808: display = getenv("DISPLAY");
1809: if (!display) {
1810: error("DISPLAY not set.");
1.51 markus 1811: return -1;
1.25 markus 1812: }
1.27 markus 1813: /*
1814: * Now we decode the value of the DISPLAY variable and make a
1815: * connection to the real X server.
1816: */
1817:
1818: /*
1819: * Check if it is a unix domain socket. Unix domain displays are in
1820: * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
1821: */
1.25 markus 1822: if (strncmp(display, "unix:", 5) == 0 ||
1823: display[0] == ':') {
1824: /* Connect to the unix domain socket. */
1825: if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
1826: error("Could not parse display number from DISPLAY: %.100s",
1827: display);
1.51 markus 1828: return -1;
1.25 markus 1829: }
1830: /* Create a socket. */
1831: sock = connect_local_xsocket(display_number);
1832: if (sock < 0)
1.51 markus 1833: return -1;
1.25 markus 1834:
1835: /* OK, we now have a connection to the display. */
1.51 markus 1836: return sock;
1.25 markus 1837: }
1.27 markus 1838: /*
1839: * Connect to an inet socket. The DISPLAY value is supposedly
1840: * hostname:d[.s], where hostname may also be numeric IP address.
1841: */
1.25 markus 1842: strncpy(buf, display, sizeof(buf));
1843: buf[sizeof(buf) - 1] = 0;
1844: cp = strchr(buf, ':');
1845: if (!cp) {
1846: error("Could not find ':' in DISPLAY: %.100s", display);
1.51 markus 1847: return -1;
1.25 markus 1848: }
1849: *cp = 0;
1.27 markus 1850: /* buf now contains the host name. But first we parse the display number. */
1.25 markus 1851: if (sscanf(cp + 1, "%d", &display_number) != 1) {
1852: error("Could not parse display number from DISPLAY: %.100s",
1853: display);
1.51 markus 1854: return -1;
1.25 markus 1855: }
1.35 markus 1856:
1857: /* Look up the host address */
1858: memset(&hints, 0, sizeof(hints));
1859: hints.ai_family = IPv4or6;
1860: hints.ai_socktype = SOCK_STREAM;
1861: snprintf(strport, sizeof strport, "%d", 6000 + display_number);
1862: if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
1863: error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
1.51 markus 1864: return -1;
1.25 markus 1865: }
1.35 markus 1866: for (ai = aitop; ai; ai = ai->ai_next) {
1867: /* Create a socket. */
1868: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1869: if (sock < 0) {
1870: debug("socket: %.100s", strerror(errno));
1.41 markus 1871: continue;
1872: }
1873: /* Connect it to the display. */
1874: if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1875: debug("connect %.100s port %d: %.100s", buf,
1876: 6000 + display_number, strerror(errno));
1877: close(sock);
1878: continue;
1879: }
1880: /* Success */
1881: break;
1.35 markus 1882: }
1883: freeaddrinfo(aitop);
1884: if (!ai) {
1.49 markus 1885: error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
1.35 markus 1886: strerror(errno));
1.51 markus 1887: return -1;
1.25 markus 1888: }
1.51 markus 1889: return sock;
1890: }
1891:
1892: /*
1893: * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
1894: * the remote channel number. We should do whatever we want, and respond
1895: * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
1896: */
1897:
1898: void
1899: x11_input_open(int type, int plen)
1900: {
1901: int remote_channel, sock = 0, newch;
1902: char *remote_host;
1903: unsigned int remote_len;
1.25 markus 1904:
1.51 markus 1905: /* Get remote channel number. */
1906: remote_channel = packet_get_int();
1907:
1908: /* Get remote originator name. */
1909: if (have_hostname_in_open) {
1910: remote_host = packet_get_string(&remote_len);
1911: remote_len += 4;
1912: } else {
1913: remote_host = xstrdup("unknown (remote did not supply name)");
1914: remote_len = 0;
1915: }
1.25 markus 1916:
1.51 markus 1917: debug("Received X11 open request.");
1918: packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
1.25 markus 1919:
1.51 markus 1920: /* Obtain a connection to the real X display. */
1921: sock = x11_connect_display();
1922: if (sock == -1) {
1923: /* Send refusal to the remote host. */
1924: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1925: packet_put_int(remote_channel);
1926: packet_send();
1927: } else {
1928: /* Allocate a channel for this connection. */
1929: newch = channel_allocate(
1930: (x11_saved_proto == NULL) ?
1931: SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
1932: sock, remote_host);
1933: channels[newch].remote_id = remote_channel;
1.25 markus 1934:
1.51 markus 1935: /* Send a confirmation to the remote host. */
1936: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1937: packet_put_int(remote_channel);
1938: packet_put_int(newch);
1939: packet_send();
1940: }
1.1 deraadt 1941: }
1942:
1.27 markus 1943: /*
1944: * Requests forwarding of X11 connections, generates fake authentication
1945: * data, and enables authentication spoofing.
1946: */
1.1 deraadt 1947:
1.49 markus 1948: void
1.51 markus 1949: x11_request_forwarding_with_spoofing(int client_session_id,
1950: const char *proto, const char *data)
1.1 deraadt 1951: {
1.25 markus 1952: unsigned int data_len = (unsigned int) strlen(data) / 2;
1953: unsigned int i, value;
1954: char *new_data;
1955: int screen_number;
1956: const char *cp;
1957: u_int32_t rand = 0;
1958:
1959: cp = getenv("DISPLAY");
1960: if (cp)
1961: cp = strchr(cp, ':');
1962: if (cp)
1963: cp = strchr(cp, '.');
1964: if (cp)
1965: screen_number = atoi(cp + 1);
1966: else
1967: screen_number = 0;
1968:
1969: /* Save protocol name. */
1970: x11_saved_proto = xstrdup(proto);
1971:
1.27 markus 1972: /*
1973: * Extract real authentication data and generate fake data of the
1974: * same length.
1975: */
1.25 markus 1976: x11_saved_data = xmalloc(data_len);
1977: x11_fake_data = xmalloc(data_len);
1978: for (i = 0; i < data_len; i++) {
1979: if (sscanf(data + 2 * i, "%2x", &value) != 1)
1980: fatal("x11_request_forwarding: bad authentication data: %.100s", data);
1981: if (i % 4 == 0)
1982: rand = arc4random();
1983: x11_saved_data[i] = value;
1984: x11_fake_data[i] = rand & 0xff;
1985: rand >>= 8;
1986: }
1987: x11_saved_data_len = data_len;
1988: x11_fake_data_len = data_len;
1989:
1990: /* Convert the fake data into hex. */
1991: new_data = xmalloc(2 * data_len + 1);
1992: for (i = 0; i < data_len; i++)
1993: sprintf(new_data + 2 * i, "%02x", (unsigned char) x11_fake_data[i]);
1994:
1995: /* Send the request packet. */
1.51 markus 1996: if (compat20) {
1997: channel_request_start(client_session_id, "x11-req", 0);
1998: packet_put_char(0); /* XXX bool single connection */
1999: } else {
2000: packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2001: }
2002: packet_put_cstring(proto);
2003: packet_put_cstring(new_data);
1.25 markus 2004: packet_put_int(screen_number);
2005: packet_send();
2006: packet_write_wait();
2007: xfree(new_data);
1.1 deraadt 2008: }
2009:
2010: /* Sends a message to the server to request authentication fd forwarding. */
2011:
1.49 markus 2012: void
1.25 markus 2013: auth_request_forwarding()
1.1 deraadt 2014: {
1.25 markus 2015: packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2016: packet_send();
2017: packet_write_wait();
1.1 deraadt 2018: }
2019:
1.27 markus 2020: /*
2021: * Returns the name of the forwarded authentication socket. Returns NULL if
2022: * there is no forwarded authentication socket. The returned value points to
2023: * a static buffer.
2024: */
1.1 deraadt 2025:
1.25 markus 2026: char *
2027: auth_get_socket_name()
1.1 deraadt 2028: {
1.25 markus 2029: return channel_forwarded_auth_socket_name;
1.1 deraadt 2030: }
2031:
1.12 markus 2032: /* removes the agent forwarding socket */
2033:
1.49 markus 2034: void
1.25 markus 2035: cleanup_socket(void)
2036: {
2037: remove(channel_forwarded_auth_socket_name);
2038: rmdir(channel_forwarded_auth_socket_dir);
1.12 markus 2039: }
2040:
1.27 markus 2041: /*
2042: * This if called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
2043: * This starts forwarding authentication requests.
2044: */
1.1 deraadt 2045:
1.49 markus 2046: void
1.25 markus 2047: auth_input_request_forwarding(struct passwd * pw)
1.1 deraadt 2048: {
1.25 markus 2049: int sock, newch;
2050: struct sockaddr_un sunaddr;
2051:
2052: if (auth_get_socket_name() != NULL)
2053: fatal("Protocol error: authentication forwarding requested twice.");
2054:
2055: /* Temporarily drop privileged uid for mkdir/bind. */
2056: temporarily_use_uid(pw->pw_uid);
2057:
2058: /* Allocate a buffer for the socket name, and format the name. */
2059: channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2060: channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2061: strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
2062:
2063: /* Create private directory for socket */
2064: if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL)
2065: packet_disconnect("mkdtemp: %.100s", strerror(errno));
2066: snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2067: channel_forwarded_auth_socket_dir, (int) getpid());
2068:
2069: if (atexit(cleanup_socket) < 0) {
2070: int saved = errno;
2071: cleanup_socket();
2072: packet_disconnect("socket: %.100s", strerror(saved));
2073: }
2074: /* Create the socket. */
2075: sock = socket(AF_UNIX, SOCK_STREAM, 0);
2076: if (sock < 0)
2077: packet_disconnect("socket: %.100s", strerror(errno));
2078:
2079: /* Bind it to the name. */
2080: memset(&sunaddr, 0, sizeof(sunaddr));
2081: sunaddr.sun_family = AF_UNIX;
2082: strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2083: sizeof(sunaddr.sun_path));
2084:
2085: if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2086: packet_disconnect("bind: %.100s", strerror(errno));
2087:
2088: /* Restore the privileged uid. */
2089: restore_uid();
2090:
2091: /* Start listening on the socket. */
2092: if (listen(sock, 5) < 0)
2093: packet_disconnect("listen: %.100s", strerror(errno));
2094:
2095: /* Allocate a channel for the authentication agent socket. */
2096: newch = channel_allocate(SSH_CHANNEL_AUTH_SOCKET, sock,
2097: xstrdup("auth socket"));
1.32 deraadt 2098: strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2099: sizeof(channels[newch].path));
1.1 deraadt 2100: }
2101:
2102: /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2103:
1.49 markus 2104: void
1.41 markus 2105: auth_input_open_request(int type, int plen)
1.1 deraadt 2106: {
1.25 markus 2107: int remch, sock, newch;
2108: char *dummyname;
1.41 markus 2109:
2110: packet_integrity_check(plen, 4, type);
1.25 markus 2111:
2112: /* Read the remote channel number from the message. */
2113: remch = packet_get_int();
2114:
1.27 markus 2115: /*
2116: * Get a connection to the local authentication agent (this may again
2117: * get forwarded).
2118: */
1.25 markus 2119: sock = ssh_get_authentication_socket();
2120:
1.27 markus 2121: /*
2122: * If we could not connect the agent, send an error message back to
2123: * the server. This should never happen unless the agent dies,
2124: * because authentication forwarding is only enabled if we have an
2125: * agent.
2126: */
1.25 markus 2127: if (sock < 0) {
2128: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2129: packet_put_int(remch);
2130: packet_send();
2131: return;
2132: }
2133: debug("Forwarding authentication connection.");
1.1 deraadt 2134:
1.27 markus 2135: /*
2136: * Dummy host name. This will be freed when the channel is freed; it
2137: * will still be valid in the packet_put_string below since the
2138: * channel cannot yet be freed at that point.
2139: */
1.25 markus 2140: dummyname = xstrdup("authentication agent connection");
2141:
2142: newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2143: channels[newch].remote_id = remch;
2144:
2145: /* Send a confirmation to the remote host. */
2146: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2147: packet_put_int(remch);
2148: packet_put_int(newch);
1.44 markus 2149: packet_send();
2150: }
2151:
2152: void
1.51 markus 2153: channel_start_open(int id)
1.44 markus 2154: {
2155: Channel *c = channel_lookup(id);
2156: if (c == NULL) {
2157: log("channel_open: %d: bad id", id);
2158: return;
2159: }
1.51 markus 2160: debug("send channel open %d", id);
1.44 markus 2161: packet_start(SSH2_MSG_CHANNEL_OPEN);
2162: packet_put_cstring(c->ctype);
2163: packet_put_int(c->self);
2164: packet_put_int(c->local_window);
2165: packet_put_int(c->local_maxpacket);
1.51 markus 2166: }
2167: void
2168: channel_open(int id)
2169: {
2170: /* XXX REMOVE ME */
2171: channel_start_open(id);
1.44 markus 2172: packet_send();
2173: }
2174: void
2175: channel_request(int id, char *service, int wantconfirm)
2176: {
2177: channel_request_start(id, service, wantconfirm);
2178: packet_send();
2179: debug("channel request %d: %s", id, service) ;
2180: }
2181: void
2182: channel_request_start(int id, char *service, int wantconfirm)
2183: {
2184: Channel *c = channel_lookup(id);
2185: if (c == NULL) {
2186: log("channel_request: %d: bad id", id);
2187: return;
2188: }
2189: packet_start(SSH2_MSG_CHANNEL_REQUEST);
2190: packet_put_int(c->remote_id);
2191: packet_put_cstring(service);
2192: packet_put_char(wantconfirm);
2193: }
2194: void
2195: channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2196: {
2197: Channel *c = channel_lookup(id);
2198: if (c == NULL) {
2199: log("channel_register_callback: %d: bad id", id);
2200: return;
2201: }
2202: c->cb_event = mtype;
2203: c->cb_fn = fn;
2204: c->cb_arg = arg;
2205: }
2206: void
2207: channel_register_cleanup(int id, channel_callback_fn *fn)
2208: {
2209: Channel *c = channel_lookup(id);
2210: if (c == NULL) {
2211: log("channel_register_cleanup: %d: bad id", id);
2212: return;
2213: }
2214: c->dettach_user = fn;
2215: }
2216: void
2217: channel_cancel_cleanup(int id)
2218: {
2219: Channel *c = channel_lookup(id);
2220: if (c == NULL) {
2221: log("channel_cancel_cleanup: %d: bad id", id);
2222: return;
2223: }
2224: c->dettach_user = NULL;
2225: }
2226:
2227: void
2228: channel_set_fds(int id, int rfd, int wfd, int efd, int extusage)
2229: {
2230: Channel *c = channel_lookup(id);
2231: if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2232: fatal("channel_activate for non-larval channel %d.", id);
1.52 ! markus 2233:
! 2234: channel_register_fds(c, rfd, wfd, efd, extusage);
1.44 markus 2235: c->type = SSH_CHANNEL_OPEN;
2236: /* XXX window size? */
2237: c->local_window = c->local_window_max = c->local_maxpacket/2;
2238: packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2239: packet_put_int(c->remote_id);
2240: packet_put_int(c->local_window);
1.25 markus 2241: packet_send();
1.1 deraadt 2242: }
![[BACK]](/icons/back.gif){kind=icon}
Return to channels.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh