X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/d6430b975d14ddbd53c40126fa9d00bea3c2d08b..b3ebaa287b8a57f3d35675889adc86f6384eb458:/ssh.c diff --git a/ssh.c b/ssh.c index 588c8c3e..a2e74c0e 100644 --- a/ssh.c +++ b/ssh.c @@ -166,7 +166,7 @@ static const char *const ssh2_disconnect_reasons[] = { #define translate(x) if (type == x) return #x #define translatec(x,ctx) if (type == x && (pkt_ctx & ctx)) return #x -char *ssh1_pkt_type(int type) +static char *ssh1_pkt_type(int type) { translate(SSH1_MSG_DISCONNECT); translate(SSH1_SMSG_PUBLIC_KEY); @@ -211,7 +211,7 @@ char *ssh1_pkt_type(int type) translate(SSH1_CMSG_AUTH_CCARD_RESPONSE); return "unknown"; } -char *ssh2_pkt_type(int pkt_ctx, int type) +static char *ssh2_pkt_type(int pkt_ctx, int type) { translate(SSH2_MSG_DISCONNECT); translate(SSH2_MSG_IGNORE); @@ -291,22 +291,6 @@ enum { PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM }; typedef struct ssh_tag *Ssh; -extern char *x11_init(Socket *, char *, void *, void *); -extern void x11_close(Socket); -extern int x11_send(Socket, char *, int); -extern void *x11_invent_auth(char *, int, char *, int); -extern void x11_unthrottle(Socket s); -extern void x11_override_throttle(Socket s, int enable); - -extern char *pfd_newconnect(Socket * s, char *hostname, int port, void *c); -extern char *pfd_addforward(char *desthost, int destport, int port, - void *backhandle); -extern void pfd_close(Socket s); -extern int pfd_send(Socket s, char *data, int len); -extern void pfd_confirm(Socket s); -extern void pfd_unthrottle(Socket s); -extern void pfd_override_throttle(Socket s, int enable); - static void ssh2_pkt_init(Ssh, int pkt_type); static void ssh2_pkt_addbool(Ssh, unsigned char value); static void ssh2_pkt_adduint32(Ssh, unsigned long value); @@ -314,7 +298,7 @@ static void ssh2_pkt_addstring_start(Ssh); static void ssh2_pkt_addstring_str(Ssh, char *data); static void ssh2_pkt_addstring_data(Ssh, char *data, int len); static void ssh2_pkt_addstring(Ssh, char *data); -static char *ssh2_mpint_fmt(Bignum b, int *len); +static unsigned char *ssh2_mpint_fmt(Bignum b, int *len); static void ssh2_pkt_addmp(Ssh, Bignum b); static int ssh2_pkt_construct(Ssh); static void ssh2_pkt_send(Ssh); @@ -638,16 +622,10 @@ struct ssh_tag { int (*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen); }; -#define logevent(s) do { \ - logevent(ssh->frontend, s); \ - if ((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)) { \ - fprintf(stderr, "%s\n", s); \ - fflush(stderr); \ - } \ -} while (0) +#define logevent(s) logevent(ssh->frontend, s) /* logevent, only printf-formatted. */ -void logeventf(Ssh ssh, char *fmt, ...) +static void logeventf(Ssh ssh, char *fmt, ...) { va_list ap; char *buf; @@ -656,10 +634,6 @@ void logeventf(Ssh ssh, char *fmt, ...) buf = dupvprintf(fmt, ap); va_end(ap); logevent(buf); - if ((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)) { - fprintf(stderr, "%s\n", buf); - fflush(stderr); - } sfree(buf); } @@ -1225,7 +1199,7 @@ static void s_wrpkt(Ssh ssh) { int len, backlog; len = s_wrpkt_prepare(ssh); - backlog = sk_write(ssh->s, ssh->pktout.data, len); + backlog = sk_write(ssh->s, (char *)ssh->pktout.data, len); if (backlog > SSH_MAX_BACKLOG) ssh_throttle_all(ssh, 1, backlog); } @@ -1271,7 +1245,7 @@ static void construct_packet(Ssh ssh, int pkttype, va_list ap1, va_list ap2) break; case PKT_STR: argp = va_arg(ap1, unsigned char *); - arglen = strlen(argp); + arglen = strlen((char *)argp); pktlen += 4 + arglen; break; case PKT_BIGNUM: @@ -1306,7 +1280,7 @@ static void construct_packet(Ssh ssh, int pkttype, va_list ap1, va_list ap2) break; case PKT_STR: argp = va_arg(ap2, unsigned char *); - arglen = strlen(argp); + arglen = strlen((char *)argp); PUT_32BIT(p, arglen); memcpy(p + 4, argp, arglen); p += 4 + arglen; @@ -1437,7 +1411,7 @@ static void ssh2_pkt_addstring(Ssh ssh, char *data) ssh2_pkt_addstring_start(ssh); ssh2_pkt_addstring_str(ssh, data); } -static char *ssh2_mpint_fmt(Bignum b, int *len) +static unsigned char *ssh2_mpint_fmt(Bignum b, int *len) { unsigned char *p; int i, n = (bignum_bitcount(b) + 7) / 8; @@ -1460,7 +1434,7 @@ static void ssh2_pkt_addmp(Ssh ssh, Bignum b) int len; p = ssh2_mpint_fmt(b, &len); ssh2_pkt_addstring_start(ssh); - ssh2_pkt_addstring_data(ssh, p, len); + ssh2_pkt_addstring_data(ssh, (char *)p, len); sfree(p); } @@ -1531,7 +1505,7 @@ static void ssh2_pkt_send(Ssh ssh) int len; int backlog; len = ssh2_pkt_construct(ssh); - backlog = sk_write(ssh->s, ssh->pktout.data, len); + backlog = sk_write(ssh->s, (char *)ssh->pktout.data, len); if (backlog > SSH_MAX_BACKLOG) ssh_throttle_all(ssh, 1, backlog); } @@ -1566,7 +1540,8 @@ static void ssh2_pkt_defer(Ssh ssh) static void ssh_pkt_defersend(Ssh ssh) { int backlog; - backlog = sk_write(ssh->s, ssh->deferred_send_data, ssh->deferred_len); + backlog = sk_write(ssh->s, (char *)ssh->deferred_send_data, + ssh->deferred_len); ssh->deferred_len = ssh->deferred_size = 0; sfree(ssh->deferred_send_data); ssh->deferred_send_data = NULL; @@ -1632,7 +1607,7 @@ static void ssh2_pkt_getstring(Ssh ssh, char **p, int *length) ssh->pktin.savedpos += 4; if (ssh->pktin.length - ssh->pktin.savedpos < *length) return; - *p = ssh->pktin.data + ssh->pktin.savedpos; + *p = (char *)(ssh->pktin.data + ssh->pktin.savedpos); ssh->pktin.savedpos += *length; } static Bignum ssh2_pkt_getmp(Ssh ssh) @@ -1648,7 +1623,7 @@ static Bignum ssh2_pkt_getmp(Ssh ssh) bombout((ssh,"internal error: Can't handle negative mpints")); return NULL; } - b = bignum_from_bytes(p, length); + b = bignum_from_bytes((unsigned char *)p, length); return b; } @@ -1698,18 +1673,18 @@ static void ssh2_add_sigblob(Ssh ssh, void *pkblob_v, int pkblob_len, if (len != siglen) { unsigned char newlen[4]; ssh2_pkt_addstring_start(ssh); - ssh2_pkt_addstring_data(ssh, sigblob, pos); + ssh2_pkt_addstring_data(ssh, (char *)sigblob, pos); /* dmemdump(sigblob, pos); */ pos += 4; /* point to start of actual sig */ PUT_32BIT(newlen, len); - ssh2_pkt_addstring_data(ssh, newlen, 4); + ssh2_pkt_addstring_data(ssh, (char *)newlen, 4); /* dmemdump(newlen, 4); */ newlen[0] = 0; while (len-- > siglen) { - ssh2_pkt_addstring_data(ssh, newlen, 1); + ssh2_pkt_addstring_data(ssh, (char *)newlen, 1); /* dmemdump(newlen, 1); */ } - ssh2_pkt_addstring_data(ssh, sigblob+pos, siglen); + ssh2_pkt_addstring_data(ssh, (char *)(sigblob+pos), siglen); /* dmemdump(sigblob+pos, siglen); */ return; } @@ -1718,7 +1693,7 @@ static void ssh2_add_sigblob(Ssh ssh, void *pkblob_v, int pkblob_len, } ssh2_pkt_addstring_start(ssh); - ssh2_pkt_addstring_data(ssh, sigblob, sigblob_len); + ssh2_pkt_addstring_data(ssh, (char *)sigblob, sigblob_len); } /* @@ -1869,7 +1844,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c) s->i = -1; } else if (s->i < sizeof(s->version) - 1) s->version[s->i++] = c; - } else if (c == '\n') + } else if (c == '\012') break; } @@ -1919,7 +1894,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c) sha_string(&ssh->exhashbase, s->vstring, strcspn(s->vstring, "\r\n")); sprintf(vlog, "We claim version: %s", verstring); logevent(vlog); - strcat(verstring, "\n"); + strcat(verstring, "\012"); logevent("Using SSH protocol version 2"); sk_write(ssh->s, verstring, strlen(verstring)); ssh->protocol = ssh2_protocol; @@ -1935,7 +1910,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c) sshver); sprintf(vlog, "We claim version: %s", verstring); logevent(vlog); - strcat(verstring, "\n"); + strcat(verstring, "\012"); logevent("Using SSH protocol version 1"); sk_write(ssh->s, verstring, strlen(verstring)); @@ -2018,7 +1993,7 @@ static int ssh_closing(Plug plug, char *error_msg, int error_code, static int ssh_receive(Plug plug, int urgent, char *data, int len) { Ssh ssh = (Ssh) plug; - ssh_gotdata(ssh, data, len); + ssh_gotdata(ssh, (unsigned char *)data, len); if (ssh->state == SSH_STATE_CLOSED) { if (ssh->s) { sk_close(ssh->s); @@ -2072,8 +2047,8 @@ static char *connect_to_host(Ssh ssh, char *host, int port, * Try to find host. */ logeventf(ssh, "Looking up host \"%s\"", host); - addr = sk_namelookup(host, realhost); - if ((err = sk_addr_error(addr))) + addr = name_lookup(host, port, realhost); + if ((err = sk_addr_error(addr)) != NULL) return err; /* @@ -2086,7 +2061,7 @@ static char *connect_to_host(Ssh ssh, char *host, int port, } ssh->fn = &fn_table; ssh->s = new_connection(addr, *realhost, port, 0, 1, nodelay, (Plug) ssh); - if ((err = sk_socket_error(ssh->s))) { + if ((err = sk_socket_error(ssh->s)) != NULL) { ssh->s = NULL; return err; } @@ -2150,7 +2125,7 @@ static void ssh_throttle_all(Ssh ssh, int enable, int bufsize) */ /* Set up a username or password input loop on a given buffer. */ -void setup_userpass_input(Ssh ssh, char *buffer, int buflen, int echo) +static void setup_userpass_input(Ssh ssh, char *buffer, int buflen, int echo) { ssh->userpass_input_buffer = buffer; ssh->userpass_input_buflen = buflen; @@ -2164,7 +2139,7 @@ void setup_userpass_input(Ssh ssh, char *buffer, int buflen, int echo) * buffer), <0 for failure (user hit ^C/^D, bomb out and exit), 0 * for inconclusive (keep waiting for more input please). */ -int process_userpass_input(Ssh ssh, unsigned char *in, int inlen) +static int process_userpass_input(Ssh ssh, unsigned char *in, int inlen) { char c; @@ -2525,7 +2500,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt) s->p += ssh1_read_bignum(s->p, &s->key.modulus); s->commentlen = GET_32BIT(s->p); s->p += 4; - s->commentp = s->p; + s->commentp = (char *)s->p; s->p += s->commentlen; send_packet(ssh, SSH1_CMSG_AUTH_RSA, PKT_BIGNUM, s->key.modulus, PKT_END); @@ -3043,11 +3018,13 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) char proto[20], data[64]; logevent("Requesting X11 forwarding"); ssh->x11auth = x11_invent_auth(proto, sizeof(proto), - data, sizeof(data)); + data, sizeof(data), cfg.x11_auth); + x11_get_real_auth(ssh->x11auth, cfg.x11_display); if (ssh->v1_local_protoflags & SSH1_PROTOFLAG_SCREEN_NUMBER) { send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING, PKT_STR, proto, PKT_STR, data, - PKT_INT, 0, PKT_END); + PKT_INT, x11_get_screen_number(cfg.x11_display), + PKT_END); } else { send_packet(ssh, SSH1_CMSG_X11_REQUEST_FORWARDING, PKT_STR, proto, PKT_STR, data, PKT_END); @@ -3071,28 +3048,46 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) char type; int n; int sport,dport,sserv,dserv; - char sports[256], dports[256], host[256]; + char sports[256], dports[256], saddr[256], host[256]; ssh->rportfwds = newtree234(ssh_rportcmp_ssh1); /* Add port forwardings. */ ssh->portfwd_strptr = cfg.portfwd; while (*ssh->portfwd_strptr) { type = *ssh->portfwd_strptr++; + saddr[0] = '\0'; n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') - sports[n++] = *ssh->portfwd_strptr++; + while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') { + if (*ssh->portfwd_strptr == ':') { + /* + * We've seen a colon in the middle of the + * source port number. This means that + * everything we've seen until now is the + * source _address_, so we'll move it into + * saddr and start sports from the beginning + * again. + */ + ssh->portfwd_strptr++; + sports[n] = '\0'; + strcpy(saddr, sports); + n = 0; + } + if (n < 255) sports[n++] = *ssh->portfwd_strptr++; + } sports[n] = 0; if (*ssh->portfwd_strptr == '\t') ssh->portfwd_strptr++; n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') - host[n++] = *ssh->portfwd_strptr++; + while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') { + if (n < 255) host[n++] = *ssh->portfwd_strptr++; + } host[n] = 0; if (*ssh->portfwd_strptr == ':') ssh->portfwd_strptr++; n = 0; - while (*ssh->portfwd_strptr) - dports[n++] = *ssh->portfwd_strptr++; + while (*ssh->portfwd_strptr) { + if (n < 255) dports[n++] = *ssh->portfwd_strptr++; + } dports[n] = 0; ssh->portfwd_strptr++; dport = atoi(dports); @@ -3117,9 +3112,12 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) } if (sport && dport) { if (type == 'L') { - pfd_addforward(host, dport, sport, ssh); - logeventf(ssh, "Local port %.*s%.*s%d%.*s forwarding to" - " %s:%.*s%.*s%d%.*s", + pfd_addforward(host, dport, *saddr ? saddr : NULL, + sport, ssh); + logeventf(ssh, "Local port %.*s%.*s%.*s%.*s%d%.*s" + " forwarding to %s:%.*s%.*s%d%.*s", + (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL, + (int)(*saddr?1:0), ":", (int)(sserv ? strlen(sports) : 0), sports, sserv, "(", sport, sserv, ")", host, @@ -3130,6 +3128,11 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) pf = smalloc(sizeof(*pf)); strcpy(pf->dhost, host); pf->dport = dport; + if (saddr) { + logeventf(ssh, + "SSH1 cannot handle source address spec \"%s:%d\"; ignoring", + saddr, sport); + } if (add234(ssh->rportfwds, pf) != pf) { logeventf(ssh, "Duplicate remote port forwarding to %s:%d", @@ -3249,7 +3252,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) int bufsize = from_backend(ssh->frontend, ssh->pktin.type == SSH1_SMSG_STDERR_DATA, - ssh->pktin.body + 4, len); + (char *)(ssh->pktin.body) + 4, len); if (!ssh->v1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) { ssh->v1_stdout_throttling = 1; ssh1_throttle(ssh, +1); @@ -3274,7 +3277,7 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) c->ssh = ssh; if (x11_init(&c->u.x11.s, cfg.x11_display, c, - ssh->x11auth) != NULL) { + ssh->x11auth, NULL, -1) != NULL) { logevent("opening X11 forward connection failed"); sfree(c); send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE, @@ -3330,7 +3333,8 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) c->ssh = ssh; hostsize = GET_32BIT(ssh->pktin.body+4); - for(h = host, p = ssh->pktin.body+8; hostsize != 0; hostsize--) { + for (h = host, p = (char *)(ssh->pktin.body+8); + hostsize != 0; hostsize--) { if (h+1 < host+sizeof(host)) *h++ = *p; p++; @@ -3462,10 +3466,10 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt) int bufsize; switch (c->type) { case CHAN_X11: - bufsize = x11_send(c->u.x11.s, p, len); + bufsize = x11_send(c->u.x11.s, (char *)p, len); break; case CHAN_SOCKDATA: - bufsize = pfd_send(c->u.pfd.s, p, len); + bufsize = pfd_send(c->u.pfd.s, (char *)p, len); break; case CHAN_AGENT: /* Data for an agent message. Buffer it. */ @@ -3599,8 +3603,9 @@ static int in_commasep_string(char *needle, char *haystack, int haylen) /* * SSH2 key creation method. */ -static void ssh2_mkkey(Ssh ssh, Bignum K, char *H, char *sessid, char chr, - char *keyspace) +static void ssh2_mkkey(Ssh ssh, Bignum K, unsigned char *H, + unsigned char *sessid, char chr, + unsigned char *keyspace) { SHA_State s; /* First 20 bytes. */ @@ -4026,7 +4031,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt) s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen); if (!s->hkey || !ssh->hostkey->verifysig(s->hkey, s->sigdata, s->siglen, - s->exchange_hash, 20)) { + (char *)s->exchange_hash, 20)) { bombout((ssh,"Server's host key did not match the signature supplied")); crReturn(0); } @@ -4564,13 +4569,13 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) logevent("This key matches configured key file"); s->tried_pubkey_config = 1; } - s->pkblob = s->p; + s->pkblob = (char *)s->p; s->p += s->pklen; s->alglen = GET_32BIT(s->pkblob); s->alg = s->pkblob + 4; s->commentlen = GET_32BIT(s->p); s->p += 4; - s->commentp = s->p; + s->commentp = (char *)s->p; s->p += s->commentlen; ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_REQUEST); ssh2_pkt_addstring(ssh, s->username); @@ -4676,8 +4681,10 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) * First, offer the public blob to see if the server is * willing to accept it. */ - pub_blob = ssh2_userkey_loadpub(cfg.keyfile, &algorithm, - &pub_blob_len); + pub_blob = + (unsigned char *)ssh2_userkey_loadpub(cfg.keyfile, + &algorithm, + &pub_blob_len); if (pub_blob) { ssh2_pkt_init(ssh, SSH2_MSG_USERAUTH_REQUEST); ssh2_pkt_addstring(ssh, s->username); @@ -4686,7 +4693,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh2_pkt_addbool(ssh, FALSE); /* no signature included */ ssh2_pkt_addstring(ssh, algorithm); ssh2_pkt_addstring_start(ssh); - ssh2_pkt_addstring_data(ssh, pub_blob, pub_blob_len); + ssh2_pkt_addstring_data(ssh, (char *)pub_blob, + pub_blob_len); ssh2_pkt_send(ssh); logevent("Offered public key"); /* FIXME */ @@ -4887,7 +4895,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh2_pkt_addstring(ssh, key->alg->name); pkblob = key->alg->public_blob(key->data, &pkblob_len); ssh2_pkt_addstring_start(ssh); - ssh2_pkt_addstring_data(ssh, pkblob, pkblob_len); + ssh2_pkt_addstring_data(ssh, (char *)pkblob, pkblob_len); /* * The data to be signed is: @@ -4903,7 +4911,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) memcpy(sigdata + 4, ssh->v2_session_id, 20); memcpy(sigdata + 24, ssh->pktout.data + 5, ssh->pktout.length - 5); - sigblob = key->alg->sign(key->data, sigdata, + sigblob = key->alg->sign(key->data, (char *)sigdata, sigdata_len, &sigblob_len); ssh2_add_sigblob(ssh, pkblob, pkblob_len, sigblob, sigblob_len); @@ -4935,6 +4943,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh2_pkt_addstring(ssh, "password"); ssh2_pkt_addbool(ssh, FALSE); ssh2_pkt_addstring(ssh, s->password); + memset(s->password, 0, sizeof(s->password)); ssh2_pkt_defer(ssh); /* * We'll include a string that's an exact multiple of the @@ -5059,7 +5068,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) char proto[20], data[64]; logevent("Requesting X11 forwarding"); ssh->x11auth = x11_invent_auth(proto, sizeof(proto), - data, sizeof(data)); + data, sizeof(data), cfg.x11_auth); + x11_get_real_auth(ssh->x11auth, cfg.x11_display); ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST); ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid); ssh2_pkt_addstring(ssh, "x11-req"); @@ -5067,7 +5077,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh2_pkt_addbool(ssh, 0); /* many connections */ ssh2_pkt_addstring(ssh, proto); ssh2_pkt_addstring(ssh, data); - ssh2_pkt_adduint32(ssh, 0); /* screen number */ + ssh2_pkt_adduint32(ssh, x11_get_screen_number(cfg.x11_display)); ssh2_pkt_send(ssh); do { @@ -5102,28 +5112,46 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) char type; int n; int sport,dport,sserv,dserv; - char sports[256], dports[256], host[256]; + char sports[256], dports[256], saddr[256], host[256]; ssh->rportfwds = newtree234(ssh_rportcmp_ssh2); /* Add port forwardings. */ ssh->portfwd_strptr = cfg.portfwd; while (*ssh->portfwd_strptr) { type = *ssh->portfwd_strptr++; + saddr[0] = '\0'; n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') - sports[n++] = *ssh->portfwd_strptr++; + while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != '\t') { + if (*ssh->portfwd_strptr == ':') { + /* + * We've seen a colon in the middle of the + * source port number. This means that + * everything we've seen until now is the + * source _address_, so we'll move it into + * saddr and start sports from the beginning + * again. + */ + ssh->portfwd_strptr++; + sports[n] = '\0'; + strcpy(saddr, sports); + n = 0; + } + if (n < 255) sports[n++] = *ssh->portfwd_strptr++; + } sports[n] = 0; if (*ssh->portfwd_strptr == '\t') ssh->portfwd_strptr++; n = 0; - while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') - host[n++] = *ssh->portfwd_strptr++; + while (*ssh->portfwd_strptr && *ssh->portfwd_strptr != ':') { + if (n < 255) host[n++] = *ssh->portfwd_strptr++; + } host[n] = 0; if (*ssh->portfwd_strptr == ':') ssh->portfwd_strptr++; n = 0; - while (*ssh->portfwd_strptr) - dports[n++] = *ssh->portfwd_strptr++; + while (*ssh->portfwd_strptr) { + if (n < 255) dports[n++] = *ssh->portfwd_strptr++; + } dports[n] = 0; ssh->portfwd_strptr++; dport = atoi(dports); @@ -5148,9 +5176,12 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) } if (sport && dport) { if (type == 'L') { - pfd_addforward(host, dport, sport, ssh); - logeventf(ssh, "Local port %.*s%.*s%d%.*s forwarding to" - " %s:%.*s%.*s%d%.*s", + pfd_addforward(host, dport, *saddr ? saddr : NULL, + sport, ssh); + logeventf(ssh, "Local port %.*s%.*s%.*s%.*s%d%.*s" + " forwarding to %s:%.*s%.*s%d%.*s", + (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL, + (int)(*saddr?1:0), ":", (int)(sserv ? strlen(sports) : 0), sports, sserv, "(", sport, sserv, ")", host, @@ -5167,8 +5198,12 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) " to %s:%d", host, dport); sfree(pf); } else { - logeventf(ssh, "Requesting remote port %.*s%.*s%d%.*s" + logeventf(ssh, "Requesting remote port " + "%.*s%.*s%.*s%.*s%d%.*s" " forward to %s:%.*s%.*s%d%.*s", + (int)(*saddr?strlen(saddr):0), + *saddr?saddr:NULL, + (int)(*saddr?1:0), ":", (int)(sserv ? strlen(sports) : 0), sports, sserv, "(", sport, sserv, ")", host, @@ -5177,6 +5212,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) ssh2_pkt_init(ssh, SSH2_MSG_GLOBAL_REQUEST); ssh2_pkt_addstring(ssh, "tcpip-forward"); ssh2_pkt_addbool(ssh, 1);/* want reply */ + if (*saddr) + ssh2_pkt_addstring(ssh, saddr); if (cfg.rport_acceptall) ssh2_pkt_addstring(ssh, "0.0.0.0"); else @@ -5552,8 +5589,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) unsigned i = ssh2_pkt_getuint32(ssh); struct ssh_channel *c; c = find234(ssh->channels, &i, ssh_channelfind); - if (!c) - continue; /* nonexistent channel */ + if (!c || c->closes) + continue; /* nonexistent or closing channel */ c->v.v2.remwindow += ssh2_pkt_getuint32(ssh); s->try_send = TRUE; } else if (ssh->pktin.type == SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) { @@ -5677,6 +5714,9 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) } else if (ssh->pktin.type == SSH2_MSG_CHANNEL_OPEN) { char *type; int typelen; + char *peeraddr; + int peeraddrlen; + int port; char *error = NULL; struct ssh_channel *c; unsigned remid, winsize, pktsize; @@ -5687,16 +5727,24 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) remid = ssh2_pkt_getuint32(ssh); winsize = ssh2_pkt_getuint32(ssh); pktsize = ssh2_pkt_getuint32(ssh); + ssh2_pkt_getstring(ssh, &peeraddr, &peeraddrlen); + port = ssh2_pkt_getuint32(ssh); if (typelen == 3 && !memcmp(type, "x11", 3)) { + char *addrstr = smalloc(peeraddrlen+1); + memcpy(addrstr, peeraddr, peeraddrlen); + peeraddr[peeraddrlen] = '\0'; + if (!ssh->X11_fwd_enabled) error = "X11 forwarding is not enabled"; else if (x11_init(&c->u.x11.s, cfg.x11_display, c, - ssh->x11auth) != NULL) { + ssh->x11auth, addrstr, port) != NULL) { error = "Unable to open an X11 connection"; } else { c->type = CHAN_X11; } + + sfree(addrstr); } else if (typelen == 15 && !memcmp(type, "forwarded-tcpip", 15)) { struct ssh_rportfwd pf, *realpf; @@ -5764,7 +5812,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) /* * We have spare data. Add it to the channel buffer. */ - ssh2_add_channel_data(ssh->mainchan, in, inlen); + ssh2_add_channel_data(ssh->mainchan, (char *)in, inlen); s->try_send = TRUE; } if (s->try_send) { @@ -5774,7 +5822,10 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt) * Try to send data on all channels if we can. */ for (i = 0; NULL != (c = index234(ssh->channels, i)); i++) { - int bufsize = ssh2_try_send(c); + int bufsize; + if (c->closes) + continue; /* don't send on closing channels */ + bufsize = ssh2_try_send(c); if (bufsize == 0) { switch (c->type) { case CHAN_MAINSESSION: @@ -5892,6 +5943,8 @@ static char *ssh_init(void *frontend_handle, void **backend_handle, ssh->overall_bufsize = 0; ssh->fallback_cmd = 0; + ssh->protocol = NULL; + p = connect_to_host(ssh, host, port, realhost, nodelay); if (p != NULL) return p; @@ -5909,7 +5962,7 @@ static int ssh_send(void *handle, char *buf, int len) if (ssh == NULL || ssh->s == NULL || ssh->protocol == NULL) return 0; - ssh->protocol(ssh, buf, len, 0); + ssh->protocol(ssh, (unsigned char *)buf, len, 0); return ssh_sendbuffer(ssh); } @@ -6053,7 +6106,7 @@ void *new_sock_channel(void *handle, Socket s) * This is called when stdout/stderr (the entity to which * from_backend sends data) manages to clear some backlog. */ -void ssh_unthrottle(void *handle, int bufsize) +static void ssh_unthrottle(void *handle, int bufsize) { Ssh ssh = (Ssh) handle; if (ssh->version == 1) {