1 /* $OpenBSD: channels.c,v 1.378 2018/01/23 05:27:21 djm Exp $ */ 2 /* 3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * This file contains functions for generic socket connection forwarding. 7 * There is also code for initiating connection forwarding for X11 connections, 8 * arbitrary tcp/ip connections, and the authentication agent connection. 9 * 10 * As far as I am concerned, the code I have written for this software 11 * can be used freely for any purpose. Any derived versions of this 12 * software must be clearly marked as such, and if the derived work is 13 * incompatible with the protocol description in the RFC file, it must be 14 * called by a name other than "ssh" or "Secure Shell". 15 * 16 * SSH2 support added by Markus Friedl. 17 * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. 18 * Copyright (c) 1999 Dug Song. All rights reserved. 19 * Copyright (c) 1999 Theo de Raadt. All rights reserved. 20 * 21 * Redistribution and use in source and binary forms, with or without 22 * modification, are permitted provided that the following conditions 23 * are met: 24 * 1. Redistributions of source code must retain the above copyright 25 * notice, this list of conditions and the following disclaimer. 26 * 2. Redistributions in binary form must reproduce the above copyright 27 * notice, this list of conditions and the following disclaimer in the 28 * documentation and/or other materials provided with the distribution. 29 * 30 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 31 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 32 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 33 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 34 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 35 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 36 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 37 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 38 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 39 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 40 */ 41 42 #include <sys/types.h> 43 #include <sys/stat.h> 44 #include <sys/ioctl.h> 45 #include <sys/un.h> 46 #include <sys/socket.h> 47 #include <sys/time.h> 48 #include <sys/queue.h> 49 50 #include <netinet/in.h> 51 #include <arpa/inet.h> 52 53 #include <errno.h> 54 #include <fcntl.h> 55 #include <limits.h> 56 #include <netdb.h> 57 #include <stdarg.h> 58 #include <stdint.h> 59 #include <stdio.h> 60 #include <stdlib.h> 61 #include <string.h> 62 #include <termios.h> 63 #include <unistd.h> 64 65 #include "xmalloc.h" 66 #include "ssh.h" 67 #include "ssh2.h" 68 #include "ssherr.h" 69 #include "sshbuf.h" 70 #include "packet.h" 71 #include "log.h" 72 #include "misc.h" 73 #include "channels.h" 74 #include "compat.h" 75 #include "canohost.h" 76 #include "key.h" 77 #include "authfd.h" 78 #include "pathnames.h" 79 80 /* -- agent forwarding */ 81 #define NUM_SOCKS 10 82 83 /* -- tcp forwarding */ 84 /* special-case port number meaning allow any port */ 85 #define FWD_PERMIT_ANY_PORT 0 86 87 /* special-case wildcard meaning allow any host */ 88 #define FWD_PERMIT_ANY_HOST "*" 89 90 /* -- X11 forwarding */ 91 /* Maximum number of fake X11 displays to try. */ 92 #define MAX_DISPLAYS 1000 93 94 /* 95 * Data structure for storing which hosts are permitted for forward requests. 96 * The local sides of any remote forwards are stored in this array to prevent 97 * a corrupt remote server from accessing arbitrary TCP/IP ports on our local 98 * network (which might be behind a firewall). 99 */ 100 /* XXX: streamlocal wants a path instead of host:port */ 101 /* Overload host_to_connect; we could just make this match Forward */ 102 /* XXX - can we use listen_host instead of listen_path? */ 103 typedef struct { 104 char *host_to_connect; /* Connect to 'host'. */ 105 int port_to_connect; /* Connect to 'port'. */ 106 char *listen_host; /* Remote side should listen address. */ 107 char *listen_path; /* Remote side should listen path. */ 108 int listen_port; /* Remote side should listen port. */ 109 Channel *downstream; /* Downstream mux*/ 110 } ForwardPermission; 111 112 typedef void chan_fn(struct ssh *, Channel *c, 113 fd_set *readset, fd_set *writeset); 114 115 /* Master structure for channels state */ 116 struct ssh_channels { 117 /* 118 * Pointer to an array containing all allocated channels. The array 119 * is dynamically extended as needed. 120 */ 121 Channel **channels; 122 123 /* 124 * Size of the channel array. All slots of the array must always be 125 * initialized (at least the type field); unused slots set to NULL 126 */ 127 u_int channels_alloc; 128 129 /* 130 * Maximum file descriptor value used in any of the channels. This is 131 * updated in channel_new. 132 */ 133 int channel_max_fd; 134 135 /* 136 * 'channel_pre*' are called just before select() to add any bits 137 * relevant to channels in the select bitmasks. 138 * 139 * 'channel_post*': perform any appropriate operations for 140 * channels which have events pending. 141 */ 142 chan_fn **channel_pre; 143 chan_fn **channel_post; 144 145 /* -- tcp forwarding */ 146 147 /* List of all permitted host/port pairs to connect by the user. */ 148 ForwardPermission *permitted_opens; 149 150 /* List of all permitted host/port pairs to connect by the admin. */ 151 ForwardPermission *permitted_adm_opens; 152 153 /* 154 * Number of permitted host/port pairs in the array permitted by 155 * the user. 156 */ 157 u_int num_permitted_opens; 158 159 /* 160 * Number of permitted host/port pair in the array permitted by 161 * the admin. 162 */ 163 u_int num_adm_permitted_opens; 164 165 /* 166 * If this is true, all opens are permitted. This is the case on 167 * the server on which we have to trust the client anyway, and the 168 * user could do anything after logging in anyway. 169 */ 170 int all_opens_permitted; 171 172 /* -- X11 forwarding */ 173 174 /* Saved X11 local (client) display. */ 175 char *x11_saved_display; 176 177 /* Saved X11 authentication protocol name. */ 178 char *x11_saved_proto; 179 180 /* Saved X11 authentication data. This is the real data. */ 181 char *x11_saved_data; 182 u_int x11_saved_data_len; 183 184 /* Deadline after which all X11 connections are refused */ 185 u_int x11_refuse_time; 186 187 /* 188 * Fake X11 authentication data. This is what the server will be 189 * sending us; we should replace any occurrences of this by the 190 * real data. 191 */ 192 u_char *x11_fake_data; 193 u_int x11_fake_data_len; 194 195 /* AF_UNSPEC or AF_INET or AF_INET6 */ 196 int IPv4or6; 197 }; 198 199 /* helper */ 200 static void port_open_helper(struct ssh *ssh, Channel *c, char *rtype); 201 static const char *channel_rfwd_bind_host(const char *listen_host); 202 203 /* non-blocking connect helpers */ 204 static int connect_next(struct channel_connect *); 205 static void channel_connect_ctx_free(struct channel_connect *); 206 static Channel *rdynamic_connect_prepare(struct ssh *, char *, char *); 207 static int rdynamic_connect_finish(struct ssh *, Channel *); 208 209 /* Setup helper */ 210 static void channel_handler_init(struct ssh_channels *sc); 211 212 /* -- channel core */ 213 214 void 215 channel_init_channels(struct ssh *ssh) 216 { 217 struct ssh_channels *sc; 218 219 if ((sc = calloc(1, sizeof(*sc))) == NULL || 220 (sc->channel_pre = calloc(SSH_CHANNEL_MAX_TYPE, 221 sizeof(*sc->channel_pre))) == NULL || 222 (sc->channel_post = calloc(SSH_CHANNEL_MAX_TYPE, 223 sizeof(*sc->channel_post))) == NULL) 224 fatal("%s: allocation failed", __func__); 225 sc->channels_alloc = 10; 226 sc->channels = xcalloc(sc->channels_alloc, sizeof(*sc->channels)); 227 sc->IPv4or6 = AF_UNSPEC; 228 channel_handler_init(sc); 229 230 ssh->chanctxt = sc; 231 } 232 233 Channel * 234 channel_by_id(struct ssh *ssh, int id) 235 { 236 Channel *c; 237 238 if (id < 0 || (u_int)id >= ssh->chanctxt->channels_alloc) { 239 logit("%s: %d: bad id", __func__, id); 240 return NULL; 241 } 242 c = ssh->chanctxt->channels[id]; 243 if (c == NULL) { 244 logit("%s: %d: bad id: channel free", __func__, id); 245 return NULL; 246 } 247 return c; 248 } 249 250 Channel * 251 channel_by_remote_id(struct ssh *ssh, u_int remote_id) 252 { 253 Channel *c; 254 u_int i; 255 256 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) { 257 c = ssh->chanctxt->channels[i]; 258 if (c != NULL && c->have_remote_id && c->remote_id == remote_id) 259 return c; 260 } 261 return NULL; 262 } 263 264 /* 265 * Returns the channel if it is allowed to receive protocol messages. 266 * Private channels, like listening sockets, may not receive messages. 267 */ 268 Channel * 269 channel_lookup(struct ssh *ssh, int id) 270 { 271 Channel *c; 272 273 if ((c = channel_by_id(ssh, id)) == NULL) 274 return NULL; 275 276 switch (c->type) { 277 case SSH_CHANNEL_X11_OPEN: 278 case SSH_CHANNEL_LARVAL: 279 case SSH_CHANNEL_CONNECTING: 280 case SSH_CHANNEL_DYNAMIC: 281 case SSH_CHANNEL_RDYNAMIC_OPEN: 282 case SSH_CHANNEL_RDYNAMIC_FINISH: 283 case SSH_CHANNEL_OPENING: 284 case SSH_CHANNEL_OPEN: 285 case SSH_CHANNEL_ABANDONED: 286 case SSH_CHANNEL_MUX_PROXY: 287 return c; 288 } 289 logit("Non-public channel %d, type %d.", id, c->type); 290 return NULL; 291 } 292 293 /* 294 * Register filedescriptors for a channel, used when allocating a channel or 295 * when the channel consumer/producer is ready, e.g. shell exec'd 296 */ 297 static void 298 channel_register_fds(struct ssh *ssh, Channel *c, int rfd, int wfd, int efd, 299 int extusage, int nonblock, int is_tty) 300 { 301 struct ssh_channels *sc = ssh->chanctxt; 302 303 /* Update the maximum file descriptor value. */ 304 sc->channel_max_fd = MAXIMUM(sc->channel_max_fd, rfd); 305 sc->channel_max_fd = MAXIMUM(sc->channel_max_fd, wfd); 306 sc->channel_max_fd = MAXIMUM(sc->channel_max_fd, efd); 307 308 if (rfd != -1) 309 fcntl(rfd, F_SETFD, FD_CLOEXEC); 310 if (wfd != -1 && wfd != rfd) 311 fcntl(wfd, F_SETFD, FD_CLOEXEC); 312 if (efd != -1 && efd != rfd && efd != wfd) 313 fcntl(efd, F_SETFD, FD_CLOEXEC); 314 315 c->rfd = rfd; 316 c->wfd = wfd; 317 c->sock = (rfd == wfd) ? rfd : -1; 318 c->efd = efd; 319 c->extended_usage = extusage; 320 321 if ((c->isatty = is_tty) != 0) 322 debug2("channel %d: rfd %d isatty", c->self, c->rfd); 323 324 /* enable nonblocking mode */ 325 if (nonblock) { 326 if (rfd != -1) 327 set_nonblock(rfd); 328 if (wfd != -1) 329 set_nonblock(wfd); 330 if (efd != -1) 331 set_nonblock(efd); 332 } 333 } 334 335 /* 336 * Allocate a new channel object and set its type and socket. This will cause 337 * remote_name to be freed. 338 */ 339 Channel * 340 channel_new(struct ssh *ssh, char *ctype, int type, int rfd, int wfd, int efd, 341 u_int window, u_int maxpack, int extusage, char *remote_name, int nonblock) 342 { 343 struct ssh_channels *sc = ssh->chanctxt; 344 u_int i, found; 345 Channel *c; 346 347 /* Try to find a free slot where to put the new channel. */ 348 for (i = 0; i < sc->channels_alloc; i++) { 349 if (sc->channels[i] == NULL) { 350 /* Found a free slot. */ 351 found = i; 352 break; 353 } 354 } 355 if (i >= sc->channels_alloc) { 356 /* 357 * There are no free slots. Take last+1 slot and expand 358 * the array. 359 */ 360 found = sc->channels_alloc; 361 if (sc->channels_alloc > CHANNELS_MAX_CHANNELS) 362 fatal("%s: internal error: channels_alloc %d too big", 363 __func__, sc->channels_alloc); 364 sc->channels = xrecallocarray(sc->channels, sc->channels_alloc, 365 sc->channels_alloc + 10, sizeof(*sc->channels)); 366 sc->channels_alloc += 10; 367 debug2("channel: expanding %d", sc->channels_alloc); 368 } 369 /* Initialize and return new channel. */ 370 c = sc->channels[found] = xcalloc(1, sizeof(Channel)); 371 if ((c->input = sshbuf_new()) == NULL || 372 (c->output = sshbuf_new()) == NULL || 373 (c->extended = sshbuf_new()) == NULL) 374 fatal("%s: sshbuf_new failed", __func__); 375 c->ostate = CHAN_OUTPUT_OPEN; 376 c->istate = CHAN_INPUT_OPEN; 377 channel_register_fds(ssh, c, rfd, wfd, efd, extusage, nonblock, 0); 378 c->self = found; 379 c->type = type; 380 c->ctype = ctype; 381 c->local_window = window; 382 c->local_window_max = window; 383 c->local_maxpacket = maxpack; 384 c->remote_name = xstrdup(remote_name); 385 c->ctl_chan = -1; 386 c->delayed = 1; /* prevent call to channel_post handler */ 387 TAILQ_INIT(&c->status_confirms); 388 debug("channel %d: new [%s]", found, remote_name); 389 return c; 390 } 391 392 static void 393 channel_find_maxfd(struct ssh_channels *sc) 394 { 395 u_int i; 396 int max = 0; 397 Channel *c; 398 399 for (i = 0; i < sc->channels_alloc; i++) { 400 c = sc->channels[i]; 401 if (c != NULL) { 402 max = MAXIMUM(max, c->rfd); 403 max = MAXIMUM(max, c->wfd); 404 max = MAXIMUM(max, c->efd); 405 } 406 } 407 sc->channel_max_fd = max; 408 } 409 410 int 411 channel_close_fd(struct ssh *ssh, int *fdp) 412 { 413 struct ssh_channels *sc = ssh->chanctxt; 414 int ret = 0, fd = *fdp; 415 416 if (fd != -1) { 417 ret = close(fd); 418 *fdp = -1; 419 if (fd == sc->channel_max_fd) 420 channel_find_maxfd(sc); 421 } 422 return ret; 423 } 424 425 /* Close all channel fd/socket. */ 426 static void 427 channel_close_fds(struct ssh *ssh, Channel *c) 428 { 429 channel_close_fd(ssh, &c->sock); 430 channel_close_fd(ssh, &c->rfd); 431 channel_close_fd(ssh, &c->wfd); 432 channel_close_fd(ssh, &c->efd); 433 } 434 435 static void 436 fwd_perm_clear(ForwardPermission *fp) 437 { 438 free(fp->host_to_connect); 439 free(fp->listen_host); 440 free(fp->listen_path); 441 bzero(fp, sizeof(*fp)); 442 } 443 444 enum { FWDPERM_USER, FWDPERM_ADMIN }; 445 446 static int 447 fwd_perm_list_add(struct ssh *ssh, int which, 448 const char *host_to_connect, int port_to_connect, 449 const char *listen_host, const char *listen_path, int listen_port, 450 Channel *downstream) 451 { 452 ForwardPermission **fpl; 453 u_int n, *nfpl; 454 455 switch (which) { 456 case FWDPERM_USER: 457 fpl = &ssh->chanctxt->permitted_opens; 458 nfpl = &ssh->chanctxt->num_permitted_opens; 459 break; 460 case FWDPERM_ADMIN: 461 fpl = &ssh->chanctxt->permitted_adm_opens; 462 nfpl = &ssh->chanctxt->num_adm_permitted_opens; 463 break; 464 default: 465 fatal("%s: invalid list %d", __func__, which); 466 } 467 468 if (*nfpl >= INT_MAX) 469 fatal("%s: overflow", __func__); 470 471 *fpl = xrecallocarray(*fpl, *nfpl, *nfpl + 1, sizeof(**fpl)); 472 n = (*nfpl)++; 473 #define MAYBE_DUP(s) ((s == NULL) ? NULL : xstrdup(s)) 474 (*fpl)[n].host_to_connect = MAYBE_DUP(host_to_connect); 475 (*fpl)[n].port_to_connect = port_to_connect; 476 (*fpl)[n].listen_host = MAYBE_DUP(listen_host); 477 (*fpl)[n].listen_path = MAYBE_DUP(listen_path); 478 (*fpl)[n].listen_port = listen_port; 479 (*fpl)[n].downstream = downstream; 480 #undef MAYBE_DUP 481 return (int)n; 482 } 483 484 static void 485 mux_remove_remote_forwardings(struct ssh *ssh, Channel *c) 486 { 487 struct ssh_channels *sc = ssh->chanctxt; 488 ForwardPermission *fp; 489 int r; 490 u_int i; 491 492 for (i = 0; i < sc->num_permitted_opens; i++) { 493 fp = &sc->permitted_opens[i]; 494 if (fp->downstream != c) 495 continue; 496 497 /* cancel on the server, since mux client is gone */ 498 debug("channel %d: cleanup remote forward for %s:%u", 499 c->self, fp->listen_host, fp->listen_port); 500 if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 || 501 (r = sshpkt_put_cstring(ssh, 502 "cancel-tcpip-forward")) != 0 || 503 (r = sshpkt_put_u8(ssh, 0)) != 0 || 504 (r = sshpkt_put_cstring(ssh, 505 channel_rfwd_bind_host(fp->listen_host))) != 0 || 506 (r = sshpkt_put_u32(ssh, fp->listen_port)) != 0 || 507 (r = sshpkt_send(ssh)) != 0) { 508 fatal("%s: channel %i: %s", __func__, 509 c->self, ssh_err(r)); 510 } 511 fwd_perm_clear(fp); /* unregister */ 512 } 513 } 514 515 /* Free the channel and close its fd/socket. */ 516 void 517 channel_free(struct ssh *ssh, Channel *c) 518 { 519 struct ssh_channels *sc = ssh->chanctxt; 520 char *s; 521 u_int i, n; 522 Channel *other; 523 struct channel_confirm *cc; 524 525 for (n = 0, i = 0; i < sc->channels_alloc; i++) { 526 if ((other = sc->channels[i]) == NULL) 527 continue; 528 n++; 529 /* detach from mux client and prepare for closing */ 530 if (c->type == SSH_CHANNEL_MUX_CLIENT && 531 other->type == SSH_CHANNEL_MUX_PROXY && 532 other->mux_ctx == c) { 533 other->mux_ctx = NULL; 534 other->type = SSH_CHANNEL_OPEN; 535 other->istate = CHAN_INPUT_CLOSED; 536 other->ostate = CHAN_OUTPUT_CLOSED; 537 } 538 } 539 debug("channel %d: free: %s, nchannels %u", c->self, 540 c->remote_name ? c->remote_name : "???", n); 541 542 if (c->type == SSH_CHANNEL_MUX_CLIENT) 543 mux_remove_remote_forwardings(ssh, c); 544 545 s = channel_open_message(ssh); 546 debug3("channel %d: status: %s", c->self, s); 547 free(s); 548 549 channel_close_fds(ssh, c); 550 sshbuf_free(c->input); 551 sshbuf_free(c->output); 552 sshbuf_free(c->extended); 553 c->input = c->output = c->extended = NULL; 554 free(c->remote_name); 555 c->remote_name = NULL; 556 free(c->path); 557 c->path = NULL; 558 free(c->listening_addr); 559 c->listening_addr = NULL; 560 while ((cc = TAILQ_FIRST(&c->status_confirms)) != NULL) { 561 if (cc->abandon_cb != NULL) 562 cc->abandon_cb(ssh, c, cc->ctx); 563 TAILQ_REMOVE(&c->status_confirms, cc, entry); 564 explicit_bzero(cc, sizeof(*cc)); 565 free(cc); 566 } 567 if (c->filter_cleanup != NULL && c->filter_ctx != NULL) 568 c->filter_cleanup(ssh, c->self, c->filter_ctx); 569 sc->channels[c->self] = NULL; 570 explicit_bzero(c, sizeof(*c)); 571 free(c); 572 } 573 574 void 575 channel_free_all(struct ssh *ssh) 576 { 577 u_int i; 578 579 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) 580 if (ssh->chanctxt->channels[i] != NULL) 581 channel_free(ssh, ssh->chanctxt->channels[i]); 582 } 583 584 /* 585 * Closes the sockets/fds of all channels. This is used to close extra file 586 * descriptors after a fork. 587 */ 588 void 589 channel_close_all(struct ssh *ssh) 590 { 591 u_int i; 592 593 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) 594 if (ssh->chanctxt->channels[i] != NULL) 595 channel_close_fds(ssh, ssh->chanctxt->channels[i]); 596 } 597 598 /* 599 * Stop listening to channels. 600 */ 601 void 602 channel_stop_listening(struct ssh *ssh) 603 { 604 u_int i; 605 Channel *c; 606 607 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) { 608 c = ssh->chanctxt->channels[i]; 609 if (c != NULL) { 610 switch (c->type) { 611 case SSH_CHANNEL_AUTH_SOCKET: 612 case SSH_CHANNEL_PORT_LISTENER: 613 case SSH_CHANNEL_RPORT_LISTENER: 614 case SSH_CHANNEL_X11_LISTENER: 615 case SSH_CHANNEL_UNIX_LISTENER: 616 case SSH_CHANNEL_RUNIX_LISTENER: 617 channel_close_fd(ssh, &c->sock); 618 channel_free(ssh, c); 619 break; 620 } 621 } 622 } 623 } 624 625 /* 626 * Returns true if no channel has too much buffered data, and false if one or 627 * more channel is overfull. 628 */ 629 int 630 channel_not_very_much_buffered_data(struct ssh *ssh) 631 { 632 u_int i; 633 u_int maxsize = ssh_packet_get_maxsize(ssh); 634 Channel *c; 635 636 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) { 637 c = ssh->chanctxt->channels[i]; 638 if (c == NULL || c->type != SSH_CHANNEL_OPEN) 639 continue; 640 if (sshbuf_len(c->output) > maxsize) { 641 debug2("channel %d: big output buffer %zu > %u", 642 c->self, sshbuf_len(c->output), maxsize); 643 return 0; 644 } 645 } 646 return 1; 647 } 648 649 /* Returns true if any channel is still open. */ 650 int 651 channel_still_open(struct ssh *ssh) 652 { 653 u_int i; 654 Channel *c; 655 656 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) { 657 c = ssh->chanctxt->channels[i]; 658 if (c == NULL) 659 continue; 660 switch (c->type) { 661 case SSH_CHANNEL_X11_LISTENER: 662 case SSH_CHANNEL_PORT_LISTENER: 663 case SSH_CHANNEL_RPORT_LISTENER: 664 case SSH_CHANNEL_MUX_LISTENER: 665 case SSH_CHANNEL_CLOSED: 666 case SSH_CHANNEL_AUTH_SOCKET: 667 case SSH_CHANNEL_DYNAMIC: 668 case SSH_CHANNEL_RDYNAMIC_OPEN: 669 case SSH_CHANNEL_CONNECTING: 670 case SSH_CHANNEL_ZOMBIE: 671 case SSH_CHANNEL_ABANDONED: 672 case SSH_CHANNEL_UNIX_LISTENER: 673 case SSH_CHANNEL_RUNIX_LISTENER: 674 continue; 675 case SSH_CHANNEL_LARVAL: 676 continue; 677 case SSH_CHANNEL_OPENING: 678 case SSH_CHANNEL_OPEN: 679 case SSH_CHANNEL_RDYNAMIC_FINISH: 680 case SSH_CHANNEL_X11_OPEN: 681 case SSH_CHANNEL_MUX_CLIENT: 682 case SSH_CHANNEL_MUX_PROXY: 683 return 1; 684 default: 685 fatal("%s: bad channel type %d", __func__, c->type); 686 /* NOTREACHED */ 687 } 688 } 689 return 0; 690 } 691 692 /* Returns the id of an open channel suitable for keepaliving */ 693 int 694 channel_find_open(struct ssh *ssh) 695 { 696 u_int i; 697 Channel *c; 698 699 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) { 700 c = ssh->chanctxt->channels[i]; 701 if (c == NULL || !c->have_remote_id) 702 continue; 703 switch (c->type) { 704 case SSH_CHANNEL_CLOSED: 705 case SSH_CHANNEL_DYNAMIC: 706 case SSH_CHANNEL_RDYNAMIC_OPEN: 707 case SSH_CHANNEL_RDYNAMIC_FINISH: 708 case SSH_CHANNEL_X11_LISTENER: 709 case SSH_CHANNEL_PORT_LISTENER: 710 case SSH_CHANNEL_RPORT_LISTENER: 711 case SSH_CHANNEL_MUX_LISTENER: 712 case SSH_CHANNEL_MUX_CLIENT: 713 case SSH_CHANNEL_MUX_PROXY: 714 case SSH_CHANNEL_OPENING: 715 case SSH_CHANNEL_CONNECTING: 716 case SSH_CHANNEL_ZOMBIE: 717 case SSH_CHANNEL_ABANDONED: 718 case SSH_CHANNEL_UNIX_LISTENER: 719 case SSH_CHANNEL_RUNIX_LISTENER: 720 continue; 721 case SSH_CHANNEL_LARVAL: 722 case SSH_CHANNEL_AUTH_SOCKET: 723 case SSH_CHANNEL_OPEN: 724 case SSH_CHANNEL_X11_OPEN: 725 return i; 726 default: 727 fatal("%s: bad channel type %d", __func__, c->type); 728 /* NOTREACHED */ 729 } 730 } 731 return -1; 732 } 733 734 /* 735 * Returns a message describing the currently open forwarded connections, 736 * suitable for sending to the client. The message contains crlf pairs for 737 * newlines. 738 */ 739 char * 740 channel_open_message(struct ssh *ssh) 741 { 742 struct sshbuf *buf; 743 Channel *c; 744 u_int i; 745 int r; 746 char *ret; 747 748 if ((buf = sshbuf_new()) == NULL) 749 fatal("%s: sshbuf_new", __func__); 750 if ((r = sshbuf_putf(buf, 751 "The following connections are open:\r\n")) != 0) 752 fatal("%s: sshbuf_putf: %s", __func__, ssh_err(r)); 753 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) { 754 c = ssh->chanctxt->channels[i]; 755 if (c == NULL) 756 continue; 757 switch (c->type) { 758 case SSH_CHANNEL_X11_LISTENER: 759 case SSH_CHANNEL_PORT_LISTENER: 760 case SSH_CHANNEL_RPORT_LISTENER: 761 case SSH_CHANNEL_CLOSED: 762 case SSH_CHANNEL_AUTH_SOCKET: 763 case SSH_CHANNEL_ZOMBIE: 764 case SSH_CHANNEL_ABANDONED: 765 case SSH_CHANNEL_MUX_LISTENER: 766 case SSH_CHANNEL_UNIX_LISTENER: 767 case SSH_CHANNEL_RUNIX_LISTENER: 768 continue; 769 case SSH_CHANNEL_LARVAL: 770 case SSH_CHANNEL_OPENING: 771 case SSH_CHANNEL_CONNECTING: 772 case SSH_CHANNEL_DYNAMIC: 773 case SSH_CHANNEL_RDYNAMIC_OPEN: 774 case SSH_CHANNEL_RDYNAMIC_FINISH: 775 case SSH_CHANNEL_OPEN: 776 case SSH_CHANNEL_X11_OPEN: 777 case SSH_CHANNEL_MUX_PROXY: 778 case SSH_CHANNEL_MUX_CLIENT: 779 if ((r = sshbuf_putf(buf, " #%d %.300s " 780 "(t%d %s%u i%u/%zu o%u/%zu fd %d/%d cc %d)\r\n", 781 c->self, c->remote_name, 782 c->type, 783 c->have_remote_id ? "r" : "nr", c->remote_id, 784 c->istate, sshbuf_len(c->input), 785 c->ostate, sshbuf_len(c->output), 786 c->rfd, c->wfd, c->ctl_chan)) != 0) 787 fatal("%s: sshbuf_putf: %s", 788 __func__, ssh_err(r)); 789 continue; 790 default: 791 fatal("%s: bad channel type %d", __func__, c->type); 792 /* NOTREACHED */ 793 } 794 } 795 if ((ret = sshbuf_dup_string(buf)) == NULL) 796 fatal("%s: sshbuf_dup_string", __func__); 797 sshbuf_free(buf); 798 return ret; 799 } 800 801 static void 802 open_preamble(struct ssh *ssh, const char *where, Channel *c, const char *type) 803 { 804 int r; 805 806 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN)) != 0 || 807 (r = sshpkt_put_cstring(ssh, type)) != 0 || 808 (r = sshpkt_put_u32(ssh, c->self)) != 0 || 809 (r = sshpkt_put_u32(ssh, c->local_window)) != 0 || 810 (r = sshpkt_put_u32(ssh, c->local_maxpacket)) != 0) { 811 fatal("%s: channel %i: open: %s", where, c->self, ssh_err(r)); 812 } 813 } 814 815 void 816 channel_send_open(struct ssh *ssh, int id) 817 { 818 Channel *c = channel_lookup(ssh, id); 819 int r; 820 821 if (c == NULL) { 822 logit("channel_send_open: %d: bad id", id); 823 return; 824 } 825 debug2("channel %d: send open", id); 826 open_preamble(ssh, __func__, c, c->ctype); 827 if ((r = sshpkt_send(ssh)) != 0) 828 fatal("%s: channel %i: %s", __func__, c->self, ssh_err(r)); 829 } 830 831 void 832 channel_request_start(struct ssh *ssh, int id, char *service, int wantconfirm) 833 { 834 Channel *c = channel_lookup(ssh, id); 835 int r; 836 837 if (c == NULL) { 838 logit("%s: %d: unknown channel id", __func__, id); 839 return; 840 } 841 if (!c->have_remote_id) 842 fatal(":%s: channel %d: no remote id", __func__, c->self); 843 844 debug2("channel %d: request %s confirm %d", id, service, wantconfirm); 845 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_REQUEST)) != 0 || 846 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 847 (r = sshpkt_put_cstring(ssh, service)) != 0 || 848 (r = sshpkt_put_u8(ssh, wantconfirm)) != 0) { 849 fatal("%s: channel %i: %s", __func__, c->self, ssh_err(r)); 850 } 851 } 852 853 void 854 channel_register_status_confirm(struct ssh *ssh, int id, 855 channel_confirm_cb *cb, channel_confirm_abandon_cb *abandon_cb, void *ctx) 856 { 857 struct channel_confirm *cc; 858 Channel *c; 859 860 if ((c = channel_lookup(ssh, id)) == NULL) 861 fatal("%s: %d: bad id", __func__, id); 862 863 cc = xcalloc(1, sizeof(*cc)); 864 cc->cb = cb; 865 cc->abandon_cb = abandon_cb; 866 cc->ctx = ctx; 867 TAILQ_INSERT_TAIL(&c->status_confirms, cc, entry); 868 } 869 870 void 871 channel_register_open_confirm(struct ssh *ssh, int id, 872 channel_open_fn *fn, void *ctx) 873 { 874 Channel *c = channel_lookup(ssh, id); 875 876 if (c == NULL) { 877 logit("%s: %d: bad id", __func__, id); 878 return; 879 } 880 c->open_confirm = fn; 881 c->open_confirm_ctx = ctx; 882 } 883 884 void 885 channel_register_cleanup(struct ssh *ssh, int id, 886 channel_callback_fn *fn, int do_close) 887 { 888 Channel *c = channel_by_id(ssh, id); 889 890 if (c == NULL) { 891 logit("%s: %d: bad id", __func__, id); 892 return; 893 } 894 c->detach_user = fn; 895 c->detach_close = do_close; 896 } 897 898 void 899 channel_cancel_cleanup(struct ssh *ssh, int id) 900 { 901 Channel *c = channel_by_id(ssh, id); 902 903 if (c == NULL) { 904 logit("%s: %d: bad id", __func__, id); 905 return; 906 } 907 c->detach_user = NULL; 908 c->detach_close = 0; 909 } 910 911 void 912 channel_register_filter(struct ssh *ssh, int id, channel_infilter_fn *ifn, 913 channel_outfilter_fn *ofn, channel_filter_cleanup_fn *cfn, void *ctx) 914 { 915 Channel *c = channel_lookup(ssh, id); 916 917 if (c == NULL) { 918 logit("%s: %d: bad id", __func__, id); 919 return; 920 } 921 c->input_filter = ifn; 922 c->output_filter = ofn; 923 c->filter_ctx = ctx; 924 c->filter_cleanup = cfn; 925 } 926 927 void 928 channel_set_fds(struct ssh *ssh, int id, int rfd, int wfd, int efd, 929 int extusage, int nonblock, int is_tty, u_int window_max) 930 { 931 Channel *c = channel_lookup(ssh, id); 932 int r; 933 934 if (c == NULL || c->type != SSH_CHANNEL_LARVAL) 935 fatal("channel_activate for non-larval channel %d.", id); 936 if (!c->have_remote_id) 937 fatal(":%s: channel %d: no remote id", __func__, c->self); 938 939 channel_register_fds(ssh, c, rfd, wfd, efd, extusage, nonblock, is_tty); 940 c->type = SSH_CHANNEL_OPEN; 941 c->local_window = c->local_window_max = window_max; 942 943 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_WINDOW_ADJUST)) != 0 || 944 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 945 (r = sshpkt_put_u32(ssh, c->local_window)) != 0 || 946 (r = sshpkt_send(ssh)) != 0) 947 fatal("%s: channel %i: %s", __func__, c->self, ssh_err(r)); 948 } 949 950 static void 951 channel_pre_listener(struct ssh *ssh, Channel *c, 952 fd_set *readset, fd_set *writeset) 953 { 954 FD_SET(c->sock, readset); 955 } 956 957 static void 958 channel_pre_connecting(struct ssh *ssh, Channel *c, 959 fd_set *readset, fd_set *writeset) 960 { 961 debug3("channel %d: waiting for connection", c->self); 962 FD_SET(c->sock, writeset); 963 } 964 965 static void 966 channel_pre_open(struct ssh *ssh, Channel *c, 967 fd_set *readset, fd_set *writeset) 968 { 969 if (c->istate == CHAN_INPUT_OPEN && 970 c->remote_window > 0 && 971 sshbuf_len(c->input) < c->remote_window && 972 sshbuf_check_reserve(c->input, CHAN_RBUF) == 0) 973 FD_SET(c->rfd, readset); 974 if (c->ostate == CHAN_OUTPUT_OPEN || 975 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { 976 if (sshbuf_len(c->output) > 0) { 977 FD_SET(c->wfd, writeset); 978 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { 979 if (CHANNEL_EFD_OUTPUT_ACTIVE(c)) 980 debug2("channel %d: " 981 "obuf_empty delayed efd %d/(%zu)", c->self, 982 c->efd, sshbuf_len(c->extended)); 983 else 984 chan_obuf_empty(ssh, c); 985 } 986 } 987 /** XXX check close conditions, too */ 988 if (c->efd != -1 && !(c->istate == CHAN_INPUT_CLOSED && 989 c->ostate == CHAN_OUTPUT_CLOSED)) { 990 if (c->extended_usage == CHAN_EXTENDED_WRITE && 991 sshbuf_len(c->extended) > 0) 992 FD_SET(c->efd, writeset); 993 else if (c->efd != -1 && !(c->flags & CHAN_EOF_SENT) && 994 (c->extended_usage == CHAN_EXTENDED_READ || 995 c->extended_usage == CHAN_EXTENDED_IGNORE) && 996 sshbuf_len(c->extended) < c->remote_window) 997 FD_SET(c->efd, readset); 998 } 999 /* XXX: What about efd? races? */ 1000 } 1001 1002 /* 1003 * This is a special state for X11 authentication spoofing. An opened X11 1004 * connection (when authentication spoofing is being done) remains in this 1005 * state until the first packet has been completely read. The authentication 1006 * data in that packet is then substituted by the real data if it matches the 1007 * fake data, and the channel is put into normal mode. 1008 * XXX All this happens at the client side. 1009 * Returns: 0 = need more data, -1 = wrong cookie, 1 = ok 1010 */ 1011 static int 1012 x11_open_helper(struct ssh *ssh, struct sshbuf *b) 1013 { 1014 struct ssh_channels *sc = ssh->chanctxt; 1015 u_char *ucp; 1016 u_int proto_len, data_len; 1017 1018 /* Is this being called after the refusal deadline? */ 1019 if (sc->x11_refuse_time != 0 && 1020 (u_int)monotime() >= sc->x11_refuse_time) { 1021 verbose("Rejected X11 connection after ForwardX11Timeout " 1022 "expired"); 1023 return -1; 1024 } 1025 1026 /* Check if the fixed size part of the packet is in buffer. */ 1027 if (sshbuf_len(b) < 12) 1028 return 0; 1029 1030 /* Parse the lengths of variable-length fields. */ 1031 ucp = sshbuf_mutable_ptr(b); 1032 if (ucp[0] == 0x42) { /* Byte order MSB first. */ 1033 proto_len = 256 * ucp[6] + ucp[7]; 1034 data_len = 256 * ucp[8] + ucp[9]; 1035 } else if (ucp[0] == 0x6c) { /* Byte order LSB first. */ 1036 proto_len = ucp[6] + 256 * ucp[7]; 1037 data_len = ucp[8] + 256 * ucp[9]; 1038 } else { 1039 debug2("Initial X11 packet contains bad byte order byte: 0x%x", 1040 ucp[0]); 1041 return -1; 1042 } 1043 1044 /* Check if the whole packet is in buffer. */ 1045 if (sshbuf_len(b) < 1046 12 + ((proto_len + 3) & ~3) + ((data_len + 3) & ~3)) 1047 return 0; 1048 1049 /* Check if authentication protocol matches. */ 1050 if (proto_len != strlen(sc->x11_saved_proto) || 1051 memcmp(ucp + 12, sc->x11_saved_proto, proto_len) != 0) { 1052 debug2("X11 connection uses different authentication protocol."); 1053 return -1; 1054 } 1055 /* Check if authentication data matches our fake data. */ 1056 if (data_len != sc->x11_fake_data_len || 1057 timingsafe_bcmp(ucp + 12 + ((proto_len + 3) & ~3), 1058 sc->x11_fake_data, sc->x11_fake_data_len) != 0) { 1059 debug2("X11 auth data does not match fake data."); 1060 return -1; 1061 } 1062 /* Check fake data length */ 1063 if (sc->x11_fake_data_len != sc->x11_saved_data_len) { 1064 error("X11 fake_data_len %d != saved_data_len %d", 1065 sc->x11_fake_data_len, sc->x11_saved_data_len); 1066 return -1; 1067 } 1068 /* 1069 * Received authentication protocol and data match 1070 * our fake data. Substitute the fake data with real 1071 * data. 1072 */ 1073 memcpy(ucp + 12 + ((proto_len + 3) & ~3), 1074 sc->x11_saved_data, sc->x11_saved_data_len); 1075 return 1; 1076 } 1077 1078 static void 1079 channel_pre_x11_open(struct ssh *ssh, Channel *c, 1080 fd_set *readset, fd_set *writeset) 1081 { 1082 int ret = x11_open_helper(ssh, c->output); 1083 1084 /* c->force_drain = 1; */ 1085 1086 if (ret == 1) { 1087 c->type = SSH_CHANNEL_OPEN; 1088 channel_pre_open(ssh, c, readset, writeset); 1089 } else if (ret == -1) { 1090 logit("X11 connection rejected because of wrong authentication."); 1091 debug2("X11 rejected %d i%d/o%d", 1092 c->self, c->istate, c->ostate); 1093 chan_read_failed(ssh, c); 1094 sshbuf_reset(c->input); 1095 chan_ibuf_empty(ssh, c); 1096 sshbuf_reset(c->output); 1097 chan_write_failed(ssh, c); 1098 debug2("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate); 1099 } 1100 } 1101 1102 static void 1103 channel_pre_mux_client(struct ssh *ssh, 1104 Channel *c, fd_set *readset, fd_set *writeset) 1105 { 1106 if (c->istate == CHAN_INPUT_OPEN && !c->mux_pause && 1107 sshbuf_check_reserve(c->input, CHAN_RBUF) == 0) 1108 FD_SET(c->rfd, readset); 1109 if (c->istate == CHAN_INPUT_WAIT_DRAIN) { 1110 /* clear buffer immediately (discard any partial packet) */ 1111 sshbuf_reset(c->input); 1112 chan_ibuf_empty(ssh, c); 1113 /* Start output drain. XXX just kill chan? */ 1114 chan_rcvd_oclose(ssh, c); 1115 } 1116 if (c->ostate == CHAN_OUTPUT_OPEN || 1117 c->ostate == CHAN_OUTPUT_WAIT_DRAIN) { 1118 if (sshbuf_len(c->output) > 0) 1119 FD_SET(c->wfd, writeset); 1120 else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) 1121 chan_obuf_empty(ssh, c); 1122 } 1123 } 1124 1125 /* try to decode a socks4 header */ 1126 static int 1127 channel_decode_socks4(Channel *c, struct sshbuf *input, struct sshbuf *output) 1128 { 1129 const u_char *p; 1130 char *host; 1131 u_int len, have, i, found, need; 1132 char username[256]; 1133 struct { 1134 u_int8_t version; 1135 u_int8_t command; 1136 u_int16_t dest_port; 1137 struct in_addr dest_addr; 1138 } s4_req, s4_rsp; 1139 int r; 1140 1141 debug2("channel %d: decode socks4", c->self); 1142 1143 have = sshbuf_len(input); 1144 len = sizeof(s4_req); 1145 if (have < len) 1146 return 0; 1147 p = sshbuf_ptr(input); 1148 1149 need = 1; 1150 /* SOCKS4A uses an invalid IP address 0.0.0.x */ 1151 if (p[4] == 0 && p[5] == 0 && p[6] == 0 && p[7] != 0) { 1152 debug2("channel %d: socks4a request", c->self); 1153 /* ... and needs an extra string (the hostname) */ 1154 need = 2; 1155 } 1156 /* Check for terminating NUL on the string(s) */ 1157 for (found = 0, i = len; i < have; i++) { 1158 if (p[i] == '\0') { 1159 found++; 1160 if (found == need) 1161 break; 1162 } 1163 if (i > 1024) { 1164 /* the peer is probably sending garbage */ 1165 debug("channel %d: decode socks4: too long", 1166 c->self); 1167 return -1; 1168 } 1169 } 1170 if (found < need) 1171 return 0; 1172 if ((r = sshbuf_get(input, &s4_req.version, 1)) != 0 || 1173 (r = sshbuf_get(input, &s4_req.command, 1)) != 0 || 1174 (r = sshbuf_get(input, &s4_req.dest_port, 2)) != 0 || 1175 (r = sshbuf_get(input, &s4_req.dest_addr, 4)) != 0) { 1176 debug("channels %d: decode socks4: %s", c->self, ssh_err(r)); 1177 return -1; 1178 } 1179 have = sshbuf_len(input); 1180 p = sshbuf_ptr(input); 1181 if (memchr(p, '\0', have) == NULL) { 1182 error("channel %d: decode socks4: user not nul terminated", 1183 c->self); 1184 return -1; 1185 } 1186 len = strlen(p); 1187 debug2("channel %d: decode socks4: user %s/%d", c->self, p, len); 1188 len++; /* trailing '\0' */ 1189 strlcpy(username, p, sizeof(username)); 1190 if ((r = sshbuf_consume(input, len)) != 0) { 1191 fatal("%s: channel %d: consume: %s", __func__, 1192 c->self, ssh_err(r)); 1193 } 1194 free(c->path); 1195 c->path = NULL; 1196 if (need == 1) { /* SOCKS4: one string */ 1197 host = inet_ntoa(s4_req.dest_addr); 1198 c->path = xstrdup(host); 1199 } else { /* SOCKS4A: two strings */ 1200 have = sshbuf_len(input); 1201 p = sshbuf_ptr(input); 1202 if (memchr(p, '\0', have) == NULL) { 1203 error("channel %d: decode socks4a: host not nul " 1204 "terminated", c->self); 1205 return -1; 1206 } 1207 len = strlen(p); 1208 debug2("channel %d: decode socks4a: host %s/%d", 1209 c->self, p, len); 1210 len++; /* trailing '\0' */ 1211 if (len > NI_MAXHOST) { 1212 error("channel %d: hostname \"%.100s\" too long", 1213 c->self, p); 1214 return -1; 1215 } 1216 c->path = xstrdup(p); 1217 if ((r = sshbuf_consume(input, len)) != 0) { 1218 fatal("%s: channel %d: consume: %s", __func__, 1219 c->self, ssh_err(r)); 1220 } 1221 } 1222 c->host_port = ntohs(s4_req.dest_port); 1223 1224 debug2("channel %d: dynamic request: socks4 host %s port %u command %u", 1225 c->self, c->path, c->host_port, s4_req.command); 1226 1227 if (s4_req.command != 1) { 1228 debug("channel %d: cannot handle: %s cn %d", 1229 c->self, need == 1 ? "SOCKS4" : "SOCKS4A", s4_req.command); 1230 return -1; 1231 } 1232 s4_rsp.version = 0; /* vn: 0 for reply */ 1233 s4_rsp.command = 90; /* cd: req granted */ 1234 s4_rsp.dest_port = 0; /* ignored */ 1235 s4_rsp.dest_addr.s_addr = INADDR_ANY; /* ignored */ 1236 if ((r = sshbuf_put(output, &s4_rsp, sizeof(s4_rsp))) != 0) { 1237 fatal("%s: channel %d: append reply: %s", __func__, 1238 c->self, ssh_err(r)); 1239 } 1240 return 1; 1241 } 1242 1243 /* try to decode a socks5 header */ 1244 #define SSH_SOCKS5_AUTHDONE 0x1000 1245 #define SSH_SOCKS5_NOAUTH 0x00 1246 #define SSH_SOCKS5_IPV4 0x01 1247 #define SSH_SOCKS5_DOMAIN 0x03 1248 #define SSH_SOCKS5_IPV6 0x04 1249 #define SSH_SOCKS5_CONNECT 0x01 1250 #define SSH_SOCKS5_SUCCESS 0x00 1251 1252 static int 1253 channel_decode_socks5(Channel *c, struct sshbuf *input, struct sshbuf *output) 1254 { 1255 /* XXX use get/put_u8 instead of trusting struct padding */ 1256 struct { 1257 u_int8_t version; 1258 u_int8_t command; 1259 u_int8_t reserved; 1260 u_int8_t atyp; 1261 } s5_req, s5_rsp; 1262 u_int16_t dest_port; 1263 char dest_addr[255+1], ntop[INET6_ADDRSTRLEN]; 1264 const u_char *p; 1265 u_int have, need, i, found, nmethods, addrlen, af; 1266 int r; 1267 1268 debug2("channel %d: decode socks5", c->self); 1269 p = sshbuf_ptr(input); 1270 if (p[0] != 0x05) 1271 return -1; 1272 have = sshbuf_len(input); 1273 if (!(c->flags & SSH_SOCKS5_AUTHDONE)) { 1274 /* format: ver | nmethods | methods */ 1275 if (have < 2) 1276 return 0; 1277 nmethods = p[1]; 1278 if (have < nmethods + 2) 1279 return 0; 1280 /* look for method: "NO AUTHENTICATION REQUIRED" */ 1281 for (found = 0, i = 2; i < nmethods + 2; i++) { 1282 if (p[i] == SSH_SOCKS5_NOAUTH) { 1283 found = 1; 1284 break; 1285 } 1286 } 1287 if (!found) { 1288 debug("channel %d: method SSH_SOCKS5_NOAUTH not found", 1289 c->self); 1290 return -1; 1291 } 1292 if ((r = sshbuf_consume(input, nmethods + 2)) != 0) { 1293 fatal("%s: channel %d: consume: %s", __func__, 1294 c->self, ssh_err(r)); 1295 } 1296 /* version, method */ 1297 if ((r = sshbuf_put_u8(output, 0x05)) != 0 || 1298 (r = sshbuf_put_u8(output, SSH_SOCKS5_NOAUTH)) != 0) { 1299 fatal("%s: channel %d: append reply: %s", __func__, 1300 c->self, ssh_err(r)); 1301 } 1302 c->flags |= SSH_SOCKS5_AUTHDONE; 1303 debug2("channel %d: socks5 auth done", c->self); 1304 return 0; /* need more */ 1305 } 1306 debug2("channel %d: socks5 post auth", c->self); 1307 if (have < sizeof(s5_req)+1) 1308 return 0; /* need more */ 1309 memcpy(&s5_req, p, sizeof(s5_req)); 1310 if (s5_req.version != 0x05 || 1311 s5_req.command != SSH_SOCKS5_CONNECT || 1312 s5_req.reserved != 0x00) { 1313 debug2("channel %d: only socks5 connect supported", c->self); 1314 return -1; 1315 } 1316 switch (s5_req.atyp){ 1317 case SSH_SOCKS5_IPV4: 1318 addrlen = 4; 1319 af = AF_INET; 1320 break; 1321 case SSH_SOCKS5_DOMAIN: 1322 addrlen = p[sizeof(s5_req)]; 1323 af = -1; 1324 break; 1325 case SSH_SOCKS5_IPV6: 1326 addrlen = 16; 1327 af = AF_INET6; 1328 break; 1329 default: 1330 debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp); 1331 return -1; 1332 } 1333 need = sizeof(s5_req) + addrlen + 2; 1334 if (s5_req.atyp == SSH_SOCKS5_DOMAIN) 1335 need++; 1336 if (have < need) 1337 return 0; 1338 if ((r = sshbuf_consume(input, sizeof(s5_req))) != 0) { 1339 fatal("%s: channel %d: consume: %s", __func__, 1340 c->self, ssh_err(r)); 1341 } 1342 if (s5_req.atyp == SSH_SOCKS5_DOMAIN) { 1343 /* host string length */ 1344 if ((r = sshbuf_consume(input, 1)) != 0) { 1345 fatal("%s: channel %d: consume: %s", __func__, 1346 c->self, ssh_err(r)); 1347 } 1348 } 1349 if ((r = sshbuf_get(input, &dest_addr, addrlen)) != 0 || 1350 (r = sshbuf_get(input, &dest_port, 2)) != 0) { 1351 debug("channel %d: parse addr/port: %s", c->self, ssh_err(r)); 1352 return -1; 1353 } 1354 dest_addr[addrlen] = '\0'; 1355 free(c->path); 1356 c->path = NULL; 1357 if (s5_req.atyp == SSH_SOCKS5_DOMAIN) { 1358 if (addrlen >= NI_MAXHOST) { 1359 error("channel %d: dynamic request: socks5 hostname " 1360 "\"%.100s\" too long", c->self, dest_addr); 1361 return -1; 1362 } 1363 c->path = xstrdup(dest_addr); 1364 } else { 1365 if (inet_ntop(af, dest_addr, ntop, sizeof(ntop)) == NULL) 1366 return -1; 1367 c->path = xstrdup(ntop); 1368 } 1369 c->host_port = ntohs(dest_port); 1370 1371 debug2("channel %d: dynamic request: socks5 host %s port %u command %u", 1372 c->self, c->path, c->host_port, s5_req.command); 1373 1374 s5_rsp.version = 0x05; 1375 s5_rsp.command = SSH_SOCKS5_SUCCESS; 1376 s5_rsp.reserved = 0; /* ignored */ 1377 s5_rsp.atyp = SSH_SOCKS5_IPV4; 1378 dest_port = 0; /* ignored */ 1379 1380 if ((r = sshbuf_put(output, &s5_rsp, sizeof(s5_rsp))) != 0 || 1381 (r = sshbuf_put_u32(output, ntohl(INADDR_ANY))) != 0 || 1382 (r = sshbuf_put(output, &dest_port, sizeof(dest_port))) != 0) 1383 fatal("%s: channel %d: append reply: %s", __func__, 1384 c->self, ssh_err(r)); 1385 return 1; 1386 } 1387 1388 Channel * 1389 channel_connect_stdio_fwd(struct ssh *ssh, 1390 const char *host_to_connect, u_short port_to_connect, int in, int out) 1391 { 1392 Channel *c; 1393 1394 debug("%s %s:%d", __func__, host_to_connect, port_to_connect); 1395 1396 c = channel_new(ssh, "stdio-forward", SSH_CHANNEL_OPENING, in, out, 1397 -1, CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 1398 0, "stdio-forward", /*nonblock*/0); 1399 1400 c->path = xstrdup(host_to_connect); 1401 c->host_port = port_to_connect; 1402 c->listening_port = 0; 1403 c->force_drain = 1; 1404 1405 channel_register_fds(ssh, c, in, out, -1, 0, 1, 0); 1406 port_open_helper(ssh, c, "direct-tcpip"); 1407 1408 return c; 1409 } 1410 1411 /* dynamic port forwarding */ 1412 static void 1413 channel_pre_dynamic(struct ssh *ssh, Channel *c, 1414 fd_set *readset, fd_set *writeset) 1415 { 1416 const u_char *p; 1417 u_int have; 1418 int ret; 1419 1420 have = sshbuf_len(c->input); 1421 debug2("channel %d: pre_dynamic: have %d", c->self, have); 1422 /* sshbuf_dump(c->input, stderr); */ 1423 /* check if the fixed size part of the packet is in buffer. */ 1424 if (have < 3) { 1425 /* need more */ 1426 FD_SET(c->sock, readset); 1427 return; 1428 } 1429 /* try to guess the protocol */ 1430 p = sshbuf_ptr(c->input); 1431 /* XXX sshbuf_peek_u8? */ 1432 switch (p[0]) { 1433 case 0x04: 1434 ret = channel_decode_socks4(c, c->input, c->output); 1435 break; 1436 case 0x05: 1437 ret = channel_decode_socks5(c, c->input, c->output); 1438 break; 1439 default: 1440 ret = -1; 1441 break; 1442 } 1443 if (ret < 0) { 1444 chan_mark_dead(ssh, c); 1445 } else if (ret == 0) { 1446 debug2("channel %d: pre_dynamic: need more", c->self); 1447 /* need more */ 1448 FD_SET(c->sock, readset); 1449 if (sshbuf_len(c->output)) 1450 FD_SET(c->sock, writeset); 1451 } else { 1452 /* switch to the next state */ 1453 c->type = SSH_CHANNEL_OPENING; 1454 port_open_helper(ssh, c, "direct-tcpip"); 1455 } 1456 } 1457 1458 /* simulate read-error */ 1459 static void 1460 rdynamic_close(struct ssh *ssh, Channel *c) 1461 { 1462 c->type = SSH_CHANNEL_OPEN; 1463 chan_read_failed(ssh, c); 1464 sshbuf_reset(c->input); 1465 chan_ibuf_empty(ssh, c); 1466 sshbuf_reset(c->output); 1467 chan_write_failed(ssh, c); 1468 } 1469 1470 /* reverse dynamic port forwarding */ 1471 static void 1472 channel_before_prepare_select_rdynamic(struct ssh *ssh, Channel *c) 1473 { 1474 const u_char *p; 1475 u_int have, len; 1476 int r, ret; 1477 1478 have = sshbuf_len(c->output); 1479 debug2("channel %d: pre_rdynamic: have %d", c->self, have); 1480 /* sshbuf_dump(c->output, stderr); */ 1481 /* EOF received */ 1482 if (c->flags & CHAN_EOF_RCVD) { 1483 if ((r = sshbuf_consume(c->output, have)) != 0) { 1484 fatal("%s: channel %d: consume: %s", 1485 __func__, c->self, ssh_err(r)); 1486 } 1487 rdynamic_close(ssh, c); 1488 return; 1489 } 1490 /* check if the fixed size part of the packet is in buffer. */ 1491 if (have < 3) 1492 return; 1493 /* try to guess the protocol */ 1494 p = sshbuf_ptr(c->output); 1495 switch (p[0]) { 1496 case 0x04: 1497 /* switch input/output for reverse forwarding */ 1498 ret = channel_decode_socks4(c, c->output, c->input); 1499 break; 1500 case 0x05: 1501 ret = channel_decode_socks5(c, c->output, c->input); 1502 break; 1503 default: 1504 ret = -1; 1505 break; 1506 } 1507 if (ret < 0) { 1508 rdynamic_close(ssh, c); 1509 } else if (ret == 0) { 1510 debug2("channel %d: pre_rdynamic: need more", c->self); 1511 /* send socks request to peer */ 1512 len = sshbuf_len(c->input); 1513 if (len > 0 && len < c->remote_window) { 1514 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_DATA)) != 0 || 1515 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 1516 (r = sshpkt_put_stringb(ssh, c->input)) != 0 || 1517 (r = sshpkt_send(ssh)) != 0) { 1518 fatal("%s: channel %i: rdynamic: %s", __func__, 1519 c->self, ssh_err(r)); 1520 } 1521 if ((r = sshbuf_consume(c->input, len)) != 0) { 1522 fatal("%s: channel %d: consume: %s", 1523 __func__, c->self, ssh_err(r)); 1524 } 1525 c->remote_window -= len; 1526 } 1527 } else if (rdynamic_connect_finish(ssh, c) < 0) { 1528 /* the connect failed */ 1529 rdynamic_close(ssh, c); 1530 } 1531 } 1532 1533 /* This is our fake X11 server socket. */ 1534 static void 1535 channel_post_x11_listener(struct ssh *ssh, Channel *c, 1536 fd_set *readset, fd_set *writeset) 1537 { 1538 Channel *nc; 1539 struct sockaddr_storage addr; 1540 int r, newsock, oerrno, remote_port; 1541 socklen_t addrlen; 1542 char buf[16384], *remote_ipaddr; 1543 1544 if (!FD_ISSET(c->sock, readset)) 1545 return; 1546 1547 debug("X11 connection requested."); 1548 addrlen = sizeof(addr); 1549 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); 1550 if (c->single_connection) { 1551 oerrno = errno; 1552 debug2("single_connection: closing X11 listener."); 1553 channel_close_fd(ssh, &c->sock); 1554 chan_mark_dead(ssh, c); 1555 errno = oerrno; 1556 } 1557 if (newsock < 0) { 1558 if (errno != EINTR && errno != EWOULDBLOCK && 1559 errno != ECONNABORTED) 1560 error("accept: %.100s", strerror(errno)); 1561 if (errno == EMFILE || errno == ENFILE) 1562 c->notbefore = monotime() + 1; 1563 return; 1564 } 1565 set_nodelay(newsock); 1566 remote_ipaddr = get_peer_ipaddr(newsock); 1567 remote_port = get_peer_port(newsock); 1568 snprintf(buf, sizeof buf, "X11 connection from %.200s port %d", 1569 remote_ipaddr, remote_port); 1570 1571 nc = channel_new(ssh, "accepted x11 socket", 1572 SSH_CHANNEL_OPENING, newsock, newsock, -1, 1573 c->local_window_max, c->local_maxpacket, 0, buf, 1); 1574 open_preamble(ssh, __func__, nc, "x11"); 1575 if ((r = sshpkt_put_cstring(ssh, remote_ipaddr)) != 0 || 1576 (r = sshpkt_put_u32(ssh, remote_port)) != 0) { 1577 fatal("%s: channel %i: reply %s", __func__, 1578 c->self, ssh_err(r)); 1579 } 1580 if ((r = sshpkt_send(ssh)) != 0) 1581 fatal("%s: channel %i: send %s", __func__, c->self, ssh_err(r)); 1582 free(remote_ipaddr); 1583 } 1584 1585 static void 1586 port_open_helper(struct ssh *ssh, Channel *c, char *rtype) 1587 { 1588 char *local_ipaddr = get_local_ipaddr(c->sock); 1589 int local_port = c->sock == -1 ? 65536 : get_local_port(c->sock); 1590 char *remote_ipaddr = get_peer_ipaddr(c->sock); 1591 int remote_port = get_peer_port(c->sock); 1592 int r; 1593 1594 if (remote_port == -1) { 1595 /* Fake addr/port to appease peers that validate it (Tectia) */ 1596 free(remote_ipaddr); 1597 remote_ipaddr = xstrdup("127.0.0.1"); 1598 remote_port = 65535; 1599 } 1600 1601 free(c->remote_name); 1602 xasprintf(&c->remote_name, 1603 "%s: listening port %d for %.100s port %d, " 1604 "connect from %.200s port %d to %.100s port %d", 1605 rtype, c->listening_port, c->path, c->host_port, 1606 remote_ipaddr, remote_port, local_ipaddr, local_port); 1607 1608 open_preamble(ssh, __func__, c, rtype); 1609 if (strcmp(rtype, "direct-tcpip") == 0) { 1610 /* target host, port */ 1611 if ((r = sshpkt_put_cstring(ssh, c->path)) != 0 || 1612 (r = sshpkt_put_u32(ssh, c->host_port)) != 0) { 1613 fatal("%s: channel %i: reply %s", __func__, 1614 c->self, ssh_err(r)); 1615 } 1616 } else if (strcmp(rtype, "direct-streamlocal@openssh.com") == 0) { 1617 /* target path */ 1618 if ((r = sshpkt_put_cstring(ssh, c->path)) != 0) { 1619 fatal("%s: channel %i: reply %s", __func__, 1620 c->self, ssh_err(r)); 1621 } 1622 } else if (strcmp(rtype, "forwarded-streamlocal@openssh.com") == 0) { 1623 /* listen path */ 1624 if ((r = sshpkt_put_cstring(ssh, c->path)) != 0) { 1625 fatal("%s: channel %i: reply %s", __func__, 1626 c->self, ssh_err(r)); 1627 } 1628 } else { 1629 /* listen address, port */ 1630 if ((r = sshpkt_put_cstring(ssh, c->path)) != 0 || 1631 (r = sshpkt_put_u32(ssh, local_port)) != 0) { 1632 fatal("%s: channel %i: reply %s", __func__, 1633 c->self, ssh_err(r)); 1634 } 1635 } 1636 if (strcmp(rtype, "forwarded-streamlocal@openssh.com") == 0) { 1637 /* reserved for future owner/mode info */ 1638 if ((r = sshpkt_put_cstring(ssh, "")) != 0) { 1639 fatal("%s: channel %i: reply %s", __func__, 1640 c->self, ssh_err(r)); 1641 } 1642 } else { 1643 /* originator host and port */ 1644 if ((r = sshpkt_put_cstring(ssh, remote_ipaddr)) != 0 || 1645 (r = sshpkt_put_u32(ssh, (u_int)remote_port)) != 0) { 1646 fatal("%s: channel %i: reply %s", __func__, 1647 c->self, ssh_err(r)); 1648 } 1649 } 1650 if ((r = sshpkt_send(ssh)) != 0) 1651 fatal("%s: channel %i: send %s", __func__, c->self, ssh_err(r)); 1652 free(remote_ipaddr); 1653 free(local_ipaddr); 1654 } 1655 1656 void 1657 channel_set_x11_refuse_time(struct ssh *ssh, u_int refuse_time) 1658 { 1659 ssh->chanctxt->x11_refuse_time = refuse_time; 1660 } 1661 1662 /* 1663 * This socket is listening for connections to a forwarded TCP/IP port. 1664 */ 1665 static void 1666 channel_post_port_listener(struct ssh *ssh, Channel *c, 1667 fd_set *readset, fd_set *writeset) 1668 { 1669 Channel *nc; 1670 struct sockaddr_storage addr; 1671 int newsock, nextstate; 1672 socklen_t addrlen; 1673 char *rtype; 1674 1675 if (!FD_ISSET(c->sock, readset)) 1676 return; 1677 1678 debug("Connection to port %d forwarding to %.100s port %d requested.", 1679 c->listening_port, c->path, c->host_port); 1680 1681 if (c->type == SSH_CHANNEL_RPORT_LISTENER) { 1682 nextstate = SSH_CHANNEL_OPENING; 1683 rtype = "forwarded-tcpip"; 1684 } else if (c->type == SSH_CHANNEL_RUNIX_LISTENER) { 1685 nextstate = SSH_CHANNEL_OPENING; 1686 rtype = "forwarded-streamlocal@openssh.com"; 1687 } else if (c->host_port == PORT_STREAMLOCAL) { 1688 nextstate = SSH_CHANNEL_OPENING; 1689 rtype = "direct-streamlocal@openssh.com"; 1690 } else if (c->host_port == 0) { 1691 nextstate = SSH_CHANNEL_DYNAMIC; 1692 rtype = "dynamic-tcpip"; 1693 } else { 1694 nextstate = SSH_CHANNEL_OPENING; 1695 rtype = "direct-tcpip"; 1696 } 1697 1698 addrlen = sizeof(addr); 1699 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); 1700 if (newsock < 0) { 1701 if (errno != EINTR && errno != EWOULDBLOCK && 1702 errno != ECONNABORTED) 1703 error("accept: %.100s", strerror(errno)); 1704 if (errno == EMFILE || errno == ENFILE) 1705 c->notbefore = monotime() + 1; 1706 return; 1707 } 1708 if (c->host_port != PORT_STREAMLOCAL) 1709 set_nodelay(newsock); 1710 nc = channel_new(ssh, rtype, nextstate, newsock, newsock, -1, 1711 c->local_window_max, c->local_maxpacket, 0, rtype, 1); 1712 nc->listening_port = c->listening_port; 1713 nc->host_port = c->host_port; 1714 if (c->path != NULL) 1715 nc->path = xstrdup(c->path); 1716 1717 if (nextstate != SSH_CHANNEL_DYNAMIC) 1718 port_open_helper(ssh, nc, rtype); 1719 } 1720 1721 /* 1722 * This is the authentication agent socket listening for connections from 1723 * clients. 1724 */ 1725 static void 1726 channel_post_auth_listener(struct ssh *ssh, Channel *c, 1727 fd_set *readset, fd_set *writeset) 1728 { 1729 Channel *nc; 1730 int r, newsock; 1731 struct sockaddr_storage addr; 1732 socklen_t addrlen; 1733 1734 if (!FD_ISSET(c->sock, readset)) 1735 return; 1736 1737 addrlen = sizeof(addr); 1738 newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); 1739 if (newsock < 0) { 1740 error("accept from auth socket: %.100s", strerror(errno)); 1741 if (errno == EMFILE || errno == ENFILE) 1742 c->notbefore = monotime() + 1; 1743 return; 1744 } 1745 nc = channel_new(ssh, "accepted auth socket", 1746 SSH_CHANNEL_OPENING, newsock, newsock, -1, 1747 c->local_window_max, c->local_maxpacket, 1748 0, "accepted auth socket", 1); 1749 open_preamble(ssh, __func__, nc, "auth-agent@openssh.com"); 1750 if ((r = sshpkt_send(ssh)) != 0) 1751 fatal("%s: channel %i: %s", __func__, c->self, ssh_err(r)); 1752 } 1753 1754 static void 1755 channel_post_connecting(struct ssh *ssh, Channel *c, 1756 fd_set *readset, fd_set *writeset) 1757 { 1758 int err = 0, sock, isopen, r; 1759 socklen_t sz = sizeof(err); 1760 1761 if (!FD_ISSET(c->sock, writeset)) 1762 return; 1763 if (!c->have_remote_id) 1764 fatal(":%s: channel %d: no remote id", __func__, c->self); 1765 /* for rdynamic the OPEN_CONFIRMATION has been sent already */ 1766 isopen = (c->type == SSH_CHANNEL_RDYNAMIC_FINISH); 1767 if (getsockopt(c->sock, SOL_SOCKET, SO_ERROR, &err, &sz) < 0) { 1768 err = errno; 1769 error("getsockopt SO_ERROR failed"); 1770 } 1771 if (err == 0) { 1772 debug("channel %d: connected to %s port %d", 1773 c->self, c->connect_ctx.host, c->connect_ctx.port); 1774 channel_connect_ctx_free(&c->connect_ctx); 1775 c->type = SSH_CHANNEL_OPEN; 1776 if (isopen) { 1777 /* no message necessary */ 1778 } else { 1779 if ((r = sshpkt_start(ssh, 1780 SSH2_MSG_CHANNEL_OPEN_CONFIRMATION)) != 0 || 1781 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 1782 (r = sshpkt_put_u32(ssh, c->self)) != 0 || 1783 (r = sshpkt_put_u32(ssh, c->local_window)) != 0 || 1784 (r = sshpkt_put_u32(ssh, c->local_maxpacket)) 1785 != 0) 1786 fatal("%s: channel %i: confirm: %s", __func__, 1787 c->self, ssh_err(r)); 1788 if ((r = sshpkt_send(ssh)) != 0) 1789 fatal("%s: channel %i: %s", __func__, c->self, 1790 ssh_err(r)); 1791 } 1792 } else { 1793 debug("channel %d: connection failed: %s", 1794 c->self, strerror(err)); 1795 /* Try next address, if any */ 1796 if ((sock = connect_next(&c->connect_ctx)) > 0) { 1797 close(c->sock); 1798 c->sock = c->rfd = c->wfd = sock; 1799 channel_find_maxfd(ssh->chanctxt); 1800 return; 1801 } 1802 /* Exhausted all addresses */ 1803 error("connect_to %.100s port %d: failed.", 1804 c->connect_ctx.host, c->connect_ctx.port); 1805 channel_connect_ctx_free(&c->connect_ctx); 1806 if (isopen) { 1807 rdynamic_close(ssh, c); 1808 } else { 1809 if ((r = sshpkt_start(ssh, 1810 SSH2_MSG_CHANNEL_OPEN_FAILURE)) != 0 || 1811 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 1812 (r = sshpkt_put_u32(ssh, 1813 SSH2_OPEN_CONNECT_FAILED)) != 0 || 1814 (r = sshpkt_put_cstring(ssh, strerror(err))) != 0 || 1815 (r = sshpkt_put_cstring(ssh, "")) != 0) { 1816 fatal("%s: channel %i: failure: %s", __func__, 1817 c->self, ssh_err(r)); 1818 } 1819 if ((r = sshpkt_send(ssh)) != 0) 1820 fatal("%s: channel %i: %s", __func__, c->self, 1821 ssh_err(r)); 1822 chan_mark_dead(ssh, c); 1823 } 1824 } 1825 } 1826 1827 static int 1828 channel_handle_rfd(struct ssh *ssh, Channel *c, 1829 fd_set *readset, fd_set *writeset) 1830 { 1831 char buf[CHAN_RBUF]; 1832 ssize_t len; 1833 int r; 1834 1835 if (c->rfd == -1 || !FD_ISSET(c->rfd, readset)) 1836 return 1; 1837 1838 len = read(c->rfd, buf, sizeof(buf)); 1839 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 1840 return 1; 1841 if (len <= 0) { 1842 debug2("channel %d: read<=0 rfd %d len %zd", 1843 c->self, c->rfd, len); 1844 if (c->type != SSH_CHANNEL_OPEN) { 1845 debug2("channel %d: not open", c->self); 1846 chan_mark_dead(ssh, c); 1847 return -1; 1848 } else { 1849 chan_read_failed(ssh, c); 1850 } 1851 return -1; 1852 } 1853 if (c->input_filter != NULL) { 1854 if (c->input_filter(ssh, c, buf, len) == -1) { 1855 debug2("channel %d: filter stops", c->self); 1856 chan_read_failed(ssh, c); 1857 } 1858 } else if (c->datagram) { 1859 if ((r = sshbuf_put_string(c->input, buf, len)) != 0) 1860 fatal("%s: channel %d: put datagram: %s", __func__, 1861 c->self, ssh_err(r)); 1862 } else if ((r = sshbuf_put(c->input, buf, len)) != 0) { 1863 fatal("%s: channel %d: put data: %s", __func__, 1864 c->self, ssh_err(r)); 1865 } 1866 return 1; 1867 } 1868 1869 static int 1870 channel_handle_wfd(struct ssh *ssh, Channel *c, 1871 fd_set *readset, fd_set *writeset) 1872 { 1873 struct termios tio; 1874 u_char *data = NULL, *buf; /* XXX const; need filter API change */ 1875 size_t dlen, olen = 0; 1876 int r, len; 1877 1878 if (c->wfd == -1 || !FD_ISSET(c->wfd, writeset) || 1879 sshbuf_len(c->output) == 0) 1880 return 1; 1881 1882 /* Send buffered output data to the socket. */ 1883 olen = sshbuf_len(c->output); 1884 if (c->output_filter != NULL) { 1885 if ((buf = c->output_filter(ssh, c, &data, &dlen)) == NULL) { 1886 debug2("channel %d: filter stops", c->self); 1887 if (c->type != SSH_CHANNEL_OPEN) 1888 chan_mark_dead(ssh, c); 1889 else 1890 chan_write_failed(ssh, c); 1891 return -1; 1892 } 1893 } else if (c->datagram) { 1894 if ((r = sshbuf_get_string(c->output, &data, &dlen)) != 0) 1895 fatal("%s: channel %d: get datagram: %s", __func__, 1896 c->self, ssh_err(r)); 1897 buf = data; 1898 } else { 1899 buf = data = sshbuf_mutable_ptr(c->output); 1900 dlen = sshbuf_len(c->output); 1901 } 1902 1903 if (c->datagram) { 1904 /* ignore truncated writes, datagrams might get lost */ 1905 len = write(c->wfd, buf, dlen); 1906 free(data); 1907 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 1908 return 1; 1909 if (len <= 0) 1910 goto write_fail; 1911 goto out; 1912 } 1913 1914 len = write(c->wfd, buf, dlen); 1915 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 1916 return 1; 1917 if (len <= 0) { 1918 write_fail: 1919 if (c->type != SSH_CHANNEL_OPEN) { 1920 debug2("channel %d: not open", c->self); 1921 chan_mark_dead(ssh, c); 1922 return -1; 1923 } else { 1924 chan_write_failed(ssh, c); 1925 } 1926 return -1; 1927 } 1928 if (c->isatty && dlen >= 1 && buf[0] != '\r') { 1929 if (tcgetattr(c->wfd, &tio) == 0 && 1930 !(tio.c_lflag & ECHO) && (tio.c_lflag & ICANON)) { 1931 /* 1932 * Simulate echo to reduce the impact of 1933 * traffic analysis. We need to match the 1934 * size of a SSH2_MSG_CHANNEL_DATA message 1935 * (4 byte channel id + buf) 1936 */ 1937 if ((r = sshpkt_msg_ignore(ssh, 4+len)) != 0 || 1938 (r = sshpkt_send(ssh)) != 0) 1939 fatal("%s: channel %d: ignore: %s", 1940 __func__, c->self, ssh_err(r)); 1941 } 1942 } 1943 if ((r = sshbuf_consume(c->output, len)) != 0) { 1944 fatal("%s: channel %d: consume: %s", 1945 __func__, c->self, ssh_err(r)); 1946 } 1947 out: 1948 c->local_consumed += olen - sshbuf_len(c->output); 1949 1950 return 1; 1951 } 1952 1953 static int 1954 channel_handle_efd_write(struct ssh *ssh, Channel *c, 1955 fd_set *readset, fd_set *writeset) 1956 { 1957 int r; 1958 ssize_t len; 1959 1960 if (!FD_ISSET(c->efd, writeset) || sshbuf_len(c->extended) == 0) 1961 return 1; 1962 1963 len = write(c->efd, sshbuf_ptr(c->extended), 1964 sshbuf_len(c->extended)); 1965 debug2("channel %d: written %zd to efd %d", c->self, len, c->efd); 1966 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 1967 return 1; 1968 if (len <= 0) { 1969 debug2("channel %d: closing write-efd %d", c->self, c->efd); 1970 channel_close_fd(ssh, &c->efd); 1971 } else { 1972 if ((r = sshbuf_consume(c->extended, len)) != 0) { 1973 fatal("%s: channel %d: consume: %s", 1974 __func__, c->self, ssh_err(r)); 1975 } 1976 c->local_consumed += len; 1977 } 1978 return 1; 1979 } 1980 1981 static int 1982 channel_handle_efd_read(struct ssh *ssh, Channel *c, 1983 fd_set *readset, fd_set *writeset) 1984 { 1985 char buf[CHAN_RBUF]; 1986 int r; 1987 ssize_t len; 1988 1989 if (!FD_ISSET(c->efd, readset)) 1990 return 1; 1991 1992 len = read(c->efd, buf, sizeof(buf)); 1993 debug2("channel %d: read %zd from efd %d", c->self, len, c->efd); 1994 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 1995 return 1; 1996 if (len <= 0) { 1997 debug2("channel %d: closing read-efd %d", 1998 c->self, c->efd); 1999 channel_close_fd(ssh, &c->efd); 2000 } else { 2001 if (c->extended_usage == CHAN_EXTENDED_IGNORE) { 2002 debug3("channel %d: discard efd", 2003 c->self); 2004 } else if ((r = sshbuf_put(c->extended, buf, len)) != 0) { 2005 fatal("%s: channel %d: append: %s", 2006 __func__, c->self, ssh_err(r)); 2007 } 2008 } 2009 return 1; 2010 } 2011 2012 static int 2013 channel_handle_efd(struct ssh *ssh, Channel *c, 2014 fd_set *readset, fd_set *writeset) 2015 { 2016 if (c->efd == -1) 2017 return 1; 2018 2019 /** XXX handle drain efd, too */ 2020 2021 if (c->extended_usage == CHAN_EXTENDED_WRITE) 2022 return channel_handle_efd_write(ssh, c, readset, writeset); 2023 else if (c->extended_usage == CHAN_EXTENDED_READ || 2024 c->extended_usage == CHAN_EXTENDED_IGNORE) 2025 return channel_handle_efd_read(ssh, c, readset, writeset); 2026 2027 return 1; 2028 } 2029 2030 static int 2031 channel_check_window(struct ssh *ssh, Channel *c) 2032 { 2033 int r; 2034 2035 if (c->type == SSH_CHANNEL_OPEN && 2036 !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) && 2037 ((c->local_window_max - c->local_window > 2038 c->local_maxpacket*3) || 2039 c->local_window < c->local_window_max/2) && 2040 c->local_consumed > 0) { 2041 if (!c->have_remote_id) 2042 fatal(":%s: channel %d: no remote id", 2043 __func__, c->self); 2044 if ((r = sshpkt_start(ssh, 2045 SSH2_MSG_CHANNEL_WINDOW_ADJUST)) != 0 || 2046 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 2047 (r = sshpkt_put_u32(ssh, c->local_consumed)) != 0 || 2048 (r = sshpkt_send(ssh)) != 0) { 2049 fatal("%s: channel %i: %s", __func__, 2050 c->self, ssh_err(r)); 2051 } 2052 debug2("channel %d: window %d sent adjust %d", 2053 c->self, c->local_window, 2054 c->local_consumed); 2055 c->local_window += c->local_consumed; 2056 c->local_consumed = 0; 2057 } 2058 return 1; 2059 } 2060 2061 static void 2062 channel_post_open(struct ssh *ssh, Channel *c, 2063 fd_set *readset, fd_set *writeset) 2064 { 2065 channel_handle_rfd(ssh, c, readset, writeset); 2066 channel_handle_wfd(ssh, c, readset, writeset); 2067 channel_handle_efd(ssh, c, readset, writeset); 2068 channel_check_window(ssh, c); 2069 } 2070 2071 static u_int 2072 read_mux(struct ssh *ssh, Channel *c, u_int need) 2073 { 2074 char buf[CHAN_RBUF]; 2075 ssize_t len; 2076 u_int rlen; 2077 int r; 2078 2079 if (sshbuf_len(c->input) < need) { 2080 rlen = need - sshbuf_len(c->input); 2081 len = read(c->rfd, buf, MINIMUM(rlen, CHAN_RBUF)); 2082 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 2083 return sshbuf_len(c->input); 2084 if (len <= 0) { 2085 debug2("channel %d: ctl read<=0 rfd %d len %zd", 2086 c->self, c->rfd, len); 2087 chan_read_failed(ssh, c); 2088 return 0; 2089 } else if ((r = sshbuf_put(c->input, buf, len)) != 0) { 2090 fatal("%s: channel %d: append: %s", 2091 __func__, c->self, ssh_err(r)); 2092 } 2093 } 2094 return sshbuf_len(c->input); 2095 } 2096 2097 static void 2098 channel_post_mux_client_read(struct ssh *ssh, Channel *c, 2099 fd_set *readset, fd_set *writeset) 2100 { 2101 u_int need; 2102 2103 if (c->rfd == -1 || !FD_ISSET(c->rfd, readset)) 2104 return; 2105 if (c->istate != CHAN_INPUT_OPEN && c->istate != CHAN_INPUT_WAIT_DRAIN) 2106 return; 2107 if (c->mux_pause) 2108 return; 2109 2110 /* 2111 * Don't not read past the precise end of packets to 2112 * avoid disrupting fd passing. 2113 */ 2114 if (read_mux(ssh, c, 4) < 4) /* read header */ 2115 return; 2116 /* XXX sshbuf_peek_u32 */ 2117 need = PEEK_U32(sshbuf_ptr(c->input)); 2118 #define CHANNEL_MUX_MAX_PACKET (256 * 1024) 2119 if (need > CHANNEL_MUX_MAX_PACKET) { 2120 debug2("channel %d: packet too big %u > %u", 2121 c->self, CHANNEL_MUX_MAX_PACKET, need); 2122 chan_rcvd_oclose(ssh, c); 2123 return; 2124 } 2125 if (read_mux(ssh, c, need + 4) < need + 4) /* read body */ 2126 return; 2127 if (c->mux_rcb(ssh, c) != 0) { 2128 debug("channel %d: mux_rcb failed", c->self); 2129 chan_mark_dead(ssh, c); 2130 return; 2131 } 2132 } 2133 2134 static void 2135 channel_post_mux_client_write(struct ssh *ssh, Channel *c, 2136 fd_set *readset, fd_set *writeset) 2137 { 2138 ssize_t len; 2139 int r; 2140 2141 if (c->wfd == -1 || !FD_ISSET(c->wfd, writeset) || 2142 sshbuf_len(c->output) == 0) 2143 return; 2144 2145 len = write(c->wfd, sshbuf_ptr(c->output), sshbuf_len(c->output)); 2146 if (len < 0 && (errno == EINTR || errno == EAGAIN)) 2147 return; 2148 if (len <= 0) { 2149 chan_mark_dead(ssh, c); 2150 return; 2151 } 2152 if ((r = sshbuf_consume(c->output, len)) != 0) 2153 fatal("%s: channel %d: consume: %s", __func__, 2154 c->self, ssh_err(r)); 2155 } 2156 2157 static void 2158 channel_post_mux_client(struct ssh *ssh, Channel *c, 2159 fd_set *readset, fd_set *writeset) 2160 { 2161 channel_post_mux_client_read(ssh, c, readset, writeset); 2162 channel_post_mux_client_write(ssh, c, readset, writeset); 2163 } 2164 2165 static void 2166 channel_post_mux_listener(struct ssh *ssh, Channel *c, 2167 fd_set *readset, fd_set *writeset) 2168 { 2169 Channel *nc; 2170 struct sockaddr_storage addr; 2171 socklen_t addrlen; 2172 int newsock; 2173 uid_t euid; 2174 gid_t egid; 2175 2176 if (!FD_ISSET(c->sock, readset)) 2177 return; 2178 2179 debug("multiplexing control connection"); 2180 2181 /* 2182 * Accept connection on control socket 2183 */ 2184 memset(&addr, 0, sizeof(addr)); 2185 addrlen = sizeof(addr); 2186 if ((newsock = accept(c->sock, (struct sockaddr*)&addr, 2187 &addrlen)) == -1) { 2188 error("%s accept: %s", __func__, strerror(errno)); 2189 if (errno == EMFILE || errno == ENFILE) 2190 c->notbefore = monotime() + 1; 2191 return; 2192 } 2193 2194 if (getpeereid(newsock, &euid, &egid) < 0) { 2195 error("%s getpeereid failed: %s", __func__, 2196 strerror(errno)); 2197 close(newsock); 2198 return; 2199 } 2200 if ((euid != 0) && (getuid() != euid)) { 2201 error("multiplex uid mismatch: peer euid %u != uid %u", 2202 (u_int)euid, (u_int)getuid()); 2203 close(newsock); 2204 return; 2205 } 2206 nc = channel_new(ssh, "multiplex client", SSH_CHANNEL_MUX_CLIENT, 2207 newsock, newsock, -1, c->local_window_max, 2208 c->local_maxpacket, 0, "mux-control", 1); 2209 nc->mux_rcb = c->mux_rcb; 2210 debug3("%s: new mux channel %d fd %d", __func__, nc->self, nc->sock); 2211 /* establish state */ 2212 nc->mux_rcb(ssh, nc); 2213 /* mux state transitions must not elicit protocol messages */ 2214 nc->flags |= CHAN_LOCAL; 2215 } 2216 2217 static void 2218 channel_handler_init(struct ssh_channels *sc) 2219 { 2220 chan_fn **pre, **post; 2221 2222 if ((pre = calloc(SSH_CHANNEL_MAX_TYPE, sizeof(*pre))) == NULL || 2223 (post = calloc(SSH_CHANNEL_MAX_TYPE, sizeof(*post))) == NULL) 2224 fatal("%s: allocation failed", __func__); 2225 2226 pre[SSH_CHANNEL_OPEN] = &channel_pre_open; 2227 pre[SSH_CHANNEL_X11_OPEN] = &channel_pre_x11_open; 2228 pre[SSH_CHANNEL_PORT_LISTENER] = &channel_pre_listener; 2229 pre[SSH_CHANNEL_RPORT_LISTENER] = &channel_pre_listener; 2230 pre[SSH_CHANNEL_UNIX_LISTENER] = &channel_pre_listener; 2231 pre[SSH_CHANNEL_RUNIX_LISTENER] = &channel_pre_listener; 2232 pre[SSH_CHANNEL_X11_LISTENER] = &channel_pre_listener; 2233 pre[SSH_CHANNEL_AUTH_SOCKET] = &channel_pre_listener; 2234 pre[SSH_CHANNEL_CONNECTING] = &channel_pre_connecting; 2235 pre[SSH_CHANNEL_DYNAMIC] = &channel_pre_dynamic; 2236 pre[SSH_CHANNEL_RDYNAMIC_FINISH] = &channel_pre_connecting; 2237 pre[SSH_CHANNEL_MUX_LISTENER] = &channel_pre_listener; 2238 pre[SSH_CHANNEL_MUX_CLIENT] = &channel_pre_mux_client; 2239 2240 post[SSH_CHANNEL_OPEN] = &channel_post_open; 2241 post[SSH_CHANNEL_PORT_LISTENER] = &channel_post_port_listener; 2242 post[SSH_CHANNEL_RPORT_LISTENER] = &channel_post_port_listener; 2243 post[SSH_CHANNEL_UNIX_LISTENER] = &channel_post_port_listener; 2244 post[SSH_CHANNEL_RUNIX_LISTENER] = &channel_post_port_listener; 2245 post[SSH_CHANNEL_X11_LISTENER] = &channel_post_x11_listener; 2246 post[SSH_CHANNEL_AUTH_SOCKET] = &channel_post_auth_listener; 2247 post[SSH_CHANNEL_CONNECTING] = &channel_post_connecting; 2248 post[SSH_CHANNEL_DYNAMIC] = &channel_post_open; 2249 post[SSH_CHANNEL_RDYNAMIC_FINISH] = &channel_post_connecting; 2250 post[SSH_CHANNEL_MUX_LISTENER] = &channel_post_mux_listener; 2251 post[SSH_CHANNEL_MUX_CLIENT] = &channel_post_mux_client; 2252 2253 sc->channel_pre = pre; 2254 sc->channel_post = post; 2255 } 2256 2257 /* gc dead channels */ 2258 static void 2259 channel_garbage_collect(struct ssh *ssh, Channel *c) 2260 { 2261 if (c == NULL) 2262 return; 2263 if (c->detach_user != NULL) { 2264 if (!chan_is_dead(ssh, c, c->detach_close)) 2265 return; 2266 debug2("channel %d: gc: notify user", c->self); 2267 c->detach_user(ssh, c->self, NULL); 2268 /* if we still have a callback */ 2269 if (c->detach_user != NULL) 2270 return; 2271 debug2("channel %d: gc: user detached", c->self); 2272 } 2273 if (!chan_is_dead(ssh, c, 1)) 2274 return; 2275 debug2("channel %d: garbage collecting", c->self); 2276 channel_free(ssh, c); 2277 } 2278 2279 enum channel_table { CHAN_PRE, CHAN_POST }; 2280 2281 static void 2282 channel_handler(struct ssh *ssh, int table, 2283 fd_set *readset, fd_set *writeset, time_t *unpause_secs) 2284 { 2285 struct ssh_channels *sc = ssh->chanctxt; 2286 chan_fn **ftab = table == CHAN_PRE ? sc->channel_pre : sc->channel_post; 2287 u_int i, oalloc; 2288 Channel *c; 2289 time_t now; 2290 2291 now = monotime(); 2292 if (unpause_secs != NULL) 2293 *unpause_secs = 0; 2294 for (i = 0, oalloc = sc->channels_alloc; i < oalloc; i++) { 2295 c = sc->channels[i]; 2296 if (c == NULL) 2297 continue; 2298 if (c->delayed) { 2299 if (table == CHAN_PRE) 2300 c->delayed = 0; 2301 else 2302 continue; 2303 } 2304 if (ftab[c->type] != NULL) { 2305 /* 2306 * Run handlers that are not paused. 2307 */ 2308 if (c->notbefore <= now) 2309 (*ftab[c->type])(ssh, c, readset, writeset); 2310 else if (unpause_secs != NULL) { 2311 /* 2312 * Collect the time that the earliest 2313 * channel comes off pause. 2314 */ 2315 debug3("%s: chan %d: skip for %d more seconds", 2316 __func__, c->self, 2317 (int)(c->notbefore - now)); 2318 if (*unpause_secs == 0 || 2319 (c->notbefore - now) < *unpause_secs) 2320 *unpause_secs = c->notbefore - now; 2321 } 2322 } 2323 channel_garbage_collect(ssh, c); 2324 } 2325 if (unpause_secs != NULL && *unpause_secs != 0) 2326 debug3("%s: first channel unpauses in %d seconds", 2327 __func__, (int)*unpause_secs); 2328 } 2329 2330 /* 2331 * Create sockets before allocating the select bitmasks. 2332 * This is necessary for things that need to happen after reading 2333 * the network-input but before channel_prepare_select(). 2334 */ 2335 static void 2336 channel_before_prepare_select(struct ssh *ssh) 2337 { 2338 struct ssh_channels *sc = ssh->chanctxt; 2339 Channel *c; 2340 u_int i, oalloc; 2341 2342 for (i = 0, oalloc = sc->channels_alloc; i < oalloc; i++) { 2343 c = sc->channels[i]; 2344 if (c == NULL) 2345 continue; 2346 if (c->type == SSH_CHANNEL_RDYNAMIC_OPEN) 2347 channel_before_prepare_select_rdynamic(ssh, c); 2348 } 2349 } 2350 2351 /* 2352 * Allocate/update select bitmasks and add any bits relevant to channels in 2353 * select bitmasks. 2354 */ 2355 void 2356 channel_prepare_select(struct ssh *ssh, fd_set **readsetp, fd_set **writesetp, 2357 int *maxfdp, u_int *nallocp, time_t *minwait_secs) 2358 { 2359 u_int n, sz, nfdset; 2360 2361 channel_before_prepare_select(ssh); /* might update channel_max_fd */ 2362 2363 n = MAXIMUM(*maxfdp, ssh->chanctxt->channel_max_fd); 2364 2365 nfdset = howmany(n+1, NFDBITS); 2366 /* Explicitly test here, because xrealloc isn't always called */ 2367 if (nfdset && SIZE_MAX / nfdset < sizeof(fd_mask)) 2368 fatal("channel_prepare_select: max_fd (%d) is too large", n); 2369 sz = nfdset * sizeof(fd_mask); 2370 2371 /* perhaps check sz < nalloc/2 and shrink? */ 2372 if (*readsetp == NULL || sz > *nallocp) { 2373 *readsetp = xreallocarray(*readsetp, nfdset, sizeof(fd_mask)); 2374 *writesetp = xreallocarray(*writesetp, nfdset, sizeof(fd_mask)); 2375 *nallocp = sz; 2376 } 2377 *maxfdp = n; 2378 memset(*readsetp, 0, sz); 2379 memset(*writesetp, 0, sz); 2380 2381 if (!ssh_packet_is_rekeying(ssh)) 2382 channel_handler(ssh, CHAN_PRE, *readsetp, *writesetp, 2383 minwait_secs); 2384 } 2385 2386 /* 2387 * After select, perform any appropriate operations for channels which have 2388 * events pending. 2389 */ 2390 void 2391 channel_after_select(struct ssh *ssh, fd_set *readset, fd_set *writeset) 2392 { 2393 channel_handler(ssh, CHAN_POST, readset, writeset, NULL); 2394 } 2395 2396 /* 2397 * Enqueue data for channels with open or draining c->input. 2398 */ 2399 static void 2400 channel_output_poll_input_open(struct ssh *ssh, Channel *c) 2401 { 2402 size_t len, plen; 2403 const u_char *pkt; 2404 int r; 2405 2406 if ((len = sshbuf_len(c->input)) == 0) { 2407 if (c->istate == CHAN_INPUT_WAIT_DRAIN) { 2408 /* 2409 * input-buffer is empty and read-socket shutdown: 2410 * tell peer, that we will not send more data: 2411 * send IEOF. 2412 * hack for extended data: delay EOF if EFD still 2413 * in use. 2414 */ 2415 if (CHANNEL_EFD_INPUT_ACTIVE(c)) 2416 debug2("channel %d: " 2417 "ibuf_empty delayed efd %d/(%zu)", 2418 c->self, c->efd, sshbuf_len(c->extended)); 2419 else 2420 chan_ibuf_empty(ssh, c); 2421 } 2422 return; 2423 } 2424 2425 if (!c->have_remote_id) 2426 fatal(":%s: channel %d: no remote id", __func__, c->self); 2427 2428 if (c->datagram) { 2429 /* Check datagram will fit; drop if not */ 2430 if ((r = sshbuf_get_string_direct(c->input, &pkt, &plen)) != 0) 2431 fatal("%s: channel %d: get datagram: %s", __func__, 2432 c->self, ssh_err(r)); 2433 /* 2434 * XXX this does tail-drop on the datagram queue which is 2435 * usually suboptimal compared to head-drop. Better to have 2436 * backpressure at read time? (i.e. read + discard) 2437 */ 2438 if (plen > c->remote_window || plen > c->remote_maxpacket) { 2439 debug("channel %d: datagram too big", c->self); 2440 return; 2441 } 2442 /* Enqueue it */ 2443 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_DATA)) != 0 || 2444 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 2445 (r = sshpkt_put_string(ssh, pkt, plen)) != 0 || 2446 (r = sshpkt_send(ssh)) != 0) { 2447 fatal("%s: channel %i: datagram: %s", __func__, 2448 c->self, ssh_err(r)); 2449 } 2450 c->remote_window -= plen; 2451 return; 2452 } 2453 2454 /* Enqueue packet for buffered data. */ 2455 if (len > c->remote_window) 2456 len = c->remote_window; 2457 if (len > c->remote_maxpacket) 2458 len = c->remote_maxpacket; 2459 if (len == 0) 2460 return; 2461 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_DATA)) != 0 || 2462 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 2463 (r = sshpkt_put_string(ssh, sshbuf_ptr(c->input), len)) != 0 || 2464 (r = sshpkt_send(ssh)) != 0) { 2465 fatal("%s: channel %i: data: %s", __func__, 2466 c->self, ssh_err(r)); 2467 } 2468 if ((r = sshbuf_consume(c->input, len)) != 0) 2469 fatal("%s: channel %i: consume: %s", __func__, 2470 c->self, ssh_err(r)); 2471 c->remote_window -= len; 2472 } 2473 2474 /* 2475 * Enqueue data for channels with open c->extended in read mode. 2476 */ 2477 static void 2478 channel_output_poll_extended_read(struct ssh *ssh, Channel *c) 2479 { 2480 size_t len; 2481 int r; 2482 2483 if ((len = sshbuf_len(c->extended)) == 0) 2484 return; 2485 2486 debug2("channel %d: rwin %u elen %zu euse %d", c->self, 2487 c->remote_window, sshbuf_len(c->extended), c->extended_usage); 2488 if (len > c->remote_window) 2489 len = c->remote_window; 2490 if (len > c->remote_maxpacket) 2491 len = c->remote_maxpacket; 2492 if (len == 0) 2493 return; 2494 if (!c->have_remote_id) 2495 fatal(":%s: channel %d: no remote id", __func__, c->self); 2496 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_EXTENDED_DATA)) != 0 || 2497 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 2498 (r = sshpkt_put_u32(ssh, SSH2_EXTENDED_DATA_STDERR)) != 0 || 2499 (r = sshpkt_put_string(ssh, sshbuf_ptr(c->extended), len)) != 0 || 2500 (r = sshpkt_send(ssh)) != 0) { 2501 fatal("%s: channel %i: data: %s", __func__, 2502 c->self, ssh_err(r)); 2503 } 2504 if ((r = sshbuf_consume(c->extended, len)) != 0) 2505 fatal("%s: channel %i: consume: %s", __func__, 2506 c->self, ssh_err(r)); 2507 c->remote_window -= len; 2508 debug2("channel %d: sent ext data %zu", c->self, len); 2509 } 2510 2511 /* If there is data to send to the connection, enqueue some of it now. */ 2512 void 2513 channel_output_poll(struct ssh *ssh) 2514 { 2515 struct ssh_channels *sc = ssh->chanctxt; 2516 Channel *c; 2517 u_int i; 2518 2519 for (i = 0; i < sc->channels_alloc; i++) { 2520 c = sc->channels[i]; 2521 if (c == NULL) 2522 continue; 2523 2524 /* 2525 * We are only interested in channels that can have buffered 2526 * incoming data. 2527 */ 2528 if (c->type != SSH_CHANNEL_OPEN) 2529 continue; 2530 if ((c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD))) { 2531 /* XXX is this true? */ 2532 debug3("channel %d: will not send data after close", 2533 c->self); 2534 continue; 2535 } 2536 2537 /* Get the amount of buffered data for this channel. */ 2538 if (c->istate == CHAN_INPUT_OPEN || 2539 c->istate == CHAN_INPUT_WAIT_DRAIN) 2540 channel_output_poll_input_open(ssh, c); 2541 /* Send extended data, i.e. stderr */ 2542 if (!(c->flags & CHAN_EOF_SENT) && 2543 c->extended_usage == CHAN_EXTENDED_READ) 2544 channel_output_poll_extended_read(ssh, c); 2545 } 2546 } 2547 2548 /* -- mux proxy support */ 2549 2550 /* 2551 * When multiplexing channel messages for mux clients we have to deal 2552 * with downstream messages from the mux client and upstream messages 2553 * from the ssh server: 2554 * 1) Handling downstream messages is straightforward and happens 2555 * in channel_proxy_downstream(): 2556 * - We forward all messages (mostly) unmodified to the server. 2557 * - However, in order to route messages from upstream to the correct 2558 * downstream client, we have to replace the channel IDs used by the 2559 * mux clients with a unique channel ID because the mux clients might 2560 * use conflicting channel IDs. 2561 * - so we inspect and change both SSH2_MSG_CHANNEL_OPEN and 2562 * SSH2_MSG_CHANNEL_OPEN_CONFIRMATION messages, create a local 2563 * SSH_CHANNEL_MUX_PROXY channel and replace the mux clients ID 2564 * with the newly allocated channel ID. 2565 * 2) Upstream messages are received by matching SSH_CHANNEL_MUX_PROXY 2566 * channels and procesed by channel_proxy_upstream(). The local channel ID 2567 * is then translated back to the original mux client ID. 2568 * 3) In both cases we need to keep track of matching SSH2_MSG_CHANNEL_CLOSE 2569 * messages so we can clean up SSH_CHANNEL_MUX_PROXY channels. 2570 * 4) The SSH_CHANNEL_MUX_PROXY channels also need to closed when the 2571 * downstream mux client are removed. 2572 * 5) Handling SSH2_MSG_CHANNEL_OPEN messages from the upstream server 2573 * requires more work, because they are not addressed to a specific 2574 * channel. E.g. client_request_forwarded_tcpip() needs to figure 2575 * out whether the request is addressed to the local client or a 2576 * specific downstream client based on the listen-address/port. 2577 * 6) Agent and X11-Forwarding have a similar problem and are currenly 2578 * not supported as the matching session/channel cannot be identified 2579 * easily. 2580 */ 2581 2582 /* 2583 * receive packets from downstream mux clients: 2584 * channel callback fired on read from mux client, creates 2585 * SSH_CHANNEL_MUX_PROXY channels and translates channel IDs 2586 * on channel creation. 2587 */ 2588 int 2589 channel_proxy_downstream(struct ssh *ssh, Channel *downstream) 2590 { 2591 Channel *c = NULL; 2592 struct sshbuf *original = NULL, *modified = NULL; 2593 const u_char *cp; 2594 char *ctype = NULL, *listen_host = NULL; 2595 u_char type; 2596 size_t have; 2597 int ret = -1, r; 2598 u_int id, remote_id, listen_port; 2599 2600 /* sshbuf_dump(downstream->input, stderr); */ 2601 if ((r = sshbuf_get_string_direct(downstream->input, &cp, &have)) 2602 != 0) { 2603 error("%s: malformed message: %s", __func__, ssh_err(r)); 2604 return -1; 2605 } 2606 if (have < 2) { 2607 error("%s: short message", __func__); 2608 return -1; 2609 } 2610 type = cp[1]; 2611 /* skip padlen + type */ 2612 cp += 2; 2613 have -= 2; 2614 if (ssh_packet_log_type(type)) 2615 debug3("%s: channel %u: down->up: type %u", __func__, 2616 downstream->self, type); 2617 2618 switch (type) { 2619 case SSH2_MSG_CHANNEL_OPEN: 2620 if ((original = sshbuf_from(cp, have)) == NULL || 2621 (modified = sshbuf_new()) == NULL) { 2622 error("%s: alloc", __func__); 2623 goto out; 2624 } 2625 if ((r = sshbuf_get_cstring(original, &ctype, NULL)) != 0 || 2626 (r = sshbuf_get_u32(original, &id)) != 0) { 2627 error("%s: parse error %s", __func__, ssh_err(r)); 2628 goto out; 2629 } 2630 c = channel_new(ssh, "mux proxy", SSH_CHANNEL_MUX_PROXY, 2631 -1, -1, -1, 0, 0, 0, ctype, 1); 2632 c->mux_ctx = downstream; /* point to mux client */ 2633 c->mux_downstream_id = id; /* original downstream id */ 2634 if ((r = sshbuf_put_cstring(modified, ctype)) != 0 || 2635 (r = sshbuf_put_u32(modified, c->self)) != 0 || 2636 (r = sshbuf_putb(modified, original)) != 0) { 2637 error("%s: compose error %s", __func__, ssh_err(r)); 2638 channel_free(ssh, c); 2639 goto out; 2640 } 2641 break; 2642 case SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: 2643 /* 2644 * Almost the same as SSH2_MSG_CHANNEL_OPEN, except then we 2645 * need to parse 'remote_id' instead of 'ctype'. 2646 */ 2647 if ((original = sshbuf_from(cp, have)) == NULL || 2648 (modified = sshbuf_new()) == NULL) { 2649 error("%s: alloc", __func__); 2650 goto out; 2651 } 2652 if ((r = sshbuf_get_u32(original, &remote_id)) != 0 || 2653 (r = sshbuf_get_u32(original, &id)) != 0) { 2654 error("%s: parse error %s", __func__, ssh_err(r)); 2655 goto out; 2656 } 2657 c = channel_new(ssh, "mux proxy", SSH_CHANNEL_MUX_PROXY, 2658 -1, -1, -1, 0, 0, 0, "mux-down-connect", 1); 2659 c->mux_ctx = downstream; /* point to mux client */ 2660 c->mux_downstream_id = id; 2661 c->remote_id = remote_id; 2662 c->have_remote_id = 1; 2663 if ((r = sshbuf_put_u32(modified, remote_id)) != 0 || 2664 (r = sshbuf_put_u32(modified, c->self)) != 0 || 2665 (r = sshbuf_putb(modified, original)) != 0) { 2666 error("%s: compose error %s", __func__, ssh_err(r)); 2667 channel_free(ssh, c); 2668 goto out; 2669 } 2670 break; 2671 case SSH2_MSG_GLOBAL_REQUEST: 2672 if ((original = sshbuf_from(cp, have)) == NULL) { 2673 error("%s: alloc", __func__); 2674 goto out; 2675 } 2676 if ((r = sshbuf_get_cstring(original, &ctype, NULL)) != 0) { 2677 error("%s: parse error %s", __func__, ssh_err(r)); 2678 goto out; 2679 } 2680 if (strcmp(ctype, "tcpip-forward") != 0) { 2681 error("%s: unsupported request %s", __func__, ctype); 2682 goto out; 2683 } 2684 if ((r = sshbuf_get_u8(original, NULL)) != 0 || 2685 (r = sshbuf_get_cstring(original, &listen_host, NULL)) != 0 || 2686 (r = sshbuf_get_u32(original, &listen_port)) != 0) { 2687 error("%s: parse error %s", __func__, ssh_err(r)); 2688 goto out; 2689 } 2690 if (listen_port > 65535) { 2691 error("%s: tcpip-forward for %s: bad port %u", 2692 __func__, listen_host, listen_port); 2693 goto out; 2694 } 2695 /* Record that connection to this host/port is permitted. */ 2696 fwd_perm_list_add(ssh, FWDPERM_USER, "<mux>", -1, 2697 listen_host, NULL, (int)listen_port, downstream); 2698 listen_host = NULL; 2699 break; 2700 case SSH2_MSG_CHANNEL_CLOSE: 2701 if (have < 4) 2702 break; 2703 remote_id = PEEK_U32(cp); 2704 if ((c = channel_by_remote_id(ssh, remote_id)) != NULL) { 2705 if (c->flags & CHAN_CLOSE_RCVD) 2706 channel_free(ssh, c); 2707 else 2708 c->flags |= CHAN_CLOSE_SENT; 2709 } 2710 break; 2711 } 2712 if (modified) { 2713 if ((r = sshpkt_start(ssh, type)) != 0 || 2714 (r = sshpkt_putb(ssh, modified)) != 0 || 2715 (r = sshpkt_send(ssh)) != 0) { 2716 error("%s: send %s", __func__, ssh_err(r)); 2717 goto out; 2718 } 2719 } else { 2720 if ((r = sshpkt_start(ssh, type)) != 0 || 2721 (r = sshpkt_put(ssh, cp, have)) != 0 || 2722 (r = sshpkt_send(ssh)) != 0) { 2723 error("%s: send %s", __func__, ssh_err(r)); 2724 goto out; 2725 } 2726 } 2727 ret = 0; 2728 out: 2729 free(ctype); 2730 free(listen_host); 2731 sshbuf_free(original); 2732 sshbuf_free(modified); 2733 return ret; 2734 } 2735 2736 /* 2737 * receive packets from upstream server and de-multiplex packets 2738 * to correct downstream: 2739 * implemented as a helper for channel input handlers, 2740 * replaces local (proxy) channel ID with downstream channel ID. 2741 */ 2742 int 2743 channel_proxy_upstream(Channel *c, int type, u_int32_t seq, struct ssh *ssh) 2744 { 2745 struct sshbuf *b = NULL; 2746 Channel *downstream; 2747 const u_char *cp = NULL; 2748 size_t len; 2749 int r; 2750 2751 /* 2752 * When receiving packets from the peer we need to check whether we 2753 * need to forward the packets to the mux client. In this case we 2754 * restore the orignal channel id and keep track of CLOSE messages, 2755 * so we can cleanup the channel. 2756 */ 2757 if (c == NULL || c->type != SSH_CHANNEL_MUX_PROXY) 2758 return 0; 2759 if ((downstream = c->mux_ctx) == NULL) 2760 return 0; 2761 switch (type) { 2762 case SSH2_MSG_CHANNEL_CLOSE: 2763 case SSH2_MSG_CHANNEL_DATA: 2764 case SSH2_MSG_CHANNEL_EOF: 2765 case SSH2_MSG_CHANNEL_EXTENDED_DATA: 2766 case SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: 2767 case SSH2_MSG_CHANNEL_OPEN_FAILURE: 2768 case SSH2_MSG_CHANNEL_WINDOW_ADJUST: 2769 case SSH2_MSG_CHANNEL_SUCCESS: 2770 case SSH2_MSG_CHANNEL_FAILURE: 2771 case SSH2_MSG_CHANNEL_REQUEST: 2772 break; 2773 default: 2774 debug2("%s: channel %u: unsupported type %u", __func__, 2775 c->self, type); 2776 return 0; 2777 } 2778 if ((b = sshbuf_new()) == NULL) { 2779 error("%s: alloc reply", __func__); 2780 goto out; 2781 } 2782 /* get remaining payload (after id) */ 2783 cp = sshpkt_ptr(ssh, &len); 2784 if (cp == NULL) { 2785 error("%s: no packet", __func__); 2786 goto out; 2787 } 2788 /* translate id and send to muxclient */ 2789 if ((r = sshbuf_put_u8(b, 0)) != 0 || /* padlen */ 2790 (r = sshbuf_put_u8(b, type)) != 0 || 2791 (r = sshbuf_put_u32(b, c->mux_downstream_id)) != 0 || 2792 (r = sshbuf_put(b, cp, len)) != 0 || 2793 (r = sshbuf_put_stringb(downstream->output, b)) != 0) { 2794 error("%s: compose for muxclient %s", __func__, ssh_err(r)); 2795 goto out; 2796 } 2797 /* sshbuf_dump(b, stderr); */ 2798 if (ssh_packet_log_type(type)) 2799 debug3("%s: channel %u: up->down: type %u", __func__, c->self, 2800 type); 2801 out: 2802 /* update state */ 2803 switch (type) { 2804 case SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: 2805 /* record remote_id for SSH2_MSG_CHANNEL_CLOSE */ 2806 if (cp && len > 4) { 2807 c->remote_id = PEEK_U32(cp); 2808 c->have_remote_id = 1; 2809 } 2810 break; 2811 case SSH2_MSG_CHANNEL_CLOSE: 2812 if (c->flags & CHAN_CLOSE_SENT) 2813 channel_free(ssh, c); 2814 else 2815 c->flags |= CHAN_CLOSE_RCVD; 2816 break; 2817 } 2818 sshbuf_free(b); 2819 return 1; 2820 } 2821 2822 /* -- protocol input */ 2823 2824 /* Parse a channel ID from the current packet */ 2825 static int 2826 channel_parse_id(struct ssh *ssh, const char *where, const char *what) 2827 { 2828 u_int32_t id; 2829 int r; 2830 2831 if ((r = sshpkt_get_u32(ssh, &id)) != 0) { 2832 error("%s: parse id: %s", where, ssh_err(r)); 2833 ssh_packet_disconnect(ssh, "Invalid %s message", what); 2834 } 2835 if (id > INT_MAX) { 2836 error("%s: bad channel id %u: %s", where, id, ssh_err(r)); 2837 ssh_packet_disconnect(ssh, "Invalid %s channel id", what); 2838 } 2839 return (int)id; 2840 } 2841 2842 /* Lookup a channel from an ID in the current packet */ 2843 static Channel * 2844 channel_from_packet_id(struct ssh *ssh, const char *where, const char *what) 2845 { 2846 int id = channel_parse_id(ssh, where, what); 2847 Channel *c; 2848 2849 if ((c = channel_lookup(ssh, id)) == NULL) { 2850 ssh_packet_disconnect(ssh, 2851 "%s packet referred to nonexistent channel %d", what, id); 2852 } 2853 return c; 2854 } 2855 2856 int 2857 channel_input_data(int type, u_int32_t seq, struct ssh *ssh) 2858 { 2859 const u_char *data; 2860 size_t data_len, win_len; 2861 Channel *c = channel_from_packet_id(ssh, __func__, "data"); 2862 int r; 2863 2864 if (channel_proxy_upstream(c, type, seq, ssh)) 2865 return 0; 2866 2867 /* Ignore any data for non-open channels (might happen on close) */ 2868 if (c->type != SSH_CHANNEL_OPEN && 2869 c->type != SSH_CHANNEL_RDYNAMIC_OPEN && 2870 c->type != SSH_CHANNEL_RDYNAMIC_FINISH && 2871 c->type != SSH_CHANNEL_X11_OPEN) 2872 return 0; 2873 2874 /* Get the data. */ 2875 if ((r = sshpkt_get_string_direct(ssh, &data, &data_len)) != 0) 2876 fatal("%s: channel %d: get data: %s", __func__, 2877 c->self, ssh_err(r)); 2878 ssh_packet_check_eom(ssh); 2879 2880 win_len = data_len; 2881 if (c->datagram) 2882 win_len += 4; /* string length header */ 2883 2884 /* 2885 * The sending side reduces its window as it sends data, so we 2886 * must 'fake' consumption of the data in order to ensure that window 2887 * updates are sent back. Otherwise the connection might deadlock. 2888 */ 2889 if (c->ostate != CHAN_OUTPUT_OPEN) { 2890 c->local_window -= win_len; 2891 c->local_consumed += win_len; 2892 return 0; 2893 } 2894 2895 if (win_len > c->local_maxpacket) { 2896 logit("channel %d: rcvd big packet %zu, maxpack %u", 2897 c->self, win_len, c->local_maxpacket); 2898 return 0; 2899 } 2900 if (win_len > c->local_window) { 2901 logit("channel %d: rcvd too much data %zu, win %u", 2902 c->self, win_len, c->local_window); 2903 return 0; 2904 } 2905 c->local_window -= win_len; 2906 2907 if (c->datagram) { 2908 if ((r = sshbuf_put_string(c->output, data, data_len)) != 0) 2909 fatal("%s: channel %d: append datagram: %s", 2910 __func__, c->self, ssh_err(r)); 2911 } else if ((r = sshbuf_put(c->output, data, data_len)) != 0) 2912 fatal("%s: channel %d: append data: %s", 2913 __func__, c->self, ssh_err(r)); 2914 2915 return 0; 2916 } 2917 2918 int 2919 channel_input_extended_data(int type, u_int32_t seq, struct ssh *ssh) 2920 { 2921 const u_char *data; 2922 size_t data_len; 2923 u_int32_t tcode; 2924 Channel *c = channel_from_packet_id(ssh, __func__, "extended data"); 2925 int r; 2926 2927 if (channel_proxy_upstream(c, type, seq, ssh)) 2928 return 0; 2929 if (c->type != SSH_CHANNEL_OPEN) { 2930 logit("channel %d: ext data for non open", c->self); 2931 return 0; 2932 } 2933 if (c->flags & CHAN_EOF_RCVD) { 2934 if (datafellows & SSH_BUG_EXTEOF) 2935 debug("channel %d: accepting ext data after eof", 2936 c->self); 2937 else 2938 ssh_packet_disconnect(ssh, "Received extended_data " 2939 "after EOF on channel %d.", c->self); 2940 } 2941 2942 if ((r = sshpkt_get_u32(ssh, &tcode)) != 0) { 2943 error("%s: parse tcode: %s", __func__, ssh_err(r)); 2944 ssh_packet_disconnect(ssh, "Invalid extended_data message"); 2945 } 2946 if (c->efd == -1 || 2947 c->extended_usage != CHAN_EXTENDED_WRITE || 2948 tcode != SSH2_EXTENDED_DATA_STDERR) { 2949 logit("channel %d: bad ext data", c->self); 2950 return 0; 2951 } 2952 if ((r = sshpkt_get_string_direct(ssh, &data, &data_len)) != 0) { 2953 error("%s: parse data: %s", __func__, ssh_err(r)); 2954 ssh_packet_disconnect(ssh, "Invalid extended_data message"); 2955 } 2956 ssh_packet_check_eom(ssh); 2957 2958 if (data_len > c->local_window) { 2959 logit("channel %d: rcvd too much extended_data %zu, win %u", 2960 c->self, data_len, c->local_window); 2961 return 0; 2962 } 2963 debug2("channel %d: rcvd ext data %zu", c->self, data_len); 2964 /* XXX sshpkt_getb? */ 2965 if ((r = sshbuf_put(c->extended, data, data_len)) != 0) 2966 error("%s: append: %s", __func__, ssh_err(r)); 2967 c->local_window -= data_len; 2968 return 0; 2969 } 2970 2971 int 2972 channel_input_ieof(int type, u_int32_t seq, struct ssh *ssh) 2973 { 2974 Channel *c = channel_from_packet_id(ssh, __func__, "ieof"); 2975 2976 ssh_packet_check_eom(ssh); 2977 2978 if (channel_proxy_upstream(c, type, seq, ssh)) 2979 return 0; 2980 chan_rcvd_ieof(ssh, c); 2981 2982 /* XXX force input close */ 2983 if (c->force_drain && c->istate == CHAN_INPUT_OPEN) { 2984 debug("channel %d: FORCE input drain", c->self); 2985 c->istate = CHAN_INPUT_WAIT_DRAIN; 2986 if (sshbuf_len(c->input) == 0) 2987 chan_ibuf_empty(ssh, c); 2988 } 2989 return 0; 2990 } 2991 2992 int 2993 channel_input_oclose(int type, u_int32_t seq, struct ssh *ssh) 2994 { 2995 Channel *c = channel_from_packet_id(ssh, __func__, "oclose"); 2996 2997 if (channel_proxy_upstream(c, type, seq, ssh)) 2998 return 0; 2999 ssh_packet_check_eom(ssh); 3000 chan_rcvd_oclose(ssh, c); 3001 return 0; 3002 } 3003 3004 int 3005 channel_input_open_confirmation(int type, u_int32_t seq, struct ssh *ssh) 3006 { 3007 Channel *c = channel_from_packet_id(ssh, __func__, "open confirmation"); 3008 u_int32_t remote_window, remote_maxpacket; 3009 int r; 3010 3011 if (channel_proxy_upstream(c, type, seq, ssh)) 3012 return 0; 3013 if (c->type != SSH_CHANNEL_OPENING) 3014 packet_disconnect("Received open confirmation for " 3015 "non-opening channel %d.", c->self); 3016 /* 3017 * Record the remote channel number and mark that the channel 3018 * is now open. 3019 */ 3020 if ((r = sshpkt_get_u32(ssh, &c->remote_id)) != 0 || 3021 (r = sshpkt_get_u32(ssh, &remote_window)) != 0 || 3022 (r = sshpkt_get_u32(ssh, &remote_maxpacket)) != 0) { 3023 error("%s: window/maxpacket: %s", __func__, ssh_err(r)); 3024 packet_disconnect("Invalid open confirmation message"); 3025 } 3026 ssh_packet_check_eom(ssh); 3027 3028 c->have_remote_id = 1; 3029 c->remote_window = remote_window; 3030 c->remote_maxpacket = remote_maxpacket; 3031 c->type = SSH_CHANNEL_OPEN; 3032 if (c->open_confirm) { 3033 debug2("%s: channel %d: callback start", __func__, c->self); 3034 c->open_confirm(ssh, c->self, 1, c->open_confirm_ctx); 3035 debug2("%s: channel %d: callback done", __func__, c->self); 3036 } 3037 debug2("channel %d: open confirm rwindow %u rmax %u", c->self, 3038 c->remote_window, c->remote_maxpacket); 3039 return 0; 3040 } 3041 3042 static char * 3043 reason2txt(int reason) 3044 { 3045 switch (reason) { 3046 case SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED: 3047 return "administratively prohibited"; 3048 case SSH2_OPEN_CONNECT_FAILED: 3049 return "connect failed"; 3050 case SSH2_OPEN_UNKNOWN_CHANNEL_TYPE: 3051 return "unknown channel type"; 3052 case SSH2_OPEN_RESOURCE_SHORTAGE: 3053 return "resource shortage"; 3054 } 3055 return "unknown reason"; 3056 } 3057 3058 int 3059 channel_input_open_failure(int type, u_int32_t seq, struct ssh *ssh) 3060 { 3061 Channel *c = channel_from_packet_id(ssh, __func__, "open failure"); 3062 u_int32_t reason; 3063 char *msg = NULL; 3064 int r; 3065 3066 if (channel_proxy_upstream(c, type, seq, ssh)) 3067 return 0; 3068 if (c->type != SSH_CHANNEL_OPENING) 3069 packet_disconnect("Received open failure for " 3070 "non-opening channel %d.", c->self); 3071 if ((r = sshpkt_get_u32(ssh, &reason)) != 0) { 3072 error("%s: reason: %s", __func__, ssh_err(r)); 3073 packet_disconnect("Invalid open failure message"); 3074 } 3075 /* skip language */ 3076 if ((r = sshpkt_get_cstring(ssh, &msg, NULL)) != 0 || 3077 (r = sshpkt_get_string_direct(ssh, NULL, NULL)) != 0) { 3078 error("%s: message/lang: %s", __func__, ssh_err(r)); 3079 packet_disconnect("Invalid open failure message"); 3080 } 3081 ssh_packet_check_eom(ssh); 3082 logit("channel %d: open failed: %s%s%s", c->self, 3083 reason2txt(reason), msg ? ": ": "", msg ? msg : ""); 3084 free(msg); 3085 if (c->open_confirm) { 3086 debug2("%s: channel %d: callback start", __func__, c->self); 3087 c->open_confirm(ssh, c->self, 0, c->open_confirm_ctx); 3088 debug2("%s: channel %d: callback done", __func__, c->self); 3089 } 3090 /* Schedule the channel for cleanup/deletion. */ 3091 chan_mark_dead(ssh, c); 3092 return 0; 3093 } 3094 3095 int 3096 channel_input_window_adjust(int type, u_int32_t seq, struct ssh *ssh) 3097 { 3098 int id = channel_parse_id(ssh, __func__, "window adjust"); 3099 Channel *c; 3100 u_int32_t adjust; 3101 u_int new_rwin; 3102 int r; 3103 3104 if ((c = channel_lookup(ssh, id)) == NULL) { 3105 logit("Received window adjust for non-open channel %d.", id); 3106 return 0; 3107 } 3108 3109 if (channel_proxy_upstream(c, type, seq, ssh)) 3110 return 0; 3111 if ((r = sshpkt_get_u32(ssh, &adjust)) != 0) { 3112 error("%s: adjust: %s", __func__, ssh_err(r)); 3113 packet_disconnect("Invalid window adjust message"); 3114 } 3115 ssh_packet_check_eom(ssh); 3116 debug2("channel %d: rcvd adjust %u", c->self, adjust); 3117 if ((new_rwin = c->remote_window + adjust) < c->remote_window) { 3118 fatal("channel %d: adjust %u overflows remote window %u", 3119 c->self, adjust, c->remote_window); 3120 } 3121 c->remote_window = new_rwin; 3122 return 0; 3123 } 3124 3125 int 3126 channel_input_status_confirm(int type, u_int32_t seq, struct ssh *ssh) 3127 { 3128 int id = channel_parse_id(ssh, __func__, "status confirm"); 3129 Channel *c; 3130 struct channel_confirm *cc; 3131 3132 /* Reset keepalive timeout */ 3133 packet_set_alive_timeouts(0); 3134 3135 debug2("%s: type %d id %d", __func__, type, id); 3136 3137 if ((c = channel_lookup(ssh, id)) == NULL) { 3138 logit("%s: %d: unknown", __func__, id); 3139 return 0; 3140 } 3141 if (channel_proxy_upstream(c, type, seq, ssh)) 3142 return 0; 3143 ssh_packet_check_eom(ssh); 3144 if ((cc = TAILQ_FIRST(&c->status_confirms)) == NULL) 3145 return 0; 3146 cc->cb(ssh, type, c, cc->ctx); 3147 TAILQ_REMOVE(&c->status_confirms, cc, entry); 3148 explicit_bzero(cc, sizeof(*cc)); 3149 free(cc); 3150 return 0; 3151 } 3152 3153 /* -- tcp forwarding */ 3154 3155 void 3156 channel_set_af(struct ssh *ssh, int af) 3157 { 3158 ssh->chanctxt->IPv4or6 = af; 3159 } 3160 3161 3162 /* 3163 * Determine whether or not a port forward listens to loopback, the 3164 * specified address or wildcard. On the client, a specified bind 3165 * address will always override gateway_ports. On the server, a 3166 * gateway_ports of 1 (``yes'') will override the client's specification 3167 * and force a wildcard bind, whereas a value of 2 (``clientspecified'') 3168 * will bind to whatever address the client asked for. 3169 * 3170 * Special-case listen_addrs are: 3171 * 3172 * "0.0.0.0" -> wildcard v4/v6 if SSH_OLD_FORWARD_ADDR 3173 * "" (empty string), "*" -> wildcard v4/v6 3174 * "localhost" -> loopback v4/v6 3175 * "127.0.0.1" / "::1" -> accepted even if gateway_ports isn't set 3176 */ 3177 static const char * 3178 channel_fwd_bind_addr(const char *listen_addr, int *wildcardp, 3179 int is_client, struct ForwardOptions *fwd_opts) 3180 { 3181 const char *addr = NULL; 3182 int wildcard = 0; 3183 3184 if (listen_addr == NULL) { 3185 /* No address specified: default to gateway_ports setting */ 3186 if (fwd_opts->gateway_ports) 3187 wildcard = 1; 3188 } else if (fwd_opts->gateway_ports || is_client) { 3189 if (((datafellows & SSH_OLD_FORWARD_ADDR) && 3190 strcmp(listen_addr, "0.0.0.0") == 0 && is_client == 0) || 3191 *listen_addr == '\0' || strcmp(listen_addr, "*") == 0 || 3192 (!is_client && fwd_opts->gateway_ports == 1)) { 3193 wildcard = 1; 3194 /* 3195 * Notify client if they requested a specific listen 3196 * address and it was overridden. 3197 */ 3198 if (*listen_addr != '\0' && 3199 strcmp(listen_addr, "0.0.0.0") != 0 && 3200 strcmp(listen_addr, "*") != 0) { 3201 packet_send_debug("Forwarding listen address " 3202 "\"%s\" overridden by server " 3203 "GatewayPorts", listen_addr); 3204 } 3205 } else if (strcmp(listen_addr, "localhost") != 0 || 3206 strcmp(listen_addr, "127.0.0.1") == 0 || 3207 strcmp(listen_addr, "::1") == 0) { 3208 /* Accept localhost address when GatewayPorts=yes */ 3209 addr = listen_addr; 3210 } 3211 } else if (strcmp(listen_addr, "127.0.0.1") == 0 || 3212 strcmp(listen_addr, "::1") == 0) { 3213 /* 3214 * If a specific IPv4/IPv6 localhost address has been 3215 * requested then accept it even if gateway_ports is in 3216 * effect. This allows the client to prefer IPv4 or IPv6. 3217 */ 3218 addr = listen_addr; 3219 } 3220 if (wildcardp != NULL) 3221 *wildcardp = wildcard; 3222 return addr; 3223 } 3224 3225 static int 3226 channel_setup_fwd_listener_tcpip(struct ssh *ssh, int type, 3227 struct Forward *fwd, int *allocated_listen_port, 3228 struct ForwardOptions *fwd_opts) 3229 { 3230 Channel *c; 3231 int sock, r, success = 0, wildcard = 0, is_client; 3232 struct addrinfo hints, *ai, *aitop; 3233 const char *host, *addr; 3234 char ntop[NI_MAXHOST], strport[NI_MAXSERV]; 3235 in_port_t *lport_p; 3236 3237 is_client = (type == SSH_CHANNEL_PORT_LISTENER); 3238 3239 if (is_client && fwd->connect_path != NULL) { 3240 host = fwd->connect_path; 3241 } else { 3242 host = (type == SSH_CHANNEL_RPORT_LISTENER) ? 3243 fwd->listen_host : fwd->connect_host; 3244 if (host == NULL) { 3245 error("No forward host name."); 3246 return 0; 3247 } 3248 if (strlen(host) >= NI_MAXHOST) { 3249 error("Forward host name too long."); 3250 return 0; 3251 } 3252 } 3253 3254 /* Determine the bind address, cf. channel_fwd_bind_addr() comment */ 3255 addr = channel_fwd_bind_addr(fwd->listen_host, &wildcard, 3256 is_client, fwd_opts); 3257 debug3("%s: type %d wildcard %d addr %s", __func__, 3258 type, wildcard, (addr == NULL) ? "NULL" : addr); 3259 3260 /* 3261 * getaddrinfo returns a loopback address if the hostname is 3262 * set to NULL and hints.ai_flags is not AI_PASSIVE 3263 */ 3264 memset(&hints, 0, sizeof(hints)); 3265 hints.ai_family = ssh->chanctxt->IPv4or6; 3266 hints.ai_flags = wildcard ? AI_PASSIVE : 0; 3267 hints.ai_socktype = SOCK_STREAM; 3268 snprintf(strport, sizeof strport, "%d", fwd->listen_port); 3269 if ((r = getaddrinfo(addr, strport, &hints, &aitop)) != 0) { 3270 if (addr == NULL) { 3271 /* This really shouldn't happen */ 3272 packet_disconnect("getaddrinfo: fatal error: %s", 3273 ssh_gai_strerror(r)); 3274 } else { 3275 error("%s: getaddrinfo(%.64s): %s", __func__, addr, 3276 ssh_gai_strerror(r)); 3277 } 3278 return 0; 3279 } 3280 if (allocated_listen_port != NULL) 3281 *allocated_listen_port = 0; 3282 for (ai = aitop; ai; ai = ai->ai_next) { 3283 switch (ai->ai_family) { 3284 case AF_INET: 3285 lport_p = &((struct sockaddr_in *)ai->ai_addr)-> 3286 sin_port; 3287 break; 3288 case AF_INET6: 3289 lport_p = &((struct sockaddr_in6 *)ai->ai_addr)-> 3290 sin6_port; 3291 break; 3292 default: 3293 continue; 3294 } 3295 /* 3296 * If allocating a port for -R forwards, then use the 3297 * same port for all address families. 3298 */ 3299 if (type == SSH_CHANNEL_RPORT_LISTENER && 3300 fwd->listen_port == 0 && allocated_listen_port != NULL && 3301 *allocated_listen_port > 0) 3302 *lport_p = htons(*allocated_listen_port); 3303 3304 if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), 3305 strport, sizeof(strport), 3306 NI_NUMERICHOST|NI_NUMERICSERV) != 0) { 3307 error("%s: getnameinfo failed", __func__); 3308 continue; 3309 } 3310 /* Create a port to listen for the host. */ 3311 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); 3312 if (sock < 0) { 3313 /* this is no error since kernel may not support ipv6 */ 3314 verbose("socket [%s]:%s: %.100s", ntop, strport, 3315 strerror(errno)); 3316 continue; 3317 } 3318 3319 set_reuseaddr(sock); 3320 3321 debug("Local forwarding listening on %s port %s.", 3322 ntop, strport); 3323 3324 /* Bind the socket to the address. */ 3325 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 3326 /* 3327 * address can be in if use ipv6 address is 3328 * already bound 3329 */ 3330 verbose("bind [%s]:%s: %.100s", 3331 ntop, strport, strerror(errno)); 3332 close(sock); 3333 continue; 3334 } 3335 /* Start listening for connections on the socket. */ 3336 if (listen(sock, SSH_LISTEN_BACKLOG) < 0) { 3337 error("listen [%s]:%s: %.100s", ntop, strport, 3338 strerror(errno)); 3339 close(sock); 3340 continue; 3341 } 3342 3343 /* 3344 * fwd->listen_port == 0 requests a dynamically allocated port - 3345 * record what we got. 3346 */ 3347 if (type == SSH_CHANNEL_RPORT_LISTENER && 3348 fwd->listen_port == 0 && 3349 allocated_listen_port != NULL && 3350 *allocated_listen_port == 0) { 3351 *allocated_listen_port = get_local_port(sock); 3352 debug("Allocated listen port %d", 3353 *allocated_listen_port); 3354 } 3355 3356 /* Allocate a channel number for the socket. */ 3357 c = channel_new(ssh, "port listener", type, sock, sock, -1, 3358 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 3359 0, "port listener", 1); 3360 c->path = xstrdup(host); 3361 c->host_port = fwd->connect_port; 3362 c->listening_addr = addr == NULL ? NULL : xstrdup(addr); 3363 if (fwd->listen_port == 0 && allocated_listen_port != NULL && 3364 !(datafellows & SSH_BUG_DYNAMIC_RPORT)) 3365 c->listening_port = *allocated_listen_port; 3366 else 3367 c->listening_port = fwd->listen_port; 3368 success = 1; 3369 } 3370 if (success == 0) 3371 error("%s: cannot listen to port: %d", __func__, 3372 fwd->listen_port); 3373 freeaddrinfo(aitop); 3374 return success; 3375 } 3376 3377 static int 3378 channel_setup_fwd_listener_streamlocal(struct ssh *ssh, int type, 3379 struct Forward *fwd, struct ForwardOptions *fwd_opts) 3380 { 3381 struct sockaddr_un sunaddr; 3382 const char *path; 3383 Channel *c; 3384 int port, sock; 3385 mode_t omask; 3386 3387 switch (type) { 3388 case SSH_CHANNEL_UNIX_LISTENER: 3389 if (fwd->connect_path != NULL) { 3390 if (strlen(fwd->connect_path) > sizeof(sunaddr.sun_path)) { 3391 error("Local connecting path too long: %s", 3392 fwd->connect_path); 3393 return 0; 3394 } 3395 path = fwd->connect_path; 3396 port = PORT_STREAMLOCAL; 3397 } else { 3398 if (fwd->connect_host == NULL) { 3399 error("No forward host name."); 3400 return 0; 3401 } 3402 if (strlen(fwd->connect_host) >= NI_MAXHOST) { 3403 error("Forward host name too long."); 3404 return 0; 3405 } 3406 path = fwd->connect_host; 3407 port = fwd->connect_port; 3408 } 3409 break; 3410 case SSH_CHANNEL_RUNIX_LISTENER: 3411 path = fwd->listen_path; 3412 port = PORT_STREAMLOCAL; 3413 break; 3414 default: 3415 error("%s: unexpected channel type %d", __func__, type); 3416 return 0; 3417 } 3418 3419 if (fwd->listen_path == NULL) { 3420 error("No forward path name."); 3421 return 0; 3422 } 3423 if (strlen(fwd->listen_path) > sizeof(sunaddr.sun_path)) { 3424 error("Local listening path too long: %s", fwd->listen_path); 3425 return 0; 3426 } 3427 3428 debug3("%s: type %d path %s", __func__, type, fwd->listen_path); 3429 3430 /* Start a Unix domain listener. */ 3431 omask = umask(fwd_opts->streamlocal_bind_mask); 3432 sock = unix_listener(fwd->listen_path, SSH_LISTEN_BACKLOG, 3433 fwd_opts->streamlocal_bind_unlink); 3434 umask(omask); 3435 if (sock < 0) 3436 return 0; 3437 3438 debug("Local forwarding listening on path %s.", fwd->listen_path); 3439 3440 /* Allocate a channel number for the socket. */ 3441 c = channel_new(ssh, "unix listener", type, sock, sock, -1, 3442 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 3443 0, "unix listener", 1); 3444 c->path = xstrdup(path); 3445 c->host_port = port; 3446 c->listening_port = PORT_STREAMLOCAL; 3447 c->listening_addr = xstrdup(fwd->listen_path); 3448 return 1; 3449 } 3450 3451 static int 3452 channel_cancel_rport_listener_tcpip(struct ssh *ssh, 3453 const char *host, u_short port) 3454 { 3455 u_int i; 3456 int found = 0; 3457 3458 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) { 3459 Channel *c = ssh->chanctxt->channels[i]; 3460 if (c == NULL || c->type != SSH_CHANNEL_RPORT_LISTENER) 3461 continue; 3462 if (strcmp(c->path, host) == 0 && c->listening_port == port) { 3463 debug2("%s: close channel %d", __func__, i); 3464 channel_free(ssh, c); 3465 found = 1; 3466 } 3467 } 3468 3469 return found; 3470 } 3471 3472 static int 3473 channel_cancel_rport_listener_streamlocal(struct ssh *ssh, const char *path) 3474 { 3475 u_int i; 3476 int found = 0; 3477 3478 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) { 3479 Channel *c = ssh->chanctxt->channels[i]; 3480 if (c == NULL || c->type != SSH_CHANNEL_RUNIX_LISTENER) 3481 continue; 3482 if (c->path == NULL) 3483 continue; 3484 if (strcmp(c->path, path) == 0) { 3485 debug2("%s: close channel %d", __func__, i); 3486 channel_free(ssh, c); 3487 found = 1; 3488 } 3489 } 3490 3491 return found; 3492 } 3493 3494 int 3495 channel_cancel_rport_listener(struct ssh *ssh, struct Forward *fwd) 3496 { 3497 if (fwd->listen_path != NULL) { 3498 return channel_cancel_rport_listener_streamlocal(ssh, 3499 fwd->listen_path); 3500 } else { 3501 return channel_cancel_rport_listener_tcpip(ssh, 3502 fwd->listen_host, fwd->listen_port); 3503 } 3504 } 3505 3506 static int 3507 channel_cancel_lport_listener_tcpip(struct ssh *ssh, 3508 const char *lhost, u_short lport, int cport, 3509 struct ForwardOptions *fwd_opts) 3510 { 3511 u_int i; 3512 int found = 0; 3513 const char *addr = channel_fwd_bind_addr(lhost, NULL, 1, fwd_opts); 3514 3515 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) { 3516 Channel *c = ssh->chanctxt->channels[i]; 3517 if (c == NULL || c->type != SSH_CHANNEL_PORT_LISTENER) 3518 continue; 3519 if (c->listening_port != lport) 3520 continue; 3521 if (cport == CHANNEL_CANCEL_PORT_STATIC) { 3522 /* skip dynamic forwardings */ 3523 if (c->host_port == 0) 3524 continue; 3525 } else { 3526 if (c->host_port != cport) 3527 continue; 3528 } 3529 if ((c->listening_addr == NULL && addr != NULL) || 3530 (c->listening_addr != NULL && addr == NULL)) 3531 continue; 3532 if (addr == NULL || strcmp(c->listening_addr, addr) == 0) { 3533 debug2("%s: close channel %d", __func__, i); 3534 channel_free(ssh, c); 3535 found = 1; 3536 } 3537 } 3538 3539 return found; 3540 } 3541 3542 static int 3543 channel_cancel_lport_listener_streamlocal(struct ssh *ssh, const char *path) 3544 { 3545 u_int i; 3546 int found = 0; 3547 3548 if (path == NULL) { 3549 error("%s: no path specified.", __func__); 3550 return 0; 3551 } 3552 3553 for (i = 0; i < ssh->chanctxt->channels_alloc; i++) { 3554 Channel *c = ssh->chanctxt->channels[i]; 3555 if (c == NULL || c->type != SSH_CHANNEL_UNIX_LISTENER) 3556 continue; 3557 if (c->listening_addr == NULL) 3558 continue; 3559 if (strcmp(c->listening_addr, path) == 0) { 3560 debug2("%s: close channel %d", __func__, i); 3561 channel_free(ssh, c); 3562 found = 1; 3563 } 3564 } 3565 3566 return found; 3567 } 3568 3569 int 3570 channel_cancel_lport_listener(struct ssh *ssh, 3571 struct Forward *fwd, int cport, struct ForwardOptions *fwd_opts) 3572 { 3573 if (fwd->listen_path != NULL) { 3574 return channel_cancel_lport_listener_streamlocal(ssh, 3575 fwd->listen_path); 3576 } else { 3577 return channel_cancel_lport_listener_tcpip(ssh, 3578 fwd->listen_host, fwd->listen_port, cport, fwd_opts); 3579 } 3580 } 3581 3582 /* protocol local port fwd, used by ssh */ 3583 int 3584 channel_setup_local_fwd_listener(struct ssh *ssh, 3585 struct Forward *fwd, struct ForwardOptions *fwd_opts) 3586 { 3587 if (fwd->listen_path != NULL) { 3588 return channel_setup_fwd_listener_streamlocal(ssh, 3589 SSH_CHANNEL_UNIX_LISTENER, fwd, fwd_opts); 3590 } else { 3591 return channel_setup_fwd_listener_tcpip(ssh, 3592 SSH_CHANNEL_PORT_LISTENER, fwd, NULL, fwd_opts); 3593 } 3594 } 3595 3596 /* protocol v2 remote port fwd, used by sshd */ 3597 int 3598 channel_setup_remote_fwd_listener(struct ssh *ssh, struct Forward *fwd, 3599 int *allocated_listen_port, struct ForwardOptions *fwd_opts) 3600 { 3601 if (fwd->listen_path != NULL) { 3602 return channel_setup_fwd_listener_streamlocal(ssh, 3603 SSH_CHANNEL_RUNIX_LISTENER, fwd, fwd_opts); 3604 } else { 3605 return channel_setup_fwd_listener_tcpip(ssh, 3606 SSH_CHANNEL_RPORT_LISTENER, fwd, allocated_listen_port, 3607 fwd_opts); 3608 } 3609 } 3610 3611 /* 3612 * Translate the requested rfwd listen host to something usable for 3613 * this server. 3614 */ 3615 static const char * 3616 channel_rfwd_bind_host(const char *listen_host) 3617 { 3618 if (listen_host == NULL) { 3619 return "localhost"; 3620 } else if (*listen_host == '\0' || strcmp(listen_host, "*") == 0) { 3621 return ""; 3622 } else 3623 return listen_host; 3624 } 3625 3626 /* 3627 * Initiate forwarding of connections to port "port" on remote host through 3628 * the secure channel to host:port from local side. 3629 * Returns handle (index) for updating the dynamic listen port with 3630 * channel_update_permitted_opens(). 3631 */ 3632 int 3633 channel_request_remote_forwarding(struct ssh *ssh, struct Forward *fwd) 3634 { 3635 int r, success = 0, idx = -1; 3636 char *host_to_connect, *listen_host, *listen_path; 3637 int port_to_connect, listen_port; 3638 3639 /* Send the forward request to the remote side. */ 3640 if (fwd->listen_path != NULL) { 3641 if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 || 3642 (r = sshpkt_put_cstring(ssh, 3643 "streamlocal-forward@openssh.com")) != 0 || 3644 (r = sshpkt_put_u8(ssh, 1)) != 0 || /* want reply */ 3645 (r = sshpkt_put_cstring(ssh, fwd->listen_path)) != 0 || 3646 (r = sshpkt_send(ssh)) != 0 || 3647 (r = ssh_packet_write_wait(ssh)) != 0) 3648 fatal("%s: request streamlocal: %s", 3649 __func__, ssh_err(r)); 3650 } else { 3651 if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 || 3652 (r = sshpkt_put_cstring(ssh, "tcpip-forward")) != 0 || 3653 (r = sshpkt_put_u8(ssh, 1)) != 0 || /* want reply */ 3654 (r = sshpkt_put_cstring(ssh, 3655 channel_rfwd_bind_host(fwd->listen_host))) != 0 || 3656 (r = sshpkt_put_u32(ssh, fwd->listen_port)) != 0 || 3657 (r = sshpkt_send(ssh)) != 0 || 3658 (r = ssh_packet_write_wait(ssh)) != 0) 3659 fatal("%s: request tcpip-forward: %s", 3660 __func__, ssh_err(r)); 3661 } 3662 /* Assume that server accepts the request */ 3663 success = 1; 3664 if (success) { 3665 /* Record that connection to this host/port is permitted. */ 3666 host_to_connect = listen_host = listen_path = NULL; 3667 port_to_connect = listen_port = 0; 3668 if (fwd->connect_path != NULL) { 3669 host_to_connect = xstrdup(fwd->connect_path); 3670 port_to_connect = PORT_STREAMLOCAL; 3671 } else { 3672 host_to_connect = xstrdup(fwd->connect_host); 3673 port_to_connect = fwd->connect_port; 3674 } 3675 if (fwd->listen_path != NULL) { 3676 listen_path = xstrdup(fwd->listen_path); 3677 listen_port = PORT_STREAMLOCAL; 3678 } else { 3679 if (fwd->listen_host != NULL) 3680 listen_host = xstrdup(fwd->listen_host); 3681 listen_port = fwd->listen_port; 3682 } 3683 idx = fwd_perm_list_add(ssh, FWDPERM_USER, 3684 host_to_connect, port_to_connect, 3685 listen_host, listen_path, listen_port, NULL); 3686 } 3687 return idx; 3688 } 3689 3690 static int 3691 open_match(ForwardPermission *allowed_open, const char *requestedhost, 3692 int requestedport) 3693 { 3694 if (allowed_open->host_to_connect == NULL) 3695 return 0; 3696 if (allowed_open->port_to_connect != FWD_PERMIT_ANY_PORT && 3697 allowed_open->port_to_connect != requestedport) 3698 return 0; 3699 if (strcmp(allowed_open->host_to_connect, FWD_PERMIT_ANY_HOST) != 0 && 3700 strcmp(allowed_open->host_to_connect, requestedhost) != 0) 3701 return 0; 3702 return 1; 3703 } 3704 3705 /* 3706 * Note that in the listen host/port case 3707 * we don't support FWD_PERMIT_ANY_PORT and 3708 * need to translate between the configured-host (listen_host) 3709 * and what we've sent to the remote server (channel_rfwd_bind_host) 3710 */ 3711 static int 3712 open_listen_match_tcpip(ForwardPermission *allowed_open, 3713 const char *requestedhost, u_short requestedport, int translate) 3714 { 3715 const char *allowed_host; 3716 3717 if (allowed_open->host_to_connect == NULL) 3718 return 0; 3719 if (allowed_open->listen_port != requestedport) 3720 return 0; 3721 if (!translate && allowed_open->listen_host == NULL && 3722 requestedhost == NULL) 3723 return 1; 3724 allowed_host = translate ? 3725 channel_rfwd_bind_host(allowed_open->listen_host) : 3726 allowed_open->listen_host; 3727 if (allowed_host == NULL || 3728 strcmp(allowed_host, requestedhost) != 0) 3729 return 0; 3730 return 1; 3731 } 3732 3733 static int 3734 open_listen_match_streamlocal(ForwardPermission *allowed_open, 3735 const char *requestedpath) 3736 { 3737 if (allowed_open->host_to_connect == NULL) 3738 return 0; 3739 if (allowed_open->listen_port != PORT_STREAMLOCAL) 3740 return 0; 3741 if (allowed_open->listen_path == NULL || 3742 strcmp(allowed_open->listen_path, requestedpath) != 0) 3743 return 0; 3744 return 1; 3745 } 3746 3747 /* 3748 * Request cancellation of remote forwarding of connection host:port from 3749 * local side. 3750 */ 3751 static int 3752 channel_request_rforward_cancel_tcpip(struct ssh *ssh, 3753 const char *host, u_short port) 3754 { 3755 struct ssh_channels *sc = ssh->chanctxt; 3756 int r; 3757 u_int i; 3758 ForwardPermission *fp; 3759 3760 for (i = 0; i < sc->num_permitted_opens; i++) { 3761 fp = &sc->permitted_opens[i]; 3762 if (open_listen_match_tcpip(fp, host, port, 0)) 3763 break; 3764 fp = NULL; 3765 } 3766 if (fp == NULL) { 3767 debug("%s: requested forward not found", __func__); 3768 return -1; 3769 } 3770 if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 || 3771 (r = sshpkt_put_cstring(ssh, "cancel-tcpip-forward")) != 0 || 3772 (r = sshpkt_put_u8(ssh, 0)) != 0 || /* want reply */ 3773 (r = sshpkt_put_cstring(ssh, channel_rfwd_bind_host(host))) != 0 || 3774 (r = sshpkt_put_u32(ssh, port)) != 0 || 3775 (r = sshpkt_send(ssh)) != 0) 3776 fatal("%s: send cancel: %s", __func__, ssh_err(r)); 3777 3778 fwd_perm_clear(fp); /* unregister */ 3779 3780 return 0; 3781 } 3782 3783 /* 3784 * Request cancellation of remote forwarding of Unix domain socket 3785 * path from local side. 3786 */ 3787 static int 3788 channel_request_rforward_cancel_streamlocal(struct ssh *ssh, const char *path) 3789 { 3790 struct ssh_channels *sc = ssh->chanctxt; 3791 int r; 3792 u_int i; 3793 ForwardPermission *fp; 3794 3795 for (i = 0; i < sc->num_permitted_opens; i++) { 3796 fp = &sc->permitted_opens[i]; 3797 if (open_listen_match_streamlocal(fp, path)) 3798 break; 3799 fp = NULL; 3800 } 3801 if (fp == NULL) { 3802 debug("%s: requested forward not found", __func__); 3803 return -1; 3804 } 3805 if ((r = sshpkt_start(ssh, SSH2_MSG_GLOBAL_REQUEST)) != 0 || 3806 (r = sshpkt_put_cstring(ssh, 3807 "cancel-streamlocal-forward@openssh.com")) != 0 || 3808 (r = sshpkt_put_u8(ssh, 0)) != 0 || /* want reply */ 3809 (r = sshpkt_put_cstring(ssh, path)) != 0 || 3810 (r = sshpkt_send(ssh)) != 0) 3811 fatal("%s: send cancel: %s", __func__, ssh_err(r)); 3812 3813 fwd_perm_clear(fp); /* unregister */ 3814 3815 return 0; 3816 } 3817 3818 /* 3819 * Request cancellation of remote forwarding of a connection from local side. 3820 */ 3821 int 3822 channel_request_rforward_cancel(struct ssh *ssh, struct Forward *fwd) 3823 { 3824 if (fwd->listen_path != NULL) { 3825 return channel_request_rforward_cancel_streamlocal(ssh, 3826 fwd->listen_path); 3827 } else { 3828 return channel_request_rforward_cancel_tcpip(ssh, 3829 fwd->listen_host, 3830 fwd->listen_port ? fwd->listen_port : fwd->allocated_port); 3831 } 3832 } 3833 3834 /* 3835 * Permits opening to any host/port if permitted_opens[] is empty. This is 3836 * usually called by the server, because the user could connect to any port 3837 * anyway, and the server has no way to know but to trust the client anyway. 3838 */ 3839 void 3840 channel_permit_all_opens(struct ssh *ssh) 3841 { 3842 if (ssh->chanctxt->num_permitted_opens == 0) 3843 ssh->chanctxt->all_opens_permitted = 1; 3844 } 3845 3846 void 3847 channel_add_permitted_opens(struct ssh *ssh, char *host, int port) 3848 { 3849 struct ssh_channels *sc = ssh->chanctxt; 3850 3851 debug("allow port forwarding to host %s port %d", host, port); 3852 fwd_perm_list_add(ssh, FWDPERM_USER, host, port, NULL, NULL, 0, NULL); 3853 sc->all_opens_permitted = 0; 3854 } 3855 3856 /* 3857 * Update the listen port for a dynamic remote forward, after 3858 * the actual 'newport' has been allocated. If 'newport' < 0 is 3859 * passed then they entry will be invalidated. 3860 */ 3861 void 3862 channel_update_permitted_opens(struct ssh *ssh, int idx, int newport) 3863 { 3864 struct ssh_channels *sc = ssh->chanctxt; 3865 3866 if (idx < 0 || (u_int)idx >= sc->num_permitted_opens) { 3867 debug("%s: index out of range: %d num_permitted_opens %d", 3868 __func__, idx, sc->num_permitted_opens); 3869 return; 3870 } 3871 debug("%s allowed port %d for forwarding to host %s port %d", 3872 newport > 0 ? "Updating" : "Removing", 3873 newport, 3874 sc->permitted_opens[idx].host_to_connect, 3875 sc->permitted_opens[idx].port_to_connect); 3876 if (newport <= 0) 3877 fwd_perm_clear(&sc->permitted_opens[idx]); 3878 else { 3879 sc->permitted_opens[idx].listen_port = 3880 (datafellows & SSH_BUG_DYNAMIC_RPORT) ? 0 : newport; 3881 } 3882 } 3883 3884 int 3885 channel_add_adm_permitted_opens(struct ssh *ssh, char *host, int port) 3886 { 3887 debug("config allows port forwarding to host %s port %d", host, port); 3888 return fwd_perm_list_add(ssh, FWDPERM_ADMIN, host, port, 3889 NULL, NULL, 0, NULL); 3890 } 3891 3892 void 3893 channel_disable_adm_local_opens(struct ssh *ssh) 3894 { 3895 channel_clear_adm_permitted_opens(ssh); 3896 fwd_perm_list_add(ssh, FWDPERM_ADMIN, NULL, 0, NULL, NULL, 0, NULL); 3897 } 3898 3899 void 3900 channel_clear_permitted_opens(struct ssh *ssh) 3901 { 3902 struct ssh_channels *sc = ssh->chanctxt; 3903 3904 sc->permitted_opens = xrecallocarray(sc->permitted_opens, 3905 sc->num_permitted_opens, 0, sizeof(*sc->permitted_opens)); 3906 sc->num_permitted_opens = 0; 3907 } 3908 3909 void 3910 channel_clear_adm_permitted_opens(struct ssh *ssh) 3911 { 3912 struct ssh_channels *sc = ssh->chanctxt; 3913 3914 sc->permitted_adm_opens = xrecallocarray(sc->permitted_adm_opens, 3915 sc->num_adm_permitted_opens, 0, sizeof(*sc->permitted_adm_opens)); 3916 sc->num_adm_permitted_opens = 0; 3917 } 3918 3919 /* returns port number, FWD_PERMIT_ANY_PORT or -1 on error */ 3920 int 3921 permitopen_port(const char *p) 3922 { 3923 int port; 3924 3925 if (strcmp(p, "*") == 0) 3926 return FWD_PERMIT_ANY_PORT; 3927 if ((port = a2port(p)) > 0) 3928 return port; 3929 return -1; 3930 } 3931 3932 /* Try to start non-blocking connect to next host in cctx list */ 3933 static int 3934 connect_next(struct channel_connect *cctx) 3935 { 3936 int sock, saved_errno; 3937 struct sockaddr_un *sunaddr; 3938 char ntop[NI_MAXHOST]; 3939 char strport[MAXIMUM(NI_MAXSERV, sizeof(sunaddr->sun_path))]; 3940 3941 for (; cctx->ai; cctx->ai = cctx->ai->ai_next) { 3942 switch (cctx->ai->ai_family) { 3943 case AF_UNIX: 3944 /* unix:pathname instead of host:port */ 3945 sunaddr = (struct sockaddr_un *)cctx->ai->ai_addr; 3946 strlcpy(ntop, "unix", sizeof(ntop)); 3947 strlcpy(strport, sunaddr->sun_path, sizeof(strport)); 3948 break; 3949 case AF_INET: 3950 case AF_INET6: 3951 if (getnameinfo(cctx->ai->ai_addr, cctx->ai->ai_addrlen, 3952 ntop, sizeof(ntop), strport, sizeof(strport), 3953 NI_NUMERICHOST|NI_NUMERICSERV) != 0) { 3954 error("connect_next: getnameinfo failed"); 3955 continue; 3956 } 3957 break; 3958 default: 3959 continue; 3960 } 3961 if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype, 3962 cctx->ai->ai_protocol)) == -1) { 3963 if (cctx->ai->ai_next == NULL) 3964 error("socket: %.100s", strerror(errno)); 3965 else 3966 verbose("socket: %.100s", strerror(errno)); 3967 continue; 3968 } 3969 if (set_nonblock(sock) == -1) 3970 fatal("%s: set_nonblock(%d)", __func__, sock); 3971 if (connect(sock, cctx->ai->ai_addr, 3972 cctx->ai->ai_addrlen) == -1 && errno != EINPROGRESS) { 3973 debug("connect_next: host %.100s ([%.100s]:%s): " 3974 "%.100s", cctx->host, ntop, strport, 3975 strerror(errno)); 3976 saved_errno = errno; 3977 close(sock); 3978 errno = saved_errno; 3979 continue; /* fail -- try next */ 3980 } 3981 if (cctx->ai->ai_family != AF_UNIX) 3982 set_nodelay(sock); 3983 debug("connect_next: host %.100s ([%.100s]:%s) " 3984 "in progress, fd=%d", cctx->host, ntop, strport, sock); 3985 cctx->ai = cctx->ai->ai_next; 3986 return sock; 3987 } 3988 return -1; 3989 } 3990 3991 static void 3992 channel_connect_ctx_free(struct channel_connect *cctx) 3993 { 3994 free(cctx->host); 3995 if (cctx->aitop) { 3996 if (cctx->aitop->ai_family == AF_UNIX) 3997 free(cctx->aitop); 3998 else 3999 freeaddrinfo(cctx->aitop); 4000 } 4001 memset(cctx, 0, sizeof(*cctx)); 4002 } 4003 4004 /* 4005 * Return connecting socket to remote host:port or local socket path, 4006 * passing back the failure reason if appropriate. 4007 */ 4008 static int 4009 connect_to_helper(struct ssh *ssh, const char *name, int port, int socktype, 4010 char *ctype, char *rname, struct channel_connect *cctx, 4011 int *reason, const char **errmsg) 4012 { 4013 struct addrinfo hints; 4014 int gaierr; 4015 int sock = -1; 4016 char strport[NI_MAXSERV]; 4017 4018 if (port == PORT_STREAMLOCAL) { 4019 struct sockaddr_un *sunaddr; 4020 struct addrinfo *ai; 4021 4022 if (strlen(name) > sizeof(sunaddr->sun_path)) { 4023 error("%.100s: %.100s", name, strerror(ENAMETOOLONG)); 4024 return -1; 4025 } 4026 4027 /* 4028 * Fake up a struct addrinfo for AF_UNIX connections. 4029 * channel_connect_ctx_free() must check ai_family 4030 * and use free() not freeaddirinfo() for AF_UNIX. 4031 */ 4032 ai = xmalloc(sizeof(*ai) + sizeof(*sunaddr)); 4033 memset(ai, 0, sizeof(*ai) + sizeof(*sunaddr)); 4034 ai->ai_addr = (struct sockaddr *)(ai + 1); 4035 ai->ai_addrlen = sizeof(*sunaddr); 4036 ai->ai_family = AF_UNIX; 4037 ai->ai_socktype = socktype; 4038 ai->ai_protocol = PF_UNSPEC; 4039 sunaddr = (struct sockaddr_un *)ai->ai_addr; 4040 sunaddr->sun_family = AF_UNIX; 4041 strlcpy(sunaddr->sun_path, name, sizeof(sunaddr->sun_path)); 4042 cctx->aitop = ai; 4043 } else { 4044 memset(&hints, 0, sizeof(hints)); 4045 hints.ai_family = ssh->chanctxt->IPv4or6; 4046 hints.ai_socktype = socktype; 4047 snprintf(strport, sizeof strport, "%d", port); 4048 if ((gaierr = getaddrinfo(name, strport, &hints, &cctx->aitop)) 4049 != 0) { 4050 if (errmsg != NULL) 4051 *errmsg = ssh_gai_strerror(gaierr); 4052 if (reason != NULL) 4053 *reason = SSH2_OPEN_CONNECT_FAILED; 4054 error("connect_to %.100s: unknown host (%s)", name, 4055 ssh_gai_strerror(gaierr)); 4056 return -1; 4057 } 4058 } 4059 4060 cctx->host = xstrdup(name); 4061 cctx->port = port; 4062 cctx->ai = cctx->aitop; 4063 4064 if ((sock = connect_next(cctx)) == -1) { 4065 error("connect to %.100s port %d failed: %s", 4066 name, port, strerror(errno)); 4067 return -1; 4068 } 4069 4070 return sock; 4071 } 4072 4073 /* Return CONNECTING channel to remote host:port or local socket path */ 4074 static Channel * 4075 connect_to(struct ssh *ssh, const char *host, int port, 4076 char *ctype, char *rname) 4077 { 4078 struct channel_connect cctx; 4079 Channel *c; 4080 int sock; 4081 4082 memset(&cctx, 0, sizeof(cctx)); 4083 sock = connect_to_helper(ssh, host, port, SOCK_STREAM, ctype, rname, 4084 &cctx, NULL, NULL); 4085 if (sock == -1) { 4086 channel_connect_ctx_free(&cctx); 4087 return NULL; 4088 } 4089 c = channel_new(ssh, ctype, SSH_CHANNEL_CONNECTING, sock, sock, -1, 4090 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, rname, 1); 4091 c->host_port = port; 4092 c->path = xstrdup(host); 4093 c->connect_ctx = cctx; 4094 4095 return c; 4096 } 4097 4098 /* 4099 * returns either the newly connected channel or the downstream channel 4100 * that needs to deal with this connection. 4101 */ 4102 Channel * 4103 channel_connect_by_listen_address(struct ssh *ssh, const char *listen_host, 4104 u_short listen_port, char *ctype, char *rname) 4105 { 4106 struct ssh_channels *sc = ssh->chanctxt; 4107 u_int i; 4108 ForwardPermission *fp; 4109 4110 for (i = 0; i < sc->num_permitted_opens; i++) { 4111 fp = &sc->permitted_opens[i]; 4112 if (open_listen_match_tcpip(fp, listen_host, listen_port, 1)) { 4113 if (fp->downstream) 4114 return fp->downstream; 4115 if (fp->port_to_connect == 0) 4116 return rdynamic_connect_prepare(ssh, 4117 ctype, rname); 4118 return connect_to(ssh, 4119 fp->host_to_connect, fp->port_to_connect, 4120 ctype, rname); 4121 } 4122 } 4123 error("WARNING: Server requests forwarding for unknown listen_port %d", 4124 listen_port); 4125 return NULL; 4126 } 4127 4128 Channel * 4129 channel_connect_by_listen_path(struct ssh *ssh, const char *path, 4130 char *ctype, char *rname) 4131 { 4132 struct ssh_channels *sc = ssh->chanctxt; 4133 u_int i; 4134 ForwardPermission *fp; 4135 4136 for (i = 0; i < sc->num_permitted_opens; i++) { 4137 fp = &sc->permitted_opens[i]; 4138 if (open_listen_match_streamlocal(fp, path)) { 4139 return connect_to(ssh, 4140 fp->host_to_connect, fp->port_to_connect, 4141 ctype, rname); 4142 } 4143 } 4144 error("WARNING: Server requests forwarding for unknown path %.100s", 4145 path); 4146 return NULL; 4147 } 4148 4149 /* Check if connecting to that port is permitted and connect. */ 4150 Channel * 4151 channel_connect_to_port(struct ssh *ssh, const char *host, u_short port, 4152 char *ctype, char *rname, int *reason, const char **errmsg) 4153 { 4154 struct ssh_channels *sc = ssh->chanctxt; 4155 struct channel_connect cctx; 4156 Channel *c; 4157 u_int i, permit, permit_adm = 1; 4158 int sock; 4159 ForwardPermission *fp; 4160 4161 permit = sc->all_opens_permitted; 4162 if (!permit) { 4163 for (i = 0; i < sc->num_permitted_opens; i++) { 4164 fp = &sc->permitted_opens[i]; 4165 if (open_match(fp, host, port)) { 4166 permit = 1; 4167 break; 4168 } 4169 } 4170 } 4171 4172 if (sc->num_adm_permitted_opens > 0) { 4173 permit_adm = 0; 4174 for (i = 0; i < sc->num_adm_permitted_opens; i++) { 4175 fp = &sc->permitted_adm_opens[i]; 4176 if (open_match(fp, host, port)) { 4177 permit_adm = 1; 4178 break; 4179 } 4180 } 4181 } 4182 4183 if (!permit || !permit_adm) { 4184 logit("Received request to connect to host %.100s port %d, " 4185 "but the request was denied.", host, port); 4186 if (reason != NULL) 4187 *reason = SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED; 4188 return NULL; 4189 } 4190 4191 memset(&cctx, 0, sizeof(cctx)); 4192 sock = connect_to_helper(ssh, host, port, SOCK_STREAM, ctype, rname, 4193 &cctx, reason, errmsg); 4194 if (sock == -1) { 4195 channel_connect_ctx_free(&cctx); 4196 return NULL; 4197 } 4198 4199 c = channel_new(ssh, ctype, SSH_CHANNEL_CONNECTING, sock, sock, -1, 4200 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, rname, 1); 4201 c->host_port = port; 4202 c->path = xstrdup(host); 4203 c->connect_ctx = cctx; 4204 4205 return c; 4206 } 4207 4208 /* Check if connecting to that path is permitted and connect. */ 4209 Channel * 4210 channel_connect_to_path(struct ssh *ssh, const char *path, 4211 char *ctype, char *rname) 4212 { 4213 struct ssh_channels *sc = ssh->chanctxt; 4214 u_int i, permit, permit_adm = 1; 4215 ForwardPermission *fp; 4216 4217 permit = sc->all_opens_permitted; 4218 if (!permit) { 4219 for (i = 0; i < sc->num_permitted_opens; i++) { 4220 fp = &sc->permitted_opens[i]; 4221 if (open_match(fp, path, PORT_STREAMLOCAL)) { 4222 permit = 1; 4223 break; 4224 } 4225 } 4226 } 4227 4228 if (sc->num_adm_permitted_opens > 0) { 4229 permit_adm = 0; 4230 for (i = 0; i < sc->num_adm_permitted_opens; i++) { 4231 fp = &sc->permitted_adm_opens[i]; 4232 if (open_match(fp, path, PORT_STREAMLOCAL)) { 4233 permit_adm = 1; 4234 break; 4235 } 4236 } 4237 } 4238 4239 if (!permit || !permit_adm) { 4240 logit("Received request to connect to path %.100s, " 4241 "but the request was denied.", path); 4242 return NULL; 4243 } 4244 return connect_to(ssh, path, PORT_STREAMLOCAL, ctype, rname); 4245 } 4246 4247 void 4248 channel_send_window_changes(struct ssh *ssh) 4249 { 4250 struct ssh_channels *sc = ssh->chanctxt; 4251 struct winsize ws; 4252 int r; 4253 u_int i; 4254 4255 for (i = 0; i < sc->channels_alloc; i++) { 4256 if (sc->channels[i] == NULL || !sc->channels[i]->client_tty || 4257 sc->channels[i]->type != SSH_CHANNEL_OPEN) 4258 continue; 4259 if (ioctl(sc->channels[i]->rfd, TIOCGWINSZ, &ws) < 0) 4260 continue; 4261 channel_request_start(ssh, i, "window-change", 0); 4262 if ((r = sshpkt_put_u32(ssh, (u_int)ws.ws_col)) != 0 || 4263 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_row)) != 0 || 4264 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_xpixel)) != 0 || 4265 (r = sshpkt_put_u32(ssh, (u_int)ws.ws_ypixel)) != 0 || 4266 (r = sshpkt_send(ssh)) != 0) 4267 fatal("%s: channel %u: send window-change: %s", 4268 __func__, i, ssh_err(r)); 4269 } 4270 } 4271 4272 /* Return RDYNAMIC_OPEN channel: channel allows SOCKS, but is not connected */ 4273 static Channel * 4274 rdynamic_connect_prepare(struct ssh *ssh, char *ctype, char *rname) 4275 { 4276 Channel *c; 4277 int r; 4278 4279 c = channel_new(ssh, ctype, SSH_CHANNEL_RDYNAMIC_OPEN, -1, -1, -1, 4280 CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, rname, 1); 4281 c->host_port = 0; 4282 c->path = NULL; 4283 4284 /* 4285 * We need to open the channel before we have a FD, 4286 * so that we can get SOCKS header from peer. 4287 */ 4288 if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION)) != 0 || 4289 (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 || 4290 (r = sshpkt_put_u32(ssh, c->self)) != 0 || 4291 (r = sshpkt_put_u32(ssh, c->local_window)) != 0 || 4292 (r = sshpkt_put_u32(ssh, c->local_maxpacket)) != 0) { 4293 fatal("%s: channel %i: confirm: %s", __func__, 4294 c->self, ssh_err(r)); 4295 } 4296 return c; 4297 } 4298 4299 /* Return CONNECTING socket to remote host:port or local socket path */ 4300 static int 4301 rdynamic_connect_finish(struct ssh *ssh, Channel *c) 4302 { 4303 struct channel_connect cctx; 4304 int sock; 4305 4306 memset(&cctx, 0, sizeof(cctx)); 4307 sock = connect_to_helper(ssh, c->path, c->host_port, SOCK_STREAM, NULL, 4308 NULL, &cctx, NULL, NULL); 4309 if (sock == -1) 4310 channel_connect_ctx_free(&cctx); 4311 else { 4312 /* similar to SSH_CHANNEL_CONNECTING but we've already sent the open */ 4313 c->type = SSH_CHANNEL_RDYNAMIC_FINISH; 4314 c->connect_ctx = cctx; 4315 channel_register_fds(ssh, c, sock, sock, -1, 0, 1, 0); 4316 } 4317 return sock; 4318 } 4319 4320 /* -- X11 forwarding */ 4321 4322 /* 4323 * Creates an internet domain socket for listening for X11 connections. 4324 * Returns 0 and a suitable display number for the DISPLAY variable 4325 * stored in display_numberp , or -1 if an error occurs. 4326 */ 4327 int 4328 x11_create_display_inet(struct ssh *ssh, int x11_display_offset, 4329 int x11_use_localhost, int single_connection, 4330 u_int *display_numberp, int **chanids) 4331 { 4332 Channel *nc = NULL; 4333 int display_number, sock; 4334 u_short port; 4335 struct addrinfo hints, *ai, *aitop; 4336 char strport[NI_MAXSERV]; 4337 int gaierr, n, num_socks = 0, socks[NUM_SOCKS]; 4338 4339 if (chanids == NULL) 4340 return -1; 4341 4342 for (display_number = x11_display_offset; 4343 display_number < MAX_DISPLAYS; 4344 display_number++) { 4345 port = 6000 + display_number; 4346 memset(&hints, 0, sizeof(hints)); 4347 hints.ai_family = ssh->chanctxt->IPv4or6; 4348 hints.ai_flags = x11_use_localhost ? 0: AI_PASSIVE; 4349 hints.ai_socktype = SOCK_STREAM; 4350 snprintf(strport, sizeof strport, "%d", port); 4351 if ((gaierr = getaddrinfo(NULL, strport, 4352 &hints, &aitop)) != 0) { 4353 error("getaddrinfo: %.100s", ssh_gai_strerror(gaierr)); 4354 return -1; 4355 } 4356 for (ai = aitop; ai; ai = ai->ai_next) { 4357 if (ai->ai_family != AF_INET && 4358 ai->ai_family != AF_INET6) 4359 continue; 4360 sock = socket(ai->ai_family, ai->ai_socktype, 4361 ai->ai_protocol); 4362 if (sock < 0) { 4363 error("socket: %.100s", strerror(errno)); 4364 freeaddrinfo(aitop); 4365 return -1; 4366 } 4367 set_reuseaddr(sock); 4368 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 4369 debug2("%s: bind port %d: %.100s", __func__, 4370 port, strerror(errno)); 4371 close(sock); 4372 for (n = 0; n < num_socks; n++) 4373 close(socks[n]); 4374 num_socks = 0; 4375 break; 4376 } 4377 socks[num_socks++] = sock; 4378 if (num_socks == NUM_SOCKS) 4379 break; 4380 } 4381 freeaddrinfo(aitop); 4382 if (num_socks > 0) 4383 break; 4384 } 4385 if (display_number >= MAX_DISPLAYS) { 4386 error("Failed to allocate internet-domain X11 display socket."); 4387 return -1; 4388 } 4389 /* Start listening for connections on the socket. */ 4390 for (n = 0; n < num_socks; n++) { 4391 sock = socks[n]; 4392 if (listen(sock, SSH_LISTEN_BACKLOG) < 0) { 4393 error("listen: %.100s", strerror(errno)); 4394 close(sock); 4395 return -1; 4396 } 4397 } 4398 4399 /* Allocate a channel for each socket. */ 4400 *chanids = xcalloc(num_socks + 1, sizeof(**chanids)); 4401 for (n = 0; n < num_socks; n++) { 4402 sock = socks[n]; 4403 nc = channel_new(ssh, "x11 listener", 4404 SSH_CHANNEL_X11_LISTENER, sock, sock, -1, 4405 CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 4406 0, "X11 inet listener", 1); 4407 nc->single_connection = single_connection; 4408 (*chanids)[n] = nc->self; 4409 } 4410 (*chanids)[n] = -1; 4411 4412 /* Return the display number for the DISPLAY environment variable. */ 4413 *display_numberp = display_number; 4414 return 0; 4415 } 4416 4417 static int 4418 connect_local_xsocket(u_int dnr) 4419 { 4420 int sock; 4421 struct sockaddr_un addr; 4422 4423 sock = socket(AF_UNIX, SOCK_STREAM, 0); 4424 if (sock < 0) 4425 error("socket: %.100s", strerror(errno)); 4426 memset(&addr, 0, sizeof(addr)); 4427 addr.sun_family = AF_UNIX; 4428 snprintf(addr.sun_path, sizeof addr.sun_path, _PATH_UNIX_X, dnr); 4429 if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == 0) 4430 return sock; 4431 close(sock); 4432 error("connect %.100s: %.100s", addr.sun_path, strerror(errno)); 4433 return -1; 4434 } 4435 4436 int 4437 x11_connect_display(struct ssh *ssh) 4438 { 4439 u_int display_number; 4440 const char *display; 4441 char buf[1024], *cp; 4442 struct addrinfo hints, *ai, *aitop; 4443 char strport[NI_MAXSERV]; 4444 int gaierr, sock = 0; 4445 4446 /* Try to open a socket for the local X server. */ 4447 display = getenv("DISPLAY"); 4448 if (!display) { 4449 error("DISPLAY not set."); 4450 return -1; 4451 } 4452 /* 4453 * Now we decode the value of the DISPLAY variable and make a 4454 * connection to the real X server. 4455 */ 4456 4457 /* 4458 * Check if it is a unix domain socket. Unix domain displays are in 4459 * one of the following formats: unix:d[.s], :d[.s], ::d[.s] 4460 */ 4461 if (strncmp(display, "unix:", 5) == 0 || 4462 display[0] == ':') { 4463 /* Connect to the unix domain socket. */ 4464 if (sscanf(strrchr(display, ':') + 1, "%u", 4465 &display_number) != 1) { 4466 error("Could not parse display number from DISPLAY: " 4467 "%.100s", display); 4468 return -1; 4469 } 4470 /* Create a socket. */ 4471 sock = connect_local_xsocket(display_number); 4472 if (sock < 0) 4473 return -1; 4474 4475 /* OK, we now have a connection to the display. */ 4476 return sock; 4477 } 4478 /* 4479 * Connect to an inet socket. The DISPLAY value is supposedly 4480 * hostname:d[.s], where hostname may also be numeric IP address. 4481 */ 4482 strlcpy(buf, display, sizeof(buf)); 4483 cp = strchr(buf, ':'); 4484 if (!cp) { 4485 error("Could not find ':' in DISPLAY: %.100s", display); 4486 return -1; 4487 } 4488 *cp = 0; 4489 /* 4490 * buf now contains the host name. But first we parse the 4491 * display number. 4492 */ 4493 if (sscanf(cp + 1, "%u", &display_number) != 1) { 4494 error("Could not parse display number from DISPLAY: %.100s", 4495 display); 4496 return -1; 4497 } 4498 4499 /* Look up the host address */ 4500 memset(&hints, 0, sizeof(hints)); 4501 hints.ai_family = ssh->chanctxt->IPv4or6; 4502 hints.ai_socktype = SOCK_STREAM; 4503 snprintf(strport, sizeof strport, "%u", 6000 + display_number); 4504 if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) { 4505 error("%.100s: unknown host. (%s)", buf, 4506 ssh_gai_strerror(gaierr)); 4507 return -1; 4508 } 4509 for (ai = aitop; ai; ai = ai->ai_next) { 4510 /* Create a socket. */ 4511 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); 4512 if (sock < 0) { 4513 debug2("socket: %.100s", strerror(errno)); 4514 continue; 4515 } 4516 /* Connect it to the display. */ 4517 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) { 4518 debug2("connect %.100s port %u: %.100s", buf, 4519 6000 + display_number, strerror(errno)); 4520 close(sock); 4521 continue; 4522 } 4523 /* Success */ 4524 break; 4525 } 4526 freeaddrinfo(aitop); 4527 if (!ai) { 4528 error("connect %.100s port %u: %.100s", buf, 4529 6000 + display_number, strerror(errno)); 4530 return -1; 4531 } 4532 set_nodelay(sock); 4533 return sock; 4534 } 4535 4536 /* 4537 * Requests forwarding of X11 connections, generates fake authentication 4538 * data, and enables authentication spoofing. 4539 * This should be called in the client only. 4540 */ 4541 void 4542 x11_request_forwarding_with_spoofing(struct ssh *ssh, int client_session_id, 4543 const char *disp, const char *proto, const char *data, int want_reply) 4544 { 4545 struct ssh_channels *sc = ssh->chanctxt; 4546 u_int data_len = (u_int) strlen(data) / 2; 4547 u_int i, value; 4548 const char *cp; 4549 char *new_data; 4550 int r, screen_number; 4551 4552 if (sc->x11_saved_display == NULL) 4553 sc->x11_saved_display = xstrdup(disp); 4554 else if (strcmp(disp, sc->x11_saved_display) != 0) { 4555 error("x11_request_forwarding_with_spoofing: different " 4556 "$DISPLAY already forwarded"); 4557 return; 4558 } 4559 4560 cp = strchr(disp, ':'); 4561 if (cp) 4562 cp = strchr(cp, '.'); 4563 if (cp) 4564 screen_number = (u_int)strtonum(cp + 1, 0, 400, NULL); 4565 else 4566 screen_number = 0; 4567 4568 if (sc->x11_saved_proto == NULL) { 4569 /* Save protocol name. */ 4570 sc->x11_saved_proto = xstrdup(proto); 4571 4572 /* Extract real authentication data. */ 4573 sc->x11_saved_data = xmalloc(data_len); 4574 for (i = 0; i < data_len; i++) { 4575 if (sscanf(data + 2 * i, "%2x", &value) != 1) 4576 fatal("x11_request_forwarding: bad " 4577 "authentication data: %.100s", data); 4578 sc->x11_saved_data[i] = value; 4579 } 4580 sc->x11_saved_data_len = data_len; 4581 4582 /* Generate fake data of the same length. */ 4583 sc->x11_fake_data = xmalloc(data_len); 4584 arc4random_buf(sc->x11_fake_data, data_len); 4585 sc->x11_fake_data_len = data_len; 4586 } 4587 4588 /* Convert the fake data into hex. */ 4589 new_data = tohex(sc->x11_fake_data, data_len); 4590 4591 /* Send the request packet. */ 4592 channel_request_start(ssh, client_session_id, "x11-req", want_reply); 4593 if ((r = sshpkt_put_u8(ssh, 0)) != 0 || /* bool: single connection */ 4594 (r = sshpkt_put_cstring(ssh, proto)) != 0 || 4595 (r = sshpkt_put_cstring(ssh, new_data)) != 0 || 4596 (r = sshpkt_put_u32(ssh, screen_number)) != 0 || 4597 (r = sshpkt_send(ssh)) != 0 || 4598 (r = ssh_packet_write_wait(ssh)) != 0) 4599 fatal("%s: send x11-req: %s", __func__, ssh_err(r)); 4600 free(new_data); 4601 } 4602