2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * This file contains functions for generic socket connection forwarding.
6 * There is also code for initiating connection forwarding for X11 connections,
7 * arbitrary tcp/ip connections, and the authentication agent connection.
9 * As far as I am concerned, the code I have written for this software
10 * can be used freely for any purpose. Any derived versions of this
11 * software must be clearly marked as such, and if the derived work is
12 * incompatible with the protocol description in the RFC file, it must be
13 * called by a name other than "ssh" or "Secure Shell".
16 * SSH2 support added by Markus Friedl.
17 * Copyright (c) 1999,2000 Markus Friedl. All rights reserved.
18 * Copyright (c) 1999 Dug Song. All rights reserved.
19 * Copyright (c) 1999 Theo de Raadt. All rights reserved.
21 * Redistribution and use in source and binary forms, with or without
22 * modification, are permitted provided that the following conditions
24 * 1. Redistributions of source code must retain the above copyright
25 * notice, this list of conditions and the following disclaimer.
26 * 2. Redistributions in binary form must reproduce the above copyright
27 * notice, this list of conditions and the following disclaimer in the
28 * documentation and/or other materials provided with the distribution.
30 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
32 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
33 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
34 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
35 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
39 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
43 RCSID("$OpenBSD: channels.c,v 1.98 2001/03/04 17:42:28 millert Exp $");
45 #include <openssl/rsa.h>
46 #include <openssl/dsa.h>
64 /* Maximum number of fake X11 displays to try. */
65 #define MAX_DISPLAYS 1000
67 /* Max len of agent socket */
68 #define MAX_SOCKET_NAME 100
71 * Pointer to an array containing all allocated channels. The array is
72 * dynamically extended as needed.
74 static Channel *channels = NULL;
77 * Size of the channel array. All slots of the array must always be
78 * initialized (at least the type field); unused slots are marked with type
81 static int channels_alloc = 0;
84 * Maximum file descriptor value used in any of the channels. This is
85 * updated in channel_allocate.
87 static int channel_max_fd = 0;
89 /* Name and directory of socket for authentication agent forwarding. */
90 static char *channel_forwarded_auth_socket_name = NULL;
91 static char *channel_forwarded_auth_socket_dir = NULL;
93 /* Saved X11 authentication protocol name. */
94 char *x11_saved_proto = NULL;
96 /* Saved X11 authentication data. This is the real data. */
97 char *x11_saved_data = NULL;
98 u_int x11_saved_data_len = 0;
101 * Fake X11 authentication data. This is what the server will be sending us;
102 * we should replace any occurrences of this by the real data.
104 char *x11_fake_data = NULL;
105 u_int x11_fake_data_len;
108 * Data structure for storing which hosts are permitted for forward requests.
109 * The local sides of any remote forwards are stored in this array to prevent
110 * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
111 * network (which might be behind a firewall).
114 char *host_to_connect; /* Connect to 'host'. */
115 u_short port_to_connect; /* Connect to 'port'. */
116 u_short listen_port; /* Remote side should listen port number. */
119 /* List of all permitted host/port pairs to connect. */
120 static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
121 /* Number of permitted host/port pairs in the array. */
122 static int num_permitted_opens = 0;
124 * If this is true, all opens are permitted. This is the case on the server
125 * on which we have to trust the client anyway, and the user could do
126 * anything after logging in anyway.
128 static int all_opens_permitted = 0;
130 /* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
131 static int have_hostname_in_open = 0;
133 /* AF_UNSPEC or AF_INET or AF_INET6 */
136 /* Sets specific protocol options. */
139 channel_set_options(int hostname_in_open)
141 have_hostname_in_open = hostname_in_open;
145 * Permits opening to any host/port in SSH_MSG_PORT_OPEN. This is usually
146 * called by the server, because the user could connect to any port anyway,
147 * and the server has no way to know but to trust the client anyway.
151 channel_permit_all_opens()
153 all_opens_permitted = 1;
156 /* lookup channel by id */
159 channel_lookup(int id)
162 if (id < 0 || id > channels_alloc) {
163 log("channel_lookup: %d: bad id", id);
167 if (c->type == SSH_CHANNEL_FREE) {
168 log("channel_lookup: %d: bad id: channel free", id);
175 * Register filedescriptors for a channel, used when allocating a channel or
176 * when the channel consumer/producer is ready, e.g. shell exec'd
180 channel_register_fds(Channel *c, int rfd, int wfd, int efd,
181 int extusage, int nonblock)
183 /* Update the maximum file descriptor value. */
184 channel_max_fd = MAX(channel_max_fd, rfd);
185 channel_max_fd = MAX(channel_max_fd, wfd);
186 channel_max_fd = MAX(channel_max_fd, efd);
188 /* XXX set close-on-exec -markus */
192 c->sock = (rfd == wfd) ? rfd : -1;
194 c->extended_usage = extusage;
196 /* XXX ugly hack: nonblock is only set by the server */
197 if (nonblock && isatty(c->rfd)) {
198 debug("channel %d: rfd %d isatty", c->self, c->rfd);
200 if (!isatty(c->wfd)) {
201 error("channel %d: wfd %d is not a tty?",
208 /* enable nonblocking mode */
220 * Allocate a new channel object and set its type and socket. This will cause
221 * remote_name to be freed.
225 channel_new(char *ctype, int type, int rfd, int wfd, int efd,
226 int window, int maxpack, int extusage, char *remote_name, int nonblock)
231 /* Do initial allocation if this is the first call. */
232 if (channels_alloc == 0) {
235 channels = xmalloc(channels_alloc * sizeof(Channel));
236 for (i = 0; i < channels_alloc; i++)
237 channels[i].type = SSH_CHANNEL_FREE;
239 * Kludge: arrange a call to channel_stop_listening if we
240 * terminate with fatal().
242 fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
244 /* Try to find a free slot where to put the new channel. */
245 for (found = -1, i = 0; i < channels_alloc; i++)
246 if (channels[i].type == SSH_CHANNEL_FREE) {
247 /* Found a free slot. */
252 /* There are no free slots. Take last+1 slot and expand the array. */
253 found = channels_alloc;
254 channels_alloc += 10;
255 debug2("channel: expanding %d", channels_alloc);
256 channels = xrealloc(channels, channels_alloc * sizeof(Channel));
257 for (i = found; i < channels_alloc; i++)
258 channels[i].type = SSH_CHANNEL_FREE;
260 /* Initialize and return new channel number. */
261 c = &channels[found];
262 buffer_init(&c->input);
263 buffer_init(&c->output);
264 buffer_init(&c->extended);
265 chan_init_iostates(c);
266 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
270 c->local_window = window;
271 c->local_window_max = window;
272 c->local_consumed = 0;
273 c->local_maxpacket = maxpack;
275 c->remote_name = remote_name;
276 c->remote_window = 0;
277 c->remote_maxpacket = 0;
281 c->dettach_user = NULL;
282 c->input_filter = NULL;
283 debug("channel %d: new [%s]", found, remote_name);
286 /* old interface XXX */
288 channel_allocate(int type, int sock, char *remote_name)
290 return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1);
294 /* Close all channel fd/socket. */
297 channel_close_fds(Channel *c)
317 /* Free the channel and close its fd/socket. */
322 Channel *c = channel_lookup(id);
323 char *s = channel_open_message();
326 packet_disconnect("channel free: bad local channel %d", id);
327 debug("channel_free: channel %d: status: %s", id, s);
330 if (c->dettach_user != NULL) {
331 debug("channel_free: channel %d: dettaching channel user", id);
332 c->dettach_user(c->self, NULL);
335 shutdown(c->sock, SHUT_RDWR);
336 channel_close_fds(c);
337 buffer_free(&c->input);
338 buffer_free(&c->output);
339 buffer_free(&c->extended);
340 c->type = SSH_CHANNEL_FREE;
341 if (c->remote_name) {
342 xfree(c->remote_name);
343 c->remote_name = NULL;
348 * 'channel_pre*' are called just before select() to add any bits relevant to
349 * channels in the select bitmasks.
352 * 'channel_post*': perform any appropriate operations for channels which
353 * have events pending.
355 typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
356 chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
357 chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
360 channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
362 FD_SET(c->sock, readset);
366 channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset)
368 debug3("channel %d: waiting for connection", c->self);
369 FD_SET(c->sock, writeset);
373 channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
375 if (buffer_len(&c->input) < packet_get_maxsize())
376 FD_SET(c->sock, readset);
377 if (buffer_len(&c->output) > 0)
378 FD_SET(c->sock, writeset);
382 channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
384 /* test whether sockets are 'alive' for read/write */
385 if (c->istate == CHAN_INPUT_OPEN)
386 if (buffer_len(&c->input) < packet_get_maxsize())
387 FD_SET(c->sock, readset);
388 if (c->ostate == CHAN_OUTPUT_OPEN ||
389 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
390 if (buffer_len(&c->output) > 0) {
391 FD_SET(c->sock, writeset);
392 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
399 channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
401 if (c->istate == CHAN_INPUT_OPEN &&
402 c->remote_window > 0 &&
403 buffer_len(&c->input) < c->remote_window)
404 FD_SET(c->rfd, readset);
405 if (c->ostate == CHAN_OUTPUT_OPEN ||
406 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
407 if (buffer_len(&c->output) > 0) {
408 FD_SET(c->wfd, writeset);
409 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
413 /** XXX check close conditions, too */
415 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
416 buffer_len(&c->extended) > 0)
417 FD_SET(c->efd, writeset);
418 else if (c->extended_usage == CHAN_EXTENDED_READ &&
419 buffer_len(&c->extended) < c->remote_window)
420 FD_SET(c->efd, readset);
425 channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
427 if (buffer_len(&c->input) == 0) {
428 packet_start(SSH_MSG_CHANNEL_CLOSE);
429 packet_put_int(c->remote_id);
431 c->type = SSH_CHANNEL_CLOSED;
432 debug("Closing channel %d after input drain.", c->self);
437 channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
439 if (buffer_len(&c->output) == 0)
440 channel_free(c->self);
442 FD_SET(c->sock, writeset);
446 * This is a special state for X11 authentication spoofing. An opened X11
447 * connection (when authentication spoofing is being done) remains in this
448 * state until the first packet has been completely read. The authentication
449 * data in that packet is then substituted by the real data if it matches the
450 * fake data, and the channel is put into normal mode.
451 * XXX All this happens at the client side.
454 x11_open_helper(Channel *c)
457 u_int proto_len, data_len;
459 /* Check if the fixed size part of the packet is in buffer. */
460 if (buffer_len(&c->output) < 12)
463 /* Parse the lengths of variable-length fields. */
464 ucp = (u_char *) buffer_ptr(&c->output);
465 if (ucp[0] == 0x42) { /* Byte order MSB first. */
466 proto_len = 256 * ucp[6] + ucp[7];
467 data_len = 256 * ucp[8] + ucp[9];
468 } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */
469 proto_len = ucp[6] + 256 * ucp[7];
470 data_len = ucp[8] + 256 * ucp[9];
472 debug("Initial X11 packet contains bad byte order byte: 0x%x",
477 /* Check if the whole packet is in buffer. */
478 if (buffer_len(&c->output) <
479 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
482 /* Check if authentication protocol matches. */
483 if (proto_len != strlen(x11_saved_proto) ||
484 memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
485 debug("X11 connection uses different authentication protocol.");
488 /* Check if authentication data matches our fake data. */
489 if (data_len != x11_fake_data_len ||
490 memcmp(ucp + 12 + ((proto_len + 3) & ~3),
491 x11_fake_data, x11_fake_data_len) != 0) {
492 debug("X11 auth data does not match fake data.");
495 /* Check fake data length */
496 if (x11_fake_data_len != x11_saved_data_len) {
497 error("X11 fake_data_len %d != saved_data_len %d",
498 x11_fake_data_len, x11_saved_data_len);
502 * Received authentication protocol and data match
503 * our fake data. Substitute the fake data with real
506 memcpy(ucp + 12 + ((proto_len + 3) & ~3),
507 x11_saved_data, x11_saved_data_len);
512 channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
514 int ret = x11_open_helper(c);
516 /* Start normal processing for the channel. */
517 c->type = SSH_CHANNEL_OPEN;
518 channel_pre_open_13(c, readset, writeset);
519 } else if (ret == -1) {
521 * We have received an X11 connection that has bad
522 * authentication information.
524 log("X11 connection rejected because of wrong authentication.");
525 buffer_clear(&c->input);
526 buffer_clear(&c->output);
529 c->type = SSH_CHANNEL_CLOSED;
530 packet_start(SSH_MSG_CHANNEL_CLOSE);
531 packet_put_int(c->remote_id);
537 channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
539 int ret = x11_open_helper(c);
541 c->type = SSH_CHANNEL_OPEN;
543 channel_pre_open_20(c, readset, writeset);
545 channel_pre_open_15(c, readset, writeset);
546 } else if (ret == -1) {
547 debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
548 chan_read_failed(c); /** force close? */
549 chan_write_failed(c);
550 debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
554 /* This is our fake X11 server socket. */
556 channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
558 struct sockaddr addr;
561 char buf[16384], *remote_ipaddr;
564 if (FD_ISSET(c->sock, readset)) {
565 debug("X11 connection requested.");
566 addrlen = sizeof(addr);
567 newsock = accept(c->sock, &addr, &addrlen);
569 error("accept: %.100s", strerror(errno));
572 remote_ipaddr = get_peer_ipaddr(newsock);
573 remote_port = get_peer_port(newsock);
574 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
575 remote_ipaddr, remote_port);
577 newch = channel_new("x11",
578 SSH_CHANNEL_OPENING, newsock, newsock, -1,
579 c->local_window_max, c->local_maxpacket,
582 packet_start(SSH2_MSG_CHANNEL_OPEN);
583 packet_put_cstring("x11");
584 packet_put_int(newch);
585 packet_put_int(c->local_window_max);
586 packet_put_int(c->local_maxpacket);
587 /* originator ipaddr and port */
588 packet_put_cstring(remote_ipaddr);
589 if (datafellows & SSH_BUG_X11FWD) {
590 debug("ssh2 x11 bug compat mode");
592 packet_put_int(remote_port);
596 packet_start(SSH_SMSG_X11_OPEN);
597 packet_put_int(newch);
598 if (have_hostname_in_open)
599 packet_put_string(buf, strlen(buf));
602 xfree(remote_ipaddr);
607 * This socket is listening for connections to a forwarded TCP/IP port.
610 channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
612 struct sockaddr addr;
615 char buf[1024], *remote_ipaddr, *rtype;
618 rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ?
619 "forwarded-tcpip" : "direct-tcpip";
621 if (FD_ISSET(c->sock, readset)) {
622 debug("Connection to port %d forwarding "
623 "to %.100s port %d requested.",
624 c->listening_port, c->path, c->host_port);
625 addrlen = sizeof(addr);
626 newsock = accept(c->sock, &addr, &addrlen);
628 error("accept: %.100s", strerror(errno));
631 remote_ipaddr = get_peer_ipaddr(newsock);
632 remote_port = get_peer_port(newsock);
633 snprintf(buf, sizeof buf,
634 "listen port %d for %.100s port %d, "
635 "connect from %.200s port %d",
636 c->listening_port, c->path, c->host_port,
637 remote_ipaddr, remote_port);
639 newch = channel_new(rtype,
640 SSH_CHANNEL_OPENING, newsock, newsock, -1,
641 c->local_window_max, c->local_maxpacket,
644 packet_start(SSH2_MSG_CHANNEL_OPEN);
645 packet_put_cstring(rtype);
646 packet_put_int(newch);
647 packet_put_int(c->local_window_max);
648 packet_put_int(c->local_maxpacket);
649 if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
650 /* listen address, port */
651 packet_put_string(c->path, strlen(c->path));
652 packet_put_int(c->listening_port);
654 /* target host, port */
655 packet_put_string(c->path, strlen(c->path));
656 packet_put_int(c->host_port);
658 /* originator host and port */
659 packet_put_cstring(remote_ipaddr);
660 packet_put_int(remote_port);
663 packet_start(SSH_MSG_PORT_OPEN);
664 packet_put_int(newch);
665 packet_put_string(c->path, strlen(c->path));
666 packet_put_int(c->host_port);
667 if (have_hostname_in_open) {
668 packet_put_string(buf, strlen(buf));
672 xfree(remote_ipaddr);
677 * This is the authentication agent socket listening for connections from
681 channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
683 struct sockaddr addr;
687 if (FD_ISSET(c->sock, readset)) {
688 addrlen = sizeof(addr);
689 newsock = accept(c->sock, &addr, &addrlen);
691 error("accept from auth socket: %.100s", strerror(errno));
694 newch = channel_new("accepted auth socket",
695 SSH_CHANNEL_OPENING, newsock, newsock, -1,
696 c->local_window_max, c->local_maxpacket,
697 0, xstrdup("accepted auth socket"), 1);
699 packet_start(SSH2_MSG_CHANNEL_OPEN);
700 packet_put_cstring("auth-agent@openssh.com");
701 packet_put_int(newch);
702 packet_put_int(c->local_window_max);
703 packet_put_int(c->local_maxpacket);
705 packet_start(SSH_SMSG_AGENT_OPEN);
706 packet_put_int(newch);
713 channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
715 if (FD_ISSET(c->sock, writeset)) {
717 int sz = sizeof(err);
718 c->type = SSH_CHANNEL_OPEN;
719 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &sz) < 0) {
720 debug("getsockopt SO_ERROR failed");
723 debug("channel %d: connected)", c->self);
725 debug("channel %d: not connected: %s",
726 c->self, strerror(err));
728 chan_write_failed(c);
735 channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
741 FD_ISSET(c->rfd, readset)) {
742 len = read(c->rfd, buf, sizeof(buf));
743 if (len < 0 && (errno == EINTR || errno == EAGAIN))
746 debug("channel %d: read<=0 rfd %d len %d",
747 c->self, c->rfd, len);
749 buffer_consume(&c->output, buffer_len(&c->output));
750 c->type = SSH_CHANNEL_INPUT_DRAINING;
751 debug("Channel %d status set to input draining.", c->self);
757 if(c->input_filter != NULL) {
758 if (c->input_filter(c, buf, len) == -1) {
759 debug("filter stops channel %d", c->self);
763 buffer_append(&c->input, buf, len);
769 channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
774 /* Send buffered output data to the socket. */
776 FD_ISSET(c->wfd, writeset) &&
777 buffer_len(&c->output) > 0) {
778 len = write(c->wfd, buffer_ptr(&c->output),
779 buffer_len(&c->output));
780 if (len < 0 && (errno == EINTR || errno == EAGAIN))
784 buffer_consume(&c->output, buffer_len(&c->output));
785 debug("Channel %d status set to input draining.", c->self);
786 c->type = SSH_CHANNEL_INPUT_DRAINING;
788 chan_write_failed(c);
792 if (compat20 && c->isatty) {
793 if (tcgetattr(c->wfd, &tio) == 0 &&
794 !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
796 * Simulate echo to reduce the impact of
797 * traffic analysis. We need to match the
798 * size of a SSH2_MSG_CHANNEL_DATA message
799 * (4 byte channel id + data)
801 packet_send_ignore(4 + len);
805 buffer_consume(&c->output, len);
806 if (compat20 && len > 0) {
807 c->local_consumed += len;
813 channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
818 /** XXX handle drain efd, too */
820 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
821 FD_ISSET(c->efd, writeset) &&
822 buffer_len(&c->extended) > 0) {
823 len = write(c->efd, buffer_ptr(&c->extended),
824 buffer_len(&c->extended));
825 debug2("channel %d: written %d to efd %d",
826 c->self, len, c->efd);
827 if (len < 0 && (errno == EINTR || errno == EAGAIN))
830 debug2("channel %d: closing write-efd %d",
835 buffer_consume(&c->extended, len);
836 c->local_consumed += len;
838 } else if (c->extended_usage == CHAN_EXTENDED_READ &&
839 FD_ISSET(c->efd, readset)) {
840 len = read(c->efd, buf, sizeof(buf));
841 debug2("channel %d: read %d from efd %d",
842 c->self, len, c->efd);
843 if (len < 0 && (errno == EINTR || errno == EAGAIN))
846 debug2("channel %d: closing read-efd %d",
851 buffer_append(&c->extended, buf, len);
858 channel_check_window(Channel *c)
860 if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
861 c->local_window < c->local_window_max/2 &&
862 c->local_consumed > 0) {
863 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
864 packet_put_int(c->remote_id);
865 packet_put_int(c->local_consumed);
867 debug2("channel %d: window %d sent adjust %d",
868 c->self, c->local_window,
870 c->local_window += c->local_consumed;
871 c->local_consumed = 0;
877 channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
879 channel_handle_rfd(c, readset, writeset);
880 channel_handle_wfd(c, readset, writeset);
884 channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
886 channel_handle_rfd(c, readset, writeset);
887 channel_handle_wfd(c, readset, writeset);
888 channel_handle_efd(c, readset, writeset);
890 channel_check_window(c);
894 channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
897 /* Send buffered output data to the socket. */
898 if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
899 len = write(c->sock, buffer_ptr(&c->output),
900 buffer_len(&c->output));
902 buffer_consume(&c->output, buffer_len(&c->output));
904 buffer_consume(&c->output, len);
909 channel_handler_init_20(void)
911 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20;
912 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
913 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
914 channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener;
915 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
916 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
917 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
919 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2;
920 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
921 channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener;
922 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
923 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
924 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
928 channel_handler_init_13(void)
930 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13;
931 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13;
932 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
933 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
934 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
935 channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining;
936 channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining;
937 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
939 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
940 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
941 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
942 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
943 channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13;
944 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
948 channel_handler_init_15(void)
950 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15;
951 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
952 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
953 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
954 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
955 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
957 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
958 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
959 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
960 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_1;
961 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
965 channel_handler_init(void)
968 for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
969 channel_pre[i] = NULL;
970 channel_post[i] = NULL;
973 channel_handler_init_20();
975 channel_handler_init_13();
977 channel_handler_init_15();
981 channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
983 static int did_init = 0;
988 channel_handler_init();
991 for (i = 0; i < channels_alloc; i++) {
993 if (c->type == SSH_CHANNEL_FREE)
995 if (ftab[c->type] == NULL)
997 (*ftab[c->type])(c, readset, writeset);
998 if (chan_is_dead(c)) {
1000 * we have to remove the fd's from the select mask
1001 * before the channels are free'd and the fd's are
1005 FD_CLR(c->wfd, writeset);
1007 FD_CLR(c->rfd, readset);
1009 if (c->extended_usage == CHAN_EXTENDED_READ)
1010 FD_CLR(c->efd, readset);
1011 if (c->extended_usage == CHAN_EXTENDED_WRITE)
1012 FD_CLR(c->efd, writeset);
1014 channel_free(c->self);
1020 channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp)
1025 n = MAX(*maxfdp, channel_max_fd);
1027 sz = howmany(n+1, NFDBITS) * sizeof(fd_mask);
1028 if (*readsetp == NULL || n > *maxfdp) {
1033 *readsetp = xmalloc(sz);
1034 *writesetp = xmalloc(sz);
1037 memset(*readsetp, 0, sz);
1038 memset(*writesetp, 0, sz);
1040 channel_handler(channel_pre, *readsetp, *writesetp);
1044 channel_after_select(fd_set * readset, fd_set * writeset)
1046 channel_handler(channel_post, readset, writeset);
1049 /* If there is data to send to the connection, enqueue some of it now. */
1052 channel_output_poll()
1057 for (i = 0; i < channels_alloc; i++) {
1060 /* We are only interested in channels that can have buffered incoming data. */
1062 if (c->type != SSH_CHANNEL_OPEN &&
1063 c->type != SSH_CHANNEL_INPUT_DRAINING)
1066 if (c->type != SSH_CHANNEL_OPEN)
1070 (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
1071 /* XXX is this true? */
1072 debug2("channel %d: no data after CLOSE", c->self);
1076 /* Get the amount of buffered data for this channel. */
1077 if ((c->istate == CHAN_INPUT_OPEN ||
1078 c->istate == CHAN_INPUT_WAIT_DRAIN) &&
1079 (len = buffer_len(&c->input)) > 0) {
1080 /* Send some data for the other side over the secure connection. */
1082 if (len > c->remote_window)
1083 len = c->remote_window;
1084 if (len > c->remote_maxpacket)
1085 len = c->remote_maxpacket;
1087 if (packet_is_interactive()) {
1091 /* Keep the packets at reasonable size. */
1092 if (len > packet_get_maxsize()/2)
1093 len = packet_get_maxsize()/2;
1097 packet_start(compat20 ?
1098 SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
1099 packet_put_int(c->remote_id);
1100 packet_put_string(buffer_ptr(&c->input), len);
1102 buffer_consume(&c->input, len);
1103 c->remote_window -= len;
1105 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
1107 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
1109 * input-buffer is empty and read-socket shutdown:
1110 * tell peer, that we will not send more data: send IEOF
1114 /* Send extended data, i.e. stderr */
1116 c->remote_window > 0 &&
1117 (len = buffer_len(&c->extended)) > 0 &&
1118 c->extended_usage == CHAN_EXTENDED_READ) {
1119 debug2("channel %d: rwin %d elen %d euse %d",
1120 c->self, c->remote_window, buffer_len(&c->extended),
1122 if (len > c->remote_window)
1123 len = c->remote_window;
1124 if (len > c->remote_maxpacket)
1125 len = c->remote_maxpacket;
1126 packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
1127 packet_put_int(c->remote_id);
1128 packet_put_int(SSH2_EXTENDED_DATA_STDERR);
1129 packet_put_string(buffer_ptr(&c->extended), len);
1131 buffer_consume(&c->extended, len);
1132 c->remote_window -= len;
1133 debug2("channel %d: sent ext data %d", c->self, len);
1139 * This is called when a packet of type CHANNEL_DATA has just been received.
1140 * The message type has already been consumed, but channel number and data is
1145 channel_input_data(int type, int plen, void *ctxt)
1152 /* Get the channel number and verify it. */
1153 id = packet_get_int();
1154 c = channel_lookup(id);
1156 packet_disconnect("Received data for nonexistent channel %d.", id);
1158 /* Ignore any data for non-open channels (might happen on close) */
1159 if (c->type != SSH_CHANNEL_OPEN &&
1160 c->type != SSH_CHANNEL_X11_OPEN)
1163 /* same for protocol 1.5 if output end is no longer open */
1164 if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
1168 data = packet_get_string(&data_len);
1172 if (data_len > c->local_maxpacket) {
1173 log("channel %d: rcvd big packet %d, maxpack %d",
1174 c->self, data_len, c->local_maxpacket);
1176 if (data_len > c->local_window) {
1177 log("channel %d: rcvd too much data %d, win %d",
1178 c->self, data_len, c->local_window);
1182 c->local_window -= data_len;
1184 packet_integrity_check(plen, 4 + 4 + data_len, type);
1186 buffer_append(&c->output, data, data_len);
1190 channel_input_extended_data(int type, int plen, void *ctxt)
1198 /* Get the channel number and verify it. */
1199 id = packet_get_int();
1200 c = channel_lookup(id);
1203 packet_disconnect("Received extended_data for bad channel %d.", id);
1204 if (c->type != SSH_CHANNEL_OPEN) {
1205 log("channel %d: ext data for non open", id);
1208 tcode = packet_get_int();
1210 c->extended_usage != CHAN_EXTENDED_WRITE ||
1211 tcode != SSH2_EXTENDED_DATA_STDERR) {
1212 log("channel %d: bad ext data", c->self);
1215 data = packet_get_string(&data_len);
1217 if (data_len > c->local_window) {
1218 log("channel %d: rcvd too much extended_data %d, win %d",
1219 c->self, data_len, c->local_window);
1223 debug2("channel %d: rcvd ext data %d", c->self, data_len);
1224 c->local_window -= data_len;
1225 buffer_append(&c->extended, data, data_len);
1231 * Returns true if no channel has too much buffered data, and false if one or
1232 * more channel is overfull.
1236 channel_not_very_much_buffered_data()
1241 for (i = 0; i < channels_alloc; i++) {
1243 if (c->type == SSH_CHANNEL_OPEN) {
1244 if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
1245 debug("channel %d: big input buffer %d",
1246 c->self, buffer_len(&c->input));
1249 if (buffer_len(&c->output) > packet_get_maxsize()) {
1250 debug("channel %d: big output buffer %d",
1251 c->self, buffer_len(&c->output));
1260 channel_input_ieof(int type, int plen, void *ctxt)
1265 packet_integrity_check(plen, 4, type);
1267 id = packet_get_int();
1268 c = channel_lookup(id);
1270 packet_disconnect("Received ieof for nonexistent channel %d.", id);
1275 channel_input_close(int type, int plen, void *ctxt)
1280 packet_integrity_check(plen, 4, type);
1282 id = packet_get_int();
1283 c = channel_lookup(id);
1285 packet_disconnect("Received close for nonexistent channel %d.", id);
1288 * Send a confirmation that we have closed the channel and no more
1289 * data is coming for it.
1291 packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
1292 packet_put_int(c->remote_id);
1296 * If the channel is in closed state, we have sent a close request,
1297 * and the other side will eventually respond with a confirmation.
1298 * Thus, we cannot free the channel here, because then there would be
1299 * no-one to receive the confirmation. The channel gets freed when
1300 * the confirmation arrives.
1302 if (c->type != SSH_CHANNEL_CLOSED) {
1304 * Not a closed channel - mark it as draining, which will
1305 * cause it to be freed later.
1307 buffer_consume(&c->input, buffer_len(&c->input));
1308 c->type = SSH_CHANNEL_OUTPUT_DRAINING;
1312 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
1314 channel_input_oclose(int type, int plen, void *ctxt)
1316 int id = packet_get_int();
1317 Channel *c = channel_lookup(id);
1318 packet_integrity_check(plen, 4, type);
1320 packet_disconnect("Received oclose for nonexistent channel %d.", id);
1321 chan_rcvd_oclose(c);
1325 channel_input_close_confirmation(int type, int plen, void *ctxt)
1327 int id = packet_get_int();
1328 Channel *c = channel_lookup(id);
1332 packet_disconnect("Received close confirmation for "
1333 "out-of-range channel %d.", id);
1334 if (c->type != SSH_CHANNEL_CLOSED)
1335 packet_disconnect("Received close confirmation for "
1336 "non-closed channel %d (type %d).", id, c->type);
1337 channel_free(c->self);
1341 channel_input_open_confirmation(int type, int plen, void *ctxt)
1347 packet_integrity_check(plen, 4 + 4, type);
1349 id = packet_get_int();
1350 c = channel_lookup(id);
1352 if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1353 packet_disconnect("Received open confirmation for "
1354 "non-opening channel %d.", id);
1355 remote_id = packet_get_int();
1356 /* Record the remote channel number and mark that the channel is now open. */
1357 c->remote_id = remote_id;
1358 c->type = SSH_CHANNEL_OPEN;
1361 c->remote_window = packet_get_int();
1362 c->remote_maxpacket = packet_get_int();
1364 if (c->cb_fn != NULL && c->cb_event == type) {
1365 debug2("callback start");
1366 c->cb_fn(c->self, c->cb_arg);
1367 debug2("callback done");
1369 debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1370 c->remote_window, c->remote_maxpacket);
1375 channel_input_open_failure(int type, int plen, void *ctxt)
1378 char *msg = NULL, *lang = NULL;
1382 packet_integrity_check(plen, 4, type);
1384 id = packet_get_int();
1385 c = channel_lookup(id);
1387 if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1388 packet_disconnect("Received open failure for "
1389 "non-opening channel %d.", id);
1391 reason = packet_get_int();
1392 if (packet_remaining() > 0) {
1393 msg = packet_get_string(NULL);
1394 lang = packet_get_string(NULL);
1397 log("channel_open_failure: %d: reason %d %s", id,
1398 reason, msg ? msg : "<no additional info>");
1404 /* Free the channel. This will also close the socket. */
1409 channel_input_channel_request(int type, int plen, void *ctxt)
1414 id = packet_get_int();
1415 c = channel_lookup(id);
1418 (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1419 packet_disconnect("Received request for "
1420 "non-open channel %d.", id);
1421 if (c->cb_fn != NULL && c->cb_event == type) {
1422 debug2("callback start");
1423 c->cb_fn(c->self, c->cb_arg);
1424 debug2("callback done");
1426 char *service = packet_get_string(NULL);
1427 debug("channel %d: rcvd request for %s", c->self, service);
1428 debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
1434 channel_input_window_adjust(int type, int plen, void *ctxt)
1442 /* Get the channel number and verify it. */
1443 id = packet_get_int();
1444 c = channel_lookup(id);
1446 if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1447 log("Received window adjust for "
1448 "non-open channel %d.", id);
1451 adjust = packet_get_int();
1453 debug2("channel %d: rcvd adjust %d", id, adjust);
1454 c->remote_window += adjust;
1458 * Stops listening for channels, and removes any unix domain sockets that we
1463 channel_stop_listening()
1466 for (i = 0; i < channels_alloc; i++) {
1467 switch (channels[i].type) {
1468 case SSH_CHANNEL_AUTH_SOCKET:
1469 close(channels[i].sock);
1470 unlink(channels[i].path);
1473 case SSH_CHANNEL_PORT_LISTENER:
1474 case SSH_CHANNEL_RPORT_LISTENER:
1475 case SSH_CHANNEL_X11_LISTENER:
1476 close(channels[i].sock);
1486 * Closes the sockets/fds of all channels. This is used to close extra file
1487 * descriptors after a fork.
1494 for (i = 0; i < channels_alloc; i++)
1495 if (channels[i].type != SSH_CHANNEL_FREE)
1496 channel_close_fds(&channels[i]);
1499 /* Returns true if any channel is still open. */
1502 channel_still_open()
1505 for (i = 0; i < channels_alloc; i++)
1506 switch (channels[i].type) {
1507 case SSH_CHANNEL_FREE:
1508 case SSH_CHANNEL_X11_LISTENER:
1509 case SSH_CHANNEL_PORT_LISTENER:
1510 case SSH_CHANNEL_RPORT_LISTENER:
1511 case SSH_CHANNEL_CLOSED:
1512 case SSH_CHANNEL_AUTH_SOCKET:
1513 case SSH_CHANNEL_CONNECTING: /* XXX ??? */
1515 case SSH_CHANNEL_LARVAL:
1517 fatal("cannot happen: SSH_CHANNEL_LARVAL");
1519 case SSH_CHANNEL_OPENING:
1520 case SSH_CHANNEL_OPEN:
1521 case SSH_CHANNEL_X11_OPEN:
1523 case SSH_CHANNEL_INPUT_DRAINING:
1524 case SSH_CHANNEL_OUTPUT_DRAINING:
1526 fatal("cannot happen: OUT_DRAIN");
1529 fatal("channel_still_open: bad channel type %d", channels[i].type);
1536 * Returns a message describing the currently open forwarded connections,
1537 * suitable for sending to the client. The message contains crlf pairs for
1542 channel_open_message()
1548 buffer_init(&buffer);
1549 snprintf(buf, sizeof buf, "The following connections are open:\r\n");
1550 buffer_append(&buffer, buf, strlen(buf));
1551 for (i = 0; i < channels_alloc; i++) {
1552 Channel *c = &channels[i];
1554 case SSH_CHANNEL_FREE:
1555 case SSH_CHANNEL_X11_LISTENER:
1556 case SSH_CHANNEL_PORT_LISTENER:
1557 case SSH_CHANNEL_RPORT_LISTENER:
1558 case SSH_CHANNEL_CLOSED:
1559 case SSH_CHANNEL_AUTH_SOCKET:
1561 case SSH_CHANNEL_LARVAL:
1562 case SSH_CHANNEL_OPENING:
1563 case SSH_CHANNEL_CONNECTING:
1564 case SSH_CHANNEL_OPEN:
1565 case SSH_CHANNEL_X11_OPEN:
1566 case SSH_CHANNEL_INPUT_DRAINING:
1567 case SSH_CHANNEL_OUTPUT_DRAINING:
1568 snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
1569 c->self, c->remote_name,
1570 c->type, c->remote_id,
1571 c->istate, buffer_len(&c->input),
1572 c->ostate, buffer_len(&c->output),
1574 buffer_append(&buffer, buf, strlen(buf));
1577 fatal("channel_open_message: bad channel type %d", c->type);
1581 buffer_append(&buffer, "\0", 1);
1582 cp = xstrdup(buffer_ptr(&buffer));
1583 buffer_free(&buffer);
1588 * Initiate forwarding of connections to local port "port" through the secure
1589 * channel to host:port from remote side.
1592 channel_request_local_forwarding(u_short listen_port, const char *host_to_connect,
1593 u_short port_to_connect, int gateway_ports)
1595 return channel_request_forwarding(
1597 host_to_connect, port_to_connect,
1598 gateway_ports, /*remote_fwd*/ 0);
1602 * If 'remote_fwd' is true we have a '-R style' listener for protocol 2
1603 * (SSH_CHANNEL_RPORT_LISTENER).
1606 channel_request_forwarding(
1607 const char *listen_address, u_short listen_port,
1608 const char *host_to_connect, u_short port_to_connect,
1609 int gateway_ports, int remote_fwd)
1611 int success, ch, sock, on = 1, ctype;
1612 struct addrinfo hints, *ai, *aitop;
1613 char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1615 struct linger linger;
1620 host = listen_address;
1621 ctype = SSH_CHANNEL_RPORT_LISTENER;
1623 host = host_to_connect;
1624 ctype =SSH_CHANNEL_PORT_LISTENER;
1627 if (strlen(host) > sizeof(channels[0].path) - 1) {
1628 error("Forward host name too long.");
1632 /* XXX listen_address is currently ignored */
1634 * getaddrinfo returns a loopback address if the hostname is
1635 * set to NULL and hints.ai_flags is not AI_PASSIVE
1637 memset(&hints, 0, sizeof(hints));
1638 hints.ai_family = IPv4or6;
1639 hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1640 hints.ai_socktype = SOCK_STREAM;
1641 snprintf(strport, sizeof strport, "%d", listen_port);
1642 if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1643 packet_disconnect("getaddrinfo: fatal error");
1645 for (ai = aitop; ai; ai = ai->ai_next) {
1646 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1648 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1649 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1650 error("channel_request_forwarding: getnameinfo failed");
1653 /* Create a port to listen for the host. */
1654 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1656 /* this is no error since kernel may not support ipv6 */
1657 verbose("socket: %.100s", strerror(errno));
1661 * Set socket options. We would like the socket to disappear
1662 * as soon as it has been closed for whatever reason.
1664 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1666 linger.l_linger = 5;
1667 setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1668 debug("Local forwarding listening on %s port %s.", ntop, strport);
1670 /* Bind the socket to the address. */
1671 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1672 /* address can be in use ipv6 address is already bound */
1674 error("bind: %.100s", strerror(errno));
1676 verbose("bind: %.100s", strerror(errno));
1681 /* Start listening for connections on the socket. */
1682 if (listen(sock, 5) < 0) {
1683 error("listen: %.100s", strerror(errno));
1687 /* Allocate a channel number for the socket. */
1688 ch = channel_new("port listener", ctype, sock, sock, -1,
1689 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1690 0, xstrdup("port listener"), 1);
1691 strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
1692 channels[ch].host_port = port_to_connect;
1693 channels[ch].listening_port = listen_port;
1697 error("channel_request_forwarding: cannot listen to port: %d",
1699 freeaddrinfo(aitop);
1704 * Initiate forwarding of connections to port "port" on remote host through
1705 * the secure channel to host:port from local side.
1709 channel_request_remote_forwarding(u_short listen_port,
1710 const char *host_to_connect, u_short port_to_connect)
1712 int payload_len, type, success = 0;
1714 /* Record locally that connection to this host/port is permitted. */
1715 if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1716 fatal("channel_request_remote_forwarding: too many forwards");
1718 /* Send the forward request to the remote side. */
1720 const char *address_to_bind = "0.0.0.0";
1721 packet_start(SSH2_MSG_GLOBAL_REQUEST);
1722 packet_put_cstring("tcpip-forward");
1723 packet_put_char(0); /* boolean: want reply */
1724 packet_put_cstring(address_to_bind);
1725 packet_put_int(listen_port);
1727 packet_write_wait();
1728 /* Assume that server accepts the request */
1731 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
1732 packet_put_int(listen_port);
1733 packet_put_cstring(host_to_connect);
1734 packet_put_int(port_to_connect);
1736 packet_write_wait();
1738 /* Wait for response from the remote side. */
1739 type = packet_read(&payload_len);
1741 case SSH_SMSG_SUCCESS:
1744 case SSH_SMSG_FAILURE:
1745 log("Warning: Server denied remote port forwarding.");
1748 /* Unknown packet */
1749 packet_disconnect("Protocol error for port forward request:"
1750 "received packet type %d.", type);
1754 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
1755 permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
1756 permitted_opens[num_permitted_opens].listen_port = listen_port;
1757 num_permitted_opens++;
1762 * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
1763 * listening for the port, and sends back a success reply (or disconnect
1764 * message if there was an error). This never returns if there was an error.
1768 channel_input_port_forward_request(int is_root, int gateway_ports)
1770 u_short port, host_port;
1773 /* Get arguments from the packet. */
1774 port = packet_get_int();
1775 hostname = packet_get_string(NULL);
1776 host_port = packet_get_int();
1780 * Check that an unprivileged user is not trying to forward a
1783 if (port < IPPORT_RESERVED && !is_root)
1784 packet_disconnect("Requested forwarding of port %d but user is not root.",
1787 /* Initiate forwarding */
1788 channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
1790 /* Free the argument string. */
1794 /* XXX move to aux.c */
1796 channel_connect_to(const char *host, u_short host_port)
1798 struct addrinfo hints, *ai, *aitop;
1799 char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1803 memset(&hints, 0, sizeof(hints));
1804 hints.ai_family = IPv4or6;
1805 hints.ai_socktype = SOCK_STREAM;
1806 snprintf(strport, sizeof strport, "%d", host_port);
1807 if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1808 error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
1811 for (ai = aitop; ai; ai = ai->ai_next) {
1812 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1814 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1815 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1816 error("channel_connect_to: getnameinfo failed");
1819 /* Create the socket. */
1820 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1822 error("socket: %.100s", strerror(errno));
1825 if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
1826 fatal("connect_to: F_SETFL: %s", strerror(errno));
1827 /* Connect to the host/port. */
1828 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 &&
1829 errno != EINPROGRESS) {
1830 error("connect %.100s port %s: %.100s", ntop, strport,
1833 continue; /* fail -- try next */
1835 break; /* success */
1838 freeaddrinfo(aitop);
1840 error("connect %.100s port %d: failed.", host, host_port);
1847 channel_connect_by_listen_adress(u_short listen_port)
1850 for (i = 0; i < num_permitted_opens; i++)
1851 if (permitted_opens[i].listen_port == listen_port)
1852 return channel_connect_to(
1853 permitted_opens[i].host_to_connect,
1854 permitted_opens[i].port_to_connect);
1855 error("WARNING: Server requests forwarding for unknown listen_port %d",
1861 * This is called after receiving PORT_OPEN message. This attempts to
1862 * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1863 * or CHANNEL_OPEN_FAILURE.
1867 channel_input_port_open(int type, int plen, void *ctxt)
1870 char *host, *originator_string;
1871 int remote_channel, sock = -1, newch, i, denied;
1872 u_int host_len, originator_len;
1874 /* Get remote channel number. */
1875 remote_channel = packet_get_int();
1877 /* Get host name to connect to. */
1878 host = packet_get_string(&host_len);
1880 /* Get port to connect to. */
1881 host_port = packet_get_int();
1883 /* Get remote originator name. */
1884 if (have_hostname_in_open) {
1885 originator_string = packet_get_string(&originator_len);
1886 originator_len += 4; /* size of packet_int */
1888 originator_string = xstrdup("unknown (remote did not supply name)");
1889 originator_len = 0; /* no originator supplied */
1892 packet_integrity_check(plen,
1893 4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
1895 /* Check if opening that port is permitted. */
1897 if (!all_opens_permitted) {
1898 /* Go trough all permitted ports. */
1899 for (i = 0; i < num_permitted_opens; i++)
1900 if (permitted_opens[i].port_to_connect == host_port &&
1901 strcmp(permitted_opens[i].host_to_connect, host) == 0)
1904 /* Check if we found the requested port among those permitted. */
1905 if (i >= num_permitted_opens) {
1906 /* The port is not permitted. */
1907 log("Received request to connect to %.100s:%d, but the request was denied.",
1912 sock = denied ? -1 : channel_connect_to(host, host_port);
1914 /* Allocate a channel for this connection. */
1915 newch = channel_allocate(SSH_CHANNEL_CONNECTING,
1916 sock, originator_string);
1917 /*XXX delay answer? */
1918 channels[newch].remote_id = remote_channel;
1920 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1921 packet_put_int(remote_channel);
1922 packet_put_int(newch);
1925 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1926 packet_put_int(remote_channel);
1933 * Creates an internet domain socket for listening for X11 connections.
1934 * Returns a suitable value for the DISPLAY variable, or NULL if an error
1938 #define NUM_SOCKS 10
1941 x11_create_display_inet(int screen_number, int x11_display_offset)
1943 int display_number, sock;
1945 struct addrinfo hints, *ai, *aitop;
1946 char strport[NI_MAXSERV];
1947 int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1949 char hostname[MAXHOSTNAMELEN];
1951 for (display_number = x11_display_offset;
1952 display_number < MAX_DISPLAYS;
1954 port = 6000 + display_number;
1955 memset(&hints, 0, sizeof(hints));
1956 hints.ai_family = IPv4or6;
1957 hints.ai_flags = AI_PASSIVE; /* XXX loopback only ? */
1958 hints.ai_socktype = SOCK_STREAM;
1959 snprintf(strport, sizeof strport, "%d", port);
1960 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1961 error("getaddrinfo: %.100s", gai_strerror(gaierr));
1964 for (ai = aitop; ai; ai = ai->ai_next) {
1965 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1967 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1969 if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) {
1970 error("socket: %.100s", strerror(errno));
1973 debug("x11_create_display_inet: Socket family %d not supported",
1978 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1979 debug("bind port %d: %.100s", port, strerror(errno));
1980 shutdown(sock, SHUT_RDWR);
1986 for (n = 0; n < num_socks; n++) {
1987 shutdown(socks[n], SHUT_RDWR);
1993 socks[num_socks++] = sock;
1994 #ifndef DONT_TRY_OTHER_AF
1995 if (num_socks == NUM_SOCKS)
2001 freeaddrinfo(aitop);
2005 if (display_number >= MAX_DISPLAYS) {
2006 error("Failed to allocate internet-domain X11 display socket.");
2009 /* Start listening for connections on the socket. */
2010 for (n = 0; n < num_socks; n++) {
2012 if (listen(sock, 5) < 0) {
2013 error("listen: %.100s", strerror(errno));
2014 shutdown(sock, SHUT_RDWR);
2020 /* Set up a suitable value for the DISPLAY variable. */
2021 if (gethostname(hostname, sizeof(hostname)) < 0)
2022 fatal("gethostname: %.100s", strerror(errno));
2024 #ifdef IPADDR_IN_DISPLAY
2026 * HPUX detects the local hostname in the DISPLAY variable and tries
2027 * to set up a shared memory connection to the server, which it
2028 * incorrectly supposes to be local.
2030 * The workaround - as used in later $$H and other programs - is
2031 * is to set display to the host's IP address.
2035 struct in_addr my_addr;
2037 he = gethostbyname(hostname);
2039 error("[X11-broken-fwd-hostname-workaround] Could not get "
2040 "IP address for hostname %s.", hostname);
2042 packet_send_debug("[X11-broken-fwd-hostname-workaround]"
2043 "Could not get IP address for hostname %s.", hostname);
2045 shutdown(sock, SHUT_RDWR);
2051 memcpy(&my_addr, he->h_addr_list[0], sizeof(struct in_addr));
2053 /* Set DISPLAY to <ip address>:screen.display */
2054 snprintf(display, sizeof(display), "%.50s:%d.%d", inet_ntoa(my_addr),
2055 display_number, screen_number);
2057 #else /* IPADDR_IN_DISPLAY */
2058 /* Just set DISPLAY to hostname:screen.display */
2059 snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
2060 display_number, screen_number);
2061 #endif /* IPADDR_IN_DISPLAY */
2063 /* Allocate a channel for each socket. */
2064 for (n = 0; n < num_socks; n++) {
2066 (void) channel_new("x11 listener",
2067 SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
2068 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
2069 0, xstrdup("X11 inet listener"), 1);
2072 /* Return a suitable value for the DISPLAY environment variable. */
2073 return xstrdup(display);
2077 #define X_UNIX_PATH "/tmp/.X11-unix/X"
2082 connect_local_xsocket(u_int dnr)
2084 static const char *const x_sockets[] = {
2086 "/var/X/.X11-unix/X" "%u",
2087 "/usr/spool/sockets/X11/" "%u",
2091 struct sockaddr_un addr;
2092 const char *const * path;
2094 for (path = x_sockets; *path; ++path) {
2095 sock = socket(AF_UNIX, SOCK_STREAM, 0);
2097 error("socket: %.100s", strerror(errno));
2098 memset(&addr, 0, sizeof(addr));
2099 addr.sun_family = AF_UNIX;
2100 snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
2101 if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
2105 error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
2110 x11_connect_display(void)
2112 int display_number, sock = 0;
2113 const char *display;
2114 char buf[1024], *cp;
2115 struct addrinfo hints, *ai, *aitop;
2116 char strport[NI_MAXSERV];
2119 /* Try to open a socket for the local X server. */
2120 display = getenv("DISPLAY");
2122 error("DISPLAY not set.");
2126 * Now we decode the value of the DISPLAY variable and make a
2127 * connection to the real X server.
2131 * Check if it is a unix domain socket. Unix domain displays are in
2132 * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
2134 if (strncmp(display, "unix:", 5) == 0 ||
2135 display[0] == ':') {
2136 /* Connect to the unix domain socket. */
2137 if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
2138 error("Could not parse display number from DISPLAY: %.100s",
2142 /* Create a socket. */
2143 sock = connect_local_xsocket(display_number);
2147 /* OK, we now have a connection to the display. */
2151 * Connect to an inet socket. The DISPLAY value is supposedly
2152 * hostname:d[.s], where hostname may also be numeric IP address.
2154 strncpy(buf, display, sizeof(buf));
2155 buf[sizeof(buf) - 1] = 0;
2156 cp = strchr(buf, ':');
2158 error("Could not find ':' in DISPLAY: %.100s", display);
2162 /* buf now contains the host name. But first we parse the display number. */
2163 if (sscanf(cp + 1, "%d", &display_number) != 1) {
2164 error("Could not parse display number from DISPLAY: %.100s",
2169 /* Look up the host address */
2170 memset(&hints, 0, sizeof(hints));
2171 hints.ai_family = IPv4or6;
2172 hints.ai_socktype = SOCK_STREAM;
2173 snprintf(strport, sizeof strport, "%d", 6000 + display_number);
2174 if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
2175 error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
2178 for (ai = aitop; ai; ai = ai->ai_next) {
2179 /* Create a socket. */
2180 sock = socket(ai->ai_family, SOCK_STREAM, 0);
2182 debug("socket: %.100s", strerror(errno));
2185 /* Connect it to the display. */
2186 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2187 debug("connect %.100s port %d: %.100s", buf,
2188 6000 + display_number, strerror(errno));
2195 freeaddrinfo(aitop);
2197 error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
2205 * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
2206 * the remote channel number. We should do whatever we want, and respond
2207 * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
2211 x11_input_open(int type, int plen, void *ctxt)
2213 int remote_channel, sock = 0, newch;
2217 /* Get remote channel number. */
2218 remote_channel = packet_get_int();
2220 /* Get remote originator name. */
2221 if (have_hostname_in_open) {
2222 remote_host = packet_get_string(&remote_len);
2225 remote_host = xstrdup("unknown (remote did not supply name)");
2229 debug("Received X11 open request.");
2230 packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
2232 /* Obtain a connection to the real X display. */
2233 sock = x11_connect_display();
2235 /* Send refusal to the remote host. */
2236 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2237 packet_put_int(remote_channel);
2240 /* Allocate a channel for this connection. */
2241 newch = channel_allocate(
2242 (x11_saved_proto == NULL) ?
2243 SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
2245 channels[newch].remote_id = remote_channel;
2247 /* Send a confirmation to the remote host. */
2248 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2249 packet_put_int(remote_channel);
2250 packet_put_int(newch);
2255 /* dummy protocol handler that denies SSH-1 requests (agent/x11) */
2257 deny_input_open(int type, int plen, void *ctxt)
2259 int rchan = packet_get_int();
2261 case SSH_SMSG_AGENT_OPEN:
2262 error("Warning: ssh server tried agent forwarding.");
2264 case SSH_SMSG_X11_OPEN:
2265 error("Warning: ssh server tried X11 forwarding.");
2268 error("deny_input_open: type %d plen %d", type, plen);
2271 error("Warning: this is probably a break in attempt by a malicious server.");
2272 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2273 packet_put_int(rchan);
2278 * Requests forwarding of X11 connections, generates fake authentication
2279 * data, and enables authentication spoofing.
2283 x11_request_forwarding_with_spoofing(int client_session_id,
2284 const char *proto, const char *data)
2286 u_int data_len = (u_int) strlen(data) / 2;
2287 u_int i, value, len;
2293 cp = getenv("DISPLAY");
2295 cp = strchr(cp, ':');
2297 cp = strchr(cp, '.');
2299 screen_number = atoi(cp + 1);
2303 /* Save protocol name. */
2304 x11_saved_proto = xstrdup(proto);
2307 * Extract real authentication data and generate fake data of the
2310 x11_saved_data = xmalloc(data_len);
2311 x11_fake_data = xmalloc(data_len);
2312 for (i = 0; i < data_len; i++) {
2313 if (sscanf(data + 2 * i, "%2x", &value) != 1)
2314 fatal("x11_request_forwarding: bad authentication data: %.100s", data);
2316 rand = arc4random();
2317 x11_saved_data[i] = value;
2318 x11_fake_data[i] = rand & 0xff;
2321 x11_saved_data_len = data_len;
2322 x11_fake_data_len = data_len;
2324 /* Convert the fake data into hex. */
2325 len = 2 * data_len + 1;
2326 new_data = xmalloc(len);
2327 for (i = 0; i < data_len; i++)
2328 snprintf(new_data + 2 * i, len - 2 * i,
2329 "%02x", (u_char) x11_fake_data[i]);
2331 /* Send the request packet. */
2333 channel_request_start(client_session_id, "x11-req", 0);
2334 packet_put_char(0); /* XXX bool single connection */
2336 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2338 packet_put_cstring(proto);
2339 packet_put_cstring(new_data);
2340 packet_put_int(screen_number);
2342 packet_write_wait();
2346 /* Sends a message to the server to request authentication fd forwarding. */
2349 auth_request_forwarding()
2351 packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2353 packet_write_wait();
2357 * Returns the name of the forwarded authentication socket. Returns NULL if
2358 * there is no forwarded authentication socket. The returned value points to
2363 auth_get_socket_name()
2365 return channel_forwarded_auth_socket_name;
2368 /* removes the agent forwarding socket */
2371 cleanup_socket(void)
2373 unlink(channel_forwarded_auth_socket_name);
2374 rmdir(channel_forwarded_auth_socket_dir);
2378 * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
2379 * This starts forwarding authentication requests.
2383 auth_input_request_forwarding(struct passwd * pw)
2386 struct sockaddr_un sunaddr;
2388 if (auth_get_socket_name() != NULL)
2389 fatal("Protocol error: authentication forwarding requested twice.");
2391 /* Temporarily drop privileged uid for mkdir/bind. */
2392 temporarily_use_uid(pw->pw_uid);
2394 /* Allocate a buffer for the socket name, and format the name. */
2395 channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2396 channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2397 strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
2399 /* Create private directory for socket */
2400 if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {
2401 packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",
2404 xfree(channel_forwarded_auth_socket_name);
2405 xfree(channel_forwarded_auth_socket_dir);
2406 channel_forwarded_auth_socket_name = NULL;
2407 channel_forwarded_auth_socket_dir = NULL;
2410 snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2411 channel_forwarded_auth_socket_dir, (int) getpid());
2413 if (atexit(cleanup_socket) < 0) {
2416 packet_disconnect("socket: %.100s", strerror(saved));
2418 /* Create the socket. */
2419 sock = socket(AF_UNIX, SOCK_STREAM, 0);
2421 packet_disconnect("socket: %.100s", strerror(errno));
2423 /* Bind it to the name. */
2424 memset(&sunaddr, 0, sizeof(sunaddr));
2425 sunaddr.sun_family = AF_UNIX;
2426 strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2427 sizeof(sunaddr.sun_path));
2429 if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2430 packet_disconnect("bind: %.100s", strerror(errno));
2432 /* Restore the privileged uid. */
2435 /* Start listening on the socket. */
2436 if (listen(sock, 5) < 0)
2437 packet_disconnect("listen: %.100s", strerror(errno));
2439 /* Allocate a channel for the authentication agent socket. */
2440 newch = channel_new("auth socket",
2441 SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
2442 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
2443 0, xstrdup("auth socket"), 1);
2445 strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2446 sizeof(channels[newch].path));
2450 /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2453 auth_input_open_request(int type, int plen, void *ctxt)
2455 int remch, sock, newch;
2458 packet_integrity_check(plen, 4, type);
2460 /* Read the remote channel number from the message. */
2461 remch = packet_get_int();
2464 * Get a connection to the local authentication agent (this may again
2467 sock = ssh_get_authentication_socket();
2470 * If we could not connect the agent, send an error message back to
2471 * the server. This should never happen unless the agent dies,
2472 * because authentication forwarding is only enabled if we have an
2476 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2477 packet_put_int(remch);
2481 debug("Forwarding authentication connection.");
2484 * Dummy host name. This will be freed when the channel is freed; it
2485 * will still be valid in the packet_put_string below since the
2486 * channel cannot yet be freed at that point.
2488 dummyname = xstrdup("authentication agent connection");
2490 newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2491 channels[newch].remote_id = remch;
2493 /* Send a confirmation to the remote host. */
2494 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2495 packet_put_int(remch);
2496 packet_put_int(newch);
2501 channel_start_open(int id)
2503 Channel *c = channel_lookup(id);
2505 log("channel_open: %d: bad id", id);
2508 debug("send channel open %d", id);
2509 packet_start(SSH2_MSG_CHANNEL_OPEN);
2510 packet_put_cstring(c->ctype);
2511 packet_put_int(c->self);
2512 packet_put_int(c->local_window);
2513 packet_put_int(c->local_maxpacket);
2516 channel_open(int id)
2519 channel_start_open(id);
2523 channel_request(int id, char *service, int wantconfirm)
2525 channel_request_start(id, service, wantconfirm);
2527 debug("channel request %d: %s", id, service) ;
2530 channel_request_start(int id, char *service, int wantconfirm)
2532 Channel *c = channel_lookup(id);
2534 log("channel_request: %d: bad id", id);
2537 packet_start(SSH2_MSG_CHANNEL_REQUEST);
2538 packet_put_int(c->remote_id);
2539 packet_put_cstring(service);
2540 packet_put_char(wantconfirm);
2543 channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2545 Channel *c = channel_lookup(id);
2547 log("channel_register_callback: %d: bad id", id);
2550 c->cb_event = mtype;
2555 channel_register_cleanup(int id, channel_callback_fn *fn)
2557 Channel *c = channel_lookup(id);
2559 log("channel_register_cleanup: %d: bad id", id);
2562 c->dettach_user = fn;
2565 channel_cancel_cleanup(int id)
2567 Channel *c = channel_lookup(id);
2569 log("channel_cancel_cleanup: %d: bad id", id);
2572 c->dettach_user = NULL;
2575 channel_register_filter(int id, channel_filter_fn *fn)
2577 Channel *c = channel_lookup(id);
2579 log("channel_register_filter: %d: bad id", id);
2582 c->input_filter = fn;
2586 channel_set_fds(int id, int rfd, int wfd, int efd,
2587 int extusage, int nonblock)
2589 Channel *c = channel_lookup(id);
2590 if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2591 fatal("channel_activate for non-larval channel %d.", id);
2592 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
2593 c->type = SSH_CHANNEL_OPEN;
2594 /* XXX window size? */
2595 c->local_window = c->local_window_max = c->local_maxpacket * 2;
2596 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2597 packet_put_int(c->remote_id);
2598 packet_put_int(c->local_window);