35 #include "openbsd-compat/sys-queue.h"
45  * SSH Protocol 1.5 aka New Channel Protocol
52  * 1.3:	strict request-ack-protocol:
53  *	CLOSE	->
54  *		<-  CLOSE_CONFIRM
57  *	IEOF	->
58  *		<-  OCLOSE
59  *		<-  IEOF
60  *	OCLOSE	->
61  *	i.e. both sides have to close the channel
65  * See the debugging output from 'ssh -v' and 'sshd -d' of
66  * ssh-1.2.27 as an example.
70 /* functions manipulating channel states */
72  * EVENTS update channel input/output states execute ACTIONS
75  * ACTIONS: should never update the channel states
77 static void	chan_send_eof2(struct ssh *, Channel *);
78 static void	chan_send_eow2(struct ssh *, Channel *);
81 static void	chan_shutdown_write(struct ssh *, Channel *);
82 static void	chan_shutdown_read(struct ssh *, Channel *);
83 static void	chan_shutdown_extended_read(struct ssh *, Channel *);
93 chan_set_istate(Channel *c, u_int next)  in chan_set_istate()
95 	if (c->istate > CHAN_INPUT_CLOSED || next > CHAN_INPUT_CLOSED)  in chan_set_istate()
96 		fatal("chan_set_istate: bad state %d -> %d", c->istate, next);  in chan_set_istate()
97 	debug2("channel %d: input %s -> %s", c->self, istates[c->istate],  in chan_set_istate()
99 	c->istate = next;  in chan_set_istate()
103 chan_set_ostate(Channel *c, u_int next)  in chan_set_ostate()
105 	if (c->ostate > CHAN_OUTPUT_CLOSED || next > CHAN_OUTPUT_CLOSED)  in chan_set_ostate()
106 		fatal("chan_set_ostate: bad state %d -> %d", c->ostate, next);  in chan_set_ostate()
107 	debug2("channel %d: output %s -> %s", c->self, ostates[c->ostate],  in chan_set_ostate()
109 	c->ostate = next;  in chan_set_ostate()
113 chan_read_failed(struct ssh *ssh, Channel *c)  in chan_read_failed()
115 	debug2("channel %d: read failed", c->self);  in chan_read_failed()
116 	switch (c->istate) {  in chan_read_failed()
122 		error("channel %d: chan_read_failed for istate %d",  in chan_read_failed()
123 		    c->self, c->istate);  in chan_read_failed()
129 chan_ibuf_empty(struct ssh *ssh, Channel *c)  in chan_ibuf_empty()
131 	debug2("channel %d: ibuf empty", c->self);  in chan_ibuf_empty()
132 	if (sshbuf_len(c->input)) {  in chan_ibuf_empty()
133 		error("channel %d: chan_ibuf_empty for non empty buffer",  in chan_ibuf_empty()
134 		    c->self);  in chan_ibuf_empty()
137 	switch (c->istate) {  in chan_ibuf_empty()
139 		if (!(c->flags & (CHAN_CLOSE_SENT|CHAN_LOCAL)))  in chan_ibuf_empty()
144 		error("channel %d: chan_ibuf_empty for istate %d",  in chan_ibuf_empty()
145 		    c->self, c->istate);  in chan_ibuf_empty()
151 chan_obuf_empty(struct ssh *ssh, Channel *c)  in chan_obuf_empty()
153 	debug2("channel %d: obuf empty", c->self);  in chan_obuf_empty()
154 	if (sshbuf_len(c->output)) {  in chan_obuf_empty()
155 		error("channel %d: chan_obuf_empty for non empty buffer",  in chan_obuf_empty()
156 		    c->self);  in chan_obuf_empty()
159 	switch (c->ostate) {  in chan_obuf_empty()
165 		error("channel %d: internal error: obuf_empty for ostate %d",  in chan_obuf_empty()
166 		    c->self, c->ostate);  in chan_obuf_empty()
172 chan_rcvd_eow(struct ssh *ssh, Channel *c)  in chan_rcvd_eow()
174 	debug2("channel %d: rcvd eow", c->self);  in chan_rcvd_eow()
175 	switch (c->istate) {  in chan_rcvd_eow()
184 chan_send_eof2(struct ssh *ssh, Channel *c)  in chan_send_eof2()
188 	debug2("channel %d: send eof", c->self);  in chan_send_eof2()
189 	switch (c->istate) {  in chan_send_eof2()
191 		if (!c->have_remote_id)  in chan_send_eof2()
192 			fatal_f("channel %d: no remote_id", c->self);  in chan_send_eof2()
193 		if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_EOF)) != 0 ||  in chan_send_eof2()
194 		    (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||  in chan_send_eof2()
195 		    (r = sshpkt_send(ssh)) != 0)  in chan_send_eof2()
197 		c->flags |= CHAN_EOF_SENT;  in chan_send_eof2()
200 		error("channel %d: cannot send eof for istate %d",  in chan_send_eof2()
201 		    c->self, c->istate);  in chan_send_eof2()
207 chan_send_close2(struct ssh *ssh, Channel *c)  in chan_send_close2()
211 	debug2("channel %d: send close", c->self);  in chan_send_close2()
212 	if (c->ostate != CHAN_OUTPUT_CLOSED ||  in chan_send_close2()
213 	    c->istate != CHAN_INPUT_CLOSED) {  in chan_send_close2()
214 		error("channel %d: cannot send close for istate/ostate %d/%d",  in chan_send_close2()
215 		    c->self, c->istate, c->ostate);  in chan_send_close2()
216 	} else if (c->flags & CHAN_CLOSE_SENT) {  in chan_send_close2()
217 		error("channel %d: already sent close", c->self);  in chan_send_close2()
219 		if (!c->have_remote_id)  in chan_send_close2()
220 			fatal_f("channel %d: no remote_id", c->self);  in chan_send_close2()
221 		if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_CLOSE)) != 0 ||  in chan_send_close2()
222 		    (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||  in chan_send_close2()
223 		    (r = sshpkt_send(ssh)) != 0)  in chan_send_close2()
225 		c->flags |= CHAN_CLOSE_SENT;  in chan_send_close2()
230 chan_send_eow2(struct ssh *ssh, Channel *c)  in chan_send_eow2()
234 	debug2("channel %d: send eow", c->self);  in chan_send_eow2()
235 	if (c->ostate == CHAN_OUTPUT_CLOSED) {  in chan_send_eow2()
236 		error("channel %d: must not sent eow on closed output",  in chan_send_eow2()
237 		    c->self);  in chan_send_eow2()
240 	if (!(ssh->compat & SSH_NEW_OPENSSH))  in chan_send_eow2()
242 	if (!c->have_remote_id)  in chan_send_eow2()
243 		fatal_f("channel %d: no remote_id", c->self);  in chan_send_eow2()
244 	if ((r = sshpkt_start(ssh, SSH2_MSG_CHANNEL_REQUEST)) != 0 ||  in chan_send_eow2()
245 	    (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||  in chan_send_eow2()
246 	    (r = sshpkt_put_cstring(ssh, "eow@openssh.com")) != 0 ||  in chan_send_eow2()
247 	    (r = sshpkt_put_u8(ssh, 0)) != 0 ||  in chan_send_eow2()
248 	    (r = sshpkt_send(ssh)) != 0)  in chan_send_eow2()
255 chan_rcvd_ieof(struct ssh *ssh, Channel *c)  in chan_rcvd_ieof()
257 	debug2("channel %d: rcvd eof", c->self);  in chan_rcvd_ieof()
258 	c->flags |= CHAN_EOF_RCVD;  in chan_rcvd_ieof()
259 	if (c->ostate == CHAN_OUTPUT_OPEN)  in chan_rcvd_ieof()
261 	if (c->ostate == CHAN_OUTPUT_WAIT_DRAIN &&  in chan_rcvd_ieof()
262 	    sshbuf_len(c->output) == 0 &&  in chan_rcvd_ieof()
268 chan_rcvd_oclose(struct ssh *ssh, Channel *c)  in chan_rcvd_oclose()
270 	debug2("channel %d: rcvd close", c->self);  in chan_rcvd_oclose()
271 	if (!(c->flags & CHAN_LOCAL)) {  in chan_rcvd_oclose()
272 		if (c->flags & CHAN_CLOSE_RCVD)  in chan_rcvd_oclose()
273 			error("channel %d: protocol error: close rcvd twice",  in chan_rcvd_oclose()
274 			    c->self);  in chan_rcvd_oclose()
275 		c->flags |= CHAN_CLOSE_RCVD;  in chan_rcvd_oclose()
277 	if (c->type == SSH_CHANNEL_LARVAL) {  in chan_rcvd_oclose()
283 	switch (c->ostate) {  in chan_rcvd_oclose()
286 		 * wait until a data from the channel is consumed if a CLOSE  in chan_rcvd_oclose()
292 	switch (c->istate) {  in chan_rcvd_oclose()
299 		if (!(c->flags & CHAN_LOCAL))  in chan_rcvd_oclose()
308 chan_write_failed(struct ssh *ssh, Channel *c)  in chan_write_failed()
310 	debug2("channel %d: write failed", c->self);  in chan_write_failed()
311 	switch (c->ostate) {  in chan_write_failed()
315 		if (strcmp(c->ctype, "session") == 0)  in chan_write_failed()
320 		error("channel %d: chan_write_failed for ostate %d",  in chan_write_failed()
321 		    c->self, c->ostate);  in chan_write_failed()
327 chan_mark_dead(struct ssh *ssh, Channel *c)  in chan_mark_dead()
329 	c->type = SSH_CHANNEL_ZOMBIE;  in chan_mark_dead()
333 chan_is_dead(struct ssh *ssh, Channel *c, int do_send)  in chan_is_dead()
335 	if (c->type == SSH_CHANNEL_ZOMBIE) {  in chan_is_dead()
336 		debug2("channel %d: zombie", c->self);  in chan_is_dead()
339 	if (c->istate != CHAN_INPUT_CLOSED || c->ostate != CHAN_OUTPUT_CLOSED)  in chan_is_dead()
340 		return 0;  in chan_is_dead()
341 	if ((ssh->compat & SSH_BUG_EXTEOF) &&  in chan_is_dead()
342 	    c->extended_usage == CHAN_EXTENDED_WRITE &&  in chan_is_dead()
343 	    c->efd != -1 &&  in chan_is_dead()
344 	    sshbuf_len(c->extended) > 0) {  in chan_is_dead()
345 		debug2("channel %d: active efd: %d len %zu",  in chan_is_dead()
346 		    c->self, c->efd, sshbuf_len(c->extended));  in chan_is_dead()
347 		return 0;  in chan_is_dead()
349 	if (c->flags & CHAN_LOCAL) {  in chan_is_dead()
350 		debug2("channel %d: is dead (local)", c->self);  in chan_is_dead()
353 	if (!(c->flags & CHAN_CLOSE_SENT)) {  in chan_is_dead()
357 			/* channel would be dead if we sent a close */  in chan_is_dead()
358 			if (c->flags & CHAN_CLOSE_RCVD) {  in chan_is_dead()
359 				debug2("channel %d: almost dead",  in chan_is_dead()
360 				    c->self);  in chan_is_dead()
365 	if ((c->flags & CHAN_CLOSE_SENT) &&  in chan_is_dead()
366 	    (c->flags & CHAN_CLOSE_RCVD)) {  in chan_is_dead()
367 		debug2("channel %d: is dead", c->self);  in chan_is_dead()
370 	return 0;  in chan_is_dead()
375 chan_shutdown_write(struct ssh *ssh, Channel *c)  in chan_shutdown_write()
377 	sshbuf_reset(c->output);  in chan_shutdown_write()
378 	if (c->type == SSH_CHANNEL_LARVAL)  in chan_shutdown_write()
381 	debug2_f("channel %d: (i%d o%d sock %d wfd %d efd %d [%s])",  in chan_shutdown_write()
382 	    c->self, c->istate, c->ostate, c->sock, c->wfd, c->efd,  in chan_shutdown_write()
384 	if (c->sock != -1) {  in chan_shutdown_write()
385 		if (shutdown(c->sock, SHUT_WR) == -1) {  in chan_shutdown_write()
386 			debug2_f("channel %d: shutdown() failed for "  in chan_shutdown_write()
387 			    "fd %d [i%d o%d]: %.100s", c->self, c->sock,  in chan_shutdown_write()
388 			    c->istate, c->ostate, strerror(errno));  in chan_shutdown_write()
391 		if (channel_close_fd(ssh, c, &c->wfd) < 0) {  in chan_shutdown_write()
392 			logit_f("channel %d: close() failed for "  in chan_shutdown_write()
393 			    "fd %d [i%d o%d]: %.100s", c->self, c->wfd,  in chan_shutdown_write()
394 			    c->istate, c->ostate, strerror(errno));  in chan_shutdown_write()
400 chan_shutdown_read(struct ssh *ssh, Channel *c)  in chan_shutdown_read()
402 	if (c->type == SSH_CHANNEL_LARVAL)  in chan_shutdown_read()
404 	debug2_f("channel %d: (i%d o%d sock %d wfd %d efd %d [%s])",  in chan_shutdown_read()
405 	    c->self, c->istate, c->ostate, c->sock, c->rfd, c->efd,  in chan_shutdown_read()
407 	if (c->sock != -1) {  in chan_shutdown_read()
411 		 * HP-UX may return ENOTCONN also.  in chan_shutdown_read()
413 		if (shutdown(c->sock, SHUT_RD) == -1 && errno != ENOTCONN) {  in chan_shutdown_read()
414 			error_f("channel %d: shutdown() failed for "  in chan_shutdown_read()
415 			    "fd %d [i%d o%d]: %.100s", c->self, c->sock,  in chan_shutdown_read()
416 			    c->istate, c->ostate, strerror(errno));  in chan_shutdown_read()
419 		if (channel_close_fd(ssh, c, &c->rfd) < 0) {  in chan_shutdown_read()
420 			logit_f("channel %d: close() failed for "  in chan_shutdown_read()
421 			    "fd %d [i%d o%d]: %.100s", c->self, c->rfd,  in chan_shutdown_read()
422 			    c->istate, c->ostate, strerror(errno));  in chan_shutdown_read()
428 chan_shutdown_extended_read(struct ssh *ssh, Channel *c)  in chan_shutdown_extended_read()
430 	if (c->type == SSH_CHANNEL_LARVAL || c->efd == -1)  in chan_shutdown_extended_read()
432 	if (c->extended_usage != CHAN_EXTENDED_READ &&  in chan_shutdown_extended_read()
433 	    c->extended_usage != CHAN_EXTENDED_IGNORE)  in chan_shutdown_extended_read()
435 	debug_f("channel %d: (i%d o%d sock %d wfd %d efd %d [%s])",  in chan_shutdown_extended_read()
436 	    c->self, c->istate, c->ostate, c->sock, c->rfd, c->efd,  in chan_shutdown_extended_read()
438 	if (channel_close_fd(ssh, c, &c->efd) < 0) {  in chan_shutdown_extended_read()
439 		logit_f("channel %d: close() failed for "  in chan_shutdown_extended_read()
440 		    "extended fd %d [i%d o%d]: %.100s", c->self, c->efd,  in chan_shutdown_extended_read()
441 		    c->istate, c->ostate, strerror(errno));  in chan_shutdown_extended_read()