1 /* $OpenBSD: channels.c,v 1.341 2015/02/06 23:21:59 millert Exp $ */
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * This file contains functions for generic socket connection forwarding.
7 * There is also code for initiating connection forwarding for X11 connections,
8 * arbitrary tcp/ip connections, and the authentication agent connection.
10 * As far as I am concerned, the code I have written for this software
11 * can be used freely for any purpose. Any derived versions of this
12 * software must be clearly marked as such, and if the derived work is
13 * incompatible with the protocol description in the RFC file, it must be
14 * called by a name other than "ssh" or "Secure Shell".
16 * SSH2 support added by Markus Friedl.
17 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved.
18 * Copyright (c) 1999 Dug Song. All rights reserved.
19 * Copyright (c) 1999 Theo de Raadt. All rights reserved.
21 * Redistribution and use in source and binary forms, with or without
22 * modification, are permitted provided that the following conditions
24 * 1. Redistributions of source code must retain the above copyright
25 * notice, this list of conditions and the following disclaimer.
26 * 2. Redistributions in binary form must reproduce the above copyright
27 * notice, this list of conditions and the following disclaimer in the
28 * documentation and/or other materials provided with the distribution.
30 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
32 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
33 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
34 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
35 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
39 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
44 #include <sys/types.h>
45 #include <sys/param.h> /* MIN MAX */
47 #include <sys/ioctl.h>
49 #include <sys/socket.h>
50 #ifdef HAVE_SYS_TIME_H
51 # include <sys/time.h>
54 #include <netinet/in.h>
55 #include <arpa/inet.h>
70 #include "openbsd-compat/sys-queue.h"
84 #include "pathnames.h"
89 * Pointer to an array containing all allocated channels. The array is
90 * dynamically extended as needed.
92 static Channel **channels = NULL;
95 * Size of the channel array. All slots of the array must always be
96 * initialized (at least the type field); unused slots set to NULL
98 static u_int channels_alloc = 0;
101 * Maximum file descriptor value used in any of the channels. This is
102 * updated in channel_new.
104 static int channel_max_fd = 0;
107 /* -- tcp forwarding */
110 * Data structure for storing which hosts are permitted for forward requests.
111 * The local sides of any remote forwards are stored in this array to prevent
112 * a corrupt remote server from accessing arbitrary TCP/IP ports on our local
113 * network (which might be behind a firewall).
115 /* XXX: streamlocal wants a path instead of host:port */
116 /* Overload host_to_connect; we could just make this match Forward */
117 /* XXX - can we use listen_host instead of listen_path? */
119 char *host_to_connect; /* Connect to 'host'. */
120 int port_to_connect; /* Connect to 'port'. */
121 char *listen_host; /* Remote side should listen address. */
122 char *listen_path; /* Remote side should listen path. */
123 int listen_port; /* Remote side should listen port. */
126 /* List of all permitted host/port pairs to connect by the user. */
127 static ForwardPermission *permitted_opens = NULL;
129 /* List of all permitted host/port pairs to connect by the admin. */
130 static ForwardPermission *permitted_adm_opens = NULL;
132 /* Number of permitted host/port pairs in the array permitted by the user. */
133 static int num_permitted_opens = 0;
135 /* Number of permitted host/port pair in the array permitted by the admin. */
136 static int num_adm_permitted_opens = 0;
138 /* special-case port number meaning allow any port */
139 #define FWD_PERMIT_ANY_PORT 0
142 * If this is true, all opens are permitted. This is the case on the server
143 * on which we have to trust the client anyway, and the user could do
144 * anything after logging in anyway.
146 static int all_opens_permitted = 0;
149 /* -- X11 forwarding */
151 /* Maximum number of fake X11 displays to try. */
152 #define MAX_DISPLAYS 1000
154 /* Saved X11 local (client) display. */
155 static char *x11_saved_display = NULL;
157 /* Saved X11 authentication protocol name. */
158 static char *x11_saved_proto = NULL;
160 /* Saved X11 authentication data. This is the real data. */
161 static char *x11_saved_data = NULL;
162 static u_int x11_saved_data_len = 0;
165 * Fake X11 authentication data. This is what the server will be sending us;
166 * we should replace any occurrences of this by the real data.
168 static u_char *x11_fake_data = NULL;
169 static u_int x11_fake_data_len;
172 /* -- agent forwarding */
176 /* AF_UNSPEC or AF_INET or AF_INET6 */
177 static int IPv4or6 = AF_UNSPEC;
180 static void port_open_helper(Channel *c, char *rtype);
182 /* non-blocking connect helpers */
183 static int connect_next(struct channel_connect *);
184 static void channel_connect_ctx_free(struct channel_connect *);
186 /* -- channel core */
189 channel_by_id(int id)
193 if (id < 0 || (u_int)id >= channels_alloc) {
194 logit("channel_by_id: %d: bad id", id);
199 logit("channel_by_id: %d: bad id: channel free", id);
206 * Returns the channel if it is allowed to receive protocol messages.
207 * Private channels, like listening sockets, may not receive messages.
210 channel_lookup(int id)
214 if ((c = channel_by_id(id)) == NULL)
218 case SSH_CHANNEL_X11_OPEN:
219 case SSH_CHANNEL_LARVAL:
220 case SSH_CHANNEL_CONNECTING:
221 case SSH_CHANNEL_DYNAMIC:
222 case SSH_CHANNEL_OPENING:
223 case SSH_CHANNEL_OPEN:
224 case SSH_CHANNEL_INPUT_DRAINING:
225 case SSH_CHANNEL_OUTPUT_DRAINING:
226 case SSH_CHANNEL_ABANDONED:
229 logit("Non-public channel %d, type %d.", id, c->type);
234 * Register filedescriptors for a channel, used when allocating a channel or
235 * when the channel consumer/producer is ready, e.g. shell exec'd
238 channel_register_fds(Channel *c, int rfd, int wfd, int efd,
239 int extusage, int nonblock, int is_tty)
241 /* Update the maximum file descriptor value. */
242 channel_max_fd = MAX(channel_max_fd, rfd);
243 channel_max_fd = MAX(channel_max_fd, wfd);
244 channel_max_fd = MAX(channel_max_fd, efd);
247 fcntl(rfd, F_SETFD, FD_CLOEXEC);
248 if (wfd != -1 && wfd != rfd)
249 fcntl(wfd, F_SETFD, FD_CLOEXEC);
250 if (efd != -1 && efd != rfd && efd != wfd)
251 fcntl(efd, F_SETFD, FD_CLOEXEC);
255 c->sock = (rfd == wfd) ? rfd : -1;
257 c->extended_usage = extusage;
259 if ((c->isatty = is_tty) != 0)
260 debug2("channel %d: rfd %d isatty", c->self, c->rfd);
262 /* XXX: Later AIX versions can't push as much data to tty */
263 c->wfd_isatty = is_tty || isatty(c->wfd);
266 /* enable nonblocking mode */
278 * Allocate a new channel object and set its type and socket. This will cause
279 * remote_name to be freed.
282 channel_new(char *ctype, int type, int rfd, int wfd, int efd,
283 u_int window, u_int maxpack, int extusage, char *remote_name, int nonblock)
289 /* Do initial allocation if this is the first call. */
290 if (channels_alloc == 0) {
292 channels = xcalloc(channels_alloc, sizeof(Channel *));
293 for (i = 0; i < channels_alloc; i++)
296 /* Try to find a free slot where to put the new channel. */
297 for (found = -1, i = 0; i < channels_alloc; i++)
298 if (channels[i] == NULL) {
299 /* Found a free slot. */
304 /* There are no free slots. Take last+1 slot and expand the array. */
305 found = channels_alloc;
306 if (channels_alloc > 10000)
307 fatal("channel_new: internal error: channels_alloc %d "
308 "too big.", channels_alloc);
309 channels = xrealloc(channels, channels_alloc + 10,
311 channels_alloc += 10;
312 debug2("channel: expanding %d", channels_alloc);
313 for (i = found; i < channels_alloc; i++)
316 /* Initialize and return new channel. */
317 c = channels[found] = xcalloc(1, sizeof(Channel));
318 buffer_init(&c->input);
319 buffer_init(&c->output);
320 buffer_init(&c->extended);
322 c->listening_addr = NULL;
323 c->listening_port = 0;
324 c->ostate = CHAN_OUTPUT_OPEN;
325 c->istate = CHAN_INPUT_OPEN;
327 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, 0);
332 c->local_window = window;
333 c->local_window_max = window;
334 c->local_consumed = 0;
335 c->local_maxpacket = maxpack;
337 c->remote_name = xstrdup(remote_name);
338 c->remote_window = 0;
339 c->remote_maxpacket = 0;
341 c->single_connection = 0;
342 c->detach_user = NULL;
344 c->open_confirm = NULL;
345 c->open_confirm_ctx = NULL;
346 c->input_filter = NULL;
347 c->output_filter = NULL;
348 c->filter_ctx = NULL;
349 c->filter_cleanup = NULL;
354 c->delayed = 1; /* prevent call to channel_post handler */
355 TAILQ_INIT(&c->status_confirms);
356 debug("channel %d: new [%s]", found, remote_name);
361 channel_find_maxfd(void)
367 for (i = 0; i < channels_alloc; i++) {
370 max = MAX(max, c->rfd);
371 max = MAX(max, c->wfd);
372 max = MAX(max, c->efd);
379 channel_close_fd(int *fdp)
381 int ret = 0, fd = *fdp;
386 if (fd == channel_max_fd)
387 channel_max_fd = channel_find_maxfd();
392 /* Close all channel fd/socket. */
394 channel_close_fds(Channel *c)
396 channel_close_fd(&c->sock);
397 channel_close_fd(&c->rfd);
398 channel_close_fd(&c->wfd);
399 channel_close_fd(&c->efd);
402 /* Free the channel and close its fd/socket. */
404 channel_free(Channel *c)
408 struct channel_confirm *cc;
410 for (n = 0, i = 0; i < channels_alloc; i++)
413 debug("channel %d: free: %s, nchannels %u", c->self,
414 c->remote_name ? c->remote_name : "???", n);
416 s = channel_open_message();
417 debug3("channel %d: status: %s", c->self, s);
421 shutdown(c->sock, SHUT_RDWR);
422 channel_close_fds(c);
423 buffer_free(&c->input);
424 buffer_free(&c->output);
425 buffer_free(&c->extended);
426 free(c->remote_name);
427 c->remote_name = NULL;
430 free(c->listening_addr);
431 c->listening_addr = NULL;
432 while ((cc = TAILQ_FIRST(&c->status_confirms)) != NULL) {
433 if (cc->abandon_cb != NULL)
434 cc->abandon_cb(c, cc->ctx);
435 TAILQ_REMOVE(&c->status_confirms, cc, entry);
436 explicit_bzero(cc, sizeof(*cc));
439 if (c->filter_cleanup != NULL && c->filter_ctx != NULL)
440 c->filter_cleanup(c->self, c->filter_ctx);
441 channels[c->self] = NULL;
446 channel_free_all(void)
450 for (i = 0; i < channels_alloc; i++)
451 if (channels[i] != NULL)
452 channel_free(channels[i]);
456 * Closes the sockets/fds of all channels. This is used to close extra file
457 * descriptors after a fork.
460 channel_close_all(void)
464 for (i = 0; i < channels_alloc; i++)
465 if (channels[i] != NULL)
466 channel_close_fds(channels[i]);
470 * Stop listening to channels.
473 channel_stop_listening(void)
478 for (i = 0; i < channels_alloc; i++) {
482 case SSH_CHANNEL_AUTH_SOCKET:
483 case SSH_CHANNEL_PORT_LISTENER:
484 case SSH_CHANNEL_RPORT_LISTENER:
485 case SSH_CHANNEL_X11_LISTENER:
486 case SSH_CHANNEL_UNIX_LISTENER:
487 case SSH_CHANNEL_RUNIX_LISTENER:
488 channel_close_fd(&c->sock);
497 * Returns true if no channel has too much buffered data, and false if one or
498 * more channel is overfull.
501 channel_not_very_much_buffered_data(void)
506 for (i = 0; i < channels_alloc; i++) {
508 if (c != NULL && c->type == SSH_CHANNEL_OPEN) {
511 buffer_len(&c->input) > packet_get_maxsize()) {
512 debug2("channel %d: big input buffer %d",
513 c->self, buffer_len(&c->input));
517 if (buffer_len(&c->output) > packet_get_maxsize()) {
518 debug2("channel %d: big output buffer %u > %u",
519 c->self, buffer_len(&c->output),
520 packet_get_maxsize());
528 /* Returns true if any channel is still open. */
530 channel_still_open(void)
535 for (i = 0; i < channels_alloc; i++) {
540 case SSH_CHANNEL_X11_LISTENER:
541 case SSH_CHANNEL_PORT_LISTENER:
542 case SSH_CHANNEL_RPORT_LISTENER:
543 case SSH_CHANNEL_MUX_LISTENER:
544 case SSH_CHANNEL_CLOSED:
545 case SSH_CHANNEL_AUTH_SOCKET:
546 case SSH_CHANNEL_DYNAMIC:
547 case SSH_CHANNEL_CONNECTING:
548 case SSH_CHANNEL_ZOMBIE:
549 case SSH_CHANNEL_ABANDONED:
550 case SSH_CHANNEL_UNIX_LISTENER:
551 case SSH_CHANNEL_RUNIX_LISTENER:
553 case SSH_CHANNEL_LARVAL:
555 fatal("cannot happen: SSH_CHANNEL_LARVAL");
557 case SSH_CHANNEL_OPENING:
558 case SSH_CHANNEL_OPEN:
559 case SSH_CHANNEL_X11_OPEN:
560 case SSH_CHANNEL_MUX_CLIENT:
562 case SSH_CHANNEL_INPUT_DRAINING:
563 case SSH_CHANNEL_OUTPUT_DRAINING:
565 fatal("cannot happen: OUT_DRAIN");
568 fatal("channel_still_open: bad channel type %d", c->type);
575 /* Returns the id of an open channel suitable for keepaliving */
577 channel_find_open(void)
582 for (i = 0; i < channels_alloc; i++) {
584 if (c == NULL || c->remote_id < 0)
587 case SSH_CHANNEL_CLOSED:
588 case SSH_CHANNEL_DYNAMIC:
589 case SSH_CHANNEL_X11_LISTENER:
590 case SSH_CHANNEL_PORT_LISTENER:
591 case SSH_CHANNEL_RPORT_LISTENER:
592 case SSH_CHANNEL_MUX_LISTENER:
593 case SSH_CHANNEL_MUX_CLIENT:
594 case SSH_CHANNEL_OPENING:
595 case SSH_CHANNEL_CONNECTING:
596 case SSH_CHANNEL_ZOMBIE:
597 case SSH_CHANNEL_ABANDONED:
598 case SSH_CHANNEL_UNIX_LISTENER:
599 case SSH_CHANNEL_RUNIX_LISTENER:
601 case SSH_CHANNEL_LARVAL:
602 case SSH_CHANNEL_AUTH_SOCKET:
603 case SSH_CHANNEL_OPEN:
604 case SSH_CHANNEL_X11_OPEN:
606 case SSH_CHANNEL_INPUT_DRAINING:
607 case SSH_CHANNEL_OUTPUT_DRAINING:
609 fatal("cannot happen: OUT_DRAIN");
612 fatal("channel_find_open: bad channel type %d", c->type);
621 * Returns a message describing the currently open forwarded connections,
622 * suitable for sending to the client. The message contains crlf pairs for
626 channel_open_message(void)
633 buffer_init(&buffer);
634 snprintf(buf, sizeof buf, "The following connections are open:\r\n");
635 buffer_append(&buffer, buf, strlen(buf));
636 for (i = 0; i < channels_alloc; i++) {
641 case SSH_CHANNEL_X11_LISTENER:
642 case SSH_CHANNEL_PORT_LISTENER:
643 case SSH_CHANNEL_RPORT_LISTENER:
644 case SSH_CHANNEL_CLOSED:
645 case SSH_CHANNEL_AUTH_SOCKET:
646 case SSH_CHANNEL_ZOMBIE:
647 case SSH_CHANNEL_ABANDONED:
648 case SSH_CHANNEL_MUX_CLIENT:
649 case SSH_CHANNEL_MUX_LISTENER:
650 case SSH_CHANNEL_UNIX_LISTENER:
651 case SSH_CHANNEL_RUNIX_LISTENER:
653 case SSH_CHANNEL_LARVAL:
654 case SSH_CHANNEL_OPENING:
655 case SSH_CHANNEL_CONNECTING:
656 case SSH_CHANNEL_DYNAMIC:
657 case SSH_CHANNEL_OPEN:
658 case SSH_CHANNEL_X11_OPEN:
659 case SSH_CHANNEL_INPUT_DRAINING:
660 case SSH_CHANNEL_OUTPUT_DRAINING:
661 snprintf(buf, sizeof buf,
662 " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d cc %d)\r\n",
663 c->self, c->remote_name,
664 c->type, c->remote_id,
665 c->istate, buffer_len(&c->input),
666 c->ostate, buffer_len(&c->output),
667 c->rfd, c->wfd, c->ctl_chan);
668 buffer_append(&buffer, buf, strlen(buf));
671 fatal("channel_open_message: bad channel type %d", c->type);
675 buffer_append(&buffer, "\0", 1);
676 cp = xstrdup((char *)buffer_ptr(&buffer));
677 buffer_free(&buffer);
682 channel_send_open(int id)
684 Channel *c = channel_lookup(id);
687 logit("channel_send_open: %d: bad id", id);
690 debug2("channel %d: send open", id);
691 packet_start(SSH2_MSG_CHANNEL_OPEN);
692 packet_put_cstring(c->ctype);
693 packet_put_int(c->self);
694 packet_put_int(c->local_window);
695 packet_put_int(c->local_maxpacket);
700 channel_request_start(int id, char *service, int wantconfirm)
702 Channel *c = channel_lookup(id);
705 logit("channel_request_start: %d: unknown channel id", id);
708 debug2("channel %d: request %s confirm %d", id, service, wantconfirm);
709 packet_start(SSH2_MSG_CHANNEL_REQUEST);
710 packet_put_int(c->remote_id);
711 packet_put_cstring(service);
712 packet_put_char(wantconfirm);
716 channel_register_status_confirm(int id, channel_confirm_cb *cb,
717 channel_confirm_abandon_cb *abandon_cb, void *ctx)
719 struct channel_confirm *cc;
722 if ((c = channel_lookup(id)) == NULL)
723 fatal("channel_register_expect: %d: bad id", id);
725 cc = xcalloc(1, sizeof(*cc));
727 cc->abandon_cb = abandon_cb;
729 TAILQ_INSERT_TAIL(&c->status_confirms, cc, entry);
733 channel_register_open_confirm(int id, channel_open_fn *fn, void *ctx)
735 Channel *c = channel_lookup(id);
738 logit("channel_register_open_confirm: %d: bad id", id);
741 c->open_confirm = fn;
742 c->open_confirm_ctx = ctx;
746 channel_register_cleanup(int id, channel_callback_fn *fn, int do_close)
748 Channel *c = channel_by_id(id);
751 logit("channel_register_cleanup: %d: bad id", id);
755 c->detach_close = do_close;
759 channel_cancel_cleanup(int id)
761 Channel *c = channel_by_id(id);
764 logit("channel_cancel_cleanup: %d: bad id", id);
767 c->detach_user = NULL;
772 channel_register_filter(int id, channel_infilter_fn *ifn,
773 channel_outfilter_fn *ofn, channel_filter_cleanup_fn *cfn, void *ctx)
775 Channel *c = channel_lookup(id);
778 logit("channel_register_filter: %d: bad id", id);
781 c->input_filter = ifn;
782 c->output_filter = ofn;
784 c->filter_cleanup = cfn;
788 channel_set_fds(int id, int rfd, int wfd, int efd,
789 int extusage, int nonblock, int is_tty, u_int window_max)
791 Channel *c = channel_lookup(id);
793 if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
794 fatal("channel_activate for non-larval channel %d.", id);
795 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, is_tty);
796 c->type = SSH_CHANNEL_OPEN;
797 c->local_window = c->local_window_max = window_max;
798 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
799 packet_put_int(c->remote_id);
800 packet_put_int(c->local_window);
805 * 'channel_pre*' are called just before select() to add any bits relevant to
806 * channels in the select bitmasks.
809 * 'channel_post*': perform any appropriate operations for channels which
810 * have events pending.
812 typedef void chan_fn(Channel *c, fd_set *readset, fd_set *writeset);
813 chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE];
814 chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE];
818 channel_pre_listener(Channel *c, fd_set *readset, fd_set *writeset)
820 FD_SET(c->sock, readset);
825 channel_pre_connecting(Channel *c, fd_set *readset, fd_set *writeset)
827 debug3("channel %d: waiting for connection", c->self);
828 FD_SET(c->sock, writeset);
832 channel_pre_open_13(Channel *c, fd_set *readset, fd_set *writeset)
834 if (buffer_len(&c->input) < packet_get_maxsize())
835 FD_SET(c->sock, readset);
836 if (buffer_len(&c->output) > 0)
837 FD_SET(c->sock, writeset);
841 channel_pre_open(Channel *c, fd_set *readset, fd_set *writeset)
843 u_int limit = compat20 ? c->remote_window : packet_get_maxsize();
845 if (c->istate == CHAN_INPUT_OPEN &&
847 buffer_len(&c->input) < limit &&
848 buffer_check_alloc(&c->input, CHAN_RBUF))
849 FD_SET(c->rfd, readset);
850 if (c->ostate == CHAN_OUTPUT_OPEN ||
851 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
852 if (buffer_len(&c->output) > 0) {
853 FD_SET(c->wfd, writeset);
854 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
855 if (CHANNEL_EFD_OUTPUT_ACTIVE(c))
856 debug2("channel %d: obuf_empty delayed efd %d/(%d)",
857 c->self, c->efd, buffer_len(&c->extended));
862 /** XXX check close conditions, too */
863 if (compat20 && c->efd != -1 &&
864 !(c->istate == CHAN_INPUT_CLOSED && c->ostate == CHAN_OUTPUT_CLOSED)) {
865 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
866 buffer_len(&c->extended) > 0)
867 FD_SET(c->efd, writeset);
868 else if (c->efd != -1 && !(c->flags & CHAN_EOF_SENT) &&
869 (c->extended_usage == CHAN_EXTENDED_READ ||
870 c->extended_usage == CHAN_EXTENDED_IGNORE) &&
871 buffer_len(&c->extended) < c->remote_window)
872 FD_SET(c->efd, readset);
874 /* XXX: What about efd? races? */
879 channel_pre_input_draining(Channel *c, fd_set *readset, fd_set *writeset)
881 if (buffer_len(&c->input) == 0) {
882 packet_start(SSH_MSG_CHANNEL_CLOSE);
883 packet_put_int(c->remote_id);
885 c->type = SSH_CHANNEL_CLOSED;
886 debug2("channel %d: closing after input drain.", c->self);
892 channel_pre_output_draining(Channel *c, fd_set *readset, fd_set *writeset)
894 if (buffer_len(&c->output) == 0)
897 FD_SET(c->sock, writeset);
901 * This is a special state for X11 authentication spoofing. An opened X11
902 * connection (when authentication spoofing is being done) remains in this
903 * state until the first packet has been completely read. The authentication
904 * data in that packet is then substituted by the real data if it matches the
905 * fake data, and the channel is put into normal mode.
906 * XXX All this happens at the client side.
907 * Returns: 0 = need more data, -1 = wrong cookie, 1 = ok
910 x11_open_helper(Buffer *b)
913 u_int proto_len, data_len;
915 /* Check if the fixed size part of the packet is in buffer. */
916 if (buffer_len(b) < 12)
919 /* Parse the lengths of variable-length fields. */
921 if (ucp[0] == 0x42) { /* Byte order MSB first. */
922 proto_len = 256 * ucp[6] + ucp[7];
923 data_len = 256 * ucp[8] + ucp[9];
924 } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */
925 proto_len = ucp[6] + 256 * ucp[7];
926 data_len = ucp[8] + 256 * ucp[9];
928 debug2("Initial X11 packet contains bad byte order byte: 0x%x",
933 /* Check if the whole packet is in buffer. */
935 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3))
938 /* Check if authentication protocol matches. */
939 if (proto_len != strlen(x11_saved_proto) ||
940 memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
941 debug2("X11 connection uses different authentication protocol.");
944 /* Check if authentication data matches our fake data. */
945 if (data_len != x11_fake_data_len ||
946 timingsafe_bcmp(ucp + 12 + ((proto_len + 3) & ~3),
947 x11_fake_data, x11_fake_data_len) != 0) {
948 debug2("X11 auth data does not match fake data.");
951 /* Check fake data length */
952 if (x11_fake_data_len != x11_saved_data_len) {
953 error("X11 fake_data_len %d != saved_data_len %d",
954 x11_fake_data_len, x11_saved_data_len);
958 * Received authentication protocol and data match
959 * our fake data. Substitute the fake data with real
962 memcpy(ucp + 12 + ((proto_len + 3) & ~3),
963 x11_saved_data, x11_saved_data_len);
968 channel_pre_x11_open_13(Channel *c, fd_set *readset, fd_set *writeset)
970 int ret = x11_open_helper(&c->output);
973 /* Start normal processing for the channel. */
974 c->type = SSH_CHANNEL_OPEN;
975 channel_pre_open_13(c, readset, writeset);
976 } else if (ret == -1) {
978 * We have received an X11 connection that has bad
979 * authentication information.
981 logit("X11 connection rejected because of wrong authentication.");
982 buffer_clear(&c->input);
983 buffer_clear(&c->output);
984 channel_close_fd(&c->sock);
986 c->type = SSH_CHANNEL_CLOSED;
987 packet_start(SSH_MSG_CHANNEL_CLOSE);
988 packet_put_int(c->remote_id);
994 channel_pre_x11_open(Channel *c, fd_set *readset, fd_set *writeset)
996 int ret = x11_open_helper(&c->output);
998 /* c->force_drain = 1; */
1001 c->type = SSH_CHANNEL_OPEN;
1002 channel_pre_open(c, readset, writeset);
1003 } else if (ret == -1) {
1004 logit("X11 connection rejected because of wrong authentication.");
1005 debug2("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
1006 chan_read_failed(c);
1007 buffer_clear(&c->input);
1009 buffer_clear(&c->output);
1010 /* for proto v1, the peer will send an IEOF */
1012 chan_write_failed(c);
1014 c->type = SSH_CHANNEL_OPEN;
1015 debug2("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
1020 channel_pre_mux_client(Channel *c, fd_set *readset, fd_set *writeset)
1022 if (c->istate == CHAN_INPUT_OPEN && !c->mux_pause &&
1023 buffer_check_alloc(&c->input, CHAN_RBUF))
1024 FD_SET(c->rfd, readset);
1025 if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
1026 /* clear buffer immediately (discard any partial packet) */
1027 buffer_clear(&c->input);
1029 /* Start output drain. XXX just kill chan? */
1030 chan_rcvd_oclose(c);
1032 if (c->ostate == CHAN_OUTPUT_OPEN ||
1033 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
1034 if (buffer_len(&c->output) > 0)
1035 FD_SET(c->wfd, writeset);
1036 else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN)
1041 /* try to decode a socks4 header */
1044 channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
1047 u_int len, have, i, found, need;
1052 u_int16_t dest_port;
1053 struct in_addr dest_addr;
1056 debug2("channel %d: decode socks4", c->self);
1058 have = buffer_len(&c->input);
1059 len = sizeof(s4_req);
1062 p = (char *)buffer_ptr(&c->input);
1065 /* SOCKS4A uses an invalid IP address 0.0.0.x */
1066 if (p[4] == 0 && p[5] == 0 && p[6] == 0 && p[7] != 0) {
1067 debug2("channel %d: socks4a request", c->self);
1068 /* ... and needs an extra string (the hostname) */
1071 /* Check for terminating NUL on the string(s) */
1072 for (found = 0, i = len; i < have; i++) {
1079 /* the peer is probably sending garbage */
1080 debug("channel %d: decode socks4: too long",
1087 buffer_get(&c->input, (char *)&s4_req.version, 1);
1088 buffer_get(&c->input, (char *)&s4_req.command, 1);
1089 buffer_get(&c->input, (char *)&s4_req.dest_port, 2);
1090 buffer_get(&c->input, (char *)&s4_req.dest_addr, 4);
1091 have = buffer_len(&c->input);
1092 p = (char *)buffer_ptr(&c->input);
1093 if (memchr(p, '\0', have) == NULL)
1094 fatal("channel %d: decode socks4: user not nul terminated",
1097 debug2("channel %d: decode socks4: user %s/%d", c->self, p, len);
1098 len++; /* trailing '\0' */
1100 fatal("channel %d: decode socks4: len %d > have %d",
1101 c->self, len, have);
1102 strlcpy(username, p, sizeof(username));
1103 buffer_consume(&c->input, len);
1107 if (need == 1) { /* SOCKS4: one string */
1108 host = inet_ntoa(s4_req.dest_addr);
1109 c->path = xstrdup(host);
1110 } else { /* SOCKS4A: two strings */
1111 have = buffer_len(&c->input);
1112 p = (char *)buffer_ptr(&c->input);
1114 debug2("channel %d: decode socks4a: host %s/%d",
1116 len++; /* trailing '\0' */
1118 fatal("channel %d: decode socks4a: len %d > have %d",
1119 c->self, len, have);
1120 if (len > NI_MAXHOST) {
1121 error("channel %d: hostname \"%.100s\" too long",
1125 c->path = xstrdup(p);
1126 buffer_consume(&c->input, len);
1128 c->host_port = ntohs(s4_req.dest_port);
1130 debug2("channel %d: dynamic request: socks4 host %s port %u command %u",
1131 c->self, c->path, c->host_port, s4_req.command);
1133 if (s4_req.command != 1) {
1134 debug("channel %d: cannot handle: %s cn %d",
1135 c->self, need == 1 ? "SOCKS4" : "SOCKS4A", s4_req.command);
1138 s4_rsp.version = 0; /* vn: 0 for reply */
1139 s4_rsp.command = 90; /* cd: req granted */
1140 s4_rsp.dest_port = 0; /* ignored */
1141 s4_rsp.dest_addr.s_addr = INADDR_ANY; /* ignored */
1142 buffer_append(&c->output, &s4_rsp, sizeof(s4_rsp));
1146 /* try to decode a socks5 header */
1147 #define SSH_SOCKS5_AUTHDONE 0x1000
1148 #define SSH_SOCKS5_NOAUTH 0x00
1149 #define SSH_SOCKS5_IPV4 0x01
1150 #define SSH_SOCKS5_DOMAIN 0x03
1151 #define SSH_SOCKS5_IPV6 0x04
1152 #define SSH_SOCKS5_CONNECT 0x01
1153 #define SSH_SOCKS5_SUCCESS 0x00
1157 channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset)
1165 u_int16_t dest_port;
1166 char dest_addr[255+1], ntop[INET6_ADDRSTRLEN];
1168 u_int have, need, i, found, nmethods, addrlen, af;
1170 debug2("channel %d: decode socks5", c->self);
1171 p = buffer_ptr(&c->input);
1174 have = buffer_len(&c->input);
1175 if (!(c->flags & SSH_SOCKS5_AUTHDONE)) {
1176 /* format: ver | nmethods | methods */
1180 if (have < nmethods + 2)
1182 /* look for method: "NO AUTHENTICATION REQUIRED" */
1183 for (found = 0, i = 2; i < nmethods + 2; i++) {
1184 if (p[i] == SSH_SOCKS5_NOAUTH) {
1190 debug("channel %d: method SSH_SOCKS5_NOAUTH not found",
1194 buffer_consume(&c->input, nmethods + 2);
1195 buffer_put_char(&c->output, 0x05); /* version */
1196 buffer_put_char(&c->output, SSH_SOCKS5_NOAUTH); /* method */
1197 FD_SET(c->sock, writeset);
1198 c->flags |= SSH_SOCKS5_AUTHDONE;
1199 debug2("channel %d: socks5 auth done", c->self);
1200 return 0; /* need more */
1202 debug2("channel %d: socks5 post auth", c->self);
1203 if (have < sizeof(s5_req)+1)
1204 return 0; /* need more */
1205 memcpy(&s5_req, p, sizeof(s5_req));
1206 if (s5_req.version != 0x05 ||
1207 s5_req.command != SSH_SOCKS5_CONNECT ||
1208 s5_req.reserved != 0x00) {
1209 debug2("channel %d: only socks5 connect supported", c->self);
1212 switch (s5_req.atyp){
1213 case SSH_SOCKS5_IPV4:
1217 case SSH_SOCKS5_DOMAIN:
1218 addrlen = p[sizeof(s5_req)];
1221 case SSH_SOCKS5_IPV6:
1226 debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp);
1229 need = sizeof(s5_req) + addrlen + 2;
1230 if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
1234 buffer_consume(&c->input, sizeof(s5_req));
1235 if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
1236 buffer_consume(&c->input, 1); /* host string length */
1237 buffer_get(&c->input, &dest_addr, addrlen);
1238 buffer_get(&c->input, (char *)&dest_port, 2);
1239 dest_addr[addrlen] = '\0';
1242 if (s5_req.atyp == SSH_SOCKS5_DOMAIN) {
1243 if (addrlen >= NI_MAXHOST) {
1244 error("channel %d: dynamic request: socks5 hostname "
1245 "\"%.100s\" too long", c->self, dest_addr);
1248 c->path = xstrdup(dest_addr);
1250 if (inet_ntop(af, dest_addr, ntop, sizeof(ntop)) == NULL)
1252 c->path = xstrdup(ntop);
1254 c->host_port = ntohs(dest_port);
1256 debug2("channel %d: dynamic request: socks5 host %s port %u command %u",
1257 c->self, c->path, c->host_port, s5_req.command);
1259 s5_rsp.version = 0x05;
1260 s5_rsp.command = SSH_SOCKS5_SUCCESS;
1261 s5_rsp.reserved = 0; /* ignored */
1262 s5_rsp.atyp = SSH_SOCKS5_IPV4;
1263 dest_port = 0; /* ignored */
1265 buffer_append(&c->output, &s5_rsp, sizeof(s5_rsp));
1266 buffer_put_int(&c->output, ntohl(INADDR_ANY)); /* bind address */
1267 buffer_append(&c->output, &dest_port, sizeof(dest_port));
1272 channel_connect_stdio_fwd(const char *host_to_connect, u_short port_to_connect,
1277 debug("channel_connect_stdio_fwd %s:%d", host_to_connect,
1280 c = channel_new("stdio-forward", SSH_CHANNEL_OPENING, in, out,
1281 -1, CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1282 0, "stdio-forward", /*nonblock*/0);
1284 c->path = xstrdup(host_to_connect);
1285 c->host_port = port_to_connect;
1286 c->listening_port = 0;
1289 channel_register_fds(c, in, out, -1, 0, 1, 0);
1290 port_open_helper(c, "direct-tcpip");
1295 /* dynamic port forwarding */
1297 channel_pre_dynamic(Channel *c, fd_set *readset, fd_set *writeset)
1303 have = buffer_len(&c->input);
1304 debug2("channel %d: pre_dynamic: have %d", c->self, have);
1305 /* buffer_dump(&c->input); */
1306 /* check if the fixed size part of the packet is in buffer. */
1309 FD_SET(c->sock, readset);
1312 /* try to guess the protocol */
1313 p = buffer_ptr(&c->input);
1316 ret = channel_decode_socks4(c, readset, writeset);
1319 ret = channel_decode_socks5(c, readset, writeset);
1327 } else if (ret == 0) {
1328 debug2("channel %d: pre_dynamic: need more", c->self);
1330 FD_SET(c->sock, readset);
1332 /* switch to the next state */
1333 c->type = SSH_CHANNEL_OPENING;
1334 port_open_helper(c, "direct-tcpip");
1338 /* This is our fake X11 server socket. */
1341 channel_post_x11_listener(Channel *c, fd_set *readset, fd_set *writeset)
1344 struct sockaddr_storage addr;
1345 int newsock, oerrno;
1347 char buf[16384], *remote_ipaddr;
1350 if (FD_ISSET(c->sock, readset)) {
1351 debug("X11 connection requested.");
1352 addrlen = sizeof(addr);
1353 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen);
1354 if (c->single_connection) {
1356 debug2("single_connection: closing X11 listener.");
1357 channel_close_fd(&c->sock);
1362 if (errno != EINTR && errno != EWOULDBLOCK &&
1363 errno != ECONNABORTED)
1364 error("accept: %.100s", strerror(errno));
1365 if (errno == EMFILE || errno == ENFILE)
1366 c->notbefore = monotime() + 1;
1369 set_nodelay(newsock);
1370 remote_ipaddr = get_peer_ipaddr(newsock);
1371 remote_port = get_peer_port(newsock);
1372 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
1373 remote_ipaddr, remote_port);
1375 nc = channel_new("accepted x11 socket",
1376 SSH_CHANNEL_OPENING, newsock, newsock, -1,
1377 c->local_window_max, c->local_maxpacket, 0, buf, 1);
1379 packet_start(SSH2_MSG_CHANNEL_OPEN);
1380 packet_put_cstring("x11");
1381 packet_put_int(nc->self);
1382 packet_put_int(nc->local_window_max);
1383 packet_put_int(nc->local_maxpacket);
1384 /* originator ipaddr and port */
1385 packet_put_cstring(remote_ipaddr);
1386 if (datafellows & SSH_BUG_X11FWD) {
1387 debug2("ssh2 x11 bug compat mode");
1389 packet_put_int(remote_port);
1393 packet_start(SSH_SMSG_X11_OPEN);
1394 packet_put_int(nc->self);
1395 if (packet_get_protocol_flags() &
1396 SSH_PROTOFLAG_HOST_IN_FWD_OPEN)
1397 packet_put_cstring(buf);
1400 free(remote_ipaddr);
1405 port_open_helper(Channel *c, char *rtype)
1408 char *local_ipaddr = get_local_ipaddr(c->sock);
1409 int local_port = c->sock == -1 ? 65536 : get_sock_port(c->sock, 1);
1410 char *remote_ipaddr = get_peer_ipaddr(c->sock);
1411 int remote_port = get_peer_port(c->sock);
1413 if (remote_port == -1) {
1414 /* Fake addr/port to appease peers that validate it (Tectia) */
1415 free(remote_ipaddr);
1416 remote_ipaddr = xstrdup("127.0.0.1");
1417 remote_port = 65535;
1420 snprintf(buf, sizeof buf,
1421 "%s: listening port %d for %.100s port %d, "
1422 "connect from %.200s port %d to %.100s port %d",
1423 rtype, c->listening_port, c->path, c->host_port,
1424 remote_ipaddr, remote_port, local_ipaddr, local_port);
1426 free(c->remote_name);
1427 c->remote_name = xstrdup(buf);
1430 packet_start(SSH2_MSG_CHANNEL_OPEN);
1431 packet_put_cstring(rtype);
1432 packet_put_int(c->self);
1433 packet_put_int(c->local_window_max);
1434 packet_put_int(c->local_maxpacket);
1435 if (strcmp(rtype, "direct-tcpip") == 0) {
1436 /* target host, port */
1437 packet_put_cstring(c->path);
1438 packet_put_int(c->host_port);
1439 } else if (strcmp(rtype, "direct-streamlocal@openssh.com") == 0) {
1441 packet_put_cstring(c->path);
1442 } else if (strcmp(rtype, "forwarded-streamlocal@openssh.com") == 0) {
1444 packet_put_cstring(c->path);
1446 /* listen address, port */
1447 packet_put_cstring(c->path);
1448 packet_put_int(local_port);
1450 if (strcmp(rtype, "forwarded-streamlocal@openssh.com") == 0) {
1451 /* reserved for future owner/mode info */
1452 packet_put_cstring("");
1454 /* originator host and port */
1455 packet_put_cstring(remote_ipaddr);
1456 packet_put_int((u_int)remote_port);
1460 packet_start(SSH_MSG_PORT_OPEN);
1461 packet_put_int(c->self);
1462 packet_put_cstring(c->path);
1463 packet_put_int(c->host_port);
1464 if (packet_get_protocol_flags() &
1465 SSH_PROTOFLAG_HOST_IN_FWD_OPEN)
1466 packet_put_cstring(c->remote_name);
1469 free(remote_ipaddr);
1474 channel_set_reuseaddr(int fd)
1479 * Set socket options.
1480 * Allow local port reuse in TIME_WAIT.
1482 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1)
1483 error("setsockopt SO_REUSEADDR fd %d: %s", fd, strerror(errno));
1487 * This socket is listening for connections to a forwarded TCP/IP port.
1491 channel_post_port_listener(Channel *c, fd_set *readset, fd_set *writeset)
1494 struct sockaddr_storage addr;
1495 int newsock, nextstate;
1499 if (FD_ISSET(c->sock, readset)) {
1500 debug("Connection to port %d forwarding "
1501 "to %.100s port %d requested.",
1502 c->listening_port, c->path, c->host_port);
1504 if (c->type == SSH_CHANNEL_RPORT_LISTENER) {
1505 nextstate = SSH_CHANNEL_OPENING;
1506 rtype = "forwarded-tcpip";
1507 } else if (c->type == SSH_CHANNEL_RUNIX_LISTENER) {
1508 nextstate = SSH_CHANNEL_OPENING;
1509 rtype = "forwarded-streamlocal@openssh.com";
1510 } else if (c->host_port == PORT_STREAMLOCAL) {
1511 nextstate = SSH_CHANNEL_OPENING;
1512 rtype = "direct-streamlocal@openssh.com";
1513 } else if (c->host_port == 0) {
1514 nextstate = SSH_CHANNEL_DYNAMIC;
1515 rtype = "dynamic-tcpip";
1517 nextstate = SSH_CHANNEL_OPENING;
1518 rtype = "direct-tcpip";
1521 addrlen = sizeof(addr);
1522 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen);
1524 if (errno != EINTR && errno != EWOULDBLOCK &&
1525 errno != ECONNABORTED)
1526 error("accept: %.100s", strerror(errno));
1527 if (errno == EMFILE || errno == ENFILE)
1528 c->notbefore = monotime() + 1;
1531 if (c->host_port != PORT_STREAMLOCAL)
1532 set_nodelay(newsock);
1533 nc = channel_new(rtype, nextstate, newsock, newsock, -1,
1534 c->local_window_max, c->local_maxpacket, 0, rtype, 1);
1535 nc->listening_port = c->listening_port;
1536 nc->host_port = c->host_port;
1537 if (c->path != NULL)
1538 nc->path = xstrdup(c->path);
1540 if (nextstate != SSH_CHANNEL_DYNAMIC)
1541 port_open_helper(nc, rtype);
1546 * This is the authentication agent socket listening for connections from
1551 channel_post_auth_listener(Channel *c, fd_set *readset, fd_set *writeset)
1555 struct sockaddr_storage addr;
1558 if (FD_ISSET(c->sock, readset)) {
1559 addrlen = sizeof(addr);
1560 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen);
1562 error("accept from auth socket: %.100s",
1564 if (errno == EMFILE || errno == ENFILE)
1565 c->notbefore = monotime() + 1;
1568 nc = channel_new("accepted auth socket",
1569 SSH_CHANNEL_OPENING, newsock, newsock, -1,
1570 c->local_window_max, c->local_maxpacket,
1571 0, "accepted auth socket", 1);
1573 packet_start(SSH2_MSG_CHANNEL_OPEN);
1574 packet_put_cstring("auth-agent@openssh.com");
1575 packet_put_int(nc->self);
1576 packet_put_int(c->local_window_max);
1577 packet_put_int(c->local_maxpacket);
1579 packet_start(SSH_SMSG_AGENT_OPEN);
1580 packet_put_int(nc->self);
1588 channel_post_connecting(Channel *c, fd_set *readset, fd_set *writeset)
1591 socklen_t sz = sizeof(err);
1593 if (FD_ISSET(c->sock, writeset)) {
1594 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, &err, &sz) < 0) {
1596 error("getsockopt SO_ERROR failed");
1599 debug("channel %d: connected to %s port %d",
1600 c->self, c->connect_ctx.host, c->connect_ctx.port);
1601 channel_connect_ctx_free(&c->connect_ctx);
1602 c->type = SSH_CHANNEL_OPEN;
1604 packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
1605 packet_put_int(c->remote_id);
1606 packet_put_int(c->self);
1607 packet_put_int(c->local_window);
1608 packet_put_int(c->local_maxpacket);
1610 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1611 packet_put_int(c->remote_id);
1612 packet_put_int(c->self);
1615 debug("channel %d: connection failed: %s",
1616 c->self, strerror(err));
1617 /* Try next address, if any */
1618 if ((sock = connect_next(&c->connect_ctx)) > 0) {
1620 c->sock = c->rfd = c->wfd = sock;
1621 channel_max_fd = channel_find_maxfd();
1624 /* Exhausted all addresses */
1625 error("connect_to %.100s port %d: failed.",
1626 c->connect_ctx.host, c->connect_ctx.port);
1627 channel_connect_ctx_free(&c->connect_ctx);
1629 packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE);
1630 packet_put_int(c->remote_id);
1631 packet_put_int(SSH2_OPEN_CONNECT_FAILED);
1632 if (!(datafellows & SSH_BUG_OPENFAILURE)) {
1633 packet_put_cstring(strerror(err));
1634 packet_put_cstring("");
1637 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1638 packet_put_int(c->remote_id);
1648 channel_handle_rfd(Channel *c, fd_set *readset, fd_set *writeset)
1650 char buf[CHAN_RBUF];
1653 force = c->isatty && c->detach_close && c->istate != CHAN_INPUT_CLOSED;
1654 if (c->rfd != -1 && (force || FD_ISSET(c->rfd, readset))) {
1656 len = read(c->rfd, buf, sizeof(buf));
1657 if (len < 0 && (errno == EINTR ||
1658 ((errno == EAGAIN || errno == EWOULDBLOCK) && !force)))
1660 #ifndef PTY_ZEROREAD
1663 if ((!c->isatty && len <= 0) ||
1664 (c->isatty && (len < 0 || (len == 0 && errno != 0)))) {
1666 debug2("channel %d: read<=0 rfd %d len %d",
1667 c->self, c->rfd, len);
1668 if (c->type != SSH_CHANNEL_OPEN) {
1669 debug2("channel %d: not open", c->self);
1672 } else if (compat13) {
1673 buffer_clear(&c->output);
1674 c->type = SSH_CHANNEL_INPUT_DRAINING;
1675 debug2("channel %d: input draining.", c->self);
1677 chan_read_failed(c);
1681 if (c->input_filter != NULL) {
1682 if (c->input_filter(c, buf, len) == -1) {
1683 debug2("channel %d: filter stops", c->self);
1684 chan_read_failed(c);
1686 } else if (c->datagram) {
1687 buffer_put_string(&c->input, buf, len);
1689 buffer_append(&c->input, buf, len);
1697 channel_handle_wfd(Channel *c, fd_set *readset, fd_set *writeset)
1700 u_char *data = NULL, *buf;
1701 u_int dlen, olen = 0;
1704 /* Send buffered output data to the socket. */
1706 FD_ISSET(c->wfd, writeset) &&
1707 buffer_len(&c->output) > 0) {
1708 olen = buffer_len(&c->output);
1709 if (c->output_filter != NULL) {
1710 if ((buf = c->output_filter(c, &data, &dlen)) == NULL) {
1711 debug2("channel %d: filter stops", c->self);
1712 if (c->type != SSH_CHANNEL_OPEN)
1715 chan_write_failed(c);
1718 } else if (c->datagram) {
1719 buf = data = buffer_get_string(&c->output, &dlen);
1721 buf = data = buffer_ptr(&c->output);
1722 dlen = buffer_len(&c->output);
1726 /* ignore truncated writes, datagrams might get lost */
1727 len = write(c->wfd, buf, dlen);
1729 if (len < 0 && (errno == EINTR || errno == EAGAIN ||
1730 errno == EWOULDBLOCK))
1733 if (c->type != SSH_CHANNEL_OPEN)
1736 chan_write_failed(c);
1742 /* XXX: Later AIX versions can't push as much data to tty */
1743 if (compat20 && c->wfd_isatty)
1744 dlen = MIN(dlen, 8*1024);
1747 len = write(c->wfd, buf, dlen);
1749 (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK))
1752 if (c->type != SSH_CHANNEL_OPEN) {
1753 debug2("channel %d: not open", c->self);
1756 } else if (compat13) {
1757 buffer_clear(&c->output);
1758 debug2("channel %d: input draining.", c->self);
1759 c->type = SSH_CHANNEL_INPUT_DRAINING;
1761 chan_write_failed(c);
1765 #ifndef BROKEN_TCGETATTR_ICANON
1766 if (compat20 && c->isatty && dlen >= 1 && buf[0] != '\r') {
1767 if (tcgetattr(c->wfd, &tio) == 0 &&
1768 !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) {
1770 * Simulate echo to reduce the impact of
1771 * traffic analysis. We need to match the
1772 * size of a SSH2_MSG_CHANNEL_DATA message
1773 * (4 byte channel id + buf)
1775 packet_send_ignore(4 + len);
1780 buffer_consume(&c->output, len);
1783 if (compat20 && olen > 0)
1784 c->local_consumed += olen - buffer_len(&c->output);
1789 channel_handle_efd(Channel *c, fd_set *readset, fd_set *writeset)
1791 char buf[CHAN_RBUF];
1794 /** XXX handle drain efd, too */
1796 if (c->extended_usage == CHAN_EXTENDED_WRITE &&
1797 FD_ISSET(c->efd, writeset) &&
1798 buffer_len(&c->extended) > 0) {
1799 len = write(c->efd, buffer_ptr(&c->extended),
1800 buffer_len(&c->extended));
1801 debug2("channel %d: written %d to efd %d",
1802 c->self, len, c->efd);
1803 if (len < 0 && (errno == EINTR || errno == EAGAIN ||
1804 errno == EWOULDBLOCK))
1807 debug2("channel %d: closing write-efd %d",
1809 channel_close_fd(&c->efd);
1811 buffer_consume(&c->extended, len);
1812 c->local_consumed += len;
1814 } else if (c->efd != -1 &&
1815 (c->extended_usage == CHAN_EXTENDED_READ ||
1816 c->extended_usage == CHAN_EXTENDED_IGNORE) &&
1817 (c->detach_close || FD_ISSET(c->efd, readset))) {
1818 len = read(c->efd, buf, sizeof(buf));
1819 debug2("channel %d: read %d from efd %d",
1820 c->self, len, c->efd);
1821 if (len < 0 && (errno == EINTR || ((errno == EAGAIN ||
1822 errno == EWOULDBLOCK) && !c->detach_close)))
1825 debug2("channel %d: closing read-efd %d",
1827 channel_close_fd(&c->efd);
1829 if (c->extended_usage == CHAN_EXTENDED_IGNORE) {
1830 debug3("channel %d: discard efd",
1833 buffer_append(&c->extended, buf, len);
1841 channel_check_window(Channel *c)
1843 if (c->type == SSH_CHANNEL_OPEN &&
1844 !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
1845 ((c->local_window_max - c->local_window >
1846 c->local_maxpacket*3) ||
1847 c->local_window < c->local_window_max/2) &&
1848 c->local_consumed > 0) {
1849 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
1850 packet_put_int(c->remote_id);
1851 packet_put_int(c->local_consumed);
1853 debug2("channel %d: window %d sent adjust %d",
1854 c->self, c->local_window,
1856 c->local_window += c->local_consumed;
1857 c->local_consumed = 0;
1863 channel_post_open(Channel *c, fd_set *readset, fd_set *writeset)
1865 channel_handle_rfd(c, readset, writeset);
1866 channel_handle_wfd(c, readset, writeset);
1869 channel_handle_efd(c, readset, writeset);
1870 channel_check_window(c);
1874 read_mux(Channel *c, u_int need)
1876 char buf[CHAN_RBUF];
1880 if (buffer_len(&c->input) < need) {
1881 rlen = need - buffer_len(&c->input);
1882 len = read(c->rfd, buf, MIN(rlen, CHAN_RBUF));
1884 if (errno != EINTR && errno != EAGAIN) {
1885 debug2("channel %d: ctl read<=0 rfd %d len %d",
1886 c->self, c->rfd, len);
1887 chan_read_failed(c);
1891 buffer_append(&c->input, buf, len);
1893 return buffer_len(&c->input);
1897 channel_post_mux_client(Channel *c, fd_set *readset, fd_set *writeset)
1903 fatal("%s: entered with !compat20", __func__);
1905 if (c->rfd != -1 && !c->mux_pause && FD_ISSET(c->rfd, readset) &&
1906 (c->istate == CHAN_INPUT_OPEN ||
1907 c->istate == CHAN_INPUT_WAIT_DRAIN)) {
1909 * Don't not read past the precise end of packets to
1910 * avoid disrupting fd passing.
1912 if (read_mux(c, 4) < 4) /* read header */
1914 need = get_u32(buffer_ptr(&c->input));
1915 #define CHANNEL_MUX_MAX_PACKET (256 * 1024)
1916 if (need > CHANNEL_MUX_MAX_PACKET) {
1917 debug2("channel %d: packet too big %u > %u",
1918 c->self, CHANNEL_MUX_MAX_PACKET, need);
1919 chan_rcvd_oclose(c);
1922 if (read_mux(c, need + 4) < need + 4) /* read body */
1924 if (c->mux_rcb(c) != 0) {
1925 debug("channel %d: mux_rcb failed", c->self);
1931 if (c->wfd != -1 && FD_ISSET(c->wfd, writeset) &&
1932 buffer_len(&c->output) > 0) {
1933 len = write(c->wfd, buffer_ptr(&c->output),
1934 buffer_len(&c->output));
1935 if (len < 0 && (errno == EINTR || errno == EAGAIN))
1941 buffer_consume(&c->output, len);
1946 channel_post_mux_listener(Channel *c, fd_set *readset, fd_set *writeset)
1949 struct sockaddr_storage addr;
1955 if (!FD_ISSET(c->sock, readset))
1958 debug("multiplexing control connection");
1961 * Accept connection on control socket
1963 memset(&addr, 0, sizeof(addr));
1964 addrlen = sizeof(addr);
1965 if ((newsock = accept(c->sock, (struct sockaddr*)&addr,
1967 error("%s accept: %s", __func__, strerror(errno));
1968 if (errno == EMFILE || errno == ENFILE)
1969 c->notbefore = monotime() + 1;
1973 if (getpeereid(newsock, &euid, &egid) < 0) {
1974 error("%s getpeereid failed: %s", __func__,
1979 if ((euid != 0) && (getuid() != euid)) {
1980 error("multiplex uid mismatch: peer euid %u != uid %u",
1981 (u_int)euid, (u_int)getuid());
1985 nc = channel_new("multiplex client", SSH_CHANNEL_MUX_CLIENT,
1986 newsock, newsock, -1, c->local_window_max,
1987 c->local_maxpacket, 0, "mux-control", 1);
1988 nc->mux_rcb = c->mux_rcb;
1989 debug3("%s: new mux channel %d fd %d", __func__,
1990 nc->self, nc->sock);
1991 /* establish state */
1993 /* mux state transitions must not elicit protocol messages */
1994 nc->flags |= CHAN_LOCAL;
1999 channel_post_output_drain_13(Channel *c, fd_set *readset, fd_set *writeset)
2003 /* Send buffered output data to the socket. */
2004 if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) {
2005 len = write(c->sock, buffer_ptr(&c->output),
2006 buffer_len(&c->output));
2008 buffer_clear(&c->output);
2010 buffer_consume(&c->output, len);
2015 channel_handler_init_20(void)
2017 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open;
2018 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
2019 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
2020 channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener;
2021 channel_pre[SSH_CHANNEL_UNIX_LISTENER] = &channel_pre_listener;
2022 channel_pre[SSH_CHANNEL_RUNIX_LISTENER] = &channel_pre_listener;
2023 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
2024 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
2025 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
2026 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic;
2027 channel_pre[SSH_CHANNEL_MUX_LISTENER] = &channel_pre_listener;
2028 channel_pre[SSH_CHANNEL_MUX_CLIENT] = &channel_pre_mux_client;
2030 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open;
2031 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
2032 channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener;
2033 channel_post[SSH_CHANNEL_UNIX_LISTENER] = &channel_post_port_listener;
2034 channel_post[SSH_CHANNEL_RUNIX_LISTENER] = &channel_post_port_listener;
2035 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
2036 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
2037 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
2038 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open;
2039 channel_post[SSH_CHANNEL_MUX_LISTENER] = &channel_post_mux_listener;
2040 channel_post[SSH_CHANNEL_MUX_CLIENT] = &channel_post_mux_client;
2044 channel_handler_init_13(void)
2046 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13;
2047 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13;
2048 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
2049 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
2050 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
2051 channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining;
2052 channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining;
2053 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
2054 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic;
2056 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open;
2057 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
2058 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
2059 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
2060 channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13;
2061 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
2062 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open;
2066 channel_handler_init_15(void)
2068 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open;
2069 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open;
2070 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener;
2071 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener;
2072 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener;
2073 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting;
2074 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic;
2076 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener;
2077 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener;
2078 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener;
2079 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open;
2080 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting;
2081 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open;
2085 channel_handler_init(void)
2089 for (i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) {
2090 channel_pre[i] = NULL;
2091 channel_post[i] = NULL;
2094 channel_handler_init_20();
2096 channel_handler_init_13();
2098 channel_handler_init_15();
2101 /* gc dead channels */
2103 channel_garbage_collect(Channel *c)
2107 if (c->detach_user != NULL) {
2108 if (!chan_is_dead(c, c->detach_close))
2110 debug2("channel %d: gc: notify user", c->self);
2111 c->detach_user(c->self, NULL);
2112 /* if we still have a callback */
2113 if (c->detach_user != NULL)
2115 debug2("channel %d: gc: user detached", c->self);
2117 if (!chan_is_dead(c, 1))
2119 debug2("channel %d: garbage collecting", c->self);
2124 channel_handler(chan_fn *ftab[], fd_set *readset, fd_set *writeset,
2125 time_t *unpause_secs)
2127 static int did_init = 0;
2133 channel_handler_init();
2137 if (unpause_secs != NULL)
2139 for (i = 0, oalloc = channels_alloc; i < oalloc; i++) {
2144 if (ftab == channel_pre)
2149 if (ftab[c->type] != NULL) {
2151 * Run handlers that are not paused.
2153 if (c->notbefore <= now)
2154 (*ftab[c->type])(c, readset, writeset);
2155 else if (unpause_secs != NULL) {
2157 * Collect the time that the earliest
2158 * channel comes off pause.
2160 debug3("%s: chan %d: skip for %d more seconds",
2162 (int)(c->notbefore - now));
2163 if (*unpause_secs == 0 ||
2164 (c->notbefore - now) < *unpause_secs)
2165 *unpause_secs = c->notbefore - now;
2168 channel_garbage_collect(c);
2170 if (unpause_secs != NULL && *unpause_secs != 0)
2171 debug3("%s: first channel unpauses in %d seconds",
2172 __func__, (int)*unpause_secs);
2176 * Allocate/update select bitmasks and add any bits relevant to channels in
2180 channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp,
2181 u_int *nallocp, time_t *minwait_secs, int rekeying)
2183 u_int n, sz, nfdset;
2185 n = MAX(*maxfdp, channel_max_fd);
2187 nfdset = howmany(n+1, NFDBITS);
2188 /* Explicitly test here, because xrealloc isn't always called */
2189 if (nfdset && SIZE_MAX / nfdset < sizeof(fd_mask))
2190 fatal("channel_prepare_select: max_fd (%d) is too large", n);
2191 sz = nfdset * sizeof(fd_mask);
2193 /* perhaps check sz < nalloc/2 and shrink? */
2194 if (*readsetp == NULL || sz > *nallocp) {
2195 *readsetp = xrealloc(*readsetp, nfdset, sizeof(fd_mask));
2196 *writesetp = xrealloc(*writesetp, nfdset, sizeof(fd_mask));
2200 memset(*readsetp, 0, sz);
2201 memset(*writesetp, 0, sz);
2204 channel_handler(channel_pre, *readsetp, *writesetp,
2209 * After select, perform any appropriate operations for channels which have
2213 channel_after_select(fd_set *readset, fd_set *writeset)
2215 channel_handler(channel_post, readset, writeset, NULL);
2219 /* If there is data to send to the connection, enqueue some of it now. */
2221 channel_output_poll(void)
2226 for (i = 0; i < channels_alloc; i++) {
2232 * We are only interested in channels that can have buffered
2236 if (c->type != SSH_CHANNEL_OPEN &&
2237 c->type != SSH_CHANNEL_INPUT_DRAINING)
2240 if (c->type != SSH_CHANNEL_OPEN)
2244 (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) {
2245 /* XXX is this true? */
2246 debug3("channel %d: will not send data after close", c->self);
2250 /* Get the amount of buffered data for this channel. */
2251 if ((c->istate == CHAN_INPUT_OPEN ||
2252 c->istate == CHAN_INPUT_WAIT_DRAIN) &&
2253 (len = buffer_len(&c->input)) > 0) {
2259 data = buffer_get_string(&c->input,
2261 if (dlen > c->remote_window ||
2262 dlen > c->remote_maxpacket) {
2263 debug("channel %d: datagram "
2264 "too big for channel",
2269 packet_start(SSH2_MSG_CHANNEL_DATA);
2270 packet_put_int(c->remote_id);
2271 packet_put_string(data, dlen);
2273 c->remote_window -= dlen + 4;
2279 * Send some data for the other side over the secure
2283 if (len > c->remote_window)
2284 len = c->remote_window;
2285 if (len > c->remote_maxpacket)
2286 len = c->remote_maxpacket;
2288 if (packet_is_interactive()) {
2292 /* Keep the packets at reasonable size. */
2293 if (len > packet_get_maxsize()/2)
2294 len = packet_get_maxsize()/2;
2298 packet_start(compat20 ?
2299 SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA);
2300 packet_put_int(c->remote_id);
2301 packet_put_string(buffer_ptr(&c->input), len);
2303 buffer_consume(&c->input, len);
2304 c->remote_window -= len;
2306 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) {
2308 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3");
2310 * input-buffer is empty and read-socket shutdown:
2311 * tell peer, that we will not send more data: send IEOF.
2312 * hack for extended data: delay EOF if EFD still in use.
2314 if (CHANNEL_EFD_INPUT_ACTIVE(c))
2315 debug2("channel %d: ibuf_empty delayed efd %d/(%d)",
2316 c->self, c->efd, buffer_len(&c->extended));
2320 /* Send extended data, i.e. stderr */
2322 !(c->flags & CHAN_EOF_SENT) &&
2323 c->remote_window > 0 &&
2324 (len = buffer_len(&c->extended)) > 0 &&
2325 c->extended_usage == CHAN_EXTENDED_READ) {
2326 debug2("channel %d: rwin %u elen %u euse %d",
2327 c->self, c->remote_window, buffer_len(&c->extended),
2329 if (len > c->remote_window)
2330 len = c->remote_window;
2331 if (len > c->remote_maxpacket)
2332 len = c->remote_maxpacket;
2333 packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA);
2334 packet_put_int(c->remote_id);
2335 packet_put_int(SSH2_EXTENDED_DATA_STDERR);
2336 packet_put_string(buffer_ptr(&c->extended), len);
2338 buffer_consume(&c->extended, len);
2339 c->remote_window -= len;
2340 debug2("channel %d: sent ext data %d", c->self, len);
2346 /* -- protocol input */
2350 channel_input_data(int type, u_int32_t seq, void *ctxt)
2354 u_int data_len, win_len;
2357 /* Get the channel number and verify it. */
2358 id = packet_get_int();
2359 c = channel_lookup(id);
2361 packet_disconnect("Received data for nonexistent channel %d.", id);
2363 /* Ignore any data for non-open channels (might happen on close) */
2364 if (c->type != SSH_CHANNEL_OPEN &&
2365 c->type != SSH_CHANNEL_X11_OPEN)
2369 data = packet_get_string_ptr(&data_len);
2372 win_len += 4; /* string length header */
2375 * Ignore data for protocol > 1.3 if output end is no longer open.
2376 * For protocol 2 the sending side is reducing its window as it sends
2377 * data, so we must 'fake' consumption of the data in order to ensure
2378 * that window updates are sent back. Otherwise the connection might
2381 if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN) {
2383 c->local_window -= win_len;
2384 c->local_consumed += win_len;
2390 if (win_len > c->local_maxpacket) {
2391 logit("channel %d: rcvd big packet %d, maxpack %d",
2392 c->self, win_len, c->local_maxpacket);
2394 if (win_len > c->local_window) {
2395 logit("channel %d: rcvd too much data %d, win %d",
2396 c->self, win_len, c->local_window);
2399 c->local_window -= win_len;
2402 buffer_put_string(&c->output, data, data_len);
2404 buffer_append(&c->output, data, data_len);
2411 channel_input_extended_data(int type, u_int32_t seq, void *ctxt)
2415 u_int data_len, tcode;
2418 /* Get the channel number and verify it. */
2419 id = packet_get_int();
2420 c = channel_lookup(id);
2423 packet_disconnect("Received extended_data for bad channel %d.", id);
2424 if (c->type != SSH_CHANNEL_OPEN) {
2425 logit("channel %d: ext data for non open", id);
2428 if (c->flags & CHAN_EOF_RCVD) {
2429 if (datafellows & SSH_BUG_EXTEOF)
2430 debug("channel %d: accepting ext data after eof", id);
2432 packet_disconnect("Received extended_data after EOF "
2433 "on channel %d.", id);
2435 tcode = packet_get_int();
2437 c->extended_usage != CHAN_EXTENDED_WRITE ||
2438 tcode != SSH2_EXTENDED_DATA_STDERR) {
2439 logit("channel %d: bad ext data", c->self);
2442 data = packet_get_string(&data_len);
2444 if (data_len > c->local_window) {
2445 logit("channel %d: rcvd too much extended_data %d, win %d",
2446 c->self, data_len, c->local_window);
2450 debug2("channel %d: rcvd ext data %d", c->self, data_len);
2451 c->local_window -= data_len;
2452 buffer_append(&c->extended, data, data_len);
2459 channel_input_ieof(int type, u_int32_t seq, void *ctxt)
2464 id = packet_get_int();
2466 c = channel_lookup(id);
2468 packet_disconnect("Received ieof for nonexistent channel %d.", id);
2471 /* XXX force input close */
2472 if (c->force_drain && c->istate == CHAN_INPUT_OPEN) {
2473 debug("channel %d: FORCE input drain", c->self);
2474 c->istate = CHAN_INPUT_WAIT_DRAIN;
2475 if (buffer_len(&c->input) == 0)
2483 channel_input_close(int type, u_int32_t seq, void *ctxt)
2488 id = packet_get_int();
2490 c = channel_lookup(id);
2492 packet_disconnect("Received close for nonexistent channel %d.", id);
2495 * Send a confirmation that we have closed the channel and no more
2496 * data is coming for it.
2498 packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION);
2499 packet_put_int(c->remote_id);
2503 * If the channel is in closed state, we have sent a close request,
2504 * and the other side will eventually respond with a confirmation.
2505 * Thus, we cannot free the channel here, because then there would be
2506 * no-one to receive the confirmation. The channel gets freed when
2507 * the confirmation arrives.
2509 if (c->type != SSH_CHANNEL_CLOSED) {
2511 * Not a closed channel - mark it as draining, which will
2512 * cause it to be freed later.
2514 buffer_clear(&c->input);
2515 c->type = SSH_CHANNEL_OUTPUT_DRAINING;
2520 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
2523 channel_input_oclose(int type, u_int32_t seq, void *ctxt)
2525 int id = packet_get_int();
2526 Channel *c = channel_lookup(id);
2530 packet_disconnect("Received oclose for nonexistent channel %d.", id);
2531 chan_rcvd_oclose(c);
2537 channel_input_close_confirmation(int type, u_int32_t seq, void *ctxt)
2539 int id = packet_get_int();
2540 Channel *c = channel_lookup(id);
2544 packet_disconnect("Received close confirmation for "
2545 "out-of-range channel %d.", id);
2546 if (c->type != SSH_CHANNEL_CLOSED && c->type != SSH_CHANNEL_ABANDONED)
2547 packet_disconnect("Received close confirmation for "
2548 "non-closed channel %d (type %d).", id, c->type);
2555 channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt)
2560 id = packet_get_int();
2561 c = channel_lookup(id);
2563 if (c==NULL || c->type != SSH_CHANNEL_OPENING)
2564 packet_disconnect("Received open confirmation for "
2565 "non-opening channel %d.", id);
2566 remote_id = packet_get_int();
2567 /* Record the remote channel number and mark that the channel is now open. */
2568 c->remote_id = remote_id;
2569 c->type = SSH_CHANNEL_OPEN;
2572 c->remote_window = packet_get_int();
2573 c->remote_maxpacket = packet_get_int();
2574 if (c->open_confirm) {
2575 debug2("callback start");
2576 c->open_confirm(c->self, 1, c->open_confirm_ctx);
2577 debug2("callback done");
2579 debug2("channel %d: open confirm rwindow %u rmax %u", c->self,
2580 c->remote_window, c->remote_maxpacket);
2587 reason2txt(int reason)
2590 case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED:
2591 return "administratively prohibited";
2592 case SSH2_OPEN_CONNECT_FAILED:
2593 return "connect failed";
2594 case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE:
2595 return "unknown channel type";
2596 case SSH2_OPEN_RESOURCE_SHORTAGE:
2597 return "resource shortage";
2599 return "unknown reason";
2604 channel_input_open_failure(int type, u_int32_t seq, void *ctxt)
2607 char *msg = NULL, *lang = NULL;
2610 id = packet_get_int();
2611 c = channel_lookup(id);
2613 if (c==NULL || c->type != SSH_CHANNEL_OPENING)
2614 packet_disconnect("Received open failure for "
2615 "non-opening channel %d.", id);
2617 reason = packet_get_int();
2618 if (!(datafellows & SSH_BUG_OPENFAILURE)) {
2619 msg = packet_get_string(NULL);
2620 lang = packet_get_string(NULL);
2622 logit("channel %d: open failed: %s%s%s", id,
2623 reason2txt(reason), msg ? ": ": "", msg ? msg : "");
2626 if (c->open_confirm) {
2627 debug2("callback start");
2628 c->open_confirm(c->self, 0, c->open_confirm_ctx);
2629 debug2("callback done");
2633 /* Schedule the channel for cleanup/deletion. */
2640 channel_input_window_adjust(int type, u_int32_t seq, void *ctxt)
2649 /* Get the channel number and verify it. */
2650 id = packet_get_int();
2651 c = channel_lookup(id);
2654 logit("Received window adjust for non-open channel %d.", id);
2657 adjust = packet_get_int();
2659 debug2("channel %d: rcvd adjust %u", id, adjust);
2660 c->remote_window += adjust;
2666 channel_input_port_open(int type, u_int32_t seq, void *ctxt)
2670 char *host, *originator_string;
2673 remote_id = packet_get_int();
2674 host = packet_get_string(NULL);
2675 host_port = packet_get_int();
2677 if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {
2678 originator_string = packet_get_string(NULL);
2680 originator_string = xstrdup("unknown (remote did not supply name)");
2683 c = channel_connect_to_port(host, host_port,
2684 "connected socket", originator_string);
2685 free(originator_string);
2688 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
2689 packet_put_int(remote_id);
2692 c->remote_id = remote_id;
2698 channel_input_status_confirm(int type, u_int32_t seq, void *ctxt)
2701 struct channel_confirm *cc;
2704 /* Reset keepalive timeout */
2705 packet_set_alive_timeouts(0);
2707 id = packet_get_int();
2710 debug2("channel_input_status_confirm: type %d id %d", type, id);
2712 if ((c = channel_lookup(id)) == NULL) {
2713 logit("channel_input_status_confirm: %d: unknown", id);
2716 if ((cc = TAILQ_FIRST(&c->status_confirms)) == NULL)
2718 cc->cb(type, c, cc->ctx);
2719 TAILQ_REMOVE(&c->status_confirms, cc, entry);
2720 explicit_bzero(cc, sizeof(*cc));
2725 /* -- tcp forwarding */
2728 channel_set_af(int af)
2735 * Determine whether or not a port forward listens to loopback, the
2736 * specified address or wildcard. On the client, a specified bind
2737 * address will always override gateway_ports. On the server, a
2738 * gateway_ports of 1 (``yes'') will override the client's specification
2739 * and force a wildcard bind, whereas a value of 2 (``clientspecified'')
2740 * will bind to whatever address the client asked for.
2742 * Special-case listen_addrs are:
2744 * "0.0.0.0" -> wildcard v4/v6 if SSH_OLD_FORWARD_ADDR
2745 * "" (empty string), "*" -> wildcard v4/v6
2746 * "localhost" -> loopback v4/v6
2747 * "127.0.0.1" / "::1" -> accepted even if gateway_ports isn't set
2750 channel_fwd_bind_addr(const char *listen_addr, int *wildcardp,
2751 int is_client, struct ForwardOptions *fwd_opts)
2753 const char *addr = NULL;
2756 if (listen_addr == NULL) {
2757 /* No address specified: default to gateway_ports setting */
2758 if (fwd_opts->gateway_ports)
2760 } else if (fwd_opts->gateway_ports || is_client) {
2761 if (((datafellows & SSH_OLD_FORWARD_ADDR) &&
2762 strcmp(listen_addr, "0.0.0.0") == 0 && is_client == 0) ||
2763 *listen_addr == '\0' || strcmp(listen_addr, "*") == 0 ||
2764 (!is_client && fwd_opts->gateway_ports == 1)) {
2767 * Notify client if they requested a specific listen
2768 * address and it was overridden.
2770 if (*listen_addr != '\0' &&
2771 strcmp(listen_addr, "0.0.0.0") != 0 &&
2772 strcmp(listen_addr, "*") != 0) {
2773 packet_send_debug("Forwarding listen address "
2774 "\"%s\" overridden by server "
2775 "GatewayPorts", listen_addr);
2777 } else if (strcmp(listen_addr, "localhost") != 0 ||
2778 strcmp(listen_addr, "127.0.0.1") == 0 ||
2779 strcmp(listen_addr, "::1") == 0) {
2780 /* Accept localhost address when GatewayPorts=yes */
2783 } else if (strcmp(listen_addr, "127.0.0.1") == 0 ||
2784 strcmp(listen_addr, "::1") == 0) {
2786 * If a specific IPv4/IPv6 localhost address has been
2787 * requested then accept it even if gateway_ports is in
2788 * effect. This allows the client to prefer IPv4 or IPv6.
2792 if (wildcardp != NULL)
2793 *wildcardp = wildcard;
2798 channel_setup_fwd_listener_tcpip(int type, struct Forward *fwd,
2799 int *allocated_listen_port, struct ForwardOptions *fwd_opts)
2802 int sock, r, success = 0, wildcard = 0, is_client;
2803 struct addrinfo hints, *ai, *aitop;
2804 const char *host, *addr;
2805 char ntop[NI_MAXHOST], strport[NI_MAXSERV];
2808 host = (type == SSH_CHANNEL_RPORT_LISTENER) ?
2809 fwd->listen_host : fwd->connect_host;
2810 is_client = (type == SSH_CHANNEL_PORT_LISTENER);
2813 error("No forward host name.");
2816 if (strlen(host) >= NI_MAXHOST) {
2817 error("Forward host name too long.");
2821 /* Determine the bind address, cf. channel_fwd_bind_addr() comment */
2822 addr = channel_fwd_bind_addr(fwd->listen_host, &wildcard,
2823 is_client, fwd_opts);
2824 debug3("%s: type %d wildcard %d addr %s", __func__,
2825 type, wildcard, (addr == NULL) ? "NULL" : addr);
2828 * getaddrinfo returns a loopback address if the hostname is
2829 * set to NULL and hints.ai_flags is not AI_PASSIVE
2831 memset(&hints, 0, sizeof(hints));
2832 hints.ai_family = IPv4or6;
2833 hints.ai_flags = wildcard ? AI_PASSIVE : 0;
2834 hints.ai_socktype = SOCK_STREAM;
2835 snprintf(strport, sizeof strport, "%d", fwd->listen_port);
2836 if ((r = getaddrinfo(addr, strport, &hints, &aitop)) != 0) {
2838 /* This really shouldn't happen */
2839 packet_disconnect("getaddrinfo: fatal error: %s",
2840 ssh_gai_strerror(r));
2842 error("%s: getaddrinfo(%.64s): %s", __func__, addr,
2843 ssh_gai_strerror(r));
2847 if (allocated_listen_port != NULL)
2848 *allocated_listen_port = 0;
2849 for (ai = aitop; ai; ai = ai->ai_next) {
2850 switch (ai->ai_family) {
2852 lport_p = &((struct sockaddr_in *)ai->ai_addr)->
2856 lport_p = &((struct sockaddr_in6 *)ai->ai_addr)->
2863 * If allocating a port for -R forwards, then use the
2864 * same port for all address families.
2866 if (type == SSH_CHANNEL_RPORT_LISTENER && fwd->listen_port == 0 &&
2867 allocated_listen_port != NULL && *allocated_listen_port > 0)
2868 *lport_p = htons(*allocated_listen_port);
2870 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop),
2871 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
2872 error("%s: getnameinfo failed", __func__);
2875 /* Create a port to listen for the host. */
2876 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
2878 /* this is no error since kernel may not support ipv6 */
2879 verbose("socket: %.100s", strerror(errno));
2883 channel_set_reuseaddr(sock);
2884 if (ai->ai_family == AF_INET6)
2885 sock_set_v6only(sock);
2887 debug("Local forwarding listening on %s port %s.",
2890 /* Bind the socket to the address. */
2891 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
2892 /* address can be in use ipv6 address is already bound */
2894 error("bind: %.100s", strerror(errno));
2896 verbose("bind: %.100s", strerror(errno));
2901 /* Start listening for connections on the socket. */
2902 if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
2903 error("listen: %.100s", strerror(errno));
2909 * fwd->listen_port == 0 requests a dynamically allocated port -
2910 * record what we got.
2912 if (type == SSH_CHANNEL_RPORT_LISTENER && fwd->listen_port == 0 &&
2913 allocated_listen_port != NULL &&
2914 *allocated_listen_port == 0) {
2915 *allocated_listen_port = get_sock_port(sock, 1);
2916 debug("Allocated listen port %d",
2917 *allocated_listen_port);
2920 /* Allocate a channel number for the socket. */
2921 c = channel_new("port listener", type, sock, sock, -1,
2922 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
2923 0, "port listener", 1);
2924 c->path = xstrdup(host);
2925 c->host_port = fwd->connect_port;
2926 c->listening_addr = addr == NULL ? NULL : xstrdup(addr);
2927 if (fwd->listen_port == 0 && allocated_listen_port != NULL &&
2928 !(datafellows & SSH_BUG_DYNAMIC_RPORT))
2929 c->listening_port = *allocated_listen_port;
2931 c->listening_port = fwd->listen_port;
2935 error("%s: cannot listen to port: %d", __func__,
2937 freeaddrinfo(aitop);
2942 channel_setup_fwd_listener_streamlocal(int type, struct Forward *fwd,
2943 struct ForwardOptions *fwd_opts)
2945 struct sockaddr_un sunaddr;
2952 case SSH_CHANNEL_UNIX_LISTENER:
2953 if (fwd->connect_path != NULL) {
2954 if (strlen(fwd->connect_path) > sizeof(sunaddr.sun_path)) {
2955 error("Local connecting path too long: %s",
2959 path = fwd->connect_path;
2960 port = PORT_STREAMLOCAL;
2962 if (fwd->connect_host == NULL) {
2963 error("No forward host name.");
2966 if (strlen(fwd->connect_host) >= NI_MAXHOST) {
2967 error("Forward host name too long.");
2970 path = fwd->connect_host;
2971 port = fwd->connect_port;
2974 case SSH_CHANNEL_RUNIX_LISTENER:
2975 path = fwd->listen_path;
2976 port = PORT_STREAMLOCAL;
2979 error("%s: unexpected channel type %d", __func__, type);
2983 if (fwd->listen_path == NULL) {
2984 error("No forward path name.");
2987 if (strlen(fwd->listen_path) > sizeof(sunaddr.sun_path)) {
2988 error("Local listening path too long: %s", fwd->listen_path);
2992 debug3("%s: type %d path %s", __func__, type, fwd->listen_path);
2994 /* Start a Unix domain listener. */
2995 omask = umask(fwd_opts->streamlocal_bind_mask);
2996 sock = unix_listener(fwd->listen_path, SSH_LISTEN_BACKLOG,
2997 fwd_opts->streamlocal_bind_unlink);
3002 debug("Local forwarding listening on path %s.", fwd->listen_path);
3004 /* Allocate a channel number for the socket. */
3005 c = channel_new("unix listener", type, sock, sock, -1,
3006 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
3007 0, "unix listener", 1);
3008 c->path = xstrdup(path);
3009 c->host_port = port;
3010 c->listening_port = PORT_STREAMLOCAL;
3011 c->listening_addr = xstrdup(fwd->listen_path);
3016 channel_cancel_rport_listener_tcpip(const char *host, u_short port)
3021 for (i = 0; i < channels_alloc; i++) {
3022 Channel *c = channels[i];
3023 if (c == NULL || c->type != SSH_CHANNEL_RPORT_LISTENER)
3025 if (strcmp(c->path, host) == 0 && c->listening_port == port) {
3026 debug2("%s: close channel %d", __func__, i);
3036 channel_cancel_rport_listener_streamlocal(const char *path)
3041 for (i = 0; i < channels_alloc; i++) {
3042 Channel *c = channels[i];
3043 if (c == NULL || c->type != SSH_CHANNEL_RUNIX_LISTENER)
3045 if (c->path == NULL)
3047 if (strcmp(c->path, path) == 0) {
3048 debug2("%s: close channel %d", __func__, i);
3058 channel_cancel_rport_listener(struct Forward *fwd)
3060 if (fwd->listen_path != NULL)
3061 return channel_cancel_rport_listener_streamlocal(fwd->listen_path);
3063 return channel_cancel_rport_listener_tcpip(fwd->listen_host, fwd->listen_port);
3067 channel_cancel_lport_listener_tcpip(const char *lhost, u_short lport,
3068 int cport, struct ForwardOptions *fwd_opts)
3072 const char *addr = channel_fwd_bind_addr(lhost, NULL, 1, fwd_opts);
3074 for (i = 0; i < channels_alloc; i++) {
3075 Channel *c = channels[i];
3076 if (c == NULL || c->type != SSH_CHANNEL_PORT_LISTENER)
3078 if (c->listening_port != lport)
3080 if (cport == CHANNEL_CANCEL_PORT_STATIC) {
3081 /* skip dynamic forwardings */
3082 if (c->host_port == 0)
3085 if (c->host_port != cport)
3088 if ((c->listening_addr == NULL && addr != NULL) ||
3089 (c->listening_addr != NULL && addr == NULL))
3091 if (addr == NULL || strcmp(c->listening_addr, addr) == 0) {
3092 debug2("%s: close channel %d", __func__, i);
3102 channel_cancel_lport_listener_streamlocal(const char *path)
3108 error("%s: no path specified.", __func__);
3112 for (i = 0; i < channels_alloc; i++) {
3113 Channel *c = channels[i];
3114 if (c == NULL || c->type != SSH_CHANNEL_UNIX_LISTENER)
3116 if (c->listening_addr == NULL)
3118 if (strcmp(c->listening_addr, path) == 0) {
3119 debug2("%s: close channel %d", __func__, i);
3129 channel_cancel_lport_listener(struct Forward *fwd, int cport, struct ForwardOptions *fwd_opts)
3131 if (fwd->listen_path != NULL)
3132 return channel_cancel_lport_listener_streamlocal(fwd->listen_path);
3134 return channel_cancel_lport_listener_tcpip(fwd->listen_host, fwd->listen_port, cport, fwd_opts);
3137 /* protocol local port fwd, used by ssh (and sshd in v1) */
3139 channel_setup_local_fwd_listener(struct Forward *fwd, struct ForwardOptions *fwd_opts)
3141 if (fwd->listen_path != NULL) {
3142 return channel_setup_fwd_listener_streamlocal(
3143 SSH_CHANNEL_UNIX_LISTENER, fwd, fwd_opts);
3145 return channel_setup_fwd_listener_tcpip(SSH_CHANNEL_PORT_LISTENER,
3146 fwd, NULL, fwd_opts);
3150 /* protocol v2 remote port fwd, used by sshd */
3152 channel_setup_remote_fwd_listener(struct Forward *fwd,
3153 int *allocated_listen_port, struct ForwardOptions *fwd_opts)
3155 if (fwd->listen_path != NULL) {
3156 return channel_setup_fwd_listener_streamlocal(
3157 SSH_CHANNEL_RUNIX_LISTENER, fwd, fwd_opts);
3159 return channel_setup_fwd_listener_tcpip(
3160 SSH_CHANNEL_RPORT_LISTENER, fwd, allocated_listen_port,
3166 * Translate the requested rfwd listen host to something usable for
3170 channel_rfwd_bind_host(const char *listen_host)
3172 if (listen_host == NULL) {
3173 if (datafellows & SSH_BUG_RFWD_ADDR)
3177 } else if (*listen_host == '\0' || strcmp(listen_host, "*") == 0) {
3178 if (datafellows & SSH_BUG_RFWD_ADDR)
3187 * Initiate forwarding of connections to port "port" on remote host through
3188 * the secure channel to host:port from local side.
3189 * Returns handle (index) for updating the dynamic listen port with
3190 * channel_update_permitted_opens().
3193 channel_request_remote_forwarding(struct Forward *fwd)
3195 int type, success = 0, idx = -1;
3197 /* Send the forward request to the remote side. */
3199 packet_start(SSH2_MSG_GLOBAL_REQUEST);
3200 if (fwd->listen_path != NULL) {
3201 packet_put_cstring("streamlocal-forward@openssh.com");
3202 packet_put_char(1); /* boolean: want reply */
3203 packet_put_cstring(fwd->listen_path);
3205 packet_put_cstring("tcpip-forward");
3206 packet_put_char(1); /* boolean: want reply */
3207 packet_put_cstring(channel_rfwd_bind_host(fwd->listen_host));
3208 packet_put_int(fwd->listen_port);
3211 packet_write_wait();
3212 /* Assume that server accepts the request */
3214 } else if (fwd->listen_path == NULL) {
3215 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST);
3216 packet_put_int(fwd->listen_port);
3217 packet_put_cstring(fwd->connect_host);
3218 packet_put_int(fwd->connect_port);
3220 packet_write_wait();
3222 /* Wait for response from the remote side. */
3223 type = packet_read();
3225 case SSH_SMSG_SUCCESS:
3228 case SSH_SMSG_FAILURE:
3231 /* Unknown packet */
3232 packet_disconnect("Protocol error for port forward request:"
3233 "received packet type %d.", type);
3236 logit("Warning: Server does not support remote stream local forwarding.");
3239 /* Record that connection to this host/port is permitted. */
3240 permitted_opens = xrealloc(permitted_opens,
3241 num_permitted_opens + 1, sizeof(*permitted_opens));
3242 idx = num_permitted_opens++;
3243 if (fwd->connect_path != NULL) {
3244 permitted_opens[idx].host_to_connect =
3245 xstrdup(fwd->connect_path);
3246 permitted_opens[idx].port_to_connect =
3249 permitted_opens[idx].host_to_connect =
3250 xstrdup(fwd->connect_host);
3251 permitted_opens[idx].port_to_connect =
3254 if (fwd->listen_path != NULL) {
3255 permitted_opens[idx].listen_host = NULL;
3256 permitted_opens[idx].listen_path =
3257 xstrdup(fwd->listen_path);
3258 permitted_opens[idx].listen_port = PORT_STREAMLOCAL;
3260 permitted_opens[idx].listen_host =
3261 fwd->listen_host ? xstrdup(fwd->listen_host) : NULL;
3262 permitted_opens[idx].listen_path = NULL;
3263 permitted_opens[idx].listen_port = fwd->listen_port;
3270 open_match(ForwardPermission *allowed_open, const char *requestedhost,
3273 if (allowed_open->host_to_connect == NULL)
3275 if (allowed_open->port_to_connect != FWD_PERMIT_ANY_PORT &&
3276 allowed_open->port_to_connect != requestedport)
3278 if (strcmp(allowed_open->host_to_connect, requestedhost) != 0)
3284 * Note that in the listen host/port case
3285 * we don't support FWD_PERMIT_ANY_PORT and
3286 * need to translate between the configured-host (listen_host)
3287 * and what we've sent to the remote server (channel_rfwd_bind_host)
3290 open_listen_match_tcpip(ForwardPermission *allowed_open,
3291 const char *requestedhost, u_short requestedport, int translate)
3293 const char *allowed_host;
3295 if (allowed_open->host_to_connect == NULL)
3297 if (allowed_open->listen_port != requestedport)
3299 if (!translate && allowed_open->listen_host == NULL &&
3300 requestedhost == NULL)
3302 allowed_host = translate ?
3303 channel_rfwd_bind_host(allowed_open->listen_host) :
3304 allowed_open->listen_host;
3305 if (allowed_host == NULL ||
3306 strcmp(allowed_host, requestedhost) != 0)
3312 open_listen_match_streamlocal(ForwardPermission *allowed_open,
3313 const char *requestedpath)
3315 if (allowed_open->host_to_connect == NULL)
3317 if (allowed_open->listen_port != PORT_STREAMLOCAL)
3319 if (allowed_open->listen_path == NULL ||
3320 strcmp(allowed_open->listen_path, requestedpath) != 0)
3326 * Request cancellation of remote forwarding of connection host:port from
3330 channel_request_rforward_cancel_tcpip(const char *host, u_short port)
3337 for (i = 0; i < num_permitted_opens; i++) {
3338 if (open_listen_match_tcpip(&permitted_opens[i], host, port, 0))
3341 if (i >= num_permitted_opens) {
3342 debug("%s: requested forward not found", __func__);
3345 packet_start(SSH2_MSG_GLOBAL_REQUEST);
3346 packet_put_cstring("cancel-tcpip-forward");
3348 packet_put_cstring(channel_rfwd_bind_host(host));
3349 packet_put_int(port);
3352 permitted_opens[i].listen_port = 0;
3353 permitted_opens[i].port_to_connect = 0;
3354 free(permitted_opens[i].host_to_connect);
3355 permitted_opens[i].host_to_connect = NULL;
3356 free(permitted_opens[i].listen_host);
3357 permitted_opens[i].listen_host = NULL;
3358 permitted_opens[i].listen_path = NULL;
3364 * Request cancellation of remote forwarding of Unix domain socket
3365 * path from local side.
3368 channel_request_rforward_cancel_streamlocal(const char *path)
3375 for (i = 0; i < num_permitted_opens; i++) {
3376 if (open_listen_match_streamlocal(&permitted_opens[i], path))
3379 if (i >= num_permitted_opens) {
3380 debug("%s: requested forward not found", __func__);
3383 packet_start(SSH2_MSG_GLOBAL_REQUEST);
3384 packet_put_cstring("cancel-streamlocal-forward@openssh.com");
3386 packet_put_cstring(path);
3389 permitted_opens[i].listen_port = 0;
3390 permitted_opens[i].port_to_connect = 0;
3391 free(permitted_opens[i].host_to_connect);
3392 permitted_opens[i].host_to_connect = NULL;
3393 permitted_opens[i].listen_host = NULL;
3394 free(permitted_opens[i].listen_path);
3395 permitted_opens[i].listen_path = NULL;
3401 * Request cancellation of remote forwarding of a connection from local side.
3404 channel_request_rforward_cancel(struct Forward *fwd)
3406 if (fwd->listen_path != NULL) {
3407 return (channel_request_rforward_cancel_streamlocal(
3410 return (channel_request_rforward_cancel_tcpip(fwd->listen_host,
3411 fwd->listen_port ? fwd->listen_port : fwd->allocated_port));
3416 * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates
3417 * listening for the port, and sends back a success reply (or disconnect
3418 * message if there was an error).
3421 channel_input_port_forward_request(int is_root, struct ForwardOptions *fwd_opts)
3426 /* Get arguments from the packet. */
3427 memset(&fwd, 0, sizeof(fwd));
3428 fwd.listen_port = packet_get_int();
3429 fwd.connect_host = packet_get_string(NULL);
3430 fwd.connect_port = packet_get_int();
3434 * Check that an unprivileged user is not trying to forward a
3437 if (fwd.listen_port < IPPORT_RESERVED && !is_root)
3439 "Requested forwarding of port %d but user is not root.",
3441 if (fwd.connect_port == 0)
3442 packet_disconnect("Dynamic forwarding denied.");
3445 /* Initiate forwarding */
3446 success = channel_setup_local_fwd_listener(&fwd, fwd_opts);
3448 /* Free the argument string. */
3449 free(fwd.connect_host);
3451 return (success ? 0 : -1);
3455 * Permits opening to any host/port if permitted_opens[] is empty. This is
3456 * usually called by the server, because the user could connect to any port
3457 * anyway, and the server has no way to know but to trust the client anyway.
3460 channel_permit_all_opens(void)
3462 if (num_permitted_opens == 0)
3463 all_opens_permitted = 1;
3467 channel_add_permitted_opens(char *host, int port)
3469 debug("allow port forwarding to host %s port %d", host, port);
3471 permitted_opens = xrealloc(permitted_opens,
3472 num_permitted_opens + 1, sizeof(*permitted_opens));
3473 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host);
3474 permitted_opens[num_permitted_opens].port_to_connect = port;
3475 permitted_opens[num_permitted_opens].listen_host = NULL;
3476 permitted_opens[num_permitted_opens].listen_path = NULL;
3477 permitted_opens[num_permitted_opens].listen_port = 0;
3478 num_permitted_opens++;
3480 all_opens_permitted = 0;
3484 * Update the listen port for a dynamic remote forward, after
3485 * the actual 'newport' has been allocated. If 'newport' < 0 is
3486 * passed then they entry will be invalidated.
3489 channel_update_permitted_opens(int idx, int newport)
3491 if (idx < 0 || idx >= num_permitted_opens) {
3492 debug("channel_update_permitted_opens: index out of range:"
3493 " %d num_permitted_opens %d", idx, num_permitted_opens);
3496 debug("%s allowed port %d for forwarding to host %s port %d",
3497 newport > 0 ? "Updating" : "Removing",
3499 permitted_opens[idx].host_to_connect,
3500 permitted_opens[idx].port_to_connect);
3502 permitted_opens[idx].listen_port =
3503 (datafellows & SSH_BUG_DYNAMIC_RPORT) ? 0 : newport;
3505 permitted_opens[idx].listen_port = 0;
3506 permitted_opens[idx].port_to_connect = 0;
3507 free(permitted_opens[idx].host_to_connect);
3508 permitted_opens[idx].host_to_connect = NULL;
3509 free(permitted_opens[idx].listen_host);
3510 permitted_opens[idx].listen_host = NULL;
3511 free(permitted_opens[idx].listen_path);
3512 permitted_opens[idx].listen_path = NULL;
3517 channel_add_adm_permitted_opens(char *host, int port)
3519 debug("config allows port forwarding to host %s port %d", host, port);
3521 permitted_adm_opens = xrealloc(permitted_adm_opens,
3522 num_adm_permitted_opens + 1, sizeof(*permitted_adm_opens));
3523 permitted_adm_opens[num_adm_permitted_opens].host_to_connect
3525 permitted_adm_opens[num_adm_permitted_opens].port_to_connect = port;
3526 permitted_adm_opens[num_adm_permitted_opens].listen_host = NULL;
3527 permitted_adm_opens[num_adm_permitted_opens].listen_path = NULL;
3528 permitted_adm_opens[num_adm_permitted_opens].listen_port = 0;
3529 return ++num_adm_permitted_opens;
3533 channel_disable_adm_local_opens(void)
3535 channel_clear_adm_permitted_opens();
3536 permitted_adm_opens = xmalloc(sizeof(*permitted_adm_opens));
3537 permitted_adm_opens[num_adm_permitted_opens].host_to_connect = NULL;
3538 num_adm_permitted_opens = 1;
3542 channel_clear_permitted_opens(void)
3546 for (i = 0; i < num_permitted_opens; i++) {
3547 free(permitted_opens[i].host_to_connect);
3548 free(permitted_opens[i].listen_host);
3549 free(permitted_opens[i].listen_path);
3551 free(permitted_opens);
3552 permitted_opens = NULL;
3553 num_permitted_opens = 0;
3557 channel_clear_adm_permitted_opens(void)
3561 for (i = 0; i < num_adm_permitted_opens; i++) {
3562 free(permitted_adm_opens[i].host_to_connect);
3563 free(permitted_adm_opens[i].listen_host);
3564 free(permitted_adm_opens[i].listen_path);
3566 free(permitted_adm_opens);
3567 permitted_adm_opens = NULL;
3568 num_adm_permitted_opens = 0;
3572 channel_print_adm_permitted_opens(void)
3576 printf("permitopen");
3577 if (num_adm_permitted_opens == 0) {
3581 for (i = 0; i < num_adm_permitted_opens; i++)
3582 if (permitted_adm_opens[i].host_to_connect == NULL)
3585 printf(" %s:%d", permitted_adm_opens[i].host_to_connect,
3586 permitted_adm_opens[i].port_to_connect);
3590 /* returns port number, FWD_PERMIT_ANY_PORT or -1 on error */
3592 permitopen_port(const char *p)
3596 if (strcmp(p, "*") == 0)
3597 return FWD_PERMIT_ANY_PORT;
3598 if ((port = a2port(p)) > 0)
3603 /* Try to start non-blocking connect to next host in cctx list */
3605 connect_next(struct channel_connect *cctx)
3607 int sock, saved_errno;
3608 struct sockaddr_un *sunaddr;
3609 char ntop[NI_MAXHOST], strport[MAX(NI_MAXSERV,sizeof(sunaddr->sun_path))];
3611 for (; cctx->ai; cctx->ai = cctx->ai->ai_next) {
3612 switch (cctx->ai->ai_family) {
3614 /* unix:pathname instead of host:port */
3615 sunaddr = (struct sockaddr_un *)cctx->ai->ai_addr;
3616 strlcpy(ntop, "unix", sizeof(ntop));
3617 strlcpy(strport, sunaddr->sun_path, sizeof(strport));
3621 if (getnameinfo(cctx->ai->ai_addr, cctx->ai->ai_addrlen,
3622 ntop, sizeof(ntop), strport, sizeof(strport),
3623 NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
3624 error("connect_next: getnameinfo failed");
3631 if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype,
3632 cctx->ai->ai_protocol)) == -1) {
3633 if (cctx->ai->ai_next == NULL)
3634 error("socket: %.100s", strerror(errno));
3636 verbose("socket: %.100s", strerror(errno));
3639 if (set_nonblock(sock) == -1)
3640 fatal("%s: set_nonblock(%d)", __func__, sock);
3641 if (connect(sock, cctx->ai->ai_addr,
3642 cctx->ai->ai_addrlen) == -1 && errno != EINPROGRESS) {
3643 debug("connect_next: host %.100s ([%.100s]:%s): "
3644 "%.100s", cctx->host, ntop, strport,
3646 saved_errno = errno;
3648 errno = saved_errno;
3649 continue; /* fail -- try next */
3651 if (cctx->ai->ai_family != AF_UNIX)
3653 debug("connect_next: host %.100s ([%.100s]:%s) "
3654 "in progress, fd=%d", cctx->host, ntop, strport, sock);
3655 cctx->ai = cctx->ai->ai_next;
3662 channel_connect_ctx_free(struct channel_connect *cctx)
3666 if (cctx->aitop->ai_family == AF_UNIX)
3669 freeaddrinfo(cctx->aitop);
3671 memset(cctx, 0, sizeof(*cctx));
3674 /* Return CONNECTING channel to remote host:port or local socket path */
3676 connect_to(const char *name, int port, char *ctype, char *rname)
3678 struct addrinfo hints;
3681 char strport[NI_MAXSERV];
3682 struct channel_connect cctx;
3685 memset(&cctx, 0, sizeof(cctx));
3687 if (port == PORT_STREAMLOCAL) {
3688 struct sockaddr_un *sunaddr;
3689 struct addrinfo *ai;
3691 if (strlen(name) > sizeof(sunaddr->sun_path)) {
3692 error("%.100s: %.100s", name, strerror(ENAMETOOLONG));
3697 * Fake up a struct addrinfo for AF_UNIX connections.
3698 * channel_connect_ctx_free() must check ai_family
3699 * and use free() not freeaddirinfo() for AF_UNIX.
3701 ai = xmalloc(sizeof(*ai) + sizeof(*sunaddr));
3702 memset(ai, 0, sizeof(*ai) + sizeof(*sunaddr));
3703 ai->ai_addr = (struct sockaddr *)(ai + 1);
3704 ai->ai_addrlen = sizeof(*sunaddr);
3705 ai->ai_family = AF_UNIX;
3706 ai->ai_socktype = SOCK_STREAM;
3707 ai->ai_protocol = PF_UNSPEC;
3708 sunaddr = (struct sockaddr_un *)ai->ai_addr;
3709 sunaddr->sun_family = AF_UNIX;
3710 strlcpy(sunaddr->sun_path, name, sizeof(sunaddr->sun_path));
3713 memset(&hints, 0, sizeof(hints));
3714 hints.ai_family = IPv4or6;
3715 hints.ai_socktype = SOCK_STREAM;
3716 snprintf(strport, sizeof strport, "%d", port);
3717 if ((gaierr = getaddrinfo(name, strport, &hints, &cctx.aitop)) != 0) {
3718 error("connect_to %.100s: unknown host (%s)", name,
3719 ssh_gai_strerror(gaierr));
3724 cctx.host = xstrdup(name);
3726 cctx.ai = cctx.aitop;
3728 if ((sock = connect_next(&cctx)) == -1) {
3729 error("connect to %.100s port %d failed: %s",
3730 name, port, strerror(errno));
3731 channel_connect_ctx_free(&cctx);
3734 c = channel_new(ctype, SSH_CHANNEL_CONNECTING, sock, sock, -1,
3735 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, rname, 1);
3736 c->connect_ctx = cctx;
3741 channel_connect_by_listen_address(const char *listen_host,
3742 u_short listen_port, char *ctype, char *rname)
3746 for (i = 0; i < num_permitted_opens; i++) {
3747 if (open_listen_match_tcpip(&permitted_opens[i], listen_host,
3750 permitted_opens[i].host_to_connect,
3751 permitted_opens[i].port_to_connect, ctype, rname);
3754 error("WARNING: Server requests forwarding for unknown listen_port %d",
3760 channel_connect_by_listen_path(const char *path, char *ctype, char *rname)
3764 for (i = 0; i < num_permitted_opens; i++) {
3765 if (open_listen_match_streamlocal(&permitted_opens[i], path)) {
3767 permitted_opens[i].host_to_connect,
3768 permitted_opens[i].port_to_connect, ctype, rname);
3771 error("WARNING: Server requests forwarding for unknown path %.100s",
3776 /* Check if connecting to that port is permitted and connect. */
3778 channel_connect_to_port(const char *host, u_short port, char *ctype, char *rname)
3780 int i, permit, permit_adm = 1;
3782 permit = all_opens_permitted;
3784 for (i = 0; i < num_permitted_opens; i++)
3785 if (open_match(&permitted_opens[i], host, port)) {
3791 if (num_adm_permitted_opens > 0) {
3793 for (i = 0; i < num_adm_permitted_opens; i++)
3794 if (open_match(&permitted_adm_opens[i], host, port)) {
3800 if (!permit || !permit_adm) {
3801 logit("Received request to connect to host %.100s port %d, "
3802 "but the request was denied.", host, port);
3805 return connect_to(host, port, ctype, rname);
3808 /* Check if connecting to that path is permitted and connect. */
3810 channel_connect_to_path(const char *path, char *ctype, char *rname)
3812 int i, permit, permit_adm = 1;
3814 permit = all_opens_permitted;
3816 for (i = 0; i < num_permitted_opens; i++)
3817 if (open_match(&permitted_opens[i], path, PORT_STREAMLOCAL)) {
3823 if (num_adm_permitted_opens > 0) {
3825 for (i = 0; i < num_adm_permitted_opens; i++)
3826 if (open_match(&permitted_adm_opens[i], path, PORT_STREAMLOCAL)) {
3832 if (!permit || !permit_adm) {
3833 logit("Received request to connect to path %.100s, "
3834 "but the request was denied.", path);
3837 return connect_to(path, PORT_STREAMLOCAL, ctype, rname);
3841 channel_send_window_changes(void)
3846 for (i = 0; i < channels_alloc; i++) {
3847 if (channels[i] == NULL || !channels[i]->client_tty ||
3848 channels[i]->type != SSH_CHANNEL_OPEN)
3850 if (ioctl(channels[i]->rfd, TIOCGWINSZ, &ws) < 0)
3852 channel_request_start(i, "window-change", 0);
3853 packet_put_int((u_int)ws.ws_col);
3854 packet_put_int((u_int)ws.ws_row);
3855 packet_put_int((u_int)ws.ws_xpixel);
3856 packet_put_int((u_int)ws.ws_ypixel);
3861 /* -- X11 forwarding */
3864 * Creates an internet domain socket for listening for X11 connections.
3865 * Returns 0 and a suitable display number for the DISPLAY variable
3866 * stored in display_numberp , or -1 if an error occurs.
3869 x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
3870 int single_connection, u_int *display_numberp, int **chanids)
3873 int display_number, sock;
3875 struct addrinfo hints, *ai, *aitop;
3876 char strport[NI_MAXSERV];
3877 int gaierr, n, num_socks = 0, socks[NUM_SOCKS];
3879 if (chanids == NULL)
3882 for (display_number = x11_display_offset;
3883 display_number < MAX_DISPLAYS;
3885 port = 6000 + display_number;
3886 memset(&hints, 0, sizeof(hints));
3887 hints.ai_family = IPv4or6;
3888 hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE;
3889 hints.ai_socktype = SOCK_STREAM;
3890 snprintf(strport, sizeof strport, "%d", port);
3891 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) {
3892 error("getaddrinfo: %.100s", ssh_gai_strerror(gaierr));
3895 for (ai = aitop; ai; ai = ai->ai_next) {
3896 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
3898 sock = socket(ai->ai_family, ai->ai_socktype,
3901 if ((errno != EINVAL) && (errno != EAFNOSUPPORT)
3903 && (errno != EPFNOSUPPORT)
3906 error("socket: %.100s", strerror(errno));
3907 freeaddrinfo(aitop);
3910 debug("x11_create_display_inet: Socket family %d not supported",
3915 if (ai->ai_family == AF_INET6)
3916 sock_set_v6only(sock);
3917 if (x11_use_localhost)
3918 channel_set_reuseaddr(sock);
3919 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
3920 debug2("bind port %d: %.100s", port, strerror(errno));
3923 for (n = 0; n < num_socks; n++) {
3929 socks[num_socks++] = sock;
3930 if (num_socks == NUM_SOCKS)
3933 freeaddrinfo(aitop);
3937 if (display_number >= MAX_DISPLAYS) {
3938 error("Failed to allocate internet-domain X11 display socket.");
3941 /* Start listening for connections on the socket. */
3942 for (n = 0; n < num_socks; n++) {
3944 if (listen(sock, SSH_LISTEN_BACKLOG) < 0) {
3945 error("listen: %.100s", strerror(errno));
3951 /* Allocate a channel for each socket. */
3952 *chanids = xcalloc(num_socks + 1, sizeof(**chanids));
3953 for (n = 0; n < num_socks; n++) {
3955 nc = channel_new("x11 listener",
3956 SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
3957 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
3958 0, "X11 inet listener", 1);
3959 nc->single_connection = single_connection;
3960 (*chanids)[n] = nc->self;
3964 /* Return the display number for the DISPLAY environment variable. */
3965 *display_numberp = display_number;
3970 connect_local_xsocket_path(const char *pathname)
3973 struct sockaddr_un addr;
3975 sock = socket(AF_UNIX, SOCK_STREAM, 0);
3977 error("socket: %.100s", strerror(errno));
3978 memset(&addr, 0, sizeof(addr));
3979 addr.sun_family = AF_UNIX;
3980 strlcpy(addr.sun_path, pathname, sizeof addr.sun_path);
3981 if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0)
3984 error("connect %.100s: %.100s", addr.sun_path, strerror(errno));
3989 connect_local_xsocket(u_int dnr)
3992 snprintf(buf, sizeof buf, _PATH_UNIX_X, dnr);
3993 return connect_local_xsocket_path(buf);
3997 x11_connect_display(void)
3999 u_int display_number;
4000 const char *display;
4001 char buf[1024], *cp;
4002 struct addrinfo hints, *ai, *aitop;
4003 char strport[NI_MAXSERV];
4004 int gaierr, sock = 0;
4006 /* Try to open a socket for the local X server. */
4007 display = getenv("DISPLAY");
4009 error("DISPLAY not set.");
4013 * Now we decode the value of the DISPLAY variable and make a
4014 * connection to the real X server.
4017 /* Check if the display is from launchd. */
4019 if (strncmp(display, "/tmp/launch", 11) == 0) {
4020 sock = connect_local_xsocket_path(display);
4024 /* OK, we now have a connection to the display. */
4029 * Check if it is a unix domain socket. Unix domain displays are in
4030 * one of the following formats: unix:d[.s], :d[.s], ::d[.s]
4032 if (strncmp(display, "unix:", 5) == 0 ||
4033 display[0] == ':') {
4034 /* Connect to the unix domain socket. */
4035 if (sscanf(strrchr(display, ':') + 1, "%u", &display_number) != 1) {
4036 error("Could not parse display number from DISPLAY: %.100s",
4040 /* Create a socket. */
4041 sock = connect_local_xsocket(display_number);
4045 /* OK, we now have a connection to the display. */
4049 * Connect to an inet socket. The DISPLAY value is supposedly
4050 * hostname:d[.s], where hostname may also be numeric IP address.
4052 strlcpy(buf, display, sizeof(buf));
4053 cp = strchr(buf, ':');
4055 error("Could not find ':' in DISPLAY: %.100s", display);
4059 /* buf now contains the host name. But first we parse the display number. */
4060 if (sscanf(cp + 1, "%u", &display_number) != 1) {
4061 error("Could not parse display number from DISPLAY: %.100s",
4066 /* Look up the host address */
4067 memset(&hints, 0, sizeof(hints));
4068 hints.ai_family = IPv4or6;
4069 hints.ai_socktype = SOCK_STREAM;
4070 snprintf(strport, sizeof strport, "%u", 6000 + display_number);
4071 if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
4072 error("%.100s: unknown host. (%s)", buf,
4073 ssh_gai_strerror(gaierr));
4076 for (ai = aitop; ai; ai = ai->ai_next) {
4077 /* Create a socket. */
4078 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
4080 debug2("socket: %.100s", strerror(errno));
4083 /* Connect it to the display. */
4084 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
4085 debug2("connect %.100s port %u: %.100s", buf,
4086 6000 + display_number, strerror(errno));
4093 freeaddrinfo(aitop);
4095 error("connect %.100s port %u: %.100s", buf, 6000 + display_number,
4104 * This is called when SSH_SMSG_X11_OPEN is received. The packet contains
4105 * the remote channel number. We should do whatever we want, and respond
4106 * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE.
4111 x11_input_open(int type, u_int32_t seq, void *ctxt)
4114 int remote_id, sock = 0;
4117 debug("Received X11 open request.");
4119 remote_id = packet_get_int();
4121 if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) {
4122 remote_host = packet_get_string(NULL);
4124 remote_host = xstrdup("unknown (remote did not supply name)");
4128 /* Obtain a connection to the real X display. */
4129 sock = x11_connect_display();
4131 /* Allocate a channel for this connection. */
4132 c = channel_new("connected x11 socket",
4133 SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0,
4135 c->remote_id = remote_id;
4140 /* Send refusal to the remote host. */
4141 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
4142 packet_put_int(remote_id);
4144 /* Send a confirmation to the remote host. */
4145 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
4146 packet_put_int(remote_id);
4147 packet_put_int(c->self);
4153 /* dummy protocol handler that denies SSH-1 requests (agent/x11) */
4156 deny_input_open(int type, u_int32_t seq, void *ctxt)
4158 int rchan = packet_get_int();
4161 case SSH_SMSG_AGENT_OPEN:
4162 error("Warning: ssh server tried agent forwarding.");
4164 case SSH_SMSG_X11_OPEN:
4165 error("Warning: ssh server tried X11 forwarding.");
4168 error("deny_input_open: type %d", type);
4171 error("Warning: this is probably a break-in attempt by a malicious server.");
4172 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
4173 packet_put_int(rchan);
4179 * Requests forwarding of X11 connections, generates fake authentication
4180 * data, and enables authentication spoofing.
4181 * This should be called in the client only.
4184 x11_request_forwarding_with_spoofing(int client_session_id, const char *disp,
4185 const char *proto, const char *data, int want_reply)
4187 u_int data_len = (u_int) strlen(data) / 2;
4194 if (x11_saved_display == NULL)
4195 x11_saved_display = xstrdup(disp);
4196 else if (strcmp(disp, x11_saved_display) != 0) {
4197 error("x11_request_forwarding_with_spoofing: different "
4198 "$DISPLAY already forwarded");
4202 cp = strchr(disp, ':');
4204 cp = strchr(cp, '.');
4206 screen_number = (u_int)strtonum(cp + 1, 0, 400, NULL);
4210 if (x11_saved_proto == NULL) {
4211 /* Save protocol name. */
4212 x11_saved_proto = xstrdup(proto);
4214 * Extract real authentication data and generate fake data
4215 * of the same length.
4217 x11_saved_data = xmalloc(data_len);
4218 x11_fake_data = xmalloc(data_len);
4219 for (i = 0; i < data_len; i++) {
4220 if (sscanf(data + 2 * i, "%2x", &value) != 1)
4221 fatal("x11_request_forwarding: bad "
4222 "authentication data: %.100s", data);
4225 x11_saved_data[i] = value;
4226 x11_fake_data[i] = rnd & 0xff;
4229 x11_saved_data_len = data_len;
4230 x11_fake_data_len = data_len;
4233 /* Convert the fake data into hex. */
4234 new_data = tohex(x11_fake_data, data_len);
4236 /* Send the request packet. */
4238 channel_request_start(client_session_id, "x11-req", want_reply);
4239 packet_put_char(0); /* XXX bool single connection */
4241 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING);
4243 packet_put_cstring(proto);
4244 packet_put_cstring(new_data);
4245 packet_put_int(screen_number);
4247 packet_write_wait();
4252 /* -- agent forwarding */
4254 /* Sends a message to the server to request authentication fd forwarding. */
4257 auth_request_forwarding(void)
4259 packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING);
4261 packet_write_wait();