channels.c

   1 /*
   2  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   3  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   4  *                    All rights reserved
   5  * This file contains functions for generic socket connection forwarding.
   6  * There is also code for initiating connection forwarding for X11 connections,
   7  * arbitrary tcp/ip connections, and the authentication agent connection.
   8  *
   9  * As far as I am concerned, the code I have written for this software
  10  * can be used freely for any purpose.  Any derived versions of this
  11  * software must be clearly marked as such, and if the derived work is
  12  * incompatible with the protocol description in the RFC file, it must be
  13  * called by a name other than "ssh" or "Secure Shell".
  14  *
  15  *
  16  * SSH2 support added by Markus Friedl.
  17  * Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
  18  * Copyright (c) 1999 Dug Song.  All rights reserved.
  19  * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
  20  *
  21  * Redistribution and use in source and binary forms, with or without
  22  * modification, are permitted provided that the following conditions
  23  * are met:
  24  * 1. Redistributions of source code must retain the above copyright
  25  *    notice, this list of conditions and the following disclaimer.
  26  * 2. Redistributions in binary form must reproduce the above copyright
  27  *    notice, this list of conditions and the following disclaimer in the
  28  *    documentation and/or other materials provided with the distribution.
  29  *
  30  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  31  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  32  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  33  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  34  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  35  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  36  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  37  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  38  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  39  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  40  */
  41
  42 #include "includes.h"
  43 RCSID("$OpenBSD: channels.c,v 1.76 2000/12/19 22:43:44 markus Exp $");
  44
  45 #include "ssh.h"
  46 #include "packet.h"
  47 #include "xmalloc.h"
  48 #include "buffer.h"
  49 #include "uidswap.h"
  50 #include "readconf.h"
  51 #include "servconf.h"
  52
  53 #include "channels.h"
  54 #include "nchan.h"
  55 #include "compat.h"
  56
  57 #include "ssh2.h"
  58
  59 #include <openssl/rsa.h>
  60 #include <openssl/dsa.h>
  61 #include "key.h"
  62 #include "authfd.h"
  63
  64 /* Maximum number of fake X11 displays to try. */
  65 #define MAX_DISPLAYS  1000
  66
  67 /* Max len of agent socket */
  68 #define MAX_SOCKET_NAME 100
  69
  70 /*
  71  * Pointer to an array containing all allocated channels.  The array is
  72  * dynamically extended as needed.
  73  */
  74 static Channel *channels = NULL;
  75
  76 /*
  77  * Size of the channel array.  All slots of the array must always be
  78  * initialized (at least the type field); unused slots are marked with type
  79  * SSH_CHANNEL_FREE.
  80  */
  81 static int channels_alloc = 0;
  82
  83 /*
  84  * Maximum file descriptor value used in any of the channels.  This is
  85  * updated in channel_allocate.
  86  */
  87 static int channel_max_fd_value = 0;
  88
  89 /* Name and directory of socket for authentication agent forwarding. */
  90 static char *channel_forwarded_auth_socket_name = NULL;
  91 static char *channel_forwarded_auth_socket_dir = NULL;
  92
  93 /* Saved X11 authentication protocol name. */
  94 char *x11_saved_proto = NULL;
  95
  96 /* Saved X11 authentication data.  This is the real data. */
  97 char *x11_saved_data = NULL;
  98 unsigned int x11_saved_data_len = 0;
  99
 100 /*
 101  * Fake X11 authentication data.  This is what the server will be sending us;
 102  * we should replace any occurrences of this by the real data.
 103  */
 104 char *x11_fake_data = NULL;
 105 unsigned int x11_fake_data_len;
 106
 107 /*
 108  * Data structure for storing which hosts are permitted for forward requests.
 109  * The local sides of any remote forwards are stored in this array to prevent
 110  * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
 111  * network (which might be behind a firewall).
 112  */
 113 typedef struct {
 114         char *host_to_connect;          /* Connect to 'host'. */
 115         u_short port_to_connect;        /* Connect to 'port'. */
 116         u_short listen_port;            /* Remote side should listen port number. */
 117 } ForwardPermission;
 118
 119 /* List of all permitted host/port pairs to connect. */
 120 static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
 121 /* Number of permitted host/port pairs in the array. */
 122 static int num_permitted_opens = 0;
 123 /*
 124  * If this is true, all opens are permitted.  This is the case on the server
 125  * on which we have to trust the client anyway, and the user could do
 126  * anything after logging in anyway.
 127  */
 128 static int all_opens_permitted = 0;
 129
 130 /* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
 131 static int have_hostname_in_open = 0;
 132
 133 /* Sets specific protocol options. */
 134
 135 void
 136 channel_set_options(int hostname_in_open)
 137 {
 138         have_hostname_in_open = hostname_in_open;
 139 }
 140
 141 /*
 142  * Permits opening to any host/port in SSH_MSG_PORT_OPEN.  This is usually
 143  * called by the server, because the user could connect to any port anyway,
 144  * and the server has no way to know but to trust the client anyway.
 145  */
 146
 147 void
 148 channel_permit_all_opens()
 149 {
 150         all_opens_permitted = 1;
 151 }
 152
 153 /* lookup channel by id */
 154
 155 Channel *
 156 channel_lookup(int id)
 157 {
 158         Channel *c;
 159         if (id < 0 || id > channels_alloc) {
 160                 log("channel_lookup: %d: bad id", id);
 161                 return NULL;
 162         }
 163         c = &channels[id];
 164         if (c->type == SSH_CHANNEL_FREE) {
 165                 log("channel_lookup: %d: bad id: channel free", id);
 166                 return NULL;
 167         }
 168         return c;
 169 }
 170
 171 /*
 172  * Register filedescriptors for a channel, used when allocating a channel or
 173  * when the channel consumer/producer is ready, e.g. shell exec'd
 174  */
 175
 176 void
 177 channel_register_fds(Channel *c, int rfd, int wfd, int efd,
 178     int extusage, int nonblock)
 179 {
 180         /* Update the maximum file descriptor value. */
 181         if (rfd > channel_max_fd_value)
 182                 channel_max_fd_value = rfd;
 183         if (wfd > channel_max_fd_value)
 184                 channel_max_fd_value = wfd;
 185         if (efd > channel_max_fd_value)
 186                 channel_max_fd_value = efd;
 187         /* XXX set close-on-exec -markus */
 188
 189         c->rfd = rfd;
 190         c->wfd = wfd;
 191         c->sock = (rfd == wfd) ? rfd : -1;
 192         c->efd = efd;
 193         c->extended_usage = extusage;
 194
 195         /* enable nonblocking mode */
 196         if (nonblock) {
 197                 if (rfd != -1)
 198                         set_nonblock(rfd);
 199                 if (wfd != -1)
 200                         set_nonblock(wfd);
 201                 if (efd != -1)
 202                         set_nonblock(efd);
 203         }
 204 }
 205
 206 /*
 207  * Allocate a new channel object and set its type and socket. This will cause
 208  * remote_name to be freed.
 209  */
 210
 211 int
 212 channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 213     int window, int maxpack, int extusage, char *remote_name, int nonblock)
 214 {
 215         int i, found;
 216         Channel *c;
 217
 218         /* Do initial allocation if this is the first call. */
 219         if (channels_alloc == 0) {
 220                 chan_init();
 221                 channels_alloc = 10;
 222                 channels = xmalloc(channels_alloc * sizeof(Channel));
 223                 for (i = 0; i < channels_alloc; i++)
 224                         channels[i].type = SSH_CHANNEL_FREE;
 225                 /*
 226                  * Kludge: arrange a call to channel_stop_listening if we
 227                  * terminate with fatal().
 228                  */
 229                 fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
 230         }
 231         /* Try to find a free slot where to put the new channel. */
 232         for (found = -1, i = 0; i < channels_alloc; i++)
 233                 if (channels[i].type == SSH_CHANNEL_FREE) {
 234                         /* Found a free slot. */
 235                         found = i;
 236                         break;
 237                 }
 238         if (found == -1) {
 239                 /* There are no free slots.  Take last+1 slot and expand the array.  */
 240                 found = channels_alloc;
 241                 channels_alloc += 10;
 242                 debug2("channel: expanding %d", channels_alloc);
 243                 channels = xrealloc(channels, channels_alloc * sizeof(Channel));
 244                 for (i = found; i < channels_alloc; i++)
 245                         channels[i].type = SSH_CHANNEL_FREE;
 246         }
 247         /* Initialize and return new channel number. */
 248         c = &channels[found];
 249         buffer_init(&c->input);
 250         buffer_init(&c->output);
 251         buffer_init(&c->extended);
 252         chan_init_iostates(c);
 253         channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
 254         c->self = found;
 255         c->type = type;
 256         c->ctype = ctype;
 257         c->local_window = window;
 258         c->local_window_max = window;
 259         c->local_consumed = 0;
 260         c->local_maxpacket = maxpack;
 261         c->remote_id = -1;
 262         c->remote_name = remote_name;
 263         c->remote_window = 0;
 264         c->remote_maxpacket = 0;
 265         c->cb_fn = NULL;
 266         c->cb_arg = NULL;
 267         c->cb_event = 0;
 268         c->dettach_user = NULL;
 269         c->input_filter = NULL;
 270         debug("channel %d: new [%s]", found, remote_name);
 271         return found;
 272 }
 273 /* old interface XXX */
 274 int
 275 channel_allocate(int type, int sock, char *remote_name)
 276 {
 277         return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1);
 278 }
 279
 280
 281 /* Close all channel fd/socket. */
 282
 283 void
 284 channel_close_fds(Channel *c)
 285 {
 286         if (c->sock != -1) {
 287                 close(c->sock);
 288                 c->sock = -1;
 289         }
 290         if (c->rfd != -1) {
 291                 close(c->rfd);
 292                 c->rfd = -1;
 293         }
 294         if (c->wfd != -1) {
 295                 close(c->wfd);
 296                 c->wfd = -1;
 297         }
 298         if (c->efd != -1) {
 299                 close(c->efd);
 300                 c->efd = -1;
 301         }
 302 }
 303
 304 /* Free the channel and close its fd/socket. */
 305
 306 void
 307 channel_free(int id)
 308 {
 309         Channel *c = channel_lookup(id);
 310         if (c == NULL)
 311                 packet_disconnect("channel free: bad local channel %d", id);
 312         debug("channel_free: channel %d: status: %s", id, channel_open_message());
 313         if (c->dettach_user != NULL) {
 314                 debug("channel_free: channel %d: dettaching channel user", id);
 315                 c->dettach_user(c->self, NULL);
 316         }
 317         if (c->sock != -1)
 318                 shutdown(c->sock, SHUT_RDWR);
 319         channel_close_fds(c);
 320         buffer_free(&c->input);
 321         buffer_free(&c->output);
 322         buffer_free(&c->extended);
 323         c->type = SSH_CHANNEL_FREE;
 324         if (c->remote_name) {
 325                 xfree(c->remote_name);
 326                 c->remote_name = NULL;
 327         }
 328 }
 329
 330 /*
 331  * 'channel_pre*' are called just before select() to add any bits relevant to
 332  * channels in the select bitmasks.
 333  */
 334 /*
 335  * 'channel_post*': perform any appropriate operations for channels which
 336  * have events pending.
 337  */
 338 typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
 339 chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
 340 chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
 341
 342 void
 343 channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
 344 {
 345         FD_SET(c->sock, readset);
 346 }
 347
 348 void
 349 channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset)
 350 {
 351         debug3("channel %d: waiting for connection", c->self);
 352         FD_SET(c->sock, writeset);
 353 }
 354
 355 void
 356 channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
 357 {
 358         if (buffer_len(&c->input) < packet_get_maxsize())
 359                 FD_SET(c->sock, readset);
 360         if (buffer_len(&c->output) > 0)
 361                 FD_SET(c->sock, writeset);
 362 }
 363
 364 void
 365 channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
 366 {
 367         /* test whether sockets are 'alive' for read/write */
 368         if (c->istate == CHAN_INPUT_OPEN)
 369                 if (buffer_len(&c->input) < packet_get_maxsize())
 370                         FD_SET(c->sock, readset);
 371         if (c->ostate == CHAN_OUTPUT_OPEN ||
 372             c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 373                 if (buffer_len(&c->output) > 0) {
 374                         FD_SET(c->sock, writeset);
 375                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 376                         chan_obuf_empty(c);
 377                 }
 378         }
 379 }
 380
 381 void
 382 channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
 383 {
 384         if (c->istate == CHAN_INPUT_OPEN &&
 385             c->remote_window > 0 &&
 386             buffer_len(&c->input) < c->remote_window)
 387                 FD_SET(c->rfd, readset);
 388         if (c->ostate == CHAN_OUTPUT_OPEN ||
 389             c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 390                 if (buffer_len(&c->output) > 0) {
 391                         FD_SET(c->wfd, writeset);
 392                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 393                         chan_obuf_empty(c);
 394                 }
 395         }
 396         /** XXX check close conditions, too */
 397         if (c->efd != -1) {
 398                 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
 399                     buffer_len(&c->extended) > 0)
 400                         FD_SET(c->efd, writeset);
 401                 else if (c->extended_usage == CHAN_EXTENDED_READ &&
 402                     buffer_len(&c->extended) < c->remote_window)
 403                         FD_SET(c->efd, readset);
 404         }
 405 }
 406
 407 void
 408 channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
 409 {
 410         if (buffer_len(&c->input) == 0) {
 411                 packet_start(SSH_MSG_CHANNEL_CLOSE);
 412                 packet_put_int(c->remote_id);
 413                 packet_send();
 414                 c->type = SSH_CHANNEL_CLOSED;
 415                 debug("Closing channel %d after input drain.", c->self);
 416         }
 417 }
 418
 419 void
 420 channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
 421 {
 422         if (buffer_len(&c->output) == 0)
 423                 channel_free(c->self);
 424         else
 425                 FD_SET(c->sock, writeset);
 426 }
 427
 428 /*
 429  * This is a special state for X11 authentication spoofing.  An opened X11
 430  * connection (when authentication spoofing is being done) remains in this
 431  * state until the first packet has been completely read.  The authentication
 432  * data in that packet is then substituted by the real data if it matches the
 433  * fake data, and the channel is put into normal mode.
 434  * XXX All this happens at the client side.
 435  */
 436 int
 437 x11_open_helper(Channel *c)
 438 {
 439         unsigned char *ucp;
 440         unsigned int proto_len, data_len;
 441
 442         /* Check if the fixed size part of the packet is in buffer. */
 443         if (buffer_len(&c->output) < 12)
 444                 return 0;
 445
 446         /* Parse the lengths of variable-length fields. */
 447         ucp = (unsigned char *) buffer_ptr(&c->output);
 448         if (ucp[0] == 0x42) {   /* Byte order MSB first. */
 449                 proto_len = 256 * ucp[6] + ucp[7];
 450                 data_len = 256 * ucp[8] + ucp[9];
 451         } else if (ucp[0] == 0x6c) {    /* Byte order LSB first. */
 452                 proto_len = ucp[6] + 256 * ucp[7];
 453                 data_len = ucp[8] + 256 * ucp[9];
 454         } else {
 455                 debug("Initial X11 packet contains bad byte order byte: 0x%x",
 456                       ucp[0]);
 457                 return -1;
 458         }
 459
 460         /* Check if the whole packet is in buffer. */
 461         if (buffer_len(&c->output) <
 462             12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
 463                 return 0;
 464
 465         /* Check if authentication protocol matches. */
 466         if (proto_len != strlen(x11_saved_proto) ||
 467             memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
 468                 debug("X11 connection uses different authentication protocol.");
 469                 return -1;
 470         }
 471         /* Check if authentication data matches our fake data. */
 472         if (data_len != x11_fake_data_len ||
 473             memcmp(ucp + 12 + ((proto_len + 3) & ~3),
 474                 x11_fake_data, x11_fake_data_len) != 0) {
 475                 debug("X11 auth data does not match fake data.");
 476                 return -1;
 477         }
 478         /* Check fake data length */
 479         if (x11_fake_data_len != x11_saved_data_len) {
 480                 error("X11 fake_data_len %d != saved_data_len %d",
 481                     x11_fake_data_len, x11_saved_data_len);
 482                 return -1;
 483         }
 484         /*
 485          * Received authentication protocol and data match
 486          * our fake data. Substitute the fake data with real
 487          * data.
 488          */
 489         memcpy(ucp + 12 + ((proto_len + 3) & ~3),
 490             x11_saved_data, x11_saved_data_len);
 491         return 1;
 492 }
 493
 494 void
 495 channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
 496 {
 497         int ret = x11_open_helper(c);
 498         if (ret == 1) {
 499                 /* Start normal processing for the channel. */
 500                 c->type = SSH_CHANNEL_OPEN;
 501                 channel_pre_open_13(c, readset, writeset);
 502         } else if (ret == -1) {
 503                 /*
 504                  * We have received an X11 connection that has bad
 505                  * authentication information.
 506                  */
 507                 log("X11 connection rejected because of wrong authentication.\r\n");
 508                 buffer_clear(&c->input);
 509                 buffer_clear(&c->output);
 510                 close(c->sock);
 511                 c->sock = -1;
 512                 c->type = SSH_CHANNEL_CLOSED;
 513                 packet_start(SSH_MSG_CHANNEL_CLOSE);
 514                 packet_put_int(c->remote_id);
 515                 packet_send();
 516         }
 517 }
 518
 519 void
 520 channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
 521 {
 522         int ret = x11_open_helper(c);
 523         if (ret == 1) {
 524                 c->type = SSH_CHANNEL_OPEN;
 525                 if (compat20)
 526                         channel_pre_open_20(c, readset, writeset);
 527                 else
 528                         channel_pre_open_15(c, readset, writeset);
 529         } else if (ret == -1) {
 530                 debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
 531                 chan_read_failed(c);    /** force close? */
 532                 chan_write_failed(c);
 533                 debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
 534         }
 535 }
 536
 537 /* This is our fake X11 server socket. */
 538 void
 539 channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
 540 {
 541         struct sockaddr addr;
 542         int newsock, newch;
 543         socklen_t addrlen;
 544         char buf[16384], *remote_hostname;
 545         int remote_port;
 546
 547         if (FD_ISSET(c->sock, readset)) {
 548                 debug("X11 connection requested.");
 549                 addrlen = sizeof(addr);
 550                 newsock = accept(c->sock, &addr, &addrlen);
 551                 if (newsock < 0) {
 552                         error("accept: %.100s", strerror(errno));
 553                         return;
 554                 }
 555                 remote_hostname = get_remote_hostname(newsock);
 556                 remote_port = get_peer_port(newsock);
 557                 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
 558                     remote_hostname, remote_port);
 559
 560                 newch = channel_new("x11",
 561                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
 562                     c->local_window_max, c->local_maxpacket,
 563                     0, xstrdup(buf), 1);
 564                 if (compat20) {
 565                         packet_start(SSH2_MSG_CHANNEL_OPEN);
 566                         packet_put_cstring("x11");
 567                         packet_put_int(newch);
 568                         packet_put_int(c->local_window_max);
 569                         packet_put_int(c->local_maxpacket);
 570                         /* originator host and port */
 571                         packet_put_cstring(remote_hostname);
 572                         if (datafellows & SSH_BUG_X11FWD) {
 573                                 debug("ssh2 x11 bug compat mode");
 574                         } else {
 575                                 packet_put_int(remote_port);
 576                         }
 577                         packet_send();
 578                 } else {
 579                         packet_start(SSH_SMSG_X11_OPEN);
 580                         packet_put_int(newch);
 581                         if (have_hostname_in_open)
 582                                 packet_put_string(buf, strlen(buf));
 583                         packet_send();
 584                 }
 585                 xfree(remote_hostname);
 586         }
 587 }
 588
 589 /*
 590  * This socket is listening for connections to a forwarded TCP/IP port.
 591  */
 592 void
 593 channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
 594 {
 595         struct sockaddr addr;
 596         int newsock, newch;
 597         socklen_t addrlen;
 598         char buf[1024], *remote_hostname, *rtype;
 599         int remote_port;
 600
 601         rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ?
 602             "forwarded-tcpip" : "direct-tcpip";
 603
 604         if (FD_ISSET(c->sock, readset)) {
 605                 debug("Connection to port %d forwarding "
 606                     "to %.100s port %d requested.",
 607                     c->listening_port, c->path, c->host_port);
 608                 addrlen = sizeof(addr);
 609                 newsock = accept(c->sock, &addr, &addrlen);
 610                 if (newsock < 0) {
 611                         error("accept: %.100s", strerror(errno));
 612                         return;
 613                 }
 614                 remote_hostname = get_remote_hostname(newsock);
 615                 remote_port = get_peer_port(newsock);
 616                 snprintf(buf, sizeof buf,
 617                     "listen port %d for %.100s port %d, "
 618                     "connect from %.200s port %d",
 619                     c->listening_port, c->path, c->host_port,
 620                     remote_hostname, remote_port);
 621
 622                 newch = channel_new(rtype,
 623                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
 624                     c->local_window_max, c->local_maxpacket,
 625                     0, xstrdup(buf), 1);
 626                 if (compat20) {
 627                         packet_start(SSH2_MSG_CHANNEL_OPEN);
 628                         packet_put_cstring(rtype);
 629                         packet_put_int(newch);
 630                         packet_put_int(c->local_window_max);
 631                         packet_put_int(c->local_maxpacket);
 632                         if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
 633                                 /* listen address, port */
 634                                 packet_put_string(c->path, strlen(c->path));
 635                                 packet_put_int(c->listening_port);
 636                         } else {
 637                                 /* target host, port */
 638                                 packet_put_string(c->path, strlen(c->path));
 639                                 packet_put_int(c->host_port);
 640                         }
 641                         /* originator host and port */
 642                         packet_put_cstring(remote_hostname);
 643                         packet_put_int(remote_port);
 644                         packet_send();
 645                 } else {
 646                         packet_start(SSH_MSG_PORT_OPEN);
 647                         packet_put_int(newch);
 648                         packet_put_string(c->path, strlen(c->path));
 649                         packet_put_int(c->host_port);
 650                         if (have_hostname_in_open) {
 651                                 packet_put_string(buf, strlen(buf));
 652                         }
 653                         packet_send();
 654                 }
 655                 xfree(remote_hostname);
 656         }
 657 }
 658
 659 /*
 660  * This is the authentication agent socket listening for connections from
 661  * clients.
 662  */
 663 void
 664 channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
 665 {
 666         struct sockaddr addr;
 667         int newsock, newch;
 668         socklen_t addrlen;
 669
 670         if (FD_ISSET(c->sock, readset)) {
 671                 addrlen = sizeof(addr);
 672                 newsock = accept(c->sock, &addr, &addrlen);
 673                 if (newsock < 0) {
 674                         error("accept from auth socket: %.100s", strerror(errno));
 675                         return;
 676                 }
 677                 newch = channel_new("accepted auth socket",
 678                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
 679                     c->local_window_max, c->local_maxpacket,
 680                     0, xstrdup("accepted auth socket"), 1);
 681                 if (compat20) {
 682                         packet_start(SSH2_MSG_CHANNEL_OPEN);
 683                         packet_put_cstring("auth-agent@openssh.com");
 684                         packet_put_int(newch);
 685                         packet_put_int(c->local_window_max);
 686                         packet_put_int(c->local_maxpacket);
 687                 } else {
 688                         packet_start(SSH_SMSG_AGENT_OPEN);
 689                         packet_put_int(newch);
 690                 }
 691                 packet_send();
 692         }
 693 }
 694
 695 void
 696 channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
 697 {
 698         if (FD_ISSET(c->sock, writeset)) {
 699                 int err = 0;
 700                 int sz = sizeof(err);
 701                 c->type = SSH_CHANNEL_OPEN;
 702                 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &sz) < 0) {
 703                         debug("getsockopt SO_ERROR failed");
 704                 } else {
 705                         if (err == 0) {
 706                                 debug("channel %d: connected)", c->self);
 707                         } else {
 708                                 debug("channel %d: not connected: %s",
 709                                     c->self, strerror(err));
 710                                 chan_read_failed(c);
 711                                 chan_write_failed(c);
 712                         }
 713                 }
 714         }
 715 }
 716
 717 int
 718 channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
 719 {
 720         char buf[16*1024];
 721         int len;
 722
 723         if (c->rfd != -1 &&
 724             FD_ISSET(c->rfd, readset)) {
 725                 len = read(c->rfd, buf, sizeof(buf));
 726                 if (len < 0 && (errno == EINTR || errno == EAGAIN))
 727                         return 1;
 728                 if (len <= 0) {
 729                         debug("channel %d: read<=0 rfd %d len %d",
 730                             c->self, c->rfd, len);
 731                         if (compat13) {
 732                                 buffer_consume(&c->output, buffer_len(&c->output));
 733                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
 734                                 debug("Channel %d status set to input draining.", c->self);
 735                         } else {
 736                                 chan_read_failed(c);
 737                         }
 738                         return -1;
 739                 }
 740                 if(c->input_filter != NULL) {
 741                         if (c->input_filter(c, buf, len) == -1) {
 742                                 debug("filter stops channel %d", c->self);
 743                                 chan_read_failed(c);
 744                         }
 745                 } else {
 746                         buffer_append(&c->input, buf, len);
 747                 }
 748         }
 749         return 1;
 750 }
 751 int
 752 channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
 753 {
 754         int len;
 755
 756         /* Send buffered output data to the socket. */
 757         if (c->wfd != -1 &&
 758             FD_ISSET(c->wfd, writeset) &&
 759             buffer_len(&c->output) > 0) {
 760                 len = write(c->wfd, buffer_ptr(&c->output),
 761                     buffer_len(&c->output));
 762                 if (len < 0 && (errno == EINTR || errno == EAGAIN))
 763                         return 1;
 764                 if (len <= 0) {
 765                         if (compat13) {
 766                                 buffer_consume(&c->output, buffer_len(&c->output));
 767                                 debug("Channel %d status set to input draining.", c->self);
 768                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
 769                         } else {
 770                                 chan_write_failed(c);
 771                         }
 772                         return -1;
 773                 }
 774                 buffer_consume(&c->output, len);
 775                 if (compat20 && len > 0) {
 776                         c->local_consumed += len;
 777                 }
 778         }
 779         return 1;
 780 }
 781 int
 782 channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
 783 {
 784         char buf[16*1024];
 785         int len;
 786
 787 /** XXX handle drain efd, too */
 788         if (c->efd != -1) {
 789                 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
 790                     FD_ISSET(c->efd, writeset) &&
 791                     buffer_len(&c->extended) > 0) {
 792                         len = write(c->efd, buffer_ptr(&c->extended),
 793                             buffer_len(&c->extended));
 794                         debug2("channel %d: written %d to efd %d",
 795                             c->self, len, c->efd);
 796                         if (len > 0) {
 797                                 buffer_consume(&c->extended, len);
 798                                 c->local_consumed += len;
 799                         }
 800                 } else if (c->extended_usage == CHAN_EXTENDED_READ &&
 801                     FD_ISSET(c->efd, readset)) {
 802                         len = read(c->efd, buf, sizeof(buf));
 803                         debug2("channel %d: read %d from efd %d",
 804                              c->self, len, c->efd);
 805                         if (len == 0) {
 806                                 debug("channel %d: closing efd %d",
 807                                     c->self, c->efd);
 808                                 close(c->efd);
 809                                 c->efd = -1;
 810                         } else if (len > 0)
 811                                 buffer_append(&c->extended, buf, len);
 812                 }
 813         }
 814         return 1;
 815 }
 816 int
 817 channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
 818 {
 819         if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
 820             c->local_window < c->local_window_max/2 &&
 821             c->local_consumed > 0) {
 822                 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
 823                 packet_put_int(c->remote_id);
 824                 packet_put_int(c->local_consumed);
 825                 packet_send();
 826                 debug2("channel %d: window %d sent adjust %d",
 827                     c->self, c->local_window,
 828                     c->local_consumed);
 829                 c->local_window += c->local_consumed;
 830                 c->local_consumed = 0;
 831         }
 832         return 1;
 833 }
 834
 835 void
 836 channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
 837 {
 838         channel_handle_rfd(c, readset, writeset);
 839         channel_handle_wfd(c, readset, writeset);
 840 }
 841
 842 void
 843 channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
 844 {
 845         channel_handle_rfd(c, readset, writeset);
 846         channel_handle_wfd(c, readset, writeset);
 847         channel_handle_efd(c, readset, writeset);
 848         channel_check_window(c, readset, writeset);
 849 }
 850
 851 void
 852 channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
 853 {
 854         int len;
 855         /* Send buffered output data to the socket. */
 856         if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
 857                 len = write(c->sock, buffer_ptr(&c->output),
 858                             buffer_len(&c->output));
 859                 if (len <= 0)
 860                         buffer_consume(&c->output, buffer_len(&c->output));
 861                 else
 862                         buffer_consume(&c->output, len);
 863         }
 864 }
 865
 866 void
 867 channel_handler_init_20(void)
 868 {
 869         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_20;
 870         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open;
 871         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 872         channel_pre[SSH_CHANNEL_RPORT_LISTENER] =       &channel_pre_listener;
 873         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 874         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
 875         channel_pre[SSH_CHANNEL_CONNECTING] =           &channel_pre_connecting;
 876
 877         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_2;
 878         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 879         channel_post[SSH_CHANNEL_RPORT_LISTENER] =      &channel_post_port_listener;
 880         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 881         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
 882         channel_post[SSH_CHANNEL_CONNECTING] =          &channel_post_connecting;
 883 }
 884
 885 void
 886 channel_handler_init_13(void)
 887 {
 888         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_13;
 889         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open_13;
 890         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 891         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 892         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
 893         channel_pre[SSH_CHANNEL_INPUT_DRAINING] =       &channel_pre_input_draining;
 894         channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] =      &channel_pre_output_draining;
 895         channel_pre[SSH_CHANNEL_CONNECTING] =           &channel_pre_connecting;
 896
 897         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_1;
 898         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 899         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 900         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
 901         channel_post[SSH_CHANNEL_OUTPUT_DRAINING] =     &channel_post_output_drain_13;
 902         channel_post[SSH_CHANNEL_CONNECTING] =          &channel_post_connecting;
 903 }
 904
 905 void
 906 channel_handler_init_15(void)
 907 {
 908         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_15;
 909         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open;
 910         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 911         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 912         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
 913         channel_pre[SSH_CHANNEL_CONNECTING] =           &channel_pre_connecting;
 914
 915         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 916         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 917         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
 918         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_1;
 919         channel_post[SSH_CHANNEL_CONNECTING] =          &channel_post_connecting;
 920 }
 921
 922 void
 923 channel_handler_init(void)
 924 {
 925         int i;
 926         for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
 927                 channel_pre[i] = NULL;
 928                 channel_post[i] = NULL;
 929         }
 930         if (compat20)
 931                 channel_handler_init_20();
 932         else if (compat13)
 933                 channel_handler_init_13();
 934         else
 935                 channel_handler_init_15();
 936 }
 937
 938 void
 939 channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
 940 {
 941         static int did_init = 0;
 942         int i;
 943         Channel *c;
 944
 945         if (!did_init) {
 946                 channel_handler_init();
 947                 did_init = 1;
 948         }
 949         for (i = 0; i < channels_alloc; i++) {
 950                 c = &channels[i];
 951                 if (c->type == SSH_CHANNEL_FREE)
 952                         continue;
 953                 if (ftab[c->type] == NULL)
 954                         continue;
 955                 (*ftab[c->type])(c, readset, writeset);
 956                 chan_delete_if_full_closed(c);
 957         }
 958 }
 959
 960 void
 961 channel_prepare_select(fd_set * readset, fd_set * writeset)
 962 {
 963         channel_handler(channel_pre, readset, writeset);
 964 }
 965
 966 void
 967 channel_after_select(fd_set * readset, fd_set * writeset)
 968 {
 969         channel_handler(channel_post, readset, writeset);
 970 }
 971
 972 /* If there is data to send to the connection, send some of it now. */
 973
 974 void
 975 channel_output_poll()
 976 {
 977         int len, i;
 978         Channel *c;
 979
 980         for (i = 0; i < channels_alloc; i++) {
 981                 c = &channels[i];
 982
 983                 /* We are only interested in channels that can have buffered incoming data. */
 984                 if (compat13) {
 985                         if (c->type != SSH_CHANNEL_OPEN &&
 986                             c->type != SSH_CHANNEL_INPUT_DRAINING)
 987                                 continue;
 988                 } else {
 989                         if (c->type != SSH_CHANNEL_OPEN)
 990                                 continue;
 991                         if (c->istate != CHAN_INPUT_OPEN &&
 992                             c->istate != CHAN_INPUT_WAIT_DRAIN)
 993                                 continue;
 994                 }
 995                 if (compat20 &&
 996                     (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
 997                         debug("channel: %d: no data after CLOSE", c->self);
 998                         continue;
 999                 }
1000
1001                 /* Get the amount of buffered data for this channel. */
1002                 len = buffer_len(&c->input);
1003                 if (len > 0) {
1004                         /* Send some data for the other side over the secure connection. */
1005                         if (compat20) {
1006                                 if (len > c->remote_window)
1007                                         len = c->remote_window;
1008                                 if (len > c->remote_maxpacket)
1009                                         len = c->remote_maxpacket;
1010                         } else {
1011                                 if (packet_is_interactive()) {
1012                                         if (len > 1024)
1013                                                 len = 512;
1014                                 } else {
1015                                         /* Keep the packets at reasonable size. */
1016                                         if (len > packet_get_maxsize()/2)
1017                                                 len = packet_get_maxsize()/2;
1018                                 }
1019                         }
1020                         if (len > 0) {
1021                                 packet_start(compat20 ?
1022                                     SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
1023                                 packet_put_int(c->remote_id);
1024                                 packet_put_string(buffer_ptr(&c->input), len);
1025                                 packet_send();
1026                                 buffer_consume(&c->input, len);
1027                                 c->remote_window -= len;
1028                         }
1029                 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
1030                         if (compat13)
1031                                 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
1032                         /*
1033                          * input-buffer is empty and read-socket shutdown:
1034                          * tell peer, that we will not send more data: send IEOF
1035                          */
1036                         chan_ibuf_empty(c);
1037                 }
1038                 /* Send extended data, i.e. stderr */
1039                 if (compat20 &&
1040                     c->remote_window > 0 &&
1041                     (len = buffer_len(&c->extended)) > 0 &&
1042                     c->extended_usage == CHAN_EXTENDED_READ) {
1043                         if (len > c->remote_window)
1044                                 len = c->remote_window;
1045                         if (len > c->remote_maxpacket)
1046                                 len = c->remote_maxpacket;
1047                         packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
1048                         packet_put_int(c->remote_id);
1049                         packet_put_int(SSH2_EXTENDED_DATA_STDERR);
1050                         packet_put_string(buffer_ptr(&c->extended), len);
1051                         packet_send();
1052                         buffer_consume(&c->extended, len);
1053                         c->remote_window -= len;
1054                 }
1055         }
1056 }
1057
1058 /*
1059  * This is called when a packet of type CHANNEL_DATA has just been received.
1060  * The message type has already been consumed, but channel number and data is
1061  * still there.
1062  */
1063
1064 void
1065 channel_input_data(int type, int plen, void *ctxt)
1066 {
1067         int id;
1068         char *data;
1069         unsigned int data_len;
1070         Channel *c;
1071
1072         /* Get the channel number and verify it. */
1073         id = packet_get_int();
1074         c = channel_lookup(id);
1075         if (c == NULL)
1076                 packet_disconnect("Received data for nonexistent channel %d.", id);
1077
1078         /* Ignore any data for non-open channels (might happen on close) */
1079         if (c->type != SSH_CHANNEL_OPEN &&
1080             c->type != SSH_CHANNEL_X11_OPEN)
1081                 return;
1082
1083         /* same for protocol 1.5 if output end is no longer open */
1084         if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
1085                 return;
1086
1087         /* Get the data. */
1088         data = packet_get_string(&data_len);
1089         packet_done();
1090
1091         if (compat20){
1092                 if (data_len > c->local_maxpacket) {
1093                         log("channel %d: rcvd big packet %d, maxpack %d",
1094                             c->self, data_len, c->local_maxpacket);
1095                 }
1096                 if (data_len > c->local_window) {
1097                         log("channel %d: rcvd too much data %d, win %d",
1098                             c->self, data_len, c->local_window);
1099                         xfree(data);
1100                         return;
1101                 }
1102                 c->local_window -= data_len;
1103         }else{
1104                 packet_integrity_check(plen, 4 + 4 + data_len, type);
1105         }
1106         buffer_append(&c->output, data, data_len);
1107         xfree(data);
1108 }
1109 void
1110 channel_input_extended_data(int type, int plen, void *ctxt)
1111 {
1112         int id;
1113         int tcode;
1114         char *data;
1115         unsigned int data_len;
1116         Channel *c;
1117
1118         /* Get the channel number and verify it. */
1119         id = packet_get_int();
1120         c = channel_lookup(id);
1121
1122         if (c == NULL)
1123                 packet_disconnect("Received extended_data for bad channel %d.", id);
1124         if (c->type != SSH_CHANNEL_OPEN) {
1125                 log("channel %d: ext data for non open", id);
1126                 return;
1127         }
1128         tcode = packet_get_int();
1129         if (c->efd == -1 ||
1130             c->extended_usage != CHAN_EXTENDED_WRITE ||
1131             tcode != SSH2_EXTENDED_DATA_STDERR) {
1132                 log("channel %d: bad ext data", c->self);
1133                 return;
1134         }
1135         data = packet_get_string(&data_len);
1136         packet_done();
1137         if (data_len > c->local_window) {
1138                 log("channel %d: rcvd too much extended_data %d, win %d",
1139                     c->self, data_len, c->local_window);
1140                 xfree(data);
1141                 return;
1142         }
1143         debug2("channel %d: rcvd ext data %d", c->self, data_len);
1144         c->local_window -= data_len;
1145         buffer_append(&c->extended, data, data_len);
1146         xfree(data);
1147 }
1148
1149
1150 /*
1151  * Returns true if no channel has too much buffered data, and false if one or
1152  * more channel is overfull.
1153  */
1154
1155 int
1156 channel_not_very_much_buffered_data()
1157 {
1158         unsigned int i;
1159         Channel *c;
1160
1161         for (i = 0; i < channels_alloc; i++) {
1162                 c = &channels[i];
1163                 if (c->type == SSH_CHANNEL_OPEN) {
1164                         if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
1165                                 debug("channel %d: big input buffer %d",
1166                                     c->self, buffer_len(&c->input));
1167                                 return 0;
1168                         }
1169                         if (buffer_len(&c->output) > packet_get_maxsize()) {
1170                                 debug("channel %d: big output buffer %d",
1171                                     c->self, buffer_len(&c->output));
1172                                 return 0;
1173                         }
1174                 }
1175         }
1176         return 1;
1177 }
1178
1179 void
1180 channel_input_ieof(int type, int plen, void *ctxt)
1181 {
1182         int id;
1183         Channel *c;
1184
1185         packet_integrity_check(plen, 4, type);
1186
1187         id = packet_get_int();
1188         c = channel_lookup(id);
1189         if (c == NULL)
1190                 packet_disconnect("Received ieof for nonexistent channel %d.", id);
1191         chan_rcvd_ieof(c);
1192 }
1193
1194 void
1195 channel_input_close(int type, int plen, void *ctxt)
1196 {
1197         int id;
1198         Channel *c;
1199
1200         packet_integrity_check(plen, 4, type);
1201
1202         id = packet_get_int();
1203         c = channel_lookup(id);
1204         if (c == NULL)
1205                 packet_disconnect("Received close for nonexistent channel %d.", id);
1206
1207         /*
1208          * Send a confirmation that we have closed the channel and no more
1209          * data is coming for it.
1210          */
1211         packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
1212         packet_put_int(c->remote_id);
1213         packet_send();
1214
1215         /*
1216          * If the channel is in closed state, we have sent a close request,
1217          * and the other side will eventually respond with a confirmation.
1218          * Thus, we cannot free the channel here, because then there would be
1219          * no-one to receive the confirmation.  The channel gets freed when
1220          * the confirmation arrives.
1221          */
1222         if (c->type != SSH_CHANNEL_CLOSED) {
1223                 /*
1224                  * Not a closed channel - mark it as draining, which will
1225                  * cause it to be freed later.
1226                  */
1227                 buffer_consume(&c->input, buffer_len(&c->input));
1228                 c->type = SSH_CHANNEL_OUTPUT_DRAINING;
1229         }
1230 }
1231
1232 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
1233 void
1234 channel_input_oclose(int type, int plen, void *ctxt)
1235 {
1236         int id = packet_get_int();
1237         Channel *c = channel_lookup(id);
1238         packet_integrity_check(plen, 4, type);
1239         if (c == NULL)
1240                 packet_disconnect("Received oclose for nonexistent channel %d.", id);
1241         chan_rcvd_oclose(c);
1242 }
1243
1244 void
1245 channel_input_close_confirmation(int type, int plen, void *ctxt)
1246 {
1247         int id = packet_get_int();
1248         Channel *c = channel_lookup(id);
1249
1250         packet_done();
1251         if (c == NULL)
1252                 packet_disconnect("Received close confirmation for "
1253                     "out-of-range channel %d.", id);
1254         if (c->type != SSH_CHANNEL_CLOSED)
1255                 packet_disconnect("Received close confirmation for "
1256                     "non-closed channel %d (type %d).", id, c->type);
1257         channel_free(c->self);
1258 }
1259
1260 void
1261 channel_input_open_confirmation(int type, int plen, void *ctxt)
1262 {
1263         int id, remote_id;
1264         Channel *c;
1265
1266         if (!compat20)
1267                 packet_integrity_check(plen, 4 + 4, type);
1268
1269         id = packet_get_int();
1270         c = channel_lookup(id);
1271
1272         if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1273                 packet_disconnect("Received open confirmation for "
1274                     "non-opening channel %d.", id);
1275         remote_id = packet_get_int();
1276         /* Record the remote channel number and mark that the channel is now open. */
1277         c->remote_id = remote_id;
1278         c->type = SSH_CHANNEL_OPEN;
1279
1280         if (compat20) {
1281                 c->remote_window = packet_get_int();
1282                 c->remote_maxpacket = packet_get_int();
1283                 packet_done();
1284                 if (c->cb_fn != NULL && c->cb_event == type) {
1285                         debug2("callback start");
1286                         c->cb_fn(c->self, c->cb_arg);
1287                         debug2("callback done");
1288                 }
1289                 debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1290                     c->remote_window, c->remote_maxpacket);
1291         }
1292 }
1293
1294 void
1295 channel_input_open_failure(int type, int plen, void *ctxt)
1296 {
1297         int id;
1298         Channel *c;
1299
1300         if (!compat20)
1301                 packet_integrity_check(plen, 4, type);
1302
1303         id = packet_get_int();
1304         c = channel_lookup(id);
1305
1306         if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1307                 packet_disconnect("Received open failure for "
1308                     "non-opening channel %d.", id);
1309         if (compat20) {
1310                 int reason = packet_get_int();
1311                 char *msg  = packet_get_string(NULL);
1312                 char *lang  = packet_get_string(NULL);
1313                 log("channel_open_failure: %d: reason %d: %s", id, reason, msg);
1314                 packet_done();
1315                 xfree(msg);
1316                 xfree(lang);
1317         }
1318         /* Free the channel.  This will also close the socket. */
1319         channel_free(id);
1320 }
1321
1322 void
1323 channel_input_channel_request(int type, int plen, void *ctxt)
1324 {
1325         int id;
1326         Channel *c;
1327
1328         id = packet_get_int();
1329         c = channel_lookup(id);
1330
1331         if (c == NULL ||
1332             (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1333                 packet_disconnect("Received request for "
1334                     "non-open channel %d.", id);
1335         if (c->cb_fn != NULL && c->cb_event == type) {
1336                 debug2("callback start");
1337                 c->cb_fn(c->self, c->cb_arg);
1338                 debug2("callback done");
1339         } else {
1340                 char *service = packet_get_string(NULL);
1341                 debug("channel: %d rcvd request for %s", c->self, service);
1342                 debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
1343                 xfree(service);
1344         }
1345 }
1346
1347 void
1348 channel_input_window_adjust(int type, int plen, void *ctxt)
1349 {
1350         Channel *c;
1351         int id, adjust;
1352
1353         if (!compat20)
1354                 return;
1355
1356         /* Get the channel number and verify it. */
1357         id = packet_get_int();
1358         c = channel_lookup(id);
1359
1360         if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1361                 log("Received window adjust for "
1362                     "non-open channel %d.", id);
1363                 return;
1364         }
1365         adjust = packet_get_int();
1366         packet_done();
1367         debug2("channel %d: rcvd adjust %d", id, adjust);
1368         c->remote_window += adjust;
1369 }
1370
1371 /*
1372  * Stops listening for channels, and removes any unix domain sockets that we
1373  * might have.
1374  */
1375
1376 void
1377 channel_stop_listening()
1378 {
1379         int i;
1380         for (i = 0; i < channels_alloc; i++) {
1381                 switch (channels[i].type) {
1382                 case SSH_CHANNEL_AUTH_SOCKET:
1383                         close(channels[i].sock);
1384                         unlink(channels[i].path);
1385                         channel_free(i);
1386                         break;
1387                 case SSH_CHANNEL_PORT_LISTENER:
1388                 case SSH_CHANNEL_RPORT_LISTENER:
1389                 case SSH_CHANNEL_X11_LISTENER:
1390                         close(channels[i].sock);
1391                         channel_free(i);
1392                         break;
1393                 default:
1394                         break;
1395                 }
1396         }
1397 }
1398
1399 /*
1400  * Closes the sockets/fds of all channels.  This is used to close extra file
1401  * descriptors after a fork.
1402  */
1403
1404 void
1405 channel_close_all()
1406 {
1407         int i;
1408         for (i = 0; i < channels_alloc; i++)
1409                 if (channels[i].type != SSH_CHANNEL_FREE)
1410                         channel_close_fds(&channels[i]);
1411 }
1412
1413 /* Returns the maximum file descriptor number used by the channels. */
1414
1415 int
1416 channel_max_fd()
1417 {
1418         return channel_max_fd_value;
1419 }
1420
1421 /* Returns true if any channel is still open. */
1422
1423 int
1424 channel_still_open()
1425 {
1426         unsigned int i;
1427         for (i = 0; i < channels_alloc; i++)
1428                 switch (channels[i].type) {
1429                 case SSH_CHANNEL_FREE:
1430                 case SSH_CHANNEL_X11_LISTENER:
1431                 case SSH_CHANNEL_PORT_LISTENER:
1432                 case SSH_CHANNEL_RPORT_LISTENER:
1433                 case SSH_CHANNEL_CLOSED:
1434                 case SSH_CHANNEL_AUTH_SOCKET:
1435                 case SSH_CHANNEL_CONNECTING:    /* XXX ??? */
1436                         continue;
1437                 case SSH_CHANNEL_LARVAL:
1438                         if (!compat20)
1439                                 fatal("cannot happen: SSH_CHANNEL_LARVAL");
1440                         continue;
1441                 case SSH_CHANNEL_OPENING:
1442                 case SSH_CHANNEL_OPEN:
1443                 case SSH_CHANNEL_X11_OPEN:
1444                         return 1;
1445                 case SSH_CHANNEL_INPUT_DRAINING:
1446                 case SSH_CHANNEL_OUTPUT_DRAINING:
1447                         if (!compat13)
1448                                 fatal("cannot happen: OUT_DRAIN");
1449                         return 1;
1450                 default:
1451                         fatal("channel_still_open: bad channel type %d", channels[i].type);
1452                         /* NOTREACHED */
1453                 }
1454         return 0;
1455 }
1456
1457 /*
1458  * Returns a message describing the currently open forwarded connections,
1459  * suitable for sending to the client.  The message contains crlf pairs for
1460  * newlines.
1461  */
1462
1463 char *
1464 channel_open_message()
1465 {
1466         Buffer buffer;
1467         int i;
1468         char buf[512], *cp;
1469
1470         buffer_init(&buffer);
1471         snprintf(buf, sizeof buf, "The following connections are open:\r\n");
1472         buffer_append(&buffer, buf, strlen(buf));
1473         for (i = 0; i < channels_alloc; i++) {
1474                 Channel *c = &channels[i];
1475                 switch (c->type) {
1476                 case SSH_CHANNEL_FREE:
1477                 case SSH_CHANNEL_X11_LISTENER:
1478                 case SSH_CHANNEL_PORT_LISTENER:
1479                 case SSH_CHANNEL_RPORT_LISTENER:
1480                 case SSH_CHANNEL_CLOSED:
1481                 case SSH_CHANNEL_AUTH_SOCKET:
1482                         continue;
1483                 case SSH_CHANNEL_LARVAL:
1484                 case SSH_CHANNEL_OPENING:
1485                 case SSH_CHANNEL_CONNECTING:
1486                 case SSH_CHANNEL_OPEN:
1487                 case SSH_CHANNEL_X11_OPEN:
1488                 case SSH_CHANNEL_INPUT_DRAINING:
1489                 case SSH_CHANNEL_OUTPUT_DRAINING:
1490                         snprintf(buf, sizeof buf, "  #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
1491                             c->self, c->remote_name,
1492                             c->type, c->remote_id,
1493                             c->istate, buffer_len(&c->input),
1494                             c->ostate, buffer_len(&c->output),
1495                             c->rfd, c->wfd);
1496                         buffer_append(&buffer, buf, strlen(buf));
1497                         continue;
1498                 default:
1499                         fatal("channel_open_message: bad channel type %d", c->type);
1500                         /* NOTREACHED */
1501                 }
1502         }
1503         buffer_append(&buffer, "\0", 1);
1504         cp = xstrdup(buffer_ptr(&buffer));
1505         buffer_free(&buffer);
1506         return cp;
1507 }
1508
1509 /*
1510  * Initiate forwarding of connections to local port "port" through the secure
1511  * channel to host:port from remote side.
1512  */
1513 void
1514 channel_request_local_forwarding(u_short listen_port, const char *host_to_connect,
1515     u_short port_to_connect, int gateway_ports)
1516 {
1517         channel_request_forwarding(
1518             NULL, listen_port,
1519             host_to_connect, port_to_connect,
1520             gateway_ports, /*remote_fwd*/ 0);
1521 }
1522
1523 /*
1524  * If 'remote_fwd' is true we have a '-R style' listener for protocol 2
1525  * (SSH_CHANNEL_RPORT_LISTENER).
1526  */
1527 void
1528 channel_request_forwarding(
1529     const char *listen_address, u_short listen_port,
1530     const char *host_to_connect, u_short port_to_connect,
1531     int gateway_ports, int remote_fwd)
1532 {
1533         int success, ch, sock, on = 1, ctype;
1534         struct addrinfo hints, *ai, *aitop;
1535         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1536         const char *host;
1537         struct linger linger;
1538
1539         if (remote_fwd) {
1540                 host = listen_address;
1541                 ctype = SSH_CHANNEL_RPORT_LISTENER;
1542         } else {
1543                 host = host_to_connect;
1544                 ctype  =SSH_CHANNEL_PORT_LISTENER;
1545         }
1546
1547         if (strlen(host) > sizeof(channels[0].path) - 1)
1548                 packet_disconnect("Forward host name too long.");
1549
1550         /* XXX listen_address is currently ignored */
1551         /*
1552          * getaddrinfo returns a loopback address if the hostname is
1553          * set to NULL and hints.ai_flags is not AI_PASSIVE
1554          */
1555         memset(&hints, 0, sizeof(hints));
1556         hints.ai_family = IPv4or6;
1557         hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1558         hints.ai_socktype = SOCK_STREAM;
1559         snprintf(strport, sizeof strport, "%d", listen_port);
1560         if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1561                 packet_disconnect("getaddrinfo: fatal error");
1562
1563         success = 0;
1564         for (ai = aitop; ai; ai = ai->ai_next) {
1565                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1566                         continue;
1567                 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1568                     strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1569                         error("channel_request_forwarding: getnameinfo failed");
1570                         continue;
1571                 }
1572                 /* Create a port to listen for the host. */
1573                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1574                 if (sock < 0) {
1575                         /* this is no error since kernel may not support ipv6 */
1576                         verbose("socket: %.100s", strerror(errno));
1577                         continue;
1578                 }
1579                 /*
1580                  * Set socket options.  We would like the socket to disappear
1581                  * as soon as it has been closed for whatever reason.
1582                  */
1583                 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1584                 linger.l_onoff = 1;
1585                 linger.l_linger = 5;
1586                 setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1587                 debug("Local forwarding listening on %s port %s.", ntop, strport);
1588
1589                 /* Bind the socket to the address. */
1590                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1591                         /* address can be in use ipv6 address is already bound */
1592                         if (!ai->ai_next)
1593                                 error("bind: %.100s", strerror(errno));
1594                         else
1595                                 verbose("bind: %.100s", strerror(errno));
1596
1597                         close(sock);
1598                         continue;
1599                 }
1600                 /* Start listening for connections on the socket. */
1601                 if (listen(sock, 5) < 0) {
1602                         error("listen: %.100s", strerror(errno));
1603                         close(sock);
1604                         continue;
1605                 }
1606                 /* Allocate a channel number for the socket. */
1607                 ch = channel_new("port listener", ctype, sock, sock, -1,
1608                     CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1609                     0, xstrdup("port listener"), 1);
1610                 strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
1611                 channels[ch].host_port = port_to_connect;
1612                 channels[ch].listening_port = listen_port;
1613                 success = 1;
1614         }
1615         if (success == 0)
1616                 packet_disconnect("cannot listen port: %d", listen_port);       /*XXX ?disconnect? */
1617         freeaddrinfo(aitop);
1618 }
1619
1620 /*
1621  * Initiate forwarding of connections to port "port" on remote host through
1622  * the secure channel to host:port from local side.
1623  */
1624
1625 void
1626 channel_request_remote_forwarding(u_short listen_port,
1627     const char *host_to_connect, u_short port_to_connect)
1628 {
1629         int payload_len, type, success = 0;
1630
1631         /* Record locally that connection to this host/port is permitted. */
1632         if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1633                 fatal("channel_request_remote_forwarding: too many forwards");
1634
1635         /* Send the forward request to the remote side. */
1636         if (compat20) {
1637                 const char *address_to_bind = "0.0.0.0";
1638                 packet_start(SSH2_MSG_GLOBAL_REQUEST);
1639                 packet_put_cstring("tcpip-forward");
1640                 packet_put_char(0);                     /* boolean: want reply */
1641                 packet_put_cstring(address_to_bind);
1642                 packet_put_int(listen_port);
1643                 packet_send();
1644                 packet_write_wait();
1645                 /* Assume that server accepts the request */
1646                 success = 1;
1647         } else {
1648                 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
1649                 packet_put_int(listen_port);
1650                 packet_put_cstring(host_to_connect);
1651                 packet_put_int(port_to_connect);
1652                 packet_send();
1653                 packet_write_wait();
1654
1655                 /* Wait for response from the remote side. */
1656                 type = packet_read(&payload_len);
1657                 switch (type) {
1658                 case SSH_SMSG_SUCCESS:
1659                         success = 1;
1660                         break;
1661                 case SSH_SMSG_FAILURE:
1662                         log("Warning: Server denied remote port forwarding.");
1663                         break;
1664                 default:
1665                         /* Unknown packet */
1666                         packet_disconnect("Protocol error for port forward request:"
1667                             "received packet type %d.", type);
1668                 }
1669         }
1670         if (success) {
1671                 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
1672                 permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
1673                 permitted_opens[num_permitted_opens].listen_port = listen_port;
1674                 num_permitted_opens++;
1675         }
1676 }
1677
1678 /*
1679  * This is called after receiving CHANNEL_FORWARDING_REQUEST.  This initates
1680  * listening for the port, and sends back a success reply (or disconnect
1681  * message if there was an error).  This never returns if there was an error.
1682  */
1683
1684 void
1685 channel_input_port_forward_request(int is_root, int gateway_ports)
1686 {
1687         u_short port, host_port;
1688         char *hostname;
1689
1690         /* Get arguments from the packet. */
1691         port = packet_get_int();
1692         hostname = packet_get_string(NULL);
1693         host_port = packet_get_int();
1694
1695 #ifndef HAVE_CYGWIN
1696         /*
1697          * Check that an unprivileged user is not trying to forward a
1698          * privileged port.
1699          */
1700         if (port < IPPORT_RESERVED && !is_root)
1701                 packet_disconnect("Requested forwarding of port %d but user is not root.",
1702                                   port);
1703 #endif
1704         /* Initiate forwarding */
1705         channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
1706
1707         /* Free the argument string. */
1708         xfree(hostname);
1709 }
1710
1711 /* XXX move to aux.c */
1712 int
1713 channel_connect_to(const char *host, u_short host_port)
1714 {
1715         struct addrinfo hints, *ai, *aitop;
1716         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1717         int gaierr;
1718         int sock = -1;
1719
1720         memset(&hints, 0, sizeof(hints));
1721         hints.ai_family = IPv4or6;
1722         hints.ai_socktype = SOCK_STREAM;
1723         snprintf(strport, sizeof strport, "%d", host_port);
1724         if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1725                 error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
1726                 return -1;
1727         }
1728         for (ai = aitop; ai; ai = ai->ai_next) {
1729                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1730                         continue;
1731                 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1732                     strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1733                         error("channel_connect_to: getnameinfo failed");
1734                         continue;
1735                 }
1736                 /* Create the socket. */
1737                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1738                 if (sock < 0) {
1739                         error("socket: %.100s", strerror(errno));
1740                         continue;
1741                 }
1742                 if (fcntl(sock, F_SETFL, O_NDELAY) < 0)
1743                         fatal("connect_to: F_SETFL: %s", strerror(errno));
1744                 /* Connect to the host/port. */
1745                 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 &&
1746                     errno != EINPROGRESS) {
1747                         error("connect %.100s port %s: %.100s", ntop, strport,
1748                             strerror(errno));
1749                         close(sock);
1750                         continue;       /* fail -- try next */
1751                 }
1752                 break; /* success */
1753
1754         }
1755         freeaddrinfo(aitop);
1756         if (!ai) {
1757                 error("connect %.100s port %d: failed.", host, host_port);
1758                 return -1;
1759         }
1760         /* success */
1761         return sock;
1762 }
1763 int
1764 channel_connect_by_listen_adress(u_short listen_port)
1765 {
1766         int i;
1767         for (i = 0; i < num_permitted_opens; i++)
1768                 if (permitted_opens[i].listen_port == listen_port)
1769                         return channel_connect_to(
1770                             permitted_opens[i].host_to_connect,
1771                             permitted_opens[i].port_to_connect);
1772         error("WARNING: Server requests forwarding for unknown listen_port %d",
1773             listen_port);
1774         return -1;
1775 }
1776
1777 /*
1778  * This is called after receiving PORT_OPEN message.  This attempts to
1779  * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1780  * or CHANNEL_OPEN_FAILURE.
1781  */
1782
1783 void
1784 channel_input_port_open(int type, int plen, void *ctxt)
1785 {
1786         u_short host_port;
1787         char *host, *originator_string;
1788         int remote_channel, sock = -1, newch, i, denied;
1789         unsigned int host_len, originator_len;
1790
1791         /* Get remote channel number. */
1792         remote_channel = packet_get_int();
1793
1794         /* Get host name to connect to. */
1795         host = packet_get_string(&host_len);
1796
1797         /* Get port to connect to. */
1798         host_port = packet_get_int();
1799
1800         /* Get remote originator name. */
1801         if (have_hostname_in_open) {
1802                 originator_string = packet_get_string(&originator_len);
1803                 originator_len += 4;    /* size of packet_int */
1804         } else {
1805                 originator_string = xstrdup("unknown (remote did not supply name)");
1806                 originator_len = 0;     /* no originator supplied */
1807         }
1808
1809         packet_integrity_check(plen,
1810             4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
1811
1812         /* Check if opening that port is permitted. */
1813         denied = 0;
1814         if (!all_opens_permitted) {
1815                 /* Go trough all permitted ports. */
1816                 for (i = 0; i < num_permitted_opens; i++)
1817                         if (permitted_opens[i].port_to_connect == host_port &&
1818                             strcmp(permitted_opens[i].host_to_connect, host) == 0)
1819                                 break;
1820
1821                 /* Check if we found the requested port among those permitted. */
1822                 if (i >= num_permitted_opens) {
1823                         /* The port is not permitted. */
1824                         log("Received request to connect to %.100s:%d, but the request was denied.",
1825                             host, host_port);
1826                         denied = 1;
1827                 }
1828         }
1829         sock = denied ? -1 : channel_connect_to(host, host_port);
1830         if (sock > 0) {
1831                 /* Allocate a channel for this connection. */
1832                 newch = channel_allocate(SSH_CHANNEL_CONNECTING,
1833                     sock, originator_string);
1834 /*XXX delay answer? */
1835                 channels[newch].remote_id = remote_channel;
1836
1837                 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1838                 packet_put_int(remote_channel);
1839                 packet_put_int(newch);
1840                 packet_send();
1841         } else {
1842                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1843                 packet_put_int(remote_channel);
1844                 packet_send();
1845         }
1846         xfree(host);
1847 }
1848
1849 /*
1850  * Creates an internet domain socket for listening for X11 connections.
1851  * Returns a suitable value for the DISPLAY variable, or NULL if an error
1852  * occurs.
1853  */
1854
1855 #define NUM_SOCKS       10
1856
1857 char *
1858 x11_create_display_inet(int screen_number, int x11_display_offset)
1859 {
1860         int display_number, sock;
1861         u_short port;
1862         struct addrinfo hints, *ai, *aitop;
1863         char strport[NI_MAXSERV];
1864         int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1865         char display[512];
1866         char hostname[MAXHOSTNAMELEN];
1867
1868         for (display_number = x11_display_offset;
1869              display_number < MAX_DISPLAYS;
1870              display_number++) {
1871                 port = 6000 + display_number;
1872                 memset(&hints, 0, sizeof(hints));
1873                 hints.ai_family = IPv4or6;
1874                 hints.ai_flags = AI_PASSIVE;            /* XXX loopback only ? */
1875                 hints.ai_socktype = SOCK_STREAM;
1876                 snprintf(strport, sizeof strport, "%d", port);
1877                 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1878                         error("getaddrinfo: %.100s", gai_strerror(gaierr));
1879                         return NULL;
1880                 }
1881                 for (ai = aitop; ai; ai = ai->ai_next) {
1882                         if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1883                                 continue;
1884                         sock = socket(ai->ai_family, SOCK_STREAM, 0);
1885                         if (sock < 0) {
1886                                 if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) {
1887                                         error("socket: %.100s", strerror(errno));
1888                                         return NULL;
1889                                 } else {
1890                                         debug("x11_create_display_inet: Socket family %d not supported",
1891                                                  ai->ai_family);
1892                                         continue;
1893                                 }
1894                         }
1895                         if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1896                                 debug("bind port %d: %.100s", port, strerror(errno));
1897                                 shutdown(sock, SHUT_RDWR);
1898                                 close(sock);
1899
1900                                 if (ai->ai_next)
1901                                         continue;
1902
1903                                 for (n = 0; n < num_socks; n++) {
1904                                         shutdown(socks[n], SHUT_RDWR);
1905                                         close(socks[n]);
1906                                 }
1907                                 num_socks = 0;
1908                                 break;
1909                         }
1910                         socks[num_socks++] = sock;
1911 #ifndef DONT_TRY_OTHER_AF
1912                         if (num_socks == NUM_SOCKS)
1913                                 break;
1914 #else
1915                         break;
1916 #endif
1917                 }
1918                 if (num_socks > 0)
1919                         break;
1920         }
1921         if (display_number >= MAX_DISPLAYS) {
1922                 error("Failed to allocate internet-domain X11 display socket.");
1923                 return NULL;
1924         }
1925         /* Start listening for connections on the socket. */
1926         for (n = 0; n < num_socks; n++) {
1927                 sock = socks[n];
1928                 if (listen(sock, 5) < 0) {
1929                         error("listen: %.100s", strerror(errno));
1930                         shutdown(sock, SHUT_RDWR);
1931                         close(sock);
1932                         return NULL;
1933                 }
1934         }
1935
1936         /* Set up a suitable value for the DISPLAY variable. */
1937
1938         if (gethostname(hostname, sizeof(hostname)) < 0)
1939                 fatal("gethostname: %.100s", strerror(errno));
1940
1941 #ifdef IPADDR_IN_DISPLAY
1942         /*
1943          * HPUX detects the local hostname in the DISPLAY variable and tries
1944          * to set up a shared memory connection to the server, which it
1945          * incorrectly supposes to be local.
1946          *
1947          * The workaround - as used in later $$H and other programs - is
1948          * is to set display to the host's IP address.
1949          */
1950         {
1951                 struct hostent *he;
1952                 struct in_addr my_addr;
1953
1954                 he = gethostbyname(hostname);
1955                 if (he == NULL) {
1956                         error("[X11-broken-fwd-hostname-workaround] Could not get "
1957                                 "IP address for hostname %s.", hostname);
1958
1959                         packet_send_debug("[X11-broken-fwd-hostname-workaround]"
1960                                 "Could not get IP address for hostname %s.", hostname);
1961
1962                         shutdown(sock, SHUT_RDWR);
1963                         close(sock);
1964
1965                         return NULL;
1966                 }
1967
1968                 memcpy(&my_addr, he->h_addr_list[0], sizeof(struct in_addr));
1969
1970                 /* Set DISPLAY to <ip address>:screen.display */
1971                 snprintf(display, sizeof(display), "%.50s:%d.%d", inet_ntoa(my_addr),
1972                         display_number, screen_number);
1973         }
1974 #else /* IPADDR_IN_DISPLAY */
1975         /* Just set DISPLAY to hostname:screen.display */
1976         snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
1977                 display_number, screen_number);
1978 #endif /* IPADDR_IN_DISPLAY */
1979
1980         /* Allocate a channel for each socket. */
1981         for (n = 0; n < num_socks; n++) {
1982                 sock = socks[n];
1983                 (void) channel_new("x11 listener",
1984                     SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
1985                     CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
1986                     0, xstrdup("X11 inet listener"), 1);
1987         }
1988
1989         /* Return a suitable value for the DISPLAY environment variable. */
1990         return xstrdup(display);
1991 }
1992
1993 #ifndef X_UNIX_PATH
1994 #define X_UNIX_PATH "/tmp/.X11-unix/X"
1995 #endif
1996
1997 static
1998 int
1999 connect_local_xsocket(unsigned int dnr)
2000 {
2001         static const char *const x_sockets[] = {
2002                 X_UNIX_PATH "%u",
2003                 "/var/X/.X11-unix/X" "%u",
2004                 "/usr/spool/sockets/X11/" "%u",
2005                 NULL
2006         };
2007         int sock;
2008         struct sockaddr_un addr;
2009         const char *const * path;
2010
2011         for (path = x_sockets; *path; ++path) {
2012                 sock = socket(AF_UNIX, SOCK_STREAM, 0);
2013                 if (sock < 0)
2014                         error("socket: %.100s", strerror(errno));
2015                 memset(&addr, 0, sizeof(addr));
2016                 addr.sun_family = AF_UNIX;
2017                 snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
2018                 if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
2019                         return sock;
2020                 close(sock);
2021         }
2022         error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
2023         return -1;
2024 }
2025
2026 int
2027 x11_connect_display(void)
2028 {
2029         int display_number, sock = 0;
2030         const char *display;
2031         char buf[1024], *cp;
2032         struct addrinfo hints, *ai, *aitop;
2033         char strport[NI_MAXSERV];
2034         int gaierr;
2035
2036         /* Try to open a socket for the local X server. */
2037         display = getenv("DISPLAY");
2038         if (!display) {
2039                 error("DISPLAY not set.");
2040                 return -1;
2041         }
2042         /*
2043          * Now we decode the value of the DISPLAY variable and make a
2044          * connection to the real X server.
2045          */
2046
2047         /*
2048          * Check if it is a unix domain socket.  Unix domain displays are in
2049          * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
2050          */
2051         if (strncmp(display, "unix:", 5) == 0 ||
2052             display[0] == ':') {
2053                 /* Connect to the unix domain socket. */
2054                 if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
2055                         error("Could not parse display number from DISPLAY: %.100s",
2056                               display);
2057                         return -1;
2058                 }
2059                 /* Create a socket. */
2060                 sock = connect_local_xsocket(display_number);
2061                 if (sock < 0)
2062                         return -1;
2063
2064                 /* OK, we now have a connection to the display. */
2065                 return sock;
2066         }
2067         /*
2068          * Connect to an inet socket.  The DISPLAY value is supposedly
2069          * hostname:d[.s], where hostname may also be numeric IP address.
2070          */
2071         strncpy(buf, display, sizeof(buf));
2072         buf[sizeof(buf) - 1] = 0;
2073         cp = strchr(buf, ':');
2074         if (!cp) {
2075                 error("Could not find ':' in DISPLAY: %.100s", display);
2076                 return -1;
2077         }
2078         *cp = 0;
2079         /* buf now contains the host name.  But first we parse the display number. */
2080         if (sscanf(cp + 1, "%d", &display_number) != 1) {
2081                 error("Could not parse display number from DISPLAY: %.100s",
2082                       display);
2083                 return -1;
2084         }
2085
2086         /* Look up the host address */
2087         memset(&hints, 0, sizeof(hints));
2088         hints.ai_family = IPv4or6;
2089         hints.ai_socktype = SOCK_STREAM;
2090         snprintf(strport, sizeof strport, "%d", 6000 + display_number);
2091         if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
2092                 error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
2093                 return -1;
2094         }
2095         for (ai = aitop; ai; ai = ai->ai_next) {
2096                 /* Create a socket. */
2097                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
2098                 if (sock < 0) {
2099                         debug("socket: %.100s", strerror(errno));
2100                         continue;
2101                 }
2102                 /* Connect it to the display. */
2103                 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2104                         debug("connect %.100s port %d: %.100s", buf,
2105                             6000 + display_number, strerror(errno));
2106                         close(sock);
2107                         continue;
2108                 }
2109                 /* Success */
2110                 break;
2111         }
2112         freeaddrinfo(aitop);
2113         if (!ai) {
2114                 error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
2115                     strerror(errno));
2116                 return -1;
2117         }
2118         return sock;
2119 }
2120
2121 /*
2122  * This is called when SSH_SMSG_X11_OPEN is received.  The packet contains
2123  * the remote channel number.  We should do whatever we want, and respond
2124  * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
2125  */
2126
2127 void
2128 x11_input_open(int type, int plen, void *ctxt)
2129 {
2130         int remote_channel, sock = 0, newch;
2131         char *remote_host;
2132         unsigned int remote_len;
2133
2134         /* Get remote channel number. */
2135         remote_channel = packet_get_int();
2136
2137         /* Get remote originator name. */
2138         if (have_hostname_in_open) {
2139                 remote_host = packet_get_string(&remote_len);
2140                 remote_len += 4;
2141         } else {
2142                 remote_host = xstrdup("unknown (remote did not supply name)");
2143                 remote_len = 0;
2144         }
2145
2146         debug("Received X11 open request.");
2147         packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
2148
2149         /* Obtain a connection to the real X display. */
2150         sock = x11_connect_display();
2151         if (sock == -1) {
2152                 /* Send refusal to the remote host. */
2153                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2154                 packet_put_int(remote_channel);
2155                 packet_send();
2156         } else {
2157                 /* Allocate a channel for this connection. */
2158                 newch = channel_allocate(
2159                      (x11_saved_proto == NULL) ?
2160                      SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
2161                      sock, remote_host);
2162                 channels[newch].remote_id = remote_channel;
2163
2164                 /* Send a confirmation to the remote host. */
2165                 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2166                 packet_put_int(remote_channel);
2167                 packet_put_int(newch);
2168                 packet_send();
2169         }
2170 }
2171
2172 /* dummy protocol handler that denies SSH-1 requests (agent/x11) */
2173 void
2174 deny_input_open(int type, int plen, void *ctxt)
2175 {
2176         int rchan = packet_get_int();
2177         switch(type){
2178         case SSH_SMSG_AGENT_OPEN:
2179                 error("Warning: ssh server tried agent forwarding.");
2180                 break;
2181         case SSH_SMSG_X11_OPEN:
2182                 error("Warning: ssh server tried X11 forwarding.");
2183                 break;
2184         default:
2185                 error("deny_input_open: type %d plen %d", type, plen);
2186                 break;
2187         }
2188         error("Warning: this is probably a break in attempt by a malicious server.");
2189         packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2190         packet_put_int(rchan);
2191         packet_send();
2192 }
2193
2194 /*
2195  * Requests forwarding of X11 connections, generates fake authentication
2196  * data, and enables authentication spoofing.
2197  */
2198
2199 void
2200 x11_request_forwarding_with_spoofing(int client_session_id,
2201     const char *proto, const char *data)
2202 {
2203         unsigned int data_len = (unsigned int) strlen(data) / 2;
2204         unsigned int i, value;
2205         char *new_data;
2206         int screen_number;
2207         const char *cp;
2208         u_int32_t rand = 0;
2209
2210         cp = getenv("DISPLAY");
2211         if (cp)
2212                 cp = strchr(cp, ':');
2213         if (cp)
2214                 cp = strchr(cp, '.');
2215         if (cp)
2216                 screen_number = atoi(cp + 1);
2217         else
2218                 screen_number = 0;
2219
2220         /* Save protocol name. */
2221         x11_saved_proto = xstrdup(proto);
2222
2223         /*
2224          * Extract real authentication data and generate fake data of the
2225          * same length.
2226          */
2227         x11_saved_data = xmalloc(data_len);
2228         x11_fake_data = xmalloc(data_len);
2229         for (i = 0; i < data_len; i++) {
2230                 if (sscanf(data + 2 * i, "%2x", &value) != 1)
2231                         fatal("x11_request_forwarding: bad authentication data: %.100s", data);
2232                 if (i % 4 == 0)
2233                         rand = arc4random();
2234                 x11_saved_data[i] = value;
2235                 x11_fake_data[i] = rand & 0xff;
2236                 rand >>= 8;
2237         }
2238         x11_saved_data_len = data_len;
2239         x11_fake_data_len = data_len;
2240
2241         /* Convert the fake data into hex. */
2242         new_data = xmalloc(2 * data_len + 1);
2243         for (i = 0; i < data_len; i++)
2244                 sprintf(new_data + 2 * i, "%02x", (unsigned char) x11_fake_data[i]);
2245
2246         /* Send the request packet. */
2247         if (compat20) {
2248                 channel_request_start(client_session_id, "x11-req", 0);
2249                 packet_put_char(0);     /* XXX bool single connection */
2250         } else {
2251                 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2252         }
2253         packet_put_cstring(proto);
2254         packet_put_cstring(new_data);
2255         packet_put_int(screen_number);
2256         packet_send();
2257         packet_write_wait();
2258         xfree(new_data);
2259 }
2260
2261 /* Sends a message to the server to request authentication fd forwarding. */
2262
2263 void
2264 auth_request_forwarding()
2265 {
2266         packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2267         packet_send();
2268         packet_write_wait();
2269 }
2270
2271 /*
2272  * Returns the name of the forwarded authentication socket.  Returns NULL if
2273  * there is no forwarded authentication socket.  The returned value points to
2274  * a static buffer.
2275  */
2276
2277 char *
2278 auth_get_socket_name()
2279 {
2280         return channel_forwarded_auth_socket_name;
2281 }
2282
2283 /* removes the agent forwarding socket */
2284
2285 void
2286 cleanup_socket(void)
2287 {
2288         unlink(channel_forwarded_auth_socket_name);
2289         rmdir(channel_forwarded_auth_socket_dir);
2290 }
2291
2292 /*
2293  * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
2294  * This starts forwarding authentication requests.
2295  */
2296
2297 int
2298 auth_input_request_forwarding(struct passwd * pw)
2299 {
2300         int sock, newch;
2301         struct sockaddr_un sunaddr;
2302
2303         if (auth_get_socket_name() != NULL)
2304                 fatal("Protocol error: authentication forwarding requested twice.");
2305
2306         /* Temporarily drop privileged uid for mkdir/bind. */
2307         temporarily_use_uid(pw->pw_uid);
2308
2309         /* Allocate a buffer for the socket name, and format the name. */
2310         channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2311         channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2312         strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
2313
2314         /* Create private directory for socket */
2315         if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {
2316                 packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",
2317                     strerror(errno));
2318                 restore_uid();
2319                 xfree(channel_forwarded_auth_socket_name);
2320                 xfree(channel_forwarded_auth_socket_dir);
2321                 channel_forwarded_auth_socket_name = NULL;
2322                 channel_forwarded_auth_socket_dir = NULL;
2323                 return 0;
2324         }
2325         snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2326                  channel_forwarded_auth_socket_dir, (int) getpid());
2327
2328         if (atexit(cleanup_socket) < 0) {
2329                 int saved = errno;
2330                 cleanup_socket();
2331                 packet_disconnect("socket: %.100s", strerror(saved));
2332         }
2333         /* Create the socket. */
2334         sock = socket(AF_UNIX, SOCK_STREAM, 0);
2335         if (sock < 0)
2336                 packet_disconnect("socket: %.100s", strerror(errno));
2337
2338         /* Bind it to the name. */
2339         memset(&sunaddr, 0, sizeof(sunaddr));
2340         sunaddr.sun_family = AF_UNIX;
2341         strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2342                 sizeof(sunaddr.sun_path));
2343
2344         if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2345                 packet_disconnect("bind: %.100s", strerror(errno));
2346
2347         /* Restore the privileged uid. */
2348         restore_uid();
2349
2350         /* Start listening on the socket. */
2351         if (listen(sock, 5) < 0)
2352                 packet_disconnect("listen: %.100s", strerror(errno));
2353
2354         /* Allocate a channel for the authentication agent socket. */
2355         newch = channel_new("auth socket",
2356             SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
2357             CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
2358             0, xstrdup("auth socket"), 1);
2359
2360         strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2361             sizeof(channels[newch].path));
2362         return 1;
2363 }
2364
2365 /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2366
2367 void
2368 auth_input_open_request(int type, int plen, void *ctxt)
2369 {
2370         int remch, sock, newch;
2371         char *dummyname;
2372
2373         packet_integrity_check(plen, 4, type);
2374
2375         /* Read the remote channel number from the message. */
2376         remch = packet_get_int();
2377
2378         /*
2379          * Get a connection to the local authentication agent (this may again
2380          * get forwarded).
2381          */
2382         sock = ssh_get_authentication_socket();
2383
2384         /*
2385          * If we could not connect the agent, send an error message back to
2386          * the server. This should never happen unless the agent dies,
2387          * because authentication forwarding is only enabled if we have an
2388          * agent.
2389          */
2390         if (sock < 0) {
2391                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2392                 packet_put_int(remch);
2393                 packet_send();
2394                 return;
2395         }
2396         debug("Forwarding authentication connection.");
2397
2398         /*
2399          * Dummy host name.  This will be freed when the channel is freed; it
2400          * will still be valid in the packet_put_string below since the
2401          * channel cannot yet be freed at that point.
2402          */
2403         dummyname = xstrdup("authentication agent connection");
2404
2405         newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2406         channels[newch].remote_id = remch;
2407
2408         /* Send a confirmation to the remote host. */
2409         packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2410         packet_put_int(remch);
2411         packet_put_int(newch);
2412         packet_send();
2413 }
2414
2415 void
2416 channel_start_open(int id)
2417 {
2418         Channel *c = channel_lookup(id);
2419         if (c == NULL) {
2420                 log("channel_open: %d: bad id", id);
2421                 return;
2422         }
2423         debug("send channel open %d", id);
2424         packet_start(SSH2_MSG_CHANNEL_OPEN);
2425         packet_put_cstring(c->ctype);
2426         packet_put_int(c->self);
2427         packet_put_int(c->local_window);
2428         packet_put_int(c->local_maxpacket);
2429 }
2430 void
2431 channel_open(int id)
2432 {
2433         /* XXX REMOVE ME */
2434         channel_start_open(id);
2435         packet_send();
2436 }
2437 void
2438 channel_request(int id, char *service, int wantconfirm)
2439 {
2440         channel_request_start(id, service, wantconfirm);
2441         packet_send();
2442         debug("channel request %d: %s", id, service) ;
2443 }
2444 void
2445 channel_request_start(int id, char *service, int wantconfirm)
2446 {
2447         Channel *c = channel_lookup(id);
2448         if (c == NULL) {
2449                 log("channel_request: %d: bad id", id);
2450                 return;
2451         }
2452         packet_start(SSH2_MSG_CHANNEL_REQUEST);
2453         packet_put_int(c->remote_id);
2454         packet_put_cstring(service);
2455         packet_put_char(wantconfirm);
2456 }
2457 void
2458 channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2459 {
2460         Channel *c = channel_lookup(id);
2461         if (c == NULL) {
2462                 log("channel_register_callback: %d: bad id", id);
2463                 return;
2464         }
2465         c->cb_event = mtype;
2466         c->cb_fn = fn;
2467         c->cb_arg = arg;
2468 }
2469 void
2470 channel_register_cleanup(int id, channel_callback_fn *fn)
2471 {
2472         Channel *c = channel_lookup(id);
2473         if (c == NULL) {
2474                 log("channel_register_cleanup: %d: bad id", id);
2475                 return;
2476         }
2477         c->dettach_user = fn;
2478 }
2479 void
2480 channel_cancel_cleanup(int id)
2481 {
2482         Channel *c = channel_lookup(id);
2483         if (c == NULL) {
2484                 log("channel_cancel_cleanup: %d: bad id", id);
2485                 return;
2486         }
2487         c->dettach_user = NULL;
2488 }
2489 void
2490 channel_register_filter(int id, channel_filter_fn *fn)
2491 {
2492         Channel *c = channel_lookup(id);
2493         if (c == NULL) {
2494                 log("channel_register_filter: %d: bad id", id);
2495                 return;
2496         }
2497         c->input_filter = fn;
2498 }
2499
2500 void
2501 channel_set_fds(int id, int rfd, int wfd, int efd,
2502     int extusage, int nonblock)
2503 {
2504         Channel *c = channel_lookup(id);
2505         if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2506                 fatal("channel_activate for non-larval channel %d.", id);
2507         channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
2508         c->type = SSH_CHANNEL_OPEN;
2509         /* XXX window size? */
2510         c->local_window = c->local_window_max = c->local_maxpacket * 2;
2511         packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2512         packet_put_int(c->remote_id);
2513         packet_put_int(c->local_window);
2514         packet_send();
2515 }