channels.c

   1 /*
   2  *
   3  * channels.c
   4  *
   5  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   6  *
   7  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   8  *                    All rights reserved
   9  *
  10  * Created: Fri Mar 24 16:35:24 1995 ylo
  11  *
  12  * This file contains functions for generic socket connection forwarding.
  13  * There is also code for initiating connection forwarding for X11 connections,
  14  * arbitrary tcp/ip connections, and the authentication agent connection.
  15  *
  16  * SSH2 support added by Markus Friedl.
  17  */
  18
  19 #include "includes.h"
  20 RCSID("$Id$");
  21
  22 #include "ssh.h"
  23 #include "packet.h"
  24 #include "xmalloc.h"
  25 #include "buffer.h"
  26 #include "authfd.h"
  27 #include "uidswap.h"
  28 #include "readconf.h"
  29 #include "servconf.h"
  30
  31 #include "channels.h"
  32 #include "nchan.h"
  33 #include "compat.h"
  34
  35 #include "ssh2.h"
  36
  37 /* Maximum number of fake X11 displays to try. */
  38 #define MAX_DISPLAYS  1000
  39
  40 /* Max len of agent socket */
  41 #define MAX_SOCKET_NAME 100
  42
  43 /* default buffer for tcp-fwd-channel */
  44 #define CHAN_WINDOW_DEFAULT      (8*1024)
  45 #define CHAN_PACKET_DEFAULT      (CHAN_WINDOW_DEFAULT/2)
  46
  47 /*
  48  * Pointer to an array containing all allocated channels.  The array is
  49  * dynamically extended as needed.
  50  */
  51 static Channel *channels = NULL;
  52
  53 /*
  54  * Size of the channel array.  All slots of the array must always be
  55  * initialized (at least the type field); unused slots are marked with type
  56  * SSH_CHANNEL_FREE.
  57  */
  58 static int channels_alloc = 0;
  59
  60 /*
  61  * Maximum file descriptor value used in any of the channels.  This is
  62  * updated in channel_allocate.
  63  */
  64 static int channel_max_fd_value = 0;
  65
  66 /* Name and directory of socket for authentication agent forwarding. */
  67 static char *channel_forwarded_auth_socket_name = NULL;
  68 static char *channel_forwarded_auth_socket_dir = NULL;
  69
  70 /* Saved X11 authentication protocol name. */
  71 char *x11_saved_proto = NULL;
  72
  73 /* Saved X11 authentication data.  This is the real data. */
  74 char *x11_saved_data = NULL;
  75 unsigned int x11_saved_data_len = 0;
  76
  77 /*
  78  * Fake X11 authentication data.  This is what the server will be sending us;
  79  * we should replace any occurrences of this by the real data.
  80  */
  81 char *x11_fake_data = NULL;
  82 unsigned int x11_fake_data_len;
  83
  84 /*
  85  * Data structure for storing which hosts are permitted for forward requests.
  86  * The local sides of any remote forwards are stored in this array to prevent
  87  * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
  88  * network (which might be behind a firewall).
  89  */
  90 typedef struct {
  91         char *host_to_connect;          /* Connect to 'host'. */
  92         u_short port_to_connect;        /* Connect to 'port'. */
  93         u_short listen_port;            /* Remote side should listen port number. */
  94 } ForwardPermission;
  95
  96 /* List of all permitted host/port pairs to connect. */
  97 static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
  98 /* Number of permitted host/port pairs in the array. */
  99 static int num_permitted_opens = 0;
 100 /*
 101  * If this is true, all opens are permitted.  This is the case on the server
 102  * on which we have to trust the client anyway, and the user could do
 103  * anything after logging in anyway.
 104  */
 105 static int all_opens_permitted = 0;
 106
 107 /* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
 108 static int have_hostname_in_open = 0;
 109
 110 /* Sets specific protocol options. */
 111
 112 void
 113 channel_set_options(int hostname_in_open)
 114 {
 115         have_hostname_in_open = hostname_in_open;
 116 }
 117
 118 /*
 119  * Permits opening to any host/port in SSH_MSG_PORT_OPEN.  This is usually
 120  * called by the server, because the user could connect to any port anyway,
 121  * and the server has no way to know but to trust the client anyway.
 122  */
 123
 124 void
 125 channel_permit_all_opens()
 126 {
 127         all_opens_permitted = 1;
 128 }
 129
 130 /* lookup channel by id */
 131
 132 Channel *
 133 channel_lookup(int id)
 134 {
 135         Channel *c;
 136         if (id < 0 && id > channels_alloc) {
 137                 log("channel_lookup: %d: bad id", id);
 138                 return NULL;
 139         }
 140         c = &channels[id];
 141         if (c->type == SSH_CHANNEL_FREE) {
 142                 log("channel_lookup: %d: bad id: channel free", id);
 143                 return NULL;
 144         }
 145         return c;
 146 }
 147
 148 /*
 149  * Allocate a new channel object and set its type and socket. This will cause
 150  * remote_name to be freed.
 151  */
 152
 153 int
 154 channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 155     int window, int maxpack, int extended_usage, char *remote_name)
 156 {
 157         int i, found;
 158         Channel *c;
 159
 160         /* Update the maximum file descriptor value. */
 161         if (rfd > channel_max_fd_value)
 162                 channel_max_fd_value = rfd;
 163         if (wfd > channel_max_fd_value)
 164                 channel_max_fd_value = wfd;
 165         if (efd > channel_max_fd_value)
 166                 channel_max_fd_value = efd;
 167         /* XXX set close-on-exec -markus */
 168
 169         /* Do initial allocation if this is the first call. */
 170         if (channels_alloc == 0) {
 171                 chan_init();
 172                 channels_alloc = 10;
 173                 channels = xmalloc(channels_alloc * sizeof(Channel));
 174                 for (i = 0; i < channels_alloc; i++)
 175                         channels[i].type = SSH_CHANNEL_FREE;
 176                 /*
 177                  * Kludge: arrange a call to channel_stop_listening if we
 178                  * terminate with fatal().
 179                  */
 180                 fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
 181         }
 182         /* Try to find a free slot where to put the new channel. */
 183         for (found = -1, i = 0; i < channels_alloc; i++)
 184                 if (channels[i].type == SSH_CHANNEL_FREE) {
 185                         /* Found a free slot. */
 186                         found = i;
 187                         break;
 188                 }
 189         if (found == -1) {
 190                 /* There are no free slots.  Take last+1 slot and expand the array.  */
 191                 found = channels_alloc;
 192                 channels_alloc += 10;
 193                 debug("channel: expanding %d", channels_alloc);
 194                 channels = xrealloc(channels, channels_alloc * sizeof(Channel));
 195                 for (i = found; i < channels_alloc; i++)
 196                         channels[i].type = SSH_CHANNEL_FREE;
 197         }
 198         /* Initialize and return new channel number. */
 199         c = &channels[found];
 200         buffer_init(&c->input);
 201         buffer_init(&c->output);
 202         buffer_init(&c->extended);
 203         chan_init_iostates(c);
 204         c->self = found;
 205         c->type = type;
 206         c->ctype = ctype;
 207         c->local_window = window;
 208         c->local_window_max = window;
 209         c->local_consumed = 0;
 210         c->local_maxpacket = maxpack;
 211         c->remote_window = 0;
 212         c->remote_maxpacket = 0;
 213         c->rfd = rfd;
 214         c->wfd = wfd;
 215         c->sock = (rfd == wfd) ? rfd : -1;
 216         c->efd = efd;
 217         c->extended_usage = extended_usage;
 218         c->remote_id = -1;
 219         c->remote_name = remote_name;
 220         c->remote_window = 0;
 221         c->remote_maxpacket = 0;
 222         c->cb_fn = NULL;
 223         c->cb_arg = NULL;
 224         c->cb_event = 0;
 225         c->dettach_user = NULL;
 226         debug("channel %d: new [%s]", found, remote_name);
 227         return found;
 228 }
 229 int
 230 channel_allocate(int type, int sock, char *remote_name)
 231 {
 232         return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name);
 233 }
 234
 235 /* Free the channel and close its socket. */
 236
 237 void
 238 channel_free(int id)
 239 {
 240         Channel *c = channel_lookup(id);
 241         if (c == NULL)
 242                 packet_disconnect("channel free: bad local channel %d", id);
 243         debug("channel_free: channel %d: status: %s", id, channel_open_message());
 244         if (c->dettach_user != NULL) {
 245                 debug("channel_free: channel %d: dettaching channel user", id);
 246                 c->dettach_user(c->self, NULL);
 247         }
 248         if (c->sock != -1) {
 249                 shutdown(c->sock, SHUT_RDWR);
 250                 close(c->sock);
 251                 c->sock = -1;
 252         }
 253         if (compat20) {
 254                 if (c->rfd != -1) {
 255                         close(c->rfd);
 256                         c->rfd = -1;
 257                 }
 258                 if (c->wfd != -1) {
 259                         close(c->wfd);
 260                         c->wfd = -1;
 261                 }
 262                 if (c->efd != -1) {
 263                         close(c->efd);
 264                         c->efd = -1;
 265                 }
 266         }
 267         buffer_free(&c->input);
 268         buffer_free(&c->output);
 269         buffer_free(&c->extended);
 270         c->type = SSH_CHANNEL_FREE;
 271         if (c->remote_name) {
 272                 xfree(c->remote_name);
 273                 c->remote_name = NULL;
 274         }
 275 }
 276
 277 /*
 278  * 'channel_pre*' are called just before select() to add any bits relevant to
 279  * channels in the select bitmasks.
 280  */
 281 /*
 282  * 'channel_post*': perform any appropriate operations for channels which
 283  * have events pending.
 284  */
 285 typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
 286 chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
 287 chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
 288
 289 void
 290 channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
 291 {
 292         FD_SET(c->sock, readset);
 293 }
 294
 295 void
 296 channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
 297 {
 298         if (buffer_len(&c->input) < packet_get_maxsize())
 299                 FD_SET(c->sock, readset);
 300         if (buffer_len(&c->output) > 0)
 301                 FD_SET(c->sock, writeset);
 302 }
 303
 304 void
 305 channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
 306 {
 307         /* test whether sockets are 'alive' for read/write */
 308         if (c->istate == CHAN_INPUT_OPEN)
 309                 if (buffer_len(&c->input) < packet_get_maxsize())
 310                         FD_SET(c->sock, readset);
 311         if (c->ostate == CHAN_OUTPUT_OPEN ||
 312             c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 313                 if (buffer_len(&c->output) > 0) {
 314                         FD_SET(c->sock, writeset);
 315                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 316                         chan_obuf_empty(c);
 317                 }
 318         }
 319 }
 320
 321 void
 322 channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
 323 {
 324         if (c->istate == CHAN_INPUT_OPEN &&
 325             c->remote_window > 0 &&
 326             buffer_len(&c->input) < c->remote_window)
 327                 FD_SET(c->rfd, readset);
 328         if (c->ostate == CHAN_OUTPUT_OPEN ||
 329             c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 330                 if (buffer_len(&c->output) > 0) {
 331                         FD_SET(c->wfd, writeset);
 332                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 333                         chan_obuf_empty(c);
 334                 }
 335         }
 336         /** XXX check close conditions, too */
 337         if (c->efd != -1) {
 338                 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
 339                     buffer_len(&c->extended) > 0)
 340                         FD_SET(c->efd, writeset);
 341                 else if (c->extended_usage == CHAN_EXTENDED_READ &&
 342                     buffer_len(&c->extended) < c->remote_window)
 343                         FD_SET(c->efd, readset);
 344         }
 345 }
 346
 347 void
 348 channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
 349 {
 350         if (buffer_len(&c->input) == 0) {
 351                 packet_start(SSH_MSG_CHANNEL_CLOSE);
 352                 packet_put_int(c->remote_id);
 353                 packet_send();
 354                 c->type = SSH_CHANNEL_CLOSED;
 355                 debug("Closing channel %d after input drain.", c->self);
 356         }
 357 }
 358
 359 void
 360 channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
 361 {
 362         if (buffer_len(&c->output) == 0)
 363                 channel_free(c->self);
 364         else
 365                 FD_SET(c->sock, writeset);
 366 }
 367
 368 /*
 369  * This is a special state for X11 authentication spoofing.  An opened X11
 370  * connection (when authentication spoofing is being done) remains in this
 371  * state until the first packet has been completely read.  The authentication
 372  * data in that packet is then substituted by the real data if it matches the
 373  * fake data, and the channel is put into normal mode.
 374  */
 375 int
 376 x11_open_helper(Channel *c)
 377 {
 378         unsigned char *ucp;
 379         unsigned int proto_len, data_len;
 380
 381         /* Check if the fixed size part of the packet is in buffer. */
 382         if (buffer_len(&c->output) < 12)
 383                 return 0;
 384
 385         /* Parse the lengths of variable-length fields. */
 386         ucp = (unsigned char *) buffer_ptr(&c->output);
 387         if (ucp[0] == 0x42) {   /* Byte order MSB first. */
 388                 proto_len = 256 * ucp[6] + ucp[7];
 389                 data_len = 256 * ucp[8] + ucp[9];
 390         } else if (ucp[0] == 0x6c) {    /* Byte order LSB first. */
 391                 proto_len = ucp[6] + 256 * ucp[7];
 392                 data_len = ucp[8] + 256 * ucp[9];
 393         } else {
 394                 debug("Initial X11 packet contains bad byte order byte: 0x%x",
 395                       ucp[0]);
 396                 return -1;
 397         }
 398
 399         /* Check if the whole packet is in buffer. */
 400         if (buffer_len(&c->output) <
 401             12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
 402                 return 0;
 403
 404         /* Check if authentication protocol matches. */
 405         if (proto_len != strlen(x11_saved_proto) ||
 406             memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
 407                 debug("X11 connection uses different authentication protocol.");
 408                 return -1;
 409         }
 410         /* Check if authentication data matches our fake data. */
 411         if (data_len != x11_fake_data_len ||
 412             memcmp(ucp + 12 + ((proto_len + 3) & ~3),
 413                 x11_fake_data, x11_fake_data_len) != 0) {
 414                 debug("X11 auth data does not match fake data.");
 415                 return -1;
 416         }
 417         /* Check fake data length */
 418         if (x11_fake_data_len != x11_saved_data_len) {
 419                 error("X11 fake_data_len %d != saved_data_len %d",
 420                     x11_fake_data_len, x11_saved_data_len);
 421                 return -1;
 422         }
 423         /*
 424          * Received authentication protocol and data match
 425          * our fake data. Substitute the fake data with real
 426          * data.
 427          */
 428         memcpy(ucp + 12 + ((proto_len + 3) & ~3),
 429             x11_saved_data, x11_saved_data_len);
 430         return 1;
 431 }
 432
 433 void
 434 channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
 435 {
 436         int ret = x11_open_helper(c);
 437         if (ret == 1) {
 438                 /* Start normal processing for the channel. */
 439                 c->type = SSH_CHANNEL_OPEN;
 440         } else if (ret == -1) {
 441                 /*
 442                  * We have received an X11 connection that has bad
 443                  * authentication information.
 444                  */
 445                 log("X11 connection rejected because of wrong authentication.\r\n");
 446                 buffer_clear(&c->input);
 447                 buffer_clear(&c->output);
 448                 close(c->sock);
 449                 c->sock = -1;
 450                 c->type = SSH_CHANNEL_CLOSED;
 451                 packet_start(SSH_MSG_CHANNEL_CLOSE);
 452                 packet_put_int(c->remote_id);
 453                 packet_send();
 454         }
 455 }
 456
 457 void
 458 channel_pre_x11_open_15(Channel *c, fd_set * readset, fd_set * writeset)
 459 {
 460         int ret = x11_open_helper(c);
 461         if (ret == 1) {
 462                 c->type = SSH_CHANNEL_OPEN;
 463         } else if (ret == -1) {
 464                 debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
 465                 chan_read_failed(c);
 466                 chan_write_failed(c);
 467                 debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
 468         }
 469 }
 470
 471 /* This is our fake X11 server socket. */
 472 void
 473 channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
 474 {
 475         struct sockaddr addr;
 476         int newsock, newch;
 477         socklen_t addrlen;
 478         char buf[16384], *remote_hostname;
 479
 480         if (FD_ISSET(c->sock, readset)) {
 481                 debug("X11 connection requested.");
 482                 addrlen = sizeof(addr);
 483                 newsock = accept(c->sock, &addr, &addrlen);
 484                 if (newsock < 0) {
 485                         error("accept: %.100s", strerror(errno));
 486                         return;
 487                 }
 488                 remote_hostname = get_remote_hostname(newsock);
 489                 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
 490                 remote_hostname, get_peer_port(newsock));
 491                 xfree(remote_hostname);
 492                 newch = channel_allocate(SSH_CHANNEL_OPENING, newsock,
 493                                          xstrdup(buf));
 494                 packet_start(SSH_SMSG_X11_OPEN);
 495                 packet_put_int(newch);
 496                 if (have_hostname_in_open)
 497                         packet_put_string(buf, strlen(buf));
 498                 packet_send();
 499         }
 500 }
 501
 502 /*
 503  * This socket is listening for connections to a forwarded TCP/IP port.
 504  */
 505 void
 506 channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
 507 {
 508         struct sockaddr addr;
 509         int newsock, newch;
 510         socklen_t addrlen;
 511         char buf[1024], *remote_hostname;
 512         int remote_port;
 513
 514         if (FD_ISSET(c->sock, readset)) {
 515                 debug("Connection to port %d forwarding "
 516                     "to %.100s port %d requested.",
 517                     c->listening_port, c->path, c->host_port);
 518                 addrlen = sizeof(addr);
 519                 newsock = accept(c->sock, &addr, &addrlen);
 520                 if (newsock < 0) {
 521                         error("accept: %.100s", strerror(errno));
 522                         return;
 523                 }
 524                 remote_hostname = get_remote_hostname(newsock);
 525                 remote_port = get_peer_port(newsock);
 526                 snprintf(buf, sizeof buf,
 527                     "listen port %d for %.100s port %d, "
 528                     "connect from %.200s port %d",
 529                     c->listening_port, c->path, c->host_port,
 530                     remote_hostname, remote_port);
 531                 newch = channel_new("direct-tcpip",
 532                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
 533                     c->local_window_max, c->local_maxpacket,
 534                     0, xstrdup(buf));
 535                 if (compat20) {
 536                         packet_start(SSH2_MSG_CHANNEL_OPEN);
 537                         packet_put_cstring("direct-tcpip");
 538                         packet_put_int(newch);
 539                         packet_put_int(c->local_window_max);
 540                         packet_put_int(c->local_maxpacket);
 541                         packet_put_string(c->path, strlen(c->path));
 542                         packet_put_int(c->host_port);
 543                         packet_put_cstring(remote_hostname);
 544                         packet_put_int(remote_port);
 545                         packet_send();
 546                 } else {
 547                         packet_start(SSH_MSG_PORT_OPEN);
 548                         packet_put_int(newch);
 549                         packet_put_string(c->path, strlen(c->path));
 550                         packet_put_int(c->host_port);
 551                         if (have_hostname_in_open) {
 552                                 packet_put_string(buf, strlen(buf));
 553                         }
 554                         packet_send();
 555                 }
 556                 xfree(remote_hostname);
 557         }
 558 }
 559
 560 /*
 561  * This is the authentication agent socket listening for connections from
 562  * clients.
 563  */
 564 void
 565 channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
 566 {
 567         struct sockaddr addr;
 568         int newsock, newch;
 569         socklen_t addrlen;
 570
 571         if (FD_ISSET(c->sock, readset)) {
 572                 addrlen = sizeof(addr);
 573                 newsock = accept(c->sock, &addr, &addrlen);
 574                 if (newsock < 0) {
 575                         error("accept from auth socket: %.100s", strerror(errno));
 576                         return;
 577                 }
 578                 newch = channel_allocate(SSH_CHANNEL_OPENING, newsock,
 579                     xstrdup("accepted auth socket"));
 580                 packet_start(SSH_SMSG_AGENT_OPEN);
 581                 packet_put_int(newch);
 582                 packet_send();
 583         }
 584 }
 585
 586 int
 587 channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
 588 {
 589         char buf[16*1024];
 590         int len;
 591
 592         if (c->rfd != -1 &&
 593             FD_ISSET(c->rfd, readset)) {
 594                 len = read(c->rfd, buf, sizeof(buf));
 595                 if (len <= 0) {
 596                         debug("channel %d: read<0 rfd %d len %d",
 597                             c->self, c->rfd, len);
 598                         if (compat13) {
 599                                 buffer_consume(&c->output, buffer_len(&c->output));
 600                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
 601                                 debug("Channel %d status set to input draining.", c->self);
 602                         } else {
 603                                 chan_read_failed(c);
 604                         }
 605                         return -1;
 606                 }
 607                 buffer_append(&c->input, buf, len);
 608         }
 609         return 1;
 610 }
 611 int
 612 channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
 613 {
 614         int len;
 615
 616         /* Send buffered output data to the socket. */
 617         if (c->wfd != -1 &&
 618             FD_ISSET(c->wfd, writeset) &&
 619             buffer_len(&c->output) > 0) {
 620                 len = write(c->wfd, buffer_ptr(&c->output),
 621                             buffer_len(&c->output));
 622                 if (len <= 0) {
 623                         if (compat13) {
 624                                 buffer_consume(&c->output, buffer_len(&c->output));
 625                                 debug("Channel %d status set to input draining.", c->self);
 626                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
 627                         } else {
 628                                 chan_write_failed(c);
 629                         }
 630                         return -1;
 631                 }
 632                 buffer_consume(&c->output, len);
 633                 if (compat20 && len > 0) {
 634                         c->local_consumed += len;
 635                 }
 636         }
 637         return 1;
 638 }
 639 int
 640 channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
 641 {
 642         char buf[16*1024];
 643         int len;
 644
 645 /** XXX handle drain efd, too */
 646         if (c->efd != -1) {
 647                 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
 648                     FD_ISSET(c->efd, writeset) &&
 649                     buffer_len(&c->extended) > 0) {
 650                         len = write(c->efd, buffer_ptr(&c->extended),
 651                             buffer_len(&c->extended));
 652                         debug("channel %d: written %d to efd %d",
 653                             c->self, len, c->efd);
 654                         if (len > 0) {
 655                                 buffer_consume(&c->extended, len);
 656                                 c->local_consumed += len;
 657                         }
 658                 } else if (c->extended_usage == CHAN_EXTENDED_READ &&
 659                     FD_ISSET(c->efd, readset)) {
 660                         len = read(c->efd, buf, sizeof(buf));
 661                         debug("channel %d: read %d from efd %d",
 662                              c->self, len, c->efd);
 663                         if (len == 0) {
 664                                 debug("channel %d: closing efd %d",
 665                                     c->self, c->efd);
 666                                 close(c->efd);
 667                                 c->efd = -1;
 668                         } else if (len > 0)
 669                                 buffer_append(&c->extended, buf, len);
 670                 }
 671         }
 672         return 1;
 673 }
 674 int
 675 channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
 676 {
 677         if (!(c->flags & CHAN_CLOSE_SENT) &&
 678             c->local_window < c->local_window_max/2 &&
 679             c->local_consumed > 0) {
 680                 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
 681                 packet_put_int(c->remote_id);
 682                 packet_put_int(c->local_consumed);
 683                 packet_send();
 684                 debug("channel %d: window %d sent adjust %d",
 685                     c->self, c->local_window,
 686                     c->local_consumed);
 687                 c->local_window += c->local_consumed;
 688                 c->local_consumed = 0;
 689         }
 690         return 1;
 691 }
 692
 693 void
 694 channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
 695 {
 696         channel_handle_rfd(c, readset, writeset);
 697         channel_handle_wfd(c, readset, writeset);
 698 }
 699
 700 void
 701 channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
 702 {
 703         channel_handle_rfd(c, readset, writeset);
 704         channel_handle_wfd(c, readset, writeset);
 705         channel_handle_efd(c, readset, writeset);
 706         channel_check_window(c, readset, writeset);
 707 }
 708
 709 void
 710 channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
 711 {
 712         int len;
 713         /* Send buffered output data to the socket. */
 714         if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
 715                 len = write(c->sock, buffer_ptr(&c->output),
 716                             buffer_len(&c->output));
 717                 if (len <= 0)
 718                         buffer_consume(&c->output, buffer_len(&c->output));
 719                 else
 720                         buffer_consume(&c->output, len);
 721         }
 722 }
 723
 724 void
 725 channel_handler_init_20(void)
 726 {
 727         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_20;
 728         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 729
 730         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_2;
 731         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 732 }
 733
 734 void
 735 channel_handler_init_13(void)
 736 {
 737         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_13;
 738         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open_13;
 739         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 740         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 741         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
 742         channel_pre[SSH_CHANNEL_INPUT_DRAINING] =       &channel_pre_input_draining;
 743         channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] =      &channel_pre_output_draining;
 744
 745         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_1;
 746         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 747         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 748         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
 749         channel_post[SSH_CHANNEL_OUTPUT_DRAINING] =     &channel_post_output_drain_13;
 750 }
 751
 752 void
 753 channel_handler_init_15(void)
 754 {
 755         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_15;
 756         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open_15;
 757         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 758         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 759         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
 760
 761         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 762         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 763         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
 764         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_1;
 765 }
 766
 767 void
 768 channel_handler_init(void)
 769 {
 770         int i;
 771         for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
 772                 channel_pre[i] = NULL;
 773                 channel_post[i] = NULL;
 774         }
 775         if (compat20)
 776                 channel_handler_init_20();
 777         else if (compat13)
 778                 channel_handler_init_13();
 779         else
 780                 channel_handler_init_15();
 781 }
 782
 783 void
 784 channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
 785 {
 786         static int did_init = 0;
 787         int i;
 788         Channel *c;
 789
 790         if (!did_init) {
 791                 channel_handler_init();
 792                 did_init = 1;
 793         }
 794         for (i = 0; i < channels_alloc; i++) {
 795                 c = &channels[i];
 796                 if (c->type == SSH_CHANNEL_FREE)
 797                         continue;
 798                 if (ftab[c->type] == NULL)
 799                         continue;
 800                 (*ftab[c->type])(c, readset, writeset);
 801                 chan_delete_if_full_closed(c);
 802         }
 803 }
 804
 805 void
 806 channel_prepare_select(fd_set * readset, fd_set * writeset)
 807 {
 808         channel_handler(channel_pre, readset, writeset);
 809 }
 810
 811 void
 812 channel_after_select(fd_set * readset, fd_set * writeset)
 813 {
 814         channel_handler(channel_post, readset, writeset);
 815 }
 816
 817 /* If there is data to send to the connection, send some of it now. */
 818
 819 void
 820 channel_output_poll()
 821 {
 822         int len, i;
 823         Channel *c;
 824
 825         for (i = 0; i < channels_alloc; i++) {
 826                 c = &channels[i];
 827
 828                 /* We are only interested in channels that can have buffered incoming data. */
 829                 if (compat13) {
 830                         if (c->type != SSH_CHANNEL_OPEN &&
 831                             c->type != SSH_CHANNEL_INPUT_DRAINING)
 832                                 continue;
 833                 } else {
 834                         if (c->type != SSH_CHANNEL_OPEN)
 835                                 continue;
 836                         if (c->istate != CHAN_INPUT_OPEN &&
 837                             c->istate != CHAN_INPUT_WAIT_DRAIN)
 838                                 continue;
 839                 }
 840                 if (compat20 && (c->flags & CHAN_CLOSE_SENT)) {
 841                         debug("channel: %d: no data after CLOSE", c->self);
 842                         continue;
 843                 }
 844
 845                 /* Get the amount of buffered data for this channel. */
 846                 len = buffer_len(&c->input);
 847                 if (len > 0) {
 848                         /* Send some data for the other side over the secure connection. */
 849                         if (compat20) {
 850                                 if (len > c->remote_window)
 851                                         len = c->remote_window;
 852                                 if (len > c->remote_maxpacket)
 853                                         len = c->remote_maxpacket;
 854                         } else {
 855                                 if (packet_is_interactive()) {
 856                                         if (len > 1024)
 857                                                 len = 512;
 858                                 } else {
 859                                         /* Keep the packets at reasonable size. */
 860                                         if (len > packet_get_maxsize()/2)
 861                                                 len = packet_get_maxsize()/2;
 862                                 }
 863                         }
 864                         if (len > 0) {
 865                                 packet_start(compat20 ?
 866                                     SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
 867                                 packet_put_int(c->remote_id);
 868                                 packet_put_string(buffer_ptr(&c->input), len);
 869                                 packet_send();
 870                                 buffer_consume(&c->input, len);
 871                                 c->remote_window -= len;
 872                                 debug("channel %d: send data len %d", c->self, len);
 873                         }
 874                 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
 875                         if (compat13)
 876                                 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
 877                         /*
 878                          * input-buffer is empty and read-socket shutdown:
 879                          * tell peer, that we will not send more data: send IEOF
 880                          */
 881                         chan_ibuf_empty(c);
 882                 }
 883                 /* Send extended data, i.e. stderr */
 884                 if (compat20 &&
 885                     c->remote_window > 0 &&
 886                     (len = buffer_len(&c->extended)) > 0 &&
 887                     c->extended_usage == CHAN_EXTENDED_READ) {
 888                         if (len > c->remote_window)
 889                                 len = c->remote_window;
 890                         if (len > c->remote_maxpacket)
 891                                 len = c->remote_maxpacket;
 892                         packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
 893                         packet_put_int(c->remote_id);
 894                         packet_put_int(SSH2_EXTENDED_DATA_STDERR);
 895                         packet_put_string(buffer_ptr(&c->extended), len);
 896                         packet_send();
 897                         buffer_consume(&c->extended, len);
 898                         c->remote_window -= len;
 899                 }
 900         }
 901 }
 902
 903 /*
 904  * This is called when a packet of type CHANNEL_DATA has just been received.
 905  * The message type has already been consumed, but channel number and data is
 906  * still there.
 907  */
 908
 909 void
 910 channel_input_data(int type, int plen)
 911 {
 912         int id;
 913         char *data;
 914         unsigned int data_len;
 915         Channel *c;
 916
 917         /* Get the channel number and verify it. */
 918         id = packet_get_int();
 919         c = channel_lookup(id);
 920         if (c == NULL)
 921                 packet_disconnect("Received data for nonexistent channel %d.", id);
 922
 923         /* Ignore any data for non-open channels (might happen on close) */
 924         if (c->type != SSH_CHANNEL_OPEN &&
 925             c->type != SSH_CHANNEL_X11_OPEN)
 926                 return;
 927
 928         /* same for protocol 1.5 if output end is no longer open */
 929         if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
 930                 return;
 931
 932         /* Get the data. */
 933         data = packet_get_string(&data_len);
 934
 935         if (compat20){
 936                 if (data_len > c->local_maxpacket) {
 937                         log("channel %d: rcvd big packet %d, maxpack %d",
 938                             c->self, data_len, c->local_maxpacket);
 939                 }
 940                 if (data_len > c->local_window) {
 941                         log("channel %d: rcvd too much data %d, win %d",
 942                             c->self, data_len, c->local_window);
 943                         xfree(data);
 944                         return;
 945                 }
 946                 c->local_window -= data_len;
 947         }else{
 948                 packet_integrity_check(plen, 4 + 4 + data_len, type);
 949         }
 950         buffer_append(&c->output, data, data_len);
 951         xfree(data);
 952 }
 953 void
 954 channel_input_extended_data(int type, int plen)
 955 {
 956         int id;
 957         int tcode;
 958         char *data;
 959         unsigned int data_len;
 960         Channel *c;
 961
 962         /* Get the channel number and verify it. */
 963         id = packet_get_int();
 964         c = channel_lookup(id);
 965
 966         if (c == NULL)
 967                 packet_disconnect("Received extended_data for bad channel %d.", id);
 968         if (c->type != SSH_CHANNEL_OPEN) {
 969                 log("channel %d: ext data for non open", id);
 970                 return;
 971         }
 972         tcode = packet_get_int();
 973         if (c->efd == -1 ||
 974             c->extended_usage != CHAN_EXTENDED_WRITE ||
 975             tcode != SSH2_EXTENDED_DATA_STDERR) {
 976                 log("channel %d: bad ext data", c->self);
 977                 return;
 978         }
 979         data = packet_get_string(&data_len);
 980         if (data_len > c->local_window) {
 981                 log("channel %d: rcvd too much extended_data %d, win %d",
 982                     c->self, data_len, c->local_window);
 983                 xfree(data);
 984                 return;
 985         }
 986         debug("channel %d: rcvd ext data %d", c->self, data_len);
 987         c->local_window -= data_len;
 988         buffer_append(&c->extended, data, data_len);
 989         xfree(data);
 990 }
 991
 992
 993 /*
 994  * Returns true if no channel has too much buffered data, and false if one or
 995  * more channel is overfull.
 996  */
 997
 998 int
 999 channel_not_very_much_buffered_data()
1000 {
1001         unsigned int i;
1002         Channel *c;
1003
1004         for (i = 0; i < channels_alloc; i++) {
1005                 c = &channels[i];
1006                 if (c->type == SSH_CHANNEL_OPEN) {
1007                         if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
1008                                 debug("channel %d: big input buffer %d",
1009                                     c->self, buffer_len(&c->input));
1010                                 return 0;
1011                         }
1012                         if (buffer_len(&c->output) > packet_get_maxsize()) {
1013                                 debug("channel %d: big output buffer %d",
1014                                     c->self, buffer_len(&c->output));
1015                                 return 0;
1016                         }
1017                 }
1018         }
1019         return 1;
1020 }
1021
1022 void
1023 channel_input_ieof(int type, int plen)
1024 {
1025         int id;
1026         Channel *c;
1027
1028         packet_integrity_check(plen, 4, type);
1029
1030         id = packet_get_int();
1031         c = channel_lookup(id);
1032         if (c == NULL)
1033                 packet_disconnect("Received ieof for nonexistent channel %d.", id);
1034         chan_rcvd_ieof(c);
1035 }
1036
1037 void
1038 channel_input_close(int type, int plen)
1039 {
1040         int id;
1041         Channel *c;
1042
1043         packet_integrity_check(plen, 4, type);
1044
1045         id = packet_get_int();
1046         c = channel_lookup(id);
1047         if (c == NULL)
1048                 packet_disconnect("Received close for nonexistent channel %d.", id);
1049
1050         /*
1051          * Send a confirmation that we have closed the channel and no more
1052          * data is coming for it.
1053          */
1054         packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
1055         packet_put_int(c->remote_id);
1056         packet_send();
1057
1058         /*
1059          * If the channel is in closed state, we have sent a close request,
1060          * and the other side will eventually respond with a confirmation.
1061          * Thus, we cannot free the channel here, because then there would be
1062          * no-one to receive the confirmation.  The channel gets freed when
1063          * the confirmation arrives.
1064          */
1065         if (c->type != SSH_CHANNEL_CLOSED) {
1066                 /*
1067                  * Not a closed channel - mark it as draining, which will
1068                  * cause it to be freed later.
1069                  */
1070                 buffer_consume(&c->input, buffer_len(&c->input));
1071                 c->type = SSH_CHANNEL_OUTPUT_DRAINING;
1072         }
1073 }
1074
1075 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
1076 void
1077 channel_input_oclose(int type, int plen)
1078 {
1079         int id = packet_get_int();
1080         Channel *c = channel_lookup(id);
1081         packet_integrity_check(plen, 4, type);
1082         if (c == NULL)
1083                 packet_disconnect("Received oclose for nonexistent channel %d.", id);
1084         chan_rcvd_oclose(c);
1085 }
1086
1087 void
1088 channel_input_close_confirmation(int type, int plen)
1089 {
1090         int id = packet_get_int();
1091         Channel *c = channel_lookup(id);
1092
1093         if (c == NULL)
1094                 packet_disconnect("Received close confirmation for "
1095                     "out-of-range channel %d.", id);
1096         if (c->type != SSH_CHANNEL_CLOSED)
1097                 packet_disconnect("Received close confirmation for "
1098                     "non-closed channel %d (type %d).", id, c->type);
1099         channel_free(c->self);
1100 }
1101
1102 void
1103 channel_input_open_confirmation(int type, int plen)
1104 {
1105         int id, remote_id;
1106         Channel *c;
1107
1108         if (!compat20)
1109                 packet_integrity_check(plen, 4 + 4, type);
1110
1111         id = packet_get_int();
1112         c = channel_lookup(id);
1113
1114         if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1115                 packet_disconnect("Received open confirmation for "
1116                     "non-opening channel %d.", id);
1117         remote_id = packet_get_int();
1118         /* Record the remote channel number and mark that the channel is now open. */
1119         c->remote_id = remote_id;
1120         c->type = SSH_CHANNEL_OPEN;
1121
1122         if (compat20) {
1123                 c->remote_window = packet_get_int();
1124                 c->remote_maxpacket = packet_get_int();
1125                 if (c->cb_fn != NULL && c->cb_event == type) {
1126                         debug("callback start");
1127                         c->cb_fn(c->self, c->cb_arg);
1128                         debug("callback done");
1129                 }
1130                 debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1131                     c->remote_window, c->remote_maxpacket);
1132         }
1133 }
1134
1135 void
1136 channel_input_open_failure(int type, int plen)
1137 {
1138         int id;
1139         Channel *c;
1140
1141         if (!compat20)
1142                 packet_integrity_check(plen, 4, type);
1143
1144         id = packet_get_int();
1145         c = channel_lookup(id);
1146
1147         if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1148                 packet_disconnect("Received open failure for "
1149                     "non-opening channel %d.", id);
1150         if (compat20) {
1151                 int reason = packet_get_int();
1152                 char *msg  = packet_get_string(NULL);
1153                 log("channel_open_failure: %d: reason %d: %s", id, reason, msg);
1154                 xfree(msg);
1155         }
1156         /* Free the channel.  This will also close the socket. */
1157         channel_free(id);
1158 }
1159
1160 void
1161 channel_input_channel_request(int type, int plen)
1162 {
1163         int id;
1164         Channel *c;
1165
1166         id = packet_get_int();
1167         c = channel_lookup(id);
1168
1169         if (c == NULL ||
1170             (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1171                 packet_disconnect("Received request for "
1172                     "non-open channel %d.", id);
1173         if (c->cb_fn != NULL && c->cb_event == type) {
1174                 debug("callback start");
1175                 c->cb_fn(c->self, c->cb_arg);
1176                 debug("callback done");
1177         } else {
1178                 char *service = packet_get_string(NULL);
1179                 debug("channel: %d rcvd request for %s", c->self, service);
1180 debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
1181                 xfree(service);
1182         }
1183 }
1184
1185 void
1186 channel_input_window_adjust(int type, int plen)
1187 {
1188         Channel *c;
1189         int id, adjust;
1190
1191         if (!compat20)
1192                 return;
1193
1194         /* Get the channel number and verify it. */
1195         id = packet_get_int();
1196         c = channel_lookup(id);
1197
1198         if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1199                 log("Received window adjust for "
1200                     "non-open channel %d.", id);
1201                 return;
1202         }
1203         adjust = packet_get_int();
1204         debug("channel %d: rcvd adjust %d", id, adjust);
1205         c->remote_window += adjust;
1206 }
1207
1208 /*
1209  * Stops listening for channels, and removes any unix domain sockets that we
1210  * might have.
1211  */
1212
1213 void
1214 channel_stop_listening()
1215 {
1216         int i;
1217         for (i = 0; i < channels_alloc; i++) {
1218                 switch (channels[i].type) {
1219                 case SSH_CHANNEL_AUTH_SOCKET:
1220                         close(channels[i].sock);
1221                         remove(channels[i].path);
1222                         channel_free(i);
1223                         break;
1224                 case SSH_CHANNEL_PORT_LISTENER:
1225                 case SSH_CHANNEL_X11_LISTENER:
1226                         close(channels[i].sock);
1227                         channel_free(i);
1228                         break;
1229                 default:
1230                         break;
1231                 }
1232         }
1233 }
1234
1235 /*
1236  * Closes the sockets of all channels.  This is used to close extra file
1237  * descriptors after a fork.
1238  */
1239
1240 void
1241 channel_close_all()
1242 {
1243         int i;
1244         for (i = 0; i < channels_alloc; i++) {
1245                 if (channels[i].type != SSH_CHANNEL_FREE)
1246                         close(channels[i].sock);
1247         }
1248 }
1249
1250 /* Returns the maximum file descriptor number used by the channels. */
1251
1252 int
1253 channel_max_fd()
1254 {
1255         return channel_max_fd_value;
1256 }
1257
1258 /* Returns true if any channel is still open. */
1259
1260 int
1261 channel_still_open()
1262 {
1263         unsigned int i;
1264         for (i = 0; i < channels_alloc; i++)
1265                 switch (channels[i].type) {
1266                 case SSH_CHANNEL_FREE:
1267                 case SSH_CHANNEL_X11_LISTENER:
1268                 case SSH_CHANNEL_PORT_LISTENER:
1269                 case SSH_CHANNEL_CLOSED:
1270                 case SSH_CHANNEL_AUTH_SOCKET:
1271                         continue;
1272                 case SSH_CHANNEL_LARVAL:
1273                         if (!compat20)
1274                                 fatal("cannot happen: SSH_CHANNEL_LARVAL");
1275                         continue;
1276                 case SSH_CHANNEL_OPENING:
1277                 case SSH_CHANNEL_OPEN:
1278                 case SSH_CHANNEL_X11_OPEN:
1279                         return 1;
1280                 case SSH_CHANNEL_INPUT_DRAINING:
1281                 case SSH_CHANNEL_OUTPUT_DRAINING:
1282                         if (!compat13)
1283                                 fatal("cannot happen: OUT_DRAIN");
1284                         return 1;
1285                 default:
1286                         fatal("channel_still_open: bad channel type %d", channels[i].type);
1287                         /* NOTREACHED */
1288                 }
1289         return 0;
1290 }
1291
1292 /*
1293  * Returns a message describing the currently open forwarded connections,
1294  * suitable for sending to the client.  The message contains crlf pairs for
1295  * newlines.
1296  */
1297
1298 char *
1299 channel_open_message()
1300 {
1301         Buffer buffer;
1302         int i;
1303         char buf[512], *cp;
1304
1305         buffer_init(&buffer);
1306         snprintf(buf, sizeof buf, "The following connections are open:\r\n");
1307         buffer_append(&buffer, buf, strlen(buf));
1308         for (i = 0; i < channels_alloc; i++) {
1309                 Channel *c = &channels[i];
1310                 switch (c->type) {
1311                 case SSH_CHANNEL_FREE:
1312                 case SSH_CHANNEL_X11_LISTENER:
1313                 case SSH_CHANNEL_PORT_LISTENER:
1314                 case SSH_CHANNEL_CLOSED:
1315                 case SSH_CHANNEL_AUTH_SOCKET:
1316                         continue;
1317                 case SSH_CHANNEL_LARVAL:
1318                 case SSH_CHANNEL_OPENING:
1319                 case SSH_CHANNEL_OPEN:
1320                 case SSH_CHANNEL_X11_OPEN:
1321                 case SSH_CHANNEL_INPUT_DRAINING:
1322                 case SSH_CHANNEL_OUTPUT_DRAINING:
1323                         snprintf(buf, sizeof buf, "  #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
1324                             c->self, c->remote_name,
1325                             c->type, c->remote_id,
1326                             c->istate, buffer_len(&c->input),
1327                             c->ostate, buffer_len(&c->output),
1328                             c->rfd, c->wfd);
1329                         buffer_append(&buffer, buf, strlen(buf));
1330                         continue;
1331                 default:
1332                         fatal("channel_open_message: bad channel type %d", c->type);
1333                         /* NOTREACHED */
1334                 }
1335         }
1336         buffer_append(&buffer, "\0", 1);
1337         cp = xstrdup(buffer_ptr(&buffer));
1338         buffer_free(&buffer);
1339         return cp;
1340 }
1341
1342 /*
1343  * Initiate forwarding of connections to local port "port" through the secure
1344  * channel to host:port from remote side.
1345  */
1346
1347 void
1348 channel_request_local_forwarding(u_short port, const char *host,
1349                                  u_short host_port, int gateway_ports)
1350 {
1351         int success, ch, sock, on = 1;
1352         struct addrinfo hints, *ai, *aitop;
1353         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1354         struct linger linger;
1355
1356         if (strlen(host) > sizeof(channels[0].path) - 1)
1357                 packet_disconnect("Forward host name too long.");
1358
1359         /*
1360          * getaddrinfo returns a loopback address if the hostname is
1361          * set to NULL and hints.ai_flags is not AI_PASSIVE
1362          */
1363         memset(&hints, 0, sizeof(hints));
1364         hints.ai_family = IPv4or6;
1365         hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1366         hints.ai_socktype = SOCK_STREAM;
1367         snprintf(strport, sizeof strport, "%d", port);
1368         if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1369                 packet_disconnect("getaddrinfo: fatal error");
1370
1371         success = 0;
1372         for (ai = aitop; ai; ai = ai->ai_next) {
1373                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1374                         continue;
1375                 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1376                     strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1377                         error("channel_request_local_forwarding: getnameinfo failed");
1378                         continue;
1379                 }
1380                 /* Create a port to listen for the host. */
1381                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1382                 if (sock < 0) {
1383                         /* this is no error since kernel may not support ipv6 */
1384                         verbose("socket: %.100s", strerror(errno));
1385                         continue;
1386                 }
1387                 /*
1388                  * Set socket options.  We would like the socket to disappear
1389                  * as soon as it has been closed for whatever reason.
1390                  */
1391                 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1392                 linger.l_onoff = 1;
1393                 linger.l_linger = 5;
1394                 setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1395                 debug("Local forwarding listening on %s port %s.", ntop, strport);
1396
1397                 /* Bind the socket to the address. */
1398                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1399                         /* address can be in use ipv6 address is already bound */
1400                         if (!ai->ai_next)
1401                                 error("bind: %.100s", strerror(errno));
1402                         else
1403                                 verbose("bind: %.100s", strerror(errno));
1404
1405                         close(sock);
1406                         continue;
1407                 }
1408                 /* Start listening for connections on the socket. */
1409                 if (listen(sock, 5) < 0) {
1410                         error("listen: %.100s", strerror(errno));
1411                         close(sock);
1412                         continue;
1413                 }
1414                 /* Allocate a channel number for the socket. */
1415                 ch = channel_new(
1416                     "port listener", SSH_CHANNEL_PORT_LISTENER,
1417                     sock, sock, -1,
1418                     CHAN_WINDOW_DEFAULT, CHAN_PACKET_DEFAULT,
1419                     0, xstrdup("port listener"));
1420                 strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
1421                 channels[ch].host_port = host_port;
1422                 channels[ch].listening_port = port;
1423                 success = 1;
1424         }
1425         if (success == 0)
1426                 packet_disconnect("cannot listen port: %d", port);
1427         freeaddrinfo(aitop);
1428 }
1429
1430 /*
1431  * Initiate forwarding of connections to port "port" on remote host through
1432  * the secure channel to host:port from local side.
1433  */
1434
1435 void
1436 channel_request_remote_forwarding(u_short listen_port, const char *host_to_connect,
1437                                   u_short port_to_connect)
1438 {
1439         int payload_len;
1440         /* Record locally that connection to this host/port is permitted. */
1441         if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1442                 fatal("channel_request_remote_forwarding: too many forwards");
1443
1444         permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
1445         permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
1446         permitted_opens[num_permitted_opens].listen_port = listen_port;
1447         num_permitted_opens++;
1448
1449         /* Send the forward request to the remote side. */
1450         if (compat20) {
1451                 const char *address_to_bind = "0.0.0.0";
1452                 packet_start(SSH2_MSG_GLOBAL_REQUEST);
1453                 packet_put_cstring("tcpip-forward");
1454                 packet_put_char(0);                     /* boolean: want reply */
1455                 packet_put_cstring(address_to_bind);
1456                 packet_put_int(listen_port);
1457         } else {
1458                 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
1459                 packet_put_int(port_to_connect);
1460                 packet_put_cstring(host_to_connect);
1461                 packet_put_int(listen_port);
1462                 packet_send();
1463                 packet_write_wait();
1464                 /*
1465                  * Wait for response from the remote side.  It will send a disconnect
1466                  * message on failure, and we will never see it here.
1467                  */
1468                 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
1469         }
1470 }
1471
1472 /*
1473  * This is called after receiving CHANNEL_FORWARDING_REQUEST.  This initates
1474  * listening for the port, and sends back a success reply (or disconnect
1475  * message if there was an error).  This never returns if there was an error.
1476  */
1477
1478 void
1479 channel_input_port_forward_request(int is_root)
1480 {
1481         u_short port, host_port;
1482         char *hostname;
1483
1484         /* Get arguments from the packet. */
1485         port = packet_get_int();
1486         hostname = packet_get_string(NULL);
1487         host_port = packet_get_int();
1488
1489         /*
1490          * Check that an unprivileged user is not trying to forward a
1491          * privileged port.
1492          */
1493         if (port < IPPORT_RESERVED && !is_root)
1494                 packet_disconnect("Requested forwarding of port %d but user is not root.",
1495                                   port);
1496         /*
1497          * Initiate forwarding,
1498          * bind port to localhost only (gateway ports == 0).
1499          */
1500         channel_request_local_forwarding(port, hostname, host_port, 0);
1501
1502         /* Free the argument string. */
1503         xfree(hostname);
1504 }
1505
1506 /* XXX move to aux.c */
1507 int
1508 channel_connect_to(const char *host, u_short host_port)
1509 {
1510         struct addrinfo hints, *ai, *aitop;
1511         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1512         int gaierr;
1513         int sock = -1;
1514
1515         memset(&hints, 0, sizeof(hints));
1516         hints.ai_family = IPv4or6;
1517         hints.ai_socktype = SOCK_STREAM;
1518         snprintf(strport, sizeof strport, "%d", host_port);
1519         if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1520                 error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
1521                 return -1;
1522         }
1523         for (ai = aitop; ai; ai = ai->ai_next) {
1524                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1525                         continue;
1526                 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1527                     strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1528                         error("channel_connect_to: getnameinfo failed");
1529                         continue;
1530                 }
1531                 /* Create the socket. */
1532                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1533                 if (sock < 0) {
1534                         error("socket: %.100s", strerror(errno));
1535                         continue;
1536                 }
1537                 /* Connect to the host/port. */
1538                 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1539                         error("connect %.100s port %s: %.100s", ntop, strport,
1540                             strerror(errno));
1541                         close(sock);
1542                         continue;       /* fail -- try next */
1543                 }
1544                 break; /* success */
1545
1546         }
1547         freeaddrinfo(aitop);
1548         if (!ai) {
1549                 error("connect %.100s port %d: failed.", host, host_port);
1550                 return -1;
1551         }
1552         /* success */
1553         return sock;
1554 }
1555
1556 /*
1557  * This is called after receiving PORT_OPEN message.  This attempts to
1558  * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1559  * or CHANNEL_OPEN_FAILURE.
1560  */
1561
1562 void
1563 channel_input_port_open(int type, int plen)
1564 {
1565         u_short host_port;
1566         char *host, *originator_string;
1567         int remote_channel, sock = -1, newch, i, denied;
1568         unsigned int host_len, originator_len;
1569
1570         /* Get remote channel number. */
1571         remote_channel = packet_get_int();
1572
1573         /* Get host name to connect to. */
1574         host = packet_get_string(&host_len);
1575
1576         /* Get port to connect to. */
1577         host_port = packet_get_int();
1578
1579         /* Get remote originator name. */
1580         if (have_hostname_in_open) {
1581                 originator_string = packet_get_string(&originator_len);
1582                 originator_len += 4;    /* size of packet_int */
1583         } else {
1584                 originator_string = xstrdup("unknown (remote did not supply name)");
1585                 originator_len = 0;     /* no originator supplied */
1586         }
1587
1588         packet_integrity_check(plen,
1589             4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
1590
1591         /* Check if opening that port is permitted. */
1592         denied = 0;
1593         if (!all_opens_permitted) {
1594                 /* Go trough all permitted ports. */
1595                 for (i = 0; i < num_permitted_opens; i++)
1596                         if (permitted_opens[i].port_to_connect == host_port &&
1597                             strcmp(permitted_opens[i].host_to_connect, host) == 0)
1598                                 break;
1599
1600                 /* Check if we found the requested port among those permitted. */
1601                 if (i >= num_permitted_opens) {
1602                         /* The port is not permitted. */
1603                         log("Received request to connect to %.100s:%d, but the request was denied.",
1604                             host, host_port);
1605                         denied = 1;
1606                 }
1607         }
1608         sock = denied ? -1 : channel_connect_to(host, host_port);
1609         if (sock > 0) {
1610                 /* Allocate a channel for this connection. */
1611                 newch = channel_allocate(SSH_CHANNEL_OPEN, sock, originator_string);
1612                 channels[newch].remote_id = remote_channel;
1613
1614                 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1615                 packet_put_int(remote_channel);
1616                 packet_put_int(newch);
1617                 packet_send();
1618         } else {
1619                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1620                 packet_put_int(remote_channel);
1621                 packet_send();
1622         }
1623         xfree(host);
1624 }
1625
1626 /*
1627  * Creates an internet domain socket for listening for X11 connections.
1628  * Returns a suitable value for the DISPLAY variable, or NULL if an error
1629  * occurs.
1630  */
1631
1632 #define NUM_SOCKS       10
1633
1634 char *
1635 x11_create_display_inet(int screen_number, int x11_display_offset)
1636 {
1637         int display_number, sock;
1638         u_short port;
1639         struct addrinfo hints, *ai, *aitop;
1640         char strport[NI_MAXSERV];
1641         int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1642         char display[512];
1643         char hostname[MAXHOSTNAMELEN];
1644
1645         for (display_number = x11_display_offset;
1646              display_number < MAX_DISPLAYS;
1647              display_number++) {
1648                 port = 6000 + display_number;
1649                 memset(&hints, 0, sizeof(hints));
1650                 hints.ai_family = IPv4or6;
1651                 hints.ai_flags = AI_PASSIVE;            /* XXX loopback only ? */
1652                 hints.ai_socktype = SOCK_STREAM;
1653                 snprintf(strport, sizeof strport, "%d", port);
1654                 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1655                         error("getaddrinfo: %.100s", gai_strerror(gaierr));
1656                         return NULL;
1657                 }
1658                 for (ai = aitop; ai; ai = ai->ai_next) {
1659                         if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1660                                 continue;
1661                         sock = socket(ai->ai_family, SOCK_STREAM, 0);
1662                         if (sock < 0) {
1663                                 if (errno != EINVAL) {
1664                                         error("socket: %.100s", strerror(errno));
1665                                         return NULL;
1666                                 } else {
1667                                         debug("Socket family %d not supported [X11 disp create]", ai->ai_family);
1668                                         continue;
1669                                 }
1670                         }
1671                         if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1672                                 debug("bind port %d: %.100s", port, strerror(errno));
1673                                 shutdown(sock, SHUT_RDWR);
1674                                 close(sock);
1675
1676                                 if (ai->ai_next)
1677                                         continue;
1678
1679                                 for (n = 0; n < num_socks; n++) {
1680                                         shutdown(socks[n], SHUT_RDWR);
1681                                         close(socks[n]);
1682                                 }
1683                                 num_socks = 0;
1684                                 break;
1685                         }
1686                         socks[num_socks++] = sock;
1687 #ifndef DONT_TRY_OTHER_AF
1688                         if (num_socks == NUM_SOCKS)
1689                                 break;
1690 #else
1691                         break;
1692 #endif
1693                 }
1694                 if (num_socks > 0)
1695                         break;
1696         }
1697         if (display_number >= MAX_DISPLAYS) {
1698                 error("Failed to allocate internet-domain X11 display socket.");
1699                 return NULL;
1700         }
1701         /* Start listening for connections on the socket. */
1702         for (n = 0; n < num_socks; n++) {
1703                 sock = socks[n];
1704                 if (listen(sock, 5) < 0) {
1705                         error("listen: %.100s", strerror(errno));
1706                         shutdown(sock, SHUT_RDWR);
1707                         close(sock);
1708                         return NULL;
1709                 }
1710         }
1711
1712         /* Set up a suitable value for the DISPLAY variable. */
1713
1714         if (gethostname(hostname, sizeof(hostname)) < 0)
1715                 fatal("gethostname: %.100s", strerror(errno));
1716
1717 #ifdef IPADDR_IN_DISPLAY
1718         /*
1719          * HPUX detects the local hostname in the DISPLAY variable and tries
1720          * to set up a shared memory connection to the server, which it
1721          * incorrectly supposes to be local.
1722          *
1723          * The workaround - as used in later $$H and other programs - is
1724          * is to set display to the host's IP address.
1725          */
1726         {
1727                 struct hostent *he;
1728                 struct in_addr my_addr;
1729
1730                 he = gethostbyname(hostname);
1731                 if (he == NULL) {
1732                         error("[X11-broken-fwd-hostname-workaround] Could not get "
1733                                 "IP address for hostname %s.", hostname);
1734
1735                         packet_send_debug("[X11-broken-fwd-hostname-workaround]"
1736                                 "Could not get IP address for hostname %s.", hostname);
1737
1738                         shutdown(sock, SHUT_RDWR);
1739                         close(sock);
1740
1741                         return NULL;
1742                 }
1743
1744                 memcpy(&my_addr, he->h_addr_list[0], sizeof(struct in_addr));
1745
1746                 /* Set DISPLAY to <ip address>:screen.display */
1747                 snprintf(display, sizeof(display), "%.50s:%d.%d", inet_ntoa(my_addr),
1748                         display_number, screen_number);
1749         }
1750 #else /* IPADDR_IN_DISPLAY */
1751         /* Just set DISPLAY to hostname:screen.display */
1752         snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
1753                 display_number, screen_number);
1754 #endif /* IPADDR_IN_DISPLAY */
1755
1756         /* Allocate a channel for each socket. */
1757         for (n = 0; n < num_socks; n++) {
1758                 sock = socks[n];
1759                 (void) channel_allocate(SSH_CHANNEL_X11_LISTENER, sock,
1760                                         xstrdup("X11 inet listener"));
1761         }
1762
1763         /* Return a suitable value for the DISPLAY environment variable. */
1764         return xstrdup(display);
1765 }
1766
1767 #ifndef X_UNIX_PATH
1768 #define X_UNIX_PATH "/tmp/.X11-unix/X"
1769 #endif
1770
1771 static
1772 int
1773 connect_local_xsocket(unsigned int dnr)
1774 {
1775         static const char *const x_sockets[] = {
1776                 X_UNIX_PATH "%u",
1777                 "/var/X/.X11-unix/X" "%u",
1778                 "/usr/spool/sockets/X11/" "%u",
1779                 NULL
1780         };
1781         int sock;
1782         struct sockaddr_un addr;
1783         const char *const * path;
1784
1785         for (path = x_sockets; *path; ++path) {
1786                 sock = socket(AF_UNIX, SOCK_STREAM, 0);
1787                 if (sock < 0)
1788                         error("socket: %.100s", strerror(errno));
1789                 memset(&addr, 0, sizeof(addr));
1790                 addr.sun_family = AF_UNIX;
1791                 snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
1792                 if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
1793                         return sock;
1794                 close(sock);
1795         }
1796         error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
1797         return -1;
1798 }
1799
1800
1801 /*
1802  * This is called when SSH_SMSG_X11_OPEN is received.  The packet contains
1803  * the remote channel number.  We should do whatever we want, and respond
1804  * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
1805  */
1806
1807 void
1808 x11_input_open(int type, int plen)
1809 {
1810         int remote_channel, display_number, sock = 0, newch;
1811         const char *display;
1812         char buf[1024], *cp, *remote_host;
1813         unsigned int remote_len;
1814         struct addrinfo hints, *ai, *aitop;
1815         char strport[NI_MAXSERV];
1816         int gaierr;
1817
1818         /* Get remote channel number. */
1819         remote_channel = packet_get_int();
1820
1821         /* Get remote originator name. */
1822         if (have_hostname_in_open) {
1823                 remote_host = packet_get_string(&remote_len);
1824                 remote_len += 4;
1825         } else {
1826                 remote_host = xstrdup("unknown (remote did not supply name)");
1827                 remote_len = 0;
1828         }
1829
1830         debug("Received X11 open request.");
1831         packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
1832
1833         /* Try to open a socket for the local X server. */
1834         display = getenv("DISPLAY");
1835         if (!display) {
1836                 error("DISPLAY not set.");
1837                 goto fail;
1838         }
1839         /*
1840          * Now we decode the value of the DISPLAY variable and make a
1841          * connection to the real X server.
1842          */
1843
1844         /*
1845          * Check if it is a unix domain socket.  Unix domain displays are in
1846          * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
1847          */
1848         if (strncmp(display, "unix:", 5) == 0 ||
1849             display[0] == ':') {
1850                 /* Connect to the unix domain socket. */
1851                 if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
1852                         error("Could not parse display number from DISPLAY: %.100s",
1853                               display);
1854                         goto fail;
1855                 }
1856                 /* Create a socket. */
1857                 sock = connect_local_xsocket(display_number);
1858                 if (sock < 0)
1859                         goto fail;
1860
1861                 /* OK, we now have a connection to the display. */
1862                 goto success;
1863         }
1864         /*
1865          * Connect to an inet socket.  The DISPLAY value is supposedly
1866          * hostname:d[.s], where hostname may also be numeric IP address.
1867          */
1868         strncpy(buf, display, sizeof(buf));
1869         buf[sizeof(buf) - 1] = 0;
1870         cp = strchr(buf, ':');
1871         if (!cp) {
1872                 error("Could not find ':' in DISPLAY: %.100s", display);
1873                 goto fail;
1874         }
1875         *cp = 0;
1876         /* buf now contains the host name.  But first we parse the display number. */
1877         if (sscanf(cp + 1, "%d", &display_number) != 1) {
1878                 error("Could not parse display number from DISPLAY: %.100s",
1879                       display);
1880                 goto fail;
1881         }
1882
1883         /* Look up the host address */
1884         memset(&hints, 0, sizeof(hints));
1885         hints.ai_family = IPv4or6;
1886         hints.ai_socktype = SOCK_STREAM;
1887         snprintf(strport, sizeof strport, "%d", 6000 + display_number);
1888         if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
1889                 error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
1890                 goto fail;
1891         }
1892         for (ai = aitop; ai; ai = ai->ai_next) {
1893                 /* Create a socket. */
1894                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1895                 if (sock < 0) {
1896                         debug("socket: %.100s", strerror(errno));
1897                         continue;
1898                 }
1899                 /* Connect it to the display. */
1900                 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1901                         debug("connect %.100s port %d: %.100s", buf,
1902                             6000 + display_number, strerror(errno));
1903                         close(sock);
1904                         continue;
1905                 }
1906                 /* Success */
1907                 break;
1908         }
1909         freeaddrinfo(aitop);
1910         if (!ai) {
1911                 error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
1912                     strerror(errno));
1913                 goto fail;
1914         }
1915 success:
1916         /* We have successfully obtained a connection to the real X display. */
1917
1918         /* Allocate a channel for this connection. */
1919         if (x11_saved_proto == NULL)
1920                 newch = channel_allocate(SSH_CHANNEL_OPEN, sock, remote_host);
1921         else
1922                 newch = channel_allocate(SSH_CHANNEL_X11_OPEN, sock, remote_host);
1923         channels[newch].remote_id = remote_channel;
1924
1925         /* Send a confirmation to the remote host. */
1926         packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1927         packet_put_int(remote_channel);
1928         packet_put_int(newch);
1929         packet_send();
1930
1931         return;
1932
1933 fail:
1934         /* Send refusal to the remote host. */
1935         packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1936         packet_put_int(remote_channel);
1937         packet_send();
1938 }
1939
1940 /*
1941  * Requests forwarding of X11 connections, generates fake authentication
1942  * data, and enables authentication spoofing.
1943  */
1944
1945 void
1946 x11_request_forwarding_with_spoofing(const char *proto, const char *data)
1947 {
1948         unsigned int data_len = (unsigned int) strlen(data) / 2;
1949         unsigned int i, value;
1950         char *new_data;
1951         int screen_number;
1952         const char *cp;
1953         u_int32_t rand = 0;
1954
1955         cp = getenv("DISPLAY");
1956         if (cp)
1957                 cp = strchr(cp, ':');
1958         if (cp)
1959                 cp = strchr(cp, '.');
1960         if (cp)
1961                 screen_number = atoi(cp + 1);
1962         else
1963                 screen_number = 0;
1964
1965         /* Save protocol name. */
1966         x11_saved_proto = xstrdup(proto);
1967
1968         /*
1969          * Extract real authentication data and generate fake data of the
1970          * same length.
1971          */
1972         x11_saved_data = xmalloc(data_len);
1973         x11_fake_data = xmalloc(data_len);
1974         for (i = 0; i < data_len; i++) {
1975                 if (sscanf(data + 2 * i, "%2x", &value) != 1)
1976                         fatal("x11_request_forwarding: bad authentication data: %.100s", data);
1977                 if (i % 4 == 0)
1978                         rand = arc4random();
1979                 x11_saved_data[i] = value;
1980                 x11_fake_data[i] = rand & 0xff;
1981                 rand >>= 8;
1982         }
1983         x11_saved_data_len = data_len;
1984         x11_fake_data_len = data_len;
1985
1986         /* Convert the fake data into hex. */
1987         new_data = xmalloc(2 * data_len + 1);
1988         for (i = 0; i < data_len; i++)
1989                 sprintf(new_data + 2 * i, "%02x", (unsigned char) x11_fake_data[i]);
1990
1991         /* Send the request packet. */
1992         packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
1993         packet_put_string(proto, strlen(proto));
1994         packet_put_string(new_data, strlen(new_data));
1995         packet_put_int(screen_number);
1996         packet_send();
1997         packet_write_wait();
1998         xfree(new_data);
1999 }
2000
2001 /* Sends a message to the server to request authentication fd forwarding. */
2002
2003 void
2004 auth_request_forwarding()
2005 {
2006         packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2007         packet_send();
2008         packet_write_wait();
2009 }
2010
2011 /*
2012  * Returns the name of the forwarded authentication socket.  Returns NULL if
2013  * there is no forwarded authentication socket.  The returned value points to
2014  * a static buffer.
2015  */
2016
2017 char *
2018 auth_get_socket_name()
2019 {
2020         return channel_forwarded_auth_socket_name;
2021 }
2022
2023 /* removes the agent forwarding socket */
2024
2025 void
2026 cleanup_socket(void)
2027 {
2028         remove(channel_forwarded_auth_socket_name);
2029         rmdir(channel_forwarded_auth_socket_dir);
2030 }
2031
2032 /*
2033  * This if called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
2034  * This starts forwarding authentication requests.
2035  */
2036
2037 void
2038 auth_input_request_forwarding(struct passwd * pw)
2039 {
2040         int sock, newch;
2041         struct sockaddr_un sunaddr;
2042
2043         if (auth_get_socket_name() != NULL)
2044                 fatal("Protocol error: authentication forwarding requested twice.");
2045
2046         /* Temporarily drop privileged uid for mkdir/bind. */
2047         temporarily_use_uid(pw->pw_uid);
2048
2049         /* Allocate a buffer for the socket name, and format the name. */
2050         channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2051         channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2052         strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
2053
2054         /* Create private directory for socket */
2055         if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL)
2056                 packet_disconnect("mkdtemp: %.100s", strerror(errno));
2057         snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2058                  channel_forwarded_auth_socket_dir, (int) getpid());
2059
2060         if (atexit(cleanup_socket) < 0) {
2061                 int saved = errno;
2062                 cleanup_socket();
2063                 packet_disconnect("socket: %.100s", strerror(saved));
2064         }
2065         /* Create the socket. */
2066         sock = socket(AF_UNIX, SOCK_STREAM, 0);
2067         if (sock < 0)
2068                 packet_disconnect("socket: %.100s", strerror(errno));
2069
2070         /* Bind it to the name. */
2071         memset(&sunaddr, 0, sizeof(sunaddr));
2072         sunaddr.sun_family = AF_UNIX;
2073         strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2074                 sizeof(sunaddr.sun_path));
2075
2076         if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2077                 packet_disconnect("bind: %.100s", strerror(errno));
2078
2079         /* Restore the privileged uid. */
2080         restore_uid();
2081
2082         /* Start listening on the socket. */
2083         if (listen(sock, 5) < 0)
2084                 packet_disconnect("listen: %.100s", strerror(errno));
2085
2086         /* Allocate a channel for the authentication agent socket. */
2087         newch = channel_allocate(SSH_CHANNEL_AUTH_SOCKET, sock,
2088                                  xstrdup("auth socket"));
2089         strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2090             sizeof(channels[newch].path));
2091 }
2092
2093 /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2094
2095 void
2096 auth_input_open_request(int type, int plen)
2097 {
2098         int remch, sock, newch;
2099         char *dummyname;
2100
2101         packet_integrity_check(plen, 4, type);
2102
2103         /* Read the remote channel number from the message. */
2104         remch = packet_get_int();
2105
2106         /*
2107          * Get a connection to the local authentication agent (this may again
2108          * get forwarded).
2109          */
2110         sock = ssh_get_authentication_socket();
2111
2112         /*
2113          * If we could not connect the agent, send an error message back to
2114          * the server. This should never happen unless the agent dies,
2115          * because authentication forwarding is only enabled if we have an
2116          * agent.
2117          */
2118         if (sock < 0) {
2119                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2120                 packet_put_int(remch);
2121                 packet_send();
2122                 return;
2123         }
2124         debug("Forwarding authentication connection.");
2125
2126         /*
2127          * Dummy host name.  This will be freed when the channel is freed; it
2128          * will still be valid in the packet_put_string below since the
2129          * channel cannot yet be freed at that point.
2130          */
2131         dummyname = xstrdup("authentication agent connection");
2132
2133         newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2134         channels[newch].remote_id = remch;
2135
2136         /* Send a confirmation to the remote host. */
2137         packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2138         packet_put_int(remch);
2139         packet_put_int(newch);
2140         packet_send();
2141 }
2142
2143 void
2144 channel_open(int id)
2145 {
2146         Channel *c = channel_lookup(id);
2147         if (c == NULL) {
2148                 log("channel_open: %d: bad id", id);
2149                 return;
2150         }
2151         packet_start(SSH2_MSG_CHANNEL_OPEN);
2152         packet_put_cstring(c->ctype);
2153         packet_put_int(c->self);
2154         packet_put_int(c->local_window);
2155         packet_put_int(c->local_maxpacket);
2156         packet_send();
2157         debug("channel open %d", id);
2158 }
2159 void
2160 channel_request(int id, char *service, int wantconfirm)
2161 {
2162         channel_request_start(id, service, wantconfirm);
2163         packet_send();
2164         debug("channel request %d: %s", id, service) ;
2165 }
2166 void
2167 channel_request_start(int id, char *service, int wantconfirm)
2168 {
2169         Channel *c = channel_lookup(id);
2170         if (c == NULL) {
2171                 log("channel_request: %d: bad id", id);
2172                 return;
2173         }
2174         packet_start(SSH2_MSG_CHANNEL_REQUEST);
2175         packet_put_int(c->remote_id);
2176         packet_put_cstring(service);
2177         packet_put_char(wantconfirm);
2178 }
2179 void
2180 channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2181 {
2182         Channel *c = channel_lookup(id);
2183         if (c == NULL) {
2184                 log("channel_register_callback: %d: bad id", id);
2185                 return;
2186         }
2187         c->cb_event = mtype;
2188         c->cb_fn = fn;
2189         c->cb_arg = arg;
2190 }
2191 void
2192 channel_register_cleanup(int id, channel_callback_fn *fn)
2193 {
2194         Channel *c = channel_lookup(id);
2195         if (c == NULL) {
2196                 log("channel_register_cleanup: %d: bad id", id);
2197                 return;
2198         }
2199         c->dettach_user = fn;
2200 }
2201 void
2202 channel_cancel_cleanup(int id)
2203 {
2204         Channel *c = channel_lookup(id);
2205         if (c == NULL) {
2206                 log("channel_cancel_cleanup: %d: bad id", id);
2207                 return;
2208         }
2209         c->dettach_user = NULL;
2210 }
2211
2212 void
2213 channel_set_fds(int id, int rfd, int wfd, int efd, int extusage)
2214 {
2215         Channel *c = channel_lookup(id);
2216         if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2217                 fatal("channel_activate for non-larval channel %d.", id);
2218         if (rfd > channel_max_fd_value)
2219                 channel_max_fd_value = rfd;
2220         if (wfd > channel_max_fd_value)
2221                 channel_max_fd_value = wfd;
2222         if (efd > channel_max_fd_value)
2223                 channel_max_fd_value = efd;
2224         c->type = SSH_CHANNEL_OPEN;
2225         c->rfd = rfd;
2226         c->wfd = wfd;
2227         c->efd = efd;
2228         c->extended_usage = extusage;
2229         /* XXX window size? */
2230         c->local_window = c->local_window_max = c->local_maxpacket/2;
2231         packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2232         packet_put_int(c->remote_id);
2233         packet_put_int(c->local_window);
2234         packet_send();
2235 }