*/
#include "includes.h"
-RCSID("$Id$");
+RCSID("$OpenBSD: channels.c,v 1.66 2000/08/19 21:55:51 markus Exp $");
#include "ssh.h"
#include "packet.h"
#include "xmalloc.h"
#include "buffer.h"
-#include "authfd.h"
#include "uidswap.h"
#include "readconf.h"
#include "servconf.h"
#include "ssh2.h"
+#include <openssl/rsa.h>
+#include <openssl/dsa.h>
+#include "key.h"
+#include "authfd.h"
+
/* Maximum number of fake X11 displays to try. */
#define MAX_DISPLAYS 1000
/* Max len of agent socket */
#define MAX_SOCKET_NAME 100
-/* default buffer for tcp-fwd-channel */
-#define CHAN_WINDOW_DEFAULT (8*1024)
-#define CHAN_PACKET_DEFAULT (CHAN_WINDOW_DEFAULT/2)
+/* default window/packet sizes for tcp/x11-fwd-channel */
+#define CHAN_TCP_WINDOW_DEFAULT (8*1024)
+#define CHAN_TCP_PACKET_DEFAULT (CHAN_TCP_WINDOW_DEFAULT/2)
+#define CHAN_X11_WINDOW_DEFAULT (4*1024)
+#define CHAN_X11_PACKET_DEFAULT (CHAN_X11_WINDOW_DEFAULT/2)
/*
* Pointer to an array containing all allocated channels. The array is
channel_lookup(int id)
{
Channel *c;
- if (id < 0 && id > channels_alloc) {
+ if (id < 0 || id > channels_alloc) {
log("channel_lookup: %d: bad id", id);
return NULL;
}
}
/*
- * Allocate a new channel object and set its type and socket. This will cause
- * remote_name to be freed.
+ * Register filedescriptors for a channel, used when allocating a channel or
+ * when the channel consumer/producer is ready, e.g. shell exec'd
*/
-int
-channel_new(char *ctype, int type, int rfd, int wfd, int efd,
- int window, int maxpack, int extended_usage, char *remote_name)
+void
+channel_register_fds(Channel *c, int rfd, int wfd, int efd, int extusage)
{
- int i, found;
- Channel *c;
-
/* Update the maximum file descriptor value. */
if (rfd > channel_max_fd_value)
channel_max_fd_value = rfd;
channel_max_fd_value = efd;
/* XXX set close-on-exec -markus */
+ c->rfd = rfd;
+ c->wfd = wfd;
+ c->sock = (rfd == wfd) ? rfd : -1;
+ c->efd = efd;
+ c->extended_usage = extusage;
+ if (rfd != -1)
+ set_nonblock(rfd);
+ if (wfd != -1)
+ set_nonblock(wfd);
+ if (efd != -1)
+ set_nonblock(efd);
+}
+
+/*
+ * Allocate a new channel object and set its type and socket. This will cause
+ * remote_name to be freed.
+ */
+
+int
+channel_new(char *ctype, int type, int rfd, int wfd, int efd,
+ int window, int maxpack, int extusage, char *remote_name)
+{
+ int i, found;
+ Channel *c;
+
/* Do initial allocation if this is the first call. */
if (channels_alloc == 0) {
chan_init();
buffer_init(&c->output);
buffer_init(&c->extended);
chan_init_iostates(c);
+ channel_register_fds(c, rfd, wfd, efd, extusage);
c->self = found;
c->type = type;
c->ctype = ctype;
c->local_window_max = window;
c->local_consumed = 0;
c->local_maxpacket = maxpack;
- c->remote_window = 0;
- c->remote_maxpacket = 0;
- c->rfd = rfd;
- c->wfd = wfd;
- c->sock = (rfd == wfd) ? rfd : -1;
- c->efd = efd;
- c->extended_usage = extended_usage;
c->remote_id = -1;
c->remote_name = remote_name;
c->remote_window = 0;
c->cb_arg = NULL;
c->cb_event = 0;
c->dettach_user = NULL;
+ c->input_filter = NULL;
debug("channel %d: new [%s]", found, remote_name);
return found;
}
+/* old interface XXX */
int
channel_allocate(int type, int sock, char *remote_name)
{
return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name);
}
-/* Free the channel and close its socket. */
+
+/* Close all channel fd/socket. */
+
+void
+channel_close_fds(Channel *c)
+{
+ if (c->sock != -1) {
+ close(c->sock);
+ c->sock = -1;
+ }
+ if (c->rfd != -1) {
+ close(c->rfd);
+ c->rfd = -1;
+ }
+ if (c->wfd != -1) {
+ close(c->wfd);
+ c->wfd = -1;
+ }
+ if (c->efd != -1) {
+ close(c->efd);
+ c->efd = -1;
+ }
+}
+
+/* Free the channel and close its fd/socket. */
void
channel_free(int id)
debug("channel_free: channel %d: dettaching channel user", id);
c->dettach_user(c->self, NULL);
}
- if (c->sock != -1) {
+ if (c->sock != -1)
shutdown(c->sock, SHUT_RDWR);
- close(c->sock);
- c->sock = -1;
- }
- if (compat20) {
- if (c->rfd != -1) {
- close(c->rfd);
- c->rfd = -1;
- }
- if (c->wfd != -1) {
- close(c->wfd);
- c->wfd = -1;
- }
- if (c->efd != -1) {
- close(c->efd);
- c->efd = -1;
- }
- }
+ channel_close_fds(c);
buffer_free(&c->input);
buffer_free(&c->output);
buffer_free(&c->extended);
* state until the first packet has been completely read. The authentication
* data in that packet is then substituted by the real data if it matches the
* fake data, and the channel is put into normal mode.
+ * XXX All this happens at the client side.
*/
int
x11_open_helper(Channel *c)
}
void
-channel_pre_x11_open_15(Channel *c, fd_set * readset, fd_set * writeset)
+channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
{
int ret = x11_open_helper(c);
if (ret == 1) {
c->type = SSH_CHANNEL_OPEN;
- channel_pre_open_15(c, readset, writeset);
+ if (compat20)
+ channel_pre_open_20(c, readset, writeset);
+ else
+ channel_pre_open_15(c, readset, writeset);
} else if (ret == -1) {
debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
- chan_read_failed(c);
+ chan_read_failed(c); /** force close? */
chan_write_failed(c);
debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
}
int newsock, newch;
socklen_t addrlen;
char buf[16384], *remote_hostname;
+ int remote_port;
if (FD_ISSET(c->sock, readset)) {
debug("X11 connection requested.");
return;
}
remote_hostname = get_remote_hostname(newsock);
+ remote_port = get_peer_port(newsock);
snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
- remote_hostname, get_peer_port(newsock));
+ remote_hostname, remote_port);
+
+ newch = channel_new("x11",
+ SSH_CHANNEL_OPENING, newsock, newsock, -1,
+ c->local_window_max, c->local_maxpacket,
+ 0, xstrdup(buf));
+ if (compat20) {
+ packet_start(SSH2_MSG_CHANNEL_OPEN);
+ packet_put_cstring("x11");
+ packet_put_int(newch);
+ packet_put_int(c->local_window_max);
+ packet_put_int(c->local_maxpacket);
+ /* originator host and port */
+ packet_put_cstring(remote_hostname);
+ if (datafellows & SSH_BUG_X11FWD) {
+ debug("ssh2 x11 bug compat mode");
+ } else {
+ packet_put_int(remote_port);
+ }
+ packet_send();
+ } else {
+ packet_start(SSH_SMSG_X11_OPEN);
+ packet_put_int(newch);
+ if (have_hostname_in_open)
+ packet_put_string(buf, strlen(buf));
+ packet_send();
+ }
xfree(remote_hostname);
- newch = channel_allocate(SSH_CHANNEL_OPENING, newsock,
- xstrdup(buf));
- packet_start(SSH_SMSG_X11_OPEN);
- packet_put_int(newch);
- if (have_hostname_in_open)
- packet_put_string(buf, strlen(buf));
- packet_send();
}
}
if (c->rfd != -1 &&
FD_ISSET(c->rfd, readset)) {
len = read(c->rfd, buf, sizeof(buf));
+ if (len < 0 && (errno == EINTR || errno == EAGAIN))
+ return 1;
if (len <= 0) {
- debug("channel %d: read<0 rfd %d len %d",
+ debug("channel %d: read<=0 rfd %d len %d",
c->self, c->rfd, len);
if (compat13) {
buffer_consume(&c->output, buffer_len(&c->output));
}
return -1;
}
- buffer_append(&c->input, buf, len);
+ if(c->input_filter != NULL) {
+ if (c->input_filter(c, buf, len) == -1) {
+ debug("filter stops channel %d", c->self);
+ chan_read_failed(c);
+ }
+ } else {
+ buffer_append(&c->input, buf, len);
+ }
}
return 1;
}
FD_ISSET(c->wfd, writeset) &&
buffer_len(&c->output) > 0) {
len = write(c->wfd, buffer_ptr(&c->output),
- buffer_len(&c->output));
+ buffer_len(&c->output));
+ if (len < 0 && (errno == EINTR || errno == EAGAIN))
+ return 1;
if (len <= 0) {
if (compat13) {
buffer_consume(&c->output, buffer_len(&c->output));
channel_handler_init_20(void)
{
channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_20;
+ channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
+ channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
channel_post[SSH_CHANNEL_OPEN] = &channel_post_open_2;
channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
+ channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
}
void
channel_handler_init_15(void)
{
channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_15;
- channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_15;
+ channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
packet_send();
buffer_consume(&c->input, len);
c->remote_window -= len;
- debug("channel %d: send data len %d", c->self, len);
}
} else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
if (compat13)
}
/*
- * Closes the sockets of all channels. This is used to close extra file
+ * Closes the sockets/fds of all channels. This is used to close extra file
* descriptors after a fork.
*/
channel_close_all()
{
int i;
- for (i = 0; i < channels_alloc; i++) {
+ for (i = 0; i < channels_alloc; i++)
if (channels[i].type != SSH_CHANNEL_FREE)
- close(channels[i].sock);
- }
+ channel_close_fds(&channels[i]);
}
/* Returns the maximum file descriptor number used by the channels. */
ch = channel_new(
"port listener", SSH_CHANNEL_PORT_LISTENER,
sock, sock, -1,
- CHAN_WINDOW_DEFAULT, CHAN_PACKET_DEFAULT,
+ CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
0, xstrdup("port listener"));
strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
channels[ch].host_port = host_port;
packet_put_int(listen_port);
} else {
packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
- packet_put_int(port_to_connect);
- packet_put_cstring(host_to_connect);
packet_put_int(listen_port);
+ packet_put_cstring(host_to_connect);
+ packet_put_int(port_to_connect);
packet_send();
packet_write_wait();
/*
*/
void
-channel_input_port_forward_request(int is_root)
+channel_input_port_forward_request(int is_root, int gateway_ports)
{
u_short port, host_port;
char *hostname;
port);
/*
* Initiate forwarding,
- * bind port to localhost only (gateway ports == 0).
*/
- channel_request_local_forwarding(port, hostname, host_port, 0);
+ channel_request_local_forwarding(port, hostname, host_port, gateway_ports);
/* Free the argument string. */
xfree(hostname);
/* Allocate a channel for each socket. */
for (n = 0; n < num_socks; n++) {
sock = socks[n];
- (void) channel_allocate(SSH_CHANNEL_X11_LISTENER, sock,
- xstrdup("X11 inet listener"));
+ (void) channel_new("x11 listener",
+ SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
+ CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
+ 0, xstrdup("X11 inet listener"));
}
/* Return a suitable value for the DISPLAY environment variable. */
return -1;
}
-
-/*
- * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
- * the remote channel number. We should do whatever we want, and respond
- * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
- */
-
-void
-x11_input_open(int type, int plen)
+int
+x11_connect_display(void)
{
- int remote_channel, display_number, sock = 0, newch;
+ int display_number, sock = 0;
const char *display;
- char buf[1024], *cp, *remote_host;
- unsigned int remote_len;
+ char buf[1024], *cp;
struct addrinfo hints, *ai, *aitop;
char strport[NI_MAXSERV];
int gaierr;
- /* Get remote channel number. */
- remote_channel = packet_get_int();
-
- /* Get remote originator name. */
- if (have_hostname_in_open) {
- remote_host = packet_get_string(&remote_len);
- remote_len += 4;
- } else {
- remote_host = xstrdup("unknown (remote did not supply name)");
- remote_len = 0;
- }
-
- debug("Received X11 open request.");
- packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
-
/* Try to open a socket for the local X server. */
display = getenv("DISPLAY");
if (!display) {
error("DISPLAY not set.");
- goto fail;
+ return -1;
}
/*
* Now we decode the value of the DISPLAY variable and make a
if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) {
error("Could not parse display number from DISPLAY: %.100s",
display);
- goto fail;
+ return -1;
}
/* Create a socket. */
sock = connect_local_xsocket(display_number);
if (sock < 0)
- goto fail;
+ return -1;
/* OK, we now have a connection to the display. */
- goto success;
+ return sock;
}
/*
* Connect to an inet socket. The DISPLAY value is supposedly
cp = strchr(buf, ':');
if (!cp) {
error("Could not find ':' in DISPLAY: %.100s", display);
- goto fail;
+ return -1;
}
*cp = 0;
/* buf now contains the host name. But first we parse the display number. */
if (sscanf(cp + 1, "%d", &display_number) != 1) {
error("Could not parse display number from DISPLAY: %.100s",
display);
- goto fail;
+ return -1;
}
/* Look up the host address */
snprintf(strport, sizeof strport, "%d", 6000 + display_number);
if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr));
- goto fail;
+ return -1;
}
for (ai = aitop; ai; ai = ai->ai_next) {
/* Create a socket. */
if (!ai) {
error("connect %.100s port %d: %.100s", buf, 6000 + display_number,
strerror(errno));
- goto fail;
+ return -1;
}
-success:
- /* We have successfully obtained a connection to the real X display. */
+ return sock;
+}
- /* Allocate a channel for this connection. */
- if (x11_saved_proto == NULL)
- newch = channel_allocate(SSH_CHANNEL_OPEN, sock, remote_host);
- else
- newch = channel_allocate(SSH_CHANNEL_X11_OPEN, sock, remote_host);
- channels[newch].remote_id = remote_channel;
+/*
+ * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
+ * the remote channel number. We should do whatever we want, and respond
+ * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
+ */
- /* Send a confirmation to the remote host. */
- packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
- packet_put_int(remote_channel);
- packet_put_int(newch);
- packet_send();
+void
+x11_input_open(int type, int plen)
+{
+ int remote_channel, sock = 0, newch;
+ char *remote_host;
+ unsigned int remote_len;
- return;
+ /* Get remote channel number. */
+ remote_channel = packet_get_int();
-fail:
- /* Send refusal to the remote host. */
- packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
- packet_put_int(remote_channel);
- packet_send();
+ /* Get remote originator name. */
+ if (have_hostname_in_open) {
+ remote_host = packet_get_string(&remote_len);
+ remote_len += 4;
+ } else {
+ remote_host = xstrdup("unknown (remote did not supply name)");
+ remote_len = 0;
+ }
+
+ debug("Received X11 open request.");
+ packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
+
+ /* Obtain a connection to the real X display. */
+ sock = x11_connect_display();
+ if (sock == -1) {
+ /* Send refusal to the remote host. */
+ packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
+ packet_put_int(remote_channel);
+ packet_send();
+ } else {
+ /* Allocate a channel for this connection. */
+ newch = channel_allocate(
+ (x11_saved_proto == NULL) ?
+ SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
+ sock, remote_host);
+ channels[newch].remote_id = remote_channel;
+
+ /* Send a confirmation to the remote host. */
+ packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
+ packet_put_int(remote_channel);
+ packet_put_int(newch);
+ packet_send();
+ }
}
/*
*/
void
-x11_request_forwarding_with_spoofing(const char *proto, const char *data)
+x11_request_forwarding_with_spoofing(int client_session_id,
+ const char *proto, const char *data)
{
unsigned int data_len = (unsigned int) strlen(data) / 2;
unsigned int i, value;
sprintf(new_data + 2 * i, "%02x", (unsigned char) x11_fake_data[i]);
/* Send the request packet. */
- packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
- packet_put_string(proto, strlen(proto));
- packet_put_string(new_data, strlen(new_data));
+ if (compat20) {
+ channel_request_start(client_session_id, "x11-req", 0);
+ packet_put_char(0); /* XXX bool single connection */
+ } else {
+ packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
+ }
+ packet_put_cstring(proto);
+ packet_put_cstring(new_data);
packet_put_int(screen_number);
packet_send();
packet_write_wait();
}
/*
- * This if called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
+ * This is called to process SSH_CMSG_AGENT_REQUEST_FORWARDING on the server.
* This starts forwarding authentication requests.
*/
-void
+int
auth_input_request_forwarding(struct passwd * pw)
{
int sock, newch;
strlcpy(channel_forwarded_auth_socket_dir, "/tmp/ssh-XXXXXXXX", MAX_SOCKET_NAME);
/* Create private directory for socket */
- if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL)
- packet_disconnect("mkdtemp: %.100s", strerror(errno));
+ if (mkdtemp(channel_forwarded_auth_socket_dir) == NULL) {
+ packet_send_debug("Agent forwarding disabled: mkdtemp() failed: %.100s",
+ strerror(errno));
+ restore_uid();
+ xfree(channel_forwarded_auth_socket_name);
+ xfree(channel_forwarded_auth_socket_dir);
+ channel_forwarded_auth_socket_name = NULL;
+ channel_forwarded_auth_socket_dir = NULL;
+ return 0;
+ }
snprintf(channel_forwarded_auth_socket_name, MAX_SOCKET_NAME, "%s/agent.%d",
channel_forwarded_auth_socket_dir, (int) getpid());
xstrdup("auth socket"));
strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
sizeof(channels[newch].path));
+ return 1;
}
/* This is called to process an SSH_SMSG_AGENT_OPEN message. */
}
void
-channel_open(int id)
+channel_start_open(int id)
{
Channel *c = channel_lookup(id);
if (c == NULL) {
log("channel_open: %d: bad id", id);
return;
}
+ debug("send channel open %d", id);
packet_start(SSH2_MSG_CHANNEL_OPEN);
packet_put_cstring(c->ctype);
packet_put_int(c->self);
packet_put_int(c->local_window);
packet_put_int(c->local_maxpacket);
+}
+void
+channel_open(int id)
+{
+ /* XXX REMOVE ME */
+ channel_start_open(id);
packet_send();
- debug("channel open %d", id);
}
void
channel_request(int id, char *service, int wantconfirm)
}
c->dettach_user = NULL;
}
+void
+channel_register_filter(int id, channel_filter_fn *fn)
+{
+ Channel *c = channel_lookup(id);
+ if (c == NULL) {
+ log("channel_register_filter: %d: bad id", id);
+ return;
+ }
+ c->input_filter = fn;
+}
void
channel_set_fds(int id, int rfd, int wfd, int efd, int extusage)
Channel *c = channel_lookup(id);
if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
fatal("channel_activate for non-larval channel %d.", id);
- if (rfd > channel_max_fd_value)
- channel_max_fd_value = rfd;
- if (wfd > channel_max_fd_value)
- channel_max_fd_value = wfd;
- if (efd > channel_max_fd_value)
- channel_max_fd_value = efd;
+
+ channel_register_fds(c, rfd, wfd, efd, extusage);
c->type = SSH_CHANNEL_OPEN;
- c->rfd = rfd;
- c->wfd = wfd;
- c->efd = efd;
- c->extended_usage = extusage;
/* XXX window size? */
c->local_window = c->local_window_max = c->local_maxpacket/2;
packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
andersk / openssh.git / blobdiff