version 1.24, 1999/11/22 21:52:42 |
version 1.25, 1999/11/24 00:26:03 |
|
|
/* |
/* |
|
* |
|
* ssh.h |
|
* |
|
* Author: Tatu Ylonen <ylo@cs.hut.fi> |
|
* |
|
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
|
* All rights reserved |
|
* |
|
* Created: Fri Mar 17 17:09:37 1995 ylo |
|
* |
|
* Generic header file for ssh. |
|
* |
|
*/ |
|
|
ssh.h |
|
|
|
Author: Tatu Ylonen <ylo@cs.hut.fi> |
|
|
|
Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
|
All rights reserved |
|
|
|
Created: Fri Mar 17 17:09:37 1995 ylo |
|
|
|
Generic header file for ssh. |
|
|
|
*/ |
|
|
|
/* RCSID("$Id$"); */ |
/* RCSID("$Id$"); */ |
|
|
#ifndef SSH_H |
#ifndef SSH_H |
|
|
#include "rsa.h" |
#include "rsa.h" |
#include "cipher.h" |
#include "cipher.h" |
|
|
/* The default cipher used if IDEA is not supported by the remote host. |
/* The default cipher used if IDEA is not supported by the remote host. |
It is recommended that this be one of the mandatory ciphers (DES, 3DES), |
It is recommended that this be one of the mandatory ciphers (DES, 3DES), |
though that is not required. */ |
though that is not required. */ |
#define SSH_FALLBACK_CIPHER SSH_CIPHER_3DES |
#define SSH_FALLBACK_CIPHER SSH_CIPHER_3DES |
|
|
not contain anything particularly secret. */ |
not contain anything particularly secret. */ |
#define SSH_USER_HOSTFILE "~/.ssh/known_hosts" |
#define SSH_USER_HOSTFILE "~/.ssh/known_hosts" |
|
|
/* Name of the default file containing client-side authentication key. |
/* Name of the default file containing client-side authentication key. |
This file should only be readable by the user him/herself. */ |
This file should only be readable by the user him/herself. */ |
#define SSH_CLIENT_IDENTITY ".ssh/identity" |
#define SSH_CLIENT_IDENTITY ".ssh/identity" |
|
|
|
|
readable by anyone but the user him/herself, but does not contain |
readable by anyone but the user him/herself, but does not contain |
anything particularly secret. If the user\'s home directory resides |
anything particularly secret. If the user\'s home directory resides |
on an NFS volume where root is mapped to nobody, this may need to be |
on an NFS volume where root is mapped to nobody, this may need to be |
world-readable. (This file is read by the daemon which is running as |
world-readable. (This file is read by the daemon which is running as |
root.) */ |
root.) */ |
#define SSH_USER_PERMITTED_KEYS ".ssh/authorized_keys" |
#define SSH_USER_PERMITTED_KEYS ".ssh/authorized_keys" |
|
|
|
|
/* Ssh-only version of /etc/hosts.equiv. */ |
/* Ssh-only version of /etc/hosts.equiv. */ |
#define SSH_HOSTS_EQUIV ETCDIR "/shosts.equiv" |
#define SSH_HOSTS_EQUIV ETCDIR "/shosts.equiv" |
|
|
/* Additionally, the daemon may use ~/.rhosts and /etc/hosts.equiv if |
/* Additionally, the daemon may use ~/.rhosts and /etc/hosts.equiv if |
rhosts authentication is enabled. */ |
rhosts authentication is enabled. */ |
|
|
/* Name of the environment variable containing the pathname of the |
/* Name of the environment variable containing the pathname of the |
|
|
many bits. This is to make double encryption with rsaref work. */ |
many bits. This is to make double encryption with rsaref work. */ |
#define SSH_KEY_BITS_RESERVED 128 |
#define SSH_KEY_BITS_RESERVED 128 |
|
|
/* Length of the session key in bytes. (Specified as 256 bits in the |
/* Length of the session key in bytes. (Specified as 256 bits in the |
protocol.) */ |
protocol.) */ |
#define SSH_SESSION_KEY_LENGTH 32 |
#define SSH_SESSION_KEY_LENGTH 32 |
|
|
|
|
#define SSH_AUTH_TIS 5 |
#define SSH_AUTH_TIS 5 |
#define SSH_AUTH_KERBEROS 6 |
#define SSH_AUTH_KERBEROS 6 |
#define SSH_PASS_KERBEROS_TGT 7 |
#define SSH_PASS_KERBEROS_TGT 7 |
/* 8 to 15 are reserved */ |
/* 8 to 15 are reserved */ |
#define SSH_PASS_AFS_TOKEN 21 |
#define SSH_PASS_AFS_TOKEN 21 |
|
|
/* Protocol flags. These are bit masks. */ |
/* Protocol flags. These are bit masks. */ |
#define SSH_PROTOFLAG_SCREEN_NUMBER 1 /* X11 forwarding includes screen */ |
#define SSH_PROTOFLAG_SCREEN_NUMBER 1 /* X11 forwarding includes |
#define SSH_PROTOFLAG_HOST_IN_FWD_OPEN 2 /* forwarding opens contain host */ |
* screen */ |
|
#define SSH_PROTOFLAG_HOST_IN_FWD_OPEN 2 /* forwarding opens contain |
|
* host */ |
|
|
/* Definition of message types. New values can be added, but old values |
/* Definition of message types. New values can be added, but old values |
should not be removed or without careful consideration of the consequences |
should not be removed or without careful consideration of the consequences |
for compatibility. The maximum value is 254; value 255 is reserved |
for compatibility. The maximum value is 254; value 255 is reserved |
for future extension. */ |
for future extension. */ |
/* Message name */ /* msg code */ /* arguments */ |
/* Message name *//* msg code *//* arguments */ |
#define SSH_MSG_NONE 0 /* no message */ |
#define SSH_MSG_NONE 0 /* no message */ |
#define SSH_MSG_DISCONNECT 1 /* cause (string) */ |
#define SSH_MSG_DISCONNECT 1 /* cause (string) */ |
#define SSH_SMSG_PUBLIC_KEY 2 /* ck,msk,srvk,hostk */ |
#define SSH_SMSG_PUBLIC_KEY 2 /* ck,msk,srvk,hostk */ |
|
|
|
|
/*------------ definitions for login.c -------------*/ |
/*------------ definitions for login.c -------------*/ |
|
|
/* Returns the time when the user last logged in. Returns 0 if the |
/* Returns the time when the user last logged in. Returns 0 if the |
information is not available. This must be called before record_login. |
information is not available. This must be called before record_login. |
The host from which the user logged in is stored in buf. */ |
The host from which the user logged in is stored in buf. */ |
unsigned long get_last_login_time(uid_t uid, const char *logname, |
unsigned long |
char *buf, unsigned int bufsize); |
get_last_login_time(uid_t uid, const char *logname, |
|
char *buf, unsigned int bufsize); |
|
|
/* Records that the user has logged in. This does many things normally |
/* Records that the user has logged in. This does many things normally |
done by login(1). */ |
done by login(1). */ |
void record_login(int pid, const char *ttyname, const char *user, uid_t uid, |
void |
const char *host, struct sockaddr_in *addr); |
record_login(int pid, const char *ttyname, const char *user, uid_t uid, |
|
const char *host, struct sockaddr_in * addr); |
|
|
/* Records that the user has logged out. This does many thigs normally |
/* Records that the user has logged out. This does many thigs normally |
done by login(1) or init. */ |
done by login(1) or init. */ |
void record_logout(int pid, const char *ttyname); |
void record_logout(int pid, const char *ttyname); |
|
|
/*------------ definitions for sshconnect.c ----------*/ |
/*------------ definitions for sshconnect.c ----------*/ |
|
|
/* Opens a TCP/IP connection to the remote server on the given host. If |
/* Opens a TCP/IP connection to the remote server on the given host. If |
port is 0, the default port will be used. If anonymous is zero, |
port is 0, the default port will be used. If anonymous is zero, |
a privileged port will be allocated to make the connection. |
a privileged port will be allocated to make the connection. |
This requires super-user privileges if anonymous is false. |
This requires super-user privileges if anonymous is false. |
Connection_attempts specifies the maximum number of tries, one per |
Connection_attempts specifies the maximum number of tries, one per |
second. This returns true on success, and zero on failure. If the |
second. This returns true on success, and zero on failure. If the |
connection is successful, this calls packet_set_connection for the |
connection is successful, this calls packet_set_connection for the |
connection. */ |
connection. */ |
int ssh_connect(const char *host, struct sockaddr_in *hostaddr, |
int |
int port, int connection_attempts, |
ssh_connect(const char *host, struct sockaddr_in * hostaddr, |
int anonymous, uid_t original_real_uid, |
int port, int connection_attempts, |
const char *proxy_command); |
int anonymous, uid_t original_real_uid, |
|
const char *proxy_command); |
|
|
/* Starts a dialog with the server, and authenticates the current user on the |
/* Starts a dialog with the server, and authenticates the current user on the |
server. This does not need any extra privileges. The basic connection |
server. This does not need any extra privileges. The basic connection |
to the server must already have been established before this is called. |
to the server must already have been established before this is called. |
If login fails, this function prints an error and never returns. |
If login fails, this function prints an error and never returns. |
This initializes the random state, and leaves it initialized (it will also |
This initializes the random state, and leaves it initialized (it will also |
have references from the packet module). */ |
have references from the packet module). */ |
|
|
void ssh_login(int host_key_valid, RSA *host_key, const char *host, |
void |
struct sockaddr_in *hostaddr, uid_t original_real_uid); |
ssh_login(int host_key_valid, RSA * host_key, const char *host, |
|
struct sockaddr_in * hostaddr, uid_t original_real_uid); |
|
|
/*------------ Definitions for various authentication methods. -------*/ |
/*------------ Definitions for various authentication methods. -------*/ |
|
|
/* Tries to authenticate the user using the .rhosts file. Returns true if |
/* Tries to authenticate the user using the .rhosts file. Returns true if |
authentication succeeds. If ignore_rhosts is non-zero, this will not |
authentication succeeds. If ignore_rhosts is non-zero, this will not |
consider .rhosts and .shosts (/etc/hosts.equiv will still be used). */ |
consider .rhosts and .shosts (/etc/hosts.equiv will still be used). */ |
int auth_rhosts(struct passwd *pw, const char *client_user); |
int auth_rhosts(struct passwd * pw, const char *client_user); |
|
|
/* Tries to authenticate the user using the .rhosts file and the host using |
/* Tries to authenticate the user using the .rhosts file and the host using |
its host key. Returns true if authentication succeeds. */ |
its host key. Returns true if authentication succeeds. */ |
int auth_rhosts_rsa(struct passwd *pw, const char *client_user, |
int |
BIGNUM *client_host_key_e, BIGNUM *client_host_key_n); |
auth_rhosts_rsa(struct passwd * pw, const char *client_user, |
|
BIGNUM * client_host_key_e, BIGNUM * client_host_key_n); |
|
|
/* Tries to authenticate the user using password. Returns true if |
/* Tries to authenticate the user using password. Returns true if |
authentication succeeds. */ |
authentication succeeds. */ |
int auth_password(struct passwd *pw, const char *password); |
int auth_password(struct passwd * pw, const char *password); |
|
|
/* Performs the RSA authentication dialog with the client. This returns |
/* Performs the RSA authentication dialog with the client. This returns |
0 if the client could not be authenticated, and 1 if authentication was |
0 if the client could not be authenticated, and 1 if authentication was |
successful. This may exit if there is a serious protocol violation. */ |
successful. This may exit if there is a serious protocol violation. */ |
int auth_rsa(struct passwd *pw, BIGNUM *client_n); |
int auth_rsa(struct passwd * pw, BIGNUM * client_n); |
|
|
/* Parses an RSA key (number of bits, e, n) from a string. Moves the pointer |
/* Parses an RSA key (number of bits, e, n) from a string. Moves the pointer |
over the key. Skips any whitespace at the beginning and at end. */ |
over the key. Skips any whitespace at the beginning and at end. */ |
int auth_rsa_read_key(char **cpp, unsigned int *bitsp, BIGNUM *e, BIGNUM *n); |
int auth_rsa_read_key(char **cpp, unsigned int *bitsp, BIGNUM * e, BIGNUM * n); |
|
|
/* Returns the name of the machine at the other end of the socket. The |
/* Returns the name of the machine at the other end of the socket. The |
returned string should be freed by the caller. */ |
returned string should be freed by the caller. */ |
char *get_remote_hostname(int socket); |
char *get_remote_hostname(int socket); |
|
|
/* Return the canonical name of the host in the other side of the current |
/* Return the canonical name of the host in the other side of the current |
connection (as returned by packet_get_connection). The host name is |
connection (as returned by packet_get_connection). The host name is |
|
|
const char *get_remote_ipaddr(void); |
const char *get_remote_ipaddr(void); |
|
|
/* Returns the port number of the peer of the socket. */ |
/* Returns the port number of the peer of the socket. */ |
int get_peer_port(int sock); |
int get_peer_port(int sock); |
|
|
/* Returns the port number of the remote host. */ |
/* Returns the port number of the remote host. */ |
int get_remote_port(void); |
int get_remote_port(void); |
|
|
/* Tries to match the host name (which must be in all lowercase) against the |
/* Tries to match the host name (which must be in all lowercase) against the |
comma-separated sequence of subpatterns (each possibly preceded by ! to |
comma-separated sequence of subpatterns (each possibly preceded by ! to |
indicate negation). Returns true if there is a positive match; zero |
indicate negation). Returns true if there is a positive match; zero |
otherwise. */ |
otherwise. */ |
int match_hostname(const char *host, const char *pattern, unsigned int len); |
int match_hostname(const char *host, const char *pattern, unsigned int len); |
|
|
/* Checks whether the given host is already in the list of our known hosts. |
/* Checks whether the given host is already in the list of our known hosts. |
Returns HOST_OK if the host is known and has the specified key, |
Returns HOST_OK if the host is known and has the specified key, |
HOST_NEW if the host is not known, and HOST_CHANGED if the host is known |
HOST_NEW if the host is not known, and HOST_CHANGED if the host is known |
but used to have a different host key. The host must be in all lowercase. */ |
but used to have a different host key. The host must be in all lowercase. */ |
typedef enum { HOST_OK, HOST_NEW, HOST_CHANGED } HostStatus; |
typedef enum { |
HostStatus check_host_in_hostfile(const char *filename, const char *host, |
HOST_OK, HOST_NEW, HOST_CHANGED |
BIGNUM *e, BIGNUM *n, BIGNUM *ke, BIGNUM *kn); |
} HostStatus; |
|
HostStatus |
|
check_host_in_hostfile(const char *filename, const char *host, |
|
BIGNUM * e, BIGNUM * n, BIGNUM * ke, BIGNUM * kn); |
|
|
/* Appends an entry to the host file. Returns false if the entry |
/* Appends an entry to the host file. Returns false if the entry |
could not be appended. */ |
could not be appended. */ |
int add_host_to_hostfile(const char *filename, const char *host, |
int |
BIGNUM *e, BIGNUM *n); |
add_host_to_hostfile(const char *filename, const char *host, |
|
BIGNUM * e, BIGNUM * n); |
|
|
/* Performs the RSA authentication challenge-response dialog with the client, |
/* Performs the RSA authentication challenge-response dialog with the client, |
and returns true (non-zero) if the client gave the correct answer to |
and returns true (non-zero) if the client gave the correct answer to |
our challenge; returns zero if the client gives a wrong answer. */ |
our challenge; returns zero if the client gives a wrong answer. */ |
int auth_rsa_challenge_dialog(BIGNUM *e, BIGNUM *n); |
int auth_rsa_challenge_dialog(BIGNUM * e, BIGNUM * n); |
|
|
/* Reads a passphrase from /dev/tty with echo turned off. Returns the |
/* Reads a passphrase from /dev/tty with echo turned off. Returns the |
passphrase (allocated with xmalloc). Exits if EOF is encountered. |
passphrase (allocated with xmalloc). Exits if EOF is encountered. |
If from_stdin is true, the passphrase will be read from stdin instead. */ |
If from_stdin is true, the passphrase will be read from stdin instead. */ |
char *read_passphrase(const char *prompt, int from_stdin); |
char *read_passphrase(const char *prompt, int from_stdin); |
|
|
/* Saves the authentication (private) key in a file, encrypting it with |
/* Saves the authentication (private) key in a file, encrypting it with |
passphrase. The identification of the file (lowest 64 bits of n) |
passphrase. The identification of the file (lowest 64 bits of n) |
will precede the key to provide identification of the key without |
will precede the key to provide identification of the key without |
needing a passphrase. */ |
needing a passphrase. */ |
int save_private_key(const char *filename, const char *passphrase, |
int |
RSA *private_key, const char *comment); |
save_private_key(const char *filename, const char *passphrase, |
|
RSA * private_key, const char *comment); |
|
|
/* Loads the public part of the key file (public key and comment). |
/* Loads the public part of the key file (public key and comment). |
Returns 0 if an error occurred; zero if the public key was successfully |
Returns 0 if an error occurred; zero if the public key was successfully |
read. The comment of the key is returned in comment_return if it is |
read. The comment of the key is returned in comment_return if it is |
non-NULL; the caller must free the value with xfree. */ |
non-NULL; the caller must free the value with xfree. */ |
int load_public_key(const char *filename, RSA *pub, |
int |
char **comment_return); |
load_public_key(const char *filename, RSA * pub, |
|
char **comment_return); |
|
|
/* Loads the private key from the file. Returns 0 if an error is encountered |
/* Loads the private key from the file. Returns 0 if an error is encountered |
(file does not exist or is not readable, or passphrase is bad). |
(file does not exist or is not readable, or passphrase is bad). |
This initializes the private key. The comment of the key is returned |
This initializes the private key. The comment of the key is returned |
in comment_return if it is non-NULL; the caller must free the value |
in comment_return if it is non-NULL; the caller must free the value |
with xfree. */ |
with xfree. */ |
int load_private_key(const char *filename, const char *passphrase, |
int |
RSA *private_key, char **comment_return); |
load_private_key(const char *filename, const char *passphrase, |
|
RSA * private_key, char **comment_return); |
|
|
/*------------ Definitions for logging. -----------------------*/ |
/*------------ Definitions for logging. -----------------------*/ |
|
|
/* Supported syslog facilities and levels. */ |
/* Supported syslog facilities and levels. */ |
typedef enum |
typedef enum { |
{ |
SYSLOG_FACILITY_DAEMON, |
SYSLOG_FACILITY_DAEMON, |
SYSLOG_FACILITY_USER, |
SYSLOG_FACILITY_USER, |
SYSLOG_FACILITY_AUTH, |
SYSLOG_FACILITY_AUTH, |
SYSLOG_FACILITY_LOCAL0, |
SYSLOG_FACILITY_LOCAL0, |
SYSLOG_FACILITY_LOCAL1, |
SYSLOG_FACILITY_LOCAL1, |
SYSLOG_FACILITY_LOCAL2, |
SYSLOG_FACILITY_LOCAL2, |
SYSLOG_FACILITY_LOCAL3, |
SYSLOG_FACILITY_LOCAL3, |
SYSLOG_FACILITY_LOCAL4, |
SYSLOG_FACILITY_LOCAL4, |
SYSLOG_FACILITY_LOCAL5, |
SYSLOG_FACILITY_LOCAL5, |
SYSLOG_FACILITY_LOCAL6, |
SYSLOG_FACILITY_LOCAL6, |
SYSLOG_FACILITY_LOCAL7 |
SYSLOG_FACILITY_LOCAL7 |
} SyslogFacility; |
} SyslogFacility; |
|
|
|
typedef enum |
typedef enum { |
{ |
SYSLOG_LEVEL_QUIET, |
SYSLOG_LEVEL_QUIET, |
SYSLOG_LEVEL_FATAL, |
SYSLOG_LEVEL_FATAL, |
SYSLOG_LEVEL_ERROR, |
SYSLOG_LEVEL_ERROR, |
SYSLOG_LEVEL_INFO, |
SYSLOG_LEVEL_INFO, |
SYSLOG_LEVEL_VERBOSE, |
SYSLOG_LEVEL_VERBOSE, |
SYSLOG_LEVEL_DEBUG |
SYSLOG_LEVEL_DEBUG |
} LogLevel; |
} LogLevel; |
|
|
|
/* Initializes logging. */ |
/* Initializes logging. */ |
void log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr); |
void log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr); |
|
|
/* Logging implementation, depending on server or client */ |
/* Logging implementation, depending on server or client */ |
void do_log(LogLevel level, const char *fmt, va_list args); |
void do_log(LogLevel level, const char *fmt, va_list args); |
|
|
/* name to facility/level */ |
/* name to facility/level */ |
SyslogFacility log_facility_number(char *name); |
SyslogFacility log_facility_number(char *name); |
LogLevel log_level_number(char *name); |
LogLevel log_level_number(char *name); |
|
|
/* Output a message to syslog or stderr */ |
/* Output a message to syslog or stderr */ |
void fatal(const char *fmt, ...) __attribute__ ((format (printf, 1, 2))); |
void fatal(const char *fmt,...) __attribute__((format(printf, 1, 2))); |
void error(const char *fmt, ...) __attribute__ ((format (printf, 1, 2))); |
void error(const char *fmt,...) __attribute__((format(printf, 1, 2))); |
void log(const char *fmt, ...) __attribute__ ((format (printf, 1, 2))); |
void log(const char *fmt,...) __attribute__((format(printf, 1, 2))); |
void verbose(const char *fmt, ...) __attribute__ ((format (printf, 1, 2))); |
void verbose(const char *fmt,...) __attribute__((format(printf, 1, 2))); |
void debug(const char *fmt, ...) __attribute__ ((format (printf, 1, 2))); |
void debug(const char *fmt,...) __attribute__((format(printf, 1, 2))); |
|
|
/* same as fatal() but w/o logging */ |
/* same as fatal() but w/o logging */ |
void fatal_cleanup(void); |
void fatal_cleanup(void); |
|
|
/* Registers a cleanup function to be called by fatal()/fatal_cleanup() before exiting. |
/* Registers a cleanup function to be called by fatal()/fatal_cleanup() before exiting. |
It is permissible to call fatal_remove_cleanup for the function itself |
It is permissible to call fatal_remove_cleanup for the function itself |
from the function. */ |
from the function. */ |
void fatal_add_cleanup(void (*proc)(void *context), void *context); |
void fatal_add_cleanup(void (*proc) (void *context), void *context); |
|
|
/* Removes a cleanup function to be called at fatal(). */ |
/* Removes a cleanup function to be called at fatal(). */ |
void fatal_remove_cleanup(void (*proc)(void *context), void *context); |
void fatal_remove_cleanup(void (*proc) (void *context), void *context); |
|
|
/*---------------- definitions for channels ------------------*/ |
/*---------------- definitions for channels ------------------*/ |
|
|
/* Sets specific protocol options. */ |
/* Sets specific protocol options. */ |
void channel_set_options(int hostname_in_open); |
void channel_set_options(int hostname_in_open); |
|
|
/* Allocate a new channel object and set its type and socket. Remote_name |
/* Allocate a new channel object and set its type and socket. Remote_name |
must have been allocated with xmalloc; this will free it when the channel |
must have been allocated with xmalloc; this will free it when the channel |
is freed. */ |
is freed. */ |
int channel_allocate(int type, int sock, char *remote_name); |
int channel_allocate(int type, int sock, char *remote_name); |
|
|
/* Free the channel and close its socket. */ |
/* Free the channel and close its socket. */ |
void channel_free(int channel); |
void channel_free(int channel); |
|
|
/* Add any bits relevant to channels in select bitmasks. */ |
/* Add any bits relevant to channels in select bitmasks. */ |
void channel_prepare_select(fd_set *readset, fd_set *writeset); |
void channel_prepare_select(fd_set * readset, fd_set * writeset); |
|
|
/* After select, perform any appropriate operations for channels which |
/* After select, perform any appropriate operations for channels which |
have events pending. */ |
have events pending. */ |
void channel_after_select(fd_set *readset, fd_set *writeset); |
void channel_after_select(fd_set * readset, fd_set * writeset); |
|
|
/* If there is data to send to the connection, send some of it now. */ |
/* If there is data to send to the connection, send some of it now. */ |
void channel_output_poll(void); |
void channel_output_poll(void); |
|
|
/* This is called when a packet of type CHANNEL_DATA has just been received. |
/* This is called when a packet of type CHANNEL_DATA has just been received. |
The message type has already been consumed, but channel number and data |
The message type has already been consumed, but channel number and data |
is still there. */ |
is still there. */ |
void channel_input_data(int payload_len); |
void channel_input_data(int payload_len); |
|
|
/* Returns true if no channel has too much buffered data. */ |
/* Returns true if no channel has too much buffered data. */ |
int channel_not_very_much_buffered_data(void); |
int channel_not_very_much_buffered_data(void); |
|
|
/* This is called after receiving CHANNEL_CLOSE. */ |
/* This is called after receiving CHANNEL_CLOSE. */ |
void channel_input_close(void); |
void channel_input_close(void); |
|
|
/* This is called after receiving CHANNEL_CLOSE_CONFIRMATION. */ |
/* This is called after receiving CHANNEL_CLOSE_CONFIRMATION. */ |
void channel_input_close_confirmation(void); |
void channel_input_close_confirmation(void); |
|
|
/* This is called after receiving CHANNEL_OPEN_CONFIRMATION. */ |
/* This is called after receiving CHANNEL_OPEN_CONFIRMATION. */ |
void channel_input_open_confirmation(void); |
void channel_input_open_confirmation(void); |
|
|
/* This is called after receiving CHANNEL_OPEN_FAILURE from the other side. */ |
/* This is called after receiving CHANNEL_OPEN_FAILURE from the other side. */ |
void channel_input_open_failure(void); |
void channel_input_open_failure(void); |
|
|
/* This closes any sockets that are listening for connections; this removes |
/* This closes any sockets that are listening for connections; this removes |
any unix domain sockets. */ |
any unix domain sockets. */ |
void channel_stop_listening(void); |
void channel_stop_listening(void); |
|
|
/* Closes the sockets of all channels. This is used to close extra file |
/* Closes the sockets of all channels. This is used to close extra file |
descriptors after a fork. */ |
descriptors after a fork. */ |
void channel_close_all(void); |
void channel_close_all(void); |
|
|
/* Returns the maximum file descriptor number used by the channels. */ |
/* Returns the maximum file descriptor number used by the channels. */ |
int channel_max_fd(void); |
int channel_max_fd(void); |
|
|
/* Returns true if there is still an open channel over the connection. */ |
/* Returns true if there is still an open channel over the connection. */ |
int channel_still_open(void); |
int channel_still_open(void); |
|
|
/* Returns a string containing a list of all open channels. The list is |
/* Returns a string containing a list of all open channels. The list is |
suitable for displaying to the user. It uses crlf instead of newlines. |
suitable for displaying to the user. It uses crlf instead of newlines. |
The caller should free the string with xfree. */ |
The caller should free the string with xfree. */ |
char *channel_open_message(void); |
char *channel_open_message(void); |
|
|
/* Initiate forwarding of connections to local port "port" through the secure |
/* Initiate forwarding of connections to local port "port" through the secure |
channel to host:port from remote side. This never returns if there |
channel to host:port from remote side. This never returns if there |
was an error. */ |
was an error. */ |
void channel_request_local_forwarding(int port, const char *host, |
void |
int remote_port); |
channel_request_local_forwarding(int port, const char *host, |
|
int remote_port); |
|
|
/* Initiate forwarding of connections to port "port" on remote host through |
/* Initiate forwarding of connections to port "port" on remote host through |
the secure channel to host:port from local side. This never returns |
the secure channel to host:port from local side. This never returns |
if there was an error. This registers that open requests for that |
if there was an error. This registers that open requests for that |
port are permitted. */ |
port are permitted. */ |
void channel_request_remote_forwarding(int port, const char *host, |
void |
int remote_port); |
channel_request_remote_forwarding(int port, const char *host, |
|
int remote_port); |
|
|
/* Permits opening to any host/port in SSH_MSG_PORT_OPEN. This is usually |
/* Permits opening to any host/port in SSH_MSG_PORT_OPEN. This is usually |
called by the server, because the user could connect to any port anyway, |
called by the server, because the user could connect to any port anyway, |
and the server has no way to know but to trust the client anyway. */ |
and the server has no way to know but to trust the client anyway. */ |
void channel_permit_all_opens(void); |
void channel_permit_all_opens(void); |
|
|
/* This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates |
/* This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates |
listening for the port, and sends back a success reply (or disconnect |
listening for the port, and sends back a success reply (or disconnect |
message if there was an error). This never returns if there was an |
message if there was an error). This never returns if there was an |
error. */ |
error. */ |
void channel_input_port_forward_request(int is_root); |
void channel_input_port_forward_request(int is_root); |
|
|
/* This is called after receiving PORT_OPEN message. This attempts to connect |
/* This is called after receiving PORT_OPEN message. This attempts to connect |
to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION or |
to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION or |
CHANNEL_OPEN_FAILURE. */ |
CHANNEL_OPEN_FAILURE. */ |
void channel_input_port_open(int payload_len); |
void channel_input_port_open(int payload_len); |
|
|
/* Creates a port for X11 connections, and starts listening for it. |
/* Creates a port for X11 connections, and starts listening for it. |
Returns the display name, or NULL if an error was encountered. */ |
Returns the display name, or NULL if an error was encountered. */ |
char *x11_create_display(int screen); |
char *x11_create_display(int screen); |
|
|
/* Creates an internet domain socket for listening for X11 connections. |
/* Creates an internet domain socket for listening for X11 connections. |
Returns a suitable value for the DISPLAY variable, or NULL if an error |
Returns a suitable value for the DISPLAY variable, or NULL if an error |
occurs. */ |
occurs. */ |
char *x11_create_display_inet(int screen); |
char *x11_create_display_inet(int screen); |
|
|
/* This is called when SSH_SMSG_X11_OPEN is received. The packet contains |
/* This is called when SSH_SMSG_X11_OPEN is received. The packet contains |
the remote channel number. We should do whatever we want, and respond |
the remote channel number. We should do whatever we want, and respond |
with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE. */ |
with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE. */ |
void x11_input_open(int payload_len); |
void x11_input_open(int payload_len); |
|
|
/* Requests forwarding of X11 connections. This should be called on the |
/* Requests forwarding of X11 connections. This should be called on the |
client only. */ |
client only. */ |
void x11_request_forwarding(void); |
void x11_request_forwarding(void); |
|
|
/* Requests forwarding for X11 connections, with authentication spoofing. |
/* Requests forwarding for X11 connections, with authentication spoofing. |
This should be called in the client only. */ |
This should be called in the client only. */ |
void x11_request_forwarding_with_spoofing(const char *proto, const char *data); |
void x11_request_forwarding_with_spoofing(const char *proto, const char *data); |
|
|
/* Sends a message to the server to request authentication fd forwarding. */ |
/* Sends a message to the server to request authentication fd forwarding. */ |
void auth_request_forwarding(void); |
void auth_request_forwarding(void); |
|
|
/* Returns the name of the forwarded authentication socket. Returns NULL |
/* Returns the name of the forwarded authentication socket. Returns NULL |
if there is no forwarded authentication socket. The returned value points |
if there is no forwarded authentication socket. The returned value points |
to a static buffer. */ |
to a static buffer. */ |
char *auth_get_socket_name(void); |
char *auth_get_socket_name(void); |
|
|
/* This if called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server. |
/* This if called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server. |
This starts forwarding authentication requests. */ |
This starts forwarding authentication requests. */ |
void auth_input_request_forwarding(struct passwd *pw); |
void auth_input_request_forwarding(struct passwd * pw); |
|
|
/* This is called to process an SSH_SMSG_AGENT_OPEN message. */ |
/* This is called to process an SSH_SMSG_AGENT_OPEN message. */ |
void auth_input_open_request(void); |
void auth_input_open_request(void); |
|
|
/* Returns true if the given string matches the pattern (which may contain |
/* Returns true if the given string matches the pattern (which may contain |
? and * as wildcards), and zero if it does not match. */ |
? and * as wildcards), and zero if it does not match. */ |
int match_pattern(const char *s, const char *pattern); |
int match_pattern(const char *s, const char *pattern); |
|
|
/* Expands tildes in the file name. Returns data allocated by xmalloc. |
/* Expands tildes in the file name. Returns data allocated by xmalloc. |
Warning: this calls getpw*. */ |
Warning: this calls getpw*. */ |
char *tilde_expand_filename(const char *filename, uid_t my_uid); |
char *tilde_expand_filename(const char *filename, uid_t my_uid); |
|
|
/* Performs the interactive session. This handles data transmission between |
/* Performs the interactive session. This handles data transmission between |
the client and the program. Note that the notion of stdin, stdout, and |
the client and the program. Note that the notion of stdin, stdout, and |
stderr in this function is sort of reversed: this function writes to |
stderr in this function is sort of reversed: this function writes to |
stdin (of the child program), and reads from stdout and stderr (of the |
stdin (of the child program), and reads from stdout and stderr (of the |
child program). */ |
child program). */ |
void server_loop(int pid, int fdin, int fdout, int fderr); |
void server_loop(int pid, int fdin, int fdout, int fderr); |
|
|
/* Client side main loop for the interactive session. */ |
/* Client side main loop for the interactive session. */ |
int client_loop(int have_pty, int escape_char); |
int client_loop(int have_pty, int escape_char); |
|
|
/* Linked list of custom environment strings (see auth-rsa.c). */ |
/* Linked list of custom environment strings (see auth-rsa.c). */ |
struct envstring { |
struct envstring { |
struct envstring *next; |
struct envstring *next; |
char *s; |
char *s; |
}; |
}; |
|
|
#ifdef KRB4 |
#ifdef KRB4 |
#include <krb.h> |
#include <krb.h> |
|
|
/* Performs Kerberos v4 mutual authentication with the client. This returns |
/* Performs Kerberos v4 mutual authentication with the client. This returns |
0 if the client could not be authenticated, and 1 if authentication was |
0 if the client could not be authenticated, and 1 if authentication was |
successful. This may exit if there is a serious protocol violation. */ |
successful. This may exit if there is a serious protocol violation. */ |
int auth_krb4(const char *server_user, KTEXT auth, char **client); |
int auth_krb4(const char *server_user, KTEXT auth, char **client); |
int krb4_init(uid_t uid); |
int krb4_init(uid_t uid); |
void krb4_cleanup_proc(void *ignore); |
void krb4_cleanup_proc(void *ignore); |
|
|
#ifdef AFS |
#ifdef AFS |
#include <kafs.h> |
#include <kafs.h> |
|
|
/* Accept passed Kerberos v4 ticket-granting ticket and AFS tokens. */ |
/* Accept passed Kerberos v4 ticket-granting ticket and AFS tokens. */ |
int auth_kerberos_tgt(struct passwd *pw, const char *string); |
int auth_kerberos_tgt(struct passwd * pw, const char *string); |
int auth_afs_token(struct passwd *pw, const char *token_string); |
int auth_afs_token(struct passwd * pw, const char *token_string); |
|
|
int creds_to_radix(CREDENTIALS *creds, unsigned char *buf); |
int creds_to_radix(CREDENTIALS * creds, unsigned char *buf); |
int radix_to_creds(const char *buf, CREDENTIALS *creds); |
int radix_to_creds(const char *buf, CREDENTIALS * creds); |
#endif /* AFS */ |
#endif /* AFS */ |
|
|
#endif /* KRB4 */ |
#endif /* KRB4 */ |
|
|
#ifdef SKEY |
#ifdef SKEY |
#include <skey.h> |
#include <skey.h> |
char *skey_fake_keyinfo(char *username); |
char *skey_fake_keyinfo(char *username); |
#endif /* SKEY */ |
#endif /* SKEY */ |
|
|
#endif /* SSH_H */ |
#endif /* SSH_H */ |