xref: /freebsd/crypto/openssh/clientloop.c (revision 8998619212f3a1c489079256ef1f6a26a7d7612c)
14a421b63SDag-Erling Smørgrav /* $OpenBSD: clientloop.c,v 1.231 2011/01/16 12:05:59 djm Exp $ */
2*89986192SBrooks Davis /* $FreeBSD$ */
3511b41d2SMark Murray /*
4511b41d2SMark Murray  * Author: Tatu Ylonen <ylo@cs.hut.fi>
5511b41d2SMark Murray  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6511b41d2SMark Murray  *                    All rights reserved
7511b41d2SMark Murray  * The main loop for the interactive session (client side).
8511b41d2SMark Murray  *
9b66f2d16SKris Kennaway  * As far as I am concerned, the code I have written for this software
10b66f2d16SKris Kennaway  * can be used freely for any purpose.  Any derived versions of this
11b66f2d16SKris Kennaway  * software must be clearly marked as such, and if the derived work is
12b66f2d16SKris Kennaway  * incompatible with the protocol description in the RFC file, it must be
13b66f2d16SKris Kennaway  * called by a name other than "ssh" or "Secure Shell".
14b66f2d16SKris Kennaway  *
15b66f2d16SKris Kennaway  *
16b66f2d16SKris Kennaway  * Copyright (c) 1999 Theo de Raadt.  All rights reserved.
17b66f2d16SKris Kennaway  *
18b66f2d16SKris Kennaway  * Redistribution and use in source and binary forms, with or without
19b66f2d16SKris Kennaway  * modification, are permitted provided that the following conditions
20b66f2d16SKris Kennaway  * are met:
21b66f2d16SKris Kennaway  * 1. Redistributions of source code must retain the above copyright
22b66f2d16SKris Kennaway  *    notice, this list of conditions and the following disclaimer.
23b66f2d16SKris Kennaway  * 2. Redistributions in binary form must reproduce the above copyright
24b66f2d16SKris Kennaway  *    notice, this list of conditions and the following disclaimer in the
25b66f2d16SKris Kennaway  *    documentation and/or other materials provided with the distribution.
26b66f2d16SKris Kennaway  *
27b66f2d16SKris Kennaway  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
28b66f2d16SKris Kennaway  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
29b66f2d16SKris Kennaway  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
30b66f2d16SKris Kennaway  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
31b66f2d16SKris Kennaway  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
32b66f2d16SKris Kennaway  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
33b66f2d16SKris Kennaway  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
34b66f2d16SKris Kennaway  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
35b66f2d16SKris Kennaway  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
36b66f2d16SKris Kennaway  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37b66f2d16SKris Kennaway  *
38b66f2d16SKris Kennaway  *
39a04a10f8SKris Kennaway  * SSH2 support added by Markus Friedl.
40ae1f160dSDag-Erling Smørgrav  * Copyright (c) 1999, 2000, 2001 Markus Friedl.  All rights reserved.
41b66f2d16SKris Kennaway  *
42b66f2d16SKris Kennaway  * Redistribution and use in source and binary forms, with or without
43b66f2d16SKris Kennaway  * modification, are permitted provided that the following conditions
44b66f2d16SKris Kennaway  * are met:
45b66f2d16SKris Kennaway  * 1. Redistributions of source code must retain the above copyright
46b66f2d16SKris Kennaway  *    notice, this list of conditions and the following disclaimer.
47b66f2d16SKris Kennaway  * 2. Redistributions in binary form must reproduce the above copyright
48b66f2d16SKris Kennaway  *    notice, this list of conditions and the following disclaimer in the
49b66f2d16SKris Kennaway  *    documentation and/or other materials provided with the distribution.
50b66f2d16SKris Kennaway  *
51b66f2d16SKris Kennaway  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
52b66f2d16SKris Kennaway  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
53b66f2d16SKris Kennaway  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
54b66f2d16SKris Kennaway  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
55b66f2d16SKris Kennaway  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
56b66f2d16SKris Kennaway  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
57b66f2d16SKris Kennaway  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
58b66f2d16SKris Kennaway  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
59b66f2d16SKris Kennaway  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
60b66f2d16SKris Kennaway  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
61511b41d2SMark Murray  */
62511b41d2SMark Murray 
63511b41d2SMark Murray #include "includes.h"
64511b41d2SMark Murray 
65761efaa7SDag-Erling Smørgrav #include <sys/types.h>
66761efaa7SDag-Erling Smørgrav #include <sys/ioctl.h>
67761efaa7SDag-Erling Smørgrav #include <sys/param.h>
68761efaa7SDag-Erling Smørgrav #ifdef HAVE_SYS_STAT_H
69761efaa7SDag-Erling Smørgrav # include <sys/stat.h>
70761efaa7SDag-Erling Smørgrav #endif
71761efaa7SDag-Erling Smørgrav #ifdef HAVE_SYS_TIME_H
72761efaa7SDag-Erling Smørgrav # include <sys/time.h>
73761efaa7SDag-Erling Smørgrav #endif
74761efaa7SDag-Erling Smørgrav #include <sys/socket.h>
75761efaa7SDag-Erling Smørgrav 
76761efaa7SDag-Erling Smørgrav #include <ctype.h>
77761efaa7SDag-Erling Smørgrav #include <errno.h>
78761efaa7SDag-Erling Smørgrav #ifdef HAVE_PATHS_H
79761efaa7SDag-Erling Smørgrav #include <paths.h>
80761efaa7SDag-Erling Smørgrav #endif
81761efaa7SDag-Erling Smørgrav #include <signal.h>
82761efaa7SDag-Erling Smørgrav #include <stdarg.h>
83761efaa7SDag-Erling Smørgrav #include <stdio.h>
84761efaa7SDag-Erling Smørgrav #include <stdlib.h>
85761efaa7SDag-Erling Smørgrav #include <string.h>
86761efaa7SDag-Erling Smørgrav #include <termios.h>
87761efaa7SDag-Erling Smørgrav #include <pwd.h>
88761efaa7SDag-Erling Smørgrav #include <unistd.h>
89761efaa7SDag-Erling Smørgrav 
90d4af9e69SDag-Erling Smørgrav #include "openbsd-compat/sys-queue.h"
91761efaa7SDag-Erling Smørgrav #include "xmalloc.h"
92511b41d2SMark Murray #include "ssh.h"
931e8db6e2SBrian Feldman #include "ssh1.h"
941e8db6e2SBrian Feldman #include "ssh2.h"
95511b41d2SMark Murray #include "packet.h"
96511b41d2SMark Murray #include "buffer.h"
97a04a10f8SKris Kennaway #include "compat.h"
98a04a10f8SKris Kennaway #include "channels.h"
99a04a10f8SKris Kennaway #include "dispatch.h"
1001e8db6e2SBrian Feldman #include "key.h"
101761efaa7SDag-Erling Smørgrav #include "cipher.h"
1021e8db6e2SBrian Feldman #include "kex.h"
1031e8db6e2SBrian Feldman #include "log.h"
1041e8db6e2SBrian Feldman #include "readconf.h"
1051e8db6e2SBrian Feldman #include "clientloop.h"
106021d409fSDag-Erling Smørgrav #include "sshconnect.h"
1071e8db6e2SBrian Feldman #include "authfd.h"
1081e8db6e2SBrian Feldman #include "atomicio.h"
109d74d50a8SDag-Erling Smørgrav #include "sshpty.h"
1101e8db6e2SBrian Feldman #include "misc.h"
111d74d50a8SDag-Erling Smørgrav #include "match.h"
112d74d50a8SDag-Erling Smørgrav #include "msg.h"
1137aee6ffeSDag-Erling Smørgrav #include "roaming.h"
1145b9b2fafSBrian Feldman 
1155b9b2fafSBrian Feldman /* import options */
1164899dde7SBrian Feldman extern Options options;
1174899dde7SBrian Feldman 
118511b41d2SMark Murray /* Flag indicating that stdin should be redirected from /dev/null. */
119511b41d2SMark Murray extern int stdin_null_flag;
120511b41d2SMark Murray 
121efcad6b7SDag-Erling Smørgrav /* Flag indicating that no shell has been requested */
122efcad6b7SDag-Erling Smørgrav extern int no_shell_flag;
123efcad6b7SDag-Erling Smørgrav 
124d74d50a8SDag-Erling Smørgrav /* Control socket */
125b15c8340SDag-Erling Smørgrav extern int muxserver_sock; /* XXX use mux_client_cleanup() instead */
126d74d50a8SDag-Erling Smørgrav 
127511b41d2SMark Murray /*
128511b41d2SMark Murray  * Name of the host we are connecting to.  This is the name given on the
129511b41d2SMark Murray  * command line, or the HostName specified for the user-supplied name in a
130511b41d2SMark Murray  * configuration file.
131511b41d2SMark Murray  */
132511b41d2SMark Murray extern char *host;
133511b41d2SMark Murray 
134b15c8340SDag-Erling Smørgrav /* Force TTY allocation */
135b15c8340SDag-Erling Smørgrav extern int force_tty_flag;
136b15c8340SDag-Erling Smørgrav 
137511b41d2SMark Murray /*
138511b41d2SMark Murray  * Flag to indicate that we have received a window change signal which has
139511b41d2SMark Murray  * not yet been processed.  This will cause a message indicating the new
140511b41d2SMark Murray  * window size to be sent to the server a little later.  This is volatile
141511b41d2SMark Murray  * because this is updated in a signal handler.
142511b41d2SMark Murray  */
143ae1f160dSDag-Erling Smørgrav static volatile sig_atomic_t received_window_change_signal = 0;
144ae1f160dSDag-Erling Smørgrav static volatile sig_atomic_t received_signal = 0;
145511b41d2SMark Murray 
146021d409fSDag-Erling Smørgrav /* Flag indicating whether the user's terminal is in non-blocking mode. */
147511b41d2SMark Murray static int in_non_blocking_mode = 0;
148511b41d2SMark Murray 
149e2f6069cSDag-Erling Smørgrav /* Time when backgrounded control master using ControlPersist should exit */
150e2f6069cSDag-Erling Smørgrav static time_t control_persist_exit_time = 0;
151e2f6069cSDag-Erling Smørgrav 
152511b41d2SMark Murray /* Common data for the client loop code. */
153b15c8340SDag-Erling Smørgrav volatile sig_atomic_t quit_pending; /* Set non-zero to quit the loop. */
154d4af9e69SDag-Erling Smørgrav static int escape_char1;	/* Escape character. (proto1 only) */
155d4af9e69SDag-Erling Smørgrav static int escape_pending1;	/* Last character was an escape (proto1 only) */
156511b41d2SMark Murray static int last_was_cr;		/* Last character was a newline. */
157d4af9e69SDag-Erling Smørgrav static int exit_status;		/* Used to store the command exit status. */
158d4af9e69SDag-Erling Smørgrav static int stdin_eof;		/* EOF has been encountered on stderr. */
159511b41d2SMark Murray static Buffer stdin_buffer;	/* Buffer for stdin data. */
160511b41d2SMark Murray static Buffer stdout_buffer;	/* Buffer for stdout data. */
161511b41d2SMark Murray static Buffer stderr_buffer;	/* Buffer for stderr data. */
1621e8db6e2SBrian Feldman static u_int buffer_high;	/* Soft max buffer size. */
163511b41d2SMark Murray static int connection_in;	/* Connection to server (input). */
164511b41d2SMark Murray static int connection_out;	/* Connection to server (output). */
1651e8db6e2SBrian Feldman static int need_rekeying;	/* Set to non-zero if rekeying is requested. */
166e2f6069cSDag-Erling Smørgrav static int session_closed;	/* In SSH2: login session closed. */
167e2f6069cSDag-Erling Smørgrav static int x11_refuse_time;	/* If >0, refuse x11 opens after this time. */
168a04a10f8SKris Kennaway 
169ae1f160dSDag-Erling Smørgrav static void client_init_dispatch(void);
170a04a10f8SKris Kennaway int	session_ident = -1;
171a04a10f8SKris Kennaway 
172b15c8340SDag-Erling Smørgrav int	session_resumed = 0;
173b15c8340SDag-Erling Smørgrav 
174d4af9e69SDag-Erling Smørgrav /* Track escape per proto2 channel */
175d4af9e69SDag-Erling Smørgrav struct escape_filter_ctx {
176d4af9e69SDag-Erling Smørgrav 	int escape_pending;
177d4af9e69SDag-Erling Smørgrav 	int escape_char;
178d74d50a8SDag-Erling Smørgrav };
179d74d50a8SDag-Erling Smørgrav 
180d4af9e69SDag-Erling Smørgrav /* Context for channel confirmation replies */
181d4af9e69SDag-Erling Smørgrav struct channel_reply_ctx {
182d4af9e69SDag-Erling Smørgrav 	const char *request_type;
183d4af9e69SDag-Erling Smørgrav 	int id, do_close;
184d4af9e69SDag-Erling Smørgrav };
185d4af9e69SDag-Erling Smørgrav 
186d4af9e69SDag-Erling Smørgrav /* Global request success/failure callbacks */
187d4af9e69SDag-Erling Smørgrav struct global_confirm {
188d4af9e69SDag-Erling Smørgrav 	TAILQ_ENTRY(global_confirm) entry;
189d4af9e69SDag-Erling Smørgrav 	global_confirm_cb *cb;
190d4af9e69SDag-Erling Smørgrav 	void *ctx;
191d4af9e69SDag-Erling Smørgrav 	int ref_count;
192d4af9e69SDag-Erling Smørgrav };
193d4af9e69SDag-Erling Smørgrav TAILQ_HEAD(global_confirms, global_confirm);
194d4af9e69SDag-Erling Smørgrav static struct global_confirms global_confirms =
195d4af9e69SDag-Erling Smørgrav     TAILQ_HEAD_INITIALIZER(global_confirms);
196d4af9e69SDag-Erling Smørgrav 
1971e8db6e2SBrian Feldman /*XXX*/
1981e8db6e2SBrian Feldman extern Kex *xxx_kex;
199511b41d2SMark Murray 
200d74d50a8SDag-Erling Smørgrav void ssh_process_session2_setup(int, int, int, Buffer *);
201d74d50a8SDag-Erling Smørgrav 
202511b41d2SMark Murray /* Restores stdin to blocking mode. */
203511b41d2SMark Murray 
204ae1f160dSDag-Erling Smørgrav static void
2051e8db6e2SBrian Feldman leave_non_blocking(void)
206511b41d2SMark Murray {
207511b41d2SMark Murray 	if (in_non_blocking_mode) {
208d74d50a8SDag-Erling Smørgrav 		unset_nonblock(fileno(stdin));
209511b41d2SMark Murray 		in_non_blocking_mode = 0;
210511b41d2SMark Murray 	}
211511b41d2SMark Murray }
212511b41d2SMark Murray 
213511b41d2SMark Murray /* Puts stdin terminal in non-blocking mode. */
214511b41d2SMark Murray 
215ae1f160dSDag-Erling Smørgrav static void
2161e8db6e2SBrian Feldman enter_non_blocking(void)
217511b41d2SMark Murray {
218511b41d2SMark Murray 	in_non_blocking_mode = 1;
219d74d50a8SDag-Erling Smørgrav 	set_nonblock(fileno(stdin));
220511b41d2SMark Murray }
221511b41d2SMark Murray 
222511b41d2SMark Murray /*
223511b41d2SMark Murray  * Signal handler for the window change signal (SIGWINCH).  This just sets a
224511b41d2SMark Murray  * flag indicating that the window has changed.
225511b41d2SMark Murray  */
226761efaa7SDag-Erling Smørgrav /*ARGSUSED */
227ae1f160dSDag-Erling Smørgrav static void
228511b41d2SMark Murray window_change_handler(int sig)
229511b41d2SMark Murray {
230511b41d2SMark Murray 	received_window_change_signal = 1;
231511b41d2SMark Murray 	signal(SIGWINCH, window_change_handler);
232511b41d2SMark Murray }
233511b41d2SMark Murray 
234511b41d2SMark Murray /*
235511b41d2SMark Murray  * Signal handler for signals that cause the program to terminate.  These
236511b41d2SMark Murray  * signals must be trapped to restore terminal modes.
237511b41d2SMark Murray  */
238761efaa7SDag-Erling Smørgrav /*ARGSUSED */
239ae1f160dSDag-Erling Smørgrav static void
240511b41d2SMark Murray signal_handler(int sig)
241511b41d2SMark Murray {
242ae1f160dSDag-Erling Smørgrav 	received_signal = sig;
243ae1f160dSDag-Erling Smørgrav 	quit_pending = 1;
244511b41d2SMark Murray }
245511b41d2SMark Murray 
246511b41d2SMark Murray /*
247511b41d2SMark Murray  * Returns current time in seconds from Jan 1, 1970 with the maximum
248511b41d2SMark Murray  * available resolution.
249511b41d2SMark Murray  */
250511b41d2SMark Murray 
251ae1f160dSDag-Erling Smørgrav static double
2521e8db6e2SBrian Feldman get_current_time(void)
253511b41d2SMark Murray {
254511b41d2SMark Murray 	struct timeval tv;
255511b41d2SMark Murray 	gettimeofday(&tv, NULL);
256511b41d2SMark Murray 	return (double) tv.tv_sec + (double) tv.tv_usec / 1000000.0;
257511b41d2SMark Murray }
258511b41d2SMark Murray 
259e2f6069cSDag-Erling Smørgrav /*
260e2f6069cSDag-Erling Smørgrav  * Sets control_persist_exit_time to the absolute time when the
261e2f6069cSDag-Erling Smørgrav  * backgrounded control master should exit due to expiry of the
262e2f6069cSDag-Erling Smørgrav  * ControlPersist timeout.  Sets it to 0 if we are not a backgrounded
263e2f6069cSDag-Erling Smørgrav  * control master process, or if there is no ControlPersist timeout.
264e2f6069cSDag-Erling Smørgrav  */
265e2f6069cSDag-Erling Smørgrav static void
266e2f6069cSDag-Erling Smørgrav set_control_persist_exit_time(void)
267e2f6069cSDag-Erling Smørgrav {
268e2f6069cSDag-Erling Smørgrav 	if (muxserver_sock == -1 || !options.control_persist
269e2f6069cSDag-Erling Smørgrav 	    || options.control_persist_timeout == 0)
270e2f6069cSDag-Erling Smørgrav 		/* not using a ControlPersist timeout */
271e2f6069cSDag-Erling Smørgrav 		control_persist_exit_time = 0;
272e2f6069cSDag-Erling Smørgrav 	else if (channel_still_open()) {
273e2f6069cSDag-Erling Smørgrav 		/* some client connections are still open */
274e2f6069cSDag-Erling Smørgrav 		if (control_persist_exit_time > 0)
275e2f6069cSDag-Erling Smørgrav 			debug2("%s: cancel scheduled exit", __func__);
276e2f6069cSDag-Erling Smørgrav 		control_persist_exit_time = 0;
277e2f6069cSDag-Erling Smørgrav 	} else if (control_persist_exit_time <= 0) {
278e2f6069cSDag-Erling Smørgrav 		/* a client connection has recently closed */
279e2f6069cSDag-Erling Smørgrav 		control_persist_exit_time = time(NULL) +
280e2f6069cSDag-Erling Smørgrav 			(time_t)options.control_persist_timeout;
281e2f6069cSDag-Erling Smørgrav 		debug2("%s: schedule exit in %d seconds", __func__,
282e2f6069cSDag-Erling Smørgrav 		    options.control_persist_timeout);
283e2f6069cSDag-Erling Smørgrav 	}
284e2f6069cSDag-Erling Smørgrav 	/* else we are already counting down to the timeout */
285e2f6069cSDag-Erling Smørgrav }
286e2f6069cSDag-Erling Smørgrav 
287043840dfSDag-Erling Smørgrav #define SSH_X11_PROTO "MIT-MAGIC-COOKIE-1"
288043840dfSDag-Erling Smørgrav void
289043840dfSDag-Erling Smørgrav client_x11_get_proto(const char *display, const char *xauth_path,
290e2f6069cSDag-Erling Smørgrav     u_int trusted, u_int timeout, char **_proto, char **_data)
291043840dfSDag-Erling Smørgrav {
292043840dfSDag-Erling Smørgrav 	char cmd[1024];
293043840dfSDag-Erling Smørgrav 	char line[512];
294043840dfSDag-Erling Smørgrav 	char xdisplay[512];
295043840dfSDag-Erling Smørgrav 	static char proto[512], data[512];
296043840dfSDag-Erling Smørgrav 	FILE *f;
297043840dfSDag-Erling Smørgrav 	int got_data = 0, generated = 0, do_unlink = 0, i;
298043840dfSDag-Erling Smørgrav 	char *xauthdir, *xauthfile;
299043840dfSDag-Erling Smørgrav 	struct stat st;
300e2f6069cSDag-Erling Smørgrav 	u_int now;
301043840dfSDag-Erling Smørgrav 
302043840dfSDag-Erling Smørgrav 	xauthdir = xauthfile = NULL;
303043840dfSDag-Erling Smørgrav 	*_proto = proto;
304043840dfSDag-Erling Smørgrav 	*_data = data;
305043840dfSDag-Erling Smørgrav 	proto[0] = data[0] = '\0';
306043840dfSDag-Erling Smørgrav 
307043840dfSDag-Erling Smørgrav 	if (xauth_path == NULL ||(stat(xauth_path, &st) == -1)) {
308043840dfSDag-Erling Smørgrav 		debug("No xauth program.");
309043840dfSDag-Erling Smørgrav 	} else {
310043840dfSDag-Erling Smørgrav 		if (display == NULL) {
311043840dfSDag-Erling Smørgrav 			debug("x11_get_proto: DISPLAY not set");
312043840dfSDag-Erling Smørgrav 			return;
313043840dfSDag-Erling Smørgrav 		}
314043840dfSDag-Erling Smørgrav 		/*
315043840dfSDag-Erling Smørgrav 		 * Handle FamilyLocal case where $DISPLAY does
316043840dfSDag-Erling Smørgrav 		 * not match an authorization entry.  For this we
317043840dfSDag-Erling Smørgrav 		 * just try "xauth list unix:displaynum.screennum".
318043840dfSDag-Erling Smørgrav 		 * XXX: "localhost" match to determine FamilyLocal
319043840dfSDag-Erling Smørgrav 		 *      is not perfect.
320043840dfSDag-Erling Smørgrav 		 */
321043840dfSDag-Erling Smørgrav 		if (strncmp(display, "localhost:", 10) == 0) {
322043840dfSDag-Erling Smørgrav 			snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
323043840dfSDag-Erling Smørgrav 			    display + 10);
324043840dfSDag-Erling Smørgrav 			display = xdisplay;
325043840dfSDag-Erling Smørgrav 		}
326043840dfSDag-Erling Smørgrav 		if (trusted == 0) {
327043840dfSDag-Erling Smørgrav 			xauthdir = xmalloc(MAXPATHLEN);
328043840dfSDag-Erling Smørgrav 			xauthfile = xmalloc(MAXPATHLEN);
3294a421b63SDag-Erling Smørgrav 			mktemp_proto(xauthdir, MAXPATHLEN);
330043840dfSDag-Erling Smørgrav 			if (mkdtemp(xauthdir) != NULL) {
331043840dfSDag-Erling Smørgrav 				do_unlink = 1;
332043840dfSDag-Erling Smørgrav 				snprintf(xauthfile, MAXPATHLEN, "%s/xauthfile",
333043840dfSDag-Erling Smørgrav 				    xauthdir);
334043840dfSDag-Erling Smørgrav 				snprintf(cmd, sizeof(cmd),
335043840dfSDag-Erling Smørgrav 				    "%s -f %s generate %s " SSH_X11_PROTO
336e2f6069cSDag-Erling Smørgrav 				    " untrusted timeout %u 2>" _PATH_DEVNULL,
337e2f6069cSDag-Erling Smørgrav 				    xauth_path, xauthfile, display, timeout);
338043840dfSDag-Erling Smørgrav 				debug2("x11_get_proto: %s", cmd);
339043840dfSDag-Erling Smørgrav 				if (system(cmd) == 0)
340043840dfSDag-Erling Smørgrav 					generated = 1;
341e2f6069cSDag-Erling Smørgrav 				if (x11_refuse_time == 0) {
342e2f6069cSDag-Erling Smørgrav 					now = time(NULL) + 1;
343e2f6069cSDag-Erling Smørgrav 					if (UINT_MAX - timeout < now)
344e2f6069cSDag-Erling Smørgrav 						x11_refuse_time = UINT_MAX;
345e2f6069cSDag-Erling Smørgrav 					else
346e2f6069cSDag-Erling Smørgrav 						x11_refuse_time = now + timeout;
347e2f6069cSDag-Erling Smørgrav 				}
348043840dfSDag-Erling Smørgrav 			}
349043840dfSDag-Erling Smørgrav 		}
350d4af9e69SDag-Erling Smørgrav 
351d4af9e69SDag-Erling Smørgrav 		/*
352d4af9e69SDag-Erling Smørgrav 		 * When in untrusted mode, we read the cookie only if it was
353d4af9e69SDag-Erling Smørgrav 		 * successfully generated as an untrusted one in the step
354d4af9e69SDag-Erling Smørgrav 		 * above.
355d4af9e69SDag-Erling Smørgrav 		 */
356d4af9e69SDag-Erling Smørgrav 		if (trusted || generated) {
357043840dfSDag-Erling Smørgrav 			snprintf(cmd, sizeof(cmd),
358021d409fSDag-Erling Smørgrav 			    "%s %s%s list %s 2>" _PATH_DEVNULL,
359043840dfSDag-Erling Smørgrav 			    xauth_path,
360043840dfSDag-Erling Smørgrav 			    generated ? "-f " : "" ,
361043840dfSDag-Erling Smørgrav 			    generated ? xauthfile : "",
362043840dfSDag-Erling Smørgrav 			    display);
363043840dfSDag-Erling Smørgrav 			debug2("x11_get_proto: %s", cmd);
364043840dfSDag-Erling Smørgrav 			f = popen(cmd, "r");
365043840dfSDag-Erling Smørgrav 			if (f && fgets(line, sizeof(line), f) &&
366043840dfSDag-Erling Smørgrav 			    sscanf(line, "%*s %511s %511s", proto, data) == 2)
367043840dfSDag-Erling Smørgrav 				got_data = 1;
368043840dfSDag-Erling Smørgrav 			if (f)
369043840dfSDag-Erling Smørgrav 				pclose(f);
370d4af9e69SDag-Erling Smørgrav 		} else
371d4af9e69SDag-Erling Smørgrav 			error("Warning: untrusted X11 forwarding setup failed: "
372d4af9e69SDag-Erling Smørgrav 			    "xauth key data not generated");
373043840dfSDag-Erling Smørgrav 	}
374043840dfSDag-Erling Smørgrav 
375043840dfSDag-Erling Smørgrav 	if (do_unlink) {
376043840dfSDag-Erling Smørgrav 		unlink(xauthfile);
377043840dfSDag-Erling Smørgrav 		rmdir(xauthdir);
378043840dfSDag-Erling Smørgrav 	}
379043840dfSDag-Erling Smørgrav 	if (xauthdir)
380043840dfSDag-Erling Smørgrav 		xfree(xauthdir);
381043840dfSDag-Erling Smørgrav 	if (xauthfile)
382043840dfSDag-Erling Smørgrav 		xfree(xauthfile);
383043840dfSDag-Erling Smørgrav 
384043840dfSDag-Erling Smørgrav 	/*
385043840dfSDag-Erling Smørgrav 	 * If we didn't get authentication data, just make up some
386043840dfSDag-Erling Smørgrav 	 * data.  The forwarding code will check the validity of the
387043840dfSDag-Erling Smørgrav 	 * response anyway, and substitute this data.  The X11
388043840dfSDag-Erling Smørgrav 	 * server, however, will ignore this fake data and use
389043840dfSDag-Erling Smørgrav 	 * whatever authentication mechanisms it was using otherwise
390043840dfSDag-Erling Smørgrav 	 * for the local connection.
391043840dfSDag-Erling Smørgrav 	 */
392043840dfSDag-Erling Smørgrav 	if (!got_data) {
393043840dfSDag-Erling Smørgrav 		u_int32_t rnd = 0;
394043840dfSDag-Erling Smørgrav 
395043840dfSDag-Erling Smørgrav 		logit("Warning: No xauth data; "
396043840dfSDag-Erling Smørgrav 		    "using fake authentication data for X11 forwarding.");
397043840dfSDag-Erling Smørgrav 		strlcpy(proto, SSH_X11_PROTO, sizeof proto);
398043840dfSDag-Erling Smørgrav 		for (i = 0; i < 16; i++) {
399043840dfSDag-Erling Smørgrav 			if (i % 4 == 0)
400043840dfSDag-Erling Smørgrav 				rnd = arc4random();
401043840dfSDag-Erling Smørgrav 			snprintf(data + 2 * i, sizeof data - 2 * i, "%02x",
402043840dfSDag-Erling Smørgrav 			    rnd & 0xff);
403043840dfSDag-Erling Smørgrav 			rnd >>= 8;
404043840dfSDag-Erling Smørgrav 		}
405043840dfSDag-Erling Smørgrav 	}
406043840dfSDag-Erling Smørgrav }
407043840dfSDag-Erling Smørgrav 
408511b41d2SMark Murray /*
409511b41d2SMark Murray  * This is called when the interactive is entered.  This checks if there is
410511b41d2SMark Murray  * an EOF coming on stdin.  We must check this explicitly, as select() does
411511b41d2SMark Murray  * not appear to wake up when redirecting from /dev/null.
412511b41d2SMark Murray  */
413511b41d2SMark Murray 
414ae1f160dSDag-Erling Smørgrav static void
4151e8db6e2SBrian Feldman client_check_initial_eof_on_stdin(void)
416511b41d2SMark Murray {
417511b41d2SMark Murray 	int len;
418511b41d2SMark Murray 	char buf[1];
419511b41d2SMark Murray 
420511b41d2SMark Murray 	/*
421511b41d2SMark Murray 	 * If standard input is to be "redirected from /dev/null", we simply
422511b41d2SMark Murray 	 * mark that we have seen an EOF and send an EOF message to the
423511b41d2SMark Murray 	 * server. Otherwise, we try to read a single character; it appears
424511b41d2SMark Murray 	 * that for some files, such /dev/null, select() never wakes up for
425511b41d2SMark Murray 	 * read for this descriptor, which means that we never get EOF.  This
426511b41d2SMark Murray 	 * way we will get the EOF if stdin comes from /dev/null or similar.
427511b41d2SMark Murray 	 */
428511b41d2SMark Murray 	if (stdin_null_flag) {
429511b41d2SMark Murray 		/* Fake EOF on stdin. */
430511b41d2SMark Murray 		debug("Sending eof.");
431511b41d2SMark Murray 		stdin_eof = 1;
432511b41d2SMark Murray 		packet_start(SSH_CMSG_EOF);
433511b41d2SMark Murray 		packet_send();
434511b41d2SMark Murray 	} else {
435511b41d2SMark Murray 		enter_non_blocking();
436511b41d2SMark Murray 
437511b41d2SMark Murray 		/* Check for immediate EOF on stdin. */
438511b41d2SMark Murray 		len = read(fileno(stdin), buf, 1);
439511b41d2SMark Murray 		if (len == 0) {
440d4af9e69SDag-Erling Smørgrav 			/*
441d4af9e69SDag-Erling Smørgrav 			 * EOF.  Record that we have seen it and send
442d4af9e69SDag-Erling Smørgrav 			 * EOF to server.
443d4af9e69SDag-Erling Smørgrav 			 */
444511b41d2SMark Murray 			debug("Sending eof.");
445511b41d2SMark Murray 			stdin_eof = 1;
446511b41d2SMark Murray 			packet_start(SSH_CMSG_EOF);
447511b41d2SMark Murray 			packet_send();
448511b41d2SMark Murray 		} else if (len > 0) {
449511b41d2SMark Murray 			/*
450511b41d2SMark Murray 			 * Got data.  We must store the data in the buffer,
451511b41d2SMark Murray 			 * and also process it as an escape character if
452511b41d2SMark Murray 			 * appropriate.
453511b41d2SMark Murray 			 */
454d4af9e69SDag-Erling Smørgrav 			if ((u_char) buf[0] == escape_char1)
455d4af9e69SDag-Erling Smørgrav 				escape_pending1 = 1;
4561e8db6e2SBrian Feldman 			else
457511b41d2SMark Murray 				buffer_append(&stdin_buffer, buf, 1);
458511b41d2SMark Murray 		}
459511b41d2SMark Murray 		leave_non_blocking();
460511b41d2SMark Murray 	}
461511b41d2SMark Murray }
462511b41d2SMark Murray 
463511b41d2SMark Murray 
464511b41d2SMark Murray /*
465511b41d2SMark Murray  * Make packets from buffered stdin data, and buffer them for sending to the
466511b41d2SMark Murray  * connection.
467511b41d2SMark Murray  */
468511b41d2SMark Murray 
469ae1f160dSDag-Erling Smørgrav static void
4701e8db6e2SBrian Feldman client_make_packets_from_stdin_data(void)
471511b41d2SMark Murray {
4721e8db6e2SBrian Feldman 	u_int len;
473511b41d2SMark Murray 
474511b41d2SMark Murray 	/* Send buffered stdin data to the server. */
475511b41d2SMark Murray 	while (buffer_len(&stdin_buffer) > 0 &&
476511b41d2SMark Murray 	    packet_not_very_much_data_to_write()) {
477511b41d2SMark Murray 		len = buffer_len(&stdin_buffer);
478511b41d2SMark Murray 		/* Keep the packets at reasonable size. */
479511b41d2SMark Murray 		if (len > packet_get_maxsize())
480511b41d2SMark Murray 			len = packet_get_maxsize();
481511b41d2SMark Murray 		packet_start(SSH_CMSG_STDIN_DATA);
482511b41d2SMark Murray 		packet_put_string(buffer_ptr(&stdin_buffer), len);
483511b41d2SMark Murray 		packet_send();
484511b41d2SMark Murray 		buffer_consume(&stdin_buffer, len);
485511b41d2SMark Murray 		/* If we have a pending EOF, send it now. */
486511b41d2SMark Murray 		if (stdin_eof && buffer_len(&stdin_buffer) == 0) {
487511b41d2SMark Murray 			packet_start(SSH_CMSG_EOF);
488511b41d2SMark Murray 			packet_send();
489511b41d2SMark Murray 		}
490511b41d2SMark Murray 	}
491511b41d2SMark Murray }
492511b41d2SMark Murray 
493511b41d2SMark Murray /*
494511b41d2SMark Murray  * Checks if the client window has changed, and sends a packet about it to
495511b41d2SMark Murray  * the server if so.  The actual change is detected elsewhere (by a software
496511b41d2SMark Murray  * interrupt on Unix); this just checks the flag and sends a message if
497511b41d2SMark Murray  * appropriate.
498511b41d2SMark Murray  */
499511b41d2SMark Murray 
500ae1f160dSDag-Erling Smørgrav static void
5011e8db6e2SBrian Feldman client_check_window_change(void)
502511b41d2SMark Murray {
503511b41d2SMark Murray 	struct winsize ws;
504511b41d2SMark Murray 
505a04a10f8SKris Kennaway 	if (! received_window_change_signal)
506a04a10f8SKris Kennaway 		return;
507a04a10f8SKris Kennaway 	/** XXX race */
508511b41d2SMark Murray 	received_window_change_signal = 0;
509511b41d2SMark Murray 
5105b9b2fafSBrian Feldman 	debug2("client_check_window_change: changed");
511a04a10f8SKris Kennaway 
512a04a10f8SKris Kennaway 	if (compat20) {
513d74d50a8SDag-Erling Smørgrav 		channel_send_window_changes();
514a04a10f8SKris Kennaway 	} else {
515d74d50a8SDag-Erling Smørgrav 		if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0)
516d74d50a8SDag-Erling Smørgrav 			return;
517511b41d2SMark Murray 		packet_start(SSH_CMSG_WINDOW_SIZE);
518761efaa7SDag-Erling Smørgrav 		packet_put_int((u_int)ws.ws_row);
519761efaa7SDag-Erling Smørgrav 		packet_put_int((u_int)ws.ws_col);
520761efaa7SDag-Erling Smørgrav 		packet_put_int((u_int)ws.ws_xpixel);
521761efaa7SDag-Erling Smørgrav 		packet_put_int((u_int)ws.ws_ypixel);
522511b41d2SMark Murray 		packet_send();
523511b41d2SMark Murray 	}
524511b41d2SMark Murray }
525511b41d2SMark Murray 
526efcad6b7SDag-Erling Smørgrav static void
527efcad6b7SDag-Erling Smørgrav client_global_request_reply(int type, u_int32_t seq, void *ctxt)
528efcad6b7SDag-Erling Smørgrav {
529d4af9e69SDag-Erling Smørgrav 	struct global_confirm *gc;
530d4af9e69SDag-Erling Smørgrav 
531d4af9e69SDag-Erling Smørgrav 	if ((gc = TAILQ_FIRST(&global_confirms)) == NULL)
532d4af9e69SDag-Erling Smørgrav 		return;
533d4af9e69SDag-Erling Smørgrav 	if (gc->cb != NULL)
534d4af9e69SDag-Erling Smørgrav 		gc->cb(type, seq, gc->ctx);
535d4af9e69SDag-Erling Smørgrav 	if (--gc->ref_count <= 0) {
536d4af9e69SDag-Erling Smørgrav 		TAILQ_REMOVE(&global_confirms, gc, entry);
537d4af9e69SDag-Erling Smørgrav 		bzero(gc, sizeof(*gc));
538d4af9e69SDag-Erling Smørgrav 		xfree(gc);
539d4af9e69SDag-Erling Smørgrav 	}
540d4af9e69SDag-Erling Smørgrav 
5417aee6ffeSDag-Erling Smørgrav 	packet_set_alive_timeouts(0);
542efcad6b7SDag-Erling Smørgrav }
543efcad6b7SDag-Erling Smørgrav 
544efcad6b7SDag-Erling Smørgrav static void
545efcad6b7SDag-Erling Smørgrav server_alive_check(void)
546efcad6b7SDag-Erling Smørgrav {
5477aee6ffeSDag-Erling Smørgrav 	if (packet_inc_alive_timeouts() > options.server_alive_count_max) {
5484a421b63SDag-Erling Smørgrav 		logit("Timeout, server %s not responding.", host);
54992eb0aa1SDag-Erling Smørgrav 		cleanup_exit(255);
55092eb0aa1SDag-Erling Smørgrav 	}
551efcad6b7SDag-Erling Smørgrav 	packet_start(SSH2_MSG_GLOBAL_REQUEST);
552efcad6b7SDag-Erling Smørgrav 	packet_put_cstring("keepalive@openssh.com");
553efcad6b7SDag-Erling Smørgrav 	packet_put_char(1);     /* boolean: want reply */
554efcad6b7SDag-Erling Smørgrav 	packet_send();
555d4af9e69SDag-Erling Smørgrav 	/* Insert an empty placeholder to maintain ordering */
556d4af9e69SDag-Erling Smørgrav 	client_register_global_confirm(NULL, NULL);
557efcad6b7SDag-Erling Smørgrav }
558efcad6b7SDag-Erling Smørgrav 
559511b41d2SMark Murray /*
560511b41d2SMark Murray  * Waits until the client can do something (some data becomes available on
561511b41d2SMark Murray  * one of the file descriptors).
562511b41d2SMark Murray  */
563ae1f160dSDag-Erling Smørgrav static void
5641e8db6e2SBrian Feldman client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp,
565d74d50a8SDag-Erling Smørgrav     int *maxfdp, u_int *nallocp, int rekeying)
566511b41d2SMark Murray {
567efcad6b7SDag-Erling Smørgrav 	struct timeval tv, *tvp;
568e2f6069cSDag-Erling Smørgrav 	int timeout_secs;
569efcad6b7SDag-Erling Smørgrav 	int ret;
570efcad6b7SDag-Erling Smørgrav 
5711e8db6e2SBrian Feldman 	/* Add any selections by the channel mechanism. */
572ae1f160dSDag-Erling Smørgrav 	channel_prepare_select(readsetp, writesetp, maxfdp, nallocp, rekeying);
573511b41d2SMark Murray 
574a04a10f8SKris Kennaway 	if (!compat20) {
575511b41d2SMark Murray 		/* Read from the connection, unless our buffers are full. */
576511b41d2SMark Murray 		if (buffer_len(&stdout_buffer) < buffer_high &&
577511b41d2SMark Murray 		    buffer_len(&stderr_buffer) < buffer_high &&
578511b41d2SMark Murray 		    channel_not_very_much_buffered_data())
5791e8db6e2SBrian Feldman 			FD_SET(connection_in, *readsetp);
580511b41d2SMark Murray 		/*
581511b41d2SMark Murray 		 * Read from stdin, unless we have seen EOF or have very much
582511b41d2SMark Murray 		 * buffered data to send to the server.
583511b41d2SMark Murray 		 */
584511b41d2SMark Murray 		if (!stdin_eof && packet_not_very_much_data_to_write())
5851e8db6e2SBrian Feldman 			FD_SET(fileno(stdin), *readsetp);
586511b41d2SMark Murray 
587a04a10f8SKris Kennaway 		/* Select stdout/stderr if have data in buffer. */
588a04a10f8SKris Kennaway 		if (buffer_len(&stdout_buffer) > 0)
5891e8db6e2SBrian Feldman 			FD_SET(fileno(stdout), *writesetp);
590a04a10f8SKris Kennaway 		if (buffer_len(&stderr_buffer) > 0)
5911e8db6e2SBrian Feldman 			FD_SET(fileno(stderr), *writesetp);
592a04a10f8SKris Kennaway 	} else {
593ae1f160dSDag-Erling Smørgrav 		/* channel_prepare_select could have closed the last channel */
594ae1f160dSDag-Erling Smørgrav 		if (session_closed && !channel_still_open() &&
595ae1f160dSDag-Erling Smørgrav 		    !packet_have_data_to_write()) {
596ae1f160dSDag-Erling Smørgrav 			/* clear mask since we did not call select() */
597ae1f160dSDag-Erling Smørgrav 			memset(*readsetp, 0, *nallocp);
598ae1f160dSDag-Erling Smørgrav 			memset(*writesetp, 0, *nallocp);
599ae1f160dSDag-Erling Smørgrav 			return;
600ae1f160dSDag-Erling Smørgrav 		} else {
6011e8db6e2SBrian Feldman 			FD_SET(connection_in, *readsetp);
602a04a10f8SKris Kennaway 		}
603ae1f160dSDag-Erling Smørgrav 	}
604511b41d2SMark Murray 
605511b41d2SMark Murray 	/* Select server connection if have data to write to the server. */
606511b41d2SMark Murray 	if (packet_have_data_to_write())
6071e8db6e2SBrian Feldman 		FD_SET(connection_out, *writesetp);
608511b41d2SMark Murray 
609511b41d2SMark Murray 	/*
610511b41d2SMark Murray 	 * Wait for something to happen.  This will suspend the process until
611511b41d2SMark Murray 	 * some selected descriptor can be read, written, or has some other
612e2f6069cSDag-Erling Smørgrav 	 * event pending, or a timeout expires.
613511b41d2SMark Murray 	 */
614511b41d2SMark Murray 
615e2f6069cSDag-Erling Smørgrav 	timeout_secs = INT_MAX; /* we use INT_MAX to mean no timeout */
616e2f6069cSDag-Erling Smørgrav 	if (options.server_alive_interval > 0 && compat20)
617e2f6069cSDag-Erling Smørgrav 		timeout_secs = options.server_alive_interval;
618e2f6069cSDag-Erling Smørgrav 	set_control_persist_exit_time();
619e2f6069cSDag-Erling Smørgrav 	if (control_persist_exit_time > 0) {
620e2f6069cSDag-Erling Smørgrav 		timeout_secs = MIN(timeout_secs,
621e2f6069cSDag-Erling Smørgrav 			control_persist_exit_time - time(NULL));
622e2f6069cSDag-Erling Smørgrav 		if (timeout_secs < 0)
623e2f6069cSDag-Erling Smørgrav 			timeout_secs = 0;
624e2f6069cSDag-Erling Smørgrav 	}
625e2f6069cSDag-Erling Smørgrav 	if (timeout_secs == INT_MAX)
626efcad6b7SDag-Erling Smørgrav 		tvp = NULL;
627efcad6b7SDag-Erling Smørgrav 	else {
628e2f6069cSDag-Erling Smørgrav 		tv.tv_sec = timeout_secs;
629efcad6b7SDag-Erling Smørgrav 		tv.tv_usec = 0;
630efcad6b7SDag-Erling Smørgrav 		tvp = &tv;
631efcad6b7SDag-Erling Smørgrav 	}
632e2f6069cSDag-Erling Smørgrav 
633efcad6b7SDag-Erling Smørgrav 	ret = select((*maxfdp)+1, *readsetp, *writesetp, NULL, tvp);
634efcad6b7SDag-Erling Smørgrav 	if (ret < 0) {
635511b41d2SMark Murray 		char buf[100];
6361e8db6e2SBrian Feldman 
6371e8db6e2SBrian Feldman 		/*
6381e8db6e2SBrian Feldman 		 * We have to clear the select masks, because we return.
6391e8db6e2SBrian Feldman 		 * We have to return, because the mainloop checks for the flags
6401e8db6e2SBrian Feldman 		 * set by the signal handlers.
6411e8db6e2SBrian Feldman 		 */
642ae1f160dSDag-Erling Smørgrav 		memset(*readsetp, 0, *nallocp);
643ae1f160dSDag-Erling Smørgrav 		memset(*writesetp, 0, *nallocp);
6441e8db6e2SBrian Feldman 
645511b41d2SMark Murray 		if (errno == EINTR)
646511b41d2SMark Murray 			return;
647511b41d2SMark Murray 		/* Note: we might still have data in the buffers. */
648511b41d2SMark Murray 		snprintf(buf, sizeof buf, "select: %s\r\n", strerror(errno));
649511b41d2SMark Murray 		buffer_append(&stderr_buffer, buf, strlen(buf));
650511b41d2SMark Murray 		quit_pending = 1;
651efcad6b7SDag-Erling Smørgrav 	} else if (ret == 0)
652efcad6b7SDag-Erling Smørgrav 		server_alive_check();
653511b41d2SMark Murray }
654511b41d2SMark Murray 
655ae1f160dSDag-Erling Smørgrav static void
656b66f2d16SKris Kennaway client_suspend_self(Buffer *bin, Buffer *bout, Buffer *berr)
657511b41d2SMark Murray {
658511b41d2SMark Murray 	/* Flush stdout and stderr buffers. */
659b66f2d16SKris Kennaway 	if (buffer_len(bout) > 0)
660d4af9e69SDag-Erling Smørgrav 		atomicio(vwrite, fileno(stdout), buffer_ptr(bout),
661d4af9e69SDag-Erling Smørgrav 		    buffer_len(bout));
662b66f2d16SKris Kennaway 	if (buffer_len(berr) > 0)
663d4af9e69SDag-Erling Smørgrav 		atomicio(vwrite, fileno(stderr), buffer_ptr(berr),
664d4af9e69SDag-Erling Smørgrav 		    buffer_len(berr));
665511b41d2SMark Murray 
666b15c8340SDag-Erling Smørgrav 	leave_raw_mode(force_tty_flag);
667511b41d2SMark Murray 
668511b41d2SMark Murray 	/*
669511b41d2SMark Murray 	 * Free (and clear) the buffer to reduce the amount of data that gets
670511b41d2SMark Murray 	 * written to swap.
671511b41d2SMark Murray 	 */
672b66f2d16SKris Kennaway 	buffer_free(bin);
673b66f2d16SKris Kennaway 	buffer_free(bout);
674b66f2d16SKris Kennaway 	buffer_free(berr);
675511b41d2SMark Murray 
676511b41d2SMark Murray 	/* Send the suspend signal to the program itself. */
677511b41d2SMark Murray 	kill(getpid(), SIGTSTP);
678511b41d2SMark Murray 
6795e8dbd04SDag-Erling Smørgrav 	/* Reset window sizes in case they have changed */
680511b41d2SMark Murray 	received_window_change_signal = 1;
681511b41d2SMark Murray 
682511b41d2SMark Murray 	/* OK, we have been continued by the user. Reinitialize buffers. */
683b66f2d16SKris Kennaway 	buffer_init(bin);
684b66f2d16SKris Kennaway 	buffer_init(bout);
685b66f2d16SKris Kennaway 	buffer_init(berr);
686511b41d2SMark Murray 
687b15c8340SDag-Erling Smørgrav 	enter_raw_mode(force_tty_flag);
688511b41d2SMark Murray }
689511b41d2SMark Murray 
690ae1f160dSDag-Erling Smørgrav static void
691a04a10f8SKris Kennaway client_process_net_input(fd_set *readset)
692511b41d2SMark Murray {
6937aee6ffeSDag-Erling Smørgrav 	int len, cont = 0;
6947aee6ffeSDag-Erling Smørgrav 	char buf[SSH_IOBUFSZ];
695511b41d2SMark Murray 
696511b41d2SMark Murray 	/*
697511b41d2SMark Murray 	 * Read input from the server, and add any such data to the buffer of
698511b41d2SMark Murray 	 * the packet subsystem.
699511b41d2SMark Murray 	 */
700511b41d2SMark Murray 	if (FD_ISSET(connection_in, readset)) {
701511b41d2SMark Murray 		/* Read as much as possible. */
7027aee6ffeSDag-Erling Smørgrav 		len = roaming_read(connection_in, buf, sizeof(buf), &cont);
7037aee6ffeSDag-Erling Smørgrav 		if (len == 0 && cont == 0) {
704d4af9e69SDag-Erling Smørgrav 			/*
705d4af9e69SDag-Erling Smørgrav 			 * Received EOF.  The remote host has closed the
706d4af9e69SDag-Erling Smørgrav 			 * connection.
707d4af9e69SDag-Erling Smørgrav 			 */
708d4af9e69SDag-Erling Smørgrav 			snprintf(buf, sizeof buf,
709d4af9e69SDag-Erling Smørgrav 			    "Connection to %.300s closed by remote host.\r\n",
710511b41d2SMark Murray 			    host);
711511b41d2SMark Murray 			buffer_append(&stderr_buffer, buf, strlen(buf));
712511b41d2SMark Murray 			quit_pending = 1;
713511b41d2SMark Murray 			return;
714511b41d2SMark Murray 		}
715511b41d2SMark Murray 		/*
716511b41d2SMark Murray 		 * There is a kernel bug on Solaris that causes select to
717511b41d2SMark Murray 		 * sometimes wake up even though there is no data available.
718511b41d2SMark Murray 		 */
719d4af9e69SDag-Erling Smørgrav 		if (len < 0 &&
720d4af9e69SDag-Erling Smørgrav 		    (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK))
721511b41d2SMark Murray 			len = 0;
722511b41d2SMark Murray 
723511b41d2SMark Murray 		if (len < 0) {
724d4af9e69SDag-Erling Smørgrav 			/*
725d4af9e69SDag-Erling Smørgrav 			 * An error has encountered.  Perhaps there is a
726d4af9e69SDag-Erling Smørgrav 			 * network problem.
727d4af9e69SDag-Erling Smørgrav 			 */
728d4af9e69SDag-Erling Smørgrav 			snprintf(buf, sizeof buf,
729d4af9e69SDag-Erling Smørgrav 			    "Read from remote host %.300s: %.100s\r\n",
730511b41d2SMark Murray 			    host, strerror(errno));
731511b41d2SMark Murray 			buffer_append(&stderr_buffer, buf, strlen(buf));
732511b41d2SMark Murray 			quit_pending = 1;
733511b41d2SMark Murray 			return;
734511b41d2SMark Murray 		}
735511b41d2SMark Murray 		packet_process_incoming(buf, len);
736511b41d2SMark Murray 	}
737a04a10f8SKris Kennaway }
738a04a10f8SKris Kennaway 
739545d5ecaSDag-Erling Smørgrav static void
740d4af9e69SDag-Erling Smørgrav client_status_confirm(int type, Channel *c, void *ctx)
741d74d50a8SDag-Erling Smørgrav {
742d4af9e69SDag-Erling Smørgrav 	struct channel_reply_ctx *cr = (struct channel_reply_ctx *)ctx;
743d4af9e69SDag-Erling Smørgrav 	char errmsg[256];
744d4af9e69SDag-Erling Smørgrav 	int tochan;
745d74d50a8SDag-Erling Smørgrav 
746d4af9e69SDag-Erling Smørgrav 	/* XXX supress on mux _client_ quietmode */
747d4af9e69SDag-Erling Smørgrav 	tochan = options.log_level >= SYSLOG_LEVEL_ERROR &&
748b15c8340SDag-Erling Smørgrav 	    c->ctl_chan != -1 && c->extended_usage == CHAN_EXTENDED_WRITE;
749d74d50a8SDag-Erling Smørgrav 
750d4af9e69SDag-Erling Smørgrav 	if (type == SSH2_MSG_CHANNEL_SUCCESS) {
751d4af9e69SDag-Erling Smørgrav 		debug2("%s request accepted on channel %d",
752d4af9e69SDag-Erling Smørgrav 		    cr->request_type, c->self);
753d4af9e69SDag-Erling Smørgrav 	} else if (type == SSH2_MSG_CHANNEL_FAILURE) {
754d4af9e69SDag-Erling Smørgrav 		if (tochan) {
755d4af9e69SDag-Erling Smørgrav 			snprintf(errmsg, sizeof(errmsg),
756d4af9e69SDag-Erling Smørgrav 			    "%s request failed\r\n", cr->request_type);
757d4af9e69SDag-Erling Smørgrav 		} else {
758d4af9e69SDag-Erling Smørgrav 			snprintf(errmsg, sizeof(errmsg),
759d4af9e69SDag-Erling Smørgrav 			    "%s request failed on channel %d",
760d4af9e69SDag-Erling Smørgrav 			    cr->request_type, c->self);
761d74d50a8SDag-Erling Smørgrav 		}
762d4af9e69SDag-Erling Smørgrav 		/* If error occurred on primary session channel, then exit */
763d4af9e69SDag-Erling Smørgrav 		if (cr->do_close && c->self == session_ident)
764d4af9e69SDag-Erling Smørgrav 			fatal("%s", errmsg);
765d4af9e69SDag-Erling Smørgrav 		/* If error occurred on mux client, append to their stderr */
766d4af9e69SDag-Erling Smørgrav 		if (tochan)
767d4af9e69SDag-Erling Smørgrav 			buffer_append(&c->extended, errmsg, strlen(errmsg));
768d4af9e69SDag-Erling Smørgrav 		else
769d4af9e69SDag-Erling Smørgrav 			error("%s", errmsg);
770d4af9e69SDag-Erling Smørgrav 		if (cr->do_close) {
771d4af9e69SDag-Erling Smørgrav 			chan_read_failed(c);
772d4af9e69SDag-Erling Smørgrav 			chan_write_failed(c);
773d74d50a8SDag-Erling Smørgrav 		}
774d74d50a8SDag-Erling Smørgrav 	}
775d4af9e69SDag-Erling Smørgrav 	xfree(cr);
776d4af9e69SDag-Erling Smørgrav }
777d74d50a8SDag-Erling Smørgrav 
778d74d50a8SDag-Erling Smørgrav static void
779d4af9e69SDag-Erling Smørgrav client_abandon_status_confirm(Channel *c, void *ctx)
780d74d50a8SDag-Erling Smørgrav {
781d4af9e69SDag-Erling Smørgrav 	xfree(ctx);
782d74d50a8SDag-Erling Smørgrav }
783d74d50a8SDag-Erling Smørgrav 
784d74d50a8SDag-Erling Smørgrav static void
785d4af9e69SDag-Erling Smørgrav client_expect_confirm(int id, const char *request, int do_close)
786d74d50a8SDag-Erling Smørgrav {
787d4af9e69SDag-Erling Smørgrav 	struct channel_reply_ctx *cr = xmalloc(sizeof(*cr));
788d74d50a8SDag-Erling Smørgrav 
789d4af9e69SDag-Erling Smørgrav 	cr->request_type = request;
790d4af9e69SDag-Erling Smørgrav 	cr->do_close = do_close;
791d74d50a8SDag-Erling Smørgrav 
792d4af9e69SDag-Erling Smørgrav 	channel_register_status_confirm(id, client_status_confirm,
793d4af9e69SDag-Erling Smørgrav 	    client_abandon_status_confirm, cr);
794d4af9e69SDag-Erling Smørgrav }
795d4af9e69SDag-Erling Smørgrav 
796d4af9e69SDag-Erling Smørgrav void
797d4af9e69SDag-Erling Smørgrav client_register_global_confirm(global_confirm_cb *cb, void *ctx)
798d4af9e69SDag-Erling Smørgrav {
799d4af9e69SDag-Erling Smørgrav 	struct global_confirm *gc, *last_gc;
800d4af9e69SDag-Erling Smørgrav 
801d4af9e69SDag-Erling Smørgrav 	/* Coalesce identical callbacks */
802d4af9e69SDag-Erling Smørgrav 	last_gc = TAILQ_LAST(&global_confirms, global_confirms);
803d4af9e69SDag-Erling Smørgrav 	if (last_gc && last_gc->cb == cb && last_gc->ctx == ctx) {
804d4af9e69SDag-Erling Smørgrav 		if (++last_gc->ref_count >= INT_MAX)
805d4af9e69SDag-Erling Smørgrav 			fatal("%s: last_gc->ref_count = %d",
806d4af9e69SDag-Erling Smørgrav 			    __func__, last_gc->ref_count);
807d74d50a8SDag-Erling Smørgrav 		return;
808d74d50a8SDag-Erling Smørgrav 	}
809d74d50a8SDag-Erling Smørgrav 
810d4af9e69SDag-Erling Smørgrav 	gc = xmalloc(sizeof(*gc));
811d4af9e69SDag-Erling Smørgrav 	gc->cb = cb;
812d4af9e69SDag-Erling Smørgrav 	gc->ctx = ctx;
813d4af9e69SDag-Erling Smørgrav 	gc->ref_count = 1;
814d4af9e69SDag-Erling Smørgrav 	TAILQ_INSERT_TAIL(&global_confirms, gc, entry);
815d74d50a8SDag-Erling Smørgrav }
816d74d50a8SDag-Erling Smørgrav 
817d74d50a8SDag-Erling Smørgrav static void
818545d5ecaSDag-Erling Smørgrav process_cmdline(void)
819545d5ecaSDag-Erling Smørgrav {
820545d5ecaSDag-Erling Smørgrav 	void (*handler)(int);
8215e8dbd04SDag-Erling Smørgrav 	char *s, *cmd, *cancel_host;
822d74d50a8SDag-Erling Smørgrav 	int delete = 0;
823cce7d346SDag-Erling Smørgrav 	int local = 0, remote = 0, dynamic = 0;
824cce7d346SDag-Erling Smørgrav 	int cancel_port;
8255e8dbd04SDag-Erling Smørgrav 	Forward fwd;
826545d5ecaSDag-Erling Smørgrav 
827d4af9e69SDag-Erling Smørgrav 	bzero(&fwd, sizeof(fwd));
828d4af9e69SDag-Erling Smørgrav 	fwd.listen_host = fwd.connect_host = NULL;
829d4af9e69SDag-Erling Smørgrav 
830b15c8340SDag-Erling Smørgrav 	leave_raw_mode(force_tty_flag);
831545d5ecaSDag-Erling Smørgrav 	handler = signal(SIGINT, SIG_IGN);
832545d5ecaSDag-Erling Smørgrav 	cmd = s = read_passphrase("\r\nssh> ", RP_ECHO);
833545d5ecaSDag-Erling Smørgrav 	if (s == NULL)
834545d5ecaSDag-Erling Smørgrav 		goto out;
835d4af9e69SDag-Erling Smørgrav 	while (isspace(*s))
836545d5ecaSDag-Erling Smørgrav 		s++;
837d74d50a8SDag-Erling Smørgrav 	if (*s == '-')
838d74d50a8SDag-Erling Smørgrav 		s++;	/* Skip cmdline '-', if any */
839d74d50a8SDag-Erling Smørgrav 	if (*s == '\0')
840545d5ecaSDag-Erling Smørgrav 		goto out;
841d74d50a8SDag-Erling Smørgrav 
842d74d50a8SDag-Erling Smørgrav 	if (*s == 'h' || *s == 'H' || *s == '?') {
843d74d50a8SDag-Erling Smørgrav 		logit("Commands:");
844761efaa7SDag-Erling Smørgrav 		logit("      -L[bind_address:]port:host:hostport    "
845761efaa7SDag-Erling Smørgrav 		    "Request local forward");
846761efaa7SDag-Erling Smørgrav 		logit("      -R[bind_address:]port:host:hostport    "
847761efaa7SDag-Erling Smørgrav 		    "Request remote forward");
848cce7d346SDag-Erling Smørgrav 		logit("      -D[bind_address:]port                  "
849cce7d346SDag-Erling Smørgrav 		    "Request dynamic forward");
850761efaa7SDag-Erling Smørgrav 		logit("      -KR[bind_address:]port                 "
851761efaa7SDag-Erling Smørgrav 		    "Cancel remote forward");
852021d409fSDag-Erling Smørgrav 		if (!options.permit_local_command)
853021d409fSDag-Erling Smørgrav 			goto out;
854761efaa7SDag-Erling Smørgrav 		logit("      !args                                  "
855761efaa7SDag-Erling Smørgrav 		    "Execute local command");
856021d409fSDag-Erling Smørgrav 		goto out;
857021d409fSDag-Erling Smørgrav 	}
858021d409fSDag-Erling Smørgrav 
859021d409fSDag-Erling Smørgrav 	if (*s == '!' && options.permit_local_command) {
860021d409fSDag-Erling Smørgrav 		s++;
861021d409fSDag-Erling Smørgrav 		ssh_local_cmd(s);
862d74d50a8SDag-Erling Smørgrav 		goto out;
863d74d50a8SDag-Erling Smørgrav 	}
864d74d50a8SDag-Erling Smørgrav 
865d74d50a8SDag-Erling Smørgrav 	if (*s == 'K') {
866d74d50a8SDag-Erling Smørgrav 		delete = 1;
867d74d50a8SDag-Erling Smørgrav 		s++;
868d74d50a8SDag-Erling Smørgrav 	}
869cce7d346SDag-Erling Smørgrav 	if (*s == 'L')
870cce7d346SDag-Erling Smørgrav 		local = 1;
871cce7d346SDag-Erling Smørgrav 	else if (*s == 'R')
872cce7d346SDag-Erling Smørgrav 		remote = 1;
873cce7d346SDag-Erling Smørgrav 	else if (*s == 'D')
874cce7d346SDag-Erling Smørgrav 		dynamic = 1;
875cce7d346SDag-Erling Smørgrav 	else {
876d95e11bfSDag-Erling Smørgrav 		logit("Invalid command.");
877545d5ecaSDag-Erling Smørgrav 		goto out;
878545d5ecaSDag-Erling Smørgrav 	}
879cce7d346SDag-Erling Smørgrav 
880cce7d346SDag-Erling Smørgrav 	if ((local || dynamic) && delete) {
881d74d50a8SDag-Erling Smørgrav 		logit("Not supported.");
882d74d50a8SDag-Erling Smørgrav 		goto out;
883d74d50a8SDag-Erling Smørgrav 	}
884cce7d346SDag-Erling Smørgrav 	if (remote && delete && !compat20) {
885d95e11bfSDag-Erling Smørgrav 		logit("Not supported for SSH protocol version 1.");
886545d5ecaSDag-Erling Smørgrav 		goto out;
887545d5ecaSDag-Erling Smørgrav 	}
888d74d50a8SDag-Erling Smørgrav 
889d4af9e69SDag-Erling Smørgrav 	while (isspace(*++s))
890d4af9e69SDag-Erling Smørgrav 		;
891545d5ecaSDag-Erling Smørgrav 
892b15c8340SDag-Erling Smørgrav 	/* XXX update list of forwards in options */
893d74d50a8SDag-Erling Smørgrav 	if (delete) {
8945e8dbd04SDag-Erling Smørgrav 		cancel_port = 0;
8955e8dbd04SDag-Erling Smørgrav 		cancel_host = hpdelim(&s);	/* may be NULL */
8965e8dbd04SDag-Erling Smørgrav 		if (s != NULL) {
8975e8dbd04SDag-Erling Smørgrav 			cancel_port = a2port(s);
8985e8dbd04SDag-Erling Smørgrav 			cancel_host = cleanhostname(cancel_host);
899d74d50a8SDag-Erling Smørgrav 		} else {
9005e8dbd04SDag-Erling Smørgrav 			cancel_port = a2port(cancel_host);
9015e8dbd04SDag-Erling Smørgrav 			cancel_host = NULL;
9025e8dbd04SDag-Erling Smørgrav 		}
903cce7d346SDag-Erling Smørgrav 		if (cancel_port <= 0) {
9045e8dbd04SDag-Erling Smørgrav 			logit("Bad forwarding close port");
905545d5ecaSDag-Erling Smørgrav 			goto out;
906545d5ecaSDag-Erling Smørgrav 		}
9075e8dbd04SDag-Erling Smørgrav 		channel_request_rforward_cancel(cancel_host, cancel_port);
9085e8dbd04SDag-Erling Smørgrav 	} else {
909cce7d346SDag-Erling Smørgrav 		if (!parse_forward(&fwd, s, dynamic, remote)) {
9105e8dbd04SDag-Erling Smørgrav 			logit("Bad forwarding specification.");
911545d5ecaSDag-Erling Smørgrav 			goto out;
912545d5ecaSDag-Erling Smørgrav 		}
913cce7d346SDag-Erling Smørgrav 		if (local || dynamic) {
9145e8dbd04SDag-Erling Smørgrav 			if (channel_setup_local_fwd_listener(fwd.listen_host,
9155e8dbd04SDag-Erling Smørgrav 			    fwd.listen_port, fwd.connect_host,
9165e8dbd04SDag-Erling Smørgrav 			    fwd.connect_port, options.gateway_ports) < 0) {
917d95e11bfSDag-Erling Smørgrav 				logit("Port forwarding failed.");
918545d5ecaSDag-Erling Smørgrav 				goto out;
919545d5ecaSDag-Erling Smørgrav 			}
9205e8dbd04SDag-Erling Smørgrav 		} else {
921761efaa7SDag-Erling Smørgrav 			if (channel_request_remote_forwarding(fwd.listen_host,
9225e8dbd04SDag-Erling Smørgrav 			    fwd.listen_port, fwd.connect_host,
923761efaa7SDag-Erling Smørgrav 			    fwd.connect_port) < 0) {
924761efaa7SDag-Erling Smørgrav 				logit("Port forwarding failed.");
925761efaa7SDag-Erling Smørgrav 				goto out;
926761efaa7SDag-Erling Smørgrav 			}
9275e8dbd04SDag-Erling Smørgrav 		}
9285e8dbd04SDag-Erling Smørgrav 
929d95e11bfSDag-Erling Smørgrav 		logit("Forwarding port.");
930d74d50a8SDag-Erling Smørgrav 	}
931d74d50a8SDag-Erling Smørgrav 
932545d5ecaSDag-Erling Smørgrav out:
933545d5ecaSDag-Erling Smørgrav 	signal(SIGINT, handler);
934b15c8340SDag-Erling Smørgrav 	enter_raw_mode(force_tty_flag);
935545d5ecaSDag-Erling Smørgrav 	if (cmd)
936545d5ecaSDag-Erling Smørgrav 		xfree(cmd);
937d4af9e69SDag-Erling Smørgrav 	if (fwd.listen_host != NULL)
938d4af9e69SDag-Erling Smørgrav 		xfree(fwd.listen_host);
939d4af9e69SDag-Erling Smørgrav 	if (fwd.connect_host != NULL)
940d4af9e69SDag-Erling Smørgrav 		xfree(fwd.connect_host);
941545d5ecaSDag-Erling Smørgrav }
942545d5ecaSDag-Erling Smørgrav 
943d4af9e69SDag-Erling Smørgrav /*
944d4af9e69SDag-Erling Smørgrav  * Process the characters one by one, call with c==NULL for proto1 case.
945d4af9e69SDag-Erling Smørgrav  */
946ae1f160dSDag-Erling Smørgrav static int
947d4af9e69SDag-Erling Smørgrav process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
948d4af9e69SDag-Erling Smørgrav     char *buf, int len)
949b66f2d16SKris Kennaway {
950b66f2d16SKris Kennaway 	char string[1024];
951b66f2d16SKris Kennaway 	pid_t pid;
952b66f2d16SKris Kennaway 	int bytes = 0;
9531e8db6e2SBrian Feldman 	u_int i;
9541e8db6e2SBrian Feldman 	u_char ch;
955b66f2d16SKris Kennaway 	char *s;
956d4af9e69SDag-Erling Smørgrav 	int *escape_pendingp, escape_char;
957d4af9e69SDag-Erling Smørgrav 	struct escape_filter_ctx *efc;
958d4af9e69SDag-Erling Smørgrav 
959d4af9e69SDag-Erling Smørgrav 	if (c == NULL) {
960d4af9e69SDag-Erling Smørgrav 		escape_pendingp = &escape_pending1;
961d4af9e69SDag-Erling Smørgrav 		escape_char = escape_char1;
962d4af9e69SDag-Erling Smørgrav 	} else {
963d4af9e69SDag-Erling Smørgrav 		if (c->filter_ctx == NULL)
964d4af9e69SDag-Erling Smørgrav 			return 0;
965d4af9e69SDag-Erling Smørgrav 		efc = (struct escape_filter_ctx *)c->filter_ctx;
966d4af9e69SDag-Erling Smørgrav 		escape_pendingp = &efc->escape_pending;
967d4af9e69SDag-Erling Smørgrav 		escape_char = efc->escape_char;
968d4af9e69SDag-Erling Smørgrav 	}
969b66f2d16SKris Kennaway 
970043840dfSDag-Erling Smørgrav 	if (len <= 0)
971043840dfSDag-Erling Smørgrav 		return (0);
972043840dfSDag-Erling Smørgrav 
973043840dfSDag-Erling Smørgrav 	for (i = 0; i < (u_int)len; i++) {
974b66f2d16SKris Kennaway 		/* Get one character at a time. */
975b66f2d16SKris Kennaway 		ch = buf[i];
976b66f2d16SKris Kennaway 
977d4af9e69SDag-Erling Smørgrav 		if (*escape_pendingp) {
978b66f2d16SKris Kennaway 			/* We have previously seen an escape character. */
979b66f2d16SKris Kennaway 			/* Clear the flag now. */
980d4af9e69SDag-Erling Smørgrav 			*escape_pendingp = 0;
981b66f2d16SKris Kennaway 
982b66f2d16SKris Kennaway 			/* Process the escaped character. */
983b66f2d16SKris Kennaway 			switch (ch) {
984b66f2d16SKris Kennaway 			case '.':
985b66f2d16SKris Kennaway 				/* Terminate the connection. */
986d4af9e69SDag-Erling Smørgrav 				snprintf(string, sizeof string, "%c.\r\n",
987d4af9e69SDag-Erling Smørgrav 				    escape_char);
988b66f2d16SKris Kennaway 				buffer_append(berr, string, strlen(string));
989b66f2d16SKris Kennaway 
990b15c8340SDag-Erling Smørgrav 				if (c && c->ctl_chan != -1) {
991d4af9e69SDag-Erling Smørgrav 					chan_read_failed(c);
992d4af9e69SDag-Erling Smørgrav 					chan_write_failed(c);
993d4af9e69SDag-Erling Smørgrav 					return 0;
994d4af9e69SDag-Erling Smørgrav 				} else
995b66f2d16SKris Kennaway 					quit_pending = 1;
996b66f2d16SKris Kennaway 				return -1;
997b66f2d16SKris Kennaway 
998b66f2d16SKris Kennaway 			case 'Z' - 64:
999d4af9e69SDag-Erling Smørgrav 				/* XXX support this for mux clients */
1000b15c8340SDag-Erling Smørgrav 				if (c && c->ctl_chan != -1) {
1001d4af9e69SDag-Erling Smørgrav  noescape:
1002d4af9e69SDag-Erling Smørgrav 					snprintf(string, sizeof string,
1003d4af9e69SDag-Erling Smørgrav 					    "%c%c escape not available to "
1004d4af9e69SDag-Erling Smørgrav 					    "multiplexed sessions\r\n",
1005d4af9e69SDag-Erling Smørgrav 					    escape_char, ch);
1006d4af9e69SDag-Erling Smørgrav 					buffer_append(berr, string,
1007d4af9e69SDag-Erling Smørgrav 					    strlen(string));
1008d4af9e69SDag-Erling Smørgrav 					continue;
1009d4af9e69SDag-Erling Smørgrav 				}
1010d4af9e69SDag-Erling Smørgrav 				/* Suspend the program. Inform the user */
1011d4af9e69SDag-Erling Smørgrav 				snprintf(string, sizeof string,
1012d4af9e69SDag-Erling Smørgrav 				    "%c^Z [suspend ssh]\r\n", escape_char);
1013b66f2d16SKris Kennaway 				buffer_append(berr, string, strlen(string));
1014b66f2d16SKris Kennaway 
1015b66f2d16SKris Kennaway 				/* Restore terminal modes and suspend. */
1016b66f2d16SKris Kennaway 				client_suspend_self(bin, bout, berr);
1017b66f2d16SKris Kennaway 
1018b66f2d16SKris Kennaway 				/* We have been continued. */
1019b66f2d16SKris Kennaway 				continue;
1020b66f2d16SKris Kennaway 
1021d95e11bfSDag-Erling Smørgrav 			case 'B':
1022d95e11bfSDag-Erling Smørgrav 				if (compat20) {
1023d95e11bfSDag-Erling Smørgrav 					snprintf(string, sizeof string,
1024d95e11bfSDag-Erling Smørgrav 					    "%cB\r\n", escape_char);
1025d95e11bfSDag-Erling Smørgrav 					buffer_append(berr, string,
1026d95e11bfSDag-Erling Smørgrav 					    strlen(string));
1027d95e11bfSDag-Erling Smørgrav 					channel_request_start(session_ident,
1028d95e11bfSDag-Erling Smørgrav 					    "break", 0);
1029d95e11bfSDag-Erling Smørgrav 					packet_put_int(1000);
1030d95e11bfSDag-Erling Smørgrav 					packet_send();
1031d95e11bfSDag-Erling Smørgrav 				}
1032d95e11bfSDag-Erling Smørgrav 				continue;
1033d95e11bfSDag-Erling Smørgrav 
10341e8db6e2SBrian Feldman 			case 'R':
10351e8db6e2SBrian Feldman 				if (compat20) {
10361e8db6e2SBrian Feldman 					if (datafellows & SSH_BUG_NOREKEY)
1037d4af9e69SDag-Erling Smørgrav 						logit("Server does not "
1038d4af9e69SDag-Erling Smørgrav 						    "support re-keying");
10391e8db6e2SBrian Feldman 					else
10401e8db6e2SBrian Feldman 						need_rekeying = 1;
10411e8db6e2SBrian Feldman 				}
10421e8db6e2SBrian Feldman 				continue;
10431e8db6e2SBrian Feldman 
1044b66f2d16SKris Kennaway 			case '&':
1045b15c8340SDag-Erling Smørgrav 				if (c && c->ctl_chan != -1)
1046d4af9e69SDag-Erling Smørgrav 					goto noescape;
1047b66f2d16SKris Kennaway 				/*
1048d4af9e69SDag-Erling Smørgrav 				 * Detach the program (continue to serve
1049d4af9e69SDag-Erling Smørgrav 				 * connections, but put in background and no
1050d4af9e69SDag-Erling Smørgrav 				 * more new connections).
1051b66f2d16SKris Kennaway 				 */
1052ae1f160dSDag-Erling Smørgrav 				/* Restore tty modes. */
1053b15c8340SDag-Erling Smørgrav 				leave_raw_mode(force_tty_flag);
1054ae1f160dSDag-Erling Smørgrav 
1055ae1f160dSDag-Erling Smørgrav 				/* Stop listening for new connections. */
1056ae1f160dSDag-Erling Smørgrav 				channel_stop_listening();
1057ae1f160dSDag-Erling Smørgrav 
1058ae1f160dSDag-Erling Smørgrav 				snprintf(string, sizeof string,
1059ae1f160dSDag-Erling Smørgrav 				    "%c& [backgrounded]\n", escape_char);
1060ae1f160dSDag-Erling Smørgrav 				buffer_append(berr, string, strlen(string));
1061ae1f160dSDag-Erling Smørgrav 
1062ae1f160dSDag-Erling Smørgrav 				/* Fork into background. */
1063ae1f160dSDag-Erling Smørgrav 				pid = fork();
1064ae1f160dSDag-Erling Smørgrav 				if (pid < 0) {
1065ae1f160dSDag-Erling Smørgrav 					error("fork: %.100s", strerror(errno));
1066ae1f160dSDag-Erling Smørgrav 					continue;
1067ae1f160dSDag-Erling Smørgrav 				}
1068ae1f160dSDag-Erling Smørgrav 				if (pid != 0) {	/* This is the parent. */
1069ae1f160dSDag-Erling Smørgrav 					/* The parent just exits. */
1070ae1f160dSDag-Erling Smørgrav 					exit(0);
1071ae1f160dSDag-Erling Smørgrav 				}
1072ae1f160dSDag-Erling Smørgrav 				/* The child continues serving connections. */
1073ae1f160dSDag-Erling Smørgrav 				if (compat20) {
1074ae1f160dSDag-Erling Smørgrav 					buffer_append(bin, "\004", 1);
1075ae1f160dSDag-Erling Smørgrav 					/* fake EOF on stdin */
1076ae1f160dSDag-Erling Smørgrav 					return -1;
1077ae1f160dSDag-Erling Smørgrav 				} else if (!stdin_eof) {
1078b66f2d16SKris Kennaway 					/*
1079d4af9e69SDag-Erling Smørgrav 					 * Sending SSH_CMSG_EOF alone does not
1080d4af9e69SDag-Erling Smørgrav 					 * always appear to be enough.  So we
1081d4af9e69SDag-Erling Smørgrav 					 * try to send an EOF character first.
1082b66f2d16SKris Kennaway 					 */
1083b66f2d16SKris Kennaway 					packet_start(SSH_CMSG_STDIN_DATA);
1084b66f2d16SKris Kennaway 					packet_put_string("\004", 1);
1085b66f2d16SKris Kennaway 					packet_send();
1086b66f2d16SKris Kennaway 					/* Close stdin. */
1087b66f2d16SKris Kennaway 					stdin_eof = 1;
1088b66f2d16SKris Kennaway 					if (buffer_len(bin) == 0) {
1089b66f2d16SKris Kennaway 						packet_start(SSH_CMSG_EOF);
1090b66f2d16SKris Kennaway 						packet_send();
1091b66f2d16SKris Kennaway 					}
1092b66f2d16SKris Kennaway 				}
1093b66f2d16SKris Kennaway 				continue;
1094b66f2d16SKris Kennaway 
1095b66f2d16SKris Kennaway 			case '?':
1096b15c8340SDag-Erling Smørgrav 				if (c && c->ctl_chan != -1) {
1097b66f2d16SKris Kennaway 					snprintf(string, sizeof string,
1098b66f2d16SKris Kennaway "%c?\r\n\
1099b66f2d16SKris Kennaway Supported escape sequences:\r\n\
1100d4af9e69SDag-Erling Smørgrav   %c.  - terminate session\r\n\
1101d4af9e69SDag-Erling Smørgrav   %cB  - send a BREAK to the remote system\r\n\
1102d4af9e69SDag-Erling Smørgrav   %cR  - Request rekey (SSH protocol 2 only)\r\n\
1103d4af9e69SDag-Erling Smørgrav   %c#  - list forwarded connections\r\n\
1104d4af9e69SDag-Erling Smørgrav   %c?  - this message\r\n\
1105d4af9e69SDag-Erling Smørgrav   %c%c  - send the escape character by typing it twice\r\n\
1106d4af9e69SDag-Erling Smørgrav (Note that escapes are only recognized immediately after newline.)\r\n",
1107d4af9e69SDag-Erling Smørgrav 					    escape_char, escape_char,
1108d4af9e69SDag-Erling Smørgrav 					    escape_char, escape_char,
1109d4af9e69SDag-Erling Smørgrav 					    escape_char, escape_char,
1110cce7d346SDag-Erling Smørgrav 					    escape_char, escape_char);
1111d4af9e69SDag-Erling Smørgrav 				} else {
1112d4af9e69SDag-Erling Smørgrav 					snprintf(string, sizeof string,
1113d4af9e69SDag-Erling Smørgrav "%c?\r\n\
1114d4af9e69SDag-Erling Smørgrav Supported escape sequences:\r\n\
1115d4af9e69SDag-Erling Smørgrav   %c.  - terminate connection (and any multiplexed sessions)\r\n\
1116d95e11bfSDag-Erling Smørgrav   %cB  - send a BREAK to the remote system\r\n\
11174b17dab0SDag-Erling Smørgrav   %cC  - open a command line\r\n\
11184b17dab0SDag-Erling Smørgrav   %cR  - Request rekey (SSH protocol 2 only)\r\n\
11194b17dab0SDag-Erling Smørgrav   %c^Z - suspend ssh\r\n\
11204b17dab0SDag-Erling Smørgrav   %c#  - list forwarded connections\r\n\
11214b17dab0SDag-Erling Smørgrav   %c&  - background ssh (when waiting for connections to terminate)\r\n\
11224b17dab0SDag-Erling Smørgrav   %c?  - this message\r\n\
11234b17dab0SDag-Erling Smørgrav   %c%c  - send the escape character by typing it twice\r\n\
1124b66f2d16SKris Kennaway (Note that escapes are only recognized immediately after newline.)\r\n",
1125d4af9e69SDag-Erling Smørgrav 					    escape_char, escape_char,
1126d4af9e69SDag-Erling Smørgrav 					    escape_char, escape_char,
1127d4af9e69SDag-Erling Smørgrav 					    escape_char, escape_char,
1128d4af9e69SDag-Erling Smørgrav 					    escape_char, escape_char,
1129d4af9e69SDag-Erling Smørgrav 					    escape_char, escape_char,
1130d4af9e69SDag-Erling Smørgrav 					    escape_char);
1131d4af9e69SDag-Erling Smørgrav 				}
1132b66f2d16SKris Kennaway 				buffer_append(berr, string, strlen(string));
1133b66f2d16SKris Kennaway 				continue;
1134b66f2d16SKris Kennaway 
1135b66f2d16SKris Kennaway 			case '#':
1136d4af9e69SDag-Erling Smørgrav 				snprintf(string, sizeof string, "%c#\r\n",
1137d4af9e69SDag-Erling Smørgrav 				    escape_char);
1138b66f2d16SKris Kennaway 				buffer_append(berr, string, strlen(string));
1139b66f2d16SKris Kennaway 				s = channel_open_message();
1140b66f2d16SKris Kennaway 				buffer_append(berr, s, strlen(s));
1141b66f2d16SKris Kennaway 				xfree(s);
1142b66f2d16SKris Kennaway 				continue;
1143b66f2d16SKris Kennaway 
1144545d5ecaSDag-Erling Smørgrav 			case 'C':
1145b15c8340SDag-Erling Smørgrav 				if (c && c->ctl_chan != -1)
1146cce7d346SDag-Erling Smørgrav 					goto noescape;
1147545d5ecaSDag-Erling Smørgrav 				process_cmdline();
1148545d5ecaSDag-Erling Smørgrav 				continue;
1149545d5ecaSDag-Erling Smørgrav 
1150b66f2d16SKris Kennaway 			default:
1151b66f2d16SKris Kennaway 				if (ch != escape_char) {
1152b66f2d16SKris Kennaway 					buffer_put_char(bin, escape_char);
1153b66f2d16SKris Kennaway 					bytes++;
1154b66f2d16SKris Kennaway 				}
1155b66f2d16SKris Kennaway 				/* Escaped characters fall through here */
1156b66f2d16SKris Kennaway 				break;
1157b66f2d16SKris Kennaway 			}
1158b66f2d16SKris Kennaway 		} else {
1159b66f2d16SKris Kennaway 			/*
1160d4af9e69SDag-Erling Smørgrav 			 * The previous character was not an escape char.
1161d4af9e69SDag-Erling Smørgrav 			 * Check if this is an escape.
1162b66f2d16SKris Kennaway 			 */
1163b66f2d16SKris Kennaway 			if (last_was_cr && ch == escape_char) {
1164d4af9e69SDag-Erling Smørgrav 				/*
1165d4af9e69SDag-Erling Smørgrav 				 * It is. Set the flag and continue to
1166d4af9e69SDag-Erling Smørgrav 				 * next character.
1167d4af9e69SDag-Erling Smørgrav 				 */
1168d4af9e69SDag-Erling Smørgrav 				*escape_pendingp = 1;
1169b66f2d16SKris Kennaway 				continue;
1170b66f2d16SKris Kennaway 			}
1171b66f2d16SKris Kennaway 		}
1172b66f2d16SKris Kennaway 
1173b66f2d16SKris Kennaway 		/*
1174b66f2d16SKris Kennaway 		 * Normal character.  Record whether it was a newline,
1175b66f2d16SKris Kennaway 		 * and append it to the buffer.
1176b66f2d16SKris Kennaway 		 */
1177b66f2d16SKris Kennaway 		last_was_cr = (ch == '\r' || ch == '\n');
1178b66f2d16SKris Kennaway 		buffer_put_char(bin, ch);
1179b66f2d16SKris Kennaway 		bytes++;
1180b66f2d16SKris Kennaway 	}
1181b66f2d16SKris Kennaway 	return bytes;
1182b66f2d16SKris Kennaway }
1183b66f2d16SKris Kennaway 
1184ae1f160dSDag-Erling Smørgrav static void
1185a04a10f8SKris Kennaway client_process_input(fd_set *readset)
1186a04a10f8SKris Kennaway {
1187a04a10f8SKris Kennaway 	int len;
11887aee6ffeSDag-Erling Smørgrav 	char buf[SSH_IOBUFSZ];
1189a04a10f8SKris Kennaway 
1190511b41d2SMark Murray 	/* Read input from stdin. */
1191511b41d2SMark Murray 	if (FD_ISSET(fileno(stdin), readset)) {
1192511b41d2SMark Murray 		/* Read as much as possible. */
1193511b41d2SMark Murray 		len = read(fileno(stdin), buf, sizeof(buf));
1194d4af9e69SDag-Erling Smørgrav 		if (len < 0 &&
1195d4af9e69SDag-Erling Smørgrav 		    (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK))
11961e8db6e2SBrian Feldman 			return;		/* we'll try again later */
1197511b41d2SMark Murray 		if (len <= 0) {
1198511b41d2SMark Murray 			/*
1199511b41d2SMark Murray 			 * Received EOF or error.  They are treated
1200511b41d2SMark Murray 			 * similarly, except that an error message is printed
1201511b41d2SMark Murray 			 * if it was an error condition.
1202511b41d2SMark Murray 			 */
1203511b41d2SMark Murray 			if (len < 0) {
1204d4af9e69SDag-Erling Smørgrav 				snprintf(buf, sizeof buf, "read: %.100s\r\n",
1205d4af9e69SDag-Erling Smørgrav 				    strerror(errno));
1206511b41d2SMark Murray 				buffer_append(&stderr_buffer, buf, strlen(buf));
1207511b41d2SMark Murray 			}
1208511b41d2SMark Murray 			/* Mark that we have seen EOF. */
1209511b41d2SMark Murray 			stdin_eof = 1;
1210511b41d2SMark Murray 			/*
1211511b41d2SMark Murray 			 * Send an EOF message to the server unless there is
1212511b41d2SMark Murray 			 * data in the buffer.  If there is data in the
1213511b41d2SMark Murray 			 * buffer, no message will be sent now.  Code
1214511b41d2SMark Murray 			 * elsewhere will send the EOF when the buffer
1215511b41d2SMark Murray 			 * becomes empty if stdin_eof is set.
1216511b41d2SMark Murray 			 */
1217511b41d2SMark Murray 			if (buffer_len(&stdin_buffer) == 0) {
1218511b41d2SMark Murray 				packet_start(SSH_CMSG_EOF);
1219511b41d2SMark Murray 				packet_send();
1220511b41d2SMark Murray 			}
1221d4af9e69SDag-Erling Smørgrav 		} else if (escape_char1 == SSH_ESCAPECHAR_NONE) {
1222511b41d2SMark Murray 			/*
1223511b41d2SMark Murray 			 * Normal successful read, and no escape character.
1224511b41d2SMark Murray 			 * Just append the data to buffer.
1225511b41d2SMark Murray 			 */
1226511b41d2SMark Murray 			buffer_append(&stdin_buffer, buf, len);
1227511b41d2SMark Murray 		} else {
1228511b41d2SMark Murray 			/*
1229d4af9e69SDag-Erling Smørgrav 			 * Normal, successful read.  But we have an escape
1230d4af9e69SDag-Erling Smørgrav 			 * character and have to process the characters one
1231d4af9e69SDag-Erling Smørgrav 			 * by one.
1232511b41d2SMark Murray 			 */
1233d4af9e69SDag-Erling Smørgrav 			if (process_escapes(NULL, &stdin_buffer,
1234d4af9e69SDag-Erling Smørgrav 			    &stdout_buffer, &stderr_buffer, buf, len) == -1)
1235511b41d2SMark Murray 				return;
1236511b41d2SMark Murray 		}
1237511b41d2SMark Murray 	}
1238511b41d2SMark Murray }
1239511b41d2SMark Murray 
1240ae1f160dSDag-Erling Smørgrav static void
1241511b41d2SMark Murray client_process_output(fd_set *writeset)
1242511b41d2SMark Murray {
1243511b41d2SMark Murray 	int len;
1244511b41d2SMark Murray 	char buf[100];
1245511b41d2SMark Murray 
1246511b41d2SMark Murray 	/* Write buffered output to stdout. */
1247511b41d2SMark Murray 	if (FD_ISSET(fileno(stdout), writeset)) {
1248511b41d2SMark Murray 		/* Write as much data as possible. */
1249511b41d2SMark Murray 		len = write(fileno(stdout), buffer_ptr(&stdout_buffer),
1250511b41d2SMark Murray 		    buffer_len(&stdout_buffer));
1251511b41d2SMark Murray 		if (len <= 0) {
1252d4af9e69SDag-Erling Smørgrav 			if (errno == EINTR || errno == EAGAIN ||
1253d4af9e69SDag-Erling Smørgrav 			    errno == EWOULDBLOCK)
1254511b41d2SMark Murray 				len = 0;
1255511b41d2SMark Murray 			else {
1256511b41d2SMark Murray 				/*
1257511b41d2SMark Murray 				 * An error or EOF was encountered.  Put an
1258511b41d2SMark Murray 				 * error message to stderr buffer.
1259511b41d2SMark Murray 				 */
1260d4af9e69SDag-Erling Smørgrav 				snprintf(buf, sizeof buf,
1261d4af9e69SDag-Erling Smørgrav 				    "write stdout: %.50s\r\n", strerror(errno));
1262511b41d2SMark Murray 				buffer_append(&stderr_buffer, buf, strlen(buf));
1263511b41d2SMark Murray 				quit_pending = 1;
1264511b41d2SMark Murray 				return;
1265511b41d2SMark Murray 			}
1266511b41d2SMark Murray 		}
1267511b41d2SMark Murray 		/* Consume printed data from the buffer. */
1268511b41d2SMark Murray 		buffer_consume(&stdout_buffer, len);
1269511b41d2SMark Murray 	}
1270511b41d2SMark Murray 	/* Write buffered output to stderr. */
1271511b41d2SMark Murray 	if (FD_ISSET(fileno(stderr), writeset)) {
1272511b41d2SMark Murray 		/* Write as much data as possible. */
1273511b41d2SMark Murray 		len = write(fileno(stderr), buffer_ptr(&stderr_buffer),
1274511b41d2SMark Murray 		    buffer_len(&stderr_buffer));
1275511b41d2SMark Murray 		if (len <= 0) {
1276d4af9e69SDag-Erling Smørgrav 			if (errno == EINTR || errno == EAGAIN ||
1277d4af9e69SDag-Erling Smørgrav 			    errno == EWOULDBLOCK)
1278511b41d2SMark Murray 				len = 0;
1279511b41d2SMark Murray 			else {
1280d4af9e69SDag-Erling Smørgrav 				/*
1281d4af9e69SDag-Erling Smørgrav 				 * EOF or error, but can't even print
1282d4af9e69SDag-Erling Smørgrav 				 * error message.
1283d4af9e69SDag-Erling Smørgrav 				 */
1284511b41d2SMark Murray 				quit_pending = 1;
1285511b41d2SMark Murray 				return;
1286511b41d2SMark Murray 			}
1287511b41d2SMark Murray 		}
1288511b41d2SMark Murray 		/* Consume printed characters from the buffer. */
1289511b41d2SMark Murray 		buffer_consume(&stderr_buffer, len);
1290511b41d2SMark Murray 	}
1291511b41d2SMark Murray }
1292511b41d2SMark Murray 
1293511b41d2SMark Murray /*
1294a04a10f8SKris Kennaway  * Get packets from the connection input buffer, and process them as long as
1295a04a10f8SKris Kennaway  * there are packets available.
1296a04a10f8SKris Kennaway  *
1297a04a10f8SKris Kennaway  * Any unknown packets received during the actual
1298a04a10f8SKris Kennaway  * session cause the session to terminate.  This is
1299a04a10f8SKris Kennaway  * intended to make debugging easier since no
1300a04a10f8SKris Kennaway  * confirmations are sent.  Any compatible protocol
1301a04a10f8SKris Kennaway  * extensions must be negotiated during the
1302a04a10f8SKris Kennaway  * preparatory phase.
1303a04a10f8SKris Kennaway  */
1304a04a10f8SKris Kennaway 
1305ae1f160dSDag-Erling Smørgrav static void
13061e8db6e2SBrian Feldman client_process_buffered_input_packets(void)
1307a04a10f8SKris Kennaway {
1308d4af9e69SDag-Erling Smørgrav 	dispatch_run(DISPATCH_NONBLOCK, &quit_pending,
1309d4af9e69SDag-Erling Smørgrav 	    compat20 ? xxx_kex : NULL);
1310a04a10f8SKris Kennaway }
1311a04a10f8SKris Kennaway 
1312b66f2d16SKris Kennaway /* scan buf[] for '~' before sending data to the peer */
1313b66f2d16SKris Kennaway 
1314d4af9e69SDag-Erling Smørgrav /* Helper: allocate a new escape_filter_ctx and fill in its escape char */
1315d4af9e69SDag-Erling Smørgrav void *
1316d4af9e69SDag-Erling Smørgrav client_new_escape_filter_ctx(int escape_char)
1317b66f2d16SKris Kennaway {
1318d4af9e69SDag-Erling Smørgrav 	struct escape_filter_ctx *ret;
1319d4af9e69SDag-Erling Smørgrav 
1320d4af9e69SDag-Erling Smørgrav 	ret = xmalloc(sizeof(*ret));
1321d4af9e69SDag-Erling Smørgrav 	ret->escape_pending = 0;
1322d4af9e69SDag-Erling Smørgrav 	ret->escape_char = escape_char;
1323d4af9e69SDag-Erling Smørgrav 	return (void *)ret;
1324d4af9e69SDag-Erling Smørgrav }
1325d4af9e69SDag-Erling Smørgrav 
1326d4af9e69SDag-Erling Smørgrav /* Free the escape filter context on channel free */
1327d4af9e69SDag-Erling Smørgrav void
1328d4af9e69SDag-Erling Smørgrav client_filter_cleanup(int cid, void *ctx)
1329d4af9e69SDag-Erling Smørgrav {
1330d4af9e69SDag-Erling Smørgrav 	xfree(ctx);
1331d4af9e69SDag-Erling Smørgrav }
1332d4af9e69SDag-Erling Smørgrav 
1333d4af9e69SDag-Erling Smørgrav int
1334d4af9e69SDag-Erling Smørgrav client_simple_escape_filter(Channel *c, char *buf, int len)
1335d4af9e69SDag-Erling Smørgrav {
1336d4af9e69SDag-Erling Smørgrav 	if (c->extended_usage != CHAN_EXTENDED_WRITE)
1337d4af9e69SDag-Erling Smørgrav 		return 0;
1338d4af9e69SDag-Erling Smørgrav 
1339d4af9e69SDag-Erling Smørgrav 	return process_escapes(c, &c->input, &c->output, &c->extended,
1340d4af9e69SDag-Erling Smørgrav 	    buf, len);
1341b66f2d16SKris Kennaway }
1342b66f2d16SKris Kennaway 
1343ae1f160dSDag-Erling Smørgrav static void
13441e8db6e2SBrian Feldman client_channel_closed(int id, void *arg)
13451e8db6e2SBrian Feldman {
1346ae1f160dSDag-Erling Smørgrav 	channel_cancel_cleanup(id);
13471e8db6e2SBrian Feldman 	session_closed = 1;
1348b15c8340SDag-Erling Smørgrav 	leave_raw_mode(force_tty_flag);
13491e8db6e2SBrian Feldman }
13501e8db6e2SBrian Feldman 
1351a04a10f8SKris Kennaway /*
1352511b41d2SMark Murray  * Implements the interactive session with the server.  This is called after
1353511b41d2SMark Murray  * the user has been authenticated, and a command has been started on the
1354ae1f160dSDag-Erling Smørgrav  * remote host.  If escape_char != SSH_ESCAPECHAR_NONE, it is the character
1355ae1f160dSDag-Erling Smørgrav  * used as an escape character for terminating or suspending the session.
1356511b41d2SMark Murray  */
1357511b41d2SMark Murray 
1358511b41d2SMark Murray int
1359b66f2d16SKris Kennaway client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
1360511b41d2SMark Murray {
13611e8db6e2SBrian Feldman 	fd_set *readset = NULL, *writeset = NULL;
1362511b41d2SMark Murray 	double start_time, total_time;
1363d74d50a8SDag-Erling Smørgrav 	int max_fd = 0, max_fd2 = 0, len, rekeying = 0;
1364d4af9e69SDag-Erling Smørgrav 	u_int64_t ibytes, obytes;
1365d74d50a8SDag-Erling Smørgrav 	u_int nalloc = 0;
1366511b41d2SMark Murray 	char buf[100];
1367511b41d2SMark Murray 
1368511b41d2SMark Murray 	debug("Entering interactive session.");
1369511b41d2SMark Murray 
1370511b41d2SMark Murray 	start_time = get_current_time();
1371511b41d2SMark Murray 
1372511b41d2SMark Murray 	/* Initialize variables. */
1373d4af9e69SDag-Erling Smørgrav 	escape_pending1 = 0;
1374511b41d2SMark Murray 	last_was_cr = 1;
1375511b41d2SMark Murray 	exit_status = -1;
1376511b41d2SMark Murray 	stdin_eof = 0;
1377511b41d2SMark Murray 	buffer_high = 64 * 1024;
1378511b41d2SMark Murray 	connection_in = packet_get_connection_in();
1379511b41d2SMark Murray 	connection_out = packet_get_connection_out();
13801e8db6e2SBrian Feldman 	max_fd = MAX(connection_in, connection_out);
13811e8db6e2SBrian Feldman 
13821e8db6e2SBrian Feldman 	if (!compat20) {
13831e8db6e2SBrian Feldman 		/* enable nonblocking unless tty */
13841e8db6e2SBrian Feldman 		if (!isatty(fileno(stdin)))
13851e8db6e2SBrian Feldman 			set_nonblock(fileno(stdin));
13861e8db6e2SBrian Feldman 		if (!isatty(fileno(stdout)))
13871e8db6e2SBrian Feldman 			set_nonblock(fileno(stdout));
13881e8db6e2SBrian Feldman 		if (!isatty(fileno(stderr)))
13891e8db6e2SBrian Feldman 			set_nonblock(fileno(stderr));
13901e8db6e2SBrian Feldman 		max_fd = MAX(max_fd, fileno(stdin));
13911e8db6e2SBrian Feldman 		max_fd = MAX(max_fd, fileno(stdout));
13921e8db6e2SBrian Feldman 		max_fd = MAX(max_fd, fileno(stderr));
13931e8db6e2SBrian Feldman 	}
1394511b41d2SMark Murray 	quit_pending = 0;
1395d4af9e69SDag-Erling Smørgrav 	escape_char1 = escape_char_arg;
1396511b41d2SMark Murray 
1397511b41d2SMark Murray 	/* Initialize buffers. */
1398511b41d2SMark Murray 	buffer_init(&stdin_buffer);
1399511b41d2SMark Murray 	buffer_init(&stdout_buffer);
1400511b41d2SMark Murray 	buffer_init(&stderr_buffer);
1401511b41d2SMark Murray 
1402a04a10f8SKris Kennaway 	client_init_dispatch();
1403a04a10f8SKris Kennaway 
1404d0c8c0bcSDag-Erling Smørgrav 	/*
1405d0c8c0bcSDag-Erling Smørgrav 	 * Set signal handlers, (e.g. to restore non-blocking mode)
1406d0c8c0bcSDag-Erling Smørgrav 	 * but don't overwrite SIG_IGN, matches behaviour from rsh(1)
1407d0c8c0bcSDag-Erling Smørgrav 	 */
14085e8dbd04SDag-Erling Smørgrav 	if (signal(SIGHUP, SIG_IGN) != SIG_IGN)
14095e8dbd04SDag-Erling Smørgrav 		signal(SIGHUP, signal_handler);
1410d0c8c0bcSDag-Erling Smørgrav 	if (signal(SIGINT, SIG_IGN) != SIG_IGN)
1411511b41d2SMark Murray 		signal(SIGINT, signal_handler);
1412d0c8c0bcSDag-Erling Smørgrav 	if (signal(SIGQUIT, SIG_IGN) != SIG_IGN)
1413511b41d2SMark Murray 		signal(SIGQUIT, signal_handler);
1414d0c8c0bcSDag-Erling Smørgrav 	if (signal(SIGTERM, SIG_IGN) != SIG_IGN)
1415511b41d2SMark Murray 		signal(SIGTERM, signal_handler);
1416511b41d2SMark Murray 	signal(SIGWINCH, window_change_handler);
1417511b41d2SMark Murray 
1418511b41d2SMark Murray 	if (have_pty)
1419b15c8340SDag-Erling Smørgrav 		enter_raw_mode(force_tty_flag);
1420511b41d2SMark Murray 
14211e8db6e2SBrian Feldman 	if (compat20) {
14221e8db6e2SBrian Feldman 		session_ident = ssh2_chan_id;
1423d4af9e69SDag-Erling Smørgrav 		if (escape_char_arg != SSH_ESCAPECHAR_NONE)
14241e8db6e2SBrian Feldman 			channel_register_filter(session_ident,
1425d4af9e69SDag-Erling Smørgrav 			    client_simple_escape_filter, NULL,
1426d4af9e69SDag-Erling Smørgrav 			    client_filter_cleanup,
1427d4af9e69SDag-Erling Smørgrav 			    client_new_escape_filter_ctx(escape_char_arg));
14281e8db6e2SBrian Feldman 		if (session_ident != -1)
14291e8db6e2SBrian Feldman 			channel_register_cleanup(session_ident,
1430021d409fSDag-Erling Smørgrav 			    client_channel_closed, 0);
14311e8db6e2SBrian Feldman 	} else {
1432b66f2d16SKris Kennaway 		/* Check if we should immediately send eof on stdin. */
1433511b41d2SMark Murray 		client_check_initial_eof_on_stdin();
14341e8db6e2SBrian Feldman 	}
1435b66f2d16SKris Kennaway 
1436511b41d2SMark Murray 	/* Main loop of the client for the interactive session mode. */
1437511b41d2SMark Murray 	while (!quit_pending) {
1438511b41d2SMark Murray 
1439511b41d2SMark Murray 		/* Process buffered packets sent by the server. */
1440511b41d2SMark Murray 		client_process_buffered_input_packets();
1441511b41d2SMark Murray 
14421e8db6e2SBrian Feldman 		if (compat20 && session_closed && !channel_still_open())
1443a04a10f8SKris Kennaway 			break;
1444a04a10f8SKris Kennaway 
14451e8db6e2SBrian Feldman 		rekeying = (xxx_kex != NULL && !xxx_kex->done);
14461e8db6e2SBrian Feldman 
14471e8db6e2SBrian Feldman 		if (rekeying) {
14481e8db6e2SBrian Feldman 			debug("rekeying in progress");
14491e8db6e2SBrian Feldman 		} else {
1450511b41d2SMark Murray 			/*
14511e8db6e2SBrian Feldman 			 * Make packets of buffered stdin data, and buffer
14521e8db6e2SBrian Feldman 			 * them for sending to the server.
1453511b41d2SMark Murray 			 */
1454a04a10f8SKris Kennaway 			if (!compat20)
1455511b41d2SMark Murray 				client_make_packets_from_stdin_data();
1456511b41d2SMark Murray 
1457511b41d2SMark Murray 			/*
14581e8db6e2SBrian Feldman 			 * Make packets from buffered channel data, and
14591e8db6e2SBrian Feldman 			 * enqueue them for sending to the server.
1460511b41d2SMark Murray 			 */
1461511b41d2SMark Murray 			if (packet_not_very_much_data_to_write())
1462511b41d2SMark Murray 				channel_output_poll();
1463511b41d2SMark Murray 
1464511b41d2SMark Murray 			/*
14651e8db6e2SBrian Feldman 			 * Check if the window size has changed, and buffer a
14661e8db6e2SBrian Feldman 			 * message about it to the server if so.
1467511b41d2SMark Murray 			 */
1468511b41d2SMark Murray 			client_check_window_change();
1469511b41d2SMark Murray 
1470511b41d2SMark Murray 			if (quit_pending)
1471511b41d2SMark Murray 				break;
14721e8db6e2SBrian Feldman 		}
1473511b41d2SMark Murray 		/*
1474511b41d2SMark Murray 		 * Wait until we have something to do (something becomes
1475511b41d2SMark Murray 		 * available on one of the descriptors).
1476511b41d2SMark Murray 		 */
1477ae1f160dSDag-Erling Smørgrav 		max_fd2 = max_fd;
14781e8db6e2SBrian Feldman 		client_wait_until_can_do_something(&readset, &writeset,
1479ae1f160dSDag-Erling Smørgrav 		    &max_fd2, &nalloc, rekeying);
1480511b41d2SMark Murray 
1481511b41d2SMark Murray 		if (quit_pending)
1482511b41d2SMark Murray 			break;
1483511b41d2SMark Murray 
14841e8db6e2SBrian Feldman 		/* Do channel operations unless rekeying in progress. */
14851e8db6e2SBrian Feldman 		if (!rekeying) {
14861e8db6e2SBrian Feldman 			channel_after_select(readset, writeset);
1487d95e11bfSDag-Erling Smørgrav 			if (need_rekeying || packet_need_rekeying()) {
1488d95e11bfSDag-Erling Smørgrav 				debug("need rekeying");
14891e8db6e2SBrian Feldman 				xxx_kex->done = 0;
14901e8db6e2SBrian Feldman 				kex_send_kexinit(xxx_kex);
14911e8db6e2SBrian Feldman 				need_rekeying = 0;
14921e8db6e2SBrian Feldman 			}
14931e8db6e2SBrian Feldman 		}
1494511b41d2SMark Murray 
1495a04a10f8SKris Kennaway 		/* Buffer input from the connection.  */
14961e8db6e2SBrian Feldman 		client_process_net_input(readset);
1497511b41d2SMark Murray 
1498a04a10f8SKris Kennaway 		if (quit_pending)
1499a04a10f8SKris Kennaway 			break;
1500a04a10f8SKris Kennaway 
1501a04a10f8SKris Kennaway 		if (!compat20) {
1502a04a10f8SKris Kennaway 			/* Buffer data from stdin */
15031e8db6e2SBrian Feldman 			client_process_input(readset);
1504511b41d2SMark Murray 			/*
1505a04a10f8SKris Kennaway 			 * Process output to stdout and stderr.  Output to
1506a04a10f8SKris Kennaway 			 * the connection is processed elsewhere (above).
1507511b41d2SMark Murray 			 */
15081e8db6e2SBrian Feldman 			client_process_output(writeset);
1509a04a10f8SKris Kennaway 		}
1510511b41d2SMark Murray 
1511b15c8340SDag-Erling Smørgrav 		if (session_resumed) {
1512b15c8340SDag-Erling Smørgrav 			connection_in = packet_get_connection_in();
1513b15c8340SDag-Erling Smørgrav 			connection_out = packet_get_connection_out();
1514b15c8340SDag-Erling Smørgrav 			max_fd = MAX(max_fd, connection_out);
1515b15c8340SDag-Erling Smørgrav 			max_fd = MAX(max_fd, connection_in);
1516b15c8340SDag-Erling Smørgrav 			session_resumed = 0;
1517b15c8340SDag-Erling Smørgrav 		}
1518b15c8340SDag-Erling Smørgrav 
1519d4af9e69SDag-Erling Smørgrav 		/*
1520d4af9e69SDag-Erling Smørgrav 		 * Send as much buffered packet data as possible to the
1521d4af9e69SDag-Erling Smørgrav 		 * sender.
1522d4af9e69SDag-Erling Smørgrav 		 */
15231e8db6e2SBrian Feldman 		if (FD_ISSET(connection_out, writeset))
1524511b41d2SMark Murray 			packet_write_poll();
1525e2f6069cSDag-Erling Smørgrav 
1526e2f6069cSDag-Erling Smørgrav 		/*
1527e2f6069cSDag-Erling Smørgrav 		 * If we are a backgrounded control master, and the
1528e2f6069cSDag-Erling Smørgrav 		 * timeout has expired without any active client
1529e2f6069cSDag-Erling Smørgrav 		 * connections, then quit.
1530e2f6069cSDag-Erling Smørgrav 		 */
1531e2f6069cSDag-Erling Smørgrav 		if (control_persist_exit_time > 0) {
1532e2f6069cSDag-Erling Smørgrav 			if (time(NULL) >= control_persist_exit_time) {
1533e2f6069cSDag-Erling Smørgrav 				debug("ControlPersist timeout expired");
1534e2f6069cSDag-Erling Smørgrav 				break;
1535e2f6069cSDag-Erling Smørgrav 			}
1536e2f6069cSDag-Erling Smørgrav 		}
1537511b41d2SMark Murray 	}
15381e8db6e2SBrian Feldman 	if (readset)
15391e8db6e2SBrian Feldman 		xfree(readset);
15401e8db6e2SBrian Feldman 	if (writeset)
15411e8db6e2SBrian Feldman 		xfree(writeset);
1542511b41d2SMark Murray 
1543511b41d2SMark Murray 	/* Terminate the session. */
1544511b41d2SMark Murray 
1545511b41d2SMark Murray 	/* Stop watching for window change. */
1546511b41d2SMark Murray 	signal(SIGWINCH, SIG_DFL);
1547511b41d2SMark Murray 
15487aee6ffeSDag-Erling Smørgrav 	if (compat20) {
15497aee6ffeSDag-Erling Smørgrav 		packet_start(SSH2_MSG_DISCONNECT);
15507aee6ffeSDag-Erling Smørgrav 		packet_put_int(SSH2_DISCONNECT_BY_APPLICATION);
15517aee6ffeSDag-Erling Smørgrav 		packet_put_cstring("disconnected by user");
15528ad9b54aSDag-Erling Smørgrav 		packet_put_cstring(""); /* language tag */
15537aee6ffeSDag-Erling Smørgrav 		packet_send();
15547aee6ffeSDag-Erling Smørgrav 		packet_write_wait();
15557aee6ffeSDag-Erling Smørgrav 	}
15567aee6ffeSDag-Erling Smørgrav 
1557ae1f160dSDag-Erling Smørgrav 	channel_free_all();
1558ae1f160dSDag-Erling Smørgrav 
1559ae1f160dSDag-Erling Smørgrav 	if (have_pty)
1560b15c8340SDag-Erling Smørgrav 		leave_raw_mode(force_tty_flag);
1561ae1f160dSDag-Erling Smørgrav 
1562ae1f160dSDag-Erling Smørgrav 	/* restore blocking io */
1563ae1f160dSDag-Erling Smørgrav 	if (!isatty(fileno(stdin)))
1564ae1f160dSDag-Erling Smørgrav 		unset_nonblock(fileno(stdin));
1565ae1f160dSDag-Erling Smørgrav 	if (!isatty(fileno(stdout)))
1566ae1f160dSDag-Erling Smørgrav 		unset_nonblock(fileno(stdout));
1567ae1f160dSDag-Erling Smørgrav 	if (!isatty(fileno(stderr)))
1568ae1f160dSDag-Erling Smørgrav 		unset_nonblock(fileno(stderr));
1569ae1f160dSDag-Erling Smørgrav 
1570efcad6b7SDag-Erling Smørgrav 	/*
1571efcad6b7SDag-Erling Smørgrav 	 * If there was no shell or command requested, there will be no remote
1572efcad6b7SDag-Erling Smørgrav 	 * exit status to be returned.  In that case, clear error code if the
1573efcad6b7SDag-Erling Smørgrav 	 * connection was deliberately terminated at this end.
1574efcad6b7SDag-Erling Smørgrav 	 */
1575efcad6b7SDag-Erling Smørgrav 	if (no_shell_flag && received_signal == SIGTERM) {
1576efcad6b7SDag-Erling Smørgrav 		received_signal = 0;
1577efcad6b7SDag-Erling Smørgrav 		exit_status = 0;
1578ae1f160dSDag-Erling Smørgrav 	}
1579511b41d2SMark Murray 
1580efcad6b7SDag-Erling Smørgrav 	if (received_signal)
1581efcad6b7SDag-Erling Smørgrav 		fatal("Killed by signal %d.", (int) received_signal);
1582efcad6b7SDag-Erling Smørgrav 
1583511b41d2SMark Murray 	/*
1584511b41d2SMark Murray 	 * In interactive mode (with pseudo tty) display a message indicating
1585511b41d2SMark Murray 	 * that the connection has been closed.
1586511b41d2SMark Murray 	 */
1587511b41d2SMark Murray 	if (have_pty && options.log_level != SYSLOG_LEVEL_QUIET) {
1588d4af9e69SDag-Erling Smørgrav 		snprintf(buf, sizeof buf,
1589d4af9e69SDag-Erling Smørgrav 		    "Connection to %.64s closed.\r\n", host);
1590511b41d2SMark Murray 		buffer_append(&stderr_buffer, buf, strlen(buf));
1591511b41d2SMark Murray 	}
1592ae1f160dSDag-Erling Smørgrav 
1593511b41d2SMark Murray 	/* Output any buffered data for stdout. */
15944a421b63SDag-Erling Smørgrav 	if (buffer_len(&stdout_buffer) > 0) {
15954a421b63SDag-Erling Smørgrav 		len = atomicio(vwrite, fileno(stdout),
15964a421b63SDag-Erling Smørgrav 		    buffer_ptr(&stdout_buffer), buffer_len(&stdout_buffer));
15974a421b63SDag-Erling Smørgrav 		if (len < 0 || (u_int)len != buffer_len(&stdout_buffer))
1598511b41d2SMark Murray 			error("Write failed flushing stdout buffer.");
15994a421b63SDag-Erling Smørgrav 		else
1600511b41d2SMark Murray 			buffer_consume(&stdout_buffer, len);
1601511b41d2SMark Murray 	}
1602511b41d2SMark Murray 
1603511b41d2SMark Murray 	/* Output any buffered data for stderr. */
16044a421b63SDag-Erling Smørgrav 	if (buffer_len(&stderr_buffer) > 0) {
16054a421b63SDag-Erling Smørgrav 		len = atomicio(vwrite, fileno(stderr),
16064a421b63SDag-Erling Smørgrav 		    buffer_ptr(&stderr_buffer), buffer_len(&stderr_buffer));
16074a421b63SDag-Erling Smørgrav 		if (len < 0 || (u_int)len != buffer_len(&stderr_buffer))
1608511b41d2SMark Murray 			error("Write failed flushing stderr buffer.");
16094a421b63SDag-Erling Smørgrav 		else
1610511b41d2SMark Murray 			buffer_consume(&stderr_buffer, len);
1611511b41d2SMark Murray 	}
1612511b41d2SMark Murray 
1613511b41d2SMark Murray 	/* Clear and free any buffers. */
1614511b41d2SMark Murray 	memset(buf, 0, sizeof(buf));
1615511b41d2SMark Murray 	buffer_free(&stdin_buffer);
1616511b41d2SMark Murray 	buffer_free(&stdout_buffer);
1617511b41d2SMark Murray 	buffer_free(&stderr_buffer);
1618511b41d2SMark Murray 
1619511b41d2SMark Murray 	/* Report bytes transferred, and transfer rates. */
1620511b41d2SMark Murray 	total_time = get_current_time() - start_time;
1621d4af9e69SDag-Erling Smørgrav 	packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
1622d4af9e69SDag-Erling Smørgrav 	packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
1623d4af9e69SDag-Erling Smørgrav 	verbose("Transferred: sent %llu, received %llu bytes, in %.1f seconds",
16244a421b63SDag-Erling Smørgrav 	    (unsigned long long)obytes, (unsigned long long)ibytes, total_time);
1625511b41d2SMark Murray 	if (total_time > 0)
1626d4af9e69SDag-Erling Smørgrav 		verbose("Bytes per second: sent %.1f, received %.1f",
1627d4af9e69SDag-Erling Smørgrav 		    obytes / total_time, ibytes / total_time);
1628511b41d2SMark Murray 	/* Return the exit status of the program. */
1629511b41d2SMark Murray 	debug("Exit status %d", exit_status);
1630511b41d2SMark Murray 	return exit_status;
1631511b41d2SMark Murray }
1632a04a10f8SKris Kennaway 
1633a04a10f8SKris Kennaway /*********/
1634a04a10f8SKris Kennaway 
1635ae1f160dSDag-Erling Smørgrav static void
1636ae1f160dSDag-Erling Smørgrav client_input_stdout_data(int type, u_int32_t seq, void *ctxt)
1637a04a10f8SKris Kennaway {
16381e8db6e2SBrian Feldman 	u_int data_len;
1639a04a10f8SKris Kennaway 	char *data = packet_get_string(&data_len);
1640ae1f160dSDag-Erling Smørgrav 	packet_check_eom();
1641a04a10f8SKris Kennaway 	buffer_append(&stdout_buffer, data, data_len);
1642a04a10f8SKris Kennaway 	memset(data, 0, data_len);
1643a04a10f8SKris Kennaway 	xfree(data);
1644a04a10f8SKris Kennaway }
1645ae1f160dSDag-Erling Smørgrav static void
1646ae1f160dSDag-Erling Smørgrav client_input_stderr_data(int type, u_int32_t seq, void *ctxt)
1647a04a10f8SKris Kennaway {
16481e8db6e2SBrian Feldman 	u_int data_len;
1649a04a10f8SKris Kennaway 	char *data = packet_get_string(&data_len);
1650ae1f160dSDag-Erling Smørgrav 	packet_check_eom();
1651a04a10f8SKris Kennaway 	buffer_append(&stderr_buffer, data, data_len);
1652a04a10f8SKris Kennaway 	memset(data, 0, data_len);
1653a04a10f8SKris Kennaway 	xfree(data);
1654a04a10f8SKris Kennaway }
1655ae1f160dSDag-Erling Smørgrav static void
1656ae1f160dSDag-Erling Smørgrav client_input_exit_status(int type, u_int32_t seq, void *ctxt)
1657a04a10f8SKris Kennaway {
1658a04a10f8SKris Kennaway 	exit_status = packet_get_int();
1659ae1f160dSDag-Erling Smørgrav 	packet_check_eom();
1660a04a10f8SKris Kennaway 	/* Acknowledge the exit. */
1661a04a10f8SKris Kennaway 	packet_start(SSH_CMSG_EXIT_CONFIRMATION);
1662a04a10f8SKris Kennaway 	packet_send();
1663a04a10f8SKris Kennaway 	/*
1664a04a10f8SKris Kennaway 	 * Must wait for packet to be sent since we are
1665a04a10f8SKris Kennaway 	 * exiting the loop.
1666a04a10f8SKris Kennaway 	 */
1667a04a10f8SKris Kennaway 	packet_write_wait();
1668a04a10f8SKris Kennaway 	/* Flag that we want to exit. */
1669a04a10f8SKris Kennaway 	quit_pending = 1;
1670a04a10f8SKris Kennaway }
1671efcad6b7SDag-Erling Smørgrav static void
1672efcad6b7SDag-Erling Smørgrav client_input_agent_open(int type, u_int32_t seq, void *ctxt)
1673efcad6b7SDag-Erling Smørgrav {
1674efcad6b7SDag-Erling Smørgrav 	Channel *c = NULL;
1675efcad6b7SDag-Erling Smørgrav 	int remote_id, sock;
1676efcad6b7SDag-Erling Smørgrav 
1677efcad6b7SDag-Erling Smørgrav 	/* Read the remote channel number from the message. */
1678efcad6b7SDag-Erling Smørgrav 	remote_id = packet_get_int();
1679efcad6b7SDag-Erling Smørgrav 	packet_check_eom();
1680efcad6b7SDag-Erling Smørgrav 
1681efcad6b7SDag-Erling Smørgrav 	/*
1682efcad6b7SDag-Erling Smørgrav 	 * Get a connection to the local authentication agent (this may again
1683efcad6b7SDag-Erling Smørgrav 	 * get forwarded).
1684efcad6b7SDag-Erling Smørgrav 	 */
1685efcad6b7SDag-Erling Smørgrav 	sock = ssh_get_authentication_socket();
1686efcad6b7SDag-Erling Smørgrav 
1687efcad6b7SDag-Erling Smørgrav 	/*
1688efcad6b7SDag-Erling Smørgrav 	 * If we could not connect the agent, send an error message back to
1689efcad6b7SDag-Erling Smørgrav 	 * the server. This should never happen unless the agent dies,
1690efcad6b7SDag-Erling Smørgrav 	 * because authentication forwarding is only enabled if we have an
1691efcad6b7SDag-Erling Smørgrav 	 * agent.
1692efcad6b7SDag-Erling Smørgrav 	 */
1693efcad6b7SDag-Erling Smørgrav 	if (sock >= 0) {
1694efcad6b7SDag-Erling Smørgrav 		c = channel_new("", SSH_CHANNEL_OPEN, sock, sock,
1695efcad6b7SDag-Erling Smørgrav 		    -1, 0, 0, 0, "authentication agent connection", 1);
1696efcad6b7SDag-Erling Smørgrav 		c->remote_id = remote_id;
1697efcad6b7SDag-Erling Smørgrav 		c->force_drain = 1;
1698efcad6b7SDag-Erling Smørgrav 	}
1699efcad6b7SDag-Erling Smørgrav 	if (c == NULL) {
1700efcad6b7SDag-Erling Smørgrav 		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
1701efcad6b7SDag-Erling Smørgrav 		packet_put_int(remote_id);
1702efcad6b7SDag-Erling Smørgrav 	} else {
1703efcad6b7SDag-Erling Smørgrav 		/* Send a confirmation to the remote host. */
1704efcad6b7SDag-Erling Smørgrav 		debug("Forwarding authentication connection.");
1705efcad6b7SDag-Erling Smørgrav 		packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
1706efcad6b7SDag-Erling Smørgrav 		packet_put_int(remote_id);
1707efcad6b7SDag-Erling Smørgrav 		packet_put_int(c->self);
1708efcad6b7SDag-Erling Smørgrav 	}
1709efcad6b7SDag-Erling Smørgrav 	packet_send();
1710efcad6b7SDag-Erling Smørgrav }
1711a04a10f8SKris Kennaway 
1712ae1f160dSDag-Erling Smørgrav static Channel *
17131e8db6e2SBrian Feldman client_request_forwarded_tcpip(const char *request_type, int rchan)
17141e8db6e2SBrian Feldman {
17151e8db6e2SBrian Feldman 	Channel *c = NULL;
17161e8db6e2SBrian Feldman 	char *listen_address, *originator_address;
1717cce7d346SDag-Erling Smørgrav 	u_short listen_port, originator_port;
17181e8db6e2SBrian Feldman 
17191e8db6e2SBrian Feldman 	/* Get rest of the packet */
17201e8db6e2SBrian Feldman 	listen_address = packet_get_string(NULL);
17211e8db6e2SBrian Feldman 	listen_port = packet_get_int();
17221e8db6e2SBrian Feldman 	originator_address = packet_get_string(NULL);
17231e8db6e2SBrian Feldman 	originator_port = packet_get_int();
1724ae1f160dSDag-Erling Smørgrav 	packet_check_eom();
17251e8db6e2SBrian Feldman 
1726d4af9e69SDag-Erling Smørgrav 	debug("client_request_forwarded_tcpip: listen %s port %d, "
1727d4af9e69SDag-Erling Smørgrav 	    "originator %s port %d", listen_address, listen_port,
1728d4af9e69SDag-Erling Smørgrav 	    originator_address, originator_port);
17291e8db6e2SBrian Feldman 
1730d4af9e69SDag-Erling Smørgrav 	c = channel_connect_by_listen_address(listen_port,
1731d4af9e69SDag-Erling Smørgrav 	    "forwarded-tcpip", originator_address);
1732d4af9e69SDag-Erling Smørgrav 
17331e8db6e2SBrian Feldman 	xfree(originator_address);
17341e8db6e2SBrian Feldman 	xfree(listen_address);
17351e8db6e2SBrian Feldman 	return c;
17361e8db6e2SBrian Feldman }
17371e8db6e2SBrian Feldman 
1738ae1f160dSDag-Erling Smørgrav static Channel *
17391e8db6e2SBrian Feldman client_request_x11(const char *request_type, int rchan)
17401e8db6e2SBrian Feldman {
17411e8db6e2SBrian Feldman 	Channel *c = NULL;
17421e8db6e2SBrian Feldman 	char *originator;
1743cce7d346SDag-Erling Smørgrav 	u_short originator_port;
1744ae1f160dSDag-Erling Smørgrav 	int sock;
17451e8db6e2SBrian Feldman 
17461e8db6e2SBrian Feldman 	if (!options.forward_x11) {
17471e8db6e2SBrian Feldman 		error("Warning: ssh server tried X11 forwarding.");
1748d4af9e69SDag-Erling Smørgrav 		error("Warning: this is probably a break-in attempt by a "
1749d4af9e69SDag-Erling Smørgrav 		    "malicious server.");
17501e8db6e2SBrian Feldman 		return NULL;
17511e8db6e2SBrian Feldman 	}
1752e2f6069cSDag-Erling Smørgrav 	if (x11_refuse_time != 0 && time(NULL) >= x11_refuse_time) {
1753e2f6069cSDag-Erling Smørgrav 		verbose("Rejected X11 connection after ForwardX11Timeout "
1754e2f6069cSDag-Erling Smørgrav 		    "expired");
1755e2f6069cSDag-Erling Smørgrav 		return NULL;
1756e2f6069cSDag-Erling Smørgrav 	}
17571e8db6e2SBrian Feldman 	originator = packet_get_string(NULL);
17581e8db6e2SBrian Feldman 	if (datafellows & SSH_BUG_X11FWD) {
17591e8db6e2SBrian Feldman 		debug2("buggy server: x11 request w/o originator_port");
17601e8db6e2SBrian Feldman 		originator_port = 0;
17611e8db6e2SBrian Feldman 	} else {
17621e8db6e2SBrian Feldman 		originator_port = packet_get_int();
17631e8db6e2SBrian Feldman 	}
1764ae1f160dSDag-Erling Smørgrav 	packet_check_eom();
17651e8db6e2SBrian Feldman 	/* XXX check permission */
17661e8db6e2SBrian Feldman 	debug("client_request_x11: request from %s %d", originator,
17671e8db6e2SBrian Feldman 	    originator_port);
1768ae1f160dSDag-Erling Smørgrav 	xfree(originator);
17691e8db6e2SBrian Feldman 	sock = x11_connect_display();
1770ae1f160dSDag-Erling Smørgrav 	if (sock < 0)
1771ae1f160dSDag-Erling Smørgrav 		return NULL;
1772*89986192SBrooks Davis 	if (options.hpn_disabled)
1773*89986192SBrooks Davis 		c = channel_new("x11", SSH_CHANNEL_X11_OPEN, sock, sock, -1,
1774*89986192SBrooks Davis 		    CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
1775*89986192SBrooks Davis 		    0, "x11", 1);
1776*89986192SBrooks Davis 	else
1777*89986192SBrooks Davis 		c = channel_new("x11", SSH_CHANNEL_X11_OPEN, sock, sock, -1,
1778*89986192SBrooks Davis 		    options.hpn_buffer_size, CHAN_X11_PACKET_DEFAULT,
1779*89986192SBrooks Davis 		    0, "x11", 1);
1780ae1f160dSDag-Erling Smørgrav 	c->force_drain = 1;
17811e8db6e2SBrian Feldman 	return c;
17821e8db6e2SBrian Feldman }
17831e8db6e2SBrian Feldman 
1784ae1f160dSDag-Erling Smørgrav static Channel *
17851e8db6e2SBrian Feldman client_request_agent(const char *request_type, int rchan)
17861e8db6e2SBrian Feldman {
17871e8db6e2SBrian Feldman 	Channel *c = NULL;
1788ae1f160dSDag-Erling Smørgrav 	int sock;
17891e8db6e2SBrian Feldman 
17901e8db6e2SBrian Feldman 	if (!options.forward_agent) {
17911e8db6e2SBrian Feldman 		error("Warning: ssh server tried agent forwarding.");
1792d4af9e69SDag-Erling Smørgrav 		error("Warning: this is probably a break-in attempt by a "
1793d4af9e69SDag-Erling Smørgrav 		    "malicious server.");
17941e8db6e2SBrian Feldman 		return NULL;
17951e8db6e2SBrian Feldman 	}
17961e8db6e2SBrian Feldman 	sock = ssh_get_authentication_socket();
1797ae1f160dSDag-Erling Smørgrav 	if (sock < 0)
1798ae1f160dSDag-Erling Smørgrav 		return NULL;
1799*89986192SBrooks Davis 	if (options.hpn_disabled)
1800ae1f160dSDag-Erling Smørgrav 		c = channel_new("authentication agent connection",
18011e8db6e2SBrian Feldman 		    SSH_CHANNEL_OPEN, sock, sock, -1,
1802*89986192SBrooks Davis 		    CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_WINDOW_DEFAULT, 0,
1803*89986192SBrooks Davis 		    "authentication agent connection", 1);
1804*89986192SBrooks Davis 	else
1805*89986192SBrooks Davis 		c = channel_new("authentication agent connection",
1806*89986192SBrooks Davis 		    SSH_CHANNEL_OPEN, sock, sock, -1,
1807*89986192SBrooks Davis 		    options.hpn_buffer_size, options.hpn_buffer_size, 0,
1808d95e11bfSDag-Erling Smørgrav 		    "authentication agent connection", 1);
1809ae1f160dSDag-Erling Smørgrav 	c->force_drain = 1;
18101e8db6e2SBrian Feldman 	return c;
18111e8db6e2SBrian Feldman }
18121e8db6e2SBrian Feldman 
1813d4af9e69SDag-Erling Smørgrav int
1814d4af9e69SDag-Erling Smørgrav client_request_tun_fwd(int tun_mode, int local_tun, int remote_tun)
1815d4af9e69SDag-Erling Smørgrav {
1816d4af9e69SDag-Erling Smørgrav 	Channel *c;
1817d4af9e69SDag-Erling Smørgrav 	int fd;
1818d4af9e69SDag-Erling Smørgrav 
1819d4af9e69SDag-Erling Smørgrav 	if (tun_mode == SSH_TUNMODE_NO)
1820d4af9e69SDag-Erling Smørgrav 		return 0;
1821d4af9e69SDag-Erling Smørgrav 
1822d4af9e69SDag-Erling Smørgrav 	if (!compat20) {
1823cce7d346SDag-Erling Smørgrav 		error("Tunnel forwarding is not supported for protocol 1");
1824d4af9e69SDag-Erling Smørgrav 		return -1;
1825d4af9e69SDag-Erling Smørgrav 	}
1826d4af9e69SDag-Erling Smørgrav 
1827d4af9e69SDag-Erling Smørgrav 	debug("Requesting tun unit %d in mode %d", local_tun, tun_mode);
1828d4af9e69SDag-Erling Smørgrav 
1829d4af9e69SDag-Erling Smørgrav 	/* Open local tunnel device */
1830d4af9e69SDag-Erling Smørgrav 	if ((fd = tun_open(local_tun, tun_mode)) == -1) {
1831d4af9e69SDag-Erling Smørgrav 		error("Tunnel device open failed.");
1832d4af9e69SDag-Erling Smørgrav 		return -1;
1833d4af9e69SDag-Erling Smørgrav 	}
1834d4af9e69SDag-Erling Smørgrav 
1835*89986192SBrooks Davis 	if (options.hpn_disabled)
1836d4af9e69SDag-Erling Smørgrav 		c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
1837*89986192SBrooks Davis 		    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
1838*89986192SBrooks Davis 		    0, "tun", 1);
1839*89986192SBrooks Davis 	else
1840*89986192SBrooks Davis 		c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
1841*89986192SBrooks Davis 		    options.hpn_buffer_size, CHAN_TCP_PACKET_DEFAULT,
1842*89986192SBrooks Davis 		    0, "tun", 1);
1843d4af9e69SDag-Erling Smørgrav 	c->datagram = 1;
1844d4af9e69SDag-Erling Smørgrav 
1845d4af9e69SDag-Erling Smørgrav #if defined(SSH_TUN_FILTER)
1846d4af9e69SDag-Erling Smørgrav 	if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
1847d4af9e69SDag-Erling Smørgrav 		channel_register_filter(c->self, sys_tun_infilter,
1848d4af9e69SDag-Erling Smørgrav 		    sys_tun_outfilter, NULL, NULL);
1849d4af9e69SDag-Erling Smørgrav #endif
1850d4af9e69SDag-Erling Smørgrav 
1851d4af9e69SDag-Erling Smørgrav 	packet_start(SSH2_MSG_CHANNEL_OPEN);
1852d4af9e69SDag-Erling Smørgrav 	packet_put_cstring("tun@openssh.com");
1853d4af9e69SDag-Erling Smørgrav 	packet_put_int(c->self);
1854d4af9e69SDag-Erling Smørgrav 	packet_put_int(c->local_window_max);
1855d4af9e69SDag-Erling Smørgrav 	packet_put_int(c->local_maxpacket);
1856d4af9e69SDag-Erling Smørgrav 	packet_put_int(tun_mode);
1857d4af9e69SDag-Erling Smørgrav 	packet_put_int(remote_tun);
1858d4af9e69SDag-Erling Smørgrav 	packet_send();
1859d4af9e69SDag-Erling Smørgrav 
1860d4af9e69SDag-Erling Smørgrav 	return 0;
1861d4af9e69SDag-Erling Smørgrav }
1862d4af9e69SDag-Erling Smørgrav 
1863a04a10f8SKris Kennaway /* XXXX move to generic input handler */
1864ae1f160dSDag-Erling Smørgrav static void
1865ae1f160dSDag-Erling Smørgrav client_input_channel_open(int type, u_int32_t seq, void *ctxt)
1866a04a10f8SKris Kennaway {
1867a04a10f8SKris Kennaway 	Channel *c = NULL;
1868a04a10f8SKris Kennaway 	char *ctype;
1869a04a10f8SKris Kennaway 	int rchan;
1870ee21a45fSDag-Erling Smørgrav 	u_int rmaxpack, rwindow, len;
1871a04a10f8SKris Kennaway 
1872a04a10f8SKris Kennaway 	ctype = packet_get_string(&len);
1873a04a10f8SKris Kennaway 	rchan = packet_get_int();
1874a04a10f8SKris Kennaway 	rwindow = packet_get_int();
1875a04a10f8SKris Kennaway 	rmaxpack = packet_get_int();
1876a04a10f8SKris Kennaway 
1877a04a10f8SKris Kennaway 	debug("client_input_channel_open: ctype %s rchan %d win %d max %d",
1878a04a10f8SKris Kennaway 	    ctype, rchan, rwindow, rmaxpack);
1879a04a10f8SKris Kennaway 
18801e8db6e2SBrian Feldman 	if (strcmp(ctype, "forwarded-tcpip") == 0) {
18811e8db6e2SBrian Feldman 		c = client_request_forwarded_tcpip(ctype, rchan);
18821e8db6e2SBrian Feldman 	} else if (strcmp(ctype, "x11") == 0) {
18831e8db6e2SBrian Feldman 		c = client_request_x11(ctype, rchan);
18841e8db6e2SBrian Feldman 	} else if (strcmp(ctype, "auth-agent@openssh.com") == 0) {
18851e8db6e2SBrian Feldman 		c = client_request_agent(ctype, rchan);
1886a04a10f8SKris Kennaway 	}
1887a04a10f8SKris Kennaway /* XXX duplicate : */
1888a04a10f8SKris Kennaway 	if (c != NULL) {
1889a04a10f8SKris Kennaway 		debug("confirm %s", ctype);
1890a04a10f8SKris Kennaway 		c->remote_id = rchan;
1891a04a10f8SKris Kennaway 		c->remote_window = rwindow;
1892a04a10f8SKris Kennaway 		c->remote_maxpacket = rmaxpack;
1893ae1f160dSDag-Erling Smørgrav 		if (c->type != SSH_CHANNEL_CONNECTING) {
1894a04a10f8SKris Kennaway 			packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
1895a04a10f8SKris Kennaway 			packet_put_int(c->remote_id);
1896a04a10f8SKris Kennaway 			packet_put_int(c->self);
1897a04a10f8SKris Kennaway 			packet_put_int(c->local_window);
1898a04a10f8SKris Kennaway 			packet_put_int(c->local_maxpacket);
1899a04a10f8SKris Kennaway 			packet_send();
1900ae1f160dSDag-Erling Smørgrav 		}
1901a04a10f8SKris Kennaway 	} else {
1902a04a10f8SKris Kennaway 		debug("failure %s", ctype);
1903a04a10f8SKris Kennaway 		packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE);
1904a04a10f8SKris Kennaway 		packet_put_int(rchan);
1905a04a10f8SKris Kennaway 		packet_put_int(SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED);
1906ae1f160dSDag-Erling Smørgrav 		if (!(datafellows & SSH_BUG_OPENFAILURE)) {
1907ae1f160dSDag-Erling Smørgrav 			packet_put_cstring("open failed");
1908a04a10f8SKris Kennaway 			packet_put_cstring("");
1909ae1f160dSDag-Erling Smørgrav 		}
1910a04a10f8SKris Kennaway 		packet_send();
1911a04a10f8SKris Kennaway 	}
1912a04a10f8SKris Kennaway 	xfree(ctype);
1913a04a10f8SKris Kennaway }
1914ae1f160dSDag-Erling Smørgrav static void
1915ae1f160dSDag-Erling Smørgrav client_input_channel_req(int type, u_int32_t seq, void *ctxt)
19161e8db6e2SBrian Feldman {
19171e8db6e2SBrian Feldman 	Channel *c = NULL;
1918d74d50a8SDag-Erling Smørgrav 	int exitval, id, reply, success = 0;
19191e8db6e2SBrian Feldman 	char *rtype;
19201e8db6e2SBrian Feldman 
19211e8db6e2SBrian Feldman 	id = packet_get_int();
19221e8db6e2SBrian Feldman 	rtype = packet_get_string(NULL);
19231e8db6e2SBrian Feldman 	reply = packet_get_char();
19241e8db6e2SBrian Feldman 
19251e8db6e2SBrian Feldman 	debug("client_input_channel_req: channel %d rtype %s reply %d",
19261e8db6e2SBrian Feldman 	    id, rtype, reply);
19271e8db6e2SBrian Feldman 
1928d74d50a8SDag-Erling Smørgrav 	if (id == -1) {
1929d74d50a8SDag-Erling Smørgrav 		error("client_input_channel_req: request for channel -1");
1930d74d50a8SDag-Erling Smørgrav 	} else if ((c = channel_lookup(id)) == NULL) {
1931d4af9e69SDag-Erling Smørgrav 		error("client_input_channel_req: channel %d: "
1932d4af9e69SDag-Erling Smørgrav 		    "unknown channel", id);
1933d4af9e69SDag-Erling Smørgrav 	} else if (strcmp(rtype, "eow@openssh.com") == 0) {
1934d4af9e69SDag-Erling Smørgrav 		packet_check_eom();
1935d4af9e69SDag-Erling Smørgrav 		chan_rcvd_eow(c);
19361e8db6e2SBrian Feldman 	} else if (strcmp(rtype, "exit-status") == 0) {
1937d74d50a8SDag-Erling Smørgrav 		exitval = packet_get_int();
1938b15c8340SDag-Erling Smørgrav 		if (c->ctl_chan != -1) {
1939b15c8340SDag-Erling Smørgrav 			mux_exit_message(c, exitval);
1940b15c8340SDag-Erling Smørgrav 			success = 1;
1941b15c8340SDag-Erling Smørgrav 		} else if (id == session_ident) {
1942b15c8340SDag-Erling Smørgrav 			/* Record exit value of local session */
19431e8db6e2SBrian Feldman 			success = 1;
1944d74d50a8SDag-Erling Smørgrav 			exit_status = exitval;
1945d74d50a8SDag-Erling Smørgrav 		} else {
1946b15c8340SDag-Erling Smørgrav 			/* Probably for a mux channel that has already closed */
1947b15c8340SDag-Erling Smørgrav 			debug("%s: no sink for exit-status on channel %d",
1948b15c8340SDag-Erling Smørgrav 			    __func__, id);
1949d74d50a8SDag-Erling Smørgrav 		}
1950ae1f160dSDag-Erling Smørgrav 		packet_check_eom();
19511e8db6e2SBrian Feldman 	}
19524a421b63SDag-Erling Smørgrav 	if (reply && c != NULL) {
19531e8db6e2SBrian Feldman 		packet_start(success ?
19541e8db6e2SBrian Feldman 		    SSH2_MSG_CHANNEL_SUCCESS : SSH2_MSG_CHANNEL_FAILURE);
1955cce7d346SDag-Erling Smørgrav 		packet_put_int(c->remote_id);
19561e8db6e2SBrian Feldman 		packet_send();
19571e8db6e2SBrian Feldman 	}
19581e8db6e2SBrian Feldman 	xfree(rtype);
19591e8db6e2SBrian Feldman }
1960ae1f160dSDag-Erling Smørgrav static void
1961ae1f160dSDag-Erling Smørgrav client_input_global_request(int type, u_int32_t seq, void *ctxt)
1962ae1f160dSDag-Erling Smørgrav {
1963ae1f160dSDag-Erling Smørgrav 	char *rtype;
1964ae1f160dSDag-Erling Smørgrav 	int want_reply;
1965ae1f160dSDag-Erling Smørgrav 	int success = 0;
1966a04a10f8SKris Kennaway 
1967ae1f160dSDag-Erling Smørgrav 	rtype = packet_get_string(NULL);
1968ae1f160dSDag-Erling Smørgrav 	want_reply = packet_get_char();
1969efcad6b7SDag-Erling Smørgrav 	debug("client_input_global_request: rtype %s want_reply %d",
1970efcad6b7SDag-Erling Smørgrav 	    rtype, want_reply);
1971ae1f160dSDag-Erling Smørgrav 	if (want_reply) {
1972ae1f160dSDag-Erling Smørgrav 		packet_start(success ?
1973ae1f160dSDag-Erling Smørgrav 		    SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
1974ae1f160dSDag-Erling Smørgrav 		packet_send();
1975ae1f160dSDag-Erling Smørgrav 		packet_write_wait();
1976ae1f160dSDag-Erling Smørgrav 	}
1977ae1f160dSDag-Erling Smørgrav 	xfree(rtype);
1978ae1f160dSDag-Erling Smørgrav }
1979ae1f160dSDag-Erling Smørgrav 
1980d74d50a8SDag-Erling Smørgrav void
1981d74d50a8SDag-Erling Smørgrav client_session2_setup(int id, int want_tty, int want_subsystem,
1982d4af9e69SDag-Erling Smørgrav     const char *term, struct termios *tiop, int in_fd, Buffer *cmd, char **env)
1983d74d50a8SDag-Erling Smørgrav {
1984d74d50a8SDag-Erling Smørgrav 	int len;
19855e8dbd04SDag-Erling Smørgrav 	Channel *c = NULL;
1986d74d50a8SDag-Erling Smørgrav 
1987d74d50a8SDag-Erling Smørgrav 	debug2("%s: id %d", __func__, id);
1988d74d50a8SDag-Erling Smørgrav 
19895e8dbd04SDag-Erling Smørgrav 	if ((c = channel_lookup(id)) == NULL)
19905e8dbd04SDag-Erling Smørgrav 		fatal("client_session2_setup: channel %d: unknown channel", id);
19915e8dbd04SDag-Erling Smørgrav 
19924a421b63SDag-Erling Smørgrav 	packet_set_interactive(want_tty,
19934a421b63SDag-Erling Smørgrav 	    options.ip_qos_interactive, options.ip_qos_bulk);
19944a421b63SDag-Erling Smørgrav 
1995d74d50a8SDag-Erling Smørgrav 	if (want_tty) {
1996d74d50a8SDag-Erling Smørgrav 		struct winsize ws;
1997d74d50a8SDag-Erling Smørgrav 
1998d74d50a8SDag-Erling Smørgrav 		/* Store window size in the packet. */
1999d74d50a8SDag-Erling Smørgrav 		if (ioctl(in_fd, TIOCGWINSZ, &ws) < 0)
2000d74d50a8SDag-Erling Smørgrav 			memset(&ws, 0, sizeof(ws));
2001d74d50a8SDag-Erling Smørgrav 
2002d4af9e69SDag-Erling Smørgrav 		channel_request_start(id, "pty-req", 1);
2003e2f6069cSDag-Erling Smørgrav 		client_expect_confirm(id, "PTY allocation", 1);
2004d74d50a8SDag-Erling Smørgrav 		packet_put_cstring(term != NULL ? term : "");
2005761efaa7SDag-Erling Smørgrav 		packet_put_int((u_int)ws.ws_col);
2006761efaa7SDag-Erling Smørgrav 		packet_put_int((u_int)ws.ws_row);
2007761efaa7SDag-Erling Smørgrav 		packet_put_int((u_int)ws.ws_xpixel);
2008761efaa7SDag-Erling Smørgrav 		packet_put_int((u_int)ws.ws_ypixel);
2009d4af9e69SDag-Erling Smørgrav 		if (tiop == NULL)
2010d4af9e69SDag-Erling Smørgrav 			tiop = get_saved_tio();
2011d4af9e69SDag-Erling Smørgrav 		tty_make_modes(-1, tiop);
2012d74d50a8SDag-Erling Smørgrav 		packet_send();
2013d74d50a8SDag-Erling Smørgrav 		/* XXX wait for reply */
20145e8dbd04SDag-Erling Smørgrav 		c->client_tty = 1;
2015d74d50a8SDag-Erling Smørgrav 	}
2016d74d50a8SDag-Erling Smørgrav 
2017d74d50a8SDag-Erling Smørgrav 	/* Transfer any environment variables from client to server */
2018d74d50a8SDag-Erling Smørgrav 	if (options.num_send_env != 0 && env != NULL) {
2019d74d50a8SDag-Erling Smørgrav 		int i, j, matched;
2020d74d50a8SDag-Erling Smørgrav 		char *name, *val;
2021d74d50a8SDag-Erling Smørgrav 
2022d74d50a8SDag-Erling Smørgrav 		debug("Sending environment.");
2023d74d50a8SDag-Erling Smørgrav 		for (i = 0; env[i] != NULL; i++) {
2024d74d50a8SDag-Erling Smørgrav 			/* Split */
2025d74d50a8SDag-Erling Smørgrav 			name = xstrdup(env[i]);
2026d74d50a8SDag-Erling Smørgrav 			if ((val = strchr(name, '=')) == NULL) {
2027021d409fSDag-Erling Smørgrav 				xfree(name);
2028d74d50a8SDag-Erling Smørgrav 				continue;
2029d74d50a8SDag-Erling Smørgrav 			}
2030d74d50a8SDag-Erling Smørgrav 			*val++ = '\0';
2031d74d50a8SDag-Erling Smørgrav 
2032d74d50a8SDag-Erling Smørgrav 			matched = 0;
2033d74d50a8SDag-Erling Smørgrav 			for (j = 0; j < options.num_send_env; j++) {
2034d74d50a8SDag-Erling Smørgrav 				if (match_pattern(name, options.send_env[j])) {
2035d74d50a8SDag-Erling Smørgrav 					matched = 1;
2036d74d50a8SDag-Erling Smørgrav 					break;
2037d74d50a8SDag-Erling Smørgrav 				}
2038d74d50a8SDag-Erling Smørgrav 			}
2039d74d50a8SDag-Erling Smørgrav 			if (!matched) {
2040d74d50a8SDag-Erling Smørgrav 				debug3("Ignored env %s", name);
2041021d409fSDag-Erling Smørgrav 				xfree(name);
2042d74d50a8SDag-Erling Smørgrav 				continue;
2043d74d50a8SDag-Erling Smørgrav 			}
2044d74d50a8SDag-Erling Smørgrav 
2045d74d50a8SDag-Erling Smørgrav 			debug("Sending env %s = %s", name, val);
2046d74d50a8SDag-Erling Smørgrav 			channel_request_start(id, "env", 0);
2047d74d50a8SDag-Erling Smørgrav 			packet_put_cstring(name);
2048d74d50a8SDag-Erling Smørgrav 			packet_put_cstring(val);
2049d74d50a8SDag-Erling Smørgrav 			packet_send();
2050021d409fSDag-Erling Smørgrav 			xfree(name);
2051d74d50a8SDag-Erling Smørgrav 		}
2052d74d50a8SDag-Erling Smørgrav 	}
2053d74d50a8SDag-Erling Smørgrav 
2054d74d50a8SDag-Erling Smørgrav 	len = buffer_len(cmd);
2055d74d50a8SDag-Erling Smørgrav 	if (len > 0) {
2056d74d50a8SDag-Erling Smørgrav 		if (len > 900)
2057d74d50a8SDag-Erling Smørgrav 			len = 900;
2058d74d50a8SDag-Erling Smørgrav 		if (want_subsystem) {
2059d4af9e69SDag-Erling Smørgrav 			debug("Sending subsystem: %.*s",
2060d4af9e69SDag-Erling Smørgrav 			    len, (u_char*)buffer_ptr(cmd));
2061d4af9e69SDag-Erling Smørgrav 			channel_request_start(id, "subsystem", 1);
2062d4af9e69SDag-Erling Smørgrav 			client_expect_confirm(id, "subsystem", 1);
2063d74d50a8SDag-Erling Smørgrav 		} else {
2064d4af9e69SDag-Erling Smørgrav 			debug("Sending command: %.*s",
2065d4af9e69SDag-Erling Smørgrav 			    len, (u_char*)buffer_ptr(cmd));
2066d4af9e69SDag-Erling Smørgrav 			channel_request_start(id, "exec", 1);
2067d4af9e69SDag-Erling Smørgrav 			client_expect_confirm(id, "exec", 1);
2068d74d50a8SDag-Erling Smørgrav 		}
2069d74d50a8SDag-Erling Smørgrav 		packet_put_string(buffer_ptr(cmd), buffer_len(cmd));
2070d74d50a8SDag-Erling Smørgrav 		packet_send();
2071d74d50a8SDag-Erling Smørgrav 	} else {
2072d4af9e69SDag-Erling Smørgrav 		channel_request_start(id, "shell", 1);
2073d4af9e69SDag-Erling Smørgrav 		client_expect_confirm(id, "shell", 1);
2074d74d50a8SDag-Erling Smørgrav 		packet_send();
2075d74d50a8SDag-Erling Smørgrav 	}
2076d74d50a8SDag-Erling Smørgrav }
2077d74d50a8SDag-Erling Smørgrav 
2078ae1f160dSDag-Erling Smørgrav static void
20791e8db6e2SBrian Feldman client_init_dispatch_20(void)
2080a04a10f8SKris Kennaway {
2081a04a10f8SKris Kennaway 	dispatch_init(&dispatch_protocol_error);
2082545d5ecaSDag-Erling Smørgrav 
2083a04a10f8SKris Kennaway 	dispatch_set(SSH2_MSG_CHANNEL_CLOSE, &channel_input_oclose);
2084a04a10f8SKris Kennaway 	dispatch_set(SSH2_MSG_CHANNEL_DATA, &channel_input_data);
2085a04a10f8SKris Kennaway 	dispatch_set(SSH2_MSG_CHANNEL_EOF, &channel_input_ieof);
2086a04a10f8SKris Kennaway 	dispatch_set(SSH2_MSG_CHANNEL_EXTENDED_DATA, &channel_input_extended_data);
2087a04a10f8SKris Kennaway 	dispatch_set(SSH2_MSG_CHANNEL_OPEN, &client_input_channel_open);
2088a04a10f8SKris Kennaway 	dispatch_set(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
2089a04a10f8SKris Kennaway 	dispatch_set(SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
20901e8db6e2SBrian Feldman 	dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &client_input_channel_req);
2091a04a10f8SKris Kennaway 	dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust);
2092d4af9e69SDag-Erling Smørgrav 	dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &channel_input_status_confirm);
2093d4af9e69SDag-Erling Smørgrav 	dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &channel_input_status_confirm);
2094ae1f160dSDag-Erling Smørgrav 	dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &client_input_global_request);
20951e8db6e2SBrian Feldman 
20961e8db6e2SBrian Feldman 	/* rekeying */
20971e8db6e2SBrian Feldman 	dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
2098545d5ecaSDag-Erling Smørgrav 
2099545d5ecaSDag-Erling Smørgrav 	/* global request reply messages */
2100545d5ecaSDag-Erling Smørgrav 	dispatch_set(SSH2_MSG_REQUEST_FAILURE, &client_global_request_reply);
2101545d5ecaSDag-Erling Smørgrav 	dispatch_set(SSH2_MSG_REQUEST_SUCCESS, &client_global_request_reply);
2102a04a10f8SKris Kennaway }
2103d4af9e69SDag-Erling Smørgrav 
2104ae1f160dSDag-Erling Smørgrav static void
21051e8db6e2SBrian Feldman client_init_dispatch_13(void)
2106a04a10f8SKris Kennaway {
2107a04a10f8SKris Kennaway 	dispatch_init(NULL);
2108a04a10f8SKris Kennaway 	dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_close);
2109a04a10f8SKris Kennaway 	dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, &channel_input_close_confirmation);
2110a04a10f8SKris Kennaway 	dispatch_set(SSH_MSG_CHANNEL_DATA, &channel_input_data);
2111a04a10f8SKris Kennaway 	dispatch_set(SSH_MSG_CHANNEL_OPEN_CONFIRMATION, &channel_input_open_confirmation);
2112a04a10f8SKris Kennaway 	dispatch_set(SSH_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
2113a04a10f8SKris Kennaway 	dispatch_set(SSH_MSG_PORT_OPEN, &channel_input_port_open);
2114a04a10f8SKris Kennaway 	dispatch_set(SSH_SMSG_EXITSTATUS, &client_input_exit_status);
2115a04a10f8SKris Kennaway 	dispatch_set(SSH_SMSG_STDERR_DATA, &client_input_stderr_data);
2116a04a10f8SKris Kennaway 	dispatch_set(SSH_SMSG_STDOUT_DATA, &client_input_stdout_data);
21174899dde7SBrian Feldman 
21184899dde7SBrian Feldman 	dispatch_set(SSH_SMSG_AGENT_OPEN, options.forward_agent ?
2119efcad6b7SDag-Erling Smørgrav 	    &client_input_agent_open : &deny_input_open);
21204899dde7SBrian Feldman 	dispatch_set(SSH_SMSG_X11_OPEN, options.forward_x11 ?
21215b9b2fafSBrian Feldman 	    &x11_input_open : &deny_input_open);
2122a04a10f8SKris Kennaway }
2123d4af9e69SDag-Erling Smørgrav 
2124ae1f160dSDag-Erling Smørgrav static void
21251e8db6e2SBrian Feldman client_init_dispatch_15(void)
2126a04a10f8SKris Kennaway {
2127a04a10f8SKris Kennaway 	client_init_dispatch_13();
2128a04a10f8SKris Kennaway 	dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_ieof);
2129a04a10f8SKris Kennaway 	dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, & channel_input_oclose);
2130a04a10f8SKris Kennaway }
2131d4af9e69SDag-Erling Smørgrav 
2132ae1f160dSDag-Erling Smørgrav static void
21331e8db6e2SBrian Feldman client_init_dispatch(void)
2134a04a10f8SKris Kennaway {
2135a04a10f8SKris Kennaway 	if (compat20)
2136a04a10f8SKris Kennaway 		client_init_dispatch_20();
2137a04a10f8SKris Kennaway 	else if (compat13)
2138a04a10f8SKris Kennaway 		client_init_dispatch_13();
2139a04a10f8SKris Kennaway 	else
2140a04a10f8SKris Kennaway 		client_init_dispatch_15();
2141a04a10f8SKris Kennaway }
2142efcad6b7SDag-Erling Smørgrav 
2143efcad6b7SDag-Erling Smørgrav /* client specific fatal cleanup */
2144efcad6b7SDag-Erling Smørgrav void
2145efcad6b7SDag-Erling Smørgrav cleanup_exit(int i)
2146efcad6b7SDag-Erling Smørgrav {
2147b15c8340SDag-Erling Smørgrav 	leave_raw_mode(force_tty_flag);
2148efcad6b7SDag-Erling Smørgrav 	leave_non_blocking();
2149d4af9e69SDag-Erling Smørgrav 	if (options.control_path != NULL && muxserver_sock != -1)
2150d74d50a8SDag-Erling Smørgrav 		unlink(options.control_path);
21514a421b63SDag-Erling Smørgrav 	ssh_kill_proxy_command();
2152efcad6b7SDag-Erling Smørgrav 	_exit(i);
2153efcad6b7SDag-Erling Smørgrav }
2154