Annotation of src/usr.bin/ssh/channels.c, Revision 1.67
1.1 deraadt 1: /*
1.26 deraadt 2: * Author: Tatu Ylonen <ylo@cs.hut.fi>
3: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: * All rights reserved
5: * This file contains functions for generic socket connection forwarding.
6: * There is also code for initiating connection forwarding for X11 connections,
7: * arbitrary tcp/ip connections, and the authentication agent connection.
1.49 markus 8: *
1.67 ! deraadt 9: * As far as I am concerned, the code I have written for this software
! 10: * can be used freely for any purpose. Any derived versions of this
! 11: * software must be clearly marked as such, and if the derived work is
! 12: * incompatible with the protocol description in the RFC file, it must be
! 13: * called by a name other than "ssh" or "Secure Shell".
! 14: *
! 15: *
1.44 markus 16: * SSH2 support added by Markus Friedl.
1.67 ! deraadt 17: * Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
! 18: * Copyright (c) 1999 Dug Song. All rights reserved.
! 19: * Copyright (c) 1999 Theo de Raadt. All rights reserved.
! 20: *
! 21: * Redistribution and use in source and binary forms, with or without
! 22: * modification, are permitted provided that the following conditions
! 23: * are met:
! 24: * 1. Redistributions of source code must retain the above copyright
! 25: * notice, this list of conditions and the following disclaimer.
! 26: * 2. Redistributions in binary form must reproduce the above copyright
! 27: * notice, this list of conditions and the following disclaimer in the
! 28: * documentation and/or other materials provided with the distribution.
! 29: *
! 30: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
! 31: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
! 32: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
! 33: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
! 34: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
! 35: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
! 36: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
! 37: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
! 38: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
! 39: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.26 deraadt 40: */
1.1 deraadt 41:
42: #include "includes.h"
1.67 ! deraadt 43: RCSID("$OpenBSD: channels.c,v 1.66 2000/08/19 21:55:51 markus Exp $");
1.1 deraadt 44:
45: #include "ssh.h"
46: #include "packet.h"
47: #include "xmalloc.h"
48: #include "buffer.h"
49: #include "uidswap.h"
1.20 markus 50: #include "readconf.h"
1.3 deraadt 51: #include "servconf.h"
1.1 deraadt 52:
1.14 markus 53: #include "channels.h"
54: #include "nchan.h"
55: #include "compat.h"
56:
1.44 markus 57: #include "ssh2.h"
1.64 markus 58:
59: #include <openssl/rsa.h>
60: #include <openssl/dsa.h>
61: #include "key.h"
62: #include "authfd.h"
1.44 markus 63:
1.1 deraadt 64: /* Maximum number of fake X11 displays to try. */
65: #define MAX_DISPLAYS 1000
66:
1.12 markus 67: /* Max len of agent socket */
68: #define MAX_SOCKET_NAME 100
69:
1.51 markus 70: /* default window/packet sizes for tcp/x11-fwd-channel */
71: #define CHAN_TCP_WINDOW_DEFAULT (8*1024)
72: #define CHAN_TCP_PACKET_DEFAULT (CHAN_TCP_WINDOW_DEFAULT/2)
73: #define CHAN_X11_WINDOW_DEFAULT (4*1024)
74: #define CHAN_X11_PACKET_DEFAULT (CHAN_X11_WINDOW_DEFAULT/2)
1.41 markus 75:
1.27 markus 76: /*
77: * Pointer to an array containing all allocated channels. The array is
78: * dynamically extended as needed.
79: */
1.1 deraadt 80: static Channel *channels = NULL;
81:
1.27 markus 82: /*
83: * Size of the channel array. All slots of the array must always be
84: * initialized (at least the type field); unused slots are marked with type
85: * SSH_CHANNEL_FREE.
86: */
1.1 deraadt 87: static int channels_alloc = 0;
88:
1.27 markus 89: /*
90: * Maximum file descriptor value used in any of the channels. This is
91: * updated in channel_allocate.
92: */
1.1 deraadt 93: static int channel_max_fd_value = 0;
94:
1.12 markus 95: /* Name and directory of socket for authentication agent forwarding. */
1.1 deraadt 96: static char *channel_forwarded_auth_socket_name = NULL;
1.25 markus 97: static char *channel_forwarded_auth_socket_dir = NULL;
1.1 deraadt 98:
99: /* Saved X11 authentication protocol name. */
100: char *x11_saved_proto = NULL;
101:
102: /* Saved X11 authentication data. This is the real data. */
103: char *x11_saved_data = NULL;
104: unsigned int x11_saved_data_len = 0;
105:
1.27 markus 106: /*
107: * Fake X11 authentication data. This is what the server will be sending us;
108: * we should replace any occurrences of this by the real data.
109: */
1.1 deraadt 110: char *x11_fake_data = NULL;
111: unsigned int x11_fake_data_len;
112:
1.27 markus 113: /*
114: * Data structure for storing which hosts are permitted for forward requests.
115: * The local sides of any remote forwards are stored in this array to prevent
116: * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
117: * network (which might be behind a firewall).
118: */
1.25 markus 119: typedef struct {
1.41 markus 120: char *host_to_connect; /* Connect to 'host'. */
121: u_short port_to_connect; /* Connect to 'port'. */
122: u_short listen_port; /* Remote side should listen port number. */
1.1 deraadt 123: } ForwardPermission;
124:
125: /* List of all permitted host/port pairs to connect. */
126: static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
127: /* Number of permitted host/port pairs in the array. */
128: static int num_permitted_opens = 0;
1.27 markus 129: /*
130: * If this is true, all opens are permitted. This is the case on the server
131: * on which we have to trust the client anyway, and the user could do
132: * anything after logging in anyway.
133: */
1.1 deraadt 134: static int all_opens_permitted = 0;
135:
136: /* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
137: static int have_hostname_in_open = 0;
138:
139: /* Sets specific protocol options. */
140:
1.49 markus 141: void
1.25 markus 142: channel_set_options(int hostname_in_open)
1.1 deraadt 143: {
1.25 markus 144: have_hostname_in_open = hostname_in_open;
1.1 deraadt 145: }
146:
1.27 markus 147: /*
148: * Permits opening to any host/port in SSH_MSG_PORT_OPEN. This is usually
149: * called by the server, because the user could connect to any port anyway,
150: * and the server has no way to know but to trust the client anyway.
151: */
1.1 deraadt 152:
1.49 markus 153: void
1.25 markus 154: channel_permit_all_opens()
1.1 deraadt 155: {
1.25 markus 156: all_opens_permitted = 1;
1.1 deraadt 157: }
158:
1.41 markus 159: /* lookup channel by id */
160:
161: Channel *
162: channel_lookup(int id)
163: {
164: Channel *c;
1.63 provos 165: if (id < 0 || id > channels_alloc) {
1.41 markus 166: log("channel_lookup: %d: bad id", id);
167: return NULL;
168: }
169: c = &channels[id];
170: if (c->type == SSH_CHANNEL_FREE) {
171: log("channel_lookup: %d: bad id: channel free", id);
172: return NULL;
173: }
174: return c;
1.55 markus 175: }
176:
1.27 markus 177: /*
1.55 markus 178: * Register filedescriptors for a channel, used when allocating a channel or
1.52 markus 179: * when the channel consumer/producer is ready, e.g. shell exec'd
1.27 markus 180: */
1.1 deraadt 181:
1.52 markus 182: void
183: channel_register_fds(Channel *c, int rfd, int wfd, int efd, int extusage)
1.1 deraadt 184: {
1.25 markus 185: /* Update the maximum file descriptor value. */
1.41 markus 186: if (rfd > channel_max_fd_value)
187: channel_max_fd_value = rfd;
188: if (wfd > channel_max_fd_value)
189: channel_max_fd_value = wfd;
190: if (efd > channel_max_fd_value)
191: channel_max_fd_value = efd;
1.27 markus 192: /* XXX set close-on-exec -markus */
1.55 markus 193:
1.52 markus 194: c->rfd = rfd;
195: c->wfd = wfd;
196: c->sock = (rfd == wfd) ? rfd : -1;
197: c->efd = efd;
198: c->extended_usage = extusage;
1.55 markus 199: if (rfd != -1)
200: set_nonblock(rfd);
201: if (wfd != -1)
202: set_nonblock(wfd);
203: if (efd != -1)
204: set_nonblock(efd);
1.52 markus 205: }
206:
207: /*
208: * Allocate a new channel object and set its type and socket. This will cause
209: * remote_name to be freed.
210: */
211:
212: int
213: channel_new(char *ctype, int type, int rfd, int wfd, int efd,
214: int window, int maxpack, int extusage, char *remote_name)
215: {
216: int i, found;
217: Channel *c;
1.25 markus 218:
219: /* Do initial allocation if this is the first call. */
220: if (channels_alloc == 0) {
1.44 markus 221: chan_init();
1.25 markus 222: channels_alloc = 10;
223: channels = xmalloc(channels_alloc * sizeof(Channel));
224: for (i = 0; i < channels_alloc; i++)
225: channels[i].type = SSH_CHANNEL_FREE;
1.27 markus 226: /*
227: * Kludge: arrange a call to channel_stop_listening if we
228: * terminate with fatal().
229: */
1.25 markus 230: fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
231: }
232: /* Try to find a free slot where to put the new channel. */
233: for (found = -1, i = 0; i < channels_alloc; i++)
234: if (channels[i].type == SSH_CHANNEL_FREE) {
235: /* Found a free slot. */
236: found = i;
237: break;
238: }
239: if (found == -1) {
1.27 markus 240: /* There are no free slots. Take last+1 slot and expand the array. */
1.25 markus 241: found = channels_alloc;
242: channels_alloc += 10;
243: debug("channel: expanding %d", channels_alloc);
244: channels = xrealloc(channels, channels_alloc * sizeof(Channel));
245: for (i = found; i < channels_alloc; i++)
246: channels[i].type = SSH_CHANNEL_FREE;
247: }
248: /* Initialize and return new channel number. */
249: c = &channels[found];
250: buffer_init(&c->input);
251: buffer_init(&c->output);
1.41 markus 252: buffer_init(&c->extended);
1.25 markus 253: chan_init_iostates(c);
1.52 markus 254: channel_register_fds(c, rfd, wfd, efd, extusage);
1.25 markus 255: c->self = found;
256: c->type = type;
1.41 markus 257: c->ctype = ctype;
1.51 markus 258: c->local_window = window;
259: c->local_window_max = window;
260: c->local_consumed = 0;
261: c->local_maxpacket = maxpack;
1.25 markus 262: c->remote_id = -1;
263: c->remote_name = remote_name;
1.41 markus 264: c->remote_window = 0;
265: c->remote_maxpacket = 0;
266: c->cb_fn = NULL;
267: c->cb_arg = NULL;
268: c->cb_event = 0;
269: c->dettach_user = NULL;
1.65 markus 270: c->input_filter = NULL;
1.25 markus 271: debug("channel %d: new [%s]", found, remote_name);
272: return found;
1.1 deraadt 273: }
1.52 markus 274: /* old interface XXX */
1.49 markus 275: int
1.41 markus 276: channel_allocate(int type, int sock, char *remote_name)
277: {
278: return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name);
279: }
1.1 deraadt 280:
1.52 markus 281:
282: /* Close all channel fd/socket. */
283:
284: void
285: channel_close_fds(Channel *c)
286: {
287: if (c->sock != -1) {
288: close(c->sock);
289: c->sock = -1;
290: }
291: if (c->rfd != -1) {
292: close(c->rfd);
293: c->rfd = -1;
294: }
295: if (c->wfd != -1) {
296: close(c->wfd);
297: c->wfd = -1;
298: }
299: if (c->efd != -1) {
300: close(c->efd);
301: c->efd = -1;
302: }
303: }
304:
305: /* Free the channel and close its fd/socket. */
1.1 deraadt 306:
1.49 markus 307: void
1.41 markus 308: channel_free(int id)
1.1 deraadt 309: {
1.41 markus 310: Channel *c = channel_lookup(id);
311: if (c == NULL)
312: packet_disconnect("channel free: bad local channel %d", id);
313: debug("channel_free: channel %d: status: %s", id, channel_open_message());
1.44 markus 314: if (c->dettach_user != NULL) {
315: debug("channel_free: channel %d: dettaching channel user", id);
316: c->dettach_user(c->self, NULL);
317: }
1.54 markus 318: if (c->sock != -1)
319: shutdown(c->sock, SHUT_RDWR);
1.52 markus 320: channel_close_fds(c);
1.41 markus 321: buffer_free(&c->input);
322: buffer_free(&c->output);
323: buffer_free(&c->extended);
324: c->type = SSH_CHANNEL_FREE;
325: if (c->remote_name) {
326: xfree(c->remote_name);
327: c->remote_name = NULL;
1.25 markus 328: }
1.1 deraadt 329: }
330:
1.27 markus 331: /*
1.41 markus 332: * 'channel_pre*' are called just before select() to add any bits relevant to
333: * channels in the select bitmasks.
334: */
335: /*
336: * 'channel_post*': perform any appropriate operations for channels which
337: * have events pending.
1.27 markus 338: */
1.41 markus 339: typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
340: chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
341: chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
342:
343: void
344: channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
345: {
346: FD_SET(c->sock, readset);
347: }
348:
349: void
350: channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
351: {
352: if (buffer_len(&c->input) < packet_get_maxsize())
353: FD_SET(c->sock, readset);
354: if (buffer_len(&c->output) > 0)
355: FD_SET(c->sock, writeset);
356: }
1.1 deraadt 357:
1.41 markus 358: void
359: channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
360: {
361: /* test whether sockets are 'alive' for read/write */
362: if (c->istate == CHAN_INPUT_OPEN)
363: if (buffer_len(&c->input) < packet_get_maxsize())
364: FD_SET(c->sock, readset);
365: if (c->ostate == CHAN_OUTPUT_OPEN ||
366: c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
367: if (buffer_len(&c->output) > 0) {
368: FD_SET(c->sock, writeset);
369: } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
370: chan_obuf_empty(c);
371: }
372: }
373: }
374:
375: void
1.44 markus 376: channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
377: {
378: if (c->istate == CHAN_INPUT_OPEN &&
379: c->remote_window > 0 &&
380: buffer_len(&c->input) < c->remote_window)
381: FD_SET(c->rfd, readset);
382: if (c->ostate == CHAN_OUTPUT_OPEN ||
383: c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
384: if (buffer_len(&c->output) > 0) {
385: FD_SET(c->wfd, writeset);
386: } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
387: chan_obuf_empty(c);
388: }
389: }
390: /** XXX check close conditions, too */
391: if (c->efd != -1) {
392: if (c->extended_usage == CHAN_EXTENDED_WRITE &&
393: buffer_len(&c->extended) > 0)
394: FD_SET(c->efd, writeset);
395: else if (c->extended_usage == CHAN_EXTENDED_READ &&
396: buffer_len(&c->extended) < c->remote_window)
397: FD_SET(c->efd, readset);
398: }
399: }
400:
401: void
1.41 markus 402: channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
403: {
404: if (buffer_len(&c->input) == 0) {
405: packet_start(SSH_MSG_CHANNEL_CLOSE);
406: packet_put_int(c->remote_id);
407: packet_send();
408: c->type = SSH_CHANNEL_CLOSED;
409: debug("Closing channel %d after input drain.", c->self);
410: }
411: }
412:
413: void
414: channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
415: {
416: if (buffer_len(&c->output) == 0)
417: channel_free(c->self);
1.49 markus 418: else
1.41 markus 419: FD_SET(c->sock, writeset);
420: }
421:
422: /*
423: * This is a special state for X11 authentication spoofing. An opened X11
424: * connection (when authentication spoofing is being done) remains in this
425: * state until the first packet has been completely read. The authentication
426: * data in that packet is then substituted by the real data if it matches the
427: * fake data, and the channel is put into normal mode.
1.51 markus 428: * XXX All this happens at the client side.
1.41 markus 429: */
430: int
431: x11_open_helper(Channel *c)
1.1 deraadt 432: {
1.25 markus 433: unsigned char *ucp;
434: unsigned int proto_len, data_len;
435:
1.41 markus 436: /* Check if the fixed size part of the packet is in buffer. */
437: if (buffer_len(&c->output) < 12)
438: return 0;
439:
440: /* Parse the lengths of variable-length fields. */
441: ucp = (unsigned char *) buffer_ptr(&c->output);
442: if (ucp[0] == 0x42) { /* Byte order MSB first. */
443: proto_len = 256 * ucp[6] + ucp[7];
444: data_len = 256 * ucp[8] + ucp[9];
445: } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */
446: proto_len = ucp[6] + 256 * ucp[7];
447: data_len = ucp[8] + 256 * ucp[9];
448: } else {
449: debug("Initial X11 packet contains bad byte order byte: 0x%x",
450: ucp[0]);
451: return -1;
452: }
453:
454: /* Check if the whole packet is in buffer. */
455: if (buffer_len(&c->output) <
456: 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
457: return 0;
458:
459: /* Check if authentication protocol matches. */
460: if (proto_len != strlen(x11_saved_proto) ||
461: memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
462: debug("X11 connection uses different authentication protocol.");
463: return -1;
464: }
465: /* Check if authentication data matches our fake data. */
466: if (data_len != x11_fake_data_len ||
467: memcmp(ucp + 12 + ((proto_len + 3) & ~3),
468: x11_fake_data, x11_fake_data_len) != 0) {
469: debug("X11 auth data does not match fake data.");
470: return -1;
471: }
472: /* Check fake data length */
473: if (x11_fake_data_len != x11_saved_data_len) {
474: error("X11 fake_data_len %d != saved_data_len %d",
475: x11_fake_data_len, x11_saved_data_len);
476: return -1;
477: }
478: /*
479: * Received authentication protocol and data match
480: * our fake data. Substitute the fake data with real
481: * data.
482: */
483: memcpy(ucp + 12 + ((proto_len + 3) & ~3),
484: x11_saved_data, x11_saved_data_len);
485: return 1;
486: }
487:
488: void
489: channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
490: {
491: int ret = x11_open_helper(c);
492: if (ret == 1) {
493: /* Start normal processing for the channel. */
494: c->type = SSH_CHANNEL_OPEN;
1.47 markus 495: channel_pre_open_13(c, readset, writeset);
1.41 markus 496: } else if (ret == -1) {
497: /*
498: * We have received an X11 connection that has bad
499: * authentication information.
500: */
501: log("X11 connection rejected because of wrong authentication.\r\n");
502: buffer_clear(&c->input);
503: buffer_clear(&c->output);
504: close(c->sock);
505: c->sock = -1;
506: c->type = SSH_CHANNEL_CLOSED;
507: packet_start(SSH_MSG_CHANNEL_CLOSE);
508: packet_put_int(c->remote_id);
509: packet_send();
510: }
511: }
1.25 markus 512:
1.41 markus 513: void
1.51 markus 514: channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
1.41 markus 515: {
516: int ret = x11_open_helper(c);
517: if (ret == 1) {
518: c->type = SSH_CHANNEL_OPEN;
1.57 markus 519: if (compat20)
520: channel_pre_open_20(c, readset, writeset);
521: else
522: channel_pre_open_15(c, readset, writeset);
1.41 markus 523: } else if (ret == -1) {
524: debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
1.51 markus 525: chan_read_failed(c); /** force close? */
1.41 markus 526: chan_write_failed(c);
527: debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
528: }
529: }
1.25 markus 530:
1.41 markus 531: /* This is our fake X11 server socket. */
532: void
533: channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
534: {
535: struct sockaddr addr;
536: int newsock, newch;
537: socklen_t addrlen;
538: char buf[16384], *remote_hostname;
1.51 markus 539: int remote_port;
1.25 markus 540:
1.41 markus 541: if (FD_ISSET(c->sock, readset)) {
542: debug("X11 connection requested.");
543: addrlen = sizeof(addr);
544: newsock = accept(c->sock, &addr, &addrlen);
545: if (newsock < 0) {
546: error("accept: %.100s", strerror(errno));
547: return;
548: }
549: remote_hostname = get_remote_hostname(newsock);
1.51 markus 550: remote_port = get_peer_port(newsock);
1.41 markus 551: snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
1.51 markus 552: remote_hostname, remote_port);
553:
554: newch = channel_new("x11",
555: SSH_CHANNEL_OPENING, newsock, newsock, -1,
556: c->local_window_max, c->local_maxpacket,
557: 0, xstrdup(buf));
558: if (compat20) {
559: packet_start(SSH2_MSG_CHANNEL_OPEN);
560: packet_put_cstring("x11");
561: packet_put_int(newch);
562: packet_put_int(c->local_window_max);
563: packet_put_int(c->local_maxpacket);
564: /* originator host and port */
565: packet_put_cstring(remote_hostname);
1.57 markus 566: if (datafellows & SSH_BUG_X11FWD) {
567: debug("ssh2 x11 bug compat mode");
568: } else {
569: packet_put_int(remote_port);
570: }
1.51 markus 571: packet_send();
572: } else {
573: packet_start(SSH_SMSG_X11_OPEN);
574: packet_put_int(newch);
575: if (have_hostname_in_open)
576: packet_put_string(buf, strlen(buf));
577: packet_send();
578: }
1.41 markus 579: xfree(remote_hostname);
580: }
581: }
1.25 markus 582:
1.41 markus 583: /*
584: * This socket is listening for connections to a forwarded TCP/IP port.
585: */
586: void
587: channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
588: {
589: struct sockaddr addr;
590: int newsock, newch;
591: socklen_t addrlen;
592: char buf[1024], *remote_hostname;
593: int remote_port;
1.25 markus 594:
1.41 markus 595: if (FD_ISSET(c->sock, readset)) {
596: debug("Connection to port %d forwarding "
597: "to %.100s port %d requested.",
598: c->listening_port, c->path, c->host_port);
599: addrlen = sizeof(addr);
600: newsock = accept(c->sock, &addr, &addrlen);
601: if (newsock < 0) {
602: error("accept: %.100s", strerror(errno));
603: return;
604: }
605: remote_hostname = get_remote_hostname(newsock);
606: remote_port = get_peer_port(newsock);
607: snprintf(buf, sizeof buf,
608: "listen port %d for %.100s port %d, "
609: "connect from %.200s port %d",
610: c->listening_port, c->path, c->host_port,
611: remote_hostname, remote_port);
612: newch = channel_new("direct-tcpip",
613: SSH_CHANNEL_OPENING, newsock, newsock, -1,
614: c->local_window_max, c->local_maxpacket,
615: 0, xstrdup(buf));
1.44 markus 616: if (compat20) {
617: packet_start(SSH2_MSG_CHANNEL_OPEN);
618: packet_put_cstring("direct-tcpip");
619: packet_put_int(newch);
620: packet_put_int(c->local_window_max);
621: packet_put_int(c->local_maxpacket);
1.48 markus 622: /* target host and port */
1.44 markus 623: packet_put_string(c->path, strlen(c->path));
624: packet_put_int(c->host_port);
1.48 markus 625: /* originator host and port */
1.44 markus 626: packet_put_cstring(remote_hostname);
627: packet_put_int(remote_port);
628: packet_send();
629: } else {
630: packet_start(SSH_MSG_PORT_OPEN);
631: packet_put_int(newch);
632: packet_put_string(c->path, strlen(c->path));
633: packet_put_int(c->host_port);
634: if (have_hostname_in_open) {
635: packet_put_string(buf, strlen(buf));
636: }
637: packet_send();
1.41 markus 638: }
639: xfree(remote_hostname);
640: }
641: }
1.25 markus 642:
1.41 markus 643: /*
644: * This is the authentication agent socket listening for connections from
645: * clients.
646: */
647: void
648: channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
649: {
650: struct sockaddr addr;
651: int newsock, newch;
652: socklen_t addrlen;
1.25 markus 653:
1.41 markus 654: if (FD_ISSET(c->sock, readset)) {
655: addrlen = sizeof(addr);
656: newsock = accept(c->sock, &addr, &addrlen);
657: if (newsock < 0) {
658: error("accept from auth socket: %.100s", strerror(errno));
659: return;
660: }
661: newch = channel_allocate(SSH_CHANNEL_OPENING, newsock,
662: xstrdup("accepted auth socket"));
663: packet_start(SSH_SMSG_AGENT_OPEN);
664: packet_put_int(newch);
665: packet_send();
666: }
667: }
1.25 markus 668:
1.41 markus 669: int
670: channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
671: {
672: char buf[16*1024];
673: int len;
1.25 markus 674:
1.41 markus 675: if (c->rfd != -1 &&
676: FD_ISSET(c->rfd, readset)) {
677: len = read(c->rfd, buf, sizeof(buf));
1.53 markus 678: if (len < 0 && (errno == EINTR || errno == EAGAIN))
679: return 1;
1.41 markus 680: if (len <= 0) {
1.51 markus 681: debug("channel %d: read<=0 rfd %d len %d",
1.41 markus 682: c->self, c->rfd, len);
1.25 markus 683: if (compat13) {
1.41 markus 684: buffer_consume(&c->output, buffer_len(&c->output));
685: c->type = SSH_CHANNEL_INPUT_DRAINING;
686: debug("Channel %d status set to input draining.", c->self);
1.25 markus 687: } else {
1.41 markus 688: chan_read_failed(c);
1.25 markus 689: }
1.41 markus 690: return -1;
691: }
1.65 markus 692: if(c->input_filter != NULL) {
1.66 markus 693: if (c->input_filter(c, buf, len) == -1) {
1.65 markus 694: debug("filter stops channel %d", c->self);
695: chan_read_failed(c);
696: }
697: } else {
698: buffer_append(&c->input, buf, len);
699: }
1.41 markus 700: }
701: return 1;
702: }
703: int
704: channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
705: {
706: int len;
1.25 markus 707:
1.41 markus 708: /* Send buffered output data to the socket. */
709: if (c->wfd != -1 &&
710: FD_ISSET(c->wfd, writeset) &&
711: buffer_len(&c->output) > 0) {
712: len = write(c->wfd, buffer_ptr(&c->output),
1.53 markus 713: buffer_len(&c->output));
714: if (len < 0 && (errno == EINTR || errno == EAGAIN))
715: return 1;
1.41 markus 716: if (len <= 0) {
717: if (compat13) {
718: buffer_consume(&c->output, buffer_len(&c->output));
719: debug("Channel %d status set to input draining.", c->self);
720: c->type = SSH_CHANNEL_INPUT_DRAINING;
721: } else {
722: chan_write_failed(c);
723: }
724: return -1;
1.25 markus 725: }
1.41 markus 726: buffer_consume(&c->output, len);
1.44 markus 727: if (compat20 && len > 0) {
728: c->local_consumed += len;
729: }
730: }
731: return 1;
732: }
733: int
734: channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
735: {
736: char buf[16*1024];
737: int len;
738:
1.45 markus 739: /** XXX handle drain efd, too */
1.44 markus 740: if (c->efd != -1) {
741: if (c->extended_usage == CHAN_EXTENDED_WRITE &&
742: FD_ISSET(c->efd, writeset) &&
743: buffer_len(&c->extended) > 0) {
744: len = write(c->efd, buffer_ptr(&c->extended),
745: buffer_len(&c->extended));
746: debug("channel %d: written %d to efd %d",
747: c->self, len, c->efd);
748: if (len > 0) {
749: buffer_consume(&c->extended, len);
750: c->local_consumed += len;
751: }
752: } else if (c->extended_usage == CHAN_EXTENDED_READ &&
753: FD_ISSET(c->efd, readset)) {
754: len = read(c->efd, buf, sizeof(buf));
755: debug("channel %d: read %d from efd %d",
756: c->self, len, c->efd);
1.45 markus 757: if (len == 0) {
758: debug("channel %d: closing efd %d",
759: c->self, c->efd);
760: close(c->efd);
761: c->efd = -1;
762: } else if (len > 0)
1.44 markus 763: buffer_append(&c->extended, buf, len);
764: }
765: }
766: return 1;
767: }
768: int
769: channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
770: {
1.46 markus 771: if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
1.44 markus 772: c->local_window < c->local_window_max/2 &&
773: c->local_consumed > 0) {
774: packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
775: packet_put_int(c->remote_id);
776: packet_put_int(c->local_consumed);
777: packet_send();
778: debug("channel %d: window %d sent adjust %d",
779: c->self, c->local_window,
780: c->local_consumed);
781: c->local_window += c->local_consumed;
782: c->local_consumed = 0;
1.1 deraadt 783: }
1.41 markus 784: return 1;
1.1 deraadt 785: }
786:
1.41 markus 787: void
788: channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
789: {
790: channel_handle_rfd(c, readset, writeset);
791: channel_handle_wfd(c, readset, writeset);
792: }
1.1 deraadt 793:
1.41 markus 794: void
1.44 markus 795: channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
796: {
797: channel_handle_rfd(c, readset, writeset);
798: channel_handle_wfd(c, readset, writeset);
799: channel_handle_efd(c, readset, writeset);
800: channel_check_window(c, readset, writeset);
801: }
802:
803: void
1.41 markus 804: channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
1.1 deraadt 805: {
1.41 markus 806: int len;
807: /* Send buffered output data to the socket. */
808: if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
809: len = write(c->sock, buffer_ptr(&c->output),
810: buffer_len(&c->output));
811: if (len <= 0)
812: buffer_consume(&c->output, buffer_len(&c->output));
813: else
814: buffer_consume(&c->output, len);
815: }
816: }
1.25 markus 817:
1.41 markus 818: void
1.44 markus 819: channel_handler_init_20(void)
820: {
821: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20;
1.51 markus 822: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
1.44 markus 823: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
1.51 markus 824: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
1.44 markus 825:
826: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2;
827: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
1.51 markus 828: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
1.44 markus 829: }
830:
831: void
1.41 markus 832: channel_handler_init_13(void)
833: {
834: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13;
835: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13;
836: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
837: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
838: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
839: channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining;
840: channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining;
1.25 markus 841:
1.41 markus 842: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
843: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
844: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
845: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
846: channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13;
847: }
1.25 markus 848:
1.41 markus 849: void
850: channel_handler_init_15(void)
851: {
852: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15;
1.51 markus 853: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
1.41 markus 854: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
855: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
856: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
1.25 markus 857:
1.41 markus 858: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
859: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
860: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
861: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
862: }
1.27 markus 863:
1.41 markus 864: void
865: channel_handler_init(void)
866: {
867: int i;
868: for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
869: channel_pre[i] = NULL;
870: channel_post[i] = NULL;
871: }
1.44 markus 872: if (compat20)
873: channel_handler_init_20();
874: else if (compat13)
1.41 markus 875: channel_handler_init_13();
876: else
877: channel_handler_init_15();
878: }
1.25 markus 879:
1.49 markus 880: void
1.41 markus 881: channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
882: {
883: static int did_init = 0;
884: int i;
885: Channel *c;
1.25 markus 886:
1.41 markus 887: if (!did_init) {
888: channel_handler_init();
889: did_init = 1;
890: }
891: for (i = 0; i < channels_alloc; i++) {
892: c = &channels[i];
893: if (c->type == SSH_CHANNEL_FREE)
894: continue;
895: if (ftab[c->type] == NULL)
1.25 markus 896: continue;
1.41 markus 897: (*ftab[c->type])(c, readset, writeset);
1.44 markus 898: chan_delete_if_full_closed(c);
1.1 deraadt 899: }
900: }
901:
1.49 markus 902: void
1.41 markus 903: channel_prepare_select(fd_set * readset, fd_set * writeset)
904: {
905: channel_handler(channel_pre, readset, writeset);
906: }
907:
1.49 markus 908: void
1.41 markus 909: channel_after_select(fd_set * readset, fd_set * writeset)
910: {
911: channel_handler(channel_post, readset, writeset);
912: }
913:
1.1 deraadt 914: /* If there is data to send to the connection, send some of it now. */
915:
1.49 markus 916: void
1.25 markus 917: channel_output_poll()
1.1 deraadt 918: {
1.25 markus 919: int len, i;
1.41 markus 920: Channel *c;
1.1 deraadt 921:
1.25 markus 922: for (i = 0; i < channels_alloc; i++) {
1.41 markus 923: c = &channels[i];
1.37 markus 924:
1.27 markus 925: /* We are only interested in channels that can have buffered incoming data. */
1.37 markus 926: if (compat13) {
1.41 markus 927: if (c->type != SSH_CHANNEL_OPEN &&
928: c->type != SSH_CHANNEL_INPUT_DRAINING)
1.37 markus 929: continue;
930: } else {
1.41 markus 931: if (c->type != SSH_CHANNEL_OPEN)
1.37 markus 932: continue;
1.41 markus 933: if (c->istate != CHAN_INPUT_OPEN &&
934: c->istate != CHAN_INPUT_WAIT_DRAIN)
1.37 markus 935: continue;
936: }
1.46 markus 937: if (compat20 &&
938: (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
1.44 markus 939: debug("channel: %d: no data after CLOSE", c->self);
940: continue;
941: }
1.25 markus 942:
943: /* Get the amount of buffered data for this channel. */
1.41 markus 944: len = buffer_len(&c->input);
1.25 markus 945: if (len > 0) {
1.27 markus 946: /* Send some data for the other side over the secure connection. */
1.44 markus 947: if (compat20) {
948: if (len > c->remote_window)
949: len = c->remote_window;
950: if (len > c->remote_maxpacket)
951: len = c->remote_maxpacket;
1.25 markus 952: } else {
1.44 markus 953: if (packet_is_interactive()) {
954: if (len > 1024)
955: len = 512;
956: } else {
957: /* Keep the packets at reasonable size. */
958: if (len > packet_get_maxsize()/2)
959: len = packet_get_maxsize()/2;
960: }
1.25 markus 961: }
1.41 markus 962: if (len > 0) {
1.44 markus 963: packet_start(compat20 ?
964: SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
1.41 markus 965: packet_put_int(c->remote_id);
966: packet_put_string(buffer_ptr(&c->input), len);
967: packet_send();
968: buffer_consume(&c->input, len);
969: c->remote_window -= len;
970: }
971: } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
1.25 markus 972: if (compat13)
973: fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
1.27 markus 974: /*
975: * input-buffer is empty and read-socket shutdown:
976: * tell peer, that we will not send more data: send IEOF
977: */
1.41 markus 978: chan_ibuf_empty(c);
1.25 markus 979: }
1.44 markus 980: /* Send extended data, i.e. stderr */
981: if (compat20 &&
982: c->remote_window > 0 &&
983: (len = buffer_len(&c->extended)) > 0 &&
984: c->extended_usage == CHAN_EXTENDED_READ) {
985: if (len > c->remote_window)
986: len = c->remote_window;
987: if (len > c->remote_maxpacket)
988: len = c->remote_maxpacket;
989: packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
990: packet_put_int(c->remote_id);
991: packet_put_int(SSH2_EXTENDED_DATA_STDERR);
992: packet_put_string(buffer_ptr(&c->extended), len);
993: packet_send();
994: buffer_consume(&c->extended, len);
995: c->remote_window -= len;
996: }
1.25 markus 997: }
1.1 deraadt 998: }
999:
1.27 markus 1000: /*
1001: * This is called when a packet of type CHANNEL_DATA has just been received.
1002: * The message type has already been consumed, but channel number and data is
1003: * still there.
1004: */
1.1 deraadt 1005:
1.49 markus 1006: void
1.41 markus 1007: channel_input_data(int type, int plen)
1.1 deraadt 1008: {
1.37 markus 1009: int id;
1.25 markus 1010: char *data;
1011: unsigned int data_len;
1.41 markus 1012: Channel *c;
1.25 markus 1013:
1014: /* Get the channel number and verify it. */
1.37 markus 1015: id = packet_get_int();
1.41 markus 1016: c = channel_lookup(id);
1017: if (c == NULL)
1.37 markus 1018: packet_disconnect("Received data for nonexistent channel %d.", id);
1.25 markus 1019:
1020: /* Ignore any data for non-open channels (might happen on close) */
1.41 markus 1021: if (c->type != SSH_CHANNEL_OPEN &&
1022: c->type != SSH_CHANNEL_X11_OPEN)
1.37 markus 1023: return;
1024:
1025: /* same for protocol 1.5 if output end is no longer open */
1.41 markus 1026: if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
1.25 markus 1027: return;
1028:
1029: /* Get the data. */
1030: data = packet_get_string(&data_len);
1.48 markus 1031: packet_done();
1.41 markus 1032:
1.44 markus 1033: if (compat20){
1034: if (data_len > c->local_maxpacket) {
1035: log("channel %d: rcvd big packet %d, maxpack %d",
1036: c->self, data_len, c->local_maxpacket);
1037: }
1038: if (data_len > c->local_window) {
1039: log("channel %d: rcvd too much data %d, win %d",
1040: c->self, data_len, c->local_window);
1041: xfree(data);
1042: return;
1043: }
1044: c->local_window -= data_len;
1045: }else{
1046: packet_integrity_check(plen, 4 + 4 + data_len, type);
1047: }
1.41 markus 1048: buffer_append(&c->output, data, data_len);
1.25 markus 1049: xfree(data);
1.1 deraadt 1050: }
1.49 markus 1051: void
1.44 markus 1052: channel_input_extended_data(int type, int plen)
1053: {
1054: int id;
1055: int tcode;
1056: char *data;
1057: unsigned int data_len;
1058: Channel *c;
1059:
1060: /* Get the channel number and verify it. */
1061: id = packet_get_int();
1062: c = channel_lookup(id);
1063:
1064: if (c == NULL)
1065: packet_disconnect("Received extended_data for bad channel %d.", id);
1066: if (c->type != SSH_CHANNEL_OPEN) {
1067: log("channel %d: ext data for non open", id);
1068: return;
1069: }
1070: tcode = packet_get_int();
1071: if (c->efd == -1 ||
1072: c->extended_usage != CHAN_EXTENDED_WRITE ||
1073: tcode != SSH2_EXTENDED_DATA_STDERR) {
1074: log("channel %d: bad ext data", c->self);
1075: return;
1076: }
1077: data = packet_get_string(&data_len);
1.48 markus 1078: packet_done();
1.44 markus 1079: if (data_len > c->local_window) {
1080: log("channel %d: rcvd too much extended_data %d, win %d",
1081: c->self, data_len, c->local_window);
1082: xfree(data);
1083: return;
1084: }
1085: debug("channel %d: rcvd ext data %d", c->self, data_len);
1086: c->local_window -= data_len;
1087: buffer_append(&c->extended, data, data_len);
1088: xfree(data);
1089: }
1090:
1.1 deraadt 1091:
1.27 markus 1092: /*
1093: * Returns true if no channel has too much buffered data, and false if one or
1094: * more channel is overfull.
1095: */
1.1 deraadt 1096:
1.49 markus 1097: int
1.25 markus 1098: channel_not_very_much_buffered_data()
1.1 deraadt 1099: {
1.25 markus 1100: unsigned int i;
1.41 markus 1101: Channel *c;
1.25 markus 1102:
1103: for (i = 0; i < channels_alloc; i++) {
1.41 markus 1104: c = &channels[i];
1105: if (c->type == SSH_CHANNEL_OPEN) {
1.44 markus 1106: if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
1.41 markus 1107: debug("channel %d: big input buffer %d",
1108: c->self, buffer_len(&c->input));
1.25 markus 1109: return 0;
1.41 markus 1110: }
1111: if (buffer_len(&c->output) > packet_get_maxsize()) {
1112: debug("channel %d: big output buffer %d",
1113: c->self, buffer_len(&c->output));
1.25 markus 1114: return 0;
1.41 markus 1115: }
1.25 markus 1116: }
1.1 deraadt 1117: }
1.25 markus 1118: return 1;
1.1 deraadt 1119: }
1120:
1.49 markus 1121: void
1.41 markus 1122: channel_input_ieof(int type, int plen)
1123: {
1124: int id;
1125: Channel *c;
1126:
1127: packet_integrity_check(plen, 4, type);
1128:
1129: id = packet_get_int();
1130: c = channel_lookup(id);
1131: if (c == NULL)
1132: packet_disconnect("Received ieof for nonexistent channel %d.", id);
1133: chan_rcvd_ieof(c);
1134: }
1.1 deraadt 1135:
1.49 markus 1136: void
1.41 markus 1137: channel_input_close(int type, int plen)
1.1 deraadt 1138: {
1.41 markus 1139: int id;
1140: Channel *c;
1.1 deraadt 1141:
1.41 markus 1142: packet_integrity_check(plen, 4, type);
1143:
1144: id = packet_get_int();
1145: c = channel_lookup(id);
1146: if (c == NULL)
1147: packet_disconnect("Received close for nonexistent channel %d.", id);
1.27 markus 1148:
1149: /*
1150: * Send a confirmation that we have closed the channel and no more
1151: * data is coming for it.
1152: */
1.25 markus 1153: packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
1.41 markus 1154: packet_put_int(c->remote_id);
1.25 markus 1155: packet_send();
1156:
1.27 markus 1157: /*
1158: * If the channel is in closed state, we have sent a close request,
1159: * and the other side will eventually respond with a confirmation.
1160: * Thus, we cannot free the channel here, because then there would be
1161: * no-one to receive the confirmation. The channel gets freed when
1162: * the confirmation arrives.
1163: */
1.41 markus 1164: if (c->type != SSH_CHANNEL_CLOSED) {
1.27 markus 1165: /*
1166: * Not a closed channel - mark it as draining, which will
1167: * cause it to be freed later.
1168: */
1.41 markus 1169: buffer_consume(&c->input, buffer_len(&c->input));
1170: c->type = SSH_CHANNEL_OUTPUT_DRAINING;
1.25 markus 1171: }
1.1 deraadt 1172: }
1173:
1.41 markus 1174: /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
1.49 markus 1175: void
1.41 markus 1176: channel_input_oclose(int type, int plen)
1177: {
1178: int id = packet_get_int();
1179: Channel *c = channel_lookup(id);
1180: packet_integrity_check(plen, 4, type);
1181: if (c == NULL)
1182: packet_disconnect("Received oclose for nonexistent channel %d.", id);
1183: chan_rcvd_oclose(c);
1184: }
1.1 deraadt 1185:
1.49 markus 1186: void
1.41 markus 1187: channel_input_close_confirmation(int type, int plen)
1.1 deraadt 1188: {
1.41 markus 1189: int id = packet_get_int();
1190: Channel *c = channel_lookup(id);
1.1 deraadt 1191:
1.48 markus 1192: packet_done();
1.41 markus 1193: if (c == NULL)
1194: packet_disconnect("Received close confirmation for "
1195: "out-of-range channel %d.", id);
1196: if (c->type != SSH_CHANNEL_CLOSED)
1197: packet_disconnect("Received close confirmation for "
1198: "non-closed channel %d (type %d).", id, c->type);
1199: channel_free(c->self);
1.1 deraadt 1200: }
1201:
1.49 markus 1202: void
1.41 markus 1203: channel_input_open_confirmation(int type, int plen)
1.1 deraadt 1204: {
1.41 markus 1205: int id, remote_id;
1206: Channel *c;
1.1 deraadt 1207:
1.44 markus 1208: if (!compat20)
1209: packet_integrity_check(plen, 4 + 4, type);
1.25 markus 1210:
1.41 markus 1211: id = packet_get_int();
1212: c = channel_lookup(id);
1.25 markus 1213:
1.41 markus 1214: if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1215: packet_disconnect("Received open confirmation for "
1216: "non-opening channel %d.", id);
1217: remote_id = packet_get_int();
1.27 markus 1218: /* Record the remote channel number and mark that the channel is now open. */
1.41 markus 1219: c->remote_id = remote_id;
1220: c->type = SSH_CHANNEL_OPEN;
1.44 markus 1221:
1222: if (compat20) {
1223: c->remote_window = packet_get_int();
1224: c->remote_maxpacket = packet_get_int();
1.48 markus 1225: packet_done();
1.44 markus 1226: if (c->cb_fn != NULL && c->cb_event == type) {
1227: debug("callback start");
1228: c->cb_fn(c->self, c->cb_arg);
1229: debug("callback done");
1230: }
1231: debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1232: c->remote_window, c->remote_maxpacket);
1233: }
1.1 deraadt 1234: }
1235:
1.49 markus 1236: void
1.41 markus 1237: channel_input_open_failure(int type, int plen)
1.1 deraadt 1238: {
1.41 markus 1239: int id;
1240: Channel *c;
1241:
1.44 markus 1242: if (!compat20)
1243: packet_integrity_check(plen, 4, type);
1.41 markus 1244:
1245: id = packet_get_int();
1246: c = channel_lookup(id);
1.25 markus 1247:
1.41 markus 1248: if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1249: packet_disconnect("Received open failure for "
1250: "non-opening channel %d.", id);
1.44 markus 1251: if (compat20) {
1252: int reason = packet_get_int();
1253: char *msg = packet_get_string(NULL);
1.48 markus 1254: char *lang = packet_get_string(NULL);
1.44 markus 1255: log("channel_open_failure: %d: reason %d: %s", id, reason, msg);
1.48 markus 1256: packet_done();
1.44 markus 1257: xfree(msg);
1.48 markus 1258: xfree(lang);
1.44 markus 1259: }
1.25 markus 1260: /* Free the channel. This will also close the socket. */
1.41 markus 1261: channel_free(id);
1.1 deraadt 1262: }
1263:
1.44 markus 1264: void
1265: channel_input_channel_request(int type, int plen)
1266: {
1267: int id;
1268: Channel *c;
1269:
1270: id = packet_get_int();
1271: c = channel_lookup(id);
1272:
1273: if (c == NULL ||
1274: (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1275: packet_disconnect("Received request for "
1276: "non-open channel %d.", id);
1277: if (c->cb_fn != NULL && c->cb_event == type) {
1278: debug("callback start");
1279: c->cb_fn(c->self, c->cb_arg);
1280: debug("callback done");
1281: } else {
1282: char *service = packet_get_string(NULL);
1283: debug("channel: %d rcvd request for %s", c->self, service);
1284: debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
1285: xfree(service);
1286: }
1287: }
1288:
1.49 markus 1289: void
1.44 markus 1290: channel_input_window_adjust(int type, int plen)
1291: {
1292: Channel *c;
1293: int id, adjust;
1294:
1295: if (!compat20)
1296: return;
1297:
1298: /* Get the channel number and verify it. */
1299: id = packet_get_int();
1300: c = channel_lookup(id);
1301:
1302: if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1303: log("Received window adjust for "
1304: "non-open channel %d.", id);
1305: return;
1306: }
1307: adjust = packet_get_int();
1.48 markus 1308: packet_done();
1.44 markus 1309: debug("channel %d: rcvd adjust %d", id, adjust);
1310: c->remote_window += adjust;
1311: }
1312:
1.27 markus 1313: /*
1314: * Stops listening for channels, and removes any unix domain sockets that we
1315: * might have.
1316: */
1.1 deraadt 1317:
1.49 markus 1318: void
1.25 markus 1319: channel_stop_listening()
1.1 deraadt 1320: {
1.25 markus 1321: int i;
1322: for (i = 0; i < channels_alloc; i++) {
1323: switch (channels[i].type) {
1324: case SSH_CHANNEL_AUTH_SOCKET:
1325: close(channels[i].sock);
1326: remove(channels[i].path);
1327: channel_free(i);
1328: break;
1329: case SSH_CHANNEL_PORT_LISTENER:
1330: case SSH_CHANNEL_X11_LISTENER:
1331: close(channels[i].sock);
1332: channel_free(i);
1333: break;
1334: default:
1335: break;
1336: }
1.1 deraadt 1337: }
1338: }
1339:
1.27 markus 1340: /*
1.52 markus 1341: * Closes the sockets/fds of all channels. This is used to close extra file
1.27 markus 1342: * descriptors after a fork.
1343: */
1.1 deraadt 1344:
1.49 markus 1345: void
1.25 markus 1346: channel_close_all()
1.1 deraadt 1347: {
1.25 markus 1348: int i;
1.52 markus 1349: for (i = 0; i < channels_alloc; i++)
1.25 markus 1350: if (channels[i].type != SSH_CHANNEL_FREE)
1.52 markus 1351: channel_close_fds(&channels[i]);
1.1 deraadt 1352: }
1353:
1354: /* Returns the maximum file descriptor number used by the channels. */
1355:
1.49 markus 1356: int
1.25 markus 1357: channel_max_fd()
1.1 deraadt 1358: {
1.25 markus 1359: return channel_max_fd_value;
1.1 deraadt 1360: }
1361:
1362: /* Returns true if any channel is still open. */
1363:
1.49 markus 1364: int
1.25 markus 1365: channel_still_open()
1.1 deraadt 1366: {
1.25 markus 1367: unsigned int i;
1368: for (i = 0; i < channels_alloc; i++)
1369: switch (channels[i].type) {
1370: case SSH_CHANNEL_FREE:
1371: case SSH_CHANNEL_X11_LISTENER:
1372: case SSH_CHANNEL_PORT_LISTENER:
1373: case SSH_CHANNEL_CLOSED:
1374: case SSH_CHANNEL_AUTH_SOCKET:
1375: continue;
1.44 markus 1376: case SSH_CHANNEL_LARVAL:
1377: if (!compat20)
1378: fatal("cannot happen: SSH_CHANNEL_LARVAL");
1379: continue;
1.25 markus 1380: case SSH_CHANNEL_OPENING:
1381: case SSH_CHANNEL_OPEN:
1382: case SSH_CHANNEL_X11_OPEN:
1383: return 1;
1384: case SSH_CHANNEL_INPUT_DRAINING:
1385: case SSH_CHANNEL_OUTPUT_DRAINING:
1386: if (!compat13)
1387: fatal("cannot happen: OUT_DRAIN");
1388: return 1;
1389: default:
1390: fatal("channel_still_open: bad channel type %d", channels[i].type);
1391: /* NOTREACHED */
1392: }
1393: return 0;
1.1 deraadt 1394: }
1395:
1.27 markus 1396: /*
1397: * Returns a message describing the currently open forwarded connections,
1398: * suitable for sending to the client. The message contains crlf pairs for
1399: * newlines.
1400: */
1.1 deraadt 1401:
1.25 markus 1402: char *
1403: channel_open_message()
1.1 deraadt 1404: {
1.25 markus 1405: Buffer buffer;
1406: int i;
1407: char buf[512], *cp;
1408:
1409: buffer_init(&buffer);
1410: snprintf(buf, sizeof buf, "The following connections are open:\r\n");
1.1 deraadt 1411: buffer_append(&buffer, buf, strlen(buf));
1.25 markus 1412: for (i = 0; i < channels_alloc; i++) {
1413: Channel *c = &channels[i];
1414: switch (c->type) {
1415: case SSH_CHANNEL_FREE:
1416: case SSH_CHANNEL_X11_LISTENER:
1417: case SSH_CHANNEL_PORT_LISTENER:
1418: case SSH_CHANNEL_CLOSED:
1419: case SSH_CHANNEL_AUTH_SOCKET:
1420: continue;
1.44 markus 1421: case SSH_CHANNEL_LARVAL:
1.25 markus 1422: case SSH_CHANNEL_OPENING:
1423: case SSH_CHANNEL_OPEN:
1424: case SSH_CHANNEL_X11_OPEN:
1425: case SSH_CHANNEL_INPUT_DRAINING:
1426: case SSH_CHANNEL_OUTPUT_DRAINING:
1.41 markus 1427: snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
1.37 markus 1428: c->self, c->remote_name,
1429: c->type, c->remote_id,
1430: c->istate, buffer_len(&c->input),
1.41 markus 1431: c->ostate, buffer_len(&c->output),
1432: c->rfd, c->wfd);
1.25 markus 1433: buffer_append(&buffer, buf, strlen(buf));
1434: continue;
1435: default:
1.41 markus 1436: fatal("channel_open_message: bad channel type %d", c->type);
1.25 markus 1437: /* NOTREACHED */
1438: }
1439: }
1440: buffer_append(&buffer, "\0", 1);
1441: cp = xstrdup(buffer_ptr(&buffer));
1442: buffer_free(&buffer);
1443: return cp;
1.1 deraadt 1444: }
1445:
1.27 markus 1446: /*
1447: * Initiate forwarding of connections to local port "port" through the secure
1448: * channel to host:port from remote side.
1449: */
1.1 deraadt 1450:
1.49 markus 1451: void
1.31 markus 1452: channel_request_local_forwarding(u_short port, const char *host,
1.33 markus 1453: u_short host_port, int gateway_ports)
1.25 markus 1454: {
1.35 markus 1455: int success, ch, sock, on = 1;
1456: struct addrinfo hints, *ai, *aitop;
1457: char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1.28 markus 1458: struct linger linger;
1.25 markus 1459:
1460: if (strlen(host) > sizeof(channels[0].path) - 1)
1461: packet_disconnect("Forward host name too long.");
1462:
1.28 markus 1463: /*
1.35 markus 1464: * getaddrinfo returns a loopback address if the hostname is
1465: * set to NULL and hints.ai_flags is not AI_PASSIVE
1.28 markus 1466: */
1.35 markus 1467: memset(&hints, 0, sizeof(hints));
1468: hints.ai_family = IPv4or6;
1469: hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1470: hints.ai_socktype = SOCK_STREAM;
1471: snprintf(strport, sizeof strport, "%d", port);
1472: if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1473: packet_disconnect("getaddrinfo: fatal error");
1474:
1475: success = 0;
1476: for (ai = aitop; ai; ai = ai->ai_next) {
1477: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1478: continue;
1479: if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1480: strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1481: error("channel_request_local_forwarding: getnameinfo failed");
1482: continue;
1483: }
1484: /* Create a port to listen for the host. */
1485: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1486: if (sock < 0) {
1487: /* this is no error since kernel may not support ipv6 */
1488: verbose("socket: %.100s", strerror(errno));
1489: continue;
1490: }
1491: /*
1492: * Set socket options. We would like the socket to disappear
1493: * as soon as it has been closed for whatever reason.
1494: */
1495: setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1496: linger.l_onoff = 1;
1497: linger.l_linger = 5;
1498: setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1499: debug("Local forwarding listening on %s port %s.", ntop, strport);
1500:
1501: /* Bind the socket to the address. */
1502: if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1503: /* address can be in use ipv6 address is already bound */
1504: verbose("bind: %.100s", strerror(errno));
1505: close(sock);
1506: continue;
1507: }
1508: /* Start listening for connections on the socket. */
1509: if (listen(sock, 5) < 0) {
1510: error("listen: %.100s", strerror(errno));
1511: close(sock);
1512: continue;
1513: }
1514: /* Allocate a channel number for the socket. */
1.41 markus 1515: ch = channel_new(
1516: "port listener", SSH_CHANNEL_PORT_LISTENER,
1517: sock, sock, -1,
1.51 markus 1518: CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1.41 markus 1519: 0, xstrdup("port listener"));
1.35 markus 1520: strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
1521: channels[ch].host_port = host_port;
1522: channels[ch].listening_port = port;
1523: success = 1;
1524: }
1525: if (success == 0)
1526: packet_disconnect("cannot listen port: %d", port);
1527: freeaddrinfo(aitop);
1.25 markus 1528: }
1.1 deraadt 1529:
1.27 markus 1530: /*
1531: * Initiate forwarding of connections to port "port" on remote host through
1532: * the secure channel to host:port from local side.
1533: */
1.1 deraadt 1534:
1.49 markus 1535: void
1.41 markus 1536: channel_request_remote_forwarding(u_short listen_port, const char *host_to_connect,
1537: u_short port_to_connect)
1.25 markus 1538: {
1539: int payload_len;
1540: /* Record locally that connection to this host/port is permitted. */
1541: if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1542: fatal("channel_request_remote_forwarding: too many forwards");
1543:
1.41 markus 1544: permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
1545: permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
1546: permitted_opens[num_permitted_opens].listen_port = listen_port;
1.25 markus 1547: num_permitted_opens++;
1548:
1549: /* Send the forward request to the remote side. */
1.44 markus 1550: if (compat20) {
1551: const char *address_to_bind = "0.0.0.0";
1552: packet_start(SSH2_MSG_GLOBAL_REQUEST);
1553: packet_put_cstring("tcpip-forward");
1554: packet_put_char(0); /* boolean: want reply */
1555: packet_put_cstring(address_to_bind);
1556: packet_put_int(listen_port);
1557: } else {
1558: packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
1.50 markus 1559: packet_put_int(listen_port);
1560: packet_put_cstring(host_to_connect);
1.44 markus 1561: packet_put_int(port_to_connect);
1562: packet_send();
1563: packet_write_wait();
1564: /*
1565: * Wait for response from the remote side. It will send a disconnect
1566: * message on failure, and we will never see it here.
1567: */
1568: packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
1569: }
1.1 deraadt 1570: }
1571:
1.27 markus 1572: /*
1573: * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
1574: * listening for the port, and sends back a success reply (or disconnect
1575: * message if there was an error). This never returns if there was an error.
1576: */
1.1 deraadt 1577:
1.49 markus 1578: void
1.56 markus 1579: channel_input_port_forward_request(int is_root, int gateway_ports)
1.1 deraadt 1580: {
1.31 markus 1581: u_short port, host_port;
1.25 markus 1582: char *hostname;
1.1 deraadt 1583:
1.25 markus 1584: /* Get arguments from the packet. */
1585: port = packet_get_int();
1586: hostname = packet_get_string(NULL);
1587: host_port = packet_get_int();
1588:
1.27 markus 1589: /*
1590: * Check that an unprivileged user is not trying to forward a
1591: * privileged port.
1592: */
1.25 markus 1593: if (port < IPPORT_RESERVED && !is_root)
1594: packet_disconnect("Requested forwarding of port %d but user is not root.",
1595: port);
1.33 markus 1596: /*
1597: * Initiate forwarding,
1598: */
1.56 markus 1599: channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
1.25 markus 1600:
1601: /* Free the argument string. */
1602: xfree(hostname);
1.1 deraadt 1603: }
1604:
1.41 markus 1605: /* XXX move to aux.c */
1606: int
1607: channel_connect_to(const char *host, u_short host_port)
1608: {
1609: struct addrinfo hints, *ai, *aitop;
1610: char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1611: int gaierr;
1612: int sock = -1;
1613:
1614: memset(&hints, 0, sizeof(hints));
1615: hints.ai_family = IPv4or6;
1616: hints.ai_socktype = SOCK_STREAM;
1617: snprintf(strport, sizeof strport, "%d", host_port);
1618: if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1619: error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
1620: return -1;
1621: }
1622: for (ai = aitop; ai; ai = ai->ai_next) {
1623: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1624: continue;
1625: if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1626: strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1627: error("channel_connect_to: getnameinfo failed");
1628: continue;
1629: }
1630: /* Create the socket. */
1631: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1632: if (sock < 0) {
1633: error("socket: %.100s", strerror(errno));
1634: continue;
1635: }
1636: /* Connect to the host/port. */
1637: if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1638: error("connect %.100s port %s: %.100s", ntop, strport,
1639: strerror(errno));
1640: close(sock);
1641: continue; /* fail -- try next */
1642: }
1643: break; /* success */
1644:
1645: }
1646: freeaddrinfo(aitop);
1647: if (!ai) {
1648: error("connect %.100s port %d: failed.", host, host_port);
1649: return -1;
1650: }
1651: /* success */
1652: return sock;
1653: }
1.27 markus 1654: /*
1655: * This is called after receiving PORT_OPEN message. This attempts to
1656: * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1657: * or CHANNEL_OPEN_FAILURE.
1658: */
1.1 deraadt 1659:
1.49 markus 1660: void
1.41 markus 1661: channel_input_port_open(int type, int plen)
1.1 deraadt 1662: {
1.31 markus 1663: u_short host_port;
1.25 markus 1664: char *host, *originator_string;
1.41 markus 1665: int remote_channel, sock = -1, newch, i, denied;
1.39 markus 1666: unsigned int host_len, originator_len;
1.25 markus 1667:
1668: /* Get remote channel number. */
1669: remote_channel = packet_get_int();
1670:
1671: /* Get host name to connect to. */
1672: host = packet_get_string(&host_len);
1673:
1674: /* Get port to connect to. */
1675: host_port = packet_get_int();
1676:
1677: /* Get remote originator name. */
1.29 markus 1678: if (have_hostname_in_open) {
1.25 markus 1679: originator_string = packet_get_string(&originator_len);
1.29 markus 1680: originator_len += 4; /* size of packet_int */
1681: } else {
1.25 markus 1682: originator_string = xstrdup("unknown (remote did not supply name)");
1.29 markus 1683: originator_len = 0; /* no originator supplied */
1684: }
1.25 markus 1685:
1.41 markus 1686: packet_integrity_check(plen,
1687: 4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
1.25 markus 1688:
1689: /* Check if opening that port is permitted. */
1.41 markus 1690: denied = 0;
1.25 markus 1691: if (!all_opens_permitted) {
1692: /* Go trough all permitted ports. */
1693: for (i = 0; i < num_permitted_opens; i++)
1.41 markus 1694: if (permitted_opens[i].port_to_connect == host_port &&
1695: strcmp(permitted_opens[i].host_to_connect, host) == 0)
1.25 markus 1696: break;
1697:
1698: /* Check if we found the requested port among those permitted. */
1699: if (i >= num_permitted_opens) {
1700: /* The port is not permitted. */
1701: log("Received request to connect to %.100s:%d, but the request was denied.",
1702: host, host_port);
1.41 markus 1703: denied = 1;
1.25 markus 1704: }
1705: }
1.41 markus 1706: sock = denied ? -1 : channel_connect_to(host, host_port);
1707: if (sock > 0) {
1708: /* Allocate a channel for this connection. */
1709: newch = channel_allocate(SSH_CHANNEL_OPEN, sock, originator_string);
1710: channels[newch].remote_id = remote_channel;
1711:
1712: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1713: packet_put_int(remote_channel);
1714: packet_put_int(newch);
1715: packet_send();
1716: } else {
1717: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1718: packet_put_int(remote_channel);
1719: packet_send();
1.25 markus 1720: }
1721: xfree(host);
1.1 deraadt 1722: }
1723:
1.27 markus 1724: /*
1725: * Creates an internet domain socket for listening for X11 connections.
1726: * Returns a suitable value for the DISPLAY variable, or NULL if an error
1727: * occurs.
1728: */
1.1 deraadt 1729:
1.35 markus 1730: #define NUM_SOCKS 10
1731:
1.25 markus 1732: char *
1.33 markus 1733: x11_create_display_inet(int screen_number, int x11_display_offset)
1.1 deraadt 1734: {
1.31 markus 1735: int display_number, sock;
1736: u_short port;
1.35 markus 1737: struct addrinfo hints, *ai, *aitop;
1738: char strport[NI_MAXSERV];
1739: int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1740: char display[512];
1.25 markus 1741: char hostname[MAXHOSTNAMELEN];
1742:
1.33 markus 1743: for (display_number = x11_display_offset;
1.25 markus 1744: display_number < MAX_DISPLAYS;
1745: display_number++) {
1746: port = 6000 + display_number;
1.35 markus 1747: memset(&hints, 0, sizeof(hints));
1748: hints.ai_family = IPv4or6;
1.36 markus 1749: hints.ai_flags = AI_PASSIVE; /* XXX loopback only ? */
1.35 markus 1750: hints.ai_socktype = SOCK_STREAM;
1751: snprintf(strport, sizeof strport, "%d", port);
1752: if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1753: error("getaddrinfo: %.100s", gai_strerror(gaierr));
1.25 markus 1754: return NULL;
1755: }
1.35 markus 1756: for (ai = aitop; ai; ai = ai->ai_next) {
1757: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1758: continue;
1759: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1760: if (sock < 0) {
1761: error("socket: %.100s", strerror(errno));
1762: return NULL;
1763: }
1764: if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1765: debug("bind port %d: %.100s", port, strerror(errno));
1766: shutdown(sock, SHUT_RDWR);
1767: close(sock);
1768: for (n = 0; n < num_socks; n++) {
1769: shutdown(socks[n], SHUT_RDWR);
1770: close(socks[n]);
1771: }
1772: num_socks = 0;
1773: break;
1774: }
1775: socks[num_socks++] = sock;
1776: if (num_socks == NUM_SOCKS)
1777: break;
1.25 markus 1778: }
1.35 markus 1779: if (num_socks > 0)
1780: break;
1.25 markus 1781: }
1782: if (display_number >= MAX_DISPLAYS) {
1783: error("Failed to allocate internet-domain X11 display socket.");
1784: return NULL;
1785: }
1786: /* Start listening for connections on the socket. */
1.35 markus 1787: for (n = 0; n < num_socks; n++) {
1788: sock = socks[n];
1789: if (listen(sock, 5) < 0) {
1790: error("listen: %.100s", strerror(errno));
1791: shutdown(sock, SHUT_RDWR);
1792: close(sock);
1793: return NULL;
1794: }
1.25 markus 1795: }
1.35 markus 1796:
1.25 markus 1797: /* Set up a suitable value for the DISPLAY variable. */
1798: if (gethostname(hostname, sizeof(hostname)) < 0)
1799: fatal("gethostname: %.100s", strerror(errno));
1.35 markus 1800: snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
1.25 markus 1801: display_number, screen_number);
1802:
1.35 markus 1803: /* Allocate a channel for each socket. */
1804: for (n = 0; n < num_socks; n++) {
1805: sock = socks[n];
1.51 markus 1806: (void) channel_new("x11 listener",
1807: SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
1808: CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
1809: 0, xstrdup("X11 inet listener"));
1.35 markus 1810: }
1.1 deraadt 1811:
1.25 markus 1812: /* Return a suitable value for the DISPLAY environment variable. */
1.35 markus 1813: return xstrdup(display);
1.1 deraadt 1814: }
1815:
1816: #ifndef X_UNIX_PATH
1817: #define X_UNIX_PATH "/tmp/.X11-unix/X"
1818: #endif
1819:
1820: static
1821: int
1.30 deraadt 1822: connect_local_xsocket(unsigned int dnr)
1.1 deraadt 1823: {
1.25 markus 1824: static const char *const x_sockets[] = {
1825: X_UNIX_PATH "%u",
1826: "/var/X/.X11-unix/X" "%u",
1827: "/usr/spool/sockets/X11/" "%u",
1828: NULL
1829: };
1830: int sock;
1831: struct sockaddr_un addr;
1832: const char *const * path;
1833:
1834: for (path = x_sockets; *path; ++path) {
1835: sock = socket(AF_UNIX, SOCK_STREAM, 0);
1836: if (sock < 0)
1837: error("socket: %.100s", strerror(errno));
1838: memset(&addr, 0, sizeof(addr));
1839: addr.sun_family = AF_UNIX;
1840: snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
1841: if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
1842: return sock;
1843: close(sock);
1844: }
1845: error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
1846: return -1;
1.1 deraadt 1847: }
1848:
1.51 markus 1849: int
1850: x11_connect_display(void)
1.1 deraadt 1851: {
1.51 markus 1852: int display_number, sock = 0;
1.25 markus 1853: const char *display;
1.51 markus 1854: char buf[1024], *cp;
1.35 markus 1855: struct addrinfo hints, *ai, *aitop;
1856: char strport[NI_MAXSERV];
1857: int gaierr;
1.25 markus 1858:
1859: /* Try to open a socket for the local X server. */
1860: display = getenv("DISPLAY");
1861: if (!display) {
1862: error("DISPLAY not set.");
1.51 markus 1863: return -1;
1.25 markus 1864: }
1.27 markus 1865: /*
1866: * Now we decode the value of the DISPLAY variable and make a
1867: * connection to the real X server.
1868: */
1869:
1870: /*
1871: * Check if it is a unix domain socket. Unix domain displays are in
1872: * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
1873: */
1.25 markus 1874: if (strncmp(display, "unix:", 5) == 0 ||
1875: display[0] == ':') {
1876: /* Connect to the unix domain socket. */
1877: if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
1878: error("Could not parse display number from DISPLAY: %.100s",
1879: display);
1.51 markus 1880: return -1;
1.25 markus 1881: }
1882: /* Create a socket. */
1883: sock = connect_local_xsocket(display_number);
1884: if (sock < 0)
1.51 markus 1885: return -1;
1.25 markus 1886:
1887: /* OK, we now have a connection to the display. */
1.51 markus 1888: return sock;
1.25 markus 1889: }
1.27 markus 1890: /*
1891: * Connect to an inet socket. The DISPLAY value is supposedly
1892: * hostname:d[.s], where hostname may also be numeric IP address.
1893: */
1.25 markus 1894: strncpy(buf, display, sizeof(buf));
1895: buf[sizeof(buf) - 1] = 0;
1896: cp = strchr(buf, ':');
1897: if (!cp) {
1898: error("Could not find ':' in DISPLAY: %.100s", display);
1.51 markus 1899: return -1;
1.25 markus 1900: }
1901: *cp = 0;
1.27 markus 1902: /* buf now contains the host name. But first we parse the display number. */
1.25 markus 1903: if (sscanf(cp + 1, "%d", &display_number) != 1) {
1904: error("Could not parse display number from DISPLAY: %.100s",
1905: display);
1.51 markus 1906: return -1;
1.25 markus 1907: }
1.35 markus 1908:
1909: /* Look up the host address */
1910: memset(&hints, 0, sizeof(hints));
1911: hints.ai_family = IPv4or6;
1912: hints.ai_socktype = SOCK_STREAM;
1913: snprintf(strport, sizeof strport, "%d", 6000 + display_number);
1914: if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
1915: error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
1.51 markus 1916: return -1;
1.25 markus 1917: }
1.35 markus 1918: for (ai = aitop; ai; ai = ai->ai_next) {
1919: /* Create a socket. */
1920: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1921: if (sock < 0) {
1922: debug("socket: %.100s", strerror(errno));
1.41 markus 1923: continue;
1924: }
1925: /* Connect it to the display. */
1926: if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1927: debug("connect %.100s port %d: %.100s", buf,
1928: 6000 + display_number, strerror(errno));
1929: close(sock);
1930: continue;
1931: }
1932: /* Success */
1933: break;
1.35 markus 1934: }
1935: freeaddrinfo(aitop);
1936: if (!ai) {
1.49 markus 1937: error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
1.35 markus 1938: strerror(errno));
1.51 markus 1939: return -1;
1.25 markus 1940: }
1.51 markus 1941: return sock;
1942: }
1943:
1944: /*
1945: * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
1946: * the remote channel number. We should do whatever we want, and respond
1947: * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
1948: */
1949:
1950: void
1951: x11_input_open(int type, int plen)
1952: {
1953: int remote_channel, sock = 0, newch;
1954: char *remote_host;
1955: unsigned int remote_len;
1.25 markus 1956:
1.51 markus 1957: /* Get remote channel number. */
1958: remote_channel = packet_get_int();
1959:
1960: /* Get remote originator name. */
1961: if (have_hostname_in_open) {
1962: remote_host = packet_get_string(&remote_len);
1963: remote_len += 4;
1964: } else {
1965: remote_host = xstrdup("unknown (remote did not supply name)");
1966: remote_len = 0;
1967: }
1.25 markus 1968:
1.51 markus 1969: debug("Received X11 open request.");
1970: packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
1.25 markus 1971:
1.51 markus 1972: /* Obtain a connection to the real X display. */
1973: sock = x11_connect_display();
1974: if (sock == -1) {
1975: /* Send refusal to the remote host. */
1976: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1977: packet_put_int(remote_channel);
1978: packet_send();
1979: } else {
1980: /* Allocate a channel for this connection. */
1981: newch = channel_allocate(
1982: (x11_saved_proto == NULL) ?
1983: SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
1984: sock, remote_host);
1985: channels[newch].remote_id = remote_channel;
1.25 markus 1986:
1.51 markus 1987: /* Send a confirmation to the remote host. */
1988: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1989: packet_put_int(remote_channel);
1990: packet_put_int(newch);
1991: packet_send();
1992: }
1.1 deraadt 1993: }
1994:
1.27 markus 1995: /*
1996: * Requests forwarding of X11 connections, generates fake authentication
1997: * data, and enables authentication spoofing.
1998: */
1.1 deraadt 1999:
1.49 markus 2000: void
1.51 markus 2001: x11_request_forwarding_with_spoofing(int client_session_id,
2002: const char *proto, const char *data)
1.1 deraadt 2003: {
1.25 markus 2004: unsigned int data_len = (unsigned int) strlen(data) / 2;
2005: unsigned int i, value;
2006: char *new_data;
2007: int screen_number;
2008: const char *cp;
2009: u_int32_t rand = 0;
2010:
2011: cp = getenv("DISPLAY");
2012: if (cp)
2013: cp = strchr(cp, ':');
2014: if (cp)
2015: cp = strchr(cp, '.');
2016: if (cp)
2017: screen_number = atoi(cp + 1);
2018: else
2019: screen_number = 0;
2020:
2021: /* Save protocol name. */
2022: x11_saved_proto = xstrdup(proto);
2023:
1.27 markus 2024: /*
2025: * Extract real authentication data and generate fake data of the
2026: * same length.
2027: */
1.25 markus 2028: x11_saved_data = xmalloc(data_len);
2029: x11_fake_data = xmalloc(data_len);
2030: for (i = 0; i < data_len; i++) {
2031: if (sscanf(data + 2 * i, "%2x", &value) != 1)
2032: fatal("x11_request_forwarding: bad authentication data: %.100s", data);
2033: if (i % 4 == 0)
2034: rand = arc4random();
2035: x11_saved_data[i] = value;
2036: x11_fake_data[i] = rand & 0xff;
2037: rand >>= 8;
2038: }
2039: x11_saved_data_len = data_len;
2040: x11_fake_data_len = data_len;
2041:
2042: /* Convert the fake data into hex. */
2043: new_data = xmalloc(2 * data_len + 1);
2044: for (i = 0; i < data_len; i++)
2045: sprintf(new_data + 2 * i, "%02x", (unsigned char) x11_fake_data[i]);
2046:
2047: /* Send the request packet. */
1.51 markus 2048: if (compat20) {
2049: channel_request_start(client_session_id, "x11-req", 0);
2050: packet_put_char(0); /* XXX bool single connection */
2051: } else {
2052: packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2053: }
2054: packet_put_cstring(proto);
2055: packet_put_cstring(new_data);
1.25 markus 2056: packet_put_int(screen_number);
2057: packet_send();
2058: packet_write_wait();
2059: xfree(new_data);
1.1 deraadt 2060: }
2061:
2062: /* Sends a message to the server to request authentication fd forwarding. */
2063:
1.49 markus 2064: void
1.25 markus 2065: auth_request_forwarding()
1.1 deraadt 2066: {
1.25 markus 2067: packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2068: packet_send();
2069: packet_write_wait();
1.1 deraadt 2070: }
2071:
1.27 markus 2072: /*
2073: * Returns the name of the forwarded authentication socket. Returns NULL if
2074: * there is no forwarded authentication socket. The returned value points to
2075: * a static buffer.
2076: */
1.1 deraadt 2077:
1.25 markus 2078: char *
2079: auth_get_socket_name()
1.1 deraadt 2080: {
1.25 markus 2081: return channel_forwarded_auth_socket_name;
1.1 deraadt 2082: }
2083:
1.12 markus 2084: /* removes the agent forwarding socket */
2085:
1.49 markus 2086: void
1.25 markus 2087: cleanup_socket(void)
2088: {
2089: remove(channel_forwarded_auth_socket_name);
2090: rmdir(channel_forwarded_auth_socket_dir);
1.12 markus 2091: }
2092:
1.27 markus 2093: /*
1.59 markus 2094: * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
1.27 markus 2095: * This starts forwarding authentication requests.
2096: */
1.1 deraadt 2097:
1.59 markus 2098: int
1.25 markus 2099: auth_input_request_forwarding(struct passwd * pw)
1.1 deraadt 2100: {
1.25 markus 2101: int sock, newch;
2102: struct sockaddr_un sunaddr;
2103:
2104: if (auth_get_socket_name() != NULL)
2105: fatal("Protocol error: authentication forwarding requested twice.");
2106:
2107: /* Temporarily drop privileged uid for mkdir/bind. */
2108: temporarily_use_uid(pw->pw_uid);
2109:
2110: /* Allocate a buffer for the socket name, and format the name. */
2111: channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2112: channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2113: strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
2114:
2115: /* Create private directory for socket */
1.59 markus 2116: if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {
2117: packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",
2118: strerror(errno));
2119: restore_uid();
2120: xfree(channel_forwarded_auth_socket_name);
2121: xfree(channel_forwarded_auth_socket_dir);
2122: channel_forwarded_auth_socket_name = NULL;
2123: channel_forwarded_auth_socket_dir = NULL;
2124: return 0;
2125: }
1.25 markus 2126: snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2127: channel_forwarded_auth_socket_dir, (int) getpid());
2128:
2129: if (atexit(cleanup_socket) < 0) {
2130: int saved = errno;
2131: cleanup_socket();
2132: packet_disconnect("socket: %.100s", strerror(saved));
2133: }
2134: /* Create the socket. */
2135: sock = socket(AF_UNIX, SOCK_STREAM, 0);
2136: if (sock < 0)
2137: packet_disconnect("socket: %.100s", strerror(errno));
2138:
2139: /* Bind it to the name. */
2140: memset(&sunaddr, 0, sizeof(sunaddr));
2141: sunaddr.sun_family = AF_UNIX;
2142: strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2143: sizeof(sunaddr.sun_path));
2144:
2145: if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2146: packet_disconnect("bind: %.100s", strerror(errno));
2147:
2148: /* Restore the privileged uid. */
2149: restore_uid();
2150:
2151: /* Start listening on the socket. */
2152: if (listen(sock, 5) < 0)
2153: packet_disconnect("listen: %.100s", strerror(errno));
2154:
2155: /* Allocate a channel for the authentication agent socket. */
2156: newch = channel_allocate(SSH_CHANNEL_AUTH_SOCKET, sock,
2157: xstrdup("auth socket"));
1.32 deraadt 2158: strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2159: sizeof(channels[newch].path));
1.59 markus 2160: return 1;
1.1 deraadt 2161: }
2162:
2163: /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2164:
1.49 markus 2165: void
1.41 markus 2166: auth_input_open_request(int type, int plen)
1.1 deraadt 2167: {
1.25 markus 2168: int remch, sock, newch;
2169: char *dummyname;
1.41 markus 2170:
2171: packet_integrity_check(plen, 4, type);
1.25 markus 2172:
2173: /* Read the remote channel number from the message. */
2174: remch = packet_get_int();
2175:
1.27 markus 2176: /*
2177: * Get a connection to the local authentication agent (this may again
2178: * get forwarded).
2179: */
1.25 markus 2180: sock = ssh_get_authentication_socket();
2181:
1.27 markus 2182: /*
2183: * If we could not connect the agent, send an error message back to
2184: * the server. This should never happen unless the agent dies,
2185: * because authentication forwarding is only enabled if we have an
2186: * agent.
2187: */
1.25 markus 2188: if (sock < 0) {
2189: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2190: packet_put_int(remch);
2191: packet_send();
2192: return;
2193: }
2194: debug("Forwarding authentication connection.");
1.1 deraadt 2195:
1.27 markus 2196: /*
2197: * Dummy host name. This will be freed when the channel is freed; it
2198: * will still be valid in the packet_put_string below since the
2199: * channel cannot yet be freed at that point.
2200: */
1.25 markus 2201: dummyname = xstrdup("authentication agent connection");
2202:
2203: newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2204: channels[newch].remote_id = remch;
2205:
2206: /* Send a confirmation to the remote host. */
2207: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2208: packet_put_int(remch);
2209: packet_put_int(newch);
1.44 markus 2210: packet_send();
2211: }
2212:
2213: void
1.51 markus 2214: channel_start_open(int id)
1.44 markus 2215: {
2216: Channel *c = channel_lookup(id);
2217: if (c == NULL) {
2218: log("channel_open: %d: bad id", id);
2219: return;
2220: }
1.51 markus 2221: debug("send channel open %d", id);
1.44 markus 2222: packet_start(SSH2_MSG_CHANNEL_OPEN);
2223: packet_put_cstring(c->ctype);
2224: packet_put_int(c->self);
2225: packet_put_int(c->local_window);
2226: packet_put_int(c->local_maxpacket);
1.51 markus 2227: }
2228: void
2229: channel_open(int id)
2230: {
2231: /* XXX REMOVE ME */
2232: channel_start_open(id);
1.44 markus 2233: packet_send();
2234: }
2235: void
2236: channel_request(int id, char *service, int wantconfirm)
2237: {
2238: channel_request_start(id, service, wantconfirm);
2239: packet_send();
2240: debug("channel request %d: %s", id, service) ;
2241: }
2242: void
2243: channel_request_start(int id, char *service, int wantconfirm)
2244: {
2245: Channel *c = channel_lookup(id);
2246: if (c == NULL) {
2247: log("channel_request: %d: bad id", id);
2248: return;
2249: }
2250: packet_start(SSH2_MSG_CHANNEL_REQUEST);
2251: packet_put_int(c->remote_id);
2252: packet_put_cstring(service);
2253: packet_put_char(wantconfirm);
2254: }
2255: void
2256: channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2257: {
2258: Channel *c = channel_lookup(id);
2259: if (c == NULL) {
2260: log("channel_register_callback: %d: bad id", id);
2261: return;
2262: }
2263: c->cb_event = mtype;
2264: c->cb_fn = fn;
2265: c->cb_arg = arg;
2266: }
2267: void
2268: channel_register_cleanup(int id, channel_callback_fn *fn)
2269: {
2270: Channel *c = channel_lookup(id);
2271: if (c == NULL) {
2272: log("channel_register_cleanup: %d: bad id", id);
2273: return;
2274: }
2275: c->dettach_user = fn;
2276: }
2277: void
2278: channel_cancel_cleanup(int id)
2279: {
2280: Channel *c = channel_lookup(id);
2281: if (c == NULL) {
2282: log("channel_cancel_cleanup: %d: bad id", id);
2283: return;
2284: }
2285: c->dettach_user = NULL;
1.65 markus 2286: }
2287: void
2288: channel_register_filter(int id, channel_filter_fn *fn)
2289: {
2290: Channel *c = channel_lookup(id);
2291: if (c == NULL) {
2292: log("channel_register_filter: %d: bad id", id);
2293: return;
2294: }
2295: c->input_filter = fn;
1.44 markus 2296: }
2297:
2298: void
2299: channel_set_fds(int id, int rfd, int wfd, int efd, int extusage)
2300: {
2301: Channel *c = channel_lookup(id);
2302: if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2303: fatal("channel_activate for non-larval channel %d.", id);
1.52 markus 2304:
2305: channel_register_fds(c, rfd, wfd, efd, extusage);
1.44 markus 2306: c->type = SSH_CHANNEL_OPEN;
2307: /* XXX window size? */
2308: c->local_window = c->local_window_max = c->local_maxpacket/2;
2309: packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2310: packet_put_int(c->remote_id);
2311: packet_put_int(c->local_window);
1.25 markus 2312: packet_send();
1.1 deraadt 2313: }
![[BACK]](/icons/back.gif){kind=icon}
Return to channels.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh