1 /* $OpenBSD: channels.c,v 1.341 2015/02/06 23:21:59 millert Exp $ */ 2 /* 3 * Author: Tatu Ylonen <ylo (at) cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo (at) cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * This file contains functions for generic socket connection forwarding. 7 * There is also code for initiating connection forwarding for X11 connections, 8 * arbitrary tcp/ip connections, and the authentication agent connection. 9 * 10 * As far as I am concerned, the code I have written for this software 11 * can be used freely for any purpose. Any derived versions of this 12 * software must be clearly marked as such, and if the derived work is 13 * incompatible with the protocol description in the RFC file, it must be 14 * called by a name other than "ssh" or "Secure Shell". 15 * 16 * SSH2 support added by Markus Friedl. 17 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. 18 * Copyright (c) 1999 Dug Song. All rights reserved. 19 * Copyright (c) 1999 Theo de Raadt. All rights reserved. 20 * 21 * Redistribution and use in source and binary forms, with or without 22 * modification, are permitted provided that the following conditions 23 * are met: 24 * 1. Redistributions of source code must retain the above copyright 25 * notice, this list of conditions and the following disclaimer. 26 * 2. Redistributions in binary form must reproduce the above copyright 27 * notice, this list of conditions and the following disclaimer in the 28 * documentation and/or other materials provided with the distribution. 29 * 30 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 31 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 32 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 33 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 34 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 35 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 36 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 37 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 38 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 39 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 40 */ 41 42 #include "includes.h" 43 44 #include <sys/types.h> 45 #include <sys/param.h> /* MIN MAX */ 46 #include <sys/stat.h> 47 #include <sys/ioctl.h> 48 #include <sys/un.h> 49 #include <sys/socket.h> 50 #ifdef HAVE_SYS_TIME_H 51 # include <sys/time.h> 52 #endif 53 54 #include <netinet/in.h> 55 #include <arpa/inet.h> 56 57 #include <errno.h> 58 #include <fcntl.h> 59 #include <netdb.h> 60 #ifdef HAVE_STDINT_H 61 #include <stdint.h> 62 #endif 63 #include <stdio.h> 64 #include <stdlib.h> 65 #include <string.h> 66 #include <termios.h> 67 #include <unistd.h> 68 #include <stdarg.h> 69 70 #include "openbsd-compat/sys-queue.h" 71 #include "xmalloc.h" 72 #include "ssh.h" 73 #include "ssh1.h" 74 #include "ssh2.h" 75 #include "packet.h" 76 #include "log.h" 77 #include "misc.h" 78 #include "buffer.h" 79 #include "channels.h" 80 #include "compat.h" 81 #include "canohost.h" 82 #include "key.h" 83 #include "authfd.h" 84 #include "pathnames.h" 85 86 /* -- channel core */ 87 88 /* 89 * Pointer to an array containing all allocated channels. The array is 90 * dynamically extended as needed. 91 */ 92 static Channel **channels = NULL; 93 94 /* 95 * Size of the channel array. All slots of the array must always be 96 * initialized (at least the type field); unused slots set to NULL 97 */ 98 static u_int channels_alloc = 0; 99 100 /* 101 * Maximum file descriptor value used in any of the channels. This is 102 * updated in channel_new. 103 */ 104 static int channel_max_fd = 0; 105 106 107 /* -- tcp forwarding */ 108 109 /* 110 * Data structure for storing which hosts are permitted for forward requests. 111 * The local sides of any remote forwards are stored in this array to prevent 112 * a corrupt remote server from accessing arbitrary TCP/IP ports on our local 113 * network (which might be behind a firewall). 114 */ 115 /* XXX: streamlocal wants a path instead of host:port */ 116 /* Overload host_to_connect; we could just make this match Forward */ 117 /* XXX - can we use listen_host instead of listen_path? */ 118 typedef struct { 119 char *host_to_connect; /* Connect to 'host'. */ 120 int port_to_connect; /* Connect to 'port'. */ 121 char *listen_host; /* Remote side should listen address. */ 122 char *listen_path; /* Remote side should listen path. */ 123 int listen_port; /* Remote side should listen port. */ 124 } ForwardPermission; 125 126 /* List of all permitted host/port pairs to connect by the user. */ 127 static ForwardPermission *permitted_opens = NULL; 128 129 /* List of all permitted host/port pairs to connect by the admin. */ 130 static ForwardPermission *permitted_adm_opens = NULL; 131 132 /* Number of permitted host/port pairs in the array permitted by the user. */ 133 static int num_permitted_opens = 0; 134 135 /* Number of permitted host/port pair in the array permitted by the admin. */ 136 static int num_adm_permitted_opens = 0; 137 138 /* special-case port number meaning allow any port */ 139 #define FWD_PERMIT_ANY_PORT 0 140 141 /* 142 * If this is true, all opens are permitted. This is the case on the server 143 * on which we have to trust the client anyway, and the user could do 144 * anything after logging in anyway. 145 */ 146 static int all_opens_permitted = 0; 147 148 149 /* -- X11 forwarding */ 150 151 /* Maximum number of fake X11 displays to try. */ 152 #define MAX_DISPLAYS 1000 153 154 /* Saved X11 local (client) display. */ 155 static char *x11_saved_display = NULL; 156 157 /* Saved X11 authentication protocol name. */ 158 static char *x11_saved_proto = NULL; 159 160 /* Saved X11 authentication data. This is the real data. */ 161 static char *x11_saved_data = NULL; 162 static u_int x11_saved_data_len = 0; 163 164 /* 165 * Fake X11 authentication data. This is what the server will be sending us; 166 * we should replace any occurrences of this by the real data. 167 */ 168 static u_char *x11_fake_data = NULL; 169 static u_int x11_fake_data_len; 170 171 172 /* -- agent forwarding */ 173 174 #define NUM_SOCKS 10 175 176 /* AF_UNSPEC or AF_INET or AF_INET6 */ 177 static int IPv4or6 = AF_UNSPEC; 178 179 /* helper */ 180 static void port_open_helper(Channel *c, char *rtype); 181 182 /* non-blocking connect helpers */ 183 static int connect_next(struct channel_connect *); 184 static void channel_connect_ctx_free(struct channel_connect *); 185 186 /* -- channel core */ 187 188 Channel * 189 channel_by_id(int id) 190 { 191 Channel *c; 192 193 if (id < 0 || (u_int)id >= channels_alloc) { 194 logit("channel_by_id: %d: bad id", id); 195 return NULL; 196 } 197 c = channels[id]; 198 if (c == NULL) { 199 logit("channel_by_id: %d: bad id: channel free", id); 200 return NULL; 201 } 202 return c; 203 } 204 205 /* 206 * Returns the channel if it is allowed to receive protocol messages. 207 * Private channels, like listening sockets, may not receive messages. 208 */ 209 Channel * 210 channel_lookup(int id) 211 { 212 Channel *c; 213 214 if ((c = channel_by_id(id)) == NULL) 215 return (NULL); 216 217 switch (c->type) { 218 case SSH_CHANNEL_X11_OPEN: 219 case SSH_CHANNEL_LARVAL: 220 case SSH_CHANNEL_CONNECTING: 221 case SSH_CHANNEL_DYNAMIC: 222 case SSH_CHANNEL_OPENING: 223 case SSH_CHANNEL_OPEN: 224 case SSH_CHANNEL_INPUT_DRAINING: 225 case SSH_CHANNEL_OUTPUT_DRAINING: 226 case SSH_CHANNEL_ABANDONED: 227 return (c); 228 } 229 logit("Non-public channel %d, type %d.", id, c->type); 230 return (NULL); 231 } 232 233 /* 234 * Register filedescriptors for a channel, used when allocating a channel or 235 * when the channel consumer/producer is ready, e.g. shell exec'd 236 */ 237 static void 238 channel_register_fds(Channel *c, int rfd, int wfd, int efd, 239 int extusage, int nonblock, int is_tty) 240 { 241 /* Update the maximum file descriptor value. */ 242 channel_max_fd = MAX(channel_max_fd, rfd); 243 channel_max_fd = MAX(channel_max_fd, wfd); 244 channel_max_fd = MAX(channel_max_fd, efd); 245 246 if (rfd != -1) 247 fcntl(rfd, F_SETFD, FD_CLOEXEC); 248 if (wfd != -1 && wfd != rfd) 249 fcntl(wfd, F_SETFD, FD_CLOEXEC); 250 if (efd != -1 && efd != rfd && efd != wfd) 251 fcntl(efd, F_SETFD, FD_CLOEXEC); 252 253 c->rfd = rfd; 254 c->wfd = wfd; 255 c->sock = (rfd == wfd) ? rfd : -1; 256 c->efd = efd; 257 c->extended_usage = extusage; 258 259 if ((c->isatty = is_tty) != 0) 260 debug2("channel %d: rfd %d isatty", c->self, c->rfd); 261 #ifdef _AIX 262 /* XXX: Later AIX versions can't push as much data to tty */ 263 c->wfd_isatty = is_tty || isatty(c->wfd); 264 #endif 265 266 /* enable nonblocking mode */ 267 if (nonblock) { 268 if (rfd != -1) 269 set_nonblock(rfd); 270 if (wfd != -1) 271 set_nonblock(wfd); 272 if (efd != -1) 273 set_nonblock(efd); 274 } 275 } 276 277 /* 278 * Allocate a new channel object and set its type and socket. This will cause 279 * remote_name to be freed. 280 */ 281 Channel * 282 channel_new(char *ctype, int type, int rfd, int wfd, int efd, 283 u_int window, u_int maxpack, int extusage, char *remote_name, int nonblock) 284 { 285 int found; 286 u_int i; 287 Channel *c; 288 289 /* Do initial allocation if this is the first call. */ 290 if (channels_alloc == 0) { 291 channels_alloc = 10; 292 channels = xcalloc(channels_alloc, sizeof(Channel *)); 293 for (i = 0; i < channels_alloc; i++) 294 channels[i] = NULL; 295 } 296 /* Try to find a free slot where to put the new channel. */ 297 for (found = -1, i = 0; i < channels_alloc; i++) 298 if (channels[i] == NULL) { 299 /* Found a free slot. */ 300 found = (int)i; 301 break; 302 } 303 if (found < 0) { 304 /* There are no free slots. Take last+1 slot and expand the array. */ 305 found = channels_alloc; 306 if (channels_alloc > 10000) 307 fatal("channel_new: internal error: channels_alloc %d " 308 "too big.", channels_alloc); 309 channels = xrealloc(channels, channels_alloc + 10, 310 sizeof(Channel *)); 311 channels_alloc += 10; 312 debug2("channel: expanding %d", channels_alloc); 313 for (i = found; i < channels_alloc; i++) 314 channels[i] = NULL; 315 } 316 /* Initialize and return new channel. */ 317 c = channels[found] = xcalloc(1, sizeof(Channel)); 318 buffer_init(&c->input); 319 buffer_init(&c->output); 320 buffer_init(&c->extended); 321 c->path = NULL; 322 c->listening_addr = NULL; 323 c->listening_port = 0; 324 c->ostate = CHAN_OUTPUT_OPEN; 325 c->istate = CHAN_INPUT_OPEN; 326 c->flags = 0; 327 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, 0); 328 c->notbefore = 0; 329 c->self = found; 330 c->type = type; 331 c->ctype = ctype; 332 c->local_window = window; 333 c->local_window_max = window; 334 c->local_consumed = 0; 335 c->local_maxpacket = maxpack; 336 c->remote_id = -1; 337 c->remote_name = xstrdup(remote_name); 338 c->remote_window = 0; 339 c->remote_maxpacket = 0; 340 c->force_drain = 0; 341 c->single_connection = 0; 342 c->detach_user = NULL; 343 c->detach_close = 0; 344 c->open_confirm = NULL; 345 c->open_confirm_ctx = NULL; 346 c->input_filter = NULL; 347 c->output_filter = NULL; 348 c->filter_ctx = NULL; 349 c->filter_cleanup = NULL; 350 c->ctl_chan = -1; 351 c->mux_rcb = NULL; 352 c->mux_ctx = NULL; 353 c->mux_pause = 0; 354 c->delayed = 1; /* prevent call to channel_post handler */ 355 TAILQ_INIT(&c->status_confirms); 356 debug("channel %d: new [%s]", found, remote_name); 357 return c; 358 } 359 360 static int 361 channel_find_maxfd(void) 362 { 363 u_int i; 364 int max = 0; 365 Channel *c; 366 367 for (i = 0; i < channels_alloc; i++) { 368 c = channels[i]; 369 if (c != NULL) { 370 max = MAX(max, c->rfd); 371 max = MAX(max, c->wfd); 372 max = MAX(max, c->efd); 373 } 374 } 375 return max; 376 } 377 378 int 379 channel_close_fd(int *fdp) 380 { 381 int ret = 0, fd = *fdp; 382 383 if (fd != -1) { 384 ret = close(fd); 385 *fdp = -1; 386 if (fd == channel_max_fd) 387 channel_max_fd = channel_find_maxfd(); 388 } 389 return ret; 390 } 391 392 /* Close all channel fd/socket. */ 393 static void 394 channel_close_fds(Channel *c) 395 { 396 channel_close_fd(&c->sock); 397 channel_close_fd(&c->rfd); 398 channel_close_fd(&c->wfd); 399 channel_close_fd(&c->efd); 400 } 401 402 /* Free the channel and close its fd/socket. */ 403 void 404 channel_free(Channel *c) 405 { 406 char *s; 407 u_int i, n; 408 struct channel_confirm *cc; 409 410 for (n = 0, i = 0; i < channels_alloc; i++) 411 if (channels[i]) 412 n++; 413 debug("channel %d: free: %s, nchannels %u", c->self, 414 c->remote_name ? c->remote_name : "???", n); 415 416 s = channel_open_message(); 417 debug3("channel %d: status: %s", c->self, s); 418 free(s); 419 420 if (c->sock != -1) 421 shutdown(c->sock, SHUT_RDWR); 422 channel_close_fds(c); 423 buffer_free(&c->input); 424 buffer_free(&c->output); 425 buffer_free(&c->extended); 426 free(c->remote_name); 427 c->remote_name = NULL; 428 free(c->path); 429 c->path = NULL; 430 free(c->listening_addr); 431 c->listening_addr = NULL; 432 while ((cc = TAILQ_FIRST(&c->status_confirms)) != NULL) { 433 if (cc->abandon_cb != NULL) 434 cc->abandon_cb(c, cc->ctx); 435 TAILQ_REMOVE(&c->status_confirms, cc, entry); 436 explicit_bzero(cc, sizeof(*cc)); 437 free(cc); 438 } 439 if (c->filter_cleanup != NULL && c->filter_ctx != NULL) 440 c->filter_cleanup(c->self, c->filter_ctx); 441 channels[c->self] = NULL; 442 free(c); 443 } 444 445 void 446 channel_free_all(void) 447 { 448 u_int i; 449 450 for (i = 0; i < channels_alloc; i++) 451 if (channels[i] != NULL) 452 channel_free(channels[i]); 453 } 454 455 /* 456 * Closes the sockets/fds of all channels. This is used to close extra file 457 * descriptors after a fork. 458 */ 459 void 460 channel_close_all(void) 461 { 462 u_int i; 463 464 for (i = 0; i < channels_alloc; i++) 465 if (channels[i] != NULL) 466 channel_close_fds(channels[i]); 467 } 468 469 /* 470 * Stop listening to channels. 471 */ 472 void 473 channel_stop_listening(void) 474 { 475 u_int i; 476 Channel *c; 477 478 for (i = 0; i < channels_alloc; i++) { 479 c = channels[i]; 480 if (c != NULL) { 481 switch (c->type) { 482 case SSH_CHANNEL_AUTH_SOCKET: 483 case SSH_CHANNEL_PORT_LISTENER: 484 case SSH_CHANNEL_RPORT_LISTENER: 485 case SSH_CHANNEL_X11_LISTENER: 486 case SSH_CHANNEL_UNIX_LISTENER: 487 case SSH_CHANNEL_RUNIX_LISTENER: 488 channel_close_fd(&c->sock); 489 channel_free(c); 490 break; 491 } 492 } 493 } 494 } 495 496 /* 497 * Returns true if no channel has too much buffered data, and false if one or 498 * more channel is overfull. 499 */ 500 int 501 channel_not_very_much_buffered_data(void) 502 { 503 u_int i; 504 Channel *c; 505 506 for (i = 0; i < channels_alloc; i++) { 507 c = channels[i]; 508 if (c != NULL && c->type == SSH_CHANNEL_OPEN) { 509 #if 0 510 if (!compat20 && 511 buffer_len(&c->input) > packet_get_maxsize()) { 512 debug2("channel %d: big input buffer %d", 513 c->self, buffer_len(&c->input)); 514 return 0; 515 } 516 #endif 517 if (buffer_len(&c->output) > packet_get_maxsize()) { 518 debug2("channel %d: big output buffer %u > %u", 519 c->self, buffer_len(&c->output), 520 packet_get_maxsize()); 521 return 0; 522 } 523 } 524 } 525 return 1; 526 } 527 528 /* Returns true if any channel is still open. */ 529 int 530 channel_still_open(void) 531 { 532 u_int i; 533 Channel *c; 534 535 for (i = 0; i < channels_alloc; i++) { 536 c = channels[i]; 537 if (c == NULL) 538 continue; 539 switch (c->type) { 540 case SSH_CHANNEL_X11_LISTENER: 541 case SSH_CHANNEL_PORT_LISTENER: 542 case SSH_CHANNEL_RPORT_LISTENER: 543 case SSH_CHANNEL_MUX_LISTENER: 544 case SSH_CHANNEL_CLOSED: 545 case SSH_CHANNEL_AUTH_SOCKET: 546 case SSH_CHANNEL_DYNAMIC: 547 case SSH_CHANNEL_CONNECTING: 548 case SSH_CHANNEL_ZOMBIE: 549 case SSH_CHANNEL_ABANDONED: 550 case SSH_CHANNEL_UNIX_LISTENER: 551 case SSH_CHANNEL_RUNIX_LISTENER: 552 continue; 553 case SSH_CHANNEL_LARVAL: 554 if (!compat20) 555 fatal("cannot happen: SSH_CHANNEL_LARVAL"); 556 continue; 557 case SSH_CHANNEL_OPENING: 558 case SSH_CHANNEL_OPEN: 559 case SSH_CHANNEL_X11_OPEN: 560 case SSH_CHANNEL_MUX_CLIENT: 561 return 1; 562 case SSH_CHANNEL_INPUT_DRAINING: 563 case SSH_CHANNEL_OUTPUT_DRAINING: 564 if (!compat13) 565 fatal("cannot happen: OUT_DRAIN"); 566 return 1; 567 default: 568 fatal("channel_still_open: bad channel type %d", c->type); 569 /* NOTREACHED */ 570 } 571 } 572 return 0; 573 } 574 575 /* Returns the id of an open channel suitable for keepaliving */ 576 int 577 channel_find_open(void) 578 { 579 u_int i; 580 Channel *c; 581 582 for (i = 0; i < channels_alloc; i++) { 583 c = channels[i]; 584 if (c == NULL || c->remote_id < 0) 585 continue; 586 switch (c->type) { 587 case SSH_CHANNEL_CLOSED: 588 case SSH_CHANNEL_DYNAMIC: 589 case SSH_CHANNEL_X11_LISTENER: 590 case SSH_CHANNEL_PORT_LISTENER: 591 case SSH_CHANNEL_RPORT_LISTENER: 592 case SSH_CHANNEL_MUX_LISTENER: 593 case SSH_CHANNEL_MUX_CLIENT: 594 case SSH_CHANNEL_OPENING: 595 case SSH_CHANNEL_CONNECTING: 596 case SSH_CHANNEL_ZOMBIE: 597 case SSH_CHANNEL_ABANDONED: 598 case SSH_CHANNEL_UNIX_LISTENER: 599 case SSH_CHANNEL_RUNIX_LISTENER: 600 continue; 601 case SSH_CHANNEL_LARVAL: 602 case SSH_CHANNEL_AUTH_SOCKET: 603 case SSH_CHANNEL_OPEN: 604 case SSH_CHANNEL_X11_OPEN: 605 return i; 606 case SSH_CHANNEL_INPUT_DRAINING: 607 case SSH_CHANNEL_OUTPUT_DRAINING: 608 if (!compat13) 609 fatal("cannot happen: OUT_DRAIN"); 610 return i; 611 default: 612 fatal("channel_find_open: bad channel type %d", c->type); 613 /* NOTREACHED */ 614 } 615 } 616 return -1; 617 } 618 619 620 /* 621 * Returns a message describing the currently open forwarded connections, 622 * suitable for sending to the client. The message contains crlf pairs for 623 * newlines. 624 */ 625 char * 626 channel_open_message(void) 627 { 628 Buffer buffer; 629 Channel *c; 630 char buf[1024], *cp; 631 u_int i; 632 633 buffer_init(&buffer); 634 snprintf(buf, sizeof buf, "The following connections are open:\r\n"); 635 buffer_append(&buffer, buf, strlen(buf)); 636 for (i = 0; i < channels_alloc; i++) { 637 c = channels[i]; 638 if (c == NULL) 639 continue; 640 switch (c->type) { 641 case SSH_CHANNEL_X11_LISTENER: 642 case SSH_CHANNEL_PORT_LISTENER: 643 case SSH_CHANNEL_RPORT_LISTENER: 644 case SSH_CHANNEL_CLOSED: 645 case SSH_CHANNEL_AUTH_SOCKET: 646 case SSH_CHANNEL_ZOMBIE: 647 case SSH_CHANNEL_ABANDONED: 648 case SSH_CHANNEL_MUX_CLIENT: 649 case SSH_CHANNEL_MUX_LISTENER: 650 case SSH_CHANNEL_UNIX_LISTENER: 651 case SSH_CHANNEL_RUNIX_LISTENER: 652 continue; 653 case SSH_CHANNEL_LARVAL: 654 case SSH_CHANNEL_OPENING: 655 case SSH_CHANNEL_CONNECTING: 656 case SSH_CHANNEL_DYNAMIC: 657 case SSH_CHANNEL_OPEN: 658 case SSH_CHANNEL_X11_OPEN: 659 case SSH_CHANNEL_INPUT_DRAINING: 660 case SSH_CHANNEL_OUTPUT_DRAINING: 661 snprintf(buf, sizeof buf, 662 " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d cc %d)\r\n", 663 c->self, c->remote_name, 664 c->type, c->remote_id, 665 c->istate, buffer_len(&c->input), 666 c->ostate, buffer_len(&c->output), 667 c->rfd, c->wfd, c->ctl_chan); 668 buffer_append(&buffer, buf, strlen(buf)); 669 continue; 670 default: 671 fatal("channel_open_message: bad channel type %d", c->type); 672 /* NOTREACHED */ 673 } 674 } 675 buffer_append(&buffer, "\0", 1); 676 cp = xstrdup((char *)buffer_ptr(&buffer)); 677 buffer_free(&buffer); 678 return cp; 679 } 680 681 void 682 channel_send_open(int id) 683 { 684 Channel *c = channel_lookup(id); 685 686 if (c == NULL) { 687 logit("channel_send_open: %d: bad id", id); 688 return; 689 } 690 debug2("channel %d: send open", id); 691 packet_start(SSH2_MSG_CHANNEL_OPEN); 692 packet_put_cstring(c->ctype); 693 packet_put_int(c->self); 694 packet_put_int(c->local_window); 695 packet_put_int(c->local_maxpacket); 696 packet_send(); 697 } 698 699 void 700 channel_request_start(int id, char *service, int wantconfirm) 701 { 702 Channel *c = channel_lookup(id); 703 704 if (c == NULL) { 705 logit("channel_request_start: %d: unknown channel id", id); 706 return; 707 } 708 debug2("channel %d: request %s confirm %d", id, service, wantconfirm); 709 packet_start(SSH2_MSG_CHANNEL_REQUEST); 710 packet_put_int(c->remote_id); 711 packet_put_cstring(service); 712 packet_put_char(wantconfirm); 713 } 714 715 void 716 channel_register_status_confirm(int id, channel_confirm_cb *cb, 717 channel_confirm_abandon_cb *abandon_cb, void *ctx) 718 { 719 struct channel_confirm *cc; 720 Channel *c; 721 722 if ((c = channel_lookup(id)) == NULL) 723 fatal("channel_register_expect: %d: bad id", id); 724 725 cc = xcalloc(1, sizeof(*cc)); 726 cc->cb = cb; 727 cc->abandon_cb = abandon_cb; 728 cc->ctx = ctx; 729 TAILQ_INSERT_TAIL(&c->status_confirms, cc, entry); 730 } 731 732 void 733 channel_register_open_confirm(int id, channel_open_fn *fn, void *ctx) 734 { 735 Channel *c = channel_lookup(id); 736 737 if (c == NULL) { 738 logit("channel_register_open_confirm: %d: bad id", id); 739 return; 740 } 741 c->open_confirm = fn; 742 c->open_confirm_ctx = ctx; 743 } 744 745 void 746 channel_register_cleanup(int id, channel_callback_fn *fn, int do_close) 747 { 748 Channel *c = channel_by_id(id); 749 750 if (c == NULL) { 751 logit("channel_register_cleanup: %d: bad id", id); 752 return; 753 } 754 c->detach_user = fn; 755 c->detach_close = do_close; 756 } 757 758 void 759 channel_cancel_cleanup(int id) 760 { 761 Channel *c = channel_by_id(id); 762 763 if (c == NULL) { 764 logit("channel_cancel_cleanup: %d: bad id", id); 765 return; 766 } 767 c->detach_user = NULL; 768 c->detach_close = 0; 769 } 770 771 void 772 channel_register_filter(int id, channel_infilter_fn *ifn, 773 channel_outfilter_fn *ofn, channel_filter_cleanup_fn *cfn, void *ctx) 774 { 775 Channel *c = channel_lookup(id); 776 777 if (c == NULL) { 778 logit("channel_register_filter: %d: bad id", id); 779 return; 780 } 781 c->input_filter = ifn; 782 c->output_filter = ofn; 783 c->filter_ctx = ctx; 784 c->filter_cleanup = cfn; 785 } 786 787 void 788 channel_set_fds(int id, int rfd, int wfd, int efd, 789 int extusage, int nonblock, int is_tty, u_int window_max) 790 { 791 Channel *c = channel_lookup(id); 792 793 if (c == NULL || c->type != SSH_CHANNEL_LARVAL) 794 fatal("channel_activate for non-larval channel %d.", id); 795 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, is_tty); 796 c->type = SSH_CHANNEL_OPEN; 797 c->local_window = c->local_window_max = window_max; 798 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); 799 packet_put_int(c->remote_id); 800 packet_put_int(c->local_window); 801 packet_send(); 802 } 803 804 /* 805 * 'channel_pre*' are called just before select() to add any bits relevant to 806 * channels in the select bitmasks. 807 */ 808 /* 809 * 'channel_post*': perform any appropriate operations for channels which 810 * have events pending. 811 */ 812 typedef void chan_fn(Channel *c, fd_set *readset, fd_set *writeset); 813 chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE]; 814 chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE]; 815 816 /* ARGSUSED */ 817 static void 818 channel_pre_listener(Channel *c, fd_set *readset, fd_set *writeset) 819 { 820 FD_SET(c->sock, readset); 821 } 822 823 /* ARGSUSED */ 824 static void 825 channel_pre_connecting(Channel *c, fd_set *readset, fd_set *writeset) 826 { 827 debug3("channel %d: waiting for connection", c->self); 828 FD_SET(c->sock, writeset); 829 } 830 831 static void 832 channel_pre_open_13(Channel *c, fd_set *readset, fd_set *writeset) 833 { 834 if (buffer_len(&c->input) < packet_get_maxsize()) 835 FD_SET(c->sock, readset); 836 if (buffer_len(&c->output) > 0) 837 FD_SET(c->sock, writeset); 838 } 839 840 static void 841 channel_pre_open(Channel *c, fd_set *readset, fd_set *writeset) 842 { 843 u_int limit = compat20 ? c->remote_window : packet_get_maxsize(); 844 845 if (c->istate == CHAN_INPUT_OPEN && 846 limit > 0 && 847 buffer_len(&c->input) < limit && 848 buffer_check_alloc(&c->input, CHAN_RBUF)) 849 FD_SET(c->rfd, readset); 850 if (c->ostate == CHAN_OUTPUT_OPEN || 851 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { 852 if (buffer_len(&c->output) > 0) { 853 FD_SET(c->wfd, writeset); 854 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { 855 if (CHANNEL_EFD_OUTPUT_ACTIVE(c)) 856 debug2("channel %d: obuf_empty delayed efd %d/(%d)", 857 c->self, c->efd, buffer_len(&c->extended)); 858 else 859 chan_obuf_empty(c); 860 } 861 } 862 /** XXX check close conditions, too */ 863 if (compat20 && c->efd != -1 && 864 !(c->istate == CHAN_INPUT_CLOSED && c->ostate == CHAN_OUTPUT_CLOSED)) { 865 if (c->extended_usage == CHAN_EXTENDED_WRITE && 866 buffer_len(&c->extended) > 0) 867 FD_SET(c->efd, writeset); 868 else if (c->efd != -1 && !(c->flags & CHAN_EOF_SENT) && 869 (c->extended_usage == CHAN_EXTENDED_READ || 870 c->extended_usage == CHAN_EXTENDED_IGNORE) && 871 buffer_len(&c->extended) < c->remote_window) 872 FD_SET(c->efd, readset); 873 } 874 /* XXX: What about efd? races? */ 875 } 876 877 /* ARGSUSED */ 878 static void 879 channel_pre_input_draining(Channel *c, fd_set *readset, fd_set *writeset) 880 { 881 if (buffer_len(&c->input) == 0) { 882 packet_start(SSH_MSG_CHANNEL_CLOSE); 883 packet_put_int(c->remote_id); 884 packet_send(); 885 c->type = SSH_CHANNEL_CLOSED; 886 debug2("channel %d: closing after input drain.", c->self); 887 } 888 } 889 890 /* ARGSUSED */ 891 static void 892 channel_pre_output_draining(Channel *c, fd_set *readset, fd_set *writeset) 893 { 894 if (buffer_len(&c->output) == 0) 895 chan_mark_dead(c); 896 else 897 FD_SET(c->sock, writeset); 898 } 899 900 /* 901 * This is a special state for X11 authentication spoofing. An opened X11 902 * connection (when authentication spoofing is being done) remains in this 903 * state until the first packet has been completely read. The authentication 904 * data in that packet is then substituted by the real data if it matches the 905 * fake data, and the channel is put into normal mode. 906 * XXX All this happens at the client side. 907 * Returns: 0 = need more data, -1 = wrong cookie, 1 = ok 908 */ 909 static int 910 x11_open_helper(Buffer *b) 911 { 912 u_char *ucp; 913 u_int proto_len, data_len; 914 915 /* Check if the fixed size part of the packet is in buffer. */ 916 if (buffer_len(b) < 12) 917 return 0; 918 919 /* Parse the lengths of variable-length fields. */ 920 ucp = buffer_ptr(b); 921 if (ucp[0] == 0x42) { /* Byte order MSB first. */ 922 proto_len = 256 * ucp[6] + ucp[7]; 923 data_len = 256 * ucp[8] + ucp[9]; 924 } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */ 925 proto_len = ucp[6] + 256 * ucp[7]; 926 data_len = ucp[8] + 256 * ucp[9]; 927 } else { 928 debug2("Initial X11 packet contains bad byte order byte: 0x%x", 929 ucp[0]); 930 return -1; 931 } 932 933 /* Check if the whole packet is in buffer. */ 934 if (buffer_len(b) < 935 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3)) 936 return 0; 937 938 /* Check if authentication protocol matches. */ 939 if (proto_len != strlen(x11_saved_proto) || 940 memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) { 941 debug2("X11 connection uses different authentication protocol."); 942 return -1; 943 } 944 /* Check if authentication data matches our fake data. */ 945 if (data_len != x11_fake_data_len || 946 timingsafe_bcmp(ucp + 12 + ((proto_len + 3) & ~3), 947 x11_fake_data, x11_fake_data_len) != 0) { 948 debug2("X11 auth data does not match fake data."); 949 return -1; 950 } 951 /* Check fake data length */ 952 if (x11_fake_data_len != x11_saved_data_len) { 953 error("X11 fake_data_len %d != saved_data_len %d", 954 x11_fake_data_len, x11_saved_data_len); 955 return -1; 956 } 957 /* 958 * Received authentication protocol and data match 959 * our fake data. Substitute the fake data with real 960 * data. 961 */ 962 memcpy(ucp + 12 + ((proto_len + 3) & ~3), 963 x11_saved_data, x11_saved_data_len); 964 return 1; 965 } 966 967 static void 968 channel_pre_x11_open_13(Channel *c, fd_set *readset, fd_set *writeset) 969 { 970 int ret = x11_open_helper(&c->output); 971 972 if (ret == 1) { 973 /* Start normal processing for the channel. */ 974 c->type = SSH_CHANNEL_OPEN; 975 channel_pre_open_13(c, readset, writeset); 976 } else if (ret == -1) { 977 /* 978 * We have received an X11 connection that has bad 979 * authentication information. 980 */ 981 logit("X11 connection rejected because of wrong authentication."); 982 buffer_clear(&c->input); 983 buffer_clear(&c->output); 984 channel_close_fd(&c->sock); 985 c->sock = -1; 986 c->type = SSH_CHANNEL_CLOSED; 987 packet_start(SSH_MSG_CHANNEL_CLOSE); 988 packet_put_int(c->remote_id); 989 packet_send(); 990 } 991 } 992 993 static void 994 channel_pre_x11_open(Channel *c, fd_set *readset, fd_set *writeset) 995 { 996 int ret = x11_open_helper(&c->output); 997 998 /* c->force_drain = 1; */ 999 1000 if (ret == 1) { 1001 c->type = SSH_CHANNEL_OPEN; 1002 channel_pre_open(c, readset, writeset); 1003 } else if (ret == -1) { 1004 logit("X11 connection rejected because of wrong authentication."); 1005 debug2("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate); 1006 chan_read_failed(c); 1007 buffer_clear(&c->input); 1008 chan_ibuf_empty(c); 1009 buffer_clear(&c->output); 1010 /* for proto v1, the peer will send an IEOF */ 1011 if (compat20) 1012 chan_write_failed(c); 1013 else 1014 c->type = SSH_CHANNEL_OPEN; 1015 debug2("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate); 1016 } 1017 } 1018 1019 static void 1020 channel_pre_mux_client(Channel *c, fd_set *readset, fd_set *writeset) 1021 { 1022 if (c->istate == CHAN_INPUT_OPEN && !c->mux_pause && 1023 buffer_check_alloc(&c->input, CHAN_RBUF)) 1024 FD_SET(c->rfd, readset); 1025 if (c->istate == CHAN_INPUT_WAIT_DRAIN) { 1026 /* clear buffer immediately (discard any partial packet) */ 1027 buffer_clear(&c->input); 1028 chan_ibuf_empty(c); 1029 /* Start output drain. XXX just kill chan? */ 1030 chan_rcvd_oclose(c); 1031 } 1032 if (c->ostate == CHAN_OUTPUT_OPEN || 1033 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { 1034 if (buffer_len(&c->output) > 0) 1035 FD_SET(c->wfd, writeset); 1036 else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) 1037 chan_obuf_empty(c); 1038 } 1039 } 1040 1041 /* try to decode a socks4 header */ 1042 /* ARGSUSED */ 1043 static int 1044 channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset) 1045 { 1046 char *p, *host; 1047 u_int len, have, i, found, need; 1048 char username[256]; 1049 struct { 1050 u_int8_t version; 1051 u_int8_t command; 1052 u_int16_t dest_port; 1053 struct in_addr dest_addr; 1054 } s4_req, s4_rsp; 1055 1056 debug2("channel %d: decode socks4", c->self); 1057 1058 have = buffer_len(&c->input); 1059 len = sizeof(s4_req); 1060 if (have < len) 1061 return 0; 1062 p = (char *)buffer_ptr(&c->input); 1063 1064 need = 1; 1065 /* SOCKS4A uses an invalid IP address 0.0.0.x */ 1066 if (p[4] == 0 && p[5] == 0 && p[6] == 0 && p[7] != 0) { 1067 debug2("channel %d: socks4a request", c->self); 1068 /* ... and needs an extra string (the hostname) */ 1069 need = 2; 1070 } 1071 /* Check for terminating NUL on the string(s) */ 1072 for (found = 0, i = len; i < have; i++) { 1073 if (p[i] == '\0') { 1074 found++; 1075 if (found == need) 1076 break; 1077 } 1078 if (i > 1024) { 1079 /* the peer is probably sending garbage */ 1080 debug("channel %d: decode socks4: too long", 1081 c->self); 1082 return -1; 1083 } 1084 } 1085 if (found < need) 1086 return 0; 1087 buffer_get(&c->input, (char *)&s4_req.version, 1); 1088 buffer_get(&c->input, (char *)&s4_req.command, 1); 1089 buffer_get(&c->input, (char *)&s4_req.dest_port, 2); 1090 buffer_get(&c->input, (char *)&s4_req.dest_addr, 4); 1091 have = buffer_len(&c->input); 1092 p = (char *)buffer_ptr(&c->input); 1093 if (memchr(p, '\0', have) == NULL) 1094 fatal("channel %d: decode socks4: user not nul terminated", 1095 c->self); 1096 len = strlen(p); 1097 debug2("channel %d: decode socks4: user %s/%d", c->self, p, len); 1098 len++; /* trailing '\0' */ 1099 if (len > have) 1100 fatal("channel %d: decode socks4: len %d > have %d", 1101 c->self, len, have); 1102 strlcpy(username, p, sizeof(username)); 1103 buffer_consume(&c->input, len); 1104 1105 free(c->path); 1106 c->path = NULL; 1107 if (need == 1) { /* SOCKS4: one string */ 1108 host = inet_ntoa(s4_req.dest_addr); 1109 c->path = xstrdup(host); 1110 } else { /* SOCKS4A: two strings */ 1111 have = buffer_len(&c->input); 1112 p = (char *)buffer_ptr(&c->input); 1113 len = strlen(p); 1114 debug2("channel %d: decode socks4a: host %s/%d", 1115 c->self, p, len); 1116 len++; /* trailing '\0' */ 1117 if (len > have) 1118 fatal("channel %d: decode socks4a: len %d > have %d", 1119 c->self, len, have); 1120 if (len > NI_MAXHOST) { 1121 error("channel %d: hostname \"%.100s\" too long", 1122 c->self, p); 1123 return -1; 1124 } 1125 c->path = xstrdup(p); 1126 buffer_consume(&c->input, len); 1127 } 1128 c->host_port = ntohs(s4_req.dest_port); 1129 1130 debug2("channel %d: dynamic request: socks4 host %s port %u command %u", 1131 c->self, c->path, c->host_port, s4_req.command); 1132 1133 if (s4_req.command != 1) { 1134 debug("channel %d: cannot handle: %s cn %d", 1135 c->self, need == 1 ? "SOCKS4" : "SOCKS4A", s4_req.command); 1136 return -1; 1137 } 1138 s4_rsp.version = 0; /* vn: 0 for reply */ 1139 s4_rsp.command = 90; /* cd: req granted */ 1140 s4_rsp.dest_port = 0; /* ignored */ 1141 s4_rsp.dest_addr.s_addr = INADDR_ANY; /* ignored */ 1142 buffer_append(&c->output, &s4_rsp, sizeof(s4_rsp)); 1143 return 1; 1144 } 1145 1146 /* try to decode a socks5 header */ 1147 #define SSH_SOCKS5_AUTHDONE 0x1000 1148 #define SSH_SOCKS5_NOAUTH 0x00 1149 #define SSH_SOCKS5_IPV4 0x01 1150 #define SSH_SOCKS5_DOMAIN 0x03 1151 #define SSH_SOCKS5_IPV6 0x04 1152 #define SSH_SOCKS5_CONNECT 0x01 1153 #define SSH_SOCKS5_SUCCESS 0x00 1154 1155 /* ARGSUSED */ 1156 static int 1157 channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset) 1158 { 1159 struct { 1160 u_int8_t version; 1161 u_int8_t command; 1162 u_int8_t reserved; 1163 u_int8_t atyp; 1164 } s5_req, s5_rsp; 1165 u_int16_t dest_port; 1166 char dest_addr[255+1], ntop[INET6_ADDRSTRLEN]; 1167 u_char *p; 1168 u_int have, need, i, found, nmethods, addrlen, af; 1169 1170 debug2("channel %d: decode socks5", c->self); 1171 p = buffer_ptr(&c->input); 1172 if (p[0] != 0x05) 1173 return -1; 1174 have = buffer_len(&c->input); 1175 if (!(c->flags & SSH_SOCKS5_AUTHDONE)) { 1176 /* format: ver | nmethods | methods */ 1177 if (have < 2) 1178 return 0; 1179 nmethods = p[1]; 1180 if (have < nmethods + 2) 1181 return 0; 1182 /* look for method: "NO AUTHENTICATION REQUIRED" */ 1183 for (found = 0, i = 2; i < nmethods + 2; i++) { 1184 if (p[i] == SSH_SOCKS5_NOAUTH) { 1185 found = 1; 1186 break; 1187 } 1188 } 1189 if (!found) { 1190 debug("channel %d: method SSH_SOCKS5_NOAUTH not found", 1191 c->self); 1192 return -1; 1193 } 1194 buffer_consume(&c->input, nmethods + 2); 1195 buffer_put_char(&c->output, 0x05); /* version */ 1196 buffer_put_char(&c->output, SSH_SOCKS5_NOAUTH); /* method */ 1197 FD_SET(c->sock, writeset); 1198 c->flags |= SSH_SOCKS5_AUTHDONE; 1199 debug2("channel %d: socks5 auth done", c->self); 1200 return 0; /* need more */ 1201 } 1202 debug2("channel %d: socks5 post auth", c->self); 1203 if (have < sizeof(s5_req)+1) 1204 return 0; /* need more */ 1205 memcpy(&s5_req, p, sizeof(s5_req)); 1206 if (s5_req.version != 0x05 || 1207 s5_req.command != SSH_SOCKS5_CONNECT || 1208 s5_req.reserved != 0x00) { 1209 debug2("channel %d: only socks5 connect supported", c->self); 1210 return -1; 1211 } 1212 switch (s5_req.atyp){ 1213 case SSH_SOCKS5_IPV4: 1214 addrlen = 4; 1215 af = AF_INET; 1216 break; 1217 case SSH_SOCKS5_DOMAIN: 1218 addrlen = p[sizeof(s5_req)]; 1219 af = -1; 1220 break; 1221 case SSH_SOCKS5_IPV6: 1222 addrlen = 16; 1223 af = AF_INET6; 1224 break; 1225 default: 1226 debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp); 1227 return -1; 1228 } 1229 need = sizeof(s5_req) + addrlen + 2; 1230 if (s5_req.atyp == SSH_SOCKS5_DOMAIN) 1231 need++; 1232 if (have < need) 1233 return 0; 1234 buffer_consume(&c->input, sizeof(s5_req)); 1235 if (s5_req.atyp == SSH_SOCKS5_DOMAIN) 1236 buffer_consume(&c->input, 1); /* host string length */ 1237 buffer_get(&c->input, &dest_addr, addrlen); 1238 buffer_get(&c->input, (char *)&dest_port, 2); 1239 dest_addr[addrlen] = '\0'; 1240 free(c->path); 1241 c->path = NULL; 1242 if (s5_req.atyp == SSH_SOCKS5_DOMAIN) { 1243 if (addrlen >= NI_MAXHOST) { 1244 error("channel %d: dynamic request: socks5 hostname " 1245 "\"%.100s\" too long", c->self, dest_addr); 1246 return -1; 1247 } 1248 c->path = xstrdup(dest_addr); 1249 } else { 1250 if (inet_ntop(af, dest_addr, ntop, sizeof(ntop)) == NULL) 1251 return -1; 1252 c->path = xstrdup(ntop); 1253 } 1254 c->host_port = ntohs(dest_port); 1255 1256 debug2("channel %d: dynamic request: socks5 host %s port %u command %u", 1257 c->self, c->path, c->host_port, s5_req.command); 1258 1259 s5_rsp.version = 0x05; 1260 s5_rsp.command = SSH_SOCKS5_SUCCESS; 1261 s5_rsp.reserved = 0; /* ignored */ 1262 s5_rsp.atyp = SSH_SOCKS5_IPV4; 1263 dest_port = 0; /* ignored */ 1264 1265 buffer_append(&c->output, &s5_rsp, sizeof(s5_rsp)); 1266 buffer_put_int(&c->output, ntohl(INADDR_ANY)); /* bind address */ 1267 buffer_append(&c->output, &dest_port, sizeof(dest_port)); 1268 return 1; 1269 } 1270 1271 Channel * 1272 channel_connect_stdio_fwd(const char *host_to_connect, u_short port_to_connect, 1273 int in, int out) 1274 { 1275 Channel *c; 1276 1277 debug("channel_connect_stdio_fwd %s:%d", host_to_connect, 1278 port_to_connect); 1279 1280 c = channel_new("stdio-forward", SSH_CHANNEL_OPENING, in, out, 1281 -1, CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 1282 0, "stdio-forward", /*nonblock*/0); 1283 1284 c->path = xstrdup(host_to_connect); 1285 c->host_port = port_to_connect; 1286 c->listening_port = 0; 1287 c->force_drain = 1; 1288 1289 channel_register_fds(c, in, out, -1, 0, 1, 0); 1290 port_open_helper(c, "direct-tcpip"); 1291 1292 return c; 1293 } 1294 1295 /* dynamic port forwarding */ 1296 static void 1297 channel_pre_dynamic(Channel *c, fd_set *readset, fd_set *writeset) 1298 { 1299 u_char *p; 1300 u_int have; 1301 int ret; 1302 1303 have = buffer_len(&c->input); 1304 debug2("channel %d: pre_dynamic: have %d", c->self, have); 1305 /* buffer_dump(&c->input); */ 1306 /* check if the fixed size part of the packet is in buffer. */ 1307 if (have < 3) { 1308 /* need more */ 1309 FD_SET(c->sock, readset); 1310 return; 1311 } 1312 /* try to guess the protocol */ 1313 p = buffer_ptr(&c->input); 1314 switch (p[0]) { 1315 case 0x04: 1316 ret = channel_decode_socks4(c, readset, writeset); 1317 break; 1318 case 0x05: 1319 ret = channel_decode_socks5(c, readset, writeset); 1320 break; 1321 default: 1322 ret = -1; 1323 break; 1324 } 1325 if (ret < 0) { 1326 chan_mark_dead(c); 1327 } else if (ret == 0) { 1328 debug2("channel %d: pre_dynamic: need more", c->self); 1329 /* need more */ 1330 FD_SET(c->sock, readset); 1331 } else { 1332 /* switch to the next state */ 1333 c->type = SSH_CHANNEL_OPENING; 1334 port_open_helper(c, "direct-tcpip"); 1335 } 1336 } 1337 1338 /* This is our fake X11 server socket. */ 1339 /* ARGSUSED */ 1340 static void 1341 channel_post_x11_listener(Channel *c, fd_set *readset, fd_set *writeset) 1342 { 1343 Channel *nc; 1344 struct sockaddr_storage addr; 1345 int newsock, oerrno; 1346 socklen_t addrlen; 1347 char buf[16384], *remote_ipaddr; 1348 int remote_port; 1349 1350 if (FD_ISSET(c->sock, readset)) { 1351 debug("X11 connection requested."); 1352 addrlen = sizeof(addr); 1353 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); 1354 if (c->single_connection) { 1355 oerrno = errno; 1356 debug2("single_connection: closing X11 listener."); 1357 channel_close_fd(&c->sock); 1358 chan_mark_dead(c); 1359 errno = oerrno; 1360 } 1361 if (newsock < 0) { 1362 if (errno != EINTR && errno != EWOULDBLOCK && 1363 errno != ECONNABORTED) 1364 error("accept: %.100s", strerror(errno)); 1365 if (errno == EMFILE || errno == ENFILE) 1366 c->notbefore = monotime() + 1; 1367 return; 1368 } 1369 set_nodelay(newsock); 1370 remote_ipaddr = get_peer_ipaddr(newsock); 1371 remote_port = get_peer_port(newsock); 1372 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d", 1373 remote_ipaddr, remote_port); 1374 1375 nc = channel_new("accepted x11 socket", 1376 SSH_CHANNEL_OPENING, newsock, newsock, -1, 1377 c->local_window_max, c->local_maxpacket, 0, buf, 1); 1378 if (compat20) { 1379 packet_start(SSH2_MSG_CHANNEL_OPEN); 1380 packet_put_cstring("x11"); 1381 packet_put_int(nc->self); 1382 packet_put_int(nc->local_window_max); 1383 packet_put_int(nc->local_maxpacket); 1384 /* originator ipaddr and port */ 1385 packet_put_cstring(remote_ipaddr); 1386 if (datafellows & SSH_BUG_X11FWD) { 1387 debug2("ssh2 x11 bug compat mode"); 1388 } else { 1389 packet_put_int(remote_port); 1390 } 1391 packet_send(); 1392 } else { 1393 packet_start(SSH_SMSG_X11_OPEN); 1394 packet_put_int(nc->self); 1395 if (packet_get_protocol_flags() & 1396 SSH_PROTOFLAG_HOST_IN_FWD_OPEN) 1397 packet_put_cstring(buf); 1398 packet_send(); 1399 } 1400 free(remote_ipaddr); 1401 } 1402 } 1403 1404 static void 1405 port_open_helper(Channel *c, char *rtype) 1406 { 1407 char buf[1024]; 1408 char *local_ipaddr = get_local_ipaddr(c->sock); 1409 int local_port = c->sock == -1 ? 65536 : get_sock_port(c->sock, 1); 1410 char *remote_ipaddr = get_peer_ipaddr(c->sock); 1411 int remote_port = get_peer_port(c->sock); 1412 1413 if (remote_port == -1) { 1414 /* Fake addr/port to appease peers that validate it (Tectia) */ 1415 free(remote_ipaddr); 1416 remote_ipaddr = xstrdup("127.0.0.1"); 1417 remote_port = 65535; 1418 } 1419 1420 snprintf(buf, sizeof buf, 1421 "%s: listening port %d for %.100s port %d, " 1422 "connect from %.200s port %d to %.100s port %d", 1423 rtype, c->listening_port, c->path, c->host_port, 1424 remote_ipaddr, remote_port, local_ipaddr, local_port); 1425 1426 free(c->remote_name); 1427 c->remote_name = xstrdup(buf); 1428 1429 if (compat20) { 1430 packet_start(SSH2_MSG_CHANNEL_OPEN); 1431 packet_put_cstring(rtype); 1432 packet_put_int(c->self); 1433 packet_put_int(c->local_window_max); 1434 packet_put_int(c->local_maxpacket); 1435 if (strcmp(rtype, "direct-tcpip") == 0) { 1436 /* target host, port */ 1437 packet_put_cstring(c->path); 1438 packet_put_int(c->host_port); 1439 } else if (strcmp(rtype, "direct-streamlocal (at) openssh.com") == 0) { 1440 /* target path */ 1441 packet_put_cstring(c->path); 1442 } else if (strcmp(rtype, "forwarded-streamlocal (at) openssh.com") == 0) { 1443 /* listen path */ 1444 packet_put_cstring(c->path); 1445 } else { 1446 /* listen address, port */ 1447 packet_put_cstring(c->path); 1448 packet_put_int(local_port); 1449 } 1450 if (strcmp(rtype, "forwarded-streamlocal (at) openssh.com") == 0) { 1451 /* reserved for future owner/mode info */ 1452 packet_put_cstring(""); 1453 } else { 1454 /* originator host and port */ 1455 packet_put_cstring(remote_ipaddr); 1456 packet_put_int((u_int)remote_port); 1457 } 1458 packet_send(); 1459 } else { 1460 packet_start(SSH_MSG_PORT_OPEN); 1461 packet_put_int(c->self); 1462 packet_put_cstring(c->path); 1463 packet_put_int(c->host_port); 1464 if (packet_get_protocol_flags() & 1465 SSH_PROTOFLAG_HOST_IN_FWD_OPEN) 1466 packet_put_cstring(c->remote_name); 1467 packet_send(); 1468 } 1469 free(remote_ipaddr); 1470 free(local_ipaddr); 1471 } 1472 1473 static void 1474 channel_set_reuseaddr(int fd) 1475 { 1476 int on = 1; 1477 1478 /* 1479 * Set socket options. 1480 * Allow local port reuse in TIME_WAIT. 1481 */ 1482 if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) == -1) 1483 error("setsockopt SO_REUSEADDR fd %d: %s", fd, strerror(errno)); 1484 } 1485 1486 /* 1487 * This socket is listening for connections to a forwarded TCP/IP port. 1488 */ 1489 /* ARGSUSED */ 1490 static void 1491 channel_post_port_listener(Channel *c, fd_set *readset, fd_set *writeset) 1492 { 1493 Channel *nc; 1494 struct sockaddr_storage addr; 1495 int newsock, nextstate; 1496 socklen_t addrlen; 1497 char *rtype; 1498 1499 if (FD_ISSET(c->sock, readset)) { 1500 debug("Connection to port %d forwarding " 1501 "to %.100s port %d requested.", 1502 c->listening_port, c->path, c->host_port); 1503 1504 if (c->type == SSH_CHANNEL_RPORT_LISTENER) { 1505 nextstate = SSH_CHANNEL_OPENING; 1506 rtype = "forwarded-tcpip"; 1507 } else if (c->type == SSH_CHANNEL_RUNIX_LISTENER) { 1508 nextstate = SSH_CHANNEL_OPENING; 1509 rtype = "forwarded-streamlocal (at) openssh.com"; 1510 } else if (c->host_port == PORT_STREAMLOCAL) { 1511 nextstate = SSH_CHANNEL_OPENING; 1512 rtype = "direct-streamlocal (at) openssh.com"; 1513 } else if (c->host_port == 0) { 1514 nextstate = SSH_CHANNEL_DYNAMIC; 1515 rtype = "dynamic-tcpip"; 1516 } else { 1517 nextstate = SSH_CHANNEL_OPENING; 1518 rtype = "direct-tcpip"; 1519 } 1520 1521 addrlen = sizeof(addr); 1522 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); 1523 if (newsock < 0) { 1524 if (errno != EINTR && errno != EWOULDBLOCK && 1525 errno != ECONNABORTED) 1526 error("accept: %.100s", strerror(errno)); 1527 if (errno == EMFILE || errno == ENFILE) 1528 c->notbefore = monotime() + 1; 1529 return; 1530 } 1531 if (c->host_port != PORT_STREAMLOCAL) 1532 set_nodelay(newsock); 1533 nc = channel_new(rtype, nextstate, newsock, newsock, -1, 1534 c->local_window_max, c->local_maxpacket, 0, rtype, 1); 1535 nc->listening_port = c->listening_port; 1536 nc->host_port = c->host_port; 1537 if (c->path != NULL) 1538 nc->path = xstrdup(c->path); 1539 1540 if (nextstate != SSH_CHANNEL_DYNAMIC) 1541 port_open_helper(nc, rtype); 1542 } 1543 } 1544 1545 /* 1546 * This is the authentication agent socket listening for connections from 1547 * clients. 1548 */ 1549 /* ARGSUSED */ 1550 static void 1551 channel_post_auth_listener(Channel *c, fd_set *readset, fd_set *writeset) 1552 { 1553 Channel *nc; 1554 int newsock; 1555 struct sockaddr_storage addr; 1556 socklen_t addrlen; 1557 1558 if (FD_ISSET(c->sock, readset)) { 1559 addrlen = sizeof(addr); 1560 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); 1561 if (newsock < 0) { 1562 error("accept from auth socket: %.100s", 1563 strerror(errno)); 1564 if (errno == EMFILE || errno == ENFILE) 1565 c->notbefore = monotime() + 1; 1566 return; 1567 } 1568 nc = channel_new("accepted auth socket", 1569 SSH_CHANNEL_OPENING, newsock, newsock, -1, 1570 c->local_window_max, c->local_maxpacket, 1571 0, "accepted auth socket", 1); 1572 if (compat20) { 1573 packet_start(SSH2_MSG_CHANNEL_OPEN); 1574 packet_put_cstring("auth-agent (at) openssh.com"); 1575 packet_put_int(nc->self); 1576 packet_put_int(c->local_window_max); 1577 packet_put_int(c->local_maxpacket); 1578 } else { 1579 packet_start(SSH_SMSG_AGENT_OPEN); 1580 packet_put_int(nc->self); 1581 } 1582 packet_send(); 1583 } 1584 } 1585 1586 /* ARGSUSED */ 1587 static void 1588 channel_post_connecting(Channel *c, fd_set *readset, fd_set *writeset) 1589 { 1590 int err = 0, sock; 1591 socklen_t sz = sizeof(err); 1592 1593 if (FD_ISSET(c->sock, writeset)) { 1594 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, &err, &sz) < 0) { 1595 err = errno; 1596 error("getsockopt SO_ERROR failed"); 1597 } 1598 if (err == 0) { 1599 debug("channel %d: connected to %s port %d", 1600 c->self, c->connect_ctx.host, c->connect_ctx.port); 1601 channel_connect_ctx_free(&c->connect_ctx); 1602 c->type = SSH_CHANNEL_OPEN; 1603 if (compat20) { 1604 packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); 1605 packet_put_int(c->remote_id); 1606 packet_put_int(c->self); 1607 packet_put_int(c->local_window); 1608 packet_put_int(c->local_maxpacket); 1609 } else { 1610 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); 1611 packet_put_int(c->remote_id); 1612 packet_put_int(c->self); 1613 } 1614 } else { 1615 debug("channel %d: connection failed: %s", 1616 c->self, strerror(err)); 1617 /* Try next address, if any */ 1618 if ((sock = connect_next(&c->connect_ctx)) > 0) { 1619 close(c->sock); 1620 c->sock = c->rfd = c->wfd = sock; 1621 channel_max_fd = channel_find_maxfd(); 1622 return; 1623 } 1624 /* Exhausted all addresses */ 1625 error("connect_to %.100s port %d: failed.", 1626 c->connect_ctx.host, c->connect_ctx.port); 1627 channel_connect_ctx_free(&c->connect_ctx); 1628 if (compat20) { 1629 packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE); 1630 packet_put_int(c->remote_id); 1631 packet_put_int(SSH2_OPEN_CONNECT_FAILED); 1632 if (!(datafellows & SSH_BUG_OPENFAILURE)) { 1633 packet_put_cstring(strerror(err)); 1634 packet_put_cstring(""); 1635 } 1636 } else { 1637 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 1638 packet_put_int(c->remote_id); 1639 } 1640 chan_mark_dead(c); 1641 } 1642 packet_send(); 1643 } 1644 } 1645 1646 /* ARGSUSED */ 1647 static int 1648 channel_handle_rfd(Channel *c, fd_set *readset, fd_set *writeset) 1649 { 1650 char buf[CHAN_RBUF]; 1651 int len, force; 1652 1653 force = c->isatty && c->detach_close && c->istate != CHAN_INPUT_CLOSED; 1654 if (c->rfd != -1 && (force || FD_ISSET(c->rfd, readset))) { 1655 errno = 0; 1656 len = read(c->rfd, buf, sizeof(buf)); 1657 if (len < 0 && (errno == EINTR || 1658 ((errno == EAGAIN || errno == EWOULDBLOCK) && !force))) 1659 return 1; 1660 #ifndef PTY_ZEROREAD 1661 if (len <= 0) { 1662 #else 1663 if ((!c->isatty && len <= 0) || 1664 (c->isatty && (len < 0 || (len == 0 && errno != 0)))) { 1665 #endif 1666 debug2("channel %d: read<=0 rfd %d len %d", 1667 c->self, c->rfd, len); 1668 if (c->type != SSH_CHANNEL_OPEN) { 1669 debug2("channel %d: not open", c->self); 1670 chan_mark_dead(c); 1671 return -1; 1672 } else if (compat13) { 1673 buffer_clear(&c->output); 1674 c->type = SSH_CHANNEL_INPUT_DRAINING; 1675 debug2("channel %d: input draining.", c->self); 1676 } else { 1677 chan_read_failed(c); 1678 } 1679 return -1; 1680 } 1681 if (c->input_filter != NULL) { 1682 if (c->input_filter(c, buf, len) == -1) { 1683 debug2("channel %d: filter stops", c->self); 1684 chan_read_failed(c); 1685 } 1686 } else if (c->datagram) { 1687 buffer_put_string(&c->input, buf, len); 1688 } else { 1689 buffer_append(&c->input, buf, len); 1690 } 1691 } 1692 return 1; 1693 } 1694 1695 /* ARGSUSED */ 1696 static int 1697 channel_handle_wfd(Channel *c, fd_set *readset, fd_set *writeset) 1698 { 1699 struct termios tio; 1700 u_char *data = NULL, *buf; 1701 u_int dlen, olen = 0; 1702 int len; 1703 1704 /* Send buffered output data to the socket. */ 1705 if (c->wfd != -1 && 1706 FD_ISSET(c->wfd, writeset) && 1707 buffer_len(&c->output) > 0) { 1708 olen = buffer_len(&c->output); 1709 if (c->output_filter != NULL) { 1710 if ((buf = c->output_filter(c, &data, &dlen)) == NULL) { 1711 debug2("channel %d: filter stops", c->self); 1712 if (c->type != SSH_CHANNEL_OPEN) 1713 chan_mark_dead(c); 1714 else 1715 chan_write_failed(c); 1716 return -1; 1717 } 1718 } else if (c->datagram) { 1719 buf = data = buffer_get_string(&c->output, &dlen); 1720 } else { 1721 buf = data = buffer_ptr(&c->output); 1722 dlen = buffer_len(&c->output); 1723 } 1724 1725 if (c->datagram) { 1726 /* ignore truncated writes, datagrams might get lost */ 1727 len = write(c->wfd, buf, dlen); 1728 free(data); 1729 if (len < 0 && (errno == EINTR || errno == EAGAIN || 1730 errno == EWOULDBLOCK)) 1731 return 1; 1732 if (len <= 0) { 1733 if (c->type != SSH_CHANNEL_OPEN) 1734 chan_mark_dead(c); 1735 else 1736 chan_write_failed(c); 1737 return -1; 1738 } 1739 goto out; 1740 } 1741 #ifdef _AIX 1742 /* XXX: Later AIX versions can't push as much data to tty */ 1743 if (compat20 && c->wfd_isatty) 1744 dlen = MIN(dlen, 8*1024); 1745 #endif 1746 1747 len = write(c->wfd, buf, dlen); 1748 if (len < 0 && 1749 (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)) 1750 return 1; 1751 if (len <= 0) { 1752 if (c->type != SSH_CHANNEL_OPEN) { 1753 debug2("channel %d: not open", c->self); 1754 chan_mark_dead(c); 1755 return -1; 1756 } else if (compat13) { 1757 buffer_clear(&c->output); 1758 debug2("channel %d: input draining.", c->self); 1759 c->type = SSH_CHANNEL_INPUT_DRAINING; 1760 } else { 1761 chan_write_failed(c); 1762 } 1763 return -1; 1764 } 1765 #ifndef BROKEN_TCGETATTR_ICANON 1766 if (compat20 && c->isatty && dlen >= 1 && buf[0] != '\r') { 1767 if (tcgetattr(c->wfd, &tio) == 0 && 1768 !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) { 1769 /* 1770 * Simulate echo to reduce the impact of 1771 * traffic analysis. We need to match the 1772 * size of a SSH2_MSG_CHANNEL_DATA message 1773 * (4 byte channel id + buf) 1774 */ 1775 packet_send_ignore(4 + len); 1776 packet_send(); 1777 } 1778 } 1779 #endif 1780 buffer_consume(&c->output, len); 1781 } 1782 out: 1783 if (compat20 && olen > 0) 1784 c->local_consumed += olen - buffer_len(&c->output); 1785 return 1; 1786 } 1787 1788 static int 1789 channel_handle_efd(Channel *c, fd_set *readset, fd_set *writeset) 1790 { 1791 char buf[CHAN_RBUF]; 1792 int len; 1793 1794 /** XXX handle drain efd, too */ 1795 if (c->efd != -1) { 1796 if (c->extended_usage == CHAN_EXTENDED_WRITE && 1797 FD_ISSET(c->efd, writeset) && 1798 buffer_len(&c->extended) > 0) { 1799 len = write(c->efd, buffer_ptr(&c->extended), 1800 buffer_len(&c->extended)); 1801 debug2("channel %d: written %d to efd %d", 1802 c->self, len, c->efd); 1803 if (len < 0 && (errno == EINTR || errno == EAGAIN || 1804 errno == EWOULDBLOCK)) 1805 return 1; 1806 if (len <= 0) { 1807 debug2("channel %d: closing write-efd %d", 1808 c->self, c->efd); 1809 channel_close_fd(&c->efd); 1810 } else { 1811 buffer_consume(&c->extended, len); 1812 c->local_consumed += len; 1813 } 1814 } else if (c->efd != -1 && 1815 (c->extended_usage == CHAN_EXTENDED_READ || 1816 c->extended_usage == CHAN_EXTENDED_IGNORE) && 1817 (c->detach_close || FD_ISSET(c->efd, readset))) { 1818 len = read(c->efd, buf, sizeof(buf)); 1819 debug2("channel %d: read %d from efd %d", 1820 c->self, len, c->efd); 1821 if (len < 0 && (errno == EINTR || ((errno == EAGAIN || 1822 errno == EWOULDBLOCK) && !c->detach_close))) 1823 return 1; 1824 if (len <= 0) { 1825 debug2("channel %d: closing read-efd %d", 1826 c->self, c->efd); 1827 channel_close_fd(&c->efd); 1828 } else { 1829 if (c->extended_usage == CHAN_EXTENDED_IGNORE) { 1830 debug3("channel %d: discard efd", 1831 c->self); 1832 } else 1833 buffer_append(&c->extended, buf, len); 1834 } 1835 } 1836 } 1837 return 1; 1838 } 1839 1840 static int 1841 channel_check_window(Channel *c) 1842 { 1843 if (c->type == SSH_CHANNEL_OPEN && 1844 !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) && 1845 ((c->local_window_max - c->local_window > 1846 c->local_maxpacket*3) || 1847 c->local_window < c->local_window_max/2) && 1848 c->local_consumed > 0) { 1849 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); 1850 packet_put_int(c->remote_id); 1851 packet_put_int(c->local_consumed); 1852 packet_send(); 1853 debug2("channel %d: window %d sent adjust %d", 1854 c->self, c->local_window, 1855 c->local_consumed); 1856 c->local_window += c->local_consumed; 1857 c->local_consumed = 0; 1858 } 1859 return 1; 1860 } 1861 1862 static void 1863 channel_post_open(Channel *c, fd_set *readset, fd_set *writeset) 1864 { 1865 channel_handle_rfd(c, readset, writeset); 1866 channel_handle_wfd(c, readset, writeset); 1867 if (!compat20) 1868 return; 1869 channel_handle_efd(c, readset, writeset); 1870 channel_check_window(c); 1871 } 1872 1873 static u_int 1874 read_mux(Channel *c, u_int need) 1875 { 1876 char buf[CHAN_RBUF]; 1877 int len; 1878 u_int rlen; 1879 1880 if (buffer_len(&c->input) < need) { 1881 rlen = need - buffer_len(&c->input); 1882 len = read(c->rfd, buf, MIN(rlen, CHAN_RBUF)); 1883 if (len <= 0) { 1884 if (errno != EINTR && errno != EAGAIN) { 1885 debug2("channel %d: ctl read<=0 rfd %d len %d", 1886 c->self, c->rfd, len); 1887 chan_read_failed(c); 1888 return 0; 1889 } 1890 } else 1891 buffer_append(&c->input, buf, len); 1892 } 1893 return buffer_len(&c->input); 1894 } 1895 1896 static void 1897 channel_post_mux_client(Channel *c, fd_set *readset, fd_set *writeset) 1898 { 1899 u_int need; 1900 ssize_t len; 1901 1902 if (!compat20) 1903 fatal("%s: entered with !compat20", __func__); 1904 1905 if (c->rfd != -1 && !c->mux_pause && FD_ISSET(c->rfd, readset) && 1906 (c->istate == CHAN_INPUT_OPEN || 1907 c->istate == CHAN_INPUT_WAIT_DRAIN)) { 1908 /* 1909 * Don't not read past the precise end of packets to 1910 * avoid disrupting fd passing. 1911 */ 1912 if (read_mux(c, 4) < 4) /* read header */ 1913 return; 1914 need = get_u32(buffer_ptr(&c->input)); 1915 #define CHANNEL_MUX_MAX_PACKET (256 * 1024) 1916 if (need > CHANNEL_MUX_MAX_PACKET) { 1917 debug2("channel %d: packet too big %u > %u", 1918 c->self, CHANNEL_MUX_MAX_PACKET, need); 1919 chan_rcvd_oclose(c); 1920 return; 1921 } 1922 if (read_mux(c, need + 4) < need + 4) /* read body */ 1923 return; 1924 if (c->mux_rcb(c) != 0) { 1925 debug("channel %d: mux_rcb failed", c->self); 1926 chan_mark_dead(c); 1927 return; 1928 } 1929 } 1930 1931 if (c->wfd != -1 && FD_ISSET(c->wfd, writeset) && 1932 buffer_len(&c->output) > 0) { 1933 len = write(c->wfd, buffer_ptr(&c->output), 1934 buffer_len(&c->output)); 1935 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 1936 return; 1937 if (len <= 0) { 1938 chan_mark_dead(c); 1939 return; 1940 } 1941 buffer_consume(&c->output, len); 1942 } 1943 } 1944 1945 static void 1946 channel_post_mux_listener(Channel *c, fd_set *readset, fd_set *writeset) 1947 { 1948 Channel *nc; 1949 struct sockaddr_storage addr; 1950 socklen_t addrlen; 1951 int newsock; 1952 uid_t euid; 1953 gid_t egid; 1954 1955 if (!FD_ISSET(c->sock, readset)) 1956 return; 1957 1958 debug("multiplexing control connection"); 1959 1960 /* 1961 * Accept connection on control socket 1962 */ 1963 memset(&addr, 0, sizeof(addr)); 1964 addrlen = sizeof(addr); 1965 if ((newsock = accept(c->sock, (struct sockaddr*)&addr, 1966 &addrlen)) == -1) { 1967 error("%s accept: %s", __func__, strerror(errno)); 1968 if (errno == EMFILE || errno == ENFILE) 1969 c->notbefore = monotime() + 1; 1970 return; 1971 } 1972 1973 if (getpeereid(newsock, &euid, &egid) < 0) { 1974 error("%s getpeereid failed: %s", __func__, 1975 strerror(errno)); 1976 close(newsock); 1977 return; 1978 } 1979 if ((euid != 0) && (getuid() != euid)) { 1980 error("multiplex uid mismatch: peer euid %u != uid %u", 1981 (u_int)euid, (u_int)getuid()); 1982 close(newsock); 1983 return; 1984 } 1985 nc = channel_new("multiplex client", SSH_CHANNEL_MUX_CLIENT, 1986 newsock, newsock, -1, c->local_window_max, 1987 c->local_maxpacket, 0, "mux-control", 1); 1988 nc->mux_rcb = c->mux_rcb; 1989 debug3("%s: new mux channel %d fd %d", __func__, 1990 nc->self, nc->sock); 1991 /* establish state */ 1992 nc->mux_rcb(nc); 1993 /* mux state transitions must not elicit protocol messages */ 1994 nc->flags |= CHAN_LOCAL; 1995 } 1996 1997 /* ARGSUSED */ 1998 static void 1999 channel_post_output_drain_13(Channel *c, fd_set *readset, fd_set *writeset) 2000 { 2001 int len; 2002 2003 /* Send buffered output data to the socket. */ 2004 if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) { 2005 len = write(c->sock, buffer_ptr(&c->output), 2006 buffer_len(&c->output)); 2007 if (len <= 0) 2008 buffer_clear(&c->output); 2009 else 2010 buffer_consume(&c->output, len); 2011 } 2012 } 2013 2014 static void 2015 channel_handler_init_20(void) 2016 { 2017 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open; 2018 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; 2019 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; 2020 channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener; 2021 channel_pre[SSH_CHANNEL_UNIX_LISTENER] = &channel_pre_listener; 2022 channel_pre[SSH_CHANNEL_RUNIX_LISTENER] = &channel_pre_listener; 2023 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; 2024 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; 2025 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; 2026 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; 2027 channel_pre[SSH_CHANNEL_MUX_LISTENER] = &channel_pre_listener; 2028 channel_pre[SSH_CHANNEL_MUX_CLIENT] = &channel_pre_mux_client; 2029 2030 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; 2031 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; 2032 channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener; 2033 channel_post[SSH_CHANNEL_UNIX_LISTENER] = &channel_post_port_listener; 2034 channel_post[SSH_CHANNEL_RUNIX_LISTENER] = &channel_post_port_listener; 2035 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; 2036 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; 2037 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; 2038 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; 2039 channel_post[SSH_CHANNEL_MUX_LISTENER] = &channel_post_mux_listener; 2040 channel_post[SSH_CHANNEL_MUX_CLIENT] = &channel_post_mux_client; 2041 } 2042 2043 static void 2044 channel_handler_init_13(void) 2045 { 2046 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13; 2047 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13; 2048 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; 2049 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; 2050 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; 2051 channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining; 2052 channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining; 2053 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; 2054 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; 2055 2056 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; 2057 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; 2058 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; 2059 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; 2060 channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13; 2061 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; 2062 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; 2063 } 2064 2065 static void 2066 channel_handler_init_15(void) 2067 { 2068 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open; 2069 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; 2070 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; 2071 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; 2072 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; 2073 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; 2074 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; 2075 2076 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; 2077 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; 2078 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; 2079 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; 2080 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; 2081 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; 2082 } 2083 2084 static void 2085 channel_handler_init(void) 2086 { 2087 int i; 2088 2089 for (i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) { 2090 channel_pre[i] = NULL; 2091 channel_post[i] = NULL; 2092 } 2093 if (compat20) 2094 channel_handler_init_20(); 2095 else if (compat13) 2096 channel_handler_init_13(); 2097 else 2098 channel_handler_init_15(); 2099 } 2100 2101 /* gc dead channels */ 2102 static void 2103 channel_garbage_collect(Channel *c) 2104 { 2105 if (c == NULL) 2106 return; 2107 if (c->detach_user != NULL) { 2108 if (!chan_is_dead(c, c->detach_close)) 2109 return; 2110 debug2("channel %d: gc: notify user", c->self); 2111 c->detach_user(c->self, NULL); 2112 /* if we still have a callback */ 2113 if (c->detach_user != NULL) 2114 return; 2115 debug2("channel %d: gc: user detached", c->self); 2116 } 2117 if (!chan_is_dead(c, 1)) 2118 return; 2119 debug2("channel %d: garbage collecting", c->self); 2120 channel_free(c); 2121 } 2122 2123 static void 2124 channel_handler(chan_fn *ftab[], fd_set *readset, fd_set *writeset, 2125 time_t *unpause_secs) 2126 { 2127 static int did_init = 0; 2128 u_int i, oalloc; 2129 Channel *c; 2130 time_t now; 2131 2132 if (!did_init) { 2133 channel_handler_init(); 2134 did_init = 1; 2135 } 2136 now = monotime(); 2137 if (unpause_secs != NULL) 2138 *unpause_secs = 0; 2139 for (i = 0, oalloc = channels_alloc; i < oalloc; i++) { 2140 c = channels[i]; 2141 if (c == NULL) 2142 continue; 2143 if (c->delayed) { 2144 if (ftab == channel_pre) 2145 c->delayed = 0; 2146 else 2147 continue; 2148 } 2149 if (ftab[c->type] != NULL) { 2150 /* 2151 * Run handlers that are not paused. 2152 */ 2153 if (c->notbefore <= now) 2154 (*ftab[c->type])(c, readset, writeset); 2155 else if (unpause_secs != NULL) { 2156 /* 2157 * Collect the time that the earliest 2158 * channel comes off pause. 2159 */ 2160 debug3("%s: chan %d: skip for %d more seconds", 2161 __func__, c->self, 2162 (int)(c->notbefore - now)); 2163 if (*unpause_secs == 0 || 2164 (c->notbefore - now) < *unpause_secs) 2165 *unpause_secs = c->notbefore - now; 2166 } 2167 } 2168 channel_garbage_collect(c); 2169 } 2170 if (unpause_secs != NULL && *unpause_secs != 0) 2171 debug3("%s: first channel unpauses in %d seconds", 2172 __func__, (int)*unpause_secs); 2173 } 2174 2175 /* 2176 * Allocate/update select bitmasks and add any bits relevant to channels in 2177 * select bitmasks. 2178 */ 2179 void 2180 channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp, 2181 u_int *nallocp, time_t *minwait_secs, int rekeying) 2182 { 2183 u_int n, sz, nfdset; 2184 2185 n = MAX(*maxfdp, channel_max_fd); 2186 2187 nfdset = howmany(n+1, NFDBITS); 2188 /* Explicitly test here, because xrealloc isn't always called */ 2189 if (nfdset && SIZE_MAX / nfdset < sizeof(fd_mask)) 2190 fatal("channel_prepare_select: max_fd (%d) is too large", n); 2191 sz = nfdset * sizeof(fd_mask); 2192 2193 /* perhaps check sz < nalloc/2 and shrink? */ 2194 if (*readsetp == NULL || sz > *nallocp) { 2195 *readsetp = xrealloc(*readsetp, nfdset, sizeof(fd_mask)); 2196 *writesetp = xrealloc(*writesetp, nfdset, sizeof(fd_mask)); 2197 *nallocp = sz; 2198 } 2199 *maxfdp = n; 2200 memset(*readsetp, 0, sz); 2201 memset(*writesetp, 0, sz); 2202 2203 if (!rekeying) 2204 channel_handler(channel_pre, *readsetp, *writesetp, 2205 minwait_secs); 2206 } 2207 2208 /* 2209 * After select, perform any appropriate operations for channels which have 2210 * events pending. 2211 */ 2212 void 2213 channel_after_select(fd_set *readset, fd_set *writeset) 2214 { 2215 channel_handler(channel_post, readset, writeset, NULL); 2216 } 2217 2218 2219 /* If there is data to send to the connection, enqueue some of it now. */ 2220 void 2221 channel_output_poll(void) 2222 { 2223 Channel *c; 2224 u_int i, len; 2225 2226 for (i = 0; i < channels_alloc; i++) { 2227 c = channels[i]; 2228 if (c == NULL) 2229 continue; 2230 2231 /* 2232 * We are only interested in channels that can have buffered 2233 * incoming data. 2234 */ 2235 if (compat13) { 2236 if (c->type != SSH_CHANNEL_OPEN && 2237 c->type != SSH_CHANNEL_INPUT_DRAINING) 2238 continue; 2239 } else { 2240 if (c->type != SSH_CHANNEL_OPEN) 2241 continue; 2242 } 2243 if (compat20 && 2244 (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) { 2245 /* XXX is this true? */ 2246 debug3("channel %d: will not send data after close", c->self); 2247 continue; 2248 } 2249 2250 /* Get the amount of buffered data for this channel. */ 2251 if ((c->istate == CHAN_INPUT_OPEN || 2252 c->istate == CHAN_INPUT_WAIT_DRAIN) && 2253 (len = buffer_len(&c->input)) > 0) { 2254 if (c->datagram) { 2255 if (len > 0) { 2256 u_char *data; 2257 u_int dlen; 2258 2259 data = buffer_get_string(&c->input, 2260 &dlen); 2261 if (dlen > c->remote_window || 2262 dlen > c->remote_maxpacket) { 2263 debug("channel %d: datagram " 2264 "too big for channel", 2265 c->self); 2266 free(data); 2267 continue; 2268 } 2269 packet_start(SSH2_MSG_CHANNEL_DATA); 2270 packet_put_int(c->remote_id); 2271 packet_put_string(data, dlen); 2272 packet_send(); 2273 c->remote_window -= dlen + 4; 2274 free(data); 2275 } 2276 continue; 2277 } 2278 /* 2279 * Send some data for the other side over the secure 2280 * connection. 2281 */ 2282 if (compat20) { 2283 if (len > c->remote_window) 2284 len = c->remote_window; 2285 if (len > c->remote_maxpacket) 2286 len = c->remote_maxpacket; 2287 } else { 2288 if (packet_is_interactive()) { 2289 if (len > 1024) 2290 len = 512; 2291 } else { 2292 /* Keep the packets at reasonable size. */ 2293 if (len > packet_get_maxsize()/2) 2294 len = packet_get_maxsize()/2; 2295 } 2296 } 2297 if (len > 0) { 2298 packet_start(compat20 ? 2299 SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA); 2300 packet_put_int(c->remote_id); 2301 packet_put_string(buffer_ptr(&c->input), len); 2302 packet_send(); 2303 buffer_consume(&c->input, len); 2304 c->remote_window -= len; 2305 } 2306 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) { 2307 if (compat13) 2308 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3"); 2309 /* 2310 * input-buffer is empty and read-socket shutdown: 2311 * tell peer, that we will not send more data: send IEOF. 2312 * hack for extended data: delay EOF if EFD still in use. 2313 */ 2314 if (CHANNEL_EFD_INPUT_ACTIVE(c)) 2315 debug2("channel %d: ibuf_empty delayed efd %d/(%d)", 2316 c->self, c->efd, buffer_len(&c->extended)); 2317 else 2318 chan_ibuf_empty(c); 2319 } 2320 /* Send extended data, i.e. stderr */ 2321 if (compat20 && 2322 !(c->flags & CHAN_EOF_SENT) && 2323 c->remote_window > 0 && 2324 (len = buffer_len(&c->extended)) > 0 && 2325 c->extended_usage == CHAN_EXTENDED_READ) { 2326 debug2("channel %d: rwin %u elen %u euse %d", 2327 c->self, c->remote_window, buffer_len(&c->extended), 2328 c->extended_usage); 2329 if (len > c->remote_window) 2330 len = c->remote_window; 2331 if (len > c->remote_maxpacket) 2332 len = c->remote_maxpacket; 2333 packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA); 2334 packet_put_int(c->remote_id); 2335 packet_put_int(SSH2_EXTENDED_DATA_STDERR); 2336 packet_put_string(buffer_ptr(&c->extended), len); 2337 packet_send(); 2338 buffer_consume(&c->extended, len); 2339 c->remote_window -= len; 2340 debug2("channel %d: sent ext data %d", c->self, len); 2341 } 2342 } 2343 } 2344 2345 2346 /* -- protocol input */ 2347 2348 /* ARGSUSED */ 2349 int 2350 channel_input_data(int type, u_int32_t seq, void *ctxt) 2351 { 2352 int id; 2353 const u_char *data; 2354 u_int data_len, win_len; 2355 Channel *c; 2356 2357 /* Get the channel number and verify it. */ 2358 id = packet_get_int(); 2359 c = channel_lookup(id); 2360 if (c == NULL) 2361 packet_disconnect("Received data for nonexistent channel %d.", id); 2362 2363 /* Ignore any data for non-open channels (might happen on close) */ 2364 if (c->type != SSH_CHANNEL_OPEN && 2365 c->type != SSH_CHANNEL_X11_OPEN) 2366 return 0; 2367 2368 /* Get the data. */ 2369 data = packet_get_string_ptr(&data_len); 2370 win_len = data_len; 2371 if (c->datagram) 2372 win_len += 4; /* string length header */ 2373 2374 /* 2375 * Ignore data for protocol > 1.3 if output end is no longer open. 2376 * For protocol 2 the sending side is reducing its window as it sends 2377 * data, so we must 'fake' consumption of the data in order to ensure 2378 * that window updates are sent back. Otherwise the connection might 2379 * deadlock. 2380 */ 2381 if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN) { 2382 if (compat20) { 2383 c->local_window -= win_len; 2384 c->local_consumed += win_len; 2385 } 2386 return 0; 2387 } 2388 2389 if (compat20) { 2390 if (win_len > c->local_maxpacket) { 2391 logit("channel %d: rcvd big packet %d, maxpack %d", 2392 c->self, win_len, c->local_maxpacket); 2393 } 2394 if (win_len > c->local_window) { 2395 logit("channel %d: rcvd too much data %d, win %d", 2396 c->self, win_len, c->local_window); 2397 return 0; 2398 } 2399 c->local_window -= win_len; 2400 } 2401 if (c->datagram) 2402 buffer_put_string(&c->output, data, data_len); 2403 else 2404 buffer_append(&c->output, data, data_len); 2405 packet_check_eom(); 2406 return 0; 2407 } 2408 2409 /* ARGSUSED */ 2410 int 2411 channel_input_extended_data(int type, u_int32_t seq, void *ctxt) 2412 { 2413 int id; 2414 char *data; 2415 u_int data_len, tcode; 2416 Channel *c; 2417 2418 /* Get the channel number and verify it. */ 2419 id = packet_get_int(); 2420 c = channel_lookup(id); 2421 2422 if (c == NULL) 2423 packet_disconnect("Received extended_data for bad channel %d.", id); 2424 if (c->type != SSH_CHANNEL_OPEN) { 2425 logit("channel %d: ext data for non open", id); 2426 return 0; 2427 } 2428 if (c->flags & CHAN_EOF_RCVD) { 2429 if (datafellows & SSH_BUG_EXTEOF) 2430 debug("channel %d: accepting ext data after eof", id); 2431 else 2432 packet_disconnect("Received extended_data after EOF " 2433 "on channel %d.", id); 2434 } 2435 tcode = packet_get_int(); 2436 if (c->efd == -1 || 2437 c->extended_usage != CHAN_EXTENDED_WRITE || 2438 tcode != SSH2_EXTENDED_DATA_STDERR) { 2439 logit("channel %d: bad ext data", c->self); 2440 return 0; 2441 } 2442 data = packet_get_string(&data_len); 2443 packet_check_eom(); 2444 if (data_len > c->local_window) { 2445 logit("channel %d: rcvd too much extended_data %d, win %d", 2446 c->self, data_len, c->local_window); 2447 free(data); 2448 return 0; 2449 } 2450 debug2("channel %d: rcvd ext data %d", c->self, data_len); 2451 c->local_window -= data_len; 2452 buffer_append(&c->extended, data, data_len); 2453 free(data); 2454 return 0; 2455 } 2456 2457 /* ARGSUSED */ 2458 int 2459 channel_input_ieof(int type, u_int32_t seq, void *ctxt) 2460 { 2461 int id; 2462 Channel *c; 2463 2464 id = packet_get_int(); 2465 packet_check_eom(); 2466 c = channel_lookup(id); 2467 if (c == NULL) 2468 packet_disconnect("Received ieof for nonexistent channel %d.", id); 2469 chan_rcvd_ieof(c); 2470 2471 /* XXX force input close */ 2472 if (c->force_drain && c->istate == CHAN_INPUT_OPEN) { 2473 debug("channel %d: FORCE input drain", c->self); 2474 c->istate = CHAN_INPUT_WAIT_DRAIN; 2475 if (buffer_len(&c->input) == 0) 2476 chan_ibuf_empty(c); 2477 } 2478 return 0; 2479 } 2480 2481 /* ARGSUSED */ 2482 int 2483 channel_input_close(int type, u_int32_t seq, void *ctxt) 2484 { 2485 int id; 2486 Channel *c; 2487 2488 id = packet_get_int(); 2489 packet_check_eom(); 2490 c = channel_lookup(id); 2491 if (c == NULL) 2492 packet_disconnect("Received close for nonexistent channel %d.", id); 2493 2494 /* 2495 * Send a confirmation that we have closed the channel and no more 2496 * data is coming for it. 2497 */ 2498 packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION); 2499 packet_put_int(c->remote_id); 2500 packet_send(); 2501 2502 /* 2503 * If the channel is in closed state, we have sent a close request, 2504 * and the other side will eventually respond with a confirmation. 2505 * Thus, we cannot free the channel here, because then there would be 2506 * no-one to receive the confirmation. The channel gets freed when 2507 * the confirmation arrives. 2508 */ 2509 if (c->type != SSH_CHANNEL_CLOSED) { 2510 /* 2511 * Not a closed channel - mark it as draining, which will 2512 * cause it to be freed later. 2513 */ 2514 buffer_clear(&c->input); 2515 c->type = SSH_CHANNEL_OUTPUT_DRAINING; 2516 } 2517 return 0; 2518 } 2519 2520 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */ 2521 /* ARGSUSED */ 2522 int 2523 channel_input_oclose(int type, u_int32_t seq, void *ctxt) 2524 { 2525 int id = packet_get_int(); 2526 Channel *c = channel_lookup(id); 2527 2528 packet_check_eom(); 2529 if (c == NULL) 2530 packet_disconnect("Received oclose for nonexistent channel %d.", id); 2531 chan_rcvd_oclose(c); 2532 return 0; 2533 } 2534 2535 /* ARGSUSED */ 2536 int 2537 channel_input_close_confirmation(int type, u_int32_t seq, void *ctxt) 2538 { 2539 int id = packet_get_int(); 2540 Channel *c = channel_lookup(id); 2541 2542 packet_check_eom(); 2543 if (c == NULL) 2544 packet_disconnect("Received close confirmation for " 2545 "out-of-range channel %d.", id); 2546 if (c->type != SSH_CHANNEL_CLOSED && c->type != SSH_CHANNEL_ABANDONED) 2547 packet_disconnect("Received close confirmation for " 2548 "non-closed channel %d (type %d).", id, c->type); 2549 channel_free(c); 2550 return 0; 2551 } 2552 2553 /* ARGSUSED */ 2554 int 2555 channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt) 2556 { 2557 int id, remote_id; 2558 Channel *c; 2559 2560 id = packet_get_int(); 2561 c = channel_lookup(id); 2562 2563 if (c==NULL || c->type != SSH_CHANNEL_OPENING) 2564 packet_disconnect("Received open confirmation for " 2565 "non-opening channel %d.", id); 2566 remote_id = packet_get_int(); 2567 /* Record the remote channel number and mark that the channel is now open. */ 2568 c->remote_id = remote_id; 2569 c->type = SSH_CHANNEL_OPEN; 2570 2571 if (compat20) { 2572 c->remote_window = packet_get_int(); 2573 c->remote_maxpacket = packet_get_int(); 2574 if (c->open_confirm) { 2575 debug2("callback start"); 2576 c->open_confirm(c->self, 1, c->open_confirm_ctx); 2577 debug2("callback done"); 2578 } 2579 debug2("channel %d: open confirm rwindow %u rmax %u", c->self, 2580 c->remote_window, c->remote_maxpacket); 2581 } 2582 packet_check_eom(); 2583 return 0; 2584 } 2585 2586 static char * 2587 reason2txt(int reason) 2588 { 2589 switch (reason) { 2590 case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED: 2591 return "administratively prohibited"; 2592 case SSH2_OPEN_CONNECT_FAILED: 2593 return "connect failed"; 2594 case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE: 2595 return "unknown channel type"; 2596 case SSH2_OPEN_RESOURCE_SHORTAGE: 2597 return "resource shortage"; 2598 } 2599 return "unknown reason"; 2600 } 2601 2602 /* ARGSUSED */ 2603 int 2604 channel_input_open_failure(int type, u_int32_t seq, void *ctxt) 2605 { 2606 int id, reason; 2607 char *msg = NULL, *lang = NULL; 2608 Channel *c; 2609 2610 id = packet_get_int(); 2611 c = channel_lookup(id); 2612 2613 if (c==NULL || c->type != SSH_CHANNEL_OPENING) 2614 packet_disconnect("Received open failure for " 2615 "non-opening channel %d.", id); 2616 if (compat20) { 2617 reason = packet_get_int(); 2618 if (!(datafellows & SSH_BUG_OPENFAILURE)) { 2619 msg = packet_get_string(NULL); 2620 lang = packet_get_string(NULL); 2621 } 2622 logit("channel %d: open failed: %s%s%s", id, 2623 reason2txt(reason), msg ? ": ": "", msg ? msg : ""); 2624 free(msg); 2625 free(lang); 2626 if (c->open_confirm) { 2627 debug2("callback start"); 2628 c->open_confirm(c->self, 0, c->open_confirm_ctx); 2629 debug2("callback done"); 2630 } 2631 } 2632 packet_check_eom(); 2633 /* Schedule the channel for cleanup/deletion. */ 2634 chan_mark_dead(c); 2635 return 0; 2636 } 2637 2638 /* ARGSUSED */ 2639 int 2640 channel_input_window_adjust(int type, u_int32_t seq, void *ctxt) 2641 { 2642 Channel *c; 2643 int id; 2644 u_int adjust; 2645 2646 if (!compat20) 2647 return 0; 2648 2649 /* Get the channel number and verify it. */ 2650 id = packet_get_int(); 2651 c = channel_lookup(id); 2652 2653 if (c == NULL) { 2654 logit("Received window adjust for non-open channel %d.", id); 2655 return 0; 2656 } 2657 adjust = packet_get_int(); 2658 packet_check_eom(); 2659 debug2("channel %d: rcvd adjust %u", id, adjust); 2660 c->remote_window += adjust; 2661 return 0; 2662 } 2663 2664 /* ARGSUSED */ 2665 int 2666 channel_input_port_open(int type, u_int32_t seq, void *ctxt) 2667 { 2668 Channel *c = NULL; 2669 u_short host_port; 2670 char *host, *originator_string; 2671 int remote_id; 2672 2673 remote_id = packet_get_int(); 2674 host = packet_get_string(NULL); 2675 host_port = packet_get_int(); 2676 2677 if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) { 2678 originator_string = packet_get_string(NULL); 2679 } else { 2680 originator_string = xstrdup("unknown (remote did not supply name)"); 2681 } 2682 packet_check_eom(); 2683 c = channel_connect_to_port(host, host_port, 2684 "connected socket", originator_string); 2685 free(originator_string); 2686 free(host); 2687 if (c == NULL) { 2688 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 2689 packet_put_int(remote_id); 2690 packet_send(); 2691 } else 2692 c->remote_id = remote_id; 2693 return 0; 2694 } 2695 2696 /* ARGSUSED */ 2697 int 2698 channel_input_status_confirm(int type, u_int32_t seq, void *ctxt) 2699 { 2700 Channel *c; 2701 struct channel_confirm *cc; 2702 int id; 2703 2704 /* Reset keepalive timeout */ 2705 packet_set_alive_timeouts(0); 2706 2707 id = packet_get_int(); 2708 packet_check_eom(); 2709 2710 debug2("channel_input_status_confirm: type %d id %d", type, id); 2711 2712 if ((c = channel_lookup(id)) == NULL) { 2713 logit("channel_input_status_confirm: %d: unknown", id); 2714 return 0; 2715 } 2716 if ((cc = TAILQ_FIRST(&c->status_confirms)) == NULL) 2717 return 0; 2718 cc->cb(type, c, cc->ctx); 2719 TAILQ_REMOVE(&c->status_confirms, cc, entry); 2720 explicit_bzero(cc, sizeof(*cc)); 2721 free(cc); 2722 return 0; 2723 } 2724 2725 /* -- tcp forwarding */ 2726 2727 void 2728 channel_set_af(int af) 2729 { 2730 IPv4or6 = af; 2731 } 2732 2733 2734 /* 2735 * Determine whether or not a port forward listens to loopback, the 2736 * specified address or wildcard. On the client, a specified bind 2737 * address will always override gateway_ports. On the server, a 2738 * gateway_ports of 1 (``yes'') will override the client's specification 2739 * and force a wildcard bind, whereas a value of 2 (``clientspecified'') 2740 * will bind to whatever address the client asked for. 2741 * 2742 * Special-case listen_addrs are: 2743 * 2744 * "0.0.0.0" -> wildcard v4/v6 if SSH_OLD_FORWARD_ADDR 2745 * "" (empty string), "*" -> wildcard v4/v6 2746 * "localhost" -> loopback v4/v6 2747 * "127.0.0.1" / "::1" -> accepted even if gateway_ports isn't set 2748 */ 2749 static const char * 2750 channel_fwd_bind_addr(const char *listen_addr, int *wildcardp, 2751 int is_client, struct ForwardOptions *fwd_opts) 2752 { 2753 const char *addr = NULL; 2754 int wildcard = 0; 2755 2756 if (listen_addr == NULL) { 2757 /* No address specified: default to gateway_ports setting */ 2758 if (fwd_opts->gateway_ports) 2759 wildcard = 1; 2760 } else if (fwd_opts->gateway_ports || is_client) { 2761 if (((datafellows & SSH_OLD_FORWARD_ADDR) && 2762 strcmp(listen_addr, "0.0.0.0") == 0 && is_client == 0) || 2763 *listen_addr == '\0' || strcmp(listen_addr, "*") == 0 || 2764 (!is_client && fwd_opts->gateway_ports == 1)) { 2765 wildcard = 1; 2766 /* 2767 * Notify client if they requested a specific listen 2768 * address and it was overridden. 2769 */ 2770 if (*listen_addr != '\0' && 2771 strcmp(listen_addr, "0.0.0.0") != 0 && 2772 strcmp(listen_addr, "*") != 0) { 2773 packet_send_debug("Forwarding listen address " 2774 "\"%s\" overridden by server " 2775 "GatewayPorts", listen_addr); 2776 } 2777 } else if (strcmp(listen_addr, "localhost") != 0 || 2778 strcmp(listen_addr, "127.0.0.1") == 0 || 2779 strcmp(listen_addr, "::1") == 0) { 2780 /* Accept localhost address when GatewayPorts=yes */ 2781 addr = listen_addr; 2782 } 2783 } else if (strcmp(listen_addr, "127.0.0.1") == 0 || 2784 strcmp(listen_addr, "::1") == 0) { 2785 /* 2786 * If a specific IPv4/IPv6 localhost address has been 2787 * requested then accept it even if gateway_ports is in 2788 * effect. This allows the client to prefer IPv4 or IPv6. 2789 */ 2790 addr = listen_addr; 2791 } 2792 if (wildcardp != NULL) 2793 *wildcardp = wildcard; 2794 return addr; 2795 } 2796 2797 static int 2798 channel_setup_fwd_listener_tcpip(int type, struct Forward *fwd, 2799 int *allocated_listen_port, struct ForwardOptions *fwd_opts) 2800 { 2801 Channel *c; 2802 int sock, r, success = 0, wildcard = 0, is_client; 2803 struct addrinfo hints, *ai, *aitop; 2804 const char *host, *addr; 2805 char ntop[NI_MAXHOST], strport[NI_MAXSERV]; 2806 in_port_t *lport_p; 2807 2808 host = (type == SSH_CHANNEL_RPORT_LISTENER) ? 2809 fwd->listen_host : fwd->connect_host; 2810 is_client = (type == SSH_CHANNEL_PORT_LISTENER); 2811 2812 if (host == NULL) { 2813 error("No forward host name."); 2814 return 0; 2815 } 2816 if (strlen(host) >= NI_MAXHOST) { 2817 error("Forward host name too long."); 2818 return 0; 2819 } 2820 2821 /* Determine the bind address, cf. channel_fwd_bind_addr() comment */ 2822 addr = channel_fwd_bind_addr(fwd->listen_host, &wildcard, 2823 is_client, fwd_opts); 2824 debug3("%s: type %d wildcard %d addr %s", __func__, 2825 type, wildcard, (addr == NULL) ? "NULL" : addr); 2826 2827 /* 2828 * getaddrinfo returns a loopback address if the hostname is 2829 * set to NULL and hints.ai_flags is not AI_PASSIVE 2830 */ 2831 memset(&hints, 0, sizeof(hints)); 2832 hints.ai_family = IPv4or6; 2833 hints.ai_flags = wildcard ? AI_PASSIVE : 0; 2834 hints.ai_socktype = SOCK_STREAM; 2835 snprintf(strport, sizeof strport, "%d", fwd->listen_port); 2836 if ((r = getaddrinfo(addr, strport, &hints, &aitop)) != 0) { 2837 if (addr == NULL) { 2838 /* This really shouldn't happen */ 2839 packet_disconnect("getaddrinfo: fatal error: %s", 2840 ssh_gai_strerror(r)); 2841 } else { 2842 error("%s: getaddrinfo(%.64s): %s", __func__, addr, 2843 ssh_gai_strerror(r)); 2844 } 2845 return 0; 2846 } 2847 if (allocated_listen_port != NULL) 2848 *allocated_listen_port = 0; 2849 for (ai = aitop; ai; ai = ai->ai_next) { 2850 switch (ai->ai_family) { 2851 case AF_INET: 2852 lport_p = &((struct sockaddr_in *)ai->ai_addr)-> 2853 sin_port; 2854 break; 2855 case AF_INET6: 2856 lport_p = &((struct sockaddr_in6 *)ai->ai_addr)-> 2857 sin6_port; 2858 break; 2859 default: 2860 continue; 2861 } 2862 /* 2863 * If allocating a port for -R forwards, then use the 2864 * same port for all address families. 2865 */ 2866 if (type == SSH_CHANNEL_RPORT_LISTENER && fwd->listen_port == 0 && 2867 allocated_listen_port != NULL && *allocated_listen_port > 0) 2868 *lport_p = htons(*allocated_listen_port); 2869 2870 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), 2871 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { 2872 error("%s: getnameinfo failed", __func__); 2873 continue; 2874 } 2875 /* Create a port to listen for the host. */ 2876 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); 2877 if (sock < 0) { 2878 /* this is no error since kernel may not support ipv6 */ 2879 verbose("socket: %.100s", strerror(errno)); 2880 continue; 2881 } 2882 2883 channel_set_reuseaddr(sock); 2884 if (ai->ai_family == AF_INET6) 2885 sock_set_v6only(sock); 2886 2887 debug("Local forwarding listening on %s port %s.", 2888 ntop, strport); 2889 2890 /* Bind the socket to the address. */ 2891 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 2892 /* address can be in use ipv6 address is already bound */ 2893 if (!ai->ai_next) 2894 error("bind: %.100s", strerror(errno)); 2895 else 2896 verbose("bind: %.100s", strerror(errno)); 2897 2898 close(sock); 2899 continue; 2900 } 2901 /* Start listening for connections on the socket. */ 2902 if (listen(sock, SSH_LISTEN_BACKLOG) < 0) { 2903 error("listen: %.100s", strerror(errno)); 2904 close(sock); 2905 continue; 2906 } 2907 2908 /* 2909 * fwd->listen_port == 0 requests a dynamically allocated port - 2910 * record what we got. 2911 */ 2912 if (type == SSH_CHANNEL_RPORT_LISTENER && fwd->listen_port == 0 && 2913 allocated_listen_port != NULL && 2914 *allocated_listen_port == 0) { 2915 *allocated_listen_port = get_sock_port(sock, 1); 2916 debug("Allocated listen port %d", 2917 *allocated_listen_port); 2918 } 2919 2920 /* Allocate a channel number for the socket. */ 2921 c = channel_new("port listener", type, sock, sock, -1, 2922 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 2923 0, "port listener", 1); 2924 c->path = xstrdup(host); 2925 c->host_port = fwd->connect_port; 2926 c->listening_addr = addr == NULL ? NULL : xstrdup(addr); 2927 if (fwd->listen_port == 0 && allocated_listen_port != NULL && 2928 !(datafellows & SSH_BUG_DYNAMIC_RPORT)) 2929 c->listening_port = *allocated_listen_port; 2930 else 2931 c->listening_port = fwd->listen_port; 2932 success = 1; 2933 } 2934 if (success == 0) 2935 error("%s: cannot listen to port: %d", __func__, 2936 fwd->listen_port); 2937 freeaddrinfo(aitop); 2938 return success; 2939 } 2940 2941 static int 2942 channel_setup_fwd_listener_streamlocal(int type, struct Forward *fwd, 2943 struct ForwardOptions *fwd_opts) 2944 { 2945 struct sockaddr_un sunaddr; 2946 const char *path; 2947 Channel *c; 2948 int port, sock; 2949 mode_t omask; 2950 2951 switch (type) { 2952 case SSH_CHANNEL_UNIX_LISTENER: 2953 if (fwd->connect_path != NULL) { 2954 if (strlen(fwd->connect_path) > sizeof(sunaddr.sun_path)) { 2955 error("Local connecting path too long: %s", 2956 fwd->connect_path); 2957 return 0; 2958 } 2959 path = fwd->connect_path; 2960 port = PORT_STREAMLOCAL; 2961 } else { 2962 if (fwd->connect_host == NULL) { 2963 error("No forward host name."); 2964 return 0; 2965 } 2966 if (strlen(fwd->connect_host) >= NI_MAXHOST) { 2967 error("Forward host name too long."); 2968 return 0; 2969 } 2970 path = fwd->connect_host; 2971 port = fwd->connect_port; 2972 } 2973 break; 2974 case SSH_CHANNEL_RUNIX_LISTENER: 2975 path = fwd->listen_path; 2976 port = PORT_STREAMLOCAL; 2977 break; 2978 default: 2979 error("%s: unexpected channel type %d", __func__, type); 2980 return 0; 2981 } 2982 2983 if (fwd->listen_path == NULL) { 2984 error("No forward path name."); 2985 return 0; 2986 } 2987 if (strlen(fwd->listen_path) > sizeof(sunaddr.sun_path)) { 2988 error("Local listening path too long: %s", fwd->listen_path); 2989 return 0; 2990 } 2991 2992 debug3("%s: type %d path %s", __func__, type, fwd->listen_path); 2993 2994 /* Start a Unix domain listener. */ 2995 omask = umask(fwd_opts->streamlocal_bind_mask); 2996 sock = unix_listener(fwd->listen_path, SSH_LISTEN_BACKLOG, 2997 fwd_opts->streamlocal_bind_unlink); 2998 umask(omask); 2999 if (sock < 0) 3000 return 0; 3001 3002 debug("Local forwarding listening on path %s.", fwd->listen_path); 3003 3004 /* Allocate a channel number for the socket. */ 3005 c = channel_new("unix listener", type, sock, sock, -1, 3006 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 3007 0, "unix listener", 1); 3008 c->path = xstrdup(path); 3009 c->host_port = port; 3010 c->listening_port = PORT_STREAMLOCAL; 3011 c->listening_addr = xstrdup(fwd->listen_path); 3012 return 1; 3013 } 3014 3015 static int 3016 channel_cancel_rport_listener_tcpip(const char *host, u_short port) 3017 { 3018 u_int i; 3019 int found = 0; 3020 3021 for (i = 0; i < channels_alloc; i++) { 3022 Channel *c = channels[i]; 3023 if (c == NULL || c->type != SSH_CHANNEL_RPORT_LISTENER) 3024 continue; 3025 if (strcmp(c->path, host) == 0 && c->listening_port == port) { 3026 debug2("%s: close channel %d", __func__, i); 3027 channel_free(c); 3028 found = 1; 3029 } 3030 } 3031 3032 return (found); 3033 } 3034 3035 static int 3036 channel_cancel_rport_listener_streamlocal(const char *path) 3037 { 3038 u_int i; 3039 int found = 0; 3040 3041 for (i = 0; i < channels_alloc; i++) { 3042 Channel *c = channels[i]; 3043 if (c == NULL || c->type != SSH_CHANNEL_RUNIX_LISTENER) 3044 continue; 3045 if (c->path == NULL) 3046 continue; 3047 if (strcmp(c->path, path) == 0) { 3048 debug2("%s: close channel %d", __func__, i); 3049 channel_free(c); 3050 found = 1; 3051 } 3052 } 3053 3054 return (found); 3055 } 3056 3057 int 3058 channel_cancel_rport_listener(struct Forward *fwd) 3059 { 3060 if (fwd->listen_path != NULL) 3061 return channel_cancel_rport_listener_streamlocal(fwd->listen_path); 3062 else 3063 return channel_cancel_rport_listener_tcpip(fwd->listen_host, fwd->listen_port); 3064 } 3065 3066 static int 3067 channel_cancel_lport_listener_tcpip(const char *lhost, u_short lport, 3068 int cport, struct ForwardOptions *fwd_opts) 3069 { 3070 u_int i; 3071 int found = 0; 3072 const char *addr = channel_fwd_bind_addr(lhost, NULL, 1, fwd_opts); 3073 3074 for (i = 0; i < channels_alloc; i++) { 3075 Channel *c = channels[i]; 3076 if (c == NULL || c->type != SSH_CHANNEL_PORT_LISTENER) 3077 continue; 3078 if (c->listening_port != lport) 3079 continue; 3080 if (cport == CHANNEL_CANCEL_PORT_STATIC) { 3081 /* skip dynamic forwardings */ 3082 if (c->host_port == 0) 3083 continue; 3084 } else { 3085 if (c->host_port != cport) 3086 continue; 3087 } 3088 if ((c->listening_addr == NULL && addr != NULL) || 3089 (c->listening_addr != NULL && addr == NULL)) 3090 continue; 3091 if (addr == NULL || strcmp(c->listening_addr, addr) == 0) { 3092 debug2("%s: close channel %d", __func__, i); 3093 channel_free(c); 3094 found = 1; 3095 } 3096 } 3097 3098 return (found); 3099 } 3100 3101 static int 3102 channel_cancel_lport_listener_streamlocal(const char *path) 3103 { 3104 u_int i; 3105 int found = 0; 3106 3107 if (path == NULL) { 3108 error("%s: no path specified.", __func__); 3109 return 0; 3110 } 3111 3112 for (i = 0; i < channels_alloc; i++) { 3113 Channel *c = channels[i]; 3114 if (c == NULL || c->type != SSH_CHANNEL_UNIX_LISTENER) 3115 continue; 3116 if (c->listening_addr == NULL) 3117 continue; 3118 if (strcmp(c->listening_addr, path) == 0) { 3119 debug2("%s: close channel %d", __func__, i); 3120 channel_free(c); 3121 found = 1; 3122 } 3123 } 3124 3125 return (found); 3126 } 3127 3128 int 3129 channel_cancel_lport_listener(struct Forward *fwd, int cport, struct ForwardOptions *fwd_opts) 3130 { 3131 if (fwd->listen_path != NULL) 3132 return channel_cancel_lport_listener_streamlocal(fwd->listen_path); 3133 else 3134 return channel_cancel_lport_listener_tcpip(fwd->listen_host, fwd->listen_port, cport, fwd_opts); 3135 } 3136 3137 /* protocol local port fwd, used by ssh (and sshd in v1) */ 3138 int 3139 channel_setup_local_fwd_listener(struct Forward *fwd, struct ForwardOptions *fwd_opts) 3140 { 3141 if (fwd->listen_path != NULL) { 3142 return channel_setup_fwd_listener_streamlocal( 3143 SSH_CHANNEL_UNIX_LISTENER, fwd, fwd_opts); 3144 } else { 3145 return channel_setup_fwd_listener_tcpip(SSH_CHANNEL_PORT_LISTENER, 3146 fwd, NULL, fwd_opts); 3147 } 3148 } 3149 3150 /* protocol v2 remote port fwd, used by sshd */ 3151 int 3152 channel_setup_remote_fwd_listener(struct Forward *fwd, 3153 int *allocated_listen_port, struct ForwardOptions *fwd_opts) 3154 { 3155 if (fwd->listen_path != NULL) { 3156 return channel_setup_fwd_listener_streamlocal( 3157 SSH_CHANNEL_RUNIX_LISTENER, fwd, fwd_opts); 3158 } else { 3159 return channel_setup_fwd_listener_tcpip( 3160 SSH_CHANNEL_RPORT_LISTENER, fwd, allocated_listen_port, 3161 fwd_opts); 3162 } 3163 } 3164 3165 /* 3166 * Translate the requested rfwd listen host to something usable for 3167 * this server. 3168 */ 3169 static const char * 3170 channel_rfwd_bind_host(const char *listen_host) 3171 { 3172 if (listen_host == NULL) { 3173 if (datafellows & SSH_BUG_RFWD_ADDR) 3174 return "127.0.0.1"; 3175 else 3176 return "localhost"; 3177 } else if (*listen_host == '\0' || strcmp(listen_host, "*") == 0) { 3178 if (datafellows & SSH_BUG_RFWD_ADDR) 3179 return "0.0.0.0"; 3180 else 3181 return ""; 3182 } else 3183 return listen_host; 3184 } 3185 3186 /* 3187 * Initiate forwarding of connections to port "port" on remote host through 3188 * the secure channel to host:port from local side. 3189 * Returns handle (index) for updating the dynamic listen port with 3190 * channel_update_permitted_opens(). 3191 */ 3192 int 3193 channel_request_remote_forwarding(struct Forward *fwd) 3194 { 3195 int type, success = 0, idx = -1; 3196 3197 /* Send the forward request to the remote side. */ 3198 if (compat20) { 3199 packet_start(SSH2_MSG_GLOBAL_REQUEST); 3200 if (fwd->listen_path != NULL) { 3201 packet_put_cstring("streamlocal-forward (at) openssh.com"); 3202 packet_put_char(1); /* boolean: want reply */ 3203 packet_put_cstring(fwd->listen_path); 3204 } else { 3205 packet_put_cstring("tcpip-forward"); 3206 packet_put_char(1); /* boolean: want reply */ 3207 packet_put_cstring(channel_rfwd_bind_host(fwd->listen_host)); 3208 packet_put_int(fwd->listen_port); 3209 } 3210 packet_send(); 3211 packet_write_wait(); 3212 /* Assume that server accepts the request */ 3213 success = 1; 3214 } else if (fwd->listen_path == NULL) { 3215 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST); 3216 packet_put_int(fwd->listen_port); 3217 packet_put_cstring(fwd->connect_host); 3218 packet_put_int(fwd->connect_port); 3219 packet_send(); 3220 packet_write_wait(); 3221 3222 /* Wait for response from the remote side. */ 3223 type = packet_read(); 3224 switch (type) { 3225 case SSH_SMSG_SUCCESS: 3226 success = 1; 3227 break; 3228 case SSH_SMSG_FAILURE: 3229 break; 3230 default: 3231 /* Unknown packet */ 3232 packet_disconnect("Protocol error for port forward request:" 3233 "received packet type %d.", type); 3234 } 3235 } else { 3236 logit("Warning: Server does not support remote stream local forwarding."); 3237 } 3238 if (success) { 3239 /* Record that connection to this host/port is permitted. */ 3240 permitted_opens = xrealloc(permitted_opens, 3241 num_permitted_opens + 1, sizeof(*permitted_opens)); 3242 idx = num_permitted_opens++; 3243 if (fwd->connect_path != NULL) { 3244 permitted_opens[idx].host_to_connect = 3245 xstrdup(fwd->connect_path); 3246 permitted_opens[idx].port_to_connect = 3247 PORT_STREAMLOCAL; 3248 } else { 3249 permitted_opens[idx].host_to_connect = 3250 xstrdup(fwd->connect_host); 3251 permitted_opens[idx].port_to_connect = 3252 fwd->connect_port; 3253 } 3254 if (fwd->listen_path != NULL) { 3255 permitted_opens[idx].listen_host = NULL; 3256 permitted_opens[idx].listen_path = 3257 xstrdup(fwd->listen_path); 3258 permitted_opens[idx].listen_port = PORT_STREAMLOCAL; 3259 } else { 3260 permitted_opens[idx].listen_host = 3261 fwd->listen_host ? xstrdup(fwd->listen_host) : NULL; 3262 permitted_opens[idx].listen_path = NULL; 3263 permitted_opens[idx].listen_port = fwd->listen_port; 3264 } 3265 } 3266 return (idx); 3267 } 3268 3269 static int 3270 open_match(ForwardPermission *allowed_open, const char *requestedhost, 3271 int requestedport) 3272 { 3273 if (allowed_open->host_to_connect == NULL) 3274 return 0; 3275 if (allowed_open->port_to_connect != FWD_PERMIT_ANY_PORT && 3276 allowed_open->port_to_connect != requestedport) 3277 return 0; 3278 if (strcmp(allowed_open->host_to_connect, requestedhost) != 0) 3279 return 0; 3280 return 1; 3281 } 3282 3283 /* 3284 * Note that in the listen host/port case 3285 * we don't support FWD_PERMIT_ANY_PORT and 3286 * need to translate between the configured-host (listen_host) 3287 * and what we've sent to the remote server (channel_rfwd_bind_host) 3288 */ 3289 static int 3290 open_listen_match_tcpip(ForwardPermission *allowed_open, 3291 const char *requestedhost, u_short requestedport, int translate) 3292 { 3293 const char *allowed_host; 3294 3295 if (allowed_open->host_to_connect == NULL) 3296 return 0; 3297 if (allowed_open->listen_port != requestedport) 3298 return 0; 3299 if (!translate && allowed_open->listen_host == NULL && 3300 requestedhost == NULL) 3301 return 1; 3302 allowed_host = translate ? 3303 channel_rfwd_bind_host(allowed_open->listen_host) : 3304 allowed_open->listen_host; 3305 if (allowed_host == NULL || 3306 strcmp(allowed_host, requestedhost) != 0) 3307 return 0; 3308 return 1; 3309 } 3310 3311 static int 3312 open_listen_match_streamlocal(ForwardPermission *allowed_open, 3313 const char *requestedpath) 3314 { 3315 if (allowed_open->host_to_connect == NULL) 3316 return 0; 3317 if (allowed_open->listen_port != PORT_STREAMLOCAL) 3318 return 0; 3319 if (allowed_open->listen_path == NULL || 3320 strcmp(allowed_open->listen_path, requestedpath) != 0) 3321 return 0; 3322 return 1; 3323 } 3324 3325 /* 3326 * Request cancellation of remote forwarding of connection host:port from 3327 * local side. 3328 */ 3329 static int 3330 channel_request_rforward_cancel_tcpip(const char *host, u_short port) 3331 { 3332 int i; 3333 3334 if (!compat20) 3335 return -1; 3336 3337 for (i = 0; i < num_permitted_opens; i++) { 3338 if (open_listen_match_tcpip(&permitted_opens[i], host, port, 0)) 3339 break; 3340 } 3341 if (i >= num_permitted_opens) { 3342 debug("%s: requested forward not found", __func__); 3343 return -1; 3344 } 3345 packet_start(SSH2_MSG_GLOBAL_REQUEST); 3346 packet_put_cstring("cancel-tcpip-forward"); 3347 packet_put_char(0); 3348 packet_put_cstring(channel_rfwd_bind_host(host)); 3349 packet_put_int(port); 3350 packet_send(); 3351 3352 permitted_opens[i].listen_port = 0; 3353 permitted_opens[i].port_to_connect = 0; 3354 free(permitted_opens[i].host_to_connect); 3355 permitted_opens[i].host_to_connect = NULL; 3356 free(permitted_opens[i].listen_host); 3357 permitted_opens[i].listen_host = NULL; 3358 permitted_opens[i].listen_path = NULL; 3359 3360 return 0; 3361 } 3362 3363 /* 3364 * Request cancellation of remote forwarding of Unix domain socket 3365 * path from local side. 3366 */ 3367 static int 3368 channel_request_rforward_cancel_streamlocal(const char *path) 3369 { 3370 int i; 3371 3372 if (!compat20) 3373 return -1; 3374 3375 for (i = 0; i < num_permitted_opens; i++) { 3376 if (open_listen_match_streamlocal(&permitted_opens[i], path)) 3377 break; 3378 } 3379 if (i >= num_permitted_opens) { 3380 debug("%s: requested forward not found", __func__); 3381 return -1; 3382 } 3383 packet_start(SSH2_MSG_GLOBAL_REQUEST); 3384 packet_put_cstring("cancel-streamlocal-forward (at) openssh.com"); 3385 packet_put_char(0); 3386 packet_put_cstring(path); 3387 packet_send(); 3388 3389 permitted_opens[i].listen_port = 0; 3390 permitted_opens[i].port_to_connect = 0; 3391 free(permitted_opens[i].host_to_connect); 3392 permitted_opens[i].host_to_connect = NULL; 3393 permitted_opens[i].listen_host = NULL; 3394 free(permitted_opens[i].listen_path); 3395 permitted_opens[i].listen_path = NULL; 3396 3397 return 0; 3398 } 3399 3400 /* 3401 * Request cancellation of remote forwarding of a connection from local side. 3402 */ 3403 int 3404 channel_request_rforward_cancel(struct Forward *fwd) 3405 { 3406 if (fwd->listen_path != NULL) { 3407 return (channel_request_rforward_cancel_streamlocal( 3408 fwd->listen_path)); 3409 } else { 3410 return (channel_request_rforward_cancel_tcpip(fwd->listen_host, 3411 fwd->listen_port ? fwd->listen_port : fwd->allocated_port)); 3412 } 3413 } 3414 3415 /* 3416 * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates 3417 * listening for the port, and sends back a success reply (or disconnect 3418 * message if there was an error). 3419 */ 3420 int 3421 channel_input_port_forward_request(int is_root, struct ForwardOptions *fwd_opts) 3422 { 3423 int success = 0; 3424 struct Forward fwd; 3425 3426 /* Get arguments from the packet. */ 3427 memset(&fwd, 0, sizeof(fwd)); 3428 fwd.listen_port = packet_get_int(); 3429 fwd.connect_host = packet_get_string(NULL); 3430 fwd.connect_port = packet_get_int(); 3431 3432 #ifndef HAVE_CYGWIN 3433 /* 3434 * Check that an unprivileged user is not trying to forward a 3435 * privileged port. 3436 */ 3437 if (fwd.listen_port < IPPORT_RESERVED && !is_root) 3438 packet_disconnect( 3439 "Requested forwarding of port %d but user is not root.", 3440 fwd.listen_port); 3441 if (fwd.connect_port == 0) 3442 packet_disconnect("Dynamic forwarding denied."); 3443 #endif 3444 3445 /* Initiate forwarding */ 3446 success = channel_setup_local_fwd_listener(&fwd, fwd_opts); 3447 3448 /* Free the argument string. */ 3449 free(fwd.connect_host); 3450 3451 return (success ? 0 : -1); 3452 } 3453 3454 /* 3455 * Permits opening to any host/port if permitted_opens[] is empty. This is 3456 * usually called by the server, because the user could connect to any port 3457 * anyway, and the server has no way to know but to trust the client anyway. 3458 */ 3459 void 3460 channel_permit_all_opens(void) 3461 { 3462 if (num_permitted_opens == 0) 3463 all_opens_permitted = 1; 3464 } 3465 3466 void 3467 channel_add_permitted_opens(char *host, int port) 3468 { 3469 debug("allow port forwarding to host %s port %d", host, port); 3470 3471 permitted_opens = xrealloc(permitted_opens, 3472 num_permitted_opens + 1, sizeof(*permitted_opens)); 3473 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host); 3474 permitted_opens[num_permitted_opens].port_to_connect = port; 3475 permitted_opens[num_permitted_opens].listen_host = NULL; 3476 permitted_opens[num_permitted_opens].listen_path = NULL; 3477 permitted_opens[num_permitted_opens].listen_port = 0; 3478 num_permitted_opens++; 3479 3480 all_opens_permitted = 0; 3481 } 3482 3483 /* 3484 * Update the listen port for a dynamic remote forward, after 3485 * the actual 'newport' has been allocated. If 'newport' < 0 is 3486 * passed then they entry will be invalidated. 3487 */ 3488 void 3489 channel_update_permitted_opens(int idx, int newport) 3490 { 3491 if (idx < 0 || idx >= num_permitted_opens) { 3492 debug("channel_update_permitted_opens: index out of range:" 3493 " %d num_permitted_opens %d", idx, num_permitted_opens); 3494 return; 3495 } 3496 debug("%s allowed port %d for forwarding to host %s port %d", 3497 newport > 0 ? "Updating" : "Removing", 3498 newport, 3499 permitted_opens[idx].host_to_connect, 3500 permitted_opens[idx].port_to_connect); 3501 if (newport >= 0) { 3502 permitted_opens[idx].listen_port = 3503 (datafellows & SSH_BUG_DYNAMIC_RPORT) ? 0 : newport; 3504 } else { 3505 permitted_opens[idx].listen_port = 0; 3506 permitted_opens[idx].port_to_connect = 0; 3507 free(permitted_opens[idx].host_to_connect); 3508 permitted_opens[idx].host_to_connect = NULL; 3509 free(permitted_opens[idx].listen_host); 3510 permitted_opens[idx].listen_host = NULL; 3511 free(permitted_opens[idx].listen_path); 3512 permitted_opens[idx].listen_path = NULL; 3513 } 3514 } 3515 3516 int 3517 channel_add_adm_permitted_opens(char *host, int port) 3518 { 3519 debug("config allows port forwarding to host %s port %d", host, port); 3520 3521 permitted_adm_opens = xrealloc(permitted_adm_opens, 3522 num_adm_permitted_opens + 1, sizeof(*permitted_adm_opens)); 3523 permitted_adm_opens[num_adm_permitted_opens].host_to_connect 3524 = xstrdup(host); 3525 permitted_adm_opens[num_adm_permitted_opens].port_to_connect = port; 3526 permitted_adm_opens[num_adm_permitted_opens].listen_host = NULL; 3527 permitted_adm_opens[num_adm_permitted_opens].listen_path = NULL; 3528 permitted_adm_opens[num_adm_permitted_opens].listen_port = 0; 3529 return ++num_adm_permitted_opens; 3530 } 3531 3532 void 3533 channel_disable_adm_local_opens(void) 3534 { 3535 channel_clear_adm_permitted_opens(); 3536 permitted_adm_opens = xmalloc(sizeof(*permitted_adm_opens)); 3537 permitted_adm_opens[num_adm_permitted_opens].host_to_connect = NULL; 3538 num_adm_permitted_opens = 1; 3539 } 3540 3541 void 3542 channel_clear_permitted_opens(void) 3543 { 3544 int i; 3545 3546 for (i = 0; i < num_permitted_opens; i++) { 3547 free(permitted_opens[i].host_to_connect); 3548 free(permitted_opens[i].listen_host); 3549 free(permitted_opens[i].listen_path); 3550 } 3551 free(permitted_opens); 3552 permitted_opens = NULL; 3553 num_permitted_opens = 0; 3554 } 3555 3556 void 3557 channel_clear_adm_permitted_opens(void) 3558 { 3559 int i; 3560 3561 for (i = 0; i < num_adm_permitted_opens; i++) { 3562 free(permitted_adm_opens[i].host_to_connect); 3563 free(permitted_adm_opens[i].listen_host); 3564 free(permitted_adm_opens[i].listen_path); 3565 } 3566 free(permitted_adm_opens); 3567 permitted_adm_opens = NULL; 3568 num_adm_permitted_opens = 0; 3569 } 3570 3571 void 3572 channel_print_adm_permitted_opens(void) 3573 { 3574 int i; 3575 3576 printf("permitopen"); 3577 if (num_adm_permitted_opens == 0) { 3578 printf(" any\n"); 3579 return; 3580 } 3581 for (i = 0; i < num_adm_permitted_opens; i++) 3582 if (permitted_adm_opens[i].host_to_connect == NULL) 3583 printf(" none"); 3584 else 3585 printf(" %s:%d", permitted_adm_opens[i].host_to_connect, 3586 permitted_adm_opens[i].port_to_connect); 3587 printf("\n"); 3588 } 3589 3590 /* returns port number, FWD_PERMIT_ANY_PORT or -1 on error */ 3591 int 3592 permitopen_port(const char *p) 3593 { 3594 int port; 3595 3596 if (strcmp(p, "*") == 0) 3597 return FWD_PERMIT_ANY_PORT; 3598 if ((port = a2port(p)) > 0) 3599 return port; 3600 return -1; 3601 } 3602 3603 /* Try to start non-blocking connect to next host in cctx list */ 3604 static int 3605 connect_next(struct channel_connect *cctx) 3606 { 3607 int sock, saved_errno; 3608 struct sockaddr_un *sunaddr; 3609 char ntop[NI_MAXHOST], strport[MAX(NI_MAXSERV,sizeof(sunaddr->sun_path))]; 3610 3611 for (; cctx->ai; cctx->ai = cctx->ai->ai_next) { 3612 switch (cctx->ai->ai_family) { 3613 case AF_UNIX: 3614 /* unix:pathname instead of host:port */ 3615 sunaddr = (struct sockaddr_un *)cctx->ai->ai_addr; 3616 strlcpy(ntop, "unix", sizeof(ntop)); 3617 strlcpy(strport, sunaddr->sun_path, sizeof(strport)); 3618 break; 3619 case AF_INET: 3620 case AF_INET6: 3621 if (getnameinfo(cctx->ai->ai_addr, cctx->ai->ai_addrlen, 3622 ntop, sizeof(ntop), strport, sizeof(strport), 3623 NI_NUMERICHOST|NI_NUMERICSERV) != 0) { 3624 error("connect_next: getnameinfo failed"); 3625 continue; 3626 } 3627 break; 3628 default: 3629 continue; 3630 } 3631 if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype, 3632 cctx->ai->ai_protocol)) == -1) { 3633 if (cctx->ai->ai_next == NULL) 3634 error("socket: %.100s", strerror(errno)); 3635 else 3636 verbose("socket: %.100s", strerror(errno)); 3637 continue; 3638 } 3639 if (set_nonblock(sock) == -1) 3640 fatal("%s: set_nonblock(%d)", __func__, sock); 3641 if (connect(sock, cctx->ai->ai_addr, 3642 cctx->ai->ai_addrlen) == -1 && errno != EINPROGRESS) { 3643 debug("connect_next: host %.100s ([%.100s]:%s): " 3644 "%.100s", cctx->host, ntop, strport, 3645 strerror(errno)); 3646 saved_errno = errno; 3647 close(sock); 3648 errno = saved_errno; 3649 continue; /* fail -- try next */ 3650 } 3651 if (cctx->ai->ai_family != AF_UNIX) 3652 set_nodelay(sock); 3653 debug("connect_next: host %.100s ([%.100s]:%s) " 3654 "in progress, fd=%d", cctx->host, ntop, strport, sock); 3655 cctx->ai = cctx->ai->ai_next; 3656 return sock; 3657 } 3658 return -1; 3659 } 3660 3661 static void 3662 channel_connect_ctx_free(struct channel_connect *cctx) 3663 { 3664 free(cctx->host); 3665 if (cctx->aitop) { 3666 if (cctx->aitop->ai_family == AF_UNIX) 3667 free(cctx->aitop); 3668 else 3669 freeaddrinfo(cctx->aitop); 3670 } 3671 memset(cctx, 0, sizeof(*cctx)); 3672 } 3673 3674 /* Return CONNECTING channel to remote host:port or local socket path */ 3675 static Channel * 3676 connect_to(const char *name, int port, char *ctype, char *rname) 3677 { 3678 struct addrinfo hints; 3679 int gaierr; 3680 int sock = -1; 3681 char strport[NI_MAXSERV]; 3682 struct channel_connect cctx; 3683 Channel *c; 3684 3685 memset(&cctx, 0, sizeof(cctx)); 3686 3687 if (port == PORT_STREAMLOCAL) { 3688 struct sockaddr_un *sunaddr; 3689 struct addrinfo *ai; 3690 3691 if (strlen(name) > sizeof(sunaddr->sun_path)) { 3692 error("%.100s: %.100s", name, strerror(ENAMETOOLONG)); 3693 return (NULL); 3694 } 3695 3696 /* 3697 * Fake up a struct addrinfo for AF_UNIX connections. 3698 * channel_connect_ctx_free() must check ai_family 3699 * and use free() not freeaddirinfo() for AF_UNIX. 3700 */ 3701 ai = xmalloc(sizeof(*ai) + sizeof(*sunaddr)); 3702 memset(ai, 0, sizeof(*ai) + sizeof(*sunaddr)); 3703 ai->ai_addr = (struct sockaddr *)(ai + 1); 3704 ai->ai_addrlen = sizeof(*sunaddr); 3705 ai->ai_family = AF_UNIX; 3706 ai->ai_socktype = SOCK_STREAM; 3707 ai->ai_protocol = PF_UNSPEC; 3708 sunaddr = (struct sockaddr_un *)ai->ai_addr; 3709 sunaddr->sun_family = AF_UNIX; 3710 strlcpy(sunaddr->sun_path, name, sizeof(sunaddr->sun_path)); 3711 cctx.aitop = ai; 3712 } else { 3713 memset(&hints, 0, sizeof(hints)); 3714 hints.ai_family = IPv4or6; 3715 hints.ai_socktype = SOCK_STREAM; 3716 snprintf(strport, sizeof strport, "%d", port); 3717 if ((gaierr = getaddrinfo(name, strport, &hints, &cctx.aitop)) != 0) { 3718 error("connect_to %.100s: unknown host (%s)", name, 3719 ssh_gai_strerror(gaierr)); 3720 return NULL; 3721 } 3722 } 3723 3724 cctx.host = xstrdup(name); 3725 cctx.port = port; 3726 cctx.ai = cctx.aitop; 3727 3728 if ((sock = connect_next(&cctx)) == -1) { 3729 error("connect to %.100s port %d failed: %s", 3730 name, port, strerror(errno)); 3731 channel_connect_ctx_free(&cctx); 3732 return NULL; 3733 } 3734 c = channel_new(ctype, SSH_CHANNEL_CONNECTING, sock, sock, -1, 3735 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, rname, 1); 3736 c->connect_ctx = cctx; 3737 return c; 3738 } 3739 3740 Channel * 3741 channel_connect_by_listen_address(const char *listen_host, 3742 u_short listen_port, char *ctype, char *rname) 3743 { 3744 int i; 3745 3746 for (i = 0; i < num_permitted_opens; i++) { 3747 if (open_listen_match_tcpip(&permitted_opens[i], listen_host, 3748 listen_port, 1)) { 3749 return connect_to( 3750 permitted_opens[i].host_to_connect, 3751 permitted_opens[i].port_to_connect, ctype, rname); 3752 } 3753 } 3754 error("WARNING: Server requests forwarding for unknown listen_port %d", 3755 listen_port); 3756 return NULL; 3757 } 3758 3759 Channel * 3760 channel_connect_by_listen_path(const char *path, char *ctype, char *rname) 3761 { 3762 int i; 3763 3764 for (i = 0; i < num_permitted_opens; i++) { 3765 if (open_listen_match_streamlocal(&permitted_opens[i], path)) { 3766 return connect_to( 3767 permitted_opens[i].host_to_connect, 3768 permitted_opens[i].port_to_connect, ctype, rname); 3769 } 3770 } 3771 error("WARNING: Server requests forwarding for unknown path %.100s", 3772 path); 3773 return NULL; 3774 } 3775 3776 /* Check if connecting to that port is permitted and connect. */ 3777 Channel * 3778 channel_connect_to_port(const char *host, u_short port, char *ctype, char *rname) 3779 { 3780 int i, permit, permit_adm = 1; 3781 3782 permit = all_opens_permitted; 3783 if (!permit) { 3784 for (i = 0; i < num_permitted_opens; i++) 3785 if (open_match(&permitted_opens[i], host, port)) { 3786 permit = 1; 3787 break; 3788 } 3789 } 3790 3791 if (num_adm_permitted_opens > 0) { 3792 permit_adm = 0; 3793 for (i = 0; i < num_adm_permitted_opens; i++) 3794 if (open_match(&permitted_adm_opens[i], host, port)) { 3795 permit_adm = 1; 3796 break; 3797 } 3798 } 3799 3800 if (!permit || !permit_adm) { 3801 logit("Received request to connect to host %.100s port %d, " 3802 "but the request was denied.", host, port); 3803 return NULL; 3804 } 3805 return connect_to(host, port, ctype, rname); 3806 } 3807 3808 /* Check if connecting to that path is permitted and connect. */ 3809 Channel * 3810 channel_connect_to_path(const char *path, char *ctype, char *rname) 3811 { 3812 int i, permit, permit_adm = 1; 3813 3814 permit = all_opens_permitted; 3815 if (!permit) { 3816 for (i = 0; i < num_permitted_opens; i++) 3817 if (open_match(&permitted_opens[i], path, PORT_STREAMLOCAL)) { 3818 permit = 1; 3819 break; 3820 } 3821 } 3822 3823 if (num_adm_permitted_opens > 0) { 3824 permit_adm = 0; 3825 for (i = 0; i < num_adm_permitted_opens; i++) 3826 if (open_match(&permitted_adm_opens[i], path, PORT_STREAMLOCAL)) { 3827 permit_adm = 1; 3828 break; 3829 } 3830 } 3831 3832 if (!permit || !permit_adm) { 3833 logit("Received request to connect to path %.100s, " 3834 "but the request was denied.", path); 3835 return NULL; 3836 } 3837 return connect_to(path, PORT_STREAMLOCAL, ctype, rname); 3838 } 3839 3840 void 3841 channel_send_window_changes(void) 3842 { 3843 u_int i; 3844 struct winsize ws; 3845 3846 for (i = 0; i < channels_alloc; i++) { 3847 if (channels[i] == NULL || !channels[i]->client_tty || 3848 channels[i]->type != SSH_CHANNEL_OPEN) 3849 continue; 3850 if (ioctl(channels[i]->rfd, TIOCGWINSZ, &ws) < 0) 3851 continue; 3852 channel_request_start(i, "window-change", 0); 3853 packet_put_int((u_int)ws.ws_col); 3854 packet_put_int((u_int)ws.ws_row); 3855 packet_put_int((u_int)ws.ws_xpixel); 3856 packet_put_int((u_int)ws.ws_ypixel); 3857 packet_send(); 3858 } 3859 } 3860 3861 /* -- X11 forwarding */ 3862 3863 /* 3864 * Creates an internet domain socket for listening for X11 connections. 3865 * Returns 0 and a suitable display number for the DISPLAY variable 3866 * stored in display_numberp , or -1 if an error occurs. 3867 */ 3868 int 3869 x11_create_display_inet(int x11_display_offset, int x11_use_localhost, 3870 int single_connection, u_int *display_numberp, int **chanids) 3871 { 3872 Channel *nc = NULL; 3873 int display_number, sock; 3874 u_short port; 3875 struct addrinfo hints, *ai, *aitop; 3876 char strport[NI_MAXSERV]; 3877 int gaierr, n, num_socks = 0, socks[NUM_SOCKS]; 3878 3879 if (chanids == NULL) 3880 return -1; 3881 3882 for (display_number = x11_display_offset; 3883 display_number < MAX_DISPLAYS; 3884 display_number++) { 3885 port = 6000 + display_number; 3886 memset(&hints, 0, sizeof(hints)); 3887 hints.ai_family = IPv4or6; 3888 hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE; 3889 hints.ai_socktype = SOCK_STREAM; 3890 snprintf(strport, sizeof strport, "%d", port); 3891 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) { 3892 error("getaddrinfo: %.100s", ssh_gai_strerror(gaierr)); 3893 return -1; 3894 } 3895 for (ai = aitop; ai; ai = ai->ai_next) { 3896 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) 3897 continue; 3898 sock = socket(ai->ai_family, ai->ai_socktype, 3899 ai->ai_protocol); 3900 if (sock < 0) { 3901 if ((errno != EINVAL) && (errno != EAFNOSUPPORT) 3902 #ifdef EPFNOSUPPORT 3903 && (errno != EPFNOSUPPORT) 3904 #endif 3905 ) { 3906 error("socket: %.100s", strerror(errno)); 3907 freeaddrinfo(aitop); 3908 return -1; 3909 } else { 3910 debug("x11_create_display_inet: Socket family %d not supported", 3911 ai->ai_family); 3912 continue; 3913 } 3914 } 3915 if (ai->ai_family == AF_INET6) 3916 sock_set_v6only(sock); 3917 if (x11_use_localhost) 3918 channel_set_reuseaddr(sock); 3919 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 3920 debug2("bind port %d: %.100s", port, strerror(errno)); 3921 close(sock); 3922 3923 for (n = 0; n < num_socks; n++) { 3924 close(socks[n]); 3925 } 3926 num_socks = 0; 3927 break; 3928 } 3929 socks[num_socks++] = sock; 3930 if (num_socks == NUM_SOCKS) 3931 break; 3932 } 3933 freeaddrinfo(aitop); 3934 if (num_socks > 0) 3935 break; 3936 } 3937 if (display_number >= MAX_DISPLAYS) { 3938 error("Failed to allocate internet-domain X11 display socket."); 3939 return -1; 3940 } 3941 /* Start listening for connections on the socket. */ 3942 for (n = 0; n < num_socks; n++) { 3943 sock = socks[n]; 3944 if (listen(sock, SSH_LISTEN_BACKLOG) < 0) { 3945 error("listen: %.100s", strerror(errno)); 3946 close(sock); 3947 return -1; 3948 } 3949 } 3950 3951 /* Allocate a channel for each socket. */ 3952 *chanids = xcalloc(num_socks + 1, sizeof(**chanids)); 3953 for (n = 0; n < num_socks; n++) { 3954 sock = socks[n]; 3955 nc = channel_new("x11 listener", 3956 SSH_CHANNEL_X11_LISTENER, sock, sock, -1, 3957 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 3958 0, "X11 inet listener", 1); 3959 nc->single_connection = single_connection; 3960 (*chanids)[n] = nc->self; 3961 } 3962 (*chanids)[n] = -1; 3963 3964 /* Return the display number for the DISPLAY environment variable. */ 3965 *display_numberp = display_number; 3966 return (0); 3967 } 3968 3969 static int 3970 connect_local_xsocket_path(const char *pathname) 3971 { 3972 int sock; 3973 struct sockaddr_un addr; 3974 3975 sock = socket(AF_UNIX, SOCK_STREAM, 0); 3976 if (sock < 0) 3977 error("socket: %.100s", strerror(errno)); 3978 memset(&addr, 0, sizeof(addr)); 3979 addr.sun_family = AF_UNIX; 3980 strlcpy(addr.sun_path, pathname, sizeof addr.sun_path); 3981 if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0) 3982 return sock; 3983 close(sock); 3984 error("connect %.100s: %.100s", addr.sun_path, strerror(errno)); 3985 return -1; 3986 } 3987 3988 static int 3989 connect_local_xsocket(u_int dnr) 3990 { 3991 char buf[1024]; 3992 snprintf(buf, sizeof buf, _PATH_UNIX_X, dnr); 3993 return connect_local_xsocket_path(buf); 3994 } 3995 3996 int 3997 x11_connect_display(void) 3998 { 3999 u_int display_number; 4000 const char *display; 4001 char buf[1024], *cp; 4002 struct addrinfo hints, *ai, *aitop; 4003 char strport[NI_MAXSERV]; 4004 int gaierr, sock = 0; 4005 4006 /* Try to open a socket for the local X server. */ 4007 display = getenv("DISPLAY"); 4008 if (!display) { 4009 error("DISPLAY not set."); 4010 return -1; 4011 } 4012 /* 4013 * Now we decode the value of the DISPLAY variable and make a 4014 * connection to the real X server. 4015 */ 4016 4017 /* Check if the display is from launchd. */ 4018 #ifdef __APPLE__ 4019 if (strncmp(display, "/tmp/launch", 11) == 0) { 4020 sock = connect_local_xsocket_path(display); 4021 if (sock < 0) 4022 return -1; 4023 4024 /* OK, we now have a connection to the display. */ 4025 return sock; 4026 } 4027 #endif 4028 /* 4029 * Check if it is a unix domain socket. Unix domain displays are in 4030 * one of the following formats: unix:d[.s], :d[.s], ::d[.s] 4031 */ 4032 if (strncmp(display, "unix:", 5) == 0 || 4033 display[0] == ':') { 4034 /* Connect to the unix domain socket. */ 4035 if (sscanf(strrchr(display, ':') + 1, "%u", &display_number) != 1) { 4036 error("Could not parse display number from DISPLAY: %.100s", 4037 display); 4038 return -1; 4039 } 4040 /* Create a socket. */ 4041 sock = connect_local_xsocket(display_number); 4042 if (sock < 0) 4043 return -1; 4044 4045 /* OK, we now have a connection to the display. */ 4046 return sock; 4047 } 4048 /* 4049 * Connect to an inet socket. The DISPLAY value is supposedly 4050 * hostname:d[.s], where hostname may also be numeric IP address. 4051 */ 4052 strlcpy(buf, display, sizeof(buf)); 4053 cp = strchr(buf, ':'); 4054 if (!cp) { 4055 error("Could not find ':' in DISPLAY: %.100s", display); 4056 return -1; 4057 } 4058 *cp = 0; 4059 /* buf now contains the host name. But first we parse the display number. */ 4060 if (sscanf(cp + 1, "%u", &display_number) != 1) { 4061 error("Could not parse display number from DISPLAY: %.100s", 4062 display); 4063 return -1; 4064 } 4065 4066 /* Look up the host address */ 4067 memset(&hints, 0, sizeof(hints)); 4068 hints.ai_family = IPv4or6; 4069 hints.ai_socktype = SOCK_STREAM; 4070 snprintf(strport, sizeof strport, "%u", 6000 + display_number); 4071 if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) { 4072 error("%.100s: unknown host. (%s)", buf, 4073 ssh_gai_strerror(gaierr)); 4074 return -1; 4075 } 4076 for (ai = aitop; ai; ai = ai->ai_next) { 4077 /* Create a socket. */ 4078 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); 4079 if (sock < 0) { 4080 debug2("socket: %.100s", strerror(errno)); 4081 continue; 4082 } 4083 /* Connect it to the display. */ 4084 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 4085 debug2("connect %.100s port %u: %.100s", buf, 4086 6000 + display_number, strerror(errno)); 4087 close(sock); 4088 continue; 4089 } 4090 /* Success */ 4091 break; 4092 } 4093 freeaddrinfo(aitop); 4094 if (!ai) { 4095 error("connect %.100s port %u: %.100s", buf, 6000 + display_number, 4096 strerror(errno)); 4097 return -1; 4098 } 4099 set_nodelay(sock); 4100 return sock; 4101 } 4102 4103 /* 4104 * This is called when SSH_SMSG_X11_OPEN is received. The packet contains 4105 * the remote channel number. We should do whatever we want, and respond 4106 * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE. 4107 */ 4108 4109 /* ARGSUSED */ 4110 int 4111 x11_input_open(int type, u_int32_t seq, void *ctxt) 4112 { 4113 Channel *c = NULL; 4114 int remote_id, sock = 0; 4115 char *remote_host; 4116 4117 debug("Received X11 open request."); 4118 4119 remote_id = packet_get_int(); 4120 4121 if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) { 4122 remote_host = packet_get_string(NULL); 4123 } else { 4124 remote_host = xstrdup("unknown (remote did not supply name)"); 4125 } 4126 packet_check_eom(); 4127 4128 /* Obtain a connection to the real X display. */ 4129 sock = x11_connect_display(); 4130 if (sock != -1) { 4131 /* Allocate a channel for this connection. */ 4132 c = channel_new("connected x11 socket", 4133 SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0, 4134 remote_host, 1); 4135 c->remote_id = remote_id; 4136 c->force_drain = 1; 4137 } 4138 free(remote_host); 4139 if (c == NULL) { 4140 /* Send refusal to the remote host. */ 4141 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 4142 packet_put_int(remote_id); 4143 } else { 4144 /* Send a confirmation to the remote host. */ 4145 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); 4146 packet_put_int(remote_id); 4147 packet_put_int(c->self); 4148 } 4149 packet_send(); 4150 return 0; 4151 } 4152 4153 /* dummy protocol handler that denies SSH-1 requests (agent/x11) */ 4154 /* ARGSUSED */ 4155 int 4156 deny_input_open(int type, u_int32_t seq, void *ctxt) 4157 { 4158 int rchan = packet_get_int(); 4159 4160 switch (type) { 4161 case SSH_SMSG_AGENT_OPEN: 4162 error("Warning: ssh server tried agent forwarding."); 4163 break; 4164 case SSH_SMSG_X11_OPEN: 4165 error("Warning: ssh server tried X11 forwarding."); 4166 break; 4167 default: 4168 error("deny_input_open: type %d", type); 4169 break; 4170 } 4171 error("Warning: this is probably a break-in attempt by a malicious server."); 4172 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 4173 packet_put_int(rchan); 4174 packet_send(); 4175 return 0; 4176 } 4177 4178 /* 4179 * Requests forwarding of X11 connections, generates fake authentication 4180 * data, and enables authentication spoofing. 4181 * This should be called in the client only. 4182 */ 4183 void 4184 x11_request_forwarding_with_spoofing(int client_session_id, const char *disp, 4185 const char *proto, const char *data, int want_reply) 4186 { 4187 u_int data_len = (u_int) strlen(data) / 2; 4188 u_int i, value; 4189 char *new_data; 4190 int screen_number; 4191 const char *cp; 4192 u_int32_t rnd = 0; 4193 4194 if (x11_saved_display == NULL) 4195 x11_saved_display = xstrdup(disp); 4196 else if (strcmp(disp, x11_saved_display) != 0) { 4197 error("x11_request_forwarding_with_spoofing: different " 4198 "$DISPLAY already forwarded"); 4199 return; 4200 } 4201 4202 cp = strchr(disp, ':'); 4203 if (cp) 4204 cp = strchr(cp, '.'); 4205 if (cp) 4206 screen_number = (u_int)strtonum(cp + 1, 0, 400, NULL); 4207 else 4208 screen_number = 0; 4209 4210 if (x11_saved_proto == NULL) { 4211 /* Save protocol name. */ 4212 x11_saved_proto = xstrdup(proto); 4213 /* 4214 * Extract real authentication data and generate fake data 4215 * of the same length. 4216 */ 4217 x11_saved_data = xmalloc(data_len); 4218 x11_fake_data = xmalloc(data_len); 4219 for (i = 0; i < data_len; i++) { 4220 if (sscanf(data + 2 * i, "%2x", &value) != 1) 4221 fatal("x11_request_forwarding: bad " 4222 "authentication data: %.100s", data); 4223 if (i % 4 == 0) 4224 rnd = arc4random(); 4225 x11_saved_data[i] = value; 4226 x11_fake_data[i] = rnd & 0xff; 4227 rnd >>= 8; 4228 } 4229 x11_saved_data_len = data_len; 4230 x11_fake_data_len = data_len; 4231 } 4232 4233 /* Convert the fake data into hex. */ 4234 new_data = tohex(x11_fake_data, data_len); 4235 4236 /* Send the request packet. */ 4237 if (compat20) { 4238 channel_request_start(client_session_id, "x11-req", want_reply); 4239 packet_put_char(0); /* XXX bool single connection */ 4240 } else { 4241 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING); 4242 } 4243 packet_put_cstring(proto); 4244 packet_put_cstring(new_data); 4245 packet_put_int(screen_number); 4246 packet_send(); 4247 packet_write_wait(); 4248 free(new_data); 4249 } 4250 4251 4252 /* -- agent forwarding */ 4253 4254 /* Sends a message to the server to request authentication fd forwarding. */ 4255 4256 void 4257 auth_request_forwarding(void) 4258 { 4259 packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING); 4260 packet_send(); 4261 packet_write_wait(); 4262 } 4263