62 #include "openbsd-compat/sys-queue.h"
80 #include "auth-options.h"
146 	if ((channel_id = channel_find_open(ssh)) == -1) {  in client_alive_check()
148 		    (r = sshpkt_put_cstring(ssh, "keepalive@openssh.com"))  in client_alive_check()
154 		    "keepalive@openssh.com", 1);  in client_alive_check()
241 	if (ret == -1) {  in wait_until_can_do_something()
292 			return -1;  in process_input()
299 	return -1;  in process_input()
331 		while ((pid = waitpid(-1, &status, WNOHANG)) > 0 ||  in collect_children()
332 		    (pid == -1 && errno == EINTR))  in collect_children()
350 	if (sigemptyset(&bsigset) == -1 || sigaddset(&bsigset, SIGCHLD) == -1)  in server_loop2()
377 		if (sigprocmask(SIG_BLOCK, &bsigset, &osigset) == -1)  in server_loop2()
383 		if (sigprocmask(SIG_UNBLOCK, &bsigset, &osigset) == -1)  in server_loop2()
413 server_input_keep_alive(int type, u_int32_t seq, struct ssh *ssh)  in server_input_keep_alive()  argument
415 	debug("Got %d/%u for keepalive", type, seq);  in server_input_keep_alive()
455 	    auth_opts->permit_port_forwarding_flag &&  in server_request_direct_tcpip()
458 		    "direct-tcpip", "direct-tcpip", reason, errmsg);  in server_request_direct_tcpip()
479 	struct passwd *pw = the_authctxt->pw;  in server_request_direct_streamlocal()
482 	if (pw == NULL || !the_authctxt->valid)  in server_request_direct_streamlocal()
500 	    auth_opts->permit_port_forwarding_flag &&  in server_request_direct_streamlocal()
501 	    !options.disable_forwarding && (pw->pw_uid == 0 || use_privsep)) {  in server_request_direct_streamlocal()
503 		    "direct-streamlocal@openssh.com", "direct-streamlocal");  in server_request_direct_streamlocal()
546 	if (auth_opts->force_tun_device != -1) {  in server_request_tun()
548 		    auth_opts->force_tun_device != (int)tun)  in server_request_tun()
550 		tun = auth_opts->force_tun_device;  in server_request_tun()
557 	c = channel_new(ssh, "tun", SSH_CHANNEL_OPEN, sock, sock, -1,  in server_request_tun()
559 	c->datagram = 1;  in server_request_tun()
562 		channel_register_filter(ssh, c->self, sys_tun_infilter,  in server_request_tun()
607 	    -1, -1, -1, /*window size*/0, CHAN_SES_PACKET_DEFAULT,  in server_request_session()
608 	    0, "server-session", 1);  in server_request_session()
609 	if (session_open(the_authctxt, c->self) != 1) {  in server_request_session()
610 		debug("session open failed, free channel %d", c->self);  in server_request_session()
614 	channel_register_cleanup(ssh, c->self, session_close_by_channel, 0);  in server_request_session()
619 server_input_channel_open(int type, u_int32_t seq, struct ssh *ssh)  in server_input_channel_open()  argument
637 	} else if (strcmp(ctype, "direct-tcpip") == 0) {  in server_input_channel_open()
639 	} else if (strcmp(ctype, "direct-streamlocal@openssh.com") == 0) {  in server_input_channel_open()
641 	} else if (strcmp(ctype, "tun@openssh.com") == 0) {  in server_input_channel_open()
646 		c->remote_id = rchan;  in server_input_channel_open()
647 		c->have_remote_id = 1;  in server_input_channel_open()
648 		c->remote_window = rwindow;  in server_input_channel_open()
649 		c->remote_maxpacket = rmaxpack;  in server_input_channel_open()
650 		if (c->type != SSH_CHANNEL_CONNECTING) {  in server_input_channel_open()
652 			    (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||  in server_input_channel_open()
653 			    (r = sshpkt_put_u32(ssh, c->self)) != 0 ||  in server_input_channel_open()
654 			    (r = sshpkt_put_u32(ssh, c->local_window)) != 0 ||  in server_input_channel_open()
655 			    (r = sshpkt_put_u32(ssh, c->local_maxpacket)) != 0 ||  in server_input_channel_open()
692 	    ssh->kex->hostkey_alg)) == KEY_RSA)  in server_input_hostkeys_prove()
693 		kex_rsa_sigalg = ssh->kex->hostkey_alg;  in server_input_hostkeys_prove()
706 		if ((ndx = ssh->kex->host_key_index(key, 1, ssh)) == -1) {  in server_input_hostkeys_prove()
711 		 * XXX refactor: make kex->sign just use an index rather  in server_input_hostkeys_prove()
727 		if (sshkey_type_plain(key->type) == KEY_RSA) {  in server_input_hostkeys_prove()
730 			else if (ssh->kex->flags & KEX_RSA_SHA2_512_SUPPORTED)  in server_input_hostkeys_prove()
731 				sigalg = "rsa-sha2-512";  in server_input_hostkeys_prove()
732 			else if (ssh->kex->flags & KEX_RSA_SHA2_256_SUPPORTED)  in server_input_hostkeys_prove()
733 				sigalg = "rsa-sha2-256";  in server_input_hostkeys_prove()
738 		    "hostkeys-prove-00@openssh.com")) != 0 ||  in server_input_hostkeys_prove()
740 		    ssh->kex->session_id)) != 0 ||  in server_input_hostkeys_prove()
742 		    (r = ssh->kex->sign(ssh, key_prv, key_pub, &sig, &slen,  in server_input_hostkeys_prove()
762 server_input_global_request(int type, u_int32_t seq, struct ssh *ssh)  in server_input_global_request()  argument
769 	struct passwd *pw = the_authctxt->pw;  in server_input_global_request()
773 	if (pw == NULL || !the_authctxt->valid)  in server_input_global_request()
781 	/* -R style forwarding */  in server_input_global_request()
782 	if (strcmp(rtype, "tcpip-forward") == 0) {  in server_input_global_request()
785 			sshpkt_fatal(ssh, r, "%s: parse tcpip-forward", __func__);  in server_input_global_request()
786 		debug_f("tcpip-forward listen %s port %u",  in server_input_global_request()
793 		    !auth_opts->permit_port_forwarding_flag ||  in server_input_global_request()
797 		    !bind_permitted(fwd.listen_port, pw->pw_uid))) {  in server_input_global_request()
810 	} else if (strcmp(rtype, "cancel-tcpip-forward") == 0) {  in server_input_global_request()
813 			sshpkt_fatal(ssh, r, "%s: parse cancel-tcpip-forward", __func__);  in server_input_global_request()
815 		debug_f("cancel-tcpip-forward addr %s port %d",  in server_input_global_request()
821 	} else if (strcmp(rtype, "streamlocal-forward@openssh.com") == 0) {  in server_input_global_request()
823 			sshpkt_fatal(ssh, r, "%s: parse streamlocal-forward@openssh.com", __func__);  in server_input_global_request()
824 		debug_f("streamlocal-forward listen path %s",  in server_input_global_request()
829 		    || !auth_opts->permit_port_forwarding_flag ||  in server_input_global_request()
831 		    (pw->pw_uid != 0 && !use_privsep)) {  in server_input_global_request()
840 	} else if (strcmp(rtype, "cancel-streamlocal-forward@openssh.com") == 0) {  in server_input_global_request()
842 			sshpkt_fatal(ssh, r, "%s: parse cancel-streamlocal-forward@openssh.com", __func__);  in server_input_global_request()
843 		debug_f("cancel-streamlocal-forward path %s",  in server_input_global_request()
847 	} else if (strcmp(rtype, "no-more-sessions@openssh.com") == 0) {  in server_input_global_request()
850 	} else if (strcmp(rtype, "hostkeys-prove-00@openssh.com") == 0) {  in server_input_global_request()
870 server_input_channel_req(int type, u_int32_t seq, struct ssh *ssh)  in server_input_channel_req()  argument
890 	if (!strcmp(rtype, "eow@openssh.com")) {  in server_input_channel_req()
894 	} else if ((c->type == SSH_CHANNEL_LARVAL ||  in server_input_channel_req()
895 	    c->type == SSH_CHANNEL_OPEN) && strcmp(c->ctype, "session") == 0)  in server_input_channel_req()
897 	if (want_reply && !(c->flags & CHAN_CLOSE_SENT)) {  in server_input_channel_req()
898 		if (!c->have_remote_id)  in server_input_channel_req()
899 			fatal_f("channel %d: no remote_id", c->self);  in server_input_channel_req()
902 		    (r = sshpkt_put_u32(ssh, c->remote_id)) != 0 ||  in server_input_channel_req()