1 /* $OpenBSD: channels.c,v 1.296 2009/05/25 06:48:00 andreas Exp $ */ 2 /* 3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * This file contains functions for generic socket connection forwarding. 7 * There is also code for initiating connection forwarding for X11 connections, 8 * arbitrary tcp/ip connections, and the authentication agent connection. 9 * 10 * As far as I am concerned, the code I have written for this software 11 * can be used freely for any purpose. Any derived versions of this 12 * software must be clearly marked as such, and if the derived work is 13 * incompatible with the protocol description in the RFC file, it must be 14 * called by a name other than "ssh" or "Secure Shell". 15 * 16 * SSH2 support added by Markus Friedl. 17 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. 18 * Copyright (c) 1999 Dug Song. All rights reserved. 19 * Copyright (c) 1999 Theo de Raadt. All rights reserved. 20 * 21 * Redistribution and use in source and binary forms, with or without 22 * modification, are permitted provided that the following conditions 23 * are met: 24 * 1. Redistributions of source code must retain the above copyright 25 * notice, this list of conditions and the following disclaimer. 26 * 2. Redistributions in binary form must reproduce the above copyright 27 * notice, this list of conditions and the following disclaimer in the 28 * documentation and/or other materials provided with the distribution. 29 * 30 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 31 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 32 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 33 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 34 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 35 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 36 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 37 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 38 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 39 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 40 */ 41 42 #include "includes.h" 43 44 #include <sys/types.h> 45 #include <sys/ioctl.h> 46 #include <sys/un.h> 47 #include <sys/socket.h> 48 #ifdef HAVE_SYS_TIME_H 49 # include <sys/time.h> 50 #endif 51 52 #include <netinet/in.h> 53 #include <arpa/inet.h> 54 55 #include <errno.h> 56 #include <netdb.h> 57 #include <stdio.h> 58 #include <stdlib.h> 59 #include <string.h> 60 #include <termios.h> 61 #include <unistd.h> 62 #include <stdarg.h> 63 64 #include "openbsd-compat/sys-queue.h" 65 #include "xmalloc.h" 66 #include "ssh.h" 67 #include "ssh1.h" 68 #include "ssh2.h" 69 #include "packet.h" 70 #include "log.h" 71 #include "misc.h" 72 #include "buffer.h" 73 #include "channels.h" 74 #include "compat.h" 75 #include "canohost.h" 76 #include "key.h" 77 #include "authfd.h" 78 #include "pathnames.h" 79 80 /* -- channel core */ 81 82 /* 83 * Pointer to an array containing all allocated channels. The array is 84 * dynamically extended as needed. 85 */ 86 static Channel **channels = NULL; 87 88 /* 89 * Size of the channel array. All slots of the array must always be 90 * initialized (at least the type field); unused slots set to NULL 91 */ 92 static u_int channels_alloc = 0; 93 94 /* 95 * Maximum file descriptor value used in any of the channels. This is 96 * updated in channel_new. 97 */ 98 static int channel_max_fd = 0; 99 100 101 /* -- tcp forwarding */ 102 103 /* 104 * Data structure for storing which hosts are permitted for forward requests. 105 * The local sides of any remote forwards are stored in this array to prevent 106 * a corrupt remote server from accessing arbitrary TCP/IP ports on our local 107 * network (which might be behind a firewall). 108 */ 109 typedef struct { 110 char *host_to_connect; /* Connect to 'host'. */ 111 u_short port_to_connect; /* Connect to 'port'. */ 112 u_short listen_port; /* Remote side should listen port number. */ 113 } ForwardPermission; 114 115 /* List of all permitted host/port pairs to connect by the user. */ 116 static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION]; 117 118 /* List of all permitted host/port pairs to connect by the admin. */ 119 static ForwardPermission permitted_adm_opens[SSH_MAX_FORWARDS_PER_DIRECTION]; 120 121 /* Number of permitted host/port pairs in the array permitted by the user. */ 122 static int num_permitted_opens = 0; 123 124 /* Number of permitted host/port pair in the array permitted by the admin. */ 125 static int num_adm_permitted_opens = 0; 126 127 /* 128 * If this is true, all opens are permitted. This is the case on the server 129 * on which we have to trust the client anyway, and the user could do 130 * anything after logging in anyway. 131 */ 132 static int all_opens_permitted = 0; 133 134 135 /* -- X11 forwarding */ 136 137 /* Maximum number of fake X11 displays to try. */ 138 #define MAX_DISPLAYS 1000 139 140 /* Saved X11 local (client) display. */ 141 static char *x11_saved_display = NULL; 142 143 /* Saved X11 authentication protocol name. */ 144 static char *x11_saved_proto = NULL; 145 146 /* Saved X11 authentication data. This is the real data. */ 147 static char *x11_saved_data = NULL; 148 static u_int x11_saved_data_len = 0; 149 150 /* 151 * Fake X11 authentication data. This is what the server will be sending us; 152 * we should replace any occurrences of this by the real data. 153 */ 154 static u_char *x11_fake_data = NULL; 155 static u_int x11_fake_data_len; 156 157 158 /* -- agent forwarding */ 159 160 #define NUM_SOCKS 10 161 162 /* AF_UNSPEC or AF_INET or AF_INET6 */ 163 static int IPv4or6 = AF_UNSPEC; 164 165 /* helper */ 166 static void port_open_helper(Channel *c, char *rtype); 167 168 /* non-blocking connect helpers */ 169 static int connect_next(struct channel_connect *); 170 static void channel_connect_ctx_free(struct channel_connect *); 171 172 /* -- channel core */ 173 174 Channel * 175 channel_by_id(int id) 176 { 177 Channel *c; 178 179 if (id < 0 || (u_int)id >= channels_alloc) { 180 logit("channel_by_id: %d: bad id", id); 181 return NULL; 182 } 183 c = channels[id]; 184 if (c == NULL) { 185 logit("channel_by_id: %d: bad id: channel free", id); 186 return NULL; 187 } 188 return c; 189 } 190 191 /* 192 * Returns the channel if it is allowed to receive protocol messages. 193 * Private channels, like listening sockets, may not receive messages. 194 */ 195 Channel * 196 channel_lookup(int id) 197 { 198 Channel *c; 199 200 if ((c = channel_by_id(id)) == NULL) 201 return (NULL); 202 203 switch (c->type) { 204 case SSH_CHANNEL_X11_OPEN: 205 case SSH_CHANNEL_LARVAL: 206 case SSH_CHANNEL_CONNECTING: 207 case SSH_CHANNEL_DYNAMIC: 208 case SSH_CHANNEL_OPENING: 209 case SSH_CHANNEL_OPEN: 210 case SSH_CHANNEL_INPUT_DRAINING: 211 case SSH_CHANNEL_OUTPUT_DRAINING: 212 return (c); 213 } 214 logit("Non-public channel %d, type %d.", id, c->type); 215 return (NULL); 216 } 217 218 /* 219 * Register filedescriptors for a channel, used when allocating a channel or 220 * when the channel consumer/producer is ready, e.g. shell exec'd 221 */ 222 static void 223 channel_register_fds(Channel *c, int rfd, int wfd, int efd, 224 int extusage, int nonblock, int is_tty) 225 { 226 /* Update the maximum file descriptor value. */ 227 channel_max_fd = MAX(channel_max_fd, rfd); 228 channel_max_fd = MAX(channel_max_fd, wfd); 229 channel_max_fd = MAX(channel_max_fd, efd); 230 231 /* XXX set close-on-exec -markus */ 232 233 c->rfd = rfd; 234 c->wfd = wfd; 235 c->sock = (rfd == wfd) ? rfd : -1; 236 c->ctl_fd = -1; /* XXX: set elsewhere */ 237 c->efd = efd; 238 c->extended_usage = extusage; 239 240 if ((c->isatty = is_tty) != 0) 241 debug2("channel %d: rfd %d isatty", c->self, c->rfd); 242 c->wfd_isatty = is_tty || isatty(c->wfd); 243 244 /* enable nonblocking mode */ 245 if (nonblock) { 246 if (rfd != -1) 247 set_nonblock(rfd); 248 if (wfd != -1) 249 set_nonblock(wfd); 250 if (efd != -1) 251 set_nonblock(efd); 252 } 253 } 254 255 /* 256 * Allocate a new channel object and set its type and socket. This will cause 257 * remote_name to be freed. 258 */ 259 Channel * 260 channel_new(char *ctype, int type, int rfd, int wfd, int efd, 261 u_int window, u_int maxpack, int extusage, char *remote_name, int nonblock) 262 { 263 int found; 264 u_int i; 265 Channel *c; 266 267 /* Do initial allocation if this is the first call. */ 268 if (channels_alloc == 0) { 269 channels_alloc = 10; 270 channels = xcalloc(channels_alloc, sizeof(Channel *)); 271 for (i = 0; i < channels_alloc; i++) 272 channels[i] = NULL; 273 } 274 /* Try to find a free slot where to put the new channel. */ 275 for (found = -1, i = 0; i < channels_alloc; i++) 276 if (channels[i] == NULL) { 277 /* Found a free slot. */ 278 found = (int)i; 279 break; 280 } 281 if (found < 0) { 282 /* There are no free slots. Take last+1 slot and expand the array. */ 283 found = channels_alloc; 284 if (channels_alloc > 10000) 285 fatal("channel_new: internal error: channels_alloc %d " 286 "too big.", channels_alloc); 287 channels = xrealloc(channels, channels_alloc + 10, 288 sizeof(Channel *)); 289 channels_alloc += 10; 290 debug2("channel: expanding %d", channels_alloc); 291 for (i = found; i < channels_alloc; i++) 292 channels[i] = NULL; 293 } 294 /* Initialize and return new channel. */ 295 c = channels[found] = xcalloc(1, sizeof(Channel)); 296 buffer_init(&c->input); 297 buffer_init(&c->output); 298 buffer_init(&c->extended); 299 c->path = NULL; 300 c->ostate = CHAN_OUTPUT_OPEN; 301 c->istate = CHAN_INPUT_OPEN; 302 c->flags = 0; 303 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, 0); 304 c->self = found; 305 c->type = type; 306 c->ctype = ctype; 307 c->local_window = window; 308 c->local_window_max = window; 309 c->local_consumed = 0; 310 c->local_maxpacket = maxpack; 311 c->remote_id = -1; 312 c->remote_name = xstrdup(remote_name); 313 c->remote_window = 0; 314 c->remote_maxpacket = 0; 315 c->force_drain = 0; 316 c->single_connection = 0; 317 c->detach_user = NULL; 318 c->detach_close = 0; 319 c->open_confirm = NULL; 320 c->open_confirm_ctx = NULL; 321 c->input_filter = NULL; 322 c->output_filter = NULL; 323 c->filter_ctx = NULL; 324 c->filter_cleanup = NULL; 325 TAILQ_INIT(&c->status_confirms); 326 debug("channel %d: new [%s]", found, remote_name); 327 return c; 328 } 329 330 static int 331 channel_find_maxfd(void) 332 { 333 u_int i; 334 int max = 0; 335 Channel *c; 336 337 for (i = 0; i < channels_alloc; i++) { 338 c = channels[i]; 339 if (c != NULL) { 340 max = MAX(max, c->rfd); 341 max = MAX(max, c->wfd); 342 max = MAX(max, c->efd); 343 } 344 } 345 return max; 346 } 347 348 int 349 channel_close_fd(int *fdp) 350 { 351 int ret = 0, fd = *fdp; 352 353 if (fd != -1) { 354 ret = close(fd); 355 *fdp = -1; 356 if (fd == channel_max_fd) 357 channel_max_fd = channel_find_maxfd(); 358 } 359 return ret; 360 } 361 362 /* Close all channel fd/socket. */ 363 static void 364 channel_close_fds(Channel *c) 365 { 366 debug3("channel %d: close_fds r %d w %d e %d c %d", 367 c->self, c->rfd, c->wfd, c->efd, c->ctl_fd); 368 369 channel_close_fd(&c->sock); 370 channel_close_fd(&c->ctl_fd); 371 channel_close_fd(&c->rfd); 372 channel_close_fd(&c->wfd); 373 channel_close_fd(&c->efd); 374 } 375 376 /* Free the channel and close its fd/socket. */ 377 void 378 channel_free(Channel *c) 379 { 380 char *s; 381 u_int i, n; 382 struct channel_confirm *cc; 383 384 for (n = 0, i = 0; i < channels_alloc; i++) 385 if (channels[i]) 386 n++; 387 debug("channel %d: free: %s, nchannels %u", c->self, 388 c->remote_name ? c->remote_name : "???", n); 389 390 s = channel_open_message(); 391 debug3("channel %d: status: %s", c->self, s); 392 xfree(s); 393 394 if (c->sock != -1) 395 shutdown(c->sock, SHUT_RDWR); 396 if (c->ctl_fd != -1) 397 shutdown(c->ctl_fd, SHUT_RDWR); 398 channel_close_fds(c); 399 buffer_free(&c->input); 400 buffer_free(&c->output); 401 buffer_free(&c->extended); 402 if (c->remote_name) { 403 xfree(c->remote_name); 404 c->remote_name = NULL; 405 } 406 if (c->path) { 407 xfree(c->path); 408 c->path = NULL; 409 } 410 while ((cc = TAILQ_FIRST(&c->status_confirms)) != NULL) { 411 if (cc->abandon_cb != NULL) 412 cc->abandon_cb(c, cc->ctx); 413 TAILQ_REMOVE(&c->status_confirms, cc, entry); 414 bzero(cc, sizeof(*cc)); 415 xfree(cc); 416 } 417 if (c->filter_cleanup != NULL && c->filter_ctx != NULL) 418 c->filter_cleanup(c->self, c->filter_ctx); 419 channels[c->self] = NULL; 420 xfree(c); 421 } 422 423 void 424 channel_free_all(void) 425 { 426 u_int i; 427 428 for (i = 0; i < channels_alloc; i++) 429 if (channels[i] != NULL) 430 channel_free(channels[i]); 431 } 432 433 /* 434 * Closes the sockets/fds of all channels. This is used to close extra file 435 * descriptors after a fork. 436 */ 437 void 438 channel_close_all(void) 439 { 440 u_int i; 441 442 for (i = 0; i < channels_alloc; i++) 443 if (channels[i] != NULL) 444 channel_close_fds(channels[i]); 445 } 446 447 /* 448 * Stop listening to channels. 449 */ 450 void 451 channel_stop_listening(void) 452 { 453 u_int i; 454 Channel *c; 455 456 for (i = 0; i < channels_alloc; i++) { 457 c = channels[i]; 458 if (c != NULL) { 459 switch (c->type) { 460 case SSH_CHANNEL_AUTH_SOCKET: 461 case SSH_CHANNEL_PORT_LISTENER: 462 case SSH_CHANNEL_RPORT_LISTENER: 463 case SSH_CHANNEL_X11_LISTENER: 464 channel_close_fd(&c->sock); 465 channel_free(c); 466 break; 467 } 468 } 469 } 470 } 471 472 /* 473 * Returns true if no channel has too much buffered data, and false if one or 474 * more channel is overfull. 475 */ 476 int 477 channel_not_very_much_buffered_data(void) 478 { 479 u_int i; 480 Channel *c; 481 482 for (i = 0; i < channels_alloc; i++) { 483 c = channels[i]; 484 if (c != NULL && c->type == SSH_CHANNEL_OPEN) { 485 #if 0 486 if (!compat20 && 487 buffer_len(&c->input) > packet_get_maxsize()) { 488 debug2("channel %d: big input buffer %d", 489 c->self, buffer_len(&c->input)); 490 return 0; 491 } 492 #endif 493 if (buffer_len(&c->output) > packet_get_maxsize()) { 494 debug2("channel %d: big output buffer %u > %u", 495 c->self, buffer_len(&c->output), 496 packet_get_maxsize()); 497 return 0; 498 } 499 } 500 } 501 return 1; 502 } 503 504 /* Returns true if any channel is still open. */ 505 int 506 channel_still_open(void) 507 { 508 u_int i; 509 Channel *c; 510 511 for (i = 0; i < channels_alloc; i++) { 512 c = channels[i]; 513 if (c == NULL) 514 continue; 515 switch (c->type) { 516 case SSH_CHANNEL_X11_LISTENER: 517 case SSH_CHANNEL_PORT_LISTENER: 518 case SSH_CHANNEL_RPORT_LISTENER: 519 case SSH_CHANNEL_CLOSED: 520 case SSH_CHANNEL_AUTH_SOCKET: 521 case SSH_CHANNEL_DYNAMIC: 522 case SSH_CHANNEL_CONNECTING: 523 case SSH_CHANNEL_ZOMBIE: 524 continue; 525 case SSH_CHANNEL_LARVAL: 526 if (!compat20) 527 fatal("cannot happen: SSH_CHANNEL_LARVAL"); 528 continue; 529 case SSH_CHANNEL_OPENING: 530 case SSH_CHANNEL_OPEN: 531 case SSH_CHANNEL_X11_OPEN: 532 return 1; 533 case SSH_CHANNEL_INPUT_DRAINING: 534 case SSH_CHANNEL_OUTPUT_DRAINING: 535 if (!compat13) 536 fatal("cannot happen: OUT_DRAIN"); 537 return 1; 538 default: 539 fatal("channel_still_open: bad channel type %d", c->type); 540 /* NOTREACHED */ 541 } 542 } 543 return 0; 544 } 545 546 /* Returns the id of an open channel suitable for keepaliving */ 547 int 548 channel_find_open(void) 549 { 550 u_int i; 551 Channel *c; 552 553 for (i = 0; i < channels_alloc; i++) { 554 c = channels[i]; 555 if (c == NULL || c->remote_id < 0) 556 continue; 557 switch (c->type) { 558 case SSH_CHANNEL_CLOSED: 559 case SSH_CHANNEL_DYNAMIC: 560 case SSH_CHANNEL_X11_LISTENER: 561 case SSH_CHANNEL_PORT_LISTENER: 562 case SSH_CHANNEL_RPORT_LISTENER: 563 case SSH_CHANNEL_OPENING: 564 case SSH_CHANNEL_CONNECTING: 565 case SSH_CHANNEL_ZOMBIE: 566 continue; 567 case SSH_CHANNEL_LARVAL: 568 case SSH_CHANNEL_AUTH_SOCKET: 569 case SSH_CHANNEL_OPEN: 570 case SSH_CHANNEL_X11_OPEN: 571 return i; 572 case SSH_CHANNEL_INPUT_DRAINING: 573 case SSH_CHANNEL_OUTPUT_DRAINING: 574 if (!compat13) 575 fatal("cannot happen: OUT_DRAIN"); 576 return i; 577 default: 578 fatal("channel_find_open: bad channel type %d", c->type); 579 /* NOTREACHED */ 580 } 581 } 582 return -1; 583 } 584 585 586 /* 587 * Returns a message describing the currently open forwarded connections, 588 * suitable for sending to the client. The message contains crlf pairs for 589 * newlines. 590 */ 591 char * 592 channel_open_message(void) 593 { 594 Buffer buffer; 595 Channel *c; 596 char buf[1024], *cp; 597 u_int i; 598 599 buffer_init(&buffer); 600 snprintf(buf, sizeof buf, "The following connections are open:\r\n"); 601 buffer_append(&buffer, buf, strlen(buf)); 602 for (i = 0; i < channels_alloc; i++) { 603 c = channels[i]; 604 if (c == NULL) 605 continue; 606 switch (c->type) { 607 case SSH_CHANNEL_X11_LISTENER: 608 case SSH_CHANNEL_PORT_LISTENER: 609 case SSH_CHANNEL_RPORT_LISTENER: 610 case SSH_CHANNEL_CLOSED: 611 case SSH_CHANNEL_AUTH_SOCKET: 612 case SSH_CHANNEL_ZOMBIE: 613 continue; 614 case SSH_CHANNEL_LARVAL: 615 case SSH_CHANNEL_OPENING: 616 case SSH_CHANNEL_CONNECTING: 617 case SSH_CHANNEL_DYNAMIC: 618 case SSH_CHANNEL_OPEN: 619 case SSH_CHANNEL_X11_OPEN: 620 case SSH_CHANNEL_INPUT_DRAINING: 621 case SSH_CHANNEL_OUTPUT_DRAINING: 622 snprintf(buf, sizeof buf, 623 " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d cfd %d)\r\n", 624 c->self, c->remote_name, 625 c->type, c->remote_id, 626 c->istate, buffer_len(&c->input), 627 c->ostate, buffer_len(&c->output), 628 c->rfd, c->wfd, c->ctl_fd); 629 buffer_append(&buffer, buf, strlen(buf)); 630 continue; 631 default: 632 fatal("channel_open_message: bad channel type %d", c->type); 633 /* NOTREACHED */ 634 } 635 } 636 buffer_append(&buffer, "\0", 1); 637 cp = xstrdup(buffer_ptr(&buffer)); 638 buffer_free(&buffer); 639 return cp; 640 } 641 642 void 643 channel_send_open(int id) 644 { 645 Channel *c = channel_lookup(id); 646 647 if (c == NULL) { 648 logit("channel_send_open: %d: bad id", id); 649 return; 650 } 651 debug2("channel %d: send open", id); 652 packet_start(SSH2_MSG_CHANNEL_OPEN); 653 packet_put_cstring(c->ctype); 654 packet_put_int(c->self); 655 packet_put_int(c->local_window); 656 packet_put_int(c->local_maxpacket); 657 packet_send(); 658 } 659 660 void 661 channel_request_start(int id, char *service, int wantconfirm) 662 { 663 Channel *c = channel_lookup(id); 664 665 if (c == NULL) { 666 logit("channel_request_start: %d: unknown channel id", id); 667 return; 668 } 669 debug2("channel %d: request %s confirm %d", id, service, wantconfirm); 670 packet_start(SSH2_MSG_CHANNEL_REQUEST); 671 packet_put_int(c->remote_id); 672 packet_put_cstring(service); 673 packet_put_char(wantconfirm); 674 } 675 676 void 677 channel_register_status_confirm(int id, channel_confirm_cb *cb, 678 channel_confirm_abandon_cb *abandon_cb, void *ctx) 679 { 680 struct channel_confirm *cc; 681 Channel *c; 682 683 if ((c = channel_lookup(id)) == NULL) 684 fatal("channel_register_expect: %d: bad id", id); 685 686 cc = xmalloc(sizeof(*cc)); 687 cc->cb = cb; 688 cc->abandon_cb = abandon_cb; 689 cc->ctx = ctx; 690 TAILQ_INSERT_TAIL(&c->status_confirms, cc, entry); 691 } 692 693 void 694 channel_register_open_confirm(int id, channel_callback_fn *fn, void *ctx) 695 { 696 Channel *c = channel_lookup(id); 697 698 if (c == NULL) { 699 logit("channel_register_open_confirm: %d: bad id", id); 700 return; 701 } 702 c->open_confirm = fn; 703 c->open_confirm_ctx = ctx; 704 } 705 706 void 707 channel_register_cleanup(int id, channel_callback_fn *fn, int do_close) 708 { 709 Channel *c = channel_by_id(id); 710 711 if (c == NULL) { 712 logit("channel_register_cleanup: %d: bad id", id); 713 return; 714 } 715 c->detach_user = fn; 716 c->detach_close = do_close; 717 } 718 719 void 720 channel_cancel_cleanup(int id) 721 { 722 Channel *c = channel_by_id(id); 723 724 if (c == NULL) { 725 logit("channel_cancel_cleanup: %d: bad id", id); 726 return; 727 } 728 c->detach_user = NULL; 729 c->detach_close = 0; 730 } 731 732 void 733 channel_register_filter(int id, channel_infilter_fn *ifn, 734 channel_outfilter_fn *ofn, channel_filter_cleanup_fn *cfn, void *ctx) 735 { 736 Channel *c = channel_lookup(id); 737 738 if (c == NULL) { 739 logit("channel_register_filter: %d: bad id", id); 740 return; 741 } 742 c->input_filter = ifn; 743 c->output_filter = ofn; 744 c->filter_ctx = ctx; 745 c->filter_cleanup = cfn; 746 } 747 748 void 749 channel_set_fds(int id, int rfd, int wfd, int efd, 750 int extusage, int nonblock, int is_tty, u_int window_max) 751 { 752 Channel *c = channel_lookup(id); 753 754 if (c == NULL || c->type != SSH_CHANNEL_LARVAL) 755 fatal("channel_activate for non-larval channel %d.", id); 756 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, is_tty); 757 c->type = SSH_CHANNEL_OPEN; 758 c->local_window = c->local_window_max = window_max; 759 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); 760 packet_put_int(c->remote_id); 761 packet_put_int(c->local_window); 762 packet_send(); 763 } 764 765 /* 766 * 'channel_pre*' are called just before select() to add any bits relevant to 767 * channels in the select bitmasks. 768 */ 769 /* 770 * 'channel_post*': perform any appropriate operations for channels which 771 * have events pending. 772 */ 773 typedef void chan_fn(Channel *c, fd_set *readset, fd_set *writeset); 774 chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE]; 775 chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE]; 776 777 /* ARGSUSED */ 778 static void 779 channel_pre_listener(Channel *c, fd_set *readset, fd_set *writeset) 780 { 781 FD_SET(c->sock, readset); 782 } 783 784 /* ARGSUSED */ 785 static void 786 channel_pre_connecting(Channel *c, fd_set *readset, fd_set *writeset) 787 { 788 debug3("channel %d: waiting for connection", c->self); 789 FD_SET(c->sock, writeset); 790 } 791 792 static void 793 channel_pre_open_13(Channel *c, fd_set *readset, fd_set *writeset) 794 { 795 if (buffer_len(&c->input) < packet_get_maxsize()) 796 FD_SET(c->sock, readset); 797 if (buffer_len(&c->output) > 0) 798 FD_SET(c->sock, writeset); 799 } 800 801 static void 802 channel_pre_open(Channel *c, fd_set *readset, fd_set *writeset) 803 { 804 u_int limit = compat20 ? c->remote_window : packet_get_maxsize(); 805 806 if (c->istate == CHAN_INPUT_OPEN && 807 limit > 0 && 808 buffer_len(&c->input) < limit && 809 buffer_check_alloc(&c->input, CHAN_RBUF)) 810 FD_SET(c->rfd, readset); 811 if (c->ostate == CHAN_OUTPUT_OPEN || 812 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { 813 if (buffer_len(&c->output) > 0) { 814 FD_SET(c->wfd, writeset); 815 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { 816 if (CHANNEL_EFD_OUTPUT_ACTIVE(c)) 817 debug2("channel %d: obuf_empty delayed efd %d/(%d)", 818 c->self, c->efd, buffer_len(&c->extended)); 819 else 820 chan_obuf_empty(c); 821 } 822 } 823 /** XXX check close conditions, too */ 824 if (compat20 && c->efd != -1 && 825 !(c->istate == CHAN_INPUT_CLOSED && c->ostate == CHAN_OUTPUT_CLOSED)) { 826 if (c->extended_usage == CHAN_EXTENDED_WRITE && 827 buffer_len(&c->extended) > 0) 828 FD_SET(c->efd, writeset); 829 else if (!(c->flags & CHAN_EOF_SENT) && 830 c->extended_usage == CHAN_EXTENDED_READ && 831 buffer_len(&c->extended) < c->remote_window) 832 FD_SET(c->efd, readset); 833 } 834 /* XXX: What about efd? races? */ 835 if (compat20 && c->ctl_fd != -1 && 836 c->istate == CHAN_INPUT_OPEN && c->ostate == CHAN_OUTPUT_OPEN) 837 FD_SET(c->ctl_fd, readset); 838 } 839 840 /* ARGSUSED */ 841 static void 842 channel_pre_input_draining(Channel *c, fd_set *readset, fd_set *writeset) 843 { 844 if (buffer_len(&c->input) == 0) { 845 packet_start(SSH_MSG_CHANNEL_CLOSE); 846 packet_put_int(c->remote_id); 847 packet_send(); 848 c->type = SSH_CHANNEL_CLOSED; 849 debug2("channel %d: closing after input drain.", c->self); 850 } 851 } 852 853 /* ARGSUSED */ 854 static void 855 channel_pre_output_draining(Channel *c, fd_set *readset, fd_set *writeset) 856 { 857 if (buffer_len(&c->output) == 0) 858 chan_mark_dead(c); 859 else 860 FD_SET(c->sock, writeset); 861 } 862 863 /* 864 * This is a special state for X11 authentication spoofing. An opened X11 865 * connection (when authentication spoofing is being done) remains in this 866 * state until the first packet has been completely read. The authentication 867 * data in that packet is then substituted by the real data if it matches the 868 * fake data, and the channel is put into normal mode. 869 * XXX All this happens at the client side. 870 * Returns: 0 = need more data, -1 = wrong cookie, 1 = ok 871 */ 872 static int 873 x11_open_helper(Buffer *b) 874 { 875 u_char *ucp; 876 u_int proto_len, data_len; 877 878 /* Check if the fixed size part of the packet is in buffer. */ 879 if (buffer_len(b) < 12) 880 return 0; 881 882 /* Parse the lengths of variable-length fields. */ 883 ucp = buffer_ptr(b); 884 if (ucp[0] == 0x42) { /* Byte order MSB first. */ 885 proto_len = 256 * ucp[6] + ucp[7]; 886 data_len = 256 * ucp[8] + ucp[9]; 887 } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */ 888 proto_len = ucp[6] + 256 * ucp[7]; 889 data_len = ucp[8] + 256 * ucp[9]; 890 } else { 891 debug2("Initial X11 packet contains bad byte order byte: 0x%x", 892 ucp[0]); 893 return -1; 894 } 895 896 /* Check if the whole packet is in buffer. */ 897 if (buffer_len(b) < 898 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3)) 899 return 0; 900 901 /* Check if authentication protocol matches. */ 902 if (proto_len != strlen(x11_saved_proto) || 903 memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) { 904 debug2("X11 connection uses different authentication protocol."); 905 return -1; 906 } 907 /* Check if authentication data matches our fake data. */ 908 if (data_len != x11_fake_data_len || 909 memcmp(ucp + 12 + ((proto_len + 3) & ~3), 910 x11_fake_data, x11_fake_data_len) != 0) { 911 debug2("X11 auth data does not match fake data."); 912 return -1; 913 } 914 /* Check fake data length */ 915 if (x11_fake_data_len != x11_saved_data_len) { 916 error("X11 fake_data_len %d != saved_data_len %d", 917 x11_fake_data_len, x11_saved_data_len); 918 return -1; 919 } 920 /* 921 * Received authentication protocol and data match 922 * our fake data. Substitute the fake data with real 923 * data. 924 */ 925 memcpy(ucp + 12 + ((proto_len + 3) & ~3), 926 x11_saved_data, x11_saved_data_len); 927 return 1; 928 } 929 930 static void 931 channel_pre_x11_open_13(Channel *c, fd_set *readset, fd_set *writeset) 932 { 933 int ret = x11_open_helper(&c->output); 934 935 if (ret == 1) { 936 /* Start normal processing for the channel. */ 937 c->type = SSH_CHANNEL_OPEN; 938 channel_pre_open_13(c, readset, writeset); 939 } else if (ret == -1) { 940 /* 941 * We have received an X11 connection that has bad 942 * authentication information. 943 */ 944 logit("X11 connection rejected because of wrong authentication."); 945 buffer_clear(&c->input); 946 buffer_clear(&c->output); 947 channel_close_fd(&c->sock); 948 c->sock = -1; 949 c->type = SSH_CHANNEL_CLOSED; 950 packet_start(SSH_MSG_CHANNEL_CLOSE); 951 packet_put_int(c->remote_id); 952 packet_send(); 953 } 954 } 955 956 static void 957 channel_pre_x11_open(Channel *c, fd_set *readset, fd_set *writeset) 958 { 959 int ret = x11_open_helper(&c->output); 960 961 /* c->force_drain = 1; */ 962 963 if (ret == 1) { 964 c->type = SSH_CHANNEL_OPEN; 965 channel_pre_open(c, readset, writeset); 966 } else if (ret == -1) { 967 logit("X11 connection rejected because of wrong authentication."); 968 debug2("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate); 969 chan_read_failed(c); 970 buffer_clear(&c->input); 971 chan_ibuf_empty(c); 972 buffer_clear(&c->output); 973 /* for proto v1, the peer will send an IEOF */ 974 if (compat20) 975 chan_write_failed(c); 976 else 977 c->type = SSH_CHANNEL_OPEN; 978 debug2("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate); 979 } 980 } 981 982 /* try to decode a socks4 header */ 983 /* ARGSUSED */ 984 static int 985 channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset) 986 { 987 char *p, *host; 988 u_int len, have, i, found, need; 989 char username[256]; 990 struct { 991 u_int8_t version; 992 u_int8_t command; 993 u_int16_t dest_port; 994 struct in_addr dest_addr; 995 } s4_req, s4_rsp; 996 997 debug2("channel %d: decode socks4", c->self); 998 999 have = buffer_len(&c->input); 1000 len = sizeof(s4_req); 1001 if (have < len) 1002 return 0; 1003 p = buffer_ptr(&c->input); 1004 1005 need = 1; 1006 /* SOCKS4A uses an invalid IP address 0.0.0.x */ 1007 if (p[4] == 0 && p[5] == 0 && p[6] == 0 && p[7] != 0) { 1008 debug2("channel %d: socks4a request", c->self); 1009 /* ... and needs an extra string (the hostname) */ 1010 need = 2; 1011 } 1012 /* Check for terminating NUL on the string(s) */ 1013 for (found = 0, i = len; i < have; i++) { 1014 if (p[i] == '\0') { 1015 found++; 1016 if (found == need) 1017 break; 1018 } 1019 if (i > 1024) { 1020 /* the peer is probably sending garbage */ 1021 debug("channel %d: decode socks4: too long", 1022 c->self); 1023 return -1; 1024 } 1025 } 1026 if (found < need) 1027 return 0; 1028 buffer_get(&c->input, (char *)&s4_req.version, 1); 1029 buffer_get(&c->input, (char *)&s4_req.command, 1); 1030 buffer_get(&c->input, (char *)&s4_req.dest_port, 2); 1031 buffer_get(&c->input, (char *)&s4_req.dest_addr, 4); 1032 have = buffer_len(&c->input); 1033 p = buffer_ptr(&c->input); 1034 len = strlen(p); 1035 debug2("channel %d: decode socks4: user %s/%d", c->self, p, len); 1036 len++; /* trailing '\0' */ 1037 if (len > have) 1038 fatal("channel %d: decode socks4: len %d > have %d", 1039 c->self, len, have); 1040 strlcpy(username, p, sizeof(username)); 1041 buffer_consume(&c->input, len); 1042 1043 if (c->path != NULL) { 1044 xfree(c->path); 1045 c->path = NULL; 1046 } 1047 if (need == 1) { /* SOCKS4: one string */ 1048 host = inet_ntoa(s4_req.dest_addr); 1049 c->path = xstrdup(host); 1050 } else { /* SOCKS4A: two strings */ 1051 have = buffer_len(&c->input); 1052 p = buffer_ptr(&c->input); 1053 len = strlen(p); 1054 debug2("channel %d: decode socks4a: host %s/%d", 1055 c->self, p, len); 1056 len++; /* trailing '\0' */ 1057 if (len > have) 1058 fatal("channel %d: decode socks4a: len %d > have %d", 1059 c->self, len, have); 1060 if (len > NI_MAXHOST) { 1061 error("channel %d: hostname \"%.100s\" too long", 1062 c->self, p); 1063 return -1; 1064 } 1065 c->path = xstrdup(p); 1066 buffer_consume(&c->input, len); 1067 } 1068 c->host_port = ntohs(s4_req.dest_port); 1069 1070 debug2("channel %d: dynamic request: socks4 host %s port %u command %u", 1071 c->self, c->path, c->host_port, s4_req.command); 1072 1073 if (s4_req.command != 1) { 1074 debug("channel %d: cannot handle: %s cn %d", 1075 c->self, need == 1 ? "SOCKS4" : "SOCKS4A", s4_req.command); 1076 return -1; 1077 } 1078 s4_rsp.version = 0; /* vn: 0 for reply */ 1079 s4_rsp.command = 90; /* cd: req granted */ 1080 s4_rsp.dest_port = 0; /* ignored */ 1081 s4_rsp.dest_addr.s_addr = INADDR_ANY; /* ignored */ 1082 buffer_append(&c->output, &s4_rsp, sizeof(s4_rsp)); 1083 return 1; 1084 } 1085 1086 /* try to decode a socks5 header */ 1087 #define SSH_SOCKS5_AUTHDONE 0x1000 1088 #define SSH_SOCKS5_NOAUTH 0x00 1089 #define SSH_SOCKS5_IPV4 0x01 1090 #define SSH_SOCKS5_DOMAIN 0x03 1091 #define SSH_SOCKS5_IPV6 0x04 1092 #define SSH_SOCKS5_CONNECT 0x01 1093 #define SSH_SOCKS5_SUCCESS 0x00 1094 1095 /* ARGSUSED */ 1096 static int 1097 channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset) 1098 { 1099 struct { 1100 u_int8_t version; 1101 u_int8_t command; 1102 u_int8_t reserved; 1103 u_int8_t atyp; 1104 } s5_req, s5_rsp; 1105 u_int16_t dest_port; 1106 u_char *p, dest_addr[255+1], ntop[INET6_ADDRSTRLEN]; 1107 u_int have, need, i, found, nmethods, addrlen, af; 1108 1109 debug2("channel %d: decode socks5", c->self); 1110 p = buffer_ptr(&c->input); 1111 if (p[0] != 0x05) 1112 return -1; 1113 have = buffer_len(&c->input); 1114 if (!(c->flags & SSH_SOCKS5_AUTHDONE)) { 1115 /* format: ver | nmethods | methods */ 1116 if (have < 2) 1117 return 0; 1118 nmethods = p[1]; 1119 if (have < nmethods + 2) 1120 return 0; 1121 /* look for method: "NO AUTHENTICATION REQUIRED" */ 1122 for (found = 0, i = 2; i < nmethods + 2; i++) { 1123 if (p[i] == SSH_SOCKS5_NOAUTH) { 1124 found = 1; 1125 break; 1126 } 1127 } 1128 if (!found) { 1129 debug("channel %d: method SSH_SOCKS5_NOAUTH not found", 1130 c->self); 1131 return -1; 1132 } 1133 buffer_consume(&c->input, nmethods + 2); 1134 buffer_put_char(&c->output, 0x05); /* version */ 1135 buffer_put_char(&c->output, SSH_SOCKS5_NOAUTH); /* method */ 1136 FD_SET(c->sock, writeset); 1137 c->flags |= SSH_SOCKS5_AUTHDONE; 1138 debug2("channel %d: socks5 auth done", c->self); 1139 return 0; /* need more */ 1140 } 1141 debug2("channel %d: socks5 post auth", c->self); 1142 if (have < sizeof(s5_req)+1) 1143 return 0; /* need more */ 1144 memcpy(&s5_req, p, sizeof(s5_req)); 1145 if (s5_req.version != 0x05 || 1146 s5_req.command != SSH_SOCKS5_CONNECT || 1147 s5_req.reserved != 0x00) { 1148 debug2("channel %d: only socks5 connect supported", c->self); 1149 return -1; 1150 } 1151 switch (s5_req.atyp){ 1152 case SSH_SOCKS5_IPV4: 1153 addrlen = 4; 1154 af = AF_INET; 1155 break; 1156 case SSH_SOCKS5_DOMAIN: 1157 addrlen = p[sizeof(s5_req)]; 1158 af = -1; 1159 break; 1160 case SSH_SOCKS5_IPV6: 1161 addrlen = 16; 1162 af = AF_INET6; 1163 break; 1164 default: 1165 debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp); 1166 return -1; 1167 } 1168 need = sizeof(s5_req) + addrlen + 2; 1169 if (s5_req.atyp == SSH_SOCKS5_DOMAIN) 1170 need++; 1171 if (have < need) 1172 return 0; 1173 buffer_consume(&c->input, sizeof(s5_req)); 1174 if (s5_req.atyp == SSH_SOCKS5_DOMAIN) 1175 buffer_consume(&c->input, 1); /* host string length */ 1176 buffer_get(&c->input, (char *)&dest_addr, addrlen); 1177 buffer_get(&c->input, (char *)&dest_port, 2); 1178 dest_addr[addrlen] = '\0'; 1179 if (c->path != NULL) { 1180 xfree(c->path); 1181 c->path = NULL; 1182 } 1183 if (s5_req.atyp == SSH_SOCKS5_DOMAIN) { 1184 if (addrlen >= NI_MAXHOST) { 1185 error("channel %d: dynamic request: socks5 hostname " 1186 "\"%.100s\" too long", c->self, dest_addr); 1187 return -1; 1188 } 1189 c->path = xstrdup(dest_addr); 1190 } else { 1191 if (inet_ntop(af, dest_addr, ntop, sizeof(ntop)) == NULL) 1192 return -1; 1193 c->path = xstrdup(ntop); 1194 } 1195 c->host_port = ntohs(dest_port); 1196 1197 debug2("channel %d: dynamic request: socks5 host %s port %u command %u", 1198 c->self, c->path, c->host_port, s5_req.command); 1199 1200 s5_rsp.version = 0x05; 1201 s5_rsp.command = SSH_SOCKS5_SUCCESS; 1202 s5_rsp.reserved = 0; /* ignored */ 1203 s5_rsp.atyp = SSH_SOCKS5_IPV4; 1204 ((struct in_addr *)&dest_addr)->s_addr = INADDR_ANY; 1205 dest_port = 0; /* ignored */ 1206 1207 buffer_append(&c->output, &s5_rsp, sizeof(s5_rsp)); 1208 buffer_append(&c->output, &dest_addr, sizeof(struct in_addr)); 1209 buffer_append(&c->output, &dest_port, sizeof(dest_port)); 1210 return 1; 1211 } 1212 1213 /* dynamic port forwarding */ 1214 static void 1215 channel_pre_dynamic(Channel *c, fd_set *readset, fd_set *writeset) 1216 { 1217 u_char *p; 1218 u_int have; 1219 int ret; 1220 1221 have = buffer_len(&c->input); 1222 c->delayed = 0; 1223 debug2("channel %d: pre_dynamic: have %d", c->self, have); 1224 /* buffer_dump(&c->input); */ 1225 /* check if the fixed size part of the packet is in buffer. */ 1226 if (have < 3) { 1227 /* need more */ 1228 FD_SET(c->sock, readset); 1229 return; 1230 } 1231 /* try to guess the protocol */ 1232 p = buffer_ptr(&c->input); 1233 switch (p[0]) { 1234 case 0x04: 1235 ret = channel_decode_socks4(c, readset, writeset); 1236 break; 1237 case 0x05: 1238 ret = channel_decode_socks5(c, readset, writeset); 1239 break; 1240 default: 1241 ret = -1; 1242 break; 1243 } 1244 if (ret < 0) { 1245 chan_mark_dead(c); 1246 } else if (ret == 0) { 1247 debug2("channel %d: pre_dynamic: need more", c->self); 1248 /* need more */ 1249 FD_SET(c->sock, readset); 1250 } else { 1251 /* switch to the next state */ 1252 c->type = SSH_CHANNEL_OPENING; 1253 port_open_helper(c, "direct-tcpip"); 1254 } 1255 } 1256 1257 /* This is our fake X11 server socket. */ 1258 /* ARGSUSED */ 1259 static void 1260 channel_post_x11_listener(Channel *c, fd_set *readset, fd_set *writeset) 1261 { 1262 Channel *nc; 1263 struct sockaddr_storage addr; 1264 int newsock; 1265 socklen_t addrlen; 1266 char buf[16384], *remote_ipaddr; 1267 int remote_port; 1268 1269 if (FD_ISSET(c->sock, readset)) { 1270 debug("X11 connection requested."); 1271 addrlen = sizeof(addr); 1272 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); 1273 if (c->single_connection) { 1274 debug2("single_connection: closing X11 listener."); 1275 channel_close_fd(&c->sock); 1276 chan_mark_dead(c); 1277 } 1278 if (newsock < 0) { 1279 error("accept: %.100s", strerror(errno)); 1280 return; 1281 } 1282 set_nodelay(newsock); 1283 remote_ipaddr = get_peer_ipaddr(newsock); 1284 remote_port = get_peer_port(newsock); 1285 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d", 1286 remote_ipaddr, remote_port); 1287 1288 nc = channel_new("accepted x11 socket", 1289 SSH_CHANNEL_OPENING, newsock, newsock, -1, 1290 c->local_window_max, c->local_maxpacket, 0, buf, 1); 1291 if (compat20) { 1292 packet_start(SSH2_MSG_CHANNEL_OPEN); 1293 packet_put_cstring("x11"); 1294 packet_put_int(nc->self); 1295 packet_put_int(nc->local_window_max); 1296 packet_put_int(nc->local_maxpacket); 1297 /* originator ipaddr and port */ 1298 packet_put_cstring(remote_ipaddr); 1299 if (datafellows & SSH_BUG_X11FWD) { 1300 debug2("ssh2 x11 bug compat mode"); 1301 } else { 1302 packet_put_int(remote_port); 1303 } 1304 packet_send(); 1305 } else { 1306 packet_start(SSH_SMSG_X11_OPEN); 1307 packet_put_int(nc->self); 1308 if (packet_get_protocol_flags() & 1309 SSH_PROTOFLAG_HOST_IN_FWD_OPEN) 1310 packet_put_cstring(buf); 1311 packet_send(); 1312 } 1313 xfree(remote_ipaddr); 1314 } 1315 } 1316 1317 static void 1318 port_open_helper(Channel *c, char *rtype) 1319 { 1320 int direct; 1321 char buf[1024]; 1322 char *remote_ipaddr = get_peer_ipaddr(c->sock); 1323 int remote_port = get_peer_port(c->sock); 1324 1325 direct = (strcmp(rtype, "direct-tcpip") == 0); 1326 1327 snprintf(buf, sizeof buf, 1328 "%s: listening port %d for %.100s port %d, " 1329 "connect from %.200s port %d", 1330 rtype, c->listening_port, c->path, c->host_port, 1331 remote_ipaddr, remote_port); 1332 1333 xfree(c->remote_name); 1334 c->remote_name = xstrdup(buf); 1335 1336 if (compat20) { 1337 packet_start(SSH2_MSG_CHANNEL_OPEN); 1338 packet_put_cstring(rtype); 1339 packet_put_int(c->self); 1340 packet_put_int(c->local_window_max); 1341 packet_put_int(c->local_maxpacket); 1342 if (direct) { 1343 /* target host, port */ 1344 packet_put_cstring(c->path); 1345 packet_put_int(c->host_port); 1346 } else { 1347 /* listen address, port */ 1348 packet_put_cstring(c->path); 1349 packet_put_int(c->listening_port); 1350 } 1351 /* originator host and port */ 1352 packet_put_cstring(remote_ipaddr); 1353 packet_put_int((u_int)remote_port); 1354 packet_send(); 1355 } else { 1356 packet_start(SSH_MSG_PORT_OPEN); 1357 packet_put_int(c->self); 1358 packet_put_cstring(c->path); 1359 packet_put_int(c->host_port); 1360 if (packet_get_protocol_flags() & 1361 SSH_PROTOFLAG_HOST_IN_FWD_OPEN) 1362 packet_put_cstring(c->remote_name); 1363 packet_send(); 1364 } 1365 xfree(remote_ipaddr); 1366 } 1367 1368 static void 1369 channel_set_reuseaddr(int fd) 1370 { 1371 int on = 1; 1372 1373 /* 1374 * Set socket options. 1375 * Allow local port reuse in TIME_WAIT. 1376 */ 1377 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1) 1378 error("setsockopt SO_REUSEADDR fd %d: %s", fd, strerror(errno)); 1379 } 1380 1381 /* 1382 * This socket is listening for connections to a forwarded TCP/IP port. 1383 */ 1384 /* ARGSUSED */ 1385 static void 1386 channel_post_port_listener(Channel *c, fd_set *readset, fd_set *writeset) 1387 { 1388 Channel *nc; 1389 struct sockaddr_storage addr; 1390 int newsock, nextstate; 1391 socklen_t addrlen; 1392 char *rtype; 1393 1394 if (FD_ISSET(c->sock, readset)) { 1395 debug("Connection to port %d forwarding " 1396 "to %.100s port %d requested.", 1397 c->listening_port, c->path, c->host_port); 1398 1399 if (c->type == SSH_CHANNEL_RPORT_LISTENER) { 1400 nextstate = SSH_CHANNEL_OPENING; 1401 rtype = "forwarded-tcpip"; 1402 } else { 1403 if (c->host_port == 0) { 1404 nextstate = SSH_CHANNEL_DYNAMIC; 1405 rtype = "dynamic-tcpip"; 1406 } else { 1407 nextstate = SSH_CHANNEL_OPENING; 1408 rtype = "direct-tcpip"; 1409 } 1410 } 1411 1412 addrlen = sizeof(addr); 1413 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); 1414 if (newsock < 0) { 1415 error("accept: %.100s", strerror(errno)); 1416 return; 1417 } 1418 set_nodelay(newsock); 1419 nc = channel_new(rtype, nextstate, newsock, newsock, -1, 1420 c->local_window_max, c->local_maxpacket, 0, rtype, 1); 1421 nc->listening_port = c->listening_port; 1422 nc->host_port = c->host_port; 1423 if (c->path != NULL) 1424 nc->path = xstrdup(c->path); 1425 1426 if (nextstate == SSH_CHANNEL_DYNAMIC) { 1427 /* 1428 * do not call the channel_post handler until 1429 * this flag has been reset by a pre-handler. 1430 * otherwise the FD_ISSET calls might overflow 1431 */ 1432 nc->delayed = 1; 1433 } else { 1434 port_open_helper(nc, rtype); 1435 } 1436 } 1437 } 1438 1439 /* 1440 * This is the authentication agent socket listening for connections from 1441 * clients. 1442 */ 1443 /* ARGSUSED */ 1444 static void 1445 channel_post_auth_listener(Channel *c, fd_set *readset, fd_set *writeset) 1446 { 1447 Channel *nc; 1448 int newsock; 1449 struct sockaddr_storage addr; 1450 socklen_t addrlen; 1451 1452 if (FD_ISSET(c->sock, readset)) { 1453 addrlen = sizeof(addr); 1454 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); 1455 if (newsock < 0) { 1456 error("accept from auth socket: %.100s", strerror(errno)); 1457 return; 1458 } 1459 nc = channel_new("accepted auth socket", 1460 SSH_CHANNEL_OPENING, newsock, newsock, -1, 1461 c->local_window_max, c->local_maxpacket, 1462 0, "accepted auth socket", 1); 1463 if (compat20) { 1464 packet_start(SSH2_MSG_CHANNEL_OPEN); 1465 packet_put_cstring("auth-agent@openssh.com"); 1466 packet_put_int(nc->self); 1467 packet_put_int(c->local_window_max); 1468 packet_put_int(c->local_maxpacket); 1469 } else { 1470 packet_start(SSH_SMSG_AGENT_OPEN); 1471 packet_put_int(nc->self); 1472 } 1473 packet_send(); 1474 } 1475 } 1476 1477 /* ARGSUSED */ 1478 static void 1479 channel_post_connecting(Channel *c, fd_set *readset, fd_set *writeset) 1480 { 1481 int err = 0, sock; 1482 socklen_t sz = sizeof(err); 1483 1484 if (FD_ISSET(c->sock, writeset)) { 1485 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, &err, &sz) < 0) { 1486 err = errno; 1487 error("getsockopt SO_ERROR failed"); 1488 } 1489 if (err == 0) { 1490 debug("channel %d: connected to %s port %d", 1491 c->self, c->connect_ctx.host, c->connect_ctx.port); 1492 channel_connect_ctx_free(&c->connect_ctx); 1493 c->type = SSH_CHANNEL_OPEN; 1494 if (compat20) { 1495 packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); 1496 packet_put_int(c->remote_id); 1497 packet_put_int(c->self); 1498 packet_put_int(c->local_window); 1499 packet_put_int(c->local_maxpacket); 1500 } else { 1501 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); 1502 packet_put_int(c->remote_id); 1503 packet_put_int(c->self); 1504 } 1505 } else { 1506 debug("channel %d: connection failed: %s", 1507 c->self, strerror(err)); 1508 /* Try next address, if any */ 1509 if ((sock = connect_next(&c->connect_ctx)) > 0) { 1510 close(c->sock); 1511 c->sock = c->rfd = c->wfd = sock; 1512 channel_max_fd = channel_find_maxfd(); 1513 return; 1514 } 1515 /* Exhausted all addresses */ 1516 error("connect_to %.100s port %d: failed.", 1517 c->connect_ctx.host, c->connect_ctx.port); 1518 channel_connect_ctx_free(&c->connect_ctx); 1519 if (compat20) { 1520 packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE); 1521 packet_put_int(c->remote_id); 1522 packet_put_int(SSH2_OPEN_CONNECT_FAILED); 1523 if (!(datafellows & SSH_BUG_OPENFAILURE)) { 1524 packet_put_cstring(strerror(err)); 1525 packet_put_cstring(""); 1526 } 1527 } else { 1528 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 1529 packet_put_int(c->remote_id); 1530 } 1531 chan_mark_dead(c); 1532 } 1533 packet_send(); 1534 } 1535 } 1536 1537 /* ARGSUSED */ 1538 static int 1539 channel_handle_rfd(Channel *c, fd_set *readset, fd_set *writeset) 1540 { 1541 char buf[CHAN_RBUF]; 1542 int len, force; 1543 1544 force = c->isatty && c->detach_close && c->istate != CHAN_INPUT_CLOSED; 1545 if (c->rfd != -1 && (force || FD_ISSET(c->rfd, readset))) { 1546 errno = 0; 1547 len = read(c->rfd, buf, sizeof(buf)); 1548 if (len < 0 && (errno == EINTR || 1549 ((errno == EAGAIN || errno == EWOULDBLOCK) && !force))) 1550 return 1; 1551 #ifndef PTY_ZEROREAD 1552 if (len <= 0) { 1553 #else 1554 if ((!c->isatty && len <= 0) || 1555 (c->isatty && (len < 0 || (len == 0 && errno != 0)))) { 1556 #endif 1557 debug2("channel %d: read<=0 rfd %d len %d", 1558 c->self, c->rfd, len); 1559 if (c->type != SSH_CHANNEL_OPEN) { 1560 debug2("channel %d: not open", c->self); 1561 chan_mark_dead(c); 1562 return -1; 1563 } else if (compat13) { 1564 buffer_clear(&c->output); 1565 c->type = SSH_CHANNEL_INPUT_DRAINING; 1566 debug2("channel %d: input draining.", c->self); 1567 } else { 1568 chan_read_failed(c); 1569 } 1570 return -1; 1571 } 1572 if (c->input_filter != NULL) { 1573 if (c->input_filter(c, buf, len) == -1) { 1574 debug2("channel %d: filter stops", c->self); 1575 chan_read_failed(c); 1576 } 1577 } else if (c->datagram) { 1578 buffer_put_string(&c->input, buf, len); 1579 } else { 1580 buffer_append(&c->input, buf, len); 1581 } 1582 } 1583 return 1; 1584 } 1585 1586 /* ARGSUSED */ 1587 static int 1588 channel_handle_wfd(Channel *c, fd_set *readset, fd_set *writeset) 1589 { 1590 struct termios tio; 1591 u_char *data = NULL, *buf; 1592 u_int dlen; 1593 int len; 1594 1595 /* Send buffered output data to the socket. */ 1596 if (c->wfd != -1 && 1597 FD_ISSET(c->wfd, writeset) && 1598 buffer_len(&c->output) > 0) { 1599 if (c->output_filter != NULL) { 1600 if ((buf = c->output_filter(c, &data, &dlen)) == NULL) { 1601 debug2("channel %d: filter stops", c->self); 1602 if (c->type != SSH_CHANNEL_OPEN) 1603 chan_mark_dead(c); 1604 else 1605 chan_write_failed(c); 1606 return -1; 1607 } 1608 } else if (c->datagram) { 1609 buf = data = buffer_get_string(&c->output, &dlen); 1610 } else { 1611 buf = data = buffer_ptr(&c->output); 1612 dlen = buffer_len(&c->output); 1613 } 1614 1615 if (c->datagram) { 1616 /* ignore truncated writes, datagrams might get lost */ 1617 c->local_consumed += dlen + 4; 1618 len = write(c->wfd, buf, dlen); 1619 xfree(data); 1620 if (len < 0 && (errno == EINTR || errno == EAGAIN || 1621 errno == EWOULDBLOCK)) 1622 return 1; 1623 if (len <= 0) { 1624 if (c->type != SSH_CHANNEL_OPEN) 1625 chan_mark_dead(c); 1626 else 1627 chan_write_failed(c); 1628 return -1; 1629 } 1630 return 1; 1631 } 1632 #ifdef _AIX 1633 /* XXX: Later AIX versions can't push as much data to tty */ 1634 if (compat20 && c->wfd_isatty) 1635 dlen = MIN(dlen, 8*1024); 1636 #endif 1637 1638 len = write(c->wfd, buf, dlen); 1639 if (len < 0 && 1640 (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)) 1641 return 1; 1642 if (len <= 0) { 1643 if (c->type != SSH_CHANNEL_OPEN) { 1644 debug2("channel %d: not open", c->self); 1645 chan_mark_dead(c); 1646 return -1; 1647 } else if (compat13) { 1648 buffer_clear(&c->output); 1649 debug2("channel %d: input draining.", c->self); 1650 c->type = SSH_CHANNEL_INPUT_DRAINING; 1651 } else { 1652 chan_write_failed(c); 1653 } 1654 return -1; 1655 } 1656 #ifndef BROKEN_TCGETATTR_ICANON 1657 if (compat20 && c->isatty && dlen >= 1 && buf[0] != '\r') { 1658 if (tcgetattr(c->wfd, &tio) == 0 && 1659 !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) { 1660 /* 1661 * Simulate echo to reduce the impact of 1662 * traffic analysis. We need to match the 1663 * size of a SSH2_MSG_CHANNEL_DATA message 1664 * (4 byte channel id + buf) 1665 */ 1666 packet_send_ignore(4 + len); 1667 packet_send(); 1668 } 1669 } 1670 #endif 1671 buffer_consume(&c->output, len); 1672 if (compat20 && len > 0) { 1673 c->local_consumed += len; 1674 } 1675 } 1676 return 1; 1677 } 1678 1679 static int 1680 channel_handle_efd(Channel *c, fd_set *readset, fd_set *writeset) 1681 { 1682 char buf[CHAN_RBUF]; 1683 int len; 1684 1685 /** XXX handle drain efd, too */ 1686 if (c->efd != -1) { 1687 if (c->extended_usage == CHAN_EXTENDED_WRITE && 1688 FD_ISSET(c->efd, writeset) && 1689 buffer_len(&c->extended) > 0) { 1690 len = write(c->efd, buffer_ptr(&c->extended), 1691 buffer_len(&c->extended)); 1692 debug2("channel %d: written %d to efd %d", 1693 c->self, len, c->efd); 1694 if (len < 0 && (errno == EINTR || errno == EAGAIN || 1695 errno == EWOULDBLOCK)) 1696 return 1; 1697 if (len <= 0) { 1698 debug2("channel %d: closing write-efd %d", 1699 c->self, c->efd); 1700 channel_close_fd(&c->efd); 1701 } else { 1702 buffer_consume(&c->extended, len); 1703 c->local_consumed += len; 1704 } 1705 } else if (c->extended_usage == CHAN_EXTENDED_READ && 1706 (c->detach_close || FD_ISSET(c->efd, readset))) { 1707 len = read(c->efd, buf, sizeof(buf)); 1708 debug2("channel %d: read %d from efd %d", 1709 c->self, len, c->efd); 1710 if (len < 0 && (errno == EINTR || ((errno == EAGAIN || 1711 errno == EWOULDBLOCK) && !c->detach_close))) 1712 return 1; 1713 if (len <= 0) { 1714 debug2("channel %d: closing read-efd %d", 1715 c->self, c->efd); 1716 channel_close_fd(&c->efd); 1717 } else { 1718 buffer_append(&c->extended, buf, len); 1719 } 1720 } 1721 } 1722 return 1; 1723 } 1724 1725 /* ARGSUSED */ 1726 static int 1727 channel_handle_ctl(Channel *c, fd_set *readset, fd_set *writeset) 1728 { 1729 char buf[16]; 1730 int len; 1731 1732 /* Monitor control fd to detect if the slave client exits */ 1733 if (c->ctl_fd != -1 && FD_ISSET(c->ctl_fd, readset)) { 1734 len = read(c->ctl_fd, buf, sizeof(buf)); 1735 if (len < 0 && 1736 (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)) 1737 return 1; 1738 if (len <= 0) { 1739 debug2("channel %d: ctl read<=0", c->self); 1740 if (c->type != SSH_CHANNEL_OPEN) { 1741 debug2("channel %d: not open", c->self); 1742 chan_mark_dead(c); 1743 return -1; 1744 } else { 1745 chan_read_failed(c); 1746 chan_write_failed(c); 1747 } 1748 return -1; 1749 } else 1750 fatal("%s: unexpected data on ctl fd", __func__); 1751 } 1752 return 1; 1753 } 1754 1755 static int 1756 channel_check_window(Channel *c) 1757 { 1758 if (c->type == SSH_CHANNEL_OPEN && 1759 !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) && 1760 ((c->local_window_max - c->local_window > 1761 c->local_maxpacket*3) || 1762 c->local_window < c->local_window_max/2) && 1763 c->local_consumed > 0) { 1764 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); 1765 packet_put_int(c->remote_id); 1766 packet_put_int(c->local_consumed); 1767 packet_send(); 1768 debug2("channel %d: window %d sent adjust %d", 1769 c->self, c->local_window, 1770 c->local_consumed); 1771 c->local_window += c->local_consumed; 1772 c->local_consumed = 0; 1773 } 1774 return 1; 1775 } 1776 1777 static void 1778 channel_post_open(Channel *c, fd_set *readset, fd_set *writeset) 1779 { 1780 if (c->delayed) 1781 return; 1782 channel_handle_rfd(c, readset, writeset); 1783 channel_handle_wfd(c, readset, writeset); 1784 if (!compat20) 1785 return; 1786 channel_handle_efd(c, readset, writeset); 1787 channel_handle_ctl(c, readset, writeset); 1788 channel_check_window(c); 1789 } 1790 1791 /* ARGSUSED */ 1792 static void 1793 channel_post_output_drain_13(Channel *c, fd_set *readset, fd_set *writeset) 1794 { 1795 int len; 1796 1797 /* Send buffered output data to the socket. */ 1798 if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) { 1799 len = write(c->sock, buffer_ptr(&c->output), 1800 buffer_len(&c->output)); 1801 if (len <= 0) 1802 buffer_clear(&c->output); 1803 else 1804 buffer_consume(&c->output, len); 1805 } 1806 } 1807 1808 static void 1809 channel_handler_init_20(void) 1810 { 1811 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open; 1812 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; 1813 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; 1814 channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener; 1815 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; 1816 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; 1817 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; 1818 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; 1819 1820 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; 1821 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; 1822 channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener; 1823 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; 1824 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; 1825 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; 1826 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; 1827 } 1828 1829 static void 1830 channel_handler_init_13(void) 1831 { 1832 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13; 1833 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13; 1834 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; 1835 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; 1836 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; 1837 channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining; 1838 channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining; 1839 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; 1840 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; 1841 1842 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; 1843 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; 1844 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; 1845 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; 1846 channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13; 1847 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; 1848 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; 1849 } 1850 1851 static void 1852 channel_handler_init_15(void) 1853 { 1854 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open; 1855 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; 1856 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; 1857 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; 1858 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; 1859 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; 1860 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; 1861 1862 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; 1863 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; 1864 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; 1865 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; 1866 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; 1867 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; 1868 } 1869 1870 static void 1871 channel_handler_init(void) 1872 { 1873 int i; 1874 1875 for (i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) { 1876 channel_pre[i] = NULL; 1877 channel_post[i] = NULL; 1878 } 1879 if (compat20) 1880 channel_handler_init_20(); 1881 else if (compat13) 1882 channel_handler_init_13(); 1883 else 1884 channel_handler_init_15(); 1885 } 1886 1887 /* gc dead channels */ 1888 static void 1889 channel_garbage_collect(Channel *c) 1890 { 1891 if (c == NULL) 1892 return; 1893 if (c->detach_user != NULL) { 1894 if (!chan_is_dead(c, c->detach_close)) 1895 return; 1896 debug2("channel %d: gc: notify user", c->self); 1897 c->detach_user(c->self, NULL); 1898 /* if we still have a callback */ 1899 if (c->detach_user != NULL) 1900 return; 1901 debug2("channel %d: gc: user detached", c->self); 1902 } 1903 if (!chan_is_dead(c, 1)) 1904 return; 1905 debug2("channel %d: garbage collecting", c->self); 1906 channel_free(c); 1907 } 1908 1909 static void 1910 channel_handler(chan_fn *ftab[], fd_set *readset, fd_set *writeset) 1911 { 1912 static int did_init = 0; 1913 u_int i; 1914 Channel *c; 1915 1916 if (!did_init) { 1917 channel_handler_init(); 1918 did_init = 1; 1919 } 1920 for (i = 0; i < channels_alloc; i++) { 1921 c = channels[i]; 1922 if (c == NULL) 1923 continue; 1924 if (ftab[c->type] != NULL) 1925 (*ftab[c->type])(c, readset, writeset); 1926 channel_garbage_collect(c); 1927 } 1928 } 1929 1930 /* 1931 * Allocate/update select bitmasks and add any bits relevant to channels in 1932 * select bitmasks. 1933 */ 1934 void 1935 channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp, 1936 u_int *nallocp, int rekeying) 1937 { 1938 u_int n, sz, nfdset; 1939 1940 n = MAX(*maxfdp, channel_max_fd); 1941 1942 nfdset = howmany(n+1, NFDBITS); 1943 /* Explicitly test here, because xrealloc isn't always called */ 1944 if (nfdset && SIZE_T_MAX / nfdset < sizeof(fd_mask)) 1945 fatal("channel_prepare_select: max_fd (%d) is too large", n); 1946 sz = nfdset * sizeof(fd_mask); 1947 1948 /* perhaps check sz < nalloc/2 and shrink? */ 1949 if (*readsetp == NULL || sz > *nallocp) { 1950 *readsetp = xrealloc(*readsetp, nfdset, sizeof(fd_mask)); 1951 *writesetp = xrealloc(*writesetp, nfdset, sizeof(fd_mask)); 1952 *nallocp = sz; 1953 } 1954 *maxfdp = n; 1955 memset(*readsetp, 0, sz); 1956 memset(*writesetp, 0, sz); 1957 1958 if (!rekeying) 1959 channel_handler(channel_pre, *readsetp, *writesetp); 1960 } 1961 1962 /* 1963 * After select, perform any appropriate operations for channels which have 1964 * events pending. 1965 */ 1966 void 1967 channel_after_select(fd_set *readset, fd_set *writeset) 1968 { 1969 channel_handler(channel_post, readset, writeset); 1970 } 1971 1972 1973 /* If there is data to send to the connection, enqueue some of it now. */ 1974 void 1975 channel_output_poll(void) 1976 { 1977 Channel *c; 1978 u_int i, len; 1979 1980 for (i = 0; i < channels_alloc; i++) { 1981 c = channels[i]; 1982 if (c == NULL) 1983 continue; 1984 1985 /* 1986 * We are only interested in channels that can have buffered 1987 * incoming data. 1988 */ 1989 if (compat13) { 1990 if (c->type != SSH_CHANNEL_OPEN && 1991 c->type != SSH_CHANNEL_INPUT_DRAINING) 1992 continue; 1993 } else { 1994 if (c->type != SSH_CHANNEL_OPEN) 1995 continue; 1996 } 1997 if (compat20 && 1998 (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) { 1999 /* XXX is this true? */ 2000 debug3("channel %d: will not send data after close", c->self); 2001 continue; 2002 } 2003 2004 /* Get the amount of buffered data for this channel. */ 2005 if ((c->istate == CHAN_INPUT_OPEN || 2006 c->istate == CHAN_INPUT_WAIT_DRAIN) && 2007 (len = buffer_len(&c->input)) > 0) { 2008 if (c->datagram) { 2009 if (len > 0) { 2010 u_char *data; 2011 u_int dlen; 2012 2013 data = buffer_get_string(&c->input, 2014 &dlen); 2015 packet_start(SSH2_MSG_CHANNEL_DATA); 2016 packet_put_int(c->remote_id); 2017 packet_put_string(data, dlen); 2018 packet_send(); 2019 c->remote_window -= dlen + 4; 2020 xfree(data); 2021 } 2022 continue; 2023 } 2024 /* 2025 * Send some data for the other side over the secure 2026 * connection. 2027 */ 2028 if (compat20) { 2029 if (len > c->remote_window) 2030 len = c->remote_window; 2031 if (len > c->remote_maxpacket) 2032 len = c->remote_maxpacket; 2033 } else { 2034 if (packet_is_interactive()) { 2035 if (len > 1024) 2036 len = 512; 2037 } else { 2038 /* Keep the packets at reasonable size. */ 2039 if (len > packet_get_maxsize()/2) 2040 len = packet_get_maxsize()/2; 2041 } 2042 } 2043 if (len > 0) { 2044 packet_start(compat20 ? 2045 SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA); 2046 packet_put_int(c->remote_id); 2047 packet_put_string(buffer_ptr(&c->input), len); 2048 packet_send(); 2049 buffer_consume(&c->input, len); 2050 c->remote_window -= len; 2051 } 2052 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) { 2053 if (compat13) 2054 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3"); 2055 /* 2056 * input-buffer is empty and read-socket shutdown: 2057 * tell peer, that we will not send more data: send IEOF. 2058 * hack for extended data: delay EOF if EFD still in use. 2059 */ 2060 if (CHANNEL_EFD_INPUT_ACTIVE(c)) 2061 debug2("channel %d: ibuf_empty delayed efd %d/(%d)", 2062 c->self, c->efd, buffer_len(&c->extended)); 2063 else 2064 chan_ibuf_empty(c); 2065 } 2066 /* Send extended data, i.e. stderr */ 2067 if (compat20 && 2068 !(c->flags & CHAN_EOF_SENT) && 2069 c->remote_window > 0 && 2070 (len = buffer_len(&c->extended)) > 0 && 2071 c->extended_usage == CHAN_EXTENDED_READ) { 2072 debug2("channel %d: rwin %u elen %u euse %d", 2073 c->self, c->remote_window, buffer_len(&c->extended), 2074 c->extended_usage); 2075 if (len > c->remote_window) 2076 len = c->remote_window; 2077 if (len > c->remote_maxpacket) 2078 len = c->remote_maxpacket; 2079 packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA); 2080 packet_put_int(c->remote_id); 2081 packet_put_int(SSH2_EXTENDED_DATA_STDERR); 2082 packet_put_string(buffer_ptr(&c->extended), len); 2083 packet_send(); 2084 buffer_consume(&c->extended, len); 2085 c->remote_window -= len; 2086 debug2("channel %d: sent ext data %d", c->self, len); 2087 } 2088 } 2089 } 2090 2091 2092 /* -- protocol input */ 2093 2094 /* ARGSUSED */ 2095 void 2096 channel_input_data(int type, u_int32_t seq, void *ctxt) 2097 { 2098 int id; 2099 char *data; 2100 u_int data_len; 2101 Channel *c; 2102 2103 /* Get the channel number and verify it. */ 2104 id = packet_get_int(); 2105 c = channel_lookup(id); 2106 if (c == NULL) 2107 packet_disconnect("Received data for nonexistent channel %d.", id); 2108 2109 /* Ignore any data for non-open channels (might happen on close) */ 2110 if (c->type != SSH_CHANNEL_OPEN && 2111 c->type != SSH_CHANNEL_X11_OPEN) 2112 return; 2113 2114 /* Get the data. */ 2115 data = packet_get_string_ptr(&data_len); 2116 2117 /* 2118 * Ignore data for protocol > 1.3 if output end is no longer open. 2119 * For protocol 2 the sending side is reducing its window as it sends 2120 * data, so we must 'fake' consumption of the data in order to ensure 2121 * that window updates are sent back. Otherwise the connection might 2122 * deadlock. 2123 */ 2124 if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN) { 2125 if (compat20) { 2126 c->local_window -= data_len; 2127 c->local_consumed += data_len; 2128 } 2129 return; 2130 } 2131 2132 if (compat20) { 2133 if (data_len > c->local_maxpacket) { 2134 logit("channel %d: rcvd big packet %d, maxpack %d", 2135 c->self, data_len, c->local_maxpacket); 2136 } 2137 if (data_len > c->local_window) { 2138 logit("channel %d: rcvd too much data %d, win %d", 2139 c->self, data_len, c->local_window); 2140 return; 2141 } 2142 c->local_window -= data_len; 2143 } 2144 if (c->datagram) 2145 buffer_put_string(&c->output, data, data_len); 2146 else 2147 buffer_append(&c->output, data, data_len); 2148 packet_check_eom(); 2149 } 2150 2151 /* ARGSUSED */ 2152 void 2153 channel_input_extended_data(int type, u_int32_t seq, void *ctxt) 2154 { 2155 int id; 2156 char *data; 2157 u_int data_len, tcode; 2158 Channel *c; 2159 2160 /* Get the channel number and verify it. */ 2161 id = packet_get_int(); 2162 c = channel_lookup(id); 2163 2164 if (c == NULL) 2165 packet_disconnect("Received extended_data for bad channel %d.", id); 2166 if (c->type != SSH_CHANNEL_OPEN) { 2167 logit("channel %d: ext data for non open", id); 2168 return; 2169 } 2170 if (c->flags & CHAN_EOF_RCVD) { 2171 if (datafellows & SSH_BUG_EXTEOF) 2172 debug("channel %d: accepting ext data after eof", id); 2173 else 2174 packet_disconnect("Received extended_data after EOF " 2175 "on channel %d.", id); 2176 } 2177 tcode = packet_get_int(); 2178 if (c->efd == -1 || 2179 c->extended_usage != CHAN_EXTENDED_WRITE || 2180 tcode != SSH2_EXTENDED_DATA_STDERR) { 2181 logit("channel %d: bad ext data", c->self); 2182 return; 2183 } 2184 data = packet_get_string(&data_len); 2185 packet_check_eom(); 2186 if (data_len > c->local_window) { 2187 logit("channel %d: rcvd too much extended_data %d, win %d", 2188 c->self, data_len, c->local_window); 2189 xfree(data); 2190 return; 2191 } 2192 debug2("channel %d: rcvd ext data %d", c->self, data_len); 2193 c->local_window -= data_len; 2194 buffer_append(&c->extended, data, data_len); 2195 xfree(data); 2196 } 2197 2198 /* ARGSUSED */ 2199 void 2200 channel_input_ieof(int type, u_int32_t seq, void *ctxt) 2201 { 2202 int id; 2203 Channel *c; 2204 2205 id = packet_get_int(); 2206 packet_check_eom(); 2207 c = channel_lookup(id); 2208 if (c == NULL) 2209 packet_disconnect("Received ieof for nonexistent channel %d.", id); 2210 chan_rcvd_ieof(c); 2211 2212 /* XXX force input close */ 2213 if (c->force_drain && c->istate == CHAN_INPUT_OPEN) { 2214 debug("channel %d: FORCE input drain", c->self); 2215 c->istate = CHAN_INPUT_WAIT_DRAIN; 2216 if (buffer_len(&c->input) == 0) 2217 chan_ibuf_empty(c); 2218 } 2219 2220 } 2221 2222 /* ARGSUSED */ 2223 void 2224 channel_input_close(int type, u_int32_t seq, void *ctxt) 2225 { 2226 int id; 2227 Channel *c; 2228 2229 id = packet_get_int(); 2230 packet_check_eom(); 2231 c = channel_lookup(id); 2232 if (c == NULL) 2233 packet_disconnect("Received close for nonexistent channel %d.", id); 2234 2235 /* 2236 * Send a confirmation that we have closed the channel and no more 2237 * data is coming for it. 2238 */ 2239 packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION); 2240 packet_put_int(c->remote_id); 2241 packet_send(); 2242 2243 /* 2244 * If the channel is in closed state, we have sent a close request, 2245 * and the other side will eventually respond with a confirmation. 2246 * Thus, we cannot free the channel here, because then there would be 2247 * no-one to receive the confirmation. The channel gets freed when 2248 * the confirmation arrives. 2249 */ 2250 if (c->type != SSH_CHANNEL_CLOSED) { 2251 /* 2252 * Not a closed channel - mark it as draining, which will 2253 * cause it to be freed later. 2254 */ 2255 buffer_clear(&c->input); 2256 c->type = SSH_CHANNEL_OUTPUT_DRAINING; 2257 } 2258 } 2259 2260 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */ 2261 /* ARGSUSED */ 2262 void 2263 channel_input_oclose(int type, u_int32_t seq, void *ctxt) 2264 { 2265 int id = packet_get_int(); 2266 Channel *c = channel_lookup(id); 2267 2268 packet_check_eom(); 2269 if (c == NULL) 2270 packet_disconnect("Received oclose for nonexistent channel %d.", id); 2271 chan_rcvd_oclose(c); 2272 } 2273 2274 /* ARGSUSED */ 2275 void 2276 channel_input_close_confirmation(int type, u_int32_t seq, void *ctxt) 2277 { 2278 int id = packet_get_int(); 2279 Channel *c = channel_lookup(id); 2280 2281 packet_check_eom(); 2282 if (c == NULL) 2283 packet_disconnect("Received close confirmation for " 2284 "out-of-range channel %d.", id); 2285 if (c->type != SSH_CHANNEL_CLOSED) 2286 packet_disconnect("Received close confirmation for " 2287 "non-closed channel %d (type %d).", id, c->type); 2288 channel_free(c); 2289 } 2290 2291 /* ARGSUSED */ 2292 void 2293 channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt) 2294 { 2295 int id, remote_id; 2296 Channel *c; 2297 2298 id = packet_get_int(); 2299 c = channel_lookup(id); 2300 2301 if (c==NULL || c->type != SSH_CHANNEL_OPENING) 2302 packet_disconnect("Received open confirmation for " 2303 "non-opening channel %d.", id); 2304 remote_id = packet_get_int(); 2305 /* Record the remote channel number and mark that the channel is now open. */ 2306 c->remote_id = remote_id; 2307 c->type = SSH_CHANNEL_OPEN; 2308 2309 if (compat20) { 2310 c->remote_window = packet_get_int(); 2311 c->remote_maxpacket = packet_get_int(); 2312 if (c->open_confirm) { 2313 debug2("callback start"); 2314 c->open_confirm(c->self, c->open_confirm_ctx); 2315 debug2("callback done"); 2316 } 2317 debug2("channel %d: open confirm rwindow %u rmax %u", c->self, 2318 c->remote_window, c->remote_maxpacket); 2319 } 2320 packet_check_eom(); 2321 } 2322 2323 static char * 2324 reason2txt(int reason) 2325 { 2326 switch (reason) { 2327 case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED: 2328 return "administratively prohibited"; 2329 case SSH2_OPEN_CONNECT_FAILED: 2330 return "connect failed"; 2331 case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE: 2332 return "unknown channel type"; 2333 case SSH2_OPEN_RESOURCE_SHORTAGE: 2334 return "resource shortage"; 2335 } 2336 return "unknown reason"; 2337 } 2338 2339 /* ARGSUSED */ 2340 void 2341 channel_input_open_failure(int type, u_int32_t seq, void *ctxt) 2342 { 2343 int id, reason; 2344 char *msg = NULL, *lang = NULL; 2345 Channel *c; 2346 2347 id = packet_get_int(); 2348 c = channel_lookup(id); 2349 2350 if (c==NULL || c->type != SSH_CHANNEL_OPENING) 2351 packet_disconnect("Received open failure for " 2352 "non-opening channel %d.", id); 2353 if (compat20) { 2354 reason = packet_get_int(); 2355 if (!(datafellows & SSH_BUG_OPENFAILURE)) { 2356 msg = packet_get_string(NULL); 2357 lang = packet_get_string(NULL); 2358 } 2359 logit("channel %d: open failed: %s%s%s", id, 2360 reason2txt(reason), msg ? ": ": "", msg ? msg : ""); 2361 if (msg != NULL) 2362 xfree(msg); 2363 if (lang != NULL) 2364 xfree(lang); 2365 } 2366 packet_check_eom(); 2367 /* Schedule the channel for cleanup/deletion. */ 2368 chan_mark_dead(c); 2369 } 2370 2371 /* ARGSUSED */ 2372 void 2373 channel_input_window_adjust(int type, u_int32_t seq, void *ctxt) 2374 { 2375 Channel *c; 2376 int id; 2377 u_int adjust; 2378 2379 if (!compat20) 2380 return; 2381 2382 /* Get the channel number and verify it. */ 2383 id = packet_get_int(); 2384 c = channel_lookup(id); 2385 2386 if (c == NULL) { 2387 logit("Received window adjust for non-open channel %d.", id); 2388 return; 2389 } 2390 adjust = packet_get_int(); 2391 packet_check_eom(); 2392 debug2("channel %d: rcvd adjust %u", id, adjust); 2393 c->remote_window += adjust; 2394 } 2395 2396 /* ARGSUSED */ 2397 void 2398 channel_input_port_open(int type, u_int32_t seq, void *ctxt) 2399 { 2400 Channel *c = NULL; 2401 u_short host_port; 2402 char *host, *originator_string; 2403 int remote_id; 2404 2405 remote_id = packet_get_int(); 2406 host = packet_get_string(NULL); 2407 host_port = packet_get_int(); 2408 2409 if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) { 2410 originator_string = packet_get_string(NULL); 2411 } else { 2412 originator_string = xstrdup("unknown (remote did not supply name)"); 2413 } 2414 packet_check_eom(); 2415 c = channel_connect_to(host, host_port, 2416 "connected socket", originator_string); 2417 xfree(originator_string); 2418 xfree(host); 2419 if (c == NULL) { 2420 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 2421 packet_put_int(remote_id); 2422 packet_send(); 2423 } else 2424 c->remote_id = remote_id; 2425 } 2426 2427 /* ARGSUSED */ 2428 void 2429 channel_input_status_confirm(int type, u_int32_t seq, void *ctxt) 2430 { 2431 Channel *c; 2432 struct channel_confirm *cc; 2433 int id; 2434 2435 /* Reset keepalive timeout */ 2436 packet_set_alive_timeouts(0); 2437 2438 id = packet_get_int(); 2439 packet_check_eom(); 2440 2441 debug2("channel_input_status_confirm: type %d id %d", type, id); 2442 2443 if ((c = channel_lookup(id)) == NULL) { 2444 logit("channel_input_status_confirm: %d: unknown", id); 2445 return; 2446 } 2447 ; 2448 if ((cc = TAILQ_FIRST(&c->status_confirms)) == NULL) 2449 return; 2450 cc->cb(type, c, cc->ctx); 2451 TAILQ_REMOVE(&c->status_confirms, cc, entry); 2452 bzero(cc, sizeof(*cc)); 2453 xfree(cc); 2454 } 2455 2456 /* -- tcp forwarding */ 2457 2458 void 2459 channel_set_af(int af) 2460 { 2461 IPv4or6 = af; 2462 } 2463 2464 static int 2465 channel_setup_fwd_listener(int type, const char *listen_addr, 2466 u_short listen_port, int *allocated_listen_port, 2467 const char *host_to_connect, u_short port_to_connect, int gateway_ports) 2468 { 2469 Channel *c; 2470 int sock, r, success = 0, wildcard = 0, is_client; 2471 struct addrinfo hints, *ai, *aitop; 2472 const char *host, *addr; 2473 char ntop[NI_MAXHOST], strport[NI_MAXSERV]; 2474 in_port_t *lport_p; 2475 2476 host = (type == SSH_CHANNEL_RPORT_LISTENER) ? 2477 listen_addr : host_to_connect; 2478 is_client = (type == SSH_CHANNEL_PORT_LISTENER); 2479 2480 if (host == NULL) { 2481 error("No forward host name."); 2482 return 0; 2483 } 2484 if (strlen(host) >= NI_MAXHOST) { 2485 error("Forward host name too long."); 2486 return 0; 2487 } 2488 2489 /* 2490 * Determine whether or not a port forward listens to loopback, 2491 * specified address or wildcard. On the client, a specified bind 2492 * address will always override gateway_ports. On the server, a 2493 * gateway_ports of 1 (``yes'') will override the client's 2494 * specification and force a wildcard bind, whereas a value of 2 2495 * (``clientspecified'') will bind to whatever address the client 2496 * asked for. 2497 * 2498 * Special-case listen_addrs are: 2499 * 2500 * "0.0.0.0" -> wildcard v4/v6 if SSH_OLD_FORWARD_ADDR 2501 * "" (empty string), "*" -> wildcard v4/v6 2502 * "localhost" -> loopback v4/v6 2503 */ 2504 addr = NULL; 2505 if (listen_addr == NULL) { 2506 /* No address specified: default to gateway_ports setting */ 2507 if (gateway_ports) 2508 wildcard = 1; 2509 } else if (gateway_ports || is_client) { 2510 if (((datafellows & SSH_OLD_FORWARD_ADDR) && 2511 strcmp(listen_addr, "0.0.0.0") == 0 && is_client == 0) || 2512 *listen_addr == '\0' || strcmp(listen_addr, "*") == 0 || 2513 (!is_client && gateway_ports == 1)) 2514 wildcard = 1; 2515 else if (strcmp(listen_addr, "localhost") != 0) 2516 addr = listen_addr; 2517 } 2518 2519 debug3("channel_setup_fwd_listener: type %d wildcard %d addr %s", 2520 type, wildcard, (addr == NULL) ? "NULL" : addr); 2521 2522 /* 2523 * getaddrinfo returns a loopback address if the hostname is 2524 * set to NULL and hints.ai_flags is not AI_PASSIVE 2525 */ 2526 memset(&hints, 0, sizeof(hints)); 2527 hints.ai_family = IPv4or6; 2528 hints.ai_flags = wildcard ? AI_PASSIVE : 0; 2529 hints.ai_socktype = SOCK_STREAM; 2530 snprintf(strport, sizeof strport, "%d", listen_port); 2531 if ((r = getaddrinfo(addr, strport, &hints, &aitop)) != 0) { 2532 if (addr == NULL) { 2533 /* This really shouldn't happen */ 2534 packet_disconnect("getaddrinfo: fatal error: %s", 2535 ssh_gai_strerror(r)); 2536 } else { 2537 error("channel_setup_fwd_listener: " 2538 "getaddrinfo(%.64s): %s", addr, 2539 ssh_gai_strerror(r)); 2540 } 2541 return 0; 2542 } 2543 if (allocated_listen_port != NULL) 2544 *allocated_listen_port = 0; 2545 for (ai = aitop; ai; ai = ai->ai_next) { 2546 switch (ai->ai_family) { 2547 case AF_INET: 2548 lport_p = &((struct sockaddr_in *)ai->ai_addr)-> 2549 sin_port; 2550 break; 2551 case AF_INET6: 2552 lport_p = &((struct sockaddr_in6 *)ai->ai_addr)-> 2553 sin6_port; 2554 break; 2555 default: 2556 continue; 2557 } 2558 /* 2559 * If allocating a port for -R forwards, then use the 2560 * same port for all address families. 2561 */ 2562 if (type == SSH_CHANNEL_RPORT_LISTENER && listen_port == 0 && 2563 allocated_listen_port != NULL && *allocated_listen_port > 0) 2564 *lport_p = htons(*allocated_listen_port); 2565 2566 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), 2567 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { 2568 error("channel_setup_fwd_listener: getnameinfo failed"); 2569 continue; 2570 } 2571 /* Create a port to listen for the host. */ 2572 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); 2573 if (sock < 0) { 2574 /* this is no error since kernel may not support ipv6 */ 2575 verbose("socket: %.100s", strerror(errno)); 2576 continue; 2577 } 2578 2579 channel_set_reuseaddr(sock); 2580 2581 debug("Local forwarding listening on %s port %s.", 2582 ntop, strport); 2583 2584 /* Bind the socket to the address. */ 2585 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 2586 /* address can be in use ipv6 address is already bound */ 2587 if (!ai->ai_next) 2588 error("bind: %.100s", strerror(errno)); 2589 else 2590 verbose("bind: %.100s", strerror(errno)); 2591 2592 close(sock); 2593 continue; 2594 } 2595 /* Start listening for connections on the socket. */ 2596 if (listen(sock, SSH_LISTEN_BACKLOG) < 0) { 2597 error("listen: %.100s", strerror(errno)); 2598 close(sock); 2599 continue; 2600 } 2601 2602 /* 2603 * listen_port == 0 requests a dynamically allocated port - 2604 * record what we got. 2605 */ 2606 if (type == SSH_CHANNEL_RPORT_LISTENER && listen_port == 0 && 2607 allocated_listen_port != NULL && 2608 *allocated_listen_port == 0) { 2609 *allocated_listen_port = get_sock_port(sock, 1); 2610 debug("Allocated listen port %d", 2611 *allocated_listen_port); 2612 } 2613 2614 /* Allocate a channel number for the socket. */ 2615 c = channel_new("port listener", type, sock, sock, -1, 2616 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 2617 0, "port listener", 1); 2618 c->path = xstrdup(host); 2619 c->host_port = port_to_connect; 2620 c->listening_port = listen_port; 2621 success = 1; 2622 } 2623 if (success == 0) 2624 error("channel_setup_fwd_listener: cannot listen to port: %d", 2625 listen_port); 2626 freeaddrinfo(aitop); 2627 return success; 2628 } 2629 2630 int 2631 channel_cancel_rport_listener(const char *host, u_short port) 2632 { 2633 u_int i; 2634 int found = 0; 2635 2636 for (i = 0; i < channels_alloc; i++) { 2637 Channel *c = channels[i]; 2638 2639 if (c != NULL && c->type == SSH_CHANNEL_RPORT_LISTENER && 2640 strcmp(c->path, host) == 0 && c->listening_port == port) { 2641 debug2("%s: close channel %d", __func__, i); 2642 channel_free(c); 2643 found = 1; 2644 } 2645 } 2646 2647 return (found); 2648 } 2649 2650 /* protocol local port fwd, used by ssh (and sshd in v1) */ 2651 int 2652 channel_setup_local_fwd_listener(const char *listen_host, u_short listen_port, 2653 const char *host_to_connect, u_short port_to_connect, int gateway_ports) 2654 { 2655 return channel_setup_fwd_listener(SSH_CHANNEL_PORT_LISTENER, 2656 listen_host, listen_port, NULL, host_to_connect, port_to_connect, 2657 gateway_ports); 2658 } 2659 2660 /* protocol v2 remote port fwd, used by sshd */ 2661 int 2662 channel_setup_remote_fwd_listener(const char *listen_address, 2663 u_short listen_port, int *allocated_listen_port, int gateway_ports) 2664 { 2665 return channel_setup_fwd_listener(SSH_CHANNEL_RPORT_LISTENER, 2666 listen_address, listen_port, allocated_listen_port, 2667 NULL, 0, gateway_ports); 2668 } 2669 2670 /* 2671 * Initiate forwarding of connections to port "port" on remote host through 2672 * the secure channel to host:port from local side. 2673 */ 2674 2675 int 2676 channel_request_remote_forwarding(const char *listen_host, u_short listen_port, 2677 const char *host_to_connect, u_short port_to_connect) 2678 { 2679 int type, success = 0; 2680 2681 /* Record locally that connection to this host/port is permitted. */ 2682 if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) 2683 fatal("channel_request_remote_forwarding: too many forwards"); 2684 2685 /* Send the forward request to the remote side. */ 2686 if (compat20) { 2687 const char *address_to_bind; 2688 if (listen_host == NULL) { 2689 if (datafellows & SSH_BUG_RFWD_ADDR) 2690 address_to_bind = "127.0.0.1"; 2691 else 2692 address_to_bind = "localhost"; 2693 } else if (*listen_host == '\0' || 2694 strcmp(listen_host, "*") == 0) { 2695 if (datafellows & SSH_BUG_RFWD_ADDR) 2696 address_to_bind = "0.0.0.0"; 2697 else 2698 address_to_bind = ""; 2699 } else 2700 address_to_bind = listen_host; 2701 2702 packet_start(SSH2_MSG_GLOBAL_REQUEST); 2703 packet_put_cstring("tcpip-forward"); 2704 packet_put_char(1); /* boolean: want reply */ 2705 packet_put_cstring(address_to_bind); 2706 packet_put_int(listen_port); 2707 packet_send(); 2708 packet_write_wait(); 2709 /* Assume that server accepts the request */ 2710 success = 1; 2711 } else { 2712 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST); 2713 packet_put_int(listen_port); 2714 packet_put_cstring(host_to_connect); 2715 packet_put_int(port_to_connect); 2716 packet_send(); 2717 packet_write_wait(); 2718 2719 /* Wait for response from the remote side. */ 2720 type = packet_read(); 2721 switch (type) { 2722 case SSH_SMSG_SUCCESS: 2723 success = 1; 2724 break; 2725 case SSH_SMSG_FAILURE: 2726 break; 2727 default: 2728 /* Unknown packet */ 2729 packet_disconnect("Protocol error for port forward request:" 2730 "received packet type %d.", type); 2731 } 2732 } 2733 if (success) { 2734 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect); 2735 permitted_opens[num_permitted_opens].port_to_connect = port_to_connect; 2736 permitted_opens[num_permitted_opens].listen_port = listen_port; 2737 num_permitted_opens++; 2738 } 2739 return (success ? 0 : -1); 2740 } 2741 2742 /* 2743 * Request cancellation of remote forwarding of connection host:port from 2744 * local side. 2745 */ 2746 void 2747 channel_request_rforward_cancel(const char *host, u_short port) 2748 { 2749 int i; 2750 2751 if (!compat20) 2752 return; 2753 2754 for (i = 0; i < num_permitted_opens; i++) { 2755 if (permitted_opens[i].host_to_connect != NULL && 2756 permitted_opens[i].listen_port == port) 2757 break; 2758 } 2759 if (i >= num_permitted_opens) { 2760 debug("%s: requested forward not found", __func__); 2761 return; 2762 } 2763 packet_start(SSH2_MSG_GLOBAL_REQUEST); 2764 packet_put_cstring("cancel-tcpip-forward"); 2765 packet_put_char(0); 2766 packet_put_cstring(host == NULL ? "" : host); 2767 packet_put_int(port); 2768 packet_send(); 2769 2770 permitted_opens[i].listen_port = 0; 2771 permitted_opens[i].port_to_connect = 0; 2772 xfree(permitted_opens[i].host_to_connect); 2773 permitted_opens[i].host_to_connect = NULL; 2774 } 2775 2776 /* 2777 * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates 2778 * listening for the port, and sends back a success reply (or disconnect 2779 * message if there was an error). 2780 */ 2781 int 2782 channel_input_port_forward_request(int is_root, int gateway_ports) 2783 { 2784 u_short port, host_port; 2785 int success = 0; 2786 char *hostname; 2787 2788 /* Get arguments from the packet. */ 2789 port = packet_get_int(); 2790 hostname = packet_get_string(NULL); 2791 host_port = packet_get_int(); 2792 2793 #ifndef HAVE_CYGWIN 2794 /* 2795 * Check that an unprivileged user is not trying to forward a 2796 * privileged port. 2797 */ 2798 if (port < IPPORT_RESERVED && !is_root) 2799 packet_disconnect( 2800 "Requested forwarding of port %d but user is not root.", 2801 port); 2802 if (host_port == 0) 2803 packet_disconnect("Dynamic forwarding denied."); 2804 #endif 2805 2806 /* Initiate forwarding */ 2807 success = channel_setup_local_fwd_listener(NULL, port, hostname, 2808 host_port, gateway_ports); 2809 2810 /* Free the argument string. */ 2811 xfree(hostname); 2812 2813 return (success ? 0 : -1); 2814 } 2815 2816 /* 2817 * Permits opening to any host/port if permitted_opens[] is empty. This is 2818 * usually called by the server, because the user could connect to any port 2819 * anyway, and the server has no way to know but to trust the client anyway. 2820 */ 2821 void 2822 channel_permit_all_opens(void) 2823 { 2824 if (num_permitted_opens == 0) 2825 all_opens_permitted = 1; 2826 } 2827 2828 void 2829 channel_add_permitted_opens(char *host, int port) 2830 { 2831 if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) 2832 fatal("channel_add_permitted_opens: too many forwards"); 2833 debug("allow port forwarding to host %s port %d", host, port); 2834 2835 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host); 2836 permitted_opens[num_permitted_opens].port_to_connect = port; 2837 num_permitted_opens++; 2838 2839 all_opens_permitted = 0; 2840 } 2841 2842 int 2843 channel_add_adm_permitted_opens(char *host, int port) 2844 { 2845 if (num_adm_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) 2846 fatal("channel_add_adm_permitted_opens: too many forwards"); 2847 debug("config allows port forwarding to host %s port %d", host, port); 2848 2849 permitted_adm_opens[num_adm_permitted_opens].host_to_connect 2850 = xstrdup(host); 2851 permitted_adm_opens[num_adm_permitted_opens].port_to_connect = port; 2852 return ++num_adm_permitted_opens; 2853 } 2854 2855 void 2856 channel_clear_permitted_opens(void) 2857 { 2858 int i; 2859 2860 for (i = 0; i < num_permitted_opens; i++) 2861 if (permitted_opens[i].host_to_connect != NULL) 2862 xfree(permitted_opens[i].host_to_connect); 2863 num_permitted_opens = 0; 2864 } 2865 2866 void 2867 channel_clear_adm_permitted_opens(void) 2868 { 2869 int i; 2870 2871 for (i = 0; i < num_adm_permitted_opens; i++) 2872 if (permitted_adm_opens[i].host_to_connect != NULL) 2873 xfree(permitted_adm_opens[i].host_to_connect); 2874 num_adm_permitted_opens = 0; 2875 } 2876 2877 void 2878 channel_print_adm_permitted_opens(void) 2879 { 2880 int i; 2881 2882 printf("permitopen"); 2883 if (num_adm_permitted_opens == 0) { 2884 printf(" any\n"); 2885 return; 2886 } 2887 for (i = 0; i < num_adm_permitted_opens; i++) 2888 if (permitted_adm_opens[i].host_to_connect != NULL) 2889 printf(" %s:%d", permitted_adm_opens[i].host_to_connect, 2890 permitted_adm_opens[i].port_to_connect); 2891 printf("\n"); 2892 } 2893 2894 /* Try to start non-blocking connect to next host in cctx list */ 2895 static int 2896 connect_next(struct channel_connect *cctx) 2897 { 2898 int sock, saved_errno; 2899 char ntop[NI_MAXHOST], strport[NI_MAXSERV]; 2900 2901 for (; cctx->ai; cctx->ai = cctx->ai->ai_next) { 2902 if (cctx->ai->ai_family != AF_INET && 2903 cctx->ai->ai_family != AF_INET6) 2904 continue; 2905 if (getnameinfo(cctx->ai->ai_addr, cctx->ai->ai_addrlen, 2906 ntop, sizeof(ntop), strport, sizeof(strport), 2907 NI_NUMERICHOST|NI_NUMERICSERV) != 0) { 2908 error("connect_next: getnameinfo failed"); 2909 continue; 2910 } 2911 if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype, 2912 cctx->ai->ai_protocol)) == -1) { 2913 if (cctx->ai->ai_next == NULL) 2914 error("socket: %.100s", strerror(errno)); 2915 else 2916 verbose("socket: %.100s", strerror(errno)); 2917 continue; 2918 } 2919 if (set_nonblock(sock) == -1) 2920 fatal("%s: set_nonblock(%d)", __func__, sock); 2921 if (connect(sock, cctx->ai->ai_addr, 2922 cctx->ai->ai_addrlen) == -1 && errno != EINPROGRESS) { 2923 debug("connect_next: host %.100s ([%.100s]:%s): " 2924 "%.100s", cctx->host, ntop, strport, 2925 strerror(errno)); 2926 saved_errno = errno; 2927 close(sock); 2928 errno = saved_errno; 2929 continue; /* fail -- try next */ 2930 } 2931 debug("connect_next: host %.100s ([%.100s]:%s) " 2932 "in progress, fd=%d", cctx->host, ntop, strport, sock); 2933 cctx->ai = cctx->ai->ai_next; 2934 set_nodelay(sock); 2935 return sock; 2936 } 2937 return -1; 2938 } 2939 2940 static void 2941 channel_connect_ctx_free(struct channel_connect *cctx) 2942 { 2943 xfree(cctx->host); 2944 if (cctx->aitop) 2945 freeaddrinfo(cctx->aitop); 2946 bzero(cctx, sizeof(*cctx)); 2947 cctx->host = NULL; 2948 cctx->ai = cctx->aitop = NULL; 2949 } 2950 2951 /* Return CONNECTING channel to remote host, port */ 2952 static Channel * 2953 connect_to(const char *host, u_short port, char *ctype, char *rname) 2954 { 2955 struct addrinfo hints; 2956 int gaierr; 2957 int sock = -1; 2958 char strport[NI_MAXSERV]; 2959 struct channel_connect cctx; 2960 Channel *c; 2961 2962 memset(&cctx, 0, sizeof(cctx)); 2963 memset(&hints, 0, sizeof(hints)); 2964 hints.ai_family = IPv4or6; 2965 hints.ai_socktype = SOCK_STREAM; 2966 snprintf(strport, sizeof strport, "%d", port); 2967 if ((gaierr = getaddrinfo(host, strport, &hints, &cctx.aitop)) != 0) { 2968 error("connect_to %.100s: unknown host (%s)", host, 2969 ssh_gai_strerror(gaierr)); 2970 return NULL; 2971 } 2972 2973 cctx.host = xstrdup(host); 2974 cctx.port = port; 2975 cctx.ai = cctx.aitop; 2976 2977 if ((sock = connect_next(&cctx)) == -1) { 2978 error("connect to %.100s port %d failed: %s", 2979 host, port, strerror(errno)); 2980 channel_connect_ctx_free(&cctx); 2981 return NULL; 2982 } 2983 c = channel_new(ctype, SSH_CHANNEL_CONNECTING, sock, sock, -1, 2984 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, rname, 1); 2985 c->connect_ctx = cctx; 2986 return c; 2987 } 2988 2989 Channel * 2990 channel_connect_by_listen_address(u_short listen_port, char *ctype, char *rname) 2991 { 2992 int i; 2993 2994 for (i = 0; i < num_permitted_opens; i++) { 2995 if (permitted_opens[i].host_to_connect != NULL && 2996 permitted_opens[i].listen_port == listen_port) { 2997 return connect_to( 2998 permitted_opens[i].host_to_connect, 2999 permitted_opens[i].port_to_connect, ctype, rname); 3000 } 3001 } 3002 error("WARNING: Server requests forwarding for unknown listen_port %d", 3003 listen_port); 3004 return NULL; 3005 } 3006 3007 /* Check if connecting to that port is permitted and connect. */ 3008 Channel * 3009 channel_connect_to(const char *host, u_short port, char *ctype, char *rname) 3010 { 3011 int i, permit, permit_adm = 1; 3012 3013 permit = all_opens_permitted; 3014 if (!permit) { 3015 for (i = 0; i < num_permitted_opens; i++) 3016 if (permitted_opens[i].host_to_connect != NULL && 3017 permitted_opens[i].port_to_connect == port && 3018 strcmp(permitted_opens[i].host_to_connect, host) == 0) 3019 permit = 1; 3020 } 3021 3022 if (num_adm_permitted_opens > 0) { 3023 permit_adm = 0; 3024 for (i = 0; i < num_adm_permitted_opens; i++) 3025 if (permitted_adm_opens[i].host_to_connect != NULL && 3026 permitted_adm_opens[i].port_to_connect == port && 3027 strcmp(permitted_adm_opens[i].host_to_connect, host) 3028 == 0) 3029 permit_adm = 1; 3030 } 3031 3032 if (!permit || !permit_adm) { 3033 logit("Received request to connect to host %.100s port %d, " 3034 "but the request was denied.", host, port); 3035 return NULL; 3036 } 3037 return connect_to(host, port, ctype, rname); 3038 } 3039 3040 void 3041 channel_send_window_changes(void) 3042 { 3043 u_int i; 3044 struct winsize ws; 3045 3046 for (i = 0; i < channels_alloc; i++) { 3047 if (channels[i] == NULL || !channels[i]->client_tty || 3048 channels[i]->type != SSH_CHANNEL_OPEN) 3049 continue; 3050 if (ioctl(channels[i]->rfd, TIOCGWINSZ, &ws) < 0) 3051 continue; 3052 channel_request_start(i, "window-change", 0); 3053 packet_put_int((u_int)ws.ws_col); 3054 packet_put_int((u_int)ws.ws_row); 3055 packet_put_int((u_int)ws.ws_xpixel); 3056 packet_put_int((u_int)ws.ws_ypixel); 3057 packet_send(); 3058 } 3059 } 3060 3061 /* -- X11 forwarding */ 3062 3063 /* 3064 * Creates an internet domain socket for listening for X11 connections. 3065 * Returns 0 and a suitable display number for the DISPLAY variable 3066 * stored in display_numberp , or -1 if an error occurs. 3067 */ 3068 int 3069 x11_create_display_inet(int x11_display_offset, int x11_use_localhost, 3070 int single_connection, u_int *display_numberp, int **chanids) 3071 { 3072 Channel *nc = NULL; 3073 int display_number, sock; 3074 u_short port; 3075 struct addrinfo hints, *ai, *aitop; 3076 char strport[NI_MAXSERV]; 3077 int gaierr, n, num_socks = 0, socks[NUM_SOCKS]; 3078 3079 if (chanids == NULL) 3080 return -1; 3081 3082 for (display_number = x11_display_offset; 3083 display_number < MAX_DISPLAYS; 3084 display_number++) { 3085 port = 6000 + display_number; 3086 memset(&hints, 0, sizeof(hints)); 3087 hints.ai_family = IPv4or6; 3088 hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE; 3089 hints.ai_socktype = SOCK_STREAM; 3090 snprintf(strport, sizeof strport, "%d", port); 3091 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) { 3092 error("getaddrinfo: %.100s", ssh_gai_strerror(gaierr)); 3093 return -1; 3094 } 3095 for (ai = aitop; ai; ai = ai->ai_next) { 3096 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) 3097 continue; 3098 sock = socket(ai->ai_family, ai->ai_socktype, 3099 ai->ai_protocol); 3100 if (sock < 0) { 3101 if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) { 3102 error("socket: %.100s", strerror(errno)); 3103 freeaddrinfo(aitop); 3104 return -1; 3105 } else { 3106 debug("x11_create_display_inet: Socket family %d not supported", 3107 ai->ai_family); 3108 continue; 3109 } 3110 } 3111 #ifdef IPV6_V6ONLY 3112 if (ai->ai_family == AF_INET6) { 3113 int on = 1; 3114 if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) < 0) 3115 error("setsockopt IPV6_V6ONLY: %.100s", strerror(errno)); 3116 } 3117 #endif 3118 if (x11_use_localhost) 3119 channel_set_reuseaddr(sock); 3120 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 3121 debug2("bind port %d: %.100s", port, strerror(errno)); 3122 close(sock); 3123 3124 for (n = 0; n < num_socks; n++) { 3125 close(socks[n]); 3126 } 3127 num_socks = 0; 3128 break; 3129 } 3130 socks[num_socks++] = sock; 3131 if (num_socks == NUM_SOCKS) 3132 break; 3133 } 3134 freeaddrinfo(aitop); 3135 if (num_socks > 0) 3136 break; 3137 } 3138 if (display_number >= MAX_DISPLAYS) { 3139 error("Failed to allocate internet-domain X11 display socket."); 3140 return -1; 3141 } 3142 /* Start listening for connections on the socket. */ 3143 for (n = 0; n < num_socks; n++) { 3144 sock = socks[n]; 3145 if (listen(sock, SSH_LISTEN_BACKLOG) < 0) { 3146 error("listen: %.100s", strerror(errno)); 3147 close(sock); 3148 return -1; 3149 } 3150 } 3151 3152 /* Allocate a channel for each socket. */ 3153 *chanids = xcalloc(num_socks + 1, sizeof(**chanids)); 3154 for (n = 0; n < num_socks; n++) { 3155 sock = socks[n]; 3156 nc = channel_new("x11 listener", 3157 SSH_CHANNEL_X11_LISTENER, sock, sock, -1, 3158 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 3159 0, "X11 inet listener", 1); 3160 nc->single_connection = single_connection; 3161 (*chanids)[n] = nc->self; 3162 } 3163 (*chanids)[n] = -1; 3164 3165 /* Return the display number for the DISPLAY environment variable. */ 3166 *display_numberp = display_number; 3167 return (0); 3168 } 3169 3170 static int 3171 connect_local_xsocket_path(const char *pathname) 3172 { 3173 int sock; 3174 struct sockaddr_un addr; 3175 3176 sock = socket(AF_UNIX, SOCK_STREAM, 0); 3177 if (sock < 0) 3178 error("socket: %.100s", strerror(errno)); 3179 memset(&addr, 0, sizeof(addr)); 3180 addr.sun_family = AF_UNIX; 3181 strlcpy(addr.sun_path, pathname, sizeof addr.sun_path); 3182 if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0) 3183 return sock; 3184 close(sock); 3185 error("connect %.100s: %.100s", addr.sun_path, strerror(errno)); 3186 return -1; 3187 } 3188 3189 static int 3190 connect_local_xsocket(u_int dnr) 3191 { 3192 char buf[1024]; 3193 snprintf(buf, sizeof buf, _PATH_UNIX_X, dnr); 3194 return connect_local_xsocket_path(buf); 3195 } 3196 3197 int 3198 x11_connect_display(void) 3199 { 3200 u_int display_number; 3201 const char *display; 3202 char buf[1024], *cp; 3203 struct addrinfo hints, *ai, *aitop; 3204 char strport[NI_MAXSERV]; 3205 int gaierr, sock = 0; 3206 3207 /* Try to open a socket for the local X server. */ 3208 display = getenv("DISPLAY"); 3209 if (!display) { 3210 error("DISPLAY not set."); 3211 return -1; 3212 } 3213 /* 3214 * Now we decode the value of the DISPLAY variable and make a 3215 * connection to the real X server. 3216 */ 3217 3218 /* Check if the display is from launchd. */ 3219 #ifdef __APPLE__ 3220 if (strncmp(display, "/tmp/launch", 11) == 0) { 3221 sock = connect_local_xsocket_path(display); 3222 if (sock < 0) 3223 return -1; 3224 3225 /* OK, we now have a connection to the display. */ 3226 return sock; 3227 } 3228 #endif 3229 /* 3230 * Check if it is a unix domain socket. Unix domain displays are in 3231 * one of the following formats: unix:d[.s], :d[.s], ::d[.s] 3232 */ 3233 if (strncmp(display, "unix:", 5) == 0 || 3234 display[0] == ':') { 3235 /* Connect to the unix domain socket. */ 3236 if (sscanf(strrchr(display, ':') + 1, "%u", &display_number) != 1) { 3237 error("Could not parse display number from DISPLAY: %.100s", 3238 display); 3239 return -1; 3240 } 3241 /* Create a socket. */ 3242 sock = connect_local_xsocket(display_number); 3243 if (sock < 0) 3244 return -1; 3245 3246 /* OK, we now have a connection to the display. */ 3247 return sock; 3248 } 3249 /* 3250 * Connect to an inet socket. The DISPLAY value is supposedly 3251 * hostname:d[.s], where hostname may also be numeric IP address. 3252 */ 3253 strlcpy(buf, display, sizeof(buf)); 3254 cp = strchr(buf, ':'); 3255 if (!cp) { 3256 error("Could not find ':' in DISPLAY: %.100s", display); 3257 return -1; 3258 } 3259 *cp = 0; 3260 /* buf now contains the host name. But first we parse the display number. */ 3261 if (sscanf(cp + 1, "%u", &display_number) != 1) { 3262 error("Could not parse display number from DISPLAY: %.100s", 3263 display); 3264 return -1; 3265 } 3266 3267 /* Look up the host address */ 3268 memset(&hints, 0, sizeof(hints)); 3269 hints.ai_family = IPv4or6; 3270 hints.ai_socktype = SOCK_STREAM; 3271 snprintf(strport, sizeof strport, "%u", 6000 + display_number); 3272 if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) { 3273 error("%.100s: unknown host. (%s)", buf, 3274 ssh_gai_strerror(gaierr)); 3275 return -1; 3276 } 3277 for (ai = aitop; ai; ai = ai->ai_next) { 3278 /* Create a socket. */ 3279 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); 3280 if (sock < 0) { 3281 debug2("socket: %.100s", strerror(errno)); 3282 continue; 3283 } 3284 /* Connect it to the display. */ 3285 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 3286 debug2("connect %.100s port %u: %.100s", buf, 3287 6000 + display_number, strerror(errno)); 3288 close(sock); 3289 continue; 3290 } 3291 /* Success */ 3292 break; 3293 } 3294 freeaddrinfo(aitop); 3295 if (!ai) { 3296 error("connect %.100s port %u: %.100s", buf, 6000 + display_number, 3297 strerror(errno)); 3298 return -1; 3299 } 3300 set_nodelay(sock); 3301 return sock; 3302 } 3303 3304 /* 3305 * This is called when SSH_SMSG_X11_OPEN is received. The packet contains 3306 * the remote channel number. We should do whatever we want, and respond 3307 * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE. 3308 */ 3309 3310 /* ARGSUSED */ 3311 void 3312 x11_input_open(int type, u_int32_t seq, void *ctxt) 3313 { 3314 Channel *c = NULL; 3315 int remote_id, sock = 0; 3316 char *remote_host; 3317 3318 debug("Received X11 open request."); 3319 3320 remote_id = packet_get_int(); 3321 3322 if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) { 3323 remote_host = packet_get_string(NULL); 3324 } else { 3325 remote_host = xstrdup("unknown (remote did not supply name)"); 3326 } 3327 packet_check_eom(); 3328 3329 /* Obtain a connection to the real X display. */ 3330 sock = x11_connect_display(); 3331 if (sock != -1) { 3332 /* Allocate a channel for this connection. */ 3333 c = channel_new("connected x11 socket", 3334 SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0, 3335 remote_host, 1); 3336 c->remote_id = remote_id; 3337 c->force_drain = 1; 3338 } 3339 xfree(remote_host); 3340 if (c == NULL) { 3341 /* Send refusal to the remote host. */ 3342 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 3343 packet_put_int(remote_id); 3344 } else { 3345 /* Send a confirmation to the remote host. */ 3346 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); 3347 packet_put_int(remote_id); 3348 packet_put_int(c->self); 3349 } 3350 packet_send(); 3351 } 3352 3353 /* dummy protocol handler that denies SSH-1 requests (agent/x11) */ 3354 /* ARGSUSED */ 3355 void 3356 deny_input_open(int type, u_int32_t seq, void *ctxt) 3357 { 3358 int rchan = packet_get_int(); 3359 3360 switch (type) { 3361 case SSH_SMSG_AGENT_OPEN: 3362 error("Warning: ssh server tried agent forwarding."); 3363 break; 3364 case SSH_SMSG_X11_OPEN: 3365 error("Warning: ssh server tried X11 forwarding."); 3366 break; 3367 default: 3368 error("deny_input_open: type %d", type); 3369 break; 3370 } 3371 error("Warning: this is probably a break-in attempt by a malicious server."); 3372 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 3373 packet_put_int(rchan); 3374 packet_send(); 3375 } 3376 3377 /* 3378 * Requests forwarding of X11 connections, generates fake authentication 3379 * data, and enables authentication spoofing. 3380 * This should be called in the client only. 3381 */ 3382 void 3383 x11_request_forwarding_with_spoofing(int client_session_id, const char *disp, 3384 const char *proto, const char *data) 3385 { 3386 u_int data_len = (u_int) strlen(data) / 2; 3387 u_int i, value; 3388 char *new_data; 3389 int screen_number; 3390 const char *cp; 3391 u_int32_t rnd = 0; 3392 3393 if (x11_saved_display == NULL) 3394 x11_saved_display = xstrdup(disp); 3395 else if (strcmp(disp, x11_saved_display) != 0) { 3396 error("x11_request_forwarding_with_spoofing: different " 3397 "$DISPLAY already forwarded"); 3398 return; 3399 } 3400 3401 cp = strchr(disp, ':'); 3402 if (cp) 3403 cp = strchr(cp, '.'); 3404 if (cp) 3405 screen_number = (u_int)strtonum(cp + 1, 0, 400, NULL); 3406 else 3407 screen_number = 0; 3408 3409 if (x11_saved_proto == NULL) { 3410 /* Save protocol name. */ 3411 x11_saved_proto = xstrdup(proto); 3412 /* 3413 * Extract real authentication data and generate fake data 3414 * of the same length. 3415 */ 3416 x11_saved_data = xmalloc(data_len); 3417 x11_fake_data = xmalloc(data_len); 3418 for (i = 0; i < data_len; i++) { 3419 if (sscanf(data + 2 * i, "%2x", &value) != 1) 3420 fatal("x11_request_forwarding: bad " 3421 "authentication data: %.100s", data); 3422 if (i % 4 == 0) 3423 rnd = arc4random(); 3424 x11_saved_data[i] = value; 3425 x11_fake_data[i] = rnd & 0xff; 3426 rnd >>= 8; 3427 } 3428 x11_saved_data_len = data_len; 3429 x11_fake_data_len = data_len; 3430 } 3431 3432 /* Convert the fake data into hex. */ 3433 new_data = tohex(x11_fake_data, data_len); 3434 3435 /* Send the request packet. */ 3436 if (compat20) { 3437 channel_request_start(client_session_id, "x11-req", 0); 3438 packet_put_char(0); /* XXX bool single connection */ 3439 } else { 3440 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING); 3441 } 3442 packet_put_cstring(proto); 3443 packet_put_cstring(new_data); 3444 packet_put_int(screen_number); 3445 packet_send(); 3446 packet_write_wait(); 3447 xfree(new_data); 3448 } 3449 3450 3451 /* -- agent forwarding */ 3452 3453 /* Sends a message to the server to request authentication fd forwarding. */ 3454 3455 void 3456 auth_request_forwarding(void) 3457 { 3458 packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING); 3459 packet_send(); 3460 packet_write_wait(); 3461 } 3462