channels.c

   1 /*
   2  *
   3  * channels.c
   4  *
   5  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   6  *
   7  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   8  *                    All rights reserved
   9  *
  10  * Created: Fri Mar 24 16:35:24 1995 ylo
  11  *
  12  * This file contains functions for generic socket connection forwarding.
  13  * There is also code for initiating connection forwarding for X11 connections,
  14  * arbitrary tcp/ip connections, and the authentication agent connection.
  15  *
  16  * SSH2 support added by Markus Friedl.
  17  */
  18
  19 #include "includes.h"
  20 RCSID("$OpenBSD: channels.c,v 1.64 2000/07/16 08:27:21 markus Exp $");
  21
  22 #include "ssh.h"
  23 #include "packet.h"
  24 #include "xmalloc.h"
  25 #include "buffer.h"
  26 #include "uidswap.h"
  27 #include "readconf.h"
  28 #include "servconf.h"
  29
  30 #include "channels.h"
  31 #include "nchan.h"
  32 #include "compat.h"
  33
  34 #include "ssh2.h"
  35
  36 #include <openssl/rsa.h>
  37 #include <openssl/dsa.h>
  38 #include "key.h"
  39 #include "authfd.h"
  40
  41 /* Maximum number of fake X11 displays to try. */
  42 #define MAX_DISPLAYS  1000
  43
  44 /* Max len of agent socket */
  45 #define MAX_SOCKET_NAME 100
  46
  47 /* default window/packet sizes for tcp/x11-fwd-channel */
  48 #define CHAN_TCP_WINDOW_DEFAULT (8*1024)
  49 #define CHAN_TCP_PACKET_DEFAULT (CHAN_TCP_WINDOW_DEFAULT/2)
  50 #define CHAN_X11_WINDOW_DEFAULT (4*1024)
  51 #define CHAN_X11_PACKET_DEFAULT (CHAN_X11_WINDOW_DEFAULT/2)
  52
  53 /*
  54  * Pointer to an array containing all allocated channels.  The array is
  55  * dynamically extended as needed.
  56  */
  57 static Channel *channels = NULL;
  58
  59 /*
  60  * Size of the channel array.  All slots of the array must always be
  61  * initialized (at least the type field); unused slots are marked with type
  62  * SSH_CHANNEL_FREE.
  63  */
  64 static int channels_alloc = 0;
  65
  66 /*
  67  * Maximum file descriptor value used in any of the channels.  This is
  68  * updated in channel_allocate.
  69  */
  70 static int channel_max_fd_value = 0;
  71
  72 /* Name and directory of socket for authentication agent forwarding. */
  73 static char *channel_forwarded_auth_socket_name = NULL;
  74 static char *channel_forwarded_auth_socket_dir = NULL;
  75
  76 /* Saved X11 authentication protocol name. */
  77 char *x11_saved_proto = NULL;
  78
  79 /* Saved X11 authentication data.  This is the real data. */
  80 char *x11_saved_data = NULL;
  81 unsigned int x11_saved_data_len = 0;
  82
  83 /*
  84  * Fake X11 authentication data.  This is what the server will be sending us;
  85  * we should replace any occurrences of this by the real data.
  86  */
  87 char *x11_fake_data = NULL;
  88 unsigned int x11_fake_data_len;
  89
  90 /*
  91  * Data structure for storing which hosts are permitted for forward requests.
  92  * The local sides of any remote forwards are stored in this array to prevent
  93  * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
  94  * network (which might be behind a firewall).
  95  */
  96 typedef struct {
  97         char *host_to_connect;          /* Connect to 'host'. */
  98         u_short port_to_connect;        /* Connect to 'port'. */
  99         u_short listen_port;            /* Remote side should listen port number. */
 100 } ForwardPermission;
 101
 102 /* List of all permitted host/port pairs to connect. */
 103 static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
 104 /* Number of permitted host/port pairs in the array. */
 105 static int num_permitted_opens = 0;
 106 /*
 107  * If this is true, all opens are permitted.  This is the case on the server
 108  * on which we have to trust the client anyway, and the user could do
 109  * anything after logging in anyway.
 110  */
 111 static int all_opens_permitted = 0;
 112
 113 /* This is set to true if both sides support SSH_PROTOFLAG_HOST_IN_FWD_OPEN. */
 114 static int have_hostname_in_open = 0;
 115
 116 /* Sets specific protocol options. */
 117
 118 void
 119 channel_set_options(int hostname_in_open)
 120 {
 121         have_hostname_in_open = hostname_in_open;
 122 }
 123
 124 /*
 125  * Permits opening to any host/port in SSH_MSG_PORT_OPEN.  This is usually
 126  * called by the server, because the user could connect to any port anyway,
 127  * and the server has no way to know but to trust the client anyway.
 128  */
 129
 130 void
 131 channel_permit_all_opens()
 132 {
 133         all_opens_permitted = 1;
 134 }
 135
 136 /* lookup channel by id */
 137
 138 Channel *
 139 channel_lookup(int id)
 140 {
 141         Channel *c;
 142         if (id < 0 || id > channels_alloc) {
 143                 log("channel_lookup: %d: bad id", id);
 144                 return NULL;
 145         }
 146         c = &channels[id];
 147         if (c->type == SSH_CHANNEL_FREE) {
 148                 log("channel_lookup: %d: bad id: channel free", id);
 149                 return NULL;
 150         }
 151         return c;
 152 }
 153
 154 /*
 155  * Register filedescriptors for a channel, used when allocating a channel or
 156  * when the channel consumer/producer is ready, e.g. shell exec'd
 157  */
 158
 159 void
 160 channel_register_fds(Channel *c, int rfd, int wfd, int efd, int extusage)
 161 {
 162         /* Update the maximum file descriptor value. */
 163         if (rfd > channel_max_fd_value)
 164                 channel_max_fd_value = rfd;
 165         if (wfd > channel_max_fd_value)
 166                 channel_max_fd_value = wfd;
 167         if (efd > channel_max_fd_value)
 168                 channel_max_fd_value = efd;
 169         /* XXX set close-on-exec -markus */
 170
 171         c->rfd = rfd;
 172         c->wfd = wfd;
 173         c->sock = (rfd == wfd) ? rfd : -1;
 174         c->efd = efd;
 175         c->extended_usage = extusage;
 176         if (rfd != -1)
 177                 set_nonblock(rfd);
 178         if (wfd != -1)
 179                 set_nonblock(wfd);
 180         if (efd != -1)
 181                 set_nonblock(efd);
 182 }
 183
 184 /*
 185  * Allocate a new channel object and set its type and socket. This will cause
 186  * remote_name to be freed.
 187  */
 188
 189 int
 190 channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 191     int window, int maxpack, int extusage, char *remote_name)
 192 {
 193         int i, found;
 194         Channel *c;
 195
 196         /* Do initial allocation if this is the first call. */
 197         if (channels_alloc == 0) {
 198                 chan_init();
 199                 channels_alloc = 10;
 200                 channels = xmalloc(channels_alloc * sizeof(Channel));
 201                 for (i = 0; i < channels_alloc; i++)
 202                         channels[i].type = SSH_CHANNEL_FREE;
 203                 /*
 204                  * Kludge: arrange a call to channel_stop_listening if we
 205                  * terminate with fatal().
 206                  */
 207                 fatal_add_cleanup((void (*) (void *)) channel_stop_listening, NULL);
 208         }
 209         /* Try to find a free slot where to put the new channel. */
 210         for (found = -1, i = 0; i < channels_alloc; i++)
 211                 if (channels[i].type == SSH_CHANNEL_FREE) {
 212                         /* Found a free slot. */
 213                         found = i;
 214                         break;
 215                 }
 216         if (found == -1) {
 217                 /* There are no free slots.  Take last+1 slot and expand the array.  */
 218                 found = channels_alloc;
 219                 channels_alloc += 10;
 220                 debug("channel: expanding %d", channels_alloc);
 221                 channels = xrealloc(channels, channels_alloc * sizeof(Channel));
 222                 for (i = found; i < channels_alloc; i++)
 223                         channels[i].type = SSH_CHANNEL_FREE;
 224         }
 225         /* Initialize and return new channel number. */
 226         c = &channels[found];
 227         buffer_init(&c->input);
 228         buffer_init(&c->output);
 229         buffer_init(&c->extended);
 230         chan_init_iostates(c);
 231         channel_register_fds(c, rfd, wfd, efd, extusage);
 232         c->self = found;
 233         c->type = type;
 234         c->ctype = ctype;
 235         c->local_window = window;
 236         c->local_window_max = window;
 237         c->local_consumed = 0;
 238         c->local_maxpacket = maxpack;
 239         c->remote_id = -1;
 240         c->remote_name = remote_name;
 241         c->remote_window = 0;
 242         c->remote_maxpacket = 0;
 243         c->cb_fn = NULL;
 244         c->cb_arg = NULL;
 245         c->cb_event = 0;
 246         c->dettach_user = NULL;
 247         debug("channel %d: new [%s]", found, remote_name);
 248         return found;
 249 }
 250 /* old interface XXX */
 251 int
 252 channel_allocate(int type, int sock, char *remote_name)
 253 {
 254         return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name);
 255 }
 256
 257
 258 /* Close all channel fd/socket. */
 259
 260 void
 261 channel_close_fds(Channel *c)
 262 {
 263         if (c->sock != -1) {
 264                 close(c->sock);
 265                 c->sock = -1;
 266         }
 267         if (c->rfd != -1) {
 268                 close(c->rfd);
 269                 c->rfd = -1;
 270         }
 271         if (c->wfd != -1) {
 272                 close(c->wfd);
 273                 c->wfd = -1;
 274         }
 275         if (c->efd != -1) {
 276                 close(c->efd);
 277                 c->efd = -1;
 278         }
 279 }
 280
 281 /* Free the channel and close its fd/socket. */
 282
 283 void
 284 channel_free(int id)
 285 {
 286         Channel *c = channel_lookup(id);
 287         if (c == NULL)
 288                 packet_disconnect("channel free: bad local channel %d", id);
 289         debug("channel_free: channel %d: status: %s", id, channel_open_message());
 290         if (c->dettach_user != NULL) {
 291                 debug("channel_free: channel %d: dettaching channel user", id);
 292                 c->dettach_user(c->self, NULL);
 293         }
 294         if (c->sock != -1)
 295                 shutdown(c->sock, SHUT_RDWR);
 296         channel_close_fds(c);
 297         buffer_free(&c->input);
 298         buffer_free(&c->output);
 299         buffer_free(&c->extended);
 300         c->type = SSH_CHANNEL_FREE;
 301         if (c->remote_name) {
 302                 xfree(c->remote_name);
 303                 c->remote_name = NULL;
 304         }
 305 }
 306
 307 /*
 308  * 'channel_pre*' are called just before select() to add any bits relevant to
 309  * channels in the select bitmasks.
 310  */
 311 /*
 312  * 'channel_post*': perform any appropriate operations for channels which
 313  * have events pending.
 314  */
 315 typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset);
 316 chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
 317 chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
 318
 319 void
 320 channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset)
 321 {
 322         FD_SET(c->sock, readset);
 323 }
 324
 325 void
 326 channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset)
 327 {
 328         if (buffer_len(&c->input) < packet_get_maxsize())
 329                 FD_SET(c->sock, readset);
 330         if (buffer_len(&c->output) > 0)
 331                 FD_SET(c->sock, writeset);
 332 }
 333
 334 void
 335 channel_pre_open_15(Channel *c, fd_set * readset, fd_set * writeset)
 336 {
 337         /* test whether sockets are 'alive' for read/write */
 338         if (c->istate == CHAN_INPUT_OPEN)
 339                 if (buffer_len(&c->input) < packet_get_maxsize())
 340                         FD_SET(c->sock, readset);
 341         if (c->ostate == CHAN_OUTPUT_OPEN ||
 342             c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 343                 if (buffer_len(&c->output) > 0) {
 344                         FD_SET(c->sock, writeset);
 345                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 346                         chan_obuf_empty(c);
 347                 }
 348         }
 349 }
 350
 351 void
 352 channel_pre_open_20(Channel *c, fd_set * readset, fd_set * writeset)
 353 {
 354         if (c->istate == CHAN_INPUT_OPEN &&
 355             c->remote_window > 0 &&
 356             buffer_len(&c->input) < c->remote_window)
 357                 FD_SET(c->rfd, readset);
 358         if (c->ostate == CHAN_OUTPUT_OPEN ||
 359             c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 360                 if (buffer_len(&c->output) > 0) {
 361                         FD_SET(c->wfd, writeset);
 362                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
 363                         chan_obuf_empty(c);
 364                 }
 365         }
 366         /** XXX check close conditions, too */
 367         if (c->efd != -1) {
 368                 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
 369                     buffer_len(&c->extended) > 0)
 370                         FD_SET(c->efd, writeset);
 371                 else if (c->extended_usage == CHAN_EXTENDED_READ &&
 372                     buffer_len(&c->extended) < c->remote_window)
 373                         FD_SET(c->efd, readset);
 374         }
 375 }
 376
 377 void
 378 channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
 379 {
 380         if (buffer_len(&c->input) == 0) {
 381                 packet_start(SSH_MSG_CHANNEL_CLOSE);
 382                 packet_put_int(c->remote_id);
 383                 packet_send();
 384                 c->type = SSH_CHANNEL_CLOSED;
 385                 debug("Closing channel %d after input drain.", c->self);
 386         }
 387 }
 388
 389 void
 390 channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
 391 {
 392         if (buffer_len(&c->output) == 0)
 393                 channel_free(c->self);
 394         else
 395                 FD_SET(c->sock, writeset);
 396 }
 397
 398 /*
 399  * This is a special state for X11 authentication spoofing.  An opened X11
 400  * connection (when authentication spoofing is being done) remains in this
 401  * state until the first packet has been completely read.  The authentication
 402  * data in that packet is then substituted by the real data if it matches the
 403  * fake data, and the channel is put into normal mode.
 404  * XXX All this happens at the client side.
 405  */
 406 int
 407 x11_open_helper(Channel *c)
 408 {
 409         unsigned char *ucp;
 410         unsigned int proto_len, data_len;
 411
 412         /* Check if the fixed size part of the packet is in buffer. */
 413         if (buffer_len(&c->output) < 12)
 414                 return 0;
 415
 416         /* Parse the lengths of variable-length fields. */
 417         ucp = (unsigned char *) buffer_ptr(&c->output);
 418         if (ucp[0] == 0x42) {   /* Byte order MSB first. */
 419                 proto_len = 256 * ucp[6] + ucp[7];
 420                 data_len = 256 * ucp[8] + ucp[9];
 421         } else if (ucp[0] == 0x6c) {    /* Byte order LSB first. */
 422                 proto_len = ucp[6] + 256 * ucp[7];
 423                 data_len = ucp[8] + 256 * ucp[9];
 424         } else {
 425                 debug("Initial X11 packet contains bad byte order byte: 0x%x",
 426                       ucp[0]);
 427                 return -1;
 428         }
 429
 430         /* Check if the whole packet is in buffer. */
 431         if (buffer_len(&c->output) <
 432             12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
 433                 return 0;
 434
 435         /* Check if authentication protocol matches. */
 436         if (proto_len != strlen(x11_saved_proto) ||
 437             memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
 438                 debug("X11 connection uses different authentication protocol.");
 439                 return -1;
 440         }
 441         /* Check if authentication data matches our fake data. */
 442         if (data_len != x11_fake_data_len ||
 443             memcmp(ucp + 12 + ((proto_len + 3) & ~3),
 444                 x11_fake_data, x11_fake_data_len) != 0) {
 445                 debug("X11 auth data does not match fake data.");
 446                 return -1;
 447         }
 448         /* Check fake data length */
 449         if (x11_fake_data_len != x11_saved_data_len) {
 450                 error("X11 fake_data_len %d != saved_data_len %d",
 451                     x11_fake_data_len, x11_saved_data_len);
 452                 return -1;
 453         }
 454         /*
 455          * Received authentication protocol and data match
 456          * our fake data. Substitute the fake data with real
 457          * data.
 458          */
 459         memcpy(ucp + 12 + ((proto_len + 3) & ~3),
 460             x11_saved_data, x11_saved_data_len);
 461         return 1;
 462 }
 463
 464 void
 465 channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
 466 {
 467         int ret = x11_open_helper(c);
 468         if (ret == 1) {
 469                 /* Start normal processing for the channel. */
 470                 c->type = SSH_CHANNEL_OPEN;
 471                 channel_pre_open_13(c, readset, writeset);
 472         } else if (ret == -1) {
 473                 /*
 474                  * We have received an X11 connection that has bad
 475                  * authentication information.
 476                  */
 477                 log("X11 connection rejected because of wrong authentication.\r\n");
 478                 buffer_clear(&c->input);
 479                 buffer_clear(&c->output);
 480                 close(c->sock);
 481                 c->sock = -1;
 482                 c->type = SSH_CHANNEL_CLOSED;
 483                 packet_start(SSH_MSG_CHANNEL_CLOSE);
 484                 packet_put_int(c->remote_id);
 485                 packet_send();
 486         }
 487 }
 488
 489 void
 490 channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
 491 {
 492         int ret = x11_open_helper(c);
 493         if (ret == 1) {
 494                 c->type = SSH_CHANNEL_OPEN;
 495                 if (compat20)
 496                         channel_pre_open_20(c, readset, writeset);
 497                 else
 498                         channel_pre_open_15(c, readset, writeset);
 499         } else if (ret == -1) {
 500                 debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
 501                 chan_read_failed(c);    /** force close? */
 502                 chan_write_failed(c);
 503                 debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
 504         }
 505 }
 506
 507 /* This is our fake X11 server socket. */
 508 void
 509 channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
 510 {
 511         struct sockaddr addr;
 512         int newsock, newch;
 513         socklen_t addrlen;
 514         char buf[16384], *remote_hostname;
 515         int remote_port;
 516
 517         if (FD_ISSET(c->sock, readset)) {
 518                 debug("X11 connection requested.");
 519                 addrlen = sizeof(addr);
 520                 newsock = accept(c->sock, &addr, &addrlen);
 521                 if (newsock < 0) {
 522                         error("accept: %.100s", strerror(errno));
 523                         return;
 524                 }
 525                 remote_hostname = get_remote_hostname(newsock);
 526                 remote_port = get_peer_port(newsock);
 527                 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
 528                     remote_hostname, remote_port);
 529
 530                 newch = channel_new("x11",
 531                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
 532                     c->local_window_max, c->local_maxpacket,
 533                     0, xstrdup(buf));
 534                 if (compat20) {
 535                         packet_start(SSH2_MSG_CHANNEL_OPEN);
 536                         packet_put_cstring("x11");
 537                         packet_put_int(newch);
 538                         packet_put_int(c->local_window_max);
 539                         packet_put_int(c->local_maxpacket);
 540                         /* originator host and port */
 541                         packet_put_cstring(remote_hostname);
 542                         if (datafellows & SSH_BUG_X11FWD) {
 543                                 debug("ssh2 x11 bug compat mode");
 544                         } else {
 545                                 packet_put_int(remote_port);
 546                         }
 547                         packet_send();
 548                 } else {
 549                         packet_start(SSH_SMSG_X11_OPEN);
 550                         packet_put_int(newch);
 551                         if (have_hostname_in_open)
 552                                 packet_put_string(buf, strlen(buf));
 553                         packet_send();
 554                 }
 555                 xfree(remote_hostname);
 556         }
 557 }
 558
 559 /*
 560  * This socket is listening for connections to a forwarded TCP/IP port.
 561  */
 562 void
 563 channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
 564 {
 565         struct sockaddr addr;
 566         int newsock, newch;
 567         socklen_t addrlen;
 568         char buf[1024], *remote_hostname;
 569         int remote_port;
 570
 571         if (FD_ISSET(c->sock, readset)) {
 572                 debug("Connection to port %d forwarding "
 573                     "to %.100s port %d requested.",
 574                     c->listening_port, c->path, c->host_port);
 575                 addrlen = sizeof(addr);
 576                 newsock = accept(c->sock, &addr, &addrlen);
 577                 if (newsock < 0) {
 578                         error("accept: %.100s", strerror(errno));
 579                         return;
 580                 }
 581                 remote_hostname = get_remote_hostname(newsock);
 582                 remote_port = get_peer_port(newsock);
 583                 snprintf(buf, sizeof buf,
 584                     "listen port %d for %.100s port %d, "
 585                     "connect from %.200s port %d",
 586                     c->listening_port, c->path, c->host_port,
 587                     remote_hostname, remote_port);
 588                 newch = channel_new("direct-tcpip",
 589                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
 590                     c->local_window_max, c->local_maxpacket,
 591                     0, xstrdup(buf));
 592                 if (compat20) {
 593                         packet_start(SSH2_MSG_CHANNEL_OPEN);
 594                         packet_put_cstring("direct-tcpip");
 595                         packet_put_int(newch);
 596                         packet_put_int(c->local_window_max);
 597                         packet_put_int(c->local_maxpacket);
 598                         /* target host and port */
 599                         packet_put_string(c->path, strlen(c->path));
 600                         packet_put_int(c->host_port);
 601                         /* originator host and port */
 602                         packet_put_cstring(remote_hostname);
 603                         packet_put_int(remote_port);
 604                         packet_send();
 605                 } else {
 606                         packet_start(SSH_MSG_PORT_OPEN);
 607                         packet_put_int(newch);
 608                         packet_put_string(c->path, strlen(c->path));
 609                         packet_put_int(c->host_port);
 610                         if (have_hostname_in_open) {
 611                                 packet_put_string(buf, strlen(buf));
 612                         }
 613                         packet_send();
 614                 }
 615                 xfree(remote_hostname);
 616         }
 617 }
 618
 619 /*
 620  * This is the authentication agent socket listening for connections from
 621  * clients.
 622  */
 623 void
 624 channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
 625 {
 626         struct sockaddr addr;
 627         int newsock, newch;
 628         socklen_t addrlen;
 629
 630         if (FD_ISSET(c->sock, readset)) {
 631                 addrlen = sizeof(addr);
 632                 newsock = accept(c->sock, &addr, &addrlen);
 633                 if (newsock < 0) {
 634                         error("accept from auth socket: %.100s", strerror(errno));
 635                         return;
 636                 }
 637                 newch = channel_allocate(SSH_CHANNEL_OPENING, newsock,
 638                     xstrdup("accepted auth socket"));
 639                 packet_start(SSH_SMSG_AGENT_OPEN);
 640                 packet_put_int(newch);
 641                 packet_send();
 642         }
 643 }
 644
 645 int
 646 channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
 647 {
 648         char buf[16*1024];
 649         int len;
 650
 651         if (c->rfd != -1 &&
 652             FD_ISSET(c->rfd, readset)) {
 653                 len = read(c->rfd, buf, sizeof(buf));
 654                 if (len < 0 && (errno == EINTR || errno == EAGAIN))
 655                         return 1;
 656                 if (len <= 0) {
 657                         debug("channel %d: read<=0 rfd %d len %d",
 658                             c->self, c->rfd, len);
 659                         if (compat13) {
 660                                 buffer_consume(&c->output, buffer_len(&c->output));
 661                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
 662                                 debug("Channel %d status set to input draining.", c->self);
 663                         } else {
 664                                 chan_read_failed(c);
 665                         }
 666                         return -1;
 667                 }
 668                 buffer_append(&c->input, buf, len);
 669         }
 670         return 1;
 671 }
 672 int
 673 channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
 674 {
 675         int len;
 676
 677         /* Send buffered output data to the socket. */
 678         if (c->wfd != -1 &&
 679             FD_ISSET(c->wfd, writeset) &&
 680             buffer_len(&c->output) > 0) {
 681                 len = write(c->wfd, buffer_ptr(&c->output),
 682                     buffer_len(&c->output));
 683                 if (len < 0 && (errno == EINTR || errno == EAGAIN))
 684                         return 1;
 685                 if (len <= 0) {
 686                         if (compat13) {
 687                                 buffer_consume(&c->output, buffer_len(&c->output));
 688                                 debug("Channel %d status set to input draining.", c->self);
 689                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
 690                         } else {
 691                                 chan_write_failed(c);
 692                         }
 693                         return -1;
 694                 }
 695                 buffer_consume(&c->output, len);
 696                 if (compat20 && len > 0) {
 697                         c->local_consumed += len;
 698                 }
 699         }
 700         return 1;
 701 }
 702 int
 703 channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
 704 {
 705         char buf[16*1024];
 706         int len;
 707
 708 /** XXX handle drain efd, too */
 709         if (c->efd != -1) {
 710                 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
 711                     FD_ISSET(c->efd, writeset) &&
 712                     buffer_len(&c->extended) > 0) {
 713                         len = write(c->efd, buffer_ptr(&c->extended),
 714                             buffer_len(&c->extended));
 715                         debug("channel %d: written %d to efd %d",
 716                             c->self, len, c->efd);
 717                         if (len > 0) {
 718                                 buffer_consume(&c->extended, len);
 719                                 c->local_consumed += len;
 720                         }
 721                 } else if (c->extended_usage == CHAN_EXTENDED_READ &&
 722                     FD_ISSET(c->efd, readset)) {
 723                         len = read(c->efd, buf, sizeof(buf));
 724                         debug("channel %d: read %d from efd %d",
 725                              c->self, len, c->efd);
 726                         if (len == 0) {
 727                                 debug("channel %d: closing efd %d",
 728                                     c->self, c->efd);
 729                                 close(c->efd);
 730                                 c->efd = -1;
 731                         } else if (len > 0)
 732                                 buffer_append(&c->extended, buf, len);
 733                 }
 734         }
 735         return 1;
 736 }
 737 int
 738 channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
 739 {
 740         if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
 741             c->local_window < c->local_window_max/2 &&
 742             c->local_consumed > 0) {
 743                 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
 744                 packet_put_int(c->remote_id);
 745                 packet_put_int(c->local_consumed);
 746                 packet_send();
 747                 debug("channel %d: window %d sent adjust %d",
 748                     c->self, c->local_window,
 749                     c->local_consumed);
 750                 c->local_window += c->local_consumed;
 751                 c->local_consumed = 0;
 752         }
 753         return 1;
 754 }
 755
 756 void
 757 channel_post_open_1(Channel *c, fd_set * readset, fd_set * writeset)
 758 {
 759         channel_handle_rfd(c, readset, writeset);
 760         channel_handle_wfd(c, readset, writeset);
 761 }
 762
 763 void
 764 channel_post_open_2(Channel *c, fd_set * readset, fd_set * writeset)
 765 {
 766         channel_handle_rfd(c, readset, writeset);
 767         channel_handle_wfd(c, readset, writeset);
 768         channel_handle_efd(c, readset, writeset);
 769         channel_check_window(c, readset, writeset);
 770 }
 771
 772 void
 773 channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset)
 774 {
 775         int len;
 776         /* Send buffered output data to the socket. */
 777         if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
 778                 len = write(c->sock, buffer_ptr(&c->output),
 779                             buffer_len(&c->output));
 780                 if (len <= 0)
 781                         buffer_consume(&c->output, buffer_len(&c->output));
 782                 else
 783                         buffer_consume(&c->output, len);
 784         }
 785 }
 786
 787 void
 788 channel_handler_init_20(void)
 789 {
 790         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_20;
 791         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open;
 792         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 793         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 794
 795         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_2;
 796         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 797         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 798 }
 799
 800 void
 801 channel_handler_init_13(void)
 802 {
 803         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_13;
 804         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open_13;
 805         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 806         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 807         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
 808         channel_pre[SSH_CHANNEL_INPUT_DRAINING] =       &channel_pre_input_draining;
 809         channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] =      &channel_pre_output_draining;
 810
 811         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_1;
 812         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 813         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 814         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
 815         channel_post[SSH_CHANNEL_OUTPUT_DRAINING] =     &channel_post_output_drain_13;
 816 }
 817
 818 void
 819 channel_handler_init_15(void)
 820 {
 821         channel_pre[SSH_CHANNEL_OPEN] =                 &channel_pre_open_15;
 822         channel_pre[SSH_CHANNEL_X11_OPEN] =             &channel_pre_x11_open;
 823         channel_pre[SSH_CHANNEL_X11_LISTENER] =         &channel_pre_listener;
 824         channel_pre[SSH_CHANNEL_PORT_LISTENER] =        &channel_pre_listener;
 825         channel_pre[SSH_CHANNEL_AUTH_SOCKET] =          &channel_pre_listener;
 826
 827         channel_post[SSH_CHANNEL_X11_LISTENER] =        &channel_post_x11_listener;
 828         channel_post[SSH_CHANNEL_PORT_LISTENER] =       &channel_post_port_listener;
 829         channel_post[SSH_CHANNEL_AUTH_SOCKET] =         &channel_post_auth_listener;
 830         channel_post[SSH_CHANNEL_OPEN] =                &channel_post_open_1;
 831 }
 832
 833 void
 834 channel_handler_init(void)
 835 {
 836         int i;
 837         for(i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
 838                 channel_pre[i] = NULL;
 839                 channel_post[i] = NULL;
 840         }
 841         if (compat20)
 842                 channel_handler_init_20();
 843         else if (compat13)
 844                 channel_handler_init_13();
 845         else
 846                 channel_handler_init_15();
 847 }
 848
 849 void
 850 channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
 851 {
 852         static int did_init = 0;
 853         int i;
 854         Channel *c;
 855
 856         if (!did_init) {
 857                 channel_handler_init();
 858                 did_init = 1;
 859         }
 860         for (i = 0; i < channels_alloc; i++) {
 861                 c = &channels[i];
 862                 if (c->type == SSH_CHANNEL_FREE)
 863                         continue;
 864                 if (ftab[c->type] == NULL)
 865                         continue;
 866                 (*ftab[c->type])(c, readset, writeset);
 867                 chan_delete_if_full_closed(c);
 868         }
 869 }
 870
 871 void
 872 channel_prepare_select(fd_set * readset, fd_set * writeset)
 873 {
 874         channel_handler(channel_pre, readset, writeset);
 875 }
 876
 877 void
 878 channel_after_select(fd_set * readset, fd_set * writeset)
 879 {
 880         channel_handler(channel_post, readset, writeset);
 881 }
 882
 883 /* If there is data to send to the connection, send some of it now. */
 884
 885 void
 886 channel_output_poll()
 887 {
 888         int len, i;
 889         Channel *c;
 890
 891         for (i = 0; i < channels_alloc; i++) {
 892                 c = &channels[i];
 893
 894                 /* We are only interested in channels that can have buffered incoming data. */
 895                 if (compat13) {
 896                         if (c->type != SSH_CHANNEL_OPEN &&
 897                             c->type != SSH_CHANNEL_INPUT_DRAINING)
 898                                 continue;
 899                 } else {
 900                         if (c->type != SSH_CHANNEL_OPEN)
 901                                 continue;
 902                         if (c->istate != CHAN_INPUT_OPEN &&
 903                             c->istate != CHAN_INPUT_WAIT_DRAIN)
 904                                 continue;
 905                 }
 906                 if (compat20 &&
 907                     (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
 908                         debug("channel: %d: no data after CLOSE", c->self);
 909                         continue;
 910                 }
 911
 912                 /* Get the amount of buffered data for this channel. */
 913                 len = buffer_len(&c->input);
 914                 if (len > 0) {
 915                         /* Send some data for the other side over the secure connection. */
 916                         if (compat20) {
 917                                 if (len > c->remote_window)
 918                                         len = c->remote_window;
 919                                 if (len > c->remote_maxpacket)
 920                                         len = c->remote_maxpacket;
 921                         } else {
 922                                 if (packet_is_interactive()) {
 923                                         if (len > 1024)
 924                                                 len = 512;
 925                                 } else {
 926                                         /* Keep the packets at reasonable size. */
 927                                         if (len > packet_get_maxsize()/2)
 928                                                 len = packet_get_maxsize()/2;
 929                                 }
 930                         }
 931                         if (len > 0) {
 932                                 packet_start(compat20 ?
 933                                     SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
 934                                 packet_put_int(c->remote_id);
 935                                 packet_put_string(buffer_ptr(&c->input), len);
 936                                 packet_send();
 937                                 buffer_consume(&c->input, len);
 938                                 c->remote_window -= len;
 939                         }
 940                 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
 941                         if (compat13)
 942                                 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
 943                         /*
 944                          * input-buffer is empty and read-socket shutdown:
 945                          * tell peer, that we will not send more data: send IEOF
 946                          */
 947                         chan_ibuf_empty(c);
 948                 }
 949                 /* Send extended data, i.e. stderr */
 950                 if (compat20 &&
 951                     c->remote_window > 0 &&
 952                     (len = buffer_len(&c->extended)) > 0 &&
 953                     c->extended_usage == CHAN_EXTENDED_READ) {
 954                         if (len > c->remote_window)
 955                                 len = c->remote_window;
 956                         if (len > c->remote_maxpacket)
 957                                 len = c->remote_maxpacket;
 958                         packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
 959                         packet_put_int(c->remote_id);
 960                         packet_put_int(SSH2_EXTENDED_DATA_STDERR);
 961                         packet_put_string(buffer_ptr(&c->extended), len);
 962                         packet_send();
 963                         buffer_consume(&c->extended, len);
 964                         c->remote_window -= len;
 965                 }
 966         }
 967 }
 968
 969 /*
 970  * This is called when a packet of type CHANNEL_DATA has just been received.
 971  * The message type has already been consumed, but channel number and data is
 972  * still there.
 973  */
 974
 975 void
 976 channel_input_data(int type, int plen)
 977 {
 978         int id;
 979         char *data;
 980         unsigned int data_len;
 981         Channel *c;
 982
 983         /* Get the channel number and verify it. */
 984         id = packet_get_int();
 985         c = channel_lookup(id);
 986         if (c == NULL)
 987                 packet_disconnect("Received data for nonexistent channel %d.", id);
 988
 989         /* Ignore any data for non-open channels (might happen on close) */
 990         if (c->type != SSH_CHANNEL_OPEN &&
 991             c->type != SSH_CHANNEL_X11_OPEN)
 992                 return;
 993
 994         /* same for protocol 1.5 if output end is no longer open */
 995         if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN)
 996                 return;
 997
 998         /* Get the data. */
 999         data = packet_get_string(&data_len);
1000         packet_done();
1001
1002         if (compat20){
1003                 if (data_len > c->local_maxpacket) {
1004                         log("channel %d: rcvd big packet %d, maxpack %d",
1005                             c->self, data_len, c->local_maxpacket);
1006                 }
1007                 if (data_len > c->local_window) {
1008                         log("channel %d: rcvd too much data %d, win %d",
1009                             c->self, data_len, c->local_window);
1010                         xfree(data);
1011                         return;
1012                 }
1013                 c->local_window -= data_len;
1014         }else{
1015                 packet_integrity_check(plen, 4 + 4 + data_len, type);
1016         }
1017         buffer_append(&c->output, data, data_len);
1018         xfree(data);
1019 }
1020 void
1021 channel_input_extended_data(int type, int plen)
1022 {
1023         int id;
1024         int tcode;
1025         char *data;
1026         unsigned int data_len;
1027         Channel *c;
1028
1029         /* Get the channel number and verify it. */
1030         id = packet_get_int();
1031         c = channel_lookup(id);
1032
1033         if (c == NULL)
1034                 packet_disconnect("Received extended_data for bad channel %d.", id);
1035         if (c->type != SSH_CHANNEL_OPEN) {
1036                 log("channel %d: ext data for non open", id);
1037                 return;
1038         }
1039         tcode = packet_get_int();
1040         if (c->efd == -1 ||
1041             c->extended_usage != CHAN_EXTENDED_WRITE ||
1042             tcode != SSH2_EXTENDED_DATA_STDERR) {
1043                 log("channel %d: bad ext data", c->self);
1044                 return;
1045         }
1046         data = packet_get_string(&data_len);
1047         packet_done();
1048         if (data_len > c->local_window) {
1049                 log("channel %d: rcvd too much extended_data %d, win %d",
1050                     c->self, data_len, c->local_window);
1051                 xfree(data);
1052                 return;
1053         }
1054         debug("channel %d: rcvd ext data %d", c->self, data_len);
1055         c->local_window -= data_len;
1056         buffer_append(&c->extended, data, data_len);
1057         xfree(data);
1058 }
1059
1060
1061 /*
1062  * Returns true if no channel has too much buffered data, and false if one or
1063  * more channel is overfull.
1064  */
1065
1066 int
1067 channel_not_very_much_buffered_data()
1068 {
1069         unsigned int i;
1070         Channel *c;
1071
1072         for (i = 0; i < channels_alloc; i++) {
1073                 c = &channels[i];
1074                 if (c->type == SSH_CHANNEL_OPEN) {
1075                         if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
1076                                 debug("channel %d: big input buffer %d",
1077                                     c->self, buffer_len(&c->input));
1078                                 return 0;
1079                         }
1080                         if (buffer_len(&c->output) > packet_get_maxsize()) {
1081                                 debug("channel %d: big output buffer %d",
1082                                     c->self, buffer_len(&c->output));
1083                                 return 0;
1084                         }
1085                 }
1086         }
1087         return 1;
1088 }
1089
1090 void
1091 channel_input_ieof(int type, int plen)
1092 {
1093         int id;
1094         Channel *c;
1095
1096         packet_integrity_check(plen, 4, type);
1097
1098         id = packet_get_int();
1099         c = channel_lookup(id);
1100         if (c == NULL)
1101                 packet_disconnect("Received ieof for nonexistent channel %d.", id);
1102         chan_rcvd_ieof(c);
1103 }
1104
1105 void
1106 channel_input_close(int type, int plen)
1107 {
1108         int id;
1109         Channel *c;
1110
1111         packet_integrity_check(plen, 4, type);
1112
1113         id = packet_get_int();
1114         c = channel_lookup(id);
1115         if (c == NULL)
1116                 packet_disconnect("Received close for nonexistent channel %d.", id);
1117
1118         /*
1119          * Send a confirmation that we have closed the channel and no more
1120          * data is coming for it.
1121          */
1122         packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
1123         packet_put_int(c->remote_id);
1124         packet_send();
1125
1126         /*
1127          * If the channel is in closed state, we have sent a close request,
1128          * and the other side will eventually respond with a confirmation.
1129          * Thus, we cannot free the channel here, because then there would be
1130          * no-one to receive the confirmation.  The channel gets freed when
1131          * the confirmation arrives.
1132          */
1133         if (c->type != SSH_CHANNEL_CLOSED) {
1134                 /*
1135                  * Not a closed channel - mark it as draining, which will
1136                  * cause it to be freed later.
1137                  */
1138                 buffer_consume(&c->input, buffer_len(&c->input));
1139                 c->type = SSH_CHANNEL_OUTPUT_DRAINING;
1140         }
1141 }
1142
1143 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
1144 void
1145 channel_input_oclose(int type, int plen)
1146 {
1147         int id = packet_get_int();
1148         Channel *c = channel_lookup(id);
1149         packet_integrity_check(plen, 4, type);
1150         if (c == NULL)
1151                 packet_disconnect("Received oclose for nonexistent channel %d.", id);
1152         chan_rcvd_oclose(c);
1153 }
1154
1155 void
1156 channel_input_close_confirmation(int type, int plen)
1157 {
1158         int id = packet_get_int();
1159         Channel *c = channel_lookup(id);
1160
1161         packet_done();
1162         if (c == NULL)
1163                 packet_disconnect("Received close confirmation for "
1164                     "out-of-range channel %d.", id);
1165         if (c->type != SSH_CHANNEL_CLOSED)
1166                 packet_disconnect("Received close confirmation for "
1167                     "non-closed channel %d (type %d).", id, c->type);
1168         channel_free(c->self);
1169 }
1170
1171 void
1172 channel_input_open_confirmation(int type, int plen)
1173 {
1174         int id, remote_id;
1175         Channel *c;
1176
1177         if (!compat20)
1178                 packet_integrity_check(plen, 4 + 4, type);
1179
1180         id = packet_get_int();
1181         c = channel_lookup(id);
1182
1183         if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1184                 packet_disconnect("Received open confirmation for "
1185                     "non-opening channel %d.", id);
1186         remote_id = packet_get_int();
1187         /* Record the remote channel number and mark that the channel is now open. */
1188         c->remote_id = remote_id;
1189         c->type = SSH_CHANNEL_OPEN;
1190
1191         if (compat20) {
1192                 c->remote_window = packet_get_int();
1193                 c->remote_maxpacket = packet_get_int();
1194                 packet_done();
1195                 if (c->cb_fn != NULL && c->cb_event == type) {
1196                         debug("callback start");
1197                         c->cb_fn(c->self, c->cb_arg);
1198                         debug("callback done");
1199                 }
1200                 debug("channel %d: open confirm rwindow %d rmax %d", c->self,
1201                     c->remote_window, c->remote_maxpacket);
1202         }
1203 }
1204
1205 void
1206 channel_input_open_failure(int type, int plen)
1207 {
1208         int id;
1209         Channel *c;
1210
1211         if (!compat20)
1212                 packet_integrity_check(plen, 4, type);
1213
1214         id = packet_get_int();
1215         c = channel_lookup(id);
1216
1217         if (c==NULL || c->type != SSH_CHANNEL_OPENING)
1218                 packet_disconnect("Received open failure for "
1219                     "non-opening channel %d.", id);
1220         if (compat20) {
1221                 int reason = packet_get_int();
1222                 char *msg  = packet_get_string(NULL);
1223                 char *lang  = packet_get_string(NULL);
1224                 log("channel_open_failure: %d: reason %d: %s", id, reason, msg);
1225                 packet_done();
1226                 xfree(msg);
1227                 xfree(lang);
1228         }
1229         /* Free the channel.  This will also close the socket. */
1230         channel_free(id);
1231 }
1232
1233 void
1234 channel_input_channel_request(int type, int plen)
1235 {
1236         int id;
1237         Channel *c;
1238
1239         id = packet_get_int();
1240         c = channel_lookup(id);
1241
1242         if (c == NULL ||
1243             (c->type != SSH_CHANNEL_OPEN && c->type != SSH_CHANNEL_LARVAL))
1244                 packet_disconnect("Received request for "
1245                     "non-open channel %d.", id);
1246         if (c->cb_fn != NULL && c->cb_event == type) {
1247                 debug("callback start");
1248                 c->cb_fn(c->self, c->cb_arg);
1249                 debug("callback done");
1250         } else {
1251                 char *service = packet_get_string(NULL);
1252                 debug("channel: %d rcvd request for %s", c->self, service);
1253 debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
1254                 xfree(service);
1255         }
1256 }
1257
1258 void
1259 channel_input_window_adjust(int type, int plen)
1260 {
1261         Channel *c;
1262         int id, adjust;
1263
1264         if (!compat20)
1265                 return;
1266
1267         /* Get the channel number and verify it. */
1268         id = packet_get_int();
1269         c = channel_lookup(id);
1270
1271         if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
1272                 log("Received window adjust for "
1273                     "non-open channel %d.", id);
1274                 return;
1275         }
1276         adjust = packet_get_int();
1277         packet_done();
1278         debug("channel %d: rcvd adjust %d", id, adjust);
1279         c->remote_window += adjust;
1280 }
1281
1282 /*
1283  * Stops listening for channels, and removes any unix domain sockets that we
1284  * might have.
1285  */
1286
1287 void
1288 channel_stop_listening()
1289 {
1290         int i;
1291         for (i = 0; i < channels_alloc; i++) {
1292                 switch (channels[i].type) {
1293                 case SSH_CHANNEL_AUTH_SOCKET:
1294                         close(channels[i].sock);
1295                         remove(channels[i].path);
1296                         channel_free(i);
1297                         break;
1298                 case SSH_CHANNEL_PORT_LISTENER:
1299                 case SSH_CHANNEL_X11_LISTENER:
1300                         close(channels[i].sock);
1301                         channel_free(i);
1302                         break;
1303                 default:
1304                         break;
1305                 }
1306         }
1307 }
1308
1309 /*
1310  * Closes the sockets/fds of all channels.  This is used to close extra file
1311  * descriptors after a fork.
1312  */
1313
1314 void
1315 channel_close_all()
1316 {
1317         int i;
1318         for (i = 0; i < channels_alloc; i++)
1319                 if (channels[i].type != SSH_CHANNEL_FREE)
1320                         channel_close_fds(&channels[i]);
1321 }
1322
1323 /* Returns the maximum file descriptor number used by the channels. */
1324
1325 int
1326 channel_max_fd()
1327 {
1328         return channel_max_fd_value;
1329 }
1330
1331 /* Returns true if any channel is still open. */
1332
1333 int
1334 channel_still_open()
1335 {
1336         unsigned int i;
1337         for (i = 0; i < channels_alloc; i++)
1338                 switch (channels[i].type) {
1339                 case SSH_CHANNEL_FREE:
1340                 case SSH_CHANNEL_X11_LISTENER:
1341                 case SSH_CHANNEL_PORT_LISTENER:
1342                 case SSH_CHANNEL_CLOSED:
1343                 case SSH_CHANNEL_AUTH_SOCKET:
1344                         continue;
1345                 case SSH_CHANNEL_LARVAL:
1346                         if (!compat20)
1347                                 fatal("cannot happen: SSH_CHANNEL_LARVAL");
1348                         continue;
1349                 case SSH_CHANNEL_OPENING:
1350                 case SSH_CHANNEL_OPEN:
1351                 case SSH_CHANNEL_X11_OPEN:
1352                         return 1;
1353                 case SSH_CHANNEL_INPUT_DRAINING:
1354                 case SSH_CHANNEL_OUTPUT_DRAINING:
1355                         if (!compat13)
1356                                 fatal("cannot happen: OUT_DRAIN");
1357                         return 1;
1358                 default:
1359                         fatal("channel_still_open: bad channel type %d", channels[i].type);
1360                         /* NOTREACHED */
1361                 }
1362         return 0;
1363 }
1364
1365 /*
1366  * Returns a message describing the currently open forwarded connections,
1367  * suitable for sending to the client.  The message contains crlf pairs for
1368  * newlines.
1369  */
1370
1371 char *
1372 channel_open_message()
1373 {
1374         Buffer buffer;
1375         int i;
1376         char buf[512], *cp;
1377
1378         buffer_init(&buffer);
1379         snprintf(buf, sizeof buf, "The following connections are open:\r\n");
1380         buffer_append(&buffer, buf, strlen(buf));
1381         for (i = 0; i < channels_alloc; i++) {
1382                 Channel *c = &channels[i];
1383                 switch (c->type) {
1384                 case SSH_CHANNEL_FREE:
1385                 case SSH_CHANNEL_X11_LISTENER:
1386                 case SSH_CHANNEL_PORT_LISTENER:
1387                 case SSH_CHANNEL_CLOSED:
1388                 case SSH_CHANNEL_AUTH_SOCKET:
1389                         continue;
1390                 case SSH_CHANNEL_LARVAL:
1391                 case SSH_CHANNEL_OPENING:
1392                 case SSH_CHANNEL_OPEN:
1393                 case SSH_CHANNEL_X11_OPEN:
1394                 case SSH_CHANNEL_INPUT_DRAINING:
1395                 case SSH_CHANNEL_OUTPUT_DRAINING:
1396                         snprintf(buf, sizeof buf, "  #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n",
1397                             c->self, c->remote_name,
1398                             c->type, c->remote_id,
1399                             c->istate, buffer_len(&c->input),
1400                             c->ostate, buffer_len(&c->output),
1401                             c->rfd, c->wfd);
1402                         buffer_append(&buffer, buf, strlen(buf));
1403                         continue;
1404                 default:
1405                         fatal("channel_open_message: bad channel type %d", c->type);
1406                         /* NOTREACHED */
1407                 }
1408         }
1409         buffer_append(&buffer, "\0", 1);
1410         cp = xstrdup(buffer_ptr(&buffer));
1411         buffer_free(&buffer);
1412         return cp;
1413 }
1414
1415 /*
1416  * Initiate forwarding of connections to local port "port" through the secure
1417  * channel to host:port from remote side.
1418  */
1419
1420 void
1421 channel_request_local_forwarding(u_short port, const char *host,
1422                                  u_short host_port, int gateway_ports)
1423 {
1424         int success, ch, sock, on = 1;
1425         struct addrinfo hints, *ai, *aitop;
1426         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1427         struct linger linger;
1428
1429         if (strlen(host) > sizeof(channels[0].path) - 1)
1430                 packet_disconnect("Forward host name too long.");
1431
1432         /*
1433          * getaddrinfo returns a loopback address if the hostname is
1434          * set to NULL and hints.ai_flags is not AI_PASSIVE
1435          */
1436         memset(&hints, 0, sizeof(hints));
1437         hints.ai_family = IPv4or6;
1438         hints.ai_flags = gateway_ports ? AI_PASSIVE : 0;
1439         hints.ai_socktype = SOCK_STREAM;
1440         snprintf(strport, sizeof strport, "%d", port);
1441         if (getaddrinfo(NULL, strport, &hints, &aitop) != 0)
1442                 packet_disconnect("getaddrinfo: fatal error");
1443
1444         success = 0;
1445         for (ai = aitop; ai; ai = ai->ai_next) {
1446                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1447                         continue;
1448                 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1449                     strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1450                         error("channel_request_local_forwarding: getnameinfo failed");
1451                         continue;
1452                 }
1453                 /* Create a port to listen for the host. */
1454                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1455                 if (sock < 0) {
1456                         /* this is no error since kernel may not support ipv6 */
1457                         verbose("socket: %.100s", strerror(errno));
1458                         continue;
1459                 }
1460                 /*
1461                  * Set socket options.  We would like the socket to disappear
1462                  * as soon as it has been closed for whatever reason.
1463                  */
1464                 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on));
1465                 linger.l_onoff = 1;
1466                 linger.l_linger = 5;
1467                 setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *)&linger, sizeof(linger));
1468                 debug("Local forwarding listening on %s port %s.", ntop, strport);
1469
1470                 /* Bind the socket to the address. */
1471                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1472                         /* address can be in use ipv6 address is already bound */
1473                         if (!ai->ai_next)
1474                                 error("bind: %.100s", strerror(errno));
1475                         else
1476                                 verbose("bind: %.100s", strerror(errno));
1477
1478                         close(sock);
1479                         continue;
1480                 }
1481                 /* Start listening for connections on the socket. */
1482                 if (listen(sock, 5) < 0) {
1483                         error("listen: %.100s", strerror(errno));
1484                         close(sock);
1485                         continue;
1486                 }
1487                 /* Allocate a channel number for the socket. */
1488                 ch = channel_new(
1489                     "port listener", SSH_CHANNEL_PORT_LISTENER,
1490                     sock, sock, -1,
1491                     CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1492                     0, xstrdup("port listener"));
1493                 strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
1494                 channels[ch].host_port = host_port;
1495                 channels[ch].listening_port = port;
1496                 success = 1;
1497         }
1498         if (success == 0)
1499                 packet_disconnect("cannot listen port: %d", port);
1500         freeaddrinfo(aitop);
1501 }
1502
1503 /*
1504  * Initiate forwarding of connections to port "port" on remote host through
1505  * the secure channel to host:port from local side.
1506  */
1507
1508 void
1509 channel_request_remote_forwarding(u_short listen_port, const char *host_to_connect,
1510                                   u_short port_to_connect)
1511 {
1512         int payload_len;
1513         /* Record locally that connection to this host/port is permitted. */
1514         if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
1515                 fatal("channel_request_remote_forwarding: too many forwards");
1516
1517         permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
1518         permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
1519         permitted_opens[num_permitted_opens].listen_port = listen_port;
1520         num_permitted_opens++;
1521
1522         /* Send the forward request to the remote side. */
1523         if (compat20) {
1524                 const char *address_to_bind = "0.0.0.0";
1525                 packet_start(SSH2_MSG_GLOBAL_REQUEST);
1526                 packet_put_cstring("tcpip-forward");
1527                 packet_put_char(0);                     /* boolean: want reply */
1528                 packet_put_cstring(address_to_bind);
1529                 packet_put_int(listen_port);
1530         } else {
1531                 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
1532                 packet_put_int(listen_port);
1533                 packet_put_cstring(host_to_connect);
1534                 packet_put_int(port_to_connect);
1535                 packet_send();
1536                 packet_write_wait();
1537                 /*
1538                  * Wait for response from the remote side.  It will send a disconnect
1539                  * message on failure, and we will never see it here.
1540                  */
1541                 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
1542         }
1543 }
1544
1545 /*
1546  * This is called after receiving CHANNEL_FORWARDING_REQUEST.  This initates
1547  * listening for the port, and sends back a success reply (or disconnect
1548  * message if there was an error).  This never returns if there was an error.
1549  */
1550
1551 void
1552 channel_input_port_forward_request(int is_root, int gateway_ports)
1553 {
1554         u_short port, host_port;
1555         char *hostname;
1556
1557         /* Get arguments from the packet. */
1558         port = packet_get_int();
1559         hostname = packet_get_string(NULL);
1560         host_port = packet_get_int();
1561
1562         /*
1563          * Check that an unprivileged user is not trying to forward a
1564          * privileged port.
1565          */
1566         if (port < IPPORT_RESERVED && !is_root)
1567                 packet_disconnect("Requested forwarding of port %d but user is not root.",
1568                                   port);
1569         /*
1570          * Initiate forwarding,
1571          */
1572         channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
1573
1574         /* Free the argument string. */
1575         xfree(hostname);
1576 }
1577
1578 /* XXX move to aux.c */
1579 int
1580 channel_connect_to(const char *host, u_short host_port)
1581 {
1582         struct addrinfo hints, *ai, *aitop;
1583         char ntop[NI_MAXHOST], strport[NI_MAXSERV];
1584         int gaierr;
1585         int sock = -1;
1586
1587         memset(&hints, 0, sizeof(hints));
1588         hints.ai_family = IPv4or6;
1589         hints.ai_socktype = SOCK_STREAM;
1590         snprintf(strport, sizeof strport, "%d", host_port);
1591         if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
1592                 error("%.100s: unknown host (%s)", host, gai_strerror(gaierr));
1593                 return -1;
1594         }
1595         for (ai = aitop; ai; ai = ai->ai_next) {
1596                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1597                         continue;
1598                 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
1599                     strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
1600                         error("channel_connect_to: getnameinfo failed");
1601                         continue;
1602                 }
1603                 /* Create the socket. */
1604                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1605                 if (sock < 0) {
1606                         error("socket: %.100s", strerror(errno));
1607                         continue;
1608                 }
1609                 /* Connect to the host/port. */
1610                 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1611                         error("connect %.100s port %s: %.100s", ntop, strport,
1612                             strerror(errno));
1613                         close(sock);
1614                         continue;       /* fail -- try next */
1615                 }
1616                 break; /* success */
1617
1618         }
1619         freeaddrinfo(aitop);
1620         if (!ai) {
1621                 error("connect %.100s port %d: failed.", host, host_port);
1622                 return -1;
1623         }
1624         /* success */
1625         return sock;
1626 }
1627
1628 /*
1629  * This is called after receiving PORT_OPEN message.  This attempts to
1630  * connect to the given host:port, and sends back CHANNEL_OPEN_CONFIRMATION
1631  * or CHANNEL_OPEN_FAILURE.
1632  */
1633
1634 void
1635 channel_input_port_open(int type, int plen)
1636 {
1637         u_short host_port;
1638         char *host, *originator_string;
1639         int remote_channel, sock = -1, newch, i, denied;
1640         unsigned int host_len, originator_len;
1641
1642         /* Get remote channel number. */
1643         remote_channel = packet_get_int();
1644
1645         /* Get host name to connect to. */
1646         host = packet_get_string(&host_len);
1647
1648         /* Get port to connect to. */
1649         host_port = packet_get_int();
1650
1651         /* Get remote originator name. */
1652         if (have_hostname_in_open) {
1653                 originator_string = packet_get_string(&originator_len);
1654                 originator_len += 4;    /* size of packet_int */
1655         } else {
1656                 originator_string = xstrdup("unknown (remote did not supply name)");
1657                 originator_len = 0;     /* no originator supplied */
1658         }
1659
1660         packet_integrity_check(plen,
1661             4 + 4 + host_len + 4 + originator_len, SSH_MSG_PORT_OPEN);
1662
1663         /* Check if opening that port is permitted. */
1664         denied = 0;
1665         if (!all_opens_permitted) {
1666                 /* Go trough all permitted ports. */
1667                 for (i = 0; i < num_permitted_opens; i++)
1668                         if (permitted_opens[i].port_to_connect == host_port &&
1669                             strcmp(permitted_opens[i].host_to_connect, host) == 0)
1670                                 break;
1671
1672                 /* Check if we found the requested port among those permitted. */
1673                 if (i >= num_permitted_opens) {
1674                         /* The port is not permitted. */
1675                         log("Received request to connect to %.100s:%d, but the request was denied.",
1676                             host, host_port);
1677                         denied = 1;
1678                 }
1679         }
1680         sock = denied ? -1 : channel_connect_to(host, host_port);
1681         if (sock > 0) {
1682                 /* Allocate a channel for this connection. */
1683                 newch = channel_allocate(SSH_CHANNEL_OPEN, sock, originator_string);
1684                 channels[newch].remote_id = remote_channel;
1685
1686                 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1687                 packet_put_int(remote_channel);
1688                 packet_put_int(newch);
1689                 packet_send();
1690         } else {
1691                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1692                 packet_put_int(remote_channel);
1693                 packet_send();
1694         }
1695         xfree(host);
1696 }
1697
1698 /*
1699  * Creates an internet domain socket for listening for X11 connections.
1700  * Returns a suitable value for the DISPLAY variable, or NULL if an error
1701  * occurs.
1702  */
1703
1704 #define NUM_SOCKS       10
1705
1706 char *
1707 x11_create_display_inet(int screen_number, int x11_display_offset)
1708 {
1709         int display_number, sock;
1710         u_short port;
1711         struct addrinfo hints, *ai, *aitop;
1712         char strport[NI_MAXSERV];
1713         int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
1714         char display[512];
1715         char hostname[MAXHOSTNAMELEN];
1716
1717         for (display_number = x11_display_offset;
1718              display_number < MAX_DISPLAYS;
1719              display_number++) {
1720                 port = 6000 + display_number;
1721                 memset(&hints, 0, sizeof(hints));
1722                 hints.ai_family = IPv4or6;
1723                 hints.ai_flags = AI_PASSIVE;            /* XXX loopback only ? */
1724                 hints.ai_socktype = SOCK_STREAM;
1725                 snprintf(strport, sizeof strport, "%d", port);
1726                 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
1727                         error("getaddrinfo: %.100s", gai_strerror(gaierr));
1728                         return NULL;
1729                 }
1730                 for (ai = aitop; ai; ai = ai->ai_next) {
1731                         if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1732                                 continue;
1733                         sock = socket(ai->ai_family, SOCK_STREAM, 0);
1734                         if (sock < 0) {
1735                                 if (errno != EINVAL) {
1736                                         error("socket: %.100s", strerror(errno));
1737                                         return NULL;
1738                                 } else {
1739                                         debug("Socket family %d not supported [X11 disp create]", ai->ai_family);
1740                                         continue;
1741                                 }
1742                         }
1743                         if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1744                                 debug("bind port %d: %.100s", port, strerror(errno));
1745                                 shutdown(sock, SHUT_RDWR);
1746                                 close(sock);
1747
1748                                 if (ai->ai_next)
1749                                         continue;
1750
1751                                 for (n = 0; n < num_socks; n++) {
1752                                         shutdown(socks[n], SHUT_RDWR);
1753                                         close(socks[n]);
1754                                 }
1755                                 num_socks = 0;
1756                                 break;
1757                         }
1758                         socks[num_socks++] = sock;
1759 #ifndef DONT_TRY_OTHER_AF
1760                         if (num_socks == NUM_SOCKS)
1761                                 break;
1762 #else
1763                         break;
1764 #endif
1765                 }
1766                 if (num_socks > 0)
1767                         break;
1768         }
1769         if (display_number >= MAX_DISPLAYS) {
1770                 error("Failed to allocate internet-domain X11 display socket.");
1771                 return NULL;
1772         }
1773         /* Start listening for connections on the socket. */
1774         for (n = 0; n < num_socks; n++) {
1775                 sock = socks[n];
1776                 if (listen(sock, 5) < 0) {
1777                         error("listen: %.100s", strerror(errno));
1778                         shutdown(sock, SHUT_RDWR);
1779                         close(sock);
1780                         return NULL;
1781                 }
1782         }
1783
1784         /* Set up a suitable value for the DISPLAY variable. */
1785
1786         if (gethostname(hostname, sizeof(hostname)) < 0)
1787                 fatal("gethostname: %.100s", strerror(errno));
1788
1789 #ifdef IPADDR_IN_DISPLAY
1790         /*
1791          * HPUX detects the local hostname in the DISPLAY variable and tries
1792          * to set up a shared memory connection to the server, which it
1793          * incorrectly supposes to be local.
1794          *
1795          * The workaround - as used in later $$H and other programs - is
1796          * is to set display to the host's IP address.
1797          */
1798         {
1799                 struct hostent *he;
1800                 struct in_addr my_addr;
1801
1802                 he = gethostbyname(hostname);
1803                 if (he == NULL) {
1804                         error("[X11-broken-fwd-hostname-workaround] Could not get "
1805                                 "IP address for hostname %s.", hostname);
1806
1807                         packet_send_debug("[X11-broken-fwd-hostname-workaround]"
1808                                 "Could not get IP address for hostname %s.", hostname);
1809
1810                         shutdown(sock, SHUT_RDWR);
1811                         close(sock);
1812
1813                         return NULL;
1814                 }
1815
1816                 memcpy(&my_addr, he->h_addr_list[0], sizeof(struct in_addr));
1817
1818                 /* Set DISPLAY to <ip address>:screen.display */
1819                 snprintf(display, sizeof(display), "%.50s:%d.%d", inet_ntoa(my_addr),
1820                         display_number, screen_number);
1821         }
1822 #else /* IPADDR_IN_DISPLAY */
1823         /* Just set DISPLAY to hostname:screen.display */
1824         snprintf(display, sizeof display, "%.400s:%d.%d", hostname,
1825                 display_number, screen_number);
1826 #endif /* IPADDR_IN_DISPLAY */
1827
1828         /* Allocate a channel for each socket. */
1829         for (n = 0; n < num_socks; n++) {
1830                 sock = socks[n];
1831                 (void) channel_new("x11 listener",
1832                     SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
1833                     CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
1834                     0, xstrdup("X11 inet listener"));
1835         }
1836
1837         /* Return a suitable value for the DISPLAY environment variable. */
1838         return xstrdup(display);
1839 }
1840
1841 #ifndef X_UNIX_PATH
1842 #define X_UNIX_PATH "/tmp/.X11-unix/X"
1843 #endif
1844
1845 static
1846 int
1847 connect_local_xsocket(unsigned int dnr)
1848 {
1849         static const char *const x_sockets[] = {
1850                 X_UNIX_PATH "%u",
1851                 "/var/X/.X11-unix/X" "%u",
1852                 "/usr/spool/sockets/X11/" "%u",
1853                 NULL
1854         };
1855         int sock;
1856         struct sockaddr_un addr;
1857         const char *const * path;
1858
1859         for (path = x_sockets; *path; ++path) {
1860                 sock = socket(AF_UNIX, SOCK_STREAM, 0);
1861                 if (sock < 0)
1862                         error("socket: %.100s", strerror(errno));
1863                 memset(&addr, 0, sizeof(addr));
1864                 addr.sun_family = AF_UNIX;
1865                 snprintf(addr.sun_path, sizeof addr.sun_path, *path, dnr);
1866                 if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0)
1867                         return sock;
1868                 close(sock);
1869         }
1870         error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
1871         return -1;
1872 }
1873
1874 int
1875 x11_connect_display(void)
1876 {
1877         int display_number, sock = 0;
1878         const char *display;
1879         char buf[1024], *cp;
1880         struct addrinfo hints, *ai, *aitop;
1881         char strport[NI_MAXSERV];
1882         int gaierr;
1883
1884         /* Try to open a socket for the local X server. */
1885         display = getenv("DISPLAY");
1886         if (!display) {
1887                 error("DISPLAY not set.");
1888                 return -1;
1889         }
1890         /*
1891          * Now we decode the value of the DISPLAY variable and make a
1892          * connection to the real X server.
1893          */
1894
1895         /*
1896          * Check if it is a unix domain socket.  Unix domain displays are in
1897          * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
1898          */
1899         if (strncmp(display, "unix:", 5) == 0 ||
1900             display[0] == ':') {
1901                 /* Connect to the unix domain socket. */
1902                 if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
1903                         error("Could not parse display number from DISPLAY: %.100s",
1904                               display);
1905                         return -1;
1906                 }
1907                 /* Create a socket. */
1908                 sock = connect_local_xsocket(display_number);
1909                 if (sock < 0)
1910                         return -1;
1911
1912                 /* OK, we now have a connection to the display. */
1913                 return sock;
1914         }
1915         /*
1916          * Connect to an inet socket.  The DISPLAY value is supposedly
1917          * hostname:d[.s], where hostname may also be numeric IP address.
1918          */
1919         strncpy(buf, display, sizeof(buf));
1920         buf[sizeof(buf) - 1] = 0;
1921         cp = strchr(buf, ':');
1922         if (!cp) {
1923                 error("Could not find ':' in DISPLAY: %.100s", display);
1924                 return -1;
1925         }
1926         *cp = 0;
1927         /* buf now contains the host name.  But first we parse the display number. */
1928         if (sscanf(cp + 1, "%d", &display_number) != 1) {
1929                 error("Could not parse display number from DISPLAY: %.100s",
1930                       display);
1931                 return -1;
1932         }
1933
1934         /* Look up the host address */
1935         memset(&hints, 0, sizeof(hints));
1936         hints.ai_family = IPv4or6;
1937         hints.ai_socktype = SOCK_STREAM;
1938         snprintf(strport, sizeof strport, "%d", 6000 + display_number);
1939         if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
1940                 error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
1941                 return -1;
1942         }
1943         for (ai = aitop; ai; ai = ai->ai_next) {
1944                 /* Create a socket. */
1945                 sock = socket(ai->ai_family, SOCK_STREAM, 0);
1946                 if (sock < 0) {
1947                         debug("socket: %.100s", strerror(errno));
1948                         continue;
1949                 }
1950                 /* Connect it to the display. */
1951                 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1952                         debug("connect %.100s port %d: %.100s", buf,
1953                             6000 + display_number, strerror(errno));
1954                         close(sock);
1955                         continue;
1956                 }
1957                 /* Success */
1958                 break;
1959         }
1960         freeaddrinfo(aitop);
1961         if (!ai) {
1962                 error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
1963                     strerror(errno));
1964                 return -1;
1965         }
1966         return sock;
1967 }
1968
1969 /*
1970  * This is called when SSH_SMSG_X11_OPEN is received.  The packet contains
1971  * the remote channel number.  We should do whatever we want, and respond
1972  * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
1973  */
1974
1975 void
1976 x11_input_open(int type, int plen)
1977 {
1978         int remote_channel, sock = 0, newch;
1979         char *remote_host;
1980         unsigned int remote_len;
1981
1982         /* Get remote channel number. */
1983         remote_channel = packet_get_int();
1984
1985         /* Get remote originator name. */
1986         if (have_hostname_in_open) {
1987                 remote_host = packet_get_string(&remote_len);
1988                 remote_len += 4;
1989         } else {
1990                 remote_host = xstrdup("unknown (remote did not supply name)");
1991                 remote_len = 0;
1992         }
1993
1994         debug("Received X11 open request.");
1995         packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
1996
1997         /* Obtain a connection to the real X display. */
1998         sock = x11_connect_display();
1999         if (sock == -1) {
2000                 /* Send refusal to the remote host. */
2001                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2002                 packet_put_int(remote_channel);
2003                 packet_send();
2004         } else {
2005                 /* Allocate a channel for this connection. */
2006                 newch = channel_allocate(
2007                      (x11_saved_proto == NULL) ?
2008                      SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
2009                      sock, remote_host);
2010                 channels[newch].remote_id = remote_channel;
2011
2012                 /* Send a confirmation to the remote host. */
2013                 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2014                 packet_put_int(remote_channel);
2015                 packet_put_int(newch);
2016                 packet_send();
2017         }
2018 }
2019
2020 /*
2021  * Requests forwarding of X11 connections, generates fake authentication
2022  * data, and enables authentication spoofing.
2023  */
2024
2025 void
2026 x11_request_forwarding_with_spoofing(int client_session_id,
2027     const char *proto, const char *data)
2028 {
2029         unsigned int data_len = (unsigned int) strlen(data) / 2;
2030         unsigned int i, value;
2031         char *new_data;
2032         int screen_number;
2033         const char *cp;
2034         u_int32_t rand = 0;
2035
2036         cp = getenv("DISPLAY");
2037         if (cp)
2038                 cp = strchr(cp, ':');
2039         if (cp)
2040                 cp = strchr(cp, '.');
2041         if (cp)
2042                 screen_number = atoi(cp + 1);
2043         else
2044                 screen_number = 0;
2045
2046         /* Save protocol name. */
2047         x11_saved_proto = xstrdup(proto);
2048
2049         /*
2050          * Extract real authentication data and generate fake data of the
2051          * same length.
2052          */
2053         x11_saved_data = xmalloc(data_len);
2054         x11_fake_data = xmalloc(data_len);
2055         for (i = 0; i < data_len; i++) {
2056                 if (sscanf(data + 2 * i, "%2x", &value) != 1)
2057                         fatal("x11_request_forwarding: bad authentication data: %.100s", data);
2058                 if (i % 4 == 0)
2059                         rand = arc4random();
2060                 x11_saved_data[i] = value;
2061                 x11_fake_data[i] = rand & 0xff;
2062                 rand >>= 8;
2063         }
2064         x11_saved_data_len = data_len;
2065         x11_fake_data_len = data_len;
2066
2067         /* Convert the fake data into hex. */
2068         new_data = xmalloc(2 * data_len + 1);
2069         for (i = 0; i < data_len; i++)
2070                 sprintf(new_data + 2 * i, "%02x", (unsigned char) x11_fake_data[i]);
2071
2072         /* Send the request packet. */
2073         if (compat20) {
2074                 channel_request_start(client_session_id, "x11-req", 0);
2075                 packet_put_char(0);     /* XXX bool single connection */
2076         } else {
2077                 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
2078         }
2079         packet_put_cstring(proto);
2080         packet_put_cstring(new_data);
2081         packet_put_int(screen_number);
2082         packet_send();
2083         packet_write_wait();
2084         xfree(new_data);
2085 }
2086
2087 /* Sends a message to the server to request authentication fd forwarding. */
2088
2089 void
2090 auth_request_forwarding()
2091 {
2092         packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
2093         packet_send();
2094         packet_write_wait();
2095 }
2096
2097 /*
2098  * Returns the name of the forwarded authentication socket.  Returns NULL if
2099  * there is no forwarded authentication socket.  The returned value points to
2100  * a static buffer.
2101  */
2102
2103 char *
2104 auth_get_socket_name()
2105 {
2106         return channel_forwarded_auth_socket_name;
2107 }
2108
2109 /* removes the agent forwarding socket */
2110
2111 void
2112 cleanup_socket(void)
2113 {
2114         remove(channel_forwarded_auth_socket_name);
2115         rmdir(channel_forwarded_auth_socket_dir);
2116 }
2117
2118 /*
2119  * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
2120  * This starts forwarding authentication requests.
2121  */
2122
2123 int
2124 auth_input_request_forwarding(struct passwd * pw)
2125 {
2126         int sock, newch;
2127         struct sockaddr_un sunaddr;
2128
2129         if (auth_get_socket_name() != NULL)
2130                 fatal("Protocol error: authentication forwarding requested twice.");
2131
2132         /* Temporarily drop privileged uid for mkdir/bind. */
2133         temporarily_use_uid(pw->pw_uid);
2134
2135         /* Allocate a buffer for the socket name, and format the name. */
2136         channel_forwarded_auth_socket_name = xmalloc(MAX_SOCKET_NAME);
2137         channel_forwarded_auth_socket_dir = xmalloc(MAX_SOCKET_NAME);
2138         strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
2139
2140         /* Create private directory for socket */
2141         if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {
2142                 packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",
2143                     strerror(errno));
2144                 restore_uid();
2145                 xfree(channel_forwarded_auth_socket_name);
2146                 xfree(channel_forwarded_auth_socket_dir);
2147                 channel_forwarded_auth_socket_name = NULL;
2148                 channel_forwarded_auth_socket_dir = NULL;
2149                 return 0;
2150         }
2151         snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
2152                  channel_forwarded_auth_socket_dir, (int) getpid());
2153
2154         if (atexit(cleanup_socket) < 0) {
2155                 int saved = errno;
2156                 cleanup_socket();
2157                 packet_disconnect("socket: %.100s", strerror(saved));
2158         }
2159         /* Create the socket. */
2160         sock = socket(AF_UNIX, SOCK_STREAM, 0);
2161         if (sock < 0)
2162                 packet_disconnect("socket: %.100s", strerror(errno));
2163
2164         /* Bind it to the name. */
2165         memset(&sunaddr, 0, sizeof(sunaddr));
2166         sunaddr.sun_family = AF_UNIX;
2167         strncpy(sunaddr.sun_path, channel_forwarded_auth_socket_name,
2168                 sizeof(sunaddr.sun_path));
2169
2170         if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0)
2171                 packet_disconnect("bind: %.100s", strerror(errno));
2172
2173         /* Restore the privileged uid. */
2174         restore_uid();
2175
2176         /* Start listening on the socket. */
2177         if (listen(sock, 5) < 0)
2178                 packet_disconnect("listen: %.100s", strerror(errno));
2179
2180         /* Allocate a channel for the authentication agent socket. */
2181         newch = channel_allocate(SSH_CHANNEL_AUTH_SOCKET, sock,
2182                                  xstrdup("auth socket"));
2183         strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
2184             sizeof(channels[newch].path));
2185         return 1;
2186 }
2187
2188 /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
2189
2190 void
2191 auth_input_open_request(int type, int plen)
2192 {
2193         int remch, sock, newch;
2194         char *dummyname;
2195
2196         packet_integrity_check(plen, 4, type);
2197
2198         /* Read the remote channel number from the message. */
2199         remch = packet_get_int();
2200
2201         /*
2202          * Get a connection to the local authentication agent (this may again
2203          * get forwarded).
2204          */
2205         sock = ssh_get_authentication_socket();
2206
2207         /*
2208          * If we could not connect the agent, send an error message back to
2209          * the server. This should never happen unless the agent dies,
2210          * because authentication forwarding is only enabled if we have an
2211          * agent.
2212          */
2213         if (sock < 0) {
2214                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2215                 packet_put_int(remch);
2216                 packet_send();
2217                 return;
2218         }
2219         debug("Forwarding authentication connection.");
2220
2221         /*
2222          * Dummy host name.  This will be freed when the channel is freed; it
2223          * will still be valid in the packet_put_string below since the
2224          * channel cannot yet be freed at that point.
2225          */
2226         dummyname = xstrdup("authentication agent connection");
2227
2228         newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
2229         channels[newch].remote_id = remch;
2230
2231         /* Send a confirmation to the remote host. */
2232         packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
2233         packet_put_int(remch);
2234         packet_put_int(newch);
2235         packet_send();
2236 }
2237
2238 void
2239 channel_start_open(int id)
2240 {
2241         Channel *c = channel_lookup(id);
2242         if (c == NULL) {
2243                 log("channel_open: %d: bad id", id);
2244                 return;
2245         }
2246         debug("send channel open %d", id);
2247         packet_start(SSH2_MSG_CHANNEL_OPEN);
2248         packet_put_cstring(c->ctype);
2249         packet_put_int(c->self);
2250         packet_put_int(c->local_window);
2251         packet_put_int(c->local_maxpacket);
2252 }
2253 void
2254 channel_open(int id)
2255 {
2256         /* XXX REMOVE ME */
2257         channel_start_open(id);
2258         packet_send();
2259 }
2260 void
2261 channel_request(int id, char *service, int wantconfirm)
2262 {
2263         channel_request_start(id, service, wantconfirm);
2264         packet_send();
2265         debug("channel request %d: %s", id, service) ;
2266 }
2267 void
2268 channel_request_start(int id, char *service, int wantconfirm)
2269 {
2270         Channel *c = channel_lookup(id);
2271         if (c == NULL) {
2272                 log("channel_request: %d: bad id", id);
2273                 return;
2274         }
2275         packet_start(SSH2_MSG_CHANNEL_REQUEST);
2276         packet_put_int(c->remote_id);
2277         packet_put_cstring(service);
2278         packet_put_char(wantconfirm);
2279 }
2280 void
2281 channel_register_callback(int id, int mtype, channel_callback_fn *fn, void *arg)
2282 {
2283         Channel *c = channel_lookup(id);
2284         if (c == NULL) {
2285                 log("channel_register_callback: %d: bad id", id);
2286                 return;
2287         }
2288         c->cb_event = mtype;
2289         c->cb_fn = fn;
2290         c->cb_arg = arg;
2291 }
2292 void
2293 channel_register_cleanup(int id, channel_callback_fn *fn)
2294 {
2295         Channel *c = channel_lookup(id);
2296         if (c == NULL) {
2297                 log("channel_register_cleanup: %d: bad id", id);
2298                 return;
2299         }
2300         c->dettach_user = fn;
2301 }
2302 void
2303 channel_cancel_cleanup(int id)
2304 {
2305         Channel *c = channel_lookup(id);
2306         if (c == NULL) {
2307                 log("channel_cancel_cleanup: %d: bad id", id);
2308                 return;
2309         }
2310         c->dettach_user = NULL;
2311 }
2312
2313 void
2314 channel_set_fds(int id, int rfd, int wfd, int efd, int extusage)
2315 {
2316         Channel *c = channel_lookup(id);
2317         if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
2318                 fatal("channel_activate for non-larval channel %d.", id);
2319
2320         channel_register_fds(c, rfd, wfd, efd, extusage);
2321         c->type = SSH_CHANNEL_OPEN;
2322         /* XXX window size? */
2323         c->local_window = c->local_window_max = c->local_maxpacket/2;
2324         packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
2325         packet_put_int(c->remote_id);
2326         packet_put_int(c->local_window);
2327         packet_send();
2328 }