Annotation of src/usr.bin/ssh/channels.c, Revision 1.80
1.1 deraadt 1: /*
1.26 deraadt 2: * Author: Tatu Ylonen <ylo@cs.hut.fi>
3: * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4: * All rights reserved
5: * This file contains functions for generic socket connection forwarding.
6: * There is also code for initiating connection forwarding for X11 connections,
7: * arbitrary tcp/ip connections, and the authentication agent connection.
1.49 markus 8: *
1.67 deraadt 9: * As far as I am concerned, the code I have written for this software
10: * can be used freely for any purpose. Any derived versions of this
11: * software must be clearly marked as such, and if the derived work is
12: * incompatible with the protocol description in the RFC file, it must be
13: * called by a name other than "ssh" or "Secure Shell".
14: *
15: *
1.44 markus 16: * SSH2 support added by Markus Friedl.
1.67 deraadt 17: * Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
18: * Copyright (c) 1999 Dug Song. All rights reserved.
19: * Copyright (c) 1999 Theo de Raadt. All rights reserved.
20: *
21: * Redistribution and use in source and binary forms, with or without
22: * modification, are permitted provided that the following conditions
23: * are met:
24: * 1. Redistributions of source code must retain the above copyright
25: * notice, this list of conditions and the following disclaimer.
26: * 2. Redistributions in binary form must reproduce the above copyright
27: * notice, this list of conditions and the following disclaimer in the
28: * documentation and/or other materials provided with the distribution.
29: *
30: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
32: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
33: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
34: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
35: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
39: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1.26 deraadt 40: */
1.1 deraadt 41:
42: #include "includes.h"
1.80 ! markus 43: RCSID("$OpenBSD: channels.c,v 1.79 2000/12/29 22:19:13 markus Exp $");
1.1 deraadt 44:
45: #include "ssh.h"
46: #include "packet.h"
47: #include "xmalloc.h"
48: #include "buffer.h"
49: #include "uidswap.h"
1.20 markus 50: #include "readconf.h"
1.3 deraadt 51: #include "servconf.h"
1.1 deraadt 52:
1.14 markus 53: #include "channels.h"
54: #include "nchan.h"
55: #include "compat.h"
56:
1.44 markus 57: #include "ssh2.h"
1.64 markus 58:
59: #include <openssl/rsa.h>
60: #include <openssl/dsa.h>
61: #include "key.h"
62: #include "authfd.h"
1.44 markus 63:
1.1 deraadt 64: /* Maximum number of fake X11 displays to try. */
65: #define MAX_DISPLAYS 1000
66:
1.12 markus 67: /* Max len of agent socket */
68: #define MAX_SOCKET_NAME 100
69:
1.27 markus 70: /*
71: * Pointer to an array containing all allocated channels. The array is
72: * dynamically extended as needed.
73: */
1.1 deraadt 74: static Channel *channels = NULL;
75:
1.27 markus 76: /*
77: * Size of the channel array. All slots of the array must always be
78: * initialized (at least the type field); unused slots are marked with type
79: * SSH_CHANNEL_FREE.
80: */
1.1 deraadt 81: static int channels_alloc = 0;
82:
1.27 markus 83: /*
84: * Maximum file descriptor value used in any of the channels. This is
85: * updated in channel_allocate.
86: */
1.1 deraadt 87: static int channel_max_fd_value = 0;
88:
1.12 markus 89: /* Name and directory of socket for authentication agent forwarding. */
1.1 deraadt 90: static char *channel_forwarded_auth_socket_name = NULL;
1.25 markus 91: static char *channel_forwarded_auth_socket_dir = NULL;
1.1 deraadt 92:
93: /* Saved X11 authentication protocol name. */
94: char *x11_saved_proto = NULL;
95:
96: /* Saved X11 authentication data. This is the real data. */
97: char *x11_saved_data = NULL;
1.77 markus 98: u_int x11_saved_data_len = 0;
1.1 deraadt 99:
1.27 markus 100: /*
101: * Fake X11 authentication data. This is what the server will be sending us;
102: * we should replace any occurrences of this by the real data.
103: */
1.1 deraadt 104: char *x11_fake_data = NULL;
1.77 markus 105: u_int x11_fake_data_len;
1.1 deraadt 106:
1.27 markus 107: /*
108: * Data structure for storing which hosts are permitted for forward requests.
109: * The local sides of any remote forwards are stored in this array to prevent
110: * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
111: * network (which might be behind a firewall).
112: */
1.25 markus 113: typedef struct {
1.41 markus 114: char *host_to_connect; /* Connect to 'host'. */
115: u_short port_to_connect; /* Connect to 'port'. */
116: u_short listen_port; /* Remote side should listen port number. */
1.1 deraadt 117: } ForwardPermission;
118:
119: /* List of all permitted host/port pairs to connect. */
120: static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
121: /* Number of permitted host/port pairs in the array. */
122: static int num_permitted_opens = 0;
1.27 markus 123: /*
124: * If this is true, all opens are permitted. This is the case on the server
125: * on which we have to trust the client anyway, and the user could do
126: * anything after logging in anyway.
127: */
1.1 deraadt 128: static int all_opens_permitted = 0;
129:
130: /* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
131: static int have_hostname_in_open = 0;
132:
133: /* Sets specific protocol options. */
134:
1.49 markus 135: void
1.25 markus 136: channel_set_options(int hostname_in_open)
1.1 deraadt 137: {
1.25 markus 138: have_hostname_in_open = hostname_in_open;
1.1 deraadt 139: }
140:
1.27 markus 141: /*
142: * Permits opening to any host/port in SSH_MSG_PORT_OPEN. This is usually
143: * called by the server, because the user could connect to any port anyway,
144: * and the server has no way to know but to trust the client anyway.
145: */
1.1 deraadt 146:
1.49 markus 147: void
1.25 markus 148: channel_permit_all_opens()
1.1 deraadt 149: {
1.25 markus 150: all_opens_permitted = 1;
1.1 deraadt 151: }
152:
1.41 markus 153: /* lookup channel by id */
154:
155: Channel *
156: channel_lookup(int id)
157: {
158: Channel *c;
1.63 provos 159: if (id < 0 || id > channels_alloc) {
1.41 markus 160: log("channel_lookup: %d: bad id", id);
161: return NULL;
162: }
163: c = &channels[id];
164: if (c->type == SSH_CHANNEL_FREE) {
165: log("channel_lookup: %d: bad id: channel free", id);
166: return NULL;
167: }
168: return c;
1.55 markus 169: }
170:
1.27 markus 171: /*
1.55 markus 172: * Register filedescriptors for a channel, used when allocating a channel or
1.52 markus 173: * when the channel consumer/producer is ready, e.g. shell exec'd
1.27 markus 174: */
1.1 deraadt 175:
1.52 markus 176: void
1.71 markus 177: channel_register_fds(Channel *c, int rfd, int wfd, int efd,
178: int extusage, int nonblock)
1.1 deraadt 179: {
1.25 markus 180: /* Update the maximum file descriptor value. */
1.41 markus 181: if (rfd > channel_max_fd_value)
182: channel_max_fd_value = rfd;
183: if (wfd > channel_max_fd_value)
184: channel_max_fd_value = wfd;
185: if (efd > channel_max_fd_value)
186: channel_max_fd_value = efd;
1.27 markus 187: /* XXX set close-on-exec -markus */
1.55 markus 188:
1.52 markus 189: c->rfd = rfd;
190: c->wfd = wfd;
191: c->sock = (rfd == wfd) ? rfd : -1;
192: c->efd = efd;
193: c->extended_usage = extusage;
1.71 markus 194:
195: /* enable nonblocking mode */
196: if (nonblock) {
197: if (rfd != -1)
198: set_nonblock(rfd);
199: if (wfd != -1)
200: set_nonblock(wfd);
201: if (efd != -1)
202: set_nonblock(efd);
203: }
1.52 markus 204: }
205:
206: /*
207: * Allocate a new channel object and set its type and socket. This will cause
208: * remote_name to be freed.
209: */
210:
211: int
212: channel_new(char *ctype, int type, int rfd, int wfd, int efd,
1.71 markus 213: int window, int maxpack, int extusage, char *remote_name, int nonblock)
1.52 markus 214: {
215: int i, found;
216: Channel *c;
1.25 markus 217:
218: /* Do initial allocation if this is the first call. */
219: if (channels_alloc == 0) {
1.44 markus 220: chan_init();
1.25 markus 221: channels_alloc = 10;
222: channels = xmalloc(channels_alloc * sizeof(Channel));
223: for (i = 0; i < channels_alloc; i++)
224: channels[i].type = SSH_CHANNEL_FREE;
1.27 markus 225: /*
226: * Kludge: arrange a call to channel_stop_listening if we
227: * terminate with fatal().
228: */
1.25 markus 229: fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
230: }
231: /* Try to find a free slot where to put the new channel. */
232: for (found = -1, i = 0; i < channels_alloc; i++)
233: if (channels[i].type == SSH_CHANNEL_FREE) {
234: /* Found a free slot. */
235: found = i;
236: break;
237: }
238: if (found == -1) {
1.27 markus 239: /* There are no free slots. Take last+1 slot and expand the array. */
1.25 markus 240: found = channels_alloc;
241: channels_alloc += 10;
1.70 markus 242: debug2("channel: expanding %d", channels_alloc);
1.25 markus 243: channels = xrealloc(channels, channels_alloc * sizeof(Channel));
244: for (i = found; i < channels_alloc; i++)
245: channels[i].type = SSH_CHANNEL_FREE;
246: }
247: /* Initialize and return new channel number. */
248: c = &channels[found];
249: buffer_init(&c->input);
250: buffer_init(&c->output);
1.41 markus 251: buffer_init(&c->extended);
1.25 markus 252: chan_init_iostates(c);
1.71 markus 253: channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
1.25 markus 254: c->self = found;
255: c->type = type;
1.41 markus 256: c->ctype = ctype;
1.51 markus 257: c->local_window = window;
258: c->local_window_max = window;
259: c->local_consumed = 0;
260: c->local_maxpacket = maxpack;
1.25 markus 261: c->remote_id = -1;
262: c->remote_name = remote_name;
1.41 markus 263: c->remote_window = 0;
264: c->remote_maxpacket = 0;
265: c->cb_fn = NULL;
266: c->cb_arg = NULL;
267: c->cb_event = 0;
268: c->dettach_user = NULL;
1.65 markus 269: c->input_filter = NULL;
1.25 markus 270: debug("channel %d: new [%s]", found, remote_name);
271: return found;
1.1 deraadt 272: }
1.52 markus 273: /* old interface XXX */
1.49 markus 274: int
1.41 markus 275: channel_allocate(int type, int sock, char *remote_name)
276: {
1.71 markus 277: return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1);
1.41 markus 278: }
1.1 deraadt 279:
1.52 markus 280:
281: /* Close all channel fd/socket. */
282:
283: void
284: channel_close_fds(Channel *c)
285: {
286: if (c->sock != -1) {
287: close(c->sock);
288: c->sock = -1;
289: }
290: if (c->rfd != -1) {
291: close(c->rfd);
292: c->rfd = -1;
293: }
294: if (c->wfd != -1) {
295: close(c->wfd);
296: c->wfd = -1;
297: }
298: if (c->efd != -1) {
299: close(c->efd);
300: c->efd = -1;
301: }
302: }
303:
304: /* Free the channel and close its fd/socket. */
1.1 deraadt 305:
1.49 markus 306: void
1.41 markus 307: channel_free(int id)
1.1 deraadt 308: {
1.41 markus 309: Channel *c = channel_lookup(id);
1.79 markus 310: char *s = channel_open_message();
311:
1.41 markus 312: if (c == NULL)
313: packet_disconnect("channel free: bad local channel %d", id);
1.79 markus 314: debug("channel_free: channel %d: status: %s", id, s);
315: xfree(s);
316:
1.44 markus 317: if (c->dettach_user != NULL) {
318: debug("channel_free: channel %d: dettaching channel user", id);
319: c->dettach_user(c->self, NULL);
320: }
1.54 markus 321: if (c->sock != -1)
322: shutdown(c->sock, SHUT_RDWR);
1.52 markus 323: channel_close_fds(c);
1.41 markus 324: buffer_free(&c->input);
325: buffer_free(&c->output);
326: buffer_free(&c->extended);
327: c->type = SSH_CHANNEL_FREE;
328: if (c->remote_name) {
329: xfree(c->remote_name);
330: c->remote_name = NULL;
1.25 markus 331: }
1.1 deraadt 332: }
333:
1.27 markus 334: /*
1.41 markus 335: * 'channel_pre*' are called just before select() to add any bits relevant to
336: * channels in the select bitmasks.
337: */
338: /*
339: * 'channel_post*': perform any appropriate operations for channels which
340: * have events pending.
1.27 markus 341: */
1.41 markus 342: typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
343: chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
344: chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
345:
346: void
347: channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
348: {
349: FD_SET(c->sock, readset);
350: }
351:
352: void
1.75 markus 353: channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset)
354: {
355: debug3("channel %d: waiting for connection", c->self);
356: FD_SET(c->sock, writeset);
357: }
358:
359: void
1.41 markus 360: channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
361: {
362: if (buffer_len(&c->input) < packet_get_maxsize())
363: FD_SET(c->sock, readset);
364: if (buffer_len(&c->output) > 0)
365: FD_SET(c->sock, writeset);
366: }
1.1 deraadt 367:
1.41 markus 368: void
369: channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
370: {
371: /* test whether sockets are 'alive' for read/write */
372: if (c->istate == CHAN_INPUT_OPEN)
373: if (buffer_len(&c->input) < packet_get_maxsize())
374: FD_SET(c->sock, readset);
375: if (c->ostate == CHAN_OUTPUT_OPEN ||
376: c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
377: if (buffer_len(&c->output) > 0) {
378: FD_SET(c->sock, writeset);
379: } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
380: chan_obuf_empty(c);
381: }
382: }
383: }
384:
385: void
1.44 markus 386: channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
387: {
388: if (c->istate == CHAN_INPUT_OPEN &&
389: c->remote_window > 0 &&
390: buffer_len(&c->input) < c->remote_window)
391: FD_SET(c->rfd, readset);
392: if (c->ostate == CHAN_OUTPUT_OPEN ||
393: c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
394: if (buffer_len(&c->output) > 0) {
395: FD_SET(c->wfd, writeset);
396: } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
397: chan_obuf_empty(c);
398: }
399: }
400: /** XXX check close conditions, too */
401: if (c->efd != -1) {
402: if (c->extended_usage == CHAN_EXTENDED_WRITE &&
403: buffer_len(&c->extended) > 0)
404: FD_SET(c->efd, writeset);
405: else if (c->extended_usage == CHAN_EXTENDED_READ &&
406: buffer_len(&c->extended) < c->remote_window)
407: FD_SET(c->efd, readset);
408: }
409: }
410:
411: void
1.41 markus 412: channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
413: {
414: if (buffer_len(&c->input) == 0) {
415: packet_start(SSH_MSG_CHANNEL_CLOSE);
416: packet_put_int(c->remote_id);
417: packet_send();
418: c->type = SSH_CHANNEL_CLOSED;
419: debug("Closing channel %d after input drain.", c->self);
420: }
421: }
422:
423: void
424: channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
425: {
426: if (buffer_len(&c->output) == 0)
427: channel_free(c->self);
1.49 markus 428: else
1.41 markus 429: FD_SET(c->sock, writeset);
430: }
431:
432: /*
433: * This is a special state for X11 authentication spoofing. An opened X11
434: * connection (when authentication spoofing is being done) remains in this
435: * state until the first packet has been completely read. The authentication
436: * data in that packet is then substituted by the real data if it matches the
437: * fake data, and the channel is put into normal mode.
1.51 markus 438: * XXX All this happens at the client side.
1.41 markus 439: */
440: int
441: x11_open_helper(Channel *c)
1.1 deraadt 442: {
1.77 markus 443: u_char *ucp;
444: u_int proto_len, data_len;
1.25 markus 445:
1.41 markus 446: /* Check if the fixed size part of the packet is in buffer. */
447: if (buffer_len(&c->output) < 12)
448: return 0;
449:
450: /* Parse the lengths of variable-length fields. */
1.77 markus 451: ucp = (u_char *) buffer_ptr(&c->output);
1.41 markus 452: if (ucp[0] == 0x42) { /* Byte order MSB first. */
453: proto_len = 256 * ucp[6] + ucp[7];
454: data_len = 256 * ucp[8] + ucp[9];
455: } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */
456: proto_len = ucp[6] + 256 * ucp[7];
457: data_len = ucp[8] + 256 * ucp[9];
458: } else {
459: debug("Initial X11 packet contains bad byte order byte: 0x%x",
460: ucp[0]);
461: return -1;
462: }
463:
464: /* Check if the whole packet is in buffer. */
465: if (buffer_len(&c->output) <
466: 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
467: return 0;
468:
469: /* Check if authentication protocol matches. */
470: if (proto_len != strlen(x11_saved_proto) ||
471: memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
472: debug("X11 connection uses different authentication protocol.");
473: return -1;
474: }
475: /* Check if authentication data matches our fake data. */
476: if (data_len != x11_fake_data_len ||
477: memcmp(ucp + 12 + ((proto_len + 3) & ~3),
478: x11_fake_data, x11_fake_data_len) != 0) {
479: debug("X11 auth data does not match fake data.");
480: return -1;
481: }
482: /* Check fake data length */
483: if (x11_fake_data_len != x11_saved_data_len) {
484: error("X11 fake_data_len %d != saved_data_len %d",
485: x11_fake_data_len, x11_saved_data_len);
486: return -1;
487: }
488: /*
489: * Received authentication protocol and data match
490: * our fake data. Substitute the fake data with real
491: * data.
492: */
493: memcpy(ucp + 12 + ((proto_len + 3) & ~3),
494: x11_saved_data, x11_saved_data_len);
495: return 1;
496: }
497:
498: void
499: channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
500: {
501: int ret = x11_open_helper(c);
502: if (ret == 1) {
503: /* Start normal processing for the channel. */
504: c->type = SSH_CHANNEL_OPEN;
1.47 markus 505: channel_pre_open_13(c, readset, writeset);
1.41 markus 506: } else if (ret == -1) {
507: /*
508: * We have received an X11 connection that has bad
509: * authentication information.
510: */
511: log("X11 connection rejected because of wrong authentication.\r\n");
512: buffer_clear(&c->input);
513: buffer_clear(&c->output);
514: close(c->sock);
515: c->sock = -1;
516: c->type = SSH_CHANNEL_CLOSED;
517: packet_start(SSH_MSG_CHANNEL_CLOSE);
518: packet_put_int(c->remote_id);
519: packet_send();
520: }
521: }
1.25 markus 522:
1.41 markus 523: void
1.51 markus 524: channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
1.41 markus 525: {
526: int ret = x11_open_helper(c);
527: if (ret == 1) {
528: c->type = SSH_CHANNEL_OPEN;
1.57 markus 529: if (compat20)
530: channel_pre_open_20(c, readset, writeset);
531: else
532: channel_pre_open_15(c, readset, writeset);
1.41 markus 533: } else if (ret == -1) {
534: debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
1.51 markus 535: chan_read_failed(c); /** force close? */
1.41 markus 536: chan_write_failed(c);
537: debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
538: }
539: }
1.25 markus 540:
1.41 markus 541: /* This is our fake X11 server socket. */
542: void
543: channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
544: {
545: struct sockaddr addr;
546: int newsock, newch;
547: socklen_t addrlen;
548: char buf[16384], *remote_hostname;
1.51 markus 549: int remote_port;
1.25 markus 550:
1.41 markus 551: if (FD_ISSET(c->sock, readset)) {
552: debug("X11 connection requested.");
553: addrlen = sizeof(addr);
554: newsock = accept(c->sock, &addr, &addrlen);
555: if (newsock < 0) {
556: error("accept: %.100s", strerror(errno));
557: return;
558: }
559: remote_hostname = get_remote_hostname(newsock);
1.51 markus 560: remote_port = get_peer_port(newsock);
1.41 markus 561: snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
1.51 markus 562: remote_hostname, remote_port);
563:
564: newch = channel_new("x11",
565: SSH_CHANNEL_OPENING, newsock, newsock, -1,
566: c->local_window_max, c->local_maxpacket,
1.71 markus 567: 0, xstrdup(buf), 1);
1.51 markus 568: if (compat20) {
569: packet_start(SSH2_MSG_CHANNEL_OPEN);
570: packet_put_cstring("x11");
571: packet_put_int(newch);
572: packet_put_int(c->local_window_max);
573: packet_put_int(c->local_maxpacket);
574: /* originator host and port */
575: packet_put_cstring(remote_hostname);
1.57 markus 576: if (datafellows & SSH_BUG_X11FWD) {
577: debug("ssh2 x11 bug compat mode");
578: } else {
579: packet_put_int(remote_port);
580: }
1.51 markus 581: packet_send();
582: } else {
583: packet_start(SSH_SMSG_X11_OPEN);
584: packet_put_int(newch);
585: if (have_hostname_in_open)
586: packet_put_string(buf, strlen(buf));
587: packet_send();
588: }
1.41 markus 589: xfree(remote_hostname);
590: }
591: }
1.25 markus 592:
1.41 markus 593: /*
594: * This socket is listening for connections to a forwarded TCP/IP port.
595: */
596: void
597: channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
598: {
599: struct sockaddr addr;
600: int newsock, newch;
601: socklen_t addrlen;
1.73 markus 602: char buf[1024], *remote_hostname, *rtype;
1.41 markus 603: int remote_port;
1.25 markus 604:
1.73 markus 605: rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ?
606: "forwarded-tcpip" : "direct-tcpip";
607:
1.41 markus 608: if (FD_ISSET(c->sock, readset)) {
609: debug("Connection to port %d forwarding "
610: "to %.100s port %d requested.",
611: c->listening_port, c->path, c->host_port);
612: addrlen = sizeof(addr);
613: newsock = accept(c->sock, &addr, &addrlen);
614: if (newsock < 0) {
615: error("accept: %.100s", strerror(errno));
616: return;
617: }
618: remote_hostname = get_remote_hostname(newsock);
619: remote_port = get_peer_port(newsock);
620: snprintf(buf, sizeof buf,
621: "listen port %d for %.100s port %d, "
622: "connect from %.200s port %d",
623: c->listening_port, c->path, c->host_port,
624: remote_hostname, remote_port);
1.73 markus 625:
626: newch = channel_new(rtype,
1.41 markus 627: SSH_CHANNEL_OPENING, newsock, newsock, -1,
628: c->local_window_max, c->local_maxpacket,
1.71 markus 629: 0, xstrdup(buf), 1);
1.44 markus 630: if (compat20) {
631: packet_start(SSH2_MSG_CHANNEL_OPEN);
1.73 markus 632: packet_put_cstring(rtype);
1.44 markus 633: packet_put_int(newch);
634: packet_put_int(c->local_window_max);
635: packet_put_int(c->local_maxpacket);
1.73 markus 636: if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
637: /* listen address, port */
638: packet_put_string(c->path, strlen(c->path));
639: packet_put_int(c->listening_port);
640: } else {
641: /* target host, port */
642: packet_put_string(c->path, strlen(c->path));
643: packet_put_int(c->host_port);
644: }
1.48 markus 645: /* originator host and port */
1.44 markus 646: packet_put_cstring(remote_hostname);
647: packet_put_int(remote_port);
648: packet_send();
649: } else {
650: packet_start(SSH_MSG_PORT_OPEN);
651: packet_put_int(newch);
652: packet_put_string(c->path, strlen(c->path));
653: packet_put_int(c->host_port);
654: if (have_hostname_in_open) {
655: packet_put_string(buf, strlen(buf));
656: }
657: packet_send();
1.41 markus 658: }
659: xfree(remote_hostname);
660: }
661: }
1.25 markus 662:
1.41 markus 663: /*
664: * This is the authentication agent socket listening for connections from
665: * clients.
666: */
667: void
668: channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
669: {
670: struct sockaddr addr;
671: int newsock, newch;
672: socklen_t addrlen;
1.25 markus 673:
1.41 markus 674: if (FD_ISSET(c->sock, readset)) {
675: addrlen = sizeof(addr);
676: newsock = accept(c->sock, &addr, &addrlen);
677: if (newsock < 0) {
678: error("accept from auth socket: %.100s", strerror(errno));
679: return;
680: }
1.73 markus 681: newch = channel_new("accepted auth socket",
682: SSH_CHANNEL_OPENING, newsock, newsock, -1,
683: c->local_window_max, c->local_maxpacket,
684: 0, xstrdup("accepted auth socket"), 1);
685: if (compat20) {
686: packet_start(SSH2_MSG_CHANNEL_OPEN);
687: packet_put_cstring("auth-agent@openssh.com");
688: packet_put_int(newch);
689: packet_put_int(c->local_window_max);
690: packet_put_int(c->local_maxpacket);
691: } else {
692: packet_start(SSH_SMSG_AGENT_OPEN);
693: packet_put_int(newch);
694: }
1.41 markus 695: packet_send();
696: }
697: }
1.25 markus 698:
1.75 markus 699: void
700: channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
701: {
702: if (FD_ISSET(c->sock, writeset)) {
703: int err = 0;
704: int sz = sizeof(err);
705: c->type = SSH_CHANNEL_OPEN;
706: if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &sz) < 0) {
707: debug("getsockopt SO_ERROR failed");
708: } else {
709: if (err == 0) {
710: debug("channel %d: connected)", c->self);
711: } else {
712: debug("channel %d: not connected: %s",
713: c->self, strerror(err));
714: chan_read_failed(c);
715: chan_write_failed(c);
716: }
717: }
718: }
719: }
720:
1.41 markus 721: int
722: channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
723: {
724: char buf[16*1024];
725: int len;
1.25 markus 726:
1.41 markus 727: if (c->rfd != -1 &&
728: FD_ISSET(c->rfd, readset)) {
729: len = read(c->rfd, buf, sizeof(buf));
1.53 markus 730: if (len < 0 && (errno == EINTR || errno == EAGAIN))
731: return 1;
1.41 markus 732: if (len <= 0) {
1.51 markus 733: debug("channel %d: read<=0 rfd %d len %d",
1.41 markus 734: c->self, c->rfd, len);
1.25 markus 735: if (compat13) {
1.41 markus 736: buffer_consume(&c->output, buffer_len(&c->output));
737: c->type = SSH_CHANNEL_INPUT_DRAINING;
738: debug("Channel %d status set to input draining.", c->self);
1.25 markus 739: } else {
1.41 markus 740: chan_read_failed(c);
1.25 markus 741: }
1.41 markus 742: return -1;
743: }
1.65 markus 744: if(c->input_filter != NULL) {
1.66 markus 745: if (c->input_filter(c, buf, len) == -1) {
1.65 markus 746: debug("filter stops channel %d", c->self);
747: chan_read_failed(c);
748: }
749: } else {
750: buffer_append(&c->input, buf, len);
751: }
1.41 markus 752: }
753: return 1;
754: }
755: int
756: channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
757: {
758: int len;
1.25 markus 759:
1.41 markus 760: /* Send buffered output data to the socket. */
761: if (c->wfd != -1 &&
762: FD_ISSET(c->wfd, writeset) &&
763: buffer_len(&c->output) > 0) {
764: len = write(c->wfd, buffer_ptr(&c->output),
1.53 markus 765: buffer_len(&c->output));
766: if (len < 0 && (errno == EINTR || errno == EAGAIN))
767: return 1;
1.41 markus 768: if (len <= 0) {
769: if (compat13) {
770: buffer_consume(&c->output, buffer_len(&c->output));
771: debug("Channel %d status set to input draining.", c->self);
772: c->type = SSH_CHANNEL_INPUT_DRAINING;
773: } else {
774: chan_write_failed(c);
775: }
776: return -1;
1.25 markus 777: }
1.41 markus 778: buffer_consume(&c->output, len);
1.44 markus 779: if (compat20 && len > 0) {
780: c->local_consumed += len;
781: }
782: }
783: return 1;
784: }
785: int
786: channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
787: {
788: char buf[16*1024];
789: int len;
790:
1.45 markus 791: /** XXX handle drain efd, too */
1.44 markus 792: if (c->efd != -1) {
793: if (c->extended_usage == CHAN_EXTENDED_WRITE &&
794: FD_ISSET(c->efd, writeset) &&
795: buffer_len(&c->extended) > 0) {
796: len = write(c->efd, buffer_ptr(&c->extended),
797: buffer_len(&c->extended));
1.70 markus 798: debug2("channel %d: written %d to efd %d",
1.44 markus 799: c->self, len, c->efd);
800: if (len > 0) {
801: buffer_consume(&c->extended, len);
802: c->local_consumed += len;
803: }
804: } else if (c->extended_usage == CHAN_EXTENDED_READ &&
805: FD_ISSET(c->efd, readset)) {
806: len = read(c->efd, buf, sizeof(buf));
1.70 markus 807: debug2("channel %d: read %d from efd %d",
1.44 markus 808: c->self, len, c->efd);
1.45 markus 809: if (len == 0) {
810: debug("channel %d: closing efd %d",
811: c->self, c->efd);
812: close(c->efd);
813: c->efd = -1;
814: } else if (len > 0)
1.44 markus 815: buffer_append(&c->extended, buf, len);
816: }
817: }
818: return 1;
819: }
820: int
821: channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
822: {
1.46 markus 823: if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
1.44 markus 824: c->local_window < c->local_window_max/2 &&
825: c->local_consumed > 0) {
826: packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
827: packet_put_int(c->remote_id);
828: packet_put_int(c->local_consumed);
829: packet_send();
1.70 markus 830: debug2("channel %d: window %d sent adjust %d",
1.44 markus 831: c->self, c->local_window,
832: c->local_consumed);
833: c->local_window += c->local_consumed;
834: c->local_consumed = 0;
1.1 deraadt 835: }
1.41 markus 836: return 1;
1.1 deraadt 837: }
838:
1.41 markus 839: void
840: channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
841: {
842: channel_handle_rfd(c, readset, writeset);
843: channel_handle_wfd(c, readset, writeset);
844: }
1.1 deraadt 845:
1.41 markus 846: void
1.44 markus 847: channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
848: {
849: channel_handle_rfd(c, readset, writeset);
850: channel_handle_wfd(c, readset, writeset);
851: channel_handle_efd(c, readset, writeset);
852: channel_check_window(c, readset, writeset);
853: }
854:
855: void
1.41 markus 856: channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
1.1 deraadt 857: {
1.41 markus 858: int len;
859: /* Send buffered output data to the socket. */
860: if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
861: len = write(c->sock, buffer_ptr(&c->output),
862: buffer_len(&c->output));
863: if (len <= 0)
864: buffer_consume(&c->output, buffer_len(&c->output));
865: else
866: buffer_consume(&c->output, len);
867: }
868: }
1.25 markus 869:
1.41 markus 870: void
1.44 markus 871: channel_handler_init_20(void)
872: {
873: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20;
1.51 markus 874: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
1.44 markus 875: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
1.73 markus 876: channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener;
1.51 markus 877: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
1.73 markus 878: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
1.75 markus 879: channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
1.44 markus 880:
881: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2;
882: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
1.73 markus 883: channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener;
1.51 markus 884: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
1.73 markus 885: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
1.75 markus 886: channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
1.44 markus 887: }
888:
889: void
1.41 markus 890: channel_handler_init_13(void)
891: {
892: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13;
893: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13;
894: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
895: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
896: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
897: channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining;
898: channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining;
1.75 markus 899: channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
1.25 markus 900:
1.41 markus 901: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
902: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
903: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
904: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
905: channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13;
1.75 markus 906: channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
1.41 markus 907: }
1.25 markus 908:
1.41 markus 909: void
910: channel_handler_init_15(void)
911: {
912: channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15;
1.51 markus 913: channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
1.41 markus 914: channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
915: channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
916: channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
1.75 markus 917: channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
1.25 markus 918:
1.41 markus 919: channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
920: channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
921: channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
922: channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
1.75 markus 923: channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
1.41 markus 924: }
1.27 markus 925:
1.41 markus 926: void
927: channel_handler_init(void)
928: {
929: int i;
930: for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
931: channel_pre[i] = NULL;
932: channel_post[i] = NULL;
933: }
1.44 markus 934: if (compat20)
935: channel_handler_init_20();
936: else if (compat13)
1.41 markus 937: channel_handler_init_13();
938: else
939: channel_handler_init_15();
940: }
1.25 markus 941:
1.49 markus 942: void
1.41 markus 943: channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
944: {
945: static int did_init = 0;
946: int i;
947: Channel *c;
1.25 markus 948:
1.41 markus 949: if (!did_init) {
950: channel_handler_init();
951: did_init = 1;
952: }
953: for (i = 0; i < channels_alloc; i++) {
954: c = &channels[i];
955: if (c->type == SSH_CHANNEL_FREE)
956: continue;
957: if (ftab[c->type] == NULL)
1.25 markus 958: continue;
1.41 markus 959: (*ftab[c->type])(c, readset, writeset);
1.44 markus 960: chan_delete_if_full_closed(c);
1.1 deraadt 961: }
962: }
963:
1.49 markus 964: void
1.41 markus 965: channel_prepare_select(fd_set * readset, fd_set * writeset)
966: {
967: channel_handler(channel_pre, readset, writeset);
968: }
969:
1.49 markus 970: void
1.41 markus 971: channel_after_select(fd_set * readset, fd_set * writeset)
972: {
973: channel_handler(channel_post, readset, writeset);
974: }
975:
1.1 deraadt 976: /* If there is data to send to the connection, send some of it now. */
977:
1.49 markus 978: void
1.25 markus 979: channel_output_poll()
1.1 deraadt 980: {
1.25 markus 981: int len, i;
1.41 markus 982: Channel *c;
1.1 deraadt 983:
1.25 markus 984: for (i = 0; i < channels_alloc; i++) {
1.41 markus 985: c = &channels[i];
1.37 markus 986:
1.27 markus 987: /* We are only interested in channels that can have buffered incoming data. */
1.37 markus 988: if (compat13) {
1.41 markus 989: if (c->type != SSH_CHANNEL_OPEN &&
990: c->type != SSH_CHANNEL_INPUT_DRAINING)
1.37 markus 991: continue;
992: } else {
1.41 markus 993: if (c->type != SSH_CHANNEL_OPEN)
1.37 markus 994: continue;
1.41 markus 995: if (c->istate != CHAN_INPUT_OPEN &&
996: c->istate != CHAN_INPUT_WAIT_DRAIN)
1.37 markus 997: continue;
998: }
1.46 markus 999: if (compat20 &&
1000: (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
1.44 markus 1001: debug("channel: %d: no data after CLOSE", c->self);
1002: continue;
1003: }
1.25 markus 1004:
1005: /* Get the amount of buffered data for this channel. */
1.41 markus 1006: len = buffer_len(&c->input);
1.25 markus 1007: if (len > 0) {
1.27 markus 1008: /* Send some data for the other side over the secure connection. */
1.44 markus 1009: if (compat20) {
1010: if (len > c->remote_window)
1011: len = c->remote_window;
1012: if (len > c->remote_maxpacket)
1013: len = c->remote_maxpacket;
1.25 markus 1014: } else {
1.44 markus 1015: if (packet_is_interactive()) {
1016: if (len > 1024)
1017: len = 512;
1018: } else {
1019: /* Keep the packets at reasonable size. */
1020: if (len > packet_get_maxsize()/2)
1021: len = packet_get_maxsize()/2;
1022: }
1.25 markus 1023: }
1.41 markus 1024: if (len > 0) {
1.44 markus 1025: packet_start(compat20 ?
1026: SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
1.41 markus 1027: packet_put_int(c->remote_id);
1028: packet_put_string(buffer_ptr(&c->input), len);
1029: packet_send();
1030: buffer_consume(&c->input, len);
1031: c->remote_window -= len;
1032: }
1033: } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
1.25 markus 1034: if (compat13)
1035: fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
1.27 markus 1036: /*
1037: * input-buffer is empty and read-socket shutdown:
1038: * tell peer, that we will not send more data: send IEOF
1039: */
1.41 markus 1040: chan_ibuf_empty(c);
1.25 markus 1041: }
1.44 markus 1042: /* Send extended data, i.e. stderr */
1043: if (compat20 &&
1044: c->remote_window > 0 &&
1045: (len = buffer_len(&c->extended)) > 0 &&
1046: c->extended_usage == CHAN_EXTENDED_READ) {
1047: if (len > c->remote_window)
1048: len = c->remote_window;
1049: if (len > c->remote_maxpacket)
1050: len = c->remote_maxpacket;
1051: packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
1052: packet_put_int(c->remote_id);
1053: packet_put_int(SSH2_EXTENDED_DATA_STDERR);
1054: packet_put_string(buffer_ptr(&c->extended), len);
1055: packet_send();
1056: buffer_consume(&c->extended, len);
1057: c->remote_window -= len;
1058: }
1.25 markus 1059: }
1.1 deraadt 1060: }
1061:
1.27 markus 1062: /*
1063: * This is called when a packet of type CHANNEL_DATA has just been received.
1064: * The message type has already been consumed, but channel number and data is
1065: * still there.
1066: */
1.1 deraadt 1067:
1.49 markus 1068: void
1.69 markus 1069: channel_input_data(int type, int plen, void *ctxt)
1.1 deraadt 1070: {
1.37 markus 1071: int id;
1.25 markus 1072: char *data;
1.77 markus 1073: u_int data_len;
1.41 markus 1074: Channel *c;
1.25 markus 1075:
1076: /* Get the channel number and verify it. */
1.37 markus 1077: id = packet_get_int();
1.41 markus 1078: c = channel_lookup(id);
1079: if (c == NULL)
1.37 markus 1080: packet_disconnect("Received data for nonexistent channel %d.", id);
1.25 markus 1081:
1082: /* Ignore any data for non-open channels (might happen on close) */
1.41 markus 1083: if (c->type != SSH_CHANNEL_OPEN &&
1084: c->type != SSH_CHANNEL_X11_OPEN)
1.37 markus 1085: return;
1086:
1087: /* same for protocol 1.5 if output end is no longer open */
1.41 markus 1088: if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
1.25 markus 1089: return;
1090:
1091: /* Get the data. */
1092: data = packet_get_string(&data_len);
1.48 markus 1093: packet_done();
1.41 markus 1094:
1.44 markus 1095: if (compat20){
1096: if (data_len > c->local_maxpacket) {
1097: log("channel %d: rcvd big packet %d, maxpack %d",
1098: c->self, data_len, c->local_maxpacket);
1099: }
1100: if (data_len > c->local_window) {
1101: log("channel %d: rcvd too much data %d, win %d",
1102: c->self, data_len, c->local_window);
1103: xfree(data);
1104: return;
1105: }
1106: c->local_window -= data_len;
1107: }else{
1108: packet_integrity_check(plen, 4 + 4 + data_len, type);
1109: }
1.41 markus 1110: buffer_append(&c->output, data, data_len);
1.25 markus 1111: xfree(data);
1.1 deraadt 1112: }
1.49 markus 1113: void
1.69 markus 1114: channel_input_extended_data(int type, int plen, void *ctxt)
1.44 markus 1115: {
1116: int id;
1117: int tcode;
1118: char *data;
1.77 markus 1119: u_int data_len;
1.44 markus 1120: Channel *c;
1121:
1122: /* Get the channel number and verify it. */
1123: id = packet_get_int();
1124: c = channel_lookup(id);
1125:
1126: if (c == NULL)
1127: packet_disconnect("Received extended_data for bad channel %d.", id);
1128: if (c->type != SSH_CHANNEL_OPEN) {
1129: log("channel %d: ext data for non open", id);
1130: return;
1131: }
1132: tcode = packet_get_int();
1133: if (c->efd == -1 ||
1134: c->extended_usage != CHAN_EXTENDED_WRITE ||
1135: tcode != SSH2_EXTENDED_DATA_STDERR) {
1136: log("channel %d: bad ext data", c->self);
1137: return;
1138: }
1139: data = packet_get_string(&data_len);
1.48 markus 1140: packet_done();
1.44 markus 1141: if (data_len > c->local_window) {
1142: log("channel %d: rcvd too much extended_data %d, win %d",
1143: c->self, data_len, c->local_window);
1144: xfree(data);
1145: return;
1146: }
1.70 markus 1147: debug2("channel %d: rcvd ext data %d", c->self, data_len);
1.44 markus 1148: c->local_window -= data_len;
1149: buffer_append(&c->extended, data, data_len);
1150: xfree(data);
1151: }
1152:
1.1 deraadt 1153:
1.27 markus 1154: /*
1155: * Returns true if no channel has too much buffered data, and false if one or
1156: * more channel is overfull.
1157: */
1.1 deraadt 1158:
1.49 markus 1159: int
1.25 markus 1160: channel_not_very_much_buffered_data()
1.1 deraadt 1161: {
1.77 markus 1162: u_int i;
1.41 markus 1163: Channel *c;
1.25 markus 1164:
1165: for (i = 0; i < channels_alloc; i++) {
1.41 markus 1166: c = &channels[i];
1167: if (c->type == SSH_CHANNEL_OPEN) {
1.44 markus 1168: if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
1.41 markus 1169: debug("channel %d: big input buffer %d",
1170: c->self, buffer_len(&c->input));
1.25 markus 1171: return 0;
1.41 markus 1172: }
1173: if (buffer_len(&c->output) > packet_get_maxsize()) {
1174: debug("channel %d: big output buffer %d",
1175: c->self, buffer_len(&c->output));
1.25 markus 1176: return 0;
1.41 markus 1177: }
1.25 markus 1178: }
1.1 deraadt 1179: }
1.25 markus 1180: return 1;
1.1 deraadt 1181: }
1182:
1.49 markus 1183: void
1.69 markus 1184: channel_input_ieof(int type, int plen, void *ctxt)
1.41 markus 1185: {
1186: int id;
1187: Channel *c;
1188:
1189: packet_integrity_check(plen, 4, type);
1190:
1191: id = packet_get_int();
1192: c = channel_lookup(id);
1193: if (c == NULL)
1194: packet_disconnect("Received ieof for nonexistent channel %d.", id);
1195: chan_rcvd_ieof(c);
1196: }
1.1 deraadt 1197:
1.49 markus 1198: void
1.69 markus 1199: channel_input_close(int type, int plen, void *ctxt)
1.1 deraadt 1200: {
1.41 markus 1201: int id;
1202: Channel *c;
1.1 deraadt 1203:
1.41 markus 1204: packet_integrity_check(plen, 4, type);
1205:
1206: id = packet_get_int();
1207: c = channel_lookup(id);
1208: if (c == NULL)
1209: packet_disconnect("Received close for nonexistent channel %d.", id);
1.27 markus 1210:
1211: /*
1212: * Send a confirmation that we have closed the channel and no more
1213: * data is coming for it.
1214: */
1.25 markus 1215: packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
1.41 markus 1216: packet_put_int(c->remote_id);
1.25 markus 1217: packet_send();
1218:
1.27 markus 1219: /*
1220: * If the channel is in closed state, we have sent a close request,
1221: * and the other side will eventually respond with a confirmation.
1222: * Thus, we cannot free the channel here, because then there would be
1223: * no-one to receive the confirmation. The channel gets freed when
1224: * the confirmation arrives.
1225: */
1.41 markus 1226: if (c->type != SSH_CHANNEL_CLOSED) {
1.27 markus 1227: /*
1228: * Not a closed channel - mark it as draining, which will
1229: * cause it to be freed later.
1230: */
1.41 markus 1231: buffer_consume(&c->input, buffer_len(&c->input));
1232: c->type = SSH_CHANNEL_OUTPUT_DRAINING;
1.25 markus 1233: }
1.1 deraadt 1234: }
1235:
1.41 markus 1236: /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
1.49 markus 1237: void
1.69 markus 1238: channel_input_oclose(int type, int plen, void *ctxt)
1.41 markus 1239: {
1240: int id = packet_get_int();
1241: Channel *c = channel_lookup(id);
1242: packet_integrity_check(plen, 4, type);
1243: if (c == NULL)
1244: packet_disconnect("Received oclose for nonexistent channel %d.", id);
1245: chan_rcvd_oclose(c);
1246: }
1.1 deraadt 1247:
1.49 markus 1248: void
1.69 markus 1249: channel_input_close_confirmation(int type, int plen, void *ctxt)
1.1 deraadt 1250: {
1.41 markus 1251: int id = packet_get_int();
1252: Channel *c = channel_lookup(id);
1.1 deraadt 1253:
1.48 markus 1254: packet_done();
1.41 markus 1255: if (c == NULL)
1256: packet_disconnect("Received close confirmation for "
1257: "out-of-range channel %d.", id);
1258: if (c->type != SSH_CHANNEL_CLOSED)
1259: packet_disconnect("Received close confirmation for "
1260: "non-closed channel %d (type %d).", id, c->type);
1261: channel_free(c->self);
1.1 deraadt 1262: }
1263:
1.49 markus 1264: void
1.69 markus 1265: channel_input_open_confirmation(int type, int plen, void *ctxt)
1.1 deraadt 1266: {
1.41 markus 1267: int id, remote_id;
1268: Channel *c;
1.1 deraadt 1269:
1.44 markus 1270: if (!compat20)
1271: packet_integrity_check(plen, 4 + 4, type);
1.25 markus 1272:
1.41 markus 1273: id = packet_get_int();
1274: c = channel_lookup(id);
1.25 markus 1275:
1.41 markus 1276: if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1277: packet_disconnect("Received open confirmation for "
1278: "non-opening channel %d.", id);
1279: remote_id = packet_get_int();
1.27 markus 1280: /* Record the remote channel number and mark that the channel is now open. */
1.41 markus 1281: c->remote_id = remote_id;
1282: c->type = SSH_CHANNEL_OPEN;
1.44 markus 1283:
1284: if (compat20) {
1285: c->remote_window = packet_get_int();
1286: c->remote_maxpacket = packet_get_int();
1.48 markus 1287: packet_done();
1.44 markus 1288: if (c->cb_fn != NULL && c->cb_event == type) {
1.70 markus 1289: debug2("callback start");
1.44 markus 1290: c->cb_fn(c->self, c->cb_arg);
1.70 markus 1291: debug2("callback done");
1.44 markus 1292: }
1293: debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1294: c->remote_window, c->remote_maxpacket);
1295: }
1.1 deraadt 1296: }
1297:
1.49 markus 1298: void
1.69 markus 1299: channel_input_open_failure(int type, int plen, void *ctxt)
1.1 deraadt 1300: {
1.41 markus 1301: int id;
1302: Channel *c;
1303:
1.44 markus 1304: if (!compat20)
1305: packet_integrity_check(plen, 4, type);
1.41 markus 1306:
1307: id = packet_get_int();
1308: c = channel_lookup(id);
1.25 markus 1309:
1.41 markus 1310: if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1311: packet_disconnect("Received open failure for "
1312: "non-opening channel %d.", id);
1.44 markus 1313: if (compat20) {
1314: int reason = packet_get_int();
1315: char *msg = packet_get_string(NULL);
1.48 markus 1316: char *lang = packet_get_string(NULL);
1.44 markus 1317: log("channel_open_failure: %d: reason %d: %s", id, reason, msg);
1.48 markus 1318: packet_done();
1.44 markus 1319: xfree(msg);
1.48 markus 1320: xfree(lang);
1.44 markus 1321: }
1.25 markus 1322: /* Free the channel. This will also close the socket. */
1.41 markus 1323: channel_free(id);
1.1 deraadt 1324: }
1325:
1.44 markus 1326: void
1.69 markus 1327: channel_input_channel_request(int type, int plen, void *ctxt)
1.44 markus 1328: {
1329: int id;
1330: Channel *c;
1331:
1332: id = packet_get_int();
1333: c = channel_lookup(id);
1334:
1335: if (c == NULL ||
1336: (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1337: packet_disconnect("Received request for "
1338: "non-open channel %d.", id);
1339: if (c->cb_fn != NULL && c->cb_event == type) {
1.70 markus 1340: debug2("callback start");
1.44 markus 1341: c->cb_fn(c->self, c->cb_arg);
1.70 markus 1342: debug2("callback done");
1.44 markus 1343: } else {
1344: char *service = packet_get_string(NULL);
1345: debug("channel: %d rcvd request for %s", c->self, service);
1.70 markus 1346: debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
1.44 markus 1347: xfree(service);
1348: }
1349: }
1350:
1.49 markus 1351: void
1.69 markus 1352: channel_input_window_adjust(int type, int plen, void *ctxt)
1.44 markus 1353: {
1354: Channel *c;
1355: int id, adjust;
1356:
1357: if (!compat20)
1358: return;
1359:
1360: /* Get the channel number and verify it. */
1361: id = packet_get_int();
1362: c = channel_lookup(id);
1363:
1364: if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1365: log("Received window adjust for "
1366: "non-open channel %d.", id);
1367: return;
1368: }
1369: adjust = packet_get_int();
1.48 markus 1370: packet_done();
1.70 markus 1371: debug2("channel %d: rcvd adjust %d", id, adjust);
1.44 markus 1372: c->remote_window += adjust;
1373: }
1374:
1.27 markus 1375: /*
1376: * Stops listening for channels, and removes any unix domain sockets that we
1377: * might have.
1378: */
1.1 deraadt 1379:
1.49 markus 1380: void
1.25 markus 1381: channel_stop_listening()
1.1 deraadt 1382: {
1.25 markus 1383: int i;
1384: for (i = 0; i < channels_alloc; i++) {
1385: switch (channels[i].type) {
1386: case SSH_CHANNEL_AUTH_SOCKET:
1387: close(channels[i].sock);
1.76 markus 1388: unlink(channels[i].path);
1.25 markus 1389: channel_free(i);
1390: break;
1391: case SSH_CHANNEL_PORT_LISTENER:
1.73 markus 1392: case SSH_CHANNEL_RPORT_LISTENER:
1.25 markus 1393: case SSH_CHANNEL_X11_LISTENER:
1394: close(channels[i].sock);
1395: channel_free(i);
1396: break;
1397: default:
1398: break;
1399: }
1.1 deraadt 1400: }
1401: }
1402:
1.27 markus 1403: /*
1.52 markus 1404: * Closes the sockets/fds of all channels. This is used to close extra file
1.27 markus 1405: * descriptors after a fork.
1406: */
1.1 deraadt 1407:
1.49 markus 1408: void
1.25 markus 1409: channel_close_all()
1.1 deraadt 1410: {
1.25 markus 1411: int i;
1.52 markus 1412: for (i = 0; i < channels_alloc; i++)
1.25 markus 1413: if (channels[i].type != SSH_CHANNEL_FREE)
1.52 markus 1414: channel_close_fds(&channels[i]);
1.1 deraadt 1415: }
1416:
1417: /* Returns the maximum file descriptor number used by the channels. */
1418:
1.49 markus 1419: int
1.25 markus 1420: channel_max_fd()
1.1 deraadt 1421: {
1.25 markus 1422: return channel_max_fd_value;
1.1 deraadt 1423: }
1424:
1425: /* Returns true if any channel is still open. */
1426:
1.49 markus 1427: int
1.25 markus 1428: channel_still_open()
1.1 deraadt 1429: {
1.77 markus 1430: u_int i;
1.25 markus 1431: for (i = 0; i < channels_alloc; i++)
1432: switch (channels[i].type) {
1433: case SSH_CHANNEL_FREE:
1434: case SSH_CHANNEL_X11_LISTENER:
1435: case SSH_CHANNEL_PORT_LISTENER:
1.73 markus 1436: case SSH_CHANNEL_RPORT_LISTENER:
1.25 markus 1437: case SSH_CHANNEL_CLOSED:
1438: case SSH_CHANNEL_AUTH_SOCKET:
1.75 markus 1439: case SSH_CHANNEL_CONNECTING: /* XXX ??? */
1.25 markus 1440: continue;
1.44 markus 1441: case SSH_CHANNEL_LARVAL:
1442: if (!compat20)
1443: fatal("cannot happen: SSH_CHANNEL_LARVAL");
1444: continue;
1.25 markus 1445: case SSH_CHANNEL_OPENING:
1446: case SSH_CHANNEL_OPEN:
1447: case SSH_CHANNEL_X11_OPEN:
1448: return 1;
1449: case SSH_CHANNEL_INPUT_DRAINING:
1450: case SSH_CHANNEL_OUTPUT_DRAINING:
1451: if (!compat13)
1452: fatal("cannot happen: OUT_DRAIN");
1453: return 1;
1454: default:
1455: fatal("channel_still_open: bad channel type %d", channels[i].type);
1456: /* NOTREACHED */
1457: }
1458: return 0;
1.1 deraadt 1459: }
1460:
1.27 markus 1461: /*
1462: * Returns a message describing the currently open forwarded connections,
1463: * suitable for sending to the client. The message contains crlf pairs for
1464: * newlines.
1465: */
1.1 deraadt 1466:
1.25 markus 1467: char *
1468: channel_open_message()
1.1 deraadt 1469: {
1.25 markus 1470: Buffer buffer;
1471: int i;
1472: char buf[512], *cp;
1473:
1474: buffer_init(&buffer);
1475: snprintf(buf, sizeof buf, "The following connections are open:\r\n");
1.1 deraadt 1476: buffer_append(&buffer, buf, strlen(buf));
1.25 markus 1477: for (i = 0; i < channels_alloc; i++) {
1478: Channel *c = &channels[i];
1479: switch (c->type) {
1480: case SSH_CHANNEL_FREE:
1481: case SSH_CHANNEL_X11_LISTENER:
1482: case SSH_CHANNEL_PORT_LISTENER:
1.73 markus 1483: case SSH_CHANNEL_RPORT_LISTENER:
1.25 markus 1484: case SSH_CHANNEL_CLOSED:
1485: case SSH_CHANNEL_AUTH_SOCKET:
1486: continue;
1.44 markus 1487: case SSH_CHANNEL_LARVAL:
1.25 markus 1488: case SSH_CHANNEL_OPENING:
1.75 markus 1489: case SSH_CHANNEL_CONNECTING:
1.25 markus 1490: case SSH_CHANNEL_OPEN:
1491: case SSH_CHANNEL_X11_OPEN:
1492: case SSH_CHANNEL_INPUT_DRAINING:
1493: case SSH_CHANNEL_OUTPUT_DRAINING:
1.41 markus 1494: snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
1.37 markus 1495: c->self, c->remote_name,
1496: c->type, c->remote_id,
1497: c->istate, buffer_len(&c->input),
1.41 markus 1498: c->ostate, buffer_len(&c->output),
1499: c->rfd, c->wfd);
1.25 markus 1500: buffer_append(&buffer, buf, strlen(buf));
1501: continue;
1502: default:
1.41 markus 1503: fatal("channel_open_message: bad channel type %d", c->type);
1.25 markus 1504: /* NOTREACHED */
1505: }
1506: }
1507: buffer_append(&buffer, "\0", 1);
1508: cp = xstrdup(buffer_ptr(&buffer));
1509: buffer_free(&buffer);
1510: return cp;
1.1 deraadt 1511: }
1512:
1.27 markus 1513: /*
1514: * Initiate forwarding of connections to local port "port" through the secure
1515: * channel to host:port from remote side.
1516: */
1.73 markus 1517: void
1518: channel_request_local_forwarding(u_short listen_port, const char *host_to_connect,
1519: u_short port_to_connect, int gateway_ports)
1520: {
1521: channel_request_forwarding(
1522: NULL, listen_port,
1523: host_to_connect, port_to_connect,
1524: gateway_ports, /*remote_fwd*/ 0);
1525: }
1.1 deraadt 1526:
1.73 markus 1527: /*
1528: * If 'remote_fwd' is true we have a '-R style' listener for protocol 2
1529: * (SSH_CHANNEL_RPORT_LISTENER).
1530: */
1.49 markus 1531: void
1.73 markus 1532: channel_request_forwarding(
1533: const char *listen_address, u_short listen_port,
1534: const char *host_to_connect, u_short port_to_connect,
1535: int gateway_ports, int remote_fwd)
1.25 markus 1536: {
1.73 markus 1537: int success, ch, sock, on = 1, ctype;
1.35 markus 1538: struct addrinfo hints, *ai, *aitop;
1539: char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1.73 markus 1540: const char *host;
1.28 markus 1541: struct linger linger;
1.25 markus 1542:
1.73 markus 1543: if (remote_fwd) {
1544: host = listen_address;
1545: ctype = SSH_CHANNEL_RPORT_LISTENER;
1546: } else {
1547: host = host_to_connect;
1548: ctype =SSH_CHANNEL_PORT_LISTENER;
1549: }
1550:
1.25 markus 1551: if (strlen(host) > sizeof(channels[0].path) - 1)
1552: packet_disconnect("Forward host name too long.");
1553:
1.73 markus 1554: /* XXX listen_address is currently ignored */
1.28 markus 1555: /*
1.35 markus 1556: * getaddrinfo returns a loopback address if the hostname is
1557: * set to NULL and hints.ai_flags is not AI_PASSIVE
1.28 markus 1558: */
1.35 markus 1559: memset(&hints, 0, sizeof(hints));
1560: hints.ai_family = IPv4or6;
1561: hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1562: hints.ai_socktype = SOCK_STREAM;
1.73 markus 1563: snprintf(strport, sizeof strport, "%d", listen_port);
1.35 markus 1564: if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1565: packet_disconnect("getaddrinfo: fatal error");
1566:
1567: success = 0;
1568: for (ai = aitop; ai; ai = ai->ai_next) {
1569: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1570: continue;
1571: if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1572: strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1.73 markus 1573: error("channel_request_forwarding: getnameinfo failed");
1.35 markus 1574: continue;
1575: }
1576: /* Create a port to listen for the host. */
1577: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1578: if (sock < 0) {
1579: /* this is no error since kernel may not support ipv6 */
1580: verbose("socket: %.100s", strerror(errno));
1581: continue;
1582: }
1583: /*
1584: * Set socket options. We would like the socket to disappear
1585: * as soon as it has been closed for whatever reason.
1586: */
1587: setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1588: linger.l_onoff = 1;
1589: linger.l_linger = 5;
1590: setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1591: debug("Local forwarding listening on %s port %s.", ntop, strport);
1592:
1593: /* Bind the socket to the address. */
1594: if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1595: /* address can be in use ipv6 address is already bound */
1596: verbose("bind: %.100s", strerror(errno));
1597: close(sock);
1598: continue;
1599: }
1600: /* Start listening for connections on the socket. */
1601: if (listen(sock, 5) < 0) {
1602: error("listen: %.100s", strerror(errno));
1603: close(sock);
1604: continue;
1605: }
1606: /* Allocate a channel number for the socket. */
1.73 markus 1607: ch = channel_new("port listener", ctype, sock, sock, -1,
1.51 markus 1608: CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1.71 markus 1609: 0, xstrdup("port listener"), 1);
1.35 markus 1610: strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
1.73 markus 1611: channels[ch].host_port = port_to_connect;
1612: channels[ch].listening_port = listen_port;
1.35 markus 1613: success = 1;
1614: }
1615: if (success == 0)
1.73 markus 1616: packet_disconnect("cannot listen port: %d", listen_port); /*XXX ?disconnect? */
1.35 markus 1617: freeaddrinfo(aitop);
1.25 markus 1618: }
1.1 deraadt 1619:
1.27 markus 1620: /*
1621: * Initiate forwarding of connections to port "port" on remote host through
1622: * the secure channel to host:port from local side.
1623: */
1.1 deraadt 1624:
1.49 markus 1625: void
1.73 markus 1626: channel_request_remote_forwarding(u_short listen_port,
1627: const char *host_to_connect, u_short port_to_connect)
1.25 markus 1628: {
1.73 markus 1629: int payload_len, type, success = 0;
1630:
1.25 markus 1631: /* Record locally that connection to this host/port is permitted. */
1632: if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1633: fatal("channel_request_remote_forwarding: too many forwards");
1634:
1635: /* Send the forward request to the remote side. */
1.44 markus 1636: if (compat20) {
1637: const char *address_to_bind = "0.0.0.0";
1638: packet_start(SSH2_MSG_GLOBAL_REQUEST);
1639: packet_put_cstring("tcpip-forward");
1640: packet_put_char(0); /* boolean: want reply */
1641: packet_put_cstring(address_to_bind);
1642: packet_put_int(listen_port);
1.73 markus 1643: packet_send();
1644: packet_write_wait();
1645: /* Assume that server accepts the request */
1646: success = 1;
1.44 markus 1647: } else {
1648: packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
1.50 markus 1649: packet_put_int(listen_port);
1650: packet_put_cstring(host_to_connect);
1.44 markus 1651: packet_put_int(port_to_connect);
1652: packet_send();
1653: packet_write_wait();
1.73 markus 1654:
1655: /* Wait for response from the remote side. */
1656: type = packet_read(&payload_len);
1657: switch (type) {
1658: case SSH_SMSG_SUCCESS:
1659: success = 1;
1660: break;
1661: case SSH_SMSG_FAILURE:
1662: log("Warning: Server denied remote port forwarding.");
1663: break;
1664: default:
1665: /* Unknown packet */
1666: packet_disconnect("Protocol error for port forward request:"
1667: "received packet type %d.", type);
1668: }
1669: }
1670: if (success) {
1671: permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
1672: permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
1673: permitted_opens[num_permitted_opens].listen_port = listen_port;
1674: num_permitted_opens++;
1.44 markus 1675: }
1.1 deraadt 1676: }
1677:
1.27 markus 1678: /*
1679: * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
1680: * listening for the port, and sends back a success reply (or disconnect
1681: * message if there was an error). This never returns if there was an error.
1682: */
1.1 deraadt 1683:
1.49 markus 1684: void
1.56 markus 1685: channel_input_port_forward_request(int is_root, int gateway_ports)
1.1 deraadt 1686: {
1.31 markus 1687: u_short port, host_port;
1.25 markus 1688: char *hostname;
1.1 deraadt 1689:
1.25 markus 1690: /* Get arguments from the packet. */
1691: port = packet_get_int();
1692: hostname = packet_get_string(NULL);
1693: host_port = packet_get_int();
1694:
1.27 markus 1695: /*
1696: * Check that an unprivileged user is not trying to forward a
1697: * privileged port.
1698: */
1.25 markus 1699: if (port < IPPORT_RESERVED && !is_root)
1700: packet_disconnect("Requested forwarding of port %d but user is not root.",
1701: port);
1.73 markus 1702: /* Initiate forwarding */
1.56 markus 1703: channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
1.25 markus 1704:
1705: /* Free the argument string. */
1706: xfree(hostname);
1.1 deraadt 1707: }
1708:
1.41 markus 1709: /* XXX move to aux.c */
1710: int
1711: channel_connect_to(const char *host, u_short host_port)
1712: {
1713: struct addrinfo hints, *ai, *aitop;
1714: char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1715: int gaierr;
1716: int sock = -1;
1717:
1718: memset(&hints, 0, sizeof(hints));
1719: hints.ai_family = IPv4or6;
1720: hints.ai_socktype = SOCK_STREAM;
1721: snprintf(strport, sizeof strport, "%d", host_port);
1722: if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1723: error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
1724: return -1;
1725: }
1726: for (ai = aitop; ai; ai = ai->ai_next) {
1727: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1728: continue;
1729: if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1730: strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1731: error("channel_connect_to: getnameinfo failed");
1732: continue;
1733: }
1734: /* Create the socket. */
1735: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1736: if (sock < 0) {
1737: error("socket: %.100s", strerror(errno));
1738: continue;
1739: }
1.80 ! markus 1740: if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
1.75 markus 1741: fatal("connect_to: F_SETFL: %s", strerror(errno));
1.41 markus 1742: /* Connect to the host/port. */
1.75 markus 1743: if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 &&
1744: errno != EINPROGRESS) {
1.41 markus 1745: error("connect %.100s port %s: %.100s", ntop, strport,
1746: strerror(errno));
1747: close(sock);
1748: continue; /* fail -- try next */
1749: }
1750: break; /* success */
1751:
1752: }
1753: freeaddrinfo(aitop);
1754: if (!ai) {
1755: error("connect %.100s port %d: failed.", host, host_port);
1756: return -1;
1757: }
1758: /* success */
1759: return sock;
1760: }
1.73 markus 1761: int
1762: channel_connect_by_listen_adress(u_short listen_port)
1763: {
1764: int i;
1765: for (i = 0; i < num_permitted_opens; i++)
1766: if (permitted_opens[i].listen_port == listen_port)
1767: return channel_connect_to(
1768: permitted_opens[i].host_to_connect,
1769: permitted_opens[i].port_to_connect);
1.74 markus 1770: error("WARNING: Server requests forwarding for unknown listen_port %d",
1771: listen_port);
1.73 markus 1772: return -1;
1773: }
1774:
1.27 markus 1775: /*
1776: * This is called after receiving PORT_OPEN message. This attempts to
1777: * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1778: * or CHANNEL_OPEN_FAILURE.
1779: */
1.1 deraadt 1780:
1.49 markus 1781: void
1.69 markus 1782: channel_input_port_open(int type, int plen, void *ctxt)
1.1 deraadt 1783: {
1.31 markus 1784: u_short host_port;
1.25 markus 1785: char *host, *originator_string;
1.41 markus 1786: int remote_channel, sock = -1, newch, i, denied;
1.77 markus 1787: u_int host_len, originator_len;
1.25 markus 1788:
1789: /* Get remote channel number. */
1790: remote_channel = packet_get_int();
1791:
1792: /* Get host name to connect to. */
1793: host = packet_get_string(&host_len);
1794:
1795: /* Get port to connect to. */
1796: host_port = packet_get_int();
1797:
1798: /* Get remote originator name. */
1.29 markus 1799: if (have_hostname_in_open) {
1.25 markus 1800: originator_string = packet_get_string(&originator_len);
1.29 markus 1801: originator_len += 4; /* size of packet_int */
1802: } else {
1.25 markus 1803: originator_string = xstrdup("unknown (remote did not supply name)");
1.29 markus 1804: originator_len = 0; /* no originator supplied */
1805: }
1.25 markus 1806:
1.41 markus 1807: packet_integrity_check(plen,
1808: 4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
1.25 markus 1809:
1810: /* Check if opening that port is permitted. */
1.41 markus 1811: denied = 0;
1.25 markus 1812: if (!all_opens_permitted) {
1813: /* Go trough all permitted ports. */
1814: for (i = 0; i < num_permitted_opens; i++)
1.41 markus 1815: if (permitted_opens[i].port_to_connect == host_port &&
1816: strcmp(permitted_opens[i].host_to_connect, host) == 0)
1.25 markus 1817: break;
1818:
1819: /* Check if we found the requested port among those permitted. */
1820: if (i >= num_permitted_opens) {
1821: /* The port is not permitted. */
1822: log("Received request to connect to %.100s:%d, but the request was denied.",
1823: host, host_port);
1.41 markus 1824: denied = 1;
1.25 markus 1825: }
1826: }
1.41 markus 1827: sock = denied ? -1 : channel_connect_to(host, host_port);
1828: if (sock > 0) {
1829: /* Allocate a channel for this connection. */
1.75 markus 1830: newch = channel_allocate(SSH_CHANNEL_CONNECTING,
1831: sock, originator_string);
1832: /*XXX delay answer? */
1.41 markus 1833: channels[newch].remote_id = remote_channel;
1834:
1835: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1836: packet_put_int(remote_channel);
1837: packet_put_int(newch);
1838: packet_send();
1839: } else {
1840: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1841: packet_put_int(remote_channel);
1842: packet_send();
1.25 markus 1843: }
1844: xfree(host);
1.1 deraadt 1845: }
1846:
1.27 markus 1847: /*
1848: * Creates an internet domain socket for listening for X11 connections.
1849: * Returns a suitable value for the DISPLAY variable, or NULL if an error
1850: * occurs.
1851: */
1.1 deraadt 1852:
1.35 markus 1853: #define NUM_SOCKS 10
1854:
1.25 markus 1855: char *
1.33 markus 1856: x11_create_display_inet(int screen_number, int x11_display_offset)
1.1 deraadt 1857: {
1.31 markus 1858: int display_number, sock;
1859: u_short port;
1.35 markus 1860: struct addrinfo hints, *ai, *aitop;
1861: char strport[NI_MAXSERV];
1862: int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1863: char display[512];
1.25 markus 1864: char hostname[MAXHOSTNAMELEN];
1865:
1.33 markus 1866: for (display_number = x11_display_offset;
1.25 markus 1867: display_number < MAX_DISPLAYS;
1868: display_number++) {
1869: port = 6000 + display_number;
1.35 markus 1870: memset(&hints, 0, sizeof(hints));
1871: hints.ai_family = IPv4or6;
1.36 markus 1872: hints.ai_flags = AI_PASSIVE; /* XXX loopback only ? */
1.35 markus 1873: hints.ai_socktype = SOCK_STREAM;
1874: snprintf(strport, sizeof strport, "%d", port);
1875: if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1876: error("getaddrinfo: %.100s", gai_strerror(gaierr));
1.25 markus 1877: return NULL;
1878: }
1.35 markus 1879: for (ai = aitop; ai; ai = ai->ai_next) {
1880: if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1881: continue;
1882: sock = socket(ai->ai_family, SOCK_STREAM, 0);
1883: if (sock < 0) {
1884: error("socket: %.100s", strerror(errno));
1885: return NULL;
1886: }
1887: if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1888: debug("bind port %d: %.100s", port, strerror(errno));
1889: shutdown(sock, SHUT_RDWR);
1890: close(sock);
1891: for (n = 0; n < num_socks; n++) {
1892: shutdown(socks[n], SHUT_RDWR);
1893: close(socks[n]);
1894: }
1895: num_socks = 0;
1896: break;
1897: }
1898: socks[num_socks++] = sock;
1899: if (num_socks == NUM_SOCKS)
1900: break;
1.25 markus 1901: }
1.35 markus 1902: if (num_socks > 0)
1903: break;
1.25 markus 1904: }
1905: if (display_number >= MAX_DISPLAYS) {
1906: error("Failed to allocate internet-domain X11 display socket.");
1907: return NULL;
1908: }
1909: /* Start listening for connections on the socket. */
1.35 markus 1910: for (n = 0; n < num_socks; n++) {
1911: sock = socks[n];
1912: if (listen(sock, 5) < 0) {
1913: error("listen: %.100s", strerror(errno));
1914: shutdown(sock, SHUT_RDWR);
1915: close(sock);
1916: return NULL;
1917: }
1.25 markus 1918: }
1.35 markus 1919:
1.25 markus 1920: /* Set up a suitable value for the DISPLAY variable. */
1921: if (gethostname(hostname, sizeof(hostname)) < 0)
1922: fatal("gethostname: %.100s", strerror(errno));
1.35 markus 1923: snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
1.25 markus 1924: display_number, screen_number);
1925:
1.35 markus 1926: /* Allocate a channel for each socket. */
1927: for (n = 0; n < num_socks; n++) {
1928: sock = socks[n];
1.51 markus 1929: (void) channel_new("x11 listener",
1930: SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
1931: CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
1.71 markus 1932: 0, xstrdup("X11 inet listener"), 1);
1.35 markus 1933: }
1.1 deraadt 1934:
1.25 markus 1935: /* Return a suitable value for the DISPLAY environment variable. */
1.35 markus 1936: return xstrdup(display);
1.1 deraadt 1937: }
1938:
1939: #ifndef X_UNIX_PATH
1940: #define X_UNIX_PATH "/tmp/.X11-unix/X"
1941: #endif
1942:
1943: static
1944: int
1.77 markus 1945: connect_local_xsocket(u_int dnr)
1.1 deraadt 1946: {
1.25 markus 1947: static const char *const x_sockets[] = {
1948: X_UNIX_PATH "%u",
1949: "/var/X/.X11-unix/X" "%u",
1950: "/usr/spool/sockets/X11/" "%u",
1951: NULL
1952: };
1953: int sock;
1954: struct sockaddr_un addr;
1955: const char *const * path;
1956:
1957: for (path = x_sockets; *path; ++path) {
1958: sock = socket(AF_UNIX, SOCK_STREAM, 0);
1959: if (sock < 0)
1960: error("socket: %.100s", strerror(errno));
1961: memset(&addr, 0, sizeof(addr));
1962: addr.sun_family = AF_UNIX;
1963: snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
1964: if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
1965: return sock;
1966: close(sock);
1967: }
1968: error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
1969: return -1;
1.1 deraadt 1970: }
1971:
1.51 markus 1972: int
1973: x11_connect_display(void)
1.1 deraadt 1974: {
1.51 markus 1975: int display_number, sock = 0;
1.25 markus 1976: const char *display;
1.51 markus 1977: char buf[1024], *cp;
1.35 markus 1978: struct addrinfo hints, *ai, *aitop;
1979: char strport[NI_MAXSERV];
1980: int gaierr;
1.25 markus 1981:
1982: /* Try to open a socket for the local X server. */
1983: display = getenv("DISPLAY");
1984: if (!display) {
1985: error("DISPLAY not set.");
1.51 markus 1986: return -1;
1.25 markus 1987: }
1.27 markus 1988: /*
1989: * Now we decode the value of the DISPLAY variable and make a
1990: * connection to the real X server.
1991: */
1992:
1993: /*
1994: * Check if it is a unix domain socket. Unix domain displays are in
1995: * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
1996: */
1.25 markus 1997: if (strncmp(display, "unix:", 5) == 0 ||
1998: display[0] == ':') {
1999: /* Connect to the unix domain socket. */
2000: if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
2001: error("Could not parse display number from DISPLAY: %.100s",
2002: display);
1.51 markus 2003: return -1;
1.25 markus 2004: }
2005: /* Create a socket. */
2006: sock = connect_local_xsocket(display_number);
2007: if (sock < 0)
1.51 markus 2008: return -1;
1.25 markus 2009:
2010: /* OK, we now have a connection to the display. */
1.51 markus 2011: return sock;
1.25 markus 2012: }
1.27 markus 2013: /*
2014: * Connect to an inet socket. The DISPLAY value is supposedly
2015: * hostname:d[.s], where hostname may also be numeric IP address.
2016: */
1.25 markus 2017: strncpy(buf, display, sizeof(buf));
2018: buf[sizeof(buf) - 1] = 0;
2019: cp = strchr(buf, ':');
2020: if (!cp) {
2021: error("Could not find ':' in DISPLAY: %.100s", display);
1.51 markus 2022: return -1;
1.25 markus 2023: }
2024: *cp = 0;
1.27 markus 2025: /* buf now contains the host name. But first we parse the display number. */
1.25 markus 2026: if (sscanf(cp + 1, "%d", &display_number) != 1) {
2027: error("Could not parse display number from DISPLAY: %.100s",
2028: display);
1.51 markus 2029: return -1;
1.25 markus 2030: }
1.35 markus 2031:
2032: /* Look up the host address */
2033: memset(&hints, 0, sizeof(hints));
2034: hints.ai_family = IPv4or6;
2035: hints.ai_socktype = SOCK_STREAM;
2036: snprintf(strport, sizeof strport, "%d", 6000 + display_number);
2037: if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
2038: error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
1.51 markus 2039: return -1;
1.25 markus 2040: }
1.35 markus 2041: for (ai = aitop; ai; ai = ai->ai_next) {
2042: /* Create a socket. */
2043: sock = socket(ai->ai_family, SOCK_STREAM, 0);
2044: if (sock < 0) {
2045: debug("socket: %.100s", strerror(errno));
1.41 markus 2046: continue;
2047: }
2048: /* Connect it to the display. */
2049: if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2050: debug("connect %.100s port %d: %.100s", buf,
2051: 6000 + display_number, strerror(errno));
2052: close(sock);
2053: continue;
2054: }
2055: /* Success */
2056: break;
1.35 markus 2057: }
2058: freeaddrinfo(aitop);
2059: if (!ai) {
1.49 markus 2060: error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
1.35 markus 2061: strerror(errno));
1.51 markus 2062: return -1;
1.25 markus 2063: }
1.51 markus 2064: return sock;
2065: }
2066:
2067: /*
2068: * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
2069: * the remote channel number. We should do whatever we want, and respond
2070: * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
2071: */
2072:
2073: void
1.69 markus 2074: x11_input_open(int type, int plen, void *ctxt)
1.51 markus 2075: {
2076: int remote_channel, sock = 0, newch;
2077: char *remote_host;
1.77 markus 2078: u_int remote_len;
1.25 markus 2079:
1.51 markus 2080: /* Get remote channel number. */
2081: remote_channel = packet_get_int();
2082:
2083: /* Get remote originator name. */
2084: if (have_hostname_in_open) {
2085: remote_host = packet_get_string(&remote_len);
2086: remote_len += 4;
2087: } else {
2088: remote_host = xstrdup("unknown (remote did not supply name)");
2089: remote_len = 0;
2090: }
1.25 markus 2091:
1.51 markus 2092: debug("Received X11 open request.");
2093: packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
1.25 markus 2094:
1.51 markus 2095: /* Obtain a connection to the real X display. */
2096: sock = x11_connect_display();
2097: if (sock == -1) {
2098: /* Send refusal to the remote host. */
2099: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2100: packet_put_int(remote_channel);
2101: packet_send();
2102: } else {
2103: /* Allocate a channel for this connection. */
2104: newch = channel_allocate(
2105: (x11_saved_proto == NULL) ?
2106: SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
2107: sock, remote_host);
2108: channels[newch].remote_id = remote_channel;
1.25 markus 2109:
1.51 markus 2110: /* Send a confirmation to the remote host. */
2111: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2112: packet_put_int(remote_channel);
2113: packet_put_int(newch);
2114: packet_send();
2115: }
1.72 markus 2116: }
2117:
2118: /* dummy protocol handler that denies SSH-1 requests (agent/x11) */
2119: void
2120: deny_input_open(int type, int plen, void *ctxt)
2121: {
2122: int rchan = packet_get_int();
2123: switch(type){
2124: case SSH_SMSG_AGENT_OPEN:
2125: error("Warning: ssh server tried agent forwarding.");
2126: break;
2127: case SSH_SMSG_X11_OPEN:
2128: error("Warning: ssh server tried X11 forwarding.");
2129: break;
2130: default:
2131: error("deny_input_open: type %d plen %d", type, plen);
2132: break;
2133: }
2134: error("Warning: this is probably a break in attempt by a malicious server.");
2135: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2136: packet_put_int(rchan);
2137: packet_send();
1.1 deraadt 2138: }
2139:
1.27 markus 2140: /*
2141: * Requests forwarding of X11 connections, generates fake authentication
2142: * data, and enables authentication spoofing.
2143: */
1.1 deraadt 2144:
1.49 markus 2145: void
1.51 markus 2146: x11_request_forwarding_with_spoofing(int client_session_id,
2147: const char *proto, const char *data)
1.1 deraadt 2148: {
1.77 markus 2149: u_int data_len = (u_int) strlen(data) / 2;
2150: u_int i, value;
1.25 markus 2151: char *new_data;
2152: int screen_number;
2153: const char *cp;
2154: u_int32_t rand = 0;
2155:
2156: cp = getenv("DISPLAY");
2157: if (cp)
2158: cp = strchr(cp, ':');
2159: if (cp)
2160: cp = strchr(cp, '.');
2161: if (cp)
2162: screen_number = atoi(cp + 1);
2163: else
2164: screen_number = 0;
2165:
2166: /* Save protocol name. */
2167: x11_saved_proto = xstrdup(proto);
2168:
1.27 markus 2169: /*
2170: * Extract real authentication data and generate fake data of the
2171: * same length.
2172: */
1.25 markus 2173: x11_saved_data = xmalloc(data_len);
2174: x11_fake_data = xmalloc(data_len);
2175: for (i = 0; i < data_len; i++) {
2176: if (sscanf(data + 2 * i, "%2x", &value) != 1)
2177: fatal("x11_request_forwarding: bad authentication data: %.100s", data);
2178: if (i % 4 == 0)
2179: rand = arc4random();
2180: x11_saved_data[i] = value;
2181: x11_fake_data[i] = rand & 0xff;
2182: rand >>= 8;
2183: }
2184: x11_saved_data_len = data_len;
2185: x11_fake_data_len = data_len;
2186:
2187: /* Convert the fake data into hex. */
2188: new_data = xmalloc(2 * data_len + 1);
2189: for (i = 0; i < data_len; i++)
1.77 markus 2190: sprintf(new_data + 2 * i, "%02x", (u_char) x11_fake_data[i]);
1.25 markus 2191:
2192: /* Send the request packet. */
1.51 markus 2193: if (compat20) {
2194: channel_request_start(client_session_id, "x11-req", 0);
2195: packet_put_char(0); /* XXX bool single connection */
2196: } else {
2197: packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2198: }
2199: packet_put_cstring(proto);
2200: packet_put_cstring(new_data);
1.25 markus 2201: packet_put_int(screen_number);
2202: packet_send();
2203: packet_write_wait();
2204: xfree(new_data);
1.1 deraadt 2205: }
2206:
2207: /* Sends a message to the server to request authentication fd forwarding. */
2208:
1.49 markus 2209: void
1.25 markus 2210: auth_request_forwarding()
1.1 deraadt 2211: {
1.25 markus 2212: packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2213: packet_send();
2214: packet_write_wait();
1.1 deraadt 2215: }
2216:
1.27 markus 2217: /*
2218: * Returns the name of the forwarded authentication socket. Returns NULL if
2219: * there is no forwarded authentication socket. The returned value points to
2220: * a static buffer.
2221: */
1.1 deraadt 2222:
1.25 markus 2223: char *
2224: auth_get_socket_name()
1.1 deraadt 2225: {
1.25 markus 2226: return channel_forwarded_auth_socket_name;
1.1 deraadt 2227: }
2228:
1.12 markus 2229: /* removes the agent forwarding socket */
2230:
1.49 markus 2231: void
1.25 markus 2232: cleanup_socket(void)
2233: {
1.78 markus 2234: unlink(channel_forwarded_auth_socket_name);
1.25 markus 2235: rmdir(channel_forwarded_auth_socket_dir);
1.12 markus 2236: }
2237:
1.27 markus 2238: /*
1.59 markus 2239: * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
1.27 markus 2240: * This starts forwarding authentication requests.
2241: */
1.1 deraadt 2242:
1.59 markus 2243: int
1.25 markus 2244: auth_input_request_forwarding(struct passwd * pw)
1.1 deraadt 2245: {
1.25 markus 2246: int sock, newch;
2247: struct sockaddr_un sunaddr;
2248:
2249: if (auth_get_socket_name() != NULL)
2250: fatal("Protocol error: authentication forwarding requested twice.");
2251:
2252: /* Temporarily drop privileged uid for mkdir/bind. */
2253: temporarily_use_uid(pw->pw_uid);
2254:
2255: /* Allocate a buffer for the socket name, and format the name. */
2256: channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2257: channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2258: strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
2259:
2260: /* Create private directory for socket */
1.59 markus 2261: if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {
2262: packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",
2263: strerror(errno));
2264: restore_uid();
2265: xfree(channel_forwarded_auth_socket_name);
2266: xfree(channel_forwarded_auth_socket_dir);
2267: channel_forwarded_auth_socket_name = NULL;
2268: channel_forwarded_auth_socket_dir = NULL;
2269: return 0;
2270: }
1.25 markus 2271: snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2272: channel_forwarded_auth_socket_dir, (int) getpid());
2273:
2274: if (atexit(cleanup_socket) < 0) {
2275: int saved = errno;
2276: cleanup_socket();
2277: packet_disconnect("socket: %.100s", strerror(saved));
2278: }
2279: /* Create the socket. */
2280: sock = socket(AF_UNIX, SOCK_STREAM, 0);
2281: if (sock < 0)
2282: packet_disconnect("socket: %.100s", strerror(errno));
2283:
2284: /* Bind it to the name. */
2285: memset(&sunaddr, 0, sizeof(sunaddr));
2286: sunaddr.sun_family = AF_UNIX;
2287: strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2288: sizeof(sunaddr.sun_path));
2289:
2290: if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2291: packet_disconnect("bind: %.100s", strerror(errno));
2292:
2293: /* Restore the privileged uid. */
2294: restore_uid();
2295:
2296: /* Start listening on the socket. */
2297: if (listen(sock, 5) < 0)
2298: packet_disconnect("listen: %.100s", strerror(errno));
2299:
2300: /* Allocate a channel for the authentication agent socket. */
1.73 markus 2301: newch = channel_new("auth socket",
2302: SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
2303: CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
2304: 0, xstrdup("auth socket"), 1);
2305:
1.32 deraadt 2306: strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2307: sizeof(channels[newch].path));
1.59 markus 2308: return 1;
1.1 deraadt 2309: }
2310:
2311: /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2312:
1.49 markus 2313: void
1.69 markus 2314: auth_input_open_request(int type, int plen, void *ctxt)
1.1 deraadt 2315: {
1.25 markus 2316: int remch, sock, newch;
2317: char *dummyname;
1.41 markus 2318:
2319: packet_integrity_check(plen, 4, type);
1.25 markus 2320:
2321: /* Read the remote channel number from the message. */
2322: remch = packet_get_int();
2323:
1.27 markus 2324: /*
2325: * Get a connection to the local authentication agent (this may again
2326: * get forwarded).
2327: */
1.25 markus 2328: sock = ssh_get_authentication_socket();
2329:
1.27 markus 2330: /*
2331: * If we could not connect the agent, send an error message back to
2332: * the server. This should never happen unless the agent dies,
2333: * because authentication forwarding is only enabled if we have an
2334: * agent.
2335: */
1.25 markus 2336: if (sock < 0) {
2337: packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2338: packet_put_int(remch);
2339: packet_send();
2340: return;
2341: }
2342: debug("Forwarding authentication connection.");
1.1 deraadt 2343:
1.27 markus 2344: /*
2345: * Dummy host name. This will be freed when the channel is freed; it
2346: * will still be valid in the packet_put_string below since the
2347: * channel cannot yet be freed at that point.
2348: */
1.25 markus 2349: dummyname = xstrdup("authentication agent connection");
2350:
2351: newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2352: channels[newch].remote_id = remch;
2353:
2354: /* Send a confirmation to the remote host. */
2355: packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2356: packet_put_int(remch);
2357: packet_put_int(newch);
1.44 markus 2358: packet_send();
2359: }
2360:
2361: void
1.51 markus 2362: channel_start_open(int id)
1.44 markus 2363: {
2364: Channel *c = channel_lookup(id);
2365: if (c == NULL) {
2366: log("channel_open: %d: bad id", id);
2367: return;
2368: }
1.51 markus 2369: debug("send channel open %d", id);
1.44 markus 2370: packet_start(SSH2_MSG_CHANNEL_OPEN);
2371: packet_put_cstring(c->ctype);
2372: packet_put_int(c->self);
2373: packet_put_int(c->local_window);
2374: packet_put_int(c->local_maxpacket);
1.51 markus 2375: }
2376: void
2377: channel_open(int id)
2378: {
2379: /* XXX REMOVE ME */
2380: channel_start_open(id);
1.44 markus 2381: packet_send();
2382: }
2383: void
2384: channel_request(int id, char *service, int wantconfirm)
2385: {
2386: channel_request_start(id, service, wantconfirm);
2387: packet_send();
2388: debug("channel request %d: %s", id, service) ;
2389: }
2390: void
2391: channel_request_start(int id, char *service, int wantconfirm)
2392: {
2393: Channel *c = channel_lookup(id);
2394: if (c == NULL) {
2395: log("channel_request: %d: bad id", id);
2396: return;
2397: }
2398: packet_start(SSH2_MSG_CHANNEL_REQUEST);
2399: packet_put_int(c->remote_id);
2400: packet_put_cstring(service);
2401: packet_put_char(wantconfirm);
2402: }
2403: void
2404: channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2405: {
2406: Channel *c = channel_lookup(id);
2407: if (c == NULL) {
2408: log("channel_register_callback: %d: bad id", id);
2409: return;
2410: }
2411: c->cb_event = mtype;
2412: c->cb_fn = fn;
2413: c->cb_arg = arg;
2414: }
2415: void
2416: channel_register_cleanup(int id, channel_callback_fn *fn)
2417: {
2418: Channel *c = channel_lookup(id);
2419: if (c == NULL) {
2420: log("channel_register_cleanup: %d: bad id", id);
2421: return;
2422: }
2423: c->dettach_user = fn;
2424: }
2425: void
2426: channel_cancel_cleanup(int id)
2427: {
2428: Channel *c = channel_lookup(id);
2429: if (c == NULL) {
2430: log("channel_cancel_cleanup: %d: bad id", id);
2431: return;
2432: }
2433: c->dettach_user = NULL;
1.65 markus 2434: }
2435: void
2436: channel_register_filter(int id, channel_filter_fn *fn)
2437: {
2438: Channel *c = channel_lookup(id);
2439: if (c == NULL) {
2440: log("channel_register_filter: %d: bad id", id);
2441: return;
2442: }
2443: c->input_filter = fn;
1.44 markus 2444: }
2445:
2446: void
1.71 markus 2447: channel_set_fds(int id, int rfd, int wfd, int efd,
2448: int extusage, int nonblock)
1.44 markus 2449: {
2450: Channel *c = channel_lookup(id);
2451: if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2452: fatal("channel_activate for non-larval channel %d.", id);
1.71 markus 2453: channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
1.44 markus 2454: c->type = SSH_CHANNEL_OPEN;
2455: /* XXX window size? */
1.68 markus 2456: c->local_window = c->local_window_max = c->local_maxpacket * 2;
1.44 markus 2457: packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2458: packet_put_int(c->remote_id);
2459: packet_put_int(c->local_window);
1.25 markus 2460: packet_send();
1.1 deraadt 2461: }
![[BACK]](/icons/back.gif){kind=icon}
Return to channels.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh