[u/mdw/putty] / x11fwd.c

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

#include "putty.h"
#include "ssh.h"

#define GET_32BIT_LSB_FIRST(cp) \
  (((unsigned long)(unsigned char)(cp)[0]) | \
  ((unsigned long)(unsigned char)(cp)[1] << 8) | \
  ((unsigned long)(unsigned char)(cp)[2] << 16) | \
  ((unsigned long)(unsigned char)(cp)[3] << 24))

#define PUT_32BIT_LSB_FIRST(cp, value) ( \
  (cp)[0] = (value), \
  (cp)[1] = (value) >> 8, \
  (cp)[2] = (value) >> 16, \
  (cp)[3] = (value) >> 24 )

#define GET_16BIT_LSB_FIRST(cp) \
  (((unsigned long)(unsigned char)(cp)[0]) | \
  ((unsigned long)(unsigned char)(cp)[1] << 8))

#define PUT_16BIT_LSB_FIRST(cp, value) ( \
  (cp)[0] = (value), \
  (cp)[1] = (value) >> 8 )

#define GET_32BIT_MSB_FIRST(cp) \
  (((unsigned long)(unsigned char)(cp)[0] << 24) | \
  ((unsigned long)(unsigned char)(cp)[1] << 16) | \
  ((unsigned long)(unsigned char)(cp)[2] << 8) | \
  ((unsigned long)(unsigned char)(cp)[3]))

#define PUT_32BIT_MSB_FIRST(cp, value) ( \
  (cp)[0] = (value) >> 24, \
  (cp)[1] = (value) >> 16, \
  (cp)[2] = (value) >> 8, \
  (cp)[3] = (value) )

#define GET_16BIT_MSB_FIRST(cp) \
  (((unsigned long)(unsigned char)(cp)[0] << 8) | \
  ((unsigned long)(unsigned char)(cp)[1]))

#define PUT_16BIT_MSB_FIRST(cp, value) ( \
  (cp)[0] = (value) >> 8, \
  (cp)[1] = (value) )

#define GET_16BIT(endian, cp) \
  (endian=='B' ? GET_16BIT_MSB_FIRST(cp) : GET_16BIT_LSB_FIRST(cp))

#define PUT_16BIT(endian, cp, val) \
  (endian=='B' ? PUT_16BIT_MSB_FIRST(cp, val) : PUT_16BIT_LSB_FIRST(cp, val))

struct X11Private {
    struct plug_function_table *fn;
    /* the above variable absolutely *must* be the first in this structure */
    unsigned char firstpkt[12];	       /* first X data packet */
    char *auth_protocol;
    unsigned char *auth_data;
    int data_read, auth_plen, auth_psize, auth_dlen, auth_dsize;
    int verified;
    int throttled, throttle_override;
    void *c;			       /* data used by ssh.c */
    Socket s;
};

void x11_close(Socket s);

static unsigned char x11_authdata[64];
static int x11_authdatalen;

void x11_invent_auth(char *proto, int protomaxlen,
		     char *data, int datamaxlen)
{
    char ourdata[64];
    int i;

    /* MIT-MAGIC-COOKIE-1. Cookie size is 128 bits (16 bytes). */
    x11_authdatalen = 16;
    for (i = 0; i < 16; i++)
	x11_authdata[i] = random_byte();

    /* Now format for the recipient. */
    strncpy(proto, "MIT-MAGIC-COOKIE-1", protomaxlen);
    ourdata[0] = '\0';
    for (i = 0; i < x11_authdatalen; i++)
	sprintf(ourdata + strlen(ourdata), "%02x", x11_authdata[i]);
    strncpy(data, ourdata, datamaxlen);
}

static int x11_verify(char *proto, unsigned char *data, int dlen)
{
    if (strcmp(proto, "MIT-MAGIC-COOKIE-1") != 0)
	return 0;		       /* wrong protocol attempted */
    if (dlen != x11_authdatalen)
	return 0;		       /* cookie was wrong length */
    if (memcmp(x11_authdata, data, dlen) != 0)
	return 0;		       /* cookie was wrong cookie! */
    return 1;
}

static int x11_closing(Plug plug, char *error_msg, int error_code,
		       int calling_back)
{
    struct X11Private *pr = (struct X11Private *) plug;

    /*
     * We have no way to communicate down the forwarded connection,
     * so if an error occurred on the socket, we just ignore it
     * and treat it like a proper close.
     */
    sshfwd_close(pr->c);
    x11_close(pr->s);
    return 1;
}

static int x11_receive(Plug plug, int urgent, char *data, int len)
{
    struct X11Private *pr = (struct X11Private *) plug;

    if (sshfwd_write(pr->c, data, len) > 0) {
	pr->throttled = 1;
	sk_set_frozen(pr->s, 1);
    }

    return 1;
}

static void x11_sent(Plug plug, int bufsize)
{
    struct X11Private *pr = (struct X11Private *) plug;

    sshfwd_unthrottle(pr->c, bufsize);
}

/*
 * Called to set up the raw connection.
 * 
 * Returns an error message, or NULL on success.
 * also, fills the SocketsStructure
 */
char *x11_init(Socket * s, char *display, void *c)
{
    static struct plug_function_table fn_table = {
	x11_closing,
	x11_receive,
	x11_sent,
	NULL
    };

    SockAddr addr;
    int port;
    char *err, *dummy_realhost;
    char host[128];
    int n, displaynum;
    struct X11Private *pr;

    /*
     * Split up display name into host and display-number parts.
     */
    n = strcspn(display, ":");
    if (display[n])
	displaynum = atoi(display + n + 1);
    else
	displaynum = 0;		       /* sensible default */
    if (n > sizeof(host) - 1)
	n = sizeof(host) - 1;
    strncpy(host, display, n);
    host[n] = '\0';

    /*
     * Try to find host.
     */
    addr = sk_namelookup(host, &dummy_realhost);
    if ((err = sk_addr_error(addr)))
	return err;

    port = 6000 + displaynum;

    /*
     * Open socket.
     */
    pr = (struct X11Private *) smalloc(sizeof(struct X11Private));
    pr->fn = &fn_table;
    pr->auth_protocol = NULL;
    pr->verified = 0;
    pr->data_read = 0;
    pr->throttled = pr->throttle_override = 0;
    pr->c = c;

    pr->s = *s = new_connection(addr, dummy_realhost, port, 0, 1, 0, (Plug) pr);
    if ((err = sk_socket_error(*s))) {
	sfree(pr);
	return err;
    }

    sk_set_private_ptr(*s, pr);
    sk_addr_free(addr);
    return NULL;
}

void x11_close(Socket s)
{
    struct X11Private *pr;
    if (!s)
	return;
    pr = (struct X11Private *) sk_get_private_ptr(s);
    if (pr->auth_protocol) {
	sfree(pr->auth_protocol);
	sfree(pr->auth_data);
    }

    sfree(pr);

    sk_close(s);
}

void x11_unthrottle(Socket s)
{
    struct X11Private *pr;
    if (!s)
	return;
    pr = (struct X11Private *) sk_get_private_ptr(s);

    pr->throttled = 0;
    sk_set_frozen(s, pr->throttled || pr->throttle_override);
}

void x11_override_throttle(Socket s, int enable)
{
    struct X11Private *pr;
    if (!s)
	return;
    pr = (struct X11Private *) sk_get_private_ptr(s);

    pr->throttle_override = enable;
    sk_set_frozen(s, pr->throttled || pr->throttle_override);
}

/*
 * Called to send data down the raw connection.
 */
int x11_send(Socket s, char *data, int len)
{
    struct X11Private *pr = (struct X11Private *) sk_get_private_ptr(s);

    if (s == NULL)
	return 0;

    /*
     * Read the first packet.
     */
    while (len > 0 && pr->data_read < 12)
	pr->firstpkt[pr->data_read++] = (unsigned char) (len--, *data++);
    if (pr->data_read < 12)
	return 0;

    /*
     * If we have not allocated the auth_protocol and auth_data
     * strings, do so now.
     */
    if (!pr->auth_protocol) {
	pr->auth_plen = GET_16BIT(pr->firstpkt[0], pr->firstpkt + 6);
	pr->auth_dlen = GET_16BIT(pr->firstpkt[0], pr->firstpkt + 8);
	pr->auth_psize = (pr->auth_plen + 3) & ~3;
	pr->auth_dsize = (pr->auth_dlen + 3) & ~3;
	/* Leave room for a terminating zero, to make our lives easier. */
	pr->auth_protocol = (char *) smalloc(pr->auth_psize + 1);
	pr->auth_data = (char *) smalloc(pr->auth_dsize);
    }

    /*
     * Read the auth_protocol and auth_data strings.
     */
    while (len > 0 && pr->data_read < 12 + pr->auth_psize)
	pr->auth_protocol[pr->data_read++ - 12] = (len--, *data++);
    while (len > 0 && pr->data_read < 12 + pr->auth_psize + pr->auth_dsize)
	pr->auth_data[pr->data_read++ - 12 -
		      pr->auth_psize] = (unsigned char) (len--, *data++);
    if (pr->data_read < 12 + pr->auth_psize + pr->auth_dsize)
	return 0;

    /*
     * If we haven't verified the authentication, do so now.
     */
    if (!pr->verified) {
	int ret;

	pr->auth_protocol[pr->auth_plen] = '\0';	/* ASCIZ */
	ret = x11_verify(pr->auth_protocol, pr->auth_data, pr->auth_dlen);

	/*
	 * If authentication failed, construct and send an error
	 * packet, then terminate the connection.
	 */
	if (!ret) {
	    char message[] = "Authentication failed at PuTTY X11 proxy";
	    unsigned char reply[8 + sizeof(message) + 4];
	    int msglen = sizeof(message) - 1;	/* skip zero byte */
	    int msgsize = (msglen + 3) & ~3;
	    reply[0] = 0;	       /* failure */
	    reply[1] = msglen;	       /* length of reason string */
	    memcpy(reply + 2, pr->firstpkt + 2, 4);	/* major/minor proto vsn */
	    PUT_16BIT(pr->firstpkt[0], reply + 6, msgsize >> 2);/* data len */
	    memset(reply + 8, 0, msgsize);
	    memcpy(reply + 8, message, msglen);
	    sshfwd_write(pr->c, reply, 8 + msgsize);
	    sshfwd_close(pr->c);
	    x11_close(s);
	    return 0;
	}

	/*
	 * Now we know we're going to accept the connection. Strip
	 * the auth data. (TODO: if we ever work out how, we should
	 * replace some real auth data in here.)
	 */
	PUT_16BIT(pr->firstpkt[0], pr->firstpkt + 6, 0);	/* auth proto */
	PUT_16BIT(pr->firstpkt[0], pr->firstpkt + 8, 0);	/* auth data */
	sk_write(s, pr->firstpkt, 12);
	pr->verified = 1;
    }

    /*
     * After initialisation, just copy data simply.
     */

    return sk_write(s, data, len);
}
Commit	Line	Data
9c964e85	1	#include <windows.h>
	2	#include <stdio.h>
	3	#include <stdlib.h>
	4
	5	#include "putty.h"
	6	#include "ssh.h"
	7
9c964e85	8	#define GET_32BIT_LSB_FIRST(cp) \
	9	(((unsigned long)(unsigned char)(cp)[0]) \| \
	10	((unsigned long)(unsigned char)(cp)[1] << 8) \| \
	11	((unsigned long)(unsigned char)(cp)[2] << 16) \| \
	12	((unsigned long)(unsigned char)(cp)[3] << 24))
	13
	14	#define PUT_32BIT_LSB_FIRST(cp, value) ( \
	15	(cp)[0] = (value), \
	16	(cp)[1] = (value) >> 8, \
	17	(cp)[2] = (value) >> 16, \
	18	(cp)[3] = (value) >> 24 )
	19
	20	#define GET_16BIT_LSB_FIRST(cp) \
	21	(((unsigned long)(unsigned char)(cp)[0]) \| \
	22	((unsigned long)(unsigned char)(cp)[1] << 8))
	23
	24	#define PUT_16BIT_LSB_FIRST(cp, value) ( \
	25	(cp)[0] = (value), \
	26	(cp)[1] = (value) >> 8 )
	27
	28	#define GET_32BIT_MSB_FIRST(cp) \
	29	(((unsigned long)(unsigned char)(cp)[0] << 24) \| \
	30	((unsigned long)(unsigned char)(cp)[1] << 16) \| \
	31	((unsigned long)(unsigned char)(cp)[2] << 8) \| \
	32	((unsigned long)(unsigned char)(cp)[3]))
	33
	34	#define PUT_32BIT_MSB_FIRST(cp, value) ( \
	35	(cp)[0] = (value) >> 24, \
	36	(cp)[1] = (value) >> 16, \
	37	(cp)[2] = (value) >> 8, \
	38	(cp)[3] = (value) )
	39
	40	#define GET_16BIT_MSB_FIRST(cp) \
	41	(((unsigned long)(unsigned char)(cp)[0] << 8) \| \
	42	((unsigned long)(unsigned char)(cp)[1]))
	43
	44	#define PUT_16BIT_MSB_FIRST(cp, value) ( \
	45	(cp)[0] = (value) >> 8, \
	46	(cp)[1] = (value) )
	47
	48	#define GET_16BIT(endian, cp) \
	49	(endian=='B' ? GET_16BIT_MSB_FIRST(cp) : GET_16BIT_LSB_FIRST(cp))
	50
	51	#define PUT_16BIT(endian, cp, val) \
	52	(endian=='B' ? PUT_16BIT_MSB_FIRST(cp, val) : PUT_16BIT_LSB_FIRST(cp, val))
	53
9c964e85	54	struct X11Private {
7e78000d	55	struct plug_function_table *fn;
7e78000d	56	/* the above variable absolutely must be the first in this structure */
32874aea	57	unsigned char firstpkt[12]; /* first X data packet */
9c964e85	58	char *auth_protocol;
	59	unsigned char *auth_data;
	60	int data_read, auth_plen, auth_psize, auth_dlen, auth_dsize;
	61	int verified;
5471d09a	62	int throttled, throttle_override;
32874aea	63	void c; / data used by ssh.c */
7e78000d	64	Socket s;
9c964e85	65	};
9c964e85	66
32874aea	67	void x11_close(Socket s);
9c964e85	68
	69	static unsigned char x11_authdata[64];
	70	static int x11_authdatalen;
	71
	72	void x11_invent_auth(char *proto, int protomaxlen,
32874aea	73	char *data, int datamaxlen)
32874aea	74	{
9c964e85	75	char ourdata[64];
	76	int i;
	77
	78	/* MIT-MAGIC-COOKIE-1. Cookie size is 128 bits (16 bytes). */
	79	x11_authdatalen = 16;
	80	for (i = 0; i < 16; i++)
32874aea	81	x11_authdata[i] = random_byte();
9c964e85	82
	83	/* Now format for the recipient. */
	84	strncpy(proto, "MIT-MAGIC-COOKIE-1", protomaxlen);
	85	ourdata[0] = '\0';
	86	for (i = 0; i < x11_authdatalen; i++)
32874aea	87	sprintf(ourdata + strlen(ourdata), "%02x", x11_authdata[i]);
9c964e85	88	strncpy(data, ourdata, datamaxlen);
	89	}
	90
32874aea	91	static int x11_verify(char proto, unsigned char data, int dlen)
32874aea	92	{
9c964e85	93	if (strcmp(proto, "MIT-MAGIC-COOKIE-1") != 0)
32874aea	94	return 0; /* wrong protocol attempted */
9c964e85	95	if (dlen != x11_authdatalen)
32874aea	96	return 0; /* cookie was wrong length */
9c964e85	97	if (memcmp(x11_authdata, data, dlen) != 0)
32874aea	98	return 0; /* cookie was wrong cookie! */
9c964e85	99	return 1;
	100	}
	101
32874aea	102	static int x11_closing(Plug plug, char *error_msg, int error_code,
	103	int calling_back)
	104	{
7e78000d	105	struct X11Private pr = (struct X11Private ) plug;
	106
	107	/*
	108	* We have no way to communicate down the forwarded connection,
	109	* so if an error occurred on the socket, we just ignore it
	110	* and treat it like a proper close.
	111	*/
	112	sshfwd_close(pr->c);
	113	x11_close(pr->s);
	114	return 1;
	115	}
	116
32874aea	117	static int x11_receive(Plug plug, int urgent, char *data, int len)
32874aea	118	{
7e78000d	119	struct X11Private pr = (struct X11Private ) plug;
9c964e85	120
5471d09a	121	if (sshfwd_write(pr->c, data, len) > 0) {
	122	pr->throttled = 1;
	123	sk_set_frozen(pr->s, 1);
	124	}
	125
9c964e85	126	return 1;
	127	}
	128
5471d09a	129	static void x11_sent(Plug plug, int bufsize)
	130	{
	131	struct X11Private pr = (struct X11Private ) plug;
	132
	133	sshfwd_unthrottle(pr->c, bufsize);
	134	}
	135
9c964e85	136	/*
	137	* Called to set up the raw connection.
	138	*
	139	* Returns an error message, or NULL on success.
	140	* also, fills the SocketsStructure
9c964e85	141	*/
32874aea	142	char x11_init(Socket s, char display, void c)
32874aea	143	{
7e78000d	144	static struct plug_function_table fn_table = {
7e78000d	145	x11_closing,
5471d09a	146	x11_receive,
	147	x11_sent,
	148	NULL
7e78000d	149	};
7e78000d	150
9c964e85	151	SockAddr addr;
9c964e85	152	int port;
0c6c9a70	153	char err, dummy_realhost;
9c964e85	154	char host[128];
	155	int n, displaynum;
	156	struct X11Private *pr;
	157
	158	/*
	159	* Split up display name into host and display-number parts.
	160	*/
	161	n = strcspn(display, ":");
	162	if (display[n])
32874aea	163	displaynum = atoi(display + n + 1);
9c964e85	164	else
32874aea	165	displaynum = 0; /* sensible default */
	166	if (n > sizeof(host) - 1)
	167	n = sizeof(host) - 1;
9c964e85	168	strncpy(host, display, n);
	169	host[n] = '\0';
	170
	171	/*
	172	* Try to find host.
	173	*/
0c6c9a70	174	addr = sk_namelookup(host, &dummy_realhost);
32874aea	175	if ((err = sk_addr_error(addr)))
9c964e85	176	return err;
	177
	178	port = 6000 + displaynum;
	179
	180	/*
	181	* Open socket.
	182	*/
32874aea	183	pr = (struct X11Private *) smalloc(sizeof(struct X11Private));
7e78000d	184	pr->fn = &fn_table;
9c964e85	185	pr->auth_protocol = NULL;
	186	pr->verified = 0;
	187	pr->data_read = 0;
5471d09a	188	pr->throttled = pr->throttle_override = 0;
9c964e85	189	pr->c = c;
9c964e85	190
8eebd221	191	pr->s = *s = new_connection(addr, dummy_realhost, port, 0, 1, 0, (Plug) pr);
32874aea	192	if ((err = sk_socket_error(*s))) {
32874aea	193	sfree(pr);
7e78000d	194	return err;
	195	}
	196
9c964e85	197	sk_set_private_ptr(*s, pr);
	198	sk_addr_free(addr);
	199	return NULL;
	200	}
	201
32874aea	202	void x11_close(Socket s)
	203	{
	204	struct X11Private *pr;
d74d141c	205	if (!s)
	206	return;
	207	pr = (struct X11Private *) sk_get_private_ptr(s);
9c964e85	208	if (pr->auth_protocol) {
32874aea	209	sfree(pr->auth_protocol);
32874aea	210	sfree(pr->auth_data);
9c964e85	211	}
	212
	213	sfree(pr);
	214
	215	sk_close(s);
	216	}
	217
5471d09a	218	void x11_unthrottle(Socket s)
	219	{
	220	struct X11Private *pr;
	221	if (!s)
	222	return;
	223	pr = (struct X11Private *) sk_get_private_ptr(s);
	224
	225	pr->throttled = 0;
	226	sk_set_frozen(s, pr->throttled \|\| pr->throttle_override);
	227	}
	228
	229	void x11_override_throttle(Socket s, int enable)
	230	{
	231	struct X11Private *pr;
	232	if (!s)
	233	return;
	234	pr = (struct X11Private *) sk_get_private_ptr(s);
	235
	236	pr->throttle_override = enable;
	237	sk_set_frozen(s, pr->throttled \|\| pr->throttle_override);
	238	}
	239
9c964e85	240	/*
	241	* Called to send data down the raw connection.
	242	*/
5471d09a	243	int x11_send(Socket s, char *data, int len)
32874aea	244	{
32874aea	245	struct X11Private pr = (struct X11Private ) sk_get_private_ptr(s);
9c964e85	246
9c964e85	247	if (s == NULL)
5471d09a	248	return 0;
9c964e85	249
	250	/*
	251	* Read the first packet.
	252	*/
	253	while (len > 0 && pr->data_read < 12)
32874aea	254	pr->firstpkt[pr->data_read++] = (unsigned char) (len--, *data++);
9c964e85	255	if (pr->data_read < 12)
5471d09a	256	return 0;
9c964e85	257
	258	/*
	259	* If we have not allocated the auth_protocol and auth_data
	260	* strings, do so now.
	261	*/
	262	if (!pr->auth_protocol) {
32874aea	263	pr->auth_plen = GET_16BIT(pr->firstpkt[0], pr->firstpkt + 6);
	264	pr->auth_dlen = GET_16BIT(pr->firstpkt[0], pr->firstpkt + 8);
	265	pr->auth_psize = (pr->auth_plen + 3) & ~3;
	266	pr->auth_dsize = (pr->auth_dlen + 3) & ~3;
	267	/* Leave room for a terminating zero, to make our lives easier. */
	268	pr->auth_protocol = (char *) smalloc(pr->auth_psize + 1);
	269	pr->auth_data = (char *) smalloc(pr->auth_dsize);
9c964e85	270	}
	271
	272	/*
	273	* Read the auth_protocol and auth_data strings.
	274	*/
	275	while (len > 0 && pr->data_read < 12 + pr->auth_psize)
32874aea	276	pr->auth_protocol[pr->data_read++ - 12] = (len--, *data++);
9c964e85	277	while (len > 0 && pr->data_read < 12 + pr->auth_psize + pr->auth_dsize)
32874aea	278	pr->auth_data[pr->data_read++ - 12 -
32874aea	279	pr->auth_psize] = (unsigned char) (len--, *data++);
9c964e85	280	if (pr->data_read < 12 + pr->auth_psize + pr->auth_dsize)
5471d09a	281	return 0;
9c964e85	282
	283	/*
	284	* If we haven't verified the authentication, do so now.
	285	*/
	286	if (!pr->verified) {
32874aea	287	int ret;
	288
	289	pr->auth_protocol[pr->auth_plen] = '\0'; /* ASCIZ */
	290	ret = x11_verify(pr->auth_protocol, pr->auth_data, pr->auth_dlen);
	291
	292	/*
	293	* If authentication failed, construct and send an error
	294	* packet, then terminate the connection.
	295	*/
	296	if (!ret) {
	297	char message[] = "Authentication failed at PuTTY X11 proxy";
	298	unsigned char reply[8 + sizeof(message) + 4];
	299	int msglen = sizeof(message) - 1; /* skip zero byte */
	300	int msgsize = (msglen + 3) & ~3;
	301	reply[0] = 0; /* failure */
	302	reply[1] = msglen; /* length of reason string */
	303	memcpy(reply + 2, pr->firstpkt + 2, 4); /* major/minor proto vsn */
75105663	304	PUT_16BIT(pr->firstpkt[0], reply + 6, msgsize >> 2);/* data len */
32874aea	305	memset(reply + 8, 0, msgsize);
	306	memcpy(reply + 8, message, msglen);
	307	sshfwd_write(pr->c, reply, 8 + msgsize);
	308	sshfwd_close(pr->c);
	309	x11_close(s);
5471d09a	310	return 0;
32874aea	311	}
	312
	313	/*
	314	* Now we know we're going to accept the connection. Strip
	315	* the auth data. (TODO: if we ever work out how, we should
	316	* replace some real auth data in here.)
	317	*/
	318	PUT_16BIT(pr->firstpkt[0], pr->firstpkt + 6, 0); /* auth proto */
	319	PUT_16BIT(pr->firstpkt[0], pr->firstpkt + 8, 0); /* auth data */
	320	sk_write(s, pr->firstpkt, 12);
	321	pr->verified = 1;
9c964e85	322	}
	323
	324	/*
	325	* After initialisation, just copy data simply.
	326	*/
	327
5471d09a	328	return sk_write(s, data, len);
9c964e85	329	}