channels.c revision 98941
1/* 2 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * All rights reserved 5 * This file contains functions for generic socket connection forwarding. 6 * There is also code for initiating connection forwarding for X11 connections, 7 * arbitrary tcp/ip connections, and the authentication agent connection. 8 * 9 * As far as I am concerned, the code I have written for this software 10 * can be used freely for any purpose. Any derived versions of this 11 * software must be clearly marked as such, and if the derived work is 12 * incompatible with the protocol description in the RFC file, it must be 13 * called by a name other than "ssh" or "Secure Shell". 14 * 15 * SSH2 support added by Markus Friedl. 16 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. 17 * Copyright (c) 1999 Dug Song. All rights reserved. 18 * Copyright (c) 1999 Theo de Raadt. All rights reserved. 19 * 20 * Redistribution and use in source and binary forms, with or without 21 * modification, are permitted provided that the following conditions 22 * are met: 23 * 1. Redistributions of source code must retain the above copyright 24 * notice, this list of conditions and the following disclaimer. 25 * 2. Redistributions in binary form must reproduce the above copyright 26 * notice, this list of conditions and the following disclaimer in the 27 * documentation and/or other materials provided with the distribution. 28 * 29 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 30 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 31 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 32 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 33 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 34 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 35 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 36 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 37 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 38 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 39 */ 40 41#include "includes.h" 42RCSID("$OpenBSD: channels.c,v 1.175 2002/06/10 22:28:41 markus Exp $"); 43 44#include "ssh.h" 45#include "ssh1.h" 46#include "ssh2.h" 47#include "packet.h" 48#include "xmalloc.h" 49#include "log.h" 50#include "misc.h" 51#include "channels.h" 52#include "compat.h" 53#include "canohost.h" 54#include "key.h" 55#include "authfd.h" 56#include "pathnames.h" 57 58 59/* -- channel core */ 60 61/* 62 * Pointer to an array containing all allocated channels. The array is 63 * dynamically extended as needed. 64 */ 65static Channel **channels = NULL; 66 67/* 68 * Size of the channel array. All slots of the array must always be 69 * initialized (at least the type field); unused slots set to NULL 70 */ 71static int channels_alloc = 0; 72 73/* 74 * Maximum file descriptor value used in any of the channels. This is 75 * updated in channel_new. 76 */ 77static int channel_max_fd = 0; 78 79 80/* -- tcp forwarding */ 81 82/* 83 * Data structure for storing which hosts are permitted for forward requests. 84 * The local sides of any remote forwards are stored in this array to prevent 85 * a corrupt remote server from accessing arbitrary TCP/IP ports on our local 86 * network (which might be behind a firewall). 87 */ 88typedef struct { 89 char *host_to_connect; /* Connect to 'host'. */ 90 u_short port_to_connect; /* Connect to 'port'. */ 91 u_short listen_port; /* Remote side should listen port number. */ 92} ForwardPermission; 93 94/* List of all permitted host/port pairs to connect. */ 95static ForwardPermission permitted_opens[SSH_MAX_FORWARDS_PER_DIRECTION]; 96 97/* Number of permitted host/port pairs in the array. */ 98static int num_permitted_opens = 0; 99/* 100 * If this is true, all opens are permitted. This is the case on the server 101 * on which we have to trust the client anyway, and the user could do 102 * anything after logging in anyway. 103 */ 104static int all_opens_permitted = 0; 105 106 107/* -- X11 forwarding */ 108 109/* Maximum number of fake X11 displays to try. */ 110#define MAX_DISPLAYS 1000 111 112/* Saved X11 authentication protocol name. */ 113static char *x11_saved_proto = NULL; 114 115/* Saved X11 authentication data. This is the real data. */ 116static char *x11_saved_data = NULL; 117static u_int x11_saved_data_len = 0; 118 119/* 120 * Fake X11 authentication data. This is what the server will be sending us; 121 * we should replace any occurrences of this by the real data. 122 */ 123static char *x11_fake_data = NULL; 124static u_int x11_fake_data_len; 125 126 127/* -- agent forwarding */ 128 129#define NUM_SOCKS 10 130 131/* AF_UNSPEC or AF_INET or AF_INET6 */ 132static int IPv4or6 = AF_UNSPEC; 133 134/* helper */ 135static void port_open_helper(Channel *c, char *rtype); 136 137/* -- channel core */ 138 139Channel * 140channel_lookup(int id) 141{ 142 Channel *c; 143 144 if (id < 0 || id >= channels_alloc) { 145 log("channel_lookup: %d: bad id", id); 146 return NULL; 147 } 148 c = channels[id]; 149 if (c == NULL) { 150 log("channel_lookup: %d: bad id: channel free", id); 151 return NULL; 152 } 153 return c; 154} 155 156/* 157 * Register filedescriptors for a channel, used when allocating a channel or 158 * when the channel consumer/producer is ready, e.g. shell exec'd 159 */ 160 161static void 162channel_register_fds(Channel *c, int rfd, int wfd, int efd, 163 int extusage, int nonblock) 164{ 165 /* Update the maximum file descriptor value. */ 166 channel_max_fd = MAX(channel_max_fd, rfd); 167 channel_max_fd = MAX(channel_max_fd, wfd); 168 channel_max_fd = MAX(channel_max_fd, efd); 169 170 /* XXX set close-on-exec -markus */ 171 172 c->rfd = rfd; 173 c->wfd = wfd; 174 c->sock = (rfd == wfd) ? rfd : -1; 175 c->efd = efd; 176 c->extended_usage = extusage; 177 178 /* XXX ugly hack: nonblock is only set by the server */ 179 if (nonblock && isatty(c->rfd)) { 180 debug("channel %d: rfd %d isatty", c->self, c->rfd); 181 c->isatty = 1; 182 if (!isatty(c->wfd)) { 183 error("channel %d: wfd %d is not a tty?", 184 c->self, c->wfd); 185 } 186 } else { 187 c->isatty = 0; 188 } 189 190 /* enable nonblocking mode */ 191 if (nonblock) { 192 if (rfd != -1) 193 set_nonblock(rfd); 194 if (wfd != -1) 195 set_nonblock(wfd); 196 if (efd != -1) 197 set_nonblock(efd); 198 } 199} 200 201/* 202 * Allocate a new channel object and set its type and socket. This will cause 203 * remote_name to be freed. 204 */ 205 206Channel * 207channel_new(char *ctype, int type, int rfd, int wfd, int efd, 208 int window, int maxpack, int extusage, char *remote_name, int nonblock) 209{ 210 int i, found; 211 Channel *c; 212 213 /* Do initial allocation if this is the first call. */ 214 if (channels_alloc == 0) { 215 channels_alloc = 10; 216 channels = xmalloc(channels_alloc * sizeof(Channel *)); 217 for (i = 0; i < channels_alloc; i++) 218 channels[i] = NULL; 219 fatal_add_cleanup((void (*) (void *)) channel_free_all, NULL); 220 } 221 /* Try to find a free slot where to put the new channel. */ 222 for (found = -1, i = 0; i < channels_alloc; i++) 223 if (channels[i] == NULL) { 224 /* Found a free slot. */ 225 found = i; 226 break; 227 } 228 if (found == -1) { 229 /* There are no free slots. Take last+1 slot and expand the array. */ 230 found = channels_alloc; 231 channels_alloc += 10; 232 debug2("channel: expanding %d", channels_alloc); 233 channels = xrealloc(channels, channels_alloc * sizeof(Channel *)); 234 for (i = found; i < channels_alloc; i++) 235 channels[i] = NULL; 236 } 237 /* Initialize and return new channel. */ 238 c = channels[found] = xmalloc(sizeof(Channel)); 239 memset(c, 0, sizeof(Channel)); 240 buffer_init(&c->input); 241 buffer_init(&c->output); 242 buffer_init(&c->extended); 243 c->ostate = CHAN_OUTPUT_OPEN; 244 c->istate = CHAN_INPUT_OPEN; 245 c->flags = 0; 246 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock); 247 c->self = found; 248 c->type = type; 249 c->ctype = ctype; 250 c->local_window = window; 251 c->local_window_max = window; 252 c->local_consumed = 0; 253 c->local_maxpacket = maxpack; 254 c->remote_id = -1; 255 c->remote_name = remote_name; 256 c->remote_window = 0; 257 c->remote_maxpacket = 0; 258 c->force_drain = 0; 259 c->single_connection = 0; 260 c->detach_user = NULL; 261 c->confirm = NULL; 262 c->input_filter = NULL; 263 debug("channel %d: new [%s]", found, remote_name); 264 return c; 265} 266 267static int 268channel_find_maxfd(void) 269{ 270 int i, max = 0; 271 Channel *c; 272 273 for (i = 0; i < channels_alloc; i++) { 274 c = channels[i]; 275 if (c != NULL) { 276 max = MAX(max, c->rfd); 277 max = MAX(max, c->wfd); 278 max = MAX(max, c->efd); 279 } 280 } 281 return max; 282} 283 284int 285channel_close_fd(int *fdp) 286{ 287 int ret = 0, fd = *fdp; 288 289 if (fd != -1) { 290 ret = close(fd); 291 *fdp = -1; 292 if (fd == channel_max_fd) 293 channel_max_fd = channel_find_maxfd(); 294 } 295 return ret; 296} 297 298/* Close all channel fd/socket. */ 299 300static void 301channel_close_fds(Channel *c) 302{ 303 debug3("channel_close_fds: channel %d: r %d w %d e %d", 304 c->self, c->rfd, c->wfd, c->efd); 305 306 channel_close_fd(&c->sock); 307 channel_close_fd(&c->rfd); 308 channel_close_fd(&c->wfd); 309 channel_close_fd(&c->efd); 310} 311 312/* Free the channel and close its fd/socket. */ 313 314void 315channel_free(Channel *c) 316{ 317 char *s; 318 int i, n; 319 320 for (n = 0, i = 0; i < channels_alloc; i++) 321 if (channels[i]) 322 n++; 323 debug("channel_free: channel %d: %s, nchannels %d", c->self, 324 c->remote_name ? c->remote_name : "???", n); 325 326 s = channel_open_message(); 327 debug3("channel_free: status: %s", s); 328 xfree(s); 329 330 if (c->sock != -1) 331 shutdown(c->sock, SHUT_RDWR); 332 channel_close_fds(c); 333 buffer_free(&c->input); 334 buffer_free(&c->output); 335 buffer_free(&c->extended); 336 if (c->remote_name) { 337 xfree(c->remote_name); 338 c->remote_name = NULL; 339 } 340 channels[c->self] = NULL; 341 xfree(c); 342} 343 344void 345channel_free_all(void) 346{ 347 int i; 348 349 for (i = 0; i < channels_alloc; i++) 350 if (channels[i] != NULL) 351 channel_free(channels[i]); 352} 353 354/* 355 * Closes the sockets/fds of all channels. This is used to close extra file 356 * descriptors after a fork. 357 */ 358 359void 360channel_close_all(void) 361{ 362 int i; 363 364 for (i = 0; i < channels_alloc; i++) 365 if (channels[i] != NULL) 366 channel_close_fds(channels[i]); 367} 368 369/* 370 * Stop listening to channels. 371 */ 372 373void 374channel_stop_listening(void) 375{ 376 int i; 377 Channel *c; 378 379 for (i = 0; i < channels_alloc; i++) { 380 c = channels[i]; 381 if (c != NULL) { 382 switch (c->type) { 383 case SSH_CHANNEL_AUTH_SOCKET: 384 case SSH_CHANNEL_PORT_LISTENER: 385 case SSH_CHANNEL_RPORT_LISTENER: 386 case SSH_CHANNEL_X11_LISTENER: 387 channel_close_fd(&c->sock); 388 channel_free(c); 389 break; 390 } 391 } 392 } 393} 394 395/* 396 * Returns true if no channel has too much buffered data, and false if one or 397 * more channel is overfull. 398 */ 399 400int 401channel_not_very_much_buffered_data(void) 402{ 403 u_int i; 404 Channel *c; 405 406 for (i = 0; i < channels_alloc; i++) { 407 c = channels[i]; 408 if (c != NULL && c->type == SSH_CHANNEL_OPEN) { 409#if 0 410 if (!compat20 && 411 buffer_len(&c->input) > packet_get_maxsize()) { 412 debug("channel %d: big input buffer %d", 413 c->self, buffer_len(&c->input)); 414 return 0; 415 } 416#endif 417 if (buffer_len(&c->output) > packet_get_maxsize()) { 418 debug("channel %d: big output buffer %d > %d", 419 c->self, buffer_len(&c->output), 420 packet_get_maxsize()); 421 return 0; 422 } 423 } 424 } 425 return 1; 426} 427 428/* Returns true if any channel is still open. */ 429 430int 431channel_still_open(void) 432{ 433 int i; 434 Channel *c; 435 436 for (i = 0; i < channels_alloc; i++) { 437 c = channels[i]; 438 if (c == NULL) 439 continue; 440 switch (c->type) { 441 case SSH_CHANNEL_X11_LISTENER: 442 case SSH_CHANNEL_PORT_LISTENER: 443 case SSH_CHANNEL_RPORT_LISTENER: 444 case SSH_CHANNEL_CLOSED: 445 case SSH_CHANNEL_AUTH_SOCKET: 446 case SSH_CHANNEL_DYNAMIC: 447 case SSH_CHANNEL_CONNECTING: 448 case SSH_CHANNEL_ZOMBIE: 449 continue; 450 case SSH_CHANNEL_LARVAL: 451 if (!compat20) 452 fatal("cannot happen: SSH_CHANNEL_LARVAL"); 453 continue; 454 case SSH_CHANNEL_OPENING: 455 case SSH_CHANNEL_OPEN: 456 case SSH_CHANNEL_X11_OPEN: 457 return 1; 458 case SSH_CHANNEL_INPUT_DRAINING: 459 case SSH_CHANNEL_OUTPUT_DRAINING: 460 if (!compat13) 461 fatal("cannot happen: OUT_DRAIN"); 462 return 1; 463 default: 464 fatal("channel_still_open: bad channel type %d", c->type); 465 /* NOTREACHED */ 466 } 467 } 468 return 0; 469} 470 471/* Returns the id of an open channel suitable for keepaliving */ 472 473int 474channel_find_open(void) 475{ 476 int i; 477 Channel *c; 478 479 for (i = 0; i < channels_alloc; i++) { 480 c = channels[i]; 481 if (c == NULL) 482 continue; 483 switch (c->type) { 484 case SSH_CHANNEL_CLOSED: 485 case SSH_CHANNEL_DYNAMIC: 486 case SSH_CHANNEL_X11_LISTENER: 487 case SSH_CHANNEL_PORT_LISTENER: 488 case SSH_CHANNEL_RPORT_LISTENER: 489 case SSH_CHANNEL_OPENING: 490 case SSH_CHANNEL_CONNECTING: 491 case SSH_CHANNEL_ZOMBIE: 492 continue; 493 case SSH_CHANNEL_LARVAL: 494 case SSH_CHANNEL_AUTH_SOCKET: 495 case SSH_CHANNEL_OPEN: 496 case SSH_CHANNEL_X11_OPEN: 497 return i; 498 case SSH_CHANNEL_INPUT_DRAINING: 499 case SSH_CHANNEL_OUTPUT_DRAINING: 500 if (!compat13) 501 fatal("cannot happen: OUT_DRAIN"); 502 return i; 503 default: 504 fatal("channel_find_open: bad channel type %d", c->type); 505 /* NOTREACHED */ 506 } 507 } 508 return -1; 509} 510 511 512/* 513 * Returns a message describing the currently open forwarded connections, 514 * suitable for sending to the client. The message contains crlf pairs for 515 * newlines. 516 */ 517 518char * 519channel_open_message(void) 520{ 521 Buffer buffer; 522 Channel *c; 523 char buf[1024], *cp; 524 int i; 525 526 buffer_init(&buffer); 527 snprintf(buf, sizeof buf, "The following connections are open:\r\n"); 528 buffer_append(&buffer, buf, strlen(buf)); 529 for (i = 0; i < channels_alloc; i++) { 530 c = channels[i]; 531 if (c == NULL) 532 continue; 533 switch (c->type) { 534 case SSH_CHANNEL_X11_LISTENER: 535 case SSH_CHANNEL_PORT_LISTENER: 536 case SSH_CHANNEL_RPORT_LISTENER: 537 case SSH_CHANNEL_CLOSED: 538 case SSH_CHANNEL_AUTH_SOCKET: 539 case SSH_CHANNEL_ZOMBIE: 540 continue; 541 case SSH_CHANNEL_LARVAL: 542 case SSH_CHANNEL_OPENING: 543 case SSH_CHANNEL_CONNECTING: 544 case SSH_CHANNEL_DYNAMIC: 545 case SSH_CHANNEL_OPEN: 546 case SSH_CHANNEL_X11_OPEN: 547 case SSH_CHANNEL_INPUT_DRAINING: 548 case SSH_CHANNEL_OUTPUT_DRAINING: 549 snprintf(buf, sizeof buf, " #%d %.300s (t%d r%d i%d/%d o%d/%d fd %d/%d)\r\n", 550 c->self, c->remote_name, 551 c->type, c->remote_id, 552 c->istate, buffer_len(&c->input), 553 c->ostate, buffer_len(&c->output), 554 c->rfd, c->wfd); 555 buffer_append(&buffer, buf, strlen(buf)); 556 continue; 557 default: 558 fatal("channel_open_message: bad channel type %d", c->type); 559 /* NOTREACHED */ 560 } 561 } 562 buffer_append(&buffer, "\0", 1); 563 cp = xstrdup(buffer_ptr(&buffer)); 564 buffer_free(&buffer); 565 return cp; 566} 567 568void 569channel_send_open(int id) 570{ 571 Channel *c = channel_lookup(id); 572 if (c == NULL) { 573 log("channel_send_open: %d: bad id", id); 574 return; 575 } 576 debug("send channel open %d", id); 577 packet_start(SSH2_MSG_CHANNEL_OPEN); 578 packet_put_cstring(c->ctype); 579 packet_put_int(c->self); 580 packet_put_int(c->local_window); 581 packet_put_int(c->local_maxpacket); 582 packet_send(); 583} 584 585void 586channel_request_start(int local_id, char *service, int wantconfirm) 587{ 588 Channel *c = channel_lookup(local_id); 589 if (c == NULL) { 590 log("channel_request_start: %d: unknown channel id", local_id); 591 return; 592 } 593 debug("channel request %d: %s", local_id, service) ; 594 packet_start(SSH2_MSG_CHANNEL_REQUEST); 595 packet_put_int(c->remote_id); 596 packet_put_cstring(service); 597 packet_put_char(wantconfirm); 598} 599void 600channel_register_confirm(int id, channel_callback_fn *fn) 601{ 602 Channel *c = channel_lookup(id); 603 if (c == NULL) { 604 log("channel_register_comfirm: %d: bad id", id); 605 return; 606 } 607 c->confirm = fn; 608} 609void 610channel_register_cleanup(int id, channel_callback_fn *fn) 611{ 612 Channel *c = channel_lookup(id); 613 if (c == NULL) { 614 log("channel_register_cleanup: %d: bad id", id); 615 return; 616 } 617 c->detach_user = fn; 618} 619void 620channel_cancel_cleanup(int id) 621{ 622 Channel *c = channel_lookup(id); 623 if (c == NULL) { 624 log("channel_cancel_cleanup: %d: bad id", id); 625 return; 626 } 627 c->detach_user = NULL; 628} 629void 630channel_register_filter(int id, channel_filter_fn *fn) 631{ 632 Channel *c = channel_lookup(id); 633 if (c == NULL) { 634 log("channel_register_filter: %d: bad id", id); 635 return; 636 } 637 c->input_filter = fn; 638} 639 640void 641channel_set_fds(int id, int rfd, int wfd, int efd, 642 int extusage, int nonblock, u_int window_max) 643{ 644 Channel *c = channel_lookup(id); 645 if (c == NULL || c->type != SSH_CHANNEL_LARVAL) 646 fatal("channel_activate for non-larval channel %d.", id); 647 channel_register_fds(c, rfd, wfd, efd, extusage, nonblock); 648 c->type = SSH_CHANNEL_OPEN; 649 c->local_window = c->local_window_max = window_max; 650 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); 651 packet_put_int(c->remote_id); 652 packet_put_int(c->local_window); 653 packet_send(); 654} 655 656/* 657 * 'channel_pre*' are called just before select() to add any bits relevant to 658 * channels in the select bitmasks. 659 */ 660/* 661 * 'channel_post*': perform any appropriate operations for channels which 662 * have events pending. 663 */ 664typedef void chan_fn(Channel *c, fd_set * readset, fd_set * writeset); 665chan_fn *channel_pre[SSH_CHANNEL_MAX_TYPE]; 666chan_fn *channel_post[SSH_CHANNEL_MAX_TYPE]; 667 668static void 669channel_pre_listener(Channel *c, fd_set * readset, fd_set * writeset) 670{ 671 FD_SET(c->sock, readset); 672} 673 674static void 675channel_pre_connecting(Channel *c, fd_set * readset, fd_set * writeset) 676{ 677 debug3("channel %d: waiting for connection", c->self); 678 FD_SET(c->sock, writeset); 679} 680 681static void 682channel_pre_open_13(Channel *c, fd_set * readset, fd_set * writeset) 683{ 684 if (buffer_len(&c->input) < packet_get_maxsize()) 685 FD_SET(c->sock, readset); 686 if (buffer_len(&c->output) > 0) 687 FD_SET(c->sock, writeset); 688} 689 690static void 691channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset) 692{ 693 u_int limit = compat20 ? c->remote_window : packet_get_maxsize(); 694 695 if (c->istate == CHAN_INPUT_OPEN && 696 limit > 0 && 697 buffer_len(&c->input) < limit) 698 FD_SET(c->rfd, readset); 699 if (c->ostate == CHAN_OUTPUT_OPEN || 700 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { 701 if (buffer_len(&c->output) > 0) { 702 FD_SET(c->wfd, writeset); 703 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { 704 if (CHANNEL_EFD_OUTPUT_ACTIVE(c)) 705 debug2("channel %d: obuf_empty delayed efd %d/(%d)", 706 c->self, c->efd, buffer_len(&c->extended)); 707 else 708 chan_obuf_empty(c); 709 } 710 } 711 /** XXX check close conditions, too */ 712 if (compat20 && c->efd != -1) { 713 if (c->extended_usage == CHAN_EXTENDED_WRITE && 714 buffer_len(&c->extended) > 0) 715 FD_SET(c->efd, writeset); 716 else if (!(c->flags & CHAN_EOF_SENT) && 717 c->extended_usage == CHAN_EXTENDED_READ && 718 buffer_len(&c->extended) < c->remote_window) 719 FD_SET(c->efd, readset); 720 } 721} 722 723static void 724channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset) 725{ 726 if (buffer_len(&c->input) == 0) { 727 packet_start(SSH_MSG_CHANNEL_CLOSE); 728 packet_put_int(c->remote_id); 729 packet_send(); 730 c->type = SSH_CHANNEL_CLOSED; 731 debug("channel %d: closing after input drain.", c->self); 732 } 733} 734 735static void 736channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset) 737{ 738 if (buffer_len(&c->output) == 0) 739 chan_mark_dead(c); 740 else 741 FD_SET(c->sock, writeset); 742} 743 744/* 745 * This is a special state for X11 authentication spoofing. An opened X11 746 * connection (when authentication spoofing is being done) remains in this 747 * state until the first packet has been completely read. The authentication 748 * data in that packet is then substituted by the real data if it matches the 749 * fake data, and the channel is put into normal mode. 750 * XXX All this happens at the client side. 751 * Returns: 0 = need more data, -1 = wrong cookie, 1 = ok 752 */ 753static int 754x11_open_helper(Buffer *b) 755{ 756 u_char *ucp; 757 u_int proto_len, data_len; 758 759 /* Check if the fixed size part of the packet is in buffer. */ 760 if (buffer_len(b) < 12) 761 return 0; 762 763 /* Parse the lengths of variable-length fields. */ 764 ucp = buffer_ptr(b); 765 if (ucp[0] == 0x42) { /* Byte order MSB first. */ 766 proto_len = 256 * ucp[6] + ucp[7]; 767 data_len = 256 * ucp[8] + ucp[9]; 768 } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */ 769 proto_len = ucp[6] + 256 * ucp[7]; 770 data_len = ucp[8] + 256 * ucp[9]; 771 } else { 772 debug("Initial X11 packet contains bad byte order byte: 0x%x", 773 ucp[0]); 774 return -1; 775 } 776 777 /* Check if the whole packet is in buffer. */ 778 if (buffer_len(b) < 779 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3)) 780 return 0; 781 782 /* Check if authentication protocol matches. */ 783 if (proto_len != strlen(x11_saved_proto) || 784 memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) { 785 debug("X11 connection uses different authentication protocol."); 786 return -1; 787 } 788 /* Check if authentication data matches our fake data. */ 789 if (data_len != x11_fake_data_len || 790 memcmp(ucp + 12 + ((proto_len + 3) & ~3), 791 x11_fake_data, x11_fake_data_len) != 0) { 792 debug("X11 auth data does not match fake data."); 793 return -1; 794 } 795 /* Check fake data length */ 796 if (x11_fake_data_len != x11_saved_data_len) { 797 error("X11 fake_data_len %d != saved_data_len %d", 798 x11_fake_data_len, x11_saved_data_len); 799 return -1; 800 } 801 /* 802 * Received authentication protocol and data match 803 * our fake data. Substitute the fake data with real 804 * data. 805 */ 806 memcpy(ucp + 12 + ((proto_len + 3) & ~3), 807 x11_saved_data, x11_saved_data_len); 808 return 1; 809} 810 811static void 812channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset) 813{ 814 int ret = x11_open_helper(&c->output); 815 if (ret == 1) { 816 /* Start normal processing for the channel. */ 817 c->type = SSH_CHANNEL_OPEN; 818 channel_pre_open_13(c, readset, writeset); 819 } else if (ret == -1) { 820 /* 821 * We have received an X11 connection that has bad 822 * authentication information. 823 */ 824 log("X11 connection rejected because of wrong authentication."); 825 buffer_clear(&c->input); 826 buffer_clear(&c->output); 827 channel_close_fd(&c->sock); 828 c->sock = -1; 829 c->type = SSH_CHANNEL_CLOSED; 830 packet_start(SSH_MSG_CHANNEL_CLOSE); 831 packet_put_int(c->remote_id); 832 packet_send(); 833 } 834} 835 836static void 837channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset) 838{ 839 int ret = x11_open_helper(&c->output); 840 841 /* c->force_drain = 1; */ 842 843 if (ret == 1) { 844 c->type = SSH_CHANNEL_OPEN; 845 channel_pre_open(c, readset, writeset); 846 } else if (ret == -1) { 847 log("X11 connection rejected because of wrong authentication."); 848 debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate); 849 chan_read_failed(c); 850 buffer_clear(&c->input); 851 chan_ibuf_empty(c); 852 buffer_clear(&c->output); 853 /* for proto v1, the peer will send an IEOF */ 854 if (compat20) 855 chan_write_failed(c); 856 else 857 c->type = SSH_CHANNEL_OPEN; 858 debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate); 859 } 860} 861 862/* try to decode a socks4 header */ 863static int 864channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset) 865{ 866 u_char *p, *host; 867 int len, have, i, found; 868 char username[256]; 869 struct { 870 u_int8_t version; 871 u_int8_t command; 872 u_int16_t dest_port; 873 struct in_addr dest_addr; 874 } s4_req, s4_rsp; 875 876 debug2("channel %d: decode socks4", c->self); 877 878 have = buffer_len(&c->input); 879 len = sizeof(s4_req); 880 if (have < len) 881 return 0; 882 p = buffer_ptr(&c->input); 883 for (found = 0, i = len; i < have; i++) { 884 if (p[i] == '\0') { 885 found = 1; 886 break; 887 } 888 if (i > 1024) { 889 /* the peer is probably sending garbage */ 890 debug("channel %d: decode socks4: too long", 891 c->self); 892 return -1; 893 } 894 } 895 if (!found) 896 return 0; 897 buffer_get(&c->input, (char *)&s4_req.version, 1); 898 buffer_get(&c->input, (char *)&s4_req.command, 1); 899 buffer_get(&c->input, (char *)&s4_req.dest_port, 2); 900 buffer_get(&c->input, (char *)&s4_req.dest_addr, 4); 901 have = buffer_len(&c->input); 902 p = buffer_ptr(&c->input); 903 len = strlen(p); 904 debug2("channel %d: decode socks4: user %s/%d", c->self, p, len); 905 if (len > have) 906 fatal("channel %d: decode socks4: len %d > have %d", 907 c->self, len, have); 908 strlcpy(username, p, sizeof(username)); 909 buffer_consume(&c->input, len); 910 buffer_consume(&c->input, 1); /* trailing '\0' */ 911 912 host = inet_ntoa(s4_req.dest_addr); 913 strlcpy(c->path, host, sizeof(c->path)); 914 c->host_port = ntohs(s4_req.dest_port); 915 916 debug("channel %d: dynamic request: socks4 host %s port %u command %u", 917 c->self, host, c->host_port, s4_req.command); 918 919 if (s4_req.command != 1) { 920 debug("channel %d: cannot handle: socks4 cn %d", 921 c->self, s4_req.command); 922 return -1; 923 } 924 s4_rsp.version = 0; /* vn: 0 for reply */ 925 s4_rsp.command = 90; /* cd: req granted */ 926 s4_rsp.dest_port = 0; /* ignored */ 927 s4_rsp.dest_addr.s_addr = INADDR_ANY; /* ignored */ 928 buffer_append(&c->output, (char *)&s4_rsp, sizeof(s4_rsp)); 929 return 1; 930} 931 932/* dynamic port forwarding */ 933static void 934channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset) 935{ 936 u_char *p; 937 int have, ret; 938 939 have = buffer_len(&c->input); 940 c->delayed = 0; 941 debug2("channel %d: pre_dynamic: have %d", c->self, have); 942 /* buffer_dump(&c->input); */ 943 /* check if the fixed size part of the packet is in buffer. */ 944 if (have < 4) { 945 /* need more */ 946 FD_SET(c->sock, readset); 947 return; 948 } 949 /* try to guess the protocol */ 950 p = buffer_ptr(&c->input); 951 switch (p[0]) { 952 case 0x04: 953 ret = channel_decode_socks4(c, readset, writeset); 954 break; 955 default: 956 ret = -1; 957 break; 958 } 959 if (ret < 0) { 960 chan_mark_dead(c); 961 } else if (ret == 0) { 962 debug2("channel %d: pre_dynamic: need more", c->self); 963 /* need more */ 964 FD_SET(c->sock, readset); 965 } else { 966 /* switch to the next state */ 967 c->type = SSH_CHANNEL_OPENING; 968 port_open_helper(c, "direct-tcpip"); 969 } 970} 971 972/* This is our fake X11 server socket. */ 973static void 974channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset) 975{ 976 Channel *nc; 977 struct sockaddr addr; 978 int newsock; 979 socklen_t addrlen; 980 char buf[16384], *remote_ipaddr; 981 int remote_port; 982 983 if (FD_ISSET(c->sock, readset)) { 984 debug("X11 connection requested."); 985 addrlen = sizeof(addr); 986 newsock = accept(c->sock, &addr, &addrlen); 987 if (c->single_connection) { 988 debug("single_connection: closing X11 listener."); 989 channel_close_fd(&c->sock); 990 chan_mark_dead(c); 991 } 992 if (newsock < 0) { 993 error("accept: %.100s", strerror(errno)); 994 return; 995 } 996 set_nodelay(newsock); 997 remote_ipaddr = get_peer_ipaddr(newsock); 998 remote_port = get_peer_port(newsock); 999 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d", 1000 remote_ipaddr, remote_port); 1001 1002 nc = channel_new("accepted x11 socket", 1003 SSH_CHANNEL_OPENING, newsock, newsock, -1, 1004 c->local_window_max, c->local_maxpacket, 1005 0, xstrdup(buf), 1); 1006 if (compat20) { 1007 packet_start(SSH2_MSG_CHANNEL_OPEN); 1008 packet_put_cstring("x11"); 1009 packet_put_int(nc->self); 1010 packet_put_int(nc->local_window_max); 1011 packet_put_int(nc->local_maxpacket); 1012 /* originator ipaddr and port */ 1013 packet_put_cstring(remote_ipaddr); 1014 if (datafellows & SSH_BUG_X11FWD) { 1015 debug("ssh2 x11 bug compat mode"); 1016 } else { 1017 packet_put_int(remote_port); 1018 } 1019 packet_send(); 1020 } else { 1021 packet_start(SSH_SMSG_X11_OPEN); 1022 packet_put_int(nc->self); 1023 if (packet_get_protocol_flags() & 1024 SSH_PROTOFLAG_HOST_IN_FWD_OPEN) 1025 packet_put_cstring(buf); 1026 packet_send(); 1027 } 1028 xfree(remote_ipaddr); 1029 } 1030} 1031 1032static void 1033port_open_helper(Channel *c, char *rtype) 1034{ 1035 int direct; 1036 char buf[1024]; 1037 char *remote_ipaddr = get_peer_ipaddr(c->sock); 1038 u_short remote_port = get_peer_port(c->sock); 1039 1040 direct = (strcmp(rtype, "direct-tcpip") == 0); 1041 1042 snprintf(buf, sizeof buf, 1043 "%s: listening port %d for %.100s port %d, " 1044 "connect from %.200s port %d", 1045 rtype, c->listening_port, c->path, c->host_port, 1046 remote_ipaddr, remote_port); 1047 1048 xfree(c->remote_name); 1049 c->remote_name = xstrdup(buf); 1050 1051 if (compat20) { 1052 packet_start(SSH2_MSG_CHANNEL_OPEN); 1053 packet_put_cstring(rtype); 1054 packet_put_int(c->self); 1055 packet_put_int(c->local_window_max); 1056 packet_put_int(c->local_maxpacket); 1057 if (direct) { 1058 /* target host, port */ 1059 packet_put_cstring(c->path); 1060 packet_put_int(c->host_port); 1061 } else { 1062 /* listen address, port */ 1063 packet_put_cstring(c->path); 1064 packet_put_int(c->listening_port); 1065 } 1066 /* originator host and port */ 1067 packet_put_cstring(remote_ipaddr); 1068 packet_put_int(remote_port); 1069 packet_send(); 1070 } else { 1071 packet_start(SSH_MSG_PORT_OPEN); 1072 packet_put_int(c->self); 1073 packet_put_cstring(c->path); 1074 packet_put_int(c->host_port); 1075 if (packet_get_protocol_flags() & 1076 SSH_PROTOFLAG_HOST_IN_FWD_OPEN) 1077 packet_put_cstring(c->remote_name); 1078 packet_send(); 1079 } 1080 xfree(remote_ipaddr); 1081} 1082 1083/* 1084 * This socket is listening for connections to a forwarded TCP/IP port. 1085 */ 1086static void 1087channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset) 1088{ 1089 Channel *nc; 1090 struct sockaddr addr; 1091 int newsock, nextstate; 1092 socklen_t addrlen; 1093 char *rtype; 1094 1095 if (FD_ISSET(c->sock, readset)) { 1096 debug("Connection to port %d forwarding " 1097 "to %.100s port %d requested.", 1098 c->listening_port, c->path, c->host_port); 1099 1100 if (c->type == SSH_CHANNEL_RPORT_LISTENER) { 1101 nextstate = SSH_CHANNEL_OPENING; 1102 rtype = "forwarded-tcpip"; 1103 } else { 1104 if (c->host_port == 0) { 1105 nextstate = SSH_CHANNEL_DYNAMIC; 1106 rtype = "dynamic-tcpip"; 1107 } else { 1108 nextstate = SSH_CHANNEL_OPENING; 1109 rtype = "direct-tcpip"; 1110 } 1111 } 1112 1113 addrlen = sizeof(addr); 1114 newsock = accept(c->sock, &addr, &addrlen); 1115 if (newsock < 0) { 1116 error("accept: %.100s", strerror(errno)); 1117 return; 1118 } 1119 set_nodelay(newsock); 1120 nc = channel_new(rtype, 1121 nextstate, newsock, newsock, -1, 1122 c->local_window_max, c->local_maxpacket, 1123 0, xstrdup(rtype), 1); 1124 nc->listening_port = c->listening_port; 1125 nc->host_port = c->host_port; 1126 strlcpy(nc->path, c->path, sizeof(nc->path)); 1127 1128 if (nextstate == SSH_CHANNEL_DYNAMIC) { 1129 /* 1130 * do not call the channel_post handler until 1131 * this flag has been reset by a pre-handler. 1132 * otherwise the FD_ISSET calls might overflow 1133 */ 1134 nc->delayed = 1; 1135 } else { 1136 port_open_helper(nc, rtype); 1137 } 1138 } 1139} 1140 1141/* 1142 * This is the authentication agent socket listening for connections from 1143 * clients. 1144 */ 1145static void 1146channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset) 1147{ 1148 Channel *nc; 1149 char *name; 1150 int newsock; 1151 struct sockaddr addr; 1152 socklen_t addrlen; 1153 1154 if (FD_ISSET(c->sock, readset)) { 1155 addrlen = sizeof(addr); 1156 newsock = accept(c->sock, &addr, &addrlen); 1157 if (newsock < 0) { 1158 error("accept from auth socket: %.100s", strerror(errno)); 1159 return; 1160 } 1161 name = xstrdup("accepted auth socket"); 1162 nc = channel_new("accepted auth socket", 1163 SSH_CHANNEL_OPENING, newsock, newsock, -1, 1164 c->local_window_max, c->local_maxpacket, 1165 0, name, 1); 1166 if (compat20) { 1167 packet_start(SSH2_MSG_CHANNEL_OPEN); 1168 packet_put_cstring("auth-agent@openssh.com"); 1169 packet_put_int(nc->self); 1170 packet_put_int(c->local_window_max); 1171 packet_put_int(c->local_maxpacket); 1172 } else { 1173 packet_start(SSH_SMSG_AGENT_OPEN); 1174 packet_put_int(nc->self); 1175 } 1176 packet_send(); 1177 } 1178} 1179 1180static void 1181channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset) 1182{ 1183 int err = 0; 1184 socklen_t sz = sizeof(err); 1185 1186 if (FD_ISSET(c->sock, writeset)) { 1187 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, &err, &sz) < 0) { 1188 err = errno; 1189 error("getsockopt SO_ERROR failed"); 1190 } 1191 if (err == 0) { 1192 debug("channel %d: connected", c->self); 1193 c->type = SSH_CHANNEL_OPEN; 1194 if (compat20) { 1195 packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); 1196 packet_put_int(c->remote_id); 1197 packet_put_int(c->self); 1198 packet_put_int(c->local_window); 1199 packet_put_int(c->local_maxpacket); 1200 } else { 1201 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); 1202 packet_put_int(c->remote_id); 1203 packet_put_int(c->self); 1204 } 1205 } else { 1206 debug("channel %d: not connected: %s", 1207 c->self, strerror(err)); 1208 if (compat20) { 1209 packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE); 1210 packet_put_int(c->remote_id); 1211 packet_put_int(SSH2_OPEN_CONNECT_FAILED); 1212 if (!(datafellows & SSH_BUG_OPENFAILURE)) { 1213 packet_put_cstring(strerror(err)); 1214 packet_put_cstring(""); 1215 } 1216 } else { 1217 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 1218 packet_put_int(c->remote_id); 1219 } 1220 chan_mark_dead(c); 1221 } 1222 packet_send(); 1223 } 1224} 1225 1226static int 1227channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset) 1228{ 1229 char buf[16*1024]; 1230 int len; 1231 1232 if (c->rfd != -1 && 1233 FD_ISSET(c->rfd, readset)) { 1234 len = read(c->rfd, buf, sizeof(buf)); 1235 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 1236 return 1; 1237 if (len <= 0) { 1238 debug("channel %d: read<=0 rfd %d len %d", 1239 c->self, c->rfd, len); 1240 if (c->type != SSH_CHANNEL_OPEN) { 1241 debug("channel %d: not open", c->self); 1242 chan_mark_dead(c); 1243 return -1; 1244 } else if (compat13) { 1245 buffer_clear(&c->output); 1246 c->type = SSH_CHANNEL_INPUT_DRAINING; 1247 debug("channel %d: input draining.", c->self); 1248 } else { 1249 chan_read_failed(c); 1250 } 1251 return -1; 1252 } 1253 if (c->input_filter != NULL) { 1254 if (c->input_filter(c, buf, len) == -1) { 1255 debug("channel %d: filter stops", c->self); 1256 chan_read_failed(c); 1257 } 1258 } else { 1259 buffer_append(&c->input, buf, len); 1260 } 1261 } 1262 return 1; 1263} 1264static int 1265channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset) 1266{ 1267 struct termios tio; 1268 u_char *data; 1269 u_int dlen; 1270 int len; 1271 1272 /* Send buffered output data to the socket. */ 1273 if (c->wfd != -1 && 1274 FD_ISSET(c->wfd, writeset) && 1275 buffer_len(&c->output) > 0) { 1276 data = buffer_ptr(&c->output); 1277 dlen = buffer_len(&c->output); 1278 len = write(c->wfd, data, dlen); 1279 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 1280 return 1; 1281 if (len <= 0) { 1282 if (c->type != SSH_CHANNEL_OPEN) { 1283 debug("channel %d: not open", c->self); 1284 chan_mark_dead(c); 1285 return -1; 1286 } else if (compat13) { 1287 buffer_clear(&c->output); 1288 debug("channel %d: input draining.", c->self); 1289 c->type = SSH_CHANNEL_INPUT_DRAINING; 1290 } else { 1291 chan_write_failed(c); 1292 } 1293 return -1; 1294 } 1295 if (compat20 && c->isatty && dlen >= 1 && data[0] != '\r') { 1296 if (tcgetattr(c->wfd, &tio) == 0 && 1297 !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) { 1298 /* 1299 * Simulate echo to reduce the impact of 1300 * traffic analysis. We need to match the 1301 * size of a SSH2_MSG_CHANNEL_DATA message 1302 * (4 byte channel id + data) 1303 */ 1304 packet_send_ignore(4 + len); 1305 packet_send(); 1306 } 1307 } 1308 buffer_consume(&c->output, len); 1309 if (compat20 && len > 0) { 1310 c->local_consumed += len; 1311 } 1312 } 1313 return 1; 1314} 1315static int 1316channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset) 1317{ 1318 char buf[16*1024]; 1319 int len; 1320 1321/** XXX handle drain efd, too */ 1322 if (c->efd != -1) { 1323 if (c->extended_usage == CHAN_EXTENDED_WRITE && 1324 FD_ISSET(c->efd, writeset) && 1325 buffer_len(&c->extended) > 0) { 1326 len = write(c->efd, buffer_ptr(&c->extended), 1327 buffer_len(&c->extended)); 1328 debug2("channel %d: written %d to efd %d", 1329 c->self, len, c->efd); 1330 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 1331 return 1; 1332 if (len <= 0) { 1333 debug2("channel %d: closing write-efd %d", 1334 c->self, c->efd); 1335 channel_close_fd(&c->efd); 1336 } else { 1337 buffer_consume(&c->extended, len); 1338 c->local_consumed += len; 1339 } 1340 } else if (c->extended_usage == CHAN_EXTENDED_READ && 1341 FD_ISSET(c->efd, readset)) { 1342 len = read(c->efd, buf, sizeof(buf)); 1343 debug2("channel %d: read %d from efd %d", 1344 c->self, len, c->efd); 1345 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 1346 return 1; 1347 if (len <= 0) { 1348 debug2("channel %d: closing read-efd %d", 1349 c->self, c->efd); 1350 channel_close_fd(&c->efd); 1351 } else { 1352 buffer_append(&c->extended, buf, len); 1353 } 1354 } 1355 } 1356 return 1; 1357} 1358static int 1359channel_check_window(Channel *c) 1360{ 1361 if (c->type == SSH_CHANNEL_OPEN && 1362 !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) && 1363 c->local_window < c->local_window_max/2 && 1364 c->local_consumed > 0) { 1365 packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); 1366 packet_put_int(c->remote_id); 1367 packet_put_int(c->local_consumed); 1368 packet_send(); 1369 debug2("channel %d: window %d sent adjust %d", 1370 c->self, c->local_window, 1371 c->local_consumed); 1372 c->local_window += c->local_consumed; 1373 c->local_consumed = 0; 1374 } 1375 return 1; 1376} 1377 1378static void 1379channel_post_open(Channel *c, fd_set * readset, fd_set * writeset) 1380{ 1381 if (c->delayed) 1382 return; 1383 channel_handle_rfd(c, readset, writeset); 1384 channel_handle_wfd(c, readset, writeset); 1385 if (!compat20) 1386 return; 1387 channel_handle_efd(c, readset, writeset); 1388 channel_check_window(c); 1389} 1390 1391static void 1392channel_post_output_drain_13(Channel *c, fd_set * readset, fd_set * writeset) 1393{ 1394 int len; 1395 /* Send buffered output data to the socket. */ 1396 if (FD_ISSET(c->sock, writeset) && buffer_len(&c->output) > 0) { 1397 len = write(c->sock, buffer_ptr(&c->output), 1398 buffer_len(&c->output)); 1399 if (len <= 0) 1400 buffer_clear(&c->output); 1401 else 1402 buffer_consume(&c->output, len); 1403 } 1404} 1405 1406static void 1407channel_handler_init_20(void) 1408{ 1409 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open; 1410 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; 1411 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; 1412 channel_pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener; 1413 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; 1414 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; 1415 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; 1416 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; 1417 1418 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; 1419 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; 1420 channel_post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener; 1421 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; 1422 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; 1423 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; 1424 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; 1425} 1426 1427static void 1428channel_handler_init_13(void) 1429{ 1430 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open_13; 1431 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open_13; 1432 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; 1433 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; 1434 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; 1435 channel_pre[SSH_CHANNEL_INPUT_DRAINING] = &channel_pre_input_draining; 1436 channel_pre[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_pre_output_draining; 1437 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; 1438 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; 1439 1440 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; 1441 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; 1442 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; 1443 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; 1444 channel_post[SSH_CHANNEL_OUTPUT_DRAINING] = &channel_post_output_drain_13; 1445 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; 1446 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; 1447} 1448 1449static void 1450channel_handler_init_15(void) 1451{ 1452 channel_pre[SSH_CHANNEL_OPEN] = &channel_pre_open; 1453 channel_pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; 1454 channel_pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; 1455 channel_pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; 1456 channel_pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; 1457 channel_pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; 1458 channel_pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; 1459 1460 channel_post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; 1461 channel_post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; 1462 channel_post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; 1463 channel_post[SSH_CHANNEL_OPEN] = &channel_post_open; 1464 channel_post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; 1465 channel_post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; 1466} 1467 1468static void 1469channel_handler_init(void) 1470{ 1471 int i; 1472 for (i = 0; i < SSH_CHANNEL_MAX_TYPE; i++) { 1473 channel_pre[i] = NULL; 1474 channel_post[i] = NULL; 1475 } 1476 if (compat20) 1477 channel_handler_init_20(); 1478 else if (compat13) 1479 channel_handler_init_13(); 1480 else 1481 channel_handler_init_15(); 1482} 1483 1484/* gc dead channels */ 1485static void 1486channel_garbage_collect(Channel *c) 1487{ 1488 if (c == NULL) 1489 return; 1490 if (c->detach_user != NULL) { 1491 if (!chan_is_dead(c, 0)) 1492 return; 1493 debug("channel %d: gc: notify user", c->self); 1494 c->detach_user(c->self, NULL); 1495 /* if we still have a callback */ 1496 if (c->detach_user != NULL) 1497 return; 1498 debug("channel %d: gc: user detached", c->self); 1499 } 1500 if (!chan_is_dead(c, 1)) 1501 return; 1502 debug("channel %d: garbage collecting", c->self); 1503 channel_free(c); 1504} 1505 1506static void 1507channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset) 1508{ 1509 static int did_init = 0; 1510 int i; 1511 Channel *c; 1512 1513 if (!did_init) { 1514 channel_handler_init(); 1515 did_init = 1; 1516 } 1517 for (i = 0; i < channels_alloc; i++) { 1518 c = channels[i]; 1519 if (c == NULL) 1520 continue; 1521 if (ftab[c->type] != NULL) 1522 (*ftab[c->type])(c, readset, writeset); 1523 channel_garbage_collect(c); 1524 } 1525} 1526 1527/* 1528 * Allocate/update select bitmasks and add any bits relevant to channels in 1529 * select bitmasks. 1530 */ 1531void 1532channel_prepare_select(fd_set **readsetp, fd_set **writesetp, int *maxfdp, 1533 int *nallocp, int rekeying) 1534{ 1535 int n; 1536 u_int sz; 1537 1538 n = MAX(*maxfdp, channel_max_fd); 1539 1540 sz = howmany(n+1, NFDBITS) * sizeof(fd_mask); 1541 /* perhaps check sz < nalloc/2 and shrink? */ 1542 if (*readsetp == NULL || sz > *nallocp) { 1543 *readsetp = xrealloc(*readsetp, sz); 1544 *writesetp = xrealloc(*writesetp, sz); 1545 *nallocp = sz; 1546 } 1547 *maxfdp = n; 1548 memset(*readsetp, 0, sz); 1549 memset(*writesetp, 0, sz); 1550 1551 if (!rekeying) 1552 channel_handler(channel_pre, *readsetp, *writesetp); 1553} 1554 1555/* 1556 * After select, perform any appropriate operations for channels which have 1557 * events pending. 1558 */ 1559void 1560channel_after_select(fd_set * readset, fd_set * writeset) 1561{ 1562 channel_handler(channel_post, readset, writeset); 1563} 1564 1565 1566/* If there is data to send to the connection, enqueue some of it now. */ 1567 1568void 1569channel_output_poll(void) 1570{ 1571 int len, i; 1572 Channel *c; 1573 1574 for (i = 0; i < channels_alloc; i++) { 1575 c = channels[i]; 1576 if (c == NULL) 1577 continue; 1578 1579 /* 1580 * We are only interested in channels that can have buffered 1581 * incoming data. 1582 */ 1583 if (compat13) { 1584 if (c->type != SSH_CHANNEL_OPEN && 1585 c->type != SSH_CHANNEL_INPUT_DRAINING) 1586 continue; 1587 } else { 1588 if (c->type != SSH_CHANNEL_OPEN) 1589 continue; 1590 } 1591 if (compat20 && 1592 (c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) { 1593 /* XXX is this true? */ 1594 debug3("channel %d: will not send data after close", c->self); 1595 continue; 1596 } 1597 1598 /* Get the amount of buffered data for this channel. */ 1599 if ((c->istate == CHAN_INPUT_OPEN || 1600 c->istate == CHAN_INPUT_WAIT_DRAIN) && 1601 (len = buffer_len(&c->input)) > 0) { 1602 /* 1603 * Send some data for the other side over the secure 1604 * connection. 1605 */ 1606 if (compat20) { 1607 if (len > c->remote_window) 1608 len = c->remote_window; 1609 if (len > c->remote_maxpacket) 1610 len = c->remote_maxpacket; 1611 } else { 1612 if (packet_is_interactive()) { 1613 if (len > 1024) 1614 len = 512; 1615 } else { 1616 /* Keep the packets at reasonable size. */ 1617 if (len > packet_get_maxsize()/2) 1618 len = packet_get_maxsize()/2; 1619 } 1620 } 1621 if (len > 0) { 1622 packet_start(compat20 ? 1623 SSH2_MSG_CHANNEL_DATA : SSH_MSG_CHANNEL_DATA); 1624 packet_put_int(c->remote_id); 1625 packet_put_string(buffer_ptr(&c->input), len); 1626 packet_send(); 1627 buffer_consume(&c->input, len); 1628 c->remote_window -= len; 1629 } 1630 } else if (c->istate == CHAN_INPUT_WAIT_DRAIN) { 1631 if (compat13) 1632 fatal("cannot happen: istate == INPUT_WAIT_DRAIN for proto 1.3"); 1633 /* 1634 * input-buffer is empty and read-socket shutdown: 1635 * tell peer, that we will not send more data: send IEOF. 1636 * hack for extended data: delay EOF if EFD still in use. 1637 */ 1638 if (CHANNEL_EFD_INPUT_ACTIVE(c)) 1639 debug2("channel %d: ibuf_empty delayed efd %d/(%d)", 1640 c->self, c->efd, buffer_len(&c->extended)); 1641 else 1642 chan_ibuf_empty(c); 1643 } 1644 /* Send extended data, i.e. stderr */ 1645 if (compat20 && 1646 !(c->flags & CHAN_EOF_SENT) && 1647 c->remote_window > 0 && 1648 (len = buffer_len(&c->extended)) > 0 && 1649 c->extended_usage == CHAN_EXTENDED_READ) { 1650 debug2("channel %d: rwin %d elen %d euse %d", 1651 c->self, c->remote_window, buffer_len(&c->extended), 1652 c->extended_usage); 1653 if (len > c->remote_window) 1654 len = c->remote_window; 1655 if (len > c->remote_maxpacket) 1656 len = c->remote_maxpacket; 1657 packet_start(SSH2_MSG_CHANNEL_EXTENDED_DATA); 1658 packet_put_int(c->remote_id); 1659 packet_put_int(SSH2_EXTENDED_DATA_STDERR); 1660 packet_put_string(buffer_ptr(&c->extended), len); 1661 packet_send(); 1662 buffer_consume(&c->extended, len); 1663 c->remote_window -= len; 1664 debug2("channel %d: sent ext data %d", c->self, len); 1665 } 1666 } 1667} 1668 1669 1670/* -- protocol input */ 1671 1672void 1673channel_input_data(int type, u_int32_t seq, void *ctxt) 1674{ 1675 int id; 1676 char *data; 1677 u_int data_len; 1678 Channel *c; 1679 1680 /* Get the channel number and verify it. */ 1681 id = packet_get_int(); 1682 c = channel_lookup(id); 1683 if (c == NULL) 1684 packet_disconnect("Received data for nonexistent channel %d.", id); 1685 1686 /* Ignore any data for non-open channels (might happen on close) */ 1687 if (c->type != SSH_CHANNEL_OPEN && 1688 c->type != SSH_CHANNEL_X11_OPEN) 1689 return; 1690 1691 /* same for protocol 1.5 if output end is no longer open */ 1692 if (!compat13 && c->ostate != CHAN_OUTPUT_OPEN) 1693 return; 1694 1695 /* Get the data. */ 1696 data = packet_get_string(&data_len); 1697 1698 if (compat20) { 1699 if (data_len > c->local_maxpacket) { 1700 log("channel %d: rcvd big packet %d, maxpack %d", 1701 c->self, data_len, c->local_maxpacket); 1702 } 1703 if (data_len > c->local_window) { 1704 log("channel %d: rcvd too much data %d, win %d", 1705 c->self, data_len, c->local_window); 1706 xfree(data); 1707 return; 1708 } 1709 c->local_window -= data_len; 1710 } 1711 packet_check_eom(); 1712 buffer_append(&c->output, data, data_len); 1713 xfree(data); 1714} 1715 1716void 1717channel_input_extended_data(int type, u_int32_t seq, void *ctxt) 1718{ 1719 int id; 1720 int tcode; 1721 char *data; 1722 u_int data_len; 1723 Channel *c; 1724 1725 /* Get the channel number and verify it. */ 1726 id = packet_get_int(); 1727 c = channel_lookup(id); 1728 1729 if (c == NULL) 1730 packet_disconnect("Received extended_data for bad channel %d.", id); 1731 if (c->type != SSH_CHANNEL_OPEN) { 1732 log("channel %d: ext data for non open", id); 1733 return; 1734 } 1735 if (c->flags & CHAN_EOF_RCVD) { 1736 if (datafellows & SSH_BUG_EXTEOF) 1737 debug("channel %d: accepting ext data after eof", id); 1738 else 1739 packet_disconnect("Received extended_data after EOF " 1740 "on channel %d.", id); 1741 } 1742 tcode = packet_get_int(); 1743 if (c->efd == -1 || 1744 c->extended_usage != CHAN_EXTENDED_WRITE || 1745 tcode != SSH2_EXTENDED_DATA_STDERR) { 1746 log("channel %d: bad ext data", c->self); 1747 return; 1748 } 1749 data = packet_get_string(&data_len); 1750 packet_check_eom(); 1751 if (data_len > c->local_window) { 1752 log("channel %d: rcvd too much extended_data %d, win %d", 1753 c->self, data_len, c->local_window); 1754 xfree(data); 1755 return; 1756 } 1757 debug2("channel %d: rcvd ext data %d", c->self, data_len); 1758 c->local_window -= data_len; 1759 buffer_append(&c->extended, data, data_len); 1760 xfree(data); 1761} 1762 1763void 1764channel_input_ieof(int type, u_int32_t seq, void *ctxt) 1765{ 1766 int id; 1767 Channel *c; 1768 1769 id = packet_get_int(); 1770 packet_check_eom(); 1771 c = channel_lookup(id); 1772 if (c == NULL) 1773 packet_disconnect("Received ieof for nonexistent channel %d.", id); 1774 chan_rcvd_ieof(c); 1775 1776 /* XXX force input close */ 1777 if (c->force_drain && c->istate == CHAN_INPUT_OPEN) { 1778 debug("channel %d: FORCE input drain", c->self); 1779 c->istate = CHAN_INPUT_WAIT_DRAIN; 1780 if (buffer_len(&c->input) == 0) 1781 chan_ibuf_empty(c); 1782 } 1783 1784} 1785 1786void 1787channel_input_close(int type, u_int32_t seq, void *ctxt) 1788{ 1789 int id; 1790 Channel *c; 1791 1792 id = packet_get_int(); 1793 packet_check_eom(); 1794 c = channel_lookup(id); 1795 if (c == NULL) 1796 packet_disconnect("Received close for nonexistent channel %d.", id); 1797 1798 /* 1799 * Send a confirmation that we have closed the channel and no more 1800 * data is coming for it. 1801 */ 1802 packet_start(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION); 1803 packet_put_int(c->remote_id); 1804 packet_send(); 1805 1806 /* 1807 * If the channel is in closed state, we have sent a close request, 1808 * and the other side will eventually respond with a confirmation. 1809 * Thus, we cannot free the channel here, because then there would be 1810 * no-one to receive the confirmation. The channel gets freed when 1811 * the confirmation arrives. 1812 */ 1813 if (c->type != SSH_CHANNEL_CLOSED) { 1814 /* 1815 * Not a closed channel - mark it as draining, which will 1816 * cause it to be freed later. 1817 */ 1818 buffer_clear(&c->input); 1819 c->type = SSH_CHANNEL_OUTPUT_DRAINING; 1820 } 1821} 1822 1823/* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */ 1824void 1825channel_input_oclose(int type, u_int32_t seq, void *ctxt) 1826{ 1827 int id = packet_get_int(); 1828 Channel *c = channel_lookup(id); 1829 1830 packet_check_eom(); 1831 if (c == NULL) 1832 packet_disconnect("Received oclose for nonexistent channel %d.", id); 1833 chan_rcvd_oclose(c); 1834} 1835 1836void 1837channel_input_close_confirmation(int type, u_int32_t seq, void *ctxt) 1838{ 1839 int id = packet_get_int(); 1840 Channel *c = channel_lookup(id); 1841 1842 packet_check_eom(); 1843 if (c == NULL) 1844 packet_disconnect("Received close confirmation for " 1845 "out-of-range channel %d.", id); 1846 if (c->type != SSH_CHANNEL_CLOSED) 1847 packet_disconnect("Received close confirmation for " 1848 "non-closed channel %d (type %d).", id, c->type); 1849 channel_free(c); 1850} 1851 1852void 1853channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt) 1854{ 1855 int id, remote_id; 1856 Channel *c; 1857 1858 id = packet_get_int(); 1859 c = channel_lookup(id); 1860 1861 if (c==NULL || c->type != SSH_CHANNEL_OPENING) 1862 packet_disconnect("Received open confirmation for " 1863 "non-opening channel %d.", id); 1864 remote_id = packet_get_int(); 1865 /* Record the remote channel number and mark that the channel is now open. */ 1866 c->remote_id = remote_id; 1867 c->type = SSH_CHANNEL_OPEN; 1868 1869 if (compat20) { 1870 c->remote_window = packet_get_int(); 1871 c->remote_maxpacket = packet_get_int(); 1872 if (c->confirm) { 1873 debug2("callback start"); 1874 c->confirm(c->self, NULL); 1875 debug2("callback done"); 1876 } 1877 debug("channel %d: open confirm rwindow %d rmax %d", c->self, 1878 c->remote_window, c->remote_maxpacket); 1879 } 1880 packet_check_eom(); 1881} 1882 1883static char * 1884reason2txt(int reason) 1885{ 1886 switch (reason) { 1887 case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED: 1888 return "administratively prohibited"; 1889 case SSH2_OPEN_CONNECT_FAILED: 1890 return "connect failed"; 1891 case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE: 1892 return "unknown channel type"; 1893 case SSH2_OPEN_RESOURCE_SHORTAGE: 1894 return "resource shortage"; 1895 } 1896 return "unknown reason"; 1897} 1898 1899void 1900channel_input_open_failure(int type, u_int32_t seq, void *ctxt) 1901{ 1902 int id, reason; 1903 char *msg = NULL, *lang = NULL; 1904 Channel *c; 1905 1906 id = packet_get_int(); 1907 c = channel_lookup(id); 1908 1909 if (c==NULL || c->type != SSH_CHANNEL_OPENING) 1910 packet_disconnect("Received open failure for " 1911 "non-opening channel %d.", id); 1912 if (compat20) { 1913 reason = packet_get_int(); 1914 if (!(datafellows & SSH_BUG_OPENFAILURE)) { 1915 msg = packet_get_string(NULL); 1916 lang = packet_get_string(NULL); 1917 } 1918 log("channel %d: open failed: %s%s%s", id, 1919 reason2txt(reason), msg ? ": ": "", msg ? msg : ""); 1920 if (msg != NULL) 1921 xfree(msg); 1922 if (lang != NULL) 1923 xfree(lang); 1924 } 1925 packet_check_eom(); 1926 /* Free the channel. This will also close the socket. */ 1927 channel_free(c); 1928} 1929 1930void 1931channel_input_window_adjust(int type, u_int32_t seq, void *ctxt) 1932{ 1933 Channel *c; 1934 int id, adjust; 1935 1936 if (!compat20) 1937 return; 1938 1939 /* Get the channel number and verify it. */ 1940 id = packet_get_int(); 1941 c = channel_lookup(id); 1942 1943 if (c == NULL || c->type != SSH_CHANNEL_OPEN) { 1944 log("Received window adjust for " 1945 "non-open channel %d.", id); 1946 return; 1947 } 1948 adjust = packet_get_int(); 1949 packet_check_eom(); 1950 debug2("channel %d: rcvd adjust %d", id, adjust); 1951 c->remote_window += adjust; 1952} 1953 1954void 1955channel_input_port_open(int type, u_int32_t seq, void *ctxt) 1956{ 1957 Channel *c = NULL; 1958 u_short host_port; 1959 char *host, *originator_string; 1960 int remote_id, sock = -1; 1961 1962 remote_id = packet_get_int(); 1963 host = packet_get_string(NULL); 1964 host_port = packet_get_int(); 1965 1966 if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) { 1967 originator_string = packet_get_string(NULL); 1968 } else { 1969 originator_string = xstrdup("unknown (remote did not supply name)"); 1970 } 1971 packet_check_eom(); 1972 sock = channel_connect_to(host, host_port); 1973 if (sock != -1) { 1974 c = channel_new("connected socket", 1975 SSH_CHANNEL_CONNECTING, sock, sock, -1, 0, 0, 0, 1976 originator_string, 1); 1977 c->remote_id = remote_id; 1978 } 1979 if (c == NULL) { 1980 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 1981 packet_put_int(remote_id); 1982 packet_send(); 1983 } 1984 xfree(host); 1985} 1986 1987 1988/* -- tcp forwarding */ 1989 1990void 1991channel_set_af(int af) 1992{ 1993 IPv4or6 = af; 1994} 1995 1996static int 1997channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_port, 1998 const char *host_to_connect, u_short port_to_connect, int gateway_ports) 1999{ 2000 Channel *c; 2001 int success, sock, on = 1; 2002 struct addrinfo hints, *ai, *aitop; 2003 const char *host; 2004 char ntop[NI_MAXHOST], strport[NI_MAXSERV]; 2005 struct linger linger; 2006 2007 success = 0; 2008 host = (type == SSH_CHANNEL_RPORT_LISTENER) ? 2009 listen_addr : host_to_connect; 2010 2011 if (host == NULL) { 2012 error("No forward host name."); 2013 return success; 2014 } 2015 if (strlen(host) > SSH_CHANNEL_PATH_LEN - 1) { 2016 error("Forward host name too long."); 2017 return success; 2018 } 2019 2020 /* 2021 * getaddrinfo returns a loopback address if the hostname is 2022 * set to NULL and hints.ai_flags is not AI_PASSIVE 2023 */ 2024 memset(&hints, 0, sizeof(hints)); 2025 hints.ai_family = IPv4or6; 2026 hints.ai_flags = gateway_ports ? AI_PASSIVE : 0; 2027 hints.ai_socktype = SOCK_STREAM; 2028 snprintf(strport, sizeof strport, "%d", listen_port); 2029 if (getaddrinfo(NULL, strport, &hints, &aitop) != 0) 2030 packet_disconnect("getaddrinfo: fatal error"); 2031 2032 for (ai = aitop; ai; ai = ai->ai_next) { 2033 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) 2034 continue; 2035 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), 2036 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { 2037 error("channel_setup_fwd_listener: getnameinfo failed"); 2038 continue; 2039 } 2040 /* Create a port to listen for the host. */ 2041 sock = socket(ai->ai_family, SOCK_STREAM, 0); 2042 if (sock < 0) { 2043 /* this is no error since kernel may not support ipv6 */ 2044 verbose("socket: %.100s", strerror(errno)); 2045 continue; 2046 } 2047 /* 2048 * Set socket options. We would like the socket to disappear 2049 * as soon as it has been closed for whatever reason. 2050 */ 2051 setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)); 2052 linger.l_onoff = 1; 2053 linger.l_linger = 5; 2054 setsockopt(sock, SOL_SOCKET, SO_LINGER, &linger, sizeof(linger)); 2055 debug("Local forwarding listening on %s port %s.", ntop, strport); 2056 2057 /* Bind the socket to the address. */ 2058 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 2059 /* address can be in use ipv6 address is already bound */ 2060 if (!ai->ai_next) 2061 error("bind: %.100s", strerror(errno)); 2062 else 2063 verbose("bind: %.100s", strerror(errno)); 2064 2065 close(sock); 2066 continue; 2067 } 2068 /* Start listening for connections on the socket. */ 2069 if (listen(sock, 5) < 0) { 2070 error("listen: %.100s", strerror(errno)); 2071 close(sock); 2072 continue; 2073 } 2074 /* Allocate a channel number for the socket. */ 2075 c = channel_new("port listener", type, sock, sock, -1, 2076 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 2077 0, xstrdup("port listener"), 1); 2078 strlcpy(c->path, host, sizeof(c->path)); 2079 c->host_port = port_to_connect; 2080 c->listening_port = listen_port; 2081 success = 1; 2082 } 2083 if (success == 0) 2084 error("channel_setup_fwd_listener: cannot listen to port: %d", 2085 listen_port); 2086 freeaddrinfo(aitop); 2087 return success; 2088} 2089 2090/* protocol local port fwd, used by ssh (and sshd in v1) */ 2091int 2092channel_setup_local_fwd_listener(u_short listen_port, 2093 const char *host_to_connect, u_short port_to_connect, int gateway_ports) 2094{ 2095 return channel_setup_fwd_listener(SSH_CHANNEL_PORT_LISTENER, 2096 NULL, listen_port, host_to_connect, port_to_connect, gateway_ports); 2097} 2098 2099/* protocol v2 remote port fwd, used by sshd */ 2100int 2101channel_setup_remote_fwd_listener(const char *listen_address, 2102 u_short listen_port, int gateway_ports) 2103{ 2104 return channel_setup_fwd_listener(SSH_CHANNEL_RPORT_LISTENER, 2105 listen_address, listen_port, NULL, 0, gateway_ports); 2106} 2107 2108/* 2109 * Initiate forwarding of connections to port "port" on remote host through 2110 * the secure channel to host:port from local side. 2111 */ 2112 2113void 2114channel_request_remote_forwarding(u_short listen_port, 2115 const char *host_to_connect, u_short port_to_connect) 2116{ 2117 int type, success = 0; 2118 2119 /* Record locally that connection to this host/port is permitted. */ 2120 if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) 2121 fatal("channel_request_remote_forwarding: too many forwards"); 2122 2123 /* Send the forward request to the remote side. */ 2124 if (compat20) { 2125 const char *address_to_bind = "0.0.0.0"; 2126 packet_start(SSH2_MSG_GLOBAL_REQUEST); 2127 packet_put_cstring("tcpip-forward"); 2128 packet_put_char(1); /* boolean: want reply */ 2129 packet_put_cstring(address_to_bind); 2130 packet_put_int(listen_port); 2131 packet_send(); 2132 packet_write_wait(); 2133 /* Assume that server accepts the request */ 2134 success = 1; 2135 } else { 2136 packet_start(SSH_CMSG_PORT_FORWARD_REQUEST); 2137 packet_put_int(listen_port); 2138 packet_put_cstring(host_to_connect); 2139 packet_put_int(port_to_connect); 2140 packet_send(); 2141 packet_write_wait(); 2142 2143 /* Wait for response from the remote side. */ 2144 type = packet_read(); 2145 switch (type) { 2146 case SSH_SMSG_SUCCESS: 2147 success = 1; 2148 break; 2149 case SSH_SMSG_FAILURE: 2150 log("Warning: Server denied remote port forwarding."); 2151 break; 2152 default: 2153 /* Unknown packet */ 2154 packet_disconnect("Protocol error for port forward request:" 2155 "received packet type %d.", type); 2156 } 2157 } 2158 if (success) { 2159 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host_to_connect); 2160 permitted_opens[num_permitted_opens].port_to_connect = port_to_connect; 2161 permitted_opens[num_permitted_opens].listen_port = listen_port; 2162 num_permitted_opens++; 2163 } 2164} 2165 2166/* 2167 * This is called after receiving CHANNEL_FORWARDING_REQUEST. This initates 2168 * listening for the port, and sends back a success reply (or disconnect 2169 * message if there was an error). This never returns if there was an error. 2170 */ 2171 2172void 2173channel_input_port_forward_request(int is_root, int gateway_ports) 2174{ 2175 u_short port, host_port; 2176 char *hostname; 2177 2178 /* Get arguments from the packet. */ 2179 port = packet_get_int(); 2180 hostname = packet_get_string(NULL); 2181 host_port = packet_get_int(); 2182 2183#ifndef HAVE_CYGWIN 2184 /* 2185 * Check that an unprivileged user is not trying to forward a 2186 * privileged port. 2187 */ 2188 if (port < IPPORT_RESERVED && !is_root) 2189 packet_disconnect("Requested forwarding of port %d but user is not root.", 2190 port); 2191#endif 2192 /* Initiate forwarding */ 2193 channel_setup_local_fwd_listener(port, hostname, host_port, gateway_ports); 2194 2195 /* Free the argument string. */ 2196 xfree(hostname); 2197} 2198 2199/* 2200 * Permits opening to any host/port if permitted_opens[] is empty. This is 2201 * usually called by the server, because the user could connect to any port 2202 * anyway, and the server has no way to know but to trust the client anyway. 2203 */ 2204void 2205channel_permit_all_opens(void) 2206{ 2207 if (num_permitted_opens == 0) 2208 all_opens_permitted = 1; 2209} 2210 2211void 2212channel_add_permitted_opens(char *host, int port) 2213{ 2214 if (num_permitted_opens >= SSH_MAX_FORWARDS_PER_DIRECTION) 2215 fatal("channel_request_remote_forwarding: too many forwards"); 2216 debug("allow port forwarding to host %s port %d", host, port); 2217 2218 permitted_opens[num_permitted_opens].host_to_connect = xstrdup(host); 2219 permitted_opens[num_permitted_opens].port_to_connect = port; 2220 num_permitted_opens++; 2221 2222 all_opens_permitted = 0; 2223} 2224 2225void 2226channel_clear_permitted_opens(void) 2227{ 2228 int i; 2229 2230 for (i = 0; i < num_permitted_opens; i++) 2231 xfree(permitted_opens[i].host_to_connect); 2232 num_permitted_opens = 0; 2233 2234} 2235 2236 2237/* return socket to remote host, port */ 2238static int 2239connect_to(const char *host, u_short port) 2240{ 2241 struct addrinfo hints, *ai, *aitop; 2242 char ntop[NI_MAXHOST], strport[NI_MAXSERV]; 2243 int gaierr; 2244 int sock = -1; 2245 2246 memset(&hints, 0, sizeof(hints)); 2247 hints.ai_family = IPv4or6; 2248 hints.ai_socktype = SOCK_STREAM; 2249 snprintf(strport, sizeof strport, "%d", port); 2250 if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) { 2251 error("connect_to %.100s: unknown host (%s)", host, 2252 gai_strerror(gaierr)); 2253 return -1; 2254 } 2255 for (ai = aitop; ai; ai = ai->ai_next) { 2256 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) 2257 continue; 2258 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), 2259 strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { 2260 error("connect_to: getnameinfo failed"); 2261 continue; 2262 } 2263 sock = socket(ai->ai_family, SOCK_STREAM, 0); 2264 if (sock < 0) { 2265 error("socket: %.100s", strerror(errno)); 2266 continue; 2267 } 2268 if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0) 2269 fatal("connect_to: F_SETFL: %s", strerror(errno)); 2270 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 && 2271 errno != EINPROGRESS) { 2272 error("connect_to %.100s port %s: %.100s", ntop, strport, 2273 strerror(errno)); 2274 close(sock); 2275 continue; /* fail -- try next */ 2276 } 2277 break; /* success */ 2278 2279 } 2280 freeaddrinfo(aitop); 2281 if (!ai) { 2282 error("connect_to %.100s port %d: failed.", host, port); 2283 return -1; 2284 } 2285 /* success */ 2286 set_nodelay(sock); 2287 return sock; 2288} 2289 2290int 2291channel_connect_by_listen_address(u_short listen_port) 2292{ 2293 int i; 2294 2295 for (i = 0; i < num_permitted_opens; i++) 2296 if (permitted_opens[i].listen_port == listen_port) 2297 return connect_to( 2298 permitted_opens[i].host_to_connect, 2299 permitted_opens[i].port_to_connect); 2300 error("WARNING: Server requests forwarding for unknown listen_port %d", 2301 listen_port); 2302 return -1; 2303} 2304 2305/* Check if connecting to that port is permitted and connect. */ 2306int 2307channel_connect_to(const char *host, u_short port) 2308{ 2309 int i, permit; 2310 2311 permit = all_opens_permitted; 2312 if (!permit) { 2313 for (i = 0; i < num_permitted_opens; i++) 2314 if (permitted_opens[i].port_to_connect == port && 2315 strcmp(permitted_opens[i].host_to_connect, host) == 0) 2316 permit = 1; 2317 2318 } 2319 if (!permit) { 2320 log("Received request to connect to host %.100s port %d, " 2321 "but the request was denied.", host, port); 2322 return -1; 2323 } 2324 return connect_to(host, port); 2325} 2326 2327/* -- X11 forwarding */ 2328 2329/* 2330 * Creates an internet domain socket for listening for X11 connections. 2331 * Returns a suitable display number for the DISPLAY variable, or -1 if 2332 * an error occurs. 2333 */ 2334int 2335x11_create_display_inet(int x11_display_offset, int x11_use_localhost, 2336 int single_connection) 2337{ 2338 Channel *nc = NULL; 2339 int display_number, sock; 2340 u_short port; 2341 struct addrinfo hints, *ai, *aitop; 2342 char strport[NI_MAXSERV]; 2343 int gaierr, n, num_socks = 0, socks[NUM_SOCKS]; 2344 2345 for (display_number = x11_display_offset; 2346 display_number < MAX_DISPLAYS; 2347 display_number++) { 2348 port = 6000 + display_number; 2349 memset(&hints, 0, sizeof(hints)); 2350 hints.ai_family = IPv4or6; 2351 hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE; 2352 hints.ai_socktype = SOCK_STREAM; 2353 snprintf(strport, sizeof strport, "%d", port); 2354 if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) { 2355 error("getaddrinfo: %.100s", gai_strerror(gaierr)); 2356 return -1; 2357 } 2358 for (ai = aitop; ai; ai = ai->ai_next) { 2359 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) 2360 continue; 2361 sock = socket(ai->ai_family, SOCK_STREAM, 0); 2362 if (sock < 0) { 2363 if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) { 2364 error("socket: %.100s", strerror(errno)); 2365 return -1; 2366 } else { 2367 debug("x11_create_display_inet: Socket family %d not supported", 2368 ai->ai_family); 2369 continue; 2370 } 2371 } 2372#ifdef IPV6_V6ONLY 2373 if (ai->ai_family == AF_INET6) { 2374 int on = 1; 2375 if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) < 0) 2376 error("setsockopt IPV6_V6ONLY: %.100s", strerror(errno)); 2377 } 2378#endif 2379 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 2380 debug("bind port %d: %.100s", port, strerror(errno)); 2381 close(sock); 2382 2383 if (ai->ai_next) 2384 continue; 2385 2386 for (n = 0; n < num_socks; n++) { 2387 close(socks[n]); 2388 } 2389 num_socks = 0; 2390 break; 2391 } 2392 socks[num_socks++] = sock; 2393#ifndef DONT_TRY_OTHER_AF 2394 if (num_socks == NUM_SOCKS) 2395 break; 2396#else 2397 if (x11_use_localhost) { 2398 if (num_socks == NUM_SOCKS) 2399 break; 2400 } else { 2401 break; 2402 } 2403#endif 2404 } 2405 freeaddrinfo(aitop); 2406 if (num_socks > 0) 2407 break; 2408 } 2409 if (display_number >= MAX_DISPLAYS) { 2410 error("Failed to allocate internet-domain X11 display socket."); 2411 return -1; 2412 } 2413 /* Start listening for connections on the socket. */ 2414 for (n = 0; n < num_socks; n++) { 2415 sock = socks[n]; 2416 if (listen(sock, 5) < 0) { 2417 error("listen: %.100s", strerror(errno)); 2418 close(sock); 2419 return -1; 2420 } 2421 } 2422 2423 /* Allocate a channel for each socket. */ 2424 for (n = 0; n < num_socks; n++) { 2425 sock = socks[n]; 2426 nc = channel_new("x11 listener", 2427 SSH_CHANNEL_X11_LISTENER, sock, sock, -1, 2428 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 2429 0, xstrdup("X11 inet listener"), 1); 2430 nc->single_connection = single_connection; 2431 } 2432 2433 /* Return the display number for the DISPLAY environment variable. */ 2434 return display_number; 2435} 2436 2437static int 2438connect_local_xsocket(u_int dnr) 2439{ 2440 int sock; 2441 struct sockaddr_un addr; 2442 2443 sock = socket(AF_UNIX, SOCK_STREAM, 0); 2444 if (sock < 0) 2445 error("socket: %.100s", strerror(errno)); 2446 memset(&addr, 0, sizeof(addr)); 2447 addr.sun_family = AF_UNIX; 2448 snprintf(addr.sun_path, sizeof addr.sun_path, _PATH_UNIX_X, dnr); 2449 if (connect(sock, (struct sockaddr *) & addr, sizeof(addr)) == 0) 2450 return sock; 2451 close(sock); 2452 error("connect %.100s: %.100s", addr.sun_path, strerror(errno)); 2453 return -1; 2454} 2455 2456int 2457x11_connect_display(void) 2458{ 2459 int display_number, sock = 0; 2460 const char *display; 2461 char buf[1024], *cp; 2462 struct addrinfo hints, *ai, *aitop; 2463 char strport[NI_MAXSERV]; 2464 int gaierr; 2465 2466 /* Try to open a socket for the local X server. */ 2467 display = getenv("DISPLAY"); 2468 if (!display) { 2469 error("DISPLAY not set."); 2470 return -1; 2471 } 2472 /* 2473 * Now we decode the value of the DISPLAY variable and make a 2474 * connection to the real X server. 2475 */ 2476 2477 /* 2478 * Check if it is a unix domain socket. Unix domain displays are in 2479 * one of the following formats: unix:d[.s], :d[.s], ::d[.s] 2480 */ 2481 if (strncmp(display, "unix:", 5) == 0 || 2482 display[0] == ':') { 2483 /* Connect to the unix domain socket. */ 2484 if (sscanf(strrchr(display, ':') + 1, "%d", &display_number) != 1) { 2485 error("Could not parse display number from DISPLAY: %.100s", 2486 display); 2487 return -1; 2488 } 2489 /* Create a socket. */ 2490 sock = connect_local_xsocket(display_number); 2491 if (sock < 0) 2492 return -1; 2493 2494 /* OK, we now have a connection to the display. */ 2495 return sock; 2496 } 2497 /* 2498 * Connect to an inet socket. The DISPLAY value is supposedly 2499 * hostname:d[.s], where hostname may also be numeric IP address. 2500 */ 2501 strlcpy(buf, display, sizeof(buf)); 2502 cp = strchr(buf, ':'); 2503 if (!cp) { 2504 error("Could not find ':' in DISPLAY: %.100s", display); 2505 return -1; 2506 } 2507 *cp = 0; 2508 /* buf now contains the host name. But first we parse the display number. */ 2509 if (sscanf(cp + 1, "%d", &display_number) != 1) { 2510 error("Could not parse display number from DISPLAY: %.100s", 2511 display); 2512 return -1; 2513 } 2514 2515 /* Look up the host address */ 2516 memset(&hints, 0, sizeof(hints)); 2517 hints.ai_family = IPv4or6; 2518 hints.ai_socktype = SOCK_STREAM; 2519 snprintf(strport, sizeof strport, "%d", 6000 + display_number); 2520 if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) { 2521 error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr)); 2522 return -1; 2523 } 2524 for (ai = aitop; ai; ai = ai->ai_next) { 2525 /* Create a socket. */ 2526 sock = socket(ai->ai_family, SOCK_STREAM, 0); 2527 if (sock < 0) { 2528 debug("socket: %.100s", strerror(errno)); 2529 continue; 2530 } 2531 /* Connect it to the display. */ 2532 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 2533 debug("connect %.100s port %d: %.100s", buf, 2534 6000 + display_number, strerror(errno)); 2535 close(sock); 2536 continue; 2537 } 2538 /* Success */ 2539 break; 2540 } 2541 freeaddrinfo(aitop); 2542 if (!ai) { 2543 error("connect %.100s port %d: %.100s", buf, 6000 + display_number, 2544 strerror(errno)); 2545 return -1; 2546 } 2547 set_nodelay(sock); 2548 return sock; 2549} 2550 2551/* 2552 * This is called when SSH_SMSG_X11_OPEN is received. The packet contains 2553 * the remote channel number. We should do whatever we want, and respond 2554 * with either SSH_MSG_OPEN_CONFIRMATION or SSH_MSG_OPEN_FAILURE. 2555 */ 2556 2557void 2558x11_input_open(int type, u_int32_t seq, void *ctxt) 2559{ 2560 Channel *c = NULL; 2561 int remote_id, sock = 0; 2562 char *remote_host; 2563 2564 debug("Received X11 open request."); 2565 2566 remote_id = packet_get_int(); 2567 2568 if (packet_get_protocol_flags() & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) { 2569 remote_host = packet_get_string(NULL); 2570 } else { 2571 remote_host = xstrdup("unknown (remote did not supply name)"); 2572 } 2573 packet_check_eom(); 2574 2575 /* Obtain a connection to the real X display. */ 2576 sock = x11_connect_display(); 2577 if (sock != -1) { 2578 /* Allocate a channel for this connection. */ 2579 c = channel_new("connected x11 socket", 2580 SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0, 2581 remote_host, 1); 2582 c->remote_id = remote_id; 2583 c->force_drain = 1; 2584 } 2585 if (c == NULL) { 2586 /* Send refusal to the remote host. */ 2587 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 2588 packet_put_int(remote_id); 2589 } else { 2590 /* Send a confirmation to the remote host. */ 2591 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); 2592 packet_put_int(remote_id); 2593 packet_put_int(c->self); 2594 } 2595 packet_send(); 2596} 2597 2598/* dummy protocol handler that denies SSH-1 requests (agent/x11) */ 2599void 2600deny_input_open(int type, u_int32_t seq, void *ctxt) 2601{ 2602 int rchan = packet_get_int(); 2603 switch (type) { 2604 case SSH_SMSG_AGENT_OPEN: 2605 error("Warning: ssh server tried agent forwarding."); 2606 break; 2607 case SSH_SMSG_X11_OPEN: 2608 error("Warning: ssh server tried X11 forwarding."); 2609 break; 2610 default: 2611 error("deny_input_open: type %d", type); 2612 break; 2613 } 2614 error("Warning: this is probably a break in attempt by a malicious server."); 2615 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 2616 packet_put_int(rchan); 2617 packet_send(); 2618} 2619 2620/* 2621 * Requests forwarding of X11 connections, generates fake authentication 2622 * data, and enables authentication spoofing. 2623 * This should be called in the client only. 2624 */ 2625void 2626x11_request_forwarding_with_spoofing(int client_session_id, 2627 const char *proto, const char *data) 2628{ 2629 u_int data_len = (u_int) strlen(data) / 2; 2630 u_int i, value, len; 2631 char *new_data; 2632 int screen_number; 2633 const char *cp; 2634 u_int32_t rand = 0; 2635 2636 cp = getenv("DISPLAY"); 2637 if (cp) 2638 cp = strchr(cp, ':'); 2639 if (cp) 2640 cp = strchr(cp, '.'); 2641 if (cp) 2642 screen_number = atoi(cp + 1); 2643 else 2644 screen_number = 0; 2645 2646 /* Save protocol name. */ 2647 x11_saved_proto = xstrdup(proto); 2648 2649 /* 2650 * Extract real authentication data and generate fake data of the 2651 * same length. 2652 */ 2653 x11_saved_data = xmalloc(data_len); 2654 x11_fake_data = xmalloc(data_len); 2655 for (i = 0; i < data_len; i++) { 2656 if (sscanf(data + 2 * i, "%2x", &value) != 1) 2657 fatal("x11_request_forwarding: bad authentication data: %.100s", data); 2658 if (i % 4 == 0) 2659 rand = arc4random(); 2660 x11_saved_data[i] = value; 2661 x11_fake_data[i] = rand & 0xff; 2662 rand >>= 8; 2663 } 2664 x11_saved_data_len = data_len; 2665 x11_fake_data_len = data_len; 2666 2667 /* Convert the fake data into hex. */ 2668 len = 2 * data_len + 1; 2669 new_data = xmalloc(len); 2670 for (i = 0; i < data_len; i++) 2671 snprintf(new_data + 2 * i, len - 2 * i, 2672 "%02x", (u_char) x11_fake_data[i]); 2673 2674 /* Send the request packet. */ 2675 if (compat20) { 2676 channel_request_start(client_session_id, "x11-req", 0); 2677 packet_put_char(0); /* XXX bool single connection */ 2678 } else { 2679 packet_start(SSH_CMSG_X11_REQUEST_FORWARDING); 2680 } 2681 packet_put_cstring(proto); 2682 packet_put_cstring(new_data); 2683 packet_put_int(screen_number); 2684 packet_send(); 2685 packet_write_wait(); 2686 xfree(new_data); 2687} 2688 2689 2690/* -- agent forwarding */ 2691 2692/* Sends a message to the server to request authentication fd forwarding. */ 2693 2694void 2695auth_request_forwarding(void) 2696{ 2697 packet_start(SSH_CMSG_AGENT_REQUEST_FORWARDING); 2698 packet_send(); 2699 packet_write_wait(); 2700} 2701 2702/* This is called to process an SSH_SMSG_AGENT_OPEN message. */ 2703 2704void 2705auth_input_open_request(int type, u_int32_t seq, void *ctxt) 2706{ 2707 Channel *c = NULL; 2708 int remote_id, sock; 2709 char *name; 2710 2711 /* Read the remote channel number from the message. */ 2712 remote_id = packet_get_int(); 2713 packet_check_eom(); 2714 2715 /* 2716 * Get a connection to the local authentication agent (this may again 2717 * get forwarded). 2718 */ 2719 sock = ssh_get_authentication_socket(); 2720 2721 /* 2722 * If we could not connect the agent, send an error message back to 2723 * the server. This should never happen unless the agent dies, 2724 * because authentication forwarding is only enabled if we have an 2725 * agent. 2726 */ 2727 if (sock >= 0) { 2728 name = xstrdup("authentication agent connection"); 2729 c = channel_new("", SSH_CHANNEL_OPEN, sock, sock, 2730 -1, 0, 0, 0, name, 1); 2731 c->remote_id = remote_id; 2732 c->force_drain = 1; 2733 } 2734 if (c == NULL) { 2735 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); 2736 packet_put_int(remote_id); 2737 } else { 2738 /* Send a confirmation to the remote host. */ 2739 debug("Forwarding authentication connection."); 2740 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION); 2741 packet_put_int(remote_id); 2742 packet_put_int(c->self); 2743 } 2744 packet_send(); 2745} 2746