xref: /freebsd/crypto/openssh/channels.c (revision 9fd69f37d28cfd7438cac3eeb45fe9dd46b4d7dd)
1 /* $OpenBSD: channels.c,v 1.296 2009/05/25 06:48:00 andreas Exp $ */
2 /*
3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
4  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5  *                    All rights reserved
6  * This file contains functions for generic socket connection forwarding.
7  * There is also code for initiating connection forwarding for X11 connections,
8  * arbitrary tcp/ip connections, and the authentication agent connection.
9  *
10  * As far as I am concerned, the code I have written for this software
11  * can be used freely for any purpose.  Any derived versions of this
12  * software must be clearly marked as such, and if the derived work is
13  * incompatible with the protocol description in the RFC file, it must be
14  * called by a name other than "ssh" or "Secure Shell".
15  *
16  * SSH2 support added by Markus Friedl.
17  * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
18  * Copyright (c) 1999 Dug Song.  All rights reserved.
19  * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
20  *
21  * Redistribution and use in source and binary forms, with or without
22  * modification, are permitted provided that the following conditions
23  * are met:
24  * 1. Redistributions of source code must retain the above copyright
25  *    notice, this list of conditions and the following disclaimer.
26  * 2. Redistributions in binary form must reproduce the above copyright
27  *    notice, this list of conditions and the following disclaimer in the
28  *    documentation and/or other materials provided with the distribution.
29  *
30  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
32  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
33  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
34  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
35  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
39  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
40  */
41 
42 #include "includes.h"
43 
44 #include <sys/types.h>
45 #include <sys/ioctl.h>
46 #include <sys/un.h>
47 #include <sys/socket.h>
48 #ifdef HAVE_SYS_TIME_H
49 # include <sys/time.h>
50 #endif
51 
52 #include <netinet/in.h>
53 #include <arpa/inet.h>
54 
55 #include <errno.h>
56 #include <netdb.h>
57 #include <stdio.h>
58 #include <stdlib.h>
59 #include <string.h>
60 #include <termios.h>
61 #include <unistd.h>
62 #include <stdarg.h>
63 
64 #include "openbsd-compat/sys-queue.h"
65 #include "xmalloc.h"
66 #include "ssh.h"
67 #include "ssh1.h"
68 #include "ssh2.h"
69 #include "packet.h"
70 #include "log.h"
71 #include "misc.h"
72 #include "buffer.h"
73 #include "channels.h"
74 #include "compat.h"
75 #include "canohost.h"
76 #include "key.h"
77 #include "authfd.h"
78 #include "pathnames.h"
79 
80 /* -- channel core */
81 
82 /*
83  * Pointer to an array containing all allocated channels.  The array is
84  * dynamically extended as needed.
85  */
86 static Channel **channels = NULL;
87 
88 /*
89  * Size of the channel array.  All slots of the array must always be
90  * initialized (at least the type field); unused slots set to NULL
91  */
92 static u_int channels_alloc = 0;
93 
94 /*
95  * Maximum file descriptor value used in any of the channels.  This is
96  * updated in channel_new.
97  */
98 static int channel_max_fd = 0;
99 
100 
101 /* -- tcp forwarding */
102 
103 /*
104  * Data structure for storing which hosts are permitted for forward requests.
105  * The local sides of any remote forwards are stored in this array to prevent
106  * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
107  * network (which might be behind a firewall).
108  */
109 typedef struct {
110 	char *host_to_connect;		/* Connect to 'host'. */
111 	u_short port_to_connect;	/* Connect to 'port'. */
112 	u_short listen_port;		/* Remote side should listen port number. */
113 } ForwardPermission;
114 
115 /* List of all permitted host/port pairs to connect by the user. */
116 static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
117 
118 /* List of all permitted host/port pairs to connect by the admin. */
119 static ForwardPermission permitted_adm_opens[SSH_MAX_FORWARDS_PER_DIRECTION];
120 
121 /* Number of permitted host/port pairs in the array permitted by the user. */
122 static int num_permitted_opens = 0;
123 
124 /* Number of permitted host/port pair in the array permitted by the admin. */
125 static int num_adm_permitted_opens = 0;
126 
127 /*
128  * If this is true, all opens are permitted.  This is the case on the server
129  * on which we have to trust the client anyway, and the user could do
130  * anything after logging in anyway.
131  */
132 static int all_opens_permitted = 0;
133 
134 
135 /* -- X11 forwarding */
136 
137 /* Maximum number of fake X11 displays to try. */
138 #define MAX_DISPLAYS  1000
139 
140 /* Saved X11 local (client) display. */
141 static char *x11_saved_display = NULL;
142 
143 /* Saved X11 authentication protocol name. */
144 static char *x11_saved_proto = NULL;
145 
146 /* Saved X11 authentication data.  This is the real data. */
147 static char *x11_saved_data = NULL;
148 static u_int x11_saved_data_len = 0;
149 
150 /*
151  * Fake X11 authentication data.  This is what the server will be sending us;
152  * we should replace any occurrences of this by the real data.
153  */
154 static u_char *x11_fake_data = NULL;
155 static u_int x11_fake_data_len;
156 
157 
158 /* -- agent forwarding */
159 
160 #define	NUM_SOCKS	10
161 
162 /* AF_UNSPEC or AF_INET or AF_INET6 */
163 static int IPv4or6 = AF_UNSPEC;
164 
165 /* helper */
166 static void port_open_helper(Channel *c, char *rtype);
167 
168 /* non-blocking connect helpers */
169 static int connect_next(struct channel_connect *);
170 static void channel_connect_ctx_free(struct channel_connect *);
171 
172 /* -- channel core */
173 
174 Channel *
175 channel_by_id(int id)
176 {
177 	Channel *c;
178 
179 	if (id < 0 || (u_int)id >= channels_alloc) {
180 		logit("channel_by_id: %d: bad id", id);
181 		return NULL;
182 	}
183 	c = channels[id];
184 	if (c == NULL) {
185 		logit("channel_by_id: %d: bad id: channel free", id);
186 		return NULL;
187 	}
188 	return c;
189 }
190 
191 /*
192  * Returns the channel if it is allowed to receive protocol messages.
193  * Private channels, like listening sockets, may not receive messages.
194  */
195 Channel *
196 channel_lookup(int id)
197 {
198 	Channel *c;
199 
200 	if ((c = channel_by_id(id)) == NULL)
201 		return (NULL);
202 
203 	switch (c->type) {
204 	case SSH_CHANNEL_X11_OPEN:
205 	case SSH_CHANNEL_LARVAL:
206 	case SSH_CHANNEL_CONNECTING:
207 	case SSH_CHANNEL_DYNAMIC:
208 	case SSH_CHANNEL_OPENING:
209 	case SSH_CHANNEL_OPEN:
210 	case SSH_CHANNEL_INPUT_DRAINING:
211 	case SSH_CHANNEL_OUTPUT_DRAINING:
212 		return (c);
213 	}
214 	logit("Non-public channel %d, type %d.", id, c->type);
215 	return (NULL);
216 }
217 
218 /*
219  * Register filedescriptors for a channel, used when allocating a channel or
220  * when the channel consumer/producer is ready, e.g. shell exec'd
221  */
222 static void
223 channel_register_fds(Channel *c, int rfd, int wfd, int efd,
224     int extusage, int nonblock, int is_tty)
225 {
226 	/* Update the maximum file descriptor value. */
227 	channel_max_fd = MAX(channel_max_fd, rfd);
228 	channel_max_fd = MAX(channel_max_fd, wfd);
229 	channel_max_fd = MAX(channel_max_fd, efd);
230 
231 	/* XXX set close-on-exec -markus */
232 
233 	c->rfd = rfd;
234 	c->wfd = wfd;
235 	c->sock = (rfd == wfd) ? rfd : -1;
236 	c->ctl_fd = -1; /* XXX: set elsewhere */
237 	c->efd = efd;
238 	c->extended_usage = extusage;
239 
240 	if ((c->isatty = is_tty) != 0)
241 		debug2("channel %d: rfd %d isatty", c->self, c->rfd);
242 	c->wfd_isatty = is_tty || isatty(c->wfd);
243 
244 	/* enable nonblocking mode */
245 	if (nonblock) {
246 		if (rfd != -1)
247 			set_nonblock(rfd);
248 		if (wfd != -1)
249 			set_nonblock(wfd);
250 		if (efd != -1)
251 			set_nonblock(efd);
252 	}
253 }
254 
255 /*
256  * Allocate a new channel object and set its type and socket. This will cause
257  * remote_name to be freed.
258  */
259 Channel *
260 channel_new(char *ctype, int type, int rfd, int wfd, int efd,
261     u_int window, u_int maxpack, int extusage, char *remote_name, int nonblock)
262 {
263 	int found;
264 	u_int i;
265 	Channel *c;
266 
267 	/* Do initial allocation if this is the first call. */
268 	if (channels_alloc == 0) {
269 		channels_alloc = 10;
270 		channels = xcalloc(channels_alloc, sizeof(Channel *));
271 		for (i = 0; i < channels_alloc; i++)
272 			channels[i] = NULL;
273 	}
274 	/* Try to find a free slot where to put the new channel. */
275 	for (found = -1, i = 0; i < channels_alloc; i++)
276 		if (channels[i] == NULL) {
277 			/* Found a free slot. */
278 			found = (int)i;
279 			break;
280 		}
281 	if (found < 0) {
282 		/* There are no free slots.  Take last+1 slot and expand the array.  */
283 		found = channels_alloc;
284 		if (channels_alloc > 10000)
285 			fatal("channel_new: internal error: channels_alloc %d "
286 			    "too big.", channels_alloc);
287 		channels = xrealloc(channels, channels_alloc + 10,
288 		    sizeof(Channel *));
289 		channels_alloc += 10;
290 		debug2("channel: expanding %d", channels_alloc);
291 		for (i = found; i < channels_alloc; i++)
292 			channels[i] = NULL;
293 	}
294 	/* Initialize and return new channel. */
295 	c = channels[found] = xcalloc(1, sizeof(Channel));
296 	buffer_init(&c->input);
297 	buffer_init(&c->output);
298 	buffer_init(&c->extended);
299 	c->path = NULL;
300 	c->ostate = CHAN_OUTPUT_OPEN;
301 	c->istate = CHAN_INPUT_OPEN;
302 	c->flags = 0;
303 	channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, 0);
304 	c->self = found;
305 	c->type = type;
306 	c->ctype = ctype;
307 	c->local_window = window;
308 	c->local_window_max = window;
309 	c->local_consumed = 0;
310 	c->local_maxpacket = maxpack;
311 	c->remote_id = -1;
312 	c->remote_name = xstrdup(remote_name);
313 	c->remote_window = 0;
314 	c->remote_maxpacket = 0;
315 	c->force_drain = 0;
316 	c->single_connection = 0;
317 	c->detach_user = NULL;
318 	c->detach_close = 0;
319 	c->open_confirm = NULL;
320 	c->open_confirm_ctx = NULL;
321 	c->input_filter = NULL;
322 	c->output_filter = NULL;
323 	c->filter_ctx = NULL;
324 	c->filter_cleanup = NULL;
325 	TAILQ_INIT(&c->status_confirms);
326 	debug("channel %d: new [%s]", found, remote_name);
327 	return c;
328 }
329 
330 static int
331 channel_find_maxfd(void)
332 {
333 	u_int i;
334 	int max = 0;
335 	Channel *c;
336 
337 	for (i = 0; i < channels_alloc; i++) {
338 		c = channels[i];
339 		if (c != NULL) {
340 			max = MAX(max, c->rfd);
341 			max = MAX(max, c->wfd);
342 			max = MAX(max, c->efd);
343 		}
344 	}
345 	return max;
346 }
347 
348 int
349 channel_close_fd(int *fdp)
350 {
351 	int ret = 0, fd = *fdp;
352 
353 	if (fd != -1) {
354 		ret = close(fd);
355 		*fdp = -1;
356 		if (fd == channel_max_fd)
357 			channel_max_fd = channel_find_maxfd();
358 	}
359 	return ret;
360 }
361 
362 /* Close all channel fd/socket. */
363 static void
364 channel_close_fds(Channel *c)
365 {
366 	debug3("channel %d: close_fds r %d w %d e %d c %d",
367 	    c->self, c->rfd, c->wfd, c->efd, c->ctl_fd);
368 
369 	channel_close_fd(&c->sock);
370 	channel_close_fd(&c->ctl_fd);
371 	channel_close_fd(&c->rfd);
372 	channel_close_fd(&c->wfd);
373 	channel_close_fd(&c->efd);
374 }
375 
376 /* Free the channel and close its fd/socket. */
377 void
378 channel_free(Channel *c)
379 {
380 	char *s;
381 	u_int i, n;
382 	struct channel_confirm *cc;
383 
384 	for (n = 0, i = 0; i < channels_alloc; i++)
385 		if (channels[i])
386 			n++;
387 	debug("channel %d: free: %s, nchannels %u", c->self,
388 	    c->remote_name ? c->remote_name : "???", n);
389 
390 	s = channel_open_message();
391 	debug3("channel %d: status: %s", c->self, s);
392 	xfree(s);
393 
394 	if (c->sock != -1)
395 		shutdown(c->sock, SHUT_RDWR);
396 	if (c->ctl_fd != -1)
397 		shutdown(c->ctl_fd, SHUT_RDWR);
398 	channel_close_fds(c);
399 	buffer_free(&c->input);
400 	buffer_free(&c->output);
401 	buffer_free(&c->extended);
402 	if (c->remote_name) {
403 		xfree(c->remote_name);
404 		c->remote_name = NULL;
405 	}
406 	if (c->path) {
407 		xfree(c->path);
408 		c->path = NULL;
409 	}
410 	while ((cc = TAILQ_FIRST(&c->status_confirms)) != NULL) {
411 		if (cc->abandon_cb != NULL)
412 			cc->abandon_cb(c, cc->ctx);
413 		TAILQ_REMOVE(&c->status_confirms, cc, entry);
414 		bzero(cc, sizeof(*cc));
415 		xfree(cc);
416 	}
417 	if (c->filter_cleanup != NULL && c->filter_ctx != NULL)
418 		c->filter_cleanup(c->self, c->filter_ctx);
419 	channels[c->self] = NULL;
420 	xfree(c);
421 }
422 
423 void
424 channel_free_all(void)
425 {
426 	u_int i;
427 
428 	for (i = 0; i < channels_alloc; i++)
429 		if (channels[i] != NULL)
430 			channel_free(channels[i]);
431 }
432 
433 /*
434  * Closes the sockets/fds of all channels.  This is used to close extra file
435  * descriptors after a fork.
436  */
437 void
438 channel_close_all(void)
439 {
440 	u_int i;
441 
442 	for (i = 0; i < channels_alloc; i++)
443 		if (channels[i] != NULL)
444 			channel_close_fds(channels[i]);
445 }
446 
447 /*
448  * Stop listening to channels.
449  */
450 void
451 channel_stop_listening(void)
452 {
453 	u_int i;
454 	Channel *c;
455 
456 	for (i = 0; i < channels_alloc; i++) {
457 		c = channels[i];
458 		if (c != NULL) {
459 			switch (c->type) {
460 			case SSH_CHANNEL_AUTH_SOCKET:
461 			case SSH_CHANNEL_PORT_LISTENER:
462 			case SSH_CHANNEL_RPORT_LISTENER:
463 			case SSH_CHANNEL_X11_LISTENER:
464 				channel_close_fd(&c->sock);
465 				channel_free(c);
466 				break;
467 			}
468 		}
469 	}
470 }
471 
472 /*
473  * Returns true if no channel has too much buffered data, and false if one or
474  * more channel is overfull.
475  */
476 int
477 channel_not_very_much_buffered_data(void)
478 {
479 	u_int i;
480 	Channel *c;
481 
482 	for (i = 0; i < channels_alloc; i++) {
483 		c = channels[i];
484 		if (c != NULL && c->type == SSH_CHANNEL_OPEN) {
485 #if 0
486 			if (!compat20 &&
487 			    buffer_len(&c->input) > packet_get_maxsize()) {
488 				debug2("channel %d: big input buffer %d",
489 				    c->self, buffer_len(&c->input));
490 				return 0;
491 			}
492 #endif
493 			if (buffer_len(&c->output) > packet_get_maxsize()) {
494 				debug2("channel %d: big output buffer %u > %u",
495 				    c->self, buffer_len(&c->output),
496 				    packet_get_maxsize());
497 				return 0;
498 			}
499 		}
500 	}
501 	return 1;
502 }
503 
504 /* Returns true if any channel is still open. */
505 int
506 channel_still_open(void)
507 {
508 	u_int i;
509 	Channel *c;
510 
511 	for (i = 0; i < channels_alloc; i++) {
512 		c = channels[i];
513 		if (c == NULL)
514 			continue;
515 		switch (c->type) {
516 		case SSH_CHANNEL_X11_LISTENER:
517 		case SSH_CHANNEL_PORT_LISTENER:
518 		case SSH_CHANNEL_RPORT_LISTENER:
519 		case SSH_CHANNEL_CLOSED:
520 		case SSH_CHANNEL_AUTH_SOCKET:
521 		case SSH_CHANNEL_DYNAMIC:
522 		case SSH_CHANNEL_CONNECTING:
523 		case SSH_CHANNEL_ZOMBIE:
524 			continue;
525 		case SSH_CHANNEL_LARVAL:
526 			if (!compat20)
527 				fatal("cannot happen: SSH_CHANNEL_LARVAL");
528 			continue;
529 		case SSH_CHANNEL_OPENING:
530 		case SSH_CHANNEL_OPEN:
531 		case SSH_CHANNEL_X11_OPEN:
532 			return 1;
533 		case SSH_CHANNEL_INPUT_DRAINING:
534 		case SSH_CHANNEL_OUTPUT_DRAINING:
535 			if (!compat13)
536 				fatal("cannot happen: OUT_DRAIN");
537 			return 1;
538 		default:
539 			fatal("channel_still_open: bad channel type %d", c->type);
540 			/* NOTREACHED */
541 		}
542 	}
543 	return 0;
544 }
545 
546 /* Returns the id of an open channel suitable for keepaliving */
547 int
548 channel_find_open(void)
549 {
550 	u_int i;
551 	Channel *c;
552 
553 	for (i = 0; i < channels_alloc; i++) {
554 		c = channels[i];
555 		if (c == NULL || c->remote_id < 0)
556 			continue;
557 		switch (c->type) {
558 		case SSH_CHANNEL_CLOSED:
559 		case SSH_CHANNEL_DYNAMIC:
560 		case SSH_CHANNEL_X11_LISTENER:
561 		case SSH_CHANNEL_PORT_LISTENER:
562 		case SSH_CHANNEL_RPORT_LISTENER:
563 		case SSH_CHANNEL_OPENING:
564 		case SSH_CHANNEL_CONNECTING:
565 		case SSH_CHANNEL_ZOMBIE:
566 			continue;
567 		case SSH_CHANNEL_LARVAL:
568 		case SSH_CHANNEL_AUTH_SOCKET:
569 		case SSH_CHANNEL_OPEN:
570 		case SSH_CHANNEL_X11_OPEN:
571 			return i;
572 		case SSH_CHANNEL_INPUT_DRAINING:
573 		case SSH_CHANNEL_OUTPUT_DRAINING:
574 			if (!compat13)
575 				fatal("cannot happen: OUT_DRAIN");
576 			return i;
577 		default:
578 			fatal("channel_find_open: bad channel type %d", c->type);
579 			/* NOTREACHED */
580 		}
581 	}
582 	return -1;
583 }
584 
585 
586 /*
587  * Returns a message describing the currently open forwarded connections,
588  * suitable for sending to the client.  The message contains crlf pairs for
589  * newlines.
590  */
591 char *
592 channel_open_message(void)
593 {
594 	Buffer buffer;
595 	Channel *c;
596 	char buf[1024], *cp;
597 	u_int i;
598 
599 	buffer_init(&buffer);
600 	snprintf(buf, sizeof buf, "The following connections are open:\r\n");
601 	buffer_append(&buffer, buf, strlen(buf));
602 	for (i = 0; i < channels_alloc; i++) {
603 		c = channels[i];
604 		if (c == NULL)
605 			continue;
606 		switch (c->type) {
607 		case SSH_CHANNEL_X11_LISTENER:
608 		case SSH_CHANNEL_PORT_LISTENER:
609 		case SSH_CHANNEL_RPORT_LISTENER:
610 		case SSH_CHANNEL_CLOSED:
611 		case SSH_CHANNEL_AUTH_SOCKET:
612 		case SSH_CHANNEL_ZOMBIE:
613 			continue;
614 		case SSH_CHANNEL_LARVAL:
615 		case SSH_CHANNEL_OPENING:
616 		case SSH_CHANNEL_CONNECTING:
617 		case SSH_CHANNEL_DYNAMIC:
618 		case SSH_CHANNEL_OPEN:
619 		case SSH_CHANNEL_X11_OPEN:
620 		case SSH_CHANNEL_INPUT_DRAINING:
621 		case SSH_CHANNEL_OUTPUT_DRAINING:
622 			snprintf(buf, sizeof buf,
623 			    "  #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d cfd %d)\r\n",
624 			    c->self, c->remote_name,
625 			    c->type, c->remote_id,
626 			    c->istate, buffer_len(&c->input),
627 			    c->ostate, buffer_len(&c->output),
628 			    c->rfd, c->wfd, c->ctl_fd);
629 			buffer_append(&buffer, buf, strlen(buf));
630 			continue;
631 		default:
632 			fatal("channel_open_message: bad channel type %d", c->type);
633 			/* NOTREACHED */
634 		}
635 	}
636 	buffer_append(&buffer, "\0", 1);
637 	cp = xstrdup(buffer_ptr(&buffer));
638 	buffer_free(&buffer);
639 	return cp;
640 }
641 
642 void
643 channel_send_open(int id)
644 {
645 	Channel *c = channel_lookup(id);
646 
647 	if (c == NULL) {
648 		logit("channel_send_open: %d: bad id", id);
649 		return;
650 	}
651 	debug2("channel %d: send open", id);
652 	packet_start(SSH2_MSG_CHANNEL_OPEN);
653 	packet_put_cstring(c->ctype);
654 	packet_put_int(c->self);
655 	packet_put_int(c->local_window);
656 	packet_put_int(c->local_maxpacket);
657 	packet_send();
658 }
659 
660 void
661 channel_request_start(int id, char *service, int wantconfirm)
662 {
663 	Channel *c = channel_lookup(id);
664 
665 	if (c == NULL) {
666 		logit("channel_request_start: %d: unknown channel id", id);
667 		return;
668 	}
669 	debug2("channel %d: request %s confirm %d", id, service, wantconfirm);
670 	packet_start(SSH2_MSG_CHANNEL_REQUEST);
671 	packet_put_int(c->remote_id);
672 	packet_put_cstring(service);
673 	packet_put_char(wantconfirm);
674 }
675 
676 void
677 channel_register_status_confirm(int id, channel_confirm_cb *cb,
678     channel_confirm_abandon_cb *abandon_cb, void *ctx)
679 {
680 	struct channel_confirm *cc;
681 	Channel *c;
682 
683 	if ((c = channel_lookup(id)) == NULL)
684 		fatal("channel_register_expect: %d: bad id", id);
685 
686 	cc = xmalloc(sizeof(*cc));
687 	cc->cb = cb;
688 	cc->abandon_cb = abandon_cb;
689 	cc->ctx = ctx;
690 	TAILQ_INSERT_TAIL(&c->status_confirms, cc, entry);
691 }
692 
693 void
694 channel_register_open_confirm(int id, channel_callback_fn *fn, void *ctx)
695 {
696 	Channel *c = channel_lookup(id);
697 
698 	if (c == NULL) {
699 		logit("channel_register_open_confirm: %d: bad id", id);
700 		return;
701 	}
702 	c->open_confirm = fn;
703 	c->open_confirm_ctx = ctx;
704 }
705 
706 void
707 channel_register_cleanup(int id, channel_callback_fn *fn, int do_close)
708 {
709 	Channel *c = channel_by_id(id);
710 
711 	if (c == NULL) {
712 		logit("channel_register_cleanup: %d: bad id", id);
713 		return;
714 	}
715 	c->detach_user = fn;
716 	c->detach_close = do_close;
717 }
718 
719 void
720 channel_cancel_cleanup(int id)
721 {
722 	Channel *c = channel_by_id(id);
723 
724 	if (c == NULL) {
725 		logit("channel_cancel_cleanup: %d: bad id", id);
726 		return;
727 	}
728 	c->detach_user = NULL;
729 	c->detach_close = 0;
730 }
731 
732 void
733 channel_register_filter(int id, channel_infilter_fn *ifn,
734     channel_outfilter_fn *ofn, channel_filter_cleanup_fn *cfn, void *ctx)
735 {
736 	Channel *c = channel_lookup(id);
737 
738 	if (c == NULL) {
739 		logit("channel_register_filter: %d: bad id", id);
740 		return;
741 	}
742 	c->input_filter = ifn;
743 	c->output_filter = ofn;
744 	c->filter_ctx = ctx;
745 	c->filter_cleanup = cfn;
746 }
747 
748 void
749 channel_set_fds(int id, int rfd, int wfd, int efd,
750     int extusage, int nonblock, int is_tty, u_int window_max)
751 {
752 	Channel *c = channel_lookup(id);
753 
754 	if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
755 		fatal("channel_activate for non-larval channel %d.", id);
756 	channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, is_tty);
757 	c->type = SSH_CHANNEL_OPEN;
758 	c->local_window = c->local_window_max = window_max;
759 	packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
760 	packet_put_int(c->remote_id);
761 	packet_put_int(c->local_window);
762 	packet_send();
763 }
764 
765 /*
766  * 'channel_pre*' are called just before select() to add any bits relevant to
767  * channels in the select bitmasks.
768  */
769 /*
770  * 'channel_post*': perform any appropriate operations for channels which
771  * have events pending.
772  */
773 typedef void chan_fn(Channel *c, fd_set *readset, fd_set *writeset);
774 chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
775 chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
776 
777 /* ARGSUSED */
778 static void
779 channel_pre_listener(Channel *c, fd_set *readset, fd_set *writeset)
780 {
781 	FD_SET(c->sock, readset);
782 }
783 
784 /* ARGSUSED */
785 static void
786 channel_pre_connecting(Channel *c, fd_set *readset, fd_set *writeset)
787 {
788 	debug3("channel %d: waiting for connection", c->self);
789 	FD_SET(c->sock, writeset);
790 }
791 
792 static void
793 channel_pre_open_13(Channel *c, fd_set *readset, fd_set *writeset)
794 {
795 	if (buffer_len(&c->input) < packet_get_maxsize())
796 		FD_SET(c->sock, readset);
797 	if (buffer_len(&c->output) > 0)
798 		FD_SET(c->sock, writeset);
799 }
800 
801 static void
802 channel_pre_open(Channel *c, fd_set *readset, fd_set *writeset)
803 {
804 	u_int limit = compat20 ? c->remote_window : packet_get_maxsize();
805 
806 	if (c->istate == CHAN_INPUT_OPEN &&
807 	    limit > 0 &&
808 	    buffer_len(&c->input) < limit &&
809 	    buffer_check_alloc(&c->input, CHAN_RBUF))
810 		FD_SET(c->rfd, readset);
811 	if (c->ostate == CHAN_OUTPUT_OPEN ||
812 	    c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
813 		if (buffer_len(&c->output) > 0) {
814 			FD_SET(c->wfd, writeset);
815 		} else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
816 			if (CHANNEL_EFD_OUTPUT_ACTIVE(c))
817 				debug2("channel %d: obuf_empty delayed efd %d/(%d)",
818 				    c->self, c->efd, buffer_len(&c->extended));
819 			else
820 				chan_obuf_empty(c);
821 		}
822 	}
823 	/** XXX check close conditions, too */
824 	if (compat20 && c->efd != -1 &&
825 	    !(c->istate == CHAN_INPUT_CLOSED && c->ostate == CHAN_OUTPUT_CLOSED)) {
826 		if (c->extended_usage == CHAN_EXTENDED_WRITE &&
827 		    buffer_len(&c->extended) > 0)
828 			FD_SET(c->efd, writeset);
829 		else if (!(c->flags & CHAN_EOF_SENT) &&
830 		    c->extended_usage == CHAN_EXTENDED_READ &&
831 		    buffer_len(&c->extended) < c->remote_window)
832 			FD_SET(c->efd, readset);
833 	}
834 	/* XXX: What about efd? races? */
835 	if (compat20 && c->ctl_fd != -1 &&
836 	    c->istate == CHAN_INPUT_OPEN && c->ostate == CHAN_OUTPUT_OPEN)
837 		FD_SET(c->ctl_fd, readset);
838 }
839 
840 /* ARGSUSED */
841 static void
842 channel_pre_input_draining(Channel *c, fd_set *readset, fd_set *writeset)
843 {
844 	if (buffer_len(&c->input) == 0) {
845 		packet_start(SSH_MSG_CHANNEL_CLOSE);
846 		packet_put_int(c->remote_id);
847 		packet_send();
848 		c->type = SSH_CHANNEL_CLOSED;
849 		debug2("channel %d: closing after input drain.", c->self);
850 	}
851 }
852 
853 /* ARGSUSED */
854 static void
855 channel_pre_output_draining(Channel *c, fd_set *readset, fd_set *writeset)
856 {
857 	if (buffer_len(&c->output) == 0)
858 		chan_mark_dead(c);
859 	else
860 		FD_SET(c->sock, writeset);
861 }
862 
863 /*
864  * This is a special state for X11 authentication spoofing.  An opened X11
865  * connection (when authentication spoofing is being done) remains in this
866  * state until the first packet has been completely read.  The authentication
867  * data in that packet is then substituted by the real data if it matches the
868  * fake data, and the channel is put into normal mode.
869  * XXX All this happens at the client side.
870  * Returns: 0 = need more data, -1 = wrong cookie, 1 = ok
871  */
872 static int
873 x11_open_helper(Buffer *b)
874 {
875 	u_char *ucp;
876 	u_int proto_len, data_len;
877 
878 	/* Check if the fixed size part of the packet is in buffer. */
879 	if (buffer_len(b) < 12)
880 		return 0;
881 
882 	/* Parse the lengths of variable-length fields. */
883 	ucp = buffer_ptr(b);
884 	if (ucp[0] == 0x42) {	/* Byte order MSB first. */
885 		proto_len = 256 * ucp[6] + ucp[7];
886 		data_len = 256 * ucp[8] + ucp[9];
887 	} else if (ucp[0] == 0x6c) {	/* Byte order LSB first. */
888 		proto_len = ucp[6] + 256 * ucp[7];
889 		data_len = ucp[8] + 256 * ucp[9];
890 	} else {
891 		debug2("Initial X11 packet contains bad byte order byte: 0x%x",
892 		    ucp[0]);
893 		return -1;
894 	}
895 
896 	/* Check if the whole packet is in buffer. */
897 	if (buffer_len(b) <
898 	    12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
899 		return 0;
900 
901 	/* Check if authentication protocol matches. */
902 	if (proto_len != strlen(x11_saved_proto) ||
903 	    memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
904 		debug2("X11 connection uses different authentication protocol.");
905 		return -1;
906 	}
907 	/* Check if authentication data matches our fake data. */
908 	if (data_len != x11_fake_data_len ||
909 	    memcmp(ucp + 12 + ((proto_len + 3) & ~3),
910 		x11_fake_data, x11_fake_data_len) != 0) {
911 		debug2("X11 auth data does not match fake data.");
912 		return -1;
913 	}
914 	/* Check fake data length */
915 	if (x11_fake_data_len != x11_saved_data_len) {
916 		error("X11 fake_data_len %d != saved_data_len %d",
917 		    x11_fake_data_len, x11_saved_data_len);
918 		return -1;
919 	}
920 	/*
921 	 * Received authentication protocol and data match
922 	 * our fake data. Substitute the fake data with real
923 	 * data.
924 	 */
925 	memcpy(ucp + 12 + ((proto_len + 3) & ~3),
926 	    x11_saved_data, x11_saved_data_len);
927 	return 1;
928 }
929 
930 static void
931 channel_pre_x11_open_13(Channel *c, fd_set *readset, fd_set *writeset)
932 {
933 	int ret = x11_open_helper(&c->output);
934 
935 	if (ret == 1) {
936 		/* Start normal processing for the channel. */
937 		c->type = SSH_CHANNEL_OPEN;
938 		channel_pre_open_13(c, readset, writeset);
939 	} else if (ret == -1) {
940 		/*
941 		 * We have received an X11 connection that has bad
942 		 * authentication information.
943 		 */
944 		logit("X11 connection rejected because of wrong authentication.");
945 		buffer_clear(&c->input);
946 		buffer_clear(&c->output);
947 		channel_close_fd(&c->sock);
948 		c->sock = -1;
949 		c->type = SSH_CHANNEL_CLOSED;
950 		packet_start(SSH_MSG_CHANNEL_CLOSE);
951 		packet_put_int(c->remote_id);
952 		packet_send();
953 	}
954 }
955 
956 static void
957 channel_pre_x11_open(Channel *c, fd_set *readset, fd_set *writeset)
958 {
959 	int ret = x11_open_helper(&c->output);
960 
961 	/* c->force_drain = 1; */
962 
963 	if (ret == 1) {
964 		c->type = SSH_CHANNEL_OPEN;
965 		channel_pre_open(c, readset, writeset);
966 	} else if (ret == -1) {
967 		logit("X11 connection rejected because of wrong authentication.");
968 		debug2("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
969 		chan_read_failed(c);
970 		buffer_clear(&c->input);
971 		chan_ibuf_empty(c);
972 		buffer_clear(&c->output);
973 		/* for proto v1, the peer will send an IEOF */
974 		if (compat20)
975 			chan_write_failed(c);
976 		else
977 			c->type = SSH_CHANNEL_OPEN;
978 		debug2("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
979 	}
980 }
981 
982 /* try to decode a socks4 header */
983 /* ARGSUSED */
984 static int
985 channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
986 {
987 	char *p, *host;
988 	u_int len, have, i, found, need;
989 	char username[256];
990 	struct {
991 		u_int8_t version;
992 		u_int8_t command;
993 		u_int16_t dest_port;
994 		struct in_addr dest_addr;
995 	} s4_req, s4_rsp;
996 
997 	debug2("channel %d: decode socks4", c->self);
998 
999 	have = buffer_len(&c->input);
1000 	len = sizeof(s4_req);
1001 	if (have < len)
1002 		return 0;
1003 	p = buffer_ptr(&c->input);
1004 
1005 	need = 1;
1006 	/* SOCKS4A uses an invalid IP address 0.0.0.x */
1007 	if (p[4] == 0 && p[5] == 0 && p[6] == 0 && p[7] != 0) {
1008 		debug2("channel %d: socks4a request", c->self);
1009 		/* ... and needs an extra string (the hostname) */
1010 		need = 2;
1011 	}
1012 	/* Check for terminating NUL on the string(s) */
1013 	for (found = 0, i = len; i < have; i++) {
1014 		if (p[i] == '\0') {
1015 			found++;
1016 			if (found == need)
1017 				break;
1018 		}
1019 		if (i > 1024) {
1020 			/* the peer is probably sending garbage */
1021 			debug("channel %d: decode socks4: too long",
1022 			    c->self);
1023 			return -1;
1024 		}
1025 	}
1026 	if (found < need)
1027 		return 0;
1028 	buffer_get(&c->input, (char *)&s4_req.version, 1);
1029 	buffer_get(&c->input, (char *)&s4_req.command, 1);
1030 	buffer_get(&c->input, (char *)&s4_req.dest_port, 2);
1031 	buffer_get(&c->input, (char *)&s4_req.dest_addr, 4);
1032 	have = buffer_len(&c->input);
1033 	p = buffer_ptr(&c->input);
1034 	len = strlen(p);
1035 	debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
1036 	len++;					/* trailing '\0' */
1037 	if (len > have)
1038 		fatal("channel %d: decode socks4: len %d > have %d",
1039 		    c->self, len, have);
1040 	strlcpy(username, p, sizeof(username));
1041 	buffer_consume(&c->input, len);
1042 
1043 	if (c->path != NULL) {
1044 		xfree(c->path);
1045 		c->path = NULL;
1046 	}
1047 	if (need == 1) {			/* SOCKS4: one string */
1048 		host = inet_ntoa(s4_req.dest_addr);
1049 		c->path = xstrdup(host);
1050 	} else {				/* SOCKS4A: two strings */
1051 		have = buffer_len(&c->input);
1052 		p = buffer_ptr(&c->input);
1053 		len = strlen(p);
1054 		debug2("channel %d: decode socks4a: host %s/%d",
1055 		    c->self, p, len);
1056 		len++;				/* trailing '\0' */
1057 		if (len > have)
1058 			fatal("channel %d: decode socks4a: len %d > have %d",
1059 			    c->self, len, have);
1060 		if (len > NI_MAXHOST) {
1061 			error("channel %d: hostname \"%.100s\" too long",
1062 			    c->self, p);
1063 			return -1;
1064 		}
1065 		c->path = xstrdup(p);
1066 		buffer_consume(&c->input, len);
1067 	}
1068 	c->host_port = ntohs(s4_req.dest_port);
1069 
1070 	debug2("channel %d: dynamic request: socks4 host %s port %u command %u",
1071 	    c->self, c->path, c->host_port, s4_req.command);
1072 
1073 	if (s4_req.command != 1) {
1074 		debug("channel %d: cannot handle: %s cn %d",
1075 		    c->self, need == 1 ? "SOCKS4" : "SOCKS4A", s4_req.command);
1076 		return -1;
1077 	}
1078 	s4_rsp.version = 0;			/* vn: 0 for reply */
1079 	s4_rsp.command = 90;			/* cd: req granted */
1080 	s4_rsp.dest_port = 0;			/* ignored */
1081 	s4_rsp.dest_addr.s_addr = INADDR_ANY;	/* ignored */
1082 	buffer_append(&c->output, &s4_rsp, sizeof(s4_rsp));
1083 	return 1;
1084 }
1085 
1086 /* try to decode a socks5 header */
1087 #define SSH_SOCKS5_AUTHDONE	0x1000
1088 #define SSH_SOCKS5_NOAUTH	0x00
1089 #define SSH_SOCKS5_IPV4		0x01
1090 #define SSH_SOCKS5_DOMAIN	0x03
1091 #define SSH_SOCKS5_IPV6		0x04
1092 #define SSH_SOCKS5_CONNECT	0x01
1093 #define SSH_SOCKS5_SUCCESS	0x00
1094 
1095 /* ARGSUSED */
1096 static int
1097 channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset)
1098 {
1099 	struct {
1100 		u_int8_t version;
1101 		u_int8_t command;
1102 		u_int8_t reserved;
1103 		u_int8_t atyp;
1104 	} s5_req, s5_rsp;
1105 	u_int16_t dest_port;
1106 	u_char *p, dest_addr[255+1], ntop[INET6_ADDRSTRLEN];
1107 	u_int have, need, i, found, nmethods, addrlen, af;
1108 
1109 	debug2("channel %d: decode socks5", c->self);
1110 	p = buffer_ptr(&c->input);
1111 	if (p[0] != 0x05)
1112 		return -1;
1113 	have = buffer_len(&c->input);
1114 	if (!(c->flags & SSH_SOCKS5_AUTHDONE)) {
1115 		/* format: ver | nmethods | methods */
1116 		if (have < 2)
1117 			return 0;
1118 		nmethods = p[1];
1119 		if (have < nmethods + 2)
1120 			return 0;
1121 		/* look for method: "NO AUTHENTICATION REQUIRED" */
1122 		for (found = 0, i = 2; i < nmethods + 2; i++) {
1123 			if (p[i] == SSH_SOCKS5_NOAUTH) {
1124 				found = 1;
1125 				break;
1126 			}
1127 		}
1128 		if (!found) {
1129 			debug("channel %d: method SSH_SOCKS5_NOAUTH not found",
1130 			    c->self);
1131 			return -1;
1132 		}
1133 		buffer_consume(&c->input, nmethods + 2);
1134 		buffer_put_char(&c->output, 0x05);		/* version */
1135 		buffer_put_char(&c->output, SSH_SOCKS5_NOAUTH);	/* method */
1136 		FD_SET(c->sock, writeset);
1137 		c->flags |= SSH_SOCKS5_AUTHDONE;
1138 		debug2("channel %d: socks5 auth done", c->self);
1139 		return 0;				/* need more */
1140 	}
1141 	debug2("channel %d: socks5 post auth", c->self);
1142 	if (have < sizeof(s5_req)+1)
1143 		return 0;			/* need more */
1144 	memcpy(&s5_req, p, sizeof(s5_req));
1145 	if (s5_req.version != 0x05 ||
1146 	    s5_req.command != SSH_SOCKS5_CONNECT ||
1147 	    s5_req.reserved != 0x00) {
1148 		debug2("channel %d: only socks5 connect supported", c->self);
1149 		return -1;
1150 	}
1151 	switch (s5_req.atyp){
1152 	case SSH_SOCKS5_IPV4:
1153 		addrlen = 4;
1154 		af = AF_INET;
1155 		break;
1156 	case SSH_SOCKS5_DOMAIN:
1157 		addrlen = p[sizeof(s5_req)];
1158 		af = -1;
1159 		break;
1160 	case SSH_SOCKS5_IPV6:
1161 		addrlen = 16;
1162 		af = AF_INET6;
1163 		break;
1164 	default:
1165 		debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp);
1166 		return -1;
1167 	}
1168 	need = sizeof(s5_req) + addrlen + 2;
1169 	if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
1170 		need++;
1171 	if (have < need)
1172 		return 0;
1173 	buffer_consume(&c->input, sizeof(s5_req));
1174 	if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
1175 		buffer_consume(&c->input, 1);    /* host string length */
1176 	buffer_get(&c->input, (char *)&dest_addr, addrlen);
1177 	buffer_get(&c->input, (char *)&dest_port, 2);
1178 	dest_addr[addrlen] = '\0';
1179 	if (c->path != NULL) {
1180 		xfree(c->path);
1181 		c->path = NULL;
1182 	}
1183 	if (s5_req.atyp == SSH_SOCKS5_DOMAIN) {
1184 		if (addrlen >= NI_MAXHOST) {
1185 			error("channel %d: dynamic request: socks5 hostname "
1186 			    "\"%.100s\" too long", c->self, dest_addr);
1187 			return -1;
1188 		}
1189 		c->path = xstrdup(dest_addr);
1190 	} else {
1191 		if (inet_ntop(af, dest_addr, ntop, sizeof(ntop)) == NULL)
1192 			return -1;
1193 		c->path = xstrdup(ntop);
1194 	}
1195 	c->host_port = ntohs(dest_port);
1196 
1197 	debug2("channel %d: dynamic request: socks5 host %s port %u command %u",
1198 	    c->self, c->path, c->host_port, s5_req.command);
1199 
1200 	s5_rsp.version = 0x05;
1201 	s5_rsp.command = SSH_SOCKS5_SUCCESS;
1202 	s5_rsp.reserved = 0;			/* ignored */
1203 	s5_rsp.atyp = SSH_SOCKS5_IPV4;
1204 	((struct in_addr *)&dest_addr)->s_addr = INADDR_ANY;
1205 	dest_port = 0;				/* ignored */
1206 
1207 	buffer_append(&c->output, &s5_rsp, sizeof(s5_rsp));
1208 	buffer_append(&c->output, &dest_addr, sizeof(struct in_addr));
1209 	buffer_append(&c->output, &dest_port, sizeof(dest_port));
1210 	return 1;
1211 }
1212 
1213 /* dynamic port forwarding */
1214 static void
1215 channel_pre_dynamic(Channel *c, fd_set *readset, fd_set *writeset)
1216 {
1217 	u_char *p;
1218 	u_int have;
1219 	int ret;
1220 
1221 	have = buffer_len(&c->input);
1222 	c->delayed = 0;
1223 	debug2("channel %d: pre_dynamic: have %d", c->self, have);
1224 	/* buffer_dump(&c->input); */
1225 	/* check if the fixed size part of the packet is in buffer. */
1226 	if (have < 3) {
1227 		/* need more */
1228 		FD_SET(c->sock, readset);
1229 		return;
1230 	}
1231 	/* try to guess the protocol */
1232 	p = buffer_ptr(&c->input);
1233 	switch (p[0]) {
1234 	case 0x04:
1235 		ret = channel_decode_socks4(c, readset, writeset);
1236 		break;
1237 	case 0x05:
1238 		ret = channel_decode_socks5(c, readset, writeset);
1239 		break;
1240 	default:
1241 		ret = -1;
1242 		break;
1243 	}
1244 	if (ret < 0) {
1245 		chan_mark_dead(c);
1246 	} else if (ret == 0) {
1247 		debug2("channel %d: pre_dynamic: need more", c->self);
1248 		/* need more */
1249 		FD_SET(c->sock, readset);
1250 	} else {
1251 		/* switch to the next state */
1252 		c->type = SSH_CHANNEL_OPENING;
1253 		port_open_helper(c, "direct-tcpip");
1254 	}
1255 }
1256 
1257 /* This is our fake X11 server socket. */
1258 /* ARGSUSED */
1259 static void
1260 channel_post_x11_listener(Channel *c, fd_set *readset, fd_set *writeset)
1261 {
1262 	Channel *nc;
1263 	struct sockaddr_storage addr;
1264 	int newsock;
1265 	socklen_t addrlen;
1266 	char buf[16384], *remote_ipaddr;
1267 	int remote_port;
1268 
1269 	if (FD_ISSET(c->sock, readset)) {
1270 		debug("X11 connection requested.");
1271 		addrlen = sizeof(addr);
1272 		newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen);
1273 		if (c->single_connection) {
1274 			debug2("single_connection: closing X11 listener.");
1275 			channel_close_fd(&c->sock);
1276 			chan_mark_dead(c);
1277 		}
1278 		if (newsock < 0) {
1279 			error("accept: %.100s", strerror(errno));
1280 			return;
1281 		}
1282 		set_nodelay(newsock);
1283 		remote_ipaddr = get_peer_ipaddr(newsock);
1284 		remote_port = get_peer_port(newsock);
1285 		snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
1286 		    remote_ipaddr, remote_port);
1287 
1288 		nc = channel_new("accepted x11 socket",
1289 		    SSH_CHANNEL_OPENING, newsock, newsock, -1,
1290 		    c->local_window_max, c->local_maxpacket, 0, buf, 1);
1291 		if (compat20) {
1292 			packet_start(SSH2_MSG_CHANNEL_OPEN);
1293 			packet_put_cstring("x11");
1294 			packet_put_int(nc->self);
1295 			packet_put_int(nc->local_window_max);
1296 			packet_put_int(nc->local_maxpacket);
1297 			/* originator ipaddr and port */
1298 			packet_put_cstring(remote_ipaddr);
1299 			if (datafellows & SSH_BUG_X11FWD) {
1300 				debug2("ssh2 x11 bug compat mode");
1301 			} else {
1302 				packet_put_int(remote_port);
1303 			}
1304 			packet_send();
1305 		} else {
1306 			packet_start(SSH_SMSG_X11_OPEN);
1307 			packet_put_int(nc->self);
1308 			if (packet_get_protocol_flags() &
1309 			    SSH_PROTOFLAG_HOST_IN_FWD_OPEN)
1310 				packet_put_cstring(buf);
1311 			packet_send();
1312 		}
1313 		xfree(remote_ipaddr);
1314 	}
1315 }
1316 
1317 static void
1318 port_open_helper(Channel *c, char *rtype)
1319 {
1320 	int direct;
1321 	char buf[1024];
1322 	char *remote_ipaddr = get_peer_ipaddr(c->sock);
1323 	int remote_port = get_peer_port(c->sock);
1324 
1325 	direct = (strcmp(rtype, "direct-tcpip") == 0);
1326 
1327 	snprintf(buf, sizeof buf,
1328 	    "%s: listening port %d for %.100s port %d, "
1329 	    "connect from %.200s port %d",
1330 	    rtype, c->listening_port, c->path, c->host_port,
1331 	    remote_ipaddr, remote_port);
1332 
1333 	xfree(c->remote_name);
1334 	c->remote_name = xstrdup(buf);
1335 
1336 	if (compat20) {
1337 		packet_start(SSH2_MSG_CHANNEL_OPEN);
1338 		packet_put_cstring(rtype);
1339 		packet_put_int(c->self);
1340 		packet_put_int(c->local_window_max);
1341 		packet_put_int(c->local_maxpacket);
1342 		if (direct) {
1343 			/* target host, port */
1344 			packet_put_cstring(c->path);
1345 			packet_put_int(c->host_port);
1346 		} else {
1347 			/* listen address, port */
1348 			packet_put_cstring(c->path);
1349 			packet_put_int(c->listening_port);
1350 		}
1351 		/* originator host and port */
1352 		packet_put_cstring(remote_ipaddr);
1353 		packet_put_int((u_int)remote_port);
1354 		packet_send();
1355 	} else {
1356 		packet_start(SSH_MSG_PORT_OPEN);
1357 		packet_put_int(c->self);
1358 		packet_put_cstring(c->path);
1359 		packet_put_int(c->host_port);
1360 		if (packet_get_protocol_flags() &
1361 		    SSH_PROTOFLAG_HOST_IN_FWD_OPEN)
1362 			packet_put_cstring(c->remote_name);
1363 		packet_send();
1364 	}
1365 	xfree(remote_ipaddr);
1366 }
1367 
1368 static void
1369 channel_set_reuseaddr(int fd)
1370 {
1371 	int on = 1;
1372 
1373 	/*
1374 	 * Set socket options.
1375 	 * Allow local port reuse in TIME_WAIT.
1376 	 */
1377 	if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1)
1378 		error("setsockopt SO_REUSEADDR fd %d: %s", fd, strerror(errno));
1379 }
1380 
1381 /*
1382  * This socket is listening for connections to a forwarded TCP/IP port.
1383  */
1384 /* ARGSUSED */
1385 static void
1386 channel_post_port_listener(Channel *c, fd_set *readset, fd_set *writeset)
1387 {
1388 	Channel *nc;
1389 	struct sockaddr_storage addr;
1390 	int newsock, nextstate;
1391 	socklen_t addrlen;
1392 	char *rtype;
1393 
1394 	if (FD_ISSET(c->sock, readset)) {
1395 		debug("Connection to port %d forwarding "
1396 		    "to %.100s port %d requested.",
1397 		    c->listening_port, c->path, c->host_port);
1398 
1399 		if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
1400 			nextstate = SSH_CHANNEL_OPENING;
1401 			rtype = "forwarded-tcpip";
1402 		} else {
1403 			if (c->host_port == 0) {
1404 				nextstate = SSH_CHANNEL_DYNAMIC;
1405 				rtype = "dynamic-tcpip";
1406 			} else {
1407 				nextstate = SSH_CHANNEL_OPENING;
1408 				rtype = "direct-tcpip";
1409 			}
1410 		}
1411 
1412 		addrlen = sizeof(addr);
1413 		newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen);
1414 		if (newsock < 0) {
1415 			error("accept: %.100s", strerror(errno));
1416 			return;
1417 		}
1418 		set_nodelay(newsock);
1419 		nc = channel_new(rtype, nextstate, newsock, newsock, -1,
1420 		    c->local_window_max, c->local_maxpacket, 0, rtype, 1);
1421 		nc->listening_port = c->listening_port;
1422 		nc->host_port = c->host_port;
1423 		if (c->path != NULL)
1424 			nc->path = xstrdup(c->path);
1425 
1426 		if (nextstate == SSH_CHANNEL_DYNAMIC) {
1427 			/*
1428 			 * do not call the channel_post handler until
1429 			 * this flag has been reset by a pre-handler.
1430 			 * otherwise the FD_ISSET calls might overflow
1431 			 */
1432 			nc->delayed = 1;
1433 		} else {
1434 			port_open_helper(nc, rtype);
1435 		}
1436 	}
1437 }
1438 
1439 /*
1440  * This is the authentication agent socket listening for connections from
1441  * clients.
1442  */
1443 /* ARGSUSED */
1444 static void
1445 channel_post_auth_listener(Channel *c, fd_set *readset, fd_set *writeset)
1446 {
1447 	Channel *nc;
1448 	int newsock;
1449 	struct sockaddr_storage addr;
1450 	socklen_t addrlen;
1451 
1452 	if (FD_ISSET(c->sock, readset)) {
1453 		addrlen = sizeof(addr);
1454 		newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen);
1455 		if (newsock < 0) {
1456 			error("accept from auth socket: %.100s", strerror(errno));
1457 			return;
1458 		}
1459 		nc = channel_new("accepted auth socket",
1460 		    SSH_CHANNEL_OPENING, newsock, newsock, -1,
1461 		    c->local_window_max, c->local_maxpacket,
1462 		    0, "accepted auth socket", 1);
1463 		if (compat20) {
1464 			packet_start(SSH2_MSG_CHANNEL_OPEN);
1465 			packet_put_cstring("auth-agent@openssh.com");
1466 			packet_put_int(nc->self);
1467 			packet_put_int(c->local_window_max);
1468 			packet_put_int(c->local_maxpacket);
1469 		} else {
1470 			packet_start(SSH_SMSG_AGENT_OPEN);
1471 			packet_put_int(nc->self);
1472 		}
1473 		packet_send();
1474 	}
1475 }
1476 
1477 /* ARGSUSED */
1478 static void
1479 channel_post_connecting(Channel *c, fd_set *readset, fd_set *writeset)
1480 {
1481 	int err = 0, sock;
1482 	socklen_t sz = sizeof(err);
1483 
1484 	if (FD_ISSET(c->sock, writeset)) {
1485 		if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, &err, &sz) < 0) {
1486 			err = errno;
1487 			error("getsockopt SO_ERROR failed");
1488 		}
1489 		if (err == 0) {
1490 			debug("channel %d: connected to %s port %d",
1491 			    c->self, c->connect_ctx.host, c->connect_ctx.port);
1492 			channel_connect_ctx_free(&c->connect_ctx);
1493 			c->type = SSH_CHANNEL_OPEN;
1494 			if (compat20) {
1495 				packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
1496 				packet_put_int(c->remote_id);
1497 				packet_put_int(c->self);
1498 				packet_put_int(c->local_window);
1499 				packet_put_int(c->local_maxpacket);
1500 			} else {
1501 				packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1502 				packet_put_int(c->remote_id);
1503 				packet_put_int(c->self);
1504 			}
1505 		} else {
1506 			debug("channel %d: connection failed: %s",
1507 			    c->self, strerror(err));
1508 			/* Try next address, if any */
1509 			if ((sock = connect_next(&c->connect_ctx)) > 0) {
1510 				close(c->sock);
1511 				c->sock = c->rfd = c->wfd = sock;
1512 				channel_max_fd = channel_find_maxfd();
1513 				return;
1514 			}
1515 			/* Exhausted all addresses */
1516 			error("connect_to %.100s port %d: failed.",
1517 			    c->connect_ctx.host, c->connect_ctx.port);
1518 			channel_connect_ctx_free(&c->connect_ctx);
1519 			if (compat20) {
1520 				packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE);
1521 				packet_put_int(c->remote_id);
1522 				packet_put_int(SSH2_OPEN_CONNECT_FAILED);
1523 				if (!(datafellows & SSH_BUG_OPENFAILURE)) {
1524 					packet_put_cstring(strerror(err));
1525 					packet_put_cstring("");
1526 				}
1527 			} else {
1528 				packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1529 				packet_put_int(c->remote_id);
1530 			}
1531 			chan_mark_dead(c);
1532 		}
1533 		packet_send();
1534 	}
1535 }
1536 
1537 /* ARGSUSED */
1538 static int
1539 channel_handle_rfd(Channel *c, fd_set *readset, fd_set *writeset)
1540 {
1541 	char buf[CHAN_RBUF];
1542 	int len, force;
1543 
1544 	force = c->isatty && c->detach_close && c->istate != CHAN_INPUT_CLOSED;
1545 	if (c->rfd != -1 && (force || FD_ISSET(c->rfd, readset))) {
1546 		errno = 0;
1547 		len = read(c->rfd, buf, sizeof(buf));
1548 		if (len < 0 && (errno == EINTR ||
1549 		    ((errno == EAGAIN || errno == EWOULDBLOCK) && !force)))
1550 			return 1;
1551 #ifndef PTY_ZEROREAD
1552 		if (len <= 0) {
1553 #else
1554 		if ((!c->isatty && len <= 0) ||
1555 		    (c->isatty && (len < 0 || (len == 0 && errno != 0)))) {
1556 #endif
1557 			debug2("channel %d: read<=0 rfd %d len %d",
1558 			    c->self, c->rfd, len);
1559 			if (c->type != SSH_CHANNEL_OPEN) {
1560 				debug2("channel %d: not open", c->self);
1561 				chan_mark_dead(c);
1562 				return -1;
1563 			} else if (compat13) {
1564 				buffer_clear(&c->output);
1565 				c->type = SSH_CHANNEL_INPUT_DRAINING;
1566 				debug2("channel %d: input draining.", c->self);
1567 			} else {
1568 				chan_read_failed(c);
1569 			}
1570 			return -1;
1571 		}
1572 		if (c->input_filter != NULL) {
1573 			if (c->input_filter(c, buf, len) == -1) {
1574 				debug2("channel %d: filter stops", c->self);
1575 				chan_read_failed(c);
1576 			}
1577 		} else if (c->datagram) {
1578 			buffer_put_string(&c->input, buf, len);
1579 		} else {
1580 			buffer_append(&c->input, buf, len);
1581 		}
1582 	}
1583 	return 1;
1584 }
1585 
1586 /* ARGSUSED */
1587 static int
1588 channel_handle_wfd(Channel *c, fd_set *readset, fd_set *writeset)
1589 {
1590 	struct termios tio;
1591 	u_char *data = NULL, *buf;
1592 	u_int dlen;
1593 	int len;
1594 
1595 	/* Send buffered output data to the socket. */
1596 	if (c->wfd != -1 &&
1597 	    FD_ISSET(c->wfd, writeset) &&
1598 	    buffer_len(&c->output) > 0) {
1599 		if (c->output_filter != NULL) {
1600 			if ((buf = c->output_filter(c, &data, &dlen)) == NULL) {
1601 				debug2("channel %d: filter stops", c->self);
1602 				if (c->type != SSH_CHANNEL_OPEN)
1603 					chan_mark_dead(c);
1604 				else
1605 					chan_write_failed(c);
1606 				return -1;
1607 			}
1608 		} else if (c->datagram) {
1609 			buf = data = buffer_get_string(&c->output, &dlen);
1610 		} else {
1611 			buf = data = buffer_ptr(&c->output);
1612 			dlen = buffer_len(&c->output);
1613 		}
1614 
1615 		if (c->datagram) {
1616 			/* ignore truncated writes, datagrams might get lost */
1617 			c->local_consumed += dlen + 4;
1618 			len = write(c->wfd, buf, dlen);
1619 			xfree(data);
1620 			if (len < 0 && (errno == EINTR || errno == EAGAIN ||
1621 			    errno == EWOULDBLOCK))
1622 				return 1;
1623 			if (len <= 0) {
1624 				if (c->type != SSH_CHANNEL_OPEN)
1625 					chan_mark_dead(c);
1626 				else
1627 					chan_write_failed(c);
1628 				return -1;
1629 			}
1630 			return 1;
1631 		}
1632 #ifdef _AIX
1633 		/* XXX: Later AIX versions can't push as much data to tty */
1634 		if (compat20 && c->wfd_isatty)
1635 			dlen = MIN(dlen, 8*1024);
1636 #endif
1637 
1638 		len = write(c->wfd, buf, dlen);
1639 		if (len < 0 &&
1640 		    (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK))
1641 			return 1;
1642 		if (len <= 0) {
1643 			if (c->type != SSH_CHANNEL_OPEN) {
1644 				debug2("channel %d: not open", c->self);
1645 				chan_mark_dead(c);
1646 				return -1;
1647 			} else if (compat13) {
1648 				buffer_clear(&c->output);
1649 				debug2("channel %d: input draining.", c->self);
1650 				c->type = SSH_CHANNEL_INPUT_DRAINING;
1651 			} else {
1652 				chan_write_failed(c);
1653 			}
1654 			return -1;
1655 		}
1656 #ifndef BROKEN_TCGETATTR_ICANON
1657 		if (compat20 && c->isatty && dlen >= 1 && buf[0] != '\r') {
1658 			if (tcgetattr(c->wfd, &tio) == 0 &&
1659 			    !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
1660 				/*
1661 				 * Simulate echo to reduce the impact of
1662 				 * traffic analysis. We need to match the
1663 				 * size of a SSH2_MSG_CHANNEL_DATA message
1664 				 * (4 byte channel id + buf)
1665 				 */
1666 				packet_send_ignore(4 + len);
1667 				packet_send();
1668 			}
1669 		}
1670 #endif
1671 		buffer_consume(&c->output, len);
1672 		if (compat20 && len > 0) {
1673 			c->local_consumed += len;
1674 		}
1675 	}
1676 	return 1;
1677 }
1678 
1679 static int
1680 channel_handle_efd(Channel *c, fd_set *readset, fd_set *writeset)
1681 {
1682 	char buf[CHAN_RBUF];
1683 	int len;
1684 
1685 /** XXX handle drain efd, too */
1686 	if (c->efd != -1) {
1687 		if (c->extended_usage == CHAN_EXTENDED_WRITE &&
1688 		    FD_ISSET(c->efd, writeset) &&
1689 		    buffer_len(&c->extended) > 0) {
1690 			len = write(c->efd, buffer_ptr(&c->extended),
1691 			    buffer_len(&c->extended));
1692 			debug2("channel %d: written %d to efd %d",
1693 			    c->self, len, c->efd);
1694 			if (len < 0 && (errno == EINTR || errno == EAGAIN ||
1695 			    errno == EWOULDBLOCK))
1696 				return 1;
1697 			if (len <= 0) {
1698 				debug2("channel %d: closing write-efd %d",
1699 				    c->self, c->efd);
1700 				channel_close_fd(&c->efd);
1701 			} else {
1702 				buffer_consume(&c->extended, len);
1703 				c->local_consumed += len;
1704 			}
1705 		} else if (c->extended_usage == CHAN_EXTENDED_READ &&
1706 		    (c->detach_close || FD_ISSET(c->efd, readset))) {
1707 			len = read(c->efd, buf, sizeof(buf));
1708 			debug2("channel %d: read %d from efd %d",
1709 			    c->self, len, c->efd);
1710 			if (len < 0 && (errno == EINTR || ((errno == EAGAIN ||
1711 			    errno == EWOULDBLOCK) && !c->detach_close)))
1712 				return 1;
1713 			if (len <= 0) {
1714 				debug2("channel %d: closing read-efd %d",
1715 				    c->self, c->efd);
1716 				channel_close_fd(&c->efd);
1717 			} else {
1718 				buffer_append(&c->extended, buf, len);
1719 			}
1720 		}
1721 	}
1722 	return 1;
1723 }
1724 
1725 /* ARGSUSED */
1726 static int
1727 channel_handle_ctl(Channel *c, fd_set *readset, fd_set *writeset)
1728 {
1729 	char buf[16];
1730 	int len;
1731 
1732 	/* Monitor control fd to detect if the slave client exits */
1733 	if (c->ctl_fd != -1 && FD_ISSET(c->ctl_fd, readset)) {
1734 		len = read(c->ctl_fd, buf, sizeof(buf));
1735 		if (len < 0 &&
1736 		    (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK))
1737 			return 1;
1738 		if (len <= 0) {
1739 			debug2("channel %d: ctl read<=0", c->self);
1740 			if (c->type != SSH_CHANNEL_OPEN) {
1741 				debug2("channel %d: not open", c->self);
1742 				chan_mark_dead(c);
1743 				return -1;
1744 			} else {
1745 				chan_read_failed(c);
1746 				chan_write_failed(c);
1747 			}
1748 			return -1;
1749 		} else
1750 			fatal("%s: unexpected data on ctl fd", __func__);
1751 	}
1752 	return 1;
1753 }
1754 
1755 static int
1756 channel_check_window(Channel *c)
1757 {
1758 	if (c->type == SSH_CHANNEL_OPEN &&
1759 	    !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
1760 	    ((c->local_window_max - c->local_window >
1761 	    c->local_maxpacket*3) ||
1762 	    c->local_window < c->local_window_max/2) &&
1763 	    c->local_consumed > 0) {
1764 		packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
1765 		packet_put_int(c->remote_id);
1766 		packet_put_int(c->local_consumed);
1767 		packet_send();
1768 		debug2("channel %d: window %d sent adjust %d",
1769 		    c->self, c->local_window,
1770 		    c->local_consumed);
1771 		c->local_window += c->local_consumed;
1772 		c->local_consumed = 0;
1773 	}
1774 	return 1;
1775 }
1776 
1777 static void
1778 channel_post_open(Channel *c, fd_set *readset, fd_set *writeset)
1779 {
1780 	if (c->delayed)
1781 		return;
1782 	channel_handle_rfd(c, readset, writeset);
1783 	channel_handle_wfd(c, readset, writeset);
1784 	if (!compat20)
1785 		return;
1786 	channel_handle_efd(c, readset, writeset);
1787 	channel_handle_ctl(c, readset, writeset);
1788 	channel_check_window(c);
1789 }
1790 
1791 /* ARGSUSED */
1792 static void
1793 channel_post_output_drain_13(Channel *c, fd_set *readset, fd_set *writeset)
1794 {
1795 	int len;
1796 
1797 	/* Send buffered output data to the socket. */
1798 	if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
1799 		len = write(c->sock, buffer_ptr(&c->output),
1800 			    buffer_len(&c->output));
1801 		if (len <= 0)
1802 			buffer_clear(&c->output);
1803 		else
1804 			buffer_consume(&c->output, len);
1805 	}
1806 }
1807 
1808 static void
1809 channel_handler_init_20(void)
1810 {
1811 	channel_pre[SSH_CHANNEL_OPEN] =			&channel_pre_open;
1812 	channel_pre[SSH_CHANNEL_X11_OPEN] =		&channel_pre_x11_open;
1813 	channel_pre[SSH_CHANNEL_PORT_LISTENER] =	&channel_pre_listener;
1814 	channel_pre[SSH_CHANNEL_RPORT_LISTENER] =	&channel_pre_listener;
1815 	channel_pre[SSH_CHANNEL_X11_LISTENER] =		&channel_pre_listener;
1816 	channel_pre[SSH_CHANNEL_AUTH_SOCKET] =		&channel_pre_listener;
1817 	channel_pre[SSH_CHANNEL_CONNECTING] =		&channel_pre_connecting;
1818 	channel_pre[SSH_CHANNEL_DYNAMIC] =		&channel_pre_dynamic;
1819 
1820 	channel_post[SSH_CHANNEL_OPEN] =		&channel_post_open;
1821 	channel_post[SSH_CHANNEL_PORT_LISTENER] =	&channel_post_port_listener;
1822 	channel_post[SSH_CHANNEL_RPORT_LISTENER] =	&channel_post_port_listener;
1823 	channel_post[SSH_CHANNEL_X11_LISTENER] =	&channel_post_x11_listener;
1824 	channel_post[SSH_CHANNEL_AUTH_SOCKET] =		&channel_post_auth_listener;
1825 	channel_post[SSH_CHANNEL_CONNECTING] =		&channel_post_connecting;
1826 	channel_post[SSH_CHANNEL_DYNAMIC] =		&channel_post_open;
1827 }
1828 
1829 static void
1830 channel_handler_init_13(void)
1831 {
1832 	channel_pre[SSH_CHANNEL_OPEN] =			&channel_pre_open_13;
1833 	channel_pre[SSH_CHANNEL_X11_OPEN] =		&channel_pre_x11_open_13;
1834 	channel_pre[SSH_CHANNEL_X11_LISTENER] =		&channel_pre_listener;
1835 	channel_pre[SSH_CHANNEL_PORT_LISTENER] =	&channel_pre_listener;
1836 	channel_pre[SSH_CHANNEL_AUTH_SOCKET] =		&channel_pre_listener;
1837 	channel_pre[SSH_CHANNEL_INPUT_DRAINING] =	&channel_pre_input_draining;
1838 	channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] =	&channel_pre_output_draining;
1839 	channel_pre[SSH_CHANNEL_CONNECTING] =		&channel_pre_connecting;
1840 	channel_pre[SSH_CHANNEL_DYNAMIC] =		&channel_pre_dynamic;
1841 
1842 	channel_post[SSH_CHANNEL_OPEN] =		&channel_post_open;
1843 	channel_post[SSH_CHANNEL_X11_LISTENER] =	&channel_post_x11_listener;
1844 	channel_post[SSH_CHANNEL_PORT_LISTENER] =	&channel_post_port_listener;
1845 	channel_post[SSH_CHANNEL_AUTH_SOCKET] =		&channel_post_auth_listener;
1846 	channel_post[SSH_CHANNEL_OUTPUT_DRAINING] =	&channel_post_output_drain_13;
1847 	channel_post[SSH_CHANNEL_CONNECTING] =		&channel_post_connecting;
1848 	channel_post[SSH_CHANNEL_DYNAMIC] =		&channel_post_open;
1849 }
1850 
1851 static void
1852 channel_handler_init_15(void)
1853 {
1854 	channel_pre[SSH_CHANNEL_OPEN] =			&channel_pre_open;
1855 	channel_pre[SSH_CHANNEL_X11_OPEN] =		&channel_pre_x11_open;
1856 	channel_pre[SSH_CHANNEL_X11_LISTENER] =		&channel_pre_listener;
1857 	channel_pre[SSH_CHANNEL_PORT_LISTENER] =	&channel_pre_listener;
1858 	channel_pre[SSH_CHANNEL_AUTH_SOCKET] =		&channel_pre_listener;
1859 	channel_pre[SSH_CHANNEL_CONNECTING] =		&channel_pre_connecting;
1860 	channel_pre[SSH_CHANNEL_DYNAMIC] =		&channel_pre_dynamic;
1861 
1862 	channel_post[SSH_CHANNEL_X11_LISTENER] =	&channel_post_x11_listener;
1863 	channel_post[SSH_CHANNEL_PORT_LISTENER] =	&channel_post_port_listener;
1864 	channel_post[SSH_CHANNEL_AUTH_SOCKET] =		&channel_post_auth_listener;
1865 	channel_post[SSH_CHANNEL_OPEN] =		&channel_post_open;
1866 	channel_post[SSH_CHANNEL_CONNECTING] =		&channel_post_connecting;
1867 	channel_post[SSH_CHANNEL_DYNAMIC] =		&channel_post_open;
1868 }
1869 
1870 static void
1871 channel_handler_init(void)
1872 {
1873 	int i;
1874 
1875 	for (i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
1876 		channel_pre[i] = NULL;
1877 		channel_post[i] = NULL;
1878 	}
1879 	if (compat20)
1880 		channel_handler_init_20();
1881 	else if (compat13)
1882 		channel_handler_init_13();
1883 	else
1884 		channel_handler_init_15();
1885 }
1886 
1887 /* gc dead channels */
1888 static void
1889 channel_garbage_collect(Channel *c)
1890 {
1891 	if (c == NULL)
1892 		return;
1893 	if (c->detach_user != NULL) {
1894 		if (!chan_is_dead(c, c->detach_close))
1895 			return;
1896 		debug2("channel %d: gc: notify user", c->self);
1897 		c->detach_user(c->self, NULL);
1898 		/* if we still have a callback */
1899 		if (c->detach_user != NULL)
1900 			return;
1901 		debug2("channel %d: gc: user detached", c->self);
1902 	}
1903 	if (!chan_is_dead(c, 1))
1904 		return;
1905 	debug2("channel %d: garbage collecting", c->self);
1906 	channel_free(c);
1907 }
1908 
1909 static void
1910 channel_handler(chan_fn *ftab[], fd_set *readset, fd_set *writeset)
1911 {
1912 	static int did_init = 0;
1913 	u_int i;
1914 	Channel *c;
1915 
1916 	if (!did_init) {
1917 		channel_handler_init();
1918 		did_init = 1;
1919 	}
1920 	for (i = 0; i < channels_alloc; i++) {
1921 		c = channels[i];
1922 		if (c == NULL)
1923 			continue;
1924 		if (ftab[c->type] != NULL)
1925 			(*ftab[c->type])(c, readset, writeset);
1926 		channel_garbage_collect(c);
1927 	}
1928 }
1929 
1930 /*
1931  * Allocate/update select bitmasks and add any bits relevant to channels in
1932  * select bitmasks.
1933  */
1934 void
1935 channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp,
1936     u_int *nallocp, int rekeying)
1937 {
1938 	u_int n, sz, nfdset;
1939 
1940 	n = MAX(*maxfdp, channel_max_fd);
1941 
1942 	nfdset = howmany(n+1, NFDBITS);
1943 	/* Explicitly test here, because xrealloc isn't always called */
1944 	if (nfdset && SIZE_T_MAX / nfdset < sizeof(fd_mask))
1945 		fatal("channel_prepare_select: max_fd (%d) is too large", n);
1946 	sz = nfdset * sizeof(fd_mask);
1947 
1948 	/* perhaps check sz < nalloc/2 and shrink? */
1949 	if (*readsetp == NULL || sz > *nallocp) {
1950 		*readsetp = xrealloc(*readsetp, nfdset, sizeof(fd_mask));
1951 		*writesetp = xrealloc(*writesetp, nfdset, sizeof(fd_mask));
1952 		*nallocp = sz;
1953 	}
1954 	*maxfdp = n;
1955 	memset(*readsetp, 0, sz);
1956 	memset(*writesetp, 0, sz);
1957 
1958 	if (!rekeying)
1959 		channel_handler(channel_pre, *readsetp, *writesetp);
1960 }
1961 
1962 /*
1963  * After select, perform any appropriate operations for channels which have
1964  * events pending.
1965  */
1966 void
1967 channel_after_select(fd_set *readset, fd_set *writeset)
1968 {
1969 	channel_handler(channel_post, readset, writeset);
1970 }
1971 
1972 
1973 /* If there is data to send to the connection, enqueue some of it now. */
1974 void
1975 channel_output_poll(void)
1976 {
1977 	Channel *c;
1978 	u_int i, len;
1979 
1980 	for (i = 0; i < channels_alloc; i++) {
1981 		c = channels[i];
1982 		if (c == NULL)
1983 			continue;
1984 
1985 		/*
1986 		 * We are only interested in channels that can have buffered
1987 		 * incoming data.
1988 		 */
1989 		if (compat13) {
1990 			if (c->type != SSH_CHANNEL_OPEN &&
1991 			    c->type != SSH_CHANNEL_INPUT_DRAINING)
1992 				continue;
1993 		} else {
1994 			if (c->type != SSH_CHANNEL_OPEN)
1995 				continue;
1996 		}
1997 		if (compat20 &&
1998 		    (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
1999 			/* XXX is this true? */
2000 			debug3("channel %d: will not send data after close", c->self);
2001 			continue;
2002 		}
2003 
2004 		/* Get the amount of buffered data for this channel. */
2005 		if ((c->istate == CHAN_INPUT_OPEN ||
2006 		    c->istate == CHAN_INPUT_WAIT_DRAIN) &&
2007 		    (len = buffer_len(&c->input)) > 0) {
2008 			if (c->datagram) {
2009 				if (len > 0) {
2010 					u_char *data;
2011 					u_int dlen;
2012 
2013 					data = buffer_get_string(&c->input,
2014 					    &dlen);
2015 					packet_start(SSH2_MSG_CHANNEL_DATA);
2016 					packet_put_int(c->remote_id);
2017 					packet_put_string(data, dlen);
2018 					packet_send();
2019 					c->remote_window -= dlen + 4;
2020 					xfree(data);
2021 				}
2022 				continue;
2023 			}
2024 			/*
2025 			 * Send some data for the other side over the secure
2026 			 * connection.
2027 			 */
2028 			if (compat20) {
2029 				if (len > c->remote_window)
2030 					len = c->remote_window;
2031 				if (len > c->remote_maxpacket)
2032 					len = c->remote_maxpacket;
2033 			} else {
2034 				if (packet_is_interactive()) {
2035 					if (len > 1024)
2036 						len = 512;
2037 				} else {
2038 					/* Keep the packets at reasonable size. */
2039 					if (len > packet_get_maxsize()/2)
2040 						len = packet_get_maxsize()/2;
2041 				}
2042 			}
2043 			if (len > 0) {
2044 				packet_start(compat20 ?
2045 				    SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
2046 				packet_put_int(c->remote_id);
2047 				packet_put_string(buffer_ptr(&c->input), len);
2048 				packet_send();
2049 				buffer_consume(&c->input, len);
2050 				c->remote_window -= len;
2051 			}
2052 		} else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
2053 			if (compat13)
2054 				fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
2055 			/*
2056 			 * input-buffer is empty and read-socket shutdown:
2057 			 * tell peer, that we will not send more data: send IEOF.
2058 			 * hack for extended data: delay EOF if EFD still in use.
2059 			 */
2060 			if (CHANNEL_EFD_INPUT_ACTIVE(c))
2061 				debug2("channel %d: ibuf_empty delayed efd %d/(%d)",
2062 				    c->self, c->efd, buffer_len(&c->extended));
2063 			else
2064 				chan_ibuf_empty(c);
2065 		}
2066 		/* Send extended data, i.e. stderr */
2067 		if (compat20 &&
2068 		    !(c->flags & CHAN_EOF_SENT) &&
2069 		    c->remote_window > 0 &&
2070 		    (len = buffer_len(&c->extended)) > 0 &&
2071 		    c->extended_usage == CHAN_EXTENDED_READ) {
2072 			debug2("channel %d: rwin %u elen %u euse %d",
2073 			    c->self, c->remote_window, buffer_len(&c->extended),
2074 			    c->extended_usage);
2075 			if (len > c->remote_window)
2076 				len = c->remote_window;
2077 			if (len > c->remote_maxpacket)
2078 				len = c->remote_maxpacket;
2079 			packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
2080 			packet_put_int(c->remote_id);
2081 			packet_put_int(SSH2_EXTENDED_DATA_STDERR);
2082 			packet_put_string(buffer_ptr(&c->extended), len);
2083 			packet_send();
2084 			buffer_consume(&c->extended, len);
2085 			c->remote_window -= len;
2086 			debug2("channel %d: sent ext data %d", c->self, len);
2087 		}
2088 	}
2089 }
2090 
2091 
2092 /* -- protocol input */
2093 
2094 /* ARGSUSED */
2095 void
2096 channel_input_data(int type, u_int32_t seq, void *ctxt)
2097 {
2098 	int id;
2099 	char *data;
2100 	u_int data_len;
2101 	Channel *c;
2102 
2103 	/* Get the channel number and verify it. */
2104 	id = packet_get_int();
2105 	c = channel_lookup(id);
2106 	if (c == NULL)
2107 		packet_disconnect("Received data for nonexistent channel %d.", id);
2108 
2109 	/* Ignore any data for non-open channels (might happen on close) */
2110 	if (c->type != SSH_CHANNEL_OPEN &&
2111 	    c->type != SSH_CHANNEL_X11_OPEN)
2112 		return;
2113 
2114 	/* Get the data. */
2115 	data = packet_get_string_ptr(&data_len);
2116 
2117 	/*
2118 	 * Ignore data for protocol > 1.3 if output end is no longer open.
2119 	 * For protocol 2 the sending side is reducing its window as it sends
2120 	 * data, so we must 'fake' consumption of the data in order to ensure
2121 	 * that window updates are sent back.  Otherwise the connection might
2122 	 * deadlock.
2123 	 */
2124 	if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN) {
2125 		if (compat20) {
2126 			c->local_window -= data_len;
2127 			c->local_consumed += data_len;
2128 		}
2129 		return;
2130 	}
2131 
2132 	if (compat20) {
2133 		if (data_len > c->local_maxpacket) {
2134 			logit("channel %d: rcvd big packet %d, maxpack %d",
2135 			    c->self, data_len, c->local_maxpacket);
2136 		}
2137 		if (data_len > c->local_window) {
2138 			logit("channel %d: rcvd too much data %d, win %d",
2139 			    c->self, data_len, c->local_window);
2140 			return;
2141 		}
2142 		c->local_window -= data_len;
2143 	}
2144 	if (c->datagram)
2145 		buffer_put_string(&c->output, data, data_len);
2146 	else
2147 		buffer_append(&c->output, data, data_len);
2148 	packet_check_eom();
2149 }
2150 
2151 /* ARGSUSED */
2152 void
2153 channel_input_extended_data(int type, u_int32_t seq, void *ctxt)
2154 {
2155 	int id;
2156 	char *data;
2157 	u_int data_len, tcode;
2158 	Channel *c;
2159 
2160 	/* Get the channel number and verify it. */
2161 	id = packet_get_int();
2162 	c = channel_lookup(id);
2163 
2164 	if (c == NULL)
2165 		packet_disconnect("Received extended_data for bad channel %d.", id);
2166 	if (c->type != SSH_CHANNEL_OPEN) {
2167 		logit("channel %d: ext data for non open", id);
2168 		return;
2169 	}
2170 	if (c->flags & CHAN_EOF_RCVD) {
2171 		if (datafellows & SSH_BUG_EXTEOF)
2172 			debug("channel %d: accepting ext data after eof", id);
2173 		else
2174 			packet_disconnect("Received extended_data after EOF "
2175 			    "on channel %d.", id);
2176 	}
2177 	tcode = packet_get_int();
2178 	if (c->efd == -1 ||
2179 	    c->extended_usage != CHAN_EXTENDED_WRITE ||
2180 	    tcode != SSH2_EXTENDED_DATA_STDERR) {
2181 		logit("channel %d: bad ext data", c->self);
2182 		return;
2183 	}
2184 	data = packet_get_string(&data_len);
2185 	packet_check_eom();
2186 	if (data_len > c->local_window) {
2187 		logit("channel %d: rcvd too much extended_data %d, win %d",
2188 		    c->self, data_len, c->local_window);
2189 		xfree(data);
2190 		return;
2191 	}
2192 	debug2("channel %d: rcvd ext data %d", c->self, data_len);
2193 	c->local_window -= data_len;
2194 	buffer_append(&c->extended, data, data_len);
2195 	xfree(data);
2196 }
2197 
2198 /* ARGSUSED */
2199 void
2200 channel_input_ieof(int type, u_int32_t seq, void *ctxt)
2201 {
2202 	int id;
2203 	Channel *c;
2204 
2205 	id = packet_get_int();
2206 	packet_check_eom();
2207 	c = channel_lookup(id);
2208 	if (c == NULL)
2209 		packet_disconnect("Received ieof for nonexistent channel %d.", id);
2210 	chan_rcvd_ieof(c);
2211 
2212 	/* XXX force input close */
2213 	if (c->force_drain && c->istate == CHAN_INPUT_OPEN) {
2214 		debug("channel %d: FORCE input drain", c->self);
2215 		c->istate = CHAN_INPUT_WAIT_DRAIN;
2216 		if (buffer_len(&c->input) == 0)
2217 			chan_ibuf_empty(c);
2218 	}
2219 
2220 }
2221 
2222 /* ARGSUSED */
2223 void
2224 channel_input_close(int type, u_int32_t seq, void *ctxt)
2225 {
2226 	int id;
2227 	Channel *c;
2228 
2229 	id = packet_get_int();
2230 	packet_check_eom();
2231 	c = channel_lookup(id);
2232 	if (c == NULL)
2233 		packet_disconnect("Received close for nonexistent channel %d.", id);
2234 
2235 	/*
2236 	 * Send a confirmation that we have closed the channel and no more
2237 	 * data is coming for it.
2238 	 */
2239 	packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
2240 	packet_put_int(c->remote_id);
2241 	packet_send();
2242 
2243 	/*
2244 	 * If the channel is in closed state, we have sent a close request,
2245 	 * and the other side will eventually respond with a confirmation.
2246 	 * Thus, we cannot free the channel here, because then there would be
2247 	 * no-one to receive the confirmation.  The channel gets freed when
2248 	 * the confirmation arrives.
2249 	 */
2250 	if (c->type != SSH_CHANNEL_CLOSED) {
2251 		/*
2252 		 * Not a closed channel - mark it as draining, which will
2253 		 * cause it to be freed later.
2254 		 */
2255 		buffer_clear(&c->input);
2256 		c->type = SSH_CHANNEL_OUTPUT_DRAINING;
2257 	}
2258 }
2259 
2260 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
2261 /* ARGSUSED */
2262 void
2263 channel_input_oclose(int type, u_int32_t seq, void *ctxt)
2264 {
2265 	int id = packet_get_int();
2266 	Channel *c = channel_lookup(id);
2267 
2268 	packet_check_eom();
2269 	if (c == NULL)
2270 		packet_disconnect("Received oclose for nonexistent channel %d.", id);
2271 	chan_rcvd_oclose(c);
2272 }
2273 
2274 /* ARGSUSED */
2275 void
2276 channel_input_close_confirmation(int type, u_int32_t seq, void *ctxt)
2277 {
2278 	int id = packet_get_int();
2279 	Channel *c = channel_lookup(id);
2280 
2281 	packet_check_eom();
2282 	if (c == NULL)
2283 		packet_disconnect("Received close confirmation for "
2284 		    "out-of-range channel %d.", id);
2285 	if (c->type != SSH_CHANNEL_CLOSED)
2286 		packet_disconnect("Received close confirmation for "
2287 		    "non-closed channel %d (type %d).", id, c->type);
2288 	channel_free(c);
2289 }
2290 
2291 /* ARGSUSED */
2292 void
2293 channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt)
2294 {
2295 	int id, remote_id;
2296 	Channel *c;
2297 
2298 	id = packet_get_int();
2299 	c = channel_lookup(id);
2300 
2301 	if (c==NULL || c->type != SSH_CHANNEL_OPENING)
2302 		packet_disconnect("Received open confirmation for "
2303 		    "non-opening channel %d.", id);
2304 	remote_id = packet_get_int();
2305 	/* Record the remote channel number and mark that the channel is now open. */
2306 	c->remote_id = remote_id;
2307 	c->type = SSH_CHANNEL_OPEN;
2308 
2309 	if (compat20) {
2310 		c->remote_window = packet_get_int();
2311 		c->remote_maxpacket = packet_get_int();
2312 		if (c->open_confirm) {
2313 			debug2("callback start");
2314 			c->open_confirm(c->self, c->open_confirm_ctx);
2315 			debug2("callback done");
2316 		}
2317 		debug2("channel %d: open confirm rwindow %u rmax %u", c->self,
2318 		    c->remote_window, c->remote_maxpacket);
2319 	}
2320 	packet_check_eom();
2321 }
2322 
2323 static char *
2324 reason2txt(int reason)
2325 {
2326 	switch (reason) {
2327 	case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED:
2328 		return "administratively prohibited";
2329 	case SSH2_OPEN_CONNECT_FAILED:
2330 		return "connect failed";
2331 	case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE:
2332 		return "unknown channel type";
2333 	case SSH2_OPEN_RESOURCE_SHORTAGE:
2334 		return "resource shortage";
2335 	}
2336 	return "unknown reason";
2337 }
2338 
2339 /* ARGSUSED */
2340 void
2341 channel_input_open_failure(int type, u_int32_t seq, void *ctxt)
2342 {
2343 	int id, reason;
2344 	char *msg = NULL, *lang = NULL;
2345 	Channel *c;
2346 
2347 	id = packet_get_int();
2348 	c = channel_lookup(id);
2349 
2350 	if (c==NULL || c->type != SSH_CHANNEL_OPENING)
2351 		packet_disconnect("Received open failure for "
2352 		    "non-opening channel %d.", id);
2353 	if (compat20) {
2354 		reason = packet_get_int();
2355 		if (!(datafellows & SSH_BUG_OPENFAILURE)) {
2356 			msg  = packet_get_string(NULL);
2357 			lang = packet_get_string(NULL);
2358 		}
2359 		logit("channel %d: open failed: %s%s%s", id,
2360 		    reason2txt(reason), msg ? ": ": "", msg ? msg : "");
2361 		if (msg != NULL)
2362 			xfree(msg);
2363 		if (lang != NULL)
2364 			xfree(lang);
2365 	}
2366 	packet_check_eom();
2367 	/* Schedule the channel for cleanup/deletion. */
2368 	chan_mark_dead(c);
2369 }
2370 
2371 /* ARGSUSED */
2372 void
2373 channel_input_window_adjust(int type, u_int32_t seq, void *ctxt)
2374 {
2375 	Channel *c;
2376 	int id;
2377 	u_int adjust;
2378 
2379 	if (!compat20)
2380 		return;
2381 
2382 	/* Get the channel number and verify it. */
2383 	id = packet_get_int();
2384 	c = channel_lookup(id);
2385 
2386 	if (c == NULL) {
2387 		logit("Received window adjust for non-open channel %d.", id);
2388 		return;
2389 	}
2390 	adjust = packet_get_int();
2391 	packet_check_eom();
2392 	debug2("channel %d: rcvd adjust %u", id, adjust);
2393 	c->remote_window += adjust;
2394 }
2395 
2396 /* ARGSUSED */
2397 void
2398 channel_input_port_open(int type, u_int32_t seq, void *ctxt)
2399 {
2400 	Channel *c = NULL;
2401 	u_short host_port;
2402 	char *host, *originator_string;
2403 	int remote_id;
2404 
2405 	remote_id = packet_get_int();
2406 	host = packet_get_string(NULL);
2407 	host_port = packet_get_int();
2408 
2409 	if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {
2410 		originator_string = packet_get_string(NULL);
2411 	} else {
2412 		originator_string = xstrdup("unknown (remote did not supply name)");
2413 	}
2414 	packet_check_eom();
2415 	c = channel_connect_to(host, host_port,
2416 	    "connected socket", originator_string);
2417 	xfree(originator_string);
2418 	xfree(host);
2419 	if (c == NULL) {
2420 		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2421 		packet_put_int(remote_id);
2422 		packet_send();
2423 	} else
2424 		c->remote_id = remote_id;
2425 }
2426 
2427 /* ARGSUSED */
2428 void
2429 channel_input_status_confirm(int type, u_int32_t seq, void *ctxt)
2430 {
2431 	Channel *c;
2432 	struct channel_confirm *cc;
2433 	int id;
2434 
2435 	/* Reset keepalive timeout */
2436 	packet_set_alive_timeouts(0);
2437 
2438 	id = packet_get_int();
2439 	packet_check_eom();
2440 
2441 	debug2("channel_input_status_confirm: type %d id %d", type, id);
2442 
2443 	if ((c = channel_lookup(id)) == NULL) {
2444 		logit("channel_input_status_confirm: %d: unknown", id);
2445 		return;
2446 	}
2447 	;
2448 	if ((cc = TAILQ_FIRST(&c->status_confirms)) == NULL)
2449 		return;
2450 	cc->cb(type, c, cc->ctx);
2451 	TAILQ_REMOVE(&c->status_confirms, cc, entry);
2452 	bzero(cc, sizeof(*cc));
2453 	xfree(cc);
2454 }
2455 
2456 /* -- tcp forwarding */
2457 
2458 void
2459 channel_set_af(int af)
2460 {
2461 	IPv4or6 = af;
2462 }
2463 
2464 static int
2465 channel_setup_fwd_listener(int type, const char *listen_addr,
2466     u_short listen_port, int *allocated_listen_port,
2467     const char *host_to_connect, u_short port_to_connect, int gateway_ports)
2468 {
2469 	Channel *c;
2470 	int sock, r, success = 0, wildcard = 0, is_client;
2471 	struct addrinfo hints, *ai, *aitop;
2472 	const char *host, *addr;
2473 	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
2474 	in_port_t *lport_p;
2475 
2476 	host = (type == SSH_CHANNEL_RPORT_LISTENER) ?
2477 	    listen_addr : host_to_connect;
2478 	is_client = (type == SSH_CHANNEL_PORT_LISTENER);
2479 
2480 	if (host == NULL) {
2481 		error("No forward host name.");
2482 		return 0;
2483 	}
2484 	if (strlen(host) >= NI_MAXHOST) {
2485 		error("Forward host name too long.");
2486 		return 0;
2487 	}
2488 
2489 	/*
2490 	 * Determine whether or not a port forward listens to loopback,
2491 	 * specified address or wildcard. On the client, a specified bind
2492 	 * address will always override gateway_ports. On the server, a
2493 	 * gateway_ports of 1 (``yes'') will override the client's
2494 	 * specification and force a wildcard bind, whereas a value of 2
2495 	 * (``clientspecified'') will bind to whatever address the client
2496 	 * asked for.
2497 	 *
2498 	 * Special-case listen_addrs are:
2499 	 *
2500 	 * "0.0.0.0"               -> wildcard v4/v6 if SSH_OLD_FORWARD_ADDR
2501 	 * "" (empty string), "*"  -> wildcard v4/v6
2502 	 * "localhost"             -> loopback v4/v6
2503 	 */
2504 	addr = NULL;
2505 	if (listen_addr == NULL) {
2506 		/* No address specified: default to gateway_ports setting */
2507 		if (gateway_ports)
2508 			wildcard = 1;
2509 	} else if (gateway_ports || is_client) {
2510 		if (((datafellows & SSH_OLD_FORWARD_ADDR) &&
2511 		    strcmp(listen_addr, "0.0.0.0") == 0 && is_client == 0) ||
2512 		    *listen_addr == '\0' || strcmp(listen_addr, "*") == 0 ||
2513 		    (!is_client && gateway_ports == 1))
2514 			wildcard = 1;
2515 		else if (strcmp(listen_addr, "localhost") != 0)
2516 			addr = listen_addr;
2517 	}
2518 
2519 	debug3("channel_setup_fwd_listener: type %d wildcard %d addr %s",
2520 	    type, wildcard, (addr == NULL) ? "NULL" : addr);
2521 
2522 	/*
2523 	 * getaddrinfo returns a loopback address if the hostname is
2524 	 * set to NULL and hints.ai_flags is not AI_PASSIVE
2525 	 */
2526 	memset(&hints, 0, sizeof(hints));
2527 	hints.ai_family = IPv4or6;
2528 	hints.ai_flags = wildcard ? AI_PASSIVE : 0;
2529 	hints.ai_socktype = SOCK_STREAM;
2530 	snprintf(strport, sizeof strport, "%d", listen_port);
2531 	if ((r = getaddrinfo(addr, strport, &hints, &aitop)) != 0) {
2532 		if (addr == NULL) {
2533 			/* This really shouldn't happen */
2534 			packet_disconnect("getaddrinfo: fatal error: %s",
2535 			    ssh_gai_strerror(r));
2536 		} else {
2537 			error("channel_setup_fwd_listener: "
2538 			    "getaddrinfo(%.64s): %s", addr,
2539 			    ssh_gai_strerror(r));
2540 		}
2541 		return 0;
2542 	}
2543 	if (allocated_listen_port != NULL)
2544 		*allocated_listen_port = 0;
2545 	for (ai = aitop; ai; ai = ai->ai_next) {
2546 		switch (ai->ai_family) {
2547 		case AF_INET:
2548 			lport_p = &((struct sockaddr_in *)ai->ai_addr)->
2549 			    sin_port;
2550 			break;
2551 		case AF_INET6:
2552 			lport_p = &((struct sockaddr_in6 *)ai->ai_addr)->
2553 			    sin6_port;
2554 			break;
2555 		default:
2556 			continue;
2557 		}
2558 		/*
2559 		 * If allocating a port for -R forwards, then use the
2560 		 * same port for all address families.
2561 		 */
2562 		if (type == SSH_CHANNEL_RPORT_LISTENER && listen_port == 0 &&
2563 		    allocated_listen_port != NULL && *allocated_listen_port > 0)
2564 			*lport_p = htons(*allocated_listen_port);
2565 
2566 		if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
2567 		    strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
2568 			error("channel_setup_fwd_listener: getnameinfo failed");
2569 			continue;
2570 		}
2571 		/* Create a port to listen for the host. */
2572 		sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
2573 		if (sock < 0) {
2574 			/* this is no error since kernel may not support ipv6 */
2575 			verbose("socket: %.100s", strerror(errno));
2576 			continue;
2577 		}
2578 
2579 		channel_set_reuseaddr(sock);
2580 
2581 		debug("Local forwarding listening on %s port %s.",
2582 		    ntop, strport);
2583 
2584 		/* Bind the socket to the address. */
2585 		if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2586 			/* address can be in use ipv6 address is already bound */
2587 			if (!ai->ai_next)
2588 				error("bind: %.100s", strerror(errno));
2589 			else
2590 				verbose("bind: %.100s", strerror(errno));
2591 
2592 			close(sock);
2593 			continue;
2594 		}
2595 		/* Start listening for connections on the socket. */
2596 		if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
2597 			error("listen: %.100s", strerror(errno));
2598 			close(sock);
2599 			continue;
2600 		}
2601 
2602 		/*
2603 		 * listen_port == 0 requests a dynamically allocated port -
2604 		 * record what we got.
2605 		 */
2606 		if (type == SSH_CHANNEL_RPORT_LISTENER && listen_port == 0 &&
2607 		    allocated_listen_port != NULL &&
2608 		    *allocated_listen_port == 0) {
2609 			*allocated_listen_port = get_sock_port(sock, 1);
2610 			debug("Allocated listen port %d",
2611 			    *allocated_listen_port);
2612 		}
2613 
2614 		/* Allocate a channel number for the socket. */
2615 		c = channel_new("port listener", type, sock, sock, -1,
2616 		    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
2617 		    0, "port listener", 1);
2618 		c->path = xstrdup(host);
2619 		c->host_port = port_to_connect;
2620 		c->listening_port = listen_port;
2621 		success = 1;
2622 	}
2623 	if (success == 0)
2624 		error("channel_setup_fwd_listener: cannot listen to port: %d",
2625 		    listen_port);
2626 	freeaddrinfo(aitop);
2627 	return success;
2628 }
2629 
2630 int
2631 channel_cancel_rport_listener(const char *host, u_short port)
2632 {
2633 	u_int i;
2634 	int found = 0;
2635 
2636 	for (i = 0; i < channels_alloc; i++) {
2637 		Channel *c = channels[i];
2638 
2639 		if (c != NULL && c->type == SSH_CHANNEL_RPORT_LISTENER &&
2640 		    strcmp(c->path, host) == 0 && c->listening_port == port) {
2641 			debug2("%s: close channel %d", __func__, i);
2642 			channel_free(c);
2643 			found = 1;
2644 		}
2645 	}
2646 
2647 	return (found);
2648 }
2649 
2650 /* protocol local port fwd, used by ssh (and sshd in v1) */
2651 int
2652 channel_setup_local_fwd_listener(const char *listen_host, u_short listen_port,
2653     const char *host_to_connect, u_short port_to_connect, int gateway_ports)
2654 {
2655 	return channel_setup_fwd_listener(SSH_CHANNEL_PORT_LISTENER,
2656 	    listen_host, listen_port, NULL, host_to_connect, port_to_connect,
2657 	    gateway_ports);
2658 }
2659 
2660 /* protocol v2 remote port fwd, used by sshd */
2661 int
2662 channel_setup_remote_fwd_listener(const char *listen_address,
2663     u_short listen_port, int *allocated_listen_port, int gateway_ports)
2664 {
2665 	return channel_setup_fwd_listener(SSH_CHANNEL_RPORT_LISTENER,
2666 	    listen_address, listen_port, allocated_listen_port,
2667 	    NULL, 0, gateway_ports);
2668 }
2669 
2670 /*
2671  * Initiate forwarding of connections to port "port" on remote host through
2672  * the secure channel to host:port from local side.
2673  */
2674 
2675 int
2676 channel_request_remote_forwarding(const char *listen_host, u_short listen_port,
2677     const char *host_to_connect, u_short port_to_connect)
2678 {
2679 	int type, success = 0;
2680 
2681 	/* Record locally that connection to this host/port is permitted. */
2682 	if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
2683 		fatal("channel_request_remote_forwarding: too many forwards");
2684 
2685 	/* Send the forward request to the remote side. */
2686 	if (compat20) {
2687 		const char *address_to_bind;
2688 		if (listen_host == NULL) {
2689 			if (datafellows & SSH_BUG_RFWD_ADDR)
2690 				address_to_bind = "127.0.0.1";
2691 			else
2692 				address_to_bind = "localhost";
2693 		} else if (*listen_host == '\0' ||
2694 			   strcmp(listen_host, "*") == 0) {
2695 			if (datafellows & SSH_BUG_RFWD_ADDR)
2696 				address_to_bind = "0.0.0.0";
2697 			else
2698 				address_to_bind = "";
2699 		} else
2700 			address_to_bind = listen_host;
2701 
2702 		packet_start(SSH2_MSG_GLOBAL_REQUEST);
2703 		packet_put_cstring("tcpip-forward");
2704 		packet_put_char(1);			/* boolean: want reply */
2705 		packet_put_cstring(address_to_bind);
2706 		packet_put_int(listen_port);
2707 		packet_send();
2708 		packet_write_wait();
2709 		/* Assume that server accepts the request */
2710 		success = 1;
2711 	} else {
2712 		packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
2713 		packet_put_int(listen_port);
2714 		packet_put_cstring(host_to_connect);
2715 		packet_put_int(port_to_connect);
2716 		packet_send();
2717 		packet_write_wait();
2718 
2719 		/* Wait for response from the remote side. */
2720 		type = packet_read();
2721 		switch (type) {
2722 		case SSH_SMSG_SUCCESS:
2723 			success = 1;
2724 			break;
2725 		case SSH_SMSG_FAILURE:
2726 			break;
2727 		default:
2728 			/* Unknown packet */
2729 			packet_disconnect("Protocol error for port forward request:"
2730 			    "received packet type %d.", type);
2731 		}
2732 	}
2733 	if (success) {
2734 		permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect);
2735 		permitted_opens[num_permitted_opens].port_to_connect = port_to_connect;
2736 		permitted_opens[num_permitted_opens].listen_port = listen_port;
2737 		num_permitted_opens++;
2738 	}
2739 	return (success ? 0 : -1);
2740 }
2741 
2742 /*
2743  * Request cancellation of remote forwarding of connection host:port from
2744  * local side.
2745  */
2746 void
2747 channel_request_rforward_cancel(const char *host, u_short port)
2748 {
2749 	int i;
2750 
2751 	if (!compat20)
2752 		return;
2753 
2754 	for (i = 0; i < num_permitted_opens; i++) {
2755 		if (permitted_opens[i].host_to_connect != NULL &&
2756 		    permitted_opens[i].listen_port == port)
2757 			break;
2758 	}
2759 	if (i >= num_permitted_opens) {
2760 		debug("%s: requested forward not found", __func__);
2761 		return;
2762 	}
2763 	packet_start(SSH2_MSG_GLOBAL_REQUEST);
2764 	packet_put_cstring("cancel-tcpip-forward");
2765 	packet_put_char(0);
2766 	packet_put_cstring(host == NULL ? "" : host);
2767 	packet_put_int(port);
2768 	packet_send();
2769 
2770 	permitted_opens[i].listen_port = 0;
2771 	permitted_opens[i].port_to_connect = 0;
2772 	xfree(permitted_opens[i].host_to_connect);
2773 	permitted_opens[i].host_to_connect = NULL;
2774 }
2775 
2776 /*
2777  * This is called after receiving CHANNEL_FORWARDING_REQUEST.  This initates
2778  * listening for the port, and sends back a success reply (or disconnect
2779  * message if there was an error).
2780  */
2781 int
2782 channel_input_port_forward_request(int is_root, int gateway_ports)
2783 {
2784 	u_short port, host_port;
2785 	int success = 0;
2786 	char *hostname;
2787 
2788 	/* Get arguments from the packet. */
2789 	port = packet_get_int();
2790 	hostname = packet_get_string(NULL);
2791 	host_port = packet_get_int();
2792 
2793 #ifndef HAVE_CYGWIN
2794 	/*
2795 	 * Check that an unprivileged user is not trying to forward a
2796 	 * privileged port.
2797 	 */
2798 	if (port < IPPORT_RESERVED && !is_root)
2799 		packet_disconnect(
2800 		    "Requested forwarding of port %d but user is not root.",
2801 		    port);
2802 	if (host_port == 0)
2803 		packet_disconnect("Dynamic forwarding denied.");
2804 #endif
2805 
2806 	/* Initiate forwarding */
2807 	success = channel_setup_local_fwd_listener(NULL, port, hostname,
2808 	    host_port, gateway_ports);
2809 
2810 	/* Free the argument string. */
2811 	xfree(hostname);
2812 
2813 	return (success ? 0 : -1);
2814 }
2815 
2816 /*
2817  * Permits opening to any host/port if permitted_opens[] is empty.  This is
2818  * usually called by the server, because the user could connect to any port
2819  * anyway, and the server has no way to know but to trust the client anyway.
2820  */
2821 void
2822 channel_permit_all_opens(void)
2823 {
2824 	if (num_permitted_opens == 0)
2825 		all_opens_permitted = 1;
2826 }
2827 
2828 void
2829 channel_add_permitted_opens(char *host, int port)
2830 {
2831 	if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
2832 		fatal("channel_add_permitted_opens: too many forwards");
2833 	debug("allow port forwarding to host %s port %d", host, port);
2834 
2835 	permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host);
2836 	permitted_opens[num_permitted_opens].port_to_connect = port;
2837 	num_permitted_opens++;
2838 
2839 	all_opens_permitted = 0;
2840 }
2841 
2842 int
2843 channel_add_adm_permitted_opens(char *host, int port)
2844 {
2845 	if (num_adm_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION)
2846 		fatal("channel_add_adm_permitted_opens: too many forwards");
2847 	debug("config allows port forwarding to host %s port %d", host, port);
2848 
2849 	permitted_adm_opens[num_adm_permitted_opens].host_to_connect
2850 	     = xstrdup(host);
2851 	permitted_adm_opens[num_adm_permitted_opens].port_to_connect = port;
2852 	return ++num_adm_permitted_opens;
2853 }
2854 
2855 void
2856 channel_clear_permitted_opens(void)
2857 {
2858 	int i;
2859 
2860 	for (i = 0; i < num_permitted_opens; i++)
2861 		if (permitted_opens[i].host_to_connect != NULL)
2862 			xfree(permitted_opens[i].host_to_connect);
2863 	num_permitted_opens = 0;
2864 }
2865 
2866 void
2867 channel_clear_adm_permitted_opens(void)
2868 {
2869 	int i;
2870 
2871 	for (i = 0; i < num_adm_permitted_opens; i++)
2872 		if (permitted_adm_opens[i].host_to_connect != NULL)
2873 			xfree(permitted_adm_opens[i].host_to_connect);
2874 	num_adm_permitted_opens = 0;
2875 }
2876 
2877 void
2878 channel_print_adm_permitted_opens(void)
2879 {
2880 	int i;
2881 
2882 	printf("permitopen");
2883 	if (num_adm_permitted_opens == 0) {
2884 		printf(" any\n");
2885 		return;
2886 	}
2887 	for (i = 0; i < num_adm_permitted_opens; i++)
2888 		if (permitted_adm_opens[i].host_to_connect != NULL)
2889 			printf(" %s:%d", permitted_adm_opens[i].host_to_connect,
2890 			    permitted_adm_opens[i].port_to_connect);
2891 	printf("\n");
2892 }
2893 
2894 /* Try to start non-blocking connect to next host in cctx list */
2895 static int
2896 connect_next(struct channel_connect *cctx)
2897 {
2898 	int sock, saved_errno;
2899 	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
2900 
2901 	for (; cctx->ai; cctx->ai = cctx->ai->ai_next) {
2902 		if (cctx->ai->ai_family != AF_INET &&
2903 		    cctx->ai->ai_family != AF_INET6)
2904 			continue;
2905 		if (getnameinfo(cctx->ai->ai_addr, cctx->ai->ai_addrlen,
2906 		    ntop, sizeof(ntop), strport, sizeof(strport),
2907 		    NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
2908 			error("connect_next: getnameinfo failed");
2909 			continue;
2910 		}
2911 		if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype,
2912 		    cctx->ai->ai_protocol)) == -1) {
2913 			if (cctx->ai->ai_next == NULL)
2914 				error("socket: %.100s", strerror(errno));
2915 			else
2916 				verbose("socket: %.100s", strerror(errno));
2917 			continue;
2918 		}
2919 		if (set_nonblock(sock) == -1)
2920 			fatal("%s: set_nonblock(%d)", __func__, sock);
2921 		if (connect(sock, cctx->ai->ai_addr,
2922 		    cctx->ai->ai_addrlen) == -1 && errno != EINPROGRESS) {
2923 			debug("connect_next: host %.100s ([%.100s]:%s): "
2924 			    "%.100s", cctx->host, ntop, strport,
2925 			    strerror(errno));
2926 			saved_errno = errno;
2927 			close(sock);
2928 			errno = saved_errno;
2929 			continue;	/* fail -- try next */
2930 		}
2931 		debug("connect_next: host %.100s ([%.100s]:%s) "
2932 		    "in progress, fd=%d", cctx->host, ntop, strport, sock);
2933 		cctx->ai = cctx->ai->ai_next;
2934 		set_nodelay(sock);
2935 		return sock;
2936 	}
2937 	return -1;
2938 }
2939 
2940 static void
2941 channel_connect_ctx_free(struct channel_connect *cctx)
2942 {
2943 	xfree(cctx->host);
2944 	if (cctx->aitop)
2945 		freeaddrinfo(cctx->aitop);
2946 	bzero(cctx, sizeof(*cctx));
2947 	cctx->host = NULL;
2948 	cctx->ai = cctx->aitop = NULL;
2949 }
2950 
2951 /* Return CONNECTING channel to remote host, port */
2952 static Channel *
2953 connect_to(const char *host, u_short port, char *ctype, char *rname)
2954 {
2955 	struct addrinfo hints;
2956 	int gaierr;
2957 	int sock = -1;
2958 	char strport[NI_MAXSERV];
2959 	struct channel_connect cctx;
2960 	Channel *c;
2961 
2962 	memset(&cctx, 0, sizeof(cctx));
2963 	memset(&hints, 0, sizeof(hints));
2964 	hints.ai_family = IPv4or6;
2965 	hints.ai_socktype = SOCK_STREAM;
2966 	snprintf(strport, sizeof strport, "%d", port);
2967 	if ((gaierr = getaddrinfo(host, strport, &hints, &cctx.aitop)) != 0) {
2968 		error("connect_to %.100s: unknown host (%s)", host,
2969 		    ssh_gai_strerror(gaierr));
2970 		return NULL;
2971 	}
2972 
2973 	cctx.host = xstrdup(host);
2974 	cctx.port = port;
2975 	cctx.ai = cctx.aitop;
2976 
2977 	if ((sock = connect_next(&cctx)) == -1) {
2978 		error("connect to %.100s port %d failed: %s",
2979 		    host, port, strerror(errno));
2980 		channel_connect_ctx_free(&cctx);
2981 		return NULL;
2982 	}
2983 	c = channel_new(ctype, SSH_CHANNEL_CONNECTING, sock, sock, -1,
2984 	    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, rname, 1);
2985 	c->connect_ctx = cctx;
2986 	return c;
2987 }
2988 
2989 Channel *
2990 channel_connect_by_listen_address(u_short listen_port, char *ctype, char *rname)
2991 {
2992 	int i;
2993 
2994 	for (i = 0; i < num_permitted_opens; i++) {
2995 		if (permitted_opens[i].host_to_connect != NULL &&
2996 		    permitted_opens[i].listen_port == listen_port) {
2997 			return connect_to(
2998 			    permitted_opens[i].host_to_connect,
2999 			    permitted_opens[i].port_to_connect, ctype, rname);
3000 		}
3001 	}
3002 	error("WARNING: Server requests forwarding for unknown listen_port %d",
3003 	    listen_port);
3004 	return NULL;
3005 }
3006 
3007 /* Check if connecting to that port is permitted and connect. */
3008 Channel *
3009 channel_connect_to(const char *host, u_short port, char *ctype, char *rname)
3010 {
3011 	int i, permit, permit_adm = 1;
3012 
3013 	permit = all_opens_permitted;
3014 	if (!permit) {
3015 		for (i = 0; i < num_permitted_opens; i++)
3016 			if (permitted_opens[i].host_to_connect != NULL &&
3017 			    permitted_opens[i].port_to_connect == port &&
3018 			    strcmp(permitted_opens[i].host_to_connect, host) == 0)
3019 				permit = 1;
3020 	}
3021 
3022 	if (num_adm_permitted_opens > 0) {
3023 		permit_adm = 0;
3024 		for (i = 0; i < num_adm_permitted_opens; i++)
3025 			if (permitted_adm_opens[i].host_to_connect != NULL &&
3026 			    permitted_adm_opens[i].port_to_connect == port &&
3027 			    strcmp(permitted_adm_opens[i].host_to_connect, host)
3028 			    == 0)
3029 				permit_adm = 1;
3030 	}
3031 
3032 	if (!permit || !permit_adm) {
3033 		logit("Received request to connect to host %.100s port %d, "
3034 		    "but the request was denied.", host, port);
3035 		return NULL;
3036 	}
3037 	return connect_to(host, port, ctype, rname);
3038 }
3039 
3040 void
3041 channel_send_window_changes(void)
3042 {
3043 	u_int i;
3044 	struct winsize ws;
3045 
3046 	for (i = 0; i < channels_alloc; i++) {
3047 		if (channels[i] == NULL || !channels[i]->client_tty ||
3048 		    channels[i]->type != SSH_CHANNEL_OPEN)
3049 			continue;
3050 		if (ioctl(channels[i]->rfd, TIOCGWINSZ, &ws) < 0)
3051 			continue;
3052 		channel_request_start(i, "window-change", 0);
3053 		packet_put_int((u_int)ws.ws_col);
3054 		packet_put_int((u_int)ws.ws_row);
3055 		packet_put_int((u_int)ws.ws_xpixel);
3056 		packet_put_int((u_int)ws.ws_ypixel);
3057 		packet_send();
3058 	}
3059 }
3060 
3061 /* -- X11 forwarding */
3062 
3063 /*
3064  * Creates an internet domain socket for listening for X11 connections.
3065  * Returns 0 and a suitable display number for the DISPLAY variable
3066  * stored in display_numberp , or -1 if an error occurs.
3067  */
3068 int
3069 x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
3070     int single_connection, u_int *display_numberp, int **chanids)
3071 {
3072 	Channel *nc = NULL;
3073 	int display_number, sock;
3074 	u_short port;
3075 	struct addrinfo hints, *ai, *aitop;
3076 	char strport[NI_MAXSERV];
3077 	int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
3078 
3079 	if (chanids == NULL)
3080 		return -1;
3081 
3082 	for (display_number = x11_display_offset;
3083 	    display_number < MAX_DISPLAYS;
3084 	    display_number++) {
3085 		port = 6000 + display_number;
3086 		memset(&hints, 0, sizeof(hints));
3087 		hints.ai_family = IPv4or6;
3088 		hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
3089 		hints.ai_socktype = SOCK_STREAM;
3090 		snprintf(strport, sizeof strport, "%d", port);
3091 		if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
3092 			error("getaddrinfo: %.100s", ssh_gai_strerror(gaierr));
3093 			return -1;
3094 		}
3095 		for (ai = aitop; ai; ai = ai->ai_next) {
3096 			if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
3097 				continue;
3098 			sock = socket(ai->ai_family, ai->ai_socktype,
3099 			    ai->ai_protocol);
3100 			if (sock < 0) {
3101 				if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) {
3102 					error("socket: %.100s", strerror(errno));
3103 					freeaddrinfo(aitop);
3104 					return -1;
3105 				} else {
3106 					debug("x11_create_display_inet: Socket family %d not supported",
3107 						 ai->ai_family);
3108 					continue;
3109 				}
3110 			}
3111 #ifdef IPV6_V6ONLY
3112 			if (ai->ai_family == AF_INET6) {
3113 				int on = 1;
3114 				if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) < 0)
3115 					error("setsockopt IPV6_V6ONLY: %.100s", strerror(errno));
3116 			}
3117 #endif
3118 			if (x11_use_localhost)
3119 				channel_set_reuseaddr(sock);
3120 			if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
3121 				debug2("bind port %d: %.100s", port, strerror(errno));
3122 				close(sock);
3123 
3124 				for (n = 0; n < num_socks; n++) {
3125 					close(socks[n]);
3126 				}
3127 				num_socks = 0;
3128 				break;
3129 			}
3130 			socks[num_socks++] = sock;
3131 			if (num_socks == NUM_SOCKS)
3132 				break;
3133 		}
3134 		freeaddrinfo(aitop);
3135 		if (num_socks > 0)
3136 			break;
3137 	}
3138 	if (display_number >= MAX_DISPLAYS) {
3139 		error("Failed to allocate internet-domain X11 display socket.");
3140 		return -1;
3141 	}
3142 	/* Start listening for connections on the socket. */
3143 	for (n = 0; n < num_socks; n++) {
3144 		sock = socks[n];
3145 		if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
3146 			error("listen: %.100s", strerror(errno));
3147 			close(sock);
3148 			return -1;
3149 		}
3150 	}
3151 
3152 	/* Allocate a channel for each socket. */
3153 	*chanids = xcalloc(num_socks + 1, sizeof(**chanids));
3154 	for (n = 0; n < num_socks; n++) {
3155 		sock = socks[n];
3156 		nc = channel_new("x11 listener",
3157 		    SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
3158 		    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
3159 		    0, "X11 inet listener", 1);
3160 		nc->single_connection = single_connection;
3161 		(*chanids)[n] = nc->self;
3162 	}
3163 	(*chanids)[n] = -1;
3164 
3165 	/* Return the display number for the DISPLAY environment variable. */
3166 	*display_numberp = display_number;
3167 	return (0);
3168 }
3169 
3170 static int
3171 connect_local_xsocket_path(const char *pathname)
3172 {
3173 	int sock;
3174 	struct sockaddr_un addr;
3175 
3176 	sock = socket(AF_UNIX, SOCK_STREAM, 0);
3177 	if (sock < 0)
3178 		error("socket: %.100s", strerror(errno));
3179 	memset(&addr, 0, sizeof(addr));
3180 	addr.sun_family = AF_UNIX;
3181 	strlcpy(addr.sun_path, pathname, sizeof addr.sun_path);
3182 	if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0)
3183 		return sock;
3184 	close(sock);
3185 	error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
3186 	return -1;
3187 }
3188 
3189 static int
3190 connect_local_xsocket(u_int dnr)
3191 {
3192 	char buf[1024];
3193 	snprintf(buf, sizeof buf, _PATH_UNIX_X, dnr);
3194 	return connect_local_xsocket_path(buf);
3195 }
3196 
3197 int
3198 x11_connect_display(void)
3199 {
3200 	u_int display_number;
3201 	const char *display;
3202 	char buf[1024], *cp;
3203 	struct addrinfo hints, *ai, *aitop;
3204 	char strport[NI_MAXSERV];
3205 	int gaierr, sock = 0;
3206 
3207 	/* Try to open a socket for the local X server. */
3208 	display = getenv("DISPLAY");
3209 	if (!display) {
3210 		error("DISPLAY not set.");
3211 		return -1;
3212 	}
3213 	/*
3214 	 * Now we decode the value of the DISPLAY variable and make a
3215 	 * connection to the real X server.
3216 	 */
3217 
3218 	/* Check if the display is from launchd. */
3219 #ifdef __APPLE__
3220 	if (strncmp(display, "/tmp/launch", 11) == 0) {
3221 		sock = connect_local_xsocket_path(display);
3222 		if (sock < 0)
3223 			return -1;
3224 
3225 		/* OK, we now have a connection to the display. */
3226 		return sock;
3227 	}
3228 #endif
3229 	/*
3230 	 * Check if it is a unix domain socket.  Unix domain displays are in
3231 	 * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
3232 	 */
3233 	if (strncmp(display, "unix:", 5) == 0 ||
3234 	    display[0] == ':') {
3235 		/* Connect to the unix domain socket. */
3236 		if (sscanf(strrchr(display, ':') + 1, "%u", &display_number) != 1) {
3237 			error("Could not parse display number from DISPLAY: %.100s",
3238 			    display);
3239 			return -1;
3240 		}
3241 		/* Create a socket. */
3242 		sock = connect_local_xsocket(display_number);
3243 		if (sock < 0)
3244 			return -1;
3245 
3246 		/* OK, we now have a connection to the display. */
3247 		return sock;
3248 	}
3249 	/*
3250 	 * Connect to an inet socket.  The DISPLAY value is supposedly
3251 	 * hostname:d[.s], where hostname may also be numeric IP address.
3252 	 */
3253 	strlcpy(buf, display, sizeof(buf));
3254 	cp = strchr(buf, ':');
3255 	if (!cp) {
3256 		error("Could not find ':' in DISPLAY: %.100s", display);
3257 		return -1;
3258 	}
3259 	*cp = 0;
3260 	/* buf now contains the host name.  But first we parse the display number. */
3261 	if (sscanf(cp + 1, "%u", &display_number) != 1) {
3262 		error("Could not parse display number from DISPLAY: %.100s",
3263 		    display);
3264 		return -1;
3265 	}
3266 
3267 	/* Look up the host address */
3268 	memset(&hints, 0, sizeof(hints));
3269 	hints.ai_family = IPv4or6;
3270 	hints.ai_socktype = SOCK_STREAM;
3271 	snprintf(strport, sizeof strport, "%u", 6000 + display_number);
3272 	if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
3273 		error("%.100s: unknown host. (%s)", buf,
3274 		ssh_gai_strerror(gaierr));
3275 		return -1;
3276 	}
3277 	for (ai = aitop; ai; ai = ai->ai_next) {
3278 		/* Create a socket. */
3279 		sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
3280 		if (sock < 0) {
3281 			debug2("socket: %.100s", strerror(errno));
3282 			continue;
3283 		}
3284 		/* Connect it to the display. */
3285 		if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
3286 			debug2("connect %.100s port %u: %.100s", buf,
3287 			    6000 + display_number, strerror(errno));
3288 			close(sock);
3289 			continue;
3290 		}
3291 		/* Success */
3292 		break;
3293 	}
3294 	freeaddrinfo(aitop);
3295 	if (!ai) {
3296 		error("connect %.100s port %u: %.100s", buf, 6000 + display_number,
3297 		    strerror(errno));
3298 		return -1;
3299 	}
3300 	set_nodelay(sock);
3301 	return sock;
3302 }
3303 
3304 /*
3305  * This is called when SSH_SMSG_X11_OPEN is received.  The packet contains
3306  * the remote channel number.  We should do whatever we want, and respond
3307  * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
3308  */
3309 
3310 /* ARGSUSED */
3311 void
3312 x11_input_open(int type, u_int32_t seq, void *ctxt)
3313 {
3314 	Channel *c = NULL;
3315 	int remote_id, sock = 0;
3316 	char *remote_host;
3317 
3318 	debug("Received X11 open request.");
3319 
3320 	remote_id = packet_get_int();
3321 
3322 	if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {
3323 		remote_host = packet_get_string(NULL);
3324 	} else {
3325 		remote_host = xstrdup("unknown (remote did not supply name)");
3326 	}
3327 	packet_check_eom();
3328 
3329 	/* Obtain a connection to the real X display. */
3330 	sock = x11_connect_display();
3331 	if (sock != -1) {
3332 		/* Allocate a channel for this connection. */
3333 		c = channel_new("connected x11 socket",
3334 		    SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0,
3335 		    remote_host, 1);
3336 		c->remote_id = remote_id;
3337 		c->force_drain = 1;
3338 	}
3339 	xfree(remote_host);
3340 	if (c == NULL) {
3341 		/* Send refusal to the remote host. */
3342 		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
3343 		packet_put_int(remote_id);
3344 	} else {
3345 		/* Send a confirmation to the remote host. */
3346 		packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
3347 		packet_put_int(remote_id);
3348 		packet_put_int(c->self);
3349 	}
3350 	packet_send();
3351 }
3352 
3353 /* dummy protocol handler that denies SSH-1 requests (agent/x11) */
3354 /* ARGSUSED */
3355 void
3356 deny_input_open(int type, u_int32_t seq, void *ctxt)
3357 {
3358 	int rchan = packet_get_int();
3359 
3360 	switch (type) {
3361 	case SSH_SMSG_AGENT_OPEN:
3362 		error("Warning: ssh server tried agent forwarding.");
3363 		break;
3364 	case SSH_SMSG_X11_OPEN:
3365 		error("Warning: ssh server tried X11 forwarding.");
3366 		break;
3367 	default:
3368 		error("deny_input_open: type %d", type);
3369 		break;
3370 	}
3371 	error("Warning: this is probably a break-in attempt by a malicious server.");
3372 	packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
3373 	packet_put_int(rchan);
3374 	packet_send();
3375 }
3376 
3377 /*
3378  * Requests forwarding of X11 connections, generates fake authentication
3379  * data, and enables authentication spoofing.
3380  * This should be called in the client only.
3381  */
3382 void
3383 x11_request_forwarding_with_spoofing(int client_session_id, const char *disp,
3384     const char *proto, const char *data)
3385 {
3386 	u_int data_len = (u_int) strlen(data) / 2;
3387 	u_int i, value;
3388 	char *new_data;
3389 	int screen_number;
3390 	const char *cp;
3391 	u_int32_t rnd = 0;
3392 
3393 	if (x11_saved_display == NULL)
3394 		x11_saved_display = xstrdup(disp);
3395 	else if (strcmp(disp, x11_saved_display) != 0) {
3396 		error("x11_request_forwarding_with_spoofing: different "
3397 		    "$DISPLAY already forwarded");
3398 		return;
3399 	}
3400 
3401 	cp = strchr(disp, ':');
3402 	if (cp)
3403 		cp = strchr(cp, '.');
3404 	if (cp)
3405 		screen_number = (u_int)strtonum(cp + 1, 0, 400, NULL);
3406 	else
3407 		screen_number = 0;
3408 
3409 	if (x11_saved_proto == NULL) {
3410 		/* Save protocol name. */
3411 		x11_saved_proto = xstrdup(proto);
3412 		/*
3413 		 * Extract real authentication data and generate fake data
3414 		 * of the same length.
3415 		 */
3416 		x11_saved_data = xmalloc(data_len);
3417 		x11_fake_data = xmalloc(data_len);
3418 		for (i = 0; i < data_len; i++) {
3419 			if (sscanf(data + 2 * i, "%2x", &value) != 1)
3420 				fatal("x11_request_forwarding: bad "
3421 				    "authentication data: %.100s", data);
3422 			if (i % 4 == 0)
3423 				rnd = arc4random();
3424 			x11_saved_data[i] = value;
3425 			x11_fake_data[i] = rnd & 0xff;
3426 			rnd >>= 8;
3427 		}
3428 		x11_saved_data_len = data_len;
3429 		x11_fake_data_len = data_len;
3430 	}
3431 
3432 	/* Convert the fake data into hex. */
3433 	new_data = tohex(x11_fake_data, data_len);
3434 
3435 	/* Send the request packet. */
3436 	if (compat20) {
3437 		channel_request_start(client_session_id, "x11-req", 0);
3438 		packet_put_char(0);	/* XXX bool single connection */
3439 	} else {
3440 		packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
3441 	}
3442 	packet_put_cstring(proto);
3443 	packet_put_cstring(new_data);
3444 	packet_put_int(screen_number);
3445 	packet_send();
3446 	packet_write_wait();
3447 	xfree(new_data);
3448 }
3449 
3450 
3451 /* -- agent forwarding */
3452 
3453 /* Sends a message to the server to request authentication fd forwarding. */
3454 
3455 void
3456 auth_request_forwarding(void)
3457 {
3458 	packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
3459 	packet_send();
3460 	packet_write_wait();
3461 }
3462