[u/mdw/putty] / x11fwd.c

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

#include "putty.h"
#include "ssh.h"

#ifndef FALSE
#define FALSE 0
#endif
#ifndef TRUE
#define TRUE 1
#endif

#define GET_32BIT_LSB_FIRST(cp) \
  (((unsigned long)(unsigned char)(cp)[0]) | \
  ((unsigned long)(unsigned char)(cp)[1] << 8) | \
  ((unsigned long)(unsigned char)(cp)[2] << 16) | \
  ((unsigned long)(unsigned char)(cp)[3] << 24))

#define PUT_32BIT_LSB_FIRST(cp, value) ( \
  (cp)[0] = (value), \
  (cp)[1] = (value) >> 8, \
  (cp)[2] = (value) >> 16, \
  (cp)[3] = (value) >> 24 )

#define GET_16BIT_LSB_FIRST(cp) \
  (((unsigned long)(unsigned char)(cp)[0]) | \
  ((unsigned long)(unsigned char)(cp)[1] << 8))

#define PUT_16BIT_LSB_FIRST(cp, value) ( \
  (cp)[0] = (value), \
  (cp)[1] = (value) >> 8 )

#define GET_32BIT_MSB_FIRST(cp) \
  (((unsigned long)(unsigned char)(cp)[0] << 24) | \
  ((unsigned long)(unsigned char)(cp)[1] << 16) | \
  ((unsigned long)(unsigned char)(cp)[2] << 8) | \
  ((unsigned long)(unsigned char)(cp)[3]))

#define PUT_32BIT_MSB_FIRST(cp, value) ( \
  (cp)[0] = (value) >> 24, \
  (cp)[1] = (value) >> 16, \
  (cp)[2] = (value) >> 8, \
  (cp)[3] = (value) )

#define GET_16BIT_MSB_FIRST(cp) \
  (((unsigned long)(unsigned char)(cp)[0] << 8) | \
  ((unsigned long)(unsigned char)(cp)[1]))

#define PUT_16BIT_MSB_FIRST(cp, value) ( \
  (cp)[0] = (value) >> 8, \
  (cp)[1] = (value) )

#define GET_16BIT(endian, cp) \
  (endian=='B' ? GET_16BIT_MSB_FIRST(cp) : GET_16BIT_LSB_FIRST(cp))

#define PUT_16BIT(endian, cp, val) \
  (endian=='B' ? PUT_16BIT_MSB_FIRST(cp, val) : PUT_16BIT_LSB_FIRST(cp, val))

struct X11Private {
    struct plug_function_table *fn;
    /* the above variable absolutely *must* be the first in this structure */
    unsigned char firstpkt[12];	       /* first X data packet */
    char *auth_protocol;
    unsigned char *auth_data;
    int data_read, auth_plen, auth_psize, auth_dlen, auth_dsize;
    int verified;
    int throttled, throttle_override;
    void *c;			       /* data used by ssh.c */
    Socket s;
};

void x11_close(Socket s);

static unsigned char x11_authdata[64];
static int x11_authdatalen;

void x11_invent_auth(char *proto, int protomaxlen,
		     char *data, int datamaxlen)
{
    char ourdata[64];
    int i;

    /* MIT-MAGIC-COOKIE-1. Cookie size is 128 bits (16 bytes). */
    x11_authdatalen = 16;
    for (i = 0; i < 16; i++)
	x11_authdata[i] = random_byte();

    /* Now format for the recipient. */
    strncpy(proto, "MIT-MAGIC-COOKIE-1", protomaxlen);
    ourdata[0] = '\0';
    for (i = 0; i < x11_authdatalen; i++)
	sprintf(ourdata + strlen(ourdata), "%02x", x11_authdata[i]);
    strncpy(data, ourdata, datamaxlen);
}

static int x11_verify(char *proto, unsigned char *data, int dlen)
{
    if (strcmp(proto, "MIT-MAGIC-COOKIE-1") != 0)
	return 0;		       /* wrong protocol attempted */
    if (dlen != x11_authdatalen)
	return 0;		       /* cookie was wrong length */
    if (memcmp(x11_authdata, data, dlen) != 0)
	return 0;		       /* cookie was wrong cookie! */
    return 1;
}

static int x11_closing(Plug plug, char *error_msg, int error_code,
		       int calling_back)
{
    struct X11Private *pr = (struct X11Private *) plug;

    /*
     * We have no way to communicate down the forwarded connection,
     * so if an error occurred on the socket, we just ignore it
     * and treat it like a proper close.
     */
    sshfwd_close(pr->c);
    x11_close(pr->s);
    return 1;
}

static int x11_receive(Plug plug, int urgent, char *data, int len)
{
    struct X11Private *pr = (struct X11Private *) plug;

    if (sshfwd_write(pr->c, data, len) > 0) {
	pr->throttled = 1;
	sk_set_frozen(pr->s, 1);
    }

    return 1;
}

static void x11_sent(Plug plug, int bufsize)
{
    struct X11Private *pr = (struct X11Private *) plug;

    sshfwd_unthrottle(pr->c, bufsize);
}

/*
 * Called to set up the raw connection.
 * 
 * Returns an error message, or NULL on success.
 * also, fills the SocketsStructure
 */
char *x11_init(Socket * s, char *display, void *c)
{
    static struct plug_function_table fn_table = {
	x11_closing,
	x11_receive,
	x11_sent,
	NULL
    };

    SockAddr addr;
    int port;
    char *err, *dummy_realhost;
    char host[128];
    int n, displaynum;
    struct X11Private *pr;

    /*
     * Split up display name into host and display-number parts.
     */
    n = strcspn(display, ":");
    if (display[n])
	displaynum = atoi(display + n + 1);
    else
	displaynum = 0;		       /* sensible default */
    if (n > sizeof(host) - 1)
	n = sizeof(host) - 1;
    strncpy(host, display, n);
    host[n] = '\0';

    /*
     * Try to find host.
     */
    addr = sk_namelookup(host, &dummy_realhost);
    if ((err = sk_addr_error(addr)))
	return err;

    port = 6000 + displaynum;

    /*
     * Open socket.
     */
    pr = (struct X11Private *) smalloc(sizeof(struct X11Private));
    pr->fn = &fn_table;
    pr->auth_protocol = NULL;
    pr->verified = 0;
    pr->data_read = 0;
    pr->throttled = pr->throttle_override = 0;
    pr->c = c;

    pr->s = *s = sk_new(addr, port, 0, 1, (Plug) pr);
    if ((err = sk_socket_error(*s))) {
	sfree(pr);
	return err;
    }

    sk_set_private_ptr(*s, pr);
    sk_addr_free(addr);
    return NULL;
}

void x11_close(Socket s)
{
    struct X11Private *pr;
    if (!s)
	return;
    pr = (struct X11Private *) sk_get_private_ptr(s);
    if (pr->auth_protocol) {
	sfree(pr->auth_protocol);
	sfree(pr->auth_data);
    }

    sfree(pr);

    sk_close(s);
}

void x11_unthrottle(Socket s)
{
    struct X11Private *pr;
    if (!s)
	return;
    pr = (struct X11Private *) sk_get_private_ptr(s);

    pr->throttled = 0;
    sk_set_frozen(s, pr->throttled || pr->throttle_override);
}

void x11_override_throttle(Socket s, int enable)
{
    struct X11Private *pr;
    if (!s)
	return;
    pr = (struct X11Private *) sk_get_private_ptr(s);

    pr->throttle_override = enable;
    sk_set_frozen(s, pr->throttled || pr->throttle_override);
}

/*
 * Called to send data down the raw connection.
 */
int x11_send(Socket s, char *data, int len)
{
    struct X11Private *pr = (struct X11Private *) sk_get_private_ptr(s);

    if (s == NULL)
	return 0;

    /*
     * Read the first packet.
     */
    while (len > 0 && pr->data_read < 12)
	pr->firstpkt[pr->data_read++] = (unsigned char) (len--, *data++);
    if (pr->data_read < 12)
	return 0;

    /*
     * If we have not allocated the auth_protocol and auth_data
     * strings, do so now.
     */
    if (!pr->auth_protocol) {
	pr->auth_plen = GET_16BIT(pr->firstpkt[0], pr->firstpkt + 6);
	pr->auth_dlen = GET_16BIT(pr->firstpkt[0], pr->firstpkt + 8);
	pr->auth_psize = (pr->auth_plen + 3) & ~3;
	pr->auth_dsize = (pr->auth_dlen + 3) & ~3;
	/* Leave room for a terminating zero, to make our lives easier. */
	pr->auth_protocol = (char *) smalloc(pr->auth_psize + 1);
	pr->auth_data = (char *) smalloc(pr->auth_dsize);
    }

    /*
     * Read the auth_protocol and auth_data strings.
     */
    while (len > 0 && pr->data_read < 12 + pr->auth_psize)
	pr->auth_protocol[pr->data_read++ - 12] = (len--, *data++);
    while (len > 0 && pr->data_read < 12 + pr->auth_psize + pr->auth_dsize)
	pr->auth_data[pr->data_read++ - 12 -
		      pr->auth_psize] = (unsigned char) (len--, *data++);
    if (pr->data_read < 12 + pr->auth_psize + pr->auth_dsize)
	return 0;

    /*
     * If we haven't verified the authentication, do so now.
     */
    if (!pr->verified) {
	int ret;

	pr->auth_protocol[pr->auth_plen] = '\0';	/* ASCIZ */
	ret = x11_verify(pr->auth_protocol, pr->auth_data, pr->auth_dlen);

	/*
	 * If authentication failed, construct and send an error
	 * packet, then terminate the connection.
	 */
	if (!ret) {
	    char message[] = "Authentication failed at PuTTY X11 proxy";
	    unsigned char reply[8 + sizeof(message) + 4];
	    int msglen = sizeof(message) - 1;	/* skip zero byte */
	    int msgsize = (msglen + 3) & ~3;
	    reply[0] = 0;	       /* failure */
	    reply[1] = msglen;	       /* length of reason string */
	    memcpy(reply + 2, pr->firstpkt + 2, 4);	/* major/minor proto vsn */
	    PUT_16BIT(pr->firstpkt[0], reply + 6, msglen >> 2);	/* data len */
	    memset(reply + 8, 0, msgsize);
	    memcpy(reply + 8, message, msglen);
	    sshfwd_write(pr->c, reply, 8 + msgsize);
	    sshfwd_close(pr->c);
	    x11_close(s);
	    return 0;
	}

	/*
	 * Now we know we're going to accept the connection. Strip
	 * the auth data. (TODO: if we ever work out how, we should
	 * replace some real auth data in here.)
	 */
	PUT_16BIT(pr->firstpkt[0], pr->firstpkt + 6, 0);	/* auth proto */
	PUT_16BIT(pr->firstpkt[0], pr->firstpkt + 8, 0);	/* auth data */
	sk_write(s, pr->firstpkt, 12);
	pr->verified = 1;
    }

    /*
     * After initialisation, just copy data simply.
     */

    return sk_write(s, data, len);
}
Commit	Line	Data
9c964e85	1	#include <windows.h>
	2	#include <stdio.h>
	3	#include <stdlib.h>
	4
	5	#include "putty.h"
	6	#include "ssh.h"
	7
	8	#ifndef FALSE
	9	#define FALSE 0
	10	#endif
	11	#ifndef TRUE
	12	#define TRUE 1
	13	#endif
	14
	15	#define GET_32BIT_LSB_FIRST(cp) \
	16	(((unsigned long)(unsigned char)(cp)[0]) \| \
	17	((unsigned long)(unsigned char)(cp)[1] << 8) \| \
	18	((unsigned long)(unsigned char)(cp)[2] << 16) \| \
	19	((unsigned long)(unsigned char)(cp)[3] << 24))
	20
	21	#define PUT_32BIT_LSB_FIRST(cp, value) ( \
	22	(cp)[0] = (value), \
	23	(cp)[1] = (value) >> 8, \
	24	(cp)[2] = (value) >> 16, \
	25	(cp)[3] = (value) >> 24 )
	26
	27	#define GET_16BIT_LSB_FIRST(cp) \
	28	(((unsigned long)(unsigned char)(cp)[0]) \| \
	29	((unsigned long)(unsigned char)(cp)[1] << 8))
	30
	31	#define PUT_16BIT_LSB_FIRST(cp, value) ( \
	32	(cp)[0] = (value), \
	33	(cp)[1] = (value) >> 8 )
	34
	35	#define GET_32BIT_MSB_FIRST(cp) \
	36	(((unsigned long)(unsigned char)(cp)[0] << 24) \| \
	37	((unsigned long)(unsigned char)(cp)[1] << 16) \| \
	38	((unsigned long)(unsigned char)(cp)[2] << 8) \| \
	39	((unsigned long)(unsigned char)(cp)[3]))
	40
	41	#define PUT_32BIT_MSB_FIRST(cp, value) ( \
	42	(cp)[0] = (value) >> 24, \
	43	(cp)[1] = (value) >> 16, \
	44	(cp)[2] = (value) >> 8, \
	45	(cp)[3] = (value) )
	46
	47	#define GET_16BIT_MSB_FIRST(cp) \
	48	(((unsigned long)(unsigned char)(cp)[0] << 8) \| \
	49	((unsigned long)(unsigned char)(cp)[1]))
	50
	51	#define PUT_16BIT_MSB_FIRST(cp, value) ( \
	52	(cp)[0] = (value) >> 8, \
	53	(cp)[1] = (value) )
	54
	55	#define GET_16BIT(endian, cp) \
	56	(endian=='B' ? GET_16BIT_MSB_FIRST(cp) : GET_16BIT_LSB_FIRST(cp))
	57
	58	#define PUT_16BIT(endian, cp, val) \
	59	(endian=='B' ? PUT_16BIT_MSB_FIRST(cp, val) : PUT_16BIT_LSB_FIRST(cp, val))
	60
9c964e85	61	struct X11Private {
7e78000d	62	struct plug_function_table *fn;
7e78000d	63	/* the above variable absolutely must be the first in this structure */
32874aea	64	unsigned char firstpkt[12]; /* first X data packet */
9c964e85	65	char *auth_protocol;
	66	unsigned char *auth_data;
	67	int data_read, auth_plen, auth_psize, auth_dlen, auth_dsize;
	68	int verified;
5471d09a	69	int throttled, throttle_override;
32874aea	70	void c; / data used by ssh.c */
7e78000d	71	Socket s;
9c964e85	72	};
9c964e85	73
32874aea	74	void x11_close(Socket s);
9c964e85	75
	76	static unsigned char x11_authdata[64];
	77	static int x11_authdatalen;
	78
	79	void x11_invent_auth(char *proto, int protomaxlen,
32874aea	80	char *data, int datamaxlen)
32874aea	81	{
9c964e85	82	char ourdata[64];
	83	int i;
	84
	85	/* MIT-MAGIC-COOKIE-1. Cookie size is 128 bits (16 bytes). */
	86	x11_authdatalen = 16;
	87	for (i = 0; i < 16; i++)
32874aea	88	x11_authdata[i] = random_byte();
9c964e85	89
	90	/* Now format for the recipient. */
	91	strncpy(proto, "MIT-MAGIC-COOKIE-1", protomaxlen);
	92	ourdata[0] = '\0';
	93	for (i = 0; i < x11_authdatalen; i++)
32874aea	94	sprintf(ourdata + strlen(ourdata), "%02x", x11_authdata[i]);
9c964e85	95	strncpy(data, ourdata, datamaxlen);
	96	}
	97
32874aea	98	static int x11_verify(char proto, unsigned char data, int dlen)
32874aea	99	{
9c964e85	100	if (strcmp(proto, "MIT-MAGIC-COOKIE-1") != 0)
32874aea	101	return 0; /* wrong protocol attempted */
9c964e85	102	if (dlen != x11_authdatalen)
32874aea	103	return 0; /* cookie was wrong length */
9c964e85	104	if (memcmp(x11_authdata, data, dlen) != 0)
32874aea	105	return 0; /* cookie was wrong cookie! */
9c964e85	106	return 1;
	107	}
	108
32874aea	109	static int x11_closing(Plug plug, char *error_msg, int error_code,
	110	int calling_back)
	111	{
7e78000d	112	struct X11Private pr = (struct X11Private ) plug;
	113
	114	/*
	115	* We have no way to communicate down the forwarded connection,
	116	* so if an error occurred on the socket, we just ignore it
	117	* and treat it like a proper close.
	118	*/
	119	sshfwd_close(pr->c);
	120	x11_close(pr->s);
	121	return 1;
	122	}
	123
32874aea	124	static int x11_receive(Plug plug, int urgent, char *data, int len)
32874aea	125	{
7e78000d	126	struct X11Private pr = (struct X11Private ) plug;
9c964e85	127
5471d09a	128	if (sshfwd_write(pr->c, data, len) > 0) {
	129	pr->throttled = 1;
	130	sk_set_frozen(pr->s, 1);
	131	}
	132
9c964e85	133	return 1;
	134	}
	135
5471d09a	136	static void x11_sent(Plug plug, int bufsize)
	137	{
	138	struct X11Private pr = (struct X11Private ) plug;
	139
	140	sshfwd_unthrottle(pr->c, bufsize);
	141	}
	142
9c964e85	143	/*
	144	* Called to set up the raw connection.
	145	*
	146	* Returns an error message, or NULL on success.
	147	* also, fills the SocketsStructure
9c964e85	148	*/
32874aea	149	char x11_init(Socket s, char display, void c)
32874aea	150	{
7e78000d	151	static struct plug_function_table fn_table = {
7e78000d	152	x11_closing,
5471d09a	153	x11_receive,
	154	x11_sent,
	155	NULL
7e78000d	156	};
7e78000d	157
9c964e85	158	SockAddr addr;
9c964e85	159	int port;
0c6c9a70	160	char err, dummy_realhost;
9c964e85	161	char host[128];
	162	int n, displaynum;
	163	struct X11Private *pr;
	164
	165	/*
	166	* Split up display name into host and display-number parts.
	167	*/
	168	n = strcspn(display, ":");
	169	if (display[n])
32874aea	170	displaynum = atoi(display + n + 1);
9c964e85	171	else
32874aea	172	displaynum = 0; /* sensible default */
	173	if (n > sizeof(host) - 1)
	174	n = sizeof(host) - 1;
9c964e85	175	strncpy(host, display, n);
	176	host[n] = '\0';
	177
	178	/*
	179	* Try to find host.
	180	*/
0c6c9a70	181	addr = sk_namelookup(host, &dummy_realhost);
32874aea	182	if ((err = sk_addr_error(addr)))
9c964e85	183	return err;
	184
	185	port = 6000 + displaynum;
	186
	187	/*
	188	* Open socket.
	189	*/
32874aea	190	pr = (struct X11Private *) smalloc(sizeof(struct X11Private));
7e78000d	191	pr->fn = &fn_table;
9c964e85	192	pr->auth_protocol = NULL;
	193	pr->verified = 0;
	194	pr->data_read = 0;
5471d09a	195	pr->throttled = pr->throttle_override = 0;
9c964e85	196	pr->c = c;
9c964e85	197
7e78000d	198	pr->s = *s = sk_new(addr, port, 0, 1, (Plug) pr);
32874aea	199	if ((err = sk_socket_error(*s))) {
32874aea	200	sfree(pr);
7e78000d	201	return err;
	202	}
	203
9c964e85	204	sk_set_private_ptr(*s, pr);
	205	sk_addr_free(addr);
	206	return NULL;
	207	}
	208
32874aea	209	void x11_close(Socket s)
	210	{
	211	struct X11Private *pr;
d74d141c	212	if (!s)
	213	return;
	214	pr = (struct X11Private *) sk_get_private_ptr(s);
9c964e85	215	if (pr->auth_protocol) {
32874aea	216	sfree(pr->auth_protocol);
32874aea	217	sfree(pr->auth_data);
9c964e85	218	}
	219
	220	sfree(pr);
	221
	222	sk_close(s);
	223	}
	224
5471d09a	225	void x11_unthrottle(Socket s)
	226	{
	227	struct X11Private *pr;
	228	if (!s)
	229	return;
	230	pr = (struct X11Private *) sk_get_private_ptr(s);
	231
	232	pr->throttled = 0;
	233	sk_set_frozen(s, pr->throttled \|\| pr->throttle_override);
	234	}
	235
	236	void x11_override_throttle(Socket s, int enable)
	237	{
	238	struct X11Private *pr;
	239	if (!s)
	240	return;
	241	pr = (struct X11Private *) sk_get_private_ptr(s);
	242
	243	pr->throttle_override = enable;
	244	sk_set_frozen(s, pr->throttled \|\| pr->throttle_override);
	245	}
	246
9c964e85	247	/*
	248	* Called to send data down the raw connection.
	249	*/
5471d09a	250	int x11_send(Socket s, char *data, int len)
32874aea	251	{
32874aea	252	struct X11Private pr = (struct X11Private ) sk_get_private_ptr(s);
9c964e85	253
9c964e85	254	if (s == NULL)
5471d09a	255	return 0;
9c964e85	256
	257	/*
	258	* Read the first packet.
	259	*/
	260	while (len > 0 && pr->data_read < 12)
32874aea	261	pr->firstpkt[pr->data_read++] = (unsigned char) (len--, *data++);
9c964e85	262	if (pr->data_read < 12)
5471d09a	263	return 0;
9c964e85	264
	265	/*
	266	* If we have not allocated the auth_protocol and auth_data
	267	* strings, do so now.
	268	*/
	269	if (!pr->auth_protocol) {
32874aea	270	pr->auth_plen = GET_16BIT(pr->firstpkt[0], pr->firstpkt + 6);
	271	pr->auth_dlen = GET_16BIT(pr->firstpkt[0], pr->firstpkt + 8);
	272	pr->auth_psize = (pr->auth_plen + 3) & ~3;
	273	pr->auth_dsize = (pr->auth_dlen + 3) & ~3;
	274	/* Leave room for a terminating zero, to make our lives easier. */
	275	pr->auth_protocol = (char *) smalloc(pr->auth_psize + 1);
	276	pr->auth_data = (char *) smalloc(pr->auth_dsize);
9c964e85	277	}
	278
	279	/*
	280	* Read the auth_protocol and auth_data strings.
	281	*/
	282	while (len > 0 && pr->data_read < 12 + pr->auth_psize)
32874aea	283	pr->auth_protocol[pr->data_read++ - 12] = (len--, *data++);
9c964e85	284	while (len > 0 && pr->data_read < 12 + pr->auth_psize + pr->auth_dsize)
32874aea	285	pr->auth_data[pr->data_read++ - 12 -
32874aea	286	pr->auth_psize] = (unsigned char) (len--, *data++);
9c964e85	287	if (pr->data_read < 12 + pr->auth_psize + pr->auth_dsize)
5471d09a	288	return 0;
9c964e85	289
	290	/*
	291	* If we haven't verified the authentication, do so now.
	292	*/
	293	if (!pr->verified) {
32874aea	294	int ret;
	295
	296	pr->auth_protocol[pr->auth_plen] = '\0'; /* ASCIZ */
	297	ret = x11_verify(pr->auth_protocol, pr->auth_data, pr->auth_dlen);
	298
	299	/*
	300	* If authentication failed, construct and send an error
	301	* packet, then terminate the connection.
	302	*/
	303	if (!ret) {
	304	char message[] = "Authentication failed at PuTTY X11 proxy";
	305	unsigned char reply[8 + sizeof(message) + 4];
	306	int msglen = sizeof(message) - 1; /* skip zero byte */
	307	int msgsize = (msglen + 3) & ~3;
	308	reply[0] = 0; /* failure */
	309	reply[1] = msglen; /* length of reason string */
	310	memcpy(reply + 2, pr->firstpkt + 2, 4); /* major/minor proto vsn */
	311	PUT_16BIT(pr->firstpkt[0], reply + 6, msglen >> 2); /* data len */
	312	memset(reply + 8, 0, msgsize);
	313	memcpy(reply + 8, message, msglen);
	314	sshfwd_write(pr->c, reply, 8 + msgsize);
	315	sshfwd_close(pr->c);
	316	x11_close(s);
5471d09a	317	return 0;
32874aea	318	}
	319
	320	/*
	321	* Now we know we're going to accept the connection. Strip
	322	* the auth data. (TODO: if we ever work out how, we should
	323	* replace some real auth data in here.)
	324	*/
	325	PUT_16BIT(pr->firstpkt[0], pr->firstpkt + 6, 0); /* auth proto */
	326	PUT_16BIT(pr->firstpkt[0], pr->firstpkt + 8, 0); /* auth data */
	327	sk_write(s, pr->firstpkt, 12);
	328	pr->verified = 1;
9c964e85	329	}
	330
	331	/*
	332	* After initialisation, just copy data simply.
	333	*/
	334
5471d09a	335	return sk_write(s, data, len);
9c964e85	336	}