]> andersk Git - openssh.git/blob - channels.c
- dtucker@cvs.openbsd.org 2008/06/16 13:22:53
[openssh.git] / channels.c
1 /* $OpenBSD: channels.c,v 1.282 2008/06/16 13:22:53 dtucker Exp $ */
2 /*
3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5  *                    All rights reserved
6  * This file contains functions for generic socket connection forwarding.
7  * There is also code for initiating connection forwarding for X11 connections,
8  * arbitrary tcp/ip connections, and the authentication agent connection.
9  *
10  * As far as I am concerned, the code I have written for this software
11  * can be used freely for any purpose.  Any derived versions of this
12  * software must be clearly marked as such, and if the derived work is
13  * incompatible with the protocol description in the RFC file, it must be
14  * called by a name other than "ssh" or "Secure Shell".
15  *
16  * SSH2 support added by Markus Friedl.
17  * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
18  * Copyright (c) 1999 Dug Song.  All rights reserved.
19  * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
20  *
21  * Redistribution and use in source and binary forms, with or without
22  * modification, are permitted provided that the following conditions
23  * are met:
24  * 1. Redistributions of source code must retain the above copyright
25  *    notice, this list of conditions and the following disclaimer.
26  * 2. Redistributions in binary form must reproduce the above copyright
27  *    notice, this list of conditions and the following disclaimer in the
28  *    documentation and/or other materials provided with the distribution.
29  *
30  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
32  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
33  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
34  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
35  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
39  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
40  */
41
42 #include "includes.h"
43
44 #include <sys/types.h>
45 #include <sys/ioctl.h>
46 #include <sys/un.h>
47 #include <sys/socket.h>
48 #ifdef HAVE_SYS_TIME_H
49 # include <sys/time.h>
50 #endif
51
52 #include <netinet/in.h>
53 #include <arpa/inet.h>
54
55 #include <errno.h>
56 #include <netdb.h>
57 #include <stdio.h>
58 #include <stdlib.h>
59 #include <string.h>
60 #include <termios.h>
61 #include <unistd.h>
62 #include <stdarg.h>
63
64 #include "openbsd-compat/sys-queue.h"
65 #include "xmalloc.h"
66 #include "ssh.h"
67 #include "ssh1.h"
68 #include "ssh2.h"
69 #include "packet.h"
70 #include "log.h"
71 #include "misc.h"
72 #include "buffer.h"
73 #include "channels.h"
74 #include "compat.h"
75 #include "canohost.h"
76 #include "key.h"
77 #include "authfd.h"
78 #include "pathnames.h"
79
80 /* -- channel core */
81
82 /*
83  * Pointer to an array containing all allocated channels.  The array is
84  * dynamically extended as needed.
85  */
86 static Channel **channels = NULL;
87
88 /*
89  * Size of the channel array.  All slots of the array must always be
90  * initialized (at least the type field); unused slots set to NULL
91  */
92 static u_int channels_alloc = 0;
93
94 /*
95  * Maximum file descriptor value used in any of the channels.  This is
96  * updated in channel_new.
97  */
98 static int channel_max_fd = 0;
99
100
101 /* -- tcp forwarding */
102
103 /*
104  * Data structure for storing which hosts are permitted for forward requests.
105  * The local sides of any remote forwards are stored in this array to prevent
106  * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
107  * network (which might be behind a firewall).
108  */
109 typedef struct {
110         char *host_to_connect;          /* Connect to 'host'. */
111         u_short port_to_connect;        /* Connect to 'port'. */
112         u_short listen_port;            /* Remote side should listen port number. */
113 } ForwardPermission;
114
115 /* List of all permitted host/port pairs to connect by the user. */
116 static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
117
118 /* List of all permitted host/port pairs to connect by the admin. */
119 static ForwardPermission permitted_adm_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
120
121 /* Number of permitted host/port pairs in the array permitted by the user. */
122 static int num_permitted_opens = 0;
123
124 /* Number of permitted host/port pair in the array permitted by the admin. */
125 static int num_adm_permitted_opens = 0;
126
127 /*
128  * If this is true, all opens are permitted.  This is the case on the server
129  * on which we have to trust the client anyway, and the user could do
130  * anything after logging in anyway.
131  */
132 static int all_opens_permitted = 0;
133
134
135 /* -- X11 forwarding */
136
137 /* Maximum number of fake X11 displays to try. */
138 #define MAX_DISPLAYS  1000
139
140 /* Saved X11 local (client) display. */
141 static char *x11_saved_display = NULL;
142
143 /* Saved X11 authentication protocol name. */
144 static char *x11_saved_proto = NULL;
145
146 /* Saved X11 authentication data.  This is the real data. */
147 static char *x11_saved_data = NULL;
148 static u_int x11_saved_data_len = 0;
149
150 /*
151  * Fake X11 authentication data.  This is what the server will be sending us;
152  * we should replace any occurrences of this by the real data.
153  */
154 static u_char *x11_fake_data = NULL;
155 static u_int x11_fake_data_len;
156
157
158 /* -- agent forwarding */
159
160 #define NUM_SOCKS       10
161
162 /* AF_UNSPEC or AF_INET or AF_INET6 */
163 static int IPv4or6 = AF_UNSPEC;
164
165 /* helper */
166 static void port_open_helper(Channel *c, char *rtype);
167
168 /* non-blocking connect helpers */
169 static int connect_next(struct channel_connect *);
170 static void channel_connect_ctx_free(struct channel_connect *);
171
172 /* -- channel core */
173
174 Channel *
175 channel_by_id(int id)
176 {
177         Channel *c;
178
179         if (id < 0 || (u_int)id >= channels_alloc) {
180                 logit("channel_by_id: %d: bad id", id);
181                 return NULL;
182         }
183         c = channels[id];
184         if (c == NULL) {
185                 logit("channel_by_id: %d: bad id: channel free", id);
186                 return NULL;
187         }
188         return c;
189 }
190
191 /*
192  * Returns the channel if it is allowed to receive protocol messages.
193  * Private channels, like listening sockets, may not receive messages.
194  */
195 Channel *
196 channel_lookup(int id)
197 {
198         Channel *c;
199
200         if ((c = channel_by_id(id)) == NULL)
201                 return (NULL);
202
203         switch (c->type) {
204         case SSH_CHANNEL_X11_OPEN:
205         case SSH_CHANNEL_LARVAL:
206         case SSH_CHANNEL_CONNECTING:
207         case SSH_CHANNEL_DYNAMIC:
208         case SSH_CHANNEL_OPENING:
209         case SSH_CHANNEL_OPEN:
210         case SSH_CHANNEL_INPUT_DRAINING:
211         case SSH_CHANNEL_OUTPUT_DRAINING:
212                 return (c);
213         }
214         logit("Non-public channel %d, type %d.", id, c->type);
215         return (NULL);
216 }
217
218 /*
219  * Register filedescriptors for a channel, used when allocating a channel or
220  * when the channel consumer/producer is ready, e.g. shell exec'd
221  */
222 static void
223 channel_register_fds(Channel *c, int rfd, int wfd, int efd,
224     int extusage, int nonblock, int is_tty)
225 {
226         /* Update the maximum file descriptor value. */
227         channel_max_fd = MAX(channel_max_fd, rfd);
228         channel_max_fd = MAX(channel_max_fd, wfd);
229         channel_max_fd = MAX(channel_max_fd, efd);
230
231         /* XXX set close-on-exec -markus */
232
233         c->rfd = rfd;
234         c->wfd = wfd;
235         c->sock = (rfd == wfd) ? rfd : -1;
236         c->ctl_fd = -1; /* XXX: set elsewhere */
237         c->efd = efd;
238         c->extended_usage = extusage;
239
240         if ((c->isatty = is_tty) != 0)
241                 debug2("channel %d: rfd %d isatty", c->self, c->rfd);
242         c->wfd_isatty = isatty || isatty(c->wfd);
243
244         /* enable nonblocking mode */
245         if (nonblock) {
246                 if (rfd != -1)
247                         set_nonblock(rfd);
248                 if (wfd != -1)
249                         set_nonblock(wfd);
250                 if (efd != -1)
251                         set_nonblock(efd);
252         }
253 }
254
255 /*
256  * Allocate a new channel object and set its type and socket. This will cause
257  * remote_name to be freed.
258  */
259 Channel *
260 channel_new(char *ctype, int type, int rfd, int wfd, int efd,
261     u_int window, u_int maxpack, int extusage, char *remote_name, int nonblock)
262 {
263         int found;
264         u_int i;
265         Channel *c;
266
267         /* Do initial allocation if this is the first call. */
268         if (channels_alloc == 0) {
269                 channels_alloc = 10;
270                 channels = xcalloc(channels_alloc, sizeof(Channel *));
271                 for (i = 0; i < channels_alloc; i++)
272                         channels[i] = NULL;
273         }
274         /* Try to find a free slot where to put the new channel. */
275         for (found = -1, i = 0; i < channels_alloc; i++)
276                 if (channels[i] == NULL) {
277                         /* Found a free slot. */
278                         found = (int)i;
279                         break;
280                 }
281         if (found < 0) {
282                 /* There are no free slots.  Take last+1 slot and expand the array.  */
283                 found = channels_alloc;
284                 if (channels_alloc > 10000)
285                         fatal("channel_new: internal error: channels_alloc %d "
286                             "too big.", channels_alloc);
287                 channels = xrealloc(channels, channels_alloc + 10,
288                     sizeof(Channel *));
289                 channels_alloc += 10;
290                 debug2("channel: expanding %d", channels_alloc);
291                 for (i = found; i < channels_alloc; i++)
292                         channels[i] = NULL;
293         }
294         /* Initialize and return new channel. */
295         c = channels[found] = xcalloc(1, sizeof(Channel));
296         buffer_init(&c->input);
297         buffer_init(&c->output);
298         buffer_init(&c->extended);
299         c->ostate = CHAN_OUTPUT_OPEN;
300         c->istate = CHAN_INPUT_OPEN;
301         c->flags = 0;
302         channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, 0);
303         c->self = found;
304         c->type = type;
305         c->ctype = ctype;
306         c->local_window = window;
307         c->local_window_max = window;
308         c->local_consumed = 0;
309         c->local_maxpacket = maxpack;
310         c->remote_id = -1;
311         c->remote_name = xstrdup(remote_name);
312         c->remote_window = 0;
313         c->remote_maxpacket = 0;
314         c->force_drain = 0;
315         c->single_connection = 0;
316         c->detach_user = NULL;
317         c->detach_close = 0;
318         c->open_confirm = NULL;
319         c->open_confirm_ctx = NULL;
320         c->input_filter = NULL;
321         c->output_filter = NULL;
322         c->filter_ctx = NULL;
323         c->filter_cleanup = NULL;
324         TAILQ_INIT(&c->status_confirms);
325         debug("channel %d: new [%s]", found, remote_name);
326         return c;
327 }
328
329 static int
330 channel_find_maxfd(void)
331 {
332         u_int i;
333         int max = 0;
334         Channel *c;
335
336         for (i = 0; i < channels_alloc; i++) {
337                 c = channels[i];
338                 if (c != NULL) {
339                         max = MAX(max, c->rfd);
340                         max = MAX(max, c->wfd);
341                         max = MAX(max, c->efd);
342                 }
343         }
344         return max;
345 }
346
347 int
348 channel_close_fd(int *fdp)
349 {
350         int ret = 0, fd = *fdp;
351
352         if (fd != -1) {
353                 ret = close(fd);
354                 *fdp = -1;
355                 if (fd == channel_max_fd)
356                         channel_max_fd = channel_find_maxfd();
357         }
358         return ret;
359 }
360
361 /* Close all channel fd/socket. */
362 static void
363 channel_close_fds(Channel *c)
364 {
365         debug3("channel %d: close_fds r %d w %d e %d c %d",
366             c->self, c->rfd, c->wfd, c->efd, c->ctl_fd);
367
368         channel_close_fd(&c->sock);
369         channel_close_fd(&c->ctl_fd);
370         channel_close_fd(&c->rfd);
371         channel_close_fd(&c->wfd);
372         channel_close_fd(&c->efd);
373 }
374
375 /* Free the channel and close its fd/socket. */
376 void
377 channel_free(Channel *c)
378 {
379         char *s;
380         u_int i, n;
381         struct channel_confirm *cc;
382
383         for (n = 0, i = 0; i < channels_alloc; i++)
384                 if (channels[i])
385                         n++;
386         debug("channel %d: free: %s, nchannels %u", c->self,
387             c->remote_name ? c->remote_name : "???", n);
388
389         s = channel_open_message();
390         debug3("channel %d: status: %s", c->self, s);
391         xfree(s);
392
393         if (c->sock != -1)
394                 shutdown(c->sock, SHUT_RDWR);
395         if (c->ctl_fd != -1)
396                 shutdown(c->ctl_fd, SHUT_RDWR);
397         channel_close_fds(c);
398         buffer_free(&c->input);
399         buffer_free(&c->output);
400         buffer_free(&c->extended);
401         if (c->remote_name) {
402                 xfree(c->remote_name);
403                 c->remote_name = NULL;
404         }
405         while ((cc = TAILQ_FIRST(&c->status_confirms)) != NULL) {
406                 if (cc->abandon_cb != NULL)
407                         cc->abandon_cb(c, cc->ctx);
408                 TAILQ_REMOVE(&c->status_confirms, cc, entry);
409                 bzero(cc, sizeof(*cc));
410                 xfree(cc);
411         }
412         if (c->filter_cleanup != NULL && c->filter_ctx != NULL)
413                 c->filter_cleanup(c->self, c->filter_ctx);
414         channels[c->self] = NULL;
415         xfree(c);
416 }
417
418 void
419 channel_free_all(void)
420 {
421         u_int i;
422
423         for (i = 0; i < channels_alloc; i++)
424                 if (channels[i] != NULL)
425                         channel_free(channels[i]);
426 }
427
428 /*
429  * Closes the sockets/fds of all channels.  This is used to close extra file
430  * descriptors after a fork.
431  */
432 void
433 channel_close_all(void)
434 {
435         u_int i;
436
437         for (i = 0; i < channels_alloc; i++)
438                 if (channels[i] != NULL)
439                         channel_close_fds(channels[i]);
440 }
441
442 /*
443  * Stop listening to channels.
444  */
445 void
446 channel_stop_listening(void)
447 {
448         u_int i;
449         Channel *c;
450
451         for (i = 0; i < channels_alloc; i++) {
452                 c = channels[i];
453                 if (c != NULL) {
454                         switch (c->type) {
455                         case SSH_CHANNEL_AUTH_SOCKET:
456                         case SSH_CHANNEL_PORT_LISTENER:
457                         case SSH_CHANNEL_RPORT_LISTENER:
458                         case SSH_CHANNEL_X11_LISTENER:
459                                 channel_close_fd(&c->sock);
460                                 channel_free(c);
461                                 break;
462                         }
463                 }
464         }
465 }
466
467 /*
468  * Returns true if no channel has too much buffered data, and false if one or
469  * more channel is overfull.
470  */
471 int
472 channel_not_very_much_buffered_data(void)
473 {
474         u_int i;
475         Channel *c;
476
477         for (i = 0; i < channels_alloc; i++) {
478                 c = channels[i];
479                 if (c != NULL && c->type == SSH_CHANNEL_OPEN) {
480 #if 0
481                         if (!compat20 &&
482                             buffer_len(&c->input) > packet_get_maxsize()) {
483                                 debug2("channel %d: big input buffer %d",
484                                     c->self, buffer_len(&c->input));
485                                 return 0;
486                         }
487 #endif
488                         if (buffer_len(&c->output) > packet_get_maxsize()) {
489                                 debug2("channel %d: big output buffer %u > %u",
490                                     c->self, buffer_len(&c->output),
491                                     packet_get_maxsize());
492                                 return 0;
493                         }
494                 }
495         }
496         return 1;
497 }
498
499 /* Returns true if any channel is still open. */
500 int
501 channel_still_open(void)
502 {
503         u_int i;
504         Channel *c;
505
506         for (i = 0; i < channels_alloc; i++) {
507                 c = channels[i];
508                 if (c == NULL)
509                         continue;
510                 switch (c->type) {
511                 case SSH_CHANNEL_X11_LISTENER:
512                 case SSH_CHANNEL_PORT_LISTENER:
513                 case SSH_CHANNEL_RPORT_LISTENER:
514                 case SSH_CHANNEL_CLOSED:
515                 case SSH_CHANNEL_AUTH_SOCKET:
516                 case SSH_CHANNEL_DYNAMIC:
517                 case SSH_CHANNEL_CONNECTING:
518                 case SSH_CHANNEL_ZOMBIE:
519                         continue;
520                 case SSH_CHANNEL_LARVAL:
521                         if (!compat20)
522                                 fatal("cannot happen: SSH_CHANNEL_LARVAL");
523                         continue;
524                 case SSH_CHANNEL_OPENING:
525                 case SSH_CHANNEL_OPEN:
526                 case SSH_CHANNEL_X11_OPEN:
527                         return 1;
528                 case SSH_CHANNEL_INPUT_DRAINING:
529                 case SSH_CHANNEL_OUTPUT_DRAINING:
530                         if (!compat13)
531                                 fatal("cannot happen: OUT_DRAIN");
532                         return 1;
533                 default:
534                         fatal("channel_still_open: bad channel type %d", c->type);
535                         /* NOTREACHED */
536                 }
537         }
538         return 0;
539 }
540
541 /* Returns the id of an open channel suitable for keepaliving */
542 int
543 channel_find_open(void)
544 {
545         u_int i;
546         Channel *c;
547
548         for (i = 0; i < channels_alloc; i++) {
549                 c = channels[i];
550                 if (c == NULL || c->remote_id < 0)
551                         continue;
552                 switch (c->type) {
553                 case SSH_CHANNEL_CLOSED:
554                 case SSH_CHANNEL_DYNAMIC:
555                 case SSH_CHANNEL_X11_LISTENER:
556                 case SSH_CHANNEL_PORT_LISTENER:
557                 case SSH_CHANNEL_RPORT_LISTENER:
558                 case SSH_CHANNEL_OPENING:
559                 case SSH_CHANNEL_CONNECTING:
560                 case SSH_CHANNEL_ZOMBIE:
561                         continue;
562                 case SSH_CHANNEL_LARVAL:
563                 case SSH_CHANNEL_AUTH_SOCKET:
564                 case SSH_CHANNEL_OPEN:
565                 case SSH_CHANNEL_X11_OPEN:
566                         return i;
567                 case SSH_CHANNEL_INPUT_DRAINING:
568                 case SSH_CHANNEL_OUTPUT_DRAINING:
569                         if (!compat13)
570                                 fatal("cannot happen: OUT_DRAIN");
571                         return i;
572                 default:
573                         fatal("channel_find_open: bad channel type %d", c->type);
574                         /* NOTREACHED */
575                 }
576         }
577         return -1;
578 }
579
580
581 /*
582  * Returns a message describing the currently open forwarded connections,
583  * suitable for sending to the client.  The message contains crlf pairs for
584  * newlines.
585  */
586 char *
587 channel_open_message(void)
588 {
589         Buffer buffer;
590         Channel *c;
591         char buf[1024], *cp;
592         u_int i;
593
594         buffer_init(&buffer);
595         snprintf(buf, sizeof buf, "The following connections are open:\r\n");
596         buffer_append(&buffer, buf, strlen(buf));
597         for (i = 0; i < channels_alloc; i++) {
598                 c = channels[i];
599                 if (c == NULL)
600                         continue;
601                 switch (c->type) {
602                 case SSH_CHANNEL_X11_LISTENER:
603                 case SSH_CHANNEL_PORT_LISTENER:
604                 case SSH_CHANNEL_RPORT_LISTENER:
605                 case SSH_CHANNEL_CLOSED:
606                 case SSH_CHANNEL_AUTH_SOCKET:
607                 case SSH_CHANNEL_ZOMBIE:
608                         continue;
609                 case SSH_CHANNEL_LARVAL:
610                 case SSH_CHANNEL_OPENING:
611                 case SSH_CHANNEL_CONNECTING:
612                 case SSH_CHANNEL_DYNAMIC:
613                 case SSH_CHANNEL_OPEN:
614                 case SSH_CHANNEL_X11_OPEN:
615                 case SSH_CHANNEL_INPUT_DRAINING:
616                 case SSH_CHANNEL_OUTPUT_DRAINING:
617                         snprintf(buf, sizeof buf,
618                             "  #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d cfd %d)\r\n",
619                             c->self, c->remote_name,
620                             c->type, c->remote_id,
621                             c->istate, buffer_len(&c->input),
622                             c->ostate, buffer_len(&c->output),
623                             c->rfd, c->wfd, c->ctl_fd);
624                         buffer_append(&buffer, buf, strlen(buf));
625                         continue;
626                 default:
627                         fatal("channel_open_message: bad channel type %d", c->type);
628                         /* NOTREACHED */
629                 }
630         }
631         buffer_append(&buffer, "\0", 1);
632         cp = xstrdup(buffer_ptr(&buffer));
633         buffer_free(&buffer);
634         return cp;
635 }
636
637 void
638 channel_send_open(int id)
639 {
640         Channel *c = channel_lookup(id);
641
642         if (c == NULL) {
643                 logit("channel_send_open: %d: bad id", id);
644                 return;
645         }
646         debug2("channel %d: send open", id);
647         packet_start(SSH2_MSG_CHANNEL_OPEN);
648         packet_put_cstring(c->ctype);
649         packet_put_int(c->self);
650         packet_put_int(c->local_window);
651         packet_put_int(c->local_maxpacket);
652         packet_send();
653 }
654
655 void
656 channel_request_start(int id, char *service, int wantconfirm)
657 {
658         Channel *c = channel_lookup(id);
659
660         if (c == NULL) {
661                 logit("channel_request_start: %d: unknown channel id", id);
662                 return;
663         }
664         debug2("channel %d: request %s confirm %d", id, service, wantconfirm);
665         packet_start(SSH2_MSG_CHANNEL_REQUEST);
666         packet_put_int(c->remote_id);
667         packet_put_cstring(service);
668         packet_put_char(wantconfirm);
669 }
670
671 void
672 channel_register_status_confirm(int id, channel_confirm_cb *cb,
673     channel_confirm_abandon_cb *abandon_cb, void *ctx)
674 {
675         struct channel_confirm *cc;
676         Channel *c;
677
678         if ((c = channel_lookup(id)) == NULL)
679                 fatal("channel_register_expect: %d: bad id", id);
680
681         cc = xmalloc(sizeof(*cc));
682         cc->cb = cb;
683         cc->abandon_cb = abandon_cb;
684         cc->ctx = ctx;
685         TAILQ_INSERT_TAIL(&c->status_confirms, cc, entry);
686 }
687
688 void
689 channel_register_open_confirm(int id, channel_callback_fn *fn, void *ctx)
690 {
691         Channel *c = channel_lookup(id);
692
693         if (c == NULL) {
694                 logit("channel_register_open_comfirm: %d: bad id", id);
695                 return;
696         }
697         c->open_confirm = fn;
698         c->open_confirm_ctx = ctx;
699 }
700
701 void
702 channel_register_cleanup(int id, channel_callback_fn *fn, int do_close)
703 {
704         Channel *c = channel_by_id(id);
705
706         if (c == NULL) {
707                 logit("channel_register_cleanup: %d: bad id", id);
708                 return;
709         }
710         c->detach_user = fn;
711         c->detach_close = do_close;
712 }
713
714 void
715 channel_cancel_cleanup(int id)
716 {
717         Channel *c = channel_by_id(id);
718
719         if (c == NULL) {
720                 logit("channel_cancel_cleanup: %d: bad id", id);
721                 return;
722         }
723         c->detach_user = NULL;
724         c->detach_close = 0;
725 }
726
727 void
728 channel_register_filter(int id, channel_infilter_fn *ifn,
729     channel_outfilter_fn *ofn, channel_filter_cleanup_fn *cfn, void *ctx)
730 {
731         Channel *c = channel_lookup(id);
732
733         if (c == NULL) {
734                 logit("channel_register_filter: %d: bad id", id);
735                 return;
736         }
737         c->input_filter = ifn;
738         c->output_filter = ofn;
739         c->filter_ctx = ctx;
740         c->filter_cleanup = cfn;
741 }
742
743 void
744 channel_set_fds(int id, int rfd, int wfd, int efd,
745     int extusage, int nonblock, int is_tty, u_int window_max)
746 {
747         Channel *c = channel_lookup(id);
748
749         if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
750                 fatal("channel_activate for non-larval channel %d.", id);
751         channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, is_tty);
752         c->type = SSH_CHANNEL_OPEN;
753         c->local_window = c->local_window_max = window_max;
754         packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
755         packet_put_int(c->remote_id);
756         packet_put_int(c->local_window);
757         packet_send();
758 }
759
760 /*
761  * 'channel_pre*' are called just before select() to add any bits relevant to
762  * channels in the select bitmasks.
763  */
764 /*
765  * 'channel_post*': perform any appropriate operations for channels which
766  * have events pending.
767  */
768 typedef void chan_fn(Channel *c, fd_set *readset, fd_set *writeset);
769 chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
770 chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
771
772 /* ARGSUSED */
773 static void
774 channel_pre_listener(Channel *c, fd_set *readset, fd_set *writeset)
775 {
776         FD_SET(c->sock, readset);
777 }
778
779 /* ARGSUSED */
780 static void
781 channel_pre_connecting(Channel *c, fd_set *readset, fd_set *writeset)
782 {
783         debug3("channel %d: waiting for connection", c->self);
784         FD_SET(c->sock, writeset);
785 }
786
787 static void
788 channel_pre_open_13(Channel *c, fd_set *readset, fd_set *writeset)
789 {
790         if (buffer_len(&c->input) < packet_get_maxsize())
791                 FD_SET(c->sock, readset);
792         if (buffer_len(&c->output) > 0)
793                 FD_SET(c->sock, writeset);
794 }
795
796 static void
797 channel_pre_open(Channel *c, fd_set *readset, fd_set *writeset)
798 {
799         u_int limit = compat20 ? c->remote_window : packet_get_maxsize();
800
801         if (c->istate == CHAN_INPUT_OPEN &&
802             limit > 0 &&
803             buffer_len(&c->input) < limit &&
804             buffer_check_alloc(&c->input, CHAN_RBUF))
805                 FD_SET(c->rfd, readset);
806         if (c->ostate == CHAN_OUTPUT_OPEN ||
807             c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
808                 if (buffer_len(&c->output) > 0) {
809                         FD_SET(c->wfd, writeset);
810                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
811                         if (CHANNEL_EFD_OUTPUT_ACTIVE(c))
812                                 debug2("channel %d: obuf_empty delayed efd %d/(%d)",
813                                     c->self, c->efd, buffer_len(&c->extended));
814                         else
815                                 chan_obuf_empty(c);
816                 }
817         }
818         /** XXX check close conditions, too */
819         if (compat20 && c->efd != -1 && 
820             !(c->istate == CHAN_INPUT_CLOSED && c->ostate == CHAN_OUTPUT_CLOSED)) {
821                 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
822                     buffer_len(&c->extended) > 0)
823                         FD_SET(c->efd, writeset);
824                 else if (!(c->flags & CHAN_EOF_SENT) &&
825                     c->extended_usage == CHAN_EXTENDED_READ &&
826                     buffer_len(&c->extended) < c->remote_window)
827                         FD_SET(c->efd, readset);
828         }
829         /* XXX: What about efd? races? */
830         if (compat20 && c->ctl_fd != -1 &&
831             c->istate == CHAN_INPUT_OPEN && c->ostate == CHAN_OUTPUT_OPEN)
832                 FD_SET(c->ctl_fd, readset);
833 }
834
835 /* ARGSUSED */
836 static void
837 channel_pre_input_draining(Channel *c, fd_set *readset, fd_set *writeset)
838 {
839         if (buffer_len(&c->input) == 0) {
840                 packet_start(SSH_MSG_CHANNEL_CLOSE);
841                 packet_put_int(c->remote_id);
842                 packet_send();
843                 c->type = SSH_CHANNEL_CLOSED;
844                 debug2("channel %d: closing after input drain.", c->self);
845         }
846 }
847
848 /* ARGSUSED */
849 static void
850 channel_pre_output_draining(Channel *c, fd_set *readset, fd_set *writeset)
851 {
852         if (buffer_len(&c->output) == 0)
853                 chan_mark_dead(c);
854         else
855                 FD_SET(c->sock, writeset);
856 }
857
858 /*
859  * This is a special state for X11 authentication spoofing.  An opened X11
860  * connection (when authentication spoofing is being done) remains in this
861  * state until the first packet has been completely read.  The authentication
862  * data in that packet is then substituted by the real data if it matches the
863  * fake data, and the channel is put into normal mode.
864  * XXX All this happens at the client side.
865  * Returns: 0 = need more data, -1 = wrong cookie, 1 = ok
866  */
867 static int
868 x11_open_helper(Buffer *b)
869 {
870         u_char *ucp;
871         u_int proto_len, data_len;
872
873         /* Check if the fixed size part of the packet is in buffer. */
874         if (buffer_len(b) < 12)
875                 return 0;
876
877         /* Parse the lengths of variable-length fields. */
878         ucp = buffer_ptr(b);
879         if (ucp[0] == 0x42) {   /* Byte order MSB first. */
880                 proto_len = 256 * ucp[6] + ucp[7];
881                 data_len = 256 * ucp[8] + ucp[9];
882         } else if (ucp[0] == 0x6c) {    /* Byte order LSB first. */
883                 proto_len = ucp[6] + 256 * ucp[7];
884                 data_len = ucp[8] + 256 * ucp[9];
885         } else {
886                 debug2("Initial X11 packet contains bad byte order byte: 0x%x",
887                     ucp[0]);
888                 return -1;
889         }
890
891         /* Check if the whole packet is in buffer. */
892         if (buffer_len(b) <
893             12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
894                 return 0;
895
896         /* Check if authentication protocol matches. */
897         if (proto_len != strlen(x11_saved_proto) ||
898             memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
899                 debug2("X11 connection uses different authentication protocol.");
900                 return -1;
901         }
902         /* Check if authentication data matches our fake data. */
903         if (data_len != x11_fake_data_len ||
904             memcmp(ucp + 12 + ((proto_len + 3) & ~3),
905                 x11_fake_data, x11_fake_data_len) != 0) {
906                 debug2("X11 auth data does not match fake data.");
907                 return -1;
908         }
909         /* Check fake data length */
910         if (x11_fake_data_len != x11_saved_data_len) {
911                 error("X11 fake_data_len %d != saved_data_len %d",
912                     x11_fake_data_len, x11_saved_data_len);
913                 return -1;
914         }
915         /*
916          * Received authentication protocol and data match
917          * our fake data. Substitute the fake data with real
918          * data.
919          */
920         memcpy(ucp + 12 + ((proto_len + 3) & ~3),
921             x11_saved_data, x11_saved_data_len);
922         return 1;
923 }
924
925 static void
926 channel_pre_x11_open_13(Channel *c, fd_set *readset, fd_set *writeset)
927 {
928         int ret = x11_open_helper(&c->output);
929
930         if (ret == 1) {
931                 /* Start normal processing for the channel. */
932                 c->type = SSH_CHANNEL_OPEN;
933                 channel_pre_open_13(c, readset, writeset);
934         } else if (ret == -1) {
935                 /*
936                  * We have received an X11 connection that has bad
937                  * authentication information.
938                  */
939                 logit("X11 connection rejected because of wrong authentication.");
940                 buffer_clear(&c->input);
941                 buffer_clear(&c->output);
942                 channel_close_fd(&c->sock);
943                 c->sock = -1;
944                 c->type = SSH_CHANNEL_CLOSED;
945                 packet_start(SSH_MSG_CHANNEL_CLOSE);
946                 packet_put_int(c->remote_id);
947                 packet_send();
948         }
949 }
950
951 static void
952 channel_pre_x11_open(Channel *c, fd_set *readset, fd_set *writeset)
953 {
954         int ret = x11_open_helper(&c->output);
955
956         /* c->force_drain = 1; */
957
958         if (ret == 1) {
959                 c->type = SSH_CHANNEL_OPEN;
960                 channel_pre_open(c, readset, writeset);
961         } else if (ret == -1) {
962                 logit("X11 connection rejected because of wrong authentication.");
963                 debug2("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
964                 chan_read_failed(c);
965                 buffer_clear(&c->input);
966                 chan_ibuf_empty(c);
967                 buffer_clear(&c->output);
968                 /* for proto v1, the peer will send an IEOF */
969                 if (compat20)
970                         chan_write_failed(c);
971                 else
972                         c->type = SSH_CHANNEL_OPEN;
973                 debug2("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
974         }
975 }
976
977 /* try to decode a socks4 header */
978 /* ARGSUSED */
979 static int
980 channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
981 {
982         char *p, *host;
983         u_int len, have, i, found;
984         char username[256];
985         struct {
986                 u_int8_t version;
987                 u_int8_t command;
988                 u_int16_t dest_port;
989                 struct in_addr dest_addr;
990         } s4_req, s4_rsp;
991
992         debug2("channel %d: decode socks4", c->self);
993
994         have = buffer_len(&c->input);
995         len = sizeof(s4_req);
996         if (have < len)
997                 return 0;
998         p = buffer_ptr(&c->input);
999         for (found = 0, i = len; i < have; i++) {
1000                 if (p[i] == '\0') {
1001                         found = 1;
1002                         break;
1003                 }
1004                 if (i > 1024) {
1005                         /* the peer is probably sending garbage */
1006                         debug("channel %d: decode socks4: too long",
1007                             c->self);
1008                         return -1;
1009                 }
1010         }
1011         if (!found)
1012                 return 0;
1013         buffer_get(&c->input, (char *)&s4_req.version, 1);
1014         buffer_get(&c->input, (char *)&s4_req.command, 1);
1015         buffer_get(&c->input, (char *)&s4_req.dest_port, 2);
1016         buffer_get(&c->input, (char *)&s4_req.dest_addr, 4);
1017         have = buffer_len(&c->input);
1018         p = buffer_ptr(&c->input);
1019         len = strlen(p);
1020         debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
1021         if (len > have)
1022                 fatal("channel %d: decode socks4: len %d > have %d",
1023                     c->self, len, have);
1024         strlcpy(username, p, sizeof(username));
1025         buffer_consume(&c->input, len);
1026         buffer_consume(&c->input, 1);           /* trailing '\0' */
1027
1028         host = inet_ntoa(s4_req.dest_addr);
1029         strlcpy(c->path, host, sizeof(c->path));
1030         c->host_port = ntohs(s4_req.dest_port);
1031
1032         debug2("channel %d: dynamic request: socks4 host %s port %u command %u",
1033             c->self, host, c->host_port, s4_req.command);
1034
1035         if (s4_req.command != 1) {
1036                 debug("channel %d: cannot handle: socks4 cn %d",
1037                     c->self, s4_req.command);
1038                 return -1;
1039         }
1040         s4_rsp.version = 0;                     /* vn: 0 for reply */
1041         s4_rsp.command = 90;                    /* cd: req granted */
1042         s4_rsp.dest_port = 0;                   /* ignored */
1043         s4_rsp.dest_addr.s_addr = INADDR_ANY;   /* ignored */
1044         buffer_append(&c->output, &s4_rsp, sizeof(s4_rsp));
1045         return 1;
1046 }
1047
1048 /* try to decode a socks5 header */
1049 #define SSH_SOCKS5_AUTHDONE     0x1000
1050 #define SSH_SOCKS5_NOAUTH       0x00
1051 #define SSH_SOCKS5_IPV4         0x01
1052 #define SSH_SOCKS5_DOMAIN       0x03
1053 #define SSH_SOCKS5_IPV6         0x04
1054 #define SSH_SOCKS5_CONNECT      0x01
1055 #define SSH_SOCKS5_SUCCESS      0x00
1056
1057 /* ARGSUSED */
1058 static int
1059 channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset)
1060 {
1061         struct {
1062                 u_int8_t version;
1063                 u_int8_t command;
1064                 u_int8_t reserved;
1065                 u_int8_t atyp;
1066         } s5_req, s5_rsp;
1067         u_int16_t dest_port;
1068         u_char *p, dest_addr[255+1];
1069         u_int have, need, i, found, nmethods, addrlen, af;
1070
1071         debug2("channel %d: decode socks5", c->self);
1072         p = buffer_ptr(&c->input);
1073         if (p[0] != 0x05)
1074                 return -1;
1075         have = buffer_len(&c->input);
1076         if (!(c->flags & SSH_SOCKS5_AUTHDONE)) {
1077                 /* format: ver | nmethods | methods */
1078                 if (have < 2)
1079                         return 0;
1080                 nmethods = p[1];
1081                 if (have < nmethods + 2)
1082                         return 0;
1083                 /* look for method: "NO AUTHENTICATION REQUIRED" */
1084                 for (found = 0, i = 2; i < nmethods + 2; i++) {
1085                         if (p[i] == SSH_SOCKS5_NOAUTH) {
1086                                 found = 1;
1087                                 break;
1088                         }
1089                 }
1090                 if (!found) {
1091                         debug("channel %d: method SSH_SOCKS5_NOAUTH not found",
1092                             c->self);
1093                         return -1;
1094                 }
1095                 buffer_consume(&c->input, nmethods + 2);
1096                 buffer_put_char(&c->output, 0x05);              /* version */
1097                 buffer_put_char(&c->output, SSH_SOCKS5_NOAUTH); /* method */
1098                 FD_SET(c->sock, writeset);
1099                 c->flags |= SSH_SOCKS5_AUTHDONE;
1100                 debug2("channel %d: socks5 auth done", c->self);
1101                 return 0;                               /* need more */
1102         }
1103         debug2("channel %d: socks5 post auth", c->self);
1104         if (have < sizeof(s5_req)+1)
1105                 return 0;                       /* need more */
1106         memcpy(&s5_req, p, sizeof(s5_req));
1107         if (s5_req.version != 0x05 ||
1108             s5_req.command != SSH_SOCKS5_CONNECT ||
1109             s5_req.reserved != 0x00) {
1110                 debug2("channel %d: only socks5 connect supported", c->self);
1111                 return -1;
1112         }
1113         switch (s5_req.atyp){
1114         case SSH_SOCKS5_IPV4:
1115                 addrlen = 4;
1116                 af = AF_INET;
1117                 break;
1118         case SSH_SOCKS5_DOMAIN:
1119                 addrlen = p[sizeof(s5_req)];
1120                 af = -1;
1121                 break;
1122         case SSH_SOCKS5_IPV6:
1123                 addrlen = 16;
1124                 af = AF_INET6;
1125                 break;
1126         default:
1127                 debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp);
1128                 return -1;
1129         }
1130         need = sizeof(s5_req) + addrlen + 2;
1131         if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
1132                 need++;
1133         if (have < need)
1134                 return 0;
1135         buffer_consume(&c->input, sizeof(s5_req));
1136         if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
1137                 buffer_consume(&c->input, 1);    /* host string length */
1138         buffer_get(&c->input, (char *)&dest_addr, addrlen);
1139         buffer_get(&c->input, (char *)&dest_port, 2);
1140         dest_addr[addrlen] = '\0';
1141         if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
1142                 strlcpy(c->path, (char *)dest_addr, sizeof(c->path));
1143         else if (inet_ntop(af, dest_addr, c->path, sizeof(c->path)) == NULL)
1144                 return -1;
1145         c->host_port = ntohs(dest_port);
1146
1147         debug2("channel %d: dynamic request: socks5 host %s port %u command %u",
1148             c->self, c->path, c->host_port, s5_req.command);
1149
1150         s5_rsp.version = 0x05;
1151         s5_rsp.command = SSH_SOCKS5_SUCCESS;
1152         s5_rsp.reserved = 0;                    /* ignored */
1153         s5_rsp.atyp = SSH_SOCKS5_IPV4;
1154         ((struct in_addr *)&dest_addr)->s_addr = INADDR_ANY;
1155         dest_port = 0;                          /* ignored */
1156
1157         buffer_append(&c->output, &s5_rsp, sizeof(s5_rsp));
1158         buffer_append(&c->output, &dest_addr, sizeof(struct in_addr));
1159         buffer_append(&c->output, &dest_port, sizeof(dest_port));
1160         return 1;
1161 }
1162
1163 /* dynamic port forwarding */
1164 static void
1165 channel_pre_dynamic(Channel *c, fd_set *readset, fd_set *writeset)
1166 {
1167         u_char *p;
1168         u_int have;
1169         int ret;
1170
1171         have = buffer_len(&c->input);
1172         c->delayed = 0;
1173         debug2("channel %d: pre_dynamic: have %d", c->self, have);
1174         /* buffer_dump(&c->input); */
1175         /* check if the fixed size part of the packet is in buffer. */
1176         if (have < 3) {
1177                 /* need more */
1178                 FD_SET(c->sock, readset);
1179                 return;
1180         }
1181         /* try to guess the protocol */
1182         p = buffer_ptr(&c->input);
1183         switch (p[0]) {
1184         case 0x04:
1185                 ret = channel_decode_socks4(c, readset, writeset);
1186                 break;
1187         case 0x05:
1188                 ret = channel_decode_socks5(c, readset, writeset);
1189                 break;
1190         default:
1191                 ret = -1;
1192                 break;
1193         }
1194         if (ret < 0) {
1195                 chan_mark_dead(c);
1196         } else if (ret == 0) {
1197                 debug2("channel %d: pre_dynamic: need more", c->self);
1198                 /* need more */
1199                 FD_SET(c->sock, readset);
1200         } else {
1201                 /* switch to the next state */
1202                 c->type = SSH_CHANNEL_OPENING;
1203                 port_open_helper(c, "direct-tcpip");
1204         }
1205 }
1206
1207 /* This is our fake X11 server socket. */
1208 /* ARGSUSED */
1209 static void
1210 channel_post_x11_listener(Channel *c, fd_set *readset, fd_set *writeset)
1211 {
1212         Channel *nc;
1213         struct sockaddr addr;
1214         int newsock;
1215         socklen_t addrlen;
1216         char buf[16384], *remote_ipaddr;
1217         int remote_port;
1218
1219         if (FD_ISSET(c->sock, readset)) {
1220                 debug("X11 connection requested.");
1221                 addrlen = sizeof(addr);
1222                 newsock = accept(c->sock, &addr, &addrlen);
1223                 if (c->single_connection) {
1224                         debug2("single_connection: closing X11 listener.");
1225                         channel_close_fd(&c->sock);
1226                         chan_mark_dead(c);
1227                 }
1228                 if (newsock < 0) {
1229                         error("accept: %.100s", strerror(errno));
1230                         return;
1231                 }
1232                 set_nodelay(newsock);
1233                 remote_ipaddr = get_peer_ipaddr(newsock);
1234                 remote_port = get_peer_port(newsock);
1235                 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
1236                     remote_ipaddr, remote_port);
1237
1238                 nc = channel_new("accepted x11 socket",
1239                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
1240                     c->local_window_max, c->local_maxpacket, 0, buf, 1);
1241                 if (compat20) {
1242                         packet_start(SSH2_MSG_CHANNEL_OPEN);
1243                         packet_put_cstring("x11");
1244                         packet_put_int(nc->self);
1245                         packet_put_int(nc->local_window_max);
1246                         packet_put_int(nc->local_maxpacket);
1247                         /* originator ipaddr and port */
1248                         packet_put_cstring(remote_ipaddr);
1249                         if (datafellows & SSH_BUG_X11FWD) {
1250                                 debug2("ssh2 x11 bug compat mode");
1251                         } else {
1252                                 packet_put_int(remote_port);
1253                         }
1254                         packet_send();
1255                 } else {
1256                         packet_start(SSH_SMSG_X11_OPEN);
1257                         packet_put_int(nc->self);
1258                         if (packet_get_protocol_flags() &
1259                             SSH_PROTOFLAG_HOST_IN_FWD_OPEN)
1260                                 packet_put_cstring(buf);
1261                         packet_send();
1262                 }
1263                 xfree(remote_ipaddr);
1264         }
1265 }
1266
1267 static void
1268 port_open_helper(Channel *c, char *rtype)
1269 {
1270         int direct;
1271         char buf[1024];
1272         char *remote_ipaddr = get_peer_ipaddr(c->sock);
1273         int remote_port = get_peer_port(c->sock);
1274
1275         direct = (strcmp(rtype, "direct-tcpip") == 0);
1276
1277         snprintf(buf, sizeof buf,
1278             "%s: listening port %d for %.100s port %d, "
1279             "connect from %.200s port %d",
1280             rtype, c->listening_port, c->path, c->host_port,
1281             remote_ipaddr, remote_port);
1282
1283         xfree(c->remote_name);
1284         c->remote_name = xstrdup(buf);
1285
1286         if (compat20) {
1287                 packet_start(SSH2_MSG_CHANNEL_OPEN);
1288                 packet_put_cstring(rtype);
1289                 packet_put_int(c->self);
1290                 packet_put_int(c->local_window_max);
1291                 packet_put_int(c->local_maxpacket);
1292                 if (direct) {
1293                         /* target host, port */
1294                         packet_put_cstring(c->path);
1295                         packet_put_int(c->host_port);
1296                 } else {
1297                         /* listen address, port */
1298                         packet_put_cstring(c->path);
1299                         packet_put_int(c->listening_port);
1300                 }
1301                 /* originator host and port */
1302                 packet_put_cstring(remote_ipaddr);
1303                 packet_put_int((u_int)remote_port);
1304                 packet_send();
1305         } else {
1306                 packet_start(SSH_MSG_PORT_OPEN);
1307                 packet_put_int(c->self);
1308                 packet_put_cstring(c->path);
1309                 packet_put_int(c->host_port);
1310                 if (packet_get_protocol_flags() &
1311                     SSH_PROTOFLAG_HOST_IN_FWD_OPEN)
1312                         packet_put_cstring(c->remote_name);
1313                 packet_send();
1314         }
1315         xfree(remote_ipaddr);
1316 }
1317
1318 static void
1319 channel_set_reuseaddr(int fd)
1320 {
1321         int on = 1;
1322
1323         /*
1324          * Set socket options.
1325          * Allow local port reuse in TIME_WAIT.
1326          */
1327         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1)
1328                 error("setsockopt SO_REUSEADDR fd %d: %s", fd, strerror(errno));
1329 }
1330
1331 /*
1332  * This socket is listening for connections to a forwarded TCP/IP port.
1333  */
1334 /* ARGSUSED */
1335 static void
1336 channel_post_port_listener(Channel *c, fd_set *readset, fd_set *writeset)
1337 {
1338         Channel *nc;
1339         struct sockaddr addr;
1340         int newsock, nextstate;
1341         socklen_t addrlen;
1342         char *rtype;
1343
1344         if (FD_ISSET(c->sock, readset)) {
1345                 debug("Connection to port %d forwarding "
1346                     "to %.100s port %d requested.",
1347                     c->listening_port, c->path, c->host_port);
1348
1349                 if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
1350                         nextstate = SSH_CHANNEL_OPENING;
1351                         rtype = "forwarded-tcpip";
1352                 } else {
1353                         if (c->host_port == 0) {
1354                                 nextstate = SSH_CHANNEL_DYNAMIC;
1355                                 rtype = "dynamic-tcpip";
1356                         } else {
1357                                 nextstate = SSH_CHANNEL_OPENING;
1358                                 rtype = "direct-tcpip";
1359                         }
1360                 }
1361
1362                 addrlen = sizeof(addr);
1363                 newsock = accept(c->sock, &addr, &addrlen);
1364                 if (newsock < 0) {
1365                         error("accept: %.100s", strerror(errno));
1366                         return;
1367                 }
1368                 set_nodelay(newsock);
1369                 nc = channel_new(rtype, nextstate, newsock, newsock, -1,
1370                     c->local_window_max, c->local_maxpacket, 0, rtype, 1);
1371                 nc->listening_port = c->listening_port;
1372                 nc->host_port = c->host_port;
1373                 strlcpy(nc->path, c->path, sizeof(nc->path));
1374
1375                 if (nextstate == SSH_CHANNEL_DYNAMIC) {
1376                         /*
1377                          * do not call the channel_post handler until
1378                          * this flag has been reset by a pre-handler.
1379                          * otherwise the FD_ISSET calls might overflow
1380                          */
1381                         nc->delayed = 1;
1382                 } else {
1383                         port_open_helper(nc, rtype);
1384                 }
1385         }
1386 }
1387
1388 /*
1389  * This is the authentication agent socket listening for connections from
1390  * clients.
1391  */
1392 /* ARGSUSED */
1393 static void
1394 channel_post_auth_listener(Channel *c, fd_set *readset, fd_set *writeset)
1395 {
1396         Channel *nc;
1397         int newsock;
1398         struct sockaddr addr;
1399         socklen_t addrlen;
1400
1401         if (FD_ISSET(c->sock, readset)) {
1402                 addrlen = sizeof(addr);
1403                 newsock = accept(c->sock, &addr, &addrlen);
1404                 if (newsock < 0) {
1405                         error("accept from auth socket: %.100s", strerror(errno));
1406                         return;
1407                 }
1408                 nc = channel_new("accepted auth socket",
1409                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
1410                     c->local_window_max, c->local_maxpacket,
1411                     0, "accepted auth socket", 1);
1412                 if (compat20) {
1413                         packet_start(SSH2_MSG_CHANNEL_OPEN);
1414                         packet_put_cstring("auth-agent@openssh.com");
1415                         packet_put_int(nc->self);
1416                         packet_put_int(c->local_window_max);
1417                         packet_put_int(c->local_maxpacket);
1418                 } else {
1419                         packet_start(SSH_SMSG_AGENT_OPEN);
1420                         packet_put_int(nc->self);
1421                 }
1422                 packet_send();
1423         }
1424 }
1425
1426 /* ARGSUSED */
1427 static void
1428 channel_post_connecting(Channel *c, fd_set *readset, fd_set *writeset)
1429 {
1430         int err = 0, sock;
1431         socklen_t sz = sizeof(err);
1432
1433         if (FD_ISSET(c->sock, writeset)) {
1434                 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, &err, &sz) < 0) {
1435                         err = errno;
1436                         error("getsockopt SO_ERROR failed");
1437                 }
1438                 if (err == 0) {
1439                         debug("channel %d: connected to %s port %d",
1440                             c->self, c->connect_ctx.host, c->connect_ctx.port);
1441                         channel_connect_ctx_free(&c->connect_ctx);
1442                         c->type = SSH_CHANNEL_OPEN;
1443                         if (compat20) {
1444                                 packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
1445                                 packet_put_int(c->remote_id);
1446                                 packet_put_int(c->self);
1447                                 packet_put_int(c->local_window);
1448                                 packet_put_int(c->local_maxpacket);
1449                         } else {
1450                                 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1451                                 packet_put_int(c->remote_id);
1452                                 packet_put_int(c->self);
1453                         }
1454                 } else {
1455                         debug("channel %d: connection failed: %s",
1456                             c->self, strerror(err));
1457                         /* Try next address, if any */
1458                         if ((sock = connect_next(&c->connect_ctx)) > 0) {
1459                                 close(c->sock);
1460                                 c->sock = c->rfd = c->wfd = sock;
1461                                 channel_max_fd = channel_find_maxfd();
1462                                 return;
1463                         }
1464                         /* Exhausted all addresses */
1465                         error("connect_to %.100s port %d: failed.",
1466                             c->connect_ctx.host, c->connect_ctx.port);
1467                         channel_connect_ctx_free(&c->connect_ctx);
1468                         if (compat20) {
1469                                 packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE);
1470                                 packet_put_int(c->remote_id);
1471                                 packet_put_int(SSH2_OPEN_CONNECT_FAILED);
1472                                 if (!(datafellows & SSH_BUG_OPENFAILURE)) {
1473                                         packet_put_cstring(strerror(err));
1474                                         packet_put_cstring("");
1475                                 }
1476                         } else {
1477                                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1478                                 packet_put_int(c->remote_id);
1479                         }
1480                         chan_mark_dead(c);
1481                 }
1482                 packet_send();
1483         }
1484 }
1485
1486 /* ARGSUSED */
1487 static int
1488 channel_handle_rfd(Channel *c, fd_set *readset, fd_set *writeset)
1489 {
1490         char buf[CHAN_RBUF];
1491         int len, force;
1492
1493         force = c->isatty && c->detach_close && c->istate != CHAN_INPUT_CLOSED;
1494         if (c->rfd != -1 && (force || FD_ISSET(c->rfd, readset))) {
1495                 errno = 0;
1496                 len = read(c->rfd, buf, sizeof(buf));
1497                 if (len < 0 && (errno == EINTR || (errno == EAGAIN && !force)))
1498                         return 1;
1499 #ifndef PTY_ZEROREAD
1500                 if (len <= 0) {
1501 #else
1502                 if ((!c->isatty && len <= 0) ||
1503                     (c->isatty && (len < 0 || (len == 0 && errno != 0)))) {
1504 #endif
1505                         debug2("channel %d: read<=0 rfd %d len %d",
1506                             c->self, c->rfd, len);
1507                         if (c->type != SSH_CHANNEL_OPEN) {
1508                                 debug2("channel %d: not open", c->self);
1509                                 chan_mark_dead(c);
1510                                 return -1;
1511                         } else if (compat13) {
1512                                 buffer_clear(&c->output);
1513                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
1514                                 debug2("channel %d: input draining.", c->self);
1515                         } else {
1516                                 chan_read_failed(c);
1517                         }
1518                         return -1;
1519                 }
1520                 if (c->input_filter != NULL) {
1521                         if (c->input_filter(c, buf, len) == -1) {
1522                                 debug2("channel %d: filter stops", c->self);
1523                                 chan_read_failed(c);
1524                         }
1525                 } else if (c->datagram) {
1526                         buffer_put_string(&c->input, buf, len);
1527                 } else {
1528                         buffer_append(&c->input, buf, len);
1529                 }
1530         }
1531         return 1;
1532 }
1533
1534 /* ARGSUSED */
1535 static int
1536 channel_handle_wfd(Channel *c, fd_set *readset, fd_set *writeset)
1537 {
1538         struct termios tio;
1539         u_char *data = NULL, *buf;
1540         u_int dlen;
1541         int len;
1542
1543         /* Send buffered output data to the socket. */
1544         if (c->wfd != -1 &&
1545             FD_ISSET(c->wfd, writeset) &&
1546             buffer_len(&c->output) > 0) {
1547                 if (c->output_filter != NULL) {
1548                         if ((buf = c->output_filter(c, &data, &dlen)) == NULL) {
1549                                 debug2("channel %d: filter stops", c->self);
1550                                 if (c->type != SSH_CHANNEL_OPEN)
1551                                         chan_mark_dead(c);
1552                                 else
1553                                         chan_write_failed(c);
1554                                 return -1;
1555                         }
1556                 } else if (c->datagram) {
1557                         buf = data = buffer_get_string(&c->output, &dlen);
1558                 } else {
1559                         buf = data = buffer_ptr(&c->output);
1560                         dlen = buffer_len(&c->output);
1561                 }
1562
1563                 if (c->datagram) {
1564                         /* ignore truncated writes, datagrams might get lost */
1565                         c->local_consumed += dlen + 4;
1566                         len = write(c->wfd, buf, dlen);
1567                         xfree(data);
1568                         if (len < 0 && (errno == EINTR || errno == EAGAIN))
1569                                 return 1;
1570                         if (len <= 0) {
1571                                 if (c->type != SSH_CHANNEL_OPEN)
1572                                         chan_mark_dead(c);
1573                                 else
1574                                         chan_write_failed(c);
1575                                 return -1;
1576                         }
1577                         return 1;
1578                 }
1579 #ifdef _AIX
1580                 /* XXX: Later AIX versions can't push as much data to tty */
1581                 if (compat20 && c->wfd_isatty)
1582                         dlen = MIN(dlen, 8*1024);
1583 #endif
1584
1585                 len = write(c->wfd, buf, dlen);
1586                 if (len < 0 && (errno == EINTR || errno == EAGAIN))
1587                         return 1;
1588                 if (len <= 0) {
1589                         if (c->type != SSH_CHANNEL_OPEN) {
1590                                 debug2("channel %d: not open", c->self);
1591                                 chan_mark_dead(c);
1592                                 return -1;
1593                         } else if (compat13) {
1594                                 buffer_clear(&c->output);
1595                                 debug2("channel %d: input draining.", c->self);
1596                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
1597                         } else {
1598                                 chan_write_failed(c);
1599                         }
1600                         return -1;
1601                 }
1602                 if (compat20 && c->isatty && dlen >= 1 && buf[0] != '\r') {
1603                         if (tcgetattr(c->wfd, &tio) == 0 &&
1604                             !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
1605                                 /*
1606                                  * Simulate echo to reduce the impact of
1607                                  * traffic analysis. We need to match the
1608                                  * size of a SSH2_MSG_CHANNEL_DATA message
1609                                  * (4 byte channel id + buf)
1610                                  */
1611                                 packet_send_ignore(4 + len);
1612                                 packet_send();
1613                         }
1614                 }
1615                 buffer_consume(&c->output, len);
1616                 if (compat20 && len > 0) {
1617                         c->local_consumed += len;
1618                 }
1619         }
1620         return 1;
1621 }
1622
1623 static int
1624 channel_handle_efd(Channel *c, fd_set *readset, fd_set *writeset)
1625 {
1626         char buf[CHAN_RBUF];
1627         int len;
1628
1629 /** XXX handle drain efd, too */
1630         if (c->efd != -1) {
1631                 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
1632                     FD_ISSET(c->efd, writeset) &&
1633                     buffer_len(&c->extended) > 0) {
1634                         len = write(c->efd, buffer_ptr(&c->extended),
1635                             buffer_len(&c->extended));
1636                         debug2("channel %d: written %d to efd %d",
1637                             c->self, len, c->efd);
1638                         if (len < 0 && (errno == EINTR || errno == EAGAIN))
1639                                 return 1;
1640                         if (len <= 0) {
1641                                 debug2("channel %d: closing write-efd %d",
1642                                     c->self, c->efd);
1643                                 channel_close_fd(&c->efd);
1644                         } else {
1645                                 buffer_consume(&c->extended, len);
1646                                 c->local_consumed += len;
1647                         }
1648                 } else if (c->extended_usage == CHAN_EXTENDED_READ &&
1649                     (c->detach_close || FD_ISSET(c->efd, readset))) {
1650                         len = read(c->efd, buf, sizeof(buf));
1651                         debug2("channel %d: read %d from efd %d",
1652                             c->self, len, c->efd);
1653                         if (len < 0 && (errno == EINTR ||
1654                             (errno == EAGAIN && !c->detach_close)))
1655                                 return 1;
1656                         if (len <= 0) {
1657                                 debug2("channel %d: closing read-efd %d",
1658                                     c->self, c->efd);
1659                                 channel_close_fd(&c->efd);
1660                         } else {
1661                                 buffer_append(&c->extended, buf, len);
1662                         }
1663                 }
1664         }
1665         return 1;
1666 }
1667
1668 /* ARGSUSED */
1669 static int
1670 channel_handle_ctl(Channel *c, fd_set *readset, fd_set *writeset)
1671 {
1672         char buf[16];
1673         int len;
1674
1675         /* Monitor control fd to detect if the slave client exits */
1676         if (c->ctl_fd != -1 && FD_ISSET(c->ctl_fd, readset)) {
1677                 len = read(c->ctl_fd, buf, sizeof(buf));
1678                 if (len < 0 && (errno == EINTR || errno == EAGAIN))
1679                         return 1;
1680                 if (len <= 0) {
1681                         debug2("channel %d: ctl read<=0", c->self);
1682                         if (c->type != SSH_CHANNEL_OPEN) {
1683                                 debug2("channel %d: not open", c->self);
1684                                 chan_mark_dead(c);
1685                                 return -1;
1686                         } else {
1687                                 chan_read_failed(c);
1688                                 chan_write_failed(c);
1689                         }
1690                         return -1;
1691                 } else
1692                         fatal("%s: unexpected data on ctl fd", __func__);
1693         }
1694         return 1;
1695 }
1696
1697 static int
1698 channel_check_window(Channel *c)
1699 {
1700         if (c->type == SSH_CHANNEL_OPEN &&
1701             !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
1702             ((c->local_window_max - c->local_window >
1703             c->local_maxpacket*3) ||
1704             c->local_window < c->local_window_max/2) &&
1705             c->local_consumed > 0) {
1706                 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
1707                 packet_put_int(c->remote_id);
1708                 packet_put_int(c->local_consumed);
1709                 packet_send();
1710                 debug2("channel %d: window %d sent adjust %d",
1711                     c->self, c->local_window,
1712                     c->local_consumed);
1713                 c->local_window += c->local_consumed;
1714                 c->local_consumed = 0;
1715         }
1716         return 1;
1717 }
1718
1719 static void
1720 channel_post_open(Channel *c, fd_set *readset, fd_set *writeset)
1721 {
1722         if (c->delayed)
1723                 return;
1724         channel_handle_rfd(c, readset, writeset);
1725         channel_handle_wfd(c, readset, writeset);
1726         if (!compat20)
1727                 return;
1728         channel_handle_efd(c, readset, writeset);
1729         channel_handle_ctl(c, readset, writeset);
1730         channel_check_window(c);
1731 }
1732
1733 /* ARGSUSED */
1734 static void
1735 channel_post_output_drain_13(Channel *c, fd_set *readset, fd_set *writeset)
1736 {
1737         int len;
1738
1739         /* Send buffered output data to the socket. */
1740         if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
1741                 len = write(c->sock, buffer_ptr(&c->output),
1742                             buffer_len(&c->output));
1743                 if (len <= 0)
1744                         buffer_clear(&c->output);
1745                 else
1746                         buffer_consume(&c->output, len);
1747         }
1748 }
1749
1750 static void
1751 channel_handler_init_20(void)
1752 {
1753         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open;
1754         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open;
1755         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
1756         channel_pre[SSH_CHANNEL_RPORT_LISTENER] =       &channel_pre_listener;
1757         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
1758         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
1759         channel_pre[SSH_CHANNEL_CONNECTING] =           &channel_pre_connecting;
1760         channel_pre[SSH_CHANNEL_DYNAMIC] =              &channel_pre_dynamic;
1761
1762         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open;
1763         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
1764         channel_post[SSH_CHANNEL_RPORT_LISTENER] =      &channel_post_port_listener;
1765         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
1766         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
1767         channel_post[SSH_CHANNEL_CONNECTING] =          &channel_post_connecting;
1768         channel_post[SSH_CHANNEL_DYNAMIC] =             &channel_post_open;
1769 }
1770
1771 static void
1772 channel_handler_init_13(void)
1773 {
1774         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_13;
1775         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open_13;
1776         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
1777         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
1778         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
1779         channel_pre[SSH_CHANNEL_INPUT_DRAINING] =       &channel_pre_input_draining;
1780         channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] =      &channel_pre_output_draining;
1781         channel_pre[SSH_CHANNEL_CONNECTING] =           &channel_pre_connecting;
1782         channel_pre[SSH_CHANNEL_DYNAMIC] =              &channel_pre_dynamic;
1783
1784         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open;
1785         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
1786         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
1787         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
1788         channel_post[SSH_CHANNEL_OUTPUT_DRAINING] =     &channel_post_output_drain_13;
1789         channel_post[SSH_CHANNEL_CONNECTING] =          &channel_post_connecting;
1790         channel_post[SSH_CHANNEL_DYNAMIC] =             &channel_post_open;
1791 }
1792
1793 static void
1794 channel_handler_init_15(void)
1795 {
1796         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open;
1797         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open;
1798         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
1799         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
1800         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
1801         channel_pre[SSH_CHANNEL_CONNECTING] =           &channel_pre_connecting;
1802         channel_pre[SSH_CHANNEL_DYNAMIC] =              &channel_pre_dynamic;
1803
1804         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
1805         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
1806         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
1807         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open;
1808         channel_post[SSH_CHANNEL_CONNECTING] =          &channel_post_connecting;
1809         channel_post[SSH_CHANNEL_DYNAMIC] =             &channel_post_open;
1810 }
1811
1812 static void
1813 channel_handler_init(void)
1814 {
1815         int i;
1816
1817         for (i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
1818                 channel_pre[i] = NULL;
1819                 channel_post[i] = NULL;
1820         }
1821         if (compat20)
1822                 channel_handler_init_20();
1823         else if (compat13)
1824                 channel_handler_init_13();
1825         else
1826                 channel_handler_init_15();
1827 }
1828
1829 /* gc dead channels */
1830 static void
1831 channel_garbage_collect(Channel *c)
1832 {
1833         if (c == NULL)
1834                 return;
1835         if (c->detach_user != NULL) {
1836                 if (!chan_is_dead(c, c->detach_close))
1837                         return;
1838                 debug2("channel %d: gc: notify user", c->self);
1839                 c->detach_user(c->self, NULL);
1840                 /* if we still have a callback */
1841                 if (c->detach_user != NULL)
1842                         return;
1843                 debug2("channel %d: gc: user detached", c->self);
1844         }
1845         if (!chan_is_dead(c, 1))
1846                 return;
1847         debug2("channel %d: garbage collecting", c->self);
1848         channel_free(c);
1849 }
1850
1851 static void
1852 channel_handler(chan_fn *ftab[], fd_set *readset, fd_set *writeset)
1853 {
1854         static int did_init = 0;
1855         u_int i;
1856         Channel *c;
1857
1858         if (!did_init) {
1859                 channel_handler_init();
1860                 did_init = 1;
1861         }
1862         for (i = 0; i < channels_alloc; i++) {
1863                 c = channels[i];
1864                 if (c == NULL)
1865                         continue;
1866                 if (ftab[c->type] != NULL)
1867                         (*ftab[c->type])(c, readset, writeset);
1868                 channel_garbage_collect(c);
1869         }
1870 }
1871
1872 /*
1873  * Allocate/update select bitmasks and add any bits relevant to channels in
1874  * select bitmasks.
1875  */
1876 void
1877 channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp,
1878     u_int *nallocp, int rekeying)
1879 {
1880         u_int n, sz, nfdset;
1881
1882         n = MAX(*maxfdp, channel_max_fd);
1883
1884         nfdset = howmany(n+1, NFDBITS);
1885         /* Explicitly test here, because xrealloc isn't always called */
1886         if (nfdset && SIZE_T_MAX / nfdset < sizeof(fd_mask))
1887                 fatal("channel_prepare_select: max_fd (%d) is too large", n);
1888         sz = nfdset * sizeof(fd_mask);
1889
1890         /* perhaps check sz < nalloc/2 and shrink? */
1891         if (*readsetp == NULL || sz > *nallocp) {
1892                 *readsetp = xrealloc(*readsetp, nfdset, sizeof(fd_mask));
1893                 *writesetp = xrealloc(*writesetp, nfdset, sizeof(fd_mask));
1894                 *nallocp = sz;
1895         }
1896         *maxfdp = n;
1897         memset(*readsetp, 0, sz);
1898         memset(*writesetp, 0, sz);
1899
1900         if (!rekeying)
1901                 channel_handler(channel_pre, *readsetp, *writesetp);
1902 }
1903
1904 /*
1905  * After select, perform any appropriate operations for channels which have
1906  * events pending.
1907  */
1908 void
1909 channel_after_select(fd_set *readset, fd_set *writeset)
1910 {
1911         channel_handler(channel_post, readset, writeset);
1912 }
1913
1914
1915 /* If there is data to send to the connection, enqueue some of it now. */
1916 void
1917 channel_output_poll(void)
1918 {
1919         Channel *c;
1920         u_int i, len;
1921
1922         for (i = 0; i < channels_alloc; i++) {
1923                 c = channels[i];
1924                 if (c == NULL)
1925                         continue;
1926
1927                 /*
1928                  * We are only interested in channels that can have buffered
1929                  * incoming data.
1930                  */
1931                 if (compat13) {
1932                         if (c->type != SSH_CHANNEL_OPEN &&
1933                             c->type != SSH_CHANNEL_INPUT_DRAINING)
1934                                 continue;
1935                 } else {
1936                         if (c->type != SSH_CHANNEL_OPEN)
1937                                 continue;
1938                 }
1939                 if (compat20 &&
1940                     (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
1941                         /* XXX is this true? */
1942                         debug3("channel %d: will not send data after close", c->self);
1943                         continue;
1944                 }
1945
1946                 /* Get the amount of buffered data for this channel. */
1947                 if ((c->istate == CHAN_INPUT_OPEN ||
1948                     c->istate == CHAN_INPUT_WAIT_DRAIN) &&
1949                     (len = buffer_len(&c->input)) > 0) {
1950                         if (c->datagram) {
1951                                 if (len > 0) {
1952                                         u_char *data;
1953                                         u_int dlen;
1954
1955                                         data = buffer_get_string(&c->input,
1956                                             &dlen);
1957                                         packet_start(SSH2_MSG_CHANNEL_DATA);
1958                                         packet_put_int(c->remote_id);
1959                                         packet_put_string(data, dlen);
1960                                         packet_send();
1961                                         c->remote_window -= dlen + 4;
1962                                         xfree(data);
1963                                 }
1964                                 continue;
1965                         }
1966                         /*
1967                          * Send some data for the other side over the secure
1968                          * connection.
1969                          */
1970                         if (compat20) {
1971                                 if (len > c->remote_window)
1972                                         len = c->remote_window;
1973                                 if (len > c->remote_maxpacket)
1974                                         len = c->remote_maxpacket;
1975                         } else {
1976                                 if (packet_is_interactive()) {
1977                                         if (len > 1024)
1978                                                 len = 512;
1979                                 } else {
1980                                         /* Keep the packets at reasonable size. */
1981                                         if (len > packet_get_maxsize()/2)
1982                                                 len = packet_get_maxsize()/2;
1983                                 }
1984                         }
1985                         if (len > 0) {
1986                                 packet_start(compat20 ?
1987                                     SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
1988                                 packet_put_int(c->remote_id);
1989                                 packet_put_string(buffer_ptr(&c->input), len);
1990                                 packet_send();
1991                                 buffer_consume(&c->input, len);
1992                                 c->remote_window -= len;
1993                         }
1994                 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
1995                         if (compat13)
1996                                 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
1997                         /*
1998                          * input-buffer is empty and read-socket shutdown:
1999                          * tell peer, that we will not send more data: send IEOF.
2000                          * hack for extended data: delay EOF if EFD still in use.
2001                          */
2002                         if (CHANNEL_EFD_INPUT_ACTIVE(c))
2003                                 debug2("channel %d: ibuf_empty delayed efd %d/(%d)",
2004                                     c->self, c->efd, buffer_len(&c->extended));
2005                         else
2006                                 chan_ibuf_empty(c);
2007                 }
2008                 /* Send extended data, i.e. stderr */
2009                 if (compat20 &&
2010                     !(c->flags & CHAN_EOF_SENT) &&
2011                     c->remote_window > 0 &&
2012                     (len = buffer_len(&c->extended)) > 0 &&
2013                     c->extended_usage == CHAN_EXTENDED_READ) {
2014                         debug2("channel %d: rwin %u elen %u euse %d",
2015                             c->self, c->remote_window, buffer_len(&c->extended),
2016                             c->extended_usage);
2017                         if (len > c->remote_window)
2018                                 len = c->remote_window;
2019                         if (len > c->remote_maxpacket)
2020                                 len = c->remote_maxpacket;
2021                         packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
2022                         packet_put_int(c->remote_id);
2023                         packet_put_int(SSH2_EXTENDED_DATA_STDERR);
2024                         packet_put_string(buffer_ptr(&c->extended), len);
2025                         packet_send();
2026                         buffer_consume(&c->extended, len);
2027                         c->remote_window -= len;
2028                         debug2("channel %d: sent ext data %d", c->self, len);
2029                 }
2030         }
2031 }
2032
2033
2034 /* -- protocol input */
2035
2036 /* ARGSUSED */
2037 void
2038 channel_input_data(int type, u_int32_t seq, void *ctxt)
2039 {
2040         int id;
2041         char *data;
2042         u_int data_len;
2043         Channel *c;
2044
2045         /* Get the channel number and verify it. */
2046         id = packet_get_int();
2047         c = channel_lookup(id);
2048         if (c == NULL)
2049                 packet_disconnect("Received data for nonexistent channel %d.", id);
2050
2051         /* Ignore any data for non-open channels (might happen on close) */
2052         if (c->type != SSH_CHANNEL_OPEN &&
2053             c->type != SSH_CHANNEL_X11_OPEN)
2054                 return;
2055
2056         /* Get the data. */
2057         data = packet_get_string_ptr(&data_len);
2058
2059         /*
2060          * Ignore data for protocol > 1.3 if output end is no longer open.
2061          * For protocol 2 the sending side is reducing its window as it sends
2062          * data, so we must 'fake' consumption of the data in order to ensure
2063          * that window updates are sent back.  Otherwise the connection might
2064          * deadlock.
2065          */
2066         if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN) {
2067                 if (compat20) {
2068                         c->local_window -= data_len;
2069                         c->local_consumed += data_len;
2070                 }
2071                 return;
2072         }
2073
2074         if (compat20) {
2075                 if (data_len > c->local_maxpacket) {
2076                         logit("channel %d: rcvd big packet %d, maxpack %d",
2077                             c->self, data_len, c->local_maxpacket);
2078                 }
2079                 if (data_len > c->local_window) {
2080                         logit("channel %d: rcvd too much data %d, win %d",
2081                             c->self, data_len, c->local_window);
2082                         return;
2083                 }
2084                 c->local_window -= data_len;
2085         }
2086         if (c->datagram)
2087                 buffer_put_string(&c->output, data, data_len);
2088         else
2089                 buffer_append(&c->output, data, data_len);
2090         packet_check_eom();
2091 }
2092
2093 /* ARGSUSED */
2094 void
2095 channel_input_extended_data(int type, u_int32_t seq, void *ctxt)
2096 {
2097         int id;
2098         char *data;
2099         u_int data_len, tcode;
2100         Channel *c;
2101
2102         /* Get the channel number and verify it. */
2103         id = packet_get_int();
2104         c = channel_lookup(id);
2105
2106         if (c == NULL)
2107                 packet_disconnect("Received extended_data for bad channel %d.", id);
2108         if (c->type != SSH_CHANNEL_OPEN) {
2109                 logit("channel %d: ext data for non open", id);
2110                 return;
2111         }
2112         if (c->flags & CHAN_EOF_RCVD) {
2113                 if (datafellows & SSH_BUG_EXTEOF)
2114                         debug("channel %d: accepting ext data after eof", id);
2115                 else
2116                         packet_disconnect("Received extended_data after EOF "
2117                             "on channel %d.", id);
2118         }
2119         tcode = packet_get_int();
2120         if (c->efd == -1 ||
2121             c->extended_usage != CHAN_EXTENDED_WRITE ||
2122             tcode != SSH2_EXTENDED_DATA_STDERR) {
2123                 logit("channel %d: bad ext data", c->self);
2124                 return;
2125         }
2126         data = packet_get_string(&data_len);
2127         packet_check_eom();
2128         if (data_len > c->local_window) {
2129                 logit("channel %d: rcvd too much extended_data %d, win %d",
2130                     c->self, data_len, c->local_window);
2131                 xfree(data);
2132                 return;
2133         }
2134         debug2("channel %d: rcvd ext data %d", c->self, data_len);
2135         c->local_window -= data_len;
2136         buffer_append(&c->extended, data, data_len);
2137         xfree(data);
2138 }
2139
2140 /* ARGSUSED */
2141 void
2142 channel_input_ieof(int type, u_int32_t seq, void *ctxt)
2143 {
2144         int id;
2145         Channel *c;
2146
2147         id = packet_get_int();
2148         packet_check_eom();
2149         c = channel_lookup(id);
2150         if (c == NULL)
2151                 packet_disconnect("Received ieof for nonexistent channel %d.", id);
2152         chan_rcvd_ieof(c);
2153
2154         /* XXX force input close */
2155         if (c->force_drain && c->istate == CHAN_INPUT_OPEN) {
2156                 debug("channel %d: FORCE input drain", c->self);
2157                 c->istate = CHAN_INPUT_WAIT_DRAIN;
2158                 if (buffer_len(&c->input) == 0)
2159                         chan_ibuf_empty(c);
2160         }
2161
2162 }
2163
2164 /* ARGSUSED */
2165 void
2166 channel_input_close(int type, u_int32_t seq, void *ctxt)
2167 {
2168         int id;
2169         Channel *c;
2170
2171         id = packet_get_int();
2172         packet_check_eom();
2173         c = channel_lookup(id);
2174         if (c == NULL)
2175                 packet_disconnect("Received close for nonexistent channel %d.", id);
2176
2177         /*
2178          * Send a confirmation that we have closed the channel and no more
2179          * data is coming for it.
2180          */
2181         packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
2182         packet_put_int(c->remote_id);
2183         packet_send();
2184
2185         /*
2186          * If the channel is in closed state, we have sent a close request,
2187          * and the other side will eventually respond with a confirmation.
2188          * Thus, we cannot free the channel here, because then there would be
2189          * no-one to receive the confirmation.  The channel gets freed when
2190          * the confirmation arrives.
2191          */
2192         if (c->type != SSH_CHANNEL_CLOSED) {
2193                 /*
2194                  * Not a closed channel - mark it as draining, which will
2195                  * cause it to be freed later.
2196                  */
2197                 buffer_clear(&c->input);
2198                 c->type = SSH_CHANNEL_OUTPUT_DRAINING;
2199         }
2200 }
2201
2202 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
2203 /* ARGSUSED */
2204 void
2205 channel_input_oclose(int type, u_int32_t seq, void *ctxt)
2206 {
2207         int id = packet_get_int();
2208         Channel *c = channel_lookup(id);
2209
2210         packet_check_eom();
2211         if (c == NULL)
2212                 packet_disconnect("Received oclose for nonexistent channel %d.", id);
2213         chan_rcvd_oclose(c);
2214 }
2215
2216 /* ARGSUSED */
2217 void
2218 channel_input_close_confirmation(int type, u_int32_t seq, void *ctxt)
2219 {
2220         int id = packet_get_int();
2221         Channel *c = channel_lookup(id);
2222
2223         packet_check_eom();
2224         if (c == NULL)
2225                 packet_disconnect("Received close confirmation for "
2226                     "out-of-range channel %d.", id);
2227         if (c->type != SSH_CHANNEL_CLOSED)
2228                 packet_disconnect("Received close confirmation for "
2229                     "non-closed channel %d (type %d).", id, c->type);
2230         channel_free(c);
2231 }
2232
2233 /* ARGSUSED */
2234 void
2235 channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt)
2236 {
2237         int id, remote_id;
2238         Channel *c;
2239
2240         id = packet_get_int();
2241         c = channel_lookup(id);
2242
2243         if (c==NULL || c->type != SSH_CHANNEL_OPENING)
2244                 packet_disconnect("Received open confirmation for "
2245                     "non-opening channel %d.", id);
2246         remote_id = packet_get_int();
2247         /* Record the remote channel number and mark that the channel is now open. */
2248         c->remote_id = remote_id;
2249         c->type = SSH_CHANNEL_OPEN;
2250
2251         if (compat20) {
2252                 c->remote_window = packet_get_int();
2253                 c->remote_maxpacket = packet_get_int();
2254                 if (c->open_confirm) {
2255                         debug2("callback start");
2256                         c->open_confirm(c->self, c->open_confirm_ctx);
2257                         debug2("callback done");
2258                 }
2259                 debug2("channel %d: open confirm rwindow %u rmax %u", c->self,
2260                     c->remote_window, c->remote_maxpacket);
2261         }
2262         packet_check_eom();
2263 }
2264
2265 static char *
2266 reason2txt(int reason)
2267 {
2268         switch (reason) {
2269         case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED:
2270                 return "administratively prohibited";
2271         case SSH2_OPEN_CONNECT_FAILED:
2272                 return "connect failed";
2273         case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE:
2274                 return "unknown channel type";
2275         case SSH2_OPEN_RESOURCE_SHORTAGE:
2276                 return "resource shortage";
2277         }
2278         return "unknown reason";
2279 }
2280
2281 /* ARGSUSED */
2282 void
2283 channel_input_open_failure(int type, u_int32_t seq, void *ctxt)
2284 {
2285         int id, reason;
2286         char *msg = NULL, *lang = NULL;
2287         Channel *c;
2288
2289         id = packet_get_int();
2290         c = channel_lookup(id);
2291
2292         if (c==NULL || c->type != SSH_CHANNEL_OPENING)
2293                 packet_disconnect("Received open failure for "
2294                     "non-opening channel %d.", id);
2295         if (compat20) {
2296                 reason = packet_get_int();
2297                 if (!(datafellows & SSH_BUG_OPENFAILURE)) {
2298                         msg  = packet_get_string(NULL);
2299                         lang = packet_get_string(NULL);
2300                 }
2301                 logit("channel %d: open failed: %s%s%s", id,
2302                     reason2txt(reason), msg ? ": ": "", msg ? msg : "");
2303                 if (msg != NULL)
2304                         xfree(msg);
2305                 if (lang != NULL)
2306                         xfree(lang);
2307         }
2308         packet_check_eom();
2309         /* Free the channel.  This will also close the socket. */
2310         channel_free(c);
2311 }
2312
2313 /* ARGSUSED */
2314 void
2315 channel_input_window_adjust(int type, u_int32_t seq, void *ctxt)
2316 {
2317         Channel *c;
2318         int id;
2319         u_int adjust;
2320
2321         if (!compat20)
2322                 return;
2323
2324         /* Get the channel number and verify it. */
2325         id = packet_get_int();
2326         c = channel_lookup(id);
2327
2328         if (c == NULL) {
2329                 logit("Received window adjust for non-open channel %d.", id);
2330                 return;
2331         }
2332         adjust = packet_get_int();
2333         packet_check_eom();
2334         debug2("channel %d: rcvd adjust %u", id, adjust);
2335         c->remote_window += adjust;
2336 }
2337
2338 /* ARGSUSED */
2339 void
2340 channel_input_port_open(int type, u_int32_t seq, void *ctxt)
2341 {
2342         Channel *c = NULL;
2343         u_short host_port;
2344         char *host, *originator_string;
2345         int remote_id;
2346
2347         remote_id = packet_get_int();
2348         host = packet_get_string(NULL);
2349         host_port = packet_get_int();
2350
2351         if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {
2352                 originator_string = packet_get_string(NULL);
2353         } else {
2354                 originator_string = xstrdup("unknown (remote did not supply name)");
2355         }
2356         packet_check_eom();
2357         c = channel_connect_to(host, host_port,
2358             "connected socket", originator_string);
2359         xfree(originator_string);
2360         xfree(host);
2361         if (c == NULL) {
2362                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2363                 packet_put_int(remote_id);
2364                 packet_send();
2365         } else
2366                 c->remote_id = remote_id;
2367 }
2368
2369 /* ARGSUSED */
2370 void
2371 channel_input_status_confirm(int type, u_int32_t seq, void *ctxt)
2372 {
2373         Channel *c;
2374         struct channel_confirm *cc;
2375         int remote_id;
2376
2377         /* Reset keepalive timeout */
2378         keep_alive_timeouts = 0;
2379
2380         remote_id = packet_get_int();
2381         packet_check_eom();
2382
2383         debug2("channel_input_confirm: type %d id %d", type, remote_id);
2384
2385         if ((c = channel_lookup(remote_id)) == NULL) {
2386                 logit("channel_input_success_failure: %d: unknown", remote_id);
2387                 return;
2388         }       
2389         ;
2390         if ((cc = TAILQ_FIRST(&c->status_confirms)) == NULL)
2391                 return;
2392         cc->cb(type, c, cc->ctx);
2393         TAILQ_REMOVE(&c->status_confirms, cc, entry);
2394         bzero(cc, sizeof(*cc));
2395         xfree(cc);
2396 }
2397
2398 /* -- tcp forwarding */
2399
2400 void
2401 channel_set_af(int af)
2402 {
2403         IPv4or6 = af;
2404 }
2405
2406 static int
2407 channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_port,
2408     const char *host_to_connect, u_short port_to_connect, int gateway_ports)
2409 {
2410         Channel *c;
2411         int sock, r, success = 0, wildcard = 0, is_client;
2412         struct addrinfo hints, *ai, *aitop;
2413         const char *host, *addr;
2414         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
2415
2416         host = (type == SSH_CHANNEL_RPORT_LISTENER) ?
2417             listen_addr : host_to_connect;
2418         is_client = (type == SSH_CHANNEL_PORT_LISTENER);
2419
2420         if (host == NULL) {
2421                 error("No forward host name.");
2422                 return 0;
2423         }
2424         if (strlen(host) > SSH_CHANNEL_PATH_LEN - 1) {
2425                 error("Forward host name too long.");
2426                 return 0;
2427         }
2428
2429         /*
2430          * Determine whether or not a port forward listens to loopback,
2431          * specified address or wildcard. On the client, a specified bind
2432          * address will always override gateway_ports. On the server, a
2433          * gateway_ports of 1 (``yes'') will override the client's
2434          * specification and force a wildcard bind, whereas a value of 2
2435          * (``clientspecified'') will bind to whatever address the client
2436          * asked for.
2437          *
2438          * Special-case listen_addrs are:
2439          *
2440          * "0.0.0.0"               -> wildcard v4/v6 if SSH_OLD_FORWARD_ADDR
2441          * "" (empty string), "*"  -> wildcard v4/v6
2442          * "localhost"             -> loopback v4/v6
2443          */
2444         addr = NULL;
2445         if (listen_addr == NULL) {
2446                 /* No address specified: default to gateway_ports setting */
2447                 if (gateway_ports)
2448                         wildcard = 1;
2449         } else if (gateway_ports || is_client) {
2450                 if (((datafellows & SSH_OLD_FORWARD_ADDR) &&
2451                     strcmp(listen_addr, "0.0.0.0") == 0 && is_client == 0) ||
2452                     *listen_addr == '\0' || strcmp(listen_addr, "*") == 0 ||
2453                     (!is_client && gateway_ports == 1))
2454                         wildcard = 1;
2455                 else if (strcmp(listen_addr, "localhost") != 0)
2456                         addr = listen_addr;
2457         }
2458
2459         debug3("channel_setup_fwd_listener: type %d wildcard %d addr %s",
2460             type, wildcard, (addr == NULL) ? "NULL" : addr);
2461
2462         /*
2463          * getaddrinfo returns a loopback address if the hostname is
2464          * set to NULL and hints.ai_flags is not AI_PASSIVE
2465          */
2466         memset(&hints, 0, sizeof(hints));
2467         hints.ai_family = IPv4or6;
2468         hints.ai_flags = wildcard ? AI_PASSIVE : 0;
2469         hints.ai_socktype = SOCK_STREAM;
2470         snprintf(strport, sizeof strport, "%d", listen_port);
2471         if ((r = getaddrinfo(addr, strport, &hints, &aitop)) != 0) {
2472                 if (addr == NULL) {
2473                         /* This really shouldn't happen */
2474                         packet_disconnect("getaddrinfo: fatal error: %s",
2475                             ssh_gai_strerror(r));
2476                 } else {
2477                         error("channel_setup_fwd_listener: "
2478                             "getaddrinfo(%.64s): %s", addr,
2479                             ssh_gai_strerror(r));
2480                 }
2481                 return 0;
2482         }
2483
2484         for (ai = aitop; ai; ai = ai->ai_next) {
2485                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
2486                         continue;
2487                 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
2488                     strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
2489                         error("channel_setup_fwd_listener: getnameinfo failed");
2490                         continue;
2491                 }
2492                 /* Create a port to listen for the host. */
2493                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
2494                 if (sock < 0) {
2495                         /* this is no error since kernel may not support ipv6 */
2496                         verbose("socket: %.100s", strerror(errno));
2497                         continue;
2498                 }
2499
2500                 channel_set_reuseaddr(sock);
2501
2502                 debug("Local forwarding listening on %s port %s.", ntop, strport);
2503
2504                 /* Bind the socket to the address. */
2505                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2506                         /* address can be in use ipv6 address is already bound */
2507                         if (!ai->ai_next)
2508                                 error("bind: %.100s", strerror(errno));
2509                         else
2510                                 verbose("bind: %.100s", strerror(errno));
2511
2512                         close(sock);
2513                         continue;
2514                 }
2515                 /* Start listening for connections on the socket. */
2516                 if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
2517                         error("listen: %.100s", strerror(errno));
2518                         close(sock);
2519                         continue;
2520                 }
2521                 /* Allocate a channel number for the socket. */
2522                 c = channel_new("port listener", type, sock, sock, -1,
2523                     CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
2524                     0, "port listener", 1);
2525                 strlcpy(c->path, host, sizeof(c->path));
2526                 c->host_port = port_to_connect;
2527                 c->listening_port = listen_port;
2528                 success = 1;
2529         }
2530         if (success == 0)
2531                 error("channel_setup_fwd_listener: cannot listen to port: %d",
2532                     listen_port);
2533         freeaddrinfo(aitop);
2534         return success;
2535 }
2536
2537 int
2538 channel_cancel_rport_listener(const char *host, u_short port)
2539 {
2540         u_int i;
2541         int found = 0;
2542
2543         for (i = 0; i < channels_alloc; i++) {
2544                 Channel *c = channels[i];
2545
2546                 if (c != NULL && c->type == SSH_CHANNEL_RPORT_LISTENER &&
2547                     strncmp(c->path, host, sizeof(c->path)) == 0 &&
2548                     c->listening_port == port) {
2549                         debug2("%s: close channel %d", __func__, i);
2550                         channel_free(c);
2551                         found = 1;
2552                 }
2553         }
2554
2555         return (found);
2556 }
2557
2558 /* protocol local port fwd, used by ssh (and sshd in v1) */
2559 int
2560 channel_setup_local_fwd_listener(const char *listen_host, u_short listen_port,
2561     const char *host_to_connect, u_short port_to_connect, int gateway_ports)
2562 {
2563         return channel_setup_fwd_listener(SSH_CHANNEL_PORT_LISTENER,
2564             listen_host, listen_port, host_to_connect, port_to_connect,
2565             gateway_ports);
2566 }
2567
2568 /* protocol v2 remote port fwd, used by sshd */
2569 int
2570 channel_setup_remote_fwd_listener(const char *listen_address,
2571     u_short listen_port, int gateway_ports)
2572 {
2573         return channel_setup_fwd_listener(SSH_CHANNEL_RPORT_LISTENER,
2574             listen_address, listen_port, NULL, 0, gateway_ports);
2575 }
2576
2577 /*
2578  * Initiate forwarding of connections to port "port" on remote host through
2579  * the secure channel to host:port from local side.
2580  */
2581
2582 int
2583 channel_request_remote_forwarding(const char *listen_host, u_short listen_port,
2584     const char *host_to_connect, u_short port_to_connect)
2585 {
2586         int type, success = 0;
2587
2588         /* Record locally that connection to this host/port is permitted. */
2589         if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
2590                 fatal("channel_request_remote_forwarding: too many forwards");
2591
2592         /* Send the forward request to the remote side. */
2593         if (compat20) {
2594                 const char *address_to_bind;
2595                 if (listen_host == NULL) {
2596                         if (datafellows & SSH_BUG_RFWD_ADDR)
2597                                 address_to_bind = "127.0.0.1";
2598                         else
2599                                 address_to_bind = "localhost";
2600                 } else if (*listen_host == '\0' ||
2601                            strcmp(listen_host, "*") == 0) {
2602                         if (datafellows & SSH_BUG_RFWD_ADDR)
2603                                 address_to_bind = "0.0.0.0";
2604                         else
2605                                 address_to_bind = "";
2606                 } else
2607                         address_to_bind = listen_host;
2608
2609                 packet_start(SSH2_MSG_GLOBAL_REQUEST);
2610                 packet_put_cstring("tcpip-forward");
2611                 packet_put_char(1);                     /* boolean: want reply */
2612                 packet_put_cstring(address_to_bind);
2613                 packet_put_int(listen_port);
2614                 packet_send();
2615                 packet_write_wait();
2616                 /* Assume that server accepts the request */
2617                 success = 1;
2618         } else {
2619                 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
2620                 packet_put_int(listen_port);
2621                 packet_put_cstring(host_to_connect);
2622                 packet_put_int(port_to_connect);
2623                 packet_send();
2624                 packet_write_wait();
2625
2626                 /* Wait for response from the remote side. */
2627                 type = packet_read();
2628                 switch (type) {
2629                 case SSH_SMSG_SUCCESS:
2630                         success = 1;
2631                         break;
2632                 case SSH_SMSG_FAILURE:
2633                         break;
2634                 default:
2635                         /* Unknown packet */
2636                         packet_disconnect("Protocol error for port forward request:"
2637                             "received packet type %d.", type);
2638                 }
2639         }
2640         if (success) {
2641                 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
2642                 permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
2643                 permitted_opens[num_permitted_opens].listen_port = listen_port;
2644                 num_permitted_opens++;
2645         }
2646         return (success ? 0 : -1);
2647 }
2648
2649 /*
2650  * Request cancellation of remote forwarding of connection host:port from
2651  * local side.
2652  */
2653 void
2654 channel_request_rforward_cancel(const char *host, u_short port)
2655 {
2656         int i;
2657
2658         if (!compat20)
2659                 return;
2660
2661         for (i = 0; i < num_permitted_opens; i++) {
2662                 if (permitted_opens[i].host_to_connect != NULL &&
2663                     permitted_opens[i].listen_port == port)
2664                         break;
2665         }
2666         if (i >= num_permitted_opens) {
2667                 debug("%s: requested forward not found", __func__);
2668                 return;
2669         }
2670         packet_start(SSH2_MSG_GLOBAL_REQUEST);
2671         packet_put_cstring("cancel-tcpip-forward");
2672         packet_put_char(0);
2673         packet_put_cstring(host == NULL ? "" : host);
2674         packet_put_int(port);
2675         packet_send();
2676
2677         permitted_opens[i].listen_port = 0;
2678         permitted_opens[i].port_to_connect = 0;
2679         xfree(permitted_opens[i].host_to_connect);
2680         permitted_opens[i].host_to_connect = NULL;
2681 }
2682
2683 /*
2684  * This is called after receiving CHANNEL_FORWARDING_REQUEST.  This initates
2685  * listening for the port, and sends back a success reply (or disconnect
2686  * message if there was an error).
2687  */
2688 int
2689 channel_input_port_forward_request(int is_root, int gateway_ports)
2690 {
2691         u_short port, host_port;
2692         int success = 0;
2693         char *hostname;
2694
2695         /* Get arguments from the packet. */
2696         port = packet_get_int();
2697         hostname = packet_get_string(NULL);
2698         host_port = packet_get_int();
2699
2700 #ifndef HAVE_CYGWIN
2701         /*
2702          * Check that an unprivileged user is not trying to forward a
2703          * privileged port.
2704          */
2705         if (port < IPPORT_RESERVED && !is_root)
2706                 packet_disconnect(
2707                     "Requested forwarding of port %d but user is not root.",
2708                     port);
2709         if (host_port == 0)
2710                 packet_disconnect("Dynamic forwarding denied.");
2711 #endif
2712
2713         /* Initiate forwarding */
2714         success = channel_setup_local_fwd_listener(NULL, port, hostname,
2715             host_port, gateway_ports);
2716
2717         /* Free the argument string. */
2718         xfree(hostname);
2719
2720         return (success ? 0 : -1);
2721 }
2722
2723 /*
2724  * Permits opening to any host/port if permitted_opens[] is empty.  This is
2725  * usually called by the server, because the user could connect to any port
2726  * anyway, and the server has no way to know but to trust the client anyway.
2727  */
2728 void
2729 channel_permit_all_opens(void)
2730 {
2731         if (num_permitted_opens == 0)
2732                 all_opens_permitted = 1;
2733 }
2734
2735 void
2736 channel_add_permitted_opens(char *host, int port)
2737 {
2738         if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
2739                 fatal("channel_add_permitted_opens: too many forwards");
2740         debug("allow port forwarding to host %s port %d", host, port);
2741
2742         permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host);
2743         permitted_opens[num_permitted_opens].port_to_connect = port;
2744         num_permitted_opens++;
2745
2746         all_opens_permitted = 0;
2747 }
2748
2749 int
2750 channel_add_adm_permitted_opens(char *host, int port)
2751 {
2752         if (num_adm_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
2753                 fatal("channel_add_adm_permitted_opens: too many forwards");
2754         debug("config allows port forwarding to host %s port %d", host, port);
2755
2756         permitted_adm_opens[num_adm_permitted_opens].host_to_connect
2757              = xstrdup(host);
2758         permitted_adm_opens[num_adm_permitted_opens].port_to_connect = port;
2759         return ++num_adm_permitted_opens;
2760 }
2761
2762 void
2763 channel_clear_permitted_opens(void)
2764 {
2765         int i;
2766
2767         for (i = 0; i < num_permitted_opens; i++)
2768                 if (permitted_opens[i].host_to_connect != NULL)
2769                         xfree(permitted_opens[i].host_to_connect);
2770         num_permitted_opens = 0;
2771 }
2772
2773 void
2774 channel_clear_adm_permitted_opens(void)
2775 {
2776         int i;
2777
2778         for (i = 0; i < num_adm_permitted_opens; i++)
2779                 if (permitted_adm_opens[i].host_to_connect != NULL)
2780                         xfree(permitted_adm_opens[i].host_to_connect);
2781         num_adm_permitted_opens = 0;
2782 }
2783
2784 void
2785 channel_print_adm_permitted_opens(void)
2786 {
2787         static int i;
2788
2789         for (i = 0; i < num_adm_permitted_opens; i++)
2790                 if (permitted_adm_opens[i].host_to_connect != NULL)
2791                         printf(" %s:%d", permitted_adm_opens[i].host_to_connect,
2792                             permitted_adm_opens[i].port_to_connect);
2793 }
2794
2795 /* Try to start non-blocking connect to next host in cctx list */
2796 static int
2797 connect_next(struct channel_connect *cctx)
2798 {
2799         int sock, saved_errno;
2800         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
2801
2802         for (; cctx->ai; cctx->ai = cctx->ai->ai_next) {
2803                 if (cctx->ai->ai_family != AF_INET &&
2804                     cctx->ai->ai_family != AF_INET6)
2805                         continue;
2806                 if (getnameinfo(cctx->ai->ai_addr, cctx->ai->ai_addrlen,
2807                     ntop, sizeof(ntop), strport, sizeof(strport),
2808                     NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
2809                         error("connect_next: getnameinfo failed");
2810                         continue;
2811                 }
2812                 if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype,
2813                     cctx->ai->ai_protocol)) == -1) {
2814                         if (cctx->ai->ai_next == NULL)
2815                                 error("socket: %.100s", strerror(errno));
2816                         else
2817                                 verbose("socket: %.100s", strerror(errno));
2818                         continue;
2819                 }
2820                 if (set_nonblock(sock) == -1)
2821                         fatal("%s: set_nonblock(%d)", __func__, sock);
2822                 if (connect(sock, cctx->ai->ai_addr,
2823                     cctx->ai->ai_addrlen) == -1 && errno != EINPROGRESS) {
2824                         debug("connect_next: host %.100s ([%.100s]:%s): "
2825                             "%.100s", cctx->host, ntop, strport,
2826                             strerror(errno));
2827                         saved_errno = errno;
2828                         close(sock);
2829                         errno = saved_errno;
2830                         continue;       /* fail -- try next */
2831                 }
2832                 debug("connect_next: host %.100s ([%.100s]:%s) "
2833                     "in progress, fd=%d", cctx->host, ntop, strport, sock);
2834                 cctx->ai = cctx->ai->ai_next;
2835                 set_nodelay(sock);
2836                 return sock;
2837         }
2838         return -1;
2839 }
2840
2841 static void
2842 channel_connect_ctx_free(struct channel_connect *cctx)
2843 {
2844         xfree(cctx->host);
2845         if (cctx->aitop)
2846                 freeaddrinfo(cctx->aitop);
2847         bzero(cctx, sizeof(*cctx));
2848         cctx->host = NULL;
2849         cctx->ai = cctx->aitop = NULL;
2850 }
2851
2852 /* Return CONNECTING channel to remote host, port */
2853 static Channel *
2854 connect_to(const char *host, u_short port, char *ctype, char *rname)
2855 {
2856         struct addrinfo hints;
2857         int gaierr;
2858         int sock = -1;
2859         char strport[NI_MAXSERV];
2860         struct channel_connect cctx;
2861         Channel *c;
2862
2863         memset(&hints, 0, sizeof(hints));
2864         hints.ai_family = IPv4or6;
2865         hints.ai_socktype = SOCK_STREAM;
2866         snprintf(strport, sizeof strport, "%d", port);
2867         if ((gaierr = getaddrinfo(host, strport, &hints, &cctx.aitop)) != 0) {
2868                 error("connect_to %.100s: unknown host (%s)", host,
2869                     ssh_gai_strerror(gaierr));
2870                 return NULL;
2871         }
2872
2873         cctx.host = xstrdup(host);
2874         cctx.port = port;
2875         cctx.ai = cctx.aitop;
2876
2877         if ((sock = connect_next(&cctx)) == -1) {
2878                 error("connect to %.100s port %d failed: %s",
2879                     host, port, strerror(errno));
2880                 channel_connect_ctx_free(&cctx);
2881                 return NULL;
2882         }
2883         c = channel_new(ctype, SSH_CHANNEL_CONNECTING, sock, sock, -1,
2884             CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, rname, 1);
2885         c->connect_ctx = cctx;
2886         return c;
2887 }
2888
2889 Channel *
2890 channel_connect_by_listen_address(u_short listen_port, char *ctype, char *rname)
2891 {
2892         int i;
2893
2894         for (i = 0; i < num_permitted_opens; i++) {
2895                 if (permitted_opens[i].host_to_connect != NULL &&
2896                     permitted_opens[i].listen_port == listen_port) {
2897                         return connect_to(
2898                             permitted_opens[i].host_to_connect,
2899                             permitted_opens[i].port_to_connect, ctype, rname);
2900                 }
2901         }
2902         error("WARNING: Server requests forwarding for unknown listen_port %d",
2903             listen_port);
2904         return NULL;
2905 }
2906
2907 /* Check if connecting to that port is permitted and connect. */
2908 Channel *
2909 channel_connect_to(const char *host, u_short port, char *ctype, char *rname)
2910 {
2911         int i, permit, permit_adm = 1;
2912
2913         permit = all_opens_permitted;
2914         if (!permit) {
2915                 for (i = 0; i < num_permitted_opens; i++)
2916                         if (permitted_opens[i].host_to_connect != NULL &&
2917                             permitted_opens[i].port_to_connect == port &&
2918                             strcmp(permitted_opens[i].host_to_connect, host) == 0)
2919                                 permit = 1;
2920         }
2921
2922         if (num_adm_permitted_opens > 0) {
2923                 permit_adm = 0;
2924                 for (i = 0; i < num_adm_permitted_opens; i++)
2925                         if (permitted_adm_opens[i].host_to_connect != NULL &&
2926                             permitted_adm_opens[i].port_to_connect == port &&
2927                             strcmp(permitted_adm_opens[i].host_to_connect, host)
2928                             == 0)
2929                                 permit_adm = 1;
2930         }
2931
2932         if (!permit || !permit_adm) {
2933                 logit("Received request to connect to host %.100s port %d, "
2934                     "but the request was denied.", host, port);
2935                 return NULL;
2936         }
2937         return connect_to(host, port, ctype, rname);
2938 }
2939
2940 void
2941 channel_send_window_changes(void)
2942 {
2943         u_int i;
2944         struct winsize ws;
2945
2946         for (i = 0; i < channels_alloc; i++) {
2947                 if (channels[i] == NULL || !channels[i]->client_tty ||
2948                     channels[i]->type != SSH_CHANNEL_OPEN)
2949                         continue;
2950                 if (ioctl(channels[i]->rfd, TIOCGWINSZ, &ws) < 0)
2951                         continue;
2952                 channel_request_start(i, "window-change", 0);
2953                 packet_put_int((u_int)ws.ws_col);
2954                 packet_put_int((u_int)ws.ws_row);
2955                 packet_put_int((u_int)ws.ws_xpixel);
2956                 packet_put_int((u_int)ws.ws_ypixel);
2957                 packet_send();
2958         }
2959 }
2960
2961 /* -- X11 forwarding */
2962
2963 /*
2964  * Creates an internet domain socket for listening for X11 connections.
2965  * Returns 0 and a suitable display number for the DISPLAY variable
2966  * stored in display_numberp , or -1 if an error occurs.
2967  */
2968 int
2969 x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
2970     int single_connection, u_int *display_numberp, int **chanids)
2971 {
2972         Channel *nc = NULL;
2973         int display_number, sock;
2974         u_short port;
2975         struct addrinfo hints, *ai, *aitop;
2976         char strport[NI_MAXSERV];
2977         int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
2978
2979         if (chanids == NULL)
2980                 return -1;
2981
2982         for (display_number = x11_display_offset;
2983             display_number < MAX_DISPLAYS;
2984             display_number++) {
2985                 port = 6000 + display_number;
2986                 memset(&hints, 0, sizeof(hints));
2987                 hints.ai_family = IPv4or6;
2988                 hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
2989                 hints.ai_socktype = SOCK_STREAM;
2990                 snprintf(strport, sizeof strport, "%d", port);
2991                 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
2992                         error("getaddrinfo: %.100s", ssh_gai_strerror(gaierr));
2993                         return -1;
2994                 }
2995                 for (ai = aitop; ai; ai = ai->ai_next) {
2996                         if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
2997                                 continue;
2998                         sock = socket(ai->ai_family, ai->ai_socktype,
2999                             ai->ai_protocol);
3000                         if (sock < 0) {
3001                                 if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) {
3002                                         error("socket: %.100s", strerror(errno));
3003                                         freeaddrinfo(aitop);
3004                                         return -1;
3005                                 } else {
3006                                         debug("x11_create_display_inet: Socket family %d not supported",
3007                                                  ai->ai_family);
3008                                         continue;
3009                                 }
3010                         }
3011 #ifdef IPV6_V6ONLY
3012                         if (ai->ai_family == AF_INET6) {
3013                                 int on = 1;
3014                                 if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) < 0)
3015                                         error("setsockopt IPV6_V6ONLY: %.100s", strerror(errno));
3016                         }
3017 #endif
3018                         if (x11_use_localhost)
3019                                 channel_set_reuseaddr(sock);
3020                         if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
3021                                 debug2("bind port %d: %.100s", port, strerror(errno));
3022                                 close(sock);
3023
3024                                 for (n = 0; n < num_socks; n++) {
3025                                         close(socks[n]);
3026                                 }
3027                                 num_socks = 0;
3028                                 break;
3029                         }
3030                         socks[num_socks++] = sock;
3031                         if (num_socks == NUM_SOCKS)
3032                                 break;
3033                 }
3034                 freeaddrinfo(aitop);
3035                 if (num_socks > 0)
3036                         break;
3037         }
3038         if (display_number >= MAX_DISPLAYS) {
3039                 error("Failed to allocate internet-domain X11 display socket.");
3040                 return -1;
3041         }
3042         /* Start listening for connections on the socket. */
3043         for (n = 0; n < num_socks; n++) {
3044                 sock = socks[n];
3045                 if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
3046                         error("listen: %.100s", strerror(errno));
3047                         close(sock);
3048                         return -1;
3049                 }
3050         }
3051
3052         /* Allocate a channel for each socket. */
3053         *chanids = xcalloc(num_socks + 1, sizeof(**chanids));
3054         for (n = 0; n < num_socks; n++) {
3055                 sock = socks[n];
3056                 nc = channel_new("x11 listener",
3057                     SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
3058                     CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
3059                     0, "X11 inet listener", 1);
3060                 nc->single_connection = single_connection;
3061                 (*chanids)[n] = nc->self;
3062         }
3063         (*chanids)[n] = -1;
3064
3065         /* Return the display number for the DISPLAY environment variable. */
3066         *display_numberp = display_number;
3067         return (0);
3068 }
3069
3070 static int
3071 connect_local_xsocket(u_int dnr)
3072 {
3073         int sock;
3074         struct sockaddr_un addr;
3075
3076         sock = socket(AF_UNIX, SOCK_STREAM, 0);
3077         if (sock < 0)
3078                 error("socket: %.100s", strerror(errno));
3079         memset(&addr, 0, sizeof(addr));
3080         addr.sun_family = AF_UNIX;
3081         snprintf(addr.sun_path, sizeof addr.sun_path, _PATH_UNIX_X, dnr);
3082         if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0)
3083                 return sock;
3084         close(sock);
3085         error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
3086         return -1;
3087 }
3088
3089 int
3090 x11_connect_display(void)
3091 {
3092         u_int display_number;
3093         const char *display;
3094         char buf[1024], *cp;
3095         struct addrinfo hints, *ai, *aitop;
3096         char strport[NI_MAXSERV];
3097         int gaierr, sock = 0;
3098
3099         /* Try to open a socket for the local X server. */
3100         display = getenv("DISPLAY");
3101         if (!display) {
3102                 error("DISPLAY not set.");
3103                 return -1;
3104         }
3105         /*
3106          * Now we decode the value of the DISPLAY variable and make a
3107          * connection to the real X server.
3108          */
3109
3110         /*
3111          * Check if it is a unix domain socket.  Unix domain displays are in
3112          * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
3113          */
3114         if (strncmp(display, "unix:", 5) == 0 ||
3115             display[0] == ':') {
3116                 /* Connect to the unix domain socket. */
3117                 if (sscanf(strrchr(display, ':') + 1, "%u", &display_number) != 1) {
3118                         error("Could not parse display number from DISPLAY: %.100s",
3119                             display);
3120                         return -1;
3121                 }
3122                 /* Create a socket. */
3123                 sock = connect_local_xsocket(display_number);
3124                 if (sock < 0)
3125                         return -1;
3126
3127                 /* OK, we now have a connection to the display. */
3128                 return sock;
3129         }
3130         /*
3131          * Connect to an inet socket.  The DISPLAY value is supposedly
3132          * hostname:d[.s], where hostname may also be numeric IP address.
3133          */
3134         strlcpy(buf, display, sizeof(buf));
3135         cp = strchr(buf, ':');
3136         if (!cp) {
3137                 error("Could not find ':' in DISPLAY: %.100s", display);
3138                 return -1;
3139         }
3140         *cp = 0;
3141         /* buf now contains the host name.  But first we parse the display number. */
3142         if (sscanf(cp + 1, "%u", &display_number) != 1) {
3143                 error("Could not parse display number from DISPLAY: %.100s",
3144                     display);
3145                 return -1;
3146         }
3147
3148         /* Look up the host address */
3149         memset(&hints, 0, sizeof(hints));
3150         hints.ai_family = IPv4or6;
3151         hints.ai_socktype = SOCK_STREAM;
3152         snprintf(strport, sizeof strport, "%u", 6000 + display_number);
3153         if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
3154                 error("%.100s: unknown host. (%s)", buf,
3155                 ssh_gai_strerror(gaierr));
3156                 return -1;
3157         }
3158         for (ai = aitop; ai; ai = ai->ai_next) {
3159                 /* Create a socket. */
3160                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
3161                 if (sock < 0) {
3162                         debug2("socket: %.100s", strerror(errno));
3163                         continue;
3164                 }
3165                 /* Connect it to the display. */
3166                 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
3167                         debug2("connect %.100s port %u: %.100s", buf,
3168                             6000 + display_number, strerror(errno));
3169                         close(sock);
3170                         continue;
3171                 }
3172                 /* Success */
3173                 break;
3174         }
3175         freeaddrinfo(aitop);
3176         if (!ai) {
3177                 error("connect %.100s port %u: %.100s", buf, 6000 + display_number,
3178                     strerror(errno));
3179                 return -1;
3180         }
3181         set_nodelay(sock);
3182         return sock;
3183 }
3184
3185 /*
3186  * This is called when SSH_SMSG_X11_OPEN is received.  The packet contains
3187  * the remote channel number.  We should do whatever we want, and respond
3188  * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
3189  */
3190
3191 /* ARGSUSED */
3192 void
3193 x11_input_open(int type, u_int32_t seq, void *ctxt)
3194 {
3195         Channel *c = NULL;
3196         int remote_id, sock = 0;
3197         char *remote_host;
3198
3199         debug("Received X11 open request.");
3200
3201         remote_id = packet_get_int();
3202
3203         if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {
3204                 remote_host = packet_get_string(NULL);
3205         } else {
3206                 remote_host = xstrdup("unknown (remote did not supply name)");
3207         }
3208         packet_check_eom();
3209
3210         /* Obtain a connection to the real X display. */
3211         sock = x11_connect_display();
3212         if (sock != -1) {
3213                 /* Allocate a channel for this connection. */
3214                 c = channel_new("connected x11 socket",
3215                     SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0,
3216                     remote_host, 1);
3217                 c->remote_id = remote_id;
3218                 c->force_drain = 1;
3219         }
3220         xfree(remote_host);
3221         if (c == NULL) {
3222                 /* Send refusal to the remote host. */
3223                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
3224                 packet_put_int(remote_id);
3225         } else {
3226                 /* Send a confirmation to the remote host. */
3227                 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
3228                 packet_put_int(remote_id);
3229                 packet_put_int(c->self);
3230         }
3231         packet_send();
3232 }
3233
3234 /* dummy protocol handler that denies SSH-1 requests (agent/x11) */
3235 /* ARGSUSED */
3236 void
3237 deny_input_open(int type, u_int32_t seq, void *ctxt)
3238 {
3239         int rchan = packet_get_int();
3240
3241         switch (type) {
3242         case SSH_SMSG_AGENT_OPEN:
3243                 error("Warning: ssh server tried agent forwarding.");
3244                 break;
3245         case SSH_SMSG_X11_OPEN:
3246                 error("Warning: ssh server tried X11 forwarding.");
3247                 break;
3248         default:
3249                 error("deny_input_open: type %d", type);
3250                 break;
3251         }
3252         error("Warning: this is probably a break-in attempt by a malicious server.");
3253         packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
3254         packet_put_int(rchan);
3255         packet_send();
3256 }
3257
3258 /*
3259  * Requests forwarding of X11 connections, generates fake authentication
3260  * data, and enables authentication spoofing.
3261  * This should be called in the client only.
3262  */
3263 void
3264 x11_request_forwarding_with_spoofing(int client_session_id, const char *disp,
3265     const char *proto, const char *data)
3266 {
3267         u_int data_len = (u_int) strlen(data) / 2;
3268         u_int i, value;
3269         char *new_data;
3270         int screen_number;
3271         const char *cp;
3272         u_int32_t rnd = 0;
3273
3274         if (x11_saved_display == NULL)
3275                 x11_saved_display = xstrdup(disp);
3276         else if (strcmp(disp, x11_saved_display) != 0) {
3277                 error("x11_request_forwarding_with_spoofing: different "
3278                     "$DISPLAY already forwarded");
3279                 return;
3280         }
3281
3282         cp = strchr(disp, ':');
3283         if (cp)
3284                 cp = strchr(cp, '.');
3285         if (cp)
3286                 screen_number = (u_int)strtonum(cp + 1, 0, 400, NULL);
3287         else
3288                 screen_number = 0;
3289
3290         if (x11_saved_proto == NULL) {
3291                 /* Save protocol name. */
3292                 x11_saved_proto = xstrdup(proto);
3293                 /*
3294                  * Extract real authentication data and generate fake data
3295                  * of the same length.
3296                  */
3297                 x11_saved_data = xmalloc(data_len);
3298                 x11_fake_data = xmalloc(data_len);
3299                 for (i = 0; i < data_len; i++) {
3300                         if (sscanf(data + 2 * i, "%2x", &value) != 1)
3301                                 fatal("x11_request_forwarding: bad "
3302                                     "authentication data: %.100s", data);
3303                         if (i % 4 == 0)
3304                                 rnd = arc4random();
3305                         x11_saved_data[i] = value;
3306                         x11_fake_data[i] = rnd & 0xff;
3307                         rnd >>= 8;
3308                 }
3309                 x11_saved_data_len = data_len;
3310                 x11_fake_data_len = data_len;
3311         }
3312
3313         /* Convert the fake data into hex. */
3314         new_data = tohex(x11_fake_data, data_len);
3315
3316         /* Send the request packet. */
3317         if (compat20) {
3318                 channel_request_start(client_session_id, "x11-req", 0);
3319                 packet_put_char(0);     /* XXX bool single connection */
3320         } else {
3321                 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
3322         }
3323         packet_put_cstring(proto);
3324         packet_put_cstring(new_data);
3325         packet_put_int(screen_number);
3326         packet_send();
3327         packet_write_wait();
3328         xfree(new_data);
3329 }
3330
3331
3332 /* -- agent forwarding */
3333
3334 /* Sends a message to the server to request authentication fd forwarding. */
3335
3336 void
3337 auth_request_forwarding(void)
3338 {
3339         packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
3340         packet_send();
3341         packet_write_wait();
3342 }
This page took 0.395607 seconds and 5 git commands to generate.