Annotation of src/usr.bin/ssh/channels.c, Revision 1.57.2.4
1.1 deraadt 1: /*
1.26 deraadt 2: * Author: Tatu Ylonen <ylo@cs.hut.fi>
3: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: * All rights reserved
5: * This file contains functions for generic socket connection forwarding.
6: * There is also code for initiating connection forwarding for X11 connections,
7: * arbitrary tcp/ip connections, and the authentication agent connection.
1.49 markus 8: *
1.57.2.3 jason 9: * As far as I am concerned, the code I have written for this software
10: * can be used freely for any purpose. Any derived versions of this
11: * software must be clearly marked as such, and if the derived work is
12: * incompatible with the protocol description in the RFC file, it must be
13: * called by a name other than "ssh" or "Secure Shell".
14: *
15: *
1.44 markus 16: * SSH2 support added by Markus Friedl.
1.57.2.3 jason 17: * Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
18: * Copyright (c) 1999 Dug Song. All rights reserved.
19: * Copyright (c) 1999 Theo de Raadt. All rights reserved.
20: *
21: * Redistribution and use in source and binary forms, with or without
22: * modification, are permitted provided that the following conditions
23: * are met:
24: * 1. Redistributions of source code must retain the above copyright
25: * notice, this list of conditions and the following disclaimer.
26: * 2. Redistributions in binary form must reproduce the above copyright
27: * notice, this list of conditions and the following disclaimer in the
28: * documentation and/or other materials provided with the distribution.
29: *
30: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
32: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
33: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
34: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
35: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
39: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.26 deraadt 40: */
1.1 deraadt 41:
42: #include "includes.h"
1.57.2.4! jason 43: RCSID("$OpenBSD: channels.c,v 1.92 2001/02/16 13:38:18 markus Exp $");
! 44:
! 45: #include <openssl/rsa.h>
! 46: #include <openssl/dsa.h>
1.1 deraadt 47:
48: #include "ssh.h"
1.57.2.4! jason 49: #include "ssh1.h"
! 50: #include "ssh2.h"
1.1 deraadt 51: #include "packet.h"
52: #include "xmalloc.h"
53: #include "buffer.h"
54: #include "uidswap.h"
1.57.2.4! jason 55: #include "log.h"
! 56: #include "misc.h"
1.14 markus 57: #include "channels.h"
58: #include "nchan.h"
59: #include "compat.h"
1.57.2.4! jason 60: #include "canohost.h"
1.57.2.2 jason 61: #include "key.h"
62: #include "authfd.h"
63:
1.1 deraadt 64: /* Maximum number of fake X11 displays to try. */
65: #define MAX_DISPLAYS 1000
66:
1.12 markus 67: /* Max len of agent socket */
68: #define MAX_SOCKET_NAME 100
69:
1.27 markus 70: /*
71: * Pointer to an array containing all allocated channels. The array is
72: * dynamically extended as needed.
73: */
1.1 deraadt 74: static Channel *channels = NULL;
75:
1.27 markus 76: /*
77: * Size of the channel array. All slots of the array must always be
78: * initialized (at least the type field); unused slots are marked with type
79: * SSH_CHANNEL_FREE.
80: */
1.1 deraadt 81: static int channels_alloc = 0;
82:
1.27 markus 83: /*
84: * Maximum file descriptor value used in any of the channels. This is
85: * updated in channel_allocate.
86: */
1.57.2.4! jason 87: static int channel_max_fd = 0;
1.1 deraadt 88:
1.12 markus 89: /* Name and directory of socket for authentication agent forwarding. */
1.1 deraadt 90: static char *channel_forwarded_auth_socket_name = NULL;
1.25 markus 91: static char *channel_forwarded_auth_socket_dir = NULL;
1.1 deraadt 92:
93: /* Saved X11 authentication protocol name. */
94: char *x11_saved_proto = NULL;
95:
96: /* Saved X11 authentication data. This is the real data. */
97: char *x11_saved_data = NULL;
1.57.2.4! jason 98: u_int x11_saved_data_len = 0;
1.1 deraadt 99:
1.27 markus 100: /*
101: * Fake X11 authentication data. This is what the server will be sending us;
102: * we should replace any occurrences of this by the real data.
103: */
1.1 deraadt 104: char *x11_fake_data = NULL;
1.57.2.4! jason 105: u_int x11_fake_data_len;
1.1 deraadt 106:
1.27 markus 107: /*
108: * Data structure for storing which hosts are permitted for forward requests.
109: * The local sides of any remote forwards are stored in this array to prevent
110: * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
111: * network (which might be behind a firewall).
112: */
1.25 markus 113: typedef struct {
1.41 markus 114: char *host_to_connect; /* Connect to 'host'. */
115: u_short port_to_connect; /* Connect to 'port'. */
116: u_short listen_port; /* Remote side should listen port number. */
1.1 deraadt 117: } ForwardPermission;
118:
119: /* List of all permitted host/port pairs to connect. */
120: static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
121: /* Number of permitted host/port pairs in the array. */
122: static int num_permitted_opens = 0;
1.27 markus 123: /*
124: * If this is true, all opens are permitted. This is the case on the server
125: * on which we have to trust the client anyway, and the user could do
126: * anything after logging in anyway.
127: */
1.1 deraadt 128: static int all_opens_permitted = 0;
129:
130: /* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
131: static int have_hostname_in_open = 0;
132:
1.57.2.4! jason 133: /* AF_UNSPEC or AF_INET or AF_INET6 */
! 134: extern int IPv4or6;
! 135:
1.1 deraadt 136: /* Sets specific protocol options. */
137:
1.49 markus 138: void
1.25 markus 139: channel_set_options(int hostname_in_open)
1.1 deraadt 140: {
1.25 markus 141: have_hostname_in_open = hostname_in_open;
1.1 deraadt 142: }
143:
1.27 markus 144: /*
145: * Permits opening to any host/port in SSH_MSG_PORT_OPEN. This is usually
146: * called by the server, because the user could connect to any port anyway,
147: * and the server has no way to know but to trust the client anyway.
148: */
1.1 deraadt 149:
1.49 markus 150: void
1.25 markus 151: channel_permit_all_opens()
1.1 deraadt 152: {
1.25 markus 153: all_opens_permitted = 1;
1.1 deraadt 154: }
155:
1.41 markus 156: /* lookup channel by id */
157:
158: Channel *
159: channel_lookup(int id)
160: {
161: Channel *c;
1.57.2.2 jason 162: if (id < 0 || id > channels_alloc) {
1.41 markus 163: log("channel_lookup: %d: bad id", id);
164: return NULL;
165: }
166: c = &channels[id];
167: if (c->type == SSH_CHANNEL_FREE) {
168: log("channel_lookup: %d: bad id: channel free", id);
169: return NULL;
170: }
171: return c;
172: }
173:
1.27 markus 174: /*
1.55 markus 175: * Register filedescriptors for a channel, used when allocating a channel or
1.52 markus 176: * when the channel consumer/producer is ready, e.g. shell exec'd
1.27 markus 177: */
1.1 deraadt 178:
1.52 markus 179: void
1.57.2.3 jason 180: channel_register_fds(Channel *c, int rfd, int wfd, int efd,
181: int extusage, int nonblock)
1.1 deraadt 182: {
1.25 markus 183: /* Update the maximum file descriptor value. */
1.57.2.4! jason 184: channel_max_fd = MAX(channel_max_fd, rfd);
! 185: channel_max_fd = MAX(channel_max_fd, wfd);
! 186: channel_max_fd = MAX(channel_max_fd, efd);
! 187:
1.27 markus 188: /* XXX set close-on-exec -markus */
1.55 markus 189:
1.52 markus 190: c->rfd = rfd;
191: c->wfd = wfd;
192: c->sock = (rfd == wfd) ? rfd : -1;
193: c->efd = efd;
194: c->extended_usage = extusage;
1.57.2.3 jason 195:
1.57.2.4! jason 196: /* XXX ugly hack: nonblock is only set by the server */
! 197: if (nonblock && isatty(c->rfd)) {
! 198: debug("channel: %d: rfd %d isatty", c->self, c->rfd);
! 199: c->isatty = 1;
! 200: if (!isatty(c->wfd)) {
! 201: error("channel: %d: wfd %d is not a tty?",
! 202: c->self, c->wfd);
! 203: }
! 204: } else {
! 205: c->isatty = 0;
! 206: }
! 207:
1.57.2.3 jason 208: /* enable nonblocking mode */
209: if (nonblock) {
210: if (rfd != -1)
211: set_nonblock(rfd);
212: if (wfd != -1)
213: set_nonblock(wfd);
214: if (efd != -1)
215: set_nonblock(efd);
216: }
1.52 markus 217: }
218:
219: /*
220: * Allocate a new channel object and set its type and socket. This will cause
221: * remote_name to be freed.
222: */
223:
224: int
225: channel_new(char *ctype, int type, int rfd, int wfd, int efd,
1.57.2.3 jason 226: int window, int maxpack, int extusage, char *remote_name, int nonblock)
1.52 markus 227: {
228: int i, found;
229: Channel *c;
1.25 markus 230:
231: /* Do initial allocation if this is the first call. */
232: if (channels_alloc == 0) {
1.44 markus 233: chan_init();
1.25 markus 234: channels_alloc = 10;
235: channels = xmalloc(channels_alloc * sizeof(Channel));
236: for (i = 0; i < channels_alloc; i++)
237: channels[i].type = SSH_CHANNEL_FREE;
1.27 markus 238: /*
239: * Kludge: arrange a call to channel_stop_listening if we
240: * terminate with fatal().
241: */
1.25 markus 242: fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
243: }
244: /* Try to find a free slot where to put the new channel. */
245: for (found = -1, i = 0; i < channels_alloc; i++)
246: if (channels[i].type == SSH_CHANNEL_FREE) {
247: /* Found a free slot. */
248: found = i;
249: break;
250: }
251: if (found == -1) {
1.27 markus 252: /* There are no free slots. Take last+1 slot and expand the array. */
1.25 markus 253: found = channels_alloc;
254: channels_alloc += 10;
1.57.2.3 jason 255: debug2("channel: expanding %d", channels_alloc);
1.25 markus 256: channels = xrealloc(channels, channels_alloc * sizeof(Channel));
257: for (i = found; i < channels_alloc; i++)
258: channels[i].type = SSH_CHANNEL_FREE;
259: }
260: /* Initialize and return new channel number. */
261: c = &channels[found];
262: buffer_init(&c->input);
263: buffer_init(&c->output);
1.41 markus 264: buffer_init(&c->extended);
1.25 markus 265: chan_init_iostates(c);
1.57.2.3 jason 266: channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
1.25 markus 267: c->self = found;
268: c->type = type;
1.41 markus 269: c->ctype = ctype;
1.51 markus 270: c->local_window = window;
271: c->local_window_max = window;
272: c->local_consumed = 0;
273: c->local_maxpacket = maxpack;
1.25 markus 274: c->remote_id = -1;
275: c->remote_name = remote_name;
1.41 markus 276: c->remote_window = 0;
277: c->remote_maxpacket = 0;
278: c->cb_fn = NULL;
279: c->cb_arg = NULL;
280: c->cb_event = 0;
281: c->dettach_user = NULL;
1.57.2.2 jason 282: c->input_filter = NULL;
1.25 markus 283: debug("channel %d: new [%s]", found, remote_name);
284: return found;
1.1 deraadt 285: }
1.52 markus 286: /* old interface XXX */
1.49 markus 287: int
1.41 markus 288: channel_allocate(int type, int sock, char *remote_name)
289: {
1.57.2.3 jason 290: return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1);
1.41 markus 291: }
1.1 deraadt 292:
1.52 markus 293:
294: /* Close all channel fd/socket. */
295:
296: void
297: channel_close_fds(Channel *c)
298: {
299: if (c->sock != -1) {
300: close(c->sock);
301: c->sock = -1;
302: }
303: if (c->rfd != -1) {
304: close(c->rfd);
305: c->rfd = -1;
306: }
307: if (c->wfd != -1) {
308: close(c->wfd);
309: c->wfd = -1;
310: }
311: if (c->efd != -1) {
312: close(c->efd);
313: c->efd = -1;
314: }
315: }
316:
317: /* Free the channel and close its fd/socket. */
1.1 deraadt 318:
1.49 markus 319: void
1.41 markus 320: channel_free(int id)
1.1 deraadt 321: {
1.41 markus 322: Channel *c = channel_lookup(id);
1.57.2.4! jason 323: char *s = channel_open_message();
! 324:
1.41 markus 325: if (c == NULL)
326: packet_disconnect("channel free: bad local channel %d", id);
1.57.2.4! jason 327: debug("channel_free: channel %d: status: %s", id, s);
! 328: xfree(s);
! 329:
1.44 markus 330: if (c->dettach_user != NULL) {
331: debug("channel_free: channel %d: dettaching channel user", id);
332: c->dettach_user(c->self, NULL);
333: }
1.54 markus 334: if (c->sock != -1)
335: shutdown(c->sock, SHUT_RDWR);
1.52 markus 336: channel_close_fds(c);
1.41 markus 337: buffer_free(&c->input);
338: buffer_free(&c->output);
339: buffer_free(&c->extended);
340: c->type = SSH_CHANNEL_FREE;
341: if (c->remote_name) {
342: xfree(c->remote_name);
343: c->remote_name = NULL;
1.25 markus 344: }
1.1 deraadt 345: }
346:
1.27 markus 347: /*
1.41 markus 348: * 'channel_pre*' are called just before select() to add any bits relevant to
349: * channels in the select bitmasks.
350: */
351: /*
352: * 'channel_post*': perform any appropriate operations for channels which
353: * have events pending.
1.27 markus 354: */
1.41 markus 355: typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
356: chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
357: chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
358:
359: void
360: channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
361: {
362: FD_SET(c->sock, readset);
363: }
364:
365: void
1.57.2.4! jason 366: channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset)
! 367: {
! 368: debug3("channel %d: waiting for connection", c->self);
! 369: FD_SET(c->sock, writeset);
! 370: }
! 371:
! 372: void
1.41 markus 373: channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
374: {
375: if (buffer_len(&c->input) < packet_get_maxsize())
376: FD_SET(c->sock, readset);
377: if (buffer_len(&c->output) > 0)
378: FD_SET(c->sock, writeset);
379: }
1.1 deraadt 380:
1.41 markus 381: void
382: channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
383: {
384: /* test whether sockets are 'alive' for read/write */
385: if (c->istate == CHAN_INPUT_OPEN)
386: if (buffer_len(&c->input) < packet_get_maxsize())
387: FD_SET(c->sock, readset);
388: if (c->ostate == CHAN_OUTPUT_OPEN ||
389: c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
390: if (buffer_len(&c->output) > 0) {
391: FD_SET(c->sock, writeset);
392: } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
393: chan_obuf_empty(c);
394: }
395: }
396: }
397:
398: void
1.44 markus 399: channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
400: {
401: if (c->istate == CHAN_INPUT_OPEN &&
402: c->remote_window > 0 &&
403: buffer_len(&c->input) < c->remote_window)
404: FD_SET(c->rfd, readset);
405: if (c->ostate == CHAN_OUTPUT_OPEN ||
406: c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
407: if (buffer_len(&c->output) > 0) {
408: FD_SET(c->wfd, writeset);
409: } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
410: chan_obuf_empty(c);
411: }
412: }
413: /** XXX check close conditions, too */
414: if (c->efd != -1) {
415: if (c->extended_usage == CHAN_EXTENDED_WRITE &&
416: buffer_len(&c->extended) > 0)
417: FD_SET(c->efd, writeset);
418: else if (c->extended_usage == CHAN_EXTENDED_READ &&
419: buffer_len(&c->extended) < c->remote_window)
420: FD_SET(c->efd, readset);
421: }
422: }
423:
424: void
1.41 markus 425: channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
426: {
427: if (buffer_len(&c->input) == 0) {
428: packet_start(SSH_MSG_CHANNEL_CLOSE);
429: packet_put_int(c->remote_id);
430: packet_send();
431: c->type = SSH_CHANNEL_CLOSED;
432: debug("Closing channel %d after input drain.", c->self);
433: }
434: }
435:
436: void
437: channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
438: {
439: if (buffer_len(&c->output) == 0)
440: channel_free(c->self);
1.49 markus 441: else
1.41 markus 442: FD_SET(c->sock, writeset);
443: }
444:
445: /*
446: * This is a special state for X11 authentication spoofing. An opened X11
447: * connection (when authentication spoofing is being done) remains in this
448: * state until the first packet has been completely read. The authentication
449: * data in that packet is then substituted by the real data if it matches the
450: * fake data, and the channel is put into normal mode.
1.51 markus 451: * XXX All this happens at the client side.
1.41 markus 452: */
453: int
454: x11_open_helper(Channel *c)
1.1 deraadt 455: {
1.57.2.4! jason 456: u_char *ucp;
! 457: u_int proto_len, data_len;
1.25 markus 458:
1.41 markus 459: /* Check if the fixed size part of the packet is in buffer. */
460: if (buffer_len(&c->output) < 12)
461: return 0;
462:
463: /* Parse the lengths of variable-length fields. */
1.57.2.4! jason 464: ucp = (u_char *) buffer_ptr(&c->output);
1.41 markus 465: if (ucp[0] == 0x42) { /* Byte order MSB first. */
466: proto_len = 256 * ucp[6] + ucp[7];
467: data_len = 256 * ucp[8] + ucp[9];
468: } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */
469: proto_len = ucp[6] + 256 * ucp[7];
470: data_len = ucp[8] + 256 * ucp[9];
471: } else {
472: debug("Initial X11 packet contains bad byte order byte: 0x%x",
473: ucp[0]);
474: return -1;
475: }
476:
477: /* Check if the whole packet is in buffer. */
478: if (buffer_len(&c->output) <
479: 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
480: return 0;
481:
482: /* Check if authentication protocol matches. */
483: if (proto_len != strlen(x11_saved_proto) ||
484: memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
485: debug("X11 connection uses different authentication protocol.");
486: return -1;
487: }
488: /* Check if authentication data matches our fake data. */
489: if (data_len != x11_fake_data_len ||
490: memcmp(ucp + 12 + ((proto_len + 3) & ~3),
491: x11_fake_data, x11_fake_data_len) != 0) {
492: debug("X11 auth data does not match fake data.");
493: return -1;
494: }
495: /* Check fake data length */
496: if (x11_fake_data_len != x11_saved_data_len) {
497: error("X11 fake_data_len %d != saved_data_len %d",
498: x11_fake_data_len, x11_saved_data_len);
499: return -1;
500: }
501: /*
502: * Received authentication protocol and data match
503: * our fake data. Substitute the fake data with real
504: * data.
505: */
506: memcpy(ucp + 12 + ((proto_len + 3) & ~3),
507: x11_saved_data, x11_saved_data_len);
508: return 1;
509: }
510:
511: void
512: channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
513: {
514: int ret = x11_open_helper(c);
515: if (ret == 1) {
516: /* Start normal processing for the channel. */
517: c->type = SSH_CHANNEL_OPEN;
1.47 markus 518: channel_pre_open_13(c, readset, writeset);
1.41 markus 519: } else if (ret == -1) {
520: /*
521: * We have received an X11 connection that has bad
522: * authentication information.
523: */
524: log("X11 connection rejected because of wrong authentication.\r\n");
525: buffer_clear(&c->input);
526: buffer_clear(&c->output);
527: close(c->sock);
528: c->sock = -1;
529: c->type = SSH_CHANNEL_CLOSED;
530: packet_start(SSH_MSG_CHANNEL_CLOSE);
531: packet_put_int(c->remote_id);
532: packet_send();
533: }
534: }
1.25 markus 535:
1.41 markus 536: void
1.51 markus 537: channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
1.41 markus 538: {
539: int ret = x11_open_helper(c);
540: if (ret == 1) {
541: c->type = SSH_CHANNEL_OPEN;
1.57 markus 542: if (compat20)
543: channel_pre_open_20(c, readset, writeset);
544: else
545: channel_pre_open_15(c, readset, writeset);
1.41 markus 546: } else if (ret == -1) {
547: debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
1.51 markus 548: chan_read_failed(c); /** force close? */
1.41 markus 549: chan_write_failed(c);
550: debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
551: }
552: }
1.25 markus 553:
1.41 markus 554: /* This is our fake X11 server socket. */
555: void
556: channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
557: {
558: struct sockaddr addr;
559: int newsock, newch;
560: socklen_t addrlen;
1.57.2.4! jason 561: char buf[16384], *remote_ipaddr;
1.51 markus 562: int remote_port;
1.25 markus 563:
1.41 markus 564: if (FD_ISSET(c->sock, readset)) {
565: debug("X11 connection requested.");
566: addrlen = sizeof(addr);
567: newsock = accept(c->sock, &addr, &addrlen);
568: if (newsock < 0) {
569: error("accept: %.100s", strerror(errno));
570: return;
571: }
1.57.2.4! jason 572: remote_ipaddr = get_peer_ipaddr(newsock);
1.51 markus 573: remote_port = get_peer_port(newsock);
1.41 markus 574: snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
1.57.2.4! jason 575: remote_ipaddr, remote_port);
1.51 markus 576:
577: newch = channel_new("x11",
578: SSH_CHANNEL_OPENING, newsock, newsock, -1,
579: c->local_window_max, c->local_maxpacket,
1.57.2.3 jason 580: 0, xstrdup(buf), 1);
1.51 markus 581: if (compat20) {
582: packet_start(SSH2_MSG_CHANNEL_OPEN);
583: packet_put_cstring("x11");
584: packet_put_int(newch);
585: packet_put_int(c->local_window_max);
586: packet_put_int(c->local_maxpacket);
1.57.2.4! jason 587: /* originator ipaddr and port */
! 588: packet_put_cstring(remote_ipaddr);
1.57 markus 589: if (datafellows & SSH_BUG_X11FWD) {
590: debug("ssh2 x11 bug compat mode");
591: } else {
592: packet_put_int(remote_port);
593: }
1.51 markus 594: packet_send();
595: } else {
596: packet_start(SSH_SMSG_X11_OPEN);
597: packet_put_int(newch);
598: if (have_hostname_in_open)
599: packet_put_string(buf, strlen(buf));
600: packet_send();
601: }
1.57.2.4! jason 602: xfree(remote_ipaddr);
1.41 markus 603: }
604: }
1.25 markus 605:
1.41 markus 606: /*
607: * This socket is listening for connections to a forwarded TCP/IP port.
608: */
609: void
610: channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
611: {
612: struct sockaddr addr;
613: int newsock, newch;
614: socklen_t addrlen;
1.57.2.4! jason 615: char buf[1024], *remote_ipaddr, *rtype;
1.41 markus 616: int remote_port;
1.25 markus 617:
1.57.2.4! jason 618: rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ?
! 619: "forwarded-tcpip" : "direct-tcpip";
! 620:
1.41 markus 621: if (FD_ISSET(c->sock, readset)) {
622: debug("Connection to port %d forwarding "
623: "to %.100s port %d requested.",
624: c->listening_port, c->path, c->host_port);
625: addrlen = sizeof(addr);
626: newsock = accept(c->sock, &addr, &addrlen);
627: if (newsock < 0) {
628: error("accept: %.100s", strerror(errno));
629: return;
630: }
1.57.2.4! jason 631: remote_ipaddr = get_peer_ipaddr(newsock);
1.41 markus 632: remote_port = get_peer_port(newsock);
633: snprintf(buf, sizeof buf,
634: "listen port %d for %.100s port %d, "
635: "connect from %.200s port %d",
636: c->listening_port, c->path, c->host_port,
1.57.2.4! jason 637: remote_ipaddr, remote_port);
! 638:
! 639: newch = channel_new(rtype,
1.41 markus 640: SSH_CHANNEL_OPENING, newsock, newsock, -1,
641: c->local_window_max, c->local_maxpacket,
1.57.2.3 jason 642: 0, xstrdup(buf), 1);
1.44 markus 643: if (compat20) {
644: packet_start(SSH2_MSG_CHANNEL_OPEN);
1.57.2.4! jason 645: packet_put_cstring(rtype);
1.44 markus 646: packet_put_int(newch);
647: packet_put_int(c->local_window_max);
648: packet_put_int(c->local_maxpacket);
1.57.2.4! jason 649: if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
! 650: /* listen address, port */
! 651: packet_put_string(c->path, strlen(c->path));
! 652: packet_put_int(c->listening_port);
! 653: } else {
! 654: /* target host, port */
! 655: packet_put_string(c->path, strlen(c->path));
! 656: packet_put_int(c->host_port);
! 657: }
1.48 markus 658: /* originator host and port */
1.57.2.4! jason 659: packet_put_cstring(remote_ipaddr);
1.44 markus 660: packet_put_int(remote_port);
661: packet_send();
662: } else {
663: packet_start(SSH_MSG_PORT_OPEN);
664: packet_put_int(newch);
665: packet_put_string(c->path, strlen(c->path));
666: packet_put_int(c->host_port);
667: if (have_hostname_in_open) {
668: packet_put_string(buf, strlen(buf));
669: }
670: packet_send();
1.41 markus 671: }
1.57.2.4! jason 672: xfree(remote_ipaddr);
1.41 markus 673: }
674: }
1.25 markus 675:
1.41 markus 676: /*
677: * This is the authentication agent socket listening for connections from
678: * clients.
679: */
680: void
681: channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
682: {
683: struct sockaddr addr;
684: int newsock, newch;
685: socklen_t addrlen;
1.25 markus 686:
1.41 markus 687: if (FD_ISSET(c->sock, readset)) {
688: addrlen = sizeof(addr);
689: newsock = accept(c->sock, &addr, &addrlen);
690: if (newsock < 0) {
691: error("accept from auth socket: %.100s", strerror(errno));
692: return;
693: }
1.57.2.4! jason 694: newch = channel_new("accepted auth socket",
! 695: SSH_CHANNEL_OPENING, newsock, newsock, -1,
! 696: c->local_window_max, c->local_maxpacket,
! 697: 0, xstrdup("accepted auth socket"), 1);
! 698: if (compat20) {
! 699: packet_start(SSH2_MSG_CHANNEL_OPEN);
! 700: packet_put_cstring("auth-agent@openssh.com");
! 701: packet_put_int(newch);
! 702: packet_put_int(c->local_window_max);
! 703: packet_put_int(c->local_maxpacket);
! 704: } else {
! 705: packet_start(SSH_SMSG_AGENT_OPEN);
! 706: packet_put_int(newch);
! 707: }
1.41 markus 708: packet_send();
709: }
710: }
1.25 markus 711:
1.57.2.4! jason 712: void
! 713: channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
! 714: {
! 715: if (FD_ISSET(c->sock, writeset)) {
! 716: int err = 0;
! 717: int sz = sizeof(err);
! 718: c->type = SSH_CHANNEL_OPEN;
! 719: if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &sz) < 0) {
! 720: debug("getsockopt SO_ERROR failed");
! 721: } else {
! 722: if (err == 0) {
! 723: debug("channel %d: connected)", c->self);
! 724: } else {
! 725: debug("channel %d: not connected: %s",
! 726: c->self, strerror(err));
! 727: chan_read_failed(c);
! 728: chan_write_failed(c);
! 729: }
! 730: }
! 731: }
! 732: }
! 733:
1.41 markus 734: int
735: channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
736: {
737: char buf[16*1024];
738: int len;
1.25 markus 739:
1.41 markus 740: if (c->rfd != -1 &&
741: FD_ISSET(c->rfd, readset)) {
742: len = read(c->rfd, buf, sizeof(buf));
1.53 markus 743: if (len < 0 && (errno == EINTR || errno == EAGAIN))
744: return 1;
1.41 markus 745: if (len <= 0) {
1.51 markus 746: debug("channel %d: read<=0 rfd %d len %d",
1.41 markus 747: c->self, c->rfd, len);
1.25 markus 748: if (compat13) {
1.41 markus 749: buffer_consume(&c->output, buffer_len(&c->output));
750: c->type = SSH_CHANNEL_INPUT_DRAINING;
751: debug("Channel %d status set to input draining.", c->self);
1.25 markus 752: } else {
1.41 markus 753: chan_read_failed(c);
1.25 markus 754: }
1.41 markus 755: return -1;
756: }
1.57.2.2 jason 757: if(c->input_filter != NULL) {
758: if (c->input_filter(c, buf, len) == -1) {
759: debug("filter stops channel %d", c->self);
760: chan_read_failed(c);
761: }
762: } else {
763: buffer_append(&c->input, buf, len);
764: }
1.41 markus 765: }
766: return 1;
767: }
768: int
769: channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
770: {
771: int len;
1.25 markus 772:
1.41 markus 773: /* Send buffered output data to the socket. */
774: if (c->wfd != -1 &&
775: FD_ISSET(c->wfd, writeset) &&
776: buffer_len(&c->output) > 0) {
777: len = write(c->wfd, buffer_ptr(&c->output),
1.53 markus 778: buffer_len(&c->output));
779: if (len < 0 && (errno == EINTR || errno == EAGAIN))
780: return 1;
1.41 markus 781: if (len <= 0) {
782: if (compat13) {
783: buffer_consume(&c->output, buffer_len(&c->output));
784: debug("Channel %d status set to input draining.", c->self);
785: c->type = SSH_CHANNEL_INPUT_DRAINING;
786: } else {
787: chan_write_failed(c);
788: }
789: return -1;
1.25 markus 790: }
1.57.2.4! jason 791: if (compat20 && c->isatty) {
! 792: struct termios tio;
! 793: if (tcgetattr(c->wfd, &tio) == 0 &&
! 794: !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
! 795: /*
! 796: * Simulate echo to reduce the impact of
! 797: * traffic analysis.
! 798: */
! 799: packet_start(SSH2_MSG_IGNORE);
! 800: memset(buffer_ptr(&c->output), 0, len);
! 801: packet_put_string(buffer_ptr(&c->output), len);
! 802: packet_send();
! 803: }
! 804: }
1.41 markus 805: buffer_consume(&c->output, len);
1.44 markus 806: if (compat20 && len > 0) {
807: c->local_consumed += len;
808: }
809: }
810: return 1;
811: }
812: int
813: channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
814: {
815: char buf[16*1024];
816: int len;
817:
1.45 markus 818: /** XXX handle drain efd, too */
1.44 markus 819: if (c->efd != -1) {
820: if (c->extended_usage == CHAN_EXTENDED_WRITE &&
821: FD_ISSET(c->efd, writeset) &&
822: buffer_len(&c->extended) > 0) {
823: len = write(c->efd, buffer_ptr(&c->extended),
824: buffer_len(&c->extended));
1.57.2.3 jason 825: debug2("channel %d: written %d to efd %d",
1.44 markus 826: c->self, len, c->efd);
827: if (len > 0) {
828: buffer_consume(&c->extended, len);
829: c->local_consumed += len;
830: }
831: } else if (c->extended_usage == CHAN_EXTENDED_READ &&
832: FD_ISSET(c->efd, readset)) {
833: len = read(c->efd, buf, sizeof(buf));
1.57.2.3 jason 834: debug2("channel %d: read %d from efd %d",
1.44 markus 835: c->self, len, c->efd);
1.45 markus 836: if (len == 0) {
837: debug("channel %d: closing efd %d",
838: c->self, c->efd);
839: close(c->efd);
840: c->efd = -1;
841: } else if (len > 0)
1.44 markus 842: buffer_append(&c->extended, buf, len);
843: }
844: }
845: return 1;
846: }
847: int
848: channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
849: {
1.46 markus 850: if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
1.44 markus 851: c->local_window < c->local_window_max/2 &&
852: c->local_consumed > 0) {
853: packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
854: packet_put_int(c->remote_id);
855: packet_put_int(c->local_consumed);
856: packet_send();
1.57.2.3 jason 857: debug2("channel %d: window %d sent adjust %d",
1.44 markus 858: c->self, c->local_window,
859: c->local_consumed);
860: c->local_window += c->local_consumed;
861: c->local_consumed = 0;
1.1 deraadt 862: }
1.41 markus 863: return 1;
1.1 deraadt 864: }
865:
1.41 markus 866: void
867: channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
868: {
869: channel_handle_rfd(c, readset, writeset);
870: channel_handle_wfd(c, readset, writeset);
871: }
1.1 deraadt 872:
1.41 markus 873: void
1.44 markus 874: channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
875: {
876: channel_handle_rfd(c, readset, writeset);
877: channel_handle_wfd(c, readset, writeset);
878: channel_handle_efd(c, readset, writeset);
879: channel_check_window(c, readset, writeset);
880: }
881:
882: void
1.41 markus 883: channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
1.1 deraadt 884: {
1.41 markus 885: int len;
886: /* Send buffered output data to the socket. */
887: if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
888: len = write(c->sock, buffer_ptr(&c->output),
889: buffer_len(&c->output));
890: if (len <= 0)
891: buffer_consume(&c->output, buffer_len(&c->output));
892: else
893: buffer_consume(&c->output, len);
894: }
895: }
1.25 markus 896:
1.41 markus 897: void
1.44 markus 898: channel_handler_init_20(void)
899: {
900: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20;
1.51 markus 901: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
1.44 markus 902: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
1.57.2.4! jason 903: channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener;
1.51 markus 904: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
1.57.2.4! jason 905: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
! 906: channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
1.44 markus 907:
908: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2;
909: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
1.57.2.4! jason 910: channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener;
1.51 markus 911: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
1.57.2.4! jason 912: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
! 913: channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
1.44 markus 914: }
915:
916: void
1.41 markus 917: channel_handler_init_13(void)
918: {
919: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13;
920: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13;
921: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
922: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
923: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
924: channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining;
925: channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining;
1.57.2.4! jason 926: channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
1.25 markus 927:
1.41 markus 928: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
929: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
930: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
931: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
932: channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13;
1.57.2.4! jason 933: channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
1.41 markus 934: }
1.25 markus 935:
1.41 markus 936: void
937: channel_handler_init_15(void)
938: {
939: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15;
1.51 markus 940: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
1.41 markus 941: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
942: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
943: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
1.57.2.4! jason 944: channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
1.25 markus 945:
1.41 markus 946: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
947: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
948: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
949: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
1.57.2.4! jason 950: channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
1.41 markus 951: }
1.27 markus 952:
1.41 markus 953: void
954: channel_handler_init(void)
955: {
956: int i;
957: for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
958: channel_pre[i] = NULL;
959: channel_post[i] = NULL;
960: }
1.44 markus 961: if (compat20)
962: channel_handler_init_20();
963: else if (compat13)
1.41 markus 964: channel_handler_init_13();
965: else
966: channel_handler_init_15();
967: }
1.25 markus 968:
1.49 markus 969: void
1.41 markus 970: channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
971: {
972: static int did_init = 0;
973: int i;
974: Channel *c;
1.25 markus 975:
1.41 markus 976: if (!did_init) {
977: channel_handler_init();
978: did_init = 1;
979: }
980: for (i = 0; i < channels_alloc; i++) {
981: c = &channels[i];
982: if (c->type == SSH_CHANNEL_FREE)
983: continue;
984: if (ftab[c->type] == NULL)
1.25 markus 985: continue;
1.41 markus 986: (*ftab[c->type])(c, readset, writeset);
1.44 markus 987: chan_delete_if_full_closed(c);
1.1 deraadt 988: }
989: }
990:
1.49 markus 991: void
1.57.2.4! jason 992: channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp)
1.41 markus 993: {
1.57.2.4! jason 994: int n;
! 995: u_int sz;
! 996:
! 997: n = MAX(*maxfdp, channel_max_fd);
! 998:
! 999: sz = howmany(n+1, NFDBITS) * sizeof(fd_mask);
! 1000: if (*readsetp == NULL || n > *maxfdp) {
! 1001: if (*readsetp)
! 1002: xfree(*readsetp);
! 1003: if (*writesetp)
! 1004: xfree(*writesetp);
! 1005: *readsetp = xmalloc(sz);
! 1006: *writesetp = xmalloc(sz);
! 1007: *maxfdp = n;
! 1008: }
! 1009: memset(*readsetp, 0, sz);
! 1010: memset(*writesetp, 0, sz);
! 1011:
! 1012: channel_handler(channel_pre, *readsetp, *writesetp);
1.41 markus 1013: }
1014:
1.49 markus 1015: void
1.41 markus 1016: channel_after_select(fd_set * readset, fd_set * writeset)
1017: {
1018: channel_handler(channel_post, readset, writeset);
1019: }
1020:
1.57.2.4! jason 1021: /* If there is data to send to the connection, enqueue some of it now. */
1.1 deraadt 1022:
1.49 markus 1023: void
1.25 markus 1024: channel_output_poll()
1.1 deraadt 1025: {
1.25 markus 1026: int len, i;
1.41 markus 1027: Channel *c;
1.1 deraadt 1028:
1.25 markus 1029: for (i = 0; i < channels_alloc; i++) {
1.41 markus 1030: c = &channels[i];
1.37 markus 1031:
1.27 markus 1032: /* We are only interested in channels that can have buffered incoming data. */
1.37 markus 1033: if (compat13) {
1.41 markus 1034: if (c->type != SSH_CHANNEL_OPEN &&
1035: c->type != SSH_CHANNEL_INPUT_DRAINING)
1.37 markus 1036: continue;
1037: } else {
1.41 markus 1038: if (c->type != SSH_CHANNEL_OPEN)
1.37 markus 1039: continue;
1.41 markus 1040: if (c->istate != CHAN_INPUT_OPEN &&
1041: c->istate != CHAN_INPUT_WAIT_DRAIN)
1.37 markus 1042: continue;
1043: }
1.46 markus 1044: if (compat20 &&
1045: (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
1.44 markus 1046: debug("channel: %d: no data after CLOSE", c->self);
1047: continue;
1048: }
1.25 markus 1049:
1050: /* Get the amount of buffered data for this channel. */
1.41 markus 1051: len = buffer_len(&c->input);
1.25 markus 1052: if (len > 0) {
1.27 markus 1053: /* Send some data for the other side over the secure connection. */
1.44 markus 1054: if (compat20) {
1055: if (len > c->remote_window)
1056: len = c->remote_window;
1057: if (len > c->remote_maxpacket)
1058: len = c->remote_maxpacket;
1.25 markus 1059: } else {
1.44 markus 1060: if (packet_is_interactive()) {
1061: if (len > 1024)
1062: len = 512;
1063: } else {
1064: /* Keep the packets at reasonable size. */
1065: if (len > packet_get_maxsize()/2)
1066: len = packet_get_maxsize()/2;
1067: }
1.25 markus 1068: }
1.41 markus 1069: if (len > 0) {
1.44 markus 1070: packet_start(compat20 ?
1071: SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
1.41 markus 1072: packet_put_int(c->remote_id);
1073: packet_put_string(buffer_ptr(&c->input), len);
1074: packet_send();
1075: buffer_consume(&c->input, len);
1076: c->remote_window -= len;
1077: }
1078: } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
1.25 markus 1079: if (compat13)
1080: fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
1.27 markus 1081: /*
1082: * input-buffer is empty and read-socket shutdown:
1083: * tell peer, that we will not send more data: send IEOF
1084: */
1.41 markus 1085: chan_ibuf_empty(c);
1.25 markus 1086: }
1.44 markus 1087: /* Send extended data, i.e. stderr */
1088: if (compat20 &&
1089: c->remote_window > 0 &&
1090: (len = buffer_len(&c->extended)) > 0 &&
1091: c->extended_usage == CHAN_EXTENDED_READ) {
1092: if (len > c->remote_window)
1093: len = c->remote_window;
1094: if (len > c->remote_maxpacket)
1095: len = c->remote_maxpacket;
1096: packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
1097: packet_put_int(c->remote_id);
1098: packet_put_int(SSH2_EXTENDED_DATA_STDERR);
1099: packet_put_string(buffer_ptr(&c->extended), len);
1100: packet_send();
1101: buffer_consume(&c->extended, len);
1102: c->remote_window -= len;
1103: }
1.25 markus 1104: }
1.1 deraadt 1105: }
1106:
1.27 markus 1107: /*
1108: * This is called when a packet of type CHANNEL_DATA has just been received.
1109: * The message type has already been consumed, but channel number and data is
1110: * still there.
1111: */
1.1 deraadt 1112:
1.49 markus 1113: void
1.57.2.3 jason 1114: channel_input_data(int type, int plen, void *ctxt)
1.1 deraadt 1115: {
1.37 markus 1116: int id;
1.25 markus 1117: char *data;
1.57.2.4! jason 1118: u_int data_len;
1.41 markus 1119: Channel *c;
1.25 markus 1120:
1121: /* Get the channel number and verify it. */
1.37 markus 1122: id = packet_get_int();
1.41 markus 1123: c = channel_lookup(id);
1124: if (c == NULL)
1.37 markus 1125: packet_disconnect("Received data for nonexistent channel %d.", id);
1.25 markus 1126:
1127: /* Ignore any data for non-open channels (might happen on close) */
1.41 markus 1128: if (c->type != SSH_CHANNEL_OPEN &&
1129: c->type != SSH_CHANNEL_X11_OPEN)
1.37 markus 1130: return;
1131:
1132: /* same for protocol 1.5 if output end is no longer open */
1.41 markus 1133: if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
1.25 markus 1134: return;
1135:
1136: /* Get the data. */
1137: data = packet_get_string(&data_len);
1.48 markus 1138: packet_done();
1.41 markus 1139:
1.44 markus 1140: if (compat20){
1141: if (data_len > c->local_maxpacket) {
1142: log("channel %d: rcvd big packet %d, maxpack %d",
1143: c->self, data_len, c->local_maxpacket);
1144: }
1145: if (data_len > c->local_window) {
1146: log("channel %d: rcvd too much data %d, win %d",
1147: c->self, data_len, c->local_window);
1148: xfree(data);
1149: return;
1150: }
1151: c->local_window -= data_len;
1152: }else{
1153: packet_integrity_check(plen, 4 + 4 + data_len, type);
1154: }
1.41 markus 1155: buffer_append(&c->output, data, data_len);
1.25 markus 1156: xfree(data);
1.1 deraadt 1157: }
1.49 markus 1158: void
1.57.2.3 jason 1159: channel_input_extended_data(int type, int plen, void *ctxt)
1.44 markus 1160: {
1161: int id;
1162: int tcode;
1163: char *data;
1.57.2.4! jason 1164: u_int data_len;
1.44 markus 1165: Channel *c;
1166:
1167: /* Get the channel number and verify it. */
1168: id = packet_get_int();
1169: c = channel_lookup(id);
1170:
1171: if (c == NULL)
1172: packet_disconnect("Received extended_data for bad channel %d.", id);
1173: if (c->type != SSH_CHANNEL_OPEN) {
1174: log("channel %d: ext data for non open", id);
1175: return;
1176: }
1177: tcode = packet_get_int();
1178: if (c->efd == -1 ||
1179: c->extended_usage != CHAN_EXTENDED_WRITE ||
1180: tcode != SSH2_EXTENDED_DATA_STDERR) {
1181: log("channel %d: bad ext data", c->self);
1182: return;
1183: }
1184: data = packet_get_string(&data_len);
1.48 markus 1185: packet_done();
1.44 markus 1186: if (data_len > c->local_window) {
1187: log("channel %d: rcvd too much extended_data %d, win %d",
1188: c->self, data_len, c->local_window);
1189: xfree(data);
1190: return;
1191: }
1.57.2.3 jason 1192: debug2("channel %d: rcvd ext data %d", c->self, data_len);
1.44 markus 1193: c->local_window -= data_len;
1194: buffer_append(&c->extended, data, data_len);
1195: xfree(data);
1196: }
1197:
1.1 deraadt 1198:
1.27 markus 1199: /*
1200: * Returns true if no channel has too much buffered data, and false if one or
1201: * more channel is overfull.
1202: */
1.1 deraadt 1203:
1.49 markus 1204: int
1.25 markus 1205: channel_not_very_much_buffered_data()
1.1 deraadt 1206: {
1.57.2.4! jason 1207: u_int i;
1.41 markus 1208: Channel *c;
1.25 markus 1209:
1210: for (i = 0; i < channels_alloc; i++) {
1.41 markus 1211: c = &channels[i];
1212: if (c->type == SSH_CHANNEL_OPEN) {
1.44 markus 1213: if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
1.41 markus 1214: debug("channel %d: big input buffer %d",
1215: c->self, buffer_len(&c->input));
1.25 markus 1216: return 0;
1.41 markus 1217: }
1218: if (buffer_len(&c->output) > packet_get_maxsize()) {
1219: debug("channel %d: big output buffer %d",
1220: c->self, buffer_len(&c->output));
1.25 markus 1221: return 0;
1.41 markus 1222: }
1.25 markus 1223: }
1.1 deraadt 1224: }
1.25 markus 1225: return 1;
1.1 deraadt 1226: }
1227:
1.49 markus 1228: void
1.57.2.3 jason 1229: channel_input_ieof(int type, int plen, void *ctxt)
1.41 markus 1230: {
1231: int id;
1232: Channel *c;
1233:
1234: packet_integrity_check(plen, 4, type);
1235:
1236: id = packet_get_int();
1237: c = channel_lookup(id);
1238: if (c == NULL)
1239: packet_disconnect("Received ieof for nonexistent channel %d.", id);
1240: chan_rcvd_ieof(c);
1241: }
1.1 deraadt 1242:
1.49 markus 1243: void
1.57.2.3 jason 1244: channel_input_close(int type, int plen, void *ctxt)
1.1 deraadt 1245: {
1.41 markus 1246: int id;
1247: Channel *c;
1.1 deraadt 1248:
1.41 markus 1249: packet_integrity_check(plen, 4, type);
1250:
1251: id = packet_get_int();
1252: c = channel_lookup(id);
1253: if (c == NULL)
1254: packet_disconnect("Received close for nonexistent channel %d.", id);
1.27 markus 1255:
1256: /*
1257: * Send a confirmation that we have closed the channel and no more
1258: * data is coming for it.
1259: */
1.25 markus 1260: packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
1.41 markus 1261: packet_put_int(c->remote_id);
1.25 markus 1262: packet_send();
1263:
1.27 markus 1264: /*
1265: * If the channel is in closed state, we have sent a close request,
1266: * and the other side will eventually respond with a confirmation.
1267: * Thus, we cannot free the channel here, because then there would be
1268: * no-one to receive the confirmation. The channel gets freed when
1269: * the confirmation arrives.
1270: */
1.41 markus 1271: if (c->type != SSH_CHANNEL_CLOSED) {
1.27 markus 1272: /*
1273: * Not a closed channel - mark it as draining, which will
1274: * cause it to be freed later.
1275: */
1.41 markus 1276: buffer_consume(&c->input, buffer_len(&c->input));
1277: c->type = SSH_CHANNEL_OUTPUT_DRAINING;
1.25 markus 1278: }
1.1 deraadt 1279: }
1280:
1.41 markus 1281: /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
1.49 markus 1282: void
1.57.2.3 jason 1283: channel_input_oclose(int type, int plen, void *ctxt)
1.41 markus 1284: {
1285: int id = packet_get_int();
1286: Channel *c = channel_lookup(id);
1287: packet_integrity_check(plen, 4, type);
1288: if (c == NULL)
1289: packet_disconnect("Received oclose for nonexistent channel %d.", id);
1290: chan_rcvd_oclose(c);
1291: }
1.1 deraadt 1292:
1.49 markus 1293: void
1.57.2.3 jason 1294: channel_input_close_confirmation(int type, int plen, void *ctxt)
1.1 deraadt 1295: {
1.41 markus 1296: int id = packet_get_int();
1297: Channel *c = channel_lookup(id);
1.1 deraadt 1298:
1.48 markus 1299: packet_done();
1.41 markus 1300: if (c == NULL)
1301: packet_disconnect("Received close confirmation for "
1302: "out-of-range channel %d.", id);
1303: if (c->type != SSH_CHANNEL_CLOSED)
1304: packet_disconnect("Received close confirmation for "
1305: "non-closed channel %d (type %d).", id, c->type);
1306: channel_free(c->self);
1.1 deraadt 1307: }
1308:
1.49 markus 1309: void
1.57.2.3 jason 1310: channel_input_open_confirmation(int type, int plen, void *ctxt)
1.1 deraadt 1311: {
1.41 markus 1312: int id, remote_id;
1313: Channel *c;
1.1 deraadt 1314:
1.44 markus 1315: if (!compat20)
1316: packet_integrity_check(plen, 4 + 4, type);
1.25 markus 1317:
1.41 markus 1318: id = packet_get_int();
1319: c = channel_lookup(id);
1.25 markus 1320:
1.41 markus 1321: if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1322: packet_disconnect("Received open confirmation for "
1323: "non-opening channel %d.", id);
1324: remote_id = packet_get_int();
1.27 markus 1325: /* Record the remote channel number and mark that the channel is now open. */
1.41 markus 1326: c->remote_id = remote_id;
1327: c->type = SSH_CHANNEL_OPEN;
1.44 markus 1328:
1329: if (compat20) {
1330: c->remote_window = packet_get_int();
1331: c->remote_maxpacket = packet_get_int();
1.48 markus 1332: packet_done();
1.44 markus 1333: if (c->cb_fn != NULL && c->cb_event == type) {
1.57.2.3 jason 1334: debug2("callback start");
1.44 markus 1335: c->cb_fn(c->self, c->cb_arg);
1.57.2.3 jason 1336: debug2("callback done");
1.44 markus 1337: }
1338: debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1339: c->remote_window, c->remote_maxpacket);
1340: }
1.1 deraadt 1341: }
1342:
1.49 markus 1343: void
1.57.2.3 jason 1344: channel_input_open_failure(int type, int plen, void *ctxt)
1.1 deraadt 1345: {
1.57.2.4! jason 1346: int id, reason;
! 1347: char *msg = NULL, *lang = NULL;
1.41 markus 1348: Channel *c;
1349:
1.44 markus 1350: if (!compat20)
1351: packet_integrity_check(plen, 4, type);
1.41 markus 1352:
1353: id = packet_get_int();
1354: c = channel_lookup(id);
1.25 markus 1355:
1.41 markus 1356: if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1357: packet_disconnect("Received open failure for "
1358: "non-opening channel %d.", id);
1.44 markus 1359: if (compat20) {
1.57.2.4! jason 1360: reason = packet_get_int();
! 1361: if (packet_remaining() > 0) {
! 1362: msg = packet_get_string(NULL);
! 1363: lang = packet_get_string(NULL);
! 1364: }
1.48 markus 1365: packet_done();
1.57.2.4! jason 1366: log("channel_open_failure: %d: reason %d %s", id,
! 1367: reason, msg ? msg : "<no additional info>");
! 1368: if (msg != NULL)
! 1369: xfree(msg);
! 1370: if (lang != NULL)
! 1371: xfree(lang);
1.44 markus 1372: }
1.25 markus 1373: /* Free the channel. This will also close the socket. */
1.41 markus 1374: channel_free(id);
1.1 deraadt 1375: }
1376:
1.44 markus 1377: void
1.57.2.3 jason 1378: channel_input_channel_request(int type, int plen, void *ctxt)
1.44 markus 1379: {
1380: int id;
1381: Channel *c;
1382:
1383: id = packet_get_int();
1384: c = channel_lookup(id);
1385:
1386: if (c == NULL ||
1387: (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1388: packet_disconnect("Received request for "
1389: "non-open channel %d.", id);
1390: if (c->cb_fn != NULL && c->cb_event == type) {
1.57.2.3 jason 1391: debug2("callback start");
1.44 markus 1392: c->cb_fn(c->self, c->cb_arg);
1.57.2.3 jason 1393: debug2("callback done");
1.44 markus 1394: } else {
1395: char *service = packet_get_string(NULL);
1396: debug("channel: %d rcvd request for %s", c->self, service);
1.57.2.3 jason 1397: debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
1.44 markus 1398: xfree(service);
1399: }
1400: }
1401:
1.49 markus 1402: void
1.57.2.3 jason 1403: channel_input_window_adjust(int type, int plen, void *ctxt)
1.44 markus 1404: {
1405: Channel *c;
1406: int id, adjust;
1407:
1408: if (!compat20)
1409: return;
1410:
1411: /* Get the channel number and verify it. */
1412: id = packet_get_int();
1413: c = channel_lookup(id);
1414:
1415: if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1416: log("Received window adjust for "
1417: "non-open channel %d.", id);
1418: return;
1419: }
1420: adjust = packet_get_int();
1.48 markus 1421: packet_done();
1.57.2.3 jason 1422: debug2("channel %d: rcvd adjust %d", id, adjust);
1.44 markus 1423: c->remote_window += adjust;
1424: }
1425:
1.27 markus 1426: /*
1427: * Stops listening for channels, and removes any unix domain sockets that we
1428: * might have.
1429: */
1.1 deraadt 1430:
1.49 markus 1431: void
1.25 markus 1432: channel_stop_listening()
1.1 deraadt 1433: {
1.25 markus 1434: int i;
1435: for (i = 0; i < channels_alloc; i++) {
1436: switch (channels[i].type) {
1437: case SSH_CHANNEL_AUTH_SOCKET:
1438: close(channels[i].sock);
1.57.2.4! jason 1439: unlink(channels[i].path);
1.25 markus 1440: channel_free(i);
1441: break;
1442: case SSH_CHANNEL_PORT_LISTENER:
1.57.2.4! jason 1443: case SSH_CHANNEL_RPORT_LISTENER:
1.25 markus 1444: case SSH_CHANNEL_X11_LISTENER:
1445: close(channels[i].sock);
1446: channel_free(i);
1447: break;
1448: default:
1449: break;
1450: }
1.1 deraadt 1451: }
1452: }
1453:
1.27 markus 1454: /*
1.52 markus 1455: * Closes the sockets/fds of all channels. This is used to close extra file
1.27 markus 1456: * descriptors after a fork.
1457: */
1.1 deraadt 1458:
1.49 markus 1459: void
1.25 markus 1460: channel_close_all()
1.1 deraadt 1461: {
1.25 markus 1462: int i;
1.52 markus 1463: for (i = 0; i < channels_alloc; i++)
1.25 markus 1464: if (channels[i].type != SSH_CHANNEL_FREE)
1.52 markus 1465: channel_close_fds(&channels[i]);
1.1 deraadt 1466: }
1467:
1468: /* Returns true if any channel is still open. */
1469:
1.49 markus 1470: int
1.25 markus 1471: channel_still_open()
1.1 deraadt 1472: {
1.57.2.4! jason 1473: u_int i;
1.25 markus 1474: for (i = 0; i < channels_alloc; i++)
1475: switch (channels[i].type) {
1476: case SSH_CHANNEL_FREE:
1477: case SSH_CHANNEL_X11_LISTENER:
1478: case SSH_CHANNEL_PORT_LISTENER:
1.57.2.4! jason 1479: case SSH_CHANNEL_RPORT_LISTENER:
1.25 markus 1480: case SSH_CHANNEL_CLOSED:
1481: case SSH_CHANNEL_AUTH_SOCKET:
1.57.2.4! jason 1482: case SSH_CHANNEL_CONNECTING: /* XXX ??? */
1.25 markus 1483: continue;
1.44 markus 1484: case SSH_CHANNEL_LARVAL:
1485: if (!compat20)
1486: fatal("cannot happen: SSH_CHANNEL_LARVAL");
1487: continue;
1.25 markus 1488: case SSH_CHANNEL_OPENING:
1489: case SSH_CHANNEL_OPEN:
1490: case SSH_CHANNEL_X11_OPEN:
1491: return 1;
1492: case SSH_CHANNEL_INPUT_DRAINING:
1493: case SSH_CHANNEL_OUTPUT_DRAINING:
1494: if (!compat13)
1495: fatal("cannot happen: OUT_DRAIN");
1496: return 1;
1497: default:
1498: fatal("channel_still_open: bad channel type %d", channels[i].type);
1499: /* NOTREACHED */
1500: }
1501: return 0;
1.1 deraadt 1502: }
1503:
1.27 markus 1504: /*
1505: * Returns a message describing the currently open forwarded connections,
1506: * suitable for sending to the client. The message contains crlf pairs for
1507: * newlines.
1508: */
1.1 deraadt 1509:
1.25 markus 1510: char *
1511: channel_open_message()
1.1 deraadt 1512: {
1.25 markus 1513: Buffer buffer;
1514: int i;
1515: char buf[512], *cp;
1516:
1517: buffer_init(&buffer);
1518: snprintf(buf, sizeof buf, "The following connections are open:\r\n");
1.1 deraadt 1519: buffer_append(&buffer, buf, strlen(buf));
1.25 markus 1520: for (i = 0; i < channels_alloc; i++) {
1521: Channel *c = &channels[i];
1522: switch (c->type) {
1523: case SSH_CHANNEL_FREE:
1524: case SSH_CHANNEL_X11_LISTENER:
1525: case SSH_CHANNEL_PORT_LISTENER:
1.57.2.4! jason 1526: case SSH_CHANNEL_RPORT_LISTENER:
1.25 markus 1527: case SSH_CHANNEL_CLOSED:
1528: case SSH_CHANNEL_AUTH_SOCKET:
1529: continue;
1.44 markus 1530: case SSH_CHANNEL_LARVAL:
1.25 markus 1531: case SSH_CHANNEL_OPENING:
1.57.2.4! jason 1532: case SSH_CHANNEL_CONNECTING:
1.25 markus 1533: case SSH_CHANNEL_OPEN:
1534: case SSH_CHANNEL_X11_OPEN:
1535: case SSH_CHANNEL_INPUT_DRAINING:
1536: case SSH_CHANNEL_OUTPUT_DRAINING:
1.41 markus 1537: snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
1.37 markus 1538: c->self, c->remote_name,
1539: c->type, c->remote_id,
1540: c->istate, buffer_len(&c->input),
1.41 markus 1541: c->ostate, buffer_len(&c->output),
1542: c->rfd, c->wfd);
1.25 markus 1543: buffer_append(&buffer, buf, strlen(buf));
1544: continue;
1545: default:
1.41 markus 1546: fatal("channel_open_message: bad channel type %d", c->type);
1.25 markus 1547: /* NOTREACHED */
1548: }
1549: }
1550: buffer_append(&buffer, "\0", 1);
1551: cp = xstrdup(buffer_ptr(&buffer));
1552: buffer_free(&buffer);
1553: return cp;
1.1 deraadt 1554: }
1555:
1.27 markus 1556: /*
1557: * Initiate forwarding of connections to local port "port" through the secure
1558: * channel to host:port from remote side.
1559: */
1.57.2.4! jason 1560: int
! 1561: channel_request_local_forwarding(u_short listen_port, const char *host_to_connect,
! 1562: u_short port_to_connect, int gateway_ports)
! 1563: {
! 1564: return channel_request_forwarding(
! 1565: NULL, listen_port,
! 1566: host_to_connect, port_to_connect,
! 1567: gateway_ports, /*remote_fwd*/ 0);
! 1568: }
1.1 deraadt 1569:
1.57.2.4! jason 1570: /*
! 1571: * If 'remote_fwd' is true we have a '-R style' listener for protocol 2
! 1572: * (SSH_CHANNEL_RPORT_LISTENER).
! 1573: */
! 1574: int
! 1575: channel_request_forwarding(
! 1576: const char *listen_address, u_short listen_port,
! 1577: const char *host_to_connect, u_short port_to_connect,
! 1578: int gateway_ports, int remote_fwd)
1.25 markus 1579: {
1.57.2.4! jason 1580: int success, ch, sock, on = 1, ctype;
1.35 markus 1581: struct addrinfo hints, *ai, *aitop;
1582: char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1.57.2.4! jason 1583: const char *host;
1.28 markus 1584: struct linger linger;
1.25 markus 1585:
1.57.2.4! jason 1586: success = 0;
! 1587:
! 1588: if (remote_fwd) {
! 1589: host = listen_address;
! 1590: ctype = SSH_CHANNEL_RPORT_LISTENER;
! 1591: } else {
! 1592: host = host_to_connect;
! 1593: ctype =SSH_CHANNEL_PORT_LISTENER;
! 1594: }
1.25 markus 1595:
1.57.2.4! jason 1596: if (strlen(host) > sizeof(channels[0].path) - 1) {
! 1597: error("Forward host name too long.");
! 1598: return success;
! 1599: }
! 1600:
! 1601: /* XXX listen_address is currently ignored */
1.28 markus 1602: /*
1.35 markus 1603: * getaddrinfo returns a loopback address if the hostname is
1604: * set to NULL and hints.ai_flags is not AI_PASSIVE
1.28 markus 1605: */
1.35 markus 1606: memset(&hints, 0, sizeof(hints));
1607: hints.ai_family = IPv4or6;
1608: hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1609: hints.ai_socktype = SOCK_STREAM;
1.57.2.4! jason 1610: snprintf(strport, sizeof strport, "%d", listen_port);
1.35 markus 1611: if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1612: packet_disconnect("getaddrinfo: fatal error");
1613:
1614: for (ai = aitop; ai; ai = ai->ai_next) {
1615: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1616: continue;
1617: if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1618: strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1.57.2.4! jason 1619: error("channel_request_forwarding: getnameinfo failed");
1.35 markus 1620: continue;
1621: }
1622: /* Create a port to listen for the host. */
1623: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1624: if (sock < 0) {
1625: /* this is no error since kernel may not support ipv6 */
1626: verbose("socket: %.100s", strerror(errno));
1627: continue;
1628: }
1629: /*
1630: * Set socket options. We would like the socket to disappear
1631: * as soon as it has been closed for whatever reason.
1632: */
1633: setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1634: linger.l_onoff = 1;
1635: linger.l_linger = 5;
1636: setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1637: debug("Local forwarding listening on %s port %s.", ntop, strport);
1638:
1639: /* Bind the socket to the address. */
1640: if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1641: /* address can be in use ipv6 address is already bound */
1642: verbose("bind: %.100s", strerror(errno));
1643: close(sock);
1644: continue;
1645: }
1646: /* Start listening for connections on the socket. */
1647: if (listen(sock, 5) < 0) {
1648: error("listen: %.100s", strerror(errno));
1649: close(sock);
1650: continue;
1651: }
1652: /* Allocate a channel number for the socket. */
1.57.2.4! jason 1653: ch = channel_new("port listener", ctype, sock, sock, -1,
1.51 markus 1654: CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1.57.2.3 jason 1655: 0, xstrdup("port listener"), 1);
1.35 markus 1656: strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
1.57.2.4! jason 1657: channels[ch].host_port = port_to_connect;
! 1658: channels[ch].listening_port = listen_port;
1.35 markus 1659: success = 1;
1660: }
1661: if (success == 0)
1.57.2.4! jason 1662: error("channel_request_forwarding: cannot listen to port: %d",
! 1663: listen_port);
1.35 markus 1664: freeaddrinfo(aitop);
1.57.2.4! jason 1665: return success;
1.25 markus 1666: }
1.1 deraadt 1667:
1.27 markus 1668: /*
1669: * Initiate forwarding of connections to port "port" on remote host through
1670: * the secure channel to host:port from local side.
1671: */
1.1 deraadt 1672:
1.49 markus 1673: void
1.57.2.4! jason 1674: channel_request_remote_forwarding(u_short listen_port,
! 1675: const char *host_to_connect, u_short port_to_connect)
1.25 markus 1676: {
1.57.2.4! jason 1677: int payload_len, type, success = 0;
! 1678:
1.25 markus 1679: /* Record locally that connection to this host/port is permitted. */
1680: if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1681: fatal("channel_request_remote_forwarding: too many forwards");
1682:
1683: /* Send the forward request to the remote side. */
1.44 markus 1684: if (compat20) {
1685: const char *address_to_bind = "0.0.0.0";
1686: packet_start(SSH2_MSG_GLOBAL_REQUEST);
1687: packet_put_cstring("tcpip-forward");
1688: packet_put_char(0); /* boolean: want reply */
1689: packet_put_cstring(address_to_bind);
1690: packet_put_int(listen_port);
1.57.2.4! jason 1691: packet_send();
! 1692: packet_write_wait();
! 1693: /* Assume that server accepts the request */
! 1694: success = 1;
1.44 markus 1695: } else {
1696: packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
1.50 markus 1697: packet_put_int(listen_port);
1698: packet_put_cstring(host_to_connect);
1.44 markus 1699: packet_put_int(port_to_connect);
1700: packet_send();
1701: packet_write_wait();
1.57.2.4! jason 1702:
! 1703: /* Wait for response from the remote side. */
! 1704: type = packet_read(&payload_len);
! 1705: switch (type) {
! 1706: case SSH_SMSG_SUCCESS:
! 1707: success = 1;
! 1708: break;
! 1709: case SSH_SMSG_FAILURE:
! 1710: log("Warning: Server denied remote port forwarding.");
! 1711: break;
! 1712: default:
! 1713: /* Unknown packet */
! 1714: packet_disconnect("Protocol error for port forward request:"
! 1715: "received packet type %d.", type);
! 1716: }
! 1717: }
! 1718: if (success) {
! 1719: permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
! 1720: permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
! 1721: permitted_opens[num_permitted_opens].listen_port = listen_port;
! 1722: num_permitted_opens++;
1.44 markus 1723: }
1.1 deraadt 1724: }
1725:
1.27 markus 1726: /*
1727: * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
1728: * listening for the port, and sends back a success reply (or disconnect
1729: * message if there was an error). This never returns if there was an error.
1730: */
1.1 deraadt 1731:
1.49 markus 1732: void
1.56 markus 1733: channel_input_port_forward_request(int is_root, int gateway_ports)
1.1 deraadt 1734: {
1.31 markus 1735: u_short port, host_port;
1.25 markus 1736: char *hostname;
1.1 deraadt 1737:
1.25 markus 1738: /* Get arguments from the packet. */
1739: port = packet_get_int();
1740: hostname = packet_get_string(NULL);
1741: host_port = packet_get_int();
1742:
1.27 markus 1743: /*
1744: * Check that an unprivileged user is not trying to forward a
1745: * privileged port.
1746: */
1.25 markus 1747: if (port < IPPORT_RESERVED && !is_root)
1748: packet_disconnect("Requested forwarding of port %d but user is not root.",
1749: port);
1.57.2.4! jason 1750: /* Initiate forwarding */
1.56 markus 1751: channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
1.25 markus 1752:
1753: /* Free the argument string. */
1754: xfree(hostname);
1.1 deraadt 1755: }
1756:
1.41 markus 1757: /* XXX move to aux.c */
1758: int
1759: channel_connect_to(const char *host, u_short host_port)
1760: {
1761: struct addrinfo hints, *ai, *aitop;
1762: char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1763: int gaierr;
1764: int sock = -1;
1765:
1766: memset(&hints, 0, sizeof(hints));
1767: hints.ai_family = IPv4or6;
1768: hints.ai_socktype = SOCK_STREAM;
1769: snprintf(strport, sizeof strport, "%d", host_port);
1770: if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1771: error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
1772: return -1;
1773: }
1774: for (ai = aitop; ai; ai = ai->ai_next) {
1775: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1776: continue;
1777: if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1778: strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1779: error("channel_connect_to: getnameinfo failed");
1780: continue;
1781: }
1782: /* Create the socket. */
1783: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1784: if (sock < 0) {
1785: error("socket: %.100s", strerror(errno));
1786: continue;
1787: }
1.57.2.4! jason 1788: if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
! 1789: fatal("connect_to: F_SETFL: %s", strerror(errno));
1.41 markus 1790: /* Connect to the host/port. */
1.57.2.4! jason 1791: if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 &&
! 1792: errno != EINPROGRESS) {
1.41 markus 1793: error("connect %.100s port %s: %.100s", ntop, strport,
1794: strerror(errno));
1795: close(sock);
1.57.2.4! jason 1796: continue; /* fail -- try next */
1.41 markus 1797: }
1798: break; /* success */
1799:
1800: }
1801: freeaddrinfo(aitop);
1802: if (!ai) {
1.57.2.4! jason 1803: error("connect %.100s port %d: failed.", host, host_port);
1.41 markus 1804: return -1;
1805: }
1806: /* success */
1807: return sock;
1808: }
1.57.2.4! jason 1809: int
! 1810: channel_connect_by_listen_adress(u_short listen_port)
! 1811: {
! 1812: int i;
! 1813: for (i = 0; i < num_permitted_opens; i++)
! 1814: if (permitted_opens[i].listen_port == listen_port)
! 1815: return channel_connect_to(
! 1816: permitted_opens[i].host_to_connect,
! 1817: permitted_opens[i].port_to_connect);
! 1818: error("WARNING: Server requests forwarding for unknown listen_port %d",
! 1819: listen_port);
! 1820: return -1;
! 1821: }
! 1822:
1.27 markus 1823: /*
1824: * This is called after receiving PORT_OPEN message. This attempts to
1825: * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1826: * or CHANNEL_OPEN_FAILURE.
1827: */
1.1 deraadt 1828:
1.49 markus 1829: void
1.57.2.3 jason 1830: channel_input_port_open(int type, int plen, void *ctxt)
1.1 deraadt 1831: {
1.31 markus 1832: u_short host_port;
1.25 markus 1833: char *host, *originator_string;
1.41 markus 1834: int remote_channel, sock = -1, newch, i, denied;
1.57.2.4! jason 1835: u_int host_len, originator_len;
1.25 markus 1836:
1837: /* Get remote channel number. */
1838: remote_channel = packet_get_int();
1839:
1840: /* Get host name to connect to. */
1841: host = packet_get_string(&host_len);
1842:
1843: /* Get port to connect to. */
1844: host_port = packet_get_int();
1845:
1846: /* Get remote originator name. */
1.29 markus 1847: if (have_hostname_in_open) {
1.25 markus 1848: originator_string = packet_get_string(&originator_len);
1.29 markus 1849: originator_len += 4; /* size of packet_int */
1850: } else {
1.25 markus 1851: originator_string = xstrdup("unknown (remote did not supply name)");
1.29 markus 1852: originator_len = 0; /* no originator supplied */
1853: }
1.25 markus 1854:
1.41 markus 1855: packet_integrity_check(plen,
1856: 4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
1.25 markus 1857:
1858: /* Check if opening that port is permitted. */
1.41 markus 1859: denied = 0;
1.25 markus 1860: if (!all_opens_permitted) {
1861: /* Go trough all permitted ports. */
1862: for (i = 0; i < num_permitted_opens; i++)
1.41 markus 1863: if (permitted_opens[i].port_to_connect == host_port &&
1864: strcmp(permitted_opens[i].host_to_connect, host) == 0)
1.25 markus 1865: break;
1866:
1867: /* Check if we found the requested port among those permitted. */
1868: if (i >= num_permitted_opens) {
1869: /* The port is not permitted. */
1870: log("Received request to connect to %.100s:%d, but the request was denied.",
1871: host, host_port);
1.41 markus 1872: denied = 1;
1.25 markus 1873: }
1874: }
1.41 markus 1875: sock = denied ? -1 : channel_connect_to(host, host_port);
1876: if (sock > 0) {
1877: /* Allocate a channel for this connection. */
1.57.2.4! jason 1878: newch = channel_allocate(SSH_CHANNEL_CONNECTING,
! 1879: sock, originator_string);
! 1880: /*XXX delay answer? */
1.41 markus 1881: channels[newch].remote_id = remote_channel;
1882:
1883: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1884: packet_put_int(remote_channel);
1885: packet_put_int(newch);
1886: packet_send();
1887: } else {
1888: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1889: packet_put_int(remote_channel);
1890: packet_send();
1.25 markus 1891: }
1892: xfree(host);
1.1 deraadt 1893: }
1894:
1.27 markus 1895: /*
1896: * Creates an internet domain socket for listening for X11 connections.
1897: * Returns a suitable value for the DISPLAY variable, or NULL if an error
1898: * occurs.
1899: */
1.1 deraadt 1900:
1.35 markus 1901: #define NUM_SOCKS 10
1902:
1.25 markus 1903: char *
1.33 markus 1904: x11_create_display_inet(int screen_number, int x11_display_offset)
1.1 deraadt 1905: {
1.31 markus 1906: int display_number, sock;
1907: u_short port;
1.35 markus 1908: struct addrinfo hints, *ai, *aitop;
1909: char strport[NI_MAXSERV];
1910: int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1911: char display[512];
1.25 markus 1912: char hostname[MAXHOSTNAMELEN];
1913:
1.33 markus 1914: for (display_number = x11_display_offset;
1.25 markus 1915: display_number < MAX_DISPLAYS;
1916: display_number++) {
1917: port = 6000 + display_number;
1.35 markus 1918: memset(&hints, 0, sizeof(hints));
1919: hints.ai_family = IPv4or6;
1.36 markus 1920: hints.ai_flags = AI_PASSIVE; /* XXX loopback only ? */
1.35 markus 1921: hints.ai_socktype = SOCK_STREAM;
1922: snprintf(strport, sizeof strport, "%d", port);
1923: if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1924: error("getaddrinfo: %.100s", gai_strerror(gaierr));
1.25 markus 1925: return NULL;
1926: }
1.35 markus 1927: for (ai = aitop; ai; ai = ai->ai_next) {
1928: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1929: continue;
1930: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1931: if (sock < 0) {
1932: error("socket: %.100s", strerror(errno));
1933: return NULL;
1934: }
1935: if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1936: debug("bind port %d: %.100s", port, strerror(errno));
1937: shutdown(sock, SHUT_RDWR);
1938: close(sock);
1939: for (n = 0; n < num_socks; n++) {
1940: shutdown(socks[n], SHUT_RDWR);
1941: close(socks[n]);
1942: }
1943: num_socks = 0;
1944: break;
1945: }
1946: socks[num_socks++] = sock;
1947: if (num_socks == NUM_SOCKS)
1948: break;
1.25 markus 1949: }
1.57.2.4! jason 1950: freeaddrinfo(aitop);
1.35 markus 1951: if (num_socks > 0)
1952: break;
1.25 markus 1953: }
1954: if (display_number >= MAX_DISPLAYS) {
1955: error("Failed to allocate internet-domain X11 display socket.");
1956: return NULL;
1957: }
1958: /* Start listening for connections on the socket. */
1.35 markus 1959: for (n = 0; n < num_socks; n++) {
1960: sock = socks[n];
1961: if (listen(sock, 5) < 0) {
1962: error("listen: %.100s", strerror(errno));
1963: shutdown(sock, SHUT_RDWR);
1964: close(sock);
1965: return NULL;
1966: }
1.25 markus 1967: }
1.35 markus 1968:
1.25 markus 1969: /* Set up a suitable value for the DISPLAY variable. */
1970: if (gethostname(hostname, sizeof(hostname)) < 0)
1971: fatal("gethostname: %.100s", strerror(errno));
1.35 markus 1972: snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
1.25 markus 1973: display_number, screen_number);
1974:
1.35 markus 1975: /* Allocate a channel for each socket. */
1976: for (n = 0; n < num_socks; n++) {
1977: sock = socks[n];
1.51 markus 1978: (void) channel_new("x11 listener",
1979: SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
1980: CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
1.57.2.3 jason 1981: 0, xstrdup("X11 inet listener"), 1);
1.35 markus 1982: }
1.1 deraadt 1983:
1.25 markus 1984: /* Return a suitable value for the DISPLAY environment variable. */
1.35 markus 1985: return xstrdup(display);
1.1 deraadt 1986: }
1987:
1988: #ifndef X_UNIX_PATH
1989: #define X_UNIX_PATH "/tmp/.X11-unix/X"
1990: #endif
1991:
1992: static
1993: int
1.57.2.4! jason 1994: connect_local_xsocket(u_int dnr)
1.1 deraadt 1995: {
1.25 markus 1996: static const char *const x_sockets[] = {
1997: X_UNIX_PATH "%u",
1998: "/var/X/.X11-unix/X" "%u",
1999: "/usr/spool/sockets/X11/" "%u",
2000: NULL
2001: };
2002: int sock;
2003: struct sockaddr_un addr;
2004: const char *const * path;
2005:
2006: for (path = x_sockets; *path; ++path) {
2007: sock = socket(AF_UNIX, SOCK_STREAM, 0);
2008: if (sock < 0)
2009: error("socket: %.100s", strerror(errno));
2010: memset(&addr, 0, sizeof(addr));
2011: addr.sun_family = AF_UNIX;
2012: snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
2013: if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
2014: return sock;
2015: close(sock);
2016: }
2017: error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
2018: return -1;
1.1 deraadt 2019: }
2020:
1.51 markus 2021: int
2022: x11_connect_display(void)
1.1 deraadt 2023: {
1.51 markus 2024: int display_number, sock = 0;
1.25 markus 2025: const char *display;
1.51 markus 2026: char buf[1024], *cp;
1.35 markus 2027: struct addrinfo hints, *ai, *aitop;
2028: char strport[NI_MAXSERV];
2029: int gaierr;
1.25 markus 2030:
2031: /* Try to open a socket for the local X server. */
2032: display = getenv("DISPLAY");
2033: if (!display) {
2034: error("DISPLAY not set.");
1.51 markus 2035: return -1;
1.25 markus 2036: }
1.27 markus 2037: /*
2038: * Now we decode the value of the DISPLAY variable and make a
2039: * connection to the real X server.
2040: */
2041:
2042: /*
2043: * Check if it is a unix domain socket. Unix domain displays are in
2044: * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
2045: */
1.25 markus 2046: if (strncmp(display, "unix:", 5) == 0 ||
2047: display[0] == ':') {
2048: /* Connect to the unix domain socket. */
2049: if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
2050: error("Could not parse display number from DISPLAY: %.100s",
2051: display);
1.51 markus 2052: return -1;
1.25 markus 2053: }
2054: /* Create a socket. */
2055: sock = connect_local_xsocket(display_number);
2056: if (sock < 0)
1.51 markus 2057: return -1;
1.25 markus 2058:
2059: /* OK, we now have a connection to the display. */
1.51 markus 2060: return sock;
1.25 markus 2061: }
1.27 markus 2062: /*
2063: * Connect to an inet socket. The DISPLAY value is supposedly
2064: * hostname:d[.s], where hostname may also be numeric IP address.
2065: */
1.25 markus 2066: strncpy(buf, display, sizeof(buf));
2067: buf[sizeof(buf) - 1] = 0;
2068: cp = strchr(buf, ':');
2069: if (!cp) {
2070: error("Could not find ':' in DISPLAY: %.100s", display);
1.51 markus 2071: return -1;
1.25 markus 2072: }
2073: *cp = 0;
1.27 markus 2074: /* buf now contains the host name. But first we parse the display number. */
1.25 markus 2075: if (sscanf(cp + 1, "%d", &display_number) != 1) {
2076: error("Could not parse display number from DISPLAY: %.100s",
2077: display);
1.51 markus 2078: return -1;
1.25 markus 2079: }
1.35 markus 2080:
2081: /* Look up the host address */
2082: memset(&hints, 0, sizeof(hints));
2083: hints.ai_family = IPv4or6;
2084: hints.ai_socktype = SOCK_STREAM;
2085: snprintf(strport, sizeof strport, "%d", 6000 + display_number);
2086: if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
2087: error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
1.51 markus 2088: return -1;
1.25 markus 2089: }
1.35 markus 2090: for (ai = aitop; ai; ai = ai->ai_next) {
2091: /* Create a socket. */
2092: sock = socket(ai->ai_family, SOCK_STREAM, 0);
2093: if (sock < 0) {
2094: debug("socket: %.100s", strerror(errno));
1.41 markus 2095: continue;
2096: }
2097: /* Connect it to the display. */
2098: if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2099: debug("connect %.100s port %d: %.100s", buf,
2100: 6000 + display_number, strerror(errno));
2101: close(sock);
2102: continue;
2103: }
2104: /* Success */
2105: break;
1.35 markus 2106: }
2107: freeaddrinfo(aitop);
2108: if (!ai) {
1.49 markus 2109: error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
1.35 markus 2110: strerror(errno));
1.51 markus 2111: return -1;
1.25 markus 2112: }
1.51 markus 2113: return sock;
2114: }
2115:
2116: /*
2117: * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
2118: * the remote channel number. We should do whatever we want, and respond
2119: * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
2120: */
2121:
2122: void
1.57.2.3 jason 2123: x11_input_open(int type, int plen, void *ctxt)
1.51 markus 2124: {
2125: int remote_channel, sock = 0, newch;
2126: char *remote_host;
1.57.2.4! jason 2127: u_int remote_len;
1.25 markus 2128:
1.51 markus 2129: /* Get remote channel number. */
2130: remote_channel = packet_get_int();
2131:
2132: /* Get remote originator name. */
2133: if (have_hostname_in_open) {
2134: remote_host = packet_get_string(&remote_len);
2135: remote_len += 4;
2136: } else {
2137: remote_host = xstrdup("unknown (remote did not supply name)");
2138: remote_len = 0;
2139: }
1.25 markus 2140:
1.51 markus 2141: debug("Received X11 open request.");
2142: packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
1.25 markus 2143:
1.51 markus 2144: /* Obtain a connection to the real X display. */
2145: sock = x11_connect_display();
2146: if (sock == -1) {
2147: /* Send refusal to the remote host. */
2148: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2149: packet_put_int(remote_channel);
2150: packet_send();
2151: } else {
2152: /* Allocate a channel for this connection. */
2153: newch = channel_allocate(
2154: (x11_saved_proto == NULL) ?
2155: SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
2156: sock, remote_host);
2157: channels[newch].remote_id = remote_channel;
1.25 markus 2158:
1.51 markus 2159: /* Send a confirmation to the remote host. */
2160: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2161: packet_put_int(remote_channel);
2162: packet_put_int(newch);
2163: packet_send();
2164: }
1.1 deraadt 2165: }
2166:
1.57.2.3 jason 2167: /* dummy protocol handler that denies SSH-1 requests (agent/x11) */
2168: void
2169: deny_input_open(int type, int plen, void *ctxt)
2170: {
2171: int rchan = packet_get_int();
2172: switch(type){
2173: case SSH_SMSG_AGENT_OPEN:
2174: error("Warning: ssh server tried agent forwarding.");
2175: break;
2176: case SSH_SMSG_X11_OPEN:
2177: error("Warning: ssh server tried X11 forwarding.");
2178: break;
2179: default:
2180: error("deny_input_open: type %d plen %d", type, plen);
2181: break;
2182: }
2183: error("Warning: this is probably a break in attempt by a malicious server.");
2184: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2185: packet_put_int(rchan);
2186: packet_send();
2187: }
2188:
1.27 markus 2189: /*
2190: * Requests forwarding of X11 connections, generates fake authentication
2191: * data, and enables authentication spoofing.
2192: */
1.1 deraadt 2193:
1.49 markus 2194: void
1.51 markus 2195: x11_request_forwarding_with_spoofing(int client_session_id,
2196: const char *proto, const char *data)
1.1 deraadt 2197: {
1.57.2.4! jason 2198: u_int data_len = (u_int) strlen(data) / 2;
! 2199: u_int i, value, len;
1.25 markus 2200: char *new_data;
2201: int screen_number;
2202: const char *cp;
2203: u_int32_t rand = 0;
2204:
2205: cp = getenv("DISPLAY");
2206: if (cp)
2207: cp = strchr(cp, ':');
2208: if (cp)
2209: cp = strchr(cp, '.');
2210: if (cp)
2211: screen_number = atoi(cp + 1);
2212: else
2213: screen_number = 0;
2214:
2215: /* Save protocol name. */
2216: x11_saved_proto = xstrdup(proto);
2217:
1.27 markus 2218: /*
2219: * Extract real authentication data and generate fake data of the
2220: * same length.
2221: */
1.25 markus 2222: x11_saved_data = xmalloc(data_len);
2223: x11_fake_data = xmalloc(data_len);
2224: for (i = 0; i < data_len; i++) {
2225: if (sscanf(data + 2 * i, "%2x", &value) != 1)
2226: fatal("x11_request_forwarding: bad authentication data: %.100s", data);
2227: if (i % 4 == 0)
2228: rand = arc4random();
2229: x11_saved_data[i] = value;
2230: x11_fake_data[i] = rand & 0xff;
2231: rand >>= 8;
2232: }
2233: x11_saved_data_len = data_len;
2234: x11_fake_data_len = data_len;
2235:
2236: /* Convert the fake data into hex. */
1.57.2.4! jason 2237: len = 2 * data_len + 1;
! 2238: new_data = xmalloc(len);
1.25 markus 2239: for (i = 0; i < data_len; i++)
1.57.2.4! jason 2240: snprintf(new_data + 2 * i, len - 2 * i,
! 2241: "%02x", (u_char) x11_fake_data[i]);
1.25 markus 2242:
2243: /* Send the request packet. */
1.51 markus 2244: if (compat20) {
2245: channel_request_start(client_session_id, "x11-req", 0);
2246: packet_put_char(0); /* XXX bool single connection */
2247: } else {
2248: packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2249: }
2250: packet_put_cstring(proto);
2251: packet_put_cstring(new_data);
1.25 markus 2252: packet_put_int(screen_number);
2253: packet_send();
2254: packet_write_wait();
2255: xfree(new_data);
1.1 deraadt 2256: }
2257:
2258: /* Sends a message to the server to request authentication fd forwarding. */
2259:
1.49 markus 2260: void
1.25 markus 2261: auth_request_forwarding()
1.1 deraadt 2262: {
1.25 markus 2263: packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2264: packet_send();
2265: packet_write_wait();
1.1 deraadt 2266: }
2267:
1.27 markus 2268: /*
2269: * Returns the name of the forwarded authentication socket. Returns NULL if
2270: * there is no forwarded authentication socket. The returned value points to
2271: * a static buffer.
2272: */
1.1 deraadt 2273:
1.25 markus 2274: char *
2275: auth_get_socket_name()
1.1 deraadt 2276: {
1.25 markus 2277: return channel_forwarded_auth_socket_name;
1.1 deraadt 2278: }
2279:
1.12 markus 2280: /* removes the agent forwarding socket */
2281:
1.49 markus 2282: void
1.25 markus 2283: cleanup_socket(void)
2284: {
1.57.2.4! jason 2285: unlink(channel_forwarded_auth_socket_name);
1.25 markus 2286: rmdir(channel_forwarded_auth_socket_dir);
1.12 markus 2287: }
2288:
1.27 markus 2289: /*
1.57.2.1 jason 2290: * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
1.27 markus 2291: * This starts forwarding authentication requests.
2292: */
1.1 deraadt 2293:
1.57.2.1 jason 2294: int
1.25 markus 2295: auth_input_request_forwarding(struct passwd * pw)
1.1 deraadt 2296: {
1.25 markus 2297: int sock, newch;
2298: struct sockaddr_un sunaddr;
2299:
2300: if (auth_get_socket_name() != NULL)
2301: fatal("Protocol error: authentication forwarding requested twice.");
2302:
2303: /* Temporarily drop privileged uid for mkdir/bind. */
2304: temporarily_use_uid(pw->pw_uid);
2305:
2306: /* Allocate a buffer for the socket name, and format the name. */
2307: channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2308: channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2309: strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
2310:
2311: /* Create private directory for socket */
1.57.2.1 jason 2312: if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {
2313: packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",
2314: strerror(errno));
2315: restore_uid();
2316: xfree(channel_forwarded_auth_socket_name);
2317: xfree(channel_forwarded_auth_socket_dir);
2318: channel_forwarded_auth_socket_name = NULL;
2319: channel_forwarded_auth_socket_dir = NULL;
2320: return 0;
2321: }
1.25 markus 2322: snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2323: channel_forwarded_auth_socket_dir, (int) getpid());
2324:
2325: if (atexit(cleanup_socket) < 0) {
2326: int saved = errno;
2327: cleanup_socket();
2328: packet_disconnect("socket: %.100s", strerror(saved));
2329: }
2330: /* Create the socket. */
2331: sock = socket(AF_UNIX, SOCK_STREAM, 0);
2332: if (sock < 0)
2333: packet_disconnect("socket: %.100s", strerror(errno));
2334:
2335: /* Bind it to the name. */
2336: memset(&sunaddr, 0, sizeof(sunaddr));
2337: sunaddr.sun_family = AF_UNIX;
2338: strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2339: sizeof(sunaddr.sun_path));
2340:
2341: if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2342: packet_disconnect("bind: %.100s", strerror(errno));
2343:
2344: /* Restore the privileged uid. */
2345: restore_uid();
2346:
2347: /* Start listening on the socket. */
2348: if (listen(sock, 5) < 0)
2349: packet_disconnect("listen: %.100s", strerror(errno));
2350:
2351: /* Allocate a channel for the authentication agent socket. */
1.57.2.4! jason 2352: newch = channel_new("auth socket",
! 2353: SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
! 2354: CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
! 2355: 0, xstrdup("auth socket"), 1);
! 2356:
1.32 deraadt 2357: strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2358: sizeof(channels[newch].path));
1.57.2.1 jason 2359: return 1;
1.1 deraadt 2360: }
2361:
2362: /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2363:
1.49 markus 2364: void
1.57.2.3 jason 2365: auth_input_open_request(int type, int plen, void *ctxt)
1.1 deraadt 2366: {
1.25 markus 2367: int remch, sock, newch;
2368: char *dummyname;
1.41 markus 2369:
2370: packet_integrity_check(plen, 4, type);
1.25 markus 2371:
2372: /* Read the remote channel number from the message. */
2373: remch = packet_get_int();
2374:
1.27 markus 2375: /*
2376: * Get a connection to the local authentication agent (this may again
2377: * get forwarded).
2378: */
1.25 markus 2379: sock = ssh_get_authentication_socket();
2380:
1.27 markus 2381: /*
2382: * If we could not connect the agent, send an error message back to
2383: * the server. This should never happen unless the agent dies,
2384: * because authentication forwarding is only enabled if we have an
2385: * agent.
2386: */
1.25 markus 2387: if (sock < 0) {
2388: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2389: packet_put_int(remch);
2390: packet_send();
2391: return;
2392: }
2393: debug("Forwarding authentication connection.");
1.1 deraadt 2394:
1.27 markus 2395: /*
2396: * Dummy host name. This will be freed when the channel is freed; it
2397: * will still be valid in the packet_put_string below since the
2398: * channel cannot yet be freed at that point.
2399: */
1.25 markus 2400: dummyname = xstrdup("authentication agent connection");
2401:
2402: newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2403: channels[newch].remote_id = remch;
2404:
2405: /* Send a confirmation to the remote host. */
2406: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2407: packet_put_int(remch);
2408: packet_put_int(newch);
1.44 markus 2409: packet_send();
2410: }
2411:
2412: void
1.51 markus 2413: channel_start_open(int id)
1.44 markus 2414: {
2415: Channel *c = channel_lookup(id);
2416: if (c == NULL) {
2417: log("channel_open: %d: bad id", id);
2418: return;
2419: }
1.51 markus 2420: debug("send channel open %d", id);
1.44 markus 2421: packet_start(SSH2_MSG_CHANNEL_OPEN);
2422: packet_put_cstring(c->ctype);
2423: packet_put_int(c->self);
2424: packet_put_int(c->local_window);
2425: packet_put_int(c->local_maxpacket);
1.51 markus 2426: }
2427: void
2428: channel_open(int id)
2429: {
2430: /* XXX REMOVE ME */
2431: channel_start_open(id);
1.44 markus 2432: packet_send();
2433: }
2434: void
2435: channel_request(int id, char *service, int wantconfirm)
2436: {
2437: channel_request_start(id, service, wantconfirm);
2438: packet_send();
2439: debug("channel request %d: %s", id, service) ;
2440: }
2441: void
2442: channel_request_start(int id, char *service, int wantconfirm)
2443: {
2444: Channel *c = channel_lookup(id);
2445: if (c == NULL) {
2446: log("channel_request: %d: bad id", id);
2447: return;
2448: }
2449: packet_start(SSH2_MSG_CHANNEL_REQUEST);
2450: packet_put_int(c->remote_id);
2451: packet_put_cstring(service);
2452: packet_put_char(wantconfirm);
2453: }
2454: void
2455: channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2456: {
2457: Channel *c = channel_lookup(id);
2458: if (c == NULL) {
2459: log("channel_register_callback: %d: bad id", id);
2460: return;
2461: }
2462: c->cb_event = mtype;
2463: c->cb_fn = fn;
2464: c->cb_arg = arg;
2465: }
2466: void
2467: channel_register_cleanup(int id, channel_callback_fn *fn)
2468: {
2469: Channel *c = channel_lookup(id);
2470: if (c == NULL) {
2471: log("channel_register_cleanup: %d: bad id", id);
2472: return;
2473: }
2474: c->dettach_user = fn;
2475: }
2476: void
2477: channel_cancel_cleanup(int id)
2478: {
2479: Channel *c = channel_lookup(id);
2480: if (c == NULL) {
2481: log("channel_cancel_cleanup: %d: bad id", id);
2482: return;
2483: }
2484: c->dettach_user = NULL;
1.57.2.2 jason 2485: }
1.57.2.4! jason 2486: void
1.57.2.2 jason 2487: channel_register_filter(int id, channel_filter_fn *fn)
2488: {
2489: Channel *c = channel_lookup(id);
2490: if (c == NULL) {
2491: log("channel_register_filter: %d: bad id", id);
2492: return;
2493: }
2494: c->input_filter = fn;
1.44 markus 2495: }
2496:
2497: void
1.57.2.3 jason 2498: channel_set_fds(int id, int rfd, int wfd, int efd,
2499: int extusage, int nonblock)
1.44 markus 2500: {
2501: Channel *c = channel_lookup(id);
2502: if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2503: fatal("channel_activate for non-larval channel %d.", id);
1.57.2.3 jason 2504: channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
1.44 markus 2505: c->type = SSH_CHANNEL_OPEN;
2506: /* XXX window size? */
1.57.2.3 jason 2507: c->local_window = c->local_window_max = c->local_maxpacket * 2;
1.44 markus 2508: packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2509: packet_put_int(c->remote_id);
2510: packet_put_int(c->local_window);
1.25 markus 2511: packet_send();
1.1 deraadt 2512: }
![[BACK]](/icons/back.gif){kind=icon}
Return to channels.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh