Import of OpenSSH 2.3.0 (virgin OpenBSD source release).

1 files changed, 69 insertions, 42 deletions

diff --git a/crypto/openssh/channels.c b/crypto/openssh/channels.c
index e9a64d9..81bd715 100644
--- a/crypto/openssh/channels.c
+++ b/crypto/openssh/channels.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.68 2000/09/07 20:40:29 markus Exp $");
+RCSID("$OpenBSD: channels.c,v 1.72 2000/10/27 07:48:22 markus Exp $");
 
 #include "ssh.h"
 #include "packet.h"
@@ -174,7 +174,8 @@ channel_lookup(int id)
  */
 
 void
-channel_register_fds(Channel *c, int rfd, int wfd, int efd, int extusage)
+channel_register_fds(Channel *c, int rfd, int wfd, int efd,
+    int extusage, int nonblock)
 {
 	/* Update the maximum file descriptor value. */
 	if (rfd > channel_max_fd_value)
@@ -190,12 +191,16 @@ channel_register_fds(Channel *c, int rfd, int wfd, int efd, int extusage)
 	c->sock = (rfd == wfd) ? rfd : -1;
 	c->efd = efd;
 	c->extended_usage = extusage;
-	if (rfd != -1)
-		set_nonblock(rfd);
-	if (wfd != -1)
-		set_nonblock(wfd);
-	if (efd != -1)
-		set_nonblock(efd);
+
+	/* enable nonblocking mode */
+	if (nonblock) {
+		if (rfd != -1)
+			set_nonblock(rfd);
+		if (wfd != -1)
+			set_nonblock(wfd);
+		if (efd != -1)
+			set_nonblock(efd);
+	}
 }
 
 /*
@@ -205,7 +210,7 @@ channel_register_fds(Channel *c, int rfd, int wfd, int efd, int extusage)
 
 int
 channel_new(char *ctype, int type, int rfd, int wfd, int efd,
-    int window, int maxpack, int extusage, char *remote_name)
+    int window, int maxpack, int extusage, char *remote_name, int nonblock)
 {
 	int i, found;
 	Channel *c;
@@ -234,7 +239,7 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 		/* There are no free slots.  Take last+1 slot and expand the array.  */
 		found = channels_alloc;
 		channels_alloc += 10;
-		debug("channel: expanding %d", channels_alloc);
+		debug2("channel: expanding %d", channels_alloc);
 		channels = xrealloc(channels, channels_alloc * sizeof(Channel));
 		for (i = found; i < channels_alloc; i++)
 			channels[i].type = SSH_CHANNEL_FREE;
@@ -245,7 +250,7 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 	buffer_init(&c->output);
 	buffer_init(&c->extended);
 	chan_init_iostates(c);
-	channel_register_fds(c, rfd, wfd, efd, extusage);
+	channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
 	c->self = found;
 	c->type = type;
 	c->ctype = ctype;
@@ -269,7 +274,7 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 int
 channel_allocate(int type, int sock, char *remote_name)
 {
-	return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name);
+	return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1);
 }
 
 
@@ -548,7 +553,7 @@ channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
 		newch = channel_new("x11",
 		    SSH_CHANNEL_OPENING, newsock, newsock, -1,
 		    c->local_window_max, c->local_maxpacket,
-		    0, xstrdup(buf));
+		    0, xstrdup(buf), 1);
 		if (compat20) {
 			packet_start(SSH2_MSG_CHANNEL_OPEN);
 			packet_put_cstring("x11");
@@ -606,7 +611,7 @@ channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
 		newch = channel_new("direct-tcpip",
 		    SSH_CHANNEL_OPENING, newsock, newsock, -1,
 		    c->local_window_max, c->local_maxpacket,
-		    0, xstrdup(buf));
+		    0, xstrdup(buf), 1);
 		if (compat20) {
 			packet_start(SSH2_MSG_CHANNEL_OPEN);
 			packet_put_cstring("direct-tcpip");
@@ -737,7 +742,7 @@ channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
 		    buffer_len(&c->extended) > 0) {
 			len = write(c->efd, buffer_ptr(&c->extended),
 			    buffer_len(&c->extended));
-			debug("channel %d: written %d to efd %d",
+			debug2("channel %d: written %d to efd %d",
 			    c->self, len, c->efd);
 			if (len > 0) {
 				buffer_consume(&c->extended, len);
@@ -746,7 +751,7 @@ channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
 		} else if (c->extended_usage == CHAN_EXTENDED_READ &&
 		    FD_ISSET(c->efd, readset)) {
 			len = read(c->efd, buf, sizeof(buf));
-			debug("channel %d: read %d from efd %d",
+			debug2("channel %d: read %d from efd %d",
 			     c->self, len, c->efd);
 			if (len == 0) {
 				debug("channel %d: closing efd %d",
@@ -769,7 +774,7 @@ channel_check_window(Channel *c, fd_set * readset, fd_set * writeset)
 		packet_put_int(c->remote_id);
 		packet_put_int(c->local_consumed);
 		packet_send();
-		debug("channel %d: window %d sent adjust %d",
+		debug2("channel %d: window %d sent adjust %d",
 		    c->self, c->local_window,
 		    c->local_consumed);
 		c->local_window += c->local_consumed;
@@ -998,7 +1003,7 @@ channel_output_poll()
  */
 
 void
-channel_input_data(int type, int plen)
+channel_input_data(int type, int plen, void *ctxt)
 {
 	int id;
 	char *data;
@@ -1043,7 +1048,7 @@ channel_input_data(int type, int plen)
 	xfree(data);
 }
 void
-channel_input_extended_data(int type, int plen)
+channel_input_extended_data(int type, int plen, void *ctxt)
 {
 	int id;
 	int tcode;
@@ -1076,7 +1081,7 @@ channel_input_extended_data(int type, int plen)
 		xfree(data);
 		return;
 	}
-	debug("channel %d: rcvd ext data %d", c->self, data_len);
+	debug2("channel %d: rcvd ext data %d", c->self, data_len);
 	c->local_window -= data_len;
 	buffer_append(&c->extended, data, data_len);
 	xfree(data);
@@ -1113,7 +1118,7 @@ channel_not_very_much_buffered_data()
 }
 
 void
-channel_input_ieof(int type, int plen)
+channel_input_ieof(int type, int plen, void *ctxt)
 {
 	int id;
 	Channel *c;
@@ -1128,7 +1133,7 @@ channel_input_ieof(int type, int plen)
 }
 
 void
-channel_input_close(int type, int plen)
+channel_input_close(int type, int plen, void *ctxt)
 {
 	int id;
 	Channel *c;
@@ -1167,7 +1172,7 @@ channel_input_close(int type, int plen)
 
 /* proto version 1.5 overloads CLOSE_CONFIRMATION with OCLOSE */
 void
-channel_input_oclose(int type, int plen)
+channel_input_oclose(int type, int plen, void *ctxt)
 {
 	int id = packet_get_int();
 	Channel *c = channel_lookup(id);
@@ -1178,7 +1183,7 @@ channel_input_oclose(int type, int plen)
 }
 
 void
-channel_input_close_confirmation(int type, int plen)
+channel_input_close_confirmation(int type, int plen, void *ctxt)
 {
 	int id = packet_get_int();
 	Channel *c = channel_lookup(id);
@@ -1194,7 +1199,7 @@ channel_input_close_confirmation(int type, int plen)
 }
 
 void
-channel_input_open_confirmation(int type, int plen)
+channel_input_open_confirmation(int type, int plen, void *ctxt)
 {
 	int id, remote_id;
 	Channel *c;
@@ -1218,9 +1223,9 @@ channel_input_open_confirmation(int type, int plen)
 		c->remote_maxpacket = packet_get_int();
 		packet_done();
 		if (c->cb_fn != NULL && c->cb_event == type) {
-			debug("callback start");
+			debug2("callback start");
 			c->cb_fn(c->self, c->cb_arg);
-			debug("callback done");
+			debug2("callback done");
 		}
 		debug("channel %d: open confirm rwindow %d rmax %d", c->self,
 		    c->remote_window, c->remote_maxpacket);
@@ -1228,7 +1233,7 @@ channel_input_open_confirmation(int type, int plen)
 }
 
 void
-channel_input_open_failure(int type, int plen)
+channel_input_open_failure(int type, int plen, void *ctxt)
 {
 	int id;
 	Channel *c;
@@ -1256,7 +1261,7 @@ channel_input_open_failure(int type, int plen)
 }
 
 void
-channel_input_channel_request(int type, int plen)
+channel_input_channel_request(int type, int plen, void *ctxt)
 {
 	int id;
 	Channel *c;
@@ -1269,19 +1274,19 @@ channel_input_channel_request(int type, int plen)
 		packet_disconnect("Received request for "
 		    "non-open channel %d.", id);
 	if (c->cb_fn != NULL && c->cb_event == type) {
-		debug("callback start");
+		debug2("callback start");
 		c->cb_fn(c->self, c->cb_arg);
-		debug("callback done");
+		debug2("callback done");
 	} else {
 		char *service = packet_get_string(NULL);
 		debug("channel: %d rcvd request for %s", c->self, service);
-debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
+		debug("cb_fn %p cb_event %d", c->cb_fn , c->cb_event);
 		xfree(service);
 	}
 }
 
 void
-channel_input_window_adjust(int type, int plen)
+channel_input_window_adjust(int type, int plen, void *ctxt)
 {
 	Channel *c;
 	int id, adjust;
@@ -1300,7 +1305,7 @@ channel_input_window_adjust(int type, int plen)
 	}
 	adjust = packet_get_int();
 	packet_done();
-	debug("channel %d: rcvd adjust %d", id, adjust);
+	debug2("channel %d: rcvd adjust %d", id, adjust);
 	c->remote_window += adjust;
 }
 
@@ -1510,7 +1515,7 @@ channel_request_local_forwarding(u_short port, const char *host,
 		    "port listener", SSH_CHANNEL_PORT_LISTENER,
 		    sock, sock, -1,
 		    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
-		    0, xstrdup("port listener"));
+		    0, xstrdup("port listener"), 1);
 		strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
 		channels[ch].host_port = host_port;
 		channels[ch].listening_port = port;
@@ -1652,7 +1657,7 @@ channel_connect_to(const char *host, u_short host_port)
  */
 
 void
-channel_input_port_open(int type, int plen)
+channel_input_port_open(int type, int plen, void *ctxt)
 {
 	u_short host_port;
 	char *host, *originator_string;
@@ -1800,7 +1805,7 @@ x11_create_display_inet(int screen_number, int x11_display_offset)
 		(void) channel_new("x11 listener",
 		    SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
 		    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
-		    0, xstrdup("X11 inet listener"));
+		    0, xstrdup("X11 inet listener"), 1);
 	}
 
 	/* Return a suitable value for the DISPLAY environment variable. */
@@ -1942,7 +1947,7 @@ x11_connect_display(void)
  */
 
 void
-x11_input_open(int type, int plen)
+x11_input_open(int type, int plen, void *ctxt)
 {
 	int remote_channel, sock = 0, newch;
 	char *remote_host;
@@ -1986,6 +1991,28 @@ x11_input_open(int type, int plen)
 	}
 }
 
+/* dummy protocol handler that denies SSH-1 requests (agent/x11) */
+void
+deny_input_open(int type, int plen, void *ctxt)
+{
+	int rchan = packet_get_int();
+	switch(type){
+	case SSH_SMSG_AGENT_OPEN:
+		error("Warning: ssh server tried agent forwarding.");
+		break;
+	case SSH_SMSG_X11_OPEN:
+		error("Warning: ssh server tried X11 forwarding.");
+		break;
+	default:
+		error("deny_input_open: type %d plen %d", type, plen);
+		break;
+	}
+	error("Warning: this is probably a break in attempt by a malicious server.");
+	packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
+	packet_put_int(rchan);
+	packet_send();
+}
+
 /*
  * Requests forwarding of X11 connections, generates fake authentication
  * data, and enables authentication spoofing.
@@ -2157,7 +2184,7 @@ auth_input_request_forwarding(struct passwd * pw)
 /* This is called to process an SSH_SMSG_AGENT_OPEN message. */
 
 void
-auth_input_open_request(int type, int plen)
+auth_input_open_request(int type, int plen, void *ctxt)
 {
 	int remch, sock, newch;
 	char *dummyname;
@@ -2290,13 +2317,13 @@ channel_register_filter(int id, channel_filter_fn *fn)
 }
 
 void
-channel_set_fds(int id, int rfd, int wfd, int efd, int extusage)
+channel_set_fds(int id, int rfd, int wfd, int efd,
+    int extusage, int nonblock)
 {
 	Channel *c = channel_lookup(id);
 	if (c == NULL || c->type != SSH_CHANNEL_LARVAL)
 		fatal("channel_activate for non-larval channel %d.", id);
-
-	channel_register_fds(c, rfd, wfd, efd, extusage);
+	channel_register_fds(c, rfd, wfd, efd, extusage, nonblock);
 	c->type = SSH_CHANNEL_OPEN;
 	/* XXX window size? */
 	c->local_window = c->local_window_max = c->local_maxpacket * 2;