1 files changed, 76 insertions, 57 deletions

diff --git a/channels.c b/channels.c
index 1be213bce..8c7b2b369 100644
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.212 2005/03/01 10:09:52 djm Exp $");
+RCSID("$OpenBSD: channels.c,v 1.223 2005/07/17 07:17:54 djm Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -58,6 +58,8 @@ RCSID("$OpenBSD: channels.c,v 1.212 2005/03/01 10:09:52 djm Exp $");
 
 /* -- channel core */
 
+#define CHAN_RBUF       16*1024
+
 /*
  * Pointer to an array containing all allocated channels.  The array is
  * dynamically extended as needed.
@@ -109,6 +111,9 @@ static int all_opens_permitted = 0;
 /* Maximum number of fake X11 displays to try. */
 #define MAX_DISPLAYS  1000
 
+/* Saved X11 local (client) display. */
+static char *x11_saved_display = NULL;
+
 /* Saved X11 authentication protocol name. */
 static char *x11_saved_proto = NULL;
 
@@ -712,6 +717,9 @@ channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset)
 {
         u_int limit = compat20 ? c->remote_window : packet_get_maxsize();
 
+        /* check buffer limits */
+        limit = MIN(limit, (BUFFER_MAX_LEN - BUFFER_MAX_CHUNK - CHAN_RBUF));
+
         if (c->istate == CHAN_INPUT_OPEN &&
             limit > 0 &&
             buffer_len(&c->input) < limit)
@@ -722,8 +730,8 @@ channel_pre_open(Channel *c, fd_set * readset, fd_set * writeset)
                         FD_SET(c->wfd, writeset);
                 } else if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN) {
                         if (CHANNEL_EFD_OUTPUT_ACTIVE(c))
-                               debug2("channel %d: obuf_empty delayed efd %d/(%d)",
-                                   c->self, c->efd, buffer_len(&c->extended));
+                                debug2("channel %d: obuf_empty delayed efd %d/(%d)",
+                                    c->self, c->efd, buffer_len(&c->extended));
                         else
                                 chan_obuf_empty(c);
                 }
@@ -889,7 +897,7 @@ static int
 channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset)
 {
         char *p, *host;
-        int len, have, i, found;
+        u_int len, have, i, found;
         char username[256];
         struct {
                 u_int8_t version;
@@ -974,7 +982,7 @@ channel_decode_socks5(Channel *c, fd_set * readset, fd_set * writeset)
         } s5_req, s5_rsp;
         u_int16_t dest_port;
         u_char *p, dest_addr[255+1];
-        int i, have, found, nmethods, addrlen, af;
+        u_int have, i, found, nmethods, addrlen, af;
 
         debug2("channel %d: decode socks5", c->self);
         p = buffer_ptr(&c->input);
@@ -1018,7 +1026,7 @@ channel_decode_socks5(Channel *c, fd_set * readset, fd_set * writeset)
                 debug2("channel %d: only socks5 connect supported", c->self);
                 return -1;
         }
-        switch(s5_req.atyp){
+        switch (s5_req.atyp){
         case SSH_SOCKS5_IPV4:
                 addrlen = 4;
                 af = AF_INET;
@@ -1070,7 +1078,8 @@ static void
 channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset)
 {
         u_char *p;
-        int have, ret;
+        u_int have;
+        int ret;
 
         have = buffer_len(&c->input);
         c->delayed = 0;
@@ -1173,7 +1182,7 @@ port_open_helper(Channel *c, char *rtype)
         int direct;
         char buf[1024];
         char *remote_ipaddr = get_peer_ipaddr(c->sock);
-        u_short remote_port = get_peer_port(c->sock);
+        int remote_port = get_peer_port(c->sock);
 
         direct = (strcmp(rtype, "direct-tcpip") == 0);
 
@@ -1203,7 +1212,7 @@ port_open_helper(Channel *c, char *rtype)
                 }
                 /* originator host and port */
                 packet_put_cstring(remote_ipaddr);
-                packet_put_int(remote_port);
+                packet_put_int((u_int)remote_port);
                 packet_send();
         } else {
                 packet_start(SSH_MSG_PORT_OPEN);
@@ -1360,7 +1369,7 @@ channel_post_connecting(Channel *c, fd_set * readset, fd_set * writeset)
 static int
 channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
 {
-        char buf[16*1024];
+        char buf[CHAN_RBUF];
         int len;
 
         if (c->rfd != -1 &&
@@ -1454,7 +1463,7 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
 static int
 channel_handle_efd(Channel *c, fd_set * readset, fd_set * writeset)
 {
-        char buf[16*1024];
+        char buf[CHAN_RBUF];
         int len;
 
 /** XXX handle drain efd, too */
@@ -1804,8 +1813,8 @@ channel_output_poll(void)
                          * hack for extended data: delay EOF if EFD still in use.
                          */
                         if (CHANNEL_EFD_INPUT_ACTIVE(c))
-                               debug2("channel %d: ibuf_empty delayed efd %d/(%d)",
-                                   c->self, c->efd, buffer_len(&c->extended));
+                                debug2("channel %d: ibuf_empty delayed efd %d/(%d)",
+                                    c->self, c->efd, buffer_len(&c->extended));
                         else
                                 chan_ibuf_empty(c);
                 }
@@ -2190,20 +2199,20 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por
 
         if (host == NULL) {
                 error("No forward host name.");
-                return success;
+                return 0;
         }
         if (strlen(host) > SSH_CHANNEL_PATH_LEN - 1) {
                 error("Forward host name too long.");
-                return success;
+                return 0;
         }
 
         /*
          * Determine whether or not a port forward listens to loopback,
-         * specified address or wildcard. On the client, a specified bind 
-         * address will always override gateway_ports. On the server, a 
-         * gateway_ports of 1 (``yes'') will override the client's 
-         * specification and force a wildcard bind, whereas a value of 2 
-         * (``clientspecified'') will bind to whatever address the client 
+         * specified address or wildcard. On the client, a specified bind
+         * address will always override gateway_ports. On the server, a
+         * gateway_ports of 1 (``yes'') will override the client's
+         * specification and force a wildcard bind, whereas a value of 2
+         * (``clientspecified'') will bind to whatever address the client
          * asked for.
          *
          * Special-case listen_addrs are:
@@ -2245,12 +2254,10 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por
                         packet_disconnect("getaddrinfo: fatal error: %s",
                             gai_strerror(r));
                 } else {
-                        verbose("channel_setup_fwd_listener: "
-                            "getaddrinfo(%.64s): %s", addr, gai_strerror(r));
-                        packet_send_debug("channel_setup_fwd_listener: "
+                        error("channel_setup_fwd_listener: "
                             "getaddrinfo(%.64s): %s", addr, gai_strerror(r));
                 }
-                aitop = NULL;
+                return 0;
         }
 
         for (ai = aitop; ai; ai = ai->ai_next) {
@@ -2317,7 +2324,7 @@ channel_cancel_rport_listener(const char *host, u_short port)
         u_int i;
         int found = 0;
 
-        for(i = 0; i < channels_alloc; i++) {
+        for (i = 0; i < channels_alloc; i++) {
                 Channel *c = channels[i];
 
                 if (c != NULL && c->type == SSH_CHANNEL_RPORT_LISTENER &&
@@ -2629,7 +2636,7 @@ channel_send_window_changes(void)
         struct winsize ws;
 
         for (i = 0; i < channels_alloc; i++) {
-                if (channels[i] == NULL || !channels[i]->client_tty || 
+                if (channels[i] == NULL || !channels[i]->client_tty ||
                     channels[i]->type != SSH_CHANNEL_OPEN)
                         continue;
                 if (ioctl(channels[i]->rfd, TIOCGWINSZ, &ws) < 0)
@@ -2652,7 +2659,7 @@ channel_send_window_changes(void)
  */
 int
 x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
-    int single_connection, u_int *display_numberp)
+    int single_connection, u_int *display_numberp, int **chanids)
 {
         Channel *nc = NULL;
         int display_number, sock;
@@ -2742,6 +2749,8 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
         }
 
         /* Allocate a channel for each socket. */
+        if (chanids != NULL)
+                *chanids = xmalloc(sizeof(**chanids) * (num_socks + 1));
         for (n = 0; n < num_socks; n++) {
                 sock = socks[n];
                 nc = channel_new("x11 listener",
@@ -2749,7 +2758,11 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
                     CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
                     0, "X11 inet listener", 1);
                 nc->single_connection = single_connection;
+                if (*chanids != NULL)
+                        (*chanids)[n] = nc->self;
         }
+        if (*chanids != NULL)
+                (*chanids)[n] = -1;
 
         /* Return the display number for the DISPLAY environment variable. */
         *display_numberp = display_number;
@@ -2947,19 +2960,27 @@ deny_input_open(int type, u_int32_t seq, void *ctxt)
  * This should be called in the client only.
  */
 void
-x11_request_forwarding_with_spoofing(int client_session_id,
+x11_request_forwarding_with_spoofing(int client_session_id, const char *disp,
     const char *proto, const char *data)
 {
         u_int data_len = (u_int) strlen(data) / 2;
-        u_int i, value, len;
+        u_int i, value;
         char *new_data;
         int screen_number;
         const char *cp;
         u_int32_t rnd = 0;
 
-        cp = getenv("DISPLAY");
-        if (cp)
-                cp = strchr(cp, ':');
+        if (x11_saved_display == NULL)
+                x11_saved_display = xstrdup(disp);
+        else if (strcmp(disp, x11_saved_display) != 0) {
+                error("x11_request_forwarding_with_spoofing: different "
+                    "$DISPLAY already forwarded");
+                return;
+        }
+
+        cp = disp;
+        if (disp)
+                cp = strchr(disp, ':');
         if (cp)
                 cp = strchr(cp, '.');
         if (cp)
@@ -2967,33 +2988,31 @@ x11_request_forwarding_with_spoofing(int client_session_id,
         else
                 screen_number = 0;
 
-        /* Save protocol name. */
-        x11_saved_proto = xstrdup(proto);
-
-        /*
-         * Extract real authentication data and generate fake data of the
-         * same length.
-         */
-        x11_saved_data = xmalloc(data_len);
-        x11_fake_data = xmalloc(data_len);
-        for (i = 0; i < data_len; i++) {
-                if (sscanf(data + 2 * i, "%2x", &value) != 1)
-                        fatal("x11_request_forwarding: bad authentication data: %.100s", data);
-                if (i % 4 == 0)
-                        rnd = arc4random();
-                x11_saved_data[i] = value;
-                x11_fake_data[i] = rnd & 0xff;
-                rnd >>= 8;
-        }
-        x11_saved_data_len = data_len;
-        x11_fake_data_len = data_len;
+        if (x11_saved_proto == NULL) {
+                /* Save protocol name. */
+                x11_saved_proto = xstrdup(proto);
+                /*
+                 * Extract real authentication data and generate fake data
+                 * of the same length.
+                 */
+                x11_saved_data = xmalloc(data_len);
+                x11_fake_data = xmalloc(data_len);
+                for (i = 0; i < data_len; i++) {
+                        if (sscanf(data + 2 * i, "%2x", &value) != 1)
+                                fatal("x11_request_forwarding: bad "
+                                    "authentication data: %.100s", data);
+                        if (i % 4 == 0)
+                                rnd = arc4random();
+                        x11_saved_data[i] = value;
+                        x11_fake_data[i] = rnd & 0xff;
+                        rnd >>= 8;
+                }
+                x11_saved_data_len = data_len;
+                x11_fake_data_len = data_len;
+        }
 
         /* Convert the fake data into hex. */
-        len = 2 * data_len + 1;
-        new_data = xmalloc(len);
-        for (i = 0; i < data_len; i++)
-                snprintf(new_data + 2 * i, len - 2 * i,
-                    "%02x", (u_char) x11_fake_data[i]);
+        new_data = tohex(x11_fake_data, data_len);
 
         /* Send the request packet. */
         if (compat20) {