channels.c

   1 /*
   2  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   3  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   4  *                    All rights reserved
   5  * This file contains functions for generic socket connection forwarding.
   6  * There is also code for initiating connection forwarding for X11 connections,
   7  * arbitrary tcp/ip connections, and the authentication agent connection.
   8  *
   9  * As far as I am concerned, the code I have written for this software
  10  * can be used freely for any purpose.  Any derived versions of this
  11  * software must be clearly marked as such, and if the derived work is
  12  * incompatible with the protocol description in the RFC file, it must be
  13  * called by a name other than "ssh" or "Secure Shell".
  14  *
  15  *
  16  * SSH2 support added by Markus Friedl.
  17  * Copyright (c) 1999,2000 Markus Friedl.  All rights reserved.
  18  * Copyright (c) 1999 Dug Song.  All rights reserved.
  19  * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
  20  *
  21  * Redistribution and use in source and binary forms, with or without
  22  * modification, are permitted provided that the following conditions
  23  * are met:
  24  * 1. Redistributions of source code must retain the above copyright
  25  *    notice, this list of conditions and the following disclaimer.
  26  * 2. Redistributions in binary form must reproduce the above copyright
  27  *    notice, this list of conditions and the following disclaimer in the
  28  *    documentation and/or other materials provided with the distribution.
  29  *
  30  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  31  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  32  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  33  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  34  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  35  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  36  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  37  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  38  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  39  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  40  */
  41
  42 #include "includes.h"
  43 RCSID("$OpenBSD: channels.c,v 1.83 2001/01/24 21:03:50 stevesk Exp $");
  44
  45 #include <openssl/rsa.h>
  46 #include <openssl/dsa.h>
  47
  48 #include "ssh.h"
  49 #include "ssh1.h"
  50 #include "ssh2.h"
  51 #include "packet.h"
  52 #include "xmalloc.h"
  53 #include "buffer.h"
  54 #include "uidswap.h"
  55 #include "log.h"
  56 #include "misc.h"
  57 #include "channels.h"
  58 #include "nchan.h"
  59 #include "compat.h"
  60 #include "canohost.h"
  61 #include "key.h"
  62 #include "authfd.h"
  63
  64 /* Maximum number of fake X11 displays to try. */
  65 #define MAX_DISPLAYS  1000
  66
  67 /* Max len of agent socket */
  68 #define MAX_SOCKET_NAME 100
  69
  70 /*
  71  * Pointer to an array containing all allocated channels.  The array is
  72  * dynamically extended as needed.
  73  */
  74 static Channel *channels = NULL;
  75
  76 /*
  77  * Size of the channel array.  All slots of the array must always be
  78  * initialized (at least the type field); unused slots are marked with type
  79  * SSH_CHANNEL_FREE.
  80  */
  81 static int channels_alloc = 0;
  82
  83 /*
  84  * Maximum file descriptor value used in any of the channels.  This is
  85  * updated in channel_allocate.
  86  */
  87 static int channel_max_fd_value = 0;
  88
  89 /* Name and directory of socket for authentication agent forwarding. */
  90 static char *channel_forwarded_auth_socket_name = NULL;
  91 static char *channel_forwarded_auth_socket_dir = NULL;
  92
  93 /* Saved X11 authentication protocol name. */
  94 char *x11_saved_proto = NULL;
  95
  96 /* Saved X11 authentication data.  This is the real data. */
  97 char *x11_saved_data = NULL;
  98 u_int x11_saved_data_len = 0;
  99
 100 /*
 101  * Fake X11 authentication data.  This is what the server will be sending us;
 102  * we should replace any occurrences of this by the real data.
 103  */
 104 char *x11_fake_data = NULL;
 105 u_int x11_fake_data_len;
 106
 107 /*
 108  * Data structure for storing which hosts are permitted for forward requests.
 109  * The local sides of any remote forwards are stored in this array to prevent
 110  * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
 111  * network (which might be behind a firewall).
 112  */
 113 typedef struct {
 114         char *host_to_connect;          /* Connect to 'host'. */
 115         u_short port_to_connect;        /* Connect to 'port'. */
 116         u_short listen_port;            /* Remote side should listen port number. */
 117 } ForwardPermission;
 118
 119 /* List of all permitted host/port pairs to connect. */
 120 static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
 121 /* Number of permitted host/port pairs in the array. */
 122 static int num_permitted_opens = 0;
 123 /*
 124  * If this is true, all opens are permitted.  This is the case on the server
 125  * on which we have to trust the client anyway, and the user could do
 126  * anything after logging in anyway.
 127  */
 128 static int all_opens_permitted = 0;
 129
 130 /* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
 131 static int have_hostname_in_open = 0;
 132
 133 /* AF_UNSPEC or AF_INET or AF_INET6 */
 134 extern int IPv4or6;
 135
 136 /* Sets specific protocol options. */
 137
 138 void
 139 channel_set_options(int hostname_in_open)
 140 {
 141         have_hostname_in_open = hostname_in_open;
 142 }
 143
 144 /*
 145  * Permits opening to any host/port in SSH_MSG_PORT_OPEN.  This is usually
 146  * called by the server, because the user could connect to any port anyway,
 147  * and the server has no way to know but to trust the client anyway.
 148  */
 149
 150 void
 151 channel_permit_all_opens()
 152 {
 153         all_opens_permitted = 1;
 154 }
 155
 156 /* lookup channel by id */
 157
 158 Channel *
 159 channel_lookup(int id)
 160 {
 161         Channel *c;
 162         if (id < 0 || id > channels_alloc) {
 163                 log("channel_lookup: %d: bad id", id);
 164                 return NULL;
 165         }
 166         c = &channels[id];
 167         if (c->type == SSH_CHANNEL_FREE) {
 168                 log("channel_lookup: %d: bad id: channel free", id);
 169                 return NULL;
 170         }
 171         return c;
 172 }
 173
 174 /*
 175  * Register filedescriptors for a channel, used when allocating a channel or
 176  * when the channel consumer/producer is ready, e.g. shell exec'd
 177  */
 178
 179 void
 180 channel_register_fds(Channel *c, int rfd, int wfd, int efd,
 181     int extusage, int nonblock)
 182 {
 183         /* Update the maximum file descriptor value. */
 184         if (rfd > channel_max_fd_value)
 185                 channel_max_fd_value = rfd;
 186         if (wfd > channel_max_fd_value)
 187                 channel_max_fd_value = wfd;
 188         if (efd > channel_max_fd_value)
 189                 channel_max_fd_value = efd;
 190         /* XXX set close-on-exec -markus */
 191
 192         c->rfd = rfd;
 193         c->wfd = wfd;
 194         c->sock = (rfd == wfd) ? rfd : -1;
 195         c->efd = efd;
 196         c->extended_usage = extusage;
 197
 198         /* enable nonblocking mode */
 199         if (nonblock) {
 200                 if (rfd != -1)
 201                         set_nonblock(rfd);
 202                 if (wfd != -1)
 203                         set_nonblock(wfd);
 204                 if (efd != -1)
 205                         set_nonblock(efd);
 206         }
 207 }
 208
 209 /*
 210  * Allocate a new channel object and set its type and socket. This will cause
 211  * remote_name to be freed.
 212  */
 213
 214 int
 215 channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 216     int window, int maxpack, int extusage, char *remote_name, int nonblock)
 217 {
 218         int i, found;
 219         Channel *c;
 220
 221         /* Do initial allocation if this is the first call. */
 222         if (channels_alloc == 0) {
 223                 chan_init();
 224                 channels_alloc = 10;
 225                 channels = xmalloc(channels_alloc * sizeof(Channel));
 226                 for (i = 0; i < channels_alloc; i++)
 227                         channels[i].type = SSH_CHANNEL_FREE;
 228                 /*
 229                  * Kludge: arrange a call to channel_stop_listening if we
 230                  * terminate with fatal().
 231                  */
 232                 fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
 233         }
 234         /* Try to find a free slot where to put the new channel. */
 235         for (found = -1, i = 0; i < channels_alloc; i++)
 236                 if (channels[i].type == SSH_CHANNEL_FREE) {
 237                         /* Found a free slot. */
 238                         found = i;
 239                         break;
 240                 }
 241         if (found == -1) {
 242                 /* There are no free slots.  Take last+1 slot and expand the array.  */
 243                 found = channels_alloc;
 244                 channels_alloc += 10;
 245                 debug2("channel: expanding %d", channels_alloc);
 246                 channels = xrealloc(channels, channels_alloc * sizeof(Channel));
 247                 for (i = found; i < channels_alloc; i++)
 248                         channels[i].type = SSH_CHANNEL_FREE;
 249         }
 250         /* Initialize and return new channel number. */
 251         c = &channels[found];
 252         buffer_init(&c->input);
 253         buffer_init(&c->output);
 254         buffer_init(&c->extended);
 255         chan_init_iostates(c);
 256         channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
 257         c->self = found;
 258         c->type = type;
 259         c->ctype = ctype;
 260         c->local_window = window;
 261         c->local_window_max = window;
 262         c->local_consumed = 0;
 263         c->local_maxpacket = maxpack;
 264         c->remote_id = -1;
 265         c->remote_name = remote_name;
 266         c->remote_window = 0;
 267         c->remote_maxpacket = 0;
 268         c->cb_fn = NULL;
 269         c->cb_arg = NULL;
 270         c->cb_event = 0;
 271         c->dettach_user = NULL;
 272         c->input_filter = NULL;
 273         debug("channel %d: new [%s]", found, remote_name);
 274         return found;
 275 }
 276 /* old interface XXX */
 277 int
 278 channel_allocate(int type, int sock, char *remote_name)
 279 {
 280         return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1);
 281 }
 282
 283
 284 /* Close all channel fd/socket. */
 285
 286 void
 287 channel_close_fds(Channel *c)
 288 {
 289         if (c->sock != -1) {
 290                 close(c->sock);
 291                 c->sock = -1;
 292         }
 293         if (c->rfd != -1) {
 294                 close(c->rfd);
 295                 c->rfd = -1;
 296         }
 297         if (c->wfd != -1) {
 298                 close(c->wfd);
 299                 c->wfd = -1;
 300         }
 301         if (c->efd != -1) {
 302                 close(c->efd);
 303                 c->efd = -1;
 304         }
 305 }
 306
 307 /* Free the channel and close its fd/socket. */
 308
 309 void
 310 channel_free(int id)
 311 {
 312         Channel *c = channel_lookup(id);
 313         char *s = channel_open_message();
 314
 315         if (c == NULL)
 316                 packet_disconnect("channel free: bad local channel %d", id);
 317         debug("channel_free: channel %d: status: %s", id, s);
 318         xfree(s);
 319
 320         if (c->dettach_user != NULL) {
 321                 debug("channel_free: channel %d: dettaching channel user", id);
 322                 c->dettach_user(c->self, NULL);
 323         }
 324         if (c->sock != -1)
 325                 shutdown(c->sock, SHUT_RDWR);
 326         channel_close_fds(c);
 327         buffer_free(&c->input);
 328         buffer_free(&c->output);
 329         buffer_free(&c->extended);
 330         c->type = SSH_CHANNEL_FREE;
 331         if (c->remote_name) {
 332                 xfree(c->remote_name);
 333                 c->remote_name = NULL;
 334         }
 335 }
 336
 337 /*
 338  * 'channel_pre*' are called just before select() to add any bits relevant to
 339  * channels in the select bitmasks.
 340  */
 341 /*
 342  * 'channel_post*': perform any appropriate operations for channels which
 343  * have events pending.
 344  */
 345 typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
 346 chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
 347 chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
 348
 349 void
 350 channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
 351 {
 352         FD_SET(c->sock, readset);
 353 }
 354
 355 void
 356 channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset)
 357 {
 358         debug3("channel %d: waiting for connection", c->self);
 359         FD_SET(c->sock, writeset);
 360 }
 361
 362 void
 363 channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
 364 {
 365         if (buffer_len(&c->input) < packet_get_maxsize())
 366                 FD_SET(c->sock, readset);
 367         if (buffer_len(&c->output) > 0)
 368                 FD_SET(c->sock, writeset);
 369 }
 370
 371 void
 372 channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
 373 {
 374         /* test whether sockets are 'alive' for read/write */
 375         if (c->istate == CHAN_INPUT_OPEN)
 376                 if (buffer_len(&c->input) < packet_get_maxsize())
 377                         FD_SET(c->sock, readset);
 378         if (c->ostate == CHAN_OUTPUT_OPEN ||
 379             c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 380                 if (buffer_len(&c->output) > 0) {
 381                         FD_SET(c->sock, writeset);
 382                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 383                         chan_obuf_empty(c);
 384                 }
 385         }
 386 }
 387
 388 void
 389 channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
 390 {
 391         if (c->istate == CHAN_INPUT_OPEN &&
 392             c->remote_window > 0 &&
 393             buffer_len(&c->input) < c->remote_window)
 394                 FD_SET(c->rfd, readset);
 395         if (c->ostate == CHAN_OUTPUT_OPEN ||
 396             c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 397                 if (buffer_len(&c->output) > 0) {
 398                         FD_SET(c->wfd, writeset);
 399                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 400                         chan_obuf_empty(c);
 401                 }
 402         }
 403         /** XXX check close conditions, too */
 404         if (c->efd != -1) {
 405                 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
 406                     buffer_len(&c->extended) > 0)
 407                         FD_SET(c->efd, writeset);
 408                 else if (c->extended_usage == CHAN_EXTENDED_READ &&
 409                     buffer_len(&c->extended) < c->remote_window)
 410                         FD_SET(c->efd, readset);
 411         }
 412 }
 413
 414 void
 415 channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
 416 {
 417         if (buffer_len(&c->input) == 0) {
 418                 packet_start(SSH_MSG_CHANNEL_CLOSE);
 419                 packet_put_int(c->remote_id);
 420                 packet_send();
 421                 c->type = SSH_CHANNEL_CLOSED;
 422                 debug("Closing channel %d after input drain.", c->self);
 423         }
 424 }
 425
 426 void
 427 channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
 428 {
 429         if (buffer_len(&c->output) == 0)
 430                 channel_free(c->self);
 431         else
 432                 FD_SET(c->sock, writeset);
 433 }
 434
 435 /*
 436  * This is a special state for X11 authentication spoofing.  An opened X11
 437  * connection (when authentication spoofing is being done) remains in this
 438  * state until the first packet has been completely read.  The authentication
 439  * data in that packet is then substituted by the real data if it matches the
 440  * fake data, and the channel is put into normal mode.
 441  * XXX All this happens at the client side.
 442  */
 443 int
 444 x11_open_helper(Channel *c)
 445 {
 446         u_char *ucp;
 447         u_int proto_len, data_len;
 448
 449         /* Check if the fixed size part of the packet is in buffer. */
 450         if (buffer_len(&c->output) < 12)
 451                 return 0;
 452
 453         /* Parse the lengths of variable-length fields. */
 454         ucp = (u_char *) buffer_ptr(&c->output);
 455         if (ucp[0] == 0x42) {   /* Byte order MSB first. */
 456                 proto_len = 256 * ucp[6] + ucp[7];
 457                 data_len = 256 * ucp[8] + ucp[9];
 458         } else if (ucp[0] == 0x6c) {    /* Byte order LSB first. */
 459                 proto_len = ucp[6] + 256 * ucp[7];
 460                 data_len = ucp[8] + 256 * ucp[9];
 461         } else {
 462                 debug("Initial X11 packet contains bad byte order byte: 0x%x",
 463                       ucp[0]);
 464                 return -1;
 465         }
 466
 467         /* Check if the whole packet is in buffer. */
 468         if (buffer_len(&c->output) <
 469             12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
 470                 return 0;
 471
 472         /* Check if authentication protocol matches. */
 473         if (proto_len != strlen(x11_saved_proto) ||
 474             memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
 475                 debug("X11 connection uses different authentication protocol.");
 476                 return -1;
 477         }
 478         /* Check if authentication data matches our fake data. */
 479         if (data_len != x11_fake_data_len ||
 480             memcmp(ucp + 12 + ((proto_len + 3) & ~3),
 481                 x11_fake_data, x11_fake_data_len) != 0) {
 482                 debug("X11 auth data does not match fake data.");
 483                 return -1;
 484         }
 485         /* Check fake data length */
 486         if (x11_fake_data_len != x11_saved_data_len) {
 487                 error("X11 fake_data_len %d != saved_data_len %d",
 488                     x11_fake_data_len, x11_saved_data_len);
 489                 return -1;
 490         }
 491         /*
 492          * Received authentication protocol and data match
 493          * our fake data. Substitute the fake data with real
 494          * data.
 495          */
 496         memcpy(ucp + 12 + ((proto_len + 3) & ~3),
 497             x11_saved_data, x11_saved_data_len);
 498         return 1;
 499 }
 500
 501 void
 502 channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
 503 {
 504         int ret = x11_open_helper(c);
 505         if (ret == 1) {
 506                 /* Start normal processing for the channel. */
 507                 c->type = SSH_CHANNEL_OPEN;
 508                 channel_pre_open_13(c, readset, writeset);
 509         } else if (ret == -1) {
 510                 /*
 511                  * We have received an X11 connection that has bad
 512                  * authentication information.
 513                  */
 514                 log("X11 connection rejected because of wrong authentication.\r\n");
 515                 buffer_clear(&c->input);
 516                 buffer_clear(&c->output);
 517                 close(c->sock);
 518                 c->sock = -1;
 519                 c->type = SSH_CHANNEL_CLOSED;
 520                 packet_start(SSH_MSG_CHANNEL_CLOSE);
 521                 packet_put_int(c->remote_id);
 522                 packet_send();
 523         }
 524 }
 525
 526 void
 527 channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
 528 {
 529         int ret = x11_open_helper(c);
 530         if (ret == 1) {
 531                 c->type = SSH_CHANNEL_OPEN;
 532                 if (compat20)
 533                         channel_pre_open_20(c, readset, writeset);
 534                 else
 535                         channel_pre_open_15(c, readset, writeset);
 536         } else if (ret == -1) {
 537                 debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
 538                 chan_read_failed(c);    /** force close? */
 539                 chan_write_failed(c);
 540                 debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
 541         }
 542 }
 543
 544 /* This is our fake X11 server socket. */
 545 void
 546 channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
 547 {
 548         struct sockaddr addr;
 549         int newsock, newch;
 550         socklen_t addrlen;
 551         char buf[16384], *remote_hostname;
 552         int remote_port;
 553
 554         if (FD_ISSET(c->sock, readset)) {
 555                 debug("X11 connection requested.");
 556                 addrlen = sizeof(addr);
 557                 newsock = accept(c->sock, &addr, &addrlen);
 558                 if (newsock < 0) {
 559                         error("accept: %.100s", strerror(errno));
 560                         return;
 561                 }
 562                 remote_hostname = get_remote_hostname(newsock);
 563                 remote_port = get_peer_port(newsock);
 564                 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
 565                     remote_hostname, remote_port);
 566
 567                 newch = channel_new("x11",
 568                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
 569                     c->local_window_max, c->local_maxpacket,
 570                     0, xstrdup(buf), 1);
 571                 if (compat20) {
 572                         packet_start(SSH2_MSG_CHANNEL_OPEN);
 573                         packet_put_cstring("x11");
 574                         packet_put_int(newch);
 575                         packet_put_int(c->local_window_max);
 576                         packet_put_int(c->local_maxpacket);
 577                         /* originator host and port */
 578                         packet_put_cstring(remote_hostname);
 579                         if (datafellows & SSH_BUG_X11FWD) {
 580                                 debug("ssh2 x11 bug compat mode");
 581                         } else {
 582                                 packet_put_int(remote_port);
 583                         }
 584                         packet_send();
 585                 } else {
 586                         packet_start(SSH_SMSG_X11_OPEN);
 587                         packet_put_int(newch);
 588                         if (have_hostname_in_open)
 589                                 packet_put_string(buf, strlen(buf));
 590                         packet_send();
 591                 }
 592                 xfree(remote_hostname);
 593         }
 594 }
 595
 596 /*
 597  * This socket is listening for connections to a forwarded TCP/IP port.
 598  */
 599 void
 600 channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
 601 {
 602         struct sockaddr addr;
 603         int newsock, newch;
 604         socklen_t addrlen;
 605         char buf[1024], *remote_hostname, *rtype;
 606         int remote_port;
 607
 608         rtype = (c->type == SSH_CHANNEL_RPORT_LISTENER) ?
 609             "forwarded-tcpip" : "direct-tcpip";
 610
 611         if (FD_ISSET(c->sock, readset)) {
 612                 debug("Connection to port %d forwarding "
 613                     "to %.100s port %d requested.",
 614                     c->listening_port, c->path, c->host_port);
 615                 addrlen = sizeof(addr);
 616                 newsock = accept(c->sock, &addr, &addrlen);
 617                 if (newsock < 0) {
 618                         error("accept: %.100s", strerror(errno));
 619                         return;
 620                 }
 621                 remote_hostname = get_remote_hostname(newsock);
 622                 remote_port = get_peer_port(newsock);
 623                 snprintf(buf, sizeof buf,
 624                     "listen port %d for %.100s port %d, "
 625                     "connect from %.200s port %d",
 626                     c->listening_port, c->path, c->host_port,
 627                     remote_hostname, remote_port);
 628
 629                 newch = channel_new(rtype,
 630                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
 631                     c->local_window_max, c->local_maxpacket,
 632                     0, xstrdup(buf), 1);
 633                 if (compat20) {
 634                         packet_start(SSH2_MSG_CHANNEL_OPEN);
 635                         packet_put_cstring(rtype);
 636                         packet_put_int(newch);
 637                         packet_put_int(c->local_window_max);
 638                         packet_put_int(c->local_maxpacket);
 639                         if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
 640                                 /* listen address, port */
 641                                 packet_put_string(c->path, strlen(c->path));
 642                                 packet_put_int(c->listening_port);
 643                         } else {
 644                                 /* target host, port */
 645                                 packet_put_string(c->path, strlen(c->path));
 646                                 packet_put_int(c->host_port);
 647                         }
 648                         /* originator host and port */
 649                         packet_put_cstring(remote_hostname);
 650                         packet_put_int(remote_port);
 651                         packet_send();
 652                 } else {
 653                         packet_start(SSH_MSG_PORT_OPEN);
 654                         packet_put_int(newch);
 655                         packet_put_string(c->path, strlen(c->path));
 656                         packet_put_int(c->host_port);
 657                         if (have_hostname_in_open) {
 658                                 packet_put_string(buf, strlen(buf));
 659                         }
 660                         packet_send();
 661                 }
 662                 xfree(remote_hostname);
 663         }
 664 }
 665
 666 /*
 667  * This is the authentication agent socket listening for connections from
 668  * clients.
 669  */
 670 void
 671 channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
 672 {
 673         struct sockaddr addr;
 674         int newsock, newch;
 675         socklen_t addrlen;
 676
 677         if (FD_ISSET(c->sock, readset)) {
 678                 addrlen = sizeof(addr);
 679                 newsock = accept(c->sock, &addr, &addrlen);
 680                 if (newsock < 0) {
 681                         error("accept from auth socket: %.100s", strerror(errno));
 682                         return;
 683                 }
 684                 newch = channel_new("accepted auth socket",
 685                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
 686                     c->local_window_max, c->local_maxpacket,
 687                     0, xstrdup("accepted auth socket"), 1);
 688                 if (compat20) {
 689                         packet_start(SSH2_MSG_CHANNEL_OPEN);
 690                         packet_put_cstring("auth-agent@openssh.com");
 691                         packet_put_int(newch);
 692                         packet_put_int(c->local_window_max);
 693                         packet_put_int(c->local_maxpacket);
 694                 } else {
 695                         packet_start(SSH_SMSG_AGENT_OPEN);
 696                         packet_put_int(newch);
 697                 }
 698                 packet_send();
 699         }
 700 }
 701
 702 void
 703 channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
 704 {
 705         if (FD_ISSET(c->sock, writeset)) {
 706                 int err = 0;
 707                 int sz = sizeof(err);
 708                 c->type = SSH_CHANNEL_OPEN;
 709                 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &sz) < 0) {
 710                         debug("getsockopt SO_ERROR failed");
 711                 } else {
 712                         if (err == 0) {
 713                                 debug("channel %d: connected)", c->self);
 714                         } else {
 715                                 debug("channel %d: not connected: %s",
 716                                     c->self, strerror(err));
 717                                 chan_read_failed(c);
 718                                 chan_write_failed(c);
 719                         }
 720                 }
 721         }
 722 }
 723
 724 int
 725 channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
 726 {
 727         char buf[16*1024];
 728         int len;
 729
 730         if (c->rfd != -1 &&
 731             FD_ISSET(c->rfd, readset)) {
 732                 len = read(c->rfd, buf, sizeof(buf));
 733                 if (len < 0 && (errno == EINTR || errno == EAGAIN))
 734                         return 1;
 735                 if (len <= 0) {
 736                         debug("channel %d: read<=0 rfd %d len %d",
 737                             c->self, c->rfd, len);
 738                         if (compat13) {
 739                                 buffer_consume(&c->output, buffer_len(&c->output));
 740                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
 741                                 debug("Channel %d status set to input draining.", c->self);
 742                         } else {
 743                                 chan_read_failed(c);
 744                         }
 745                         return -1;
 746                 }
 747                 if(c->input_filter != NULL) {
 748                         if (c->input_filter(c, buf, len) == -1) {
 749                                 debug("filter stops channel %d", c->self);
 750                                 chan_read_failed(c);
 751                         }
 752                 } else {
 753                         buffer_append(&c->input, buf, len);
 754                 }
 755         }
 756         return 1;
 757 }
 758 int
 759 channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
 760 {
 761         int len;
 762
 763         /* Send buffered output data to the socket. */
 764         if (c->wfd != -1 &&
 765             FD_ISSET(c->wfd, writeset) &&
 766             buffer_len(&c->output) > 0) {
 767                 len = write(c->wfd, buffer_ptr(&c->output),
 768                     buffer_len(&c->output));
 769                 if (len < 0 && (errno == EINTR || errno == EAGAIN))
 770                         return 1;
 771                 if (len <= 0) {
 772                         if (compat13) {
 773                                 buffer_consume(&c->output, buffer_len(&c->output));
 774                                 debug("Channel %d status set to input draining.", c->self);
 775                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
 776                         } else {
 777                                 chan_write_failed(c);
 778                         }
 779                         return -1;
 780                 }
 781                 buffer_consume(&c->output, len);
 782                 if (compat20 && len > 0) {
 783                         c->local_consumed += len;
 784                 }
 785         }
 786         return 1;
 787 }
 788 int
 789 channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
 790 {
 791         char buf[16*1024];
 792         int len;
 793
 794 /** XXX handle drain efd, too */
 795         if (c->efd != -1) {
 796                 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
 797                     FD_ISSET(c->efd, writeset) &&
 798                     buffer_len(&c->extended) > 0) {
 799                         len = write(c->efd, buffer_ptr(&c->extended),
 800                             buffer_len(&c->extended));
 801                         debug2("channel %d: written %d to efd %d",
 802                             c->self, len, c->efd);
 803                         if (len > 0) {
 804                                 buffer_consume(&c->extended, len);
 805                                 c->local_consumed += len;
 806                         }
 807                 } else if (c->extended_usage == CHAN_EXTENDED_READ &&
 808                     FD_ISSET(c->efd, readset)) {
 809                         len = read(c->efd, buf, sizeof(buf));
 810                         debug2("channel %d: read %d from efd %d",
 811                              c->self, len, c->efd);
 812                         if (len == 0) {
 813                                 debug("channel %d: closing efd %d",
 814                                     c->self, c->efd);
 815                                 close(c->efd);
 816                                 c->efd = -1;
 817                         } else if (len > 0)
 818                                 buffer_append(&c->extended, buf, len);
 819                 }
 820         }
 821         return 1;
 822 }
 823 int
 824 channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
 825 {
 826         if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
 827             c->local_window < c->local_window_max/2 &&
 828             c->local_consumed > 0) {
 829                 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
 830                 packet_put_int(c->remote_id);
 831                 packet_put_int(c->local_consumed);
 832                 packet_send();
 833                 debug2("channel %d: window %d sent adjust %d",
 834                     c->self, c->local_window,
 835                     c->local_consumed);
 836                 c->local_window += c->local_consumed;
 837                 c->local_consumed = 0;
 838         }
 839         return 1;
 840 }
 841
 842 void
 843 channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
 844 {
 845         channel_handle_rfd(c, readset, writeset);
 846         channel_handle_wfd(c, readset, writeset);
 847 }
 848
 849 void
 850 channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
 851 {
 852         channel_handle_rfd(c, readset, writeset);
 853         channel_handle_wfd(c, readset, writeset);
 854         channel_handle_efd(c, readset, writeset);
 855         channel_check_window(c, readset, writeset);
 856 }
 857
 858 void
 859 channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
 860 {
 861         int len;
 862         /* Send buffered output data to the socket. */
 863         if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
 864                 len = write(c->sock, buffer_ptr(&c->output),
 865                             buffer_len(&c->output));
 866                 if (len <= 0)
 867                         buffer_consume(&c->output, buffer_len(&c->output));
 868                 else
 869                         buffer_consume(&c->output, len);
 870         }
 871 }
 872
 873 void
 874 channel_handler_init_20(void)
 875 {
 876         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_20;
 877         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open;
 878         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 879         channel_pre[SSH_CHANNEL_RPORT_LISTENER] =       &channel_pre_listener;
 880         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 881         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
 882         channel_pre[SSH_CHANNEL_CONNECTING] =           &channel_pre_connecting;
 883
 884         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_2;
 885         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 886         channel_post[SSH_CHANNEL_RPORT_LISTENER] =      &channel_post_port_listener;
 887         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 888         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
 889         channel_post[SSH_CHANNEL_CONNECTING] =          &channel_post_connecting;
 890 }
 891
 892 void
 893 channel_handler_init_13(void)
 894 {
 895         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_13;
 896         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open_13;
 897         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 898         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 899         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
 900         channel_pre[SSH_CHANNEL_INPUT_DRAINING] =       &channel_pre_input_draining;
 901         channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] =      &channel_pre_output_draining;
 902         channel_pre[SSH_CHANNEL_CONNECTING] =           &channel_pre_connecting;
 903
 904         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_1;
 905         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 906         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 907         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
 908         channel_post[SSH_CHANNEL_OUTPUT_DRAINING] =     &channel_post_output_drain_13;
 909         channel_post[SSH_CHANNEL_CONNECTING] =          &channel_post_connecting;
 910 }
 911
 912 void
 913 channel_handler_init_15(void)
 914 {
 915         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_15;
 916         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open;
 917         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 918         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 919         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
 920         channel_pre[SSH_CHANNEL_CONNECTING] =           &channel_pre_connecting;
 921
 922         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 923         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 924         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
 925         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_1;
 926         channel_post[SSH_CHANNEL_CONNECTING] =          &channel_post_connecting;
 927 }
 928
 929 void
 930 channel_handler_init(void)
 931 {
 932         int i;
 933         for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
 934                 channel_pre[i] = NULL;
 935                 channel_post[i] = NULL;
 936         }
 937         if (compat20)
 938                 channel_handler_init_20();
 939         else if (compat13)
 940                 channel_handler_init_13();
 941         else
 942                 channel_handler_init_15();
 943 }
 944
 945 void
 946 channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
 947 {
 948         static int did_init = 0;
 949         int i;
 950         Channel *c;
 951
 952         if (!did_init) {
 953                 channel_handler_init();
 954                 did_init = 1;
 955         }
 956         for (i = 0; i < channels_alloc; i++) {
 957                 c = &channels[i];
 958                 if (c->type == SSH_CHANNEL_FREE)
 959                         continue;
 960                 if (ftab[c->type] == NULL)
 961                         continue;
 962                 (*ftab[c->type])(c, readset, writeset);
 963                 chan_delete_if_full_closed(c);
 964         }
 965 }
 966
 967 void
 968 channel_prepare_select(fd_set * readset, fd_set * writeset)
 969 {
 970         channel_handler(channel_pre, readset, writeset);
 971 }
 972
 973 void
 974 channel_after_select(fd_set * readset, fd_set * writeset)
 975 {
 976         channel_handler(channel_post, readset, writeset);
 977 }
 978
 979 /* If there is data to send to the connection, send some of it now. */
 980
 981 void
 982 channel_output_poll()
 983 {
 984         int len, i;
 985         Channel *c;
 986
 987         for (i = 0; i < channels_alloc; i++) {
 988                 c = &channels[i];
 989
 990                 /* We are only interested in channels that can have buffered incoming data. */
 991                 if (compat13) {
 992                         if (c->type != SSH_CHANNEL_OPEN &&
 993                             c->type != SSH_CHANNEL_INPUT_DRAINING)
 994                                 continue;
 995                 } else {
 996                         if (c->type != SSH_CHANNEL_OPEN)
 997                                 continue;
 998                         if (c->istate != CHAN_INPUT_OPEN &&
 999                             c->istate != CHAN_INPUT_WAIT_DRAIN)
1000                                 continue;
1001                 }
1002                 if (compat20 &&
1003                     (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
1004                         debug("channel: %d: no data after CLOSE", c->self);
1005                         continue;
1006                 }
1007
1008                 /* Get the amount of buffered data for this channel. */
1009                 len = buffer_len(&c->input);
1010                 if (len > 0) {
1011                         /* Send some data for the other side over the secure connection. */
1012                         if (compat20) {
1013                                 if (len > c->remote_window)
1014                                         len = c->remote_window;
1015                                 if (len > c->remote_maxpacket)
1016                                         len = c->remote_maxpacket;
1017                         } else {
1018                                 if (packet_is_interactive()) {
1019                                         if (len > 1024)
1020                                                 len = 512;
1021                                 } else {
1022                                         /* Keep the packets at reasonable size. */
1023                                         if (len > packet_get_maxsize()/2)
1024                                                 len = packet_get_maxsize()/2;
1025                                 }
1026                         }
1027                         if (len > 0) {
1028                                 packet_start(compat20 ?
1029                                     SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
1030                                 packet_put_int(c->remote_id);
1031                                 packet_put_string(buffer_ptr(&c->input), len);
1032                                 packet_send();
1033                                 buffer_consume(&c->input, len);
1034                                 c->remote_window -= len;
1035                         }
1036                 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
1037                         if (compat13)
1038                                 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
1039                         /*
1040                          * input-buffer is empty and read-socket shutdown:
1041                          * tell peer, that we will not send more data: send IEOF
1042                          */
1043                         chan_ibuf_empty(c);
1044                 }
1045                 /* Send extended data, i.e. stderr */
1046                 if (compat20 &&
1047                     c->remote_window > 0 &&
1048                     (len = buffer_len(&c->extended)) > 0 &&
1049                     c->extended_usage == CHAN_EXTENDED_READ) {
1050                         if (len > c->remote_window)
1051                                 len = c->remote_window;
1052                         if (len > c->remote_maxpacket)
1053                                 len = c->remote_maxpacket;
1054                         packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
1055                         packet_put_int(c->remote_id);
1056                         packet_put_int(SSH2_EXTENDED_DATA_STDERR);
1057                         packet_put_string(buffer_ptr(&c->extended), len);
1058                         packet_send();
1059                         buffer_consume(&c->extended, len);
1060                         c->remote_window -= len;
1061                 }
1062         }
1063 }
1064
1065 /*
1066  * This is called when a packet of type CHANNEL_DATA has just been received.
1067  * The message type has already been consumed, but channel number and data is
1068  * still there.
1069  */
1070
1071 void
1072 channel_input_data(int type, int plen, void *ctxt)
1073 {
1074         int id;
1075         char *data;
1076         u_int data_len;
1077         Channel *c;
1078
1079         /* Get the channel number and verify it. */
1080         id = packet_get_int();
1081         c = channel_lookup(id);
1082         if (c == NULL)
1083                 packet_disconnect("Received data for nonexistent channel %d.", id);
1084
1085         /* Ignore any data for non-open channels (might happen on close) */
1086         if (c->type != SSH_CHANNEL_OPEN &&
1087             c->type != SSH_CHANNEL_X11_OPEN)
1088                 return;
1089
1090         /* same for protocol 1.5 if output end is no longer open */
1091         if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
1092                 return;
1093
1094         /* Get the data. */
1095         data = packet_get_string(&data_len);
1096         packet_done();
1097
1098         if (compat20){
1099                 if (data_len > c->local_maxpacket) {
1100                         log("channel %d: rcvd big packet %d, maxpack %d",
1101                             c->self, data_len, c->local_maxpacket);
1102                 }
1103                 if (data_len > c->local_window) {
1104                         log("channel %d: rcvd too much data %d, win %d",
1105                             c->self, data_len, c->local_window);
1106                         xfree(data);
1107                         return;
1108                 }
1109                 c->local_window -= data_len;
1110         }else{
1111                 packet_integrity_check(plen, 4 + 4 + data_len, type);
1112         }
1113         buffer_append(&c->output, data, data_len);
1114         xfree(data);
1115 }
1116 void
1117 channel_input_extended_data(int type, int plen, void *ctxt)
1118 {
1119         int id;
1120         int tcode;
1121         char *data;
1122         u_int data_len;
1123         Channel *c;
1124
1125         /* Get the channel number and verify it. */
1126         id = packet_get_int();
1127         c = channel_lookup(id);
1128
1129         if (c == NULL)
1130                 packet_disconnect("Received extended_data for bad channel %d.", id);
1131         if (c->type != SSH_CHANNEL_OPEN) {
1132                 log("channel %d: ext data for non open", id);
1133                 return;
1134         }
1135         tcode = packet_get_int();
1136         if (c->efd == -1 ||
1137             c->extended_usage != CHAN_EXTENDED_WRITE ||
1138             tcode != SSH2_EXTENDED_DATA_STDERR) {
1139                 log("channel %d: bad ext data", c->self);
1140                 return;
1141         }
1142         data = packet_get_string(&data_len);
1143         packet_done();
1144         if (data_len > c->local_window) {
1145                 log("channel %d: rcvd too much extended_data %d, win %d",
1146                     c->self, data_len, c->local_window);
1147                 xfree(data);
1148                 return;
1149         }
1150         debug2("channel %d: rcvd ext data %d", c->self, data_len);
1151         c->local_window -= data_len;
1152         buffer_append(&c->extended, data, data_len);
1153         xfree(data);
1154 }
1155
1156
1157 /*
1158  * Returns true if no channel has too much buffered data, and false if one or
1159  * more channel is overfull.
1160  */
1161
1162 int
1163 channel_not_very_much_buffered_data()
1164 {
1165         u_int i;
1166         Channel *c;
1167
1168         for (i = 0; i < channels_alloc; i++) {
1169                 c = &channels[i];
1170                 if (c->type == SSH_CHANNEL_OPEN) {
1171                         if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
1172                                 debug("channel %d: big input buffer %d",
1173                                     c->self, buffer_len(&c->input));
1174                                 return 0;
1175                         }
1176                         if (buffer_len(&c->output) > packet_get_maxsize()) {
1177                                 debug("channel %d: big output buffer %d",
1178                                     c->self, buffer_len(&c->output));
1179                                 return 0;
1180                         }
1181                 }
1182         }
1183         return 1;
1184 }
1185
1186 void
1187 channel_input_ieof(int type, int plen, void *ctxt)
1188 {
1189         int id;
1190         Channel *c;
1191
1192         packet_integrity_check(plen, 4, type);
1193
1194         id = packet_get_int();
1195         c = channel_lookup(id);
1196         if (c == NULL)
1197                 packet_disconnect("Received ieof for nonexistent channel %d.", id);
1198         chan_rcvd_ieof(c);
1199 }
1200
1201 void
1202 channel_input_close(int type, int plen, void *ctxt)
1203 {
1204         int id;
1205         Channel *c;
1206
1207         packet_integrity_check(plen, 4, type);
1208
1209         id = packet_get_int();
1210         c = channel_lookup(id);
1211         if (c == NULL)
1212                 packet_disconnect("Received close for nonexistent channel %d.", id);
1213
1214         /*
1215          * Send a confirmation that we have closed the channel and no more
1216          * data is coming for it.
1217          */
1218         packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
1219         packet_put_int(c->remote_id);
1220         packet_send();
1221
1222         /*
1223          * If the channel is in closed state, we have sent a close request,
1224          * and the other side will eventually respond with a confirmation.
1225          * Thus, we cannot free the channel here, because then there would be
1226          * no-one to receive the confirmation.  The channel gets freed when
1227          * the confirmation arrives.
1228          */
1229         if (c->type != SSH_CHANNEL_CLOSED) {
1230                 /*
1231                  * Not a closed channel - mark it as draining, which will
1232                  * cause it to be freed later.
1233                  */
1234                 buffer_consume(&c->input, buffer_len(&c->input));
1235                 c->type = SSH_CHANNEL_OUTPUT_DRAINING;
1236         }
1237 }
1238
1239 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
1240 void
1241 channel_input_oclose(int type, int plen, void *ctxt)
1242 {
1243         int id = packet_get_int();
1244         Channel *c = channel_lookup(id);
1245         packet_integrity_check(plen, 4, type);
1246         if (c == NULL)
1247                 packet_disconnect("Received oclose for nonexistent channel %d.", id);
1248         chan_rcvd_oclose(c);
1249 }
1250
1251 void
1252 channel_input_close_confirmation(int type, int plen, void *ctxt)
1253 {
1254         int id = packet_get_int();
1255         Channel *c = channel_lookup(id);
1256
1257         packet_done();
1258         if (c == NULL)
1259                 packet_disconnect("Received close confirmation for "
1260                     "out-of-range channel %d.", id);
1261         if (c->type != SSH_CHANNEL_CLOSED)
1262                 packet_disconnect("Received close confirmation for "
1263                     "non-closed channel %d (type %d).", id, c->type);
1264         channel_free(c->self);
1265 }
1266
1267 void
1268 channel_input_open_confirmation(int type, int plen, void *ctxt)
1269 {
1270         int id, remote_id;
1271         Channel *c;
1272
1273         if (!compat20)
1274                 packet_integrity_check(plen, 4 + 4, type);
1275
1276         id = packet_get_int();
1277         c = channel_lookup(id);
1278
1279         if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1280                 packet_disconnect("Received open confirmation for "
1281                     "non-opening channel %d.", id);
1282         remote_id = packet_get_int();
1283         /* Record the remote channel number and mark that the channel is now open. */
1284         c->remote_id = remote_id;
1285         c->type = SSH_CHANNEL_OPEN;
1286
1287         if (compat20) {
1288                 c->remote_window = packet_get_int();
1289                 c->remote_maxpacket = packet_get_int();
1290                 packet_done();
1291                 if (c->cb_fn != NULL && c->cb_event == type) {
1292                         debug2("callback start");
1293                         c->cb_fn(c->self, c->cb_arg);
1294                         debug2("callback done");
1295                 }
1296                 debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1297                     c->remote_window, c->remote_maxpacket);
1298         }
1299 }
1300
1301 void
1302 channel_input_open_failure(int type, int plen, void *ctxt)
1303 {
1304         int id;
1305         Channel *c;
1306
1307         if (!compat20)
1308                 packet_integrity_check(plen, 4, type);
1309
1310         id = packet_get_int();
1311         c = channel_lookup(id);
1312
1313         if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1314                 packet_disconnect("Received open failure for "
1315                     "non-opening channel %d.", id);
1316         if (compat20) {
1317                 int reason = packet_get_int();
1318                 char *msg  = packet_get_string(NULL);
1319                 char *lang  = packet_get_string(NULL);
1320                 log("channel_open_failure: %d: reason %d: %s", id, reason, msg);
1321                 packet_done();
1322                 xfree(msg);
1323                 xfree(lang);
1324         }
1325         /* Free the channel.  This will also close the socket. */
1326         channel_free(id);
1327 }
1328
1329 void
1330 channel_input_channel_request(int type, int plen, void *ctxt)
1331 {
1332         int id;
1333         Channel *c;
1334
1335         id = packet_get_int();
1336         c = channel_lookup(id);
1337
1338         if (c == NULL ||
1339             (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1340                 packet_disconnect("Received request for "
1341                     "non-open channel %d.", id);
1342         if (c->cb_fn != NULL && c->cb_event == type) {
1343                 debug2("callback start");
1344                 c->cb_fn(c->self, c->cb_arg);
1345                 debug2("callback done");
1346         } else {
1347                 char *service = packet_get_string(NULL);
1348                 debug("channel: %d rcvd request for %s", c->self, service);
1349                 debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
1350                 xfree(service);
1351         }
1352 }
1353
1354 void
1355 channel_input_window_adjust(int type, int plen, void *ctxt)
1356 {
1357         Channel *c;
1358         int id, adjust;
1359
1360         if (!compat20)
1361                 return;
1362
1363         /* Get the channel number and verify it. */
1364         id = packet_get_int();
1365         c = channel_lookup(id);
1366
1367         if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1368                 log("Received window adjust for "
1369                     "non-open channel %d.", id);
1370                 return;
1371         }
1372         adjust = packet_get_int();
1373         packet_done();
1374         debug2("channel %d: rcvd adjust %d", id, adjust);
1375         c->remote_window += adjust;
1376 }
1377
1378 /*
1379  * Stops listening for channels, and removes any unix domain sockets that we
1380  * might have.
1381  */
1382
1383 void
1384 channel_stop_listening()
1385 {
1386         int i;
1387         for (i = 0; i < channels_alloc; i++) {
1388                 switch (channels[i].type) {
1389                 case SSH_CHANNEL_AUTH_SOCKET:
1390                         close(channels[i].sock);
1391                         unlink(channels[i].path);
1392                         channel_free(i);
1393                         break;
1394                 case SSH_CHANNEL_PORT_LISTENER:
1395                 case SSH_CHANNEL_RPORT_LISTENER:
1396                 case SSH_CHANNEL_X11_LISTENER:
1397                         close(channels[i].sock);
1398                         channel_free(i);
1399                         break;
1400                 default:
1401                         break;
1402                 }
1403         }
1404 }
1405
1406 /*
1407  * Closes the sockets/fds of all channels.  This is used to close extra file
1408  * descriptors after a fork.
1409  */
1410
1411 void
1412 channel_close_all()
1413 {
1414         int i;
1415         for (i = 0; i < channels_alloc; i++)
1416                 if (channels[i].type != SSH_CHANNEL_FREE)
1417                         channel_close_fds(&channels[i]);
1418 }
1419
1420 /* Returns the maximum file descriptor number used by the channels. */
1421
1422 int
1423 channel_max_fd()
1424 {
1425         return channel_max_fd_value;
1426 }
1427
1428 /* Returns true if any channel is still open. */
1429
1430 int
1431 channel_still_open()
1432 {
1433         u_int i;
1434         for (i = 0; i < channels_alloc; i++)
1435                 switch (channels[i].type) {
1436                 case SSH_CHANNEL_FREE:
1437                 case SSH_CHANNEL_X11_LISTENER:
1438                 case SSH_CHANNEL_PORT_LISTENER:
1439                 case SSH_CHANNEL_RPORT_LISTENER:
1440                 case SSH_CHANNEL_CLOSED:
1441                 case SSH_CHANNEL_AUTH_SOCKET:
1442                 case SSH_CHANNEL_CONNECTING:    /* XXX ??? */
1443                         continue;
1444                 case SSH_CHANNEL_LARVAL:
1445                         if (!compat20)
1446                                 fatal("cannot happen: SSH_CHANNEL_LARVAL");
1447                         continue;
1448                 case SSH_CHANNEL_OPENING:
1449                 case SSH_CHANNEL_OPEN:
1450                 case SSH_CHANNEL_X11_OPEN:
1451                         return 1;
1452                 case SSH_CHANNEL_INPUT_DRAINING:
1453                 case SSH_CHANNEL_OUTPUT_DRAINING:
1454                         if (!compat13)
1455                                 fatal("cannot happen: OUT_DRAIN");
1456                         return 1;
1457                 default:
1458                         fatal("channel_still_open: bad channel type %d", channels[i].type);
1459                         /* NOTREACHED */
1460                 }
1461         return 0;
1462 }
1463
1464 /*
1465  * Returns a message describing the currently open forwarded connections,
1466  * suitable for sending to the client.  The message contains crlf pairs for
1467  * newlines.
1468  */
1469
1470 char *
1471 channel_open_message()
1472 {
1473         Buffer buffer;
1474         int i;
1475         char buf[512], *cp;
1476
1477         buffer_init(&buffer);
1478         snprintf(buf, sizeof buf, "The following connections are open:\r\n");
1479         buffer_append(&buffer, buf, strlen(buf));
1480         for (i = 0; i < channels_alloc; i++) {
1481                 Channel *c = &channels[i];
1482                 switch (c->type) {
1483                 case SSH_CHANNEL_FREE:
1484                 case SSH_CHANNEL_X11_LISTENER:
1485                 case SSH_CHANNEL_PORT_LISTENER:
1486                 case SSH_CHANNEL_RPORT_LISTENER:
1487                 case SSH_CHANNEL_CLOSED:
1488                 case SSH_CHANNEL_AUTH_SOCKET:
1489                         continue;
1490                 case SSH_CHANNEL_LARVAL:
1491                 case SSH_CHANNEL_OPENING:
1492                 case SSH_CHANNEL_CONNECTING:
1493                 case SSH_CHANNEL_OPEN:
1494                 case SSH_CHANNEL_X11_OPEN:
1495                 case SSH_CHANNEL_INPUT_DRAINING:
1496                 case SSH_CHANNEL_OUTPUT_DRAINING:
1497                         snprintf(buf, sizeof buf, "  #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
1498                             c->self, c->remote_name,
1499                             c->type, c->remote_id,
1500                             c->istate, buffer_len(&c->input),
1501                             c->ostate, buffer_len(&c->output),
1502                             c->rfd, c->wfd);
1503                         buffer_append(&buffer, buf, strlen(buf));
1504                         continue;
1505                 default:
1506                         fatal("channel_open_message: bad channel type %d", c->type);
1507                         /* NOTREACHED */
1508                 }
1509         }
1510         buffer_append(&buffer, "\0", 1);
1511         cp = xstrdup(buffer_ptr(&buffer));
1512         buffer_free(&buffer);
1513         return cp;
1514 }
1515
1516 /*
1517  * Initiate forwarding of connections to local port "port" through the secure
1518  * channel to host:port from remote side.
1519  */
1520 void
1521 channel_request_local_forwarding(u_short listen_port, const char *host_to_connect,
1522     u_short port_to_connect, int gateway_ports)
1523 {
1524         channel_request_forwarding(
1525             NULL, listen_port,
1526             host_to_connect, port_to_connect,
1527             gateway_ports, /*remote_fwd*/ 0);
1528 }
1529
1530 /*
1531  * If 'remote_fwd' is true we have a '-R style' listener for protocol 2
1532  * (SSH_CHANNEL_RPORT_LISTENER).
1533  */
1534 void
1535 channel_request_forwarding(
1536     const char *listen_address, u_short listen_port,
1537     const char *host_to_connect, u_short port_to_connect,
1538     int gateway_ports, int remote_fwd)
1539 {
1540         int success, ch, sock, on = 1, ctype;
1541         struct addrinfo hints, *ai, *aitop;
1542         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1543         const char *host;
1544         struct linger linger;
1545
1546         if (remote_fwd) {
1547                 host = listen_address;
1548                 ctype = SSH_CHANNEL_RPORT_LISTENER;
1549         } else {
1550                 host = host_to_connect;
1551                 ctype  =SSH_CHANNEL_PORT_LISTENER;
1552         }
1553
1554         if (strlen(host) > sizeof(channels[0].path) - 1)
1555                 packet_disconnect("Forward host name too long.");
1556
1557         /* XXX listen_address is currently ignored */
1558         /*
1559          * getaddrinfo returns a loopback address if the hostname is
1560          * set to NULL and hints.ai_flags is not AI_PASSIVE
1561          */
1562         memset(&hints, 0, sizeof(hints));
1563         hints.ai_family = IPv4or6;
1564         hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1565         hints.ai_socktype = SOCK_STREAM;
1566         snprintf(strport, sizeof strport, "%d", listen_port);
1567         if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1568                 packet_disconnect("getaddrinfo: fatal error");
1569
1570         success = 0;
1571         for (ai = aitop; ai; ai = ai->ai_next) {
1572                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1573                         continue;
1574                 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1575                     strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1576                         error("channel_request_forwarding: getnameinfo failed");
1577                         continue;
1578                 }
1579                 /* Create a port to listen for the host. */
1580                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1581                 if (sock < 0) {
1582                         /* this is no error since kernel may not support ipv6 */
1583                         verbose("socket: %.100s", strerror(errno));
1584                         continue;
1585                 }
1586                 /*
1587                  * Set socket options.  We would like the socket to disappear
1588                  * as soon as it has been closed for whatever reason.
1589                  */
1590                 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1591                 linger.l_onoff = 1;
1592                 linger.l_linger = 5;
1593                 setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1594                 debug("Local forwarding listening on %s port %s.", ntop, strport);
1595
1596                 /* Bind the socket to the address. */
1597                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1598                         /* address can be in use ipv6 address is already bound */
1599                         if (!ai->ai_next)
1600                                 error("bind: %.100s", strerror(errno));
1601                         else
1602                                 verbose("bind: %.100s", strerror(errno));
1603
1604                         close(sock);
1605                         continue;
1606                 }
1607                 /* Start listening for connections on the socket. */
1608                 if (listen(sock, 5) < 0) {
1609                         error("listen: %.100s", strerror(errno));
1610                         close(sock);
1611                         continue;
1612                 }
1613                 /* Allocate a channel number for the socket. */
1614                 ch = channel_new("port listener", ctype, sock, sock, -1,
1615                     CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1616                     0, xstrdup("port listener"), 1);
1617                 strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
1618                 channels[ch].host_port = port_to_connect;
1619                 channels[ch].listening_port = listen_port;
1620                 success = 1;
1621         }
1622         if (success == 0)
1623                 packet_disconnect("cannot listen port: %d", listen_port);       /*XXX ?disconnect? */
1624         freeaddrinfo(aitop);
1625 }
1626
1627 /*
1628  * Initiate forwarding of connections to port "port" on remote host through
1629  * the secure channel to host:port from local side.
1630  */
1631
1632 void
1633 channel_request_remote_forwarding(u_short listen_port,
1634     const char *host_to_connect, u_short port_to_connect)
1635 {
1636         int payload_len, type, success = 0;
1637
1638         /* Record locally that connection to this host/port is permitted. */
1639         if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1640                 fatal("channel_request_remote_forwarding: too many forwards");
1641
1642         /* Send the forward request to the remote side. */
1643         if (compat20) {
1644                 const char *address_to_bind = "0.0.0.0";
1645                 packet_start(SSH2_MSG_GLOBAL_REQUEST);
1646                 packet_put_cstring("tcpip-forward");
1647                 packet_put_char(0);                     /* boolean: want reply */
1648                 packet_put_cstring(address_to_bind);
1649                 packet_put_int(listen_port);
1650                 packet_send();
1651                 packet_write_wait();
1652                 /* Assume that server accepts the request */
1653                 success = 1;
1654         } else {
1655                 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
1656                 packet_put_int(listen_port);
1657                 packet_put_cstring(host_to_connect);
1658                 packet_put_int(port_to_connect);
1659                 packet_send();
1660                 packet_write_wait();
1661
1662                 /* Wait for response from the remote side. */
1663                 type = packet_read(&payload_len);
1664                 switch (type) {
1665                 case SSH_SMSG_SUCCESS:
1666                         success = 1;
1667                         break;
1668                 case SSH_SMSG_FAILURE:
1669                         log("Warning: Server denied remote port forwarding.");
1670                         break;
1671                 default:
1672                         /* Unknown packet */
1673                         packet_disconnect("Protocol error for port forward request:"
1674                             "received packet type %d.", type);
1675                 }
1676         }
1677         if (success) {
1678                 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
1679                 permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
1680                 permitted_opens[num_permitted_opens].listen_port = listen_port;
1681                 num_permitted_opens++;
1682         }
1683 }
1684
1685 /*
1686  * This is called after receiving CHANNEL_FORWARDING_REQUEST.  This initates
1687  * listening for the port, and sends back a success reply (or disconnect
1688  * message if there was an error).  This never returns if there was an error.
1689  */
1690
1691 void
1692 channel_input_port_forward_request(int is_root, int gateway_ports)
1693 {
1694         u_short port, host_port;
1695         char *hostname;
1696
1697         /* Get arguments from the packet. */
1698         port = packet_get_int();
1699         hostname = packet_get_string(NULL);
1700         host_port = packet_get_int();
1701
1702 #ifndef HAVE_CYGWIN
1703         /*
1704          * Check that an unprivileged user is not trying to forward a
1705          * privileged port.
1706          */
1707         if (port < IPPORT_RESERVED && !is_root)
1708                 packet_disconnect("Requested forwarding of port %d but user is not root.",
1709                                   port);
1710 #endif
1711         /* Initiate forwarding */
1712         channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
1713
1714         /* Free the argument string. */
1715         xfree(hostname);
1716 }
1717
1718 /* XXX move to aux.c */
1719 int
1720 channel_connect_to(const char *host, u_short host_port)
1721 {
1722         struct addrinfo hints, *ai, *aitop;
1723         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1724         int gaierr;
1725         int sock = -1;
1726
1727         memset(&hints, 0, sizeof(hints));
1728         hints.ai_family = IPv4or6;
1729         hints.ai_socktype = SOCK_STREAM;
1730         snprintf(strport, sizeof strport, "%d", host_port);
1731         if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1732                 error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
1733                 return -1;
1734         }
1735         for (ai = aitop; ai; ai = ai->ai_next) {
1736                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1737                         continue;
1738                 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1739                     strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1740                         error("channel_connect_to: getnameinfo failed");
1741                         continue;
1742                 }
1743                 /* Create the socket. */
1744                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1745                 if (sock < 0) {
1746                         error("socket: %.100s", strerror(errno));
1747                         continue;
1748                 }
1749                 if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0)
1750                         fatal("connect_to: F_SETFL: %s", strerror(errno));
1751                 /* Connect to the host/port. */
1752                 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 &&
1753                     errno != EINPROGRESS) {
1754                         error("connect %.100s port %s: %.100s", ntop, strport,
1755                             strerror(errno));
1756                         close(sock);
1757                         continue;       /* fail -- try next */
1758                 }
1759                 break; /* success */
1760
1761         }
1762         freeaddrinfo(aitop);
1763         if (!ai) {
1764                 error("connect %.100s port %d: failed.", host, host_port);
1765                 return -1;
1766         }
1767         /* success */
1768         return sock;
1769 }
1770 int
1771 channel_connect_by_listen_adress(u_short listen_port)
1772 {
1773         int i;
1774         for (i = 0; i < num_permitted_opens; i++)
1775                 if (permitted_opens[i].listen_port == listen_port)
1776                         return channel_connect_to(
1777                             permitted_opens[i].host_to_connect,
1778                             permitted_opens[i].port_to_connect);
1779         error("WARNING: Server requests forwarding for unknown listen_port %d",
1780             listen_port);
1781         return -1;
1782 }
1783
1784 /*
1785  * This is called after receiving PORT_OPEN message.  This attempts to
1786  * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1787  * or CHANNEL_OPEN_FAILURE.
1788  */
1789
1790 void
1791 channel_input_port_open(int type, int plen, void *ctxt)
1792 {
1793         u_short host_port;
1794         char *host, *originator_string;
1795         int remote_channel, sock = -1, newch, i, denied;
1796         u_int host_len, originator_len;
1797
1798         /* Get remote channel number. */
1799         remote_channel = packet_get_int();
1800
1801         /* Get host name to connect to. */
1802         host = packet_get_string(&host_len);
1803
1804         /* Get port to connect to. */
1805         host_port = packet_get_int();
1806
1807         /* Get remote originator name. */
1808         if (have_hostname_in_open) {
1809                 originator_string = packet_get_string(&originator_len);
1810                 originator_len += 4;    /* size of packet_int */
1811         } else {
1812                 originator_string = xstrdup("unknown (remote did not supply name)");
1813                 originator_len = 0;     /* no originator supplied */
1814         }
1815
1816         packet_integrity_check(plen,
1817             4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
1818
1819         /* Check if opening that port is permitted. */
1820         denied = 0;
1821         if (!all_opens_permitted) {
1822                 /* Go trough all permitted ports. */
1823                 for (i = 0; i < num_permitted_opens; i++)
1824                         if (permitted_opens[i].port_to_connect == host_port &&
1825                             strcmp(permitted_opens[i].host_to_connect, host) == 0)
1826                                 break;
1827
1828                 /* Check if we found the requested port among those permitted. */
1829                 if (i >= num_permitted_opens) {
1830                         /* The port is not permitted. */
1831                         log("Received request to connect to %.100s:%d, but the request was denied.",
1832                             host, host_port);
1833                         denied = 1;
1834                 }
1835         }
1836         sock = denied ? -1 : channel_connect_to(host, host_port);
1837         if (sock > 0) {
1838                 /* Allocate a channel for this connection. */
1839                 newch = channel_allocate(SSH_CHANNEL_CONNECTING,
1840                     sock, originator_string);
1841 /*XXX delay answer? */
1842                 channels[newch].remote_id = remote_channel;
1843
1844                 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1845                 packet_put_int(remote_channel);
1846                 packet_put_int(newch);
1847                 packet_send();
1848         } else {
1849                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1850                 packet_put_int(remote_channel);
1851                 packet_send();
1852         }
1853         xfree(host);
1854 }
1855
1856 /*
1857  * Creates an internet domain socket for listening for X11 connections.
1858  * Returns a suitable value for the DISPLAY variable, or NULL if an error
1859  * occurs.
1860  */
1861
1862 #define NUM_SOCKS       10
1863
1864 char *
1865 x11_create_display_inet(int screen_number, int x11_display_offset)
1866 {
1867         int display_number, sock;
1868         u_short port;
1869         struct addrinfo hints, *ai, *aitop;
1870         char strport[NI_MAXSERV];
1871         int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1872         char display[512];
1873         char hostname[MAXHOSTNAMELEN];
1874
1875         for (display_number = x11_display_offset;
1876              display_number < MAX_DISPLAYS;
1877              display_number++) {
1878                 port = 6000 + display_number;
1879                 memset(&hints, 0, sizeof(hints));
1880                 hints.ai_family = IPv4or6;
1881                 hints.ai_flags = AI_PASSIVE;            /* XXX loopback only ? */
1882                 hints.ai_socktype = SOCK_STREAM;
1883                 snprintf(strport, sizeof strport, "%d", port);
1884                 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1885                         error("getaddrinfo: %.100s", gai_strerror(gaierr));
1886                         return NULL;
1887                 }
1888                 for (ai = aitop; ai; ai = ai->ai_next) {
1889                         if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1890                                 continue;
1891                         sock = socket(ai->ai_family, SOCK_STREAM, 0);
1892                         if (sock < 0) {
1893                                 if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) {
1894                                         error("socket: %.100s", strerror(errno));
1895                                         return NULL;
1896                                 } else {
1897                                         debug("x11_create_display_inet: Socket family %d not supported",
1898                                                  ai->ai_family);
1899                                         continue;
1900                                 }
1901                         }
1902                         if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1903                                 debug("bind port %d: %.100s", port, strerror(errno));
1904                                 shutdown(sock, SHUT_RDWR);
1905                                 close(sock);
1906
1907                                 if (ai->ai_next)
1908                                         continue;
1909
1910                                 for (n = 0; n < num_socks; n++) {
1911                                         shutdown(socks[n], SHUT_RDWR);
1912                                         close(socks[n]);
1913                                 }
1914                                 num_socks = 0;
1915                                 break;
1916                         }
1917                         socks[num_socks++] = sock;
1918 #ifndef DONT_TRY_OTHER_AF
1919                         if (num_socks == NUM_SOCKS)
1920                                 break;
1921 #else
1922                         break;
1923 #endif
1924                 }
1925                 freeaddrinfo(aitop);
1926                 if (num_socks > 0)
1927                         break;
1928         }
1929         if (display_number >= MAX_DISPLAYS) {
1930                 error("Failed to allocate internet-domain X11 display socket.");
1931                 return NULL;
1932         }
1933         /* Start listening for connections on the socket. */
1934         for (n = 0; n < num_socks; n++) {
1935                 sock = socks[n];
1936                 if (listen(sock, 5) < 0) {
1937                         error("listen: %.100s", strerror(errno));
1938                         shutdown(sock, SHUT_RDWR);
1939                         close(sock);
1940                         return NULL;
1941                 }
1942         }
1943
1944         /* Set up a suitable value for the DISPLAY variable. */
1945         if (gethostname(hostname, sizeof(hostname)) < 0)
1946                 fatal("gethostname: %.100s", strerror(errno));
1947
1948 #ifdef IPADDR_IN_DISPLAY
1949         /*
1950          * HPUX detects the local hostname in the DISPLAY variable and tries
1951          * to set up a shared memory connection to the server, which it
1952          * incorrectly supposes to be local.
1953          *
1954          * The workaround - as used in later $$H and other programs - is
1955          * is to set display to the host's IP address.
1956          */
1957         {
1958                 struct hostent *he;
1959                 struct in_addr my_addr;
1960
1961                 he = gethostbyname(hostname);
1962                 if (he == NULL) {
1963                         error("[X11-broken-fwd-hostname-workaround] Could not get "
1964                                 "IP address for hostname %s.", hostname);
1965
1966                         packet_send_debug("[X11-broken-fwd-hostname-workaround]"
1967                                 "Could not get IP address for hostname %s.", hostname);
1968
1969                         shutdown(sock, SHUT_RDWR);
1970                         close(sock);
1971
1972                         return NULL;
1973                 }
1974
1975                 memcpy(&my_addr, he->h_addr_list[0], sizeof(struct in_addr));
1976
1977                 /* Set DISPLAY to <ip address>:screen.display */
1978                 snprintf(display, sizeof(display), "%.50s:%d.%d", inet_ntoa(my_addr),
1979                          display_number, screen_number);
1980         }
1981 #else /* IPADDR_IN_DISPLAY */
1982         /* Just set DISPLAY to hostname:screen.display */
1983         snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
1984                  display_number, screen_number);
1985 #endif /* IPADDR_IN_DISPLAY */
1986
1987         /* Allocate a channel for each socket. */
1988         for (n = 0; n < num_socks; n++) {
1989                 sock = socks[n];
1990                 (void) channel_new("x11 listener",
1991                     SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
1992                     CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
1993                     0, xstrdup("X11 inet listener"), 1);
1994         }
1995
1996         /* Return a suitable value for the DISPLAY environment variable. */
1997         return xstrdup(display);
1998 }
1999
2000 #ifndef X_UNIX_PATH
2001 #define X_UNIX_PATH "/tmp/.X11-unix/X"
2002 #endif
2003
2004 static
2005 int
2006 connect_local_xsocket(u_int dnr)
2007 {
2008         static const char *const x_sockets[] = {
2009                 X_UNIX_PATH "%u",
2010                 "/var/X/.X11-unix/X" "%u",
2011                 "/usr/spool/sockets/X11/" "%u",
2012                 NULL
2013         };
2014         int sock;
2015         struct sockaddr_un addr;
2016         const char *const * path;
2017
2018         for (path = x_sockets; *path; ++path) {
2019                 sock = socket(AF_UNIX, SOCK_STREAM, 0);
2020                 if (sock < 0)
2021                         error("socket: %.100s", strerror(errno));
2022                 memset(&addr, 0, sizeof(addr));
2023                 addr.sun_family = AF_UNIX;
2024                 snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
2025                 if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
2026                         return sock;
2027                 close(sock);
2028         }
2029         error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
2030         return -1;
2031 }
2032
2033 int
2034 x11_connect_display(void)
2035 {
2036         int display_number, sock = 0;
2037         const char *display;
2038         char buf[1024], *cp;
2039         struct addrinfo hints, *ai, *aitop;
2040         char strport[NI_MAXSERV];
2041         int gaierr;
2042
2043         /* Try to open a socket for the local X server. */
2044         display = getenv("DISPLAY");
2045         if (!display) {
2046                 error("DISPLAY not set.");
2047                 return -1;
2048         }
2049         /*
2050          * Now we decode the value of the DISPLAY variable and make a
2051          * connection to the real X server.
2052          */
2053
2054         /*
2055          * Check if it is a unix domain socket.  Unix domain displays are in
2056          * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
2057          */
2058         if (strncmp(display, "unix:", 5) == 0 ||
2059             display[0] == ':') {
2060                 /* Connect to the unix domain socket. */
2061                 if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
2062                         error("Could not parse display number from DISPLAY: %.100s",
2063                               display);
2064                         return -1;
2065                 }
2066                 /* Create a socket. */
2067                 sock = connect_local_xsocket(display_number);
2068                 if (sock < 0)
2069                         return -1;
2070
2071                 /* OK, we now have a connection to the display. */
2072                 return sock;
2073         }
2074         /*
2075          * Connect to an inet socket.  The DISPLAY value is supposedly
2076          * hostname:d[.s], where hostname may also be numeric IP address.
2077          */
2078         strncpy(buf, display, sizeof(buf));
2079         buf[sizeof(buf) - 1] = 0;
2080         cp = strchr(buf, ':');
2081         if (!cp) {
2082                 error("Could not find ':' in DISPLAY: %.100s", display);
2083                 return -1;
2084         }
2085         *cp = 0;
2086         /* buf now contains the host name.  But first we parse the display number. */
2087         if (sscanf(cp + 1, "%d", &display_number) != 1) {
2088                 error("Could not parse display number from DISPLAY: %.100s",
2089                       display);
2090                 return -1;
2091         }
2092
2093         /* Look up the host address */
2094         memset(&hints, 0, sizeof(hints));
2095         hints.ai_family = IPv4or6;
2096         hints.ai_socktype = SOCK_STREAM;
2097         snprintf(strport, sizeof strport, "%d", 6000 + display_number);
2098         if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
2099                 error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
2100                 return -1;
2101         }
2102         for (ai = aitop; ai; ai = ai->ai_next) {
2103                 /* Create a socket. */
2104                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
2105                 if (sock < 0) {
2106                         debug("socket: %.100s", strerror(errno));
2107                         continue;
2108                 }
2109                 /* Connect it to the display. */
2110                 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2111                         debug("connect %.100s port %d: %.100s", buf,
2112                             6000 + display_number, strerror(errno));
2113                         close(sock);
2114                         continue;
2115                 }
2116                 /* Success */
2117                 break;
2118         }
2119         freeaddrinfo(aitop);
2120         if (!ai) {
2121                 error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
2122                     strerror(errno));
2123                 return -1;
2124         }
2125         return sock;
2126 }
2127
2128 /*
2129  * This is called when SSH_SMSG_X11_OPEN is received.  The packet contains
2130  * the remote channel number.  We should do whatever we want, and respond
2131  * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
2132  */
2133
2134 void
2135 x11_input_open(int type, int plen, void *ctxt)
2136 {
2137         int remote_channel, sock = 0, newch;
2138         char *remote_host;
2139         u_int remote_len;
2140
2141         /* Get remote channel number. */
2142         remote_channel = packet_get_int();
2143
2144         /* Get remote originator name. */
2145         if (have_hostname_in_open) {
2146                 remote_host = packet_get_string(&remote_len);
2147                 remote_len += 4;
2148         } else {
2149                 remote_host = xstrdup("unknown (remote did not supply name)");
2150                 remote_len = 0;
2151         }
2152
2153         debug("Received X11 open request.");
2154         packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
2155
2156         /* Obtain a connection to the real X display. */
2157         sock = x11_connect_display();
2158         if (sock == -1) {
2159                 /* Send refusal to the remote host. */
2160                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2161                 packet_put_int(remote_channel);
2162                 packet_send();
2163         } else {
2164                 /* Allocate a channel for this connection. */
2165                 newch = channel_allocate(
2166                      (x11_saved_proto == NULL) ?
2167                      SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
2168                      sock, remote_host);
2169                 channels[newch].remote_id = remote_channel;
2170
2171                 /* Send a confirmation to the remote host. */
2172                 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2173                 packet_put_int(remote_channel);
2174                 packet_put_int(newch);
2175                 packet_send();
2176         }
2177 }
2178
2179 /* dummy protocol handler that denies SSH-1 requests (agent/x11) */
2180 void
2181 deny_input_open(int type, int plen, void *ctxt)
2182 {
2183         int rchan = packet_get_int();
2184         switch(type){
2185         case SSH_SMSG_AGENT_OPEN:
2186                 error("Warning: ssh server tried agent forwarding.");
2187                 break;
2188         case SSH_SMSG_X11_OPEN:
2189                 error("Warning: ssh server tried X11 forwarding.");
2190                 break;
2191         default:
2192                 error("deny_input_open: type %d plen %d", type, plen);
2193                 break;
2194         }
2195         error("Warning: this is probably a break in attempt by a malicious server.");
2196         packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2197         packet_put_int(rchan);
2198         packet_send();
2199 }
2200
2201 /*
2202  * Requests forwarding of X11 connections, generates fake authentication
2203  * data, and enables authentication spoofing.
2204  */
2205
2206 void
2207 x11_request_forwarding_with_spoofing(int client_session_id,
2208     const char *proto, const char *data)
2209 {
2210         u_int data_len = (u_int) strlen(data) / 2;
2211         u_int i, value;
2212         char *new_data;
2213         int screen_number;
2214         const char *cp;
2215         u_int32_t rand = 0;
2216
2217         cp = getenv("DISPLAY");
2218         if (cp)
2219                 cp = strchr(cp, ':');
2220         if (cp)
2221                 cp = strchr(cp, '.');
2222         if (cp)
2223                 screen_number = atoi(cp + 1);
2224         else
2225                 screen_number = 0;
2226
2227         /* Save protocol name. */
2228         x11_saved_proto = xstrdup(proto);
2229
2230         /*
2231          * Extract real authentication data and generate fake data of the
2232          * same length.
2233          */
2234         x11_saved_data = xmalloc(data_len);
2235         x11_fake_data = xmalloc(data_len);
2236         for (i = 0; i < data_len; i++) {
2237                 if (sscanf(data + 2 * i, "%2x", &value) != 1)
2238                         fatal("x11_request_forwarding: bad authentication data: %.100s", data);
2239                 if (i % 4 == 0)
2240                         rand = arc4random();
2241                 x11_saved_data[i] = value;
2242                 x11_fake_data[i] = rand & 0xff;
2243                 rand >>= 8;
2244         }
2245         x11_saved_data_len = data_len;
2246         x11_fake_data_len = data_len;
2247
2248         /* Convert the fake data into hex. */
2249         new_data = xmalloc(2 * data_len + 1);
2250         for (i = 0; i < data_len; i++)
2251                 sprintf(new_data + 2 * i, "%02x", (u_char) x11_fake_data[i]);
2252
2253         /* Send the request packet. */
2254         if (compat20) {
2255                 channel_request_start(client_session_id, "x11-req", 0);
2256                 packet_put_char(0);     /* XXX bool single connection */
2257         } else {
2258                 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2259         }
2260         packet_put_cstring(proto);
2261         packet_put_cstring(new_data);
2262         packet_put_int(screen_number);
2263         packet_send();
2264         packet_write_wait();
2265         xfree(new_data);
2266 }
2267
2268 /* Sends a message to the server to request authentication fd forwarding. */
2269
2270 void
2271 auth_request_forwarding()
2272 {
2273         packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2274         packet_send();
2275         packet_write_wait();
2276 }
2277
2278 /*
2279  * Returns the name of the forwarded authentication socket.  Returns NULL if
2280  * there is no forwarded authentication socket.  The returned value points to
2281  * a static buffer.
2282  */
2283
2284 char *
2285 auth_get_socket_name()
2286 {
2287         return channel_forwarded_auth_socket_name;
2288 }
2289
2290 /* removes the agent forwarding socket */
2291
2292 void
2293 cleanup_socket(void)
2294 {
2295         unlink(channel_forwarded_auth_socket_name);
2296         rmdir(channel_forwarded_auth_socket_dir);
2297 }
2298
2299 /*
2300  * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
2301  * This starts forwarding authentication requests.
2302  */
2303
2304 int
2305 auth_input_request_forwarding(struct passwd * pw)
2306 {
2307         int sock, newch;
2308         struct sockaddr_un sunaddr;
2309
2310         if (auth_get_socket_name() != NULL)
2311                 fatal("Protocol error: authentication forwarding requested twice.");
2312
2313         /* Temporarily drop privileged uid for mkdir/bind. */
2314         temporarily_use_uid(pw->pw_uid);
2315
2316         /* Allocate a buffer for the socket name, and format the name. */
2317         channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2318         channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2319         strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
2320
2321         /* Create private directory for socket */
2322         if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {
2323                 packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",
2324                     strerror(errno));
2325                 restore_uid();
2326                 xfree(channel_forwarded_auth_socket_name);
2327                 xfree(channel_forwarded_auth_socket_dir);
2328                 channel_forwarded_auth_socket_name = NULL;
2329                 channel_forwarded_auth_socket_dir = NULL;
2330                 return 0;
2331         }
2332         snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2333                  channel_forwarded_auth_socket_dir, (int) getpid());
2334
2335         if (atexit(cleanup_socket) < 0) {
2336                 int saved = errno;
2337                 cleanup_socket();
2338                 packet_disconnect("socket: %.100s", strerror(saved));
2339         }
2340         /* Create the socket. */
2341         sock = socket(AF_UNIX, SOCK_STREAM, 0);
2342         if (sock < 0)
2343                 packet_disconnect("socket: %.100s", strerror(errno));
2344
2345         /* Bind it to the name. */
2346         memset(&sunaddr, 0, sizeof(sunaddr));
2347         sunaddr.sun_family = AF_UNIX;
2348         strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2349                 sizeof(sunaddr.sun_path));
2350
2351         if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2352                 packet_disconnect("bind: %.100s", strerror(errno));
2353
2354         /* Restore the privileged uid. */
2355         restore_uid();
2356
2357         /* Start listening on the socket. */
2358         if (listen(sock, 5) < 0)
2359                 packet_disconnect("listen: %.100s", strerror(errno));
2360
2361         /* Allocate a channel for the authentication agent socket. */
2362         newch = channel_new("auth socket",
2363             SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
2364             CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
2365             0, xstrdup("auth socket"), 1);
2366
2367         strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2368             sizeof(channels[newch].path));
2369         return 1;
2370 }
2371
2372 /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2373
2374 void
2375 auth_input_open_request(int type, int plen, void *ctxt)
2376 {
2377         int remch, sock, newch;
2378         char *dummyname;
2379
2380         packet_integrity_check(plen, 4, type);
2381
2382         /* Read the remote channel number from the message. */
2383         remch = packet_get_int();
2384
2385         /*
2386          * Get a connection to the local authentication agent (this may again
2387          * get forwarded).
2388          */
2389         sock = ssh_get_authentication_socket();
2390
2391         /*
2392          * If we could not connect the agent, send an error message back to
2393          * the server. This should never happen unless the agent dies,
2394          * because authentication forwarding is only enabled if we have an
2395          * agent.
2396          */
2397         if (sock < 0) {
2398                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2399                 packet_put_int(remch);
2400                 packet_send();
2401                 return;
2402         }
2403         debug("Forwarding authentication connection.");
2404
2405         /*
2406          * Dummy host name.  This will be freed when the channel is freed; it
2407          * will still be valid in the packet_put_string below since the
2408          * channel cannot yet be freed at that point.
2409          */
2410         dummyname = xstrdup("authentication agent connection");
2411
2412         newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2413         channels[newch].remote_id = remch;
2414
2415         /* Send a confirmation to the remote host. */
2416         packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2417         packet_put_int(remch);
2418         packet_put_int(newch);
2419         packet_send();
2420 }
2421
2422 void
2423 channel_start_open(int id)
2424 {
2425         Channel *c = channel_lookup(id);
2426         if (c == NULL) {
2427                 log("channel_open: %d: bad id", id);
2428                 return;
2429         }
2430         debug("send channel open %d", id);
2431         packet_start(SSH2_MSG_CHANNEL_OPEN);
2432         packet_put_cstring(c->ctype);
2433         packet_put_int(c->self);
2434         packet_put_int(c->local_window);
2435         packet_put_int(c->local_maxpacket);
2436 }
2437 void
2438 channel_open(int id)
2439 {
2440         /* XXX REMOVE ME */
2441         channel_start_open(id);
2442         packet_send();
2443 }
2444 void
2445 channel_request(int id, char *service, int wantconfirm)
2446 {
2447         channel_request_start(id, service, wantconfirm);
2448         packet_send();
2449         debug("channel request %d: %s", id, service) ;
2450 }
2451 void
2452 channel_request_start(int id, char *service, int wantconfirm)
2453 {
2454         Channel *c = channel_lookup(id);
2455         if (c == NULL) {
2456                 log("channel_request: %d: bad id", id);
2457                 return;
2458         }
2459         packet_start(SSH2_MSG_CHANNEL_REQUEST);
2460         packet_put_int(c->remote_id);
2461         packet_put_cstring(service);
2462         packet_put_char(wantconfirm);
2463 }
2464 void
2465 channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2466 {
2467         Channel *c = channel_lookup(id);
2468         if (c == NULL) {
2469                 log("channel_register_callback: %d: bad id", id);
2470                 return;
2471         }
2472         c->cb_event = mtype;
2473         c->cb_fn = fn;
2474         c->cb_arg = arg;
2475 }
2476 void
2477 channel_register_cleanup(int id, channel_callback_fn *fn)
2478 {
2479         Channel *c = channel_lookup(id);
2480         if (c == NULL) {
2481                 log("channel_register_cleanup: %d: bad id", id);
2482                 return;
2483         }
2484         c->dettach_user = fn;
2485 }
2486 void
2487 channel_cancel_cleanup(int id)
2488 {
2489         Channel *c = channel_lookup(id);
2490         if (c == NULL) {
2491                 log("channel_cancel_cleanup: %d: bad id", id);
2492                 return;
2493         }
2494         c->dettach_user = NULL;
2495 }
2496 void
2497 channel_register_filter(int id, channel_filter_fn *fn)
2498 {
2499         Channel *c = channel_lookup(id);
2500         if (c == NULL) {
2501                 log("channel_register_filter: %d: bad id", id);
2502                 return;
2503         }
2504         c->input_filter = fn;
2505 }
2506
2507 void
2508 channel_set_fds(int id, int rfd, int wfd, int efd,
2509     int extusage, int nonblock)
2510 {
2511         Channel *c = channel_lookup(id);
2512         if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2513                 fatal("channel_activate for non-larval channel %d.", id);
2514         channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
2515         c->type = SSH_CHANNEL_OPEN;
2516         /* XXX window size? */
2517         c->local_window = c->local_window_max = c->local_maxpacket * 2;
2518         packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2519         packet_put_int(c->remote_id);
2520         packet_put_int(c->local_window);
2521         packet_send();
2522 }